export v0.1.8: session-scope-guard human-only three-channel ruling (#6617) + browser-debug nested OOPIF skill update

Align the shared workflow skill with Octopus pane agents: prefer the
user-visible pane, pre-arm dialogs, use f{seq}/e{n} frame refs, and
dual-leg highlight/locator tools.

.gitea/workflows/wake.yml

@@ -0,0 +1,37 @@
+# GENERATED by script/coord-init.sh — DO NOT EDIT BY HAND (machine-table-v1).
+# Regenerate: bash script/coord-init.sh --table <machine-table.tsv> --out <dir>
+# Cross-machine coordination wake channel — parameterized rendering of the
+# hand-written #6590 wake.yml (semantic parity: machine:<X> dual-shape label
+# guard + status= comment guard + from:<X>, per-machine runner label,
+# concurrency group with cancel-in-progress, constant local payload file).
+# Iron invariants (wiki rules/cross-machine-agent-ops §0): events contribute
+# TIMING only, never content — the payload is a constant file local to the
+# target machine; the workflow references no Gitea secret.
+name: wake
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+jobs:
+  wake:
+    if: |
+      (github.event_name == 'issues' &&
+        ((github.event.label != null && github.event.label.name == 'machine:wf-mac01') ||
+         (github.event.changes != null && contains(github.event.changes.added_labels.*.name, 'machine:wf-mac01')))) ||
+      (github.event_name == 'issue_comment' && startsWith(github.event.comment.body, 'status=') && contains(github.event.issue.labels.*.name, 'from:wf-mac01'))
+    runs-on: [self-hosted, wf-mac01]
+    concurrency:
+      group: wake-wf-mac01
+      cancel-in-progress: true
+    steps:
+      - name: wake local dispatcher via prompt_async (constant local payload)
+        # shell: default (POSIX runner)
+        run: |
+          curl -sS --fail-with-body --max-time 30 -X POST http://127.0.0.1:4097/prompt_async \
+            -H 'content-type: application/json' \
+            -d @/Users/zhusihong/workspaces/Octopus/octopus-coord-n06-external-verify/.n06-tmp/wf-4097/wake-payload-wf-mac01.json

core/adapters/gitea/patterns.md

@@ -138,31 +138,6 @@ curl -fsS -X PATCH "<gitea-base-url>/api/v1/repos/Octopus/octopus/issues/comment
 
 单评论聚合不变量（工件索引、当前状态表等）的执行手段。
 
-## Pattern 7: move-issue-to-column
-
-看板列迁移（Todo → In Progress → Review → Done）。projects/columns
-发现用 REST；「把工单移到列」的操作端点语义复杂，经 swagger 查询后
-调用，不臆造路径：
-
-```bash
-# 列出 repo 级 projects（projects 仅 repo 级，无 org/user 级端点）
-curl -fsS -H "Authorization: token <token>" \
-  "<gitea-base-url>/api/v1/repos/Octopus/octopus/projects"
-# 列某 project 的 columns
-curl -fsS -H "Authorization: token <token>" \
-  "<gitea-base-url>/api/v1/repos/Octopus/octopus/projects/{project_id}/columns"
-# 移动工单到列：先经 swagger.v1.json 查询 projects 相关端点后调用
-curl -s <gitea-base-url>/swagger.v1.json -o /tmp/gitea-sw.json
-jq -r '.paths | keys[]' /tmp/gitea-sw.json | grep projects
-```
-
-## Pattern 7.5: move-issue-to-pipeline-stage
-
-管线阶段板列（Pipeline Stages board column）承载阶段迁移——阶段转移
-落到板列，**不落** `## 当前状态` 行（该表只承载 PR / 评审 / CI 行与
-非阶段阻塞项）。列序列按管线阶段定义；移动与 Pattern 7 同款
-（projects/columns 经 REST + swagger 发现，同上）。
-
 ## Pattern 8: post-commit-status
 
 commit status 直发 REST（评审综合的 Tier-2 落点）：
@@ -183,22 +158,6 @@ context 公式：`pipeline/review-{stage}`（`code` / `review-dag` /
 `audit-process`）。token 从实例配置读取（此处 `<token>` 占位）。
 merge 前读回验证：`GET /commits/{PR_SHA}/status`。
 
-## Pattern 9: create-iteration-board
-
-```bash
-# 建 project（board）：先经 swagger 查询 create 端点契约
-curl -s <gitea-base-url>/swagger.v1.json -o /tmp/gitea-sw.json
-jq '.paths["/repos/{owner}/{repo}/projects"].post' /tmp/gitea-sw.json
-# 随后 POST 建板（title="{slug} — Iteration {N}", description="…"）
-# 再对每列（Todo / In Progress / Review / Done）：
-jq '.paths["/repos/{owner}/{repo}/projects/{project_id}/columns"].post' /tmp/gitea-sw.json
-# 随后 POST 建列
-```
-
-projects 仅 repo 级。DAG 聚合 agent 在单门 PASS 后建板；工单正文模板带
-`## Node Reference`（指向 `{epic-slug}/dag`）、`## Acceptance Criteria`、
-`## Parent`。
-
 ## Pattern 10: artifact-index（工单 ↔ 工件索引）
 
 技能发布工件后，在源工单维护 **`## 工件索引` 评论**——单一原位编辑的

core/adapters/gitea/reading.md

@@ -80,7 +80,7 @@ curl -fsS -H "Authorization: token <token>" \
 
 ## Pattern 4: read-project-column-issues
 
-看板列工单队列。project/column 发现：
+看板列工单队列（只读）。project/column 发现：
 
 ```
 curl -fsS -H "Authorization: token <token>" \
@@ -89,9 +89,7 @@ curl -fsS -H "Authorization: token <token>" \
   "<gitea-base-url>/api/v1/repos/Octopus/octopus/projects/{project_id}/columns"
 ```
 
-「把工单移到列」等复杂操作：经 `swagger.v1.json`
+projects 仅 repo 级（无 org/user 级端点）。
-（`jq '.paths | keys[]' | grep projects`）查询 projects 相关端点后调用，
-不要臆造具体端点路径。projects 仅 repo 级（无 org/user 级端点）。
 
