axstack 0.56.0 → 0.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/diligence.md

@@ -5,7 +5,9 @@ and bounded follow-ups are defined in [Peer mode](../../axstack-review/SKILL.md#
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch.
 Dispatch `axstack-diligence` with async `delegate_task` in the driver worktree,
-using a pinned brief and private evidence paths.
+using a pinned brief and private evidence paths. Explicit non-repository
+research/article diligence uses [Local artifacts](local-artifacts.md) with
+local shared isolation and independently reopened sources, without a fake Git repo.
 It is read-only, never authors or edits, and returns `PASS`, `FINDINGS`, or `UNKNOWN`
 with locations, observed evidence, and limits. A stale or missing receipt is
 not a pass. Keep its first pass independent of other reviewers and workers.

package/skills/axstack/references/fleet-dispatch.md

@@ -7,6 +7,12 @@ records and forge actions. Helpers validate explicit saved inputs only: no
 network, clock, dispatch, retry, merge, retained state or aggregate permission grant.
 Synthetic evidence can pass binding checks; helpers cannot authenticate it.
 
+For explicit local non-repository Research/Explain/Publish work, apply
+[Local artifacts](local-artifacts.md): its discriminated scope, native read/list
+null-identity proof and owned folders replace only the repository/checkout terms.
+All native execution authority and independent exact-byte review remain required.
+Engineering/code review and remote routes retain their existing rules.
+
 ## Observe before selecting
 
 1. Record installed Axstack and both T3 versions, directed origin/target link,
@@ -25,7 +31,7 @@ Synthetic evidence can pass binding checks; helpers cannot authenticate it.
 3. Keep the model/effort/provider pins from the run; do not re-resolve to another
    model when quota/auth/timeout fails. Missing native `t3_thread_configuration`
    means unavailable effective fields stay unknown. Catalog runtimeModes advertise
-   support; they do not prove effective access. Native task/thread facts supply
+   provider restrictions; they do not prove effective access. Native task/thread facts supply
    only the fields actually returned. A worker assertion is not native readback.
 4. Normalize current driver assignments and the pending batch as below. Sample
    telemetry with C2's bounded command, then recompute C1 immediately before each
@@ -70,8 +76,28 @@ read envelope is `{tool,environmentId,args,observedAt,evidence,value}` where arg
 excludes the forwarding environmentId, and evidence points to the preserved raw
 native call/result. environment/project/capabilities are read on the selected
 host; links are read on origin. The capabilities envelope uses `valueText` for
-exact raw catalog bytes instead of value. Project repositoryIdentity.canonicalKey
-must match the requested repositoryId. Unknown mappings hold rather than guessing.
+exact raw catalog bytes instead of value. For repository scope, project repositoryIdentity.canonicalKey
+must match the requested repositoryId. If project-read identity is null/omitted,
+`projectList` may carry an ordered array of `t3_project_list` read envelopes on
+that same environment. Collect from cursor 0 through native nextCursor:null,
+recording actual cursor/limit arguments (native defaults: 0/20, limit at most 100).
+Every page must join without gaps, extra arguments or duplicate project IDs.
+The selected project's ID and workspaceRoot must equal project-read; every
+available canonicalKey must equal repositoryId, including when both reads have
+identity. In repository scope, missing identity in both holds; local-artifact
+scope instead requires explicit null in both reads. Incomplete pagination and
+any conflict hold for either scope.
+
+For observed T3 0.1.5 native Codex/Claude drivers, omitted provider runtimeModes
+means no provider restriction: native resolveRuntimeMode and RuntimePolicy
+preserve the requested mode. Bind this only with catalog runtimeMode equal to
+the request, exactly one selected provider, canRunChildTask:true and an explicit
+empty constraints array. Explicit mode restrictions must include the requested
+mode. Unknown version/driver omission semantics, missing caller authority,
+unavailable providers or restrictions hold. This is preflight support, never
+proof of a child's effective mode; terminal receipts still require actual native
+readback. Preserve the exact catalog bytes/digest; do not synthesize runtimeModes
+or repositoryIdentity in the saved raw reads. Unknown mappings hold rather than guessing.
 The pure `inspectDestination` API returns per-term pass/fail/unknown with evidence;
 `dispatch-plan` holds on a failed/unknown term. This is supplied binding proof only.
 
@@ -80,9 +106,11 @@ recommendation, explicit evaluation time and config pin. Compare its target to t
 independently selected host/environment/project/model/options/runtimeMode. Copy only
 native supported fields, never inputs or fleetBinding. Call `delegate_task` with
 that exact target, full-access, a role-labelled title, stable clientRequestId and
-scope. Reviewers require native isolation:"worktree" and pinned candidate/base;
-no shell-created child checkout. Other nonwriters write only their named private
-evidence directory on that host. Preserve requested arguments and native response.
+scope. Code reviewers require native isolation:"worktree" and pinned candidate/base;
+no shell-created child checkout. Explicit local artifact reviewers instead use
+shared isolation and SHA-256 snapshots under [Local artifacts](local-artifacts.md);
+artifact writers use only their owned artifact/evidence folders. Other nonwriters
+write only their named private evidence directory on that host. Preserve requested arguments and native response.
 
 Record taskId on the origin plus remoteChild.environmentId/threadId. The native
 remoteChild schema need not return runId: normalize it from observed task/thread
@@ -99,7 +127,9 @@ recommendation at the same model/permission pins; record the exclusion evidence.
 
 Preserve schemaVersion:1, recommendationJSON (exact bytes), configDigest,
 attempt (key, exact title, clientRequestId, origin environmentId/threadId/taskId,
-candidate/base SHAs), requested target/runtimeMode/isolation and native submission.
+candidate/base SHAs for repositories, artifact SHA-256/null base for local artifacts),
+requested target/runtimeMode/isolation and native submission. Artifact ownership
+and byte readbacks follow [Local artifacts](local-artifacts.md#receipts).
 The driver's independent fleetAttempt is the expected run-record identity;
 never copy it from an arriving receipt to make a comparison pass.
 
