@zq-silk/yui 2.21.0 → 2.23.0

package/docs/roles-and-configuration.md

@@ -155,6 +155,23 @@ different contracts. Provider bypass does not grant writes to another Project.
 Managed workspace owner, exact Assignment and resource grants enforce Yui
 operations; broad native permissions are not an OS sandbox.
 
+Codex configured permissions can explicitly exclude automatic writable temp roots:
+`--sandbox workspace-write --exclude-tmpdir-env-var true --exclude-slash-tmp true`.
+Each exclusion accepts `true` or `false`; `--clear-exclude-tmpdir-env-var` and
+`--clear-exclude-slash-tmp` remove the respective override. Omission preserves
+native defaults, not an implicit exclusion. Both fields require an explicit
+`workspace-write` sandbox and reject other adapters or conflicting strategies.
+Managed launches compile them into per-thread `sandbox_workspace_write`
+configuration on start/resume, never shared-daemon defaults or account files.
+Ordinary interactive launches use equivalent invocation-local structured options.
+The mapping follows the native
+[configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference).
+These exclude automatic `$TMPDIR` and `/tmp` grants, not explicitly authorized
+writable roots within those paths. They do not establish read isolation or
+prevent effects through an authorized Controller RPC. Inspect the actual native
+receipt and validate enforcement in a separately authorized disposable fixture;
+accepting the configuration does not prove OS sandbox enforcement.
+
 A write-intent delivery Leader launched in its own Task-owned main workspace
 captures that workspace's bound writable Projects without needing an open
 WorkItem. Accepted results do not remove this direct-delivery scope. An explicit
@@ -236,12 +253,23 @@ yui config role show <global-role>
 yui config profile show <profile>
 yui task role add <task> <role> --profile <profile>
 yui task role show <task> <role>
+yui task role show <task> <role> --view full
 yui task role update <task> <role> --environment <preparation-id>
 yui task role update <task> <role> --managed-environment
 yui task role session inspect <task> <role>
 yui task role session new <task> <role> --reason "<why a fresh Session is useful>"
 ```
 
+`task role show` defaults to the complete desired Role configuration and its
+current recorded Session configuration, not historical Run snapshots. Recorded
+configuration and a retained control target are not live-state or stop evidence;
+use the returned status/session inspection commands for those questions.
+`--view full` retains the previous complete `role`, `sessions`, and `runs`
+document with bounded pagination. JSON consumers needing those historical
+fields must now request that view and retain it on cursor continuations.
+This changes the CLI default JSON view, not storage or the `task.role.show`
+configuration RPC used by the interactive wizard.
+
 The global query uses the calling process's default native context. Task-scoped
 queries use the Controller's native account environment and the selected Role
 configuration; they never forward the caller's credentials to another Provider.

package/docs/roles-and-configuration.zh-CN.md

@@ -125,6 +125,18 @@ Provider 权限策略、Profile 访问意图和 Project 写范围是不同的合
 不授予对另一个 Project 的写入。受管工作区 owner、精确 Assignment 和资源 grant
 落实 Yui 操作；宽泛的原生权限不是 OS 沙箱。
 
+Codex configured 权限可显式排除自动加入的可写临时目录：
+`--sandbox workspace-write --exclude-tmpdir-env-var true --exclude-slash-tmp true`。
+两项均接受 `true`/`false`；`--clear-exclude-tmpdir-env-var` 和
+`--clear-exclude-slash-tmp` 分别清除覆盖。省略时保留原生默认语义，不默认排除。
+两项都要求显式 `workspace-write`，其他 adapter 或冲突策略会被拒绝。
+受管 start/resume 编译到该 Thread 的 `sandbox_workspace_write`，不修改共享 daemon
+默认值或账户文件；普通交互启动使用等价的单次调用结构化选项。
+映射依据[原生配置参考](https://learn.chatgpt.com/docs/config-file/config-reference)。
+这只排除自动 `$TMPDIR`、`/tmp` 写授权，不排除位于其中且被显式授权的 writable root；
+也不证明读隔离或阻止合法 Controller RPC 的副作用。配置被接受不是 OS 沙箱生效证明；
+应检查原生回执，并在另行授权的可丢弃 fixture 内验证实际执行边界。
+
 以 write 意图在自己 Task-owned main 工作区启动的 delivery Leader，从该工作区
 捕获已绑定 Project 的写域，不要求存在 open WorkItem；已接受结果也不会移除这个
 直接交付写域。显式 Assignment（包括空写域）仍决定受派发执行的范围。
@@ -189,12 +201,21 @@ yui config role show <global-role>
 yui config profile show <profile>
 yui task role add <task> <role> --profile <profile>
 yui task role show <task> <role>
+yui task role show <task> <role> --view full
 yui task role update <task> <role> --environment <preparation-id>
 yui task role update <task> <role> --managed-environment
 yui task role session inspect <task> <role>
 yui task role session new <task> <role> --reason "<why a fresh Session is useful>"
 ```
 
