fuli-context 0.11.1 → 0.12.1

package/dist/web/index.html

@@ -9,24 +9,29 @@
     />
     <link rel="icon" type="image/png" href="/assets/fuli-logo-ER1wQ8Kk.png" />
     <title>复利 · Context Graph</title>
-    <script type="module" crossorigin src="/assets/index-D1OHIz4c.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/i18n-b14l2pQA.js">
+    <script type="module" crossorigin src="/assets/index-DO10_fLc.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/i18n-oJFlt8hW.js">
     <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-BDNMzG2s.js">
-    <link rel="modulepreload" crossorigin href="/assets/client-DLS5FZBI.js">
-    <link rel="modulepreload" crossorigin href="/assets/console-CqzwSo7a.js">
-    <link rel="modulepreload" crossorigin href="/assets/UiDialog-Q7fsJUoO.js">
-    <link rel="modulepreload" crossorigin href="/assets/useApi-CROJJdhE-CEQAEuug.js">
-    <link rel="modulepreload" crossorigin href="/assets/vue-router-B6ZjK-Br.js">
+    <link rel="modulepreload" crossorigin href="/assets/client-DnwnUBQV.js">
+    <link rel="modulepreload" crossorigin href="/assets/console-Cw7TzOSC.js">
+    <link rel="modulepreload" crossorigin href="/assets/UiButton-x8hiHNRM.js">
+    <link rel="modulepreload" crossorigin href="/assets/useApi-CROJJdhE-7gt0QyQ5.js">
+    <link rel="modulepreload" crossorigin href="/assets/vue-router-CCvPGaLD.js">
     <link rel="modulepreload" crossorigin href="/assets/fuli-logo-Bu9WBuQe.js">
-    <link rel="modulepreload" crossorigin href="/assets/UiSelect-DcGpPQQo.js">
-    <link rel="modulepreload" crossorigin href="/assets/attention-store-D-qIFRIb.js">
-    <link rel="modulepreload" crossorigin href="/assets/AgentHand-DkyF4vgk.js">
-    <link rel="modulepreload" crossorigin href="/assets/UiDisclosure-BS-muK5j.js">
+    <link rel="modulepreload" crossorigin href="/assets/UiDialog-mjletK0y.js">
+    <link rel="modulepreload" crossorigin href="/assets/UiSelect-K29jnV-1.js">
+    <link rel="modulepreload" crossorigin href="/assets/attention-store-CA5y8j1R.js">
+    <link rel="modulepreload" crossorigin href="/assets/AgentHand-UzVhbKUC.js">
+    <link rel="modulepreload" crossorigin href="/assets/UiDisclosure-_IxeiexW.js">
+    <link rel="modulepreload" crossorigin href="/assets/profile-model-BQO4zNs9.js">
+    <link rel="modulepreload" crossorigin href="/assets/task-evidence-DTiPCs7r.js">
+    <link rel="modulepreload" crossorigin href="/assets/useAgentRoster-B84mzZIg.js">
+    <link rel="modulepreload" crossorigin href="/assets/agent-pins-DS4mNsNt.js">
     <link rel="modulepreload" crossorigin href="/assets/paths-CDREouhi.js">
     <link rel="stylesheet" crossorigin href="/assets/client-CIuQ1icy.css">
     <link rel="stylesheet" crossorigin href="/assets/UiSelect-Bv6R0yr1.css">
     <link rel="stylesheet" crossorigin href="/assets/AgentHand-Y83Oo36U.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-kPB0Cf8Q.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-BfHCcUL2.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/web/licenses/ant-design-icons.txt

@@ -0,0 +1,22 @@
+MIT LICENSE
+
+Copyright (c) 2018-present Ant UED, https://xtech.antfin.com/
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/docs/agent-conversations-and-collaboration.md

@@ -34,8 +34,8 @@ Neo4j Provider 的独立日志中；工作记忆继续保存经过整理的决
 包含稳定 `@{agentId}`、项目 ID 和会话 ID；复制失败时可手动选中。生成的 ID 会编码特殊字符，
 改名不影响接续。这是 FULI 的提示词匹配，不表示 Cursor、Codex 的原生 @ 下拉列表已注册此人。
 