@@ -119,6 +149,9 @@ submission.childRunId; never use lexical ordering of IDs or the original summary
 Require completed/result_available/no pending children/no unanswered questions or
 approval. Require exactly one AXSTACK-DONE key/candidate/report marker on both origin's
 latestTerminalSummary and the destination's final current-run agent message.
+For local artifacts only, T3 0.1.5's deduplicated summary uses the exact
+run/byte-bound exception in [Local artifacts](local-artifacts.md#receipts);
+never rewrite raw native fields or extend it to remote/engineering receipts.
 A completion marker may be followed by the T3
 `PR <url>, head <sha>, checks and reviews <state>` trailer. Other trailing text
 or additional AXSTACK markers keep the receipt held.
@@ -131,7 +164,51 @@ For isolated review include checkout with those fields, candidate/base and readb
 Never infer local file existence from a remote absolute path.
 Requested settings remain separate from effective native status.providerInstanceId,
 model/options and thread.providerInstanceId/model/runtimeMode. Missing effective
-options or mode is unknown and holds required verification.
+options or mode is unknown and holds required verification, except for the bounded
+T3 0.1.5 initial remote-launch join below.
+
+### T3 0.1.5 initial remote receipt
+
+The remote `readRemoteTask` emitter omits options and returns null childRunId and
+latestTerminalRunId. Preserve those raw omissions/nulls. A current family shell
+is current thread metadata, not an immutable settings record for an older run.
+Never use it to authorize a continuation from an origin summary lacking a run ID.
+
+For the sole initial remote run, optional receipt `nativeFamily` can corroborate
+settings and run identity. The driver acquires `orchestration.getThreadFamily`
+with exact `{threadId}` on the actual destination using an authenticated native
+RPC read with `orchestration:read` scope. This is metadata access, not agent
+execution or an alternate worker launch path. Record host/environment identity,
+authenticated acquisition provenance, exact request/result, and independently
+observed server version. Do not execute an agent through SSH/CLI to obtain it.
+Temporary read sessions require their authorized lifecycle and revocation; never
+put tokens/tickets into evidence. This contract grants no auth/session authority.
+
+The envelope is `{tool:"orchestration.getThreadFamily",transport:"t3-native-rpc",
+environmentId,serverVersion:"0.1.5",args:{threadId},observedAt,evidence,value}`.
+`value` is the unmodified native `{snapshotSequence,threads}` response. Retain
+raw bytes separately, including any diagnostic/revocation trailer; parse only
+the JSON response into a separate file. Never rewrite the raw response as JSON.
+The version must also match selected destination versions; observe the family
+after thread/wait and no later than receipt evaluation. Missing provenance holds.
+
+Require a unique child with the selected project, exact title/current run,
+provider/model/options/mode and delegatedFrom origin environment/thread. Every
+returned family member must explicitly have idle/completed status, null active
+run/request, zero pending guest input and an empty pendingBackgroundTasks array.
+Unknown or live descendants hold even when remote status claims no pending child.
+
+The fallback requires native thread runCount:1, exactly one recentRuns row at
+ordinal:1, null local child IDs/childRunIds on status/submission, null origin
+latestTerminalRunId, and identical origin/destination final text. Existing
+current-run, completed terminal, marker, question and host/path checks still
+apply. Explicit status options or run IDs cannot be overwritten by family facts.
+T3 remote launch forwards the accepted explicit model selection and uses it for
+both thread creation and the initial message; this is the source-backed scope
+of the join. More runs or missing counts/ordinals hold. Later continuations need
+actual result-run/per-run settings provenance; repeated matching markers or
+current family settings are insufficient. Complete native statuses retain their
+existing run-ID path. Saved inputs cannot authenticate their own provenance.
 
 `inspectFleetReceipt(receipt,{attempt,recommendation,recommendationJSON,now})`
 returns terms, never authority. Existing dispatch-plan --verify can additionally

package/skills/axstack/references/fleet-route-schema.md

@@ -112,6 +112,13 @@ for serial emulator use, desktop safety and declared thermal prechecks.
 | `pendingAssignments` | Array of `{clientRequestId, environmentId, taskId?}` |
 | `exclusions` | `{hosts: {hostId: reason}, routes: {routeId: reason}}`; nonempty reason strings |
 
+`request.scope` may be `{kind:"repository"}` with a nonempty repositoryId;
+legacy omitted scope retains that repository requirement. The explicit
+`{kind:"local-artifact", ...}` alternative requires repositoryId:null and the
+workflow, role, native project and ownership fields in [Local artifacts](local-artifacts.md).
+Artifact destination project also carries workspaceRoot; only the bound local
+environment/project/workspace is eligible. Null alone never selects a route.
+
 `role` is `reader` (all nonwriter roles) or `author`. `requiredCapabilities`
 is an array of strings. An authentication requirement names the actual session
 capability; only the host proving that session is eligible. No credential
@@ -168,6 +175,11 @@ Optional `nativeInventory` is normalized before counts under
 Unknown native totals are null; balance ranking uses the separately labelled
 pendingLowerBound. Counts also retain inventoryReasons/evidence; flags.countsUnknown follows normalized status.
 Optional `nativeDestination` carries observed native forwarded preflight reads.
+Optional `nativeDestination.projectList` is the complete ordered native project-list
+page envelopes used to join a cold project-read repository identity; preserve
+raw reads and catalogs. Conflicting identities/workspaces or incomplete pages hold.
+T3 0.1.5 native provider mode omissions require the documented caller/provider
+authority evidence, never synthesized catalog fields.
 The same reference defines terminal receipt validation and its supplied-evidence
 limitation. Live drivers require these observed facts, not synthetic caller claims.
 Legacy normalized input remains unchanged. Remote coordinator remains disabled.
@@ -306,7 +318,10 @@ unavailable destination model/options, or role/settings/config disagreement.
 It never reinterprets a requested model pin as a different available model.
 
 Task plans add `environmentId`/`projectId` to `target`; launch plans add them
-beside `modelSelection`. All requested options survive as T3 option entries.
+beside `modelSelection`. All requested options survive as T3 option entries. Explicit local-artifact
+plans require nativeDestination, the exact scope role and task kind; they emit
+isolation:"shared" and artifactScope evidence. The latter is never a native
+argument. Artifact readback compares scope and shared isolation as well.
 Both include `fleetBinding: {configDigest, destinationSnapshotId,
 destinationCapabilitiesDigest}`. This is preserved evidence, not a T3 launch
 parameter. Copy only tool-supported launch fields. Coordinator author routes

package/skills/axstack/references/lifecycle.md

@@ -29,6 +29,12 @@ Prefer parallel independent bounded work; no redundant workers. Fanout is depend
 capacity-driven within host/spending limits. [PR shape](pr-shape.md) covers
 theme/size; queue dependencies under [PR chains](pr-chain.md).
 
