frontend-project-context 1.7.0 → 1.9.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.9.1 - 2026-09-23
+
+- Repair Context Bundle read-target identity so task targets and local Contract sources merge by normalized path without duplicate output.
+- Preserve complete, stable unions of item IDs, source IDs, reasons, and every JSON Pointer, including the RFC 6901 root pointer.
+- Share one strict coverage profile parser and selector between Context Bundle and Coverage Audit; invalid v1/v2 profiles now fail closed consistently.
+- Add HC-01 through HC-14 while retaining TC-01 through TC-16 and every prior regression; public schemas, Exchange Protocol 9, and AI Entry renderer 5 remain unchanged.
+- Adopt schema-3 consumption, outside-owned AI Entry digest mode, and bounded coverage v2 in this repository.
+- Pass read-only real-Host revalidation in `dtg-tmc-mobile` and `dtg-tmc-pc` with the same frozen source candidate; both end clean, same-path task/source aggregation stays unique, and undeclared target coverage is reported as a Contract data gap. The release tarball is a separate artifact and does not claim byte identity with that earlier source snapshot.
+
+## 1.9.0 - Unreleased
+
+- Add deterministic `context --locate --task` followed by exact, order-independent multi-path targeted Context.
+- Publish Context Bundle schema 1 with structured items, scope coverage, typed read targets, gaps, authority handoff, compatibility `content`, and a canonical digest.
+- Add Contract schema 3 `consumption` roles and `outside-owned-ai-entry` source digest mode while preserving schema-1/2 read-only bytes.
+- Add coverage profile v2 / Coverage Audit schema 2, Initialization Instruction schema 2, capabilities / Exchange Protocol 9, and AI Entry renderer 5.
+- Add TC-01 through TC-16 without Provider, Agent Runtime, Git, network, dependency installation, business-code execution, or a new persistent store.
+
+## 1.8.0 - 2026-09-15
+
+- Add the package-owned `docs/AI-PROJECT-INITIALIZATION.md` as the only normative Host initialization procedure and expose it through read-only `instructions --json|--prompt` plus capabilities discovery.
+- Resolve and freeze `targetRoot`, forbid parent-project truth discovery and outside symlink evidence, and keep Provider, Agent Runtime, Git, network, package mutation, business-code writes, automatic approval, and publication outside the runtime.
+- Upgrade capabilities / Exchange Protocol to 8, add initialization-instruction schema 1, and upgrade project-status to schema 2 with independent `contractReadiness` and `compile-task-context` routing.
+- Upgrade AI Entry to renderer 4 so clean status still requires task/path context, actual item IDs/scopes/read targets, and fail-closed onboarding/context gaps before source development.
+- Reuse create-only proposals, atomic multi-item `approveProposal`, managed-region CAS, final entry digest binding, and the existing scope compiler; add no new persistent store, universal apply command, or business-file writer.
+- Add O-01 through O-12 deterministic local acceptance. Real-project memoryless Host acceptance and publication remain separate blocking gates.
+
 ## 1.7.0 - Unreleased
 
 - Generate human-readable AI Entry and discovery statements in Chinese while preserving English machine IDs, subjects, commands, markers, JSON fields, and enums; AI Entry renderer 3 also fixes the cross-platform offline project-local CLI invocation, while existing renderer 1/2 regions require an explicit owned republish instead of being silently rewritten.

package/README.md

@@ -32,21 +32,24 @@ It does **not** call an AI provider, edit business code, manage Git, install dep
 Pin it as a development dependency so local users and CI run the same version:
 
 ```bash
-npm install --save-dev frontend-project-context@1.7.0
+npm install --save-dev frontend-project-context@1.9.1
 ```
 
 The package has zero runtime dependencies.
 
