Qiongli current program index

Ledger schema: qiongli-program-ledger/v1 Ledger update: 2026-10-09 Tasks: 249

The master roadmap owns descriptions and ordering. The program ledger owns live task state. Markdown checkboxes are presentation only.

State summary

State	Count	Meaning
accepted	46	Exact repository evidence, commit and CI run are recorded.
active	9	The bounded task is currently being implemented or integrated.
blocked	14	Work cannot advance until the recorded blocker clears.
deferred	157	Intentionally held behind a milestone or policy gate.
proposed	23	Ordered work that has not entered implementation.
superseded	0	Replaced by another recorded task or decision.

Tasks

M0 — v2.0.0-alpha.3 exact-head closure

REL

ID	State	Owner	Description	Dependencies	Evidence / blocker
REL-300	accepted	REL	Close the self-contained App/CLI/Plugin/Skills/MCP/Zotero first-usable spine under the completed Trellis task.	—	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31438158969
REL-301	blocked	REL	Freeze the exact current candidate commit after release-blocker fixes.	REL-300	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31438158969 blocker: Historical cced6082 evidence is not reusable after product changes; freeze a new exact candidate.
REL-302	blocked	REL	Re-run all local A5 source, frontend, release-policy and diff gates.	REL-301	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31438158969 blocker: A changed product source requires a new exact-candidate local gate run.
REL-303	blocked	REL	Require successful Native CI for the exact frozen commit.	REL-302	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31438158969 blocker: A changed product source requires a new exact-head Native CI run.
REL-304	blocked	REL	Generate a new Community Alpha candidate from that exact commit.	REL-303	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: A changed product source requires a new non-publishing three-target candidate.
REL-305	blocked	REL	Complete exact-package R5D Zotero, R5E visual, R5F control-plane and R5G workspace acceptance. Exact-package R5D Zotero automation and product-control acceptance passed; the CLI budget plus R5E/R5F/R5G named manual observations remain open.	REL-304	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: The CLI size decision and named R5E, R5F, and R5G manual observations remain open.
REL-306	blocked	REL	Complete macOS, Windows and Linux target-native receipts for every claimed capability. Fresh packages exist for all three targets; capability-specific target claims remain open.	REL-305	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: Capability-specific macOS, Windows, and Linux target-native receipts remain open.
REL-307	blocked	REL	Complete independent authenticated Codex and Claude Code revision-bound handoff receipts. A local authenticated Codex transaction exists for cced6082, but it required bypassing the incorrect Lite route result that this task fixes. Claude live execution was not authorized. REL-307 therefore remains open, and any future acceptance must bind both Hosts to the next exact product candidate.	REL-306	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: Independent Codex and Claude Code receipts must bind the next exact candidate.
REL-308	blocked	REL	Complete the declared Alpha 1-to-Alpha 3 update/rollback journey or switch truthfully to manual replacement.	REL-307	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: The Alpha 1-to-Alpha 3 update and rollback journey or manual-replacement decision remains open.
REL-309	blocked	REL	Generate and independently verify checksums, SBOMs, provenance, detached signatures and update metadata.	REL-308	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: Checksums, SBOMs, provenance, signatures, and update metadata remain unqualified.
REL-310	blocked	REL	Publish only after A8 authorization binds source, packages, receipts and trust artifacts.	REL-309	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: A8 publication authorization has not been granted.
REL-311	blocked	REL	Run public-download, startup, Host and rollback-trigger observation under A9.	REL-310	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: A9 public-download and rollback-trigger observation cannot run before publication.
REL-312	blocked	REL	Record a redacted A8 publication-authorization receipt naming the approving role, exact commit, asset digests, channels, decision, constraints and expiry.	REL-310	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: No accepted A8 publication-authorization receipt exists.
REL-313	blocked	REL	Push release state in the declared order: immutable tag, signed assets, update/package metadata, independent public verification, then announcement.	REL-310 REL-312	evidence: docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31439930097 blocker: Ordered release publication remains blocked by A8 and all preceding exact-candidate gates.
REL-314	proposed	REL	Never replace a published tag or asset in place; hold, withdraw or supersede a failed candidate with a new version and an explicit correction notice.	REL-313	—

GOV

ID	State	Owner	Description	Dependencies	Evidence / blocker
GOV-301	accepted	GOV	Reconcile CHANGELOG.md, candidate notes and the acceptance ledger so only one publication state is expressed.	REL-300	evidence: CHANGELOG.md docs/superpowers/acceptance/2026-08-01-qiongli-alpha3-readiness.md commit cced60826ac4 run 31438158969

M1 — v2.0.0-alpha.4 Evaluation Truth and Platform Baseline

CLI

ID	State	Owner	Description	Dependencies	Evidence / blocker
CLI-401	active	CLI	Audit the current branch, GUI dependencies and retained source; adopt the CLI-first direction and close the App development stage (LF-Q01).	—	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md
CLI-402	active	CLI	Separate a pure native CLI/MCP target from graphical build, test and launch dependencies while preserving command and service behavior (LF-Q02).	CLI-401	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md docs/superpowers/reviews/2026-09-11-qiongli-2x-coherence-review.md docs/superpowers/reviews/2026-09-11-outcome-guided-skills-review.md docs/superpowers/reviews/2026-09-11-outcome-guided-skills-trial.json docs/architecture/decisions/0226-confirmed-codex-plugin-source-migration.md docs/superpowers/plans/2026-10-05-v2-4-plugin-quality-release-plan.md blocker: The September 14 post-2.0 review confirms native CLI separation and the released installation/content changes at 4f2107f7; historical beta-only descriptions are superseded for current planning. The existing plan records current three-target distribution evidence and preserves earlier observations. Installed-session/Hook behavior, actual Graph browser interaction, model-produced normalization and current release-target performance qualification remain separate; capacity profiles and incremental Portfolio owners already exist. No historical accepted record is promoted. October 7 maintainer-confirmed all-installed-client increment: add install/upgrade/update all, main guide choice 5 and Host choice 6/all; --target all detects supported Host CLIs read-only, reports skips and errors on an empty set. Explicit lists stay strict. Full-preset option validation precedes filtering; each selected Plugin keeps existing approvals, receipts and fail-stop behavior, with Skills/MCP included and no duplicate component installs. ADR 0235 and the current 2.4 plan record seven focused native passes, four isolated terminal cancellation/no-client observations, strict Clippy, formatting and review. Fixture-driver setup failures are retained. No real Host installation/session, model/authentication call or publication is claimed; next deliver with the local AGY entry fix under a separately scoped CLI update. Task states, dependencies and accepted records remain unchanged. October 8 automatic-selection follow-up after 60399ef5: unqualified Plugin commands and main-guide Enter select detected Hosts; existing registered or verified legacy paths precede separate Codex/Claude defaults. AGY recovers custom sources from a verified receipt-bound cache; Pi and DeepSeek retain their owners. Existing approvals, receipts, conflict/cancellation checks and model settings remain intact; detected-all preserves Hook settings. ADR 0237 owns the bounded path/default compatibility change, and the current plan owns gpt-6.1-sol/low verification and retained setup/fixture failures. No real user installation, model/authentication call, publication, release monitoring or task/dependency/accepted-evidence promotion is included. Next qualify the changed native installer on declared release targets under a separately scoped delivery; old 2.5.0 artifact evidence does not qualify these new bytes. October 8 installation-recovery follow-up after d715fd35: ADR 0238 supersedes only batch fail-stop/decline behavior; ordinary Host failures and explicit declines continue, while closed input/output stops safely. Per-Host summaries and targeted retries distinguish installed, failed, skipped and not-run results; partial failures remain nonzero. Bounded official-manager commands retain exit codes, show known static diagnostic categories and five-second progress without echoing raw output. Existing approvals, paths, receipts/CAS, model settings and registry pins remain unchanged. The current plan records 39 focused Rust cases, five isolated terminal regressions, independent gpt-6.1-sol/low review and retained fixture failures. Synthetic DSH reproduction proves lost diagnostics, not the cause on the user machine. Direct-child-only timeout termination and pending target-native delivery qualification remain explicit; no live Host/session, task-state or accepted-evidence promotion, real profile update or publication is claimed. October 8 DSH clarification after 14b0ec33: the user reports Qiongli2.5.0, DSH0.2.0-rc.2 and desktop. Exact integrity-verified published DSH parser reproduction shows the npm launcher refuses the reserved desktop profile while Desktop opt-in accepts the same argv; public metadata confirms qiongli2.5.0 exists. This remains conditional on the user launcher path, not a confirmed machine diagnosis. Add the precise static error category and clarify Desktop vs npm launchers in guides/generated npm README under ADR0238. No launcher switching, profile mutation or permission bypass is introduced; focused checks and evidence remain in the current plan. October 8 DeepSeek step-reporting follow-up after fa7a87fb: user evidence confirms the Desktop-owned macOS launcher, Desktop quit in both cases and successful direct installation; previous npm-entry/open-app hypotheses do not explain this case. The original cause remains unconfirmed. Add twelve staged results and timings, separate registration/package/receipt/language verification, and actual command-context plus bounded safe output observations under ADR0238. Environment, arguments, approvals, profile writes and batch recovery retain their existing owners. The current plan owns focused gpt-6.1-sol/low verification and remaining machine-level diagnosis; no acceptance or publication is claimed. October 8 local diagnostic delivery at runtime ce2c8d1e: release-profile Linux ARM64 portable/npm archives