@zq-silk/yui 2.11.0 → 2.14.0

package/dist/storage/sqliteStore.js

@@ -1,3 +1,4 @@
+import { validateAgentJobRun, assertAgentJobRunTransition } from "../job/agentJob.js";
 /**
  * SQLite WAL Store (task-21, work-item-3).
  *
@@ -1079,6 +1080,10 @@ export class SqliteTaskStore {
             throw new StorageRecordError("Task id is required.");
         }
         this.#mutate(() => {
+            const previous = this.getTask(task.id);
+            if (previous !== null && !isDeepStrictEqual(previous.source, task.source)) {
+                throw new StorageRecordError("Task source is immutable after creation.");
+            }
             const schedules = this.listSchedules({ kind: "task", taskId: task.id });
             if (task.status === "completed" && schedules.some(s => s.rule.kind === "once"
                 && (s.state === "enabled" || s.state === "needs-attention"))) {
@@ -1117,6 +1122,18 @@ export class SqliteTaskStore {
         const tasks = this.#listPayload("task_records", "1=1", []);
         return this.#sortById(tasks, (task) => task.id);
     }
+    listTaskDelegations(taskId) {
+        const rows = this.#db.prepare(`SELECT task_id AS scope, job_id AS id, payload FROM durable_jobs
+      WHERE json_extract(payload,'$.delegation.taskId') = ?
+      UNION ALL SELECT 'global' AS scope, run_id AS id, payload FROM global_job_runs
+      WHERE json_extract(payload,'$.delegation.taskId') = ? LIMIT 101`).all(taskId, taskId);
+        return { complete: rows.length <= 100, items: rows.slice(0, 100).map(row => {
+                const run = JSON.parse(row.payload);
+                return { sourceRun: { scope: row.scope === "global" ? { kind: "global" }
+                            : { kind: "task", taskId: row.scope }, runId: row.id },
+                    jobId: run.definitionId, delegation: run.delegation, status: run.status };
+            }) };
+    }
     queryTaskCatalog(query) {
         return queryTaskCatalog(this.#db, query);
     }
@@ -1175,6 +1192,7 @@ export class SqliteTaskStore {
         return {
             ...base,
             pendingUserMessages: pendingCompletionMessages(this, taskId),
+            agentJobs: this.listAgentJobRuns({ kind: "task", taskId }),
             managedWorkspaces: this.#sortById(this.#listPayload("managed_workspaces", "task_id = ?", [taskId]), (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: this.#sortById(this.#listPayload("durable_jobs", "task_id = ?", [taskId]), (job) => job.id),
         };
@@ -1332,6 +1350,41 @@ export class SqliteTaskStore {
                 .run(run.id, this.#recordJson("global_job_runs", run), run.status);
         });
     }
+    saveAgentJobRun(run) {
+        validateAgentJobRun(run);
+        if (run.scope.kind === "task")
+            this.#requireTask(run.scope.taskId);
+        this.#mutate(() => {
+            const previous = this.getAgentJobRun(run.id);
+            if (previous)
+                assertAgentJobRunTransition(previous, run);
+            this.#db.prepare(`INSERT INTO agent_job_runs VALUES(?,?,?,?)
+        ON CONFLICT(run_id) DO UPDATE SET payload=excluded.payload`)
+                .run(run.id, jobScopeKey(run.scope), run.definitionId, this.#recordJson("agent_job_runs", run));
+            if (run.scope.kind === "task" && (!previous || previous.status !== run.status
+                || !isDeepStrictEqual(previous.businessResult, run.businessResult) || previous.cancelRequestedAt !== run.cancelRequestedAt)) {
+                const taskId = run.scope.taskId;
+                this.saveEvent(taskId, createTaskEvent(this.nextEventId(taskId), taskId, "job.state-changed", {
+                    jobId: run.id, status: run.status,
+                    ...(previous ? { previousStatus: previous.status } : {}),
+                    ...(run.cancelRequestedAt ? { cancelRequestedAt: run.cancelRequestedAt } : {})
+                }, new Date(run.updatedAt)));
+            }
+        });
+    }
+    getAgentJobRun(id) {
+        return this.#getPayload("agent_job_runs", "run_id=?", [id]);
+    }
+    listAgentJobRuns(scope, definitionId) {
+        return this.#listPayload("agent_job_runs", definitionId === undefined ? "scope_key=?" : "scope_key=? AND definition_id=?", definitionId === undefined ? [jobScopeKey(scope)] : [jobScopeKey(scope), definitionId]);
+    }
+    listAgentJobRunsForRole(recipient) {
+        return this.#listPayload("agent_job_runs", `json_extract(payload,'$.attempts[#-1].recipient.scope')=?
+       AND json_extract(payload,'$.attempts[#-1].recipient.roleName')=?
+       AND COALESCE(json_extract(payload,'$.attempts[#-1].recipient.taskId'),'')=?
+       AND (json_extract(payload,'$.attempts[#-1].terminal') IS NULL
+         OR json_extract(payload,'$.businessResult') IS NULL)`, [recipient.scope, recipient.roleName, recipient.scope === "task" ? recipient.taskId : ""]);
+    }
     getGlobalJobRun(id) {
         return this.#getPayload("global_job_runs", "run_id=?", [id]);
     }

