cowork-flow 0.0.52 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 1.1.0 - 2026-08-29
+
+> **版本内容错位说明**：npm registry 上的 1.0.0 tarball 发布于 2026-08-26（仅含发版脚本修复之前的代码）。1.0.0 段下述的里程碑描述以本 1.1.0 为其实际发布载体——阶段 0-3 的全部内容自本版本起进入 npm 分发。
+
+### 方向落地（阶段 0-3，详见 1.0.0 段与 docs/direction.md）
+
+- 阶段 0：README 定位改写为「运行时上下文与协作事实层」；注入协议契约 `spec/contracts/context-injection.md`；契约指纹序列化三线统一 + slim 全覆盖 + 跨 host 一致性测试。
+- 阶段 1：`run state [task] --json` 事实视图；`<workflow-state>` 属性事实头 + `<decision-anchor>` 决策要点注入（三线一致）。
+- 阶段 2：`executor` 归属、冲突拦截与 `--takeover`、无会话 CI start、`subagent evidence` 证据位。
+- 阶段 3：`run mcp-state` 无依赖 MCP stdio 只读服务（`task_state` / `task_list`）+ `spec/contracts/fact-layer-access.md` 接入契约。
+- MCP 全局入口：`cowork-flow mcp-state` 透传命令——MCP 客户端全局注册一次即可服务所有 cowork-flow 项目。
+
+## 1.0.0 - 2026-08-26
+
+首个稳定主线发布：核心流程契约、会话模型与宿主矩阵在此版本冻结，后续改动进入语义化版本约束。
+
+### 稳定性声明
+
+- **宿主矩阵冻结**：`codex` / `opencode` / `claude-code` / `dsh` / `zcode` 五宿主经 host-assets 注册、adapter 一致性校验与 doctor 全链路覆盖；zcode 插件资产与工作区流程资产均为单源分发（`.zcode/` 走插件市场，技能落盘 `.cowork-flow/skills/` 供内核解析且不进入提示层）。
+- **状态注入协议冻结**：`<workflow-state>` 块 + contract-digest（SessionStart 全量 / 逐消息指纹行）+ 生命周期快照（`.runtime/state-snapshot.json`，与状态转换同单元原子提交）构成宿主 hook 的标准输入；`build_hook_context` 共享协议具备直接单测覆盖。
+- **会话模型冻结**：按会话身份（host session id / 显式 context id / hook sessionId）绑定；显式身份无绑定时判 `no_task` 并列可改绑任务，无身份请求才走全局最新有效兜底；进程级 fallback 绑定不再自动跟随。
+
+### 自 0.0.52 以来的变更
+
+- 会话绑定安全加固：进程 fallback 会话键（`ZCODE_PROCESS_LABEL`）带 provenance 标记，导航、`--run` 派发、review/complete 目标解析与命令行收尾拒绝自动跟随 fallback 绑定，要求显式任务目录；trusted 身份（显式 env、宿主 session env、hook sessionId）保持完整绑定语义。
+- 对抗性审查修正批次：显式 `COWORK_FLOW_CONTEXT_ID` 按裸键解析与 CLI 对齐；PostToolUse 刷新过滤支持 `cd` + 裸 `run` 与 Windows `run.cmd` 命令形态；legacy cursor 宿主保留完整 contract-digest；改绑提示排除已完成的终态任务；doctor 会话卫生检查对无时区时间戳降级为告警而非崩溃。
+- 交互式平台选择器与平台检测断言随五宿主矩阵更新。
+- release.sh 容错：`--version` 精确模式在版本文件已全部就位（干净工作树）时，`git commit` 的 no-op 空提交不再中止脚本，继续 tag 与 publish；其余 commit 失败仍立即中止。新增回归测试覆盖两条路径。
+- release.sh 容错：目标发布 tag 已存在且指向当前 HEAD 时跳过创建并继续 publish（上次运行 tag 后 publish 未完成的重跑场景）；指向其它提交则中止报错。新增回归测试覆盖两条路径。
+- 方向收敛（阶段 0）：README 定位改为「运行时上下文与协作事实层」；新增注入协议契约 `spec/contracts/context-injection.md`（事件时机矩阵、digest 形态规则、序列化规范）；契约指纹序列化三线统一（zcode/opencode 稳定排序 + Python 紧凑分隔符，跨 host 指纹一致性测试锁定）；Python 线补 slim（SessionStart 全量 / 后续单行指纹，无事件 host 按会话文件首次判定）；codex 事件名读取；opencode 首次全量后续单行；dsh 会话开始全量、生命周期命令后单行刷新。
+- 事实层 API 化（阶段 1a）：新增 `./.cowork-flow/run state [task] --json` 事实视图——聚合 task.json（含 `_state` 修订）、decision-anchor 结构化要点（目标/验收项/被拒方案名）、plan 绑定、绑定会话与受信快照；无绑定输出 `task: null` 供机器分支。
