project-tiny-context-harness 0.8.13 → 0.8.16

package/assets/README.zh-CN.md

@@ -75,7 +75,7 @@ ty-context enable long-task
 2. **仅在需要时建立 Design Authority。** 如果项目尚未采用 Design Authority，且本次工作属于 style-bearing 范围，显式选择 `$design-system-authoring`，生成、选择并采用规范 `DESIGN.md`、token source 和 provider binding。项目已经配置 Design Authority 时跳过这一步。
 3. **准备一份可写的初始方案。** 将项目原生的产品/技术方案放在明确路径，例如 `docs/initial-proposal.md`。它可以由用户、外部服务或显式请求的适用方案能力编写。`design-resource-authoring` 不负责初始方案 authoring，也不要求经过独立的中间 authoring 阶段。
 4. **生成并选择设计资源。** 选择 `$design-resource-authoring`，传入初始方案路径、精确开发范围和目标。它会输出一份完成一次性回改的修订方案、选定的不可变规范资源及其 manifest 和 dependencies，以及通过校验的残余 `design-resource-handoff-v1`。
-5. **启动 Single-Goal 交付。** 选择 `$long-task-workflow`，传入修订方案、已校验 handoff 和选定规范资源集合的精确路径。该 Skill 会建立 Source-bound Contract Draft；第一次 Compile/Authority Lock 必须在实现前无条件结束当前回合，并输出 `处理好模型更换之后，请发送【继续】。`。此前任何模型策略文字都不能跳过该边界，Harness 也不能观察模型是否真的改变。用户恢复后，父 Goal 执行内部 Delegation Suitability 判断；只有宿主显式选择精确 `long_task_implementation` 时才把独立有界工作交给它，否则不启动 generic 替代项而由父 Goal 执行。Authority、架构、Context、集成、当前候选检查与正式验证始终由父 Goal 持有。
+5. **启动 Single-Goal 交付。** 选择 `$long-task-workflow`，传入修订方案、已校验 handoff 和选定规范资源集合的精确路径。该 Skill 会建立 Source-bound Contract Draft；第一次 Compile/Authority Lock 必须在实现前无条件结束当前回合，并输出 `处理好模型更换后，请仅回复：模型切换卡点解除，继续`。普通“继续”不满足 managed prompt protocol；此前任何模型策略文字都不能跳过该边界，Harness 也不能观察下一条宿主消息或模型是否真的改变。用户恢复后，父 Goal 先识别合格的有界工作包，再判断 profile/capacity；没有用户或宿主显式禁止时，合格集合必须实际调用多个精确 `long_task_implementation`，由宿主结果进入六理由 zero-start 或 partial delegation。数量保持动态，禁止 generic 替代项；Source、Contract、Authority、架构、Context、工作包选择、集成、当前候选检查、正式验证、Final Gate、close 与 completion 始终只由父 Goal 持有。
 
 一组可以直接改写使用的调用顺序如下：
 
@@ -229,6 +229,10 @@ provider-neutral handoff 是残余语义与绑定层，不是 CSS 文本副本
 
 只要是已经选定、准备进入实现的设计资源，DSA 先用 `ty-context design-resource bundle` 发布精确 target 集；两种开发路径再对每个已发布 handoff 运行 `ty-context design-resource preflight <handoff.md>`。取得不完整、缺少或多出未声明依赖/target、target 重复、不安全路径、manifest/文件 digest 过期、虚构 locator、Census 未冻结/不完整、生成被抽样/截断、轴值被聚合、Expected/Canonical/Handoff Fact 集不相等、required method 缺失、comparator/Oracle/environment 绑定无效、design-system lineage 未解析、适用 cell 未覆盖、exact target 缺 full-target layout/pixel Fact、证据不受支持或含义未决都 fail closed。preflight 只证明设计输入语义完整且资源身份正确；开发流程仍必须打开真实资源，并从生产入口证明当前实现。
 
+Long-Task 投影继续要求每个 Claim-bearing Assertion 只绑定一个 Claim。对每个 selected-design verification method，target 的 root conformance Assertion 与该方法的独立 Assertion 以并集覆盖其 Fact/Rule 引用的 Source Claims；该并集只补齐覆盖，不合并方法 capability、证据、结果或失败归因。
+
+repository pattern 只把圆括号作为经过转义的 route-group 字面字符，不把它们解释成正则分组或 extglob；现有 `*`、`**`、`?` 语义保持不变，`[]`/`{}` 仍不受支持。
+
 对 material 工作，`context_uiux_design` 应用上面的投影规则并让风险比例化 coverage reasoning 保持 task-local。`context_development_engineer` 用稳定 surface/control key 把每个受影响的 selected target 和声明 condition 追踪到生产 route/component owner、冷启动真实用户旅程及适用的渲染/交互检查。第一个有价值的可运行纵向切片只是建议性的真实入口反馈点，不是实现门禁；最终候选仍必须重跑受影响的冷启动旅程。Source 已明确要求的组合不能静默删减，但默认路线应报告未被证据建立的条件，而不是声称精确机器闭包。资源哈希、manifest 和数量只证明资源完整性，实现截图既不能成为自己的目标，也不能单独证明实现一致性。
 
 显式 Long-Task 是同一共享义务的强权威载体。它在 Compile 前解决缺失/冲突的 UI 权威，并用 `field_coverage` 闭合每个真实 Product Control 的全部 22 个 canonical 字段；这条产品语义投影与更细的 design Fact universe 相互独立，绝不构成粒度上限。选定 target 冻结 canonical manifest identity/digest，并把每个原子 Fact/required-method 对投影为一个 `fact_expectations` row，其中包含 subject/target/condition/variation/property identity、expected located-value digest、comparator/parameter/tolerance/mask、Oracle identity/capability、environment 和 sensitivity。只有 package-admitted observer 能提供匹配的 `fact_results` Actual/comparison row。当前 slice 中，项目 `design_conformance`、`design_method` 与 `fact_results` record 只作诊断；受影响的 UI/design obligation 必须保留阻断性 External Confirmation，不能成为 machine proof。Product `surface_bindings`、Control Claims/relations 与 root-entry journey 继续承载产品语义，已有 Claim、Assertion、Check、Stage、Binding、revision 与 Final Gate 仍是唯一 Long-Task 生命周期和 closure。每个 blocker 保留精确 Source-item/method/capability lineage，不能在 Contract 内自行豁免；缩减范围必须修订 Source/Contract 权威。
@@ -281,8 +285,8 @@ Skill 只通过结构化 MCP（必要时有限使用 CLI/daemon/UI fallback）
 - 一个用户选定的仓库与最终验证/收敛 worktree；
 - 一次完整选定交付、一个 Contract、一个 Final Gate；
 - Outcome 依赖只表示验收与中间证明就绪关系，不限制实现顺序，也不表示 Worker 调度；
-- 第一次 Authority Lock 后、正式实现前有一次无条件的宿主模型更换检查点；Agent 结束当前回合，用户处理后发送普通“继续”，Harness 不观察或验证模型是否改变；
-- 当前 Goal 自主选择实现顺序、局部计划、工具，并可按 ROI 选择单 agent 或多开平台原生 agent/subagent；Harness 不负责分配、调度、重试或恢复，agent 报告不是 Progress 或证明，所有结果必须汇入同一验证 worktree；Frontier 只提供验收/验证建议；
+- 第一次 Authority Lock 后、正式实现前有一次无条件的宿主模型更换检查点；Agent 结束当前回合，用户处理后只回复 `模型切换卡点解除，继续`，普通“继续”不满足 package-managed prompt protocol，Harness 不观察或验证模型是否改变；
+- 当前 Goal 自主选择实现顺序、局部计划、工具、具体工作包分解与动态 Worker 数量；满足正向默认谓词时必须实际调用多个精确 `long_task_implementation`，否则声明一个许可的 solo 理由并由父 Goal 执行。Harness 不负责分配、调度、重试或恢复，agent 报告不是 Progress 或证明，所有结果必须汇入同一验证 worktree；Frontier 只提供验收/验证建议；
 - targeted verify 是可选反馈与修复证据，永远不能 accepted，也不构成继续实现或进入 Final Gate 的门禁；
 - scope-only revision 可先做无状态候选诊断，机械边界内的修复自动采用；只有稳定且确需用户决策的候选才至多询问一次精确 identity；
 - Final Gate 在一个当前快照上重跑全部 Check；
@@ -290,7 +294,7 @@ Skill 只通过结构化 MCP（必要时有限使用 CLI/daemon/UI fallback）
 
 它的证明命题有明确前提：Source 在声明观察粒度下完整且准确、Source→Contract 投影保持语义、所有实际适用单元被展开；在这些前提下，只有每个机器义务同时具有冻结 Expected 权威、package-admitted 当前 Actual、Harness 计算的 comparison/verdict、可归因静态生产载体或直接 process observation、因果 Counterfactual 与当前 Final Gate 快照证明时，fresh `machine_accepted` 且无待定 External Confirmation 的 `AcceptedDeliveryTerminal` 才推出声明内机器可观察漂移为空。`machine_accepted_external_pending` 只证明已准入机器范围，完整交付仍未完成。Harness 无法发现未声明要求，也不声称任意物理/外部观察绝对可靠。
 
-Compile 为每个机器 Claim 或 Fact × required-method obligation 派生内部 `CompiledObservationAuthority`，它不是新的 Contract Authority、状态或 registry。首版只有两条机器路径：`package_static_json_exact` 读取 runner 前快照中已存在、runner 后 no-follow 文件 identity/digest 不变、匹配生产 Binding 且不属于 Source/Context/Contract/expected/evidence/report/status/verifier output 的 UTF-8 JSON 静态结构；prepare-all mutation observation 与逐文件 pre/post identity/hash 共同拒绝 transient/persistent swap，它只证明静态内容，不证明运行时消费。`package_process_json_exact` 只支持 Source-backed 的 `runtime_family: process`、`role: product` 目标，以及 target 和完整 argv 与该权威一致的直接 root `project_binary`。每个 required target 都由一项 canonical Source technical obligation 精确覆盖 key、role、family、root、完整 argv 和 capabilities。Compile 生成声明稳定的 process runtime closure：精确 Source-backed root、当前 Claim/Counterfactual production carriers，以及由有限 argv→production Binding 匹配得到的路径。匹配只读取独立参数或显式 `--key=value`，从声明 `cwd` 规范化安全仓库相对路径，并要求 exact 或 pattern Binding 覆盖结果；glob 与无扩展名文件都受支持。未匹配的安全相对值被忽略且不复制；绝对路径、仓库逃逸、`file:` URL 与网络 URL fail closed，除非其语义被显式转到既有 external TCB/External Confirmation 边界。Compile 不广域扫描或复制全部 `input_paths`，角色分离只检查实际 closure 成员。Global Check 将 Outcome Binding 投影成内部 `{ outcome_key, local_key, binding_ref, binding }`，并复用 `<outcome>.<binding>`：逻辑 ref 保持独立，相同物理路径可只复制一次，不改变 authored Contract 或建立 registry。Exact planned closure member 可以到 Final Gate 才 materialize。Harness 仅复制这份 closure，并把其 identity 绑定到 host attestation。兼容的 Cross-Check 与 implicit-preserved Facts 共享一个受限 stdout `ty-context-product-observation-v1` envelope，同时保留独立 result identity。无法显式 production-bind 的嵌入式依赖或无法直接绑定 root 输出面的 Claim 必须 External Confirmation。项目 payload 继续使用 v3，不发布 v4，也不建设通用 UI/native observer 或语言依赖解析器。
