@zq-silk/yui 2.8.1 → 2.10.0

package/docs/schedules.md

@@ -0,0 +1,132 @@
+# Persistent time plans
+
+A Schedule answers **when** to admit a Run of an existing scoped Job. It owns
+the time rule and trigger progress, not the command, execution status or result.
+Immediate execution remains `job run`; manual Runs do not move a Schedule.
+All processing uses the existing Controller and the Job supervisor.
+
+## Public CLI and API
+
+```sh
+yui schedule create --global --schedule daily-probe --job probe \
+  --rule '{"kind":"cron","expression":"30 9 * * 1-5","timezone":"Asia/Shanghai"}'
+yui schedule list --global
+yui schedule show --global --schedule daily-probe
+yui schedule disable --global --schedule daily-probe --revision 1
+yui schedule enable --global --schedule daily-probe --revision 2
+yui schedule update --global --schedule daily-probe --revision 3 \
+  --rule '{"kind":"interval","anchor":"2026-10-17T00:00:00Z","everyMs":3600000}'
+```
+
+Create the referenced Job first using [the Job CLI](job-runs.md). Replace
+`--global` with `--task task-N` for a Task-owned Schedule. Global management
+requires a current authenticated Operator Session; Task callers cannot access
+global or other Tasks' plans. Assignment limits are checked against the Job
+on the server. A Project is a Job target, never an ownership scope.
+
+The Controller RPC is `schedule.control`. Its input is
+`{op,scope,caller,id?,jobId?,rule?,expectedRevision?}`. Supported `op` values
+are `create`, `list`, `show`, `update`, `enable`, `disable`. `scope` uses the
+Job `JobScope` contract. Trusted ingress must resolve/authenticate `caller`;
+client-supplied scope/identity is not authorization. `create` requires `id`,
+`jobId`, `rule`; all edits require the observed `expectedRevision`. `update`
+requires a complete rule and optionally changes `jobId` within the same scope,
+revalidating both old visibility and new execution authority. Scope is immutable.
+Rule updates retain enabled status only for an already enabled plan; all other
+states become disabled with the new future rule and require explicit enable.
+
+Create/edits return the Schedule; list returns visible Schedule records.
+Show returns `{schedule,lastSuccess}`. `lastSuccess` is the latest readable
+**succeeded JobRun** triggered by this Schedule under its current Job, or null.
+It is derived from Run history, never a separately writable Schedule field.
+Retargeting does not move or erase the old Job's Run history.
+
+## Time and trigger rules
+
+- Once: `{"kind":"once","at":"2026-10-17T08:00:00+08:00"}`. Creation and rule
+  replacement require a future instant with an explicit UTC offset.
+- Interval: `{"kind":"interval","anchor":"2026-10-17T00:00:00Z","everyMs":60000}`.
+  Minimum interval is 1000 ms. Occurrences are anchor + N × everyMs, N ≥ 0.
+  The next occurrence is strictly after creation/edit/enable time. Manual
+  execution and maintenance delays never shift the anchor.
+- Cron: five fields, explicit IANA timezone, `cron-parser` 5.10.2 semantics.
+  Random `H` is rejected. DST spring gaps move the nonexistent time forward
+  by the offset change; repeated fall local times select the earlier instance
+  once. For example New York 02:30 on March 8, 2026 becomes 03:30 (07:30Z);
+  01:30 on November 1 selects 05:30Z, with the next daily occurrence November 2
+  at 06:30Z. This deliberately uses the parser's policy, not a custom
+  “skip gap / both folds” enumerator.
+
+`nextDue` is persisted as UTC. Each Controller reconciliation admits at most
+one occurrence per selected Schedule, with at most 100 due Schedules per pass.
+Plans are ordered by oldest attempt to prevent blocked once plans starving
+others. This is maintenance-resolution scheduling, not a real-time timer:
+actual admission can lag the due instant by Controller load/reconciliation
+interval. No independent daemon or per-plan timer is created.
+
+After downtime, the earliest pending occurrence represents the coalesced
+work; the next occurrence is strictly after the current clock/high-water fence.
+There is no historical catch-up queue. A persisted UTC `processedThrough`
+prevents clock rollback or rule edits from replaying old progress.
+Rule updates increase `generation`; enable retains it. The internal trigger
+key is `<schedule-id>:<generation>:<UTC-due>`, scoped to the Job.
+
+Admission and advancement commit in the same Store transaction. Repeated scans
+and Controller replacement retain the same Run and occurrence identity.
+The transaction never spawns. The supervisor starts committed Runs and
+preserves its existing unknown-effect and exact-process safeguards.
+This is not an exactly-once guarantee for external side effects.
+
+## State and authority
+
+`enabled` allows future admission; `disabled` is explicit user/Agent disposal
+of future intent; `completed` means a once occurrence was **admitted**, not that
+its Run succeeded; `needs-attention` preserves blocked intent; `retired` records
+Task terminal shutdown. Disabling does not cancel an already admitted Run,
+and cancelling a Run does not disable its Schedule.
+
+`lastAttempt` records `at`, `dueAt`, `outcome` (`admitted`, `overlap`, `blocked`),
+optional exact `runId`, and reason. An overlap Run is the occupying execution,
+not a successful execution of this occurrence. Recurring overlap skips that
+coalesced tick and advances; once overlap retains its original due instant and
+retries admission on a later pass without adding a queued Run.
+Failed Runs stay in Job history; the next recurring tick follows the same plan.
+
+Creation, update and enable capture the authenticated Session binding and Job
+revision. They do not grant execution to a replacement Session or a changed
+Job definition. Before each admission both are checked again, along with current
+Job/Task/workspace prerequisites. Revocation or a changed definition stops the
+plan as `needs-attention`; an authorized current manager must inspect and
+explicitly enable it. Controller restart alone does not revoke the binding.
+Worker-owned plans also retain the current Assignment boundary.
+
+Unclassified admission failures roll back, stop that plan, persist the reason
+and notify its Task Leader or global Operator via existing durable inboxes.
+No new recovery queue, lease or automatic retry protocol is introduced.
+
+Task stop marks enabled plans as needing attention; restarting execution alone
+does not silently reactivate them. Normal Task completion refuses unfulfilled
+enabled/blocked once plans: explicitly disable or fulfil them first. Repeating
+plans do not block completion and are atomically retired with the Task.
+Cancellation/archive retires enabled/blocked plans with their reason and
+history preserved. Existing active/unknown Runs retain all earlier lifecycle
+settlement guards. A reopened Task does not implicitly resume retired plans.
+
+## Storage and downstream integration
+
+Storage **1.9 → 1.10** appends `schedules`, keyed by `(scope_key,schedule_id)`,
+and its due index. Old Job/Run bytes and published baseline checksums remain
+unchanged. New Homes initialize 1.10; existing Homes require the centralized
+explicit upgrade path. No real Home migration or package release is implied.
+
+`src/schedule/schedule.ts` exports `Schedule`, `ScheduleRule`, time calculation
+and validation. `src/controller/scheduleControl.ts` owns management and bounded
+reconciliation; `admitJobRun` remains the only execution admission seam.
+Consumers should use RPC/service responses rather than write storage directly.
+
+Project refresh is a separate controlled Job action supplied by Task128.
+Schedule does not implement refresh or Knowledge maintenance. A refresh Job
+can use the same reference-only plan once that action is integrated and tested;
+this document alone is not evidence of that joint integration.
+InputRequest recommended-option deadlines, heartbeat, redelivery and other
+internal domain timers remain with their existing owners.

