project-tiny-context-harness 0.8.16 → 0.11.0

package/assets/runtime/windows-job-supervisor/formal_process_supervisor_native_types.cs

@@ -0,0 +1,215 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public sealed class FormalProcessSupervisorResult
+{
+    public string RequestId { get; set; }
+    public int ProcessId { get; set; }
+    public int ExitCode { get; set; }
+    public bool TimedOut { get; set; }
+    public bool OutputOverflow { get; set; }
+    public bool DescendantsCleaned { get; set; }
+    public long StdoutBytes { get; set; }
+    public long StderrBytes { get; set; }
+    public long StartedUnixMs { get; set; }
+    public long CompletedUnixMs { get; set; }
+    public string MonotonicStartedNs { get; set; }
+    public string MonotonicCompletedNs { get; set; }
+    public string MonotonicClockId { get; set; }
+    public string WallClockId { get; set; }
+    public long UserCpu100Ns { get; set; }
+    public long KernelCpu100Ns { get; set; }
+    public long TotalCpu100Ns { get; set; }
+    public uint TotalProcesses { get; set; }
+    public uint ActiveProcessesAtResult { get; set; }
+    public uint TotalTerminatedProcesses { get; set; }
+    public string AccountingSourceKind { get; set; }
+    public string Error { get; set; }
+}
+
+public static partial class FormalProcessSupervisor
+{
+    private const uint CREATE_SUSPENDED = 0x00000004;
+    private const uint CREATE_NO_WINDOW = 0x08000000;
+    private const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
+    private const uint STARTF_USESTDHANDLES = 0x00000100;
+    private const uint HANDLE_FLAG_INHERIT = 0x00000001;
+    private const uint JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000;
+    private const int JobObjectBasicAccountingInformation = 1;
+    private const int JobObjectExtendedLimitInformation = 9;
+    private const uint STILL_ACTIVE = 259;
+    private const int CleanupWaitMilliseconds = 5000;
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct SECURITY_ATTRIBUTES
+    {
+        public int nLength;
+        public IntPtr lpSecurityDescriptor;
+        [MarshalAs(UnmanagedType.Bool)] public bool bInheritHandle;
+    }
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct STARTUPINFO
+    {
+        public int cb;
+        public string lpReserved;
+        public string lpDesktop;
+        public string lpTitle;
+        public uint dwX;
+        public uint dwY;
+        public uint dwXSize;
+        public uint dwYSize;
+        public uint dwXCountChars;
+        public uint dwYCountChars;
+        public uint dwFillAttribute;
+        public uint dwFlags;
+        public short wShowWindow;
+        public short cbReserved2;
+        public IntPtr lpReserved2;
+        public IntPtr hStdInput;
+        public IntPtr hStdOutput;
+        public IntPtr hStdError;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct PROCESS_INFORMATION
+    {
+        public IntPtr hProcess;
+        public IntPtr hThread;
+        public uint dwProcessId;
+        public uint dwThreadId;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct JOBOBJECT_BASIC_LIMIT_INFORMATION
+    {
+        public long PerProcessUserTimeLimit;
+        public long PerJobUserTimeLimit;
+        public uint LimitFlags;
+        public UIntPtr MinimumWorkingSetSize;
+        public UIntPtr MaximumWorkingSetSize;
+        public uint ActiveProcessLimit;
+        public UIntPtr Affinity;
+        public uint PriorityClass;
+        public uint SchedulingClass;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct IO_COUNTERS
+    {
+        public ulong ReadOperationCount;
+        public ulong WriteOperationCount;
+        public ulong OtherOperationCount;
+        public ulong ReadTransferCount;
+        public ulong WriteTransferCount;
+        public ulong OtherTransferCount;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION
+    {
+        public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
+        public IO_COUNTERS IoInfo;
+        public UIntPtr ProcessMemoryLimit;
+        public UIntPtr JobMemoryLimit;
+        public UIntPtr PeakProcessMemoryUsed;
+        public UIntPtr PeakJobMemoryUsed;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
+    {
+        public long TotalUserTime;
+        public long TotalKernelTime;
+        public long ThisPeriodTotalUserTime;
+        public long ThisPeriodTotalKernelTime;
+        public uint TotalPageFaultCount;
+        public uint TotalProcesses;
+        public uint ActiveProcesses;
+        public uint TotalTerminatedProcesses;
+    }
+
+    private sealed class CaptureState
+    {
+        public long CombinedBytes;
+        public int Overflow;
+        public long Limit;
+        public IntPtr Job;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern IntPtr CreateJobObject(IntPtr attributes, string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetInformationJobObject(
+        IntPtr job,
+        int informationClass,
+        ref JOBOBJECT_EXTENDED_LIMIT_INFORMATION information,
+        uint informationLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool QueryInformationJobObject(
+        IntPtr job,
+        int informationClass,
+        out JOBOBJECT_BASIC_ACCOUNTING_INFORMATION information,
+        uint informationLength,
+        IntPtr returnLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool TerminateJobObject(IntPtr job, uint exitCode);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CreatePipe(
+        out IntPtr readPipe,
+        out IntPtr writePipe,
+        ref SECURITY_ATTRIBUTES attributes,
+        uint size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetHandleInformation(
+        IntPtr handle,
+        uint mask,
+        uint flags);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CreateProcessW(
+        string applicationName,
+        StringBuilder commandLine,
+        IntPtr processAttributes,
+        IntPtr threadAttributes,
+        [MarshalAs(UnmanagedType.Bool)] bool inheritHandles,
+        uint creationFlags,
+        IntPtr environment,
+        string currentDirectory,
+        ref STARTUPINFO startupInfo,
+        out PROCESS_INFORMATION processInformation);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern uint ResumeThread(IntPtr thread);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetExitCodeProcess(IntPtr process, out uint exitCode);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool TerminateProcess(IntPtr process, uint exitCode);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CloseHandle(IntPtr handle);
+}