+For explicit non-repository Research/Explain/Publish artifacts, use
+[Local artifacts](local-artifacts.md) for owned shared delegates and SHA-256
+receipts. The reviewer checkout row above applies to code candidates; article
+review retains independent source/fact and exact-byte UI/design checks.
+Null identity does not waive engineering isolation or authorize remote artifacts.
+
 ## Ownership
 
 The PR owner is accountable for candidate, fixes, evidence, monitoring.

package/skills/axstack/references/local-artifacts.md

@@ -0,0 +1,100 @@
+# Local non-repository artifacts
+
+Research, Explain and Publish may use an explicitly bound non-repository
+artifact scope. Null repository identity alone never authorizes a route.
+Engineering authors and code reviewers still require a repository and native
+Git worktree isolation. Remote artifacts and remote author/coordinator work
+remain outside this scope.
+
+## Scope and ownership
+
+Use `request.scope` below with `repositoryId:null` and `role:reader`.
+Here reader means no product-code authority; an explainer may write only its
+owned article artifacts. `task` remains a load preference, not role authority.
+The scope is evidence for the helpers and brief, never a native T3 argument.
+
+```json
+{
+  "kind": "local-artifact",
+  "workflow": "explain",
+  "roleId": "axstack-explainer",
+  "environmentId": "<current environment>",
+  "projectId": "<actual parent project>",
+  "workspaceRoot": "/scratch",
+  "artifactRoot": "/scratch/run/artifacts/author-a1",
+  "evidenceRoot": "/scratch/run/evidence/author-a1",
+  "reservedRoots": ["/scratch/run/artifacts/other-attempt"]
+}
+```
+
+`workflow` is research, explain or publish. All three permit the configured
+research requirements/code/code-sol/web/web-sol/X and explore-execution/
+explore-execution-sol source roles plus diligence. Explain and Publish also
+permit explainer, explainer-review and the configured UI verifier roles.
+Use their full `axstack-` role IDs; this list does not make an absent seat
+available or change provider/model/effort/options/runtime authority.
+The selected role ID must equal scope.roleId in dispatch-plan.
+No engineering author, code reviewer, owner or arbitrary role can use this scope.
+
+The driver binds the native parent project and its real workspaceRoot. Require
+explicit null repositoryIdentity in both project-read and complete project-list
+reads; omitted, conflicting or incomplete observations hold. Native environment,
+project, catalog, provider restrictions, options, runtime and access checks still
+apply. Use only a local route in that environment/project/workspace. Do not
+fabricate a repository ID, initialize Git or attach an unrelated repository.
+
+Give every attempt separate owned artifact and evidence directories, strict
+children of the observed workspaceRoot. They must be canonical absolute paths,
+with no traversal, shared-root writes or ancestor/equal overlap. `reservedRoots`
+is the driver's current list of other attempts' owned artifact/evidence roots;
+include pending and retained attempts, never guess an empty inventory.
+The helper checks lexical paths and overlaps; the driver must independently
+verify real paths, no symlink escapes, ownership and exclusive writers on disk.
+Unknown ownership holds. This is supplied evidence, not an authenticated lock.
+
+## Native dispatch and review
+
+Use async native `delegate_task` with `isolation:"shared"`, exact local target,
+role-labelled title and stable clientRequestId. Native local projectId must equal
+the parent's project; moving to another local project is unsupported. Preserve
+requested arguments and native effective settings separately. Dispatch-plan
+requires nativeDestination and `--kind task`; it returns artifactScope as evidence
+and shared isolation. Copy only supported native arguments into delegate_task.
+No top-level launch, shell checkout, live policy edit or per-run bypass is needed.
+
+Research branches keep independent first passes and cited-source reopening.
+Diligence reopens answer-changing claims; it never becomes the article author.
+The explainer remains sole source writer. Reviewers/verifiers get their own
+byte-identical snapshot in their owned artifact directory; their reports/probes
+stay in their separate evidence directory and never edit the author's original.
+Independent explainer review checks the exact SHA-256 bytes. Before public
+publication require Playwright layout/interaction evidence and independent
+source/fact and design review of those same bytes under Explain/Publish rules.
+Changed bytes invalidate affected reviews and renders; unknown proof holds.
+Shared filesystem access does not permit cross-reading independent first passes.
+Publication remains the explicitly authorized driver's action.
+
+## Receipts
+
+Retain the normal native task/thread/run, pending-question and settings checks.
+For artifact receipts, `attempt.candidate` and marker `head` are the exact
+64-hex artifact SHA-256; `attempt.base` is null. They are not Git revisions.
+Bind `artifactScope` to the requested scope and report to evidenceRoot.
+Supply `artifact:{path,sha256,readback:{path,sha256,evidence}}` for the independently
+hashed owned snapshot. Requested isolation must be shared. Native child worktreePath may be null;
+on T3 0.1.5 it may also inherit the parent's non-Git scratch path. For the latter,
+include `parent` as a saved `t3_thread_read` observation (tool, environmentId,
+args.threadId, observedAt, evidence, value.thread). Bind it to the attempt's
+origin thread, selected project, child parentThreadId/subagent relationship and
+identical canonical path inside workspaceRoot. Verify the actual filesystem;
+this is shared access, not a Git checkout or OS isolation. Checkout metadata
+remains forbidden. Unknown or different parent/path evidence holds.
+
+T3 0.1.5 deduplicates local task results: latestTerminalSummary can be null when
+summary contains the same result. For local artifact receipts only, use that
+summary when childRunId and latestTerminalRunId both equal the current completed
+run and its bytes equal the destination final message. An explicit conflicting
+terminal summary, stale run, other version or remote result does not use this
+fallback. Preserve the raw native fields; do not rewrite them. Never synthesize an effective field from requested settings.
+The driver checks actual bytes and readbacks; helpers validate saved data only.
+Keep artifact receipts separate from Git candidate publication/PR/merge receipts.

package/skills/axstack/references/role-roster.md

@@ -6,6 +6,11 @@ native destination. Remote reviewers require T3 worktree isolation; no shell chi
 checkout. Host names confer no role or permission. Remote authors/coordinator stay
 disabled; local isolated authors remain supported even overloaded.
 