and a staged source bundle are source/hash bound. Actual ELF inspection requires glibc2.39; corrected local descriptions use the npm composer optional README without changing release defaults. Eleven packaging tests, clean offline installed CLI/alias/postinstall, Lite15/Full35 MCP, DSH bundle-loader22 Skills and six installed-launcher synthetic stage cases pass under gpt-6.1-sol/low; unchanged31 native cases are reused. The current plan records artifacts, frozen evidence, initial ABI-description mismatch and fixture help-route corrections. Local CLI installation is verified, not macOS or real DSH installation/session; the installer still selects public npm2.5.0. Next build on Mac and retry the original case with stage output. No acceptance promotion, real profile change or publication is claimed. October 8 Apple Silicon binary follow-up at66252b29: an offline locked release cross-build succeeds on Linux. Corrected portable/npm artifacts require macOS13+ per actual Mach-O load commands; initial configured11.0 assumptions are retained as failed packaging evidence, with no published baseline change. Independent gpt-6.1-sol/low checks cover ARM64 structure, system dylibs,5675 ad-hoc signature pages, exact resource-pack/source inclusion and actual archive/receipt identity. The current plan binds artifacts/provenance and task-only scratch cleanup. This is a user-run diagnostic package, not Mac execution, Gatekeeper/Keychain, npm install or real DSH session acceptance. The user confirms Apple Silicon but OS-version compatibility remains unestablished. Next collect the Mac-native run and DSH stage outcome; no task-state or accepted-evidence promotion, real profile change or publication is claimed. October 8 authorized2.5.1 release handoff: the maintainer supplies a successful Apple Silicon DSH0.2.0-rc.2 installation trace for the local diagnosticCLI installing public2.5.0; new-session tools and the original failure cause remain unverified. Fresh candidate575b74e2 passes22 Python contracts, strict format/Clippy,47 CLI plus9 MCP tests and canonical LinuxARM64/glibc2.35 archive/npm/wheel/Plugin installation qualification. Independent actual artifact/receipt/pack checks and retained locally qualified2.5.0-to-2.5.1 npm/pip upgrades pass, preserving synthetic research/model canaries; current public predecessor identity is not claimed. The current plan binds source, hashes, setup observations and scoped cache cleanup. Unchanged31 installer tests are reused as behavioral evidence only. The authorized next action is main/tag synchronization and the existing release task; exact-tag four-target and publication gates remain active, then no monitoring after accepted dispatch. Task dispatch does not establish publication or live Host acceptance; AGY/Pi remain experimental and all task states, dependencies, accepted evidence and commit/run fields remain unchanged. October 8 compact-display follow-up after1f203549: the maintainer reports successful2.5.1 installation but crowded output. ADR0239 adds grouped Host sections, one short current-step/elapsed line on supported wide Unix terminals, concise plain fallback and explicit --verbose/--plain options. Full approval previews/digests, official-manager execution, safe automatic failure diagnostics and batch continuation remain unchanged. Independent gpt-6.1-sol/low records43 distinct affected Rust passes,8 phase-sensitive reruns,21 final terminal/refusal cases, exact approval-preview equality, strict Clippy/format and architecture/ADR checks. The successful synthetic transcript drops from93 to54 persistent lines; Mac-native output is not yet verified. The current plan binds source/binary/evidence hashes and retains setup failures, excluded partial-copy runs and scoped inactive debug-cache cleanup. Next qualify target-native output and release artifacts under a separate delivery; this increment includes local integration only, with no real Host/profile/session access, publication, release monitoring or change to task states, dependencies, accepted evidence and commit/run fields. October 8 authorized2.5.2 release handoff: clean candidatef6c823bf binds the compact installation display to synchronized2.5.2 versions and446-entry pack. Independent gpt-6.1-sol/low passes22 Python contracts, strict workspaceCLI format/Clippy,47CLI+9MCP tests and canonical LinuxARM64/glibc2.35 archive/npm/wheel/Plugin qualification. Five actual native payloads, receipts, embedded pack/source and ELF baseline match; retained locally qualified2.5.1-to-2.5.2 npm/pip upgrades preserve three synthetic canaries, without claiming current public predecessor identity. The current plan records exact hashes, setup refusals and narrowly scoped inactive compiler-cache cleanup. Prior43 native and21 terminal cases remain behavior evidence only. The maintainer authorizes main/tag publication and existing release-CI dispatch, then immediate stop without monitoring. Exact-tag four-target/public-download/registry gates remain mandatory; no live Host, Mac terminal, program-acceptance or Marketplace promotion is implied. All task states, dependencies, accepted evidence and commit/run fields remain unchanged. October9 DeepSeek installer resolves public npm latest into an exact approved version, uses normal dsh plugin add argv with native terminal progress, retains bounded initialization/version capture and verifies source-pack consistency independently of the launching CLI. Compact output and saved-language reuse reduce scrolling and prompts; default desktop requires initialization and other profiles remain explicit. Independent gpt-6.1-sol/low passes23 focused checks, strict libClippy, format and ADR validation; the current plan binds reports and retained initial failures. Source mapping, obsolete duplicate-output assertion and ADR catalog fixes are included. Review has no unresolved actionable finding. Real Mac/DSH/session use, registry authenticity and release qualification remain separate; this is local integration only, with no preceding-release monitoring or acceptance-field promotion. October9 authorized2.5.3 release handoff: clean candidatecd76e8c1 binds synchronized2.5.3 metadata and the446-entry content pack. Independent gpt-6.1-sol/low passes22 Python contracts, strict workspaceCLI Clippy/format,47CLI+9MCP release tests and canonical LinuxARM64/glibc2.35 archive/npm/wheel/Plugin qualification. Five native payloads, package receipts, source/pack bindings and ELF baseline match; retained locally qualified2.5.2-to-2.5.3 npm/pip upgrades preserve three synthetic canaries without asserting current public predecessor identity. The current plan binds the frozen report and retains setup failures, including security refusals from inherited task-clone directory permissions before an unchanged-source full rerun passed. Prior23 behavior checks remain separate. The maintainer authorizes atomic main/tag push and existing post-mode release automation, then immediate stop on accepted dispatch without monitoring. Exact-tag four-target/public-download/registry gates remain mandatory; local qualification does not establish live Mac/DSH/session behavior, publication completion or program acceptance. Task states, dependencies, accepted evidence and commit/run fields remain unchanged.
CLI-403	active	CLI	Qualify independent resources, package identity, trust, installation, update and rollback without an App bundle (LF-Q03).	CLI-402	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md tooling/release/acceptance/v2.0.0-alpha.7-distribution.json docs/architecture/decisions/0222-user-approved-local-plugin-sources.md docs/architecture/decisions/0228-channel-specific-native-plugin-identities.md docs/superpowers/plans/2026-09-15-v2-0-1-transition-release-execution.md docs/architecture/decisions/0229-plugin-v1-transition-and-2-1-cutoff.md commit 4f2107f7fda9 run 34767534232 blocker: The September 14 review confirms 2.0.0 three-target builds and combined installs at 4f2107f7 in run 34767534232, plus successful Cargo publication and all three public registry installs in run 34768006565. npm latest and three non-yanked PyPI wheels expose 2.0.0. The existing plan binds the public observations. These do not complete the broader managed installation/update/rollback lifecycle or installed-Host acceptance; retain historical partial platform and recovery evidence at its original source. September 15 source increment dc2500c3 implements stable qiongli versus Alpha/Beta qiongli-next identities and receipt-compatible migration under ADR 0228. Isolated real Codex cancellation, confirmed migration and full old/new cache hashes pass, including the hidden old-ID configuration case. Existing model settings and live user installations are unchanged. The current plan records focused checks and remaining release/session qualification; published 2.0.0 and all 46 accepted rows retain their existing evidence. ADR 0229 retains Next/v1 in 2.0.1 and moves v1 output retirement and stable identity migration to 2.1 without removing verified legacy receipt readers. The current transition execution plan records the gpt-6-astra / low implementation, two coordinator review repair rounds and development port 60f2cf37. Final compatible main 789b0bbe is qualified-unpublished on macOS ARM64: 47 CLI/MCP tests, archive/npm/wheel/two Plugin checks, five artifact hashes and actual both-Host v1/Next evidence pass. Isolated real 2.0.0 source upgrades, repeat/refusal/drift retry and old-CLI restoration/reupgrade pass for Codex and Claude. Exact source, artifact hashes, commands and limits are in the plan. Windows/Linux, real combined packet, Cargo/public installs, remote refs, publication and installed-Host acceptance remain pending. One unchanged diagnostic negative and full-suite gaps remain disclosed. All task states/dependencies and 46 accepted rows are unchanged. September 24: the requested DeepSeek Cordis Plugin and Claude Code/DeepSeek/Antigravity prepare/collect adapters reuse the existing native projection and coordinator/result owners. The current plan records successful temporary DSH Plugin activation (two Skills, 32 Full MCP tools and config status) and actual synthetic Claude/Antigravity collection. Published DSH 0.1.5-rc.3 lacks the source-documented headless --json protocol, so that external execution lane remains unqualified. Canonical Skill source is 839cc17f; no installed-user configuration, research write, publication or acceptance promotion occurred. Follow the current plan for focused validation, remaining Host/platform checks and source integration. September 30: installed macOS ARM64 DeepSeek Harness 0.2.0-rc.2 accepts the clean-source c2e10fb1 Qiongli bundle through its official manager. Isolated repeat installation preserves the profile; live Cordis activation loads two Skills, exposes 32 Full MCP tools, calls config status successfully and exits 0. Removal preserves other bundles. Headless help now exposes --json, but actual model execution and installed-user activation remain untested. Exact source, artifact hashes, failed probe attempts and scope are recorded in the current plan; no state, dependency or accepted-evidence promotion. September 30 multi-entry follow-up at 92f1f7d4 reuses the Codex workflow