@zq-silk/yui 1.1.2 → 2.1.0

package/docs/cli-information-contract.zh-CN.md

@@ -0,0 +1,81 @@
+# CLI 信息契约
+
+Yui 将命令的效果、发现和完整证据读取分开。查询不会消费 Message，也不启动后续工作。
+变更回执说明 saved/requested/accepted/unknown 等真实事实；`ok: true` 只说明这次
+CLI 调用成功，不代表 Task、原生 Turn 或远端投递完成。
+
+这是当前通信契约，不是兼容模式。已保存的 Task、Message、结果、Snapshot 和 Session
+历史保持不变；没有持久 schema 迁移，也没有新增快照或缓存存储。
+
+## 日常读取路径
+
+| 问题 | 入口 | 默认信息与下一步 |
+| --- | --- | --- |
+| 找哪个 Task？ | `task list` | 既有有界目录、过滤器、attention 与游标 |
+| 当前有什么？ | `task context <task>` | 当前 Task/Brief/Role/Project/工作区事实、活跃工作与 Run、开放输入、有效决策、未解决 Job、近期 Message 引用；不倾倒事件或终态 Run |
+| 有哪些记录？ | `task context list <task> --store <family>` | 一种获授权的记录、摘要与带 digest 的确切引用 |
+| 原文是什么？ | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | 确切当前记录，含原始结果展开；长文档分页 |
+| 发生了什么变化？ | `task context delta <task> --after <cursor>` | 固定上界内的不可变事件，不是可变当前状态的快照 |
+| Global 收到了什么？ | `session context <role>` | 身份、Profile、权限、当前原生 Turn/retry，以及分别有界的 pending/recent Message 页 |
+| 读取 Global 输入 | `role message list <role> [--pending]`、`role message show <role> <id>` | 在自身范围内发现，再读完整原文；队列接受不删除历史 |
+| 本次唤醒带来什么？ | `task wake show <task> <wake>` | 固定窗口与 Message/Run/Event 读取指针，不重复正文 |
+| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与一份带摘要的 `pointers` 目录；`deltaRefs` 表示变化身份；当前观察独立 |
+| 实际配置是什么？ | `task role session inspect <task> <role>` | Task/Role 身份、期望绑定、冻结 Session、当前 Provider 绑定、retry 与显式 Host 观察；不复制整个 Task/Role 或 Provider 会话历史 |
+
+Task Message、事件、WorkItem、Run、决策、里程碑、publication 和 InputRequest 列表
+共用摘要/引用分页。Role 状态与 wake 历史列表也分页，并给出详情命令。
+Role 发现返回 `recordedHealth` 与 `hostObservation: "not-requested"`，不是实时 Host
+健康度。记录状态正常也不能排除 Host 失败或终态未确认；需沿条目的 `task role status`
+读取指针检查。
+Context 列表还暴露候选、Review、Job、Project Knowledge、工作区等获授权的记录。
+`--status`、`--after`、`--work-item` 缩小发现范围；续读必须保留过滤条件。
+Run 列表接受 Task 或 `task/work` 目标。
