omp-onlyne 0.1.0 → 0.2.0

package/README.md

@@ -24,6 +24,7 @@ key_scope = "project"
 
 [server]
 bind = "127.0.0.1"
+# port is written by the runtime; set it only to pin one by hand.
 
 [threads]
 page_size = 50
@@ -35,12 +36,15 @@ references. `/onlyne init` suggests region from the current Tern session name
 and leaves the node id empty for the user. A short region is saved as
 `urn:onlyne:region:<encoded name>`.
 
-The listening port is allocated by the operating system at startup; the runtime
-derives the endpoint and publishes it through discovery. Discovery uses a seed
-address supplied during bootstrap and an HTTP candidate exchange stored in
-`.onlyne/omp.db`. DNS-SD is an optional same-link accelerator: install
+The first start lets the operating system choose the listening port, and the
+runtime writes that port back as `server.port`; every later start reuses it, so
+the address a peer recorded keeps answering. A port another process already
+holds moves the node to a system-chosen one, which is written back the same way.
+The runtime derives the endpoint and publishes it through discovery. Discovery
+uses a seed address supplied during bootstrap and an HTTP candidate exchange
+stored in `.onlyne/omp.db`. DNS-SD is an optional same-link accelerator: install
 `bonjour-service` to enable it. The configuration does not contain endpoint,
-port, peers, task-spawn policy or supplement windows.
+peers, task-spawn policy or supplement windows.
 
 `node.key_scope` names where the identity key lives. `project` keeps it in
 `<project>/.onlyne/keys`, which a git work tree must ignore; the node refuses to
@@ -66,6 +70,10 @@ separate security proposal; leave both at their defaults for the first E2E.
   `onlyne://outbound`, `onlyne://neighbors` — read-only views. List views accept
   `page_size` (or `limit`) and `cursor`; a conversation holds both directions of one
   exchange.
+- `onlyne://threads` also lists the threads this node was invited into and does not own.
+  Those rows carry the owner, the last sequence the local records know, and the member
+  list when the owner answers; they are read-only, so the composer refuses them and
+  entries are read from the owner.
 - `onlyne://resources` reads the local node and peers whose key exchange is complete.
   Each owner returns its authorized resources or an explicit failure. Select
   `onlyne://resources/<encoded-owner>` for one owner's inventory and pagination.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "omp-onlyne",
-	"version": "0.1.0",
+	"version": "0.2.0",
 	"description": "Onlyne v3 for OMP: one msg tool, thread-aware attention and SystemOne delivery decisions",
 	"type": "module",
 	"main": "./index.ts",
@@ -39,8 +39,8 @@
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@onlyne/lib": "^3.0.0",
-		"@onlyne/node-host": "^3.0.0"
+		"@onlyne/lib": "^3.1.0",
+		"@onlyne/node-host": "^3.1.0"
 	},
 	"peerDependencies": {
 		"@oh-my-pi/pi-agent-core": "*",