wrapper generator: 20 workflow entries plus qiongli/no-qiongli have identical bytes and both user/model invocation enabled. Actual DSH 0.2.0-rc.2 registry loads and browser Session directory API expose all 22 entries in an isolated profile; 32 Full MCP tools and config status still pass. DSH schema 4 binds the complete projection while historical schema 3 remains verifiable. The current plan records 21 packaging checks, exact artifacts and remaining installed-user/model/UI scope; acceptance is unchanged. September 30 stable 2.1.0 release increment c10c4b70 puts the same 22-entry DSH bundle in the existing qiongli npm package. The current plan records clean macOS CLI/npm/wheel qualification and actual isolated DSH 0.2.0-rc.2 archive and npm-registry-fixture installation, browser-facing catalog and 32-tool Full MCP checks. The maintainer authorizes stable publication and requests ending tracking after accepted release-command submission; public publication and other target qualification remain automation-owned. No state, dependency or accepted-evidence promotion. September 30 installer follow-up: the current plan records the local multi-Host selector and terminal-approved official DSH npm installation, with shared option validation, cancellation/refusal/drift checks and isolated actual DSH 0.2.0-rc.2 registry installation. All 22 Skill entries, browser Session catalog and 32-tool Full MCP config status pass without activating a model. This fix is local and unpublished; the existing v2.1.0 tag is retained. No task state, dependency or accepted-evidence promotion. September 30: install-time auto/zh/en metadata selection and humanizer-reviewed bilingual descriptions are implemented through the existing native projection, plan and receipt owners. Local Codex/Claude exports and isolated official DSH 0.2.0-rc.2 sessions verify both languages, stable bodies/entry IDs and 22 DSH Skills/32 Full MCP tools. The current plan records exact development artifact hashes, focused checks, corrected test failures and remaining cross-platform/client-refresh qualification. No version bump, publication, installed-user or acceptance promotion is implied. September 30: the maintainer authorizes the 2.1.1 stable patch for multi-Host installation and bilingual Skill metadata. The current plan owns version preparation and tag-bound release submission; existing automation owns fresh three-platform qualification and publication. No state, dependency or accepted-evidence promotion. October 3 documentation follow-up: bilingual READMEs and current installation/upgrade/CLI/Plugin pages are simplified for 2.2.0, including Linux ARM64 and the new-receipt rollback limit. Shared navigation classifies current use, maintenance and preserved historical records; existing checks follow moved 1.x references. The current execution plan records focused validation and local integration scope. No runtime, model, task-state, accepted-evidence, push or publication change is implied. That earlier documentation observation reported 2.1.1 in GitHub/npm/PyPI. October 3 post-release observation now confirms GitHub v2.2.1 published at 17:51:15 UTC; current user docs describe that release. No fresh registry-install or installed-Host acceptance is inferred.
CLI-404	active	CLI	Provide window-free Host integration and a verified human approval path using existing preview/apply owners (LF-Q04).	CLI-403 SEC-403	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: Historical dfebb17c Codex review, authorized Inbox/consolidation and revision-2 reads remain valid for that candidate. Current 2.0.0 installed-Host approval, boundary and restart qualification is still open. The September 14 baseline keeps the previously paused Host-registration lane separate from the immediate synthetic answer-bound observation implementation; no installed-current-session acceptance is inferred from release success.
CLI-405	active	CLI	Complete one real Host research journey and same-device handoff with source-bound candidates, approved writes and restart recovery (LF-Q05).	CLI-404	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md docs/architecture/decisions/0222-user-approved-local-plugin-sources.md docs/superpowers/plans/2026-09-15-v2-0-1-transition-release-execution.md docs/superpowers/plans/2026-10-05-v2-4-plugin-quality-release-plan.md blocker: The September 14 answer-bound increment at 7c843870 and C-to-F continuity increment at 7e3de537 retain their scoped synthetic observations, initial failures and coordinator self-review, not independent acceptance. Distribution scan fix ec3d700b now prunes excluded directories before descent, preserves exact file hashes and symlink checks, and fails included-directory scan errors. On the same staged package scan calls fell from 1266 to 3 with identical 69-file SHA-256 maps; this does not prove an end-to-end speedup or explain the earlier full-run interruption. All 38 distribution checks pass, including the originally interrupted stale-npm test. Full discovery was retried but stopped during Plugin materialization after scoped checks passed and other failures were visible: 14 distinct failing methods and five erroring methods were observed, not final suite counts. Architecture fix c91773e5 registers existing ADRs 0226/0227 and aligns overview assertions with current CLI-first boundaries; all 23 architecture checks pass with accepted ADRs, frozen inventory and negative checks unchanged. Full discovery was not rerun. Next reconcile the delivery validator's old release-command marker with the current --cli-github checklist, preserving approval/release authority. Remaining validation failures and installed-candidate Host/SEC, provider/quota and real normalization qualification keep separate scope. Host registration stays paused; no program acceptance changes. September 22: maintainer selects literature discovery, accurate BibTeX and Zotero linkage as the next bounded increment. Live public known-title search and synthetic export probes plus native source inspection identify provider-order truncation, missing bibliographic fields, planner/executor differences and an object-array Host schema mismatch. Zotero Companion responds, but no library search/write or installed Plugin update occurred. The current plan records exact inputs, source limits, existing owners and acceptance cases. Diagnosis and planning do not establish a fix or research-quality acceptance. Implementation update: 15a8b901 completes the bounded literature source increment with metadata-preserving typed export, targeted candidate filters, scoped Skills and Companion version-aware identity. Local regressions, public arXiv/registry export checks and gpt-6-astra/low independent review are recorded in the current execution plan. Maintainer-topic, installed-Host and approved real-library qualification remain open; no task or accepted-evidence state is promoted. October 1 discipline and lifecycle increment cf42c26f adds seven conditional field guides, strengthens A–M and corrects selected method/reporting guidance on the 2.1.1 baseline. The current plan records focused checks, the verified 443-resource native export, exact Codex/Claude/DeepSeek content projections and nine read-only synthetic sub-agent cases assessed by the coordinator. No new subject IDs, Host entries, model settings or research-write owners are introduced. Real study/domain-expert and installed-Host qualification remain open; no task state or accepted evidence is promoted and no publication or installed-plugin update is performed. October 1 decision-guidance follow-up 8289e3f0 makes the shared decision/evidence/continuation questions actionable across C/E/F while retaining model choice and existing write owners. Synthesis and interpretation cards remove fixed method and prose quotas; the effect interpretation output is aligned with the existing F3 contract. The current plan records focused checks, the regenerated 443-resource pack, exact three-Host content projections and two complete bounded fictional candidate tasks assessed by the coordinator, with a separately recorded changed-source continuation. Temporary trial artifacts are local observations, not durable accepted evidence. Real study, expert and installed-Host qualification remain open; no release, installation or program-acceptance change is implied. October 2: the authorized discovery-to-fulltext increment is implemented at fb3d6d76. Existing five-provider search retains abstracts, identifiers and access leads; native Lite/Full and standalone Rust Lite share public PDF/TEI/JATS excerpt reading with source digests, identity checks and unchanged canonical write boundaries. Host-native search remains Host-executed. The current plan records focused checks, independent repair review, one synthetic three-record Skill observation and actual public arXiv/PMC probes. PDF internal decompression limits, authenticated OpenAlex content, installed-Host and target-native qualification remain open. No release, private library access or state/dependency/accepted-evidence promotion. October 2 public-paper/evidence-review follow-up: d44c45d2 adds shared source-bound claim verification; b4ce372f freezes three real-paper tasks and their separate criteria; 2a368167 corrects observed review attribution and uncertainty defects. Four native checkpoints completed; final coordinator review records three passes and one reopened quantitative computation-scope check, preserving original answers and review disagreement. Existing Codex/Claude prepare/collect completed the same public-source/candidate review using configured models; the current plan separates transport success, substantive limits, observed usage and a fresh reconciliation observation. Final 446-resource pack and three-Host content projections pass focused checks. No permanent discipline agents, new write owner, model override, acceptance promotion or installed-Plugin qualification. Temporary observations remain local evidence; actual tables/supplements, domain expertise and installed-Host/project qualification remain open. October 2 selected workflow-reliability increment: 2ae0c8d6, 9f1bd51e and 96d20848 consolidate existing Skill owners, bound native parser workers, fix public-search credential routing and preserve actual table/failure observations. Installed Codex exposed two compatibility faults, repaired by 2ae52aa4/d50a1ef0/f3f1379a; final candidate d1b3af4f has verified regenerated content and matching isolated cache. Actual configured gpt-6-astra/xhigh author and resumed processes use installed tools and public HTML; coordinator source review and approved native writes persist research_state/decision_log at revision 2, reject a real revision-1 consolidation without mutation, and survive Host restart. Failed providers/native DNS access, original title conflict, unresolved denominators and missing standalone handoff artifacts remain explicit. The current plan records all six bounded outcomes, exact candidates, checks and local observations; no general Host/release/domain-expert acceptance is claimed. Next qualify configured providers/transport and representative disciplines, with a separately selected formal handoff flow if needed. No permanent agent registry, private-library