+Compile 为每个机器 Claim 或 Fact × required-method obligation 派生内部 `CompiledObservationAuthority`，它不是新的 Contract Authority、状态或 registry。首版只有两条机器路径：`package_static_json_exact` 读取 runner 前快照中已存在、runner 后 no-follow 文件 identity/digest 不变、匹配生产 Binding 且不属于 Source/Context/Contract/expected/evidence/report/status/verifier output 的 UTF-8 JSON 静态结构；prepare-all mutation observation 与逐文件 pre/post identity/hash 共同拒绝 transient/persistent swap，它只证明静态内容，不证明运行时消费。`package_process_json_exact` 只支持 Source-backed 的 `runtime_family: process`、`role: product` 目标，以及 target 和完整 argv 与该权威一致的直接 root `project_binary`。每个 required target 都由一项 canonical Source technical obligation 精确覆盖 key、role、family、root、完整 argv 和 capabilities。Compile 生成声明稳定的 process runtime closure：精确 Source-backed root、当前 Claim/Counterfactual production carriers，以及由有限 argv→production Binding 匹配得到的路径。每个 `root_argv` 数组成员始终是 child-visible exact token；分类器不拆空格、不去引号、不重写反斜杠。封闭语法只检查独立 token 或一个显式 `--name=value`，支持的 standalone switch 是 label，其他 compound form 不获得机器闭包；raw token 与派生 locator 分离。quote、POSIX/UNC absolute、drive-prefixed、slash/backslash 平台歧义、除精确小写十进制 `node:<number>` 外的所有 scheme-shaped colon prefix 和 unsupported compound 在执行前 fail closed，除非显式转到既有 external TCB/External Confirmation。parent segment 先结合声明 `cwd` 解析，再判断是否真实越出仓库，因此仓库内 `..` 合法，真实 escape 才失败。exact/pattern Binding 支持 glob、无扩展名和含空格单 token 文件；安全 unmatched 以及精确小写十进制 `node:<number>` 和纯数字 `<hours>:<minutes>` 两种 colon scalar 允许但不复制。Compile 不广域扫描或复制全部 `input_paths`，角色分离只检查实际 closure 成员。Global Check 将 Outcome Binding 投影成内部 `{ outcome_key, local_key, binding_ref, binding }`，并复用 `<outcome>.<binding>`：逻辑 ref 保持独立，相同物理路径可只复制一次，不改变 authored Contract 或建立 registry。Exact planned closure member 可以到 Final Gate 才 materialize。Harness 仅复制这份 closure，把其 identity 绑定到 host attestation，并把未修改的 raw argv 传给 child。兼容的 Cross-Check 与 implicit-preserved Facts 共享一个受限 stdout `ty-context-product-observation-v1` envelope，同时保留独立 result identity。无法显式 production-bind 的嵌入式依赖或无法直接绑定 root 输出面的 Claim 必须 External Confirmation。项目 payload 继续使用 v3，不发布 v4，也不建设 shell/URI/dependency parser 或通用 UI/native observer。
 
 项目自报的 v3 actual/value digest、comparison、`passed`、verdict 与 capability record 只作兼容诊断，不能提供 Actual 或完成权威。当前 package 可派生范围只有 exact/presence 与 host-derived `target_runtime`；`interaction_trace`、`state_delta`、`design_conformance` 以及其他尚无 package derivation 的 capability 即使有项目 record 也必须保留阻断性 External Confirmation。custom/`named_external_tcb` Oracle、间接 wrapper、browser/native/device session、layout/pixel/accessibility/motion、protected observation、tolerance/mask 与 custom locator 同样不能关闭 machine obligation。每个机器 Counterfactual 都要有 package-admitted baseline/mutated observation、相同 compiled closure identity、属于 production carrier 集合的 mutation target、affected/preserved/allowed-fan-out 精确集合与相同 obligation universe，并在适用时保持 host-derived process liveness；没有 admitted observation 时不得跳过。旧 Contract 不会被静默改写，target/closure TCB 变化会使旧 Active Authority、Progress、Evidence 与 Receipt 失去验收效力。
 
@@ -310,34 +314,44 @@ Direct-process observer 提供的是受限 containment，不是针对恶意代
     "required": true,
     "phase": "post_authority_lock_pre_implementation",
     "action": "change_model_in_host_then_continue",
-    "resume_token": "continue",
+    "resume_token": "model checkpoint cleared, continue",
     "turn_boundary": "end_current_turn",
     "blocked_until_resume": ["product_implementation", "file_edits", "build", "test_execution"],
     "model_change_owner": "host_or_user",
     "model_change_observable_by_harness": false,
-    "generic_continue_satisfies": true,
-    "message": "处理好模型更换之后，请发送【继续】。"
+    "generic_continue_satisfies": false,
+    "message": "处理好模型更换后，请仅回复：模型切换卡点解除，继续"
   }
 }
 ```
 
-这是无条件的终止当前回合边界。Agent 在该结果后不得继续产品实现、文件编辑、构建或测试，必须输出 `处理好模型更换之后，请发送【继续】。` 并结束当前回合；用户此前写过任何模型策略都不能跳过。之后用户发送普通“继续”即可恢复，Harness 不观察、不验证宿主模型是否改变。后续 `compile --revise` 返回 `required: false`，不会重复暂停。Harness 不会自动切换模型，也不持久化 acknowledgement、model route 或 checkpoint state；该检查点不是验收证据。
+这是无条件的终止当前回合边界。Agent 在该结果后不得继续产品实现、文件编辑、构建或测试，必须输出 `处理好模型更换后，请仅回复：模型切换卡点解除，继续` 并结束当前回合；用户此前写过任何模型策略都不能跳过，普通“继续”不满足 managed prompt protocol。它仍是人工宿主提示，不是 Harness 强制执行的解锁：Harness 不观察下一条宿主消息，也不验证模型是否改变。后续 `compile --revise` 返回 `required: false`，不会重复暂停。Harness 不会自动切换模型，也不持久化 acknowledgement、model route 或 checkpoint state；该检查点不是验收证据。
 
-锁定后的修订把“Authority 有变化”和“需要用户决策”分开：单调增强、锁定 Claims/targets/proof obligations 不变的 Source/Context snapshot 更新、Runner/input 实装修复、repo-bound scope 扩展、风险增强，以及 carrier、mutation、Check 相同且 Claim/预期失败断言覆盖不减少的等价 Counterfactual 覆盖可自动采用；产品/Source Claim/target/external-confirmation 变化，丢失 scenario/Claim/Evidence Capability/失败拦截，移除 forbidden/owner Context，runner type/effect、verifier kernel 或未知 reason 则只预览并等待精确 identity，风险降级直接拒绝。`diagnose-revision` 无副作用，撤回/替换候选只在同一 `delivery-contract.yaml` 合并，不产生询问。最终 pending brief 先解释 Authority Revision 是什么，再区分 `user_decision_reasons` 与机械边界变化。必须先展示 brief；若当前任务已有明确指令精确覆盖全部决策 reason，可机械转录而不二次询问，泛化“继续”、一揽子批准、建议或 Agent 推断不算。每次采用都保留 exact identity、旧 Authority 连续性、证据失效和完整 Final Gate，并返回滚动实现，绝不表示完成。
+锁定后的修订把“Authority 有变化”和“需要用户决策”分开：单调增强、锁定 Claims/targets/proof obligations 不变的 Source/Context snapshot 更新、Runner/input 实装修复、repo-bound scope 扩展、风险增强，以及 carrier、mutation、Check 相同且 Claim/预期失败断言覆盖不减少的等价 Counterfactual 覆盖可自动采用；产品/Source Claim/target/external-confirmation 变化，丢失 scenario/Claim/Evidence Capability/失败拦截，移除 forbidden/owner Context，runner type/effect、verifier kernel 或未知 reason 则只预览并等待精确 identity，风险降级直接拒绝。verifier 内容 identity 变化会使旧证据失效；没有旧 Authority 或可信发布来源提供的独立保持证明时仍保持 fail-closed，但 digest 变化本身不再被误报为已经证实的 acceptance/proof reduction，brief 会列出变化文件并明确“语义保持尚未独立建立”。`diagnose-revision` 无副作用，撤回/替换候选只在同一 `delivery-contract.yaml` 合并，不产生询问。最终 pending brief 先解释 Authority Revision 是什么，再区分 `user_decision_reasons` 与机械边界变化。必须先展示 brief；若当前任务已有明确指令精确覆盖全部决策 reason，可机械转录而不二次询问，泛化“继续”、一揽子批准、建议或 Agent 推断不算。每次采用都保留 exact identity、旧 Authority 连续性、证据失效和完整 Final Gate，并返回滚动实现，绝不表示完成。
 
