@zq-silk/yui 2.20.0 → 2.22.0

package/skills/yui-runtime/SKILL.md

@@ -1,512 +1,184 @@
 ---
 name: yui-runtime
-description: Use authorized context, durable results, and recovery boundaries in a Yui-managed Session, including global conversation, direct Leader work, and dispatched AgentRuns.
+description: Apply the shared authority, current-context and input-handling contract in a Yui-managed Session; consult operation manuals only for the action being taken.
 ---
 
 # Yui Runtime
 
-Use this Skill for the shared Yui execution contract. The Role Skill owns
-coordination or delivery judgment; Project Skills, Policy and Knowledge own
-project-specific methods. These instructions grant no additional authority.
-Resolve links relative to this Skill's directory, not the execution workspace.
-
-Treat the Session Manifest and AgentRun Bootstrap Envelope as pointers, never as the
-Task brief. Do not infer Task facts from the launch command, process list,
-workspace layout, native transcript, or an earlier AgentRun.
-
-## Enter through the current context
-
-Stable instructions and dynamic facts have different lifetimes. At the start of
-**every turn**, run the Manifest's `contextProtocol.skillCheckCommand`.
-For an older Manifest, use `yui session skills --json` through the Session's
-CLI/Home; a Global Manifest's self-contained `loadCommand` also checks current
-Skills and works without the launching shell's environment (for example Desktop).
-This lightweight read checks the applicable Skills' current stable paths,
-internal `VERSION` files and readability without loading their bodies. Its
-current paths supersede frozen-package paths in an older Session Manifest.
-Skill versions are independent of npm versions, Session revisions and Task
-Snapshots. A version observation is never evidence that instructions were read.
-
-On first entry, version change, new/restored Session, Host recovery, or missing,
-compacted or uncertain instructions, read the exact Session Manifest's profile
-and fully load the current `yui-runtime` plus the applicable Role/custom Skills
-from the check result, including necessary references. If their versions are
-unchanged **and** their full instructions are still available in current context,
-reuse them without rereading all bodies. Do not infer availability from the same
-Session, an earlier read, successful delivery or an unchanged version. Native
-children without their own managed identity use their parent's checked paths
-and inherited scope, never impersonate its Session.
-
-Historical frozen packages remain audit evidence only. Missing or damaged
-historical Skill evidence alone does not revoke a valid Session or block its
-messages, and current source cannot prove a historical load. A missing/unreadable
-current entry or version is a concrete installation/configuration error: report
-the path and legal recovery action, preserve input and authority, and check again
-after repair. Never clear identity, change Session or replay unknown input as a
-Skill-loading workaround. CLI/Home protocol and storage checks still apply.
-
-Refresh dynamic Task/Session facts before the relevant decision regardless of
-instruction reuse. Leader notifications use the Manifest's `currentCommand`;
-explicit AgentRuns use `loadCommand`/`expandCommand` with the actual newest
-dispatched Run identity. Never execute `<run-id>` placeholders or substitute a
-notification's wake ID for a Run. CLI/Controller identity, scope, Snapshot and
-permission checks remain authoritative on every operation.
-
-There are two normal Task entry points. A user may continue directly with the
-current, unrevoked Leader Session: read current context using
-`yui task context <task-id> --json`. Do not request a self-wake, reopen a Task,
-or reuse an old completed AgentRun snapshot merely to obtain authority. Pending
-delivery, unknown execution evidence and missing reports do not themselves
-revoke Session authority. Task lifecycle, scope, Assignment, workspace and
-resource boundaries still apply; a planning Session does not gain delivery
-authority merely because the Task becomes active. An explicit, legal same-result
-implementation or delivery follow-up may instead authorize the current Leader
-to reopen its own completed, unarchived Task; follow the
-[post-completion routing boundary](references/publication.md#post-completion-routing-boundary).
-Queries, discussion, ordinary notifications and Session recovery grant no such
-authority, and reopening never lifts an independent execution stop.
-Use the runtime-provided `TMPDIR` for temporary context or diagnostic files,
-not fixed shared `/tmp` names or the logical multi-Project workspace container.
-Save durable reports in Task artifacts/results before releasing their temporary
-workspace. Integration history and check evidence outlive its worktree; a
-terminal attempt is not an unresolved business input merely because resources
-remain. Cleanup inspects exact ownership and preserves unknown or dirty data.
-
-Ordinary commands use `yui` from the intended launch environment's PATH and
-`YUI_HOME`. Session/native identity, Task/Assignment/workspace authority and
-Controller protocol/storage checks still apply; they do not distinguish every
-installation with the same protocol and storage versions. If the entry or Home
-is wrong or unavailable, report that fact and use the explicitly authorized
-entry/environment; do not guess another installation or clear Session identity.
