xuym-codex-collab 0.1.1 → 0.3.1

package/packages/peer/store.mjs

@@ -5,18 +5,27 @@ import { join, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { digest, makeSigner, validateTeam } from './config.mjs';
 import { reducePeerTask, taskIdPattern } from './protocol.mjs';
+import { readRegistry, recordHash, registryPath } from './registry.mjs';
 const exec = promisify(execFile);
 const pause = (ms) => new Promise((r) => setTimeout(r, ms));
 export async function git(cwd, ...args) {
-  const { stdout } = await exec('git', ['-c', 'core.hooksPath=/dev/null', '-C', cwd, ...args], { env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, timeout: 30000, maxBuffer: 4 * 1024 * 1024 });
-  return stdout.trim();
+  try {
+    const { stdout } = await exec('git', ['-c', 'core.hooksPath=/dev/null', '-C', cwd, ...args], { env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, timeout: 30000, maxBuffer: 4 * 1024 * 1024 });
+    return stdout.trim();
+  } catch (error) {
+    // Keep stderr available to callers that can turn it into a safe, actionable message.
+    // Never expose the raw value directly to the browser: it may contain credentials.
+    error.git_args = args;
+    throw error;
+  }
 }
 
 /** Disposable ledger clone, cross-process local lock, remote fast-forward CAS and signed replay. */
 export class PeerGitStore {
-  constructor({ repo, dataDir, team, agentId, privateKey, clock = Date.now, maxRetries = 8 }) {
+  constructor({ repo, dataDir, team, agentId, privateKey, clock = Date.now, maxRetries = 8, registryRoot, enrollmentOnly = false }) {
     this.repo = resolve(repo); this.dataDir = resolve(dataDir); this.checkout = join(this.dataDir, 'peer-ledger');
-    this.team = validateTeam(team); this.agentId = agentId; this.sign = makeSigner(team, agentId, privateKey);
+    this.team = validateTeam(team); this.agentId = agentId; this.enrollmentOnly = enrollmentOnly; this.sign = enrollmentOnly ? null : makeSigner(team, agentId, privateKey);
+    this.privateKey = privateKey; this.registryRoot = registryRoot; this.registry = null;
     this.clock = clock; this.maxRetries = maxRetries; this.push = true;
   }
   async locked(fn) {
@@ -63,6 +72,23 @@ export class PeerGitStore {
     await git(this.checkout, 'checkout', '-B', 'agent-collab', 'refs/remotes/origin/agent-collab');
     await git(this.checkout, 'reset', '--hard', 'refs/remotes/origin/agent-collab');
     await git(this.checkout, 'clean', '-fd');
+    if (this.registryRoot) {
+      const registry = await readRegistry(this.checkout, this.registryRoot);
+      const checkpointPath = join(this.dataDir, 'team-checkpoint.json');
+      let checkpoint;
+      try { checkpoint = JSON.parse(await readFile(checkpointPath, 'utf8')); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      if (checkpoint && (registry.records.length < checkpoint.version || recordHash(registry.records[checkpoint.version - 1]) !== checkpoint.hash)) throw new Error('team registry rolled back or forked; refusing to trust it');
+      if (!this.enrollmentOnly) {
+        if (!registry.latest.team.agents[this.agentId]) throw new Error('member is not yet approved in the team registry');
+        this.sign = makeSigner(registry.latest.team, this.agentId, this.privateKey);
+      }
+      this.team = registry.latest.team; this.registry = registry;
+      const temporary = `${checkpointPath}.${process.pid}.tmp`;
+      await writeFile(temporary, JSON.stringify({ version: registry.latest.version, hash: recordHash(registry.latest) }) + '\n', { mode: 0o600 });
+      const { rename } = await import('node:fs/promises');
+      await rename(temporary, checkpointPath);
+    }
   }
   root(id) {
     if (!taskIdPattern.test(id ?? '')) throw new Error('invalid peer task ID');
@@ -74,7 +100,9 @@ export class PeerGitStore {
     const files = (await readdir(join(root, 'events'))).sort();
     if (files.some((f) => !/^\d{6}-[a-f0-9-]{36}\.json$/.test(f))) throw new Error('unexpected peer event file');
     const events = await Promise.all(files.map(async (file) => JSON.parse(await readFile(join(root, 'events', file), 'utf8'))));
-    return { spec, events, state: reducePeerTask(spec, events, this.team) };
+    const team = this.registry ? this.registry.teams.get(events[0]?.team_hash) : this.team;
+    if (!team) throw new Error('task references an untrusted team policy');