+Explicit non-repository Research/Explain/Publish uses the bounded role allowlist
+and local shared-artifact isolation in [Local artifacts](local-artifacts.md).
+This changes no configured seat, source independence or exact-byte review duty.
+Engineering authors and code reviewers cannot acquire this artifact authority.
+
 - Chat drives (no role ID); `axstack-owner` owns one PR and
   `axstack-author` its sole writer.
   For own PRs, automatic merge is the default under the

package/skills/axstack/references/t3-runtime.md

@@ -204,6 +204,13 @@ a candidate follows [UI verification](ui-verification.md).
 
 The driver must be the sole run-record writer and enforce one writer per
 candidate; it never writes tracked candidate source or tests or repairs an author's source.
+For explicit non-repository Research/Explain/Publish only,
+[Local artifacts](local-artifacts.md) supplies the artifact branch of this table:
+source readers, diligence, explainers and article/UI reviewers use local shared
+native delegates with separate owned folders and exact SHA-256 snapshots.
+Its role allowlist excludes engineering authors and code reviewers; their native
+Git worktree rules above remain mandatory. Null repository alone grants nothing.
+
 The driver may write planning artifacts (spec, ticket map) in its own worktree when the selected store is repository Markdown.
 Repairs return to that author. Missing or idle sessions grant no ownership transfer.
 The current chat/driver has no role row in any preset.

package/skills/axstack/references/ui-verification.md

@@ -24,8 +24,11 @@ All other browser checks outside the two named exceptions remain delegated to co
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch; for candidate
 checks use its driver-made disposable detached checkout at the pinned candidate SHA.
+For explicit non-repository article checks, use the local shared delegate and
+owned SHA-256 snapshot in [Local artifacts](local-artifacts.md); no Git candidate
+is fabricated. Engineering candidate checks retain the checkout requirement.
 Use the configured verifier browser and honor the user browser-tool policy.
-Candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Engineering candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
 
 For every interactive page, require a real-browser `axstack-ui-verifier` interaction pass.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 import { inspectFleetReceipt } from './fleet-receipt.js';
 import { bindFleet } from './fleet-dispatch.js';
+import { canonical } from './fleet-config.js';
 
 const fleetFlags = ['--recommendation', '--fleet-input', '--now', '--config-digest'];
 const flags = ['--role', '--roles', '--capabilities', '--kind', '--verify', '--out', ...fleetFlags];
@@ -34,6 +35,9 @@ by its destination facts. It is never the origin catalog by default.
 Fleet verification requires environmentId/projectId and fleetBinding alongside
 the effective T3 configuration. C3 collects that host-qualified evidence envelope.
 Optional input.nativeDestination validates saved native forwarded reads.
+Explicit local-artifact scope requires those reads and kind task; emits isolation:"shared".
+artifactScope is preserved evidence only, never a native tool argument.
+Artifact verification also requires artifactScope and independently checked isolation.
 Optional --verify fleetAttempt/fleetReceipt validates host-qualified terminal facts;
 --out retains per-term receipt evidence. Synthetic bindings cannot authenticate reads.
 Coordinator routes remain unsupported here. A plan grants no launch authority.
@@ -98,6 +102,11 @@ function verify(configuration, provider, model, options, fleet) {
   if (fleet) {
     for (const [field, expected] of Object.entries(fleet.destination)) compare(field, expected, configuration?.[field]);
     for (const [field, expected] of Object.entries(fleet.fleetBinding)) compare(field, expected, configuration?.fleetBinding?.[field]);
+    if (fleet.artifactScope) {
+      compare('artifactScope', fleet.artifactScope, configuration?.artifactScope,
+        canonical(fleet.artifactScope) === canonical(configuration?.artifactScope));
+      compare('isolation', 'shared', configuration?.isolation);
+    }
   }
   let receiptTerms;
   if (fleet && configuration?.fleetReceipt !== undefined) {
@@ -175,7 +184,7 @@ function plan(argv, io) {
     const recommendation = JSON.parse(recommendationJSON);
     fleet = bindFleet(readJSON(args['--fleet-input']), recommendation,
       args['--config-digest'], Number(args['--now']), readFileSync(args['--capabilities'], 'utf8'),
-      resolution, role.id === 'axstack-author');
+      resolution, role.id === 'axstack-author', role.id, args['--kind']);
     fleet.recommendation = recommendation;
     fleet.recommendationJSON = recommendationJSON;
     fleet.now = Number(args['--now']);
@@ -189,6 +198,7 @@ function plan(argv, io) {
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: providerInstanceId,
     model, options, ...(args['--kind'] === 'task' ? fleet?.destination : {}) };
   emit({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection, runtimeMode: 'full-access',
+    ...(fleet?.artifactScope ? { artifactScope: fleet.artifactScope, isolation: fleet.isolation } : {}),
     ...(fleet ? { fleetBinding: fleet.fleetBinding, ...(args['--kind'] === 'launch' ? fleet.destination : {}) } : {}),
     ...(args['--kind'] === 'task' && role.id === 'axstack-author' ? { isolation: 'worktree' } : {}) });
   return 0;

package/skills/axstack/scripts/fleet-config.js

@@ -1,3 +1,5 @@
+import { validScope } from './fleet-scope.js';
+
 // Configuration is reviewed data. This module does not read account-local files.
 export function fail(code) { throw new Error(code); }
 export const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -58,7 +60,7 @@ export function validateInput(input, now) {
   const r = input.request;
   if (!record(r) || !text(r.task) || !['reader', 'author'].includes(r.role)
     || !Array.isArray(r.requiredCapabilities) || !r.requiredCapabilities.every(text)
-    || !text(r.repositoryId) || !text(r.providerInstanceId) || !text(r.model)
+    || !validScope(r) || !text(r.providerInstanceId) || !text(r.model)
     || !record(r.options) || !text(r.runtimeMode)) fail('request-schema');
   for (const key of ['destinations', 'routeFacts', 'telemetry', 'assignments', 'pendingAssignments']) {
     if (!Array.isArray(input[key])) fail(`${key}-schema`);

package/skills/axstack/scripts/fleet-destination.js

@@ -1,4 +1,5 @@
 // Validate explicit saved native reads. These bindings do not authenticate input.
+import { isArtifact } from './fleet-scope.js';
 import { canonical, text, time } from './fleet-config.js';
 