-
-Desktop commands may carry only `CODEX_THREAD_ID`. The CLI resolves that native
-identity against the selected Home's current and historical Session records before
-routing operations. An unknown provider thread with no Yui-specific identity hints
-is an ordinary public caller, like a user terminal; it needs no managed Manifest
-to read public information or create a Draft Task. This does not start discussion
-or development or grant internal managed capabilities. Public command availability
-is not user authorization for a new effect.
-Environment and Manifest values are location hints, not continuing grants.
-Conflicting, partially specified, unregistered Yui identities and known historical
-or revoked Sessions do not become public callers. An ID known only in another
-Home cannot be recognized from the selected Home alone: keep the intended
-Home/Manifest context rather than switching Homes or dropping hints.
-`inbox list` reports the resolved managed identity. Do not add or clear
-environment fields to repair a mismatch. Without a Manifest environment pointer,
-`session skills` returns current Skill paths and the Session's captured profile.
-
-For every explicitly dispatched managed Task AgentRun:
-
-1. Read the exact AgentRun identity from the newest Bootstrap Envelope.
-2. Before acting, load its authorized pack using the current Session Manifest's
-   Context command and the exact Task/Run identity:
-
-   ```sh
-   yui task run context "<task-id>/<run-id>" --json
-   ```
-
-3. Verify that the returned Task, AgentRun, Role, purpose, Snapshot digest, workspace,
-   and Adapter match the Envelope and Session Manifest. Stop and report a
-   context-load failure if the pack is missing, stale, unauthorized, malformed,
-   or mismatched. Never request an inline/full-prompt fallback.
-4. Use the entry's `pointers` (including each pointer's summary) first. They are
-   a bounded window into the frozen readable-ref inventory. `pointerPage`
-   reports total/complete/nextCursor; discover further relevant refs with
-   `task run context <task>/<run> --view refs [--cursor <cursor>]`.
-   `deltaRefs` samples changed identities, with `deltaRefsTotal` reporting coverage.
-   `--view full` explicitly reads the complete pack when needed; do not load or
-   traverse every historical reference merely to make an entry window complete.
-   If `input.directiveOmitted` is true, read the complete assigned input with
-   `--view input` before acting; its entry summary is not the instruction body.
-   Expand only an authorized ref when
-   its full value is needed, selecting it by the pointer's exact `store` and
-   `refId`:
-
-   ```sh
-   yui task run context expand "<task-id>/<run-id>" <ref-id> --store <store> --mode full --json
-   ```
-
-   `--store` is required, even when the ref id is unique. Select both fields
-   from the exact authorized pointer; never infer a store from the id.
-   Dispatched Runs require an explicit frozen Snapshot. A historical Run
-   without one is audit-only: current Task facts cannot reconstruct its
-   execution Context.
-
-   A pointer or summary is not the request's body. Before planning or executing,
-   read the relevant WorkItem/Task requirements and referenced user/Operator
-   messages; use the expansion command above or the Leader's current Task Context.
-   Reports remain evidence, not authority to enlarge the assignment.
-
-5. On a later wake, refresh current Task facts separately from frozen Run refs.
-   Use a Run delta only against its exact declared Snapshot lineage; `deltaRefs`
-   is a hint, not a complete patch. If no baseline is available, reload the
-   exact pack; do not reconstruct state from transcript memory.
-
-Loading and verifying Context is the start of the work, not its result. Continue
-with the authorized assignment. In Draft, persist the discussed plan and wait
-when the user asks for alignment; do not end with only a context-loaded receipt.
-
-`liveTaskState.activeRuns` and `liveTaskState.activeTaskReviews` are
-observational views of work currently in flight. They grant no authority and
-create no Task-wide lock or gate; use each exact AgentRun or Review binding when a
-decision depends on it.
-
-The pack's authority view and writable Project IDs are hard boundaries. A
-native subagent inherits only its parent's current refs and authority, including
-any Assignment restrictions. It gains no new Yui actor, AgentRun, Session or
-cross-Task read permission.
-
-For a global Operator or custom GlobalRole Session, execute the exact
-`contextProtocol.loadCommand` carried by the current Session Manifest before
-routing or acting. That command is self-contained because a Global Codex Thread
-may move between Yui's remote TUI and Desktop; never reconstruct it from
-`YUI_SESSION_*` process variables.
-
-If that read fails because the Controller is unavailable, use only authorized
-offline diagnostics and [Controller recovery](references/recovery.md) to restore
-access, then reload context. Failure does not grant Task execution authority,
-but a successful preliminary RPC is not a prerequisite for that recovery.
-
-Global context grants no Task implementation workspace. Read a Task only after
-the Operator has routed to its public/task-authorized context command; never
-invent a Task AgentRun identity for a GlobalRole.