-`1.7.0` is the package release candidate in this source tree. It includes the cumulative `1.4.0` status/takeover, `1.5.0` evidence, `1.6.0` target-upgrade, Adaptive Bounded Task Context, truth-resolution repair, and Chinese human-readable project semantics. The candidate has passed all 194 local regressions; public release still requires the separately governed Host/Provider and release gates.
+Version `1.9.1` repairs normalized-path read-target aggregation, lossless JSON Pointer union, and shared strict coverage parsing while keeping Context Bundle schema 1, Coverage Audit schema 2, capabilities / Exchange Protocol 9, and AI Entry renderer 5 unchanged. Read-only real-Host revalidation passed in both TMC targets on the same frozen source candidate; that earlier source snapshot is distinct from the published package artifact.
 
 ### Quick start
 
-Every host can begin with one read-only status command, including before initialization:
+Every initializing Host begins by loading the package's single normative instruction and resolved target root:
 
 ```bash
+npm exec --offline -- project-context instructions --project . --prompt
 npm exec --offline -- project-context status --project . --json
 ```
 
+The only initialization procedure is [AI Project Initialization](./docs/AI-PROJECT-INITIALIZATION.md). The examples below document individual governance primitives; they are not a second initialization workflow and must not be composed in place of that instruction.
+
 All `npm exec --offline -- project-context` commands below require the exact development dependency installed above. `--offline` makes a missing local binary fail closed instead of downloading the unrelated `project-context` package from a configured registry.
 
 `status` classifies uninitialized, partial, invalid, attention, clean, and ownership-conflict states without reading business source bodies or writing project files. After initialization, publish a fixed startup route into a managed region of root `AGENTS.md` while preserving all human content outside that region:
@@ -55,7 +58,7 @@ All `npm exec --offline -- project-context` commands below require the exact dev
 npm exec --offline -- project-context publish-entry --project . --output AGENTS.md --write --json
 ```
 
-The `1.7.0` AI Entry renderer 3 writes human-readable project guidance in Chinese and invokes only the offline project-local CLI while keeping commands, markers, IDs, JSON fields, and enums stable in English. Existing renderer-1/2 entries remain readable but become stale and require an explicit owned republish; no entry is rewritten automatically.
+Version `1.9.1` keeps AI Entry renderer 5: it routes unknown targets through `context --locate`, then recompiles exact multi-path Context and reports item IDs, scopeCoverage, required/conditional read targets, provenance-only sources, and gaps. Existing renderer-1/2/3/4 entries remain readable but stale until an explicit owned republish.
 
 Use `remove-entry` with the same output to remove only a trusted managed region. Plans and previews never include `--write`; human approval of the exact path remains required.
 
@@ -208,7 +211,7 @@ npm exec --offline -- project-context upgrade-apply --project . --plan .project-
 
 `upgrade-check` and `upgrade-plan` are permanently read-only. `upgrade-apply` previews by default and can write only the single compiled, product-owned unit shown in that exact plan. Re-run check and plan after every unit. Even `coreMigration: complete` still requires the Host to verify dependency/lockfile pins, project tests or CI, and an independent new window. The product does not run a package manager, Git, network, project tests, business writes, automatic approval, rollback, or publication.
 
-The package publishes twenty machine schemas, including capabilities 7, project status, projection lock 1/2, Migration Manifest 2, Upgrade Assessment/Migration Plan/Upgrade Result Bundle 1, Evidence Input/Bundle, Assist/Action/Review bundles, the four staged-context schemas, Context Query/Adaptive Context Bundle/Routing Index 2, and Coverage Audit 1.
+The package publishes twenty machine schemas, including capabilities 9, project status, projection lock 1/2, Migration Manifest 2, Upgrade Assessment/Migration Plan/Upgrade Result Bundle 1, Evidence Input/Bundle, Assist/Action/Review bundles, the four staged-context schemas, Context Query/Adaptive Context Bundle/Routing Index 2, and Coverage Audit 2.
 
 Generate the read-only governance dashboard:
 
@@ -324,21 +327,24 @@ AI 编程工具通常只读取仓库的一部分，而项目约定分散在文
 建议固定为开发依赖，让本地与 CI 使用同一版本：
 