+
+当前 Context 的 `attention.messages` 统计全部获授权 Message，不仅是未投递输入。
+`collections` 计数与 `omitted` 明确表达发现不完整。近期抽样不能证明没有更早的待处理
+或相关输入。读取相关固定 wake 与原始 Message；更广的需求/历史审计使用分类发现。
+
+## 预算与续读
+
+- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB。条目包含摘要，不含完整报告正文。
+- 当前 Task Context 至多 64 条，记录与 attention 共 24 KiB，响应预算 32 KiB。
+  单个内联值至多 2 KiB；大值及 Message/Run/WorkItem/Knowledge 正文用引用。
+  入口每个集合最多抽样八条。
+- Global 入口分别抽样八条 pending 与八条 recent；独立续读，历史不能挤掉待处理输入。
+- 不超过 16 KiB 的详情保持普通 JSON。更大详情返回 `contentPage`：确切来源、
+  SHA-256 digest、JSON 字符偏移、总字节数/字符数、文本、完整性与下一游标。
+  每块最多 4096 个 UTF-16 单元，不拆代理对，转义后的输出低于 32 KiB。
+  不再因 4 MiB 上限而永久无法读取合法原文。
+- Task 元信息/next-action/remote-delivery、Brief、WorkItem、Message、Run、
+  决策/里程碑/事件、Role show/status/Session 检查、wake 详情、InputRequest、
+  Run Context 与冻结展开使用有界详情读取。
+
+使用 `--json` 读取顶层 `data`；Run Context 和展开使用 `data.context`，Run Context delta 使用 `data.contextDelta`。
+长详情用同一读取命令加 `--cursor <contentPage.nextCursor>` 继续。按 offset 顺序拼接
+`text`，校验相同 source 与 digest，最后一次性解析 JSON。不要分别解析块，也不要把
+第一块当成完整报告。
+
+列表包含 `items`、`total`、`complete`、`nextCursor`。计数、条目和游标校验处于同一
+授权范围。游标是不透明位置，不是通行令牌：每页重新授权。集合或文档改变时明确报错，
+重新读取，不混合版本；无需持久分页 Session。可变集合不保证并发写入期间无中断遍历。
+追加事件遍历使用固定上界 Context delta。目前分类发现扫描选定的授权集合来计算指纹；
+有界的是输出，不是总存储读取成本。
+
+## 效果与例外
+
+Message send/queue/steer 回执保留身份、digest、正文字节数及原有提交/投递/control
+状态，不回显正文。Brief 更新返回 saved 引用。没有新增等待、重试、确认或审批阶段。
+重复读游标绝不能重放变更。
+
+激活、完成、集成和输入控制仍是完整事务业务操作，即使内部有多步工程机制。
+其特定状态回执与已有未知效果诊断保留，不压平成通用“已执行”标志。
+
+本次覆盖日常 Agent Context、协作发现和原始证据读取，并非产品全部诊断或导出。
+既有日志尾部/artifact 限制、Task 目录分页、有界错误诊断保留各自契约。
+配置目录、Project/config 管理、资源清单、归档诊断、发布操作和专用集成/change-set
+读取仍有自己的用途契约；不宣称它们全部受 32 KiB 限制。Web 全详情投影是独立消费者，
+不会被 CLI 摘要悄悄替代。大 Project Knowledge 与 Task 证据用定向 Context 发现。
+
+典型通知读取一次当前 Context、一次固定 wake，再逐条读取相关原文（或其全部文档页）。
+不要为了入口故意省略的详情重复读聚合。只有原文超过内联预算才增加原文分页调用；
+摘要不能代替完整原文。