-开发者是持久负责人，Jefa/HR 是同级协作角色。只有管理员成员的项目不会把开发任务
-隐式记到管理员名下；需要先通过 HR 分配或招聘开发者。显式选中管理员及其本职任务仍可使用。
+开发者是持久负责人，Jefa/AR 是同级协作角色。只有管理员成员的项目不会把开发任务
+隐式记到管理员名下；需要先通过 AR 分配或招聘开发者。显式选中管理员及其本职任务仍可使用。
 收尾将实际员工工具返回的协作回执合并展示，例如“Alex 负责实现；Jefa 整理看板”。
 没有执行工具或 worker 的配置不能当成协作执行证据；不另起模型来生成这行回执。
 派工前分别核对每位成员的客户端与执行器锁，并与任务策略取交集；负责人的推荐平台
@@ -47,7 +47,7 @@ Neo4j Provider 的独立日志中；工作记忆继续保存经过整理的决
 
 用户的品味、协作性格和判断偏好继续按确认状态和全局/项目/Agent 作用域读取；入口精简
 保留完整指令、画像分类和写作品味域。协作职责同时带上 Agent 自己的判断、品味、个性和期望。
-工作摘要、HR 配置的性格以及自动推断都不能伪装成人工确认的用户偏好。
+工作摘要、AR 配置的性格以及自动推断都不能伪装成人工确认的用户偏好。
 
 ## 采集与失败恢复
 

package/docs/agent-roundtable.md

@@ -75,3 +75,36 @@ Waking needs the client's CLI on this machine: `claude` for Claude Code, and `co
 (or the CLI bundled with the Codex app) for Codex. Override the paths with
 `FULI_CLAUDE_BIN` / `FULI_CODEX_BIN`. A recipient is only woken in clients its Agent
 profile allows.
+
+## LAN roundtable (Beta)
+
+Devices on the same trusted local network can share project leads. Each computer
+needs FULI 0.12.1 or later. Open **Settings → LAN roundtable (Beta)** on the computer
+itself. Choose one computer to host, copy its one-use invitation to the other
+computer, compare the displayed fingerprints, and join. Select the project leads
+and local clients you want to share. Sharing is off until you choose it.
+
+`find_agents` includes shared leads with their device and project names. Use the
+returned `peer:` address with `message_agent`. Remote asks support `auto` or `new`
+conversation selection, not a remote session ID or a caller-supplied folder.
+`get_agent_message_status` checks an ask; `cancel_agent_message` cancels one you sent.
+The console refreshes remote answers in the roundtable timeline.
+
+The coordinator routes messages; the receiving computer makes outbound connections
+and runs its own allowed, read-only client. The optional folder is verified against
+that local project and never sent to the other device. A shared project needs an
+active lead, an allowed installed client, and either a matching recent session
+folder or a confirmed project folder. Generic MCP clients can send questions;
+automatic answering currently uses the Codex or Claude Code adapters.
+
+Turning sharing off cancels its active deliveries. Removing a device ends its trust.
+If the coordinator is offline when a member leaves, that member stops immediately
+and retries removal when the coordinator returns. A lost execution lease stops the
+managed process; an uncertain attempt is shown as unknown and is not replayed.
+Messages expire after at most 30 minutes. Devices verify transport certificates,
+signed messages and the source Provider's project-lead proof before any execution.
+The console's separate LAN-access switch does not turn this feature on.
+
+The equivalent local controls are available with `fuli peer --help`. Full database
+backups contain private device and origin-authority material; keep those backups
+private. Public knowledge exports do not include those keys.