+`task role show` 默认返回完整的期望 Role 配置及当前记录的 Session 配置，
+不再附带历史 Run 配置副本。记录配置和保留的控制目标不等于实时状态或停止
+证明；需要这些事实时使用返回的 status/session 检查入口。`--view full`
+保留原来的完整 `role`、`sessions`、`runs` 文档及有界分页。依赖这些历史
+字段的 JSON 消费者须显式选择 full，并在后续游标读取中保持同一视图。
+这是 CLI 默认 JSON 视图变更，不改变存储，也不改变交互配置向导使用的
+`task.role.show` 配置 RPC。
+
 全局查询使用调用进程的默认原生环境；Task 查询使用 Controller 的原生账户环境及
 所选 Role 配置，不把调用方的凭据转交给其他 Provider。省略 `--error` 查看当前期望
 配置；指定错误记录时，使用失败时保存的模型、工作区、profile/settings 选项，不受

package/docs/storage-baseline.md

@@ -2,7 +2,19 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.25. The 1.24 → 1.25 transition admits optional Role
+Current storage is 1.28. The 1.27 → 1.28 transition admits exact-identity native
+title effect receipts under `runtime/native-titles`. It does not infer historical
+title ownership, rename conversations, or change existing database payloads.
+Unconfirmed naming intents remain non-replayable across Host replacement.
+
+The 1.26 → 1.27 transition admits versioned Host-upgrade
+signals in the existing role-runtime mailbox. It adds no table, infers no past
+upgrade request, and preserves existing payloads. Drain receipts precede Host
+exit; a Controller restart resumes the exact request, not business input.
+The 1.25 → 1.26 transition admits optional Codex
+workspace-write temporary-directory exclusions without changing historical
+permission payloads. The published 1.24 → 1.25 transition remains unchanged
+and admits optional Role
 `instanceCode` and Session `generatedTitle` presentation fields without rewriting
 existing records. Untagged historical titles remain user-owned; no code or
 title provenance is inferred. The 1.23 → 1.24 transition adds transaction-maintained

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,11 @@
 
 # 存储基线 1.0
 
-当前存储为 1.25。1.24 → 1.25 增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+当前存储为 1.28。1.27 → 1.28 声明 `runtime/native-titles` 下绑定精确会话身份的原生标题意图与回执；迁移不认领历史标题、不改名、不改写既有数据库 payload。未确认改名意图在 Host 替换后也不得重放。
+
+1.26 → 1.27 允许现有 role-runtime mailbox 保存版本化 Host 升级信号，不新增表、不推断历史升级请求、不改写既有 payload。排空回执先于 Host 退出持久化；Controller 重启继续精确升级请求，不重放业务输入。
+
+1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
 同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
 
 1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。

package/docs/task-delivery.md

@@ -73,6 +73,13 @@ An existing merge/rebase/cherry-pick without the attempt's own progress receipt
 is not adopted from Git markers. Preserve the scene and choose explicit recovery;
 normal continuation uses the original receipt and never replays a completed step.
 