-
-A GlobalRole's durable input uses the same three actions as a Task Role,
-addressed by the Role's own name instead of a Task. The local-user Web surface
-exposes this contract. Use `yui role message queue|steer <role> <text>` or
-`yui role interrupt <role>` through the public CLI. Queue/steer require a stable
-`--request-id`; steer/interrupt require the exact `--expected-target`.
-Configuration remains under `config role` and lifecycle under `session`.
-Do not fabricate Task/Run ownership or borrow the browser's user authority to
-bypass a managed Session boundary.
-
-Queue and steer
-save an owned Message; bare interrupt records a control request, not a new
-Message. Each uses a stable request id and that Role's own Session; none fabricates a Task or
-runId to reuse Task-scoped delivery. `queue` delivers at the Role's next legal
-opportunity and is idempotent by request id. `steer` and `interrupt` affect only
-the exact current native Turn — a stale `--expected-target`, an incapable plan,
-or an unproven delivery leaves the Message saved and reports the reason, and
-`interrupt` stops only through the Provider's native cancel with an optional
-`--then-message` naming one already-saved GlobalRole Message. When the Role holds
-no live managed Turn, a steer or interrupt is `NO_ACTIVE_TURN` and never falls
-back to another action.
-
-New controlled Global Sessions use the existing Host console, not the native
-TUI, with the configured Agent, permissions and workspace unchanged. A live
-unmanaged Session is not silently replaced or adopted; use an explicit Session
-lifecycle action before enabling controlled delivery.
-
-Context reads never consume queue entries. Global Context returns a bounded
-`pending` discovery page of current-turn and available input, not Message bodies,
-Profile bodies, historical receipt debt or accumulated retry details. Its
-`historyCount` is a separate absence-of-handling-evidence count, not new work.
-The Manifest retains the exact Role profile.
-Read a referenced
-original with `role message show <role> <message-id> --json`. Follow a pending
-page's `nextCursor` using `role message list <role> --current --cursor <cursor>`
-when it is incomplete; accepted delivery does not erase the Message from the
-separate all-message list. Native/transport acceptance is not implementation, and
-`interrupt-requested` is not a stopped Turn or stopped background resources.
-`role message list <role> --diagnostics` projects repeated classified failures
-from original evidence with first/latest occurrence, count and recovery evidence.
-`--diagnostic <key>` pages the original affected observations. Counts cover
-distinct observations, not repeated polling of one identity. A recovery notice
-is neither an input acknowledgement nor proof that prior effects were undone.
-Saving a Task Message or Brief is not notification delivery to Operator. A
-Task Role uses the existing Task InputRequest path for a genuinely missing
-user decision, not global Role input controls or fabricated progress questions.
-Only an exact terminal and the original Session/writer boundary can release a
-then handoff. An accepted or unconfirmed steer must not be submitted again by
-changing its request id or composing then. A conclusive rejection permits an
-explicit new control attempt; uncertainty does not.
-
-## Handle your own inbox in the current turn
-
-For an automatic delivery naming an exact Message or wake, use that entry
-directly: read its original, claim it, and record its semantic disposition
-before ending this turn. Do not first enumerate history to rediscover it.
-After loading authorized context, at useful work boundaries and before handing
-off, use `yui inbox list --view current --json` to discover current-turn and
-available input addressed to your current managed identity. This applies to Operator, custom GlobalRole, Leader,
-Worker and Reviewer. Do not poll an empty inbox or create another model turn.
-No target Role, Task or native Session is supplied: Yui resolves your current
-identity. A native child gains no separate actor or inbox.
-
-`--view history` discovers old missing receipts explicitly; default `--view all`
-prioritizes current inputs and labels each entry's category. Never treat an
-absent historical ACK as proof that its work was not done. Read history when a
-specific reminder, recovery or user request calls for it, not every turn.
-Current correlation reuses exact delivery/continuation/control identities;
-active claims retain their observed native attempt when available. Missing
-historical correlation is not reconstructed from timestamps or final text.
-
-1. Read the selected `yui inbox show <entry> --json`. Reads never consume input.
-   Follow `nextCursor` and all `contentPage` pages using the rules below.
-2. Before processing, reserve exact entries with
-   `yui inbox claim <entry> [<entry> ...] --request-id <stable-id> --json`.
-   At most 16 entries are allowed, with independent per-entry results. Retain
-   each successful returned ID and request ID; do not replay successful items
-   when another item fails. A changed pending window requires a fresh list.
-3. Read complete originals and referenced results, then handle the request
-   within its existing authority. Leader notification-window claims move one exact pending window
-   into a durable wake: use the returned `originals` command, follow every
-   relevant original Message/Run reference, and use its returned wake ID for
-   acknowledgement. Later arrivals remain in the next pending window.