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.14";
+export const CURRENT_STORAGE_VERSION = "1.20";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/dist/storage/storeRpc.js

@@ -73,6 +73,9 @@ const READ_ONLY_STORE_METHODS = new Set([
     "getJobDefinition",
     "listJobDefinitions",
     "getGlobalJobRun",
+    "getAgentJobRun",
+    "listAgentJobRuns",
+    "listAgentJobRunsForRole",
     "listGlobalJobRuns",
     "listActiveGlobalJobRuns",
     "listRoles",

package/dist/storage/taskCatalog.js

@@ -21,6 +21,10 @@ export function queryTaskCatalog(db, query) {
         match.push("status = @status");
         params.status = query.status;
     }
+    if (query.source !== undefined) {
+        match.push(`EXISTS (SELECT 1 FROM task_records r WHERE r.task_id = facts.id AND
+      json_extract(r.payload, '$.source.kind') ${query.source === "job" ? "= 'job-run'" : "IS NULL"})`);
+    }
     if (query.project !== undefined) {
         match.push(`EXISTS (SELECT 1 FROM task_records r, json_each(r.payload, '$.projectBindings') p
       WHERE r.task_id = facts.id AND json_extract(p.value, '$.projectId') = @project)`);
@@ -57,6 +61,10 @@ export function queryTaskCatalog(db, query) {
         after.push("(createdAt, id) > (@afterDate, @afterId)");
     }
     const count = (table, condition) => `(SELECT count(*) FROM ${table} x WHERE x.task_id = c.task_id AND (${condition}))`;
+    const incoming = (statuses) => `(SELECT count(*) FROM global_job_runs x
+    WHERE json_extract(x.payload,'$.delegation.taskId') = c.task_id AND x.status IN (${statuses}))
+    + (SELECT count(*) FROM durable_jobs x WHERE x.task_id <> c.task_id
+      AND json_extract(x.payload,'$.delegation.taskId') = c.task_id AND x.status IN (${statuses}))`;
     const displaySummary = `CASE
     WHEN page.status IN ('completed','archived')
       AND json_extract(r.payload,'$.completionSummary') IS NOT NULL
@@ -76,8 +84,8 @@ export function queryTaskCatalog(db, query) {
       ${count("work_items", "1=1")} AS workItems,
       ${count("turns", "status = 'active'")} AS activeRuns,
       ${count("input_requests", "status = 'open'")} AS openInputs,
-      ${count("durable_jobs", "status IN ('queued','running')")} AS pendingOperations,
-      ${count("durable_jobs", "status = 'unknown-needs-attention'")} AS unknownOperations,
+      ${count("durable_jobs", "status IN ('queued','running')")} + ${incoming("'queued','running'")} AS pendingOperations,
+      ${count("durable_jobs", "status = 'unknown-needs-attention'")} + ${incoming("'unknown-needs-attention'")} AS unknownOperations,
       CASE WHEN c.status IN ('active','draft') THEN
         ${count("turns", "status = 'active'")} +
         ${count("work_items", "status = 'open' OR (status = 'accepted' AND json_extract(payload, '$.currentExecutionGroupId') IS NOT NULL)")} +

package/dist/storage/upgrade/jobBusinessResultMigration.js

@@ -0,0 +1,20 @@
+import { processBusinessResult } from "../../job/jobBusinessResult.js";
+import { validateDurableJob } from "../../job/durableJob.js";
+/** Preserve raw history and derive only what each original result actually proves. */
+export function migrateJobBusinessResults(db) {
+    for (const table of ["durable_jobs", "global_job_runs"]) {
+        const rows = db.prepare(`SELECT rowid, payload FROM ${table}`).all();
+        for (const row of rows) {
+            const run = JSON.parse(row.payload);
+            if (run.businessResult !== undefined)
+                throw new Error("Unexpected business result in storage 1.14.");
+            validateDurableJob(run);
+            if (!run.result)
+                continue;
+            const migrated = validateDurableJob({ ...run, businessResult: processBusinessResult(run, run.result) });
+            db.prepare("INSERT INTO storage_migration_archive(migration_version,family,record_key,payload) VALUES(?,?,?,?)")
+                .run(15, table, `${"taskId" in run ? run.taskId : "global"}/${run.id}`, row.payload);
+            db.prepare(`UPDATE ${table} SET payload=? WHERE rowid=?`).run(JSON.stringify(migrated), row.rowid);
+        }
+    }
+}