access, user-profile update, publication or state/dependency/accepted-evidence promotion. October 2 public-channel follow-up: ef7885de retains usable selected channels when the shared credential loader stalls; candidate a432ea35 repeats the same public known-title query and now returns one arXiv record with explicit warnings for unsearched OpenAlex/Semantic Scholar, where the prior candidate returned only a credential-load error. DNS-only observations explain the unchanged fulltext special-address rejection without proving its system cause. Native configuration/partial-result Skills are corrected; runtime, Lite, content, pack and three-Host projection checks pass. The current plan records exact before/after candidates and local observations. Authenticated-provider quotas, secret-store access and fulltext transport remain unqualified; no research-quality, installed-Host or release acceptance follows. Representative discipline assessment and a separately selected formal handoff persistence flow remain next. No new agents, private access, profile update, publication or state/dependency/accepted-evidence promotion. October 2 discipline-transition assessment: 14e33e19 strengthens adjustment timing/causal targets at the shared Stage C owner and benchmark quantity/split boundaries in the computing guide. Two public-source exercises retain design-to-prose IDs, source limits and the actual education predecessor; their durable selected-span annotations explicitly record main-agent self-review, not blind evaluation or measured improvement. All 20 earlier corpus files and the original three-pass/two-failure observations remain unchanged. Candidate f9a1fc07 passes 32 focused checks, corpus/negative mutations, content validation, two embedded-pack checks and exact three-Host projections. The current plan records source-access limits and candidate identities. Next is formal stage-handoff persistence/resume via existing preview/approval/CAS; expert review, broader disciplines and authenticated-provider/transport qualification remain open. No project persistence, installation, publication or program-acceptance change is claimed. October 2 formal handoff persistence: fafd6801 extends existing native capture consolidation with an optional reviewed handoff draft, exact resulting-content preview, append-only history and unchanged approval/transaction ownership. Preview and apply reject drift in registered semantic inputs. A copied CLI saves and resumes identical bytes in separate processes, rejects changed drafts and stale revisions, and retains default capture behavior. The requested gpt-6.1-sol/low sub-agent reviews the diff and runs 20 focused compatibility checks; its privacy/documentation findings are corrected. The current plan records the bounded synthetic journeys, remaining Clippy toolchain debt and regenerated content identity. Non-registered sources still require separate byte checks; stage summaries, live Host qualification and research-quality acceptance are not established by this storage test. Next exercise the new save/resume from an isolated configured Host with public evidence and changed-source continuation. No installed-profile/model changes, private access, publication or task/dependency/accepted-evidence promotion. October 2 actual Host continuation: baseline 058a047b supplies the unchanged copied native CLI for an isolated public-paper journey. Three actual gpt-6.1-sol/low processes author, restart-read and continue after an expanded source packet; separate coordinator review and native preview/approval/CAS persist revisions 2 and 3 while preserving prior bytes and the original unmerged conflict. Hash changes are detected despite an unchanged project revision. The current plan records exact outputs, network failures, scholarly limits and the H2-only auditor correction. This is process-local Host/MCP evidence, not installed-Plugin or independent domain acceptance. Next is versioned stage-summary persistence/history using existing write owners. No user-profile/private-library/publication or task/dependency/accepted-evidence change. October 2 versioned stage-summary persistence: 683169cf adds source/predecessor-bound immutable summaries, exact state/history/handoff previews and create-only transaction writes through the existing capture owner. Candidate df0b42f2 includes the regenerated 446-resource pack. Two-version service and three copied-CLI journeys pass with source drift, approval, revision, collision and rollback checks; the requested gpt-6.1-sol/low sub-agent reviews the final implementation without actionable findings. The current plan records exact hashes, input/compatibility limits and remaining Clippy debt. Next exercise successive summaries and changed-source restart from an isolated configured Host with public evidence. No new Graph authority, stage acceptance, installed-profile/model changes, private-library access, publication or task/dependency/accepted-evidence promotion. October 2 actual Host versioned-summary continuation: unchanged baseline cd18e16d passes four actual gpt-6.1-sol/low processes in the isolated public project. Coordinator native preview/dual approval/CAS saves STG-B-001 and STG-B-002 at revisions 4/5; fresh processes verify files, receipts, source hashes and predecessor history. Real packet expansion at unchanged revision 4 rejects a stale preview without mutation. The requested lightweight verifier checks execution and persistence, flags a coefficient-scale wording gap that is corrected, and confirms the final read. The current plan retains exact hashes, failed network attempt, table discrepancies, source limits and dependent review attribution. No runtime/content change or test rerun is claimed. Next diagnose public fulltext transport and its error reporting through existing owners without weakening network guards. Installed-Plugin, authenticated-provider and expert qualification remain separate; no user-profile/private-library/publication or task/dependency/accepted-evidence change. October 2 public fulltext transport diagnostics: 194b4eaa distinguishes signed-query/redirect policy from DNS failure at the shared reader; candidate a9e462c5 regenerates the canonical guidance pack. Current PLOS observations resolve publicly but reject a signed storage redirect; rebuilt Lite/Full now identify that stage without exposing signing values or weakening guards. Native arXiv PDF reading and fresh-process digest-bound continuation expose page-2 body passages; this is bounded retrieval, not complete reading or verified structured identity, and is not attributed to the diagnostic patch. The requested gpt-6.1-sol/low verifier reviews the source and passes both Lite compatibility checks. Focused runtime/content/pack checks pass; the broader research-standard validator retains 24 failures outside the changed owner, recorded in the current plan. Next is an isolated Host native-body-to-notes journey using existing source and write owners. No installed-profile/model changes, private access, publication or task/dependency/accepted-evidence promotion. October 3 native body-to-note Host journey: unchanged b5c91e1e and its copied CLI pass actual gpt-6.1-sol/low author and fresh-reader processes. Four native status/plan/fulltext calls yield four digest-bound PDF segments; source review preserves Vaswani2017Attention, V2017-C1/C2, exact anchors and partial/unverified identity limits. Existing migration preview/filesystem approval/CAS saves five reviewed unregistered files into a new revision-1 project; missing approval and changed-note stale plans refuse without writes. A fresh Host and the requested lightweight verifier confirm note/source/inventory/receipt hashes and unchanged files. The current plan records exact identities, coordinator wording changes and the narrower first-import scope. No runtime/content repair or test rerun is claimed. Next add reviewed paper-note creation/update for existing registered projects through the current transaction and approval owners; first import does not provide that capability. No user profile/model changes, private-library access, publication or task/dependency/accepted-evidence promotion. October 3 registered-project paper-note persistence: dd95e732 adds strict source/prior-note-bound creation and append through the existing consolidation preview, dual approval, revision, transaction and receipt owners. Pack candidate c438449d contains regenerated guidance and 446 resources. Local project, copied-CLI, input/drift/collision/rollback, content and pack checks pass; the requested gpt-6.1-sol/low sub-agent adds bounded CLI coverage and reviews the final changes without actionable findings. The current plan records exact identities, compatibility and snapshot limits. Next exercise reviewed append and fresh-process recovery from an isolated Host using existing public evidence. Notes do not become semantic/Graph artifacts or complete B2; new source-packet persistence and installed/authenticated qualification remain separate. No user-profile/model changes, private access, publication or task/dependency/accepted-evidence promotion. October 3 registered-note Host continuation: unchanged 7858d58a and the prior pack pass actual gpt-6.1-sol/low author and fresh-reader processes against the isolated public-paper project. Coordinator review and native preview/dual approval/CAS append the note and handoff at revision 2, preserving the complete prior note and source bytes; missing approvals and changed-draft stale plans refuse without mutation. Fresh Host and requested lightweight verification confirm actual file, preview, receipt and capture bindings. The current plan retains the initial unsupported-evidence capture, empty-lock assertion correction, unavailable capture-list MCP request and unscoped CLI fallback failure; a separate explicitly scoped coordinator CLI read confirms stale/applied capture states without writes. These are corrected observation-harness gaps, not runtime fixes or Host capture-list success. No runtime/content changes or test reruns are claimed. Next add reviewed persistence of newly retrieved public-body source packets through existing project transaction and approval owners. Complete reading, identity/version, Graph, expert and installed/authenticated qualification remain open. No user-profile/model changes, private access, publication or task/dependency/accepted-evidence promotion. October 3 reviewed source-packet persistence: 102f3ade adds strict raw-JSON packet saving at immutable citekey/content-hash paths through existing consolidation preview, dual approval, CAS, transaction and receipts. Canonical guidance source 9b91d7ab supplies the regenerated 446-resource pack. Prior packets and old API/no-option behavior remain intact; later notes/summaries bind saved files under a new current-revision capture. The shared directory owner now safely creates absent intermediate project directories after the initial first-save test exposed that gap. Project, parser, copied-CLI, rollback/collision, content and embedded-pack checks pass; actual gpt-6.1-sol/low independent code/docs review and six CLI/pack checks find no actionable issue. The current plan records exact hashes, toolchain