+- 注入结构化（阶段 1b）：`<workflow-state>` 升级为属性事实头（`task`/`status`/`source` 进开标签，body 保留人读面包屑），三线一致并在协议契约冻结；planning/in_progress/review 状态下三线注入紧凑 `<decision-anchor>` 决策要点块（Python 复用 fact_view 解析单源），completed 终态与缺文件不注入。
+- 多执行者语义（阶段 2）：task.json 增加 `executor` 归属（start 写入会话 key 或显式 `--executor`）；执行者冲突 fail-closed（`LIFECYCLE-EXECUTOR-001`，幂等重跑同样拦截），`--takeover` 显式接管并覆写归属（含已激活任务的幂等接管）；`--executor` 允许无会话 CI/无头 start（不建会话绑定）；子代理运行时上下文新增 `evidence` 证据位（`subagent evidence <id> --note [--artifact]`，CAS 保护、closed 可补记、不影响任务状态机）；`run state` 人读摘要透出 Executor。
+- 生态适配（阶段 3）：新增 `./.cowork-flow/run mcp-state`——无依赖 MCP stdio 只读服务（newline-delimited JSON-RPC 2.0），工具 `task_state`（事实视图）与 `task_list`（活动任务概览）；接入契约 `spec/contracts/fact-layer-access.md` 冻结只读保证与"不自创跨 agent 协议、adapter 保持薄"立场，写路径仍独占于 CLI 门禁链。
+- MCP 全局入口：npm CLI 新增 `cowork-flow mcp-state` 透传命令——从 cwd 向上定位最近 `.cowork-flow/` 并以继承 stdio exec 该项目的 `run mcp-state`；MCP 客户端全局注册一次（`cowork-flow mcp-state`）即可服务所有 cowork-flow 项目，无需逐项目配置。
+
 ## 0.0.52 - 2026-08-26
 
 ### ZCode 宿主与 hook 体验

package/README.md

@@ -1,16 +1,17 @@
 # cowork-flow
 
-> 项目协作流程模板 — 把需求、计划、实现、验证串成闭环。
+> 多主机 Agent 协作的运行时上下文与协作事实层 — 让任何主机上的任何 agent，在任何会话、任何时刻，从同一份权威事实起步。
 
 ## 一句话
 
-**cowork-flow 不写代码，它帮你建流程。** 把 `template/` 复制到目标项目，立刻获得任务流、规格治理、开发计划和会话记录骨架。
+**cowork-flow 不写代码，它给 agent 喂状态。** 把 `template/` 复制到目标项目，立刻获得运行时状态注入、任务生命周期、决策记录、规格契约与跨宿主的协作事实一致性。
 
 ## 当前能力
 
 | 领域 | 当前能力 |
 |---|---|
 | 任务流程 | `task next --json` 给出下一步 action，`task next --run` 只执行当前 action。 |
+| 事实接入 | `run state [task] --json` 事实视图；`run mcp-state` 无依赖 MCP 只读服务（`task_state` / `task_list`）供任何 MCP 客户端查询。 |
 | 运行健康 | `doctor` 诊断 runtime、host assets、Skill replica 和任务 hygiene，不推进生命周期。 |
 | Host 分发 | Host Asset Manifest 驱动 Codex / OpenCode / Claude Code / ZCode / DeepSeek Harness 资产和 obsolete 清理。 |
 | 批处理与讨论 | Batch 发布 Host action；Party Mode 只输出 advisory final facts。 |
@@ -24,6 +25,7 @@
 | 理解任务如何流转 | [任务流程](#任务流程) |
 | 处理故障或漂移 | [支持与故障诊断](#支持与故障诊断) |
 | 做发布前检查 | [发布](#发布)、[`CHANGELOG.md`](CHANGELOG.md) |
+| 了解项目方向与演进路线 | [`docs/direction.md`](docs/direction.md) |
 | 接入到自己项目 | [接入原则](#接入原则) |
 
 ## 适用 / 不适用
@@ -64,6 +66,10 @@ cowork-flow install-dsh-preset
 # 机器级安装实时 workflow-state 注入（推荐：不换预设，任意 DSH 会话生效）
 cowork-flow install-dsh-hook
 
+# MCP 客户端接入（可选）：全局注册一次，任意项目查询任务事实
+# 各客户端配置样例见 docs/mcp-client-setup.md
+cowork-flow mcp-state
+
 # 维护者发布前检查
 npm run release:check
 ```