package/src/acquire.ts

@@ -0,0 +1,182 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+
+/** RFC 0018 §2: how far a peer may be acquired without a human confirming first. */
+export type AcquirePolicy = "all" | "segment" | "none";
+
+/** RFC 0018 §5: host-side acquisition settings. The library never reads them. */
+export interface AcquisitionPolicy {
+	policy: AcquirePolicy;
+	/** CIDR blocks and host names; only read when `policy` is `segment`. */
+	allow: string[];
+}
+
+/**
+ * The default delegation: loopback only. Discovery excludes loopback by default, so the two
+ * defaults together mean a remote peer is neither discovered nor approved (RFC 0018 §5.1).
+ */
+export const DEFAULT_ACQUISITION: AcquisitionPolicy = {
+	policy: "segment",
+	allow: ["127.0.0.0/8", "::1/128"],
+};
+
+/** Turns a host name into the addresses it names; an empty list means it names none. */
+export type Resolver = (host: string) => Promise<string[]>;
+
+const dnsResolver: Resolver = async host => (await lookup(host, { all: true })).map(row => row.address);
+
+/** The configured policy, or the documented default when the config carries none. */
+export function acquisitionOf(config: { acquisition?: AcquisitionPolicy }): AcquisitionPolicy {
+	return config.acquisition ?? DEFAULT_ACQUISITION;
+}
+
+export type AcquireReason =
+	| "policy_all"
+	| "policy_segment"
+	| "policy_denied_none"
+	| "policy_unobserved"
+	| "policy_denied_observed"
+	| "policy_denied_declared"
+	| "policy_denied_recorded";
+
+/** RFC 0018 §2.1–2.2: what the host observed, what the peer declared, what discovery recorded. */
+export interface AcquireInput {
+	/** The address this statement's connection arrived from; absent when it was not observed. */
+	observed?: string;
+	/** The `base_url` the peer wrote into its own statement. */
+	declared?: string;
+	/** The discovery addresses recorded for this node id when the statement arrived. */
+	recorded?: readonly string[];
+}
+
+export interface AcquireVerdict {
+	allowed: boolean;
+	reason: AcquireReason;
+	/** The allow entry the observed address matched, when one did. */
+	matched?: string;
+}
+
+interface Block {
+	network: string;
+	prefix: number;
+	type: "ipv4" | "ipv6";
+}
+
+const HOST_NAME = /^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$/;
+
+/** One `[acquisition] allow` entry: `network/prefix`, or a host name to accept as written. */
+export function parseAllowBlock(value: string): Block | { name: string } | undefined {
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return undefined;
+	const slash = trimmed.lastIndexOf("/");
+	if (slash <= 0) {
+		// A name is matched by its own spelling, so listing it involves no resolution. A bare
+		// address is not a block: it needs a prefix to say what it covers.
+		if (isIP(trimmed) !== 0 || !HOST_NAME.test(trimmed)) return undefined;
+		return { name: trimmed.toLowerCase() };
+	}
+	const prefix = Number(trimmed.slice(slash + 1));
+	if (!Number.isInteger(prefix) || prefix < 0) return undefined;
+	const network = literalAddress(trimmed.slice(0, slash));
+	if (network === undefined) return undefined;
+	if (prefix > (network.type === "ipv4" ? 32 : 128)) return undefined;
+	return { network: network.address, prefix, type: network.type };
+}
+
+/** The host a value names: a URL's hostname, or the value itself when it is already a host. */
+function hostOf(value: string): string | undefined {
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return undefined;
+	if (!trimmed.includes("://")) return trimmed.replace(/^\[(.*)\]$/, "$1");
+	try {
+		const host = new URL(trimmed).hostname;
+		return host.replace(/^\[(.*)\]$/, "$1");
+	} catch {
+		return undefined;
+	}
+}
+
+/** A host that is already a literal address, with IPv4-mapped IPv6 read as IPv4. */
+function literalAddress(host: string): { address: string; type: "ipv4" | "ipv6" } | undefined {
+	const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(bare);
+	if (mapped !== null) return { address: mapped[1]!, type: "ipv4" };
+	const family = isIP(bare);
+	if (family === 4) return { address: bare, type: "ipv4" };
+	if (family === 6) return { address: bare, type: "ipv6" };
+	return undefined;
+}
+
+function blockHolds(address: { address: string; type: "ipv4" | "ipv6" }, block: Block): boolean {
+	if (block.type !== address.type) return false;
+	const blocks = new BlockList();
+	blocks.addSubnet(block.network, block.prefix, block.type);
+	return blocks.check(address.address, block.type);
+}
+
+/** The allow entry an address falls in, or undefined. */
+function entryFor(address: { address: string; type: "ipv4" | "ipv6" }, allow: readonly string[]): string | undefined {
+	for (const entry of allow) {
+		const block = parseAllowBlock(entry);
+		if (block === undefined || "name" in block) continue;
+		if (blockHolds(address, block)) return entry.trim();
+	}
+	return undefined;
+}
+
+/**
+ * The allow entry a value matches, or undefined. A literal address is judged as itself. A host
+ * name matches an allow entry of the same name; otherwise it is resolved and every address it
+ * names must fall inside the allow set (RFC 0018 §2.1) — a name that resolves to nothing, or to
+ * one address outside the set, matches nothing.
+ */
+export async function allowMatch(value: string, allow: readonly string[], resolve: Resolver = dnsResolver): Promise<string | undefined> {
+	const host = hostOf(value);
+	if (host === undefined) return undefined;
+	const literal = literalAddress(host);
+	if (literal !== undefined) return entryFor(literal, allow);
+	const named = allow.find(entry => {
+		const block = parseAllowBlock(entry);
+		return block !== undefined && "name" in block && block.name === host.toLowerCase();
+	});
+	if (named !== undefined) return named.trim();
+	const resolved = await resolve(host).catch(() => [] as string[]);
+	let matched: string | undefined;
+	for (const address of resolved) {
+		const target = literalAddress(address);
+		if (target === undefined) return undefined;
+		const entry = entryFor(target, allow);
+		if (entry === undefined) return undefined;
+		matched ??= entry;
+	}
+	return matched;
+}
+
+/**
+ * RFC 0018 §2: decide whether this peer may be approved without a human confirming first.
+ *
+ * The declared address is checked because the trust row stores it and `peerBase` falls back to
+ * it when discovery has no record. The recorded addresses are checked because
+ * `discovery.resolve()` re-probes every one of them before it connects, so a record outside the
+ * allow set is an outbound request the policy never authorized.
+ */
+export async function evaluateAcquisition(
+	policy: AcquisitionPolicy,
+	input: AcquireInput,
+	resolve: Resolver = dnsResolver,
+): Promise<AcquireVerdict> {
+	if (policy.policy === "none") return { allowed: false, reason: "policy_denied_none" };
+	if (policy.policy === "all") return { allowed: true, reason: "policy_all" };
+	if (input.observed === undefined) return { allowed: false, reason: "policy_unobserved" };
+	const observed = await allowMatch(input.observed, policy.allow, resolve);
+	if (observed === undefined) return { allowed: false, reason: "policy_denied_observed" };
+	if (input.declared !== undefined && await allowMatch(input.declared, policy.allow, resolve) === undefined) {
+		return { allowed: false, reason: "policy_denied_declared", matched: observed };
+	}
+	for (const address of input.recorded ?? []) {
+		if (await allowMatch(address, policy.allow, resolve) === undefined) {
+			return { allowed: false, reason: "policy_denied_recorded", matched: observed };
+		}
+	}
+	return { allowed: true, reason: "policy_segment", matched: observed };
+}