package/docs/storage-baseline.md

@@ -2,7 +2,37 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.8. The declared 1.7 → 1.8 transition permits an optional
+Current storage is 1.13. The 1.12 → 1.13 transition permits exact native attempt
+identity on new inbox claims, exact target identity on new steer controls,
+explicit Global inbox retirement and terminal handling-check evidence.
+It does not rewrite historical messages, infer old turn ownership or synthesize
+ACKs. SQL layout is unchanged. Current inputs and historical missing handling
+evidence have separate bounded discovery views; neither is a second queue.
+
+The 1.11 → 1.12 transition admits append-only
+`task.project-delivery-decided` events with Project requirement, reason, actor,
+original Message/digest/quote and the previous decision ID. Existing records and
+SQL layout are unchanged. No historical exclusions are inferred; absent decisions
+retain the required-delivery default. See [Project delivery scope](project-delivery-scope.md).
+
+The declared 1.10 → 1.11 transition adds source provenance
+to new activation-request event payloads: an existing Message/body digest or
+exact caller-attributed native input, plus the recorded Message boundary.
+Historical events are preserved without guessed sources or replay. Missing
+provenance is an explicit read diagnostic. SQL layout and frozen digests are
+unchanged; the centralized transition has no data rewrite.
+New Task Job status/result/cancellation/acknowledgement writes also append
+`job.state-changed` events atomically. Existing Job history is not backfilled.
+
+The 1.9 → 1.10 transition appends independent
+[Schedules](schedules.md) and their due index without rewriting Jobs or Runs.
+
+The declared 1.8 → 1.9 transition adds stable Job
+definitions and global Runs, and links each historical Task execution to its
+own definition while preserving exact IDs, artifacts and Integration references.
+Original Job payload bytes are archived. See [Job/Run contracts](job-runs.md).
+
+The declared 1.7 → 1.8 transition permits an optional
 Model management connection in Yui configuration. Only service addresses and
 file references are stored; no credentials are imported. Existing Homes remain
 unconfigured, and the SQL layout is unchanged.