@@ -124,6 +130,7 @@ Skills 维护在 `template/skills/` 唯一源码，`init` / `sync` 时按目录
 | `install-dsh-preset` | 安装 DSH agent 预设到 `~/.dsh/.agent-presets/cowork-flow/`（整套 agent，可选） |
 | `install-dsh-hook` | 机器级注册 workflow-state hook 组合行到 `$DSH_HOME/cordis.patch.yml`（当前 DSH 的 agent 提示不收集 host 层 section，实时注入请用预设方式） |
 | `update [--dry-run]` | 升级 CLI 本身 |
+| `mcp-state` | 全局 MCP 事实入口：从 cwd 向上定位项目运行时并透传 `run mcp-state`（全局注册一次，所有 cowork-flow 项目通用） |
 
 ### init 选项
 
@@ -314,6 +321,7 @@ npm run release:check     # 发布信心门禁；当前等价于 test:all
 ```bash
 npm run release          # patch
 npm run release -- minor # minor
+npm run release -- --version 0.1.0  # 精确发布指定版本（跳过自动 bump）
 ```
 
 **发布流程：**
@@ -324,6 +332,8 @@ npm run release -- minor # minor
 5. `git commit` + `git tag`
 6. `npm publish`
 
+**CI 发布通道（推荐）：** `scripts/release.sh --version <v>` 打好 tag 后，`gh release create v<v>` 触发 `.github/workflows/publish.yml`——Ubuntu/Windows 双平台全量门禁通过后自动 `npm publish`（需仓库 secret `NPM_TOKEN`，权限：publish）。
+
 - 发布说明维护在 `CHANGELOG.md`；发布前更新当前版本段落，并保留 `release:check` 和 `git diff --check` 证据。
 
 CI 的 PR 同时运行 Ubuntu core 与 Windows core；发布工作流要求 Ubuntu 与 Windows full verification 均成功后才执行 publish。测试 job 不接触 `NPM_TOKEN`，仅 publish job 使用该 secret。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.52",
+  "version": "1.1.0",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {

package/presets/dsh/plugins/workflow-state.js

@@ -51,6 +51,7 @@ import sys
 from pathlib import Path
 
 cwd = sys.argv[1]
+full_digest = len(sys.argv) > 2 and sys.argv[2] != "0"
 current = Path(cwd).resolve()
 root = None
 while True:
@@ -77,6 +78,7 @@ print(build_hook_context(
         "runtime_context_identity: formal subagent sessions bind before workflow-state injection\\n"
         "</dsh-runtime>",
     ),
+    session_start=full_digest,
 ))
 `;
 
@@ -127,11 +129,11 @@ function discoverCandidates() {
 }
 
 
-function tryPython(candidate, cwd) {
+function tryPython(candidate, cwd, full = true) {
   return new Promise((resolve) => {
     execFile(
       candidate.command,
-      [...candidate.args, '-c', PYTHON_PROTOCOL, cwd],
+      [...candidate.args, '-c', PYTHON_PROTOCOL, cwd, full ? '1' : '0'],
       EXEC_OPTIONS,
       (error, stdout) => {
         if (error) {
@@ -192,10 +194,12 @@ export async function findCoworkRoot(cwd) {
 
 /**
  * Produce the `<workflow-state>` hook context block for a workspace cwd.
- * Empty string means "contribute nothing" (no root, hooks disabled, no
- * usable interpreter, or a broken runtime).