package/docs/managed-turn-and-session-runtime.md

@@ -41,6 +41,7 @@ automatically create Runs. Explicit dispatch loads one exact Run Context Pack.
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -52,6 +53,14 @@ Delta pages immutable events through a fixed upper bound; inspect expands a
 current record and can require an exact digest. Runtime observations state their
 own coverage and do not become another durable snapshot.
 
+Entry Context samples current facts; it is not a complete historical inventory.
+List one authorized record family, then inspect the relevant originals. Large
+details use `contentPage` and `--cursor`; concatenate all exact text chunks before
+parsing. Global `session context` likewise separates bounded pending/recent
+discovery from `role message show`. See the
+[CLI information contract](cli-information-contract.md) for budgets, scope,
+continuations and the complete-original reading protocol.
+
 Run Context freezes Assignment, source references, effective configuration and
 workspace boundaries. A Role edit does not rewrite an existing Assignment.
 Reading either Context does not acknowledge input or create execution authority.

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -33,6 +33,7 @@ Run Context Pack。
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -43,6 +44,11 @@ Task Context 是一个有界的、获授权的工作集，带有当前 core 游
 上界内分页不可变事件；inspect 展开一条当前记录，并可要求确切摘要。运行时观察声明
 自己的覆盖范围，不会成为另一份持久快照。
 
+入口 Context 抽样当前事实，不是完整历史目录。先列出一种获授权的记录，再展开相关原文。
+长详情使用 `contentPage` 与 `--cursor`；必须拼接全部确切文本分块后再解析 JSON。
+Global `session context` 同样把有界 pending/recent 发现与 `role message show` 原文分开。
+预算、范围、续读及完整原文协议见 [CLI 信息契约](cli-information-contract.zh-CN.md)。
+
 Run Context 冻结 Assignment、来源引用、生效配置和工作区边界。一次 Role 编辑不改写
 既有 Assignment。读取任一 Context 都不确认输入或创建执行权限。每一条受管输入都指向
 确切的 Session Manifest 和 CLI 入口。Run Pack 是一个参考目录：动手前先读相关的需求

package/docs/plugin-sdk.md

@@ -87,7 +87,9 @@ changed source does not inherit an old digest's authorization. The boundaries
 around resources, network, global configuration and the core namespace are
 unchanged; when existing authority is sufficient it is not re-approved, and when a
 new permission is missing the specific gap is reported rather than impersonating
-the Operator or self-issuing a grant.
+the Operator or inventing user authorization. An original user authorization
+can support a bounded [Leader grant](../skills/yui-leader/references/authorization.md)
+without another Operator signature.
 
 On validation failure the Agent preserves the original error and judges the fix;
 an unknown or partial effect must not be auto-rerun. After using a new capability
@@ -323,8 +325,10 @@ Because trusted-local does not bound direct host effects, this grant must allow
 statement that every call actually produces an irreversible effect. `none` or
 `reversible` must not be read as unlimited local execution authority.
 
-An Operator explicitly authorized by the user uses the original grant ingress,
-for example to allow a single validation:
+An Operator explicitly authorized by the user uses the original grant ingress.
+A current delivery Leader can use that same ingress with `--source-message`,
+a verbatim `--purpose`, stable `--request-id`, expiry and finite uses, limited
+to the user's actual authorization. For example, the Operator path for a single validation:
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/plugin-sdk.zh-CN.md

@@ -66,7 +66,8 @@ Leader 先通过稳定 `capability search/describe` 读取当前目录和契约
 Task-local 管理权限不等于执行信任：可执行包仍逐阶段核对下面定义的精确
 `plugin.execute` grant，源码改变后不会继承旧摘要授权。资源、网络、全局
 配置及核心 namespace 的边界不变；已有授权充分时不重复批准，缺少新权限则
-报告具体缺口，不冒充 Operator 或自己签发 grant。
+报告具体缺口，不冒充 Operator 或虚构授权。原始用户授权已覆盖时，可使用
+[有界 Leader Grant](../skills/yui-leader/references/authorization.md)，无需 Operator 再次签字。
 
 验证失败由 Agent 保存原错误并判断修复；不可把 unknown／部分效果自动重跑。
 使用新增能力取得实际业务结果后，通过 `artifact.save` 将独立内容保存为文件产物
@@ -245,7 +246,9 @@ package scope 替代资源授信。因 trusted-local 不约束直接宿主效果
 必须允许 `irreversibilityCeiling: irreversible`：这是能力上限，不表示每次调用
 实际产生不可逆效果。`none/reversible` 不得解释为无限本机执行权。
 
-由获用户明确授权的 Operator 使用原 grant 入口，例如只允许一次验证：
+获明确授权的 Operator 保留原 grant 入口；当前 delivery Leader 也可使用同一入口，
+附上 `--source-message`、逐字授权引文 `--purpose`、稳定 `--request-id`、有效期及有限次数，
+范围必须来自真实用户授权。以下是 Operator 只允许一次验证的示例：
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/release-workflow.md

@@ -27,6 +27,29 @@ system sits behind `ReleaseWorkflowPorts`
 external ports exercise recovery without real GitHub, npm, git, Controller,
 or model effects.
 