observations and compatibility/source limits. Next exercise newly retrieved public-body packet save, later note binding and restart in an isolated Codex Host. JSON storage does not establish provenance, complete reading, Graph or expert acceptance; installed/authenticated qualification remains separate. No installed Qiongli profile/model, private-library, publication or task/dependency/accepted-evidence promotion. October 3 public Host packet journey: unchanged a8c286d2 exercises packet-first revision 2-to-3 persistence and a later source-bound note/handoff append at revision 4. Native refresh is DNS-blocked before a request; coordinator Host open supplies partial body text with distinct provenance and no new PDF hash. Actual gpt-6.1-sol/low author and fresh-reader processes verify packet, note prefix, sources, captures and both receipt links; approval/stale-draft refusals preserve all scoped files. The current plan retains initial app-server startup failure, historical-prefix verification instead of assumed preview text, execution identities and lightweight independent review limits. No runtime/content repair or full-suite rerun is claimed. Next persist per-attempt retrieval_manifest.csv history through the existing native capture/preview/approval/CAS owner, retaining failed and successful provenance and unknown metadata. Complete B2, Graph/expert and installed/authenticated qualification remain open. No profile/model, private-library, publication or task/dependency/accepted-evidence promotion. October 3 post-2.2.1 increment: reviewed retrieval_manifest.csv persistence now reuses the existing capture/preview/dual-approval/revision-CAS/receipt owner. It preserves the eleven-column per-attempt history and old bytes, binds saved packets and actual local fulltext files, and retains explicit unknown metadata. One gpt-6.1-sol / low verifier performs independent focused checks and a public Crossref metadata packet-to-manifest-to-later-note journey using fresh CLI processes. The current plan owns final test counts, source identities, initial failures and limits. The prior retrieval-manifest next-step statement is superseded. Next qualify the current-package single-Codex reading/save/writing/restart paths; actual full-paper, installed/authenticated, Graph/Hook/browser and domain acceptance remain separately unqualified. No model/profile, private-library, task-state/dependency or accepted-evidence change. October 3 installed Codex continuity observation: development baseline eef45e6d, copied binary de60ae8e and the existing content pack pass isolated official Plugin installation, actual authenticated gpt-6.1-sol/low partial-body reading, four approved packet/history/note/continuation saves and unchanged-history source-drift refusal. The same lightweight verifier owns execution and byte/source review. A fresh installed-Plugin process reads project context and resumes from independently checked file snapshots; native note/manifest/packet body reading remains unavailable and unqualified. The current plan retains exact identities, all Host approval failures, interrupted attempt, snapshot limits and temporary-auth cleanup. Next add bounded revision/digest-bound saved-document reads through native CLI/Full MCP, keeping Graph and write authority unchanged, then repeat fresh recovery without supplied snapshots. Missing literature tool annotations are a separate observed gap, not a proven approval cause. No user-model/profile, private-library, publication, task-state/dependency or accepted-evidence change. October 4 native saved-document increment: 67a51deb adds a shared bounded CLI/Full MCP reader with registered project identity, expected revision/whole-file digest, UTF-8 paging and existing safe-file/recovery owners. Canonical content 252663aa capability-gates it; Graph and all write owners remain unchanged. The same gpt-6.1-sol/low verifier passes focused checks and one actual fresh isolated installed Codex run: native note, manifest and packet reads match disk bytes, a drifted test packet refuses, no supplied body snapshots or writes occur, and project/config bytes remain unchanged. The current plan binds the test-profile candidate, all setup/review failures, observed calls, hashes and auth cleanup. This supersedes the previous missing-reader next step only for known bindings and this candidate; the paper remains partially read. Next recover saved path/digest bindings through existing read-only project/consolidation receipt owners, preserving drift refusal and avoiding a parallel index. Full B2, expert/blind review, Graph/Hook/browser, other Hosts/platforms and publication retain separate scope. No task state/dependency or accepted-evidence promotion. October 4 saved-binding recovery: af2b3c6a adds read-only receipt-backed document listing through the existing registered-project/consolidation/capture/storage owners. Canonical guidance 002559d1 and the shared CLI/Full MCP contract preserve saved digests, expose read arguments only for current files, reject invalid history and bind pagination without a new index or Graph/write authority. The same gpt-6.1-sol/low verifier passes 33 native and 23 Python checks, scoped Clippy/formatting, isolated official Plugin installation and native preflight showing three current bindings plus one changed test copy. The prepared project-ID-only Codex observation does not run: automatic approval review rejects the saved-body processing scope pending explicit user authorization. No model call, answer, authentication link or live-Host byte-preservation result is claimed. The current plan records exact source/artifact hashes, test-only setup errors, metadata evidence and the pending read-only action. Next authorize/observe that recovery, then continue the remaining public-paper passages and reviewed note/save/restart flow; partial-paper, expert/blind, Graph/Hook/browser, other Host/platform and publication limits remain. No task state/dependency or accepted-evidence promotion. October 4 explicit-authorization follow-up: the maintainer authorizes one isolated 180-second gpt-6.1-sol/low read-only Codex session to process the named public arXiv test project bodies. The unchanged af2b3c6a candidate/cache 6d41caa0 and pack 78ea65da complete exactly one project-ID-only observation in 86.481425 seconds with seven successful native calls: project revision, two history-bound list pages and four body windows. Three current documents reconstruct exactly to disk bytes/hashes; the changed test copy is skipped. No supplied revision/path/hash/body, resource/shell fallback, fresh retrieval or write occurs. Project/Qiongli-config byte maps agree and temporary auth is cleaned up. The current plan binds prompt/answer/event hashes, user authority and the preserved earlier refusal/deferred record. Lightweight source-visible review retains partial 16/27 paper coverage, distinct PDF/packet identities, autoregression and unresolved BLEU values; it is not blind/expert or complete-paper acceptance. The earlier authorization-dependent observation is now completed for this candidate/project only. Next complete remaining paper passages and the reviewed note/save/restart journey through existing owners. Prior native/CLI/lint checks are reused; no task state/dependency, accepted-evidence or publication promotion. October 4 reviewed continuation: a single digest-bound native fetch retrieves segments16-26 of27 from the unchanged public PDF. Coordinator-reviewed packet, candidate-status manifest row and anchored note append use existing approved capture/consolidation owners, advancing the isolated project from revision6 to9 while preserving original note/CSV prefixes and both negative fixtures. The new row separates successful text transport from unverified report identity; the historical retrieved_preprint row is retained. One fresh gpt-6.1-sol/low installed Codex session exits0 in66.44seconds with ten successful native calls, recovering all four current documents from projectID alone and skipping the changed test packet. All returned bytes/hashes match disk; project/config remain unchanged and temporary auth is removed. Current-revision reading with the old note hash is refused without mutation (generic project-revision-conflict). The current plan binds raw/source/receipt/prompt/answer/event hashes, the corrected harness-only EOF assertion and exact limits. All27 extracted text segments are reviewed across two retrievals; visual/table/formula validation, source identity/version/license, provisional parsing values and BLEU41.8/41.0 remain open. Next reconcile layout-sensitive numerical claims against the same PDF and verify public report identity before source-status promotion. No code/content/install change, task state/dependency, accepted-evidence or publication promotion. October 4 identity/layout review: the same gpt-6.1-sol/low verifier renders original PDF pages1/8/9/10, confirms Table4 transcriptions and establishes that BLEU41.8/41.0 differs in the source layout itself. Primary arXiv records corroborate title/eight authors/v7 and repository DataCite DOI; publication DOI/version and broader reuse remain unverified. Reviewed raw metadata/render provenance, retrieved_preprint history row and note append advance the same isolated project9->12, preserving old bytes and native identity_status fields. Deterministic native list/read reconstructs all five current documents, including the96241-byte packet in two windows; latest receipts, prefixes and negative fixtures pass. Old-note binding refuses without mutation. The current plan retains direct license HTTP406, initial intake-helper approval rejection and later explicitly reviewed intake scope, exact hashes and limited visual scope. No new model/auth call or runtime/content/install change; preceding Host/native/lint evidence is reused. Next correct the previously observed three-literature-tool read-only descriptor gap without changing Host approval authority or claiming it caused earlier refusals. No task state/dependency, accepted-evidence or publication promotion. October 4 next-delivery source: 01d46f0a adds precise read-only/open-world hints to the three canonical literature descriptors without handler or permission changes. fd8ffcac prepares local 2.3.0 version owners and scoped candidate notes; the supported generator binds 446 resources to that content source. The same gpt-6.1-sol/low verifier passes 17 focused native, 41 packaging and 14 version checks, with tag/capability/format checks; the current plan preserves initial staging failures and the stopped unrelated legacy command. Next freeze clean local 2.x and qualify actual Linux ARM64 artifacts, manylinux 2.35 compatibility, isolated registry/Plugin installs and Cargo source archives; external manifests own the eventual exact-source results. Four-target CI needs separate remote authority. Historical public research observations remain source-bound; no new model/profile/private-library, task-state/dependency, accepted-evidence or publication promotion. Initial 2.3.0 release owner at f04bb473 passes strict headless Clippy but stops at42/46 CLI tests. One stale33-tool assertion is corrected to35; same-binary controlled diagnosis proves the other3failures