axstack 0.56.1 → 0.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.56.1",
+  "version": "0.57.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/diligence.md

@@ -5,7 +5,9 @@ and bounded follow-ups are defined in [Peer mode](../../axstack-review/SKILL.md#
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch.
 Dispatch `axstack-diligence` with async `delegate_task` in the driver worktree,
-using a pinned brief and private evidence paths.
+using a pinned brief and private evidence paths. Explicit non-repository
+research/article diligence uses [Local artifacts](local-artifacts.md) with
+local shared isolation and independently reopened sources, without a fake Git repo.
 It is read-only, never authors or edits, and returns `PASS`, `FINDINGS`, or `UNKNOWN`
 with locations, observed evidence, and limits. A stale or missing receipt is
 not a pass. Keep its first pass independent of other reviewers and workers.

package/skills/axstack/references/fleet-dispatch.md

@@ -7,6 +7,12 @@ records and forge actions. Helpers validate explicit saved inputs only: no
 network, clock, dispatch, retry, merge, retained state or aggregate permission grant.
 Synthetic evidence can pass binding checks; helpers cannot authenticate it.
 
+For explicit local non-repository Research/Explain/Publish work, apply
+[Local artifacts](local-artifacts.md): its discriminated scope, native read/list
+null-identity proof and owned folders replace only the repository/checkout terms.
+All native execution authority and independent exact-byte review remain required.
+Engineering/code review and remote routes retain their existing rules.
+
 ## Observe before selecting
 
 1. Record installed Axstack and both T3 versions, directed origin/target link,
@@ -70,7 +76,7 @@ read envelope is `{tool,environmentId,args,observedAt,evidence,value}` where arg
 excludes the forwarding environmentId, and evidence points to the preserved raw
 native call/result. environment/project/capabilities are read on the selected
 host; links are read on origin. The capabilities envelope uses `valueText` for
-exact raw catalog bytes instead of value. Project repositoryIdentity.canonicalKey
+exact raw catalog bytes instead of value. For repository scope, project repositoryIdentity.canonicalKey
 must match the requested repositoryId. If project-read identity is null/omitted,
 `projectList` may carry an ordered array of `t3_project_list` read envelopes on
 that same environment. Collect from cursor 0 through native nextCursor:null,
@@ -78,7 +84,9 @@ recording actual cursor/limit arguments (native defaults: 0/20, limit at most 10
 Every page must join without gaps, extra arguments or duplicate project IDs.
 The selected project's ID and workspaceRoot must equal project-read; every
 available canonicalKey must equal repositoryId, including when both reads have
-identity. Missing identity in both, incomplete pagination and any conflict hold.
+identity. In repository scope, missing identity in both holds; local-artifact
+scope instead requires explicit null in both reads. Incomplete pagination and
+any conflict hold for either scope.
 
 For observed T3 0.1.5 native Codex/Claude drivers, omitted provider runtimeModes
 means no provider restriction: native resolveRuntimeMode and RuntimePolicy
@@ -98,9 +106,11 @@ recommendation, explicit evaluation time and config pin. Compare its target to t
 independently selected host/environment/project/model/options/runtimeMode. Copy only
 native supported fields, never inputs or fleetBinding. Call `delegate_task` with
 that exact target, full-access, a role-labelled title, stable clientRequestId and
-scope. Reviewers require native isolation:"worktree" and pinned candidate/base;
-no shell-created child checkout. Other nonwriters write only their named private
-evidence directory on that host. Preserve requested arguments and native response.
+scope. Code reviewers require native isolation:"worktree" and pinned candidate/base;
+no shell-created child checkout. Explicit local artifact reviewers instead use
+shared isolation and SHA-256 snapshots under [Local artifacts](local-artifacts.md);
+artifact writers use only their owned artifact/evidence folders. Other nonwriters
+write only their named private evidence directory on that host. Preserve requested arguments and native response.
 
 Record taskId on the origin plus remoteChild.environmentId/threadId. The native
 remoteChild schema need not return runId: normalize it from observed task/thread
@@ -117,7 +127,9 @@ recommendation at the same model/permission pins; record the exclusion evidence.
 
 Preserve schemaVersion:1, recommendationJSON (exact bytes), configDigest,
 attempt (key, exact title, clientRequestId, origin environmentId/threadId/taskId,
-candidate/base SHAs), requested target/runtimeMode/isolation and native submission.
+candidate/base SHAs for repositories, artifact SHA-256/null base for local artifacts),
+requested target/runtimeMode/isolation and native submission. Artifact ownership
+and byte readbacks follow [Local artifacts](local-artifacts.md#receipts).
 The driver's independent fleetAttempt is the expected run-record identity;
 never copy it from an arriving receipt to make a comparison pass.
 