package/src/bridge-text.ts

@@ -51,6 +51,24 @@ const en = {
 	todoNoLinks: "Onlyne todo metadata on entry {entry} has no links array; the association cannot be replayed.",
 	todoUnknownRecordedAction: "Onlyne todo decision on entry {entry} has an unknown action.",
 	todoMissingString: "Onlyne todo metadata on entry {entry} has no string {field}.",
+
+	trustHeader: "Onlyne trust · {phase} · {node}",
+	trustFingerprint: "fingerprint: {fingerprint}",
+	trustDeclared: "declared address: {declared}",
+	trustObserved: "observed address: {observed}",
+	trustUnobserved: "not observed",
+	trustPolicy: "acquisition policy: {policy}",
+	trustJudgement: "judgement: {reason} · {conclusion}",
+	trustAllowed: "allowed",
+	trustRefused: "refused",
+	trustInvited: "This peer's approval waits for yours. Decide it explicitly:",
+	trustApproved: "The acquisition policy approved this peer before any human confirmed, and the approval is committed. No action is requested.",
+	trustRequested: "Local approval is committed; the exchange completes when the peer confirms. This is a status update; no action is requested.",
+	trustExchanged: "Both sides approved. This is a status update; no action is requested.",
+	trustRevoked: "Local approval was dropped. This is a status update; no action is requested.",
+	trustAcceptAction: 'accept: msg({ delivery_kind: "accept the trust handshake", msg: "accept {node}", meta: { op: "trust_accept", node_id: "{node}", fingerprint: "{fingerprint}" } })',
+	trustRevokeAction: 'revoke: msg({ delivery_kind: "revoke the trust handshake", msg: "revoke {node}", meta: { op: "trust_revoke", node_id: "{node}" } })',
+	trustPanelOnly: "The acquisition policy is none, so this approval is the human's: only the panel can accept it. You may read and revoke.",
 };
 