package/docs/client-connections.md

@@ -0,0 +1,86 @@
+# Connect a client
+
+FULI works through standard MCP tool calls. A client's brand or model provider is
+not an admission requirement. Installation and configuration generation do not
+call a model. A model can help a user configure a client or diagnose an error,
+but is never required to run the installer.
+
+## Local connection
+
+1. Install and initialize FULI with `npm install --global fuli-context` and
+   `fuli setup`. Setup can finish even when no known client is installed. Use
+   `fuli setup --skip-agents` to configure only FULI without changing any client.
+2. Run `fuli connect`, or open **Settings → Client connection** in the console.
+3. Merge the generated `fuli` entry into the client's MCP settings, keeping its
+   other servers. Reload and trust the connection as required by that client.
+
+The generated configuration launches a local stdio server using the current
+Node executable and installed package. It contains paths, not credentials. It
+is for this machine; regenerate it after moving the installation or changing
+the Node location. Use `fuli connect --data-dir PATH` for a separate FULI data
+directory, or `--runtime-config FILE` for an explicit runtime configuration.
+
+`fuli connect --format vscode` uses VS Code's `servers` envelope.
+`fuli connect --format server` prints only the server's `type`, `command` and
+`args` for clients with their own configuration editor. Paths with spaces remain
+individual JSON arguments; do not paste them as an unquoted shell command.
+
+Clients that only ask for a command can use `fuli mcp` if `fuli` is on their PATH.
+`fuli mcp --tools` lists the available tool contract without starting a task.
+Configuration export is read-only: it neither modifies client settings nor
+claims the client has connected successfully.
+
+## What a compatible client needs
+
+- MCP **tool discovery and invocation**, using stdio or the remote transport
+  described below. A resource-only MCP viewer cannot run FULI workflows.
+- Permission to connect to FULI and to use the relevant project and Agent.
+- An Agent that receives and follows the server's task-entry and completion
+  instructions. If the client omits MCP server instructions, add the installed
+  FULI Skill or equivalent task instructions to that client's instruction field.
+
+The generic connection uses the existing `other` client attribution and preserves
+project, Agent and executor permissions. It does not impersonate a supported host.
+To continue work, select the same FLA and authorized project against the same
+accessible FULI data. FULI does not copy source files or native client tool state.
+
+Verify a connection by checking that FULI tools appear, asking the Agent to load
+the current project's context, completing a small task, and checking that the
+same FLA can recover the saved result in a new conversation. Merely saving JSON
+is not proof that task entry or completion ran.
+
+## Optional client integration
+
+| Capability | Generic MCP | Current dedicated adapters |
+| --- | --- | --- |
+| Tools, authorized preferences and working memory | Available through tool calls | Shared behavior |
+| Automatic configuration and bundled instructions | Merge generated configuration | Codex, Claude Code, Cursor |
+| Task entry and completion hooks | Agent follows instructions; no guaranteed hook | Host-specific adapters; Cursor has a limited completion reminder |
+| Automatic visible conversation capture | No | Supported Codex and Claude Code transcript formats |
+| Roundtable wake/resume | Messages can wait for the recipient's next task | Codex and Claude Code CLIs |
+
+VS Code/Copilot, Gemini CLI and Cline document compatible local MCP transports.
+They are candidates for generic connection, not a claim of completed FULI
+end-to-end acceptance. Other MCP clients and custom Agents can use the same
+contract. Closed chat interfaces without tools or an extension interface cannot
+connect directly.
+
+New dedicated adapters belong behind the shared client ports. They should add
+only host-specific configuration, hooks, transcript parsing or execution, never
+a second version of FULI's knowledge and role rules. Missing enhancements must
+remain explicit; a generic connection must not claim automatic capture or wake.
+
+## Remote clients
+
+FULI includes a project-bound Streamable HTTP MCP upstream via `fuli remote-mcp`.
+It is separate from the console at port 2727. Cloud clients cannot reach a user's
+loopback address. They need a reachable HTTPS endpoint with authentication and
+the allowed project scope. The current upstream binds to loopback and requires
+an authenticated proxy for cloud use; it is not a turnkey public service.
+See the [remote connector setup](../README.md#remote-claude--cowork-connector-upstream).
+
+## References
+
+- [VS Code MCP configuration](https://code.visualstudio.com/docs/agent-customization/mcp-servers)
+- [Gemini CLI MCP servers](https://geminicli.com/docs/tools/mcp-server/)
+- [Cline MCP connections](https://docs.cline.bot/mcp/mcp-overview)