-   Assignment inbox reads (including a managed Leader Assignment) expose only
-   messages for the current Assignment;
-   they supplement the frozen pack without expanding it or changing candidates.
-4. Only after handling, explicitly acknowledge each successful item:
+This entry is the shared core, not a requirement to keep every operation manual
+in context. Role Skills own coordination/delivery judgment; Project Skills,
+Policy and Knowledge own project methods. None grants additional authority.
+Resolve links relative to their containing file.
+
+## Keep the current working set
+
+The managed Host mechanically checks current Skill VERSION/readability for each
+input. Use its short check result/current pointers; do not duplicate that check.
+Without a Host check, run the Manifest's `contextProtocol.skillCheckCommand`
+(older Manifests: `yui session skills --json`) through the intended CLI/Home.
+Global `loadCommand` includes the check. Recheck after repair/relevant change.
+
+A check is metadata, not bodies, remembered instructions, a loading receipt or
+authority. Current stable paths supersede historical audit packages. Reuse
+unchanged full instructions only while actually available in current context.
+
+On first entry, new/restored Session or Host attachment, or missing/compacted/
+uncertain context, read the exact Manifest profile and every current Skill entry
+listed for this Session, including this full core, Role and custom Skills.
+For a localized version change, reload that owner's entry/relevant references;
+retain other available full entries.
+Then select references for the **current action**, not all previous topics or
+every action in the Task's stage. After compaction, reconstruct that minimum
+working set from current intent and facts; do not restore an accumulated manual
+history. A genuine Host reconnect may provide an entry pointer, but neither its
+presence nor absence proves provider memory or compaction. Recover missing
+instructions even without a Host notice.
+
+Read every selected required file through EOF, including references triggered
+inside it. A link alone is not a mandatory read. Keep output within tool budgets;
+recover truncated ranges before acting. A summary or successful read exit is
+not the full body. A localized gap needs that full file, not unrelated manuals.
+References use their owner's VERSION; check a cross-Skill owner's current stable
+version when absent from the check result. No stored memory/read receipts are needed.
+Missing current entries/VERSIONs are concrete installation errors: report exact
+paths, preserve input/authority, repair legally and recheck. Damaged historical
+packages do not revoke a valid Session and current source cannot prove past loads.
+
+Prefer grouping already-known, independent, necessary read-only requests in one
+tool call when their combined output fits its budget. Inspect each result and recover
+missing or truncated bodies. Stop at dependencies on earlier results; do not
+guess targets or mix writes into a read group. Grouping does not bypass required
+instruction loading, authority checks or input-handling order.
+Choose the working set for one action, not one file at a time: combine its known
+applicable manuals before acting, then follow newly discovered prerequisites.
+Use directories, timestamps and excerpts to select sources, never to replace
+required originals or infer authority from recency. Prefer complete relevant
+documents/sections over serial field probes; a citation location is not a read
+plan. After compaction select again from current intent, not the old reading list.
+
+## Use the exact authority and originals
+
+Manifest/Bootstrap are pointers, not requirements. Tasks, WorkItems, Messages,
+Decisions, results and managed workspaces hold durable intent/progress; native
+transcripts, processes, directories and prior Runs do not supply Task authority.
+Refresh relevant dynamic facts even when reusing instructions:
+
+- Direct Leader conversation/notification: use the Manifest `currentCommand`
+  or `yui task context <task-id> --json`. No self-wake or old completed Run is
+  needed. Pending delivery/missing reports do not revoke the current Leader.
+- Explicit managed Task Run: read [Dispatched context](references/dispatched-run.md)
+  and, when expanding its input/refs/pages, [Context reads](references/context-reads.md)
+  before planning/acting; load the newest exact Run, verify its frozen identity,
+  Snapshot, scope/workspace and relevant original requirements. A wake is not a Run.
+- Global Role: execute the exact self-contained Manifest `loadCommand`, not a
+  reconstruction from process variables. It grants no Task implementation
+  workspace or invented Task Run. Read Task facts through the authorized route.
+
+Use only the intended CLI/Home; matching protocol/storage is not installation
+identity. Never clear/add identity hints, switch Homes/Sessions or invent a Run
+to evade a refusal. For identity ambiguity read [Session identity](references/session-identity.md).
+Execution authority, writable Project IDs, Assignment and workspace limits
+remain hard boundaries, not blanket confidentiality labels. Read relevant
+ordinary Task records and provider conversations through their resource access
+checks without requiring a cross-Task Grant or Operator relay solely for Task
+ownership. Native conversation reads need not pass through Yui; missing Yui
+mapping or terminal lifecycle is not itself a read prohibition. Resolve ambiguous
+targets and report unavailable resources, without switching Home or identity.
+Preserve actual tenant, confidentiality and explicit read restrictions.