package/assets/runtime/windows-job-supervisor/windows_job_process_supervisor.ps1

@@ -0,0 +1,117 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$utf8 = New-Object System.Text.UTF8Encoding($false)
+[Console]::InputEncoding = $utf8
+[Console]::OutputEncoding = $utf8
+
+if ([System.Environment]::OSVersion.Platform -ne [System.PlatformID]::Win32NT) {
+    throw 'formal_process_supervisor_platform_unsupported'
+}
+
+$nativeSources = @(
+    Join-Path $PSScriptRoot 'formal_process_supervisor_native_types.cs'
+    Join-Path $PSScriptRoot 'formal_process_supervisor_native_run.cs'
+    Join-Path $PSScriptRoot 'formal_process_supervisor_native_helpers.cs'
+)
+Add-Type -Path $nativeSources
+
+function Get-ExactProperty {
+    param(
+        [Parameter(Mandatory = $true)] [object] $Object,
+        [Parameter(Mandatory = $true)] [string] $Name
+    )
+    $matches = @($Object.PSObject.Properties | Where-Object { $_.Name -ceq $Name })
+    if ($matches.Count -ne 1) { throw 'formal_process_supervisor_request_shape' }
+    return $matches[0]
+}
+
+while (($line = [Console]::In.ReadLine()) -ne $null) {
+    if ([string]::IsNullOrWhiteSpace($line)) { continue }
+    $request = $null
+    $requestId = $null
+    $requestStage = 'json'
+    try {
+        [FormalProcessSupervisor]::AssertUniqueJsonObjectKeys($line)
+        $request = $line | ConvertFrom-Json
+        if ($null -eq $request -or $request -is [System.Array] -or $request -is [string]) {
+            throw 'formal_process_supervisor_request_shape'
+        }
+        $expected = @('schema_version', 'request_id', 'executable', 'argv', 'cwd', 'stdout_path', 'stderr_path', 'timeout_ms', 'combined_output_limit_bytes', 'environment')
+        $actual = @($request.PSObject.Properties | ForEach-Object { $_.Name } | Sort-Object)
+        $requestStage = 'fields'
+        if (@(Compare-Object ($expected | Sort-Object) $actual -CaseSensitive).Count -ne 0) {
+            throw 'formal_process_supervisor_request_shape'
+        }
+        $requestStage = 'properties'
+        $schemaVersion = (Get-ExactProperty $request 'schema_version').Value
+        $requestId = (Get-ExactProperty $request 'request_id').Value
+        $executable = (Get-ExactProperty $request 'executable').Value
+        $argv = (Get-ExactProperty $request 'argv').Value
+        $cwd = (Get-ExactProperty $request 'cwd').Value
+        $stdoutPath = (Get-ExactProperty $request 'stdout_path').Value
+        $stderrPath = (Get-ExactProperty $request 'stderr_path').Value
+        $timeoutMs = (Get-ExactProperty $request 'timeout_ms').Value
+        $combinedOutputLimit = (Get-ExactProperty $request 'combined_output_limit_bytes').Value
+        $environmentObject = (Get-ExactProperty $request 'environment').Value
+        $requestStage = 'values'
+        if ($schemaVersion -isnot [string] -or $schemaVersion -cne 'formal-process-supervisor-request-v1' -or
+            $requestId -isnot [string] -or $executable -isnot [string] -or $cwd -isnot [string] -or
+            $stdoutPath -isnot [string] -or $stderrPath -isnot [string] -or
+            $argv -isnot [System.Array] -or
+            (($timeoutMs -isnot [int]) -and ($timeoutMs -isnot [long])) -or
+            (($combinedOutputLimit -isnot [int]) -and ($combinedOutputLimit -isnot [long])) -or
+            $null -eq $environmentObject -or $environmentObject -is [System.Array] -or $environmentObject -is [string]) {
+            throw 'formal_process_supervisor_request_shape'
+        }
+        foreach ($argument in $argv) {
+            if ($argument -isnot [string]) { throw 'formal_process_supervisor_request_shape' }
+        }
+        $requestStage = 'environment'
+        $seenEnvironment = @{}
+        $environment = @(
+            $environmentObject.PSObject.Properties |
+                Sort-Object Name |
+                ForEach-Object {
+                    $environmentName = [string]$_.Name
+                    if ($seenEnvironment.ContainsKey($environmentName)) {
+                        throw ('formal_process_supervisor_request_shape:environment_duplicate:{0}' -f $environmentName)
+                    }
+                    if ([string]::IsNullOrEmpty($environmentName) -or
+                        $environmentName.IndexOf([char]61) -ge 0 -or
+                        $environmentName.IndexOf([char]0) -ge 0 -or
+                        $environmentName.IndexOf([char]13) -ge 0 -or
+                        $environmentName.IndexOf([char]10) -ge 0) {
+                        throw ('formal_process_supervisor_request_shape:environment_name:{0}' -f $environmentName)
+                    }
+                    if ($_.Value -isnot [string]) {
+                        throw ('formal_process_supervisor_request_shape:environment_value:{0}:{1}' -f $environmentName, $_.Value.GetType().FullName)
+                    }
+                    $seenEnvironment[$environmentName] = $true
+                    '{0}={1}' -f $environmentName, $_.Value
+                }
+        )
+        $requestStage = 'native_run'
+        $result = [FormalProcessSupervisor]::Run(
+            [string]$requestId,
+            [string]$executable,
+            [string[]]$argv,
+            [string]$cwd,
+            [string]$stdoutPath,
+            [string]$stderrPath,
+            [int]$timeoutMs,
+            [long]$combinedOutputLimit,
+            [string[]]$environment
+        )
+        [Console]::Out.WriteLine(($result | ConvertTo-Json -Compress -Depth 8))
+        [Console]::Out.Flush()
+    }
+    catch {
+        $failure = [ordered]@{
+            RequestId = if ($requestId -is [string]) { [string]$requestId } else { $null }
+            Error = '{0}:{1}' -f $requestStage, [string]$_.Exception.Message
+        }
+        [Console]::Out.WriteLine(($failure | ConvertTo-Json -Compress))
+        [Console]::Out.Flush()
+    }
+}