@@ -137,6 +149,9 @@ submission.childRunId; never use lexical ordering of IDs or the original summary
 Require completed/result_available/no pending children/no unanswered questions or
 approval. Require exactly one AXSTACK-DONE key/candidate/report marker on both origin's
 latestTerminalSummary and the destination's final current-run agent message.
+For local artifacts only, T3 0.1.5's deduplicated summary uses the exact
+run/byte-bound exception in [Local artifacts](local-artifacts.md#receipts);
+never rewrite raw native fields or extend it to remote/engineering receipts.
 A completion marker may be followed by the T3
 `PR <url>, head <sha>, checks and reviews <state>` trailer. Other trailing text
 or additional AXSTACK markers keep the receipt held.

package/skills/axstack/references/fleet-route-schema.md

@@ -112,6 +112,13 @@ for serial emulator use, desktop safety and declared thermal prechecks.
 | `pendingAssignments` | Array of `{clientRequestId, environmentId, taskId?}` |
 | `exclusions` | `{hosts: {hostId: reason}, routes: {routeId: reason}}`; nonempty reason strings |
 
+`request.scope` may be `{kind:"repository"}` with a nonempty repositoryId;
+legacy omitted scope retains that repository requirement. The explicit
+`{kind:"local-artifact", ...}` alternative requires repositoryId:null and the
+workflow, role, native project and ownership fields in [Local artifacts](local-artifacts.md).
+Artifact destination project also carries workspaceRoot; only the bound local
+environment/project/workspace is eligible. Null alone never selects a route.
+
 `role` is `reader` (all nonwriter roles) or `author`. `requiredCapabilities`
 is an array of strings. An authentication requirement names the actual session
 capability; only the host proving that session is eligible. No credential
@@ -311,7 +318,10 @@ unavailable destination model/options, or role/settings/config disagreement.
 It never reinterprets a requested model pin as a different available model.
 
 Task plans add `environmentId`/`projectId` to `target`; launch plans add them
-beside `modelSelection`. All requested options survive as T3 option entries.
+beside `modelSelection`. All requested options survive as T3 option entries. Explicit local-artifact
+plans require nativeDestination, the exact scope role and task kind; they emit
+isolation:"shared" and artifactScope evidence. The latter is never a native
+argument. Artifact readback compares scope and shared isolation as well.
 Both include `fleetBinding: {configDigest, destinationSnapshotId,
 destinationCapabilitiesDigest}`. This is preserved evidence, not a T3 launch
 parameter. Copy only tool-supported launch fields. Coordinator author routes

package/skills/axstack/references/lifecycle.md

@@ -29,6 +29,12 @@ Prefer parallel independent bounded work; no redundant workers. Fanout is depend
 capacity-driven within host/spending limits. [PR shape](pr-shape.md) covers
 theme/size; queue dependencies under [PR chains](pr-chain.md).
 
+For explicit non-repository Research/Explain/Publish artifacts, use
+[Local artifacts](local-artifacts.md) for owned shared delegates and SHA-256
+receipts. The reviewer checkout row above applies to code candidates; article
+review retains independent source/fact and exact-byte UI/design checks.
+Null identity does not waive engineering isolation or authorize remote artifacts.
+
 ## Ownership
 
 The PR owner is accountable for candidate, fixes, evidence, monitoring.