package/docs/employee-agents.md

@@ -1,6 +1,6 @@
 # Specialist Agents
 
-An employee template is a reusable role with an optional FULI-hosted or native workbench. Recruitment reuses the existing durable Project Agent identity and assignment model. Two roles are fixed: **Jefa**, the project manager, and **Bole**, the HR Agent. Both exist in every personal space from the start, manage all projects by default, cannot be archived or replaced by another coordinator or `hr` identity, and are never offered for hire. Neither requires a separate runtime package.
+An employee template is a reusable role with an optional FULI-hosted or native workbench. Recruitment reuses the existing durable Project Agent identity and assignment model. Three roles are fixed: **Jefa**, the project manager, **Bole**, the AR (Agent Resources) Agent, and **Tonborg**, the judgment Agent. They exist in every personal space from the start, manage all projects by default, and are never offered for hire. They require no separate runtime package. See [judgment and autonomy](judgment-and-autonomy.md) for Tonborg's review, feedback, and execution-choice workflow.
 
 ## User flow
 
@@ -94,7 +94,7 @@ The optional built-in-only native workbench declaration is `workbench: { "kind":
 
 The reserved identity is `employee.<template-id>`, recognized by the generic `fuli.employee:<template-id>` capability. Preserve this marker when customizing employee profiles. The actual role, history, memory and project assignments remain in FULI's existing Agent model.
 
-`employee.bole` is additionally reserved as the only system HR identity. Its Provider type is `hr`; other identities cannot claim that type. Recruitment history records the coordinating and HR Agent IDs, time, reason, proposed identity and final recruited identity, which powers Bole's people panel without inventing activity.
+`employee.bole` is additionally reserved as the only system AR identity. Its Provider type is `hr`; other identities cannot claim that type. Recruitment history records the coordinating and AR Agent IDs, time, reason, proposed identity and final recruited identity, which powers Bole's people panel without inventing activity.
 
 ## HTTP and MCP
 
@@ -172,7 +172,7 @@ Signing, remote catalog distribution, a runtime sandbox, database migration/unin
 
 ### Bole identity upgrades
 
-Local startup calls the idempotent system-HR endpoint for both fresh and existing installs.
+Local startup calls the idempotent system-AR endpoint for both fresh and existing installs.
 It consolidates the reserved legacy `fuli-project-hr` identity into `employee.bole` in one
 transaction. Names never identify merge targets. The legacy node remains an audit alias;
 assignments, recruitment references, attention and task history follow the canonical Bole.

package/docs/judgment-and-autonomy.md

@@ -0,0 +1,33 @@
+# Tonborg and autonomy
+
+Tonborg is the built-in judgment Agent, alongside Jefa and Bole. It has a persistent FLA identity, scoped Agent memory, and a native decision workbench. All Agents can be pinned from their card; pins appear in navigation. The three built-in roles are the initial defaults. Removing a pin, including every pin, survives reloads.
+
+## Choose the amount of autonomy
+
+Settings offers three choices, saved immediately with Undo:
+
+- **I decide**: Tonborg analyzes and records suggestions.
+- **Shared decisions**: Tonborg applies routine knowledge reviews backed by existing confirmation and accepts verified FULI tasks.
+- **Autonomous**: Tonborg may also review ordinary pending knowledge. Conflicts, sensitive preferences, uncertain evidence, and actions outside existing authority remain for the user.
+
+Projects inherit the global policy unless the user sets an exception. Updating FULI does not silently expand existing authority. The selected local client runs the judgment, and quality preference controls its reasoning effort. Logs show the actual model only when the client reports it.
+
+## What a decision does
+
+Knowledge review uses bounded batches and an independent review ledger. A successful assessment appears as **Tonborg reviewed**. It does not change human confirmation, authoritative-source confirmation, publication eligibility, or the original evidence. The Provider compares an evidence snapshot within the write transaction; edited or conflicted knowledge loses its effective AI-reviewed disposition. A failing item cannot block the rest of the queue.
+
+`assess_agent_action` recommends continuing the current conversation, reusing an authorized conversation, opening a session, or delegating work. It selects only registered, authorized, preflighted executors and available models that satisfy the Agent, assignment, task, and user routing constraints. The host performs and reports the actual launch or resumption. Conversation history is supplied only to a judgment client permitted for that Agent.
+
+`assess_task_completion` is called by the accountable lead with its current task context, exact task revision, and artifact revision. Automatic acceptance requires a passed real verification by another Agent. The Provider rechecks the current lead context, task revision, artifact, and verified attempt before completing the FULI task. Jefa's separate human acceptance, publication, permissions, and payments retain their existing boundaries.
+
+The console processes bounded automatic review batches while running. Manual review is available in Tonborg's workbench. Other MCP processes share the same local policy and decision database without starting duplicate schedulers. A lease prevents simultaneous decisions for the same project.
+
+## Correct a judgment
+
+Use thumbs up or thumbs down with an optional reason. A vote takes one click; reasons can be changed or cleared. The original decision, execution receipts, and feedback history remain auditable. Relevant feedback includes the selected client/model and work kind, so a reasonless vote still identifies the choice being evaluated. Feedback is scoped evidence for later decisions, not a new universal instruction or automatic reversal of an action.
+
+Tonborg uses only its own scoped memory and authorized evidence. Client failure, malformed output, stale evidence, or missing authority produces a visible failure or escalation rather than a successful execution claim. Its judgment subprocess has no task tools or MCP access.
+
+## Interfaces
+
+The MCP tools are `get_judgment_policy`, `list_judgments`, `review_with_tonborg`, `assess_agent_action`, `assess_task_completion`, `get_agent_pins`, and `pin_agent`. Autonomy changes and feedback remain local user operations. Agent entry context supplies the current policy and workflow guidance; existing sessions should reconnect to discover newly installed tools.