+## Yui's default release boundary
+
+For development of Yui itself, the repository's `AGENTS.md` owns the release policy:
+do not release a version by default. Development, tests, acceptance, PR creation
+and merge do not include changing version numbers, creating release tags or
+GitHub Releases, or publishing to npm. Each external effect still requires the
+Task's actual authorization. A workflow containing only PR, CI and merge steps
+is a valid delivery plan; its `ReleaseWorkflow` name does not authorize any
+package release, global CLI update or Controller replacement.
+
+When the user explicitly asks to release a new version without naming its
+level, select only minor or patch according to the actual changes and project
+version rules. A major release requires explicit user authorization for major
+or a specific major version. If breaking changes cannot honestly be represented
+by minor/patch, explain the compatibility conflict and wait for the necessary
+explicit user choice: neither silently publish major nor mislabel incompatible
+behavior as compatible. This does not require adding historical compatibility
+mechanisms. Package release versions are distinct from storage migration
+versions; the storage rules below do not authorize a package release.
+
+The operations and examples below describe how to execute already-authorized
+effects, not a default sequence to run after completing or merging a Task.
+
 ## Stable 1.0 baseline and release evidence
 
 Package 1.0.0 defines the storage **1.0** contract directly. The runtime and
@@ -149,9 +172,12 @@ protection remain enforced.
 
 Storage upgrades are limited to the current major's explicit minor steps.
 Cross-major conversion is independently authorized and is not a runtime fallback.
-Session CLI refresh only retargets the current two-argument quoted wrapper
-named by a valid Manifest. It does not convert retired wrapper forms. Runtime
-diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
+New Sessions use the ordinary `yui` entry from their launch environment; updates
+do not generate or retarget per-Session CLI scripts. Global Context commands
+remain self-contained for remote TUI/Desktop use. Correct PATH and Home selection
+are required: protocol/storage checks do not distinguish every same-contract
+installation. Development uses an explicit isolated checkout entry.
+Runtime diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
 idempotency file; current SQLite data and per-key release receipts remain the
 authorities, and unrelated files are left untouched.
 
@@ -275,18 +301,25 @@ grouped by Role/AgentRun, and process owners use PID/start identity. Storage
 changes follow the [single explicit upgrade boundary](sqlite-control-plane-design.md);
 ordinary commands never rewrite the Home schema.
 