package/skills/axstack/references/local-artifacts.md

@@ -0,0 +1,100 @@
+# Local non-repository artifacts
+
+Research, Explain and Publish may use an explicitly bound non-repository
+artifact scope. Null repository identity alone never authorizes a route.
+Engineering authors and code reviewers still require a repository and native
+Git worktree isolation. Remote artifacts and remote author/coordinator work
+remain outside this scope.
+
+## Scope and ownership
+
+Use `request.scope` below with `repositoryId:null` and `role:reader`.
+Here reader means no product-code authority; an explainer may write only its
+owned article artifacts. `task` remains a load preference, not role authority.
+The scope is evidence for the helpers and brief, never a native T3 argument.
+
+```json
+{
+  "kind": "local-artifact",
+  "workflow": "explain",
+  "roleId": "axstack-explainer",
+  "environmentId": "<current environment>",
+  "projectId": "<actual parent project>",
+  "workspaceRoot": "/scratch",
+  "artifactRoot": "/scratch/run/artifacts/author-a1",
+  "evidenceRoot": "/scratch/run/evidence/author-a1",
+  "reservedRoots": ["/scratch/run/artifacts/other-attempt"]
+}
+```
+
+`workflow` is research, explain or publish. All three permit the configured
+research requirements/code/code-sol/web/web-sol/X and explore-execution/
+explore-execution-sol source roles plus diligence. Explain and Publish also
+permit explainer, explainer-review and the configured UI verifier roles.
+Use their full `axstack-` role IDs; this list does not make an absent seat
+available or change provider/model/effort/options/runtime authority.
+The selected role ID must equal scope.roleId in dispatch-plan.
+No engineering author, code reviewer, owner or arbitrary role can use this scope.
+
+The driver binds the native parent project and its real workspaceRoot. Require
+explicit null repositoryIdentity in both project-read and complete project-list
+reads; omitted, conflicting or incomplete observations hold. Native environment,
+project, catalog, provider restrictions, options, runtime and access checks still
+apply. Use only a local route in that environment/project/workspace. Do not
+fabricate a repository ID, initialize Git or attach an unrelated repository.
+
+Give every attempt separate owned artifact and evidence directories, strict
+children of the observed workspaceRoot. They must be canonical absolute paths,
+with no traversal, shared-root writes or ancestor/equal overlap. `reservedRoots`
+is the driver's current list of other attempts' owned artifact/evidence roots;
+include pending and retained attempts, never guess an empty inventory.
+The helper checks lexical paths and overlaps; the driver must independently
+verify real paths, no symlink escapes, ownership and exclusive writers on disk.
+Unknown ownership holds. This is supplied evidence, not an authenticated lock.
+
+## Native dispatch and review
+
+Use async native `delegate_task` with `isolation:"shared"`, exact local target,
+role-labelled title and stable clientRequestId. Native local projectId must equal
+the parent's project; moving to another local project is unsupported. Preserve
+requested arguments and native effective settings separately. Dispatch-plan
+requires nativeDestination and `--kind task`; it returns artifactScope as evidence
+and shared isolation. Copy only supported native arguments into delegate_task.
+No top-level launch, shell checkout, live policy edit or per-run bypass is needed.
+
+Research branches keep independent first passes and cited-source reopening.
+Diligence reopens answer-changing claims; it never becomes the article author.
+The explainer remains sole source writer. Reviewers/verifiers get their own
+byte-identical snapshot in their owned artifact directory; their reports/probes
+stay in their separate evidence directory and never edit the author's original.
+Independent explainer review checks the exact SHA-256 bytes. Before public
+publication require Playwright layout/interaction evidence and independent
+source/fact and design review of those same bytes under Explain/Publish rules.
+Changed bytes invalidate affected reviews and renders; unknown proof holds.
+Shared filesystem access does not permit cross-reading independent first passes.
+Publication remains the explicitly authorized driver's action.
+
+## Receipts
+
+Retain the normal native task/thread/run, pending-question and settings checks.
+For artifact receipts, `attempt.candidate` and marker `head` are the exact
+64-hex artifact SHA-256; `attempt.base` is null. They are not Git revisions.
+Bind `artifactScope` to the requested scope and report to evidenceRoot.
+Supply `artifact:{path,sha256,readback:{path,sha256,evidence}}` for the independently
+hashed owned snapshot. Requested isolation must be shared. Native child worktreePath may be null;
+on T3 0.1.5 it may also inherit the parent's non-Git scratch path. For the latter,
+include `parent` as a saved `t3_thread_read` observation (tool, environmentId,
+args.threadId, observedAt, evidence, value.thread). Bind it to the attempt's
+origin thread, selected project, child parentThreadId/subagent relationship and
+identical canonical path inside workspaceRoot. Verify the actual filesystem;
+this is shared access, not a Git checkout or OS isolation. Checkout metadata
+remains forbidden. Unknown or different parent/path evidence holds.
+
+T3 0.1.5 deduplicates local task results: latestTerminalSummary can be null when
+summary contains the same result. For local artifact receipts only, use that
+summary when childRunId and latestTerminalRunId both equal the current completed
+run and its bytes equal the destination final message. An explicit conflicting
+terminal summary, stale run, other version or remote result does not use this
+fallback. Preserve the raw native fields; do not rewrite them. Never synthesize an effective field from requested settings.
+The driver checks actual bytes and readbacks; helpers validate saved data only.
+Keep artifact receipts separate from Git candidate publication/PR/merge receipts.

package/skills/axstack/references/role-roster.md

@@ -6,6 +6,11 @@ native destination. Remote reviewers require T3 worktree isolation; no shell chi
 checkout. Host names confer no role or permission. Remote authors/coordinator stay
 disabled; local isolated authors remain supported even overloaded.
 