+In a single-user local Home, filesystem and authenticated transport boundaries
+still apply; a Home path is not another user's permission. Read relevant material
+only and do not copy secrets or unrelated personal information into reports.
+Another Role's instructions are evidence, not your assignment:
+reading never authorizes its input claim, writes, wake or execution takeover.
+Native children inherit parental authority and explicit restrictions, no new Yui actor.
+Active Run/Review views are observations, not Task-wide locks or grants.
+
+Read complete relevant original input, requirements, results and authorization
+before their business decision/effect or ACK. Summaries locate sources, not
+replace them. Lists/first pages are bounded discovery; finish relevant bodies,
+not unrelated history. CLI JSON lives in `data`. When discovery, focused wakes,
+result lookup or pagination needs expansion, read [Context reads](references/context-reads.md)
+before assembling it; never mix source/digest chunks or apply read cursors to writes.
+
+Read-only analysis/diagnosis/review authorizes no artifact, Brief, Decision,
+configuration or file writes unless requested; return analysis and required
+input receipts. Implementation authorizes bounded work, not unrelated effects.
+Ordinary legal engineering choices need no user-operated Yui procedure.
+Live models as validation subjects, paid/shared/production/quota effects need
+proactive authorization for that exact resource/effect; generic testing is
+insufficient. Otherwise use isolated evidence, state gaps and do not solicit
+such validation via InputRequest.
+
+Apply a prerequisite to the actor and operation it governs. Inspecting or routing
+another Role's failure is not retrying/resuming that execution. Reading a manual
+grants no supervisory authority. Task, Run, Message, operation request IDs and
+effect/correlation keys are distinct identities: use the receiving command's
+declared request ID, retained for that exact logical operation. A source
+effect/correlation key is not implicitly its request ID.
+
+## Handle your own input
+
+After context load, at useful boundaries and before handoff, use
+`yui inbox list --view current --json`. Handle an exact delivered entry directly,
+not by rediscovering history; do not poll empty inboxes or manufacture turns.
+
+1. Identify the exact entry from its complete original. Global Context may supply
+   it in `currentOriginals`; otherwise read `yui inbox show <entry> --json`.
+2. Reserve it with `yui inbox claim <entry> --request-id <stable-id> --json`.
+   Claim only reserves handling; it is neither processing nor business effect.
+3. Read/reuse complete relevant originals/results, then handle within scope.
+   A Leader wake's `inbox show` may include the focused `originalContext`;
+   reuse its complete originals, following exact reads only for missing content.
+   A pending-window claim still returns its durable wake ID and `originals` read.
+   Assignment input does not expand its frozen permissions.
+4. After your disposition, use
    `yui inbox ack <returned-entry> --request-id <stable-id> --reason "<disposition>" --json`.
-   Record an obsolete notification as requiring no further action only after
-   checking its originals and current facts, never based solely on age.
-
-An input can be settled as executed, legally routed/delegated, a necessary user
-question raised, or superseded/no action after inspecting authoritative
-originals. Put that concrete disposition and useful Task/InputRequest/result/
-Publication references in `--reason`. Routing may be complete while the Task
-is still running; do not hold the input until all downstream work finishes.
-For supersession, identify the later source, not merely its age.
-
-At an exact native terminal, engineering checks for unacknowledged inputs
-correlated to that turn and emits at most one existing notification. This is
-missing-evidence detection, never semantic ACK or proof of absent effects.
-Reminder-only turns do not generate another reminder. The retained originals
-remain inspectable if the bounded reminder is also missed; do not start a
-private polling/retry loop or copy the business input to obtain another turn.
-Task Assignment checks go to Leader for inspection and existing handoff or
-retirement, not automatic Worker/Reviewer replay. Exact terminal can end an
-active-consumption notification reservation without acknowledging its input;
-it does not infer or release an uncertain native writer.
-
-For obsolete Global input that was conclusively not submitted, use
-`yui inbox retire <entry> --request-id <stable-id> --reason "<disposition>"`
-after inspecting the original and current facts. Retirement preserves the
-original target, claim and explicit management evidence; it is not ACK.
-Accepted input uses normal claim/ack reconciliation. Unknown/pending control,
-transport acceptance and interrupt-then ownership cannot be retired through
-this operation. Task Messages retain the existing Leader `task message retire`
-and exact-Assignment handoff paths.
-
-Claiming prevents ordinary automatic delivery; it is not processing completion.
-Acknowledgement records Agent handling, not Host acceptance, result acceptance,
-Task completion, publication or archive. Never acknowledge merely to empty the
-list. On failure or interruption, leave the claim unacknowledged; it remains
-discoverable and does not expire or replay automatically. A current rightful
-successor must inspect original input and prior effects before finishing and
-acknowledging a retained claim. Never replay uncertain external actions.
