qfai 2.1.0 → 2.1.2

package/assets/init/.qfai/assistant/skill/qfai-prototyping/references/iteration-loop.md

@@ -18,9 +18,8 @@
 ```
 
 The orchestrator writes the reviewer's payload for each `(UI contract, screen)` pair beside the
-per-iteration `review.json` summary, from the first iteration on (schema:
-`references/review-payload-schema.md`, aggregation rule:
-`references/reviewer-prompt.md`). That holds for a single-contract run as much
+per-iteration `review.json` summary, from the first iteration on (the payload schema and the aggregation rule are
+in the reviewer references the loop step names). That holds for a single-contract run as much
 as for a multi-contract one.
 
 The reviewer operates Playwright live. A screenshot or HTML snapshot is an
@@ -55,7 +54,7 @@ prototype. It is neutral with respect to AI behavior.
 ## Produced after the loop
 
 - `.qfai/prototype/final/index.html` and `.qfai/prototype/final/handoff.json`.
-  See `handoff.md`.
+  The `prototyping-handoff` step defines its fields.
 
 ## Brand identity
 

package/assets/init/.qfai/assistant/skill/qfai-prototyping/references/review-payload-schema.md

@@ -7,9 +7,17 @@ and the user reads what it finds before confirming the prototype.
 The schema is **closed**: any key not listed below is rejected. The
 orchestrator checks each payload against it before writing it, and asks the
 reviewer again for one that does not conform before the prototype is put to
-the user. A near-miss (extra key, misspelled field, legacy flat key) fails the
+the user. A near-miss (extra key, misspelled field) fails the
 whole file.
 
+## Contents
+
+- Path
+- Shape (11 required top-level fields)
+- Field rules
+- Not accepted
+- `sessionStatus` and the retry policy
+
 ## Path
 
 ```text
@@ -23,8 +31,8 @@ per-(UI contract × screen) artifact written for a review — no `.html`, no
 `.png`, no `.interaction.json`.
 
 The Reviewer's other result is the per-iteration summary
-`iter-NN/review.json` (one per iteration, a different shape — see
-`references/reviewer-prompt.md`). It is not a per-screen artifact and
+`iter-NN/review.json` (one per iteration, a different shape, set by
+the reviewer prompt). It is not a per-screen artifact and
 is never read against this schema.
 
 ## Shape (11 required top-level fields)
@@ -91,8 +99,7 @@ These keys belong to the per-iteration summary, **not** to this payload.
 Writing any of them here breaks the closed schema:
 
 `iterIndex`, `reviewerId`, `proseCritique`, `pivotDirective`,
-`evidenceRefs`, and the retired flat `timeBudgetSoftWarning` string
-(use `softWarnings.timeBudget: boolean`).
+and `evidenceRefs`.
 
 ## `sessionStatus` and the retry policy
 

package/assets/init/.qfai/assistant/skill/qfai-prototyping/references/reviewer-prompt.md

@@ -18,12 +18,25 @@ put to the user. Explain observable defects and corrective actions in prose. A f
 score never hides a blocking finding. Do not use numeric AC-pass or
 transition-pass percentages as a substitute for the qualitative review.
 
+## Contents
+
+- Inputs
+- Outputs — two files, two schemas
+- Per-iteration summary (`iter-NN/review.json`)
+- The four ordinal UX axes
+- Diagnostic criteria
+- Applying the four axes
+- What blocks
+- Layout anti-pattern matching (`lap-*`)
+- pivotDirective rules
+- Prose critique format (at most 500 English words, or 2500 Japanese/Chinese characters)
+
 ## Inputs
 