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,31 @@
 
 # 存储基线 1.0
 
-当前存储为 1.8。1.7 → 1.8 允许在 Yui 配置中保存可选的 Model 管理连接，
+当前存储为 1.13。1.12 → 1.13 允许新 inbox claim 记录精确 native attempt、
+新 steer control 记录精确目标，以及 Global 输入显式退役和终态缺回执检查证据。
+不改写历史消息、不推断旧轮次归属、不补造 ACK；SQL 布局不变。
+当前输入和历史处理缺证据通过有界视图分别发现，不新增第二队列。
+
+1.11 → 1.12 允许追加 `task.project-delivery-decided` 事件，
+记录 Project 交付要求、原因、actor、原始 Message/digest/引用及前一决定 ID。
+SQL 布局和历史记录不变，不自动推断历史排除；没有决定时仍按需交付处理。
+详见 [Project 交付范围](project-delivery-scope.md)。
+
+1.10 → 1.11 为新 activation-request 事件增加来源证据：
+已有 Message 及正文 digest，或带调用者归属的原生输入原文，以及当时的 Message 序号边界。
+历史事件保持原样，不推测缺失来源、不重放输入；缺失来源通过读取诊断明确展示。
+SQL 布局及冻结 digest 不变，集中迁移不改写历史正文。
+新的 Task Job 状态、结果、取消请求及确认处置原子追加 `job.state-changed` 事件；
+不回填历史 Job 事件。
+
+1.9 → 1.10 追加独立 [Schedule](schedules.md) 表和到期索引，
+不改写历史 Job/Run，也不自动启用任何计划。
+
+1.8 → 1.9 新增稳定 Job 定义和 global Run；每条历史 Task 执行
+独立映射为定义，保留原执行 ID、产物与 Integration 精确引用，并归档原始 payload。
+详见 [Job/Run 契约](job-runs.md)。
+
+1.7 → 1.8 允许在 Yui 配置中保存可选的 Model 管理连接，
 仅保存服务地址及文件引用，不导入凭据；已有 Home 保持未配置，SQL 布局不变。
 
 1.6 → 1.7 为规范 Message 和 Leader wake 增加可选的 Agent

package/docs/task-delivery.md

@@ -208,8 +208,10 @@ Task Integration produced that exact candidate, pass its local ID with
 This records one Task event, not a new delivery status, Candidate lifecycle,
 Git operation, or permission to change completed work.
 
-`task publication verify` remains the explicit, authorized provider read. It
-records the remote source head, PR/MR state and merge commit independently of
+`task publication verify` accepts tool-neutral evidence with `--observation
+<json>`, or performs an explicit authorized provider read with the optional
+gh/glab adapter when that option is absent. Neither tool is mandatory.
+It records the remote source head, PR/MR state and merge commit independently of
 Task acceptance. A mismatched head or non-merged state is saved as **reported**,
 superseding earlier verification; provider errors or mismatched external identity
 write nothing. A merged provider observation verifies only that Publication's
@@ -218,6 +220,76 @@ Metadata/verification successors preserve adoption only through an uninterrupted
 same-candidate Publication lineage. Candidate or referenced Integration changes
 cannot silently reuse the decision.
 