 Long-Task Skill 采用渐进读取：主 `SKILL.md` 只保留目标、硬边界和路由；Draft 输入/Contract Authoring、Evidence Design 与 Authority Lifecycle 细节按当前活动读取一层 reference，其中 Draft 输入与 Contract mapping 同时进行。这只是指令组织，不产生第二权威。共享 Architecture Deliberation 与适用质量路由在 Source-bound Draft authoring 中完成；material 且可独立证伪的架构/工程质量不变量使用已有 Source-backed obligations/constraints/forbidden shortcuts、owner/path/Binding、项目原生 executable Checks，以及功能行为可独立通过时的单独 Assertion。Final Gate 是唯一的 Long-Task Engineering Quality/Architecture Conformance 承载点，只证明该声明、项目检查绑定的集合。
 
-Draft Outcome 只是 Authority Lock 前的 Outcome。Outcome 按可独立观察、判断、纵向闭环和定向验证的结果拆分，用于投影 acceptance/verification-ready 工作集、定位失败、恢复 finding 并精确失效旧局部结果。`depends_on` 只表示 acceptance 与中间证明 readiness，不授权或禁止实现编辑。每个 Outcome 属于一个有序 Stage；Stage gate 传递依赖同 Stage 其余 Outcome，后续 Stage 依赖前置 gate。Rolling Frontier 和 Stage 状态都由普通 Outcome Progress 临时派生，只是建议性验证/诊断投影。当前 Goal 可按代码现实跨 Outcome/Stage 实现、检查或返工，也可使用平台原生 opaque delegation；Harness 不创建 delegation scheduler、不把委派当证明，所有结果必须汇入选定验证 worktree。Outcome 不是 Worker、scheduler task、queue 或并行单元，Stage 也没有 Receipt 或第二个 Gate。Outcome 拆分诊断和证明归属，不拆分完成权威，因此最终仍必须在当前最终快照运行一次完整 Final Gate。
+Draft Outcome 只是 Authority Lock 前的 Outcome。Outcome 按可独立观察、判断、纵向闭环和定向验证的结果拆分，用于投影 acceptance/verification-ready 工作集、定位失败、恢复 finding 并精确失效旧局部结果。`depends_on` 只表示 acceptance 与中间证明 readiness，不授权或禁止实现编辑。每个 Outcome 属于一个有序 Stage；Stage gate 传递依赖同 Stage 其余 Outcome，后续 Stage 依赖前置 gate。Rolling Frontier 和 Stage 状态都由普通 Outcome Progress 临时派生，只是建议性验证/诊断投影。当前 Goal 可按代码现实跨 Outcome/Stage 实现、检查或返工，并应用上述正向默认精确 Worker 规则；Harness 不创建 delegation scheduler、不把委派当证明，所有结果必须汇入选定验证 worktree。Outcome 不是 Worker、scheduler task、queue 或并行单元，Stage 也没有 Receipt 或第二个 Gate。Outcome 拆分诊断和证明归属，不拆分完成权威，因此最终仍必须在当前最终快照运行一次完整 Final Gate。
 
 Contract 声明一个有界 target profile、非空 required product target refs，以及每个 target 的 runtime family、root entrypoint、完整 root argv 和显式 capabilities。每个 required target 还必须通过 Source Claim disposition 映射到一项相同 identity 的 canonical Source technical obligation；process root 与有限 exact/pattern 匹配实际准入的每个 argv 路径同时属于 production owner 与 production Binding。Compile 只从 root、已匹配 argv 路径与必需 carriers 生成声明稳定的 runtime closure，不复制或广域扫描全部 `input_paths` 或 manifest sibling。安全但未匹配的相对参数不是依赖；绝对、逃逸、file-URL 或网络引用 fail closed，除非显式进入外部边界。已匹配路径可以是 `planned` 并在 Preflight/Compile 时尚不存在，但 Final Gate 必须在当前 candidate 中看到它们；仅 materialize 不改变 Authority identity。Web/process 代理不能代替单独要求的 Native/desktop 目标。当前机器 `target_runtime` 只有 Harness 直接启动该 Source-backed process product root 才能成立；browser/native/desktop/device 要求保留阻断性 External Confirmation。每个 `critical_user_path` Outcome 和 Stage gate 都必须通过 admitted root proof 或对应 External Confirmation 处理每个 required target。
 
 如果声明结果可能在代理表面通过、却在目标运行时独立失败，最早 owning Outcome 必须使用 admitted direct-process root Check 或阻断性 External Confirmation。项目 payload、仓库内状态报告、截图、二进制、日志、历史运行、新 session id 和代理表面都不是 runtime Authority。Check 仍声明精确 Given/When、journey 与 applicability，所有 Claim/证明单元仍独立可归因；项目 capability record 只作兼容诊断，只有当前准入的 exact/presence 与 host `target_runtime` 结果能满足对应 all-of cell，其余 capability 继续 external。每个行为型 machine Assertion 的同 Check Counterfactual 必须观察 affected Facts 变化、preserved Facts/liveness 不变、其他变化属于显式 fan-out，并保持相同 obligation universe 与 compiled process-closure identity。Binding 或路径不是 production reachability：静态 mutation 只证明该结构，runtime 必须经过 `Harness mutation of compiled production carrier → direct Source-backed product-root execution → package-observed Actual change`；Authority/verification/evidence/status/report/Receipt/verifier input 都不能进入 closure。既有最小失效范围、targeted feedback 与当前 Final Gate 规则不变，不新增通用 reachability scanner、实现 Gate、调度器或状态。
 
-长程任务工作流的“防劣化保障”同时保护当前因果链的真实性、跨版本的漂移拦截强度，以及相邻的 `F = 实现自由边界（Implementation Freedom Boundary）`。Context 对“当前实现”的描述必须与索引到的真实代码/运行逻辑一致；当前实现必须继续承担“需求/架构意义表达”和“fail-closed 识别、返工、最终快照复验”两项共同必要职责，并在明确的 Source 完整性、语义绑定、可观察性和可信边界下推出“不错误完成”的设计目的。`F` 是效率与反流程膨胀边界，不是第三项机制职责或无漂移定理前提：在 Source/Contract、架构、安全、禁止捷径、不可逆影响与外部动作边界内，实现顺序、方法、局部反馈节奏以及可选的单 agent/多 agent 或 subagent 实现由当前 Goal 决定；Harness 不建立开发阶段/方法 Gate、逐编辑强制验证、agent 调度/状态或委派证明。设计目的、关键逻辑、两项职责、成立边界和 `F` 都属于受保护设计不变量；弱化或替换它们必须由项目 owner 显式作出设计目的变更决策并给出替代证明，不能由 Agent 推断、文档/代码/测试同步改写或成本理由暗中授权。新增开发期限制还必须解决 Final Gate 或更轻项目检查无法覆盖的独立风险，并在全部安全/证明硬约束之后证明正的净 ROI——具体表现为有证据的高 total-cost ROI 与高效率；“高”表示显著、稳定余量，不是全局或局部最优。目的有效性、相对非劣化、must-allow、结构成本和适用的实测总成本阈值闭合后即停止扩建，除非出现新的真实反例、反复出现的重大成本热点或显著额外净收益证据。该保障复用现有 Context、索引、测试、关键哨兵、路由和一致性门禁，不新增第二 Authority、Gate 或状态；它也不能补出未表达/不可观察的需求，或对拥有全部修改权限者的蓄意联合弱化提供绝对不可变保证。
+长程任务工作流的“防劣化保障”同时保护当前因果链的真实性、跨版本的漂移拦截强度，以及相邻的 `F = 实现自由边界（Implementation Freedom Boundary）`。Context 对“当前实现”的描述必须与索引到的真实代码/运行逻辑一致；当前实现必须继续承担“需求/架构意义表达”和“fail-closed 识别、返工、最终快照复验”两项共同必要职责，并在明确的 Source 完整性、语义绑定、可观察性和可信边界下推出“不错误完成”的设计目的。`F` 是效率与反流程膨胀边界，不是第三项机制职责或无漂移定理前提：在 Source/Contract、架构、安全、禁止捷径、不可逆影响与外部动作边界内，实现顺序、方法、局部反馈节奏、具体工作包分解与动态 Worker 数量由当前 Goal 决定；当前正向默认规则只在上述有界谓词成立时要求多个精确 Worker，否则要求一个许可的 solo 理由。Harness 不建立开发阶段/方法 Gate、逐编辑强制验证、固定分配、agent 调度/状态或委派证明。设计目的、关键逻辑、两项职责、成立边界和 `F` 都属于受保护设计不变量；弱化或替换它们必须由项目 owner 显式作出设计目的变更决策并给出替代证明，不能由 Agent 推断、文档/代码/测试同步改写或成本理由暗中授权。新增开发期限制还必须解决 Final Gate 或更轻项目检查无法覆盖的独立风险，并在全部安全/证明硬约束之后证明正的净 ROI——具体表现为有证据的高 total-cost ROI 与高效率；“高”表示显著、稳定余量，不是全局或局部最优。目的有效性、相对非劣化、must-allow、结构成本和适用的实测总成本阈值闭合后即停止扩建，除非出现新的真实反例、反复出现的重大成本热点或显著额外净收益证据。该保障复用现有 Context、索引、测试、关键哨兵、路由和一致性门禁，不新增第二 Authority、Gate 或状态；它也不能补出未表达/不可观察的需求，或对拥有全部修改权限者的蓄意联合弱化提供绝对不可变保证。
+
+因此机制开发和发布结论只使用四级证据措辞：已设计、已实现、已建立声明中的已知反例保护、在明确 TCB 内高水准实现。当前 observer 修订保持 Level 3。R9/R10 各自保留三层不可互换证明：未消费的非闭包 evidence/verification 输入 must-allow；产品尝试读取非闭包文件时由运行隔离阻止接受；显式 production-bound 的 argv closure 成员若兼任 evidence/verification 角色则 Compile-reject。后续 raw argv 分类反例由 owner regression、完整 current-candidate lifecycle matrix 与独立审计证明；历史 real-process ROI workload 不证明该反例，也不新增 `CASE_ID`。Compile owner diagnostic 绑定完整已提交攻击候选；stale-Authority 防复用另由 legal-neighbor Authority 后在同一攻击候选上触发 Final-Gate freshness 拒绝证明，`active_task_missing`、dirty candidate 或 fresh Compile rejection 均不能替代。当前 machine report 持有准确 attack/control 集合与 terminal，不新增 registry。Level 4 仍要求未改变的完整 total-cost ROI 定理、无开放 critical false acceptance 的独立能力审计和项目所有者单独明确批准。prose 审计、测试数量、fresh-Agent 实验、observed lifecycle 胜出和脱敏 fixture 都不能单独提升等级或证明真实事故代表性。
+