+Explicit non-repository Research/Explain/Publish uses the bounded role allowlist
+and local shared-artifact isolation in [Local artifacts](local-artifacts.md).
+This changes no configured seat, source independence or exact-byte review duty.
+Engineering authors and code reviewers cannot acquire this artifact authority.
+
 - Chat drives (no role ID); `axstack-owner` owns one PR and
   `axstack-author` its sole writer.
   For own PRs, automatic merge is the default under the

package/skills/axstack/references/t3-runtime.md

@@ -204,6 +204,13 @@ a candidate follows [UI verification](ui-verification.md).
 
 The driver must be the sole run-record writer and enforce one writer per
 candidate; it never writes tracked candidate source or tests or repairs an author's source.
+For explicit non-repository Research/Explain/Publish only,
+[Local artifacts](local-artifacts.md) supplies the artifact branch of this table:
+source readers, diligence, explainers and article/UI reviewers use local shared
+native delegates with separate owned folders and exact SHA-256 snapshots.
+Its role allowlist excludes engineering authors and code reviewers; their native
+Git worktree rules above remain mandatory. Null repository alone grants nothing.
+
 The driver may write planning artifacts (spec, ticket map) in its own worktree when the selected store is repository Markdown.
 Repairs return to that author. Missing or idle sessions grant no ownership transfer.
 The current chat/driver has no role row in any preset.

package/skills/axstack/references/ui-verification.md

@@ -24,8 +24,11 @@ All other browser checks outside the two named exceptions remain delegated to co
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch; for candidate
 checks use its driver-made disposable detached checkout at the pinned candidate SHA.
+For explicit non-repository article checks, use the local shared delegate and
+owned SHA-256 snapshot in [Local artifacts](local-artifacts.md); no Git candidate
+is fabricated. Engineering candidate checks retain the checkout requirement.
 Use the configured verifier browser and honor the user browser-tool policy.
-Candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Engineering candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
 
 For every interactive page, require a real-browser `axstack-ui-verifier` interaction pass.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 import { inspectFleetReceipt } from './fleet-receipt.js';
 import { bindFleet } from './fleet-dispatch.js';
+import { canonical } from './fleet-config.js';
 
 const fleetFlags = ['--recommendation', '--fleet-input', '--now', '--config-digest'];
 const flags = ['--role', '--roles', '--capabilities', '--kind', '--verify', '--out', ...fleetFlags];
@@ -34,6 +35,9 @@ by its destination facts. It is never the origin catalog by default.
 Fleet verification requires environmentId/projectId and fleetBinding alongside
 the effective T3 configuration. C3 collects that host-qualified evidence envelope.
 Optional input.nativeDestination validates saved native forwarded reads.
+Explicit local-artifact scope requires those reads and kind task; emits isolation:"shared".
+artifactScope is preserved evidence only, never a native tool argument.
+Artifact verification also requires artifactScope and independently checked isolation.
 Optional --verify fleetAttempt/fleetReceipt validates host-qualified terminal facts;
 --out retains per-term receipt evidence. Synthetic bindings cannot authenticate reads.
 Coordinator routes remain unsupported here. A plan grants no launch authority.
@@ -98,6 +102,11 @@ function verify(configuration, provider, model, options, fleet) {
   if (fleet) {
     for (const [field, expected] of Object.entries(fleet.destination)) compare(field, expected, configuration?.[field]);
     for (const [field, expected] of Object.entries(fleet.fleetBinding)) compare(field, expected, configuration?.fleetBinding?.[field]);
+    if (fleet.artifactScope) {
+      compare('artifactScope', fleet.artifactScope, configuration?.artifactScope,
+        canonical(fleet.artifactScope) === canonical(configuration?.artifactScope));
+      compare('isolation', 'shared', configuration?.isolation);
+    }
   }
   let receiptTerms;
   if (fleet && configuration?.fleetReceipt !== undefined) {
@@ -175,7 +184,7 @@ function plan(argv, io) {
     const recommendation = JSON.parse(recommendationJSON);
     fleet = bindFleet(readJSON(args['--fleet-input']), recommendation,
       args['--config-digest'], Number(args['--now']), readFileSync(args['--capabilities'], 'utf8'),
-      resolution, role.id === 'axstack-author');
+      resolution, role.id === 'axstack-author', role.id, args['--kind']);
     fleet.recommendation = recommendation;
     fleet.recommendationJSON = recommendationJSON;
     fleet.now = Number(args['--now']);
@@ -189,6 +198,7 @@ function plan(argv, io) {
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: providerInstanceId,
     model, options, ...(args['--kind'] === 'task' ? fleet?.destination : {}) };
   emit({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection, runtimeMode: 'full-access',
+    ...(fleet?.artifactScope ? { artifactScope: fleet.artifactScope, isolation: fleet.isolation } : {}),
     ...(fleet ? { fleetBinding: fleet.fleetBinding, ...(args['--kind'] === 'launch' ? fleet.destination : {}) } : {}),
     ...(args['--kind'] === 'task' && role.id === 'axstack-author' ? { isolation: 'worktree' } : {}) });
   return 0;