package/assets/skills/context_development_engineer/SKILL.md

@@ -1,65 +1,51 @@
 ---
 name: context_development_engineer
-description: Use when the user explicitly asks for an architecture or engineering design, technical design/plan, complex implementation design, system decomposition, API/data/state/lifecycle design, engineering trade-off, or high-level engineering assessment; or asks for 架构方案, 工程设计, 技术设计, 复杂实现方案, 系统拆分, 接口/数据/状态/生命周期设计, 工程取舍, or 高层工程评估 in a Minimal Context Harness project. Do not trigger for routine coding, bug fixes, small refactors, package/release work, generic requests to implement/build/change code, a generic implementation plan, role-only mentions such as developer/software engineer, or requests merely mentioning multi-agent, subagent, or parallel work.
+description: Use when the user asks for an architecture or engineering design, technical design/plan, complex implementation design, high-level engineering assessment, 架构方案/工程设计/技术设计/复杂实现方案/系统拆分/工程取舍/架构审计, or when the actual task content materially requires owner/source-of-truth, API/schema/data/state/lifecycle, dependency, complex alternatives, concurrency/recovery, external-integration/shared-abstraction, performance, security, compatibility/migration, implementation tradeoff, or architecture-audit judgment. Do not trigger merely for routine coding, local bug fixes, small refactors, tests, documentation, styling, package/release work, generic requests to implement/build/change code, a generic implementation plan, role-only mentions, or mentions of multi-agent, subagent, or parallel work.
 ---
 
 # Context Development Engineer
 
 ## Scope
 
-Add explicit engineering-design and architecture judgment to the repository's default Workflow Contract. This Skill is not the default implementation workflow, a coding persona, a planning artifact, an agent allocator or a verification authority. Routine implementation continues under root `AGENTS.md` without this Skill.
+Add engineering-design and architecture judgment to the default Workflow Contract. This Skill is not the default implementation workflow, a coding persona, planner, agent allocator or verification authority. Routine implementation continues under root `AGENTS.md`.
 