+真实 process ROI 的实现 owner 是 `examples/delivery-benchmark/real-process-workload/**`、real-process runner/policy/scoring、唯一 package materializer、formal acquisition modules 与 `tools/verify_long_task_real_process_roi.mjs`。它冻结 8 个 Fact、normal/degraded modes、两个 Counterfactual、独立 semantic gold、A/B/C 角色及每个 fixture 的已提交候选 identity。Real-process v5 总是采集五组 A/B/C repeat；前三组结果只作诊断。唯一 materializer 负责 detached checkout、`npm ci`、build、source parity 与禁用 scripts 的 pack，并绑定 exact commit/tree/lockfile/runtime/clean status。Workload、collection、summary、aggregate 与 attestation 只拥有 immutable raw 或可重算 `observed_lifecycle_*`，formal status 只能是 `not_evaluated`；formal-v2 packet 只声明一对一路径。顶层 verifier 在验证实际 manifest-v2 run set 后构造 immutable artifact index，并继续是 evidence admission、normalized exclusive ownership、`total_roi_supported`、`total_roi_positive` 与 formal status 的唯一 owner；packet 自报 bytes、digest、role、verified、normalized value、事故货币总额、event ID 或结论都会被拒绝。Verifier 绑定 A/B/C commit/tree/materialized-package、benchmark implementation、acquisition runtime/TCB、scenario、collector、precollection、retention 与 redaction identities。本轮口径仍为 1 NCU=CNY 1、active/wait 每小时 CNY 200/50、十次交付周期、repeatable cost 的五组中位数投影、maintenance/recovery 每周期一次、introduction/adoption/migration 一次性、以及一个事故 benefit 中位数。Provider/compute/storage 只从 prelocked 实际账单或官方价格材料换算，事故 benefit 从 raw time/usage 重算；benefit 至少为正增量成本 1.25 倍、至少 4/5 paired net 为正且 sample CV 不超过 20%，成本下降另报。缺失证据即 unsupported。Provider-event v1-v2、其他已列 formal v1 schema、real-process v1-v4 与 manifest v1 均须重新采集；机器测量、独立审计与 owner promotion 保持分离。
+
+当前精确 schema 矩阵为：accounting-policy、evidence-packet、precollection-plan、raw-event、scenario-catalog 和 source-manifest 为 v2；Provider event 为 v3；real-process 为 v5；run-set manifest 为 v2。Provider-event v1-v2、其他已列 formal v1 schema、real-process v1-v4 和 manifest v1 均须重新采集；`next` 未分配。
+
+Formal collection 的 11-scenario catalog 是 scenario/source/zero policy 的唯一 owner；collector 只声明 capabilities，所有 source 只能是 `required|forbidden`。Human time 来自 runner contemporaneous interaction recorder，compute 来自 Job-contained 完整 process tree，State 来自 runner exact payload/ledger 与预冻结 retention，Provider usage 来自 invocation-bound Provider correlation。Module-private branded acquisition runtime 自行构造 recorder、Windows Job supervisor、固定 Provider bridge 与 State capture；缺失 source、sampling/default-zero proxy、普通 spawn fallback 或 stream overflow 均 fail closed。`invocation_id` 在 spawn 前派生，record SHA 与 `execution_id` 在 tree close 后派生；human/process/wall/Provider clock 各有独立 ID，250ms 与 5000ms 容差不能替代因果 correlation。 Parent 捕获 exact prompt，并只用 `process.execPath`、空 `execArgv`、`shell:false`、bounded pipes 和 allowlist 环境启动 candidate-owned isolated Provider worker；proxy、自定义 CA 与 Node preload/loader 不受支持并 fail closed。单一 protocol owner 冻结 request/result shape、endpoint、prompt/response/stdout/stderr/deadline/abort/output-token limits 与 error code。Worker 单独拥有 `node:https`、bounded streaming 和固定 parser，四个 create-new/no-follow 临时文件在 worker/bridge 完全关闭后必须整体删除且不进入 run-set。Provider event 绑定未保留 response 的 digest、parser 与 worker identity；verifier 校验 acquisition TCB，但不声称独立重解析未保留的 response bytes。
+
+Catalog 派生 86 次 execution 与 586 个 formal artifact：516 个 base file、30 个 compute record、10 个 State ledger 加 10 个 payload、10 个 prompt 加 10 个 Provider event。Formal fuse 为 650 files/364.625 MiB，完整 run-set fuse 为 4,379 files/974.3125 MiB。Evidence Candidate 冻结全部 code/schema/Context/test/package-version/protocol bytes；Promotion Commit 必须是其直接子提交，只新增四个 package-/TCB-external governance record，并保持 materialized-package、benchmark 与 runtime/TCB identities 不变，否则重新采集与审计。 Runtime TCB v2 绑定 clean Node launch、executable path/hash、worker/protocol、parser/transport 与 limits。Benchmark implementation identity 纳入 `npm_command_spec.mjs`、Provider protocol/worker 与有限 local-dependency closure checker；working-tree、Git object、collection 与 Promotion 路径都重算闭包并绑定实际执行源码根。
 
-因此机制开发和发布结论只使用四级证据措辞：已设计、已实现、已建立声明中的已知反例保护、在明确 TCB 内高水准实现。当前 observer 修订保持 Level 3。R9/R10 各自保留三层不可互换证明：未消费的非闭包 evidence/verification 输入 must-allow；产品尝试读取非闭包文件时由运行隔离阻止接受；显式 production-bound 的 argv closure 成员若兼任 evidence/verification 角色则 Compile-reject。Compile owner diagnostic 绑定完整已提交攻击候选；stale-Authority 防复用另由 legal-neighbor Authority 后在同一攻击候选上触发 Final-Gate freshness 拒绝证明，`active_task_missing`、dirty candidate 或 fresh Compile rejection 均不能替代。当前 machine report 持有准确 attack/control 集合与 terminal，不新增 registry。Level 4 仍要求未改变的完整 total-cost ROI 定理及无开放 critical false acceptance 的独立能力审计。prose 审计、测试数量、fresh-Agent 实验、observed lifecycle 胜出和脱敏 fixture 都不能单独提升等级或证明真实事故代表性。
+真实采集当前为 `external_pending`：Starward-derived fixture 缺少获授权的原始事故 design/runtime evidence、完整 original-to-sanitized mapping 及 retention/publication authorization；本轮也没有可保留的 invocation-bound Provider usage/price material 或 State-retention Source。Synthetic control 只能证明结构，不能作为 formal-positive evidence。完成这些真实外部输入、唯一 verifier 的完整正向报告、独立审计与 owner promotion 前，能力保持 Level 3。Package 0.8.15 是历史冻结的 Evidence Candidate identity；Package 0.8.16 是当前 Level-3 package candidate，不继承其 package、benchmark 或 runtime/TCB evidence。`capability_level=level_3`、`level_4_claimed=false`，没有 formal-positive 或实际 Promotion。Provider readiness 只表示本地配置、credential presence 与 clean worker launch envelope 足以发起一次有界尝试；public `independent_evidence_admitted` 只表示 packet structure/source binding，完整证据与正 ROI 仍分别由 `total_roi_supported`、`total_roi_positive` 表示。
 
-真实 process ROI 的 owner 是 `examples/delivery-benchmark/real-process-workload/**`、`tools/long_task_real_process_roi_{policy,runner,scoring}.mjs` 与 `tools/verify_long_task_real_process_roi.mjs`。它冻结 8 个 Fact、normal/degraded modes、两个 Counterfactual、独立 semantic gold、A/B/C 比较角色及每个 fixture 的已提交候选 identity。每个 fixture 生命周期前后的 HEAD/tree/status 原始命令记录绑定该 identity，并要求候选保持 clean 且不变。版本化报告可以暴露可重算的 `observed_lifecycle_*` 有效性、配对胜出、余量、方差、阶段、正确路径、资源及错误完成/错误阻断事实，但它们没有准入含义，也不使用 `qualified_positive_*`。完整 total-cost 支持还要求独立可归因且已验证的 Authoring、Runtime、State、Recovery、maintenance、test、process、introduction、adoption 与 migration 证据。当前 v2 尚未实现独立正式成本证据接入，也不准入自报的 `verified` 记录；任一类别缺失、未验证或未准入都强制 `total_roi_supported=false`，并禁止 `total_roi_positive=true`。机器测量与独立治理准入保持分离；报告结构变化必须升级 schema，或提供明确、有测试且保留缺失证据语义的兼容读取器。
+Formal collection 还会在执行前锁定一个固定 scenario catalog，覆盖十类成本和一个 controlled incident 的 exact task/gold bytes。每个 event 绑定唯一 raw output：成本 B/C 都必须命中共同 gold；事故 B 必须错误而 C 必须命中它。这样只提交时间/usage 不能制造 purpose benefit，也不会新增通用 scenario registry。
 