package/dist/storage/upgrade/scheduleDispatchMigration.js

@@ -0,0 +1,15 @@
+import { validateSchedule } from "../../schedule/schedule.js";
+/** Keep valid historical Session authority; never infer a service grant. */
+export function migrateScheduleDispatch(db) {
+    const rows = db.prepare("SELECT rowid,scope_key,schedule_id,payload FROM schedules").all();
+    for (const row of rows) {
+        const old = JSON.parse(row.payload);
+        if (old.target !== undefined || old.authorization?.kind !== undefined)
+            throw new Error("Unexpected Schedule shape in storage 1.15.");
+        const next = validateSchedule({ ...old, target: { kind: "existing-job" },
+            authorization: { ...old.authorization, kind: "session" } });
+        db.prepare("INSERT INTO storage_migration_archive(migration_version,family,record_key,payload) VALUES(?,?,?,?)")
+            .run(16, "schedules", `${row.scope_key}/${row.schedule_id}`, row.payload);
+        db.prepare("UPDATE schedules SET payload=? WHERE rowid=?").run(JSON.stringify(next), row.rowid);
+    }
+}

package/dist/task/archivePreflight.js

@@ -23,6 +23,9 @@ export function archiveSettlementChecks(store, task) {
     for (const job of store.listDurableJobs(task.id).filter(j => ["queued", "running"].includes(j.status) || (j.status === "unknown-needs-attention" && j.acknowledgedAt === undefined))) {
         add(`job:${task.id}/${job.id}`, "active-durable-job", "Task has an active or unacknowledged DurableJob.", "settled job", job.status, `yui job get --task ${task.id} --job ${job.id}`);
     }
+    for (const job of store.listAgentJobRuns({ kind: "task", taskId: task.id }).filter(run => !run.businessResult)) {
+        add(`job:${task.id}/${job.id}`, "active-durable-job", "Agent JobRun has no explicit business result.", "settled job", job.status, `yui job run-context --task ${task.id} --job ${job.definitionId} --run ${job.id}`);
+    }
     return checks;
 }
 /** Unknown execution is never permission to remove workspaces, even after
@@ -40,6 +43,18 @@ export function archiveExecutionChecks(store, taskId, home, phase = "before-remo
         if (blocker !== undefined)
             add(`job:${taskId}/${job.id}`, "unresolved-execution", blocker, job.status, `yui job get --task ${taskId} --job ${job.id}`);
     }
+    for (const job of store.listAgentJobRuns({ kind: "task", taskId })) {
+        const last = job.attempts.at(-1);
+        if (!last.terminal)
+            add(`job:${taskId}/${job.id}`, "unresolved-execution", "Agent Job input has no exact native terminal; business reporting alone is not quiescence.", job.status, `yui job run-evidence --task ${taskId} --job ${job.definitionId} --run ${job.id}`);
+    }
+    for (const role of store.listGlobalRoles().filter(role => role.jobOwner?.scope.kind === "task" && role.jobOwner.scope.taskId === taskId)) {
+        const binding = store.getGlobalRoleSessionSet(role.name)?.providerBinding;
+        if (binding?.run && !["completed", "failed", "cancelled", "rejected"].includes(binding.run.status)
+            || hasRuntimeLifecycleWork(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name })))) {
+            add(`global-role:${role.name}`, "unresolved-provider-input", "Task-owned Job Role retains an unresolved input or lifecycle operation.", binding?.run?.status ?? "lifecycle pending", `yui job session-inspect --task ${taskId} --job ${role.jobOwner.jobId}`);
+        }
+    }
     for (const role of store.listRoles(taskId)) {
         const resource = `role:${taskId}/${role.name}`;
         const action = `yui task role session inspect ${taskId} ${role.name}`;

package/dist/task/completionReadiness.js

@@ -81,6 +81,13 @@ export function projectCompletionReadiness(facts) {
         });
     }
     // Active DurableJobs (integration checks, etc.) must settle.
+    for (const job of facts.agentJobs ?? []) {
+        if (job.businessResult)
+            continue;
+        blockers.push({ code: "active-durable-job", ref: ref("durable-job", job.id),
+            reason: `Agent JobRun ${job.id} has no explicit business result.`,
+            fix: `inspect yui job run-context --task ${facts.task.id} --job ${job.definitionId} --run ${job.id}; settle its original input without replay` });
+    }
     for (const job of facts.durableJobs) {
         if (!ACTIVE_JOB_STATUSES.has(job.status))
             continue;