+    return { spec, events, state: reducePeerTask(spec, events, team), ...(this.registry ? { team } : {}) };
   }
   async listLocal() {
     let entries;
@@ -85,7 +113,29 @@ export class PeerGitStore {
   }
   async list() { return this.locked(async () => { await this.sync(); return this.listLocal(); }); }
   async read(id) { return this.locked(async () => { await this.sync(); return this.readLocal(id); }); }
+  async registryTransaction(build) {
+    return this.locked(async () => {
+      for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+        await this.sync();
+        const result = await build(this.registry);
+        if (!result.files?.length) return result.value;
+        for (const [path, value] of result.files) {
+          if (!new RegExp(`^${registryPath.replace('.', '\\.')}/(?:versions/\\d{6}|(?:invitations|requests)/[a-f0-9-]{36})\\.json$`).test(path)) throw new Error('unsupported team registry file');
+          const target = join(this.checkout, path);
+          await mkdir(join(target, '..'), { recursive: true });
+          await writeFile(target, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' });
+          await git(this.checkout, 'add', '--', path);
+        }
+        await git(this.checkout, 'commit', '-m', 'collab: update signed team enrollment');
+        try { await git(this.checkout, 'push', 'origin', 'HEAD:refs/heads/agent-collab'); }
+        catch { await pause(20 * (attempt + 1)); continue; }
+        await this.sync(); return result.value;
+      }
+      throw new Error('team enrollment not accepted; check Git access and retry');
+    });
+  }
   async transact(id, idempotencyKey, build) {
+    if (this.enrollmentOnly) throw new Error('enrollment client cannot write tasks');
     if (typeof idempotencyKey !== 'string' || !idempotencyKey || idempotencyKey.length > 300) throw new Error('invalid idempotency key');
     return this.locked(async () => {
       for (let attempt = 0; attempt < this.maxRetries; attempt++) {
@@ -102,10 +152,12 @@ export class PeerGitStore {
         if (!built) return null;
         const spec = current?.spec || built.spec;
         if (!spec || spec.id !== id) throw new Error('transaction task mismatch');
-        const event = this.sign({ schema_version: 2, task_id: id, seq: (current?.state.seq || 0) + 1,
+        const taskTeam = current?.team || this.team;
+        const sign = makeSigner(taskTeam, this.agentId, this.privateKey);
+        const event = sign({ schema_version: 2, task_id: id, seq: (current?.state.seq || 0) + 1,
           event_id: randomUUID(), actor_id: this.agentId, occurred_at: new Date(now).toISOString(), idempotency_key: idempotencyKey,
           ...built.event, ...(current ? {} : { spec_hash: digest(spec) }) });
-        reducePeerTask(spec, [...(current?.events || []), event], this.team);
+        reducePeerTask(spec, [...(current?.events || []), event], taskTeam);
         const root = this.root(id); await mkdir(join(root, 'events'), { recursive: true });
         if (!current) await writeFile(join(root, 'spec.json'), JSON.stringify(spec, null, 2) + '\n', { flag: 'wx' });
         await writeFile(join(root, 'events', `${String(event.seq).padStart(6, '0')}-${event.event_id}.json`), JSON.stringify(event, null, 2) + '\n', { flag: 'wx' });

package/schemas/encrypted-invite.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:encrypted-invite:v1",
+  "title": "Codex Collab Encrypted Private Onboarding Package v1",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "schema_version",
+    "kind",
+    "salt",
+    "iv",
+    "tag",
+    "ciphertext"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "kind": {
+      "const": "codex-collab-encrypted-invite"
+    },
+    "salt": {
+      "type": "string",
+      "contentEncoding": "base64"
+    },
+    "iv": {
+      "type": "string",
+      "contentEncoding": "base64"
+    },
+    "tag": {
+      "type": "string",
+      "contentEncoding": "base64"
+    },
+    "ciphertext": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 500000,
+      "contentEncoding": "base64"
+    }
+  },
+  "$comment": "This file is private, not a Git ledger record. Runtime validates decoded salt=16 bytes, IV=12 bytes and tag=16 bytes; scrypt derives AES-256-GCM key from a separate password, then verifies signed history and invitation in the decrypted payload."
+}