-Grant issue and revoke are irreversible-authority operations. They require
+Operator grant issue and revoke retain their existing authority. They require
 the current registered global Operator conversation. Its native session ID
 must match the durable live session binding: Codex commands use `CODEX_THREAD_ID`
 when present, otherwise `YUI_NATIVE_SESSION_ID`; Claude uses `YUI_NATIVE_SESSION_ID`.
 Host generation and launch-time Agent labels are not caller identity. Resuming
 the same conversation through another entry point does not revoke its authority.
 An unregistered, replaced, or ended conversation has no such authority.
-A managed Task Agent cannot self-issue or
-self-revoke a grant, and clearing the child-process environment does not
-confer user authority. The recorded granter/revoker is bound to that
-Operator session (`operator:<agent-id>`); there is no `--granter`/`--by`
-label to spoof.
+A current delivery Leader can instead issue finite, expiring grants for its own
+Task from an original user/Operator Message, using `--source-message`,
+`--purpose` (a verbatim authorization quotation), and `--request-id`. It must
+choose only the actions actually authorized by that source. Source validation
+is not natural-language approval; development intent is not publication intent.
+Release scope requires Task Projects and their repositories; package/version
+effects also need explicit package/version bounds. Global update, Controller
+replacement and migration remain Operator-only. The Leader may revoke only
+Leader-issued grants in its Task. Empty environments, Worker/Reviewer or
+planning/replaced Sessions confer no such authority. Granter/revoker attribution
+comes from the current Session; there is no `--granter`/`--by` label to spoof.
+See the [complete source/ordinary archive contract](../skills/yui-leader/references/authorization.md).
 
 ```sh
 # 1. The Operator session issues the authority for the release chain.

package/docs/release-workflow.zh-CN.md

@@ -20,6 +20,22 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 （`src/release/releaseWorkflowPorts.ts`）之后。可用临时 SQLite 和确定性的外部端口测试
 恢复逻辑，无需真实 GitHub、npm、git、Controller 或模型效果。
 
+## Yui 的默认发版边界
+
+开发 Yui 本身时，发版规则以仓库中的 `AGENTS.md` 为准：默认不发布新版本。
+开发、测试、验收、创建 PR 和合并不包含修改版本号、创建发布 tag 或 GitHub Release、
+发布 npm；每项外部效果仍需 Task 的实际授权。仅包含 PR、CI 和合并步骤也是合法的交付
+计划，`ReleaseWorkflow` 这个名称不授予包发布、全局 CLI 更新或 Controller 替换权限。
+
+用户明确要求「发布新版本」但没有指定级别时，根据实际变更和项目版本规则，仅选择
+minor（中版本）或 patch（小版本）。major（大版本）必须得到用户对大版本或具体 major
+版本号的明确授权。如果破坏性变更无法诚实地用 minor/patch 表达，说明兼容性冲突，
+等待必要的明确用户选择：既不能静默发布 major，也不能把不兼容行为冒称为兼容。
+这不要求为了回避选择而新增历史兼容机制。包发布版本与存储迁移版本是不同契约，
+下文的存储规则不授予包发布权限。
+
+下文操作及示例说明如何执行已经获授权的效果，不是 Task 完成或合并后默认运行的步骤。
+
 ## 稳定的 1.0 基线与发布证据
 
 1.0.0 软件包直接定义存储 **1.0** 契约。运行包和当前源码不携带任何历史
@@ -113,8 +129,10 @@ Controller RPC 版本 1。Host 不打开 Home 数据库，包括进程归属、
 
 存储升级仅包含同主版本内明确的小版本步骤。跨主版本转换独立授权，
 不构成运行时回退。
-Session CLI 刷新只重定位有效 Manifest 指向的当前双参数引号 wrapper，不转换
-退役形态。运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
+新 Session 使用启动环境中的普通 `yui` 入口；升级不生成或重定向会话 CLI 脚本。
+Global Context 命令保持自足，供远端 TUI/Desktop 使用。必须正确选择 PATH 和 Home：
+协议及存储校验不能区分所有同合约安装；开发使用显式隔离的 checkout 入口。
+运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
 当前 SQLite 与逐 key release 回执仍是权威，无关文件保持原样。
 
 `task role status`、`task role list` 和 `task role session inspect` 在持久 Run 状态旁
@@ -209,14 +227,19 @@ Session 权威依据当前持久绑定检查。Telemetry 按 Role/AgentRun 分
 PID/start 身份。存储变更遵循[唯一的显式升级边界](sqlite-control-plane-design.zh-CN.md);
 普通命令绝不改写 Home schema。
 
-grant 的签发与撤销是不可逆权威操作。它们需要当前已登记的全局 Operator 对话。它的
+Operator 的 grant 签发与撤销保留现有权威边界，需要当前已登记的全局 Operator 对话。它的
 原生 session ID 必须与持久的活动 session 绑定匹配：Codex 命令在存在时使用
 `CODEX_THREAD_ID`，否则使用 `YUI_NATIVE_SESSION_ID`;Claude 使用 `YUI_NATIVE_SESSION_ID`。
 Host generation 和启动时的 Agent 标签不是调用者身份。通过另一个入口恢复同一段对话
-不撤销其权威。一个未登记、被替换或已结束的对话没有这种权威。一个受管的 Task Agent
-不能自签发或自撤销 grant，清空子进程环境也不赋予用户权威。被记录的授权者/撤销者
-绑定到那个 Operator session（`operator:<agent-id>`）；不存在可伪造的 `--granter`/`--by`
-标签。
+不撤销其权威。未登记、被替换或已结束的对话没有这种权威。
+本 Task 当前 delivery Leader 也可引用真实用户/Operator 原消息，以
+`--source-message`、`--purpose`（逐字授权引文）、`--request-id` 签发有有效期及有限次数的
+有界 Grant，并撤销本 Task 的 Leader Grant。语义判断仍由 Agent 负责：引文匹配只是来源
+验证，开发指令不是发布许可。发布必须限定 Task Project/repository，包与版本操作另须明确
+package/version 边界；全局升级、共享 Controller 替换、迁移仍不开放。
+Worker/Reviewer、规划/失效 Session 和清空环境不获得授权；身份来自当前持久 Session，
+不存在可伪造的 `--granter`/`--by` 标签。参见
+[完整来源与普通归档契约](../skills/yui-leader/references/authorization.md)。
 