 ## Pattern 5: read-review-status（CLI）
 

core/checklists/release.md

@@ -74,3 +74,24 @@
 | 6.1 | Tagged commit 可构建                | ☐    | ☐      |      |
 | 6.2 | 测试全部通过                        | ☐    | ☐      |      |
 | 6.3 | 回到了原始分支                      | ☐    | ☐      |      |
+
+---
+
+## 7. 产物发布（DIST — Artifact Distribution，octopus 项目）
+
+> 对应 `.octopus/skills/release/SKILL.md` Phase 4b（#2003 退役 CI publish
+> 管线后的手工发布流程）。**主仓库 tag + release 对象 ≠ 发布完成**——CLI
+> 二进制、公开镜像、桌面 feed 三层外圈全部就位才算。本清单从磁盘读取，
+> 作为技能注入被截断时的兜底事实源（v0.25.0 发布时技能注入截断恰好切掉
+> Phase 4b，导致外圈整层遗漏——本节由此设立）。
+
+| #   | 检查项                                   | 通过 | 不通过 | 备注 |
+| --- | ---------------------------------------- | ---- | ------ | ---- |
+| 7.1 | 12 平台 CLI 二进制已构建（tag 的干净 checkout，`bun packages/octopus/script/build.ts`），全部 smoke test 输出版本号 | ☐ | ☐ | Windows 无 `python3` 命令，zip 归档需垫 shim 或手动补齐 |
+| 7.2 | 12 个归档已挂到主仓库 release（zip×6 + tar.gz×6） | ☐ | ☐ | |
+| 7.3 | （可选，Gitea-only 口径可跳过）npm/docker/AUR 外部 registry 已发或明确跳过 | ☐ | ☐ | `OCTOPUS_GITEA_ONLY=true` |
+| 7.4 | `sync-public-assets.sh` 已跑：公共镜像 `Octopus/octopus-release` 的 `v{version}` release 有 12 资产 | ☐ | ☐ | 大 POST 出站不通时经服务器 localhost 中继 |
+| 7.5 | `sync-public-install.sh` 已跑：install/install.ps1/README 同步到镜像 main（注意 cp 目标是**根 README.md**，不是 scripts/ 副本） | ☐ | ☐ | |
+| 7.6 | `verify-public-sync.sh` PASSED | ☐ | ☐ | |
+| 7.7 | Desktop feed 三腿已派发（mac 走 `desktop-mac.yml` dispatch；win/linux 各一次 `desktop-feed.yml` dispatch），`bun packages/desktop/script/verify-feed.ts --version <ver> --channel <beta|prod>` PASS（三平台 yml 全量校验：`latest.yml`/`latest-linux.yml`/`latest-mac.yml` 的 `version:` == CLI 版本 + size 对资产逐项核对 + 匿名可达） | ☐ | ☐ | #6378 起以 verify-feed.ts 为准（v0.31.0 漏腿事故 #6375 的 fail-loud 补丁）；concurrency 组已按 platform 分离；stable 通道 feed 缺失见 #6376 |
+| 7.8 | README 下载链接抽查（install 脚本 raw、资产直链、docs 相对链接）匿名可达 | ☐ | ☐ | v0.18 遗留 wiki 坏链由此发现 |

core/rules/issue-checklist-sync.md

@@ -46,9 +46,9 @@ Rules:
   surfaced by checklist annotations alone — do NOT add live-status rows for
   them. PR / review / CI transitions carry BOTH a checklist annotation AND
   a live-status row.
-- **Stage rows live on the board, not here**: pipeline stage transitions are
+- **No stage rows here**: pipeline stage transitions are NOT represented by
-  represented by the Pipeline Stages board column (shared write-patterns
+  `## 当前状态` rows — they surface through checklist annotations at skill
-  Pattern 7.5), NOT by `## 当前状态` rows. Keep only the
+  exits. Keep only the
   status-sync-automated rows (PR / 代码评审 / CI) and non-stage
   blockers/deferrals.
 - Update in place (same section heading `## 当前状态`), never append a second copy.

core/rules/session-scope-guard.md

@@ -84,6 +84,19 @@ and the provision wrapper (adds the worktree + Tier-1 runs scaffold). The
 manual 3-step is the fallback where the scripts are unavailable, same
 re-verification.
 
+**Human-only tickets ([org-internal #6617]-P1).** A ticket marked
+human-only in ANY of three machine-readable forms — title `[人工执行]`
+(ASCII/【】 fullwidth variants), label `executor/human-only`, or a body
+line `executor: human` / `executor: human-only` (line-anchored,
+blockquote-tolerant) — is NOT claimable by an agent: the claim script
+refuses (exit 4, stage=precheck; takeover mode too — taking over a dead
+claim is not taking over execution rights). The title channel keeps the
+`--allow-human-only` override (explicit human instruction only, visible in
+the invoking transcript); the label/body channels have NO override — an
+explicit marker is a hard refusal for agents ([org-internal #6617] merged
+ruling). Never claim, execute, self-accept or close such a ticket on agent
+initiative.
+
 **Merge-time equivalence check.** Before merging, scan the remote main
 branch's recent commits for `#<ticket>` — surfacing an equivalent
 implementation already on main *before* the merge rejection.

core/schemas/reviewer-output.schema.json

@@ -31,6 +31,7 @@
     },
     "quantitative_summary": {
       "type": "object",
+      "description": "Every check the reviewer executed this round (PASS and FAIL counted in total_checks; NA reported via na_count). The verdict field must follow these counts per the thresholds documented on verdict — a synthesis consumer recalculates pass_rate from passed/total_checks and treats a mismatch as a malformed artifact.",
       "required": ["total_checks", "passed", "failed", "pass_rate"],
       "properties": {
         "total_checks": { "type": "integer", "minimum": 1 },
@@ -74,7 +75,8 @@
           },
           "severity": {
             "type": "string",
-            "enum": ["BLOCKER", "MAJOR", "MINOR", "INFO"]
+            "enum": ["BLOCKER", "MAJOR", "MINOR", "INFO"],
+            "description": "BLOCKER: breaks an acceptance criterion, hangs/leaks, or opens an abuse channel — the artifact must not land as-is. MAJOR: a real defect on a non-blocking path, or a test/lock blind to a plausible regression (a mutation would escape). MINOR: quality/drift issue with a cheap local fix (naming, duplication, small docs gap); no behavioral risk. INFO: observation, accepted-risk note, or follow-up ticket material — no action required this round. Calibration rule: severity grades the FINDING's impact, not the reviewer's confidence; low-confidence suspicions go to INFO with the evidence, never inflated to MAJOR."
           },
           "checklist_ref": {
             "type": "string",

core/skills/_shared/review-pipeline-phases.md

@@ -41,11 +41,6 @@ in `_shared/gitea-write-patterns.md`.
 