package/schemas/event.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:event:v1",
+  "title": "Codex Collab Event v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "event_id", "task_id", "seq", "type", "actor_id", "occurred_at", "idempotency_key"],
+  "allOf": [{
+    "if": { "properties": { "type": { "const": "handoff" } }, "required": ["type"] },
+    "then": {
+      "required": ["summary", "refs"],
+      "properties": {
+        "summary": { "type": "string", "minLength": 1, "maxLength": 4000 },
+        "refs": {
+          "type": "object", "required": ["branch", "commit", "tests"],
+          "properties": {
+            "branch": { "type": "string", "pattern": "^codex/[A-Za-z0-9][A-Za-z0-9._/-]{0,150}$" },
+            "commit": { "type": "string", "pattern": "^[a-fA-F0-9]{40}([a-fA-F0-9]{24})?$" },
+            "tests": { "type": "string", "minLength": 1, "maxLength": 1000 }
+          }
+        }
+      }
+    }
+  }],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "event_id": { "type": "string", "minLength": 1 },
+    "task_id": { "type": "string", "pattern": "^[A-Z][A-Z0-9-]{1,63}$" },
+    "seq": { "type": "integer", "minimum": 1 },
+    "type": { "enum": ["created", "assigned", "run_started", "progress", "blocked", "run_failed", "handoff", "review_requested", "review_started", "review_note", "reviewed", "completed", "cancelled"] },
+    "actor_id": { "type": "string", "minLength": 1 },
+    "occurred_at": { "type": "string", "format": "date-time" },
+    "idempotency_key": { "type": "string", "minLength": 1 },
+    "summary": { "type": "string", "maxLength": 4000 },
+    "assignee": { "type": "string", "minLength": 1 },
+    "chat_id": { "type": "string", "minLength": 1 },
+    "channel": { "enum": ["feishu", "wecom"] },
+    "run_id": { "type": "string", "minLength": 1 },
+    "decision": { "enum": ["approved", "changes_requested"] },
+    "refs": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "branch": { "type": "string" },
+        "commit": { "type": "string" },
+        "pr": { "type": "string" },
+        "tests": { "type": "string" }
+      }
+    }
+  }
+}

package/schemas/peer-event.schema.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:peer-event:v2",
+  "title": "Codex Collab Signed Peer Event v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "event_id", "task_id", "seq", "type", "actor_id", "occurred_at", "idempotency_key", "team_hash", "signature"],
+  "properties": {
+    "schema_version": { "const": 2 },
+    "event_id": { "type": "string", "minLength": 1 },
+    "task_id": { "type": "string", "pattern": "^T-[A-Z0-9-]{1,62}$" },
+    "seq": { "type": "integer", "minimum": 1 },
+    "type": { "enum": ["created", "desktop_claimed", "claimed", "renewed", "progress", "checkpoint", "handoff", "stage_review_requested", "review_requested", "run_failed", "blocked", "reopened", "reviewed", "completed", "cancelled"] },
+    "actor_id": { "type": "string", "pattern": "^[a-zA-Z0-9_-]{1,64}$" },
+    "occurred_at": { "type": "string", "format": "date-time", "pattern": "Z$" },
+    "idempotency_key": { "type": "string", "minLength": 1 },
+    "team_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "signature": { "type": "string", "minLength": 1 },
+    "spec_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "epoch": { "type": "integer", "minimum": 1 },
+    "lease_id": { "type": "string", "minLength": 1 },
+    "expires_at": { "type": "string", "format": "date-time" },
+    "summary": { "type": "string", "maxLength": 4000 },
+    "next_stage": { "type": "integer", "minimum": 1 },
+    "decision": { "enum": ["approved", "changes_requested"] },
+    "refs": {
+      "type": "object", "additionalProperties": false, "required": ["branch", "commit", "tests"],
+      "properties": {
+        "branch": { "type": "string", "pattern": "^codex/[A-Za-z0-9][A-Za-z0-9._/-]{0,150}$" },
+        "commit": { "type": "string", "pattern": "^[a-fA-F0-9]{40}([a-fA-F0-9]{24})?$" },
+        "tests": { "type": "string", "minLength": 1, "maxLength": 1000, "pattern": "\\S" }
+      }
+    }
+  },
+  "allOf": [
+    { "if": { "properties": { "type": { "const": "created" } }, "required": ["type"] }, "then": { "required": ["spec_hash"] } },
+    { "if": { "properties": { "type": { "enum": ["claimed", "renewed"] } }, "required": ["type"] }, "then": { "required": ["epoch", "lease_id", "expires_at"] } },
+    { "if": { "properties": { "type": { "enum": ["checkpoint", "handoff", "stage_review_requested", "review_requested", "completed"] } }, "required": ["type"] }, "then": { "required": ["refs"] } },
+    { "if": { "properties": { "type": { "enum": ["handoff", "stage_review_requested"] } }, "required": ["type"] }, "then": { "required": ["summary", "next_stage"], "properties": { "summary": { "minLength": 1, "pattern": "\\S" } } } },
+    { "if": { "properties": { "type": { "const": "reviewed" } }, "required": ["type"] }, "then": { "required": ["decision"] } },
+    { "if": { "properties": { "type": { "const": "reopened" } }, "required": ["type"] }, "then": { "required": ["summary"], "properties": { "summary": { "minLength": 1, "pattern": "\\S" } } } }
+  ],
+  "$comment": "Runtime additionally verifies Ed25519 signatures, pinned team hash, event sequence, role/route/capacity, exact shared branch-tip SHA and state transitions. Manual desktop reservations have no lease and require manual continuation or cancellation. desktop_poll tasks use the claimed/renewed lease events and existing fencing; bound conversation IDs stay private, never in event fields or idempotency keys. Team policy v3 requires nonempty rejection feedback and a current expected_seq on human review writes; runtime checks these policy-dependent requirements."
+}