 ```sh
 # 1. Operator session 为发布链签发权威。

package/docs/storage-baseline.md

@@ -2,6 +2,11 @@
 
 # Storage baseline 1.0
 
+Current storage is 1.2. The declared 1.1 → 1.2 transition adds optional
+CapabilityGrant authorization-source evidence and native-human input/archive
+audit records. Existing valid Operator grants remain unchanged; migration does
+not infer or invent past user authority. The SQL layout is unchanged.
+
 Yui 1.0.0 starts from one clean persistent contract. The package version,
 storage schema, record envelopes and Controller protocol are separate
 identities; none is inferred from another.

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.1 and its declared 1.0 minor
+The stable suite owns current storage 1.2 and its declared 1.0/1.1 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.1, exact schema/record validation, no initialization over
+1. Fresh storage 1.2, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/i18n/README.zh-CN.md

@@ -345,6 +345,8 @@ Yui 面向一个受信任本地用户，不是 OS 沙箱，也不是远程多用
 [总体架构](../ARCHITECTURE.zh-CN.md)介绍端到端设计，
 [文档导航](../docs/architecture/README.zh-CN.md)提供配置、执行、交付、存储和插件的
 当前合同。想直接操作 CLI 时，使用 `yui --help` 查看命令。
+[CLI 信息契约](../docs/cli-information-contract.zh-CN.md)说明当前 Context、分页发现、
+完整原文读取和变更回执。
 
 Yui 默认将控制面数据保存在 `~/.yui`，通过 `YUI_HOME` 选择另一个实例。
 切换构建或更新已有 Home 前，请查看[存储与升级](../docs/sqlite-control-plane-design.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "1.1.2",
+  "version": "2.1.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -7,11 +7,18 @@ description: Lead one Yui Task through authorized planning, activation handoff,
 
 Follow [yui-runtime](../yui-runtime/SKILL.md) first. Load the exact Context Pack
 for an explicitly dispatched AgentRun; for direct conversation or a Task
-notification, read current Task context through the Manifest's Session CLI.
+notification, read current Task context using `yui task context <task-id> --json`.
 No self-dispatch or old completed Run is needed. Read the actual Task
 requirements, current Brief and relevant user/Operator Messages, not just
 their summaries. Resolve links relative to the file containing them.
 