+### Record a Leader's tool observation
+
+First `publication upsert` the owning Task's exact candidate, PR/MR URL and
+target branch. The Leader can inspect that object with any authorized CLI/API,
+interpret its result, and submit the following JSON using
+`task publication verify task-1/publication-1 --observation '<json>'`:
+
+```json
+{
+  "taskId": "task-1",
+  "publicationId": "publication-1",
+  "projectId": "project-1",
+  "provider": "gitlab",
+  "repository": "team/app",
+  "externalKind": "merge-request",
+  "externalId": "42",
+  "externalUrl": "https://forge.example/team/app/-/merge_requests/42",
+  "targetBranch": "main",
+  "localCommit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "state": "merged",
+  "headCommit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "remoteCommit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "observedAt": "2026-10-17T04:00:00.000Z",
+  "tool": "internal-cli",
+  "command": "internal-cli mr inspect team/app!42",
+  "output": "{\"iid\":42,\"state\":\"merged\",\"sha\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"merge_commit_sha\":\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\"}"
+}
+```
+
+Replace every example identity, SHA, timestamp and output with observed facts.
+`provider` describes the forge (GitHub PR or GitLab MR), not the tool brand.
+All fields shown are required for a merged observation; `remoteCommit` is optional
+for open/closed, and `mergedAt` is optional. Output must be a nonempty, sanitized
+relevant response excerpt, not credentials or just a conclusion; the whole JSON
+is limited to 64 KiB. Yui never executes `command` or parses arbitrary output into
+success. It trusts the authorized caller's inspection and checks exact identity,
+URL/service, target, candidate and timestamps.
+
+New evidence must refer to the current Publication, be no more than 24 hours
+old and not future-dated. Observation may precede initial bookkeeping or a
+title-only update. Immutable history supplies the lower time bound only when
+the candidate, object, target or remote facts materially changed; changing and
+restoring a candidate does not revive earlier evidence. After a title-only
+update, bind the same actual result to the current record ID without re-querying.
+An exact immediate retry returns the existing receipt without duplicating it;
+later changes cannot replay it. The full canonical JSON is kept in the existing
+opaque `evidence` text, with actor and record time on the immutable Publication.
+There is no new persistent format or migration; historical records remain valid.
+Once recorded, verification is a fixed observation, not live monitoring or a
+24-hour archive lease. Known later changes require a successor; failures and
+unknown results never assert a fresh success. URL/target/candidate changes reset
+verification, while title-only changes can retain it.
+GitHub repository URL comparison respects case-insensitive owner/name identity.
+GitLab browser routes are deployment-specific: standard `/-/merge_requests/`,
+legacy `/merge_requests/`, and custom service paths are allowed in both entry
+points. Identity comes from structured repository/MR evidence, not a URL path
+template. The complete registered URL must still match after URL parsing and
+removal of one trailing slash; HTTP(S) is required and credentials, query and
+fragment remain forbidden. The provider URL is retained, not rewritten to a
+guessed route. A successful HTTP response is not merge evidence.
+Adapter observations retain the observed target
+branch even when the earlier Publication did not specify one; missing targets
+cannot establish new verification.
+
+`upsert --verified` is now rejected: use this observation path or the optional
+adapter. No natural-language summary or bare flag verifies a merge. Existing
+verified records are not rewritten. Remote delivery and ordinary archive reuse
+sufficient exact evidence without another gh/glab read; acceptance, business
+settlement, stopped execution and safe resource cleanup remain independent.
+
 CLI, current Leader Context and Web derive coverage from these same facts, with
 no provider reads or evidence writes. They distinguish not delivered, merged
 but uncovered, covering merge not verified, partial delivery and verified merge.

package/docs/task-delivery.zh-CN.md

@@ -161,13 +161,51 @@ Review 时跳过刷新，该新鲜度字段为 null。重复完成不重新观
 `--integration <id>`，一并绑定其已提交证据。这只新增一个 Task 事件，不新增交付
 状态表、Candidate 生命周期或 Git 操作，也不授权修改已完成成果。
 
-`task publication verify` 仍是显式且须获授权的 provider 读取。它独立于 Task
+`task publication verify --observation '<json>'` 接受 Leader 通过任意获授权
+CLI/API 得到的精确工具证据；省略此选项时才使用可选 gh/glab 适配器执行 provider
+读取。不强制工具品牌，也不要求已充分核验的结果再用 gh/glab 重查。它独立于 Task
 验收，记录远端 source head、PR/MR 状态和 merge commit。head 不匹配或尚未合并时，
 保存为 **reported** 并取代旧验证；provider 错误或外部身份不匹配则不写任何证据。
 已合并的 provider 观察仅验证该 Publication 的精确本地候选；squash 不需要伪造
 提交祖先关系。元数据/验证更新只有沿连续同候选的 Publication 血缘才能继承采用；
 候选或所引用的 Integration 变化，不能悄悄复用旧决定。
 