 export function inspectDestination(observation, recommendation, capabilitiesText, now) {
@@ -7,6 +8,9 @@ export function inspectDestination(observation, recommendation, capabilitiesText
     state: pass ? 'pass' : missing ? 'unknown' : 'fail', evidence: evidence ?? null });
   const s = recommendation.selected;
   const o = observation ?? {};
+  const observed = (read, tool, environmentId, args) => read?.tool === tool
+    && read?.environmentId === environmentId && canonical(read?.args) === canonical(args)
+    && time(read?.observedAt) && read.observedAt <= now && text(read?.evidence);
   for (const [name, tool, environmentId, args] of [
     ['environment', 't3_environment_read', s.environmentId, {}],
     ['project', 't3_project_read', s.environmentId, { projectId: s.projectId }],
@@ -14,22 +18,66 @@ export function inspectDestination(observation, recommendation, capabilitiesText
     ['links', 't3_environment_links', recommendation.originEnvironmentId, {}],
   ]) {
     const read = o[name];
-    term('destination-observation', read?.tool === tool && read?.environmentId === environmentId
-      && canonical(read?.args) === canonical(args) && time(read?.observedAt)
-      && read.observedAt <= now && text(read?.evidence), read);
+    term('destination-observation', observed(read, tool, environmentId, args), read);
   }
   term('destination-identity', o.environment?.value?.environmentId === s.environmentId,
     o.environment?.value?.environmentId);
   term('destination-project', o.project?.value?.id === s.projectId && text(o.project?.value?.workspaceRoot),
     o.project?.value);
-  term('destination-repository', o.project?.value?.repositoryIdentity?.canonicalKey === s.repositoryId,
-    o.project?.value?.repositoryIdentity);
+  const project = o.project?.value;
+  let listed;
+  if (o.projectList !== undefined) {
+    const pages = o.projectList;
+    const projects = [];
+    let cursor = 0;
+    let complete = Array.isArray(pages) && pages.length > 0;
+    if (complete) for (const page of pages) {
+      const args = page?.args;
+      const limit = args?.limit ?? 20;
+      const rows = page?.value?.projects;
+      const next = page?.value?.nextCursor;
+      complete &&= cursor !== null && observed(page, 't3_project_list', s.environmentId, {
+        ...(args?.cursor === undefined ? {} : { cursor }),
+        ...(args?.limit === undefined ? {} : { limit }),
+      }) && (args?.cursor ?? 0) === cursor && Number.isInteger(limit) && limit >= 1 && limit <= 100
+        && Array.isArray(rows) && rows.length <= limit
+        && (next === null || (next === cursor + limit && rows.length === limit));
+      if (Array.isArray(rows)) projects.push(...rows);
+      cursor = next;
+    }
+    listed = projects.find((p) => p?.id === s.projectId);
+    term('destination-project-list', complete && cursor === null
+      && projects.every((p) => text(p?.id)) && new Set(projects.map((p) => p?.id)).size === projects.length
+      && listed?.id === s.projectId && listed.id === project?.id && listed?.workspaceRoot === project?.workspaceRoot, pages);
+  }
+  // ProjectService.listPage resolves the cold identity cache; getById need not.
+  const identities = [project?.repositoryIdentity, listed?.repositoryIdentity].filter((v) => v != null);
+  if (isArtifact(recommendation.request)) {
+    const scope = recommendation.request.scope;
+    term('destination-artifact-project', project?.repositoryIdentity === null
+      && listed?.repositoryIdentity === null && project?.workspaceRoot === scope.workspaceRoot
+      && s.environmentId === scope.environmentId && s.projectId === scope.projectId,
+    { project, listed });
+  } else {
+    term('destination-repository', identities.length > 0
+      && identities.every((v) => v.canonicalKey === s.repositoryId), identities,
+    identities.length === 0);
+  }
   term('destination-catalog', o.capabilities?.valueText === capabilitiesText, o.capabilities?.valueText);
   const catalog = JSON.parse(capabilitiesText);
-  const provider = catalog.providers?.find((v) => v.providerInstanceId === recommendation.request.providerInstanceId);
-  term('destination-execution', provider?.canRunChildTask === true
-    && provider?.runtimeModes?.includes(recommendation.request.runtimeMode), provider,
-  provider?.canRunChildTask == null || !Array.isArray(provider?.runtimeModes));
+  const providers = catalog.providers?.filter((v) => v.providerInstanceId === recommendation.request.providerInstanceId);
+  const provider = providers?.length === 1 ? providers[0] : undefined;
+  const mode = recommendation.request.runtimeMode;
+  // T3 0.1.5 resolveRuntimeMode/RuntimePolicy preserve modes without restrictions.
+  // Limit omission semantics to the observed version and native drivers we checked.
+  const unrestricted = provider?.runtimeModes === undefined && o.environment?.value?.serverVersion === '0.1.5'
+    && ['codex', 'claudeAgent'].includes(provider?.driverKind);
+  const supported = unrestricted || (Array.isArray(provider?.runtimeModes) && provider.runtimeModes.includes(mode));
+  term('destination-execution', provider?.canRunChildTask === true && supported
+    && catalog.runtimeMode === mode && Array.isArray(provider?.constraints) && provider.constraints.length === 0,
+  { provider, runtimeMode: catalog.runtimeMode, serverVersion: o.environment?.value?.serverVersion },
+  providers?.length === 0 || provider?.canRunChildTask == null || catalog.runtimeMode == null
+    || provider?.constraints == null || (provider?.runtimeModes === undefined && !unrestricted));
   const local = s.environmentId === recommendation.originEnvironmentId;
   const link = o.links?.value?.links?.find((v) => v.environmentId === s.environmentId);
   term('destination-access', o.links?.value?.environmentId === recommendation.originEnvironmentId

package/skills/axstack/scripts/fleet-dispatch.js

@@ -1,15 +1,22 @@
 // Bind supplied placement facts to a plan. No reads, dispatch or authority grant.
+import { isArtifact } from './fleet-scope.js';
 import { inspectDestination } from './fleet-destination.js';
 import { canonical, record, text } from './fleet-config.js';
 import { recommend } from './fleet-route.js';
 