 - The live prototype URL and declared `screens[]` routes from the UI contract.
   Open each route in your own Playwright session and exercise its declared
   primary tasks. Record `sessionStatus` and `retryCount` in the per-screen
-  payload according to `references/review-payload-schema.md`.
+  payload according to the closed per-screen payload schema.
 - A screenshot or HTML snapshot, only when one was taken. Name any mandatory
   input you did not receive in a finding.
 - The layout anti-pattern registry the package ships.
@@ -55,7 +68,7 @@ below and are relative to the project root.
    per-UI-contract subdirectory is mandatory for every run that declares UI
    screens, including a run with one contract. Its schema is closed
    (11 required top-level fields, unknown keys rejected) and lives in
-   `references/review-payload-schema.md`. Build it from that
+   the payload schema reference. Build it from that
    reference, not from the block below.
 2. **Per-iteration summary** —
    `.qfai/prototype/iter-NN/review.json`, one per iteration. Its shape is
@@ -114,7 +127,7 @@ type Review = {
 
 Fill `designMdViolations` yourself: one entry per distinct value the
 prototype uses that root `DESIGN.md` does not declare, in the categories
-`generator-prompt.md` lists.
+the generator prompt lists.
 
 ## The four ordinal UX axes
 
@@ -155,7 +168,7 @@ count can support a finding, but cannot replace the live assessment.
 | 5   | No catalogued anti-pattern is present                                 | `lap-*`, below                           |
 | 6   | Conformant, procured, restrained and consistent                       | below                                    |
 | 7   | Every declared `primary_task` walks                                   | below                                    |
-| 8   | No text on the screen explains the interface                          | `.agents/rules/interface-clarity.md`     |
+| 8   | No text explains the interface, and the text shown is the contract's  | `.agents/rules/interface-clarity.md`     |
 
 Criteria 1 to 4 are the procurement ladder read as questions, so a screen
 cannot pass by a standard it was not built to.
@@ -201,6 +214,22 @@ Hint text survives only where a need was demonstrated, the control was
 improved first and the need remained, and it is one sentence at most. Longer
 means the question needs clarifying or splitting.
 
+Compare the rendered text with the screen's UI contract in both directions. The
+screen shows its `title`, the group headings of its `structure`, its labels and
+the `supplements` it declares. A text shown that none of them declares is excess,
+and a declared supplement that is not shown is an unmet need. The finding names
+the screen, the task or state, the meaning that is duplicated or the need that is
+unmet, and the text to remove or the control or structure to repair. Apply the
+patterns of the section on copy that adds no meaning, which the loop step names; the
+rest of the design anti-patterns list stays with the direction review.
+
+A repair keeps what the task needs: a condition, cost, storage or transmission
+destination, result, recovery step, the consequence of an action that cannot be
+undone, and every label, accessible name, role and state. Moving that into a
+tooltip or a placeholder is not a repair. After a repair, walk the task again at
+the declared narrow and desktop widths, in the normal, empty, error, loading and
+success states the screen has.
+
 The counts are contract-relative. A screen declaring one primary task and
 carrying forty controls is wrong; the same forty elsewhere may be right. The
 denominator is in the contract, so no global threshold has to be invented.

package/assets/init/.qfai/assistant/skill/qfai-run/SKILL.md

@@ -12,15 +12,16 @@ mode: execution-focused
 
 ## /qfai-run - Change request entry
 
-[DRIFT-PROTOCOL:MANDATORY]
+[DRIFT-PROTOCOL:REQUIRED]
 
-The user states a change once. This skill reads the request into facts, asks
-`npx qfai workflow plan` for the plan they give, and runs its steps in order.
+The CLI plans; this skill follows its steps in order.
 
-- The facts a request is read into: `references/extraction.md`.
-- The command, its input and its output: `references/plan.md`.
-- What the user sees, and how questions are put: `references/operator-screens.md`.
-- Invoke the CLI through the launcher of `.qfai/assistant/rule/shared-skill-operating-baseline.md#canonical-qfai-launcher-mandatory`.
+- Read `references/extraction.md` to extract a request.
+- Plan command and format: `references/plan.md`.
+- Screens and questions: `references/operator-screens.md`.
+- Release, decision and branch points: `references/stage-points.md`.
+- Run preflight before planning, as `.qfai/assistant/rule/shared-skill-operating-baseline.md#canonical-qfai-launcher-mandatory` says.
+  If the launcher is missing or preflight fails, read `references/operator-screens.md` for recovery.
 