+ * `full` selects the digest shape: true (default) for the full contract
+ * block on session-start-like refreshes, false for the single fingerprint
+ * line on intra-turn refreshes. Empty string means "contribute nothing"
+ * (no root, hooks disabled, no usable interpreter, or a broken runtime).
  */
-export async function runWorkflowState(cwd) {
+export async function runWorkflowState(cwd, full = true) {
   if (hooksDisabled() || !cwd) {
     return '';
   }
@@ -212,14 +216,14 @@ export async function runWorkflowState(cwd) {
     return '';
   }
   if (workingPython !== null) {
-    const result = await tryPython(workingPython, cwd);
+    const result = await tryPython(workingPython, cwd, full);
     if (!result.missing) {
       return normalize(result.output);
     }
     workingPython = null;
   }
   for (const candidate of discoverCandidates()) {
-    const result = await tryPython(candidate, cwd);
+    const result = await tryPython(candidate, cwd, full);
     if (result.missing) {
       continue;
     }
@@ -231,11 +235,15 @@ export async function runWorkflowState(cwd) {
 
 
 export function apply(ctx) {
-  // One cache entry per agent: { text, inflight, queued }. The WeakMap key
-  // is the live Agent object the events and the assembly context both carry.
+  // One cache entry per agent: { text, inflight, queued, full }.
+  // `full` records the digest shape the next refresh should use: session
+  // starts and inbox claims re-inject the full contract block, intra-turn
+  // refreshes after lifecycle commands only repeat the fingerprint line.
+  // The WeakMap key is the live Agent object the events and the assembly
+  // context both carry.
   const states = new WeakMap();
 
-  const refresh = (agent) => {
+  const refresh = (agent, full = true) => {
     const cwd = agent && agent.cwd;
     if (!cwd) {
       return;
@@ -245,6 +253,7 @@ export function apply(ctx) {
       entry = { text: '', inflight: false, queued: false };
       states.set(agent, entry);
     }
+    entry.full = full;
     if (entry.inflight) {
       // A refresh arrived while one was running (e.g. several lifecycle
       // commands back to back). Re-run once after it settles so the latest
@@ -253,7 +262,7 @@ export function apply(ctx) {
       return;
     }
     entry.inflight = true;
-    runWorkflowState(cwd)
+    runWorkflowState(cwd, entry.full)
       .then((text) => {
         entry.text = text;
       })
@@ -264,21 +273,22 @@ export function apply(ctx) {
         entry.inflight = false;
         if (entry.queued) {
           entry.queued = false;
-          refresh(agent);
+          refresh(agent, entry.full);
         }
       });
   };
 
-  ctx.on('agent/session-start', (payload) => refresh(payload && payload.agent));
-  ctx.on('agent/inbox/claimed', (payload) => refresh(payload && payload.agent));
+  ctx.on('agent/session-start', (payload) => refresh(payload && payload.agent, true));
+  ctx.on('agent/inbox/claimed', (payload) => refresh(payload && payload.agent, true));
   // Intra-turn refresh: a lifecycle command just settled, so the next prompt
   // assembly should already see the new state instead of the stale block.
+  // Same-session refresh, so only the fingerprint line is repeated.
   ctx.on('tools/result', (exec) => {
     const agent = exec && exec.agent;
     if (!agent || !isLifecycleCommand(exec && exec.arguments)) {
       return;
     }
-    refresh(agent);
+    refresh(agent, false);
   });
 
   ctx.effect(() => ctx.systemPrompt.section({

package/src/cli.js

@@ -6,6 +6,7 @@ import { runInit } from './commands/init.js';
 import { runInstallDshHook } from './commands/install-dsh-hook.js';
 import { runInstallDshPreset } from './commands/install-dsh-preset.js';
 import { runInstallZCodePlugin } from './commands/install-zcode-plugin.js';
+import { runMcpState } from './commands/mcp-state.js';
 import { runSourceRefresh } from './commands/source-refresh.js';
 import { runSync } from './commands/sync.js';
 import { runUpdate } from './commands/update.js';
@@ -21,6 +22,7 @@ Usage:
   cowork-flow update
   cowork-flow sync [target] [--dry-run] [--force]
   cowork-flow source-refresh [target] [--dry-run]
+  cowork-flow mcp-state
   cowork-flow --version
   cowork-flow --help
 `;
@@ -199,6 +201,10 @@ export async function main(argv = process.argv.slice(2), options = {}) {
       return await runInstallDshHook(args);
     }
 
+    if (command === 'mcp-state') {
+      return await runMcpState(args);
+    }
+
     io.writeErr(`Unknown command: ${command}\n`);
     return 1;
   } catch (error) {

package/src/commands/mcp-state.js

@@ -0,0 +1,66 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const DIR_WORKFLOW = '.cowork-flow';
+
+function defaultIo() {
+  return {
+    writeOut(message) {
+      process.stdout.write(message);
+    },
+    writeErr(message) {
+      process.stderr.write(message);
+    },
+  };
+}
+
+function findNearestWorkflowRoot(startDir) {
+  let current = resolve(startDir);
+  // Same semantics as the MCP server's root resolution (get_repo_root):
+  // walk up to the nearest directory containing .cowork-flow/, so a client
+  // launching the globally registered server inside any project subdirectory
+  // still lands on the right facts.