package/skills/axstack/scripts/fleet-config.js

@@ -1,3 +1,5 @@
+import { validScope } from './fleet-scope.js';
+
 // Configuration is reviewed data. This module does not read account-local files.
 export function fail(code) { throw new Error(code); }
 export const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -58,7 +60,7 @@ export function validateInput(input, now) {
   const r = input.request;
   if (!record(r) || !text(r.task) || !['reader', 'author'].includes(r.role)
     || !Array.isArray(r.requiredCapabilities) || !r.requiredCapabilities.every(text)
-    || !text(r.repositoryId) || !text(r.providerInstanceId) || !text(r.model)
+    || !validScope(r) || !text(r.providerInstanceId) || !text(r.model)
     || !record(r.options) || !text(r.runtimeMode)) fail('request-schema');
   for (const key of ['destinations', 'routeFacts', 'telemetry', 'assignments', 'pendingAssignments']) {
     if (!Array.isArray(input[key])) fail(`${key}-schema`);

package/skills/axstack/scripts/fleet-destination.js

@@ -1,4 +1,5 @@
 // Validate explicit saved native reads. These bindings do not authenticate input.
+import { isArtifact } from './fleet-scope.js';
 import { canonical, text, time } from './fleet-config.js';
 
 export function inspectDestination(observation, recommendation, capabilitiesText, now) {
@@ -51,9 +52,17 @@ export function inspectDestination(observation, recommendation, capabilitiesText
   }
   // ProjectService.listPage resolves the cold identity cache; getById need not.
   const identities = [project?.repositoryIdentity, listed?.repositoryIdentity].filter((v) => v != null);
-  term('destination-repository', identities.length > 0
-    && identities.every((v) => v.canonicalKey === s.repositoryId), identities,
-  identities.length === 0);
+  if (isArtifact(recommendation.request)) {
+    const scope = recommendation.request.scope;
+    term('destination-artifact-project', project?.repositoryIdentity === null
+      && listed?.repositoryIdentity === null && project?.workspaceRoot === scope.workspaceRoot
+      && s.environmentId === scope.environmentId && s.projectId === scope.projectId,
+    { project, listed });
+  } else {
+    term('destination-repository', identities.length > 0
+      && identities.every((v) => v.canonicalKey === s.repositoryId), identities,
+    identities.length === 0);
+  }
   term('destination-catalog', o.capabilities?.valueText === capabilitiesText, o.capabilities?.valueText);
   const catalog = JSON.parse(capabilitiesText);
   const providers = catalog.providers?.filter((v) => v.providerInstanceId === recommendation.request.providerInstanceId);

package/skills/axstack/scripts/fleet-dispatch.js

@@ -1,15 +1,22 @@
 // Bind supplied placement facts to a plan. No reads, dispatch or authority grant.
+import { isArtifact } from './fleet-scope.js';
 import { inspectDestination } from './fleet-destination.js';
 import { canonical, record, text } from './fleet-config.js';
 import { recommend } from './fleet-route.js';
 