 Project-specific engineering rules belong in `<harnessRoot>/skills/development_engineer/SKILL.md`; the repo-local Skill is more specific, while durable conclusions still belong in `project_context/**`.
 
-When a valid Long-Task binding is active, `long-task-workflow` alone owns Source/Contract lifecycle, selected workspace, Progress, formal verification and Final Gate. This Skill contributes architecture judgment only and creates no second plan, stage, delegation policy/state or acceptance path.
+With a valid Long-Task binding, `long-task-workflow` alone owns its lifecycle and Final Gate. This Skill contributes architecture judgment only and creates no second plan, stage, delegation policy/state or acceptance path.
+
+## Progressive reasoning reference
+
+Read [engineering-design-reasoning.md](references/engineering-design-reasoning.md) completely. Apply only the methods triggered by actual uncertainty and risk; this is not a checklist, artifact schema or required sequence. An explicit-owner task without material design uncertainty stays on the lightweight default path.
 
 ## Engineering-design workflow
 
-1. Read the core/default Context required by `AGENTS.md`, then the owners implicated by the proposed architecture. Before `Context Delta`, run the bounded high-signal Context search already required by the default Workflow; widen only when dependency or semantic ownership demands it.
-2. State the problem, success boundary and non-goals. Separate intended Source/Context requirements from current-code behavior; code cannot silently redefine missing authority.
+1. Read required core/default and implicated-owner Context. Before `Context Delta`, run the default bounded high-signal Context search; widen only for discovered dependency or semantic ownership.
+2. State the problem, success boundary and non-goals. Separate facts, constraints, assumptions and unknowns, and Source/Context requirements from current-code behavior.
 3. Identify the existing source of truth and extension point, affected owners, dependency direction, public/internal interfaces, state and lifecycle, failure/recovery boundaries, compatibility constraints and project-native verification entries.
 4. Compare the smallest material alternatives. Prefer the existing owner/facade/adapter when it carries the stable concept; introduce an abstraction only for an evidenced change axis or durable boundary with positive net value. When foundational machinery, a mature protocol/security boundary, a dependency/shared abstraction or a nearby extension point makes sourcing material, add the risk-triggered Build / Reuse / Buy judgment below.
-5. Surface one externally observable, repository-bound `Architecture Deliberation` before implementation edits. Include the selected design, rejected material alternatives, one plausible future-change challenge, touched technical debt and disposition, forbidden shortcuts, checks and triggered quality attributes or concrete preservation basis.
+5. Before implementation edits, surface one externally observable, repository-bound `Architecture Deliberation`: selected design, rejected material alternatives, one plausible future-change challenge, touched technical debt and disposition, forbidden shortcuts, checks, and triggered quality attributes or preservation basis.
 6. Decide exactly one `Context Delta: none|required`. Durable ownership, architecture, API/schema/data, state/recovery, dependency, compatibility, verification/deployment or rationale changes are `required` and update the smallest owning Context before code. A task-local design that preserves those facts is `none`.
-7. Hand the design to the current Goal for implementation under the existing Workflow Contract. After current-candidate project checks, include Engineering/Architecture Conformance in the default Contract Conformance and run the separate Context drift check. Do not add another gate or proof ledger.
+7. Implement under the current Goal and Workflow Contract. After current-candidate checks, include Engineering/Architecture Conformance in default Contract Conformance, then run the separate Context drift check. Add no gate or proof ledger.
 
 ## Architecture Deliberation content
 
-Risk changes depth, never whether the checkpoint occurs. A small design may say that it preserves the existing boundary, but it must still name the concrete owner/extension point and verification entry.
-
-Cover what is material:
-
-- controlling Context and current code symbol/path;
-- owner and unique source of truth;
-- allowed dependency direction and prohibited bypass;
-- inputs/outputs, interface and state/persistence/lifecycle boundaries;
-- failure, retry, timeout, cancellation, degradation, recovery and resource release;
-- concurrency/consistency and security/privacy/safety boundaries when triggered;
-- compatibility, migration and rollout when a public/schema/config/versioned boundary changes;
-- selected design, material alternatives and why they lose;
-- a realistic adjacent future change and where it lands without duplicate truth or reverse dependency;
-- technical debt eliminated, isolated without worsening, or blocked pending a bounded project-owned exception with owner/reason/tracking/removal condition;
-- project-owned type/lint/AST/dependency/contract/behavior/benchmark/probe checks.
+Risk changes depth, not whether the checkpoint occurs. Name the controlling Context/code path, concrete owner and unique source of truth, extension point, dependency direction and prohibited bypass; API/schema/data inputs/outputs; interface, state and lifecycle boundaries; material failure/recovery/resource-release behavior; and triggered concurrency, security or compatibility boundaries. State the selected design, material alternatives, a realistic future-change landing without duplicate truth or reverse dependency, technical debt disposition or bounded project-owned exception, forbidden shortcuts, and project-owned type/lint/AST/dependency/contract/behavior/benchmark/probe checks.
 