 ## What this skill never does
 
@@ -44,48 +45,42 @@ value but the three below plans nothing.
 
 ## Request kinds
 
+- For independent targets under one goal, read `references/operator-screens.md`
+  before planning or switching during a wait.
 - A change, a question, a proposal to decide or a report to close is planned.
   A question plans a route that answers it and changes nothing. Text that is
   not a request is not planned.
+- A reply with a requested answer or result resumes the same step without a new
+  invocation, including failure. An independent new request is planned. Read
+  `references/operator-screens.md` for replies.
 - `stop`: end the work at once and list every open decision as open.
 - A request naming a stage skill: invoke that skill by name.
 
 ## The work
 
 1. **Extract.** Read the request into an extraction as
-   `references/extraction.md` sets out, and pass it to
+   `references/extraction.md` sets out, using its definition of acceptance.
+   Pass the extraction to
    `npx qfai workflow plan --in <file>`, or `--in -` on standard input.
 2. **Candidates.** When `plan` returns `candidates`, put one single-select
    question, each option saying in the user's words what that route will do,
    then run `npx qfai workflow plan --route <route>` for the chosen one.
-3. **Scope.** Ask which scope to run, as `references/operator-screens.md` says; run only its stages.
+3. **Scope.** With two or more scopes, ask which to run as
+   `references/operator-screens.md` says, and run only its stages.
+   With one scope, no scopes, or a branch destination's plan, ask nothing and
+   run every stage.
 4. **Announce.** Before the first stage, give the goal, the chosen stages in
    order in plain words, and the files the work may change. Ask nothing. Then run
    `common-policy-check` once. On a route that changes no file, one that
    closes, answers or asks, it reads and reports and writes nothing.
 5. **Run the stages.** Run each stage in plan order, and each of its steps in
-   order. Write any artifact yourself. Give a part to a sub-agent only to run
-   independent parts in parallel, or for a review. At each step, handle the
-   points the plan names for it:
-   - **Release point.** Before a step `releasePoint` names runs, ask the user
-     to approve the release; where it is `end`, ask once the last stage's
-     gates have passed, then rerun them over the approval's `decisions.md`
-     row. `verify-commit` runs after that, so the commit holds the approval. Nothing after it
-     runs without the approval, which authorizes no push, merge, tag or publication.
-   - **Decision point.** At a step `decisionPoints` names, put each critical
-     decision to the user through the structured question tool before
-     changing anything that depends on it. A decision is critical when it contradicts a
-     specification, a contract or a recorded decision, cannot be taken back, or
-     rests on product intent nothing written states. Take every other decision
-     yourself, ask nothing, and list it with its reason in the final report.
-   - **Branch point.** When a step `branchPoints` names reports an outcome
-     paired with one route, move there; with several, to the one the step
-     names; with `decision-table`, to the route `plan --in` gives the step's
-     new extraction. Take the destination's plan with
-     `npx qfai workflow plan --route <route>` at once: no later step of this
-     route runs. Any other outcome continues the route. Before the third move
-     and every one after it, ask the user, naming the destination in plain
-     words; `stop` ends the work. From a scope that leaves stages out, ask before any move.
+   order, as `.qfai/assistant/rule/shared-skill-operating-baseline.md#running-steps-mandatory` says.
+   When a step is short or passes without edits, read `references/operator-screens.md`.
+   Write artifacts yourself or delegate independent parallel work or review.
+   At each step, follow its plan's points in `references/stage-points.md`:
+   - **Release point.** Ask the user to approve the release before the step `releasePoint` names.
+   - **Decision point.** Put each critical decision at a step `decisionPoints` names to the user.
+   - **Branch point.** Move to the destination a step `branchPoints` names, and plan it at once.
 6. **Review.** After a stage whose `review` is `spec`, `requirements-reviewer`
    reviews, with `architecture-reviewer` when a contract changed; after one
    whose `review` is `code`, `implementation-reviewer`.
@@ -102,6 +97,8 @@ value but the three below plans nothing.
 ## Under a no-question mode
 
