qlogicagent 2.16.4 → 2.16.6

package/README.md

@@ -2,27 +2,18 @@
 
 ## Community Red-Team Reports
 
-Generate the v0.15 community red-team reports from the same detectors and permission checker used by local community flows:
+Generate the community desensitization red-team report from the same detectors used by local community flows:
 
 ```bash
 pnpm redteam:community-desensitization -- --out=../qlogicagent-hub/reports/community-go-live/red-team/desensitization.json
-pnpm redteam:community-sandbox -- --out=../qlogicagent-hub/reports/community-go-live/red-team/sandbox.json
 ```
 
-The reports contain case ids, rule/finding ids, counts, and failures only; they do not store raw emails, secrets, paths, phone numbers, memories, skill text, tool commands, or file paths.
-
-Installed community skills are marked from their lifecycle registry provenance. Non-official installed skills execute as `community-skill:*` subturns, and `PermissionChecker` applies the L1 sandbox overlay only while that subturn is active.
+The report contains case ids, rule/finding ids, counts, and failures only; it does not store raw emails, secrets, paths, phone numbers, memories, skill text, tool commands, or file paths.
 
 The generic `skill` meta-tool no longer exposes raw URL installation. New community skills must enter through the v0.15 registry install flow so manifest kind, source tier, risk tier, dependencies, checksum, and local `SKILL.md` rescan all run on the same path.
 
 Community skill installation also rescans the downloaded `SKILL.md` entry after checksum verification and before moving it into the owner profile. Prompt-injection hits fail closed, leave no installed skill or lifecycle record, and return only a generic scan failure.
 
-At runtime, the community sandbox overlay also blocks host side-effect tools such as `send_message`, `agent`, `team`, `cron`, and `monitor` from community skill subturns, so injected instructions cannot escape through delegation, team control, or scheduled work.
-
-Community skill subturns also treat local file upload as tainted data egress. A `file_upload` call from `community-skill:*` requires explicit per-call approval before any provider Files API upload can proceed; auto-mode classifiers cannot replace that approval, and denied approvals leave no raw file path in the sandbox red-team report.
-
-Community skill subturns also treat provider prompt/media tools as tainted external egress. Calls such as `image_generate`, `video_generate`, `music_generate`, `tts`, `three_d_generate`, `video_edit`, `video_merge`, `video_upscale`, `voice_clone`, and `stt` require explicit per-call approval from `community-skill:*`; worker/coordinator roles fail closed, and auto-mode classifiers cannot replace that approval.
-
 Pet/Soul data is display-only. Runtime load/save sanitization strips fields and Chinese/English text that claim the pet is a desktop agent, execution actor, decision layer, permission subject, or can alter agent tools, permissions, memory, retrieval, planning, security policy, or system prompts.
 
 小智 Claw 的本地 AI Agent 运行时。作为独立进程运行，通过 **ACP (Agent Client Protocol) + Native JSON-RPC over stdio** 对外提供 Agent 能力。openclaw 智能网关作为 ACP Client 连接本进程。