package/docs/project-agent-memory.md

@@ -6,12 +6,12 @@ Provider 读取已授权的员工和项目记录。切换客户端不会复制
 ## 人员目录与个人主页
 
 `/project-agents` 是简洁的人员目录，点击姓名进入 `/agents/:spaceId/:agentId`。
-个人主页展示 HR 配置的判断、品味、个性、用户期望，以及有来源的任职、招聘、
+个人主页展示 AR 配置的判断、品味、个性、用户期望，以及有来源的任职、招聘、
 工作和合作记录。未填写的风格不自动编造；角色描述不等于实际成长证据。
 合作次数只统计双方实际参与过的任务，不把排队或仅被分配算作已合作。
 
-组织关系来自各项目的协调策略。HR 人员目录支持名字、技能、职责、项目和任务
-模糊检索，在本地完成，不额外调用模型。也可让客户端中的 HR 通过人员工具查询。
+组织关系来自各项目的协调策略。AR 人员目录支持名字、技能、职责、项目和任务
+模糊检索，在本地完成，不额外调用模型。也可让客户端中的 AR 通过人员工具查询。
 主页设置可修改执行平台偏好和期望；锁定的执行平台仍受原策略约束。
 技术性配置保留在 `/project-agents/manage` 高级管理入口。
 
@@ -21,7 +21,7 @@ Provider 读取已授权的员工和项目记录。切换客户端不会复制
 | --- | --- | --- |
 | 身份 | 姓名、职责、能力、客户端与执行器偏好 | 个人空间中的稳定 Agent ID |
 | 任职 | 负责的项目、职责及任职历史 | 精确的空间、项目和 Agent |
-| 项目小组 | 小组长、长期成员、自动归组策略 | 项目协调策略；HR、项目经理保持同级 |
+| 项目小组 | 小组长、长期成员、自动归组策略 | 项目协调策略；AR、项目经理保持同级 |
 | 工作记录 | 本次结果、状态、来源客户端和时间 | Provider 中的任务生命周期记录 |
 | 可见对话 | 用户消息、助手回复和工具记录 | 同一数据库中独立日志；按空间、项目、Agent 隔离 |
 | 私有工作记忆 | 摘要、决策、未完成问题、下一步 | Neo4j 中按空间、项目、Agent 隔离的版本记录 |
@@ -32,7 +32,7 @@ Provider 读取已授权的员工和项目记录。切换客户端不会复制
 
 ## 小组随项目成长
 
-新项目可以没有专业员工。HR 按任务需要招募长期员工；默认首位成为小组长，
+新项目可以没有专业员工。AR 按任务需要招募长期员工；默认首位成为小组长，
 后续新员工加入小组。归组与招聘处于同一个事务中，失败时一起回滚。
 临时协作者只参加任务，不进入固定小组。
 