 Nothing is asked. The plan's narrowest scope, or the first candidate and its narrowest scope, is taken and reported as an assumption.
+An uncovered question-only move to tracked-file repair instead stops that target
+with a report and no tracked open question, as `references/stage-points.md` says.
 A critical decision or a release point becomes one `open-questions.md` row,
 the step stops before the change that depends on it, and the report lists the
 decision as open. A third branch move, or one from a scope that leaves stages out, stops the work.
@@ -123,11 +120,7 @@ Follow `.qfai/assistant/rule/shared-skill-delegation-baseline.md`.
 
 ## Work Orders Summary
 
-Where parts ran in parallel, report one row per part given to a sub-agent.
-
-| Step | Role (sub-agent) | Agent instance  | Task title        | Input (refs)  | Output (refs) | Status (PASS/REVISE/PENDING) |
-| ---- | ---------------- | --------------- | ----------------- | ------------- | ------------- | ---------------------------- |
-| 1    | `<role>`         | `<instance id>` | `<part in words>` | The step file | The result    | PASS/REVISE                  |
+When parts ran in parallel, use the summary in `references/operator-screens.md`.
 
 ## Default Autopilot Policy
 
@@ -144,6 +137,11 @@ Where parts ran in parallel, report one row per part given to a sub-agent.
 
 Follow `.qfai/assistant/rule/shared-skill-operating-baseline.md#completion-contract-shared`. **Smallest applicable smoke check** (this skill's override): the gates of the `verify-qfai-gate` and `verify-repo-gate` steps the chosen scope holds; a scope holding none runs no gate, and the report says so. A gate that cannot run is UNRUN, not a pass.
 
+When the request requires evidence handover before session archive, read
+`references/evidence-delivery.md` and complete its receiving proof first.
+Missing access keeps the handover pending and originals retained. Ordinary
+completion does not require an unsolicited upload.
+
 project_memory:
 
 - The user names no stage after the first request.

package/assets/init/.qfai/assistant/skill/qfai-run/references/evidence-delivery.md