-export function bindFleet(input, saved, configDigest, now, capabilitiesText, resolved, author) {
+export function bindFleet(input, saved, configDigest, now, capabilitiesText, resolved, author, roleId, kind) {
   const hold = (code) => { throw Object.assign(new Error(code), { exitCode: 2 }); };
   if (saved?.schemaVersion !== 1) hold('schema-version: recommendation');
   if (configDigest !== input?.configDigest) hold('config-digest-mismatch');
   let current;
   try { current = recommend(input, now); } catch (error) { hold(error.message); }
   if (canonical(saved) !== canonical(current)) hold('recommendation-mismatch');
+  const artifact = isArtifact(current.request);
+  if (artifact) {
+    if (roleId !== current.request.scope.roleId) hold('artifact-role-mismatch');
+    if (kind !== 'task') hold('artifact-task-only');
+    if (input.nativeDestination === undefined) hold('artifact-native-destination-required');
+  }
   const selected = current.selected;
   if (!selected) hold('no-executable-route');
   // Coordinator enablement/lifecycle is a later capability, never inferred here.
@@ -40,7 +47,8 @@ export function bindFleet(input, saved, configDigest, now, capabilitiesText, res
     return { id, value };
   });
   return {
-    options, destination: { environmentId: selected.environmentId, projectId: selected.projectId },
+    options, ...(artifact ? { artifactScope: current.request.scope, isolation: 'shared' } : {}),
+    destination: { environmentId: selected.environmentId, projectId: selected.projectId },
     fleetBinding: { configDigest, destinationSnapshotId: selected.destinationSnapshotId,
       destinationCapabilitiesDigest: digest },
   };

package/skills/axstack/scripts/fleet-facts.js

@@ -1,3 +1,4 @@
+import { isArtifact } from './fleet-scope.js';
 import { nativeAssignments } from './fleet-inventory.js';
 import { canonical, evidence, fail, record, text, time } from './fleet-config.js';
 
@@ -116,6 +117,8 @@ export function routeReasons(route, host, destination, facts, input, now) {
   const add = (code) => { if (!reasons.includes(code)) reasons.push(code); };
   const remote = route.environmentId !== input.origin.environmentId;
   const r = input.request;
+  const artifact = isArtifact(r);
+  if (artifact && (remote || route.kind !== 'local' || r.scope.environmentId !== input.origin.environmentId)) add('artifact-local-only');
   if (Object.hasOwn(input.exclusions.hosts, host.id)) add('excluded-host');
   if (Object.hasOwn(input.exclusions.routes, route.id)) add('excluded-route');
   if (!route.enabled) add('route-disabled');
@@ -134,7 +137,9 @@ export function routeReasons(route, host, destination, facts, input, now) {
       || !evidence(destination.evidence, host.environmentId, now)) add('evidence-unproven');
     if (!text(destination.snapshotId) || facts?.destinationSnapshotId !== destination.snapshotId) add('target-snapshot-mismatch');
     if (!record(destination.project) || !text(destination.project.id)) add('project-missing');
-    else if (destination.project.repositoryId !== r.repositoryId) add('project-mismatch');
+    else if (destination.project.repositoryId !== r.repositoryId
+      || (artifact && (destination.project.id !== r.scope.projectId
+        || destination.project.workspaceRoot !== r.scope.workspaceRoot))) add('project-mismatch');
     const e = destination.execution;
     if (!record(e) || e.available !== true) add('execution-unproven');
     else if (e.providerInstanceId !== r.providerInstanceId || e.model !== r.model

package/skills/axstack/scripts/fleet-receipt.js

@@ -1,5 +1,6 @@
 // Saved evidence validator. A pass binds supplied facts; it cannot authenticate them.
 import { canonical, record, text, time } from './fleet-config.js';
+import { inside, isArtifact } from './fleet-scope.js';
 import { inspectNativeFamily } from './fleet-native-receipt.js';
 