 本机制自己的 Final-Gate Oracle 读取固定 test-id 的 machine report，并对完整 wrong-candidate 与 correct-control workflow status 做对照。runtime capability 必须通过真实生命周期得到 `wrong candidate != machine_accepted` 且 `correct candidate == machine_accepted`；“命令 exit 0 + token/string 存在”只能证明文档一致。ROI 由独立 verifier 计算，绝不进入 safety Fact verdict。
 
@@ -457,7 +471,7 @@ make validate-harness
 - 默认 Workflow 提供 model-led、证据边界内的符合性，不提供声明范围零漂移证明或机器完成权威；未验证和外部待确认范围必须显式保留。
 - bounded Context keyword search 仍可能漏掉同义词或间接依赖，只能补充语义判断。
 - Harness 不能切换 host 选择的模型，只能在第一次 Authority Lock 后要求一次用户选择。
-- Tiny Context 不提供并行 mutation/delegation runtime；平台 Goal 可使用自身 opaque implementation delegation，但 Harness 不持久化它，也不把它当证据。
+- Tiny Context 不提供并行 mutation/delegation runtime；package-managed Skill 的有界谓词成立时，平台 Goal 必须实际调用多个精确 `long_task_implementation`，但 Harness 不负责分配或持久化这些行为，也不把它们当证据。
 - 它不观测平台 token 或模型调用数。
 - Network policy 会约束传给 runner 的代理环境。准入的 direct-process 路径还会运行冻结 runtime-closure 副本并监视/清理进程树，但两者都不是 OS 安全 sandbox，也不能证明恶意代码无法访问环境中的文件系统、网络或进程资源。
 - 同用户/管理员文件篡改、系统级 Hook 绕过不在安全边界内。

package/assets/agents/AGENTS_CORE.md

@@ -63,11 +63,11 @@ Route by required assurance, not task size. Select Long-Task when stable machine
 
 The loaded Skill and its progressive references own Source/Contract authoring, Control/applicability closure, selected-design projection, evidence design, protected revision, rolling repair and lifecycle commands. Do not duplicate those low-frequency rules in this startup router. During Draft/proof/lifecycle work, read the applicable Skill reference and use `ty-context long-task help` for CLI syntax.
 
-After the first Authority Lock, `execution_model_checkpoint.required: true` is an unconditional terminal-turn boundary. Stop before product implementation, edits, builds or tests even when an earlier message stated a model strategy. Tell a Chinese-speaking user exactly `处理好模型更换之后，请发送【继续】。`; use `After handling the model change, send [continue].` in English. Harness cannot observe or verify the host model change; later revisions do not repeat the pause and no acknowledgement, model route or checkpoint state is recorded.
+After the first Authority Lock, `execution_model_checkpoint.required: true` is an unconditional terminal-turn boundary. Stop before product implementation, edits, builds or tests even when an earlier message stated a model strategy. Tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; use `After handling the model change, reply exactly: model checkpoint cleared, continue` in English. A generic continuation does not satisfy the package-managed prompt protocol. Harness cannot observe the next host message or verify the host model change; later revisions do not repeat the pause and no acknowledgement, model route or checkpoint state is recorded.
 
 Long-Task Final Gate is the sole `Engineering Quality Conformance`, `Architecture Conformance` and selected-design closure owner. It source-recompiles and reruns every declared Check on one current snapshot; targeted Progress, prose, historical tests, Receipts, compiled cache or Agent judgment never create acceptance. It proves the declared falsifiable project-check-bound invariants, not overall code quality. Exactly fresh `machine_accepted` with no pending External Confirmation is the complete declared-machine terminal; qualified/external-pending results never complete the platform-native Goal.
 
-The `F = Implementation Freedom Boundary` keeps implementation order, methods and local feedback cadence Goal-owned within Source/Contract, architecture, safety, forbidden-shortcut and external-action boundaries. After the checkpoint, follow the loaded Skill's parent-owned Delegation Suitability policy for optional fixed-profile workers. Harness creates no development method Gate, per-edit mandate, fixed agent allocation, scheduler/delegation state or proof from delegated reports; all proof-bearing output converges into the selected verification workspace.
+The `F = Implementation Freedom Boundary` keeps implementation order, methods, local feedback cadence, concrete packet decomposition and dynamic worker count Goal-owned within Source/Contract, architecture, safety, forbidden-shortcut and external-action boundaries. After the checkpoint, follow the loaded Skill's packet-first positive-default policy: a qualifying packet set requires actual calls for multiple exact fixed-profile workers; zero-start and partial-delegation outcomes use its admitted reason and integration rules. Harness creates no development method Gate, per-edit mandate, fixed agent allocation, scheduler/delegation state or proof from delegated reports; all proof-bearing output converges into the selected verification workspace.
 
 Long-Task Anti-Degradation Assurance requires mechanism changes to preserve or strengthen coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before total-cost ROI matters. Admission targets evidenced high ROI and high efficiency with a significant stable margin, not a global/local optimum; the complete formal cost theorem is unchanged and `observed_lifecycle_*` facts have no admission meaning. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or significant additional-benefit evidence appears. Replacing the controlling purpose requires an explicit project-owner design-purpose decision plus replacement proof.
 

package/assets/agents/long-task-implementation.toml

@@ -1,6 +1,6 @@
 # ty-context:managed:long-task-implementation-worker
 name = "long_task_implementation"
-description = "Optional implementation worker for bounded Long-Task rolling code and repair after the parent Goal satisfies the execution-model checkpoint."
+description = "Package-owned implementation worker for bounded Long-Task rolling code and repair after the parent Goal satisfies the execution-model checkpoint."
 model = "gpt-5.6-luna"
 model_reasoning_effort = "max"
 developer_instructions = """

package/assets/skills/long-task-workflow/SKILL.md

@@ -13,9 +13,9 @@ That Goal is host/user-selected; Harness does not create, persist or reconnect a
 
 The host/user owns model selection. Exactly one unconditional terminal-turn checkpoint follows the first Authority Lock before implementation. Harness neither switches nor verifies the model, persists checkpoint/acknowledgement/route state, nor creates a model scheduler, automatic switch or native-Goal completion state. Do not otherwise pause a healthy Goal solely to change models.