 const zh: Record<keyof typeof en, string> = {
@@ -104,6 +122,24 @@ const zh: Record<keyof typeof en, string> = {
 	todoNoLinks: "条目 {entry} 上的 onlyne todo 元数据没有 links 数组；无法重放该关联。",
 	todoUnknownRecordedAction: "条目 {entry} 上的 onlyne todo 决策含有未知动作。",
 	todoMissingString: "条目 {entry} 上的 onlyne todo 元数据缺少字符串字段 {field}。",
+
+	trustHeader: "Onlyne 信任 · {phase} · {node}",
+	trustFingerprint: "指纹：{fingerprint}",
+	trustDeclared: "声明地址：{declared}",
+	trustObserved: "观测地址：{observed}",
+	trustUnobserved: "未观测到",
+	trustPolicy: "获取策略：{policy}",
+	trustJudgement: "判定：{reason} · {conclusion}",
+	trustAllowed: "允许",
+	trustRefused: "拒绝",
+	trustInvited: "这个对端的批准在等你。请显式决定：",
+	trustApproved: "获取策略在任何人工确认之前批准了这个对端，批准已经提交。不索取任何动作。",
+	trustRequested: "本地批准已提交；对端确认后交换完成。这是状态更新，不索取任何动作。",
+	trustExchanged: "双方都已批准。这是状态更新，不索取任何动作。",
+	trustRevoked: "本地批准已撤销。这是状态更新，不索取任何动作。",
+	trustAcceptAction: '批准：msg({ delivery_kind: "批准信任握手", msg: "批准 {node}", meta: { op: "trust_accept", node_id: "{node}", fingerprint: "{fingerprint}" } })',
+	trustRevokeAction: '撤销：msg({ delivery_kind: "撤销信任握手", msg: "撤销 {node}", meta: { op: "trust_revoke", node_id: "{node}" } })',
+	trustPanelOnly: "获取策略是 none，这次批准属于人类：只有面板能接受它。你可以读取与撤销。",
 };
 
 export const bridgeText = createTranslator({ en, "zh-CN": zh });

package/src/config.ts

@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import type { OnlyneConfig } from "./types.ts";
 import type { Locale } from "@onlyne/node-host/i18n";
 import { hostText as t } from "./host-text.ts";
+import { DEFAULT_ACQUISITION, parseAllowBlock, type AcquirePolicy, type AcquisitionPolicy } from "./acquire.ts";
 