-export function bindFleet(input, saved, configDigest, now, capabilitiesText, resolved, author) {
+export function bindFleet(input, saved, configDigest, now, capabilitiesText, resolved, author, roleId, kind) {
   const hold = (code) => { throw Object.assign(new Error(code), { exitCode: 2 }); };
   if (saved?.schemaVersion !== 1) hold('schema-version: recommendation');
   if (configDigest !== input?.configDigest) hold('config-digest-mismatch');
   let current;
   try { current = recommend(input, now); } catch (error) { hold(error.message); }
   if (canonical(saved) !== canonical(current)) hold('recommendation-mismatch');
+  const artifact = isArtifact(current.request);
+  if (artifact) {
+    if (roleId !== current.request.scope.roleId) hold('artifact-role-mismatch');
+    if (kind !== 'task') hold('artifact-task-only');
+    if (input.nativeDestination === undefined) hold('artifact-native-destination-required');
+  }
   const selected = current.selected;
   if (!selected) hold('no-executable-route');
   // Coordinator enablement/lifecycle is a later capability, never inferred here.
@@ -40,7 +47,8 @@ export function bindFleet(input, saved, configDigest, now, capabilitiesText, res
     return { id, value };
   });
   return {
-    options, destination: { environmentId: selected.environmentId, projectId: selected.projectId },
+    options, ...(artifact ? { artifactScope: current.request.scope, isolation: 'shared' } : {}),
+    destination: { environmentId: selected.environmentId, projectId: selected.projectId },
     fleetBinding: { configDigest, destinationSnapshotId: selected.destinationSnapshotId,
       destinationCapabilitiesDigest: digest },
   };

package/skills/axstack/scripts/fleet-facts.js

@@ -1,3 +1,4 @@
+import { isArtifact } from './fleet-scope.js';
 import { nativeAssignments } from './fleet-inventory.js';
 import { canonical, evidence, fail, record, text, time } from './fleet-config.js';
 
@@ -116,6 +117,8 @@ export function routeReasons(route, host, destination, facts, input, now) {
   const add = (code) => { if (!reasons.includes(code)) reasons.push(code); };
   const remote = route.environmentId !== input.origin.environmentId;
   const r = input.request;
+  const artifact = isArtifact(r);
+  if (artifact && (remote || route.kind !== 'local' || r.scope.environmentId !== input.origin.environmentId)) add('artifact-local-only');
   if (Object.hasOwn(input.exclusions.hosts, host.id)) add('excluded-host');
   if (Object.hasOwn(input.exclusions.routes, route.id)) add('excluded-route');
   if (!route.enabled) add('route-disabled');
@@ -134,7 +137,9 @@ export function routeReasons(route, host, destination, facts, input, now) {
       || !evidence(destination.evidence, host.environmentId, now)) add('evidence-unproven');
     if (!text(destination.snapshotId) || facts?.destinationSnapshotId !== destination.snapshotId) add('target-snapshot-mismatch');
     if (!record(destination.project) || !text(destination.project.id)) add('project-missing');
-    else if (destination.project.repositoryId !== r.repositoryId) add('project-mismatch');
+    else if (destination.project.repositoryId !== r.repositoryId
+      || (artifact && (destination.project.id !== r.scope.projectId
+        || destination.project.workspaceRoot !== r.scope.workspaceRoot))) add('project-mismatch');
     const e = destination.execution;
     if (!record(e) || e.available !== true) add('execution-unproven');
     else if (e.providerInstanceId !== r.providerInstanceId || e.model !== r.model

package/skills/axstack/scripts/fleet-native-receipt.js

@@ -0,0 +1,35 @@
+// T3 0.1.5 remote status omits options and a result-run ID. Never synthesize them.
+import { canonical, text, time } from './fleet-config.js';
+
+export function inspectNativeFamily(receipt, expected) {
+  const r = receipt;
+  const n = r.nativeFamily;
+  const s = expected.recommendation.selected;
+  const a = expected.attempt;
+  const child = r.status?.value?.remoteChild?.threadId;
+  const current = r.thread?.value?.thread?.latestRunId;
+  const terms = [];
+  const term = (pass, evidence) => terms.push({ code: 'receipt-native-family',
+    state: pass ? 'pass' : evidence == null ? 'unknown' : 'fail', evidence: evidence ?? null });
+  term(n?.tool === 'orchestration.getThreadFamily' && n?.transport === 't3-native-rpc'
+    && n?.environmentId === s.environmentId && n?.serverVersion === '0.1.5'
+    && s.versions?.t3 === n.serverVersion && canonical(n?.args) === canonical({ threadId: child })
+    && time(n?.observedAt) && n.observedAt <= expected.now
+    && n.observedAt >= r.thread?.observedAt && n.observedAt >= r.terminal?.observedAt
+    && text(n?.evidence), n);
+  const rows = n?.value?.threads;
+  const matches = Array.isArray(rows) ? rows.filter((v) => v?.id === child) : [];
+  term(time(n?.value?.snapshotSequence) && Array.isArray(rows)
+    && rows.every((v) => text(v?.id)) && new Set(rows.map((v) => v.id)).size === rows.length
+    && matches.length === 1, n?.value);
+  const shell = matches[0];
+  term(shell?.id === child && shell?.projectId === s.projectId && shell?.title === a?.title
+    && shell?.latestRunId === current && text(current)
+    && shell?.delegatedFrom?.environmentId === a?.origin?.environmentId
+    && shell?.delegatedFrom?.threadId === a?.origin?.threadId, shell);
+  term(shell?.status === 'completed' && Array.isArray(rows)
+    && rows.every((v) => ['completed', 'idle'].includes(v?.status) && v?.activeRunId === null
+      && Array.isArray(v?.pendingBackgroundTasks) && v.pendingBackgroundTasks.length === 0
+      && v?.pendingRuntimeRequest === null && v?.pendingGuestMessageCount === 0), rows);
+  return { terms, shell };
+}

package/skills/axstack/scripts/fleet-receipt.js

@@ -1,5 +1,7 @@
 // Saved evidence validator. A pass binds supplied facts; it cannot authenticate them.
 import { canonical, record, text, time } from './fleet-config.js';
+import { inside, isArtifact } from './fleet-scope.js';
+import { inspectNativeFamily } from './fleet-native-receipt.js';
 