 
-A Codex-root `long-task` install may expose optional fixed package-owned `long_task_implementation` with child multi-agent disabled. It is static, stateless, non-Authority and post-checkpoint—not a checkpoint option, model route or runtime. Install proves no discovery or selection. If unavailable/invalid/colliding or not exactly selectable, the parent implements; never substitute a generic child or add dynamic tiers, retry or scheduling.
+A Codex-root `long-task` install may expose fixed package-owned `long_task_implementation` with child agents disabled. It is static, stateless, non-Authority and post-checkpoint; install proves neither selection nor effective model/reasoning/tier. Profile and spawn never set `service_tier`. Exact-call or capability failure returns a packet to the parent; never infer it, use a generic child, or add tiers/retry/scheduling.
 
-`long-task-delivery-v2` is the only active Contract schema. `delivery-contract.yaml` is the one root authoring file. New authoring uses inline Outcomes; existing `outcome_files` are physical compatibility only. Legacy split-delivery commands are non-executing.
+`long-task-delivery-v2` is the active Contract schema. `delivery-contract.yaml` is the root authoring file. New authoring uses inline Outcomes; existing `outcome_files` are compatibility only. Legacy split-delivery commands are non-executing.
 
 ## Controlling Objective
 
@@ -25,9 +25,11 @@ Complete Source is not a prose or current-code ceiling. Material non-UI meaning
 
 Only fresh evidence from the complete current final snapshot may create machine acceptance. Exactly fresh `machine_accepted` with no pending External Confirmation is `AcceptedDeliveryTerminal`; `machine_accepted_external_pending` proves only declared machine scope. Progress is repair evidence only and never acceptance authority. Final Gate is the sole Long-Task Engineering Quality Conformance and Architecture Conformance carrier, and it proves only the declared, falsifiable, project-check-bound set—not overall code quality. This adds no quality Boolean, matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt, and no separate default Contract Conformance closure runs.
 
-Anti-Degradation Assurance preserves coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before cost. Purpose/invariant replacement requires project-owner design-purpose decision and replacement proof. `F = Implementation Freedom Boundary` keeps order, methods and feedback Goal-owned within Source/Contract, architecture, safety, forbidden shortcuts and external actions. After the checkpoint, one ephemeral Delegation Suitability judgment may use one or more `long_task_implementation` instances only when the host explicitly selects that exact custom agent and independent benefit exceeds coordination cost. Generic/built-in/null/unknown roles, task names, prompt imitation and model-only selection never qualify. If unavailable or an exposed spawned type differs, never rely on/retry a generic child; the parent executes or independently redoes the packet. Prefer read-heavy exploration/entrypoint location, independent diagnosis and log/test analysis, disjoint-path implementation/targeted verification and bounded repetitive work. Parallel writes require disjoint owner/path/source-of-truth scope; shared Contract/Context/configuration and coupled work stays in the parent. Add no development phase/method Gate, fixed count/Outcome mapping, agent allocator/scheduler, retry, queue, DAG, registry, delegation proof or persistent delegation state.
+Anti-Degradation Assurance protects coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before cost. Purpose replacement requires a project-owner design-purpose decision and replacement proof. `F = Implementation Freedom Boundary` leaves methods, feedback, packet decomposition and dynamic count Goal-owned within Source/Contract/safety. After the checkpoint, identify packets before profile/capacity. Each is `independently_safe`, has `positive_expected_parallel_benefit` and `bounded_input_and_output`, is `parent_integratable`, and the set is pairwise `owner_disjoint`, `path_disjoint` and `source_of_truth_disjoint`. Unless explicit user/host policy prohibits agents, make actual host calls for multiple exact workers with `agent_type: long_task_implementation`; intent is not delegation and only call or explicit capability results establish profile/capacity. Count stays dynamic.
 
-Each worker receives only its bounded packet. It may inspect named Source/Contract/Context and implement/check locally, but never author/revise Source, Contract, Authority or Context; create Progress/Evidence/Receipt/Final Gate; run lifecycle commands; choose models; spawn/retry/schedule; create branches/worktrees; or claim acceptance/completion. Active `PreToolUse` denies non-exact creation; exact `SubagentStart` reinforces it without proving trust or acceptance. The parent reviews and integrates every report (advisory only), resolves overlaps, writes Context and runs current-candidate/formal verification.
+Select one zero-start reason by the Workflow Contract's ordered first-match rule: policy prohibition -> insufficient base candidates -> disjointness conflict -> coordination cost -> actual exact-spawn capacity failure -> other exact-worker unavailability. Unknown capacity is not insufficiency. Once any exact worker starts, later profile/capacity failure is partial delegation rather than a parent-only reason: keep that worker, return the rest to the parent and report the cause; use no generic substitute or retry. A type mismatch returns its packet. Never override `service_tier` or claim unobservable inheritance. Add no development phase/method Gate, fixed count/Outcome mapping, allocator/scheduler, queue/DAG/registry/proof or persistent delegation state.
+
+Each worker gets one self-contained packet containing its goal, allowed owners and paths, forbidden paths, relevant Source, Contract and Context references, implementation entrypoints, checks, expected return format and known dependency/integration risk. Before dispatch, the parent reads `git status --short` and `git diff --name-only` non-persistently. Workers only implement/check; truth, Authority, spawning, worktrees and acceptance remain parent-owned. `PreToolUse` denies non-exact creation and freshly checks visible profile parity; `SubagentStart` reinforces type without proving trust, effective execution or load atomicity. After return, the parent inspects the actual diff and integrates results only after comparing actual changed paths and the final working-tree diff with the union of packet envelopes. This proves path-envelope conformance, not per-line actor attribution; unexplained/overlapping/out-of-envelope/shared-owner changes block integration and Final Gate.
 
 ## Progressive Reference Loading
 
@@ -53,14 +55,14 @@ A Draft Outcome is an Outcome before Authority Lock, not a new schema field or r
 1. Read the request, real Source, relevant Context, repository owners and selected design resources. Before formal Compile and the first implementation edit, surface one repository-bound `Architecture Deliberation`: owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, future-change challenge, debt disposition, forbidden shortcuts, project-owned Checks and triggered quality attributes or concrete preservation. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields. Decide `Context Delta: none|required`.
 2. Open the one Contract Draft immediately. When inputs need Source repair, read Source authoring and Contract authoring together; preserve at least one real `source_path`, complete all required semantic/design closure and repair every `decision_required` item without inventing product meaning.
 3. Run read-only `ty-context long-task preflight <workdir>`, repair the same Draft, then run formal Compile only when Source, Context, Contract, repository scope and proof bindings are ready. Compile creates the first Authority Lock; Preflight creates no Authority, Progress, Receipt or state.
-4. When the first Compile returns `execution_model_checkpoint.required: true`, always obey its terminal-turn boundary. Do no product implementation, file edit, build or test after that result, regardless of any earlier textual model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换之后，请发送【继续】。`; use `After handling the model change, send [continue].` in English. Harness cannot observe or verify the model change. A later Compile returns `required: false` and never repeats the pause.
-5. After continuation, apply the Delegation Suitability judgment above and begin Goal-owned rolling implementation. Delegate independent bounded packets only through explicit exact `long_task_implementation`; otherwise the parent executes without a generic substitute or retry. Keep non-independent work in the parent. Re-evaluate Context Delta and Architecture Deliberation when durable facts, scope, ownership, dependency direction, selected design, quality applicability or debt disposition materially changes.
+4. On the first Compile result with `execution_model_checkpoint.required: true`, do no product implementation, edit, build or test; end the turn. Tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; in English use `After handling the model change, reply exactly: model checkpoint cleared, continue`. Generic continuation does not satisfy this managed prompt protocol. Harness observes neither the next host message nor the model change, so this is no machine unlock or attestation. Later Compile returns `required: false` without repeating the pause.
+5. After continuation, begin Goal-owned rolling implementation and apply Delegation Suitability above. Qualifying work gets actual multiple exact `long_task_implementation` calls; otherwise record one admitted solo reason. Keep coupled work in the parent. Refresh Context Delta and Architecture Deliberation when durable scope, ownership, dependency, design, quality or debt changes.
 6. Use targeted verification only when its expected localization value exceeds cost. If authority changes, keep the same Draft and follow protected revision; mechanically bounded repairs may auto-adopt, while semantic weakening or unknown change requires the exact user decision. Adoption returns to rolling implementation and is never completion.
 7. Complete Context, implementation and project tests, create the clean candidate required by the lifecycle reference, then run the one source-recompiled current-snapshot Final Gate. Stop/close and any native Goal completion remain subject to the exact lifecycle and veto rules in the Authority reference.
 
 ## Rolling Execution
 
-After Authority Lock and the one-time terminal-turn checkpoint, the parent Goal chooses implementation order, local planning, tools and repair hypotheses, then applies the bounded independence/benefit/coordination test above. Qualifying disjoint packets should be delegated proactively; a packet may cross Outcome or Stage boundaries when its code owner remains coherent, because those boundaries control acceptance readiness rather than edit permission. The profile is optional and can be absent. The parent retains every authority, architecture, Context, integration and formal-verification owner. Delegated reports are advisory, Harness stores no delegation state and all proof-bearing changes converge into the selected verification workspace.