are valid refusals caused by0775 checkout ancestors, not runtime defects. No security gate or existing permissions are weakened. Next qualify the revised clean source in a secure local clone and retain the original failed packet; the current plan binds exact paths and diagnostic evidence. No acceptance or publication promotion. The secure e977cb02 run passes Clippy and45/46 CLI tests, exposing a later synthetic cache-copy failure. Controlled Codex/Claude observations prove directories inherited0700 under umask077 instead of the exported0755 contract. The test copier now preserves source directory permissions; runtime verification and approval/drift negatives remain. Next qualify the final clean source in the same secure clone; initial failed packets and diagnostic setup mistake are retained. Staged prior-source Cargo archives do not establish installation or final-source evidence. October 4 local 2.3.0 qualification: exact source bc8c0fdd passes the unchanged release owner in rootless Ubuntu 22.04/glibc 2.35, including strict Clippy, 46 CLI + 9 MCP tests, actual manylinux 2.35 audit, archive/npm/wheel installs, Plugin archives and five asset hashes. Final Cargo source archives install offline with both aliases; existing pip 1.17.0/npm 2.1.1 upgrades retain three synthetic files; packaged Lite 15/Full 35 annotations and mutator negatives pass. The current plan binds manifest 2bcf8adf and all receipt identities, preserves the glibc 2.39 symbol refusal and fixture/cache/setup failures, and separates archive closure from publication, live Host and data migration claims. Next separately authorize a candidate-branch push and exact-head four-target distribution/combined installs; the other three targets remain unrun. This evidence-only commit does not rebind bc8c artifacts. No task-state/dependency, accepted-evidence, model/profile, private-library or publication promotion. October 4 publication handoff: the maintainer explicitly authorizes stable 2.3.0 push and unattended release, stopping after accepted dispatch without subsequent monitoring. Final version-facing docs preserve runtime/content bytes and the bc8c0fdd local receipt identity. Remote main and 2.x are ancestors of the reviewed baseline; use a main fast-forward and immutable tag with the existing release-automation owner, retaining exact-tag four-target/asset/public-download and registry gates. No publication result or program acceptance is inferred; task states, dependencies and accepted records remain unchanged. The current plan owns the handoff scope and remaining limits. October 5 Plugin-quality baseline: local bcec1b0f adds the frozen three-case installed-Codex capture/review adapter over existing observation and Evaluation Truth V1 owners. The explicitly authorized gpt-6.1-sol/low calls all execute on the unchanged 153cb15d candidate; temporary authentication links are removed. Structural results are 2/3 and complete reviewed passes 0/3: retain the approved-fixture overlap, absent Skill-read traces, short paragraph and one unsupported resources/list call. Recovery reads current saved bindings and skips the changed synthetic packet. The same lightweight verifier passes 50 focused checks; the current plan binds raw captures, corrected review, actual token/tool/time metrics and the initial review/setup/approval failures. Literal section coverage is corrected to 70/82 without claiming academic defects or token savings. Next establish actual Skill-body loading and requested output bounds before expanding cases; the three-call Codex login authorization is exhausted. The subsequently requested Antigravity adapter is tracked under CLI-409. No task-state/dependency or accepted-evidence promotion, user-model/profile change, private research, release monitoring or publication. October 5 authorized 2.4 implementation: e167f4bd strengthens existing Plugin observation freeze/seal, full call bindings, run-outcome retention, installed guidance evidence and whole-answer length checks; f825c60f updates canonical reading/writing guidance. The 2.4 plan records 77 focused passes, capability validation, exact content-only materialization, original 227-character failure reproduction and the interrupted legacy materializer attempt. No new live Host, credential reuse, native candidate build or publication occurred. AGY full-result capture/clean shutdown and fresh installed-Codex observations remain next; save/restart, held-out and upgrade qualification remain open. Task states/dependencies and accepted evidence are unchanged. October 5 fresh installed-Codex preparation: 8618fb44 refreshes the 446-entry native pack from content source 7bbcb171 and stamps a test-profile CLI-only build (cbd45851; pack caecff2f). Official Codex 0.160.0 installs quality-next in a new private profile; 468 receipt-listed files/modes and complete native Skill projection match, with Lite15/Full35 discovery. A new public/synthetic revision-4 project passes two exact document readbacks and changed-source/stale-revision refusals; all fixture saves precede the 16-file input freeze 01b799b2. The 2.4 plan binds all identities, independent low-cost verification and retained preparation failures. Three known-guidance-path cases remain unattempted; no auth reuse, model execution, live acceptance or release claim. The next bounded three-call batch needs a new temporary-login grant; the earlier grant is exhausted. Task states/dependencies and accepted evidence are unchanged. October 5 authorized fresh Codex observations: the new three-call gpt-6.1-sol/low login grant is exhausted and both temporary links are removed. The initial driver fails before any model call on a text/bytes hash mismatch; a new corrected freeze e1ceec15 follows a complete offline driver smoke. All three real processes then complete normally on the unchanged 8618fb44 candidate, but structural and complete reviewed results are 0/3. Sealed capture ed52402a and model review 634cacc8 retain missing guidance-load evidence, one incorrect anchor count, an undelivered paragraph and an actual MCP approval denial without recovered documents. All project/config snapshots are preserved. Offline app-server startup reports a user-namespace requirement; effective read-tool policy remains unverified and sandbox command probes stop at configuration validation. The 2.4 plan binds failures, actual metrics, cleanup and diagnostic limits. Next establish read-only Host execution and effective scoped tool policy before any newly authorized model batch. AGY capture, save/restart, held-out and upgrade/release gates remain open. No task-state/dependency or accepted-evidence promotion, user-profile change, push or publication. October 5 release-readiness implementation: 13548357 adds credential-free fail-closed Codex sandbox preflight with actual fake-process regressions; real preflight retains sandbox denial and absence of auth. Candidate e4b05659 sets canonical 2.4.0 and checked source coverage; the generated 446-entry pack 2693f17f binds that content source. The 2.4 plan records focused checks, unchanged historical failures and independent Host-policy/quality gates. No new model call, credential reuse, task-state/dependency or accepted-evidence promotion. The preflight runtime-access correction adds only the resolved public Codex executable to the read allowlist; nine focused tests and the boundary check pass. Nested runtime observations remain unsuccessful, and no Host or policy pass is inferred. Local artifact qualification retains its separate 84bc1079 source identity. October 6: maintainer explicitly authorizes use of the existing system Codex login for planned public validation; this authority remains available without another login-permission question after prerequisite repair. The same gpt-6.1-sol/low verifier runs one credential-free preflight at 9dfad782: Codex 0.160.0 version passes, but sandbox /usr/bin/true exits 1 with the retained bwrap loopback RTM_NEWADDR permission denial. Guidance/policy and model tasks do not run; both command groups are reaped, snapshots unchanged and auth absent. The 2.4 plan binds the new receipt 40e26f4b and read-only kernel clues without asserting a kernel-policy root cause. Zero new model calls or credential links; this is not a new failed baseline batch. Actual sandbox execution and effective read-tool policy remain prerequisites for the authorized observations. No policy/profile changes, task-state/dependency/accepted-evidence promotion or publication. October 6 repaired sandbox and installed regression: Codex 0.160.1 passes credential-free execution and effective exact read-tool policy. Retained public cohorts B and C each score structural 3/3, reviewed 2/3; canonical fixes 8889fe73/f26ee4a5 preserve method detail, resolve reading resources and bound coverage handoffs. Native candidate 85758cac / pack 1d84ed12 passes the fixed three-case structural and complete independent gpt-6.1-sol/low review 3/3. The 2.4 plan binds actual installation, guidance, whole-body recovery, tokens, failures and auth cleanup. This is test-profile installed-Host regression with prepared history, not automatic discovery, a new note-save journey or release-package acceptance. Next complete actual new-note save/restart and the three frozen fresh synthetic cases; no state/dependency or accepted-evidence change. October 6 persistence and fresh cases: unchanged candidate 85758cac saves the actual reviewed D answer through native preview/review/approval/CAS and passes fresh project-ID recovery structure/review 1/1. Missing approval, missing source and stale revision refusals preserve fixtures. Three pre-frozen synthetic cases pass structure/review 3/3 with abstract-only, conflicting-number/unit and changed-source handling; whole-answer reviews, native payloads, exact metrics and auth cleanup are bound in the 2.4 plan. These observed cases now become regressions, not broad academic or automatic-discovery acceptance. AGY and final-source artifact gates remain separate; task states, dependencies and accepted evidence are unchanged. October 6 writing-quality follow-up: canonical b2d52413 applies readable prose guidance during drafting, strengthens RQ-linked literature synthesis, and extends citation coverage and explanatory-note rules through existing owners. The 2.4 plan binds 81 focused checks, exact materialization and three complete synthetic forward-trial answers with subsequent same-agent review using gpt-6.1-sol / low. These temporary observations do not reproduce the unavailable user manuscript or establish installed-Host, controlled improvement or expert acceptance. Actual manuscript/source review and changed-candidate qualification remain open; no task state or accepted evidence changes. October 6 traceability priority: the maintainer makes source-traceable literature summaries and substantive writing the main 2.4.0 outcome. The existing plan orders exact passage readback, bounded discovery, claim traversal/review, synthesis/change tracking and installed qualification. First implementation 6970da52 adds optional JSON-pointer selection through the shared saved-document CLI/Full MCP owner, preserving raw wire behavior, current revision and whole-file identity. Focused local evidence