package/dist/task/task.js

@@ -400,7 +400,7 @@ export function validateTask(task) {
     if (task.schemaVersion !== 1)
         throw new Error("Task must use schemaVersion 1.");
     const fields = [
-        "schemaVersion", "id", "title", "type", "description", "priority", "tags", "dueAt",
+        "schemaVersion", "source", "id", "title", "type", "description", "priority", "tags", "dueAt",
         "projectBindings", "cwd", "workspaceIdentity", "status", "executionGate", "activationRequest",
         "settledActivationRequests", "completedAt", "completedBy", "completionSummary", "completionArtifactRefs",
         "retiredAt", "retiredBy", "retirementSummary", "retirementIsolation", "replacementTaskId",
@@ -411,6 +411,22 @@ export function validateTask(task) {
             throw new Error(`Task contains an unsupported field: ${field}.`);
     }
     requireSafeIdentity(task.id, "Task id");
+    if (task.source !== undefined) {
+        const source = task.source;
+        if (source.kind !== "job-run" || Object.keys(source).some(key => !["kind", "jobId", "run"].includes(key))) {
+            throw new Error("Invalid Task source.");
+        }
+        requireSafeIdentity(source.jobId, "Source Job id");
+        requireSafeIdentity(source.run.runId, "Source Run id");
+        if (Object.keys(source.run).some(key => !["scope", "runId"].includes(key))
+            || Object.keys(source.run.scope).some(key => !["kind", "taskId"].includes(key))
+            || !["global", "task"].includes(source.run.scope.kind))
+            throw new Error("Invalid Task source Run.");
+        if (source.run.scope.kind === "task")
+            requireSafeIdentity(source.run.scope.taskId, "Source Task id");
+        else if ("taskId" in source.run.scope)
+            throw new Error("Global source cannot name a Task.");
+    }
     requireText(task.title, "Task title");
     if (task.type !== undefined)
         requireSafeIdentity(task.type, "Task type");

package/dist/verification/verificationGateService.js

@@ -62,6 +62,8 @@ export function beginGateVerification(store, identity, plan, now) {
  * artifact is self-contained evidence after the job's own logs are cleaned.
  */
 export async function recordGateArtifactFromJob(store, home, identity, plan, job, now) {
+    if (job.delegation)
+        throw new Error("Task delegation is not process verification evidence.");
     const steps = (job.result?.steps ?? []).map((result) => {
         const planned = job.steps.find((step) => step.name === result.name);
         return {
@@ -216,6 +218,8 @@ function sanitizeLogName(name) {
  * failure; the Integration gate has not started when bootstrap fails.
  */
 export function checkResultsFromGateJob(job, _home) {
+    if (job.delegation)
+        throw new Error("Task delegation is not process verification evidence.");
     const results = new Map((job.result?.steps ?? []).map((step) => [step.name, step]));
     const checks = [];
     for (const step of job.steps) {

package/dist/web/assets/client/app/catalog.js

@@ -98,6 +98,18 @@ function renderSidebar(deps, progress) {
     reset(deps, progress);
   });
   el.catalogCount.textContent = fill(t("catalog.count"), { shown: state.tasks.length, total: state.catalogTotal });
+  let source = el.filters.querySelector("select");
+  if (!source) {
+    source = h("select", { "aria-label": t("jobs.taskCategory") });
+    source.addEventListener("change", function () {
+      state.source = source.value; state.attentionFilter = null; state.query = ""; el.search.value = "";
+      syncUrl(state, false); reset(deps, progress);
+    });
+    el.filters.append(source);
+  }
+  source.replaceChildren(...["ordinary", "job", "all"].map(value =>
+    h("option", { value }, t("jobs.category." + value))));
+  source.value = state.query.trim() || state.attentionFilter ? "all" : state.source || "ordinary";
   el.catalogReset.hidden = !state.catalogCursor;
   el.catalogNext.hidden = !state.nextCursor && !state.catalogCursor;
   el.catalogAttentionReset.hidden = !state.attentionFilter;
@@ -137,6 +149,9 @@ function catalogQuery(state) {
   if (state.filter !== "all") query.set("status", state.filter);
   if (state.query.trim()) query.set("search", state.query.trim());
   if (state.attentionFilter) query.set("attention", state.attentionFilter);
+  // Search and attention remain cross-category discovery; the server owns filtering.
+  if (!state.query.trim() && !state.attentionFilter && state.source !== "all")
+    query.set("source", state.source || "ordinary");
   if (state.catalogCursor) query.set("cursor", state.catalogCursor);
   return query.toString();
 }
@@ -192,6 +207,7 @@ function applyFilters(deps, params) {
   state.query = params.get("q") || "";
   state.attentionFilter = ATTENTION_KINDS.includes(params.get("attention")) ? params.get("attention") : null;
   state.catalogAll = params.get("all") === "true";
+  state.source = ["ordinary", "job", "all"].includes(params.get("source")) ? params.get("source") : "ordinary";
   deps.el.search.value = state.query;
 }
 

package/dist/web/assets/client/app/settings.js

@@ -9,6 +9,7 @@ import { clearPreference, readSessionAccessMode, writeSessionAccessMode } from "
 import { i18n, createManageShell, pageSections, registerManagePage, navigateManage } from "/assets/js/layout/manageShell.js";
 import { mountSkills } from "/assets/js/views/skills.js";
 import { mountJobs } from "/assets/js/views/jobs.js";
+import { mountPermissions } from "/assets/js/views/permissions.js";
 