+  for (;;) {
+    if (existsSync(join(current, DIR_WORKFLOW))) {
+      return current;
+    }
+    const parent = resolve(current, '..');
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+export async function runMcpState(args, options = {}) {
+  const io = options.io ?? defaultIo();  const root = findNearestWorkflowRoot(process.cwd());
+  if (root === null) {
+    io.writeErr(
+      'Error: no .cowork-flow/ found from the current directory; '
+        + 'run this inside a cowork-flow project.\n'
+    );
+    return 1;
+  }
+
+  const runnerName = process.platform === 'win32' ? 'run.cmd' : 'run';
+  const runner = join(root, DIR_WORKFLOW, runnerName);
+  if (!existsSync(runner)) {
+    io.writeErr(`Error: workflow runner not found: ${runner}\n`);
+    return 1;
+  }
+
+  return await new Promise((resolveExit) => {
+    const child = spawn(runner, ['mcp-state', ...args], {
+      stdio: 'inherit',
+      cwd: root,
+    });
+    child.on('error', (error) => {
+      io.writeErr(`Error: failed to launch ${runner}: ${error.message}\n`);
+      resolveExit(1);
+    });
+    child.on('exit', (code) => {
+      resolveExit(code ?? 1);
+    });
+  });
+}

package/template/.claude/hooks/inject-workflow-state.py

@@ -63,6 +63,11 @@ def main() -> int:
     sys.path.insert(0, str(scripts_dir))
     from adapters.host.workflow_state_hook import build_hook_context
 
+    event_name = (
+        hook_input.get("hook_event_name")
+        or hook_input.get("hookEventName")
+        or "UserPromptSubmit"
+    )
     context = build_hook_context(
         root,
         hook_input,
@@ -75,11 +80,7 @@ def main() -> int:
                 "</claude-code-runtime>"
             ),
         ),
-    )
-    event_name = (
-        hook_input.get("hook_event_name")
-        or hook_input.get("hookEventName")
-        or "UserPromptSubmit"
+        session_start=(event_name == "SessionStart"),
     )
     print(
         json.dumps(

package/template/.codex/hooks/inject-workflow-state.py

@@ -61,6 +61,11 @@ def main() -> int:
     )
 
     dispatch_mode = codex_dispatch_mode(root)
+    event_name = (
+        hook_input.get("hook_event_name")
+        or hook_input.get("hookEventName")
+        or "UserPromptSubmit"
+    )
     context = build_hook_context(
         root,
         hook_input,
@@ -77,12 +82,15 @@ def main() -> int:
                 "</codex-runtime>"
             ),
         ),
+        # Codex registers UserPromptSubmit only, so event_name carries no
+        # session-start signal; build_hook_context falls back to the session
+        # state file probe (full on first injection, slim afterwards).
     )
     print(
         json.dumps(
             {
                 "hookSpecificOutput": {
-                    "hookEventName": "UserPromptSubmit",
+                    "hookEventName": event_name,
                     "additionalContext": context,
                 }
             },

package/template/.cowork-flow/.version

@@ -1 +1 @@
-0.0.52
+1.1.0

package/template/.cowork-flow/scripts/adapters/cli/state.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""`run state [task] [--json]` — the fact-layer read entry.