is recorded in the 2.4 plan; cross-document search, automatic claim traversal, source-support review and installed-current-candidate qualification remain separate pending work. No task state, dependency or accepted evidence is promoted. Slice B implementation 8da74df2 adds literal passage search within one explicitly bound saved file, returning exact context readback arguments and query/source-bound pagination through CLI and the existing Full reader. The 2.4 plan records focused local checks and pack b4e70b64; metadata matches and no-hit results retain explicit evidence-scope limits. Next is claim-to-source traversal and review (C), then synthesis/change tracking and installed qualification (D/E). No acceptance promotion or new evidence store is introduced. The maintainer clarifies manuscript-first scope for C: body assertions, explanations, logical bridges, captions and notes must be traced while writing. Canonical increment 8e25df35 connects existing Stage F and evidence-verification owners, retaining claim IDs/locations and separating source support from writing quality. Two frozen synthetic tasks exercise body drafting and full-claim audit with actual two-location native recovery; same-agent review and real-manuscript/installed limits remain explicit in the 2.4 plan. LF-only fixture correction 4ffa62fe retains original observations and separate recovery bindings. D/E remain open; no semantic native extractor or acceptance promotion is introduced. D canonical increment f469c8e6 connects reading summaries, cross-paper synthesis and changed-source review to actual manuscript uses; 56ee4916 clarifies partial body evidence without adding labels or claiming whole-paper access. Frozen synthetic initial/update outputs and a separate prompted repair preserve source versions, failures, original claim-atomization/binding omissions and unchanged conclusions. The current plan records requested gpt-6.1-sol / low checks and same-agent review limits. Next is E installed continuity and final-source qualification; no automatic dependency engine, real-manuscript acceptance or task-state promotion is claimed. October 7 E observation on unchanged ff6ce4db/content56ee4916: official isolated Codex fixed regressions pass structure and full review 3/3. The new frozen installed-trace exercise produces source-supported body and note, but its original claim map combines a finding and inference; complete writing pass is 0/1. Native summary/handoff save preserves that original with partial/unaccepted review and passes approval/revision/source-drift refusals. Fresh literal search and exact source readback pass, but body/claim-ID recovery remains 0/1: the driver did not establish an authorized summary-discovery route from redacted project metadata and the saved-document list. A correctly denied unapproved tool is not retried; this is not proof of a native bug. The plan binds full outputs, prerequisite corrections, preservation and cleanup. Next fix atomic mapping and establish supported discovery before a separate frozen continuation; no original capture, task state or accepted evidence is relabelled. October 7 real-sample follow-up: the maintainer supplies an earlier-version manuscript section, retained outside the repository with private diagnostic/selected-span records. Source texts, bibliography and surrounding paper are still unavailable; citekeys do not establish support. Canonical71765313 strengthens substantive literature synthesis versus contribution/protocol language, cross-source comparability and broad literature/dataset claim support, and separates independently checkable findings/inferences sharing one passage. A frozen invented regression reuses earlier sources; one376-word original and complete same-context review pass, alongside13 content checks and materialization/capability/resource validation. The current plan preserves original observations and limits. This does not establish repair of the real manuscript or clear E installed discovery/recovery and atomization gates; accepted records remain unchanged. October 7 readability follow-up: canonical c6313177 strengthens readable, concise expression and explicit reasoning across all requested manuscript sections through the existing scholarly-voice and Stage F owners. Necessary technical meaning, premises, quantities and qualifications survive simplification; paragraph links and scope continuity are reviewed separately from source support. Three frozen original synthetic responses receive complete targeted same-context reviews, with 14 scoped content checks and materialization validation passing under gpt-6.1-sol/low. The plan retains the initial interrupted broad-check selection and limits. This is not whole-manuscript or installed-Host qualification; saved-writing discovery and a separately frozen continuation remain next, with accepted records unchanged. October 7 completion request: the maintainer requests atomic claim and saved-writing recovery completion then publication-task dispatch. Source c9748636 extends existing receipt-backed discovery and strict document reads/search to saved stage summaries, preserving 15/35 tools, source/revision checks and unchanged write authority. Eight list, eighteen reader, five actual CLI/MCP and focused content checks pass; the current plan retains setup failures and freezes a separate installed continuation. Previous failed outputs remain unchanged; program acceptance is not promoted. On isolated candidate 3fa02b17, installed baseline passes 3/3. Original new writing remains 0/1 for five mixed claim rows; one explicit reviewed correction preserves body/note and twelve rows, retires five IDs and introduces ten new IDs with lineage. Native audited sources, approved saving and fresh project-ID-only recovery pass, including all 13534 summary bytes and exact source search/readback. New boundary originals are 2/3; their unit-conversion omission passes a separately reviewed correction. Original failures, a denied ungranted correction call and review errata remain retained; the final reviewed workflow is qualified within this synthetic scope, not first-draft infallibility or broad acceptance. October 8 writing increment aligns child cards, corpus-driven mapping, original inference and pooled-result attribution with Stage F. Frozen long-form supplied-guidance comparison completes on gpt-6.1-sol/low: candidate2/2 and baseline2/2 pass anonymous six-dimension review. Original transport failures remain; focused contracts, projection and pack checks pass. The current plan binds exact outputs and limitations; no pass-count improvement, installed discovery, expert acceptance or general writing-quality claim is inferred.
CLI-406	proposed	CLI	Extend existing task/checkpoint owners with atomic local claims, isolated candidates and exact-digest review contracts (LF-Q06).	CLI-405	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md docs/superpowers/reviews/2026-09-11-outcome-guided-skills-review.md docs/superpowers/reviews/2026-09-11-outcome-guided-skills-trial.json docs/superpowers/plans/2026-09-15-v2-0-1-transition-release-execution.md blocker: Preliminary delegation and portable proposal guidance is locally implemented at baa892dc; this does not implement or accept atomic cross-Host task claims, checkpoint transfer or concurrent canonical writes. CLI-406 remains proposed under ADR 0218 and its existing dependencies. September 22: the maintainer authorizes a bounded 2.1 Host delegation increment. Optional completed delegation observations bind actual reported dispatch identities and exact result bytes to the originating handoff; existing coordinator evidence and checkpoint CAS remain authoritative. Canonical Skill source 051a35dd passed an actual synthetic subagent forward test and scoped independent review. Native implementation and resource lock 2e4a5c1e passed 117 execution tests, seven copied-binary MCP tests and all-target Clippy; 11 Skill contracts and the final added byte-boundary assertions also passed. Validation and local integration are recorded in the current plan. This is not execution authentication, an automatic external adapter, cross-Host claims or two-Host acceptance; state and dependencies remain unchanged. Next increment implemented: configured Codex transport at 05113e41 with canonical Skill source e99f3387 prepares fixed argv/stdin and collects source-bound JSONL through the same delegation owner. The Host retains launch, process supervision, cancellation and cleanup; no Qiongli launcher or new task store is added. 118 execution, 41 CLI, seven MCP and 11 Skill/handoff tests pass, with final focused file-boundary checks and all-target Clippy. Actual configured Codex 0.155.1 synthetic runs demonstrate completed collection, cancellation after turn start, startup timeout and a separately launched fresh run; independent gpt-6-astra/low review found no blockers. Exact identities, hashes and limits are in the current plan. Next exercise registered synthetic Full MCP submission, changed sources and in-turn timeout. Persistent reconnection, installed-Host, two-Host claims and collaboration acceptance remain open; no state, dependency or accepted-evidence promotion. September 23: local 2.x source 130bebf3 passed a registered synthetic Full MCP test through real configured Codex 0.155.1 and authenticated project reads. A completed old-revision result was rejected after semantic revision 2->3 (project-revision-conflict); a timeout after turn.started was reaped and collect rejected it; a fresh execution with a distinct thread ID was collected and accepted as a synthetic candidate with authenticated read evidence. The current plan records exact thread IDs, JSONL hashes, candidate digest and the canary-content limit. No installed Plugin, real research/library write, persistent reconnect or two-Host acceptance was tested. Existing task state, dependencies and accepted rows remain unchanged. September 24: the requested DeepSeek Cordis Plugin and Claude Code/DeepSeek/Antigravity prepare/collect adapters reuse the existing native projection and coordinator/result owners. The current plan records successful temporary DSH Plugin activation (two Skills, 32 Full MCP tools and config status) and actual synthetic Claude/Antigravity collection. Published DSH 0.1.5-rc.3 lacks the source-documented headless --json protocol, so that external execution lane remains unqualified. Canonical Skill source is 839cc17f; no installed-user configuration, research write, publication or acceptance promotion occurred. Follow the current plan for focused validation, remaining Host/platform checks and source integration. September 30: installed macOS ARM64 DeepSeek Harness 0.2.0-rc.2 accepts the clean-source c2e10fb1 Qiongli bundle through its official manager. Isolated repeat installation preserves the profile; live Cordis activation loads two Skills, exposes 32 Full MCP tools, calls config status successfully and exits 0. Removal preserves other bundles. Headless help now exposes --json, but actual model execution and installed-user activation remain untested. Exact source, artifact hashes, failed probe attempts and scope are recorded in the current plan; no state, dependency or accepted-evidence promotion.