 ```bash
-npm install --save-dev frontend-project-context@1.7.0
+npm install --save-dev frontend-project-context@1.9.1
 ```
 
 本包没有运行时第三方依赖。
 
-`1.7.0` 是当前源码树描述的版本，累计包含 `1.4.0` 状态/接管、`1.5.0` 证据、`1.6.0` 目标升级、自适应有界任务上下文、真源裁定修复和中文人类可读项目语义。候选已通过本地 194 项回归；公开发布仍必须通过单独治理的 Host/Provider 与发布门槛。
+`1.9.1` 修复了规范化 path 级 read-target 聚合、JSON Pointer 无损并集和共享严格 coverage 解析，Context Bundle schema 1、Coverage Audit schema 2、capabilities / Exchange Protocol 9 与 AI Entry renderer 5 保持不变。两个 TMC 目标曾使用同一冻结源码候选完成只读真实 Host 复验；该历史源码快照与正式包工件不是同一字节对象。
 
 ### 快速开始
 
-任何宿主都可以先运行同一条只读状态命令，包括尚未初始化的项目：
+执行初始化的 Host 必须先读取包内唯一规范和 resolved targetRoot：
 
 ```bash
+npm exec --offline -- project-context instructions --project . --prompt
 npm exec --offline -- project-context status --project . --json
 ```
 
+唯一初始化流程见 [AI Project Initialization](./docs/AI-PROJECT-INITIALIZATION.md)。下文命令只解释各治理原语，不构成另一套初始化步骤，也不能替代该指令由 Host 自行拼装流程。
+
 以下所有 `npm exec --offline -- project-context` 命令都要求先安装上面的精确开发依赖。`--offline` 会在本地 CLI 缺失时失败封闭，避免从配置的 registry 下载无关的同名 `project-context` 包。
 
 `status` 在不读取业务源码正文、不写项目文件的前提下分类 uninitialized、partial、invalid、attention、clean 和所有权冲突。初始化后，可把固定启动路由发布到根 `AGENTS.md` 的受管区域，同时完整保留区域外人工内容：
@@ -347,7 +353,7 @@ npm exec --offline -- project-context status --project . --json
 npm exec --offline -- project-context publish-entry --project . --output AGENTS.md --write --json
 ```
 
-`1.7.0` 的 AI Entry renderer 3 默认用中文生成人类可读的项目规则，并只调用离线的项目本地 CLI；命令、marker、ID、JSON 字段和枚举继续保持稳定英文。既有 renderer 1/2 入口仍可读取，但会标记 stale，只有显式受管 republish 才会升级，不会自动重写。
+`1.9.1` 继续使用 AI Entry renderer 5：目标未知时先运行 `context --locate`，随后用完整最小路径集合重新编译 targeted Context，并报告 item IDs、scopeCoverage、required/conditional read targets、provenance-only sources 与 gaps。既有 renderer 1/2/3/4 仍可读取但会标记 stale，只有显式受管 republish 才升级。
 
 使用相同 output 的 `remove-entry` 只移除可信受管区域。计划与 preview 都不含 `--write`，仍需人对精确路径授权。
 
@@ -500,7 +506,7 @@ npm exec --offline -- project-context upgrade-apply --project . --plan .project-
 
 `upgrade-check` 与 `upgrade-plan` 永久只读；`upgrade-apply` 默认 preview，只有显式 `--write` 才能执行该 plan 展示的一个已编译、产品自有单元。每个单元后必须重新 check/plan。即使 `coreMigration: complete`，Host 仍需核对依赖与 lockfile、运行项目测试或 CI，并用独立新窗口复核。产品不会执行包管理器、Git、网络、项目测试、业务写入、自动批准、回滚或发布。
 
-npm 包包含二十份机器 schema，包括 capabilities 7、project status、projection lock 1/2、Migration Manifest 2、Upgrade Assessment/Migration Plan/Upgrade Result Bundle 1、Evidence Input/Bundle、Assist/Action/Review Bundle、四份 staged-context schema、Context Query/Adaptive Context Bundle/Routing Index 2 与 Coverage Audit 1。
+npm 包包含版本化机器 schema，包括 capabilities 8、initialization instruction 1、project status 2、projection lock 1/2、Migration Manifest 2、Upgrade Assessment/Migration Plan/Upgrade Result Bundle 1、Evidence Input/Bundle、Assist/Action/Review Bundle、四份 staged-context schema、Context Query/Adaptive Context Bundle/Routing Index 2 与 Coverage Audit 1。
 