 **Orchestrator actions**:
 
-0. **Move the source issue to the `review` column** on the Pipeline Stages
-   board per `_shared/gitea-write-patterns.md` Pattern 7.5. Skip if no
-   source issue exists. The review stage is a single board column covering
-   all review targets (DAG single gate / code review / audit-process).
-
 0.5. **Initialize the review-status file** (round 1 only). The Orchestrator
    creates `<runs-root>/{slug}/reviews/{stage}/status.json` before dispatching
    round 1, with the full schema-required field set
@@ -111,6 +106,13 @@ in `_shared/gitea-write-patterns.md`.
      `core/skills/_shared/review-orchestrator-rules.md` — Default
      Explorer Permissions).
    - Temperature: 0.1 (deterministic output).
+   - StructuredOutput mount ([org-internal #5658]): pass `format: { type:
+     "json_schema", schema: <the reviewer-output.schema.json contents you
+     read at prompt build time> }` on the task dispatch — the reviewer's
+     final emission is schema-enforced (malformed verdict/severity/summary
+     args are rejected with field-path repair feedback inside the reviewer's
+     own loop). The findings FILE remains the canonical Tier-1 artifact; the
+     structured output mirrors it as a self-check.
 
 4. Wait for all {REVIEWER_OR_AUDITOR}s to complete. Each reviewer writes its
    dimension result to the skill's configured findings sink:
@@ -171,6 +173,11 @@ in `_shared/gitea-write-patterns.md`.
      `tier1-local` skills; `/tmp/octopus/...` for `tier2-comment` skills)
    - `permissions`: read + write + edit + bash + glob + grep (all allow)
    - `temperature`: 0.1
+   - `format` ([org-internal #5658]): `{ type: "json_schema", schema: <the
+     synthesis.schema.json contents you read> }` — the Synthesizer's final
+     emission is schema-enforced (malformed verdict/dimension args rejected
+     with field-path repair feedback in-loop). The posted fenced JSON block
+     remains the canonical artifact; the structured output mirrors it.
    - Foreground (the Orchestrator waits for completion).
 
 3. The Synthesizer:

core/skills/_shared/review-reviewer-prompt.md

@@ -32,6 +32,18 @@ Label: {DIMENSION_NAME}
 
 ## Instructions
 
+### Gate records are deterministic inputs ([org-internal #5656] N-04)
+
+When the work item carries gate records (`gate` tool results — metadata
+`exit_code`, `duration_ms`, `ci_run_id`), those records ARE the command
+outcomes for mechanical questions (tests/typecheck/lint): cite the exit code
+verbatim (`gate <id> (<tier>): exit_code=<n> -> green|red` — canonical block
+in `packages/octopus/src/gate/consume.ts`) and never substitute a model's
+narration of command output. A claim that disagrees with a record's
+exit_code is a finding (record wins); a mechanical claim with no record is
+unverifiable — request the citation. A green verdict-cache hit
+(`metadata.verdict_cache.key`) counts the same as a fresh run.
+
 {READ_FIRST_STEPS}
 4. For each checklist item, determine whether the {ARTIFACT_NOUN} satisfies it.
    Every checklist item must receive a PASS or FAIL verdict.
@@ -46,6 +58,21 @@ Label: {DIMENSION_NAME}
    (reviewer_count > 1), use the slot-prefixed form {DIM}R{k}-F{NNN} with your
    1-based slot k (e.g. TOPOR1-F001) so parallel slot files never collide on id.
 {CONTRADICTION_RULE}
+6b. Code graph availability (worktree sessions): if `codegraph_status` is
+   unavailable or reports no index for the tree under review (typical when
+   reviewing from a session worktree whose per-worktree `.codegraph/` index
+   has not finished building — see `<instance-root>/rules/code-graph.md`), do NOT
+   silently substitute grep+read for structural questions ("who calls /
+   what depends on / where defined"). Instead:
+   - For symbols on the MAIN branch side (baselines, design refs, cross-session
+     frozen contracts), you MAY query the main checkout's index (path given in
+     your dispatch preamble) and cite `main:<path>:<line>`.
+   - If no index is reachable at all, mark the affected checklist items NA
+     with reason "codegraph unavailable — structural check degraded to grep"
+     and emit one INFO finding (id `{DIM}-F001`-style, in your dimension's own
+     code) recording the degradation, so the Synthesizer can surface it.
+   Findings derived purely from grep+read when a graph query was required are
+   treated as low-confidence and may be waived in synthesis.
 7. Assign severity strictly:
 {SEVERITY_DEFINITIONS}
 8. Count every PASS and FAIL. Compute pass_rate = passed / total_checks.

core/skills/_shared/roles/coordinator.yaml

@@ -1,4 +1,4 @@
-> Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
+# > Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
 name: Coordinator
 purpose: >
   Pool dispatch coordinator (billing-v2 [org-internal #4041] §7, REQ-F-012): a wake-driven,

core/skills/_shared/roles/producer.yaml

@@ -1,4 +1,4 @@
-> Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
+# > Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
 name: Producer
 purpose: >
   Write production artifacts — requirements, design, plans, code, fixes,

core/skills/_shared/roles/reviewer.yaml

@@ -1,4 +1,4 @@
-> Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
+# > Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
 name: Reviewer
 purpose: >
   Review one dimension of an artifact against its checklist, read-only.