 function options(value) {
@@ -21,6 +22,7 @@ export function inspectFleetReceipt(receipt, expected) {
   const a = expected.attempt;
   const s = expected.recommendation.selected;
   const request = expected.recommendation.request;
+  const artifact = isArtifact(request);
   term('receipt-origin', text(a?.origin?.threadId) && a?.origin?.environmentId === expected.recommendation.originEnvironmentId
     && same(r.attempt?.origin, a?.origin), r.attempt?.origin,
   !text(a?.origin?.threadId) || r.attempt?.origin == null);
@@ -127,16 +129,46 @@ export function inspectFleetReceipt(receipt, expected) {
   };
   const items = r.thread?.value?.items;
   const final = Array.isArray(items) ? items.filter((v) => v.runId === current && v.createdBy === 'agent').at(-1) : null;
-  term('receipt-marker', /^[a-f0-9]{40}$/.test(a?.candidate ?? '')
-    && finalMarker(status?.latestTerminalSummary) === marker && finalMarker(final?.text) === marker
-    && (!initial || status?.latestTerminalSummary === final?.text),
-  { origin: status?.latestTerminalSummary, destination: final?.text });
+  // T3 0.1.5 suppresses latestTerminalSummary when it equals summary.
+  // Only the same local result run may use that deduplicated value.
+  const localSummary = artifact && !remote && s.versions?.t3 === '0.1.5'
+    && status?.latestTerminalSummary === null && text(current)
+    && status?.childRunId === current && status?.latestTerminalRunId === current
+    && status?.status === 'completed' && status?.summary === final?.text;
+  const resultSummary = localSummary ? status.summary : status?.latestTerminalSummary;
+  term('receipt-marker', (artifact ? /^[a-f0-9]{64}$/ : /^[a-f0-9]{40}$/).test(a?.candidate ?? '')
+    && finalMarker(resultSummary) === marker && finalMarker(final?.text) === marker
+    && (!initial || resultSummary === final?.text),
+  { origin: resultSummary, destination: final?.text });
   term('receipt-host-path', r.evidence?.hostId === s.hostId && r.evidence?.environmentId === s.environmentId
-    && absolute(r.evidence?.path) && finalMarker(status?.latestTerminalSummary)?.endsWith(` report=${r.evidence.path}`), r.evidence);
-  if (a?.title?.startsWith('Reviewer: ')) {
+    && absolute(r.evidence?.path) && finalMarker(resultSummary)?.endsWith(` report=${r.evidence.path}`), r.evidence);
+  if (artifact) {
+    const scope = request.scope;
+    const bytes = r.artifact;
+    term('receipt-artifact-scope', a?.base === null && same(r.artifactScope, scope)
+      && inside(r.evidence?.path, scope.evidenceRoot), r.artifactScope);
+    term('receipt-artifact-bytes', bytes?.sha256 === a?.candidate && inside(bytes?.path, scope.artifactRoot)
+      && bytes?.readback?.path === bytes.path && bytes?.readback?.sha256 === bytes.sha256
+      && text(bytes?.readback?.evidence), bytes);
+    // Shared native children can inherit a parent's non-Git scratch directory.
+    // Bind that value to an actual parent read; a path alone proves nothing.
+    const parent = r.parent;
+    const parentThread = parent?.value?.thread;
+    const inherited = !remote && s.versions?.t3 === '0.1.5'
+      && parent?.tool === 't3_thread_read' && parent.environmentId === a?.origin?.environmentId
+      && same(parent.args, { threadId: a?.origin?.threadId })
+      && time(parent.observedAt) && parent.observedAt <= expected.now && text(parent.evidence)
+      && parentThread?.threadId === a?.origin?.threadId && parentThread?.projectId === s.projectId
+      && thread?.parentThreadId === parentThread?.threadId && thread?.relationshipToParent === 'subagent'
+      && absolute(parentThread?.worktreePath) && inside(parentThread.worktreePath, scope.workspaceRoot)
+      && thread?.worktreePath === parentThread.worktreePath;
+    term('receipt-isolation', r.requested?.isolation === 'shared'
+      && (thread?.worktreePath === null || inherited) && r.checkout == null,
+    { isolation: r.requested?.isolation, worktreePath: thread?.worktreePath, parent });
+  } else if (a?.title?.startsWith('Reviewer: ')) {
     term('receipt-isolation', r.requested?.isolation === 'worktree', r.requested?.isolation);
   }
-  if (a?.title?.startsWith('Reviewer: ') || r.checkout != null || thread?.worktreePath != null || r.requested?.isolation === 'worktree') {
+  if (!artifact && (a?.title?.startsWith('Reviewer: ') || r.checkout != null || thread?.worktreePath != null || r.requested?.isolation === 'worktree')) {
     const c = r.checkout;
     term('receipt-checkout', c?.hostId === s.hostId && c?.environmentId === s.environmentId
       && absolute(c?.path) && c.path === thread?.worktreePath