 生成只读治理看板：
 
@@ -545,6 +551,7 @@ npm exec --offline -- project-context dashboard --project . > project-context-da
 
 | 命令 | 用途 |
 | --- | --- |
+| `instructions` | 读取包内唯一初始化指令并固定 resolved targetRoot |
 | `setup` | 聚合安全初始化、保守 discovery 和 Assist Bundle |
 | `capabilities` | 查询协议版本、schema、action kind、初始化状态和永久边界 |
 | `evidence` | 从项目内输入生成确定性、只读且需人工复核的 Evidence Bundle |

package/UPGRADING.md

@@ -1,5 +1,23 @@
 # 升级说明
 
+## `1.8.0 / 1.9.0 → 1.9.1`
+
+`1.9.1` 是对未发布 `1.9.0` Context 消费语义的补丁：read target 改为按规范化 path 唯一聚合，同路径多 JSON Pointer 完整保留，Context Bundle 与 Coverage Audit 共用一份严格 coverage profile parser/selector。Context Bundle schema 1、Coverage Audit schema 2、Contract schema 3、capabilities / Exchange Protocol 9 和 AI Entry renderer 5 均不升级。
+
+从已发布 `1.8.0` 或本地 `1.9.0` 进入 `1.9.1` 均是 `package-only`；不会自动迁移目标项目 Contract。两个真实项目曾在同一冻结源码候选上完成只读 Host 复验；目标项目实际安装本包并执行任务仍需各自授权与核验。
+
+## `1.8.0 → 1.9.0`
+
+`1.9.0` 增加 Context Bundle schema 1、`context --locate`、稳定多路径 targeted Context、Contract schema 3 的可选消费职责与受管区域外摘要、Coverage Audit schema 2、Initialization Instruction schema 2、capabilities / Exchange Protocol 9 和 AI Entry renderer 5。Contract schema 1/2 继续只读兼容；只有显式使用 `consumption` 或 `digestMode` 的治理写入才升级为 schema 3。短生命周期 Context/Coverage/Instruction 工件应重新生成，AI Entry 需要显式 republish；不自动改写 store 或人工入口。
+
+## `1.7.0 → 1.8.0`
+
+`1.8.0` 新增只读 `instructions` 和唯一包内规范 `docs/AI-PROJECT-INITIALIZATION.md`；capabilities / Exchange Protocol 升至 8，新增 initialization-instruction schema 1；project-status 升至 schema 2，以 `contractReadiness` 独立区分 `not-initialized`、`contract-incomplete` 与 `contract-ready`；AI Entry 升至 renderer 4，clean 状态也必须先运行 task/path context 并消费实际 Contract。
+
+Contract、source lock、proposal、projection lock 和普通 projection renderer 均不迁移。既有 AI Entry renderer 1/2/3 保持可读但会报告 stale；`upgrade-check --from-version 1.7.0` 可生成受当前 baseline 绑定的 `republish-ai-entry` 单元。初始化方法只以包内唯一指令为准；README、操作手册和 CLI help 只提供链接或发现入口。
+
+本地 O-01 至 O-12 和完整回归是实现门。升级或初始化后的真实无历史 Host 接管、目标项目访问、Provider、Git、网络与发布均不在本轮权限内。
+
 ## `1.6.0 → 1.7.0`（本地实现，未发布）
 
 `1.7.0` 新增只读 `context-query`、`coverage-audit`、`reconcile-truth`，以及默认 preview、只有显式 `--write` 才持久化可删除派生索引的 `index-context`。Context Query、Adaptive Context Bundle、Routing Index、Truth Reconciliation Input 与 Truth Reconciliation Review Bundle 当前写 schema 2，Coverage Audit 与 Host Promotion Evidence 保持 schema 1，capabilities / Exchange Protocol 升至 7；Contract、source lock、proposal、持久 renderer、Action Plan 与 Review Bundle 均不迁移。AI Entry 的人类可读文案改为中文，并固定 `npm exec --offline -- project-context` 的项目本地安全入口，renderer 从 1/2 升至 3；Projection Lock schema 仍为 2。

package/docs/08-INSTALLATION-AND-DISTRIBUTION.md

@@ -2,7 +2,7 @@
 
 > 权威说明：本文是支持性设计文档；当前唯一规范真源是 [00-PRODUCT-CONSTITUTION.md](./00-PRODUCT-CONSTITUTION.md)。
 