core/skills/_shared/roles/tool.yaml

@@ -1,4 +1,4 @@
-> Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
+# > Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
 name: Tool
 purpose: >
   Specialized tool agent for image interpretation and other vision/utility

core/skills/_shared/roles/verifier.yaml

@@ -1,4 +1,4 @@
-> Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
+# > Core 中立版（Increment 6a 改写，原 deferHard verbatim）。编号与条目结构严格不变（C-2 不变量）；实例术语按 `core/adapters/TERMINOLOGY.md` 绑定。
 name: Verifier
 purpose: >
   Run the iteration's DoD matrix, integration tests, NFR validation, and

core/skills/_shared/synthesis_task.md

@@ -198,6 +198,14 @@
 - **Rule 4 — Aggregation, not reinterpretation**: You MUST NOT soften, rephrase,
   or downgrade reviewer findings. If a reviewer writes "BLOCKER", it stays
   "BLOCKER" in synthesis.
+
+1c. **Pass-rate recalc post-check (MANDATORY, [org-internal #5658])**: for
+   every dimension, recompute `pass_rate = passed / total_checks` from its
+   `quantitative_summary` and compare with the reported value. On a mismatch:
+   keep the raw file unchanged, use the RECOMPUTED value in the synthesis
+   digest, and note the mismatch — a reviewer-output whose `pass_rate` does
+   not match its own counts is a malformed artifact (the schema description
+   says exactly this; this step is the enforcement).
 - **Rule 5 — Anonymous findings preservation**: If two reviewers independently
   flag the same issue from different dimensions, preserve both entries. Do not
   deduplicate by discarding one — cross-dimension agreement is itself a signal.
@@ -209,6 +217,11 @@
 Return ONLY this summary as your final message. Do NOT include the full
 synthesis JSON — it is already posted to the pipeline PR / source issue
 comment (for audit-process runs, the wiki page `audit/{date}/round{N}/synthesis`).
+
+When your dispatch carries `format` (StructuredOutput mount, [org-internal
+[org-internal #5658]]): the structured output is the MIRROR self-check of this summary (same
+schema, schema-enforced), not a second artifact — the posted fenced JSON block
+and this summary remain canonical.
 Persist this summary verbatim to
 `<runs-root>/{slug}/reviews/{stage}/round{N}/synthesis-return.md` before
 returning (step 9 above — worker-report persistence [org-internal #2847]).

core/skills/browser-debug/SKILL.md

@@ -1,21 +1,33 @@
 ---
 name: browser-debug
 description: >
-  Use ONLY when an agent needs to interact with a live browser to debug, verify,
+  Use ONLY when an agent must interact with a live browser to debug, verify,
-  or iterate on Web UI work in packages/app — navigate to the dev server, snapshot
+  or iterate on Web UI work in packages/app. Triggers on UI bugs, visual
-  the DOM/accessibility tree, capture console and network errors, screenshot
+  regressions, layout/positioning issues, keyboard-focus problems,
-  component states, and exercise user flows end-to-end. Triggers on UI bugs,
+  console-error reports, and any "open the page and check X" task. Uses the
-  visual regressions, layout/positioning issues, keyboard-focus problems,
+  built-in unified browser tool surface (browser_open, browser_snapshot,
-  console-error reports, and any "open the page and check X" task. Loads the
+  browser_take_screenshot, browser_console_messages, browser_evaluate,
-  Playwright MCP toolset (browser_navigate, browser_snapshot,
+  browser_close) — contract shared/browser-tool-surface-v1 ([org-internal #4972]); the
-  browser_take_screenshot, browser_console_messages, browser_evaluate, etc.).
+  playwright MCP server is retired ([org-internal #4977]). Use ONLY for interactive browser
-  Use ONLY for interactive browser work; for writing Playwright *test files*
+  work; for writing Playwright *test files* use the existing e2e/ suites under
-  use the existing e2e/ suites under packages/app, not this skill.
+  packages/app, not this skill.
+tools:
+  - browser_open
+  - browser_close
+  - browser_snapshot
+  - browser_console_messages
+  - browser_take_screenshot
+  - browser_evaluate
+  - browser_click
+  - browser_type
+  - browser_act_batch
+  - browser_handle_dialog
+  - browser_highlight
+  - browser_generate_locator
 triggers:
   - browser debug
   - open the page
   - check the page
-  - screenshot the
   - inspect element
   - console error
   - visual bug
@@ -26,8 +38,6 @@ triggers:
   - tab order
   - 浏览器调试
   - 打开页面
-  - 截图
-  - 视觉
   - 布局错乱
   - 对齐
   - 焦点
@@ -36,13 +46,15 @@ role: Producer
 ---
 
 > Core 中立版（Increment 6a 改写，原 deferHard verbatimDir）。机制、结构与 frontmatter 保持；实例术语（工具名、路径、工单号）按 `core/adapters/TERMINOLOGY.md` 绑定到具体实例。
-
 # Browser Debug
 
 Interactive browser automation for Web UI work in `packages/app`. This skill
-teaches the *recipe* for driving the Playwright MCP toolset — when to reach
+teaches the *recipe* for driving the unified browser tool surface — when to
-for it, which tool for which job, and how to capture evidence a reviewer can
+reach for it, which tool for which job, and how to capture evidence a reviewer
-trust.
+can trust. The former playwright MCP server is retired ([org-internal #4977], Epic [org-internal #4972]
+N-05); the tools below are built-in and mount into the session tool face
+when this skill activates (default-off the LLM face for weight economy,
+[org-internal #5131]) — a user-configured tools_exclude vetoes the mounts.
 
 ## When this skill applies
 
@@ -68,65 +80,90 @@ Do **not** reach for it when:
 
 ## Preconditions
 
-1. **Playwright MCP is configured.** The project `octopus.jsonc` carries a
+1. **Unified browser tools are built-in and skill-mounted.** `browser_open`,
-   `mcp.playwright` block launching `@playwright/mcp`. If the MCP tools are
+   `browser_snapshot`, `browser_console_messages`, `browser_take_screenshot`,
-   not visible, run `/kickoff` or follow the `codegraph-setup` skill's
+   `browser_evaluate`, and `browser_close` are registered for every session
-   recipe (the closest analog for debugging missing MCP servers).
+   (no MCP server needed) but default-off the LLM face — activating this skill
+   mounts them onto the session tool face ([org-internal #5131]); a user tools_exclude
+   vetoes the mounts
+   config needed (the playwright MCP is retired, [org-internal #4977]). If the tools are
+   not visible, the session runs a pre-[org-internal #4972] build — update.
 2. **Dev server is running.** The app under test must be reachable. For
-    `packages/app`, run `bash script/dev-fresh.sh --full` for the dev server
+   `packages/app`, run `bash script/dev-fresh.sh --full` for the dev server
-    (Windows workstations: `bash script/dev-fresh-windows.sh` — dev-fresh.sh's
+   (Windows workstations: `bash script/dev-fresh-windows.sh` — dev-fresh.sh's
-    stop path depends on setsid/ss, silently ineffective under Git Bash; see
+   stop path depends on setsid/ss, silently ineffective under Git Bash; see
-    local-workstation-quirks.md §5);
+   local-workstation-quirks.md §5);
-    frontend is at `http://localhost:4444` and backend at `http://localhost:4096`
+   frontend is at `http://localhost:4444` and backend at `http://localhost:4096`
-    (see AGENTS.md Dev services section).
+   (see AGENTS.md Dev services section).
-3. **Chromium is installed.** First run of `@playwright/mcp` downloads it
+3. **Chromium is installed.** The headless backend drives an isolated
-   automatically; if the tool reports a missing browser, run
+   Chromium; if a tool reports a missing browser, run
    `bunx playwright install chromium` once in any shell.
 