 const CONFIG_RELATIVE_PATH = join(".onlyne", "config.toml");
 const REGION_PREFIX = "urn:onlyne:region:";
@@ -136,8 +137,12 @@ export function parseConfig(text: string, path: string): OnlyneConfig {
 	const keyRef = optionalString(node, "key_ref", "node.key_ref");
 	const keyScope = optionalString(node, "key_scope", "node.key_scope");
 	const publicUrl = optionalString(server, "public_url", "server.public_url");
+	const port = optionalInteger(server, "port", "server.port");
 	const seeds = discovery === undefined ? undefined : stringArray(discovery, "seeds", "discovery.seeds");
 	const trust = trustSeeds(raw, path);
+	const acquisition = raw.acquisition === undefined ? undefined : table(raw, "acquisition", path);
+	const acquirePolicy = acquisition === undefined ? undefined : optionalString(acquisition, "policy", "acquisition.policy");
+	const acquireAllow = acquisition === undefined ? undefined : stringArray(acquisition, "allow", "acquisition.allow");
 	const bind = optionalString(server, "bind", "server.bind");
 	const pageSize = optionalInteger(threads, "page_size", "threads.page_size");
 	return validateConfig({
@@ -145,8 +150,9 @@ export function parseConfig(text: string, path: string): OnlyneConfig {
 		...(raw.language === undefined ? {} : { language: raw.language as Locale }),
 		region: region ?? "",
 		node: { id: id ?? "", ...(keyRef === undefined ? {} : { key_ref: keyRef }), ...(keyScope === undefined ? {} : { key_scope: keyScope as "project" | "global" | "none" }) },
-		server: { bind: bind ?? DEFAULT_BIND, ...(publicUrl === undefined ? {} : { public_url: publicUrl }) },
+		server: { bind: bind ?? DEFAULT_BIND, ...(port === undefined ? {} : { port }), ...(publicUrl === undefined ? {} : { public_url: publicUrl }) },
 		threads: { page_size: pageSize ?? DEFAULT_PAGE_SIZE },
+		acquisition: { policy: acquirePolicyOf(acquirePolicy), allow: acquireAllow ?? [...DEFAULT_ACQUISITION.allow] },
 		...(seeds === undefined && trust === undefined ? {} : { discovery: { ...(seeds === undefined ? {} : { seeds }), ...(trust === undefined ? {} : { trust }) } }),
 		...(trust === undefined ? {} : { trust }),
 	});
@@ -167,11 +173,15 @@ export function serializeConfig(config: OnlyneConfig): string {
 		"",
 		"[server]",
 		`bind = ${tomlString(config.server.bind)}`,
+		...(config.server.port === undefined ? [] : [`port = ${String(config.server.port)}`]),
 		...(config.server.public_url === undefined ? [] : [`public_url = ${tomlString(config.server.public_url)}`]),
 		"",
 		"[threads]",
 		`page_size = ${String(config.threads.page_size)}`,
 	);
+	const acquisition = config.acquisition ?? DEFAULT_ACQUISITION;
+	lines.push("", "[acquisition]", `policy = ${tomlString(acquisition.policy)}`);
+	if (acquisition.allow.length > 0) lines.push(`allow = [${acquisition.allow.map(entry => tomlString(entry)).join(", ")}]`);
 	if (config.discovery?.seeds !== undefined || config.trust !== undefined) {
 		lines.push("", "[discovery]");
 		const seeds = config.discovery?.seeds ?? [];
@@ -192,11 +202,15 @@ function validateConfig(config: OnlyneConfig): OnlyneConfig {
 	const keyRef = config.node.key_ref?.trim();
 	const bind = config.server.bind.trim();
 	const publicUrl = config.server.public_url?.trim();
+	const port = config.server.port;
 	const keyScope = config.node.key_scope;
 	if (keyScope !== undefined && keyScope !== "project" && keyScope !== "global" && keyScope !== "none") {
 		throw new ConfigError("invalid", t("keyScopeInvalid", { value: JSON.stringify(keyScope) }));
 	}
 	if (publicUrl !== undefined && publicUrl.length === 0) throw new ConfigError("invalid", t("publicUrlEmpty"));
+	if (port !== undefined && (!Number.isInteger(port) || port < 0 || port > 65535)) {
+		throw new ConfigError("invalid", t("portRange", { value: String(port) }));
+	}
 	// A seed is contacted at every start, so it is stored in the one spelling the node uses.
 	const seeds = [...new Set((config.discovery?.seeds ?? []).map(seed => seed.trim()).filter(seed => seed.length > 0).map(normalizeServiceUrl))];
 	if (bind.length === 0) throw new ConfigError("invalid", t("bindEmpty"));
@@ -207,13 +221,25 @@ function validateConfig(config: OnlyneConfig): OnlyneConfig {
 	if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
 		throw new ConfigError("invalid", t("pageSizeRange", { value: String(pageSize) }));
 	}
+	const policy = config.acquisition?.policy ?? DEFAULT_ACQUISITION.policy;
+	if (policy !== "all" && policy !== "segment" && policy !== "none") {
+		throw new ConfigError("invalid", t("acquirePolicy", { value: JSON.stringify(policy) }));
+	}
+	const acquisition: AcquisitionPolicy = {
+		policy,
+		allow: [...new Set((config.acquisition?.allow ?? DEFAULT_ACQUISITION.allow).map(entry => entry.trim()).filter(entry => entry.length > 0))],
+	};
+	for (const entry of acquisition.allow) {
+		if (parseAllowBlock(entry) === undefined) throw new ConfigError("invalid", t("acquireAllow", { value: JSON.stringify(entry) }));
+	}
 	return {
 		path: config.path,
 		...(config.language === undefined ? {} : { language: config.language }),
 		region,
 		node: { id, ...(keyRef === undefined || keyRef.length === 0 ? {} : { key_ref: keyRef }), ...(keyScope === undefined ? {} : { key_scope: keyScope }) },
-		server: { bind, ...(publicUrl === undefined ? {} : { public_url: publicUrl }) },
+		server: { bind, ...(port === undefined || port === 0 ? {} : { port }), ...(publicUrl === undefined ? {} : { public_url: publicUrl }) },
 		threads: { page_size: pageSize },
+		acquisition,
 		...(seeds.length === 0 ? {} : { discovery: { seeds } }),
 		...(config.trust === undefined ? {} : { trust: config.trust }),
 	};
@@ -226,7 +252,6 @@ function rejectRetired(
 	threads: Record<string, unknown>,
 ): void {
 	rejectKey(node, "endpoint", t("retiredEndpoint"));
-	rejectKey(server, "port", t("retiredPort"));
 	rejectKey(raw, "peers", t("retiredPeers"));
 	rejectKey(raw, "omp", t("retiredOmp"));
 	rejectKey(threads, "default_attention", t("retiredAttention"));
@@ -236,6 +261,13 @@ function rejectKey(source: Record<string, unknown>, key: string, message: string
 	if (source[key] !== undefined) throw new ConfigError("invalid", message);
 }
 