-状态：`frontend-project-context@1.7.0` 发布前实现、195/195、真实 PC 初始化与 A-130 有界 Host/Provider 终验均已通过；发布已授权并正在执行，公开 registry 当前已核验基线仍为 `1.6.0`
+状态：本文记录安装与分发原则及历史发布证据；当前版本与发布事实以 `package.json` 和 `PROJECT_STATE.json` 为准。
 适用项目：`dtg-frontend-delivery-agent`  
 本文记录产品如何交付、安装、共享、升级和验证；它不自行授权打包、registry、Git 或发布操作。
 
@@ -43,10 +43,10 @@ CI 安装项目锁定的依赖版本并执行只读检查。CI 不依赖机器
 持久初始化前，先把精确版本安装为项目开发依赖：
 
 ```bash
-npm install --save-dev frontend-project-context@1.7.0
+npm install --save-dev frontend-project-context@1.9.1
 ```
 
-包名冻结为 `frontend-project-context`，可执行文件名为 `project-context`。安装必须先于持久 `setup`，使 discovery 登记的 `package.json` digest 已包含正式依赖，避免初始化完成后仅因补装工具而立即产生 `source-changed`。`1.7.0` 公开发布前，外部项目继续使用已发布且已独立核验的 `1.6.0`；候选源码中的 `1.7.0` 命令用于冻结将要进入该版本 tarball 的消费合同。
+包名冻结为 `frontend-project-context`，可执行文件名为 `project-context`。安装必须先于任何持久初始化写入，使 discovery 登记的 `package.json` digest 已包含正式依赖，避免补装工具后立即产生 `source-changed`。`1.9.1` 的实现门为 HC-01 至 HC-14、TC-01 至 TC-16 和全部回归；此前两个真实项目的只读 Host 复验使用同一冻结源码候选，目标项目安装发布包及运行具体需求需在各自窗口另行核验。
 
 选择项目内安装而不是全局安装，原因是：
 
@@ -58,16 +58,18 @@ npm install --save-dev frontend-project-context@1.7.0
 
 ### 3.2 首次初始化：只运行已安装的本地 CLI
 
-先确认本地包存在，再从本地依赖离线执行只读状态和 setup preview：
+先确认本地包存在，再从本地依赖读取唯一初始化指令：
 
 ```bash
+npm exec --offline -- project-context instructions --project . --prompt
 npm exec --offline -- project-context status --project . --json
-npm exec --offline -- project-context setup --project . --id PROJECT_ID --name "Project Name" --json
 ```
 
+唯一流程正文是 [AI-PROJECT-INITIALIZATION.md](./AI-PROJECT-INITIALIZATION.md)。本文件只说明安装与分发，不复制另一套 Host 初始化步骤。
+
 `--offline` 使本地 CLI 缺失时失败封闭，不允许 npm 临时下载无关的同名 `project-context` 包。确需一次性运行器时，只允许用精确包名和版本做零写 preview；任何 `setup --write` 前仍必须先完成项目内固定安装。
 
-`setup` 初始化入口只负责：
+作为底层原语，`setup` 只负责：
 
 - 在内存中构造与 `init` 相同的空 store 并复用保守 discovery；
 - 输出包含候选、`readTargets` 和 `workUnits` 的 Assist Bundle；
@@ -264,3 +266,24 @@ IDE 插件可以在未来提供状态提示、冲突解释和可视化配置，
 7. 针对 `src/components/flight/non-whitelist-confirm.vue` 与 `src/components/center/protocolPriceDialog.vue` 的真实行李展示任务，`context --locale zh-CN` 成功产生中文 Project Context Bundle。
 