-Correctness/invariants and maintainability/changeability always receive at least a preservation judgment. Reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when the design makes them material. A performance claim additionally requires workload, metric, baseline/budget, environment, comparator/tolerance and a project-owned measurement; static shape is not runtime proof.
+Always judge correctness/invariants and maintainability/changeability. Activate reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability only when material. A performance claim requires workload, metric, baseline/budget, environment, comparator/tolerance and project-owned measurement; static shape is not runtime proof.
 
 Refresh the deliberation if scope, ownership, dependency direction, selected design, quality applicability or debt disposition materially changes.
 
 ### Risk-triggered Build / Reuse / Buy
 
-Express the judgment as an `allowed solution set`, `prohibited failure modes` and `required rationale/evidence`, never a single required library or abstraction. Allowed choices may include the owning repository service/facade/adapter, standard library, installed dependency, mature compatible external library, a small bounded self-implementation or intentional non-abstraction.
+Record an `allowed solution set`, `prohibited failure modes` and `required rationale/evidence`, not one required library or abstraction. Choices may include the owning service/facade/adapter, standard library, installed dependency, mature compatible external library, small bounded self-implementation or intentional non-abstraction.
 
-Enumerate every materially supported member before selecting one; selection never removes another supported member from the allowed set. Judge the task's viable set, not its first proposal. If one member has current support, allow and select it while keeping every unselected but legal member as an alternative. Only a choice which actually exhibits a prohibited failure mode belongs in the prohibited list. Use `block` only when no member is supported or safety/compatibility evidence is missing; use `decision-required` only for a genuine user/product/external choice, never for multiple implementation-equivalent options.
+Enumerate every materially supported member before selecting one; selection never removes another supported member from the allowed set. Judge the viable set, retain each unselected but legal member as an alternative, and prohibit only a choice which actually exhibits a prohibited failure mode. `block` needs no supported member or missing safety/compatibility evidence; `decision-required` needs a genuine user/product/external choice.
 
 Reject duplicate owner-held rules, extension-point bypass, an unjustified heavy dependency, plainly incomplete reinvention of mature security-sensitive behavior, incompatible license/platform support, forced abstraction over structurally similar but semantically different code and a second source of truth for one stable rule. Do not add a mandatory open-source preference, DRY rule, generic quality score, artifact, stage or Gate. Conformance asks only whether the selected choice is in the allowed set, avoids prohibited failures and has risk-proportional current evidence.
 
 ## Boundary routing
 
-- Product goals, business/user rules, flows and acceptance meaning belong to `context_product_plan`.
-- Durable main/drilldown/surface information/action/feedback responsibility belongs to `context_surface_contract`.
-- Durable Design Authority, tokens, rationale, adopted target interpretation and UI Authority Closure belong to `context_uiux_design`.
-- New design-resource generation/handoff belongs to `design-resource-authoring`.
-- Exact non-UI semantic facts remain owned by Source/Context; exact selected UI values remain owned by selected-design closure. This Skill does not invent either.
+Product goals and acceptance meaning belong to `context_product_plan`. Durable main/drilldown/surface information/action/feedback responsibility belongs to `context_surface_contract`. Durable Design Authority and UI Authority Closure belong to `context_uiux_design`. New design-resource generation/handoff belongs to `design-resource-authoring`. Exact non-UI semantic facts remain owned by Source/Context; exact selected UI values remain owned by selected-design closure.
 
 For monorepos, distinguish expandable read scope from intended/supporting workspaces. Existing Context workspace mappings are semantic routing rather than edit authorization or read ACLs. Do not add workspace registries, topology scans or empty Context mirrors.
 

package/assets/skills/context_development_engineer/references/engineering-design-reasoning.md