+先用 `publication upsert` 登记本 Task 的精确候选、PR/MR URL（含服务地址）和
+目标分支，再用工具检查该对象。观察 JSON 的完整示例见
+[工具证据录入](task-delivery.md#record-a-leaders-tool-observation)；
+必需字段为 `taskId`、`publicationId`、`projectId`、`provider`、`repository`、
+`externalKind`、`externalId`、`externalUrl`、`targetBranch`、`localCommit`、
+`state`、`headCommit`、`observedAt`、`tool`、`command`、`output`。
+合并状态还必须有 `remoteCommit`，`mergedAt` 可选。SHA 为完整小写值，时间为
+ISO 时间戳。`provider` 表示 GitHub/GitLab 服务，不表示工具品牌。
+`output` 保留经过脱敏的实际响应关键摘录，不是凭据或一句“已合并”结论；
+完整 JSON 最大 64 KiB。Yui 不执行 `command`，不解析任意自然语言来判定成功。
+Leader 负责实际检查和解释输出，Core 负责身份、服务 URL、目标、候选和时间绑定。
+
+GitLab 浏览路径由服务部署决定：两个验证入口均允许标准 `/-/merge_requests/`、
+legacy `/merge_requests/` 和自定义服务路径，不再用 URL 模板推断仓库/MR 身份。
+结构化身份仍须匹配；完整登记 URL 经 URL 解析及移除一个末尾斜杠后仍须一致。
+仅允许 HTTP(S)，禁止凭据、query 和 fragment；保留 provider 返回的 URL，
+不改写为猜测的路由。HTTP 访问成功不是合并证据。
+
+新证据必须引用当前不可变 Publication，距登记不超过 24 小时且不能在未来。
+观察可以早于首次登记或仅标题更新；只有不可变历史中的候选、对象、目标或远程事实
+发生实质变化，才构成观察时间下界。候选改变后又恢复，也不能复用变化前的证据。
+仅标题更新时，将实际结果绑定到当前记录 ID，无需重新查询。
+相同观察的直接重试复用原回执；之后发生变化
+不能重放旧回执。完整规范化 JSON 保存在既有不透明 `evidence` 文本中，操作者和
+登记时间由 Publication 保留；没有新增持久化格式，也不改写历史证据。
+登记后的验证是固定观察，不是实时监控或 24 小时归档租约；已知后续变化须另记
+后继事实。失败或未知结果不能变成新的验证成功。URL、目标分支、候选变化会失效
+旧验证；仅标题变化可保留验证。
+GitHub URL 按 owner/name 不区分大小写比较；GitLab 支持相对部署路径，但完整的
+已登记服务前缀仍须匹配。适配器会持久化实际读到的目标分支，即使原记录未填写；
+缺失目标分支不能建立新的验证。
+
+`upsert --verified` 现在会被拒绝，请使用上述观察入口或可选适配器。
+现存已验证历史保持可读。普通归档复用精确充分的证据，不重跑指定工具；
+候选验收、业务结清、执行停止和安全清理检查不变。
+
 CLI、当前 Leader Context 和 Web 从同一组事实推导覆盖，不联网、不写证据。展示
 区分尚未交付、PR/MR 已合并但未覆盖、已覆盖合并但未验证、部分交付、已验证合并。
 每个 Project 保留自己的验收 head、候选、采用引用和原因。缺失的历史 head 仍然

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.8 and its declared 1.0/1.1/1.2/1.3/1.4/1.5/1.6/1.7 minor
+The stable suite owns current storage 1.13 and its declared 1.0 through 1.12 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.8, exact schema/record validation, no initialization over
+1. Fresh storage 1.13, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
@@ -75,6 +75,10 @@ Current coverage includes:
 8. Failure isolation for optional Controller maintenance, individual retry
    Sessions and Task continuation observation, with scoped errors and no
    fabricated delivery, cancellation or quiescence.
+9. Activation-source handoff without replay, Brief guards across same-timestamp
+   input, Home/baseline-bound fixed event windows, and complete frozen-ref deltas
+   with removals. These deterministic checks establish contracts, not a model's
+   semantic conflict judgment.
 