 ## Tool selection recipe
 
-The Playwright MCP exposes many tools. Pick by *what you need to observe*,
+The unified surface exposes focused read/navigation tools. Pick by *what you
-not by familiarity:
+need to observe*, not by familiarity. Cost discipline applies: the snapshot
+answers structure/state questions, the screenshot only visual ones — take
+both in one cycle only when a visual verdict is itself the deliverable:
 
 | Need | Tool | Why |
 | --- | --- | --- |
-| Open a URL | `browser_navigate` | Always the first call. |
+| Open a URL | `browser_open` | Always the first call (opens the user-visible browser pane / isolated browser). Pass `surface: "headless"` when the intent is headless — the user's pane is never touched (no confirmation bar, no pane binding) and later browser_* tools operate on the isolated headless copy; if already bound to the pane, `browser_pane_release` first. |
 | See the page structure (roles, names) | `browser_snapshot` | Returns the accessibility tree — stable across CSS refactors. Prefer this over `browser_take_screenshot` when asserting "does element X exist / is it labelled Y?". |
-| See the page *visually* | `browser_take_screenshot` | For layout, spacing, color, overflow. Attach the PNG to your report. |
+| See the page *visually* | `browser_take_screenshot` | For layout, spacing, color, overflow. Attach the PNG to your report. **Vision-model guard (#screenshot-guard):** the PNG is pixels, not text — a session model without vision CANNOT read it. If YOU cannot see images, you must delegate reading via `Task(role: "Tool")` per the `image-interpret` skill (returns a structured text spec); never attempt to interpret the PNG yourself. Pixel questions → image-interpret; DOM/state questions → `browser_evaluate`. |
 | Read console errors / warnings | `browser_console_messages` | Filter by level (`error`, `warn`). The first stop for any "page is blank" bug. |
-| Read failed network calls | `browser_network_requests` | Locate 4xx/5xx, CORS failures, hanging fetches. |
-| Click, type, hover, select | `browser_click`, `browser_type`, `browser_hover`, `browser_select_option` | Drive the flow. Always `browser_snapshot` first to get the `ref` for the target element. |
 | Assert computed style / DOM state | `browser_evaluate` | Last resort. Snapshots cover 90%; reach for `evaluate` only when you need `getComputedStyle`, scroll positions, or arbitrary JS state. |
-| Keyboard navigation | `browser_press_key` | For tab order, focus rings, escape-to-close. |
+| Close the session | `browser_close` | Tear down when done; see the session cleanup section. |
-| Record a video / trace | `browser_start_tracing`, `browser_stop_tracing` | Heavy; use only when a bug is timing-sensitive and console+snapshot can't catch it. |
+
+
+## Pane-first recipe (prefer over headless)
+
+Default to the **user-visible browser pane** unless the task explicitly needs
+an isolated headless Chromium (`surface: "headless"`). Pane agents now match
+or exceed Playwright for the hard cases:
+
+| Need | Pane tool / pattern | Notes |
+| --- | --- | --- |
+| Open / bind pane | `browser_open` (default surface) | Never touch the user's pane from a headless-only intent — pass `surface: "headless"` or `browser_pane_release` first. |
+| Structure + refs | `browser_snapshot` | Open shadow is pierced; closed shadow is CDP-merged (`closedShadow:true`, no `e<n>`). Cross-origin iframes expose `f{seq}/e{n}` synthetic refs — prefer those over attr ids when acting into child frames. Closed hosts inside stitched OOPIF subtrees carry `closedShadow:true` (CDP merge after stitch). |
+| Act (click/type/…) | `browser_click` / `browser_type` / `browser_act_batch` | Locators (`role=` / `text=` / …) walk open shadow; after a JS miss, pane CDP pierces **closed** shadow for locate/wait/scroll (nested closed-in-open + same-origin iframe contentDocument + cross-origin OOPIF via Target.attachToTarget, including nested OOPIF-in-OOPIF host-offset chains; `DOM.focus` for type). `css=` stays light-DOM. Cross-origin click/type route through CDP trusted events. |
+| Native dialogs | `browser_handle_dialog` **before** the act | Prefer `mode: "arm"` (or `act_batch.dialog_prearm`) so the pane parks the answer before the click that opens confirm/prompt — avoids the 1.5s auto-dismiss / widget-cancel race. Bind with `messageIncludes` when the page can raise multiple dialogs. Call `mode: "disarm"` if the trigger was cancelled. |
+| Highlight / locator | `browser_highlight`, `browser_generate_locator` | Dual-leg: both pane and headless. Use highlight to confirm the ref before a write. |
+| Failure recovery | re-snapshot + path candidates | Act/locator failures may return `pathCandidates` (frame/shadow path hints). Heal scores framePath so sibling iframes do not auto-heal across frames. |
+
+Headless remains the right tool for parallel CI-style isolation and when the
+user must not see the session. For interactive debug of `packages/app`, stay
+on the pane.
 
 ## Standard recipe — reproduce a UI bug
 
 Follow these steps in order. Do not skip the snapshot step: the `ref` it
 returns is the stable handle every subsequent tool needs.
 
-1. `browser_navigate` to the page where the bug lives.
+1. `browser_open` the page where the bug lives.
 2. `browser_console_messages` — record any errors *before* touching anything.
    Many "interaction bugs" are actually load-time errors.
-3. `browser_snapshot` — locate the target element; capture its `ref` and
+3. `browser_snapshot` — locate the target element; capture its accessible
-   accessible name.
+   name.
-4. Drive the interaction with `browser_click` / `browser_type` /
+4. If the reproduction needs interaction beyond reading, use
-   `browser_press_key` until the bug reproduces.
+   `browser_evaluate` sparingly to probe state — the unified surface is
-5. Re-read `browser_console_messages` and `browser_network_requests` —
+   read-focused; drive deep flows via the e2e suites when needed.
-   capture the *delta* introduced by the interaction.
+5. Re-read `browser_console_messages` — capture the *delta* introduced by
+   the interaction / page state.
 6. `browser_take_screenshot` (or a second `browser_snapshot`) to freeze the
    broken state.
-7. Report: URL, the minimal interaction sequence, console delta, network
+7. Report: URL, the observation sequence, console delta, screenshot, and the
-   delta, screenshot, and the suspected component path in
+   suspected component path in `packages/app/src/...`.
-   `packages/app/src/...`.
 