+
+Assembles one machine-readable fact view per task (task.json, decision-anchor
+essentials, plan binding, bound sessions, trusted snapshot). See
+services/fact_view.py and docs/direction.md stage 1.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+if __package__:
+    from . import _bootstrap as _bootstrap  # noqa: F401
+else:
+    import _bootstrap  # noqa: F401
+
+from infra.paths import get_repo_root
+from runtime.session_state import get_active_task
+from services.fact_view import build_fact_view
+from services.task_repository import TaskRepository, TaskRepositoryError
+
+
+def _human_summary(view: dict) -> str:
+    task = view.get("task") or {}
+    lines = [
+        f"Task: {view.get('taskPath')}",
+        f"Status: {task.get('status')}",
+    ]
+    executor = task.get("executor")
+    if executor:
+        lines.append(f"Executor: {executor}")
+    anchor = view.get("decisionAnchor") or {}
+    if anchor.get("exists"):
+        goal = anchor.get("goal") or ""
+        lines.append(f"Goal: {goal.splitlines()[0] if goal else ''}")
+        criteria = anchor.get("acceptanceCriteria") or []
+        lines.append(f"Acceptance criteria: {len(criteria)}")
+        rejected = anchor.get("rejectedOptions") or []
+        if rejected:
+            lines.append(f"Rejected options: {len(rejected)}")
+    plan = view.get("plan") or {}
+    if plan.get("bound"):
+        lines.append(f"Plan: {plan.get('file')}")
+    sessions = view.get("sessions") or []
+    lines.append(f"Bound sessions: {len(sessions)}")
+    snapshot = view.get("snapshot")
+    lines.append(
+        f"Snapshot: {snapshot.get('status') if snapshot else 'none'}"
+    )
+    return "\n".join(lines)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        prog="state",
+        description="Show the fact view for a task (machine-readable with --json).",
+    )
+    parser.add_argument(
+        "task",
+        nargs="?",
+        default=None,
+        help="Task directory or name; defaults to the session-bound active task.",
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        dest="as_json",
+        help="Print the fact view as JSON.",
+    )
+    args = parser.parse_args()
+
+    repo_root = get_repo_root()
+    target = args.task
+    if target is None:
+        active = get_active_task(repo_root)
+        target = active.task_path
+        if not target:
+            if args.as_json:
+                print(
+                    json.dumps(
+                        {
+                            "schemaVersion": 1,
+                            "task": None,
+                            "reason": "no-active-task",
+                        },
+                        ensure_ascii=False,
+                    )
+                )
+                return 0
+            print(
+                "No active task bound to this session; pass a task directory "
+                "or name.",
+                file=sys.stderr,
+            )
+            return 1
+
+    try:
+        task_dir = TaskRepository(repo_root).resolve(target)
+    except TaskRepositoryError as error:
+        print(f"Error: {error}", file=sys.stderr)
+        return 1
+
+    if not (Path(task_dir) / "task.json").is_file():
+        print(f"Error: task.json not found under {task_dir}", file=sys.stderr)
+        return 1
+
+    view = build_fact_view(repo_root, Path(task_dir))
+    if args.as_json:
+        print(json.dumps(view, ensure_ascii=False, indent=2))
+    else:
+        print(_human_summary(view))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/template/.cowork-flow/scripts/adapters/cli/subagent.py

@@ -273,6 +273,25 @@ def cmd_bind(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_evidence(args: argparse.Namespace) -> int:
+    repo_root = get_repo_root()
+    try:
+        context = RuntimeContextService(repo_root).evidence(
+            args.subagent_id,
+            note=args.note,
+            artifact=getattr(args, "artifact", None),
+        )
+    except RuntimeContextError as error:
+        _print_runtime_error(error)
+        return 1
+    if context is None:
+        print(f"Error: subagent not found: {args.subagent_id}", file=sys.stderr)
+        return 1
+    entries = context.get("evidence") or []
+    print(f"subagent {args.subagent_id} evidence entries={len(entries)}")
+    return 0
+
+
 def cmd_close(args: argparse.Namespace) -> int:
     repo_root = get_repo_root()
     try:
@@ -322,6 +341,15 @@ def build_parser() -> argparse.ArgumentParser:
     bind.add_argument("context_key")