@@ -0,0 +1,93 @@
+# Engineering Design Reasoning
+
+Use this reference only after `context_development_engineer` has been selected for material engineering-design or architecture judgment. It deepens the existing Architecture Deliberation; it does not create a design phase, plan artifact, evidence ledger, second workflow or acceptance carrier. Apply the smallest useful subset below and state when a method is not material.
+
+## 1. Frame what is actually known
+
+Separate four categories before choosing a design:
+
+- **Facts:** user/Source/Context requirements, repository owners and extension points, observed code/test behavior and externally verified dependency facts.
+- **Constraints:** compatibility, platform, policy, budget, rollout, security, data, lifecycle and scope boundaries that a legal solution must preserve.
+- **Assumptions:** plausible but unproved premises currently needed to proceed. Name who can validate them and what changes if they are false.
+- **Unknowns:** missing information that distinguishes alternatives, changes safety or makes an acceptance claim unsupported.
+
+Current code is implementation evidence, not silent product or architecture authority. A genuine product, legal, security, commercial, safety or external choice remains `decision-required`; implementation-equivalent freedom belongs to the current Goal.
+
+## 2. Identify drivers and path dependence
+
+Name the few forces that materially shape the solution: owner/source-of-truth location, dependency direction, data/state boundaries, lifecycle and failure semantics, compatibility commitments, load/threat conditions and verification reachability. Distinguish an enduring invariant from historical path dependence such as an old API, migration window, installed dependency or deployment constraint. Preserve path dependence only while its reason still applies; do not mistake legacy shape for the desired architecture.
+
+For each material driver, point to repository evidence or authoritative external evidence. If current dependency/library behavior matters and may have changed, use current primary documentation rather than memory.
+
+## 3. Build the smallest material alternative set
+
+Enumerate only alternatives that could plausibly change an owner, boundary, lifecycle, dependency, operational risk or future change cost. Include the current extension point or intentional non-abstraction when viable. When sourcing is material, express Build / Reuse / Buy as the existing allowed solution set, prohibited failure modes and required rationale/evidence.
+
+Steelman every material alternative before rejecting it:
+
+- where it fits the requirements well;
+- its cleanest owner and dependency direction;
+- the strongest reason a competent maintainer would select it; and
+- the evidence or condition under which it would become preferable.
+
+Do not manufacture alternatives for a local choice whose owner and semantics are already explicit. Do not relabel an unselected allowed option as a prohibited failure.
+
+## 4. Use counterfactuals and failure paths
+
+Challenge the leading design with at least one realistic adjacent change and one relevant failure:
+
+- If the next client, provider, state, data volume, permission model or workflow variation arrives, which existing extension point absorbs it?
+- If the selected dependency is unavailable, stale, slow, partial or incompatible, which failure is visible and where does recovery live?
+- If the main assumption is false, which decision changes and which parts remain valid?
+- What would make the rejected alternative win?
+
+Trace only triggered retry, timeout, cancellation, idempotency, transaction, concurrency, consistency, degradation, recovery and resource-release semantics. A family that is not material gets a concise preservation basis rather than invented machinery.
+
+## 5. Select risk-triggered methods
+
+Choose methods for the actual uncertainty; never run all of them by default:
+
+| Trigger | Useful method | Minimum output |
+| --- | --- | --- |
+| Unclear owner or dependency boundary | Repository owner/extension-point trace | One source of truth, legal dependency direction and prohibited bypass |
+| API/schema/data/state change | Contract and state-transition analysis | Inputs/outputs/errors, invariants, ownership, compatibility and recovery |
+| Shared mutable state or parallel execution | Interleaving/consistency analysis | Atomicity boundary, ordering, idempotency and failure recovery |
+| External integration or mature protocol | Current primary-source and repository-fit research | Supported allowed set, compatibility/security/maintenance evidence |
+| Material performance/capacity/cost risk | Complexity model plus project-owned measurement | Workload, metric, baseline/budget, environment and comparator/tolerance |
+| Trust, permission or sensitive data boundary | Threat/abuse-path analysis | Assets, actors, trust crossings, prohibited failures and attributable checks |
+| Public or versioned compatibility change | Migration/rollout analysis | Compatibility window, upgrade/rollback path and current-version evidence |
+| High uncertainty that code can cheaply resolve | Minimum architecture experiment | Hypothesis, smallest observable probe, budget and exit condition |
+
+Research or an experiment informs the decision but is not durable authority or product acceptance. Preserve only stable conclusions in their owning Context.
+
+## 6. Design a minimum architecture experiment
+
+Use an experiment only when a material unknown distinguishes legal alternatives and repository inspection or authoritative documentation cannot answer it cheaply. Define:
+
+- the exact question and competing hypotheses;
+- the smallest representative fixture or probe that can falsify the leading assumption;
+- environment, inputs, metric/observation and comparator;
+- time/resource budget and stop condition; and
+- how each possible result changes the design.
+
+Do not turn a spike into production by default. Representative input proves only its declared scope; it cannot establish an all-provider, all-interface, all-platform or full-population claim.
+
+## 7. Project the decision into implementation
+
+Before handoff to the current Goal, make the design concrete enough to implement without inventing a second architecture:
+
+- owning modules, paths and symbols plus the existing extension point;
+- public/internal interfaces, inputs, outputs and explicit error semantics;
+- data and state owner, persistence boundary and invariants;
+- runtime/resource lifecycle, initialization, cleanup, recovery and observability;
+- dependency direction and forbidden shortcuts;
+- compatibility/migration/rollout handling when applicable;
+- the smallest complete implementation surface and any intentional non-goals;
+- project-owned type/lint/AST/dependency/contract/behavior/benchmark/probe checks; and
+- `Context Delta: none|required`, with the smallest durable owner updated before code when required.
+
+## Architecture audit route
+
+For an audit, compare the current implementation against controlling Source/Context and the concrete owner/boundary model above. Report wrong owner, duplicate truth, reversed dependency, extension-point bypass, silent failure, incomplete lifecycle/recovery, unsupported quality claim and new/worsened debt separately. Distinguish observed defects from assumptions and unverified risks. Do not implement repairs unless the request also authorizes change.
+
+The final current-candidate Engineering/Architecture Conformance remains in the existing default Contract Conformance or, when validly active, the sole Long-Task Final Gate. This reference creates neither.