@@ -0,0 +1,322 @@
+# Evidence delivery
+
+## Contents
+
+- When delivery is required
+- Identity and the ignored index
+- Selection and privacy
+- Native preflight
+- Copy and archive
+- Retained storage and receipt
+- Independent receiver
+- Failure and proof limits
+
+## When delivery is required
+
+Read this guide when a request requires evidence handover before a session is
+archived. Complete that handover before archiving the session. Ordinary
+completion does not require an unsolicited upload or an extra full verification
+run solely to deliver evidence.
+
+Use explicit selected regular files, an ignored human-readable index, standard
+native tools and authorized retained storage. Keep originals until the named
+recipient or receiving role has independently received and checked every
+required item. A storage link or producer self-read is not that receipt.
+
+This guide adds no QFAI command, exporter, storage service, machine schema or
+runtime state. It does not change the plan, its gates or existing verdicts.
+
+## Identity and the ignored index
+
+Write the index in an ignored location outside the selected payload and keep
+its destination in the stage report or session handoff. Record:
+
+- target, scope, repository, branch and full source revision;
+- observed worktree/index state and the fingerprint of the selected input;
+- actual executable and build, command with separated argv, cwd, runtime,
+  input and time where observed;
+- each selected relative name, expected byte length and SHA-256 digest;
+- original results, excluded attempts and their original result and exclusion
+  reason, review identity, open work, owner and resume condition;
+- sharing authority, exclusions, destination, receiving role and retention.
+
+Use native Git observations such as `git rev-parse HEAD`,
+`git status --porcelain=v1 --untracked-files=all` and
+`git rev-parse --git-path index` to record the source and index. Where the index
+exists, record its raw-byte digest too. Recheck the revision, index and selected
+input before producing the archive. A changed revision/index or stale index
+entry stops delivery until the intended source and required inventory are
+established again. A dirty tree is disclosed with the selected-byte snapshot;
+its commit alone cannot identify the actual input or build used by an old run.
+
+Keep trusted expected selected sizes/digests, source identity and archive digest
+outside the delivered bundle. Compare the index with those expectations. A
+downloaded index cannot establish its own source or digest authority. Required
+selected-file or independent source/archive identity that is UNKNOWN refuses
+delivery; do not fabricate it from an unverified receipt.
+
+Historical executable, build, command or time that was not observed stays
+UNKNOWN. Known evidence may still be preserved, but unknown historical execution
+does not prove verification. Keep old-source PASS separate from current FAIL,
+UNRUN and delegated pending checks. Retain excluded failed attempts without
+changing their result. No delivery completes failed or unrun required
+verification, turns pending CI into PASS or relabels a review for another head.
+Existing `verify.json` fields, scope and statuses stay unchanged.
+
+## Selection and privacy
+
+Select only the files needed to resume this target. Do not recursively discover
+scratch, select a directory or copy a whole checkout. Give each required entry
+a canonical relative name with `/` separators, a known expected byte length and
+lowercase SHA-256 digest. Use a new owned staging root; keep the index and
+archive outside it.
+
+For portable names and unambiguous native listings, exclude control characters
+and components ending in a dot or space. If a required original uses such a
+name, review and identify a separately named copy before selecting it.
+
+Review the selected names and contents, sharing authority and destination before
+upload. Exclude credentials and unapproved private material. Record exclusions
+without exposing withheld values. If a reviewed or redacted copy is needed,
+identify it separately from the retained original and hash the bytes actually
+delivered. Neither hashes nor the preflight detect all secrets, automatically
+redact contents or establish privacy completeness.
+
+The preflight below reads only the explicit selection. It refuses unsafe names,
+missing or non-regular entries, linked root/ancestors/leaves, hardlinks,
+duplicate normalized names, case collisions and wrong or changed byte identity.
+It checks observations again during and after reading. These observations are
+not an atomic snapshot or protection against every concurrent adversary.
+
+## Native preflight
+
+Save this single block verbatim as an owned temporary `.mjs` file. Run it with
+the installed Node executable and separated argv:
+
+`node <saved-preflight.mjs> <absolute-root> <relative-name> <decimal-byte-length> <lowercase-sha256> [more triples]`
+
+Use the same block and trusted expected triples for source, staged copy and