+If Git stopped but persisting the conflict failed, explicit `task integration
+continue` can resume that same operation when the original progress receipt,
+workspace, branch, source and Git metadata all match. This recovery requires a
+nonempty staged resolution with no unresolved, unstaged or untracked files.
+Ordinary re-entry does not authorize it; missing evidence still refuses recovery.
+It does not invent a conflict record, restart the source command or bypass checks.
+
 When checks are a DurableJob, the Integration retains that exact jobId while
 running. Once the Job settles, `task integration continue <task>/<integration>`
 consumes its result and performs the guarded finalization. Existing unsettled

package/docs/task-delivery.zh-CN.md

@@ -58,6 +58,11 @@ Integration 在候选 worktree 中套用固定来源提交，运行已配置的
 已有 merge/rebase/cherry-pick 若缺少原尝试的进度回执，不根据 Git 标记接管。
 保留现场并选择显式恢复；正常续作使用原回执，不重放已完成步骤。
 
+若 Git 已停止而保存冲突的事务失败，显式 `task integration continue` 可以继续
+同一次操作，但原进度回执、工作区、分支、来源和 Git 元数据必须全部匹配。
+此恢复要求非空且全部暂存的解决结果，无未解决、未暂存或未跟踪文件。
+普通重入不授权恢复；缺少证据仍拒绝。不伪造冲突记录、不重新发起来源命令，也不跳过检查。
+
 当检查是一个 DurableJob 时，Integration 在运行期间保留那个确切的 jobId。Job 结算
 后，`task integration continue <task>/<integration>` 消费其结果并执行带守卫的收尾。
 未结算的 Integration（包括冲突）仍阻止完成，不依赖 Agent 采用了什么执行顺序。

package/docs/testing/review-evaluation.md

@@ -48,8 +48,8 @@ outside this example's contract. The index is a navigation hint, not a finding
 or a claim that all paths were inspected.
 
 Keep evidence roles separate: that contract is the expectation;
-`scripts/review-eval/verify.mjs`'s E03 probes are executable references;
-only an actual `node scripts/review-eval/evaluate.mjs verify` invocation plus its
+`scripts/eval/review/verify.mjs`'s E03 probes are executable references;
+only an actual `node scripts/eval/review/evaluate.mjs verify` invocation plus its
 candidate commit, environment and output establishes a result. The probes use
 the two supplied modules for the counterexample, a one-page normal control,
 and a controlled wait followed by rejection to check pending/failure behavior.
@@ -65,7 +65,7 @@ inspection still covers the complete frozen candidate, not just these hints.
 
 ## Small development corpus
 
-`scripts/review-eval/` is an offline file tool, not a scheduler, model adapter or
+`scripts/eval/review/` is an offline file tool, not a scheduler, model adapter or
 new Core store. It never calls a provider. No historical Task cases or results
 are inputs. All eight examples are newly constructed from explicit contracts.
 
@@ -86,8 +86,8 @@ prove exhaustive correctness, independent authorship verification or Agent
 effectiveness. Additional valid findings require adjudication.
 
 ```sh
-node scripts/review-eval/evaluate.mjs verify
-node scripts/review-eval/evaluate.mjs export E03 basic /absolute/new-participant-directory
+node scripts/eval/review/evaluate.mjs verify
+node scripts/eval/review/evaluate.mjs export E03 basic /absolute/new-participant-directory
 ```
 
 Export uses an explicit projection of candidate source and requirements; indexed
@@ -112,8 +112,8 @@ does not fabricate a holdout or claim one has been evaluated.
 ## Freeze a comparison before running it
 
 ```sh
-node scripts/review-eval/evaluate.mjs plan protocol.json
-node scripts/review-eval/evaluate.mjs score plan.json records.json
+node scripts/eval/review/evaluate.mjs plan protocol.json
+node scripts/eval/review/evaluate.mjs score plan.json records.json
 ```
 
 Capture stdout as separate files using your normal artifact workflow. The

package/docs/testing/review-evaluation.zh-CN.md

@@ -36,8 +36,8 @@ E03 的契约要求原样传递不透明游标并按顺序返回条目。实际
 已累计条目不会作为成功结果返回。重试/并发修改不属于此例契约。
 索引只是定位提示，不是缺陷结论，也不声称已检查所有路径。
 