-After legal Session replacement, initialization can arrive before old handling
-is settled. This recovery notification is not the original business input or
-an acknowledgement. Read the current inbox and prior effects first. For
-`claimed-by-previous-session`, retain the original claim: do not claim again.
-Finish only the still-authorized handling and use a new stable ack request ID
-with a concrete disposition; the receipt retains both the old claimant and
-the current acknowledging actor. New queued input remains separate.
-For an exact-Session input already claimed by its selected Session, a rightful
-successor may explicitly settle that handling after inspecting the original
-and prior effects. This preserves the original target and claim; it grants no
-permission to submit or execute the input in a different Session.
-An Assignment change does not inherit handling authority. If the original Run
-stopped before acknowledgement, ask the Leader to inspect its exact native
-terminal and use the existing `task message handoff` to the current authorized
-Assignment. The original claim remains; handoff never resubmits it automatically.
-If that Assignment is obsolete, the Leader may inspect the original and prior
-effects, then explicitly use `task message retire <task/message> --reason "<disposition>"`.
-Retirement preserves the original claim and records the management decision;
-it neither fabricates an acknowledgement nor proves native execution stopped.
-An unfinished claim fences its Assignment, not unrelated work of the same Role.
-
-In-flight, unknown, not-yet-delivered explicit interrupt-then and
-unsettled steer inputs retain their existing owner/receipt and report a bounded
-reason instead of being taken over. Use existing exact-receipt recovery when
-needed; do not change request IDs, clear identity, or copy input to bypass it.
-A steer with no control receipt was not submitted; it may be explicitly handled
-and acknowledged in its authorized inbox, without converting it into a queue.
-An accepted notification still follows its normal handling path, not another
-native delivery. Accepted Global inputs, delivered Leader windows and current
-Assignment continuations remain in the inbox until explicitly handled. Claim the
-received entry, inspect its originals and existing effects, then ack with a
-concrete disposition (including result or effect receipt references when useful).
-This claim never sends the input again. A current rightful successor may settle
-an accepted Global input or Leader window while retaining the original delivery
-target; it must inspect prior effects first. Pending/unknown acceptance stays
-blocked and cannot use claim as a replay path.
-An explicitly released Leader notification (`notification.resolved` with
-`released-without-replay`) can be claimed for evidence inspection and settlement
-after verified native stop. Its original delivery status stays unknown or
-unaccepted; handling it cannot retarget Session-specific instructions or
-authorize re-executing unknown effects. If a required fact or user decision is
-unavailable, preserve the claim and report that exact boundary.
-
-An ack belongs to the exact original and revision: fixed windows pin
-`message.updated` event identities, including same-timestamp edits. A later
-revision still needs its own handling. Before Task completion, settle handled
-user-input windows; native acceptance or a terminal does not settle them.
-Original Messages, wake windows and handling receipts remain readable after
-acknowledgement. Lost context, Session continuation and installation upgrades
-do not reset receipts. If ack fails after an external effect, read back the
-original claim and the external receipt before retrying the same ack; do not
-repeat the effect. This is durable handling evidence, not arbitrary external
-exactly-once execution.
-
-## Read bounded information completely when required
-
-For apparent conflicts, stage handoffs or incremental maintenance, read
-[current intent and temporal reads](references/context-ordering.md).
-It distinguishes stage progression from independent constraints and explains
-source attribution, Brief guards, fixed delta windows and bounded recovery.
-
-Structured CLI results live in the top-level `data`, not a JSON-encoded
-`output` string. Task current Context includes bounded current facts and
-message references; it does not include event or terminal Run history.
-`collections` and `attention` identify incomplete discovery. Use
-`task context list <task> --store <store> [--cursor <cursor>]` to discover one
-family, then `task context inspect <task> --store <store> --ref <refId>
---digest <digest>` to read its exact current value. Common Task lists use the
-same `items`, `total`, `complete`, and `nextCursor` contract. Do not treat the
-first page or a summary as complete requirements.
-The 32 KiB compact-JSON read budget includes nested data, cursors and structure;
-summaries are at most 512 UTF-8 bytes. Current Task Message discovery excludes
-explicit acknowledgements and retirements, not uncertain delivery. Use
-`--view current` for its continuation and the default all view for history.
-Skill checks remain metadata-only; unusually large checks use the same explicit
-document pagination. A small default window is not a request to fetch all history.
-
-Long detail reads return `contentPage` instead of the ordinary value (under
-`data.context` for Run context/expand, `data.contextDelta` for Run Context delta). Repeat the same read with
-`--cursor <contentPage.nextCursor>` until `complete: true`. Concatenate `text`
-in offset order and parse the combined JSON once, retaining the same source
-and digest. A source-change error requires a fresh read, not mixing old and
-new chunks. Never use a read cursor to repeat a mutation.