 Keep the test phase seconds-scale and measure build separately. Use the
 existing assembled-package smoke for actual CLI/Controller/Host/tmux wiring,

package/docs/testing/verification-levels.zh-CN.md

@@ -36,12 +36,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 ## 永久 core smoke
 
 `npm test` 和 `npm run test:core` 构建当前 checkout 并运行维护中的套件。
-稳定套件只维护当前存储 1.0 和未来明确声明的小版本迁移，不包含任何历史
-转换实现、样本或兼容测试。
+稳定套件维护当前存储 1.13 和明确声明的 1.0 至 1.12 连续小版本迁移，
+不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.0、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.13、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、
@@ -54,6 +54,9 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
    和备份行为。
 8. Controller 可选维护、各个重试 Session、Task continuation 观察的失败隔离，
    诊断包含所属对象，不伪造投递、取消或静默状态。
+9. 无重放的激活来源交接、同时间戳新输入使 Brief 写入校验失效、绑定 Home 与基线的
+   固定事件窗口，以及含移除项的完整冻结引用增量。这些确定性测试验证契约，
+   不代表已验证真实模型的语义冲突判断效果。
 
 测试阶段保持秒级，构建单独计时。真实 CLI／Controller／Host／tmux 接线复用现有
 组装包冒烟，不新增守护进程矩阵；稳定套件不重建任何已退役的存储路径。

package/i18n/README.zh-CN.md

@@ -27,7 +27,7 @@ Yui 是面向编程 Agent 的本地控制面。你只需用自然语言把目标
 - **自带 Agent** —— Codex CLI、Claude Code CLI 和 ACP 通过统一边界接入，
   可替换而不丢失 Task。
 - **本地优先、私有** —— 一切运行在你自己的机器上，面向单个受信任用户；
-  Web 仅本地回环，包含只读视图和经认证的用户控制。
+  Web 默认本地回环，可显式开启带认证的可信内网访问。
 - **默认隔离** —— 仓库改动发生在受管 Git worktree 中，稳定 checkout 保持只读。
 
 > **状态：** 1.1.0，当前存储版本为 1.1，已声明从 1.0 基线升级。默认更新只执行同一存储
@@ -156,6 +156,9 @@ Agent 可以重新读取任务上下文，继续兼容的 Session，或在必要
 想直观看进展，可以在另一个终端运行 `yui web`。本地 Web 展示同一份任务与
 待回答问题，也允许发送消息、回答问题，以及显式 queue、steer 或 interrupt Task 输入。
 这些经认证的 Task 控制复用 CLI 的相同操作，不是另一套需要同步的任务系统。
+内网监听要求权限受限的凭证文件；浏览器使用原生认证提示（用户名 `yui`）。
+当前 Operator 可按用户请求启动、查询和停止，不能冒充浏览器用户。HTTP 不加密。
+详见[受控 Web 访问](../docs/web-access.md)的命令、地址发现、凭证轮换及安全边界。
 详情分为四个页签：概览（用户待办、任务进展和关键决定）、交付（工作项、评审、
 集成与远程交付，按需读取）、运行（Role、原生会话活动、进行中的执行和用量）、
 记录（决定、里程碑、执行与问题的时间线）。详见[用户关注与进展](../docs/observability/README.zh-CN.md#web-用户关注与进展)。
@@ -263,7 +266,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
      它负责搬运工作、记录事实——但从不判断回答好坏
 
   Agent 在 Project 中工作：只读 checkout + 隔离 worktree。
-  Web（yui web）：本地回环视图 + 经认证的用户控制。
+  Web（yui web）：默认本地回环 + 显式认证的内网访问。
 ```
 
 ### 分层设计
@@ -272,7 +275,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
 
 ```text
   体验层 Experience   —  你如何交互
-    CLI（Operator）· Web（本地回环、经认证）· 原生 Agent 会话
+    CLI（Operator）· Web（本地 / 经认证内网）· 原生 Agent 会话
     采集输入 · 展示事实 · 确认操作 · 调用能力
         ▼
   决策层 Intelligence —  谁来决定

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.8.1",
+  "version": "2.10.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,
@@ -48,12 +48,13 @@
   "dependencies": {
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
+    "cron-parser": "5.10.2",
     "node-pty": "1.2.0-beta.15",
     "smol-toml": "1.8.0",
     "ws": "^8.21.1"
   },
   "optionalDependencies": {
-    "sqlite-modern": "npm:better-sqlite3@13.0.3",
-    "sqlite-compat": "npm:better-sqlite3@10.1.0"
+    "sqlite-compat": "npm:better-sqlite3@10.1.0",
+    "sqlite-modern": "npm:better-sqlite3@13.0.3"
   }
 }

package/skills/yui-leader/SKILL.md

@@ -42,6 +42,11 @@ transcript or process.
 
 Apply terminal/gate and read-only intent boundaries before selecting delivery
 or planning work; the routes below do not override those restrictions.
+When old discussion text differs from new intent, apply
+[current intent and temporal reads](../yui-runtime/references/context-ordering.md):
+inspect exact sources before treating normal stage progression as a conflict.
+An adopted same-scope development request supersedes the earlier discussion-only
+stage, not independent restrictions. Never use active status or Brief alone.
 