-分清证据身份：上述契约是预期；`scripts/review-eval/verify.mjs` 的 E03
-探针是可执行引用；只有实际运行 `node scripts/review-eval/evaluate.mjs verify`
+分清证据身份：上述契约是预期；`scripts/eval/review/verify.mjs` 的 E03
+探针是可执行引用；只有实际运行 `node scripts/eval/review/evaluate.mjs verify`
 并保留候选提交、环境和输出才构成结果。探针用给定的两个模块验证反例，
 提供单页正常对照，以及可控等待后拒绝的未完成/失败行为检查；
 不覆盖真实服务、崩溃恢复或 Reviewer 行为。
@@ -49,7 +49,7 @@ E03 的契约要求原样传递不透明游标并按顺序返回条目。实际
 
 ## 小型开发集
 
-`scripts/review-eval/` 是离线文件工具，不是调度器、模型适配器或新增 Core 存储。
+`scripts/eval/review/` 是离线文件工具，不是调度器、模型适配器或新增 Core 存储。
 它不调用 Provider，不以任何历史 Task 案例或结果为输入。八个题目均由明确契约新构造。
 
 | 案例 | 能力 | 形态 |
@@ -66,8 +66,8 @@ E03 的契约要求原样传递不透明游标并按顺序返回条目。实际
 这不证明穷尽正确性、独立出题核实或 Agent 效果。额外有效发现需要裁定。
 
 ```sh
-node scripts/review-eval/evaluate.mjs verify
-node scripts/review-eval/evaluate.mjs export E03 basic /absolute/new-participant-directory
+node scripts/eval/review/evaluate.mjs verify
+node scripts/eval/review/evaluate.mjs export E03 basic /absolute/new-participant-directory
 ```
 
 导出仅投影候选源码与要求；indexed 材料只增加导航索引。两组的必要契约与源码完全相同。
@@ -85,8 +85,8 @@ node scripts/review-eval/evaluate.mjs export E03 basic /absolute/new-participant
 ## 运行前固定比较协议
 
 ```sh
-node scripts/review-eval/evaluate.mjs plan protocol.json
-node scripts/review-eval/evaluate.mjs score plan.json records.json
+node scripts/eval/review/evaluate.mjs plan protocol.json
+node scripts/eval/review/evaluate.mjs score plan.json records.json
 ```
 
 按正常工件流程将 stdout 保存为单独文件。协议 JSON 包括非空

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.25 and its declared 1.0 through 1.24 minor
+The stable suite owns current storage 1.28 and its declared 1.0 through 1.27 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.25, exact schema/record validation, no initialization over
+1. Fresh storage 1.28, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
@@ -90,6 +90,49 @@ stable suite. Real-model or real-Home checks require explicit authorization.
 Current envelope checks reject arbitrary unknown fields, rather than maintaining
 a blacklist of retired field names.
 
+## Context evaluation checks
+
+Evaluation code is organized by topic under [scripts/eval](../../scripts/eval/README.md).
+Core evidence utilities and provider usage adapters are separate from the Yui
+context scenarios below and the independent review-material evaluation.
+
+The framework produces engineering measurements and objective check evidence;
+the executing Agent interprets actual trajectories, semantic quality, model
+variation and optimization benefit. Assemble related changes before a bounded
+representative experiment. Wording-only or small byte reductions normally need
+deterministic checks, not their own full A/B and model-review chains. Record the
+decision question and spending bounds in the experiment plan; independent model
+review is optional for material disputes, never automatic. This does not grant
+real-resource authorization.
+
+New runs freeze `decisionPolicy: agent-analysis`: process exit describes complete
+collection and released cleanup, not quality acceptance. Original check failures
+and unknowns remain in reports. Only bounded non-recovery business reading/load
+findings cease to censor later safe inputs; authority, effects, handling, identity,
+native execution and recovery fences remain. Historical exits and seals are not
+rewritten. See the framework README for exact boundaries and Agent handoff.
+
+`npm run eval:check` checks evaluation contracts without starting a Home.
+The explicit `npm run eval:context:wiring -- --product <absolute-checkout> --out <new-dir>`
+uses the [maintained framework](../../scripts/eval/context/README.md)
+for multi-input CLI/Controller/Host/fake-Provider chains and bounded fault checks.
+It remains outside `npm test` and the platform matrix: package smoke continues
+to own package/OS wiring. Fake success is not a real-model, native-compaction or
+lossless-observation claim. Historical performance ledgers are not reset by
+framework validation; live resources require a separately authorized freeze.
+The fake-only `native-normal` scenario verifies completed native tool evidence
+through the real adapter without participant files. Read/load checks are bound
+to Role/Thread/context epoch and decision time; unsupported evidence stays
+unknown. Current observation cannot yield an unqualified valid-pass.
+Proxy checks exercise both managed and identity-free detached control clients;
+detached transport cannot supply subject read/load evidence.
+The opt-in wiring `--profile recovery` checks a scheduled retained-claim
+Session replacement using the same native evidence adapter as real mode:
+exact predecessor stop, fresh successor ownership/read/load, preserved effect
+and successor ACK; a native background-inspection rejection fences replacement.
+It is deterministic CLI/Host wiring, not live model recovery or native
+compaction. Real `session-recovery` requires its own exact authorized freeze.
+
 ## Skill and instruction changes
 