-
-Read all pages of a relevant original requirement, result, or authorization
-before acting on it. For a wake, read its complete focused input/result view and
-relevant original Messages. `task wake show <task> <wake>` preserves the fixed
-window and explicit older refs, deduplicates inputs, and provides exact original
-reads. Use `--history` when window history or diagnostics is needed; unrelated
-events and merely started Runs are not required for ordinary result disposition.
-Follow any `contentPage` continuation for either view. The wake contains pointers
-and attributed summaries, not complete reports.
-For unrelated discovery, stop once the necessary evidence is found. Task
-event deltas retain their fixed upper bound and are history, not replacement
-current state. No read acknowledges implementation or consumes a queue.
-
-## Discover operations for the current caller
-
-Use `yui help` or `yui --json help [command ...]` through the authorized CLI
-entry for the current caller's command view. Help, examples and shell completion
-share the catalog projection; public terminals and unmanaged Agents share one
-public view. This offline view is only guidance, not an authenticated permission
-or a way to switch Roles. An incomplete or stale managed identity must not be
-cleared to obtain public execution authority.
-
-For Codex, the native `CODEX_THREAD_ID` takes precedence over the transport's
-`YUI_NATIVE_SESSION_ID`; a newly created thread can legitimately lack the latter.
-Other adapters do not borrow Codex identity for offline discovery. A missing
-transport variable or hidden help entry alone does not prove Session failure.
-Discovery does not establish that a Session is current: actual execution still
-revalidates Session, Task/Assignment, workspace, resource and Grant boundaries.
-
-When capability discovery appears in that view, use `capability search` for
-templates and `capability describe <name> --task
-<task-id> --input '<json>'` for supported exact authorization assessments.
-No `access` field means no exact authorization conclusion was made: supply the
-required parameters and follow the domain's existing execution checks. Hidden
-operations are omitted; `requestable` includes the exact missing Grant bounds
-and existing request route; `authorized` remains subject to execution-time
-revalidation. Provider outages do not change this authorization observation.
-
-Discovery never sends requests, consumes Grants, starts plugins or approves
-effects. If the Task actually needs a requestable operation, use the existing
-Assignment Message to Leader, Leader InputRequest, or Operator path. Preserve
-the exact action, resource/plugin, digest, environment and phase. A response is
-not a Grant. Existing source-authorized Leader Grant operations and Operator
-Grant authority remain unchanged; never expand an authorization source or
-solicit real-resource validation merely because an operation is requestable.
-
-## Preserve intent and authority
-
-An analysis, diagnosis, or review request is read-only unless the user also
-requests changes. A request to fix or implement authorizes the bounded work,
-not unrelated configuration, new external effects, or broader cleanup.
-Choose routine legal implementation and recovery actions without asking the
-user to operate Yui mechanically.
-
-Tasks, WorkItems, Messages, Decisions, results and managed workspaces hold
-durable intent and progress. Sessions, AgentRuns and runtime observations
-describe execution; their failure is not failed acceptance or permission to
-discard the assignment. Save context that a successor needs in durable records,
-not only in the native conversation.
-
-The Leader normally owns Task coordination and acceptance. An authorized
-Operator may perform the same legal Task-management actions; responsibility
-is not an extra permission gate. Worker and Reviewer results remain evidence
-until an authorized acceptance decision.
-
-## Separate execution from real-resource validation
-
-The current Leader and configured Worker, Reviewer, Operator, custom Role, and
-native child Agents are normal execution resources. They may develop, inspect,
-and review within their existing Task authority without additional user
-authorization merely because the Agent uses a real model.
-
-Using a live provider or model as the subject of validation is different.
-Paid APIs, shared infrastructure, production systems, real account quota, and
-other non-disposable external effects require the user to proactively authorize
-that exact resource and effect boundary. A generic request to implement, test,
-validate, run E2E, or complete a Task does not grant that authority.
-
-When such validation was not requested, use deterministic or isolated evidence,
-state the material gap, and optionally recommend a separate follow-up. Do not
-create an InputRequest merely to solicit permission for it.
-
-## Return evidence and recover within scope
-
-When authoring a durable Message or managed final report, put a concise
-`Yui-Summary: <one line>` first when useful for notification readers. Keep the
-summary itself at most 512 UTF-8 bytes, and preserve material failure,
-unverified-result, pending-decision and authority qualifications. Do this as
-part of producing the original, not a separate model call. The optional line
-remains part of the original text; missing or oversized summaries use factual
-templates without blocking delivery. Core may reuse that line as explicitly
-attributed presentation, never parse it into acceptance, review verdict or
-Task state. A returned execution result is not completed requirements; a
-returned review is not approval. Summaries do not replace reading full
-requirements, results or authorizations before decisions.