     bind.set_defaults(func=cmd_bind)
 
+    evidence = subparsers.add_parser(
+        "evidence",
+        help="Append an evidence entry to a runtime context (does not move task status)",
+    )
+    evidence.add_argument("subagent_id")
+    evidence.add_argument("--note", required=True)
+    evidence.add_argument("--artifact", default=None)
+    evidence.set_defaults(func=cmd_evidence)
+
     close = subparsers.add_parser("close", help="Close subagent runtime context")
     close.add_argument("subagent_id")
     close.set_defaults(func=cmd_close)

package/template/.cowork-flow/scripts/adapters/cli/task_lifecycle_commands.py

@@ -26,7 +26,11 @@ from infra.paths import (
     FILE_TASK_JSON,
     get_repo_root,
 )
-from runtime.session_state import clear_active_task, get_active_task
+from runtime.session_state import (
+    PROVENANCE_PROCESS_FALLBACK,
+    clear_active_task,
+    get_active_task,
+)
 
 
 def _report_check_block(title: str, blockers: tuple[str, ...]) -> int:
@@ -71,6 +75,19 @@ def _resolve_status_task_dir(
                 file=sys.stderr,
             )
             return None
+        if (
+            active.task_path
+            and active.provenance == PROVENANCE_PROCESS_FALLBACK
+        ):
+            print(
+                colored(
+                    "Error: Session binding is process-fallback (shared); "
+                    "pass a task dir explicitly.",
+                    Colors.RED,
+                ),
+                file=sys.stderr,
+            )
+            return None
         if not active.task_path:
             print(
                 colored(
@@ -249,7 +266,11 @@ def cmd_start(args: argparse.Namespace) -> int:
     if getattr(args, "auto", False):
         return _run_auto_start(args, full_path, service)
 
-    result = service.start(full_path)
+    result = service.start(
+        full_path,
+        executor=getattr(args, "executor", None),
+        takeover=bool(getattr(args, "takeover", False)),
+    )
     if not result.ok:
         return _report_start_failure(result)
 
@@ -342,6 +363,16 @@ def cmd_finish(args: argparse.Namespace) -> int:
     """Clear the active task for this session."""
     repo_root = get_repo_root()
     active = get_active_task(repo_root)
+    if active.task_path and active.provenance == PROVENANCE_PROCESS_FALLBACK:
+        print(
+            colored(
+                "Error: Refusing to clear a session binding resolved from "
+                "process-fallback identity; archive the task to clear it.",
+                Colors.RED,
+            ),
+            file=sys.stderr,
+        )
+        return 1
     if not active.task_path:
         print(
             colored(

package/template/.cowork-flow/scripts/adapters/cli/task_navigation.py

@@ -10,7 +10,11 @@ from services.task_context import TaskContextService
 from adapters.cli.task_support import resolve_task_dir
 from adapters.cli.execution_context_args import execution_context_from_namespace
 from infra.paths import get_repo_root
-from runtime.session_state import get_active_task
+from runtime.session_state import (
+    FALLBACK_BINDING_BLOCKER,
+    PROVENANCE_PROCESS_FALLBACK,
+    get_active_task,
+)
 from services.readiness import task_readiness_blockers
 from services.task_repository import TaskRepository, TaskRepositoryError
 
@@ -359,13 +363,20 @@ def _navigation_target(args, repo_root: Path, structured: bool):
 
     active = get_active_task(repo_root)
     source = f"{active.source}:{active.context_key or '-'}"
-    if active.task_path:
+    # 进程标签回退身份是同实例所有会话共享的；其绑定只作 advisory，
+    # 不得自动定位任务（否则他会话绑定的任务会被当作本会话任务）。
+    untrusted_binding = (
+        bool(active.task_path)
+        and active.provenance == PROVENANCE_PROCESS_FALLBACK
+    )
+    if active.task_path and not untrusted_binding:
         return repo_root / active.task_path, active.task_path, source, True
+    blockers = [FALLBACK_BINDING_BLOCKER] if untrusted_binding else []
     if structured:
         payload = build_navigation_payload(
             args=args,
             status="no_task",
-            blockers=[],
+            blockers=blockers,
             active_target=False,
             task_path=None,
             repo_root=repo_root,
@@ -379,7 +390,7 @@ def _navigation_target(args, repo_root: Path, structured: bool):
             args=args,
             status="no_task",
             task_path=None,
-            blockers=[],
+            blockers=blockers,
             active_target=False,
             repo_root=repo_root,
         )