package/assets/skills/context_surface_contract/SKILL.md

@@ -45,7 +45,7 @@ Use the narrowest mode that matches the request:
 
 - Audit Mode: inspect whether existing surfaces have clear responsibility.
 - Compile Mode: turn audit findings or user decisions into Context candidates.
-- Apply Mode: write durable Context only when the user explicitly allows durable writes.
+- Apply Mode: write durable Context only when the user explicitly allows durable writes, or when already-authorized product/UI implementation independently yields `Context Delta: required` in the current Goal.
 - Conformance Mode: check implementation against an existing Product Surface Contract.
 
 Do not run implementation, long validation, browser smoke, app smoke or CLI smoke unless the user explicitly asks for execution.
@@ -85,7 +85,7 @@ Do not assume business responsibilities from current code shape alone. Ask for c
 
 ## Apply Mode
 
-Use only when the user explicitly allows durable writes.
+Use only when the user explicitly allows durable writes, or when product/UI implementation is already authorized and the current Goal independently decides that durable Surface/Screen responsibility changed. Skill activation, analysis, audit, candidate comparison or resource generation alone never grants write authority.
 
 Allowed writes:
 
@@ -126,7 +126,13 @@ For each touched surface, answer only what is relevant:
 
 - What surface is being touched?
 - What platform shape does it have?
+- Which authoritative target-user and usage-context reference applies?
 - What primary user question does it answer?
+- What primary task outcome, primary work object and shortest task loop does it support?
+- Which critical context must remain visible while the user acts?
+- How are each material operation, affected object and feedback related?
+- Does the task force repeated scrolling, navigation or context switching to make one judgment?
+- Which client/host, input-method and size-class constraints change the interaction topology?
 - What belongs on the main surface?
 - What must move to drilldown, diagnostics, operations, evidence or technical detail?
 - Which long-running or mutating actions require task id, progress, retry, import, recovery or history?
@@ -138,6 +144,7 @@ When screen depth is material, also answer only the applicable questions:
 
 - What stable surface/route key, entry context, exit outcome, inherited state and committed state identify the screen?
 - What is the semantic information order and which regions are fixed, scrolling or overlay-owned?
+- Across supported size classes, which regions remain, reflow, collapse, become sheets/sidebars/modals or move to another surface, and how is the primary work object preserved?
 - Which navigation, back/cancel, focus restoration, interruption and responsive/mode/state variants are durable?
 - For each material stable control key, what are its region/location, type/label, user task, visibility/availability, trigger/input/validation/default, interaction/navigation, loading/empty/success/failure/recovery/permission/feedback and accessibility semantics?
 - Which exact-target/constraint/inspiration IDs govern which declared conditions, and which verification path proves each independent claim?
@@ -158,6 +165,10 @@ For any task touching user-facing surfaces, information placement, forms, filter
 - Surface Platform: `<web | mobile | desktop | game | cli-tui | extension | embedded | mixed>`
 - Owning Product Domain: `<area / subdomain>`
 - Primary User Question: `<one concrete user judgment>`
+- Primary Task Outcome / Work Object / Loop: `<outcome; object; orient-act-feedback-finish loop>`
+- Critical Context Kept Visible: `<context required while acting>`
+- Operation–Object–Feedback: `<material relationship>`
+- Client / Size-Class Topology: `<host/input constraints and region changes>`
 - Main Surface Allows: `<durable visible information and actions>`
 - Main Surface Forbids: `<backend fields, raw payloads, diagnostics, debug ids, fake states, etc.>`
 - Drilldown Ownership: `<details / evidence / operations / diagnostics / technical details>`