package/skills/axstack/scripts/fleet-scope.js

@@ -0,0 +1,24 @@
+// Explicit artifact authority, separate from repository engineering authority.
+const sourceRoles = ['axstack-research-requirements', 'axstack-research-code', 'axstack-research-code-sol',
+  'axstack-explore-execution', 'axstack-explore-execution-sol',
+  'axstack-research-web', 'axstack-research-web-sol', 'axstack-research-x', 'axstack-diligence'];
+const articleRoles = ['axstack-explainer', 'axstack-explainer-review', 'axstack-ui-verifier', 'axstack-ui-verifier-sonnet'];
+export const isArtifact = (request) => request?.scope?.kind === 'local-artifact';
+const path = (value) => typeof value === 'string' && value.startsWith('/') && value !== '/'
+  && !/[\s\x00-\x1f\x7f]/.test(value) && !value.slice(1).split('/').some((v) => ['', '.', '..'].includes(v));
+export const inside = (value, root) => path(value) && path(root) && value.startsWith(`${root}/`);
+const overlaps = (a, b) => a === b || inside(a, b) || inside(b, a);
+
+export function validScope(request) {
+  const s = request.scope;
+  if (s === undefined) return typeof request.repositoryId === 'string' && request.repositoryId.trim().length > 0;
+  if (s?.kind === 'repository') return typeof request.repositoryId === 'string' && request.repositoryId.trim().length > 0;
+  if (!isArtifact(request) || request.repositoryId !== null || request.role !== 'reader'
+    || !['research', 'explain', 'publish'].includes(s.workflow)
+    || ![...sourceRoles, ...(s.workflow === 'research' ? [] : articleRoles)].includes(s.roleId)
+    || ![s.environmentId, s.projectId].every((v) => typeof v === 'string' && v.trim().length > 0)
+    || !inside(s.artifactRoot, s.workspaceRoot) || !inside(s.evidenceRoot, s.workspaceRoot)
+    || overlaps(s.artifactRoot, s.evidenceRoot) || !Array.isArray(s.reservedRoots)
+    || s.reservedRoots.some((root) => !path(root) || overlaps(root, s.artifactRoot) || overlaps(root, s.evidenceRoot))) return false;
+  return true;
+}

package/skills/axstack-explain/SKILL.md

@@ -20,6 +20,10 @@ scope baseline. Ordinary work in the current chat needs no launch preflight;
 load the [T3 runtime boundary](../axstack/references/t3-runtime.md) only
 immediately before an actual profile dispatch.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## 1. Bound the question and evidence
 
 1. Identify the audience, question, requested format, theme, and publication

package/skills/axstack-explain/references/visual-qa.md

@@ -24,7 +24,12 @@ Interaction checks remain with `axstack-ui-verifier`; source-fidelity review is
 Use this checklist for every HTML explanation and other visual artifacts where
 rendering matters.
 
-Browser and visual checks must run in the delegated `axstack-ui-verifier` in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Browser and visual checks use delegated `axstack-ui-verifier`: engineering
+candidates require its own detached checkout; explicit non-repository articles
+use the local shared delegate with an owned exact-byte snapshot under
+[Local artifacts](../../axstack/references/local-artifacts.md). Outputs stay in
+its private evidence folder. Playwright checks and source/design review remain
+bound to the exact final SHA-256 before public publication.
 
 1. Identify the final artifact bytes and theme. The explicit user theme wins;
    otherwise use `prefers-color-scheme`.

package/skills/axstack-publish/SKILL.md

@@ -10,6 +10,10 @@ The current T3 driver owns publication; workers return checked artifacts.
 Load [Standing contracts](../axstack/references/contracts.md) and follow its
 lifecycle pointers. Keep page bytes, checks and receipts in private run evidence.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## 1. Bind the request
 
 Read host-managed `~/.config/axstack/publish.json` containing string fields

package/skills/axstack-research/SKILL.md

@@ -20,6 +20,10 @@ baseline, ticket map, or author pipeline. Keep it read-only unless requested
 and separately authorized to change product code or publish; otherwise, neither
 is part of research.
 
+For explicit local non-repository work, apply
+[Local artifacts](../axstack/references/local-artifacts.md) before native dispatch.
+Preserve this phase's independent source/fact and exact-byte review requirements.
+
 ## Procedure
 
 1. **Frame the question.** Restate the question, what is in scope, what is

package/skills/axstack-review/SKILL.md

@@ -11,6 +11,11 @@ Include [Safe deletion](../axstack/references/workspace-hygiene.md#safe-deletion
 
 Manual review keeps the user’s chat and workspace open.
 
+For non-repository article/source review, follow
+[Local artifacts](../axstack/references/local-artifacts.md); Explain/Publish own
+the independent artifact review. PR/code-review modes below retain repository
+and native worktree requirements; null identity never selects those modes.
+
 Produce evidence-bound findings for an exact revision using the review count
 and model routing required by its mode. Report within the requested authority;
 for own PRs, automatic merge is the default under the