package/schemas/peer-task.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:peer-task:v2",
+  "title": "Codex Collab Peer Task v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "repo", "title", "base_branch", "acceptance", "workflow"],
+  "properties": {
+    "schema_version": { "const": 2 },
+    "id": { "type": "string", "pattern": "^T-[A-Z0-9-]{1,62}$" },
+    "repo": { "type": "string", "minLength": 1 },
+    "title": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "\\S" },
+    "description": { "type": "string", "maxLength": 4000 },
+    "base_branch": { "const": "main" },
+    "execution_mode": { "enum": ["desktop", "automatic", "desktop_poll"] },
+    "acceptance": { "type": "array", "minItems": 1, "maxItems": 32, "items": { "type": "string", "minLength": 1, "maxLength": 1000, "pattern": "\\S" } },
+    "workflow": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "type": "string", "pattern": "^[a-zA-Z0-9_-]{1,64}$" } },
+    "source": { "type": "object", "additionalProperties": false, "required": ["channel", "chat_id"], "properties": { "channel": { "const": "wecom" }, "chat_id": { "type": "string", "minLength": 1 } } }
+  },
+  "$comment": "Runtime additionally verifies repo identity and every workflow route against the pinned team policy. desktop_poll starts open and uses signed execution leases for existing-thread heartbeat workers; automatic SDK dispatch excludes that mode."
+}

package/schemas/task.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:task:v1",
+  "title": "Codex Collab Task v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "repo", "title", "base_branch", "acceptance"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "id": { "type": "string", "pattern": "^[A-Z][A-Z0-9-]{1,63}$" },
+    "repo": { "type": "string", "minLength": 1 },
+    "title": { "type": "string", "minLength": 1, "maxLength": 200 },
+    "description": { "type": "string" },
+    "base_branch": { "type": "string", "minLength": 1 },
+    "acceptance": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+    "source": { "type": "object", "additionalProperties": { "type": "string" } }
+  }
+}

package/schemas/team-enrollment.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:team-enrollment:v1",
+  "title": "Codex Collab Dual-Signed Enrollment Request v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "request_id",
+    "invite_id",
+    "agent_id",
+    "public_key",
+    "wecom_userid",
+    "chat_id",
+    "signature",
+    "invitation_signature"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "request_id": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "invite_id": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "agent_id": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+    },
+    "public_key": {
+      "type": "string",
+      "minLength": 1
+    },
+    "wecom_userid": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "minLength": 1,
+      "maxLength": 200
+    },
+    "chat_id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200
+    },
+    "signature": {
+      "type": "string",
+      "minLength": 1
+    },
+    "invitation_signature": {
+      "type": "string",
+      "minLength": 1
+    }
+  },
+  "$comment": "Runtime checks both member and invitation claim signatures, invite identity, allowed chat, expiry and userid semantics. Admin approval consumes invite_id once in a team version."
+}