+Current Context is a bounded working set, not all Task history. Use
+`task context list <task> --store <store>` or a domain list for discovery,
+then an exact detail read. A wake contains original Message/Run read pointers,
+not copied reports. Follow Runtime's `nextCursor` and `contentPage` rules:
+read the full relevant window and originals before disposition, without
+unconditionally walking unrelated history.
+
 ## Select the applicable stage
 
 Use current lifecycle, latest intent and the Session's actual planning/delivery

package/skills/yui-leader/references/authorization.md

@@ -0,0 +1,64 @@
+# Source-authorized Task actions
+
+Read the original user/Operator Message in full. A development request, local
+completion, Role report, quoted third-party text, or publication permission
+alone does not authorize another effect. Decide whether the user authorized
+the particular action, resource, trust and scope. Engineering verifies source
+and fixed bounds, not natural-language meaning: a matching quotation proves
+origin, not that your interpretation is correct. Do not issue publication or
+resource grants from a request that only asks to develop.
+
+For actual authorization, the current delivery Leader uses:
+
+```sh
+yui task grant issue <task> --source-message <message-id> \
+  --purpose "<verbatim explicit authorization>" --request-id <stable-id> \
+  --action <action> --expires-at <timestamp> --max-uses <finite-count> \
+  <exact scope, parameter bounds and irreversible ceiling>
+```
+
+The existing Grant records source identity/digest, quotation, Session and fixed
+bounds. Replaying the request id returns the same grant; it never replenishes
+expired, exhausted or revoked authority. Do not change ids to evade limits.
+A changed plan needs a new bounded decision within the user's scope, or a real
+InputRequest if new authority is missing. Operator retains issue/revoke.
+The current Leader may revoke this Task's Leader-issued grants, including
+after Session replacement, but cannot revoke Operator grants.
+
+Release grants require explicit Task Projects/repositories and `sourceCommit`
+bounds (checked against the workflow source, never a step's claimed value); package effects
+also require packages and concrete version bounds. All steps sharing a
+version-bound grant must pass that version. Global installation, shared
+Controller replacement, migration and other Tasks remain outside this path.
+Preserve source/artifact integrity, changed-candidate acceptance, CI,
+Publication and unknown-effect reconciliation.
+
+Plugin execution requires exact pluginId, digest, environmentRef, trust and
+phase. Directory grants require the resourceId, canonical path and read/write
+action. An explicitly authorized unregistered directory can be registered with
+`resource.local.register` using `sourceMessage` and a verbatim `purpose`;
+registration grants no access or Project configuration authority. Then use the
+existing prepare/adopt/bind/release operations. A Home, stable Project or
+managed workspace cannot be registered through this Leader path.
+
+Human input through the Host's human-owned console is persisted before the
+Provider write. Read that original Message. Provider-visible userMessage items
+alone cannot prove human authorship: managed prompts use them too. Never
+transcribe unproven input into a Role report and call it user authority. Use
+the authenticated user input surface when transport provenance is unavailable.
+
+For an explicitly authorized ordinary archive, first save acceptance/delivery
+evidence and complete the Task:
+
+```sh
+yui task archive <task> --integrated --source-message <message-id> \
+  --purpose "<verbatim archive authorization>" --request-id <stable-id>
+```
+
+This single Controller operation checks settlement, delivery and clean
+workspaces, records the source, stops the requesting Leader and applies normal
+cleanup/archive checks. The conversation can end before the CLI response.
+Inspect `task.leader-archive-started`, `task.leader-archive-result`,
+`task.archived` and cleanup receipts. A started operation without a result is
+uncertain; inspect its effects before recovery, never replay with a new id.
+No automatic retry, force or abandonment authority is implied.

package/skills/yui-leader/references/execution.md

@@ -22,6 +22,17 @@ implementation patterns, scheduling options, review routing, or recoverable
 runtime actions. Create an InputRequest only for a real product choice, new
 authority, irreversible external effect, or unavailable external fact.
 