 - **Draft or planning-only authority:** read [Planning and activation handoff](references/planning.md).
   Use the recorded submission intent (`record`, `discuss`, `develop`) and
@@ -100,7 +105,8 @@ then ack the exact entry. Inbox acknowledgement
 never accepts a Candidate or completes the Task.
 
 The DB Brief is the current summary, not a full plan or a history of messages.
-After meaningful progress, use `task brief update` with only intended fields;
+After meaningful progress, read `task brief show` and use
+`task brief update --if-current <writeGuard>` with only intended fields;
 read `task event list` before deliberately restoring an older value. Keep
 references to substantial plans, prototypes and reports in that summary.
 When a delivered correction resolves a recorded blocker or changes the next
@@ -111,6 +117,10 @@ before `task complete`. The completion summary is the terminal conclusion;
 do not copy it into Brief merely to create a second completion record. Brief
 maintenance is not a new completion gate, and routine unchanged steps do not
 need an update.
+Also reconcile the summary at requirement changes and phase handoffs; carry the
+exact activation/input references. Core projects current lifecycle and source
+diagnostics without rewriting historical messages. A stale-guard rejection
+requires reading the new input and reconciling, not retrying the old text.
 Decisions contain the actual decision, reason and necessary boundaries, not
 the entire proposal. Label recommendations as recommendations, not user
 decisions.
@@ -132,6 +142,39 @@ heartbeat or unchanged wait. Ordinary fact edits need no self-wake.
 
 ## Close the current turn
 
+### Adjust Project delivery scope without erasing work
+
+When explicit user intent or an original delegation allows a Project to leave
+the final delivery, read that original Message and `task remote-delivery`.
+Record the bounded decision with
+`task project delivery <task> <project-id> --requirement excluded --reason <reason>
+--source-message <message-id> --purpose <verbatim-authorization>
+--if-current <scopeDecision.id|none>`.
+Interpret whether the original really authorizes this scope change; a matching
+quote alone is not semantic permission. Do not exclude a Project to conceal an
+unmet commitment. Ask only for a genuinely missing scope decision, not a second
+approval when existing user intent or delegated judgment already covers it.
+Use the same operation with `--requirement required` and the latest decision ID
+to restore normal checks. Reconcile a stale guard instead of overwriting newer
+intent. These append-only decisions also work on completed, unarchived Tasks
+without reopening, rewriting acceptance, or rerunning work.
+
+Unchanged Projects need no exclusion. Required changed/unknown Projects still
+need exact verified delivery. Excluded Projects retain their binding, code
+changes and Publication facts and are not counted as merged or verified merely
+because they are excluded. Scope is not execution, write, archive or deletion
+authority: open commitments and unknown execution still need settlement, and
+unique commits or dirty resources remain protected. With separate archive
+authorization, use ordinary archive/preflight and report retained resources;
+do not recommend force merely because an authorized Project is excluded.
+
+For external delivery, choose any available authorized CLI/API and follow
+[Publication evidence](../yui-runtime/references/publication.md). Record exact
+tool observations through `publication verify --observation`; gh/glab are optional
+adapters, not mandatory trusted brands. Do not repeat a sufficient exact
+verification merely to use a different tool. Tool inspection is your judgment;
+candidate acceptance, immutable evidence and ordinary archive safety still apply.
+
 - **Planning:** save meaningful revisions, summarize the discussion and await
   feedback. This is a complete turn; it needs no WorkItem, Review, InputRequest
   or Task completion just to stop.

package/skills/yui-leader/VERSION

@@ -1 +1 @@
-3
+6

package/skills/yui-leader/references/planning.md

@@ -56,7 +56,15 @@ and historical Runs/Sessions count even when no Session is currently busy.
 CLI commands: an authorized Operator can perform the mechanical operation.
 