 原始 PC 仓库全程保持干净，没有写入业务代码、`AGENTS.md`、`package.json`、lockfile 或 `.project-context`。本次结果证明 `1.7.0` 候选包能在真实 PC 项目结构中完成初始化并进入正常任务路径。后续 A-130 有界 Host/Provider 终验已通过，见 `docs/24` 第 11 节；A-144 不属于本次发布范围。
+
+## 18. `1.7.0` public npm 发布与 registry 回装
+
+`2026-09-14`，release commit `d5b6389` 与 tag `v1.7.0` 已推送，精确冻结的 99 文件 tarball 发布为 public npm 的 `frontend-project-context@1.7.0`。registry 的 `latest`、SHA-1 与 SHA-512 integrity 均指向该版本；重新下载后的 SHA-256 为 `42d83423d61831b4bf0d4b1bc39e29731e18acf181827abe699c60fb512fb4af`，与冻结候选逐字节一致。
+
+独立回装在全新临时项目中从 registry 安装精确 `1.7.0`，然后只使用安装后的 `npm exec --offline -- project-context`：
+
+1. capabilities 报告包版本 `1.7.0`、schema 7 与 Exchange Protocol 7；
+2. status 正确识别为 `uninitialized`，setup preview 零写入；
+3. setup write 后由人显式批准四项直接发现的客观事实；
+4. publish-entry 仅追加 renderer 3 受管区域；
+5. 对登记的 `AGENTS.md` 执行一次精确 source acceptance 与重审批；
+6. check 无 findings，status 为 `clean/ready-for-task`，正常中文任务 context 成功生成。
+
+发布工件、Git 与回装证据全部闭合，本次 release 权限已经消费。
+
+## 19. `1.8.0` Real Project Onboarding Closure 正式发布
+
+`frontend-project-context@1.8.0` 于 `2026-09-15T09:41:29.644Z` 由 `fushanyx1` 发布到官方 public npm，`latest` 指向 `1.8.0`。发布包包含 104 个文件，压缩大小 378437 bytes、解包大小 1352711 bytes；SHA-1 为 `0146a54dd7b0fab80aa877efd5d09056eacede01`，SHA-256 为 `0153d84761e13c6c7b4d84e66bc802402db7cea71c50ff387374cc57adf56a5b`，integrity 为 `sha512-6EoGqyM2YucdgN49l/3Pm9Gid7zd6mmtHr9pMFb2lnxHiN7V/VVp6tJJiPPQ1SKNIPD1C46wzoGGjvb2HFYmag==`。
+
+官方 registry 重下载包与冻结候选逐字节一致。全新消费者从该包离线安装后通过 package version、help、capabilities schema 8、uninitialized status 和唯一初始化指令 digest 冒烟。实现前置门为 O-01 至 O-12 与完整回归 207/207，真实 Host 前置门已在真实项目隔离副本通过。最终授权只完成官方 public npm 发布、registry 核验和本地事实归档；没有继续推送私有 Git 远端，后续发布仍需重新授权。

package/docs/14-FORMAL-RELEASE-READINESS.md

@@ -130,3 +130,17 @@ registry/可见性决策、发布者认证、A-39/pack、release commit、`v1.0.
 7. 从 registry 重新下载的 tarball 与候选逐字节一致，随后在全新目录从 registry 安装，version/help/capabilities/status/init/publish-entry/clean-check 全部通过。
 