 const $ = selector => document.querySelector(selector);
 const t = i18n.t;
@@ -20,12 +21,14 @@ function readSection() {
 }
 let section = readSection();
 let jobs;
+let permissions;
 const shell = createManageShell({ page: "settings", t, onNavigate: navigate });
 function showSection(next) {
   section = next;
   document.querySelectorAll("#settings-root > .manage-section[data-section]").forEach(panel => { panel.hidden = panel.dataset.section !== next; });
   shell.set(next);
   if (next === "jobs" && !jobs) jobs = mountJobs($("#global-jobs"), t);
+  if (next === "permissions" && !permissions) permissions = mountPermissions($("#permission-browser"), t);
 }
 function navigate(next) {
   navigateManage({ page: "settings", section: next });
@@ -39,6 +42,7 @@ registerManagePage("settings", { show: next => showSection(next.section) });
 i18n.subscribe(() => shell.render());
 i18n.subscribe(() => {
   if (jobs && !jobs.isDirty() && !jobs.isBusy()) jobs = mountJobs($("#global-jobs"), t);
+  permissions?.translate();
 });
 showSection(section);
 const skills = mountSkills($("#skill-browser"), t, { heading: false, onDirty: value => markDirty("skills", value) });

package/dist/web/assets/client/i18n/en.js

@@ -3,10 +3,83 @@
 // domain vocabulary (statuses, owners, actions) keeps the exact product terms.
 // Placeholders such as {count} are filled by fill() in lib/format.
 export const EN = {
+    "settings.section.permissions": "Command permissions",
+    "permissions.intro": "Read-only discovery templates, not authorization for a specific call. No rules or Grants are changed.",
+    "permissions.notice": "Compare CLI discovery by role. Visible means included in that role's default help/completion, not permission to execute. Choosing a role does not switch your identity.",
+    "permissions.commands": "Command × role matrix",
+    "permissions.capabilities": "Built-in capability contracts",
+    "permissions.view": "View",
+    "permissions.search": "Find a command or capability",
+    "permissions.role": "Role template",
+    "permissions.category": "Command category",
+    "permissions.allRoles": "Compare all role templates",
+    "permissions.allCategories": "All categories",
+    "permissions.configured": "Configured GlobalRole",
+    "permissions.role.public": "Terminal / unmanaged",
+    "permissions.role.operator": "Operator",
+    "permissions.role.global": "GlobalRole",
+    "permissions.role.leader": "Task Leader",
+    "permissions.role.worker": "Task Worker",
+    "permissions.role.reviewer": "Task Reviewer",
+    "permissions.role.unbound": "Unbound identity",
+    "permissions.command": "Command",
+    "permissions.visible": "Visible",
+    "permissions.hidden": "Hidden",
+    "permissions.tableHint": "Discovery only · select a command for role-specific usage and boundaries. Scroll horizontally to compare roles.",
+    "permissions.reason.visible": "Included by the current catalog projection. Options below are filtered by the same role audience as CLI help.",
+    "permissions.reason.hidden": "Not discoverable as an executable command in this audience's catalog. This is not a missing-Grant assessment.",
+    "permissions.unevaluated": "No specific authorization assessment performed. No target, live Session or Grant has been inspected.",
+    "permissions.boundaries": "Execution still checks the actual Session, Task/lifecycle, planning or delivery authority, Assignment/Review, Project/workspace and resource/Grant bounds as applicable. The catalog cannot enumerate every domain check; never infer authorization from visibility, command name or a query effect.",
+    "permissions.boundary.public": "Ordinary terminals and unmanaged sessions share the public surface. This does not grant a managed identity or authorize unrequested effects.",
+    "permissions.boundary.operator": "Requires the current Operator binding and the domain's operation-specific checks. An offline template cannot establish that binding.",
+    "permissions.boundary.global": "Configured GlobalRoles share this discovery audience, not Operator authority. Role configuration and exact domain scope remain authoritative.",
+    "permissions.boundary.leader": "Own Task and captured Project scope. Planning Sessions do not acquire delivery authority just because a Task becomes active.",
+    "permissions.boundary.assignment": "Worker and Reviewer share discovery templates, but their exact Assignment/Review, frozen references and writable workspace may differ.",
+    "permissions.boundary.unbound": "Incomplete/conflicting managed identity has no public fallback. Historical or revoked Sessions are rechecked at execution even if offline help is visible.",