+Task Messages and the Brief are durable records, not delivery receipts to the
+Operator. For a genuinely missing user choice, resource, credential or scope,
+use `task input request`; the Controller notifies the Operator through the
+existing durable notification path with references to the original records.
+Completion and existing blocked-work notifications use that same path. Do not
+invent an InputRequest just to announce progress or ask again for authority
+already granted. A failed global input call does not mean Task notifications
+are broken: a Task Leader must not call global `role message queue`, `steer`
+or `role interrupt`, impersonate Operator, or clear identity environment
+variables to bypass that boundary.
+
 ## Separate the work unit, executor, and concurrency
 
 Honor the user's explicit choice of direct work or delegation. Otherwise make
@@ -286,8 +297,9 @@ Use `capability search`, `describe`, and `call` to inspect current tools.
 Prefer existing tools, composition or a one-off script when sufficient.
 For reusable Task-local capabilities, read [Task plugins](task-plugins.md)
 before creation, validation or activation. Plugin management permission does
-not grant code execution or broader external effects. Never issue your own
-grants, impersonate Operator, or modify the core installation to obtain a tool.
+not grant code execution or broader external effects. Use
+[source-authorized capabilities](authorization.md) for existing explicit user
+authority. Never invent authorization, impersonate Operator, or modify the core installation to obtain a tool.
 
 ## Validate and make the review judgment
 
@@ -369,7 +381,9 @@ after its final report. Cleanup can remain advisory at completion. Ordinary
 archive requires settled resources; explicitly authorized force archive preserves
 unresolved resources and diagnostics under the shared
 [archive contract](../../yui-runtime/references/publication.md). The Leader
-does not gain independent archive authorization.
+does not gain independent archive authorization. An original explicit user
+archive request can authorize the Controller-owned ordinary archive described
+in [source-authorized capabilities](authorization.md).
 
 Complete only when the Task outcome is satisfied, required checks and review
 contracts are settled, WorkItems are accepted or deliberately retired, latest
@@ -381,7 +395,7 @@ yui task complete <task-id> \
 ```
 
 Completion records the exact Project heads. Archive is a separate,
-user-authorized Operator action.
+user-authorized action, never an implication of completion or publication.
 
 Completion is offline by default. `--refresh-remote` only refreshes remote
 freshness observations; neither path rebases or starts Integration checks.

package/skills/yui-leader/references/task-plugins.md

@@ -1,7 +1,7 @@
 # Task-local capabilities
 
 Read this before creating, validating or activating a Task-local plugin.
-Use the stable Session CLI's capability directory and read the exact schema
+Use the `yui` CLI's capability directory and read the exact schema
 before each unfamiliar operation. Prefer an existing tool, composition or
 one-off script unless a reusable named capability is useful.
 
@@ -17,7 +17,9 @@ the exact plugin id, digest, environment, trust and phase, within its remaining
 uses and validity. A source change cannot inherit an old digest's grant.
 Trusted-local subprocesses are not an OS sandbox.
 
-Never issue your own grants, impersonate Operator, change global configuration,
+Use [source-authorized capabilities](authorization.md) when original user input
+already authorizes the exact Task plugin/resource. Never invent grants,
+impersonate Operator, change global configuration,
 or modify the core installation, namespace or carrying Endpoint to obtain a
 tool. Request only a genuinely missing resource or trust boundary, not authority
 already available. Plugin grants do not authorize unrelated external effects.

package/skills/yui-operator/SKILL.md

@@ -227,8 +227,15 @@ a dormant Role and verify the complete binding before the next launch.
 
 ## Present current progress
 
-Use JSON reads and their top-level `data` field. Report the facts needed to
-understand the outcome:
+Use JSON reads and their top-level `data` field.
+Use Global Context's `pending`/`recent` pages to find Messages, then
+`role message show operator <id>` for the original. A successful send receipt
+contains saved identity and delivery/control facts, not another copy of the
+submitted body. Follow Runtime's bounded-read contract for list continuations
+and long `contentPage` details; do not decode `output` as nested JSON or print
+an entire Context again merely to extract one already-returned reference.
+
+Report the facts needed to understand the outcome:
 
 - Task ID, Projects, recorded bases, and lifecycle;
 - current WorkItems, ownership, dependencies, and acceptance state;