+Apply packet-first above. Outcomes/Stages govern acceptance, not edits; coherent-owner packets may cross them. Parent retains Authority, packet selection, Context, integration and verification; proof-bearing changes converge into the selected verification workspace.
 
 The derived Frontier is only an acceptance/verification and diagnosis projection. Use `verify --explain [--outcome/--check]` for a read-only cost preview and targeted `verify --outcome/--check` for optional feedback. `progress_stale` is a freshness fact; refresh only before an intermediate decision relies on that Progress. Continuing implementation and entering Final Gate need no targeted refresh because Final Gate ignores Progress and reruns all required Checks. Do not add another model-switch pause, trigger queue, implementation gate, per-edit rebuild rule or per-platform progress state.
 

package/assets/skills/long-task-workflow/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "Long-Task Workflow"
   short_description: "Run one Delivery Contract in the current native Goal"
-  default_prompt: "Use $long-task-workflow for one Canonical Delivery Contract. After the first-Authority-Lock checkpoint, proactively delegate independent bounded packets only to the exact custom agent long_task_implementation, using multiple instances for disjoint workstreams when beneficial. If the host cannot explicitly select that custom agent, do not spawn a generic substitute; execute in the parent. Keep Source, Contract, Authority, Context, integration and formal verification in the parent Goal."
+  default_prompt: "Use $long-task-workflow for one Canonical Delivery Contract. After the first-Authority-Lock checkpoint, identify qualifying bounded packets before profile/capacity; absent an explicit policy prohibition, make actual calls for multiple exact long_task_implementation workers and let host results determine zero-start or partial fallback. Never infer unavailability, use a generic substitute or fix the count. Keep Source, Contract, Authority, architecture, Context, packet selection, integration and formal verification in the parent Goal."
 policy:
   allow_implicit_invocation: false

package/assets/skills/long-task-workflow/references/authority-lifecycle.md

@@ -14,7 +14,7 @@ Preflight keeps every independently discovered diagnostic. When a structural dup
 
 The first successful `ty-context long-task compile <workdir>` is Authority Lock and freezes the immutable initial base and complete compiled authority snapshot in Git common-dir, bound to the worktree marker by task id, revision and compiled identity.
 
-Its JSON result includes `execution_model_checkpoint.required: true`, `action: change_model_in_host_then_continue`, `resume_token: continue`, `turn_boundary: end_current_turn`, the blocked implementation actions and explicit model non-observability. Always do no product implementation, file edit, build or test after that result, even when an earlier message stated a model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换之后，请发送【继续】。`; use `After handling the model change, send [continue].` in English. Harness cannot observe or verify the host model change, and the continuation is not an acknowledgement record. Later Compile revisions return `required: false`; no checkpoint file, acknowledgement state, model route or automatic model switch is created.
+Its JSON result includes `execution_model_checkpoint.required: true`, `action: change_model_in_host_then_continue`, `resume_token: model checkpoint cleared, continue`, `generic_continue_satisfies: false`, `turn_boundary: end_current_turn`, the blocked implementation actions and explicit model non-observability. Always do no product implementation, file edit, build or test after that result, even when an earlier message stated a model strategy. End the turn and tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; use `After handling the model change, reply exactly: model checkpoint cleared, continue` in English. Do not accept a generic continuation under this package-managed prompt protocol. Harness cannot observe the next host message or verify the host model change, and the continuation is neither a machine-enforced unlock nor an acknowledgement record. Later Compile revisions return `required: false`; no checkpoint file, acknowledgement state, model route or automatic model switch is created.
 
 The optional Codex `long_task_implementation` custom agent is available only as a post-checkpoint rolling implementation affordance. Its fixed package-owned configuration is not a checkpoint option and cannot acknowledge, satisfy or replace the host boundary. It writes no workflow state and owns no Source, Contract, Authority, Context writeback, Progress, Evidence, Receipt or Final Gate; if the exact profile selector or Codex custom-agent support is unavailable, the parent Goal continues directly without a generic substitute and formal acceptance is unchanged. The main Skill owns the complete Delegation Suitability and parent/worker policy.
 

package/dist/commands/long-task-revision.js

@@ -90,7 +90,7 @@ function printCompileResult(compiled, previous, preserveProgress, revisionPropos
             ? projectAuthorityRevisionDecision(revisionProposal)
             : null,
         next_action: firstAuthorityLock
-            ? "End this turn now. Do not implement, edit files, build, or test. After the user handles the model change in the host, wait for [continue]. Harness cannot observe or verify the model change."
+            ? "End this turn now. Do not implement, edit files, build, or test. After the user handles the model change in the host, ask them to reply exactly: model checkpoint cleared, continue. This is package-managed prompt guidance; Harness cannot observe the next host message or verify the model change."
             : authorityChanged
                 ? "Run status or resume, then continue rolling implementation or repair under the adopted Authority Revision."
                 : "Continue rolling implementation or repair under the active Authority.",
@@ -158,7 +158,7 @@ function executionModelCheckpoint(firstAuthorityLock) {
         required: true,
         phase: "post_authority_lock_pre_implementation",
         action: "change_model_in_host_then_continue",
-        resume_token: "continue",
+        resume_token: "model checkpoint cleared, continue",
         turn_boundary: "end_current_turn",
         blocked_until_resume: [
             "product_implementation",
@@ -168,8 +168,8 @@ function executionModelCheckpoint(firstAuthorityLock) {
         ],
         model_change_owner: "host_or_user",
         model_change_observable_by_harness: false,
-        generic_continue_satisfies: true,
-        message: "Authority Lock created. End the current turn before product implementation, file edits, builds, or tests. After handling the model change, send [continue]. Harness cannot observe or verify the model change.",
+        generic_continue_satisfies: false,
+        message: "Authority Lock created. End the current turn before product implementation, file edits, builds, or tests. After handling the model change, reply exactly: model checkpoint cleared, continue. This is package-managed prompt guidance; Harness cannot observe the next host message or verify the model change.",
     };
 }
 function message(error) {

package/dist/lib/long-task-authority-revision-brief.js

@@ -15,7 +15,9 @@ export function buildAuthorityRevisionDecisionBrief(summary, changeClass, approv
     addCategory(summary.source_or_claims_changed, "Source/Claims", detail("Source or Claim authority changed", summary.source_claim_changes));
     addCategory(summary.context_authority_changed, "Context authority", "Controlling Context authority changed.");
     addCategory(summary.acceptance_or_proof_weakened, "acceptance/proof", detail("Acceptance or proof was reduced", summary.proof_reductions));
-    addCategory(summary.verifier_or_runner_changed, "verifier/runner", "Verifier or runner authority changed.");
+    addCategory(summary.verifier_or_runner_changed, "verifier/runner", summary.verifier_content_changed
+        ? detail("Verifier content changed; prior evidence is invalid and semantic preservation is not independently established", summary.verifier_files_changed)
+        : "Verifier or runner authority changed.");
     addCategory(summary.write_scope_expanded, "write scope", detail("Owner or allowed write scope expanded", uniqueSorted([
         ...summary.expanded_owner_paths,
         ...summary.expanded_expected_change_paths,

package/dist/lib/long-task-authority-revision-summary.js

@@ -59,7 +59,6 @@ const PROOF_REDUCTION_REASONS = new Set([
     "rollback_or_recovery_weakened",
     "counterfactual_removed",
     "population_weakened",
-    "verifier_content_changed",
     "acceptance_not_monotonic",
 ]);
 export function classifyAuthorityRevision(diff) {
@@ -136,6 +135,8 @@ export function summarizeAuthorityRevision(diff, outcomeKeys) {
         verifier_or_runner_changed: diff.verifier_content_changed ||
             diff.verifier_runtime_locator_changed ||
             diff.runner_definitions_changed.length > 0,
+        verifier_content_changed: diff.verifier_content_changed,
+        verifier_files_changed: uniqueSorted(diff.verifier_files_changed),
         write_scope_expanded: diff.owner_or_path_boundary_changed,
         risk_changed: diff.risk_changed,
         external_confirmations_changed: diff.external_confirmations_changed,
@@ -184,13 +185,16 @@ export function projectAuthorityRevisionDecision(value) {
         ? {
             ...computedSummary,
             ...storedSummary,
+            acceptance_or_proof_weakened: computedSummary.acceptance_or_proof_weakened,
+            verifier_content_changed: computedSummary.verifier_content_changed,
+            verifier_files_changed: computedSummary.verifier_files_changed,
             semantic_fields_changed: storedSummary.semantic_fields_changed ??
                 computedSummary.semantic_fields_changed,
             source_claim_changes: storedSummary.source_claim_changes ??
                 computedSummary.source_claim_changes,
             product_claim_changes: storedSummary.product_claim_changes ??
                 computedSummary.product_claim_changes,
-            proof_reductions: storedSummary.proof_reductions ?? computedSummary.proof_reductions,
+            proof_reductions: computedSummary.proof_reductions,
             external_confirmation_changes: storedSummary.external_confirmation_changes ??
                 computedSummary.external_confirmation_changes,
             user_decision_reasons: storedSummary.user_decision_reasons ??