package/assets/skills/context_uiux_design/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: context_uiux_design
-description: Use when the user explicitly asks to establish, adopt or repair durable UI/UX Design Authority, DESIGN.md, design-system governance, visual tokens/rationale, adopted target interpretation, UI Authority Closure, selected-design alignment, or durable visual standards in a Minimal Context Harness project. Do not trigger for product/surface responsibility, design-resource generation, ordinary UI implementation, local CSS/UI fixes, copy edits, or an unselected visual exploration.
+description: Use when the user explicitly asks to establish, adopt or repair durable UI/UX Design Authority, DESIGN.md, design-system governance, visual tokens/rationale, adopted target interpretation, UI Authority Closure, selected-design alignment or durable visual standards; or when actual task content requires material UI/UX analysis or audit for a new page/flow/complex control, information hierarchy, fixed/scroll/overlay/sheet/sidebar/modal topology, map/canvas/editor work, primary task and feedback loop, client adaptation, navigation/recovery/states or accessibility in a Minimal Context Harness project. Do not trigger merely for product/surface responsibility, design-resource generation, ordinary local UI implementation, CSS/copy/icon/image fixes, local exact-target alignment, a single-control visual preview or an unselected visual exploration.
 ---
 
 # Context UI/UX Design
@@ -11,7 +11,11 @@ Own durable Design Authority only: root `DESIGN.md`, visual identity and exact-v
 
 This Skill does not own product goals/business rules/acceptance (`context_product_plan`), information/action/feedback and main/drilldown responsibility (`context_surface_contract`), resource generation (`design-resource-authoring`), implementation, or acceptance. Route rather than duplicate those owners.
 
-Project-specific UI/UX rules may live in `<harnessRoot>/skills/uiux_design/SKILL.md`; durable facts remain in `DESIGN.md` and owning `project_context/**`. Active Long-Task retains its one Source/Contract lifecycle and Final Gate; this Skill contributes authority closure only.
+Project-specific UI/UX rules may live in `<harnessRoot>/skills/uiux_design/SKILL.md`; durable facts remain in `DESIGN.md` and owning `project_context/**`. When a valid Long-Task binding is active, `long-task-workflow` alone owns Source/Contract lifecycle, formal verification, Final Gate and completion. This Skill may contribute non-authoritative task-level UI/UX analysis and Design Authority closure, but creates no second plan, lifecycle, Authority, Gate or acceptance path.
+
+## Task-level analysis adapter
+
+For a material task-analysis trigger, read [task-uiux-analysis.md](references/task-uiux-analysis.md) completely and apply only the relevant methods. This adapter is non-authoritative: Product/Surface/Screen Source owns the user, page duty, primary task/work object, information/action/feedback and interaction-topology facts; this Skill still owns durable Design Authority only. The current Goal may compare and select implementation candidates under those constraints. A conflicting candidate cannot proceed to resource generation or implementation until the stale owner is authoritatively updated or a genuine decision is obtained.
 
 ## UI Authority Closure
 
@@ -23,7 +27,7 @@ Project-specific UI/UX rules may live in `<harnessRoot>/skills/uiux_design/SKILL
    - screen/interaction targets are fully owned by the owning Screen Contract, with `DESIGN.md` keeping only the stable key and owner/anchor;
    - the record preserves interpretation, selection basis, immutable path/URI and digest, applicable conditions and editable upstream owner/locator/update route.
 5. Never overwrite an adopted baseline. Create a new immutable version/digest, review it deliberately and update the unique canonical record. An implementation render/diff is evidence and cannot become the target it claims to match.
-6. Decide exactly one `Context Delta: none|required`. Durable visual-system, token, rationale, adopted interpretation, owner/anchor or verification-route change is `required`; ordinary UI/CSS fixes that preserve authority are `none`.
+6. Decide exactly one `Context Delta: none|required`. Skill activation, analysis, audit or candidate comparison alone authorizes no durable write. Durable visual-system, token, rationale, adopted interpretation, owner/anchor or verification-route change is `required`; ordinary UI/CSS fixes that preserve authority are `none`. When product/UI implementation is already authorized and the current Goal independently finds a durable Surface/Screen change, update the smallest owning Surface Context before code or return `decision-required`.
 7. Route unresolved surface placement to `context_surface_contract`; route any request to generate/iterate a wireframe, prototype, visual candidate, state study or handoff to `design-resource-authoring`. Do not invoke resource generation implicitly.
 
 ## Selected-design alignment