+    "permissions.capabilityNotice": "Built-in descriptors from the existing registry definition, not a second CLI-to-capability map. Permission categories and required inputs are contracts, not role grants. Task-local plugin descriptors and live assessments are intentionally excluded.",
+    "permissions.effect": "Declared effect",
+    "permissions.requiredPermissions": "Required permission categories",
+    "permissions.requiredInputs": "Required target inputs",
+    "permissions.inputs": "All input fields",
+    "permissions.legend": "Meaning, limits and sources",
+    "permissions.states": "Exact capability discovery may return hidden, requestable (with a bounded request route), or authorized (rechecked at execution). Without exact input there is no access assessment; this page never labels a role/command pair authorized or requestable.",
+    "permissions.sources": "Sources",
+    "permissions.previous": "Previous",
+    "permissions.next": "Next",
+    "permissions.loading": "Loading templates…",
+    "permissions.empty": "No matching templates.",
+    "permissions.retry": "Retry read",
     "tabs.jobs": "Jobs",
     "settings.section.jobs": "Jobs & schedules",
+    "jobs.builtinSync": "Built-in Project sync · safe fast-forward only",
+    "jobs.automatic": "Automatic sync preference",
+    "jobs.syncEvery": "Sync interval (milliseconds, minimum 60000)",
+    "jobs.enabled": "On",
+    "jobs.disabled": "Off",
+    "jobs.result": "Business result",
     "jobs.heading": "Jobs & schedules",
-    "jobs.help": "Run now starts one execution without changing the cadence. Cancel stops only the selected Run. Disable prevents future scheduled admissions. Operations use the current Operator binding.",
+    "jobs.help": "Ownership is separate from execution target. Run now admits one execution; disable prevents future admissions. Cancellation does not prove business or process termination. Global management needs no Operator Session; Task management retains its current authority checks.",
+    "jobs.executor": "Execution method",
+    "jobs.executionTask": "Open execution Task",
+    "jobs.sourceJob": "Created by Job / Run",
+    "jobs.taskCategory": "Task category",
+    "jobs.category.ordinary": "Ordinary Tasks",
+    "jobs.category.job": "Job execution Tasks",
+    "jobs.category.all": "All Tasks",
+    "jobs.recentSuccess": "Most recent successful Run",
+    "jobs.diagnostics": "Execution diagnostics",
+    "jobs.artifacts": "Registered fixed artifacts",
+    "jobs.registeredOnly": "Only the exact registered owner, Run, commit, path and digest are readable. Linked images must also be registered.",
+    "jobs.inspectSaved": "Inspect saved / unregistered evidence",
+    "jobs.register": "Register exact saved artifact",
+    "jobs.registerHelp": "Registration publishes this saved evidence; it does not rerun work. Saved but unregistered files are not yet formal results.",
+    "jobs.cancelBoundary": "Request cancellation of this exact Run only. This does not stop its execution Task or interrupt a shared Agent Session. Inspect the result for confirmation.",
+    "jobs.inspectSession": "Inspect Job-owned Session",
+    "jobs.stopSession": "Request stop of selected Session",
+    "jobs.newSession": "Replace stopped Session",
+    "jobs.sessionBoundary": "Only this Job-owned Session is targeted. Stop is a cleanup request; replacement requires proven termination and settled input. Neither operation replays work or removes evidence.",
+    "jobs.stale": "Refresh failed. Any retained facts are from the previous observation, not live success.",
+    "jobs.unavailable": "Selected Job is unavailable in this management scope.",
     "jobs.details": "Details",
     "jobs.scope": "Ownership",
     "jobs.project": "Target Project",
@@ -34,7 +107,7 @@ export const EN = {
     "jobs.unknown": "Submission outcome is unknown; it will not be resent. Inspect current facts and the original operation before taking another action.",
     "jobs.empty": "No Jobs in this scope. Creating a Job does not run it.",
     "jobs.configuration": "Execution configuration",
-    "jobs.taskConfig": "Task-only shell specification: use the registered managed workspace, exact Project HEAD and owner. Commands and environment must not contain secrets. The server validates scope and execution prerequisites.",
+    "jobs.taskConfig": "Use the documented shell, Task delegation or Agent configuration. Shell requires an exact managed workspace/HEAD; new execution Tasks still require independent activation. Agent input grants no extra authority. No secrets. Executor kind is immutable.",
     "jobs.rebind": "Saving a Project refresh Job explicitly binds its current catalog target. It does not refresh the Project. No arbitrary global shell commands.",
     "jobs.rule": "Time rule",
     "jobs.instant": "Instant / interval anchor (ISO time with UTC offset)",