@@ -42,7 +42,7 @@ Provider 读取已授权的员工和项目记录。切换客户端不会复制
 
 自动沿用开启时，项目小组长是默认沟通负责人。显式指定有效员工仍然优先；
 关闭自动沿用后需要手动选择。角色、职能、模型策略和执行器偏好仍由用户配置。
-小组策略不改变 HR 与项目经理的管理权限，也不授权启动任意 worker。
+小组策略不改变 AR 与项目经理的管理权限，也不授权启动任意 worker。
 
 ## 任务入口与首次接管
 

package/graph-provider/fuli_graph/ai_review.py

@@ -0,0 +1,154 @@
+"""Version-bound AI review evidence helpers.
+
+An AI decision is useful only for the exact item snapshot that was supplied to
+the model.  Keep the digest deliberately independent from timestamps: edits can
+be visible in the graph before a separate revision or audit timestamp moves.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from datetime import date, datetime
+from typing import Any
+
+
+_DIRECT_FIELDS = (
+    'item_kind',
+    'item_id',
+    'title',
+    'content',
+    'valid_at',
+    'invalid_at',
+    'confirmation_status',
+    'confirmation_basis_json',
+    'profile_aspect',
+    'preference_scope',
+    'preference_project_id',
+    'preference_agent_id',
+    'inheritance_mode',
+    'current_quadrant',
+    'utility_score',
+    'confidence_score',
+    'qualified_use_count',
+    'distinct_task_count',
+    'negative_evidence_count',
+    'requires_attention',
+    'human_change_version',
+    'attributes_json',
+    'attributes',
+)
+
+
+def _json_safe(value: Any) -> Any:
+    if isinstance(value, (datetime, date)):
+        return value.isoformat()
+    to_native = getattr(value, 'to_native', None)
+    if callable(to_native):
+        return _json_safe(to_native())
+    if hasattr(value, 'model_dump'):
+        return _json_safe(value.model_dump(mode='json'))
+    if isinstance(value, dict):
+        return {str(key): _json_safe(item) for key, item in value.items()}
+    if isinstance(value, set):
+        return sorted((_json_safe(item) for item in value), key=repr)
+    if isinstance(value, (list, tuple)):
+        return [_json_safe(item) for item in value]
+    return value
+
+
+def _canonical_value(item: dict[str, Any], key: str) -> Any:
+    value = item.get(key)
+    if key == 'attributes' and value is None:
+        value = item.get('attributes_json')
+    if key == 'attributes_json' and value is None:
+        value = item.get('attributes')
+    if key in {'attributes', 'attributes_json'}:
+        if value in (None, '', '{}'):
+            return {}
+        if isinstance(value, str):
+            try:
+                value = json.loads(value)
+            except (TypeError, ValueError):
+                pass
+    return _json_safe(value)
+
+
+def ai_review_evidence_payload(
+    item: dict[str, Any],
+    *,
+    scope: str,
+    personal_project_id: str | None,
+    has_conflict: bool,
+) -> dict[str, Any]:
+    """Build the complete evidence identity used by candidate and CAS paths."""
+
+    payload = {
+        'direct': {
+            key: _canonical_value(item, key)
+            for key in _DIRECT_FIELDS
+        },
+        'scope': scope,
+        'personal_project_id': personal_project_id,
+        'project_ids': sorted({
+            str(project_id)
+            for project_id in (item.get('project_ids') or [])
+            if project_id
+        }),
+        'has_conflict': bool(has_conflict),
+    }
+    return _json_safe(payload)
+
+
+def ai_review_evidence_token(
+    item: dict[str, Any],
+    *,
+    scope: str,
+    personal_project_id: str | None,
+    has_conflict: bool,
+) -> str:
+    """Return a deterministic SHA-256 token for the reviewable item snapshot."""
+
+    encoded = json.dumps(
+        ai_review_evidence_payload(
+            item,
+            scope=scope,
+            personal_project_id=personal_project_id,
+            has_conflict=has_conflict,
+        ),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(',', ':'),
+    ).encode('utf-8')
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def effective_ai_review(
+    item: dict[str, Any],
+    *,
+    stored_token: str | None,
+    stored_assessment: dict[str, Any] | str | None,
+    scope: str,
+    personal_project_id: str | None,
+    has_conflict: bool,
+) -> dict[str, Any] | None:
+    """Expose an assessment only while its exact current evidence still holds."""
+
+    if not stored_token or item.get('requires_attention') is True or has_conflict:
+        return None
+    current_token = ai_review_evidence_token(
+        item,
+        scope=scope,
+        personal_project_id=personal_project_id,
+        has_conflict=has_conflict,
+    )
+    if current_token != stored_token:
+        return None
+    if isinstance(stored_assessment, str):
+        try:
+            stored_assessment = json.loads(stored_assessment)
+        except (TypeError, ValueError):
+            return None
+    if not isinstance(stored_assessment, dict):
+        return None
+    return stored_assessment