+/** `acquisition.policy`: the documented default when absent; any other word is a configuration error. */
+function acquirePolicyOf(value: string | undefined): AcquirePolicy {
+	if (value === undefined) return DEFAULT_ACQUISITION.policy;
+	if (value === "all" || value === "segment" || value === "none") return value;
+	throw new ConfigError("invalid", t("acquirePolicy", { value: JSON.stringify(value) }));
+}
+
 function table(root: Record<string, unknown>, key: string, path: string): Record<string, unknown> {
 	const value = root[key];
 	if (value === undefined) return {};

package/src/decider-text.ts

@@ -7,11 +7,11 @@ import { createTranslator } from "@onlyne/node-host/i18n";
 const en = {
 	"judge.o1.instructions":
 		"Choose the one action the model's message asks for. communicate: deliver a message, reply or progress note to another agent. inspect: look up local or network state. manage_thread: create, close, describe or change members of a local thread. manage_domain: manage this node's domain membership. operate_resource: operate a resource the message names explicitly.",
-	"judge.o1.communicate": "The message is meant for another agent or node, including asking a peer something.",
+	"judge.o1.communicate": "The message is meant for another agent or node: delivering, replying, asking, reporting, or starting a new task or topic with one. Work another agent should carry out is this intent even when the action sounds physical (deploy, archive, clean up).",
 	"judge.o1.inspect":
-		"The message asks to see node-level state: who is online, the inbox, a thread's messages, one message, or delivery evidence. The thread registry and a thread's members are not this.",
+		"The message asks to see node-level state: who is online, the neighbors or contacts list, the inbox, a thread's messages, one message, or delivery evidence. Listing or reading any of these is inspect. The thread registry and a thread's members are not this.",
 	"judge.o1.manage_thread":
-		"The message works on threads themselves: list the threads, describe one thread's members, create, close, add or remove a member. Reading a thread's messages is inspect.",
+		"The message works on threads themselves: list the threads, describe one thread's members, create, close, add or remove a member. Reading a thread's messages is inspect. Starting a new task or conversation with a peer is communicate, not this.",
 	"judge.o1.manage_domain":
 		"The message changes or reads this node's domain membership: join, leave, list or describe the membership, or discover a domain's members.",
 	"judge.o1.operate_resource":
@@ -20,12 +20,14 @@ const en = {
 	"judge.relation.instructions":
 		"The message references an earlier message. Is it a final reply or a progress supplement?",
 	"judge.relation.reply": "A final answer that may release the original sender's wait.",
-	"judge.relation.followup": "A supplement or progress note that does not release a wait.",
+	"judge.relation.followup": "A supplement or progress note that does not release a wait. A courtesy acknowledgement of a message that asked for nothing (收到、感谢同步) is this, or a plain new message — not a reply that releases an expectation nobody holds.",
 
 	"judge.target.instructions":
-		"Choose the node that should receive this message. Each candidate is named by its node id; the alias is its short name.",
+		"Choose the node that should receive this message. Each candidate is named by its node id; the alias is its short name. none: no candidate is named or implied by this call — refusing beats a random guess.",
 	"judge.target.peer":
 		"Discovered peer {node} at {base_url} (instance {instance}, last seen {last_seen}).",
+	"judge.target.none":
+		"No candidate is named or implied by this call; sending would be a guess.",
 
 	"judge.response.instructions":
 		"Two facts decide: does the receiver have to act, and can the sender continue without the answer?",
@@ -50,7 +52,7 @@ const en = {
 		"The message does not continue any published context and starts fresh work instead.",
 
 	"judge.inbound.instructions":
-		"Choose where this inbound message is handled. main_agent: the main session takes it. A context alias: the named execution context continues the work it was created for. new_subagent: fresh independent work in a new subagent.",
+		"Choose where this inbound message is handled. main_agent: the main session takes it — a message that needs no answer and is not a self-contained work item always lands here, however clearly it says no follow-up is wanted. A context alias: the named execution context continues the work it was created for. new_subagent: fresh independent work in a new subagent.",
 	"judge.inbound.main_agent": "The message needs an answer, or no registered context's work matches it.",
 	"judge.inbound.context": "{summary} (state: {state}, agent: {agent})",
 	"judge.inbound.context_same_thread":
@@ -59,11 +61,11 @@ const en = {
 		"The message is a self-contained work item with its own background, and needs no answer. A status note, greeting, relay or summary is not this.",
 