 Review the shared Runtime contract and affected Role/Project Skills together.

package/docs/testing/verification-levels.zh-CN.md

@@ -39,12 +39,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.25 和明确声明的 1.0 至 1.24 连续小版本迁移，
+稳定套件维护当前存储 1.28 和明确声明的 1.0 至 1.27 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.24、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.28、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、
@@ -66,6 +66,25 @@ CI 每个作业只显式构建一次。
 真实模型或真实 Home 检查需要显式授权。
 当前记录按声明的字段集合拒绝未知字段，不维护退役字段名称黑名单。
 
+## 上下文评测检查
+
+评测代码按专题组织在 [scripts/eval](../../scripts/eval/README.md)：
+通用证据工具、Provider统计适配与下述Yui上下文场景分开；代码审查材料评测
+也是独立专题，不继承上下文场景的义务判定。
+
+`npm run eval:check` 不启动 Home，只检查评测契约。
+`npm run eval:context:wiring -- --product <绝对路径> --out <全新目录>` 显式运行
+[维护框架](../../scripts/eval/context/README.md)的多输入
+CLI/Controller/Host/fake Provider 闭环和有限故障验证。它不加入默认 `npm test`
+或平台矩阵；安装包与 OS wiring 仍由现有 package smoke 负责。
+fake 通过不证明真实模型、原生压缩或无损观测；框架验证不重置历史性能账本，
+真实资源需另行明确授权和冻结。
+fake 专用 `native-normal` 场景不写 participant 文件，经真实适配分支检查完成的
+native 工具证据；读取/加载限定 Role、Thread、上下文代次与决策时间。
+不支持的证据仍为 unknown；当前观测条件不能产生无保留 valid-pass。
+代理检查同时覆盖 managed 和无管理身份的 detached control；
+后者仅保留控制传输记录，不能提供主体原文/加载证据。
+
 ## Skill 与指令变更
 
 一并审阅共享的 Runtime 合同和受影响的 Role/Project Skill。用几个相关场景检查指令

package/i18n/README.zh-CN.md

@@ -392,6 +392,12 @@ Yui 默认将控制面数据保存在 `~/.yui`，通过 `YUI_HOME` 选择另一
 状态命令前执行该 launcher 的 `setup`。开发工具不管理全局安装，
 不要用全局 `yui` 验证本地修改。真实模型、付费或共享资源测试需要用户明确请求这些资源。
 
+按专题划分的评测及通用证据工具见[评测入口](../scripts/eval/README.md)：
+`npm run eval:check` 做快速离线契约检查；
+`npm run eval:context:wiring -- --product <产品绝对路径> --out <全新输出目录>`
+显式执行隔离 fake Provider 的 CLI/Controller/Host 完整链。它不默认加入核心测试，
+不证明真实模型效果；真实资源仍需另行精确授权，历史条件不重置。
+
 ## 社区与支持
 
 - 问题、缺陷与功能建议：提交

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.21.0",
+  "version": "2.23.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,