package/dist/web/assets/client/i18n/zh-CN.js

@@ -1,10 +1,83 @@
 // Simplified Chinese UI copy. Typed against the English catalog, so a key that
 // does not exist in en.ts is a compile error; a missing key falls back to en.
 export const ZH_CN = {
+    "settings.section.permissions": "命令权限",
+    "permissions.intro": "只读的命令发现模板，不是具体调用的授权结论。不会修改规则或 Grant。",
+    "permissions.notice": "按角色比较 CLI 发现范围。“可见”仅表示默认帮助与补全包含该命令，不代表可以执行。选择角色不会切换你的身份。",
+    "permissions.commands": "命令 × 角色矩阵",
+    "permissions.capabilities": "内置能力契约",
+    "permissions.view": "视图",
+    "permissions.search": "查找命令或能力",
+    "permissions.role": "角色模板",
+    "permissions.category": "命令分类",
+    "permissions.allRoles": "比较全部角色模板",
+    "permissions.allCategories": "全部分类",
+    "permissions.configured": "已配置 GlobalRole",
+    "permissions.role.public": "终端 / 非管控会话",
+    "permissions.role.operator": "Operator",
+    "permissions.role.global": "GlobalRole",
+    "permissions.role.leader": "Task Leader",
+    "permissions.role.worker": "Task Worker",
+    "permissions.role.reviewer": "Task Reviewer",
+    "permissions.role.unbound": "未绑定身份",
+    "permissions.command": "命令",
+    "permissions.visible": "发现可见",
+    "permissions.hidden": "隐藏",
+    "permissions.tableHint": "仅展示发现范围 · 选择命令查看各角色用法与边界；可横向滚动比较角色。",
+    "permissions.reason.visible": "当前目录投影包含该命令。下方选项与 CLI 帮助使用相同的角色过滤规则。",
+    "permissions.reason.hidden": "该角色的目录中不展示此可执行命令。这不表示仅缺少一个 Grant。",
+    "permissions.unevaluated": "尚未进行具体授权评估；未检查目标、实时 Session 或 Grant。",
+    "permissions.boundaries": "执行仍按实际操作检查 Session、Task/生命周期、planning 或 delivery 权限、Assignment/Review、Project/工作区及资源/Grant 边界。目录不能枚举全部领域检查；不可根据可见性、命令名称或 query 效果推断已授权。",
+    "permissions.boundary.public": "普通终端与非 Yui 管控会话共用公共入口；这不赋予管控身份，也不授权未被请求的操作。",
+    "permissions.boundary.operator": "需要当前 Operator 绑定及领域操作检查。离线模板不能证明该绑定有效。",
+    "permissions.boundary.global": "已配置 GlobalRole 共用此发现范围，但不继承 Operator 权限；角色配置和具体领域范围仍是权威来源。",
+    "permissions.boundary.leader": "限自身 Task 及已捕获的 Project 范围。Task 激活不会将 planning Session 自动提升为 delivery。",
+    "permissions.boundary.assignment": "Worker 与 Reviewer 共用发现模板，但各自 Assignment/Review、冻结引用和可写工作区可能不同。",
+    "permissions.boundary.unbound": "不完整或冲突的管控身份不能回退为公共身份。历史或已撤销 Session 即使能看到离线帮助，执行时仍会被重新检查。",
+    "permissions.capabilityNotice": "直接展示现有 registry 的内置描述，不维护另一份 CLI 与能力映射。权限类别和必填输入是契约，不是角色授权；不展示 Task 私有插件描述或实时评估。",
+    "permissions.effect": "声明效果",
+    "permissions.requiredPermissions": "所需权限类别",
+    "permissions.requiredInputs": "必填目标输入",
+    "permissions.inputs": "全部输入字段",
+    "permissions.legend": "含义、限制与来源",
+    "permissions.states": "具体能力发现可能返回 hidden（隐藏）、requestable（可经限定渠道申请）或 authorized（已授权，执行时仍复核）。缺少具体输入时不提供 access 结论；此页不会将角色与命令组合标为已授权或可申请。",
+    "permissions.sources": "来源",
+    "permissions.previous": "上一页",
+    "permissions.next": "下一页",
+    "permissions.loading": "正在读取模板…",
+    "permissions.empty": "没有匹配的模板。",
+    "permissions.retry": "重新读取",
     "tabs.jobs": "Job",
     "settings.section.jobs": "Job 与时间计划",
+    "jobs.builtinSync": "内置 Project 同步 · 仅安全快进",
+    "jobs.automatic": "自动同步偏好",
+    "jobs.syncEvery": "同步间隔（毫秒，最少 60000）",
+    "jobs.enabled": "开启",
+    "jobs.disabled": "关闭",
+    "jobs.result": "业务结果",
     "jobs.heading": "Job 与时间计划",
-    "jobs.help": "立即运行只新增一次执行，不改变周期；取消仅处理选中的 Run；停用计划阻止后续触发。操作使用当前 Operator 绑定。",
+    "jobs.help": "管理归属与执行目标独立。立即运行只接纳一次执行；关闭计划阻止后续触发。取消不证明业务或进程已经停止。全局管理不要求 Operator Session 在线，Task 管理保留现有权限校验。",
+    "jobs.executor": "执行方式",
+    "jobs.executionTask": "打开执行 Task",
+    "jobs.sourceJob": "创建来源 Job / Run",
+    "jobs.taskCategory": "任务分类",
+    "jobs.category.ordinary": "普通任务",
+    "jobs.category.job": "Job 执行任务",
+    "jobs.category.all": "全部任务",
+    "jobs.recentSuccess": "最近成功的 Run",
+    "jobs.diagnostics": "执行诊断",
+    "jobs.artifacts": "已登记固定产物",
+    "jobs.registeredOnly": "仅可读取已登记的准确归属、Run、commit、路径及摘要。引用图片也须独立登记。",
+    "jobs.inspectSaved": "检查已保存／未登记材料",
+    "jobs.register": "补登记准确产物",
+    "jobs.registerHelp": "补登记只发布已保存证据，不重跑业务；已保存但未登记的文件尚非正式结果。",
+    "jobs.cancelBoundary": "仅请求取消此准确 Run，不停止其执行 Task 或中断共享 Agent Session。请检查结果确认实际状态。",
+    "jobs.inspectSession": "检查 Job 自有 Session",
+    "jobs.stopSession": "请求停止选中 Session",
+    "jobs.newSession": "替换已停止 Session",
+    "jobs.sessionBoundary": "仅作用于此 Job 自有 Session。停止是清理请求；替换要求旧实例确已终止且输入已结算。两者都不会重放业务或删除证据。",
+    "jobs.stale": "刷新失败，保留内容来自上次观察，不代表实时成功。",
+    "jobs.unavailable": "选中的 Job 在此管理范围内不可用。",
     "jobs.details": "详情",
     "jobs.scope": "所属范围",
     "jobs.project": "目标 Project",
@@ -32,7 +105,7 @@ export const ZH_CN = {
     "jobs.unknown": "提交结果未知，不会重发。请先检查当前事实和原操作，再决定后续动作。",
     "jobs.empty": "此范围暂无 Job。创建定义不会立即执行。",
     "jobs.configuration": "执行配置",
-    "jobs.taskConfig": "仅 Task 可配置 shell：使用已登记的受管工作区、准确 Project HEAD 和 owner。命令与环境变量不得包含凭据；服务端校验范围和执行前提。",
+    "jobs.taskConfig": "使用已文档化的 shell、Task 委托或 Agent 配置。shell 要求准确受管工作区及 HEAD；新执行 Task 仍需独立激活。Agent 输入不扩展权限。禁止包含凭据；执行器类型不可改写。",
     "jobs.rebind": "保存 Project 刷新 Job 会显式绑定当前目录中的目标，但不会执行刷新。全局不开放任意 shell 命令。",
     "jobs.rule": "时间规则",
     "jobs.instant": "执行时间／周期锚点（带 UTC 偏移的 ISO 时间）",