 该授权不包含真实目标项目升级、Phase D 其余适配器、Provider/Agent Runtime、自动批准或新产品能力。本次实现与发布授权均已消耗。
+
+## 13. `1.8.0` Real Project Onboarding Closure 正式发布
+
+用户于 `2026-09-15` 在 O-01 至 O-12、207/207 本地回归和隔离真实项目无历史 Host 验收通过后，明确授权 `1.8.0` 发布到官方 public npm。冻结候选对应本地 release commit `5f997106d195506afcb6a991400045e973365548` 与本地 annotated tag `v1.8.0`；最终 public-registry-only 范围未继续推送私有 Git 远端。
+
+发布验证记录：
+
+1. tarball 包含 104 个文件，压缩大小 378437 bytes、解包大小 1352711 bytes，不包含测试、自托管 `.project-context/`、`PROJECT_STATE.json`、`RTK.md` 或 tarball；
+2. SHA-1 为 `0146a54dd7b0fab80aa877efd5d09056eacede01`，SHA-256 为 `0153d84761e13c6c7b4d84e66bc802402db7cea71c50ff387374cc57adf56a5b`，integrity 为 `sha512-6EoGqyM2YucdgN49l/3Pm9Gid7zd6mmtHr9pMFb2lnxHiN7V/VVp6tJJiPPQ1SKNIPD1C46wzoGGjvb2HFYmag==`；
+3. `fushanyx1` 于 `2026-09-15T09:41:29.644Z` 发布 `frontend-project-context@1.8.0`，官方 registry 的 `latest` 指向该版本；
+4. registry 重下载 tarball 与冻结候选逐字节一致；
+5. 全新消费者离线安装后通过 package version、help、capabilities schema / Exchange Protocol 8、uninitialized status 与初始化指令 digest 冒烟。
+
+本次发布与核验授权已经消费。Provider、A-144、Sidecar、真实目标写入、业务代码修改、私有 Git 远端推送和后续版本发布仍需分别授权。

package/docs/24-A130-REAL-HOST-TARGET-PROJECT-COMPARISON.md

@@ -1,6 +1,6 @@
 # 24 — A-130 真实 Host / 目标项目对照证据
 
-> 状态：`bounded-revalidation-passed; A-130-closed; 1.7.0-release-authorized`
+> 状态：`bounded-revalidation-passed; A-130-closed; 1.7.0-published-and-registry-verified`
 >
 > 日期：`2026-09-12`
 >

package/docs/26-A130-QUALITY-CLOSURE-AND-ADAPTIVE-DELIVERY-REPAIR-DESIGN.md

@@ -2,7 +2,7 @@
 
 > 权威说明：本文冻结 A-130 两次真实 Host/Provider 失败后的下一轮设计、缺陷分类、实现边界与可证伪验收。产品身份和永久边界仍以 [00-PRODUCT-CONSTITUTION.md](./00-PRODUCT-CONSTITUTION.md) 为准；历史运行事实仍以 [24-A130-REAL-HOST-TARGET-PROJECT-COMPARISON.md](./24-A130-REAL-HOST-TARGET-PROJECT-COMPARISON.md) 为准。
 >
-> 状态：`design-implemented; local-195-of-195; bounded-provider-revalidation-passed; A-130-closed`
+> 状态：`design-implemented; local-195-of-195; bounded-provider-revalidation-passed; A-130-closed; 1.7.0-published`
 >
 > 日期：`2026-09-12`
 >

package/docs/27-TEAM-SHARED-CONTEXT-DIRECTION-DISCUSSION.md

@@ -0,0 +1,30 @@
+# 27 — 未来方向讨论记录
+
+> 日期：`2026-09-14`
+>
+> 状态：`discussion-only`
+>
+> 边界：本文只记录讨论已开启，不是设计、路线、实现计划或执行授权。
+
+## 讨论缘起
+
+基于《Stateful Agent 基础设施：Persistent KV 与增量上下文》，团队开始讨论 Stateful Agent、Persistent KV、增量上下文与当前自研项目可能的未来关系。
+
+原始材料：`/Users/fushan/fushanyx/知识库/AI/Stateful Agent基础设施-Persistent KV与增量上下文.md`
+
+## 当前讨论共识
+
+Frontend Project Context 的核心意义是：
+
+> 让团队共同拥有同一份项目上下文。
+
+项目事实、规则、来源和人工决定应属于项目与团队，不依附于某个人、某次对话或某一款 AI 工具。
+
+Persistent KV 与增量上下文作为可继续讨论的远期方向，目前不进入产品设计或实现。
+
+## 当前阶段
+
+- 产品开发先收口在 `1.7.0`。
+- 当前主要关注真实项目应用和团队日常实用性。
+- 后续方向保持开放讨论，需要时再单独重开。
+- 本记录不改变产品宪法、`Project Contract` 或当前授权。