 	"judge.needs_answer.instructions":
-		"Does the sender expect this node to answer? A reference to an earlier message does not by itself create that expectation.",
+		"Does the sender expect this node to answer? A reference to an earlier message does not by itself create that expectation, and a message that explicitly says no reply is needed (不用回、不用发给我、报告直接入库即可) is always no, however much work it requests.",
 	"judge.needs_answer.yes":
 		"The sender asks a question, greets and waits for an answer, requests work whose result must be reported back, or otherwise needs a reply from this node. plan.response await or async is consistent with this.",
 	"judge.needs_answer.no":
-		"The sender expects nothing back: it completes a reply this node asked for, reports status, records a fact, or says no answer is needed. plan.response none is consistent with this.",
+		"The sender expects nothing back: it completes a reply this node asked for, reports status, records a fact, or explicitly says no reply is needed. plan.response none is consistent with this.",
 
 	"judge.insertion.instructions":
 		"The message goes to the main session. Choose when it should enter the agent's work.",
@@ -118,10 +120,17 @@ const en = {
 	"judge.domain_op.describe": "Describe this node's membership.",
 	"judge.domain_op.discover": "Discover a domain's declared members.",
 
+	"judge.original.instructions":
+		"This call states neither an in_reply_to reference nor a relation. Decide whether it answers one of the listed inbound messages — records this context can see that nobody has answered yet — or starts a new message. Decide from what the call is for; recency or being the only candidate never makes a call an answer.",
+	"judge.original.new": "Not an answer to any of them; a new message on its own topic.",
+	"judge.original.candidate": "Answer the inbound message from {from} ({kind}) at thread {thread} seq {seq}: {body}",
+
 	"error.outbound_intent": "The decision did not choose an outbound intent.",
 	"error.relation_needs_reference": "A relation needs an in_reply_to reference.",
 	"error.reply_authority":
 		"The reply must go to its original reply authority {authority}, not {target}.",
+	"error.reply_reference_conflict":
+		"The referenced message id belongs to {actual}, not to the sender you named ({named}). Answer that message, or name its sender.",
 	"error.delivery_target": "The decision did not choose a delivery target.",
 	"error.execution_context_missing":
 		'{to} publishes no execution context this message continues. Send it with execution "new" to start one.',
@@ -222,11 +231,11 @@ const en = {
 const zh: Record<keyof typeof en, string> = {
 	"judge.o1.instructions":
 		"选择模型这条消息要求执行的那一个动作。communicate：向另一个 agent 投递消息、回复或进度说明。inspect：查询本地或网络状态。manage_thread：创建、关闭、描述本地 thread 或变更其成员。manage_domain：管理本节点的域成员身份。operate_resource：操作消息明确点名的资源。",
-	"judge.o1.communicate": "这条消息是发给另一个 agent 或节点的，包括向对端提问。",
+	"judge.o1.communicate": "这条消息是发给另一个 agent 或节点的：投递、回复、提问、汇报，或与对端开启一项新任务、新话题。交给另一个 agent 去做的操作也属此类，即使动作听起来像物理操作（部署、归档、清理）。",
 	"judge.o1.inspect":
-		"这条消息要求查看节点级状态：谁在线、inbox、某个 thread 的消息、单条消息或投递凭据。thread 注册表和某个 thread 的成员不属于此。",
+		"这条消息要求查看节点级状态：谁在线、邻居或联系人列表、inbox、某个 thread 的消息、单条消息或投递凭据。列出或读取其中任何一项都属 inspect。thread 注册表和某个 thread 的成员不属于此。",
 	"judge.o1.manage_thread":
-		"这条消息作用于 thread 本身：列出 thread、描述某个 thread 的成员、创建、关闭、添加或移除成员。读取 thread 内的消息属于 inspect。",
+		"这条消息作用于 thread 本身：列出 thread、描述某个 thread 的成员、创建、关闭、添加或移除成员。读取 thread 内的消息属于 inspect。与对端开启一项新任务或新对话属于 communicate,不属于此。",
 	"judge.o1.manage_domain":
 		"这条消息改变或读取本节点的域成员身份：加入、离开、列出或描述成员身份，或发现某个域的成员。",
 	"judge.o1.operate_resource":
@@ -234,12 +243,19 @@ const zh: Record<keyof typeof en, string> = {
 