 ## Standard recipe — verify a UI fix
 
-1. `browser_navigate` to the affected page.
+1. `browser_open` the affected page.
 2. `browser_snapshot` — confirm the fixed element is present with the
    expected accessible name.
-3. `browser_take_screenshot` — full page **and** element-cropped if the fix
+3. `browser_take_screenshot` — only when the fix is visual (layout, styling,
-   is local.
+   rendering); full page **and** element-cropped if the fix is local. For
+   non-visual fixes (logic, state, wiring) the snapshot plus console delta is
+   the evidence — skip the screenshot.
 4. If the fix touched layout, `browser_evaluate` a `getBoundingClientRect()`
    or `getComputedStyle()` on the key node and paste the value into your
    report. Numbers beat adjectives.
@@ -150,7 +187,7 @@ When a `verify` work item has an E2E or UI DoD entry:
    reference (UI-touching PRs, `verify` skill Phase 2.7 / contract
    `browser-evidence-4486/shared/evidence-ref-v1`), promote the captures
    into an evidence pack first — feed COPIES through
-   `writeEvidencePack` (`<harness-package>/src/browser/evidence-pack.ts`,
+   `writeEvidencePack` (`packages/octopus/src/browser/evidence-pack.ts`,
    the single mandatory sanitize boundary; the `.playwright-mcp/` layer
    keeps its current semantics, additive not replaced) and cite the pack
    directory. Evidence ladder: raw capture → `.playwright-mcp/` working
@@ -163,9 +200,9 @@ When a `verify` work item has an E2E or UI DoD entry:
 | --- | --- |
 | "The unit test already covers it." | Unit tests assert component logic, not what Chromium actually renders. Visual and focus bugs live in the gap. |
 | "I can tell from the JSX that it's aligned." | Computed layout depends on parent containers, fonts, and viewport. Screenshot the real page. |
-| "Browser automation is overkill for a small change." | A `browser_navigate` + `browser_take_screenshot` pair is ~2 seconds. The cost is in *not* looking. |
+| "Browser automation is overkill for a small change." | A `browser_open` + `browser_snapshot` read is ~2 seconds — cheap. The cost is in *not* looking; add the screenshot only where the question is visual. |
 | "I'll just run the whole e2e suite." | The suite answers "did anything break?" — it does not answer "does this specific change look right?". |
-| "Snapshot is enough, skip the screenshot." | Accessibility trees hide overflow, clipping, and z-index bugs. Take both for visual changes. |
+| "Snapshot is enough, skip the screenshot." | Depends on the claim. For a visual change it is backwards — accessibility trees hide overflow, clipping, and z-index bugs, so take the screenshot too. For a non-visual claim (presence, label, state) the snapshot alone IS the observation; don't pad it with pixels. |
 
 ## Boundaries
 
@@ -184,18 +221,12 @@ When a `verify` work item has an E2E or UI DoD entry:
 
 ## Session cleanup (mandatory)
 
-A Playwright MCP browser is a real Chrome with a `/tmp` user-data-dir — its
+The unified surface's isolated backend is a real Chrome with a `/tmp`
-mode follows `mcp.playwright.headless` (`headless-field-v1`, [org-internal #4393]): the repo
+user-data-dir. It stays alive as long as its parent octopus backend runs.
-default `auto` spawns headed on desktop (win32/darwin; linux only with
+When a browser-debug session ends without an explicit `browser_close`, OR the
-DISPLAY/WAYLAND_DISPLAY set) and headless otherwise; an explicit `true`/`false`
+octopus session times out mid-task, the Chrome is orphaned and accumulates
-or `OCTOPUS_MCP_HEADLESS=1|0` pins it. The mode is fixed per new session —
+across sessions — burning CPU and leaving dead profile dirs (issue [org-internal #1315]); in
-switching the config does not hot-switch a running browser. It
+headed mode the orphan is a visible stray window.
-stays alive as long as its MCP server runs, and the MCP server stays alive as
-long as its parent octopus backend runs. When a browser-debug session ends
-without an explicit `browser_close`, OR the octopus session times out mid-task,
-the Chrome + its MCP server are orphaned and accumulate across sessions —
-burning CPU and leaving dead profile dirs (issue [org-internal #1315]); in headed mode the
-orphan is a visible stray window.
 
 **Iron rule: every browser-debug session MUST close its browser before ending.**
 
@@ -217,19 +248,16 @@ orphan is a visible stray window.
 
 **Why this matters:** a single forgotten `browser_close` leaves a Chrome
 subtree (8+ processes) running indefinitely. Over days this is hundreds of
-orphaned processes and wasted CPU. The MCP server does not auto-close its
+orphaned processes and wasted CPU. Only an explicit `browser_close` (or
-browser on disconnect — only an explicit `browser_close` (or process reaping)
+process reaping) releases it.
-releases it.
 
 ## Screenshot output paths
 
-The Playwright MCP server is launched WITHOUT `--output-dir` (see
+Screenshots from `browser_take_screenshot` land in `.playwright-mcp/` in the
-`octopus.jsonc` → `mcp.playwright.command`): its default output location is
+process cwd (the worktree root), gitignored. An explicit `filename` can
-`.playwright-mcp/` in the process cwd (the worktree root), gitignored and
+resolve against the cwd and drop the PNG into the repo root, where the
-auto-evicted at 100 MB via `--output-max-size`. Auto-named output (no
+`/*.png` gitignore backstop hides it from `git status` and nothing ever
-`filename`) lands there — but an explicit `filename` can resolve against the
+cleans it up.
-cwd and drop the PNG into the repo root, where the `/*.png` gitignore
-backstop hides it from `git status` and nothing ever cleans it up.
 