+receiver roots. There is no collection/receiver mode and no input from stdin.
+The block changes no file. Exit 0 and `Verified N selected files.` mean only
+that this selection passed these checks. Exit 1 refuses it; neither result
+proves sharing authority, storage access, historical execution or handover.
+
+```js
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+function sameIdentity(left, right) {
+  return ["dev", "ino", "mode", "nlink", "size", "mtimeNs", "ctimeNs"].every(
+    (key) => left[key] === right[key],
+  );
+}
+
+function sameDirectory(left, right) {
+  return ["dev", "ino", "mode"].every((key) => left[key] === right[key]);
+}
+
+function main() {
+  const [rootArg, ...args] = process.argv.slice(2);
+  if (!rootArg || !path.isAbsolute(rootArg) || !args.length || args.length % 3) {
+    throw new Error("Use an absolute root and complete name/size/digest triples.");
+  }
+  const root = path.resolve(rootArg);
+  const names = new Set();
+  const directories = new Map();
+  const entries = [];
+
+  function directory(name) {
+    const stat = fs.lstatSync(name, { bigint: true });
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error("A selected path has a linked or non-directory component.");
+    }
+    const previous = directories.get(name);
+    if (previous && !sameDirectory(previous, stat)) {
+      throw new Error("A selected directory changed.");
+    }
+    directories.set(name, stat);
+  }
+
+  const parents = [];
+  for (let current = root; ; current = path.dirname(current)) {
+    parents.push(current);
+    if (path.dirname(current) === current) break;
+  }
+  parents.reverse().forEach(directory);
+
+  for (let offset = 0; offset < args.length; offset += 3) {
+    const [name, sizeText, digest] = args.slice(offset, offset + 3);
+    const parts = name.split("/");
+    if (
+      path.isAbsolute(name) ||
+      /[\\:\x00-\x1f\x7f]/u.test(name) ||
+      parts.some((part) => !part || part === "." || part === ".." || /[. ]$/u.test(part)) ||
+      !/^\d+$/u.test(sizeText) ||
+      !Number.isSafeInteger(Number(sizeText)) ||
+      !/^[a-f0-9]{64}$/u.test(digest)
+    ) {
+      throw new Error("A selected name, expected size or digest is unsafe.");
+    }
+    const normalized = name.toLowerCase();
+    if (names.has(normalized)) {
+      throw new Error("Selected names are duplicated or collide by case.");
+    }
+    names.add(normalized);
+    let current = root;
+    for (const part of parts.slice(0, -1)) {
+      current = path.join(current, part);
+      directory(current);
+    }
+    const file = path.join(root, ...parts);
+    const stat = fs.lstatSync(file, { bigint: true });
+    const expectedSize = BigInt(sizeText);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1n) {
+      throw new Error("A selected entry is linked, hardlinked or non-regular.");
+    }
+    if (stat.size !== expectedSize) throw new Error("A selected size changed.");
+    entries.push({ file, stat, expectedSize, digest });
+  }
+
+  function recheckDirectories() {
+    for (const [name, before] of directories) {
+      const after = fs.lstatSync(name, { bigint: true });
+      if (!after.isDirectory() || after.isSymbolicLink() || !sameDirectory(before, after)) {
+        throw new Error("A selected directory changed.");
+      }
+    }
+  }
+
+  const buffer = Buffer.alloc(64 * 1024);
+  for (const entry of entries) {
+    recheckDirectories();
+    const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0);
+    const descriptor = fs.openSync(entry.file, flags);
+    try {
+      const before = fs.fstatSync(descriptor, { bigint: true });
+      if (!before.isFile() || before.nlink !== 1n || !sameIdentity(entry.stat, before)) {
+        throw new Error("A selected entry changed before reading.");
+      }
+      const hash = createHash("sha256");
+      let size = 0n;
+      for (;;) {
+        const count = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+        if (!count) break;
+        size += BigInt(count);
+        if (size > entry.expectedSize) throw new Error("A selected size changed.");
+        hash.update(buffer.subarray(0, count));
+      }
+      const after = fs.fstatSync(descriptor, { bigint: true });
+      const current = fs.lstatSync(entry.file, { bigint: true });
+      if (
+        !sameIdentity(before, after) ||
+        !sameIdentity(before, current) ||
+        size !== entry.expectedSize ||
+        hash.digest("hex") !== entry.digest
+      ) {
+        throw new Error("Selected bytes or identity changed.");
+      }
+      recheckDirectories();
+    } finally {
+      fs.closeSync(descriptor);
+    }
+  }
+  recheckDirectories();
+  for (const entry of entries) {
+    if (!sameIdentity(entry.stat, fs.lstatSync(entry.file, { bigint: true }))) {
+      throw new Error("A selected entry changed after reading.");
+    }
+  }
+  console.log(`Verified ${entries.length} selected files.`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`Evidence preflight refused: ${error.message}`);