 	"judge.relation.instructions": "这条消息引用了更早的一条消息。它是最终回复还是进度补充？",
 	"judge.relation.reply": "一个最终答复，可以解除原发送方的等待。",
-	"judge.relation.followup": "一个补充或进度说明，不解除任何等待。",
+	"judge.relation.followup": "一个补充或进度说明，不解除任何等待。对并未索取回答的消息致意确认（收到、感谢同步）属此，或干脆作为新消息——而不是解除无人持有的等待的 reply。",
+
+	"judge.original.instructions":
+		"这次调用既没有 in_reply_to 引用，也没有 relation。请判断它是否在回答下面列出的某条入站消息（本上下文可见、且尚无人答复的记录），还是一条独立的新消息。按调用的目的判断；最新或唯一候选本身不能说明它就是回答。",
+	"judge.original.new": "都不是；这是一条独立话题的新消息。",
+	"judge.original.candidate": "回答来自 {from} 的入站消息（{kind}），位于 thread {thread} seq {seq}：{body}",
 
 	"judge.target.instructions":
-		"选择应当接收这条消息的节点。每个候选以其 node id 命名，alias 是它的短名。",
+		"选择应当接收这条消息的节点。每个候选以其 node id 命名，alias 是它的短名。none：这次调用没有点名或暗示任何候选——宁可拒绝也不随机猜测。",
 	"judge.target.peer":
 		"已发现的 peer {node}，位于 {base_url}（实例 {instance}，最后出现于 {last_seen}）。",
+	"judge.target.none":
+		"这次调用没有点名或暗示任何候选；强行发送只是猜测。",
 
 	"judge.response.instructions":
 		"两个事实决定：接收方是否必须动手，以及发送方能否在没有答复的情况下继续。",
@@ -261,7 +277,7 @@ const zh: Record<keyof typeof en, string> = {
 	"judge.context.none": "这条消息不延续任何已发布的上下文，而是开启新工作。",
 
 	"judge.inbound.instructions":
-		"选择这条入站消息在哪里处理。main_agent：由主会话处理。上下文别名：由该执行上下文延续它当初被创建来处理的工作。new_subagent：在新的 subagent 中处理独立的新工作。",
+		"选择这条入站消息在哪里处理。main_agent：由主会话处理——不需要答复、也不是自成一体工作项的消息一律落在这里，无论它把「不用后续处理」说得多明确。上下文别名：由该执行上下文延续它当初被创建来处理的工作。new_subagent：在新的 subagent 中处理独立的新工作。",
 	"judge.inbound.main_agent": "这条消息需要答复，或没有任何已注册上下文的工作与之匹配。",
 	"judge.inbound.context": "{summary}（state: {state}, agent: {agent}）",
 	"judge.inbound.context_same_thread":
@@ -270,7 +286,7 @@ const zh: Record<keyof typeof en, string> = {
 		"这条消息是一个自带背景、自成一体的工作项，且无需答复。状态说明、问候、转达或汇总不属于此。",
 
 	"judge.needs_answer.instructions":
-		"发送方是否期待本节点答复？仅引用更早的消息本身并不构成这种期待。",
+		"发送方是否期待本节点答复？仅引用更早的消息本身并不构成这种期待；明说不必回复（不用回、不用发给我、报告直接入库即可）的消息，无论请求多少工作，一律为 no。",
 	"judge.needs_answer.yes":
 		"发送方提出问题、问候并等待答复、请求必须回报结果的工作，或以其他方式需要本节点回复。plan.response 为 await 或 async 与此一致。",
 	"judge.needs_answer.no":
@@ -329,6 +345,8 @@ const zh: Record<keyof typeof en, string> = {
 	"error.outbound_intent": "决策没有选择出站意图。",
 	"error.relation_needs_reference": "relation 需要 in_reply_to 引用。",
 	"error.reply_authority": "回复必须发往其原始回复权威 {authority}，而不是 {target}。",
+	"error.reply_reference_conflict":
+		"引用的消息 id 属于 {actual}，而不是你指名的发送方（{named}）。请回答那条消息，或改用它的发送方。",
 	"error.delivery_target": "决策没有选择投递目标。",
 	"error.execution_context_missing":
 		'{to} 未发布这条消息所延续的执行上下文。要以 execution "new" 发送以新建一个。',