 **Iron rule: 截图文件名必须写进 `.playwright-mcp/`。** Every `filename`
 passed to `browser_take_screenshot` (or any tool that writes a file) MUST
@@ -262,10 +290,10 @@ Two valid destinations for screenshots, by purpose:
    octopus UI. The endpoint exists but has returned 500 on this instance;
    verify before relying on it.
 3. **Publish to the wiki evidence namespace `{slug}/verify/evidence/{name}`
-   via `wiki 读写 API（见 TERMINOLOGY）`** — last resort only, when no other channel
+   via git direct-push to `octopus.wiki.git` (`_shared/gitea-write-patterns.md` top-of-file, [org-internal #6180])** — last resort only, when no other channel
    works AND the evidence must outlive the worktree (this is the same durable
    channel `verify` mandates for DoD evidence entries — see
-   `core/skills/verify/SKILL.md` References). Keep it small:
+   `.octopus/skills/verify/SKILL.md` References). Keep it small:
    ≤5 images per PR, each ≤200KB (compress/downscale, prefer element
    crops over full-page).
 
@@ -283,13 +311,19 @@ prefix is the real fix; rely on that, not on the backstop.
 
 ## References
 
-- `core/skills/frontend/SKILL.md` — where UI changes are planned; invoke
+- `.octopus/skills/image-interpret/SKILL.md` — REQUIRED when the session model
+  has no vision: `browser_take_screenshot` writes a PNG the driving model
+  cannot read. Delegate reading via `Task(role: "Tool")` (structured text spec
+  back); never self-interpret pixel content. Pixel questions (layout, color,
+  spacing) → image-interpret; DOM/state questions (form values, validation) →
+  `browser_evaluate`.
+- `.octopus/skills/frontend/SKILL.md` — where UI changes are planned; invoke
   this skill during Phase 3 / Phase 4 to verify each state visually.
-- `core/skills/implement/SKILL.md` — Frontend Mode; pair with
+- `.octopus/skills/implement/SKILL.md` — Frontend Mode; pair with
   `browser-debug` when the work item touches rendering.
-- `core/skills/implement/SKILL.md` (Mode: bugfix) — Phase 1 reproduction; use this skill
+- `.octopus/skills/implement/SKILL.md` (Mode: bugfix) — Phase 1 reproduction; use this skill
   to capture the failing state before isolating root cause.
-- `core/skills/verify/SKILL.md` — Phase 2 / DoD matrix; use this skill
+- `.octopus/skills/verify/SKILL.md` — Phase 2 / DoD matrix; use this skill
   to generate screenshot evidence for UI-tagged DoD entries.
 - `packages/app/e2e/` — permanent Playwright test suites; this skill is the
   ad-hoc complement, not a replacement.

core/skills/codegraph-setup/SKILL.md

@@ -1,33 +1,14 @@
 ---
 name: codegraph-setup
 description: >
-  Use ONLY when installing, configuring, initializing, or troubleshooting CodeGraph
+  Use ONLY when installing, configuring, initializing, or troubleshooting
-  (@colbymchenry/codegraph — https://github.com/colbymchenry/codegraph) in the
+  CodeGraph (@colbymchenry/codegraph) in the octopus environment.
-  octopus environment. Covers global CLI install, per-project `.codegraph/`
-  indexing, and maintenance commands (status, sync, upgrade, uninstall). MCP
-  wiring into octopus.jsonc is handled by the kickoff pipeline
-  (`octopus kickoff` or `/kickoff`). Also use when a project session reports a
-  missing/stale `.codegraph/` index.
 triggers:
   - codegraph
   - code graph
-  - codegraph setup
-  - codegraph install
-  - codegraph init
-  - .codegraph
-  - codegraph_explore
-  - codegraph_node
-  - codegraph_callers
-  - codegraph_status
-  - install codegraph
-  # Chinese — bare nouns for code-graph concepts. The English "codegraph" brand
-  # name above already covers mixed-language phrasings; these cover pure Chinese.
   - 代码图
-  - 代码图谱
   - 代码索引
   - 索引代码
-  - 装代码图
-  - 初始化代码图
 role: Producer
 ---
 

core/skills/implement/SKILL.md

@@ -127,6 +127,20 @@ Rules:
 
 Each execution mode below defines its own Tester focus and any mode-specific orchestration overrides.
 
+**Producer test preflight** (before writing any test):
+
+1. **No absolute-path targets outside the test's own fixture/instance dir** — target fixtures or instance-relative paths instead. Where behavior is
+   platform-dependent (path resolution differs Windows/Linux), assert the
+   platform-specific expectation explicitly; a platform mismatch must fail,
+   never pass by accident.
+2. **Polling/wait-for loops must be bounded AND non-vacuous** — bound the
+   loop AND assert the body executed at least once (e.g. an iteration
+   counter asserted after the loop), so a timeout-cut never yields a false
+   green.
+
+Anchor: CI job 112302 (PR [org-internal #6409] first head red — nonexistent absolute path
+drill + 15s-bound vacuous loop).
+
 ## Greenfield vs. Brownfield
 
 **Greenfield** (new project): Create new files following the design. Project conventions are defined by the design document.

core/skills/implement/reference/implement-mode.md

@@ -179,10 +179,6 @@ Available work items:
 
 #### Phase 1 — Parse Context
 
-> **Pipeline stage**: if the source issue exists, move it to the `implement`
-> column on the Pipeline Stages board per `_shared/gitea-write-patterns.md`
-> Pattern 7.5. Skip if no source issue exists.
-
 Read the upstream artifacts to build a complete implementation context.
 Resolve inputs per the DAG-route read map (Preconditions above); standalone
 modes read the request/bug report instead:
@@ -499,11 +495,6 @@ issue exists.
    retired — each one re-triggered the full CI surface for near-zero re-tested
    risk.
 