package/schemas/team-invitation.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:team-invitation:v1",
+  "title": "Codex Collab Signed Member Invitation v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "invite_id",
+    "agent_id",
+    "capabilities",
+    "bot_id",
+    "chat_ids",
+    "commands_enabled",
+    "prefer",
+    "claim_public_key",
+    "expires_at",
+    "team_hash",
+    "actor_id",
+    "signature"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "invite_id": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$"
+    },
+    "agent_id": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+    },
+    "capabilities": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+      }
+    },
+    "bot_id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200
+    },
+    "chat_ids": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 200
+      }
+    },
+    "commands_enabled": {
+      "type": "boolean"
+    },
+    "prefer": {
+      "type": "boolean"
+    },
+    "claim_public_key": {
+      "type": "string",
+      "minLength": 1
+    },
+    "expires_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "team_hash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "actor_id": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+    },
+    "signature": {
+      "type": "string",
+      "minLength": 1
+    },
+    "owner_userid": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200,
+      "description": "Optional owner pinned to the issuing administrator for adding their own independent agent."
+    }
+  },
+  "$comment": "Runtime verifies administrator signature under team_hash, Ed25519 claim key, expiry, and conflicts with existing members or assignments. No bot Secret or private keys are allowed here. A self-owned invitation pins owner_userid to the issuing administrator; enrollment must prove the same account. Existing invitations without this optional field remain valid.",
+  "allOf": [
+    {
+      "if": {
+        "required": [
+          "owner_userid"
+        ]
+      },
+      "then": {
+        "properties": {
+          "commands_enabled": {
+            "const": true
+          }
+        }
+      }
+    }
+  ]
+}

package/schemas/team-policy.schema.json

@@ -0,0 +1,182 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:codex-collab:team-policy:v3",
+  "title": "Codex Collab Peer Team Policy v2/v3",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "schema_version",
+    "repo",
+    "default_route",
+    "reviewer",
+    "agents",
+    "routes",
+    "policy"
+  ],
+  "properties": {
+    "schema_version": {
+      "enum": [
+        2,
+        3
+      ]
+    },
+    "repo": {
+      "type": "string",
+      "minLength": 1
+    },
+    "default_route": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+    },
+    "reviewer": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+    },
+    "agents": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+      },
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": [
+          "role",
+          "capabilities",
+          "max_concurrent_tasks",
+          "public_key"
+        ],
+        "properties": {
+          "role": {
+            "enum": [
+              "admin",
+              "member"
+            ]
+          },
+          "capabilities": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+            }
+          },
+          "max_concurrent_tasks": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 16
+          },
+          "public_key": {
+            "type": "string",
+            "minLength": 1
+          },
+          "wecom_userid": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "routes": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+      },
+      "additionalProperties": {
+        "type": "array",
+        "minItems": 1,
+        "uniqueItems": true,
+        "items": {
+          "type": "string",
+          "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+        }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": [
+        "claim_timeout_ms",
+        "lease_ms",
+        "clock_skew_ms",
+        "max_attempts"
+      ],
+      "properties": {
+        "claim_timeout_ms": {
+          "type": "integer",
+          "minimum": 10,
+          "maximum": 3600000
+        },
+        "lease_ms": {
+          "type": "integer",
+          "minimum": 100,
+          "maximum": 3600000
+        },
+        "clock_skew_ms": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 60000
+        },
+        "max_attempts": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 20
+        }
+      }
+    },
+    "review_rules": {
+      "type": "object",
+      "propertyNames": {
+        "pattern": "^[a-zA-Z0-9_-]{1,64}$"
+      },
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "required",
+          "reviewer",
+          "notify"
+        ],
+        "properties": {
+          "required": {
+            "type": "boolean"
+          },
+          "reviewer": {
+            "type": "string",
+            "pattern": "^(owner|admin|member:[a-zA-Z0-9_-]{1,64})$"
+          },
+          "notify": {
+            "type": "string",
+            "pattern": "^(owner|reviewer|none|member:[a-zA-Z0-9_-]{1,64})$"
+          }
+        }
+      }
+    }
+  },
+  "$comment": "Runtime verifies distinct Ed25519 keys and valid owner IDs (several agents may share the same human owner), valid reviewer and route capabilities, and clock skew below half the lease. v3 requires a review rule for every route; specific members require a verified owner. v2 forbids review_rules so old clients cannot silently bypass gates.",
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "schema_version": {
+            "const": 3
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "review_rules"
+        ]
+      },
+      "else": {
+        "not": {
+          "required": [
+            "review_rules"
+          ]
+        }
+      }
+    }
+  ]
+}