package/graph-provider/fuli_graph/common_knowledge.py

@@ -330,6 +330,18 @@ def _promotion_query(item_kind):
         WITH space, parent, canonical, direct_children,
              collect({{item: duplicate, spec: duplicate_spec}}) AS duplicate_pairs
         WHERE size(duplicate_pairs) = size($duplicate_specs)
+        WITH space, parent, canonical, direct_children, duplicate_pairs,
+             [{{kind: $item_kind, item: canonical}}] +
+             [pair IN duplicate_pairs |
+                {{kind: $item_kind, item: pair.item}}] AS lock_items
+        UNWIND lock_items AS lock_item
+        WITH space, parent, canonical, direct_children,
+             duplicate_pairs, lock_item
+        ORDER BY lock_item.kind + ':' + lock_item.item.uuid
+        SET lock_item.item.fuli_ai_review_lock_version =
+              coalesce(lock_item.item.fuli_ai_review_lock_version, 0) + 1
+        WITH space, parent, canonical, direct_children,
+             duplicate_pairs, collect(lock_item) AS _locked_items
         SET canonical.fuli_inheritance_mode = 'descendants',
             canonical.fuli_inherited_project_ids = []
         {duplicate_update}

package/graph-provider/fuli_graph/default_project_lead.py

@@ -83,6 +83,6 @@ class StoreDefaultProjectLead:
                 break
         return ProjectAgentContextResolution(
             status='ready', reason='default_project_lead',
-            match_basis=['HR hired the project lead for its first task'],
+            match_basis=['AR hired the project lead for its first task'],
             candidate_count=1, agent=lead,
         )

package/graph-provider/fuli_graph/graph_models.py

@@ -55,6 +55,13 @@ class GraphNode(StrictModel):
     last_human_changed_at: datetime | None = None
     last_agent_viewed_at: datetime | None = None
     last_agent_reviewed_at: datetime | None = None
+    ai_review_evidence_token: str | None = None
+    ai_assessment: dict[str, Any] | None = None
+    ai_review_scope: str | None = None
+    ai_review_project_id: str | None = None
+    ai_reviewed_at: datetime | None = None
+    ai_review_id: str | None = None
+    ai_review_decision_id: str | None = None
     utility_score: float = Field(default=0, ge=0, le=1)
     confidence_score: float = Field(default=0.5, ge=0, le=1)
     qualified_use_count: int = Field(default=0, ge=0)
@@ -109,6 +116,13 @@ class GraphEdge(StrictModel):
     last_human_changed_at: datetime | None = None
     last_agent_viewed_at: datetime | None = None
     last_agent_reviewed_at: datetime | None = None
+    ai_review_evidence_token: str | None = None
+    ai_assessment: dict[str, Any] | None = None
+    ai_review_scope: str | None = None
+    ai_review_project_id: str | None = None
+    ai_reviewed_at: datetime | None = None
+    ai_review_id: str | None = None
+    ai_review_decision_id: str | None = None
     utility_score: float = Field(default=0, ge=0, le=1)
     confidence_score: float = Field(default=0.5, ge=0, le=1)
     qualified_use_count: int = Field(default=0, ge=0)