+  process.exitCode = 1;
+}
+```
+
+## Copy and archive
+
+After source preflight succeeds, copy only those selected files to the new owned
+staging root. Use a native literal-path copy or Node's `fs.copyFileSync`; create
+only their listed parent directories. Do not decode, rewrite or normalize
+binary data, encoding markers, LF or CRLF. Re-run the exact preflight block on
+staging with the trusted source expectations immediately before native tar.
+If anything changes or cannot be read, stop before archive and keep originals.
+
+Use the installed native tar executable with separated argv, for example:
+
+- create: `tar -cf <absolute-bundle.tar> -C <absolute-staging-root> ./<selected-name> ...`
+- list: `tar -tf <absolute-bundle.tar>`
+- extract: `tar -xf <absolute-bundle.tar> -C <fresh-absolute-receiver-root>`
+
+Prefix each selected name with `./` to avoid option or archive-inclusion
+interpretation. Select no directory and use no wildcard or shell interpolation.
+Check the actual listing against the exact expected member set: each required
+name occurs once, with no unexpected or missing member. Record the actual
+executable/version, argv, cwd, platform, exit/signal and stdout/stderr. A missing
+tool or failed command is not successful production. Different native tar
+implementations need not produce identical archive container bytes.
+
+Calculate the produced archive's raw-byte SHA-256 and record it with the trusted
+source and selected expectations outside the archive. Archive digest identity
+alone does not prove file provenance, privacy or recipient access.
+
+## Retained storage and receipt
+
+Before upload, establish existing authority for this target and payload,
+destination privacy, the named recipient or receiving role, required access and
+retention. A visible storage link grants none of these. Use an existing
+authorized retained channel; do not create a paid service or publish private raw
+evidence by assumption. Preserve actual upload results and artifact identity.
+
+The ignored receiving receipt records who received the evidence, retrieval time,
+destination and artifact identity, retrieved items, independently checked source
+and archive identity, every required size/digest result and missing evidence.
+Keep its reference in the stage report or handoff. A required item or receipt
+that is unavailable, expired, denied, incomplete or mismatched leaves handover
+pending, records the blocker and resume condition, and retains originals.
+
+## Independent receiver
+
+The receiver independently retrieves every required item from retained storage;
+producer self-read or index visibility is insufficient. Supply trusted source,
+archive digest and selected-file expectations through a separate authorized
+channel. Check the archive's actual raw-byte digest and source identity against
+those expectations before extraction. Refuse a mismatched or unknown archive.
+
+Extract only this known-safe producer archive into a fresh owned receiving root.
+This procedure does not safely extract arbitrary third-party archives. Check
+the exact member set and re-run the same preflight on the extracted regular
+files with the trusted expected triples. Compare the index's target/source and
+inventory with the separately supplied expectations. Missing, duplicated,
+unexpected, linked or altered members do not produce an accepted receipt.
+
+Only the named recipient's actual complete receiving proof allows the requested
+handover to complete before real session archive. Local producer checks cannot
+stand in for it. Preserve unrelated receiver contents and originals when proof
+fails; do not destroy or silently replace them to make the receipt pass.
+
+## Failure and proof limits
+
+On unsafe selection, changed source or index, missing evidence, unknown required
+identity, denied access, expiry or mismatched bytes, stop dependent delivery and
+archive. Name the observed blocker, missing item, owner and resume condition.
+Keep actual failure output and originals. Required verification FAIL, UNRUN or
+pending remains incomplete even if some evidence was successfully delivered.
+
+Generic capability acceptance requires actual native Linux and Windows
+producers and separate Linux and Windows hosted receivers. Each receiver must
+retrieve both retained producer artifacts and independently check their bytes,
+digests and source identity: all four transfer directions need actual proof.
+Executing only the instructions or reading one's own output is insufficient.
+
+That controlled CI receipt proves the tested capability. It does not establish
+this session's real successor access, long-term retention, a session archive or
+general sharing permission. Historical metadata remains UNKNOWN where absent.
+The preflight is neither an automatic secret scanner, an exporter nor an atomic
+concurrent-adversary guarantee. Native archives are not a general safe restore
+engine. Report these limits with the actual observations.