 function options(value) {
   if (!Array.isArray(value)) return record(value) ? value : null;
@@ -20,6 +22,7 @@ export function inspectFleetReceipt(receipt, expected) {
   const a = expected.attempt;
   const s = expected.recommendation.selected;
   const request = expected.recommendation.request;
+  const artifact = isArtifact(request);
   term('receipt-origin', text(a?.origin?.threadId) && a?.origin?.environmentId === expected.recommendation.originEnvironmentId
     && same(r.attempt?.origin, a?.origin), r.attempt?.origin,
   !text(a?.origin?.threadId) || r.attempt?.origin == null);
@@ -57,12 +60,30 @@ export function inspectFleetReceipt(receipt, expected) {
     && target?.providerInstanceId === request.providerInstanceId && target?.model === request.model
     && same(options(target?.options), request.options) && r.requested?.runtimeMode === request.runtimeMode,
   r.requested);
+  const native = r.nativeFamily === undefined ? null : inspectNativeFamily(r, expected);
+  if (native) terms.push(...native.terms);
+  const shell = native?.shell;
+  const nativeValid = remote && native?.terms.every((t) => t.state === 'pass');
+  if (native) term('receipt-effective', shell?.providerInstanceId === request.providerInstanceId
+    && shell?.modelSelection?.instanceId === request.providerInstanceId
+    && shell?.modelSelection?.model === request.model
+    && Array.isArray(shell?.modelSelection?.options)
+    && same(options(shell?.modelSelection?.options), request.options)
+    && shell?.runtimeMode === request.runtimeMode, shell?.modelSelection);
+  const runs = r.thread?.value?.recentRuns;
+  // Without the origin result-run ID, only the sole initial run can own its summary.
+  const initial = nativeValid && status?.childThreadId === null && submitted?.childThreadId === null
+    && status?.childRunId === null && submitted?.childRunId === null
+    && status?.latestTerminalRunId === null && thread?.runCount === 1
+    && Array.isArray(runs) && runs.length === 1 && runs[0]?.ordinal === 1;
+  const effectiveOptions = status?.options === undefined && initial
+    ? shell?.modelSelection?.options : status?.options;
   term('receipt-effective', status?.providerInstanceId === request.providerInstanceId
     && status?.model === request.model && thread?.providerInstanceId === request.providerInstanceId
-    && thread?.model === request.model && same(options(status?.options), request.options)
+    && thread?.model === request.model && same(options(effectiveOptions), request.options)
     && thread?.runtimeMode === request.runtimeMode, { provider: status?.providerInstanceId,
-    model: status?.model, options: status?.options ?? null, runtimeMode: thread?.runtimeMode },
-  status?.options == null || thread?.runtimeMode == null);
+    model: status?.model, options: effectiveOptions ?? null, runtimeMode: thread?.runtimeMode },
+  effectiveOptions == null || thread?.runtimeMode == null);
   const terminal = r.terminal?.value;
   term('receipt-terminal', status?.status === 'completed' && status?.latestTerminalStatus === 'completed'
     && status?.workState === 'result_available' && status?.hasPendingChildRuns === false
@@ -84,9 +105,8 @@ export function inspectFleetReceipt(receipt, expected) {
     && questions.value.requests.length === 0, questions,
   questions == null || questions.value?.requests === undefined);
   const current = thread?.latestRunId;
-  const runs = r.thread?.value?.recentRuns;
   const latest = Array.isArray(runs) ? runs.find((v) => v.runId === current) : null;
-  term('receipt-run', text(current) && status?.latestTerminalRunId === current
+  term('receipt-run', text(current) && (status?.latestTerminalRunId === current || initial)
     && terminal?.threadId === child(status) && terminal?.runId === current
     && (!terminal?.resultRun || (terminal.resultRun.runId === current && terminal.resultRun.status === 'completed'))
     && (!remote || (r.remoteChild?.environmentId === s.environmentId
@@ -94,7 +114,7 @@ export function inspectFleetReceipt(receipt, expected) {
     && latest?.status === 'completed' && Number.isSafeInteger(latest?.ordinal)
     && runs.every((v) => Number.isSafeInteger(v.ordinal) && v.ordinal <= latest.ordinal),
   { current, originTerminal: status?.latestTerminalRunId, terminal, runs },
-  !current || !status?.latestTerminalRunId || !terminal?.runId || !Array.isArray(runs)
+  !current || (!status?.latestTerminalRunId && !initial) || !terminal?.runId || !Array.isArray(runs)
     || (remote && !r.remoteChild?.runId));
   const marker = `AXSTACK-DONE key=${a?.key} head=${a?.candidate} report=${r.evidence?.path}`;
   const finalMarker = (value) => {
@@ -109,15 +129,46 @@ export function inspectFleetReceipt(receipt, expected) {
   };
   const items = r.thread?.value?.items;
   const final = Array.isArray(items) ? items.filter((v) => v.runId === current && v.createdBy === 'agent').at(-1) : null;
-  term('receipt-marker', /^[a-f0-9]{40}$/.test(a?.candidate ?? '')
-    && finalMarker(status?.latestTerminalSummary) === marker && finalMarker(final?.text) === marker,
-  { origin: status?.latestTerminalSummary, destination: final?.text });
+  // T3 0.1.5 suppresses latestTerminalSummary when it equals summary.
+  // Only the same local result run may use that deduplicated value.
+  const localSummary = artifact && !remote && s.versions?.t3 === '0.1.5'
+    && status?.latestTerminalSummary === null && text(current)
+    && status?.childRunId === current && status?.latestTerminalRunId === current
+    && status?.status === 'completed' && status?.summary === final?.text;
+  const resultSummary = localSummary ? status.summary : status?.latestTerminalSummary;
+  term('receipt-marker', (artifact ? /^[a-f0-9]{64}$/ : /^[a-f0-9]{40}$/).test(a?.candidate ?? '')
+    && finalMarker(resultSummary) === marker && finalMarker(final?.text) === marker
+    && (!initial || resultSummary === final?.text),
+  { origin: resultSummary, destination: final?.text });
   term('receipt-host-path', r.evidence?.hostId === s.hostId && r.evidence?.environmentId === s.environmentId
-    && absolute(r.evidence?.path) && finalMarker(status?.latestTerminalSummary)?.endsWith(` report=${r.evidence.path}`), r.evidence);
-  if (a?.title?.startsWith('Reviewer: ')) {
+    && absolute(r.evidence?.path) && finalMarker(resultSummary)?.endsWith(` report=${r.evidence.path}`), r.evidence);
+  if (artifact) {
+    const scope = request.scope;
+    const bytes = r.artifact;
+    term('receipt-artifact-scope', a?.base === null && same(r.artifactScope, scope)
+      && inside(r.evidence?.path, scope.evidenceRoot), r.artifactScope);
+    term('receipt-artifact-bytes', bytes?.sha256 === a?.candidate && inside(bytes?.path, scope.artifactRoot)
+      && bytes?.readback?.path === bytes.path && bytes?.readback?.sha256 === bytes.sha256
+      && text(bytes?.readback?.evidence), bytes);
+    // Shared native children can inherit a parent's non-Git scratch directory.
+    // Bind that value to an actual parent read; a path alone proves nothing.
+    const parent = r.parent;
+    const parentThread = parent?.value?.thread;
+    const inherited = !remote && s.versions?.t3 === '0.1.5'
+      && parent?.tool === 't3_thread_read' && parent.environmentId === a?.origin?.environmentId
+      && same(parent.args, { threadId: a?.origin?.threadId })
+      && time(parent.observedAt) && parent.observedAt <= expected.now && text(parent.evidence)
+      && parentThread?.threadId === a?.origin?.threadId && parentThread?.projectId === s.projectId
+      && thread?.parentThreadId === parentThread?.threadId && thread?.relationshipToParent === 'subagent'
+      && absolute(parentThread?.worktreePath) && inside(parentThread.worktreePath, scope.workspaceRoot)
+      && thread?.worktreePath === parentThread.worktreePath;
+    term('receipt-isolation', r.requested?.isolation === 'shared'
+      && (thread?.worktreePath === null || inherited) && r.checkout == null,
+    { isolation: r.requested?.isolation, worktreePath: thread?.worktreePath, parent });
+  } else if (a?.title?.startsWith('Reviewer: ')) {
     term('receipt-isolation', r.requested?.isolation === 'worktree', r.requested?.isolation);
   }
-  if (a?.title?.startsWith('Reviewer: ') || r.checkout != null || thread?.worktreePath != null || r.requested?.isolation === 'worktree') {
+  if (!artifact && (a?.title?.startsWith('Reviewer: ') || r.checkout != null || thread?.worktreePath != null || r.requested?.isolation === 'worktree')) {
     const c = r.checkout;
     term('receipt-checkout', c?.hostId === s.hostId && c?.environmentId === s.environmentId
       && absolute(c?.path) && c.path === thread?.worktreePath