 With that authorization, inspect any existing activation request before creating
-one with `task activation request <task-id> --request-id <id> --environment <plan>`.
+one with `task activation request <task-id> --request-id <id> --environment <plan>
+--source-message <message-id>`. If the new authorization arrived directly in
+the native conversation and has no saved Message, use `--source-text` with the
+exact user input instead. Core records this as caller-attributed source text in
+the immutable activation event, not a new Message or another delivery. Never
+substitute a Brief paraphrase, fabricate user authorship, or resend the input.
+Keep the same source and request ID on retries. Read the returned source event
+when diagnosing a mismatch. Update Brief with the new intent and source refs
+before ending the planning turn; do not rewrite old user messages.
 Choose the plan from the authorized resources; retain the request id for retries.
 The Controller adopts an eligible request. `task activate <task-id>` is the
 foreground adoption operation for an existing request, not a request-free shortcut.

package/skills/yui-operator/SKILL.md

@@ -183,6 +183,23 @@ user-owned configuration and external-effect boundaries.
 Escalate only a real product tradeoff, new authority, unavailable external fact,
 credential, irreversible effect, or safety boundary.
 
+For user-requested Web lifecycle operations, use `yui web`, `yui web --status`
+and `yui web --stop` with the current Operator identity and intended Home.
+Operator starts return a Controller-owned receipt without holding this turn
+open. Non-loopback binding requires `--auth-file <absolute-path>` containing
+an owner-only (0600) regular file with a unique 32–128 character printable ASCII
+password; browser username is `yui`. There is no default password.
+Honor the user's exact network exposure and credential scope. Never clear
+managed identity, impersonate a browser user, launch a bypass server or restart
+the Controller merely to open Web. Report actual access URLs and failures,
+never a wildcard address or an old snapshot as a working link. Explain that
+HTTP is unencrypted, and keep credentials out of messages, logs and URLs.
+Lifecycle authority does not authenticate visitors. On unknown startup outcome,
+inspect status before retrying; a running listener is not proof of remote reachability.
+Stopping Web closes browser connections without stopping Agents. Password
+rotation requires explicit stop/start; changing the file alone does not revoke
+the running credential. Controller recovery does not automatically reopen Web.
+
 ## Configure Yui through confirmed conversation
 
 Read both effective configuration and the catalog before explaining or changing
@@ -237,6 +254,10 @@ Apply **yui-runtime**'s own-inbox flow at useful routing boundaries and before
 handoff. `yui inbox list/show/claim/ack` processes Operator input in this turn;
 do not wait for another wake or copy pending notices into new input. Read every
 relevant original and finish the authorized routing/disposition before ack.
+Routing to an owning Task, recording a necessary user question, or verifying
+that a later request superseded a notice may settle this input immediately;
+cite the durable reference and do not wait for the downstream Task to finish.
+Use the Runtime current/history split and never replay effects to repair ACK.
 
 Use JSON reads and their top-level `data` field.
 Use Global Context's bounded `pending` page to find Messages, then
@@ -287,6 +308,16 @@ Distinguish settled business and stopped execution from safely retained
 physical resources. Ordinary archive may retain the latter; follow the shared
 archive diagnostics and exact cleanup actions instead of requesting force
 merely for old terminal Integration worktrees or preserved diagnostics.
+When only some bound Projects remain in the final delivery, preserve the exact
+user scope decision or delegation in the owning Task and route it to its Leader.
+The Leader can record `task project delivery` with the original Message and
+latest scope-decision guard; this also works for completed, unarchived Tasks
+without reopening them. An unchanged Project already needs no delivery.
+An explicitly excluded Project is not a verified merge and its data is not
+disposable. Use the shared remote-delivery/preflight projection, settle open
+business and execution independently, and use ordinary authorized archive
+while reporting safely retained resources. Do not demand force, delete bindings,
+or solicit repeated Operator approval when the original scope authority suffices.
 When the user explicitly authorizes force archive for an eligible terminal
 Task, archive even if delivery proof or cleanup is incomplete. Report the
 warnings and retained resources without claiming merge verification or physical

package/skills/yui-operator/VERSION

@@ -1 +1 @@
-3
+6

package/skills/yui-reviewer/SKILL.md

@@ -57,6 +57,10 @@ own-inbox flow for current-ReviewRound clarification. Read complete originals,
 claim before handling, and ack after disposition. These messages supplement
 the frozen pack; they cannot replace its Candidate, expand review scope, or
 turn acknowledgement into a review verdict.
+Use Runtime's [temporal read contract](../yui-runtime/references/context-ordering.md)
+for stale summaries or delayed input. Current facts can explain a handoff but
+cannot silently replace the frozen candidate. Read original source relations
+before reporting a historical planning-stage restriction as a current conflict.
 
 Verify the exact AgentRun identity, Context Pack, frozen head, and ReviewRound-owned
 workspace before inspecting candidate sources. If context loading or workspace

package/skills/yui-reviewer/VERSION

@@ -1 +1 @@
-3
+4