-> **Kanban column lifecycle**: automated (`POST <gitea-base-url>/api/v1/repos/{owner}/{repo}/issues` → Backlog,
-> `POST .../pulls` → Review; no manual moves). Single shared reference:
-> `_shared/gitea-write-patterns.md` Pattern 7.5; column semantics: wiki
-> `kanban-lifecycle`.
-
 ---
 
 #### Phase 5 — Report

core/skills/review-artifact/SKILL.md

@@ -97,10 +97,7 @@ The stage IDs remain as-is — they are used by the stage registry and auto-appr
 This skill follows the standardized parallel-review pipeline. The full mechanics are in:
 
 - `<!-- inject: ../_shared/review-pipeline-phases.md -->` — Phase A through Phase E
-  - **Phase A step 0**: move the source issue to the `review` column on the
+  (canonical orchestrator actions for the shared flow)
-    Pipeline Stages board per `_shared/gitea-write-patterns.md` Pattern 7.5
-    (see `_shared/review-pipeline-phases.md` for the canonical orchestrator
-    actions — step 0 is now part of the shared flow).
 - `<!-- inject: ../_shared/review-orchestrator-rules.md -->` — mandatory orchestrator rules
 - `<!-- inject: ../_shared/review-final-report-template.md -->` — final report format
 - `<!-- inject: ../_shared/review-revision-prompt.md -->` — Phase C revision prompt template

core/skills/review-code/SKILL.md

@@ -458,7 +458,7 @@ table).
 <!-- section:phase-a -->
 ## Phase A — Parallel Review
 
-> **Canonical mechanics**: `core/skills/_shared/review-pipeline-phases.md` — keep this section in sync with the canonical Phase A–E flow. This section adds review-code-specific constants (10 dimensions, severity definitions, risk tiers, output mode, standalone-bugfix mode). Step 0 (move source issue to `review` column on Pipeline Stages board per Pattern 7.5) is inherited from the shared Phase A orchestrator actions; see `_shared/review-pipeline-phases.md`.
+> **Canonical mechanics**: `core/skills/_shared/review-pipeline-phases.md` — keep this section in sync with the canonical Phase A–E flow. This section adds review-code-specific constants (10 dimensions, severity definitions, risk tiers, output mode, standalone-bugfix mode); orchestrator actions are inherited from the shared Phase A flow.
 
 ### Standalone Bugfix Mode — Orchestrator Dispatch
 
@@ -530,6 +530,13 @@ fallback is retired with the design pipeline, [org-internal #3072] phase 3):
      emits the reviewer's output; it does NOT touch the code under review, so
      rule #7 auditor independence holds.)
    - Temperature: 0.1 (deterministic output).
+   - StructuredOutput mount ([org-internal #5658]): pass `format: { type: "json_schema",
+     schema: <the reviewer-output.schema.json contents you read at prompt
+     build time> }` on the Task dispatch — the reviewer's final emission is
+     schema-enforced (malformed verdict/severity/summary args are rejected
+     with field-path repair feedback inside the reviewer's own loop). The
+     findings FILE remains the canonical Tier-1 artifact; the structured
+     output mirrors it as a self-check.
 
    **Worktree-path rule (mandatory)**: Every file path in the reviewer prompt
    (`{FILE_SECTIONS}`, design reference paths, artifact paths) MUST be the
@@ -545,6 +552,21 @@ fallback is retired with the design pipeline, [org-internal #3072] phase 3):
    observed in the 2026-07 auto-approve retrospective (5-round convergence,
    67.7% rework fraction).
 
+   **Code-graph availability preamble (worktree sessions, [org-internal #4187])**: the main
+   checkout's `.codegraph/` index does NOT cover a session worktree
+   ([org-internal #2561]/TD-006). Before dispatch, the Orchestrator checks the worktree's
+   own index: run `codegraph_status` against the worktree root, or check for
+   `<worktree-root>/.codegraph/codegraph.db` (a bare `init.log` without the
+   db means the background `session-worktree.sh create` init is still running).
+   Include in each reviewer's dispatch preamble: (a) the worktree index state
+   (ready / building / absent), and (b) when absent or still building, the
+   ABSOLUTE path of the main checkout (which has its own `.codegraph/`) so
+   DGN/COR reviewers can query MAIN-side symbols (design baselines, frozen
+   cross-session contracts) from the main checkout's index and cite them as
+   `main:<path>:<line>`. Reviewers apply rule 6b of
+   `_shared/review-reviewer-prompt.md` (NA + INFO finding) when no index is
+   reachable at all — grep-only structural claims must never pass silently.
+
 4. Wait for all reviewers to complete. Each reviewer writes its finding JSON to
    `<runs-root>/{slug}/reviews/code/round{N}/findings-{DIMENSION_CODE}.json`
     (Tier 1 local, validated by `core/schemas/reviewer-output.schema.json`). After all

core/skills/verify/SKILL.md

@@ -196,10 +196,6 @@ each missing item.
 <!-- section:phase-1 -->
 ## Phase 1 — Load Verification Context
 
-> **Pipeline stage**: if the source issue exists, move it to the `verify`
-> column on the Pipeline Stages board per `_shared/gitea-write-patterns.md`
-> Pattern 7.5. Skip if no source issue exists.
-
 Read the upstream artifacts. DAG task/milestone mode (the live path — see
 the DAG branch below for its read map):
 
@@ -310,6 +306,20 @@ gate fingerprint is keyed on the working tree (SHA + uncommitted state +
 untracked), so it covers pre-push/headless states the same-SHA CI clauses
 cannot.
 
+### 2.0b — Gate Records as Deterministic Inputs ([org-internal #5656] N-04)
+
+Mechanical checks MUST be grounded in gate records (`gate` tool result
+metadata), never in a model's transcription of command output:
+
+- Cite `exit_code` verbatim — canonical block from
+  `packages/octopus/src/gate/consume.ts`: `gate <id> (<tier>):
+  exit_code=<n> -> green|red`, plus `duration_ms` / `ci_run_id` when present.
+- `exit_code === null` (timeout/abort) is NO verdict — rerun required; a
+  pass claim cannot stand on it.
+- A green verdict-cache hit (`metadata.verdict_cache.key`) satisfies the
+  check the same as a fresh run (content-addressed, same fingerprint).
+- Narration drift (claim != record) is itself a verification finding.
+
 ### 2.1 Full Test Suite
 
 ```bash
@@ -1203,10 +1213,7 @@ If the user confirms, invoke the commit workflow per
 
 An iteration is NOT Done until all code is committed in git history.
 
-After the commit gate passes, move the source issue to the `done` column on
+Issue closing follows the lifecycle per `issue-checklist-sync.md` 归档动作.
-the Pipeline Stages board per `_shared/gitea-write-patterns.md` Pattern 7.5.
-Skip if no source issue exists. `done` is a stage column marker; issue
-closing follows the lifecycle per `issue-checklist-sync.md` 归档动作.
 
 To notify workflow completion, call the `signal_stage_done` tool.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "octopus-workflow",
-  "version": "0.1.4",
+  "version": "0.1.8",
   "description": "Standalone workflow core: provider-neutral agent workflow corpus (skills / rules / checklists / templates / schemas) with drift guards, extracted from the octopus agent platform.",
   "license": "MIT",
   "private": false,