package/dist/lib/long-task-authority-revision-types.d.ts

@@ -7,6 +7,8 @@ export interface AuthorityRevisionApprovalSummaryV2 {
     context_authority_changed: boolean;
     acceptance_or_proof_weakened: boolean;
     verifier_or_runner_changed: boolean;
+    verifier_content_changed: boolean;
+    verifier_files_changed: string[];
     write_scope_expanded: boolean;
     risk_changed: boolean;
     external_confirmations_changed: boolean;

package/dist/lib/long-task-design-resource-method-binding.js

@@ -49,6 +49,7 @@ export function validateSymbolicVerificationMethodBindings(contract, contractTar
         const assertion = check.positive_assertions.find((item) => item.key === binding.assertion_ref);
         if (!assertion)
             invalid("v2_verification_method_assertion_unknown", `${target.key}:${binding.method}:${binding.assertion_ref}`);
+        const assertedClaims = claimsAssertedByRootOrMethod(target, check, assertion.claims);
         for (const capability of requiredCapabilities(binding.method))
             if (!assertion.evidence_capabilities.includes(capability))
                 invalid("v2_verification_method_capability_required", `${target.key}:${binding.method}:${capability}`);
@@ -60,7 +61,7 @@ export function validateSymbolicVerificationMethodBindings(contract, contractTar
             const rule = preflight.manifest.fact_rules.find((item) => item.key === expectation.fact_rule_ref);
             for (const sourceItemRef of rule.source_item_refs)
                 for (const claimRef of claimsBySourceItem.get(sourceItemRef) ?? [])
-                    if (!assertion.claims.includes(claimRef))
+                    if (!assertedClaims.has(claimRef))
                         invalid("v2_verification_method_claim_not_asserted", `${target.key}:${binding.method}:${sourceItemRef}:${claimRef}`);
             boundObligationRefs.push(expectation.obligation_ref);
         }
@@ -145,12 +146,13 @@ export function validateVerificationMethodBindings(target, check, facts, proofs,
         const assertion = check.positive_assertions.find((item) => item.key === binding.assertion_ref);
         if (!assertion)
             invalid("verification_method_assertion_unknown", `${target.key}:${binding.method}:${binding.assertion_ref}`);
+        const assertedClaims = claimsAssertedByRootOrMethod(target, check, assertion.claims);
         const sourceItems = new Set(facts
             .filter((fact) => proofs.some((proof) => proof.fact_ref === fact.key && proof.method === binding.method))
             .flatMap((fact) => fact.source_item_refs));
         for (const sourceItemRef of sourceItems)
             for (const claimRef of claimsBySourceItem.get(sourceItemRef) ?? [])
-                if (!assertion.claims.includes(claimRef))
+                if (!assertedClaims.has(claimRef))
                     invalid("verification_method_claim_not_asserted", `${target.key}:${binding.method}:${sourceItemRef}:${claimRef}`);
         for (const capability of requiredCapabilities(binding.method))
             if (!assertion.evidence_capabilities.includes(capability))
@@ -173,6 +175,10 @@ export function validateVerificationMethodBindings(target, check, facts, proofs,
     }
     assertSameSet(boundFactRefs, facts.map((fact) => fact.key), "design_method_fact_refs_mismatch", target.key);
 }
+function claimsAssertedByRootOrMethod(target, check, methodClaims) {
+    const rootAssertion = check.positive_assertions.find((item) => item.key === target.conformance_assertion_ref);
+    return new Set([...(rootAssertion?.claims ?? []), ...methodClaims]);
+}
 function designFactExpectation(indexed, factRef, proofRef) {
     const handoff = indexed.preflight.handoff;
     const fact = handoff.facts.find((item) => item.key === factRef);

package/dist/lib/long-task-git.d.ts

@@ -0,0 +1,26 @@
+export declare class GitCommandError extends Error {
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly stdoutBytes: number;
+    readonly stderrBytes: number;
+    constructor(exitCode: number | null, signal: NodeJS.Signals | null, argv: string[], stdout: Buffer, stderr: Buffer);
+}
+export declare function repositoryRoot(start: string): Promise<string>;
+export declare function gitCommonDir(root: string): Promise<string>;
+export declare function currentGitState(root: string): Promise<{
+    head: string;
+    tree: string;
+    dirty: string[];
+}>;
+export declare function currentGitTree(root: string): Promise<string>;
+export declare function gitPath(root: string, pathSpec: string): Promise<string>;
+export declare function gitConfigGet(root: string, name: string): Promise<string | null>;
+export declare function gitEffectiveConfigGet(root: string, name: string): Promise<string | null>;
+export declare function gitConfigSet(root: string, name: string, value: string): Promise<void>;
+export declare function gitConfigUnset(root: string, name: string): Promise<void>;
+export declare function repoRelative(rootInput: string, fileInput: string): string;
+export declare function gitOutput(root: string, argv: string[]): Promise<string>;
+export declare function gitVoid(root: string, argv: string[]): Promise<void>;
+export declare function gitBuffer(root: string, argv: string[]): Promise<Buffer>;
+export declare function gitBufferInput(root: string, argv: string[], input?: Buffer): Promise<Buffer>;
+export declare function splitGitZero(value: Buffer): string[];

package/dist/lib/long-task-git.js

@@ -0,0 +1,130 @@
+import { spawn } from "node:child_process";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+export class GitCommandError extends Error {
+    exitCode;
+    signal;
+    stdoutBytes;
+    stderrBytes;
+    constructor(exitCode, signal, argv, stdout, stderr) {
+        const stderrText = stderr.toString("utf8").trim();
+        super(`git_exit:${exitCode ?? "null"}:${argv.join(" ")}:signal=${signal ?? "none"}:stdout_bytes=${stdout.length}:stderr=${stderrText}`);
+        this.name = "GitCommandError";
+        this.exitCode = exitCode;
+        this.signal = signal;
+        this.stdoutBytes = stdout.length;
+        this.stderrBytes = stderr.length;
+    }
+}
+export async function repositoryRoot(start) {
+    const resolved = path.resolve(start);
+    const gitEntry = await stat(path.join(resolved, ".git")).catch(() => null);
+    if (gitEntry?.isDirectory() || gitEntry?.isFile())
+        return resolved;
+    return path.resolve(await gitOutput(resolved, ["rev-parse", "--show-toplevel"]));
+}
+export async function gitCommonDir(root) {
+    return path.resolve(await gitOutput(root, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-common-dir",
+    ]));
+}
+export async function currentGitState(root) {
+    const [head, tree, raw] = await Promise.all([
+        gitOutput(root, ["rev-parse", "HEAD"]),
+        gitOutput(root, ["rev-parse", "HEAD^{tree}"]),
+        gitOutput(root, ["status", "--short", "--untracked-files=all"]),
+    ]);
+    return {
+        head,
+        tree,
+        dirty: raw ? raw.split(/\r?\n/u).filter(Boolean) : [],
+    };
+}
+export async function currentGitTree(root) {
+    return gitOutput(root, ["rev-parse", "HEAD^{tree}"]);
+}
+export async function gitPath(root, pathSpec) {
+    return path.resolve(await gitOutput(root, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-path",
+        pathSpec,
+    ]));
+}
+export async function gitConfigGet(root, name) {
+    try {
+        return await gitOutput(root, ["config", "--local", "--get", name]);
+    }
+    catch (error) {
+        if (error instanceof GitCommandError && error.exitCode === 1)
+            return null;
+        throw error;
+    }
+}
+export async function gitEffectiveConfigGet(root, name) {
+    try {
+        return await gitOutput(root, ["config", "--get", name]);
+    }
+    catch (error) {
+        if (error instanceof GitCommandError && error.exitCode === 1)
+            return null;
+        throw error;
+    }
+}
+export async function gitConfigSet(root, name, value) {
+    await gitVoid(root, ["config", "--local", name, value]);
+}
+export async function gitConfigUnset(root, name) {
+    try {
+        await gitVoid(root, ["config", "--local", "--unset-all", name]);
+    }
+    catch (error) {
+        if (!(error instanceof GitCommandError) || error.exitCode !== 5)
+            throw error;
+    }
+}
+export function repoRelative(rootInput, fileInput) {
+    const value = path
+        .relative(path.resolve(rootInput), path.resolve(fileInput))
+        .replace(/\\/gu, "/");
+    if (value.startsWith("../") || path.isAbsolute(value))
+        throw new Error(`path_outside_repository:${fileInput}`);
+    return value;
+}
+export async function gitOutput(root, argv) {
+    return (await gitBuffer(root, argv)).toString("utf8").trim();
+}
+export async function gitVoid(root, argv) {
+    await gitBuffer(root, argv);
+}
+export async function gitBuffer(root, argv) {
+    return gitBufferInput(root, argv);
+}
+export async function gitBufferInput(root, argv, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", argv, {
+            cwd: root,
+            shell: false,
+            windowsHide: true,
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", reject);
+        child.stdin.end(input);
+        child.on("close", (code, signal) => {
+            const stdoutBytes = Buffer.concat(stdout);
+            const stderrBytes = Buffer.concat(stderr);
+            if (code === 0)
+                resolve(stdoutBytes);
+            else
+                reject(new GitCommandError(code, signal, argv, stdoutBytes, stderrBytes));
+        });
+    });
+}
+export function splitGitZero(value) {
+    return value.toString("utf8").split("\0").filter(Boolean);
+}