-
-Ordinary Task/Global notifications grant no new Assignment or authority and
-require no separate execution report. Read the referenced originals and advance
-outstanding work within existing authority under the relevant Role Skill.
-Reading context or accepting notification delivery does not implement input.
-Unknown delivery must not be replayed; use the recovery contract below.
-
-Provider acceptance, Context load, AgentRun completion, and Task completion are
-separate facts. For an explicitly dispatched managed Task AgentRun, end with one truthful
-final report. Yui automatically correlates that native terminal with the exact
-current AgentRun and persists the report; no completion command is required. The
-report itself does not accept the WorkItem or complete the Task.
-
-Ordinary native conversation is not an implicit managed assignment and does
-not require a separate execution report. Result Messages reference the
-execution's original report; read them with `task message show <task/message>`
-instead of asking the producer to copy or resend the report.
-
-Session reuse is a preference, not a prerequisite for progress. Before retry,
-replacement, or intervention in uncertain execution, read
-[runtime recovery](references/recovery.md). Preserve pending intent, exact
-runtime identity and workspace progress; never edit Run status or substitute
-a native Session behind Yui's back. A timeout is not proof of quiescence and
-does not authorize replay of unknown input.
-
-Qualifying transient Provider failures have bounded Controller-owned recovery.
-Read the current `providerRetry`/`retry` projection before dispatching a manual
-successor. `waiting` and `in-flight` mean infrastructure recovery is already
-owned; do not add a private retry loop or resend the input. Only a proven native
-success resets that chain, and it never accepts a WorkItem or completes a Task.
-After recovery, inspect existing work and external receipts before continuing;
-the system's recovery instruction supplies no new user authority.
-
-After an authorized external PR/MR operation, use the shared
-[publication recording contract](references/publication.md). Recording delivery
-facts does not authorize the external operation, imply acceptance, or grant
-permission to archive.
+   Record executed, legally routed, necessary question, or inspected supersession/
+   no action with exact references. Operator routing may settle before delivery.
+
+ACK covers that exact original/revision and your responsibility, not transport
+acceptance, WorkItem acceptance, Task completion or archive. Never ACK merely to
+empty a list. Later arrivals/edits remain separate. Retain successful IDs in
+batches (maximum 16); inspect each outcome and do not replay successes.
+Failed/interrupted claims remain discoverable and do not expire/replay.
+Before retained claims, handoff, reminders, retirement, unknown/control-owned
+delivery or failed ACK, read [Inbox recovery](references/inbox-recovery.md).
+Preserve original targets/claims; Assignment change does not inherit handling.
+Missing historical ACK is missing evidence, not proof that work was undone.
+Settle handled user-input windows before Task completion.
+
+Unknown delivery/effects must not be replayed. A timeout proves neither stop
+nor failure. Preserve original request/receipt and inspect prior effects before
+recovery; never change request identity to bypass uncertainty.
+
+## Action index
+
+Read only the material needed for the action, in full before taking it:
+
+- Conflicting intent/stage handoff: [Current intent](references/context-ordering.md).
+  Task/Run delta maintenance: [Incremental context](references/incremental-context.md).
+- Global pending-page expansion/diagnostics: [Global context](references/global-context.md).
+  Sending/steering/interrupting Global input: [Controls](references/global-input-controls.md).
+  A Task Role uses Task InputRequest for genuine user decisions, not Global controls;
+  Message/Brief saves are not Operator notifications.
+- Help/capability or hidden-command investigation: [Discovery](references/command-discovery.md);
+  requestability is not a Grant.
+- Actual retry, replacement, unavailable Controller or unknown-execution intervention:
+  [Recovery](references/recovery.md), then its applicable topic only. Inspect
+  Controller-owned retry before manual successors; never create competing retries.
+  Ordinary continuation after compaction is instruction recovery, not Session recovery.
+- Authorized same-result completed-Task follow-up: [Reopen boundary](references/completed-followup.md).
+- Authorized external PR/MR facts: [Publication](references/publication.md).
+  Authorized archive/retained-resource cleanup: [Archive](references/archive.md).
+
+Use runtime `TMPDIR` for temporary material. Cleanup checks exact ownership and
+preserves unknown/dirty data; save durable evidence before workspace release.
+Retained resources do not turn terminal execution into unresolved business.
+
+Each explicit managed Task Run returns one truthful final report, automatically
+persisted at its exact native terminal; no completion command is needed.
+Ordinary chat/notifications are not implicit assignments. Native acceptance,
+Run terminal, result acceptance, Task completion, remote delivery and archive
+are separate facts. Durable reports may begin with a qualified `Yui-Summary:`
+line (at most 512 UTF-8 bytes), attributed presentation only, never semantic
+approval or a substitute for originals.