package/skills/axstack/scripts/fleet-scope.js

@@ -0,0 +1,24 @@
+// Explicit artifact authority, separate from repository engineering authority.
+const sourceRoles = ['axstack-research-requirements', 'axstack-research-code', 'axstack-research-code-sol',
+  'axstack-explore-execution', 'axstack-explore-execution-sol',
+  'axstack-research-web', 'axstack-research-web-sol', 'axstack-research-x', 'axstack-diligence'];
+const articleRoles = ['axstack-explainer', 'axstack-explainer-review', 'axstack-ui-verifier', 'axstack-ui-verifier-sonnet'];
+export const isArtifact = (request) => request?.scope?.kind === 'local-artifact';
+const path = (value) => typeof value === 'string' && value.startsWith('/') && value !== '/'
+  && !/[\s\x00-\x1f\x7f]/.test(value) && !value.slice(1).split('/').some((v) => ['', '.', '..'].includes(v));
+export const inside = (value, root) => path(value) && path(root) && value.startsWith(`${root}/`);
+const overlaps = (a, b) => a === b || inside(a, b) || inside(b, a);
+
+export function validScope(request) {
+  const s = request.scope;
+  if (s === undefined) return typeof request.repositoryId === 'string' && request.repositoryId.trim().length > 0;
+  if (s?.kind === 'repository') return typeof request.repositoryId === 'string' && request.repositoryId.trim().length > 0;
+  if (!isArtifact(request) || request.repositoryId !== null || request.role !== 'reader'
+    || !['research', 'explain', 'publish'].includes(s.workflow)
+    || ![...sourceRoles, ...(s.workflow === 'research' ? [] : articleRoles)].includes(s.roleId)
+    || ![s.environmentId, s.projectId].every((v) => typeof v === 'string' && v.trim().length > 0)
+    || !inside(s.artifactRoot, s.workspaceRoot) || !inside(s.evidenceRoot, s.workspaceRoot)
+    || overlaps(s.artifactRoot, s.evidenceRoot) || !Array.isArray(s.reservedRoots)
+    || s.reservedRoots.some((root) => !path(root) || overlaps(root, s.artifactRoot) || overlaps(root, s.evidenceRoot))) return false;
+  return true;
+}

package/skills/axstack-explain/SKILL.md

@@ -20,6 +20,10 @@ scope baseline. Ordinary work in the current chat needs no launch preflight;
 load the [T3 runtime boundary](../axstack/references/t3-runtime.md) only
 immediately before an actual profile dispatch.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## 1. Bound the question and evidence
 
 1. Identify the audience, question, requested format, theme, and publication

package/skills/axstack-explain/references/visual-qa.md

@@ -24,7 +24,12 @@ Interaction checks remain with `axstack-ui-verifier`; source-fidelity review is
 Use this checklist for every HTML explanation and other visual artifacts where
 rendering matters.
 
-Browser and visual checks must run in the delegated `axstack-ui-verifier` in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Browser and visual checks use delegated `axstack-ui-verifier`: engineering
+candidates require its own detached checkout; explicit non-repository articles
+use the local shared delegate with an owned exact-byte snapshot under
+[Local artifacts](../../axstack/references/local-artifacts.md). Outputs stay in
+its private evidence folder. Playwright checks and source/design review remain
+bound to the exact final SHA-256 before public publication.
 
 1. Identify the final artifact bytes and theme. The explicit user theme wins;
    otherwise use `prefers-color-scheme`.

package/skills/axstack-publish/SKILL.md

@@ -10,6 +10,10 @@ The current T3 driver owns publication; workers return checked artifacts.
 Load [Standing contracts](../axstack/references/contracts.md) and follow its
 lifecycle pointers. Keep page bytes, checks and receipts in private run evidence.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## 1. Bind the request
 
 Read host-managed `~/.config/axstack/publish.json` containing string fields

package/skills/axstack-research/SKILL.md

@@ -20,6 +20,10 @@ baseline, ticket map, or author pipeline. Keep it read-only unless requested
 and separately authorized to change product code or publish; otherwise, neither
 is part of research.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## Procedure
 
 1. **Frame the question.** Restate the question, what is in scope, what is

package/skills/axstack-review/SKILL.md

@@ -11,6 +11,11 @@ Include [Safe deletion](../axstack/references/workspace-hygiene.md#safe-deletion
 
 Manual review keeps the user’s chat and workspace open.
 
+For non-repository article/source review, follow
+[Local artifacts](../axstack/references/local-artifacts.md); Explain/Publish own
+the independent artifact review. PR/code-review modes below retain repository
+and native worktree requirements; null identity never selects those modes.
+
 Produce evidence-bound findings for an exact revision using the review count
 and model routing required by its mode. Report within the requested authority;
 for own PRs, automatic merge is the default under the