package/dist/web/assets/client/index.js

@@ -61,6 +61,7 @@ import { TASK_VIEW_SCRIPT } from "./app/taskView.js";
 import { SETTINGS_SCRIPT } from "./app/settings.js";
 import { SKILLS_SCRIPT } from "./views/skills.js";
 import { JOBS_SCRIPT } from "./views/jobs.js";
+import { PERMISSIONS_SCRIPT } from "./views/permissions.js";
 import { MODELS_VIEW_SCRIPT } from "./views/models.js";
 import { MODELS_SCRIPT } from "./app/models.js";
 import { MANAGE_SHELL_SCRIPT } from "./layout/manageShell.js";
@@ -69,6 +70,7 @@ export { APP_SCRIPT } from "./app/main.js";
 export const CLIENT_MODULES = Object.freeze({
     "views/skills": SKILLS_SCRIPT,
     "views/jobs": JOBS_SCRIPT,
+    "views/permissions": PERMISSIONS_SCRIPT,
     "views/models": MODELS_VIEW_SCRIPT,
     "lib/dom": DOM_SCRIPT,
     "lib/format": FORMAT_SCRIPT,

package/dist/web/assets/client/layout/manageShell.js

@@ -21,9 +21,16 @@ export function readManageRoute(url) {
   const section = (SECTIONS[area].find(item => item.section === requested) ||
     (area === "models" && requested === "connection" ? SECTIONS.settings.at(-1) : SECTIONS[area][0])).section;
   return { page: section === "connection" ? "models" : area, section,
+    ...(section === "jobs" ? { job: url.searchParams.get("job"), jobRun: url.searchParams.get("jobRun"),
+      artifact: url.searchParams.get("artifact") } : {}),
     source: url.searchParams.get("source") === "command-code" ? "command-code" : "factory" };
 }
 export function manageHref(next) {
+  if (next.section === "jobs") {
+    const query = new URLSearchParams();
+    for (const key of ["job", "jobRun", "artifact"]) if (next[key]) query.set(key, next[key]);
+    return "/settings/jobs" + (query.size ? "?" + query : "");
+  }
   return "/" + manageArea(next.page, next.section) + "/" + next.section +
     (next.section === "quota" && next.source === "command-code" ? "?source=command-code" : "");
 }
@@ -81,6 +88,8 @@ export function startManagement() {
     if (!link || link.target || link.hasAttribute("download") || event.defaultPrevented ||
       event.button > 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
     const url = new URL(link.href);
+    // Exact Job/Run links initialize a new pinned view, not just a section switch.
+    if (url.searchParams.has("job")) return;
     if (url.origin !== location.origin || !/^\/(models|settings)(\/|$)/.test(url.pathname)) return;
     event.preventDefault();
     navigateManage(readManageRoute(url));

package/dist/web/assets/client/layout/router.js

@@ -23,6 +23,7 @@ export function syncUrl(state, replace) {
   if (state.query) params.set("q", state.query); else params.delete("q");
   if (state.attentionFilter) params.set("attention", state.attentionFilter); else params.delete("attention");
   if (state.catalogAll) params.set("all", "true"); else params.delete("all");
+  if (state.source && state.source !== "ordinary") params.set("source", state.source); else params.delete("source");
   applyUrl(params, replace);
 }