CLI-407	proposed	CLI	Complete two actual local Host sessions performing bounded work and candidate review before human commit (LF-Q07).	CLI-406	—
CLI-408	proposed	CLI	Prove local claim conflict, stale sources/reviews, cancellation, duplicate commit, crash recovery and approval revocation cases (LF-Q08).	CLI-406	—
CLI-409	proposed	CLI	Qualify additional Hosts independently against the same native contracts and declared capabilities (LF-Q09).	CLI-405	evidence: docs/superpowers/plans/2026-10-05-v2-4-plugin-quality-release-plan.md blocker: October 5 maintainer-selected Antigravity increment: local ff62b06a adds terminal install/update targets antigravity/agy, native Plugin projection and separately confirmed official registration over existing receipt/CAS owners. ADR 0233 preserves signed/App targets, configured models and canonical MCP contracts. Nine new adapter/bundle/cache checks and closest retained Codex/parser/guide checks pass, with strict affected Clippy, formatting and ADR validation. Actual AGY 1.2.17 install/update passes in an isolated profile with binary 726154ba and matching source/cache receipt debf43d0; 468 files match, including modes. The observed owner-only cache directory mismatch is fixed only in the read-only AGY cache verifier, retaining strict source/signed, ownership/link, drift and unsafe-permission checks. Authenticated workspace observations separately prove workflow/paper-read entry reads and fresh-session Full35 discovery; the final new-candidate run obtains one exact single-approved config_status return. Earlier headless denial, empty-tools session, native timeout, cache mismatch and driver failures are retained. The final call returns an object, but full raw MCP JSON is not independently serialized and a subsequent driver assertion ends the Host with exit -9; this is not a clean-exit or broad academic pass. Project/config byte maps and temporary-trust CAS cleanup pass, restoring the original settings bytes. The current plan binds manifests, receipts, logs, review and remaining limits; next improve structured result capture and clean shutdown before academic write/restart tasks. No persistent trust/permission, user Plugin/model, credential migration, task-state/dependency or accepted-evidence change; no push/publication or release monitoring. October 5 AGY observation increment 1ae2bbdd and scoring-identity fix 0cac3641 add a bounded stream capture/cleanup adapter under the existing research-journey and Evaluation Truth V1 owners. The 2.4 plan records 56 focused passes and a read-only replay preserving the historical permission denial/missing output despite Host SUCCESS. Exact command/environment, complete result, process/group cleanup and fixture preservation remain separate checks; no model or permission override, credential migration or live rerun occurred. Actual installed full-output capture/clean shutdown remains unqualified; independent Codex preparation can proceed. Task states/dependencies and accepted records are unchanged. October 5 packaged-candidate observation: archived native source 84bc1079 exports a 2.4.0 AGY Plugin with 22 Skill entries and all 467 receipt entries verified, including bytes and modes. Its bundled executable directly completes Full stdio initialization, 35-tool discovery and a complete matched qiongli_config_status call in isolated public configuration. The 2.4 plan binds binary, pack, installation receipt and raw-result hashes. Official registration is declined and no AGY Host/model/authentication is used. These package/native checks do not fill the actual AGY complete-output/clean-shutdown or read/recovery gates. No task state, dependency or accepted record changes. October 6: isolated AGY 1.3.0 native source export and official install/enable pass on unchanged 85758cac; source/cache, receipt and exact status-only policy are verified. One bounded official Host startup lacks silent login, exits 1 after 60.79 seconds with zero model turns/MCP calls, and preserves snapshots/cleanup. No credential files are inspected, copied or linked; no login fallback or retry occurs. The retained profile awaits normal user login before complete Host result/normal-completion and read/recovery observations. Separately, archived c2cae736 exports 22 Skills and passes Full 35/status native stdio; this does not fill the Host gate. The 2.4 plan binds evidence, setup failures and unchanged acceptance scope. October 6 authenticated observation: after the maintainer logs into the retained isolated AGY 1.3.0 profile, one status call returns schema-valid native data and exits normally in 12.124649 seconds with verified cleanup and unchanged public fixtures/settings. The Host exposes a projected JSON body without the MCP response envelope, so the original strict full_native_result gate remains failed. The current 2.4 plan binds the new capture and earlier login failure separately; bounded projected-body recovery cannot substitute for this missing wire evidence. No configured model or accepted record changes. The first projected-body recovery fails: project read succeeds, seven list attempts use invalid parameters, two schema/Skill file reads are denied, and no body is recovered. The test policy also blocks Host schema discovery. Its raw failure and exact cleanup remain retained; a separately frozen metadata-access observation is next. The separate metadata-assisted r3 observation completes normally and native windows reconstruct both complete saved bodies, but one missing native output, a denied Host output-file read and an inaccurate reported count keep whole-session/V1 at 0/1. Permission/settings restoration and source-fidelity checks pass. The 2.4 plan binds both retained failures; a proposed experimental release boundary awaits the maintainer decision and does not yet change the required gate. October 7 explicit maintainer decision: Antigravity CLI is experimental in 2.4.0. Installation/status and schema-assisted body observations remain scoped successes; automatic discovery, complete session recovery and original MCP envelope capture remain unqualified. The strict failed gates are retained for later promotion, rather than required for this experimental release scope. Release notes and installation documentation disclose this boundary; no accepted state or model/configuration change. October 7 post-release-task entry fix: ADR 0234 narrows new AGY exports to the qiongli research router and independent no-qiongli reply-only entry, retaining all internal workflow resources, language/variants, one MCP server and strict legacy receipt readers. Four existing AGY cases and two new compact/legacy cases pass, along with five terminal-adapter and two shared bundle checks, strict affected Clippy and formatting. An isolated official manager installs the legacy 22-entry source, validates and replaces it with two entries, removes old wrapper directories and preserves identical source/cache receipt bytes. Original unsafe-directory, invalid-fixture, hardlink and timeout results remain in the current plan; no full Codex integration, GUI/model routing or complete-session pass is claimed. Verification uses gpt-6.1-sol/low without live Host model/authentication calls or actual user-profile changes. The plan binds scoped evidence and the next delivery increment; no task state, dependency, accepted record or publication change. October 7 Pi increment from 26cc94c4: ADR 0236 adds terminal target pi/choice 7 and detected all-install, with a receipt-bound two-Skill local package and built-in Full MCP extension for Pi 0.99.0+. Existing source/profile/model choices are preserved, with separate source/registration approvals and unsafe/filter/duplicate/CAS refusals. Six adapter, three bundle, seven CLI, five AGY adapter, two exact AGY bundle and two shared bundle cases pass, along with strict affected Clippy. Official 0.99.0 and 1.1.0 package loaders pass; isolated 1.1.0 installation honors a custom agent directory and creates private settings under parent umask 002. Both cancellation boundaries pass. A no-LLM SDK session discovers the two Skills and 35 native MCP tools with deferred exposure and completes config-status. The current plan binds original compile/fixture/space failures and corrected outcomes; no model-driven research, cross-platform, user-profile or release qualification is claimed. Next deliver the accumulated local Pi/all-install/AGY changes under a separately scoped CLI update and qualify real research sessions. Task states, dependencies and accepted records remain unchanged. October 8 maintainer authorizes delivering the accumulated Pi/all-install/compact-AGY changes in 2.5.0 with experimental Host limits retained. Candidate cfbb897c passes Linux ARM64 package/upgrade checks and current-pack Pi3/AGY6 regressions. Prior SDK/Host observations keep their original source bindings; model-driven Pi and cross-platform Host qualification remain open.
CLI-410	active	CLI	Qualify and separately authorize the standalone CLI baseline release without waiting for local collaboration (LF-Q10).	CLI-405	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md tooling/release/v2.0.0-alpha.6.md tooling/release/acceptance/v2.0.0-alpha.6-github.json tooling/release/v2.0.0-alpha.7.md tooling/release/acceptance/v2.0.0-alpha.7-distribution.json docs/architecture/decisions/0221-cargo-cli-publication.md tooling/release/v2.0.0-alpha.8.md tooling/release/acceptance/v2.0.0-alpha.8-distribution.json docs/architecture/decisions/0223-bundled-marketplace-native-mcp.md tooling/release/v2.0.0-beta.1.md tooling/release/acceptance/v2.0.0-beta.1-distribution.json tooling/release/v2.0.0-beta.2.md tooling/release/v2.0.0-beta.3.md docs/architecture/decisions/0227-native-main-cutover-and-stable-release-routing.md tooling/release/v2.0.0.md docs/guide/whats-new-2.md docs/zh/guide/whats-new-2.md docs/architecture/decisions/0228-channel-specific-native-plugin-identities.md docs/superpowers/plans/2026-09-15-v2-0-1-transition-release-execution.md docs/architecture/decisions/0229-plugin-v1-transition-and-2-1-cutoff.md tooling/release/v2.0.1.md docs/architecture/decisions/0230-local-macos-verification.md docs/development/local-macos-checks.md docs/architecture/decisions/0231-hosted-three-platform-verification.md docs/architecture/decisions/0232-linux-arm64-registry-distribution.md tooling/release/v2.2.0.md commit 4f2107f7fda9 run 34767534232 blocker: September 14 read-only review confirms stable v2.0.0 at 4f2107f7, published September 13 with 16 GitHub assets. Release Automation 34767514924, native three-target build/combined-install run 34767534232, npm 34768004314, PyPI 34768005399 and Cargo 34768006565 all succeeded at that source; Cargo includes three successful public-install jobs. npm latest is 2.0.0 and next remains beta.6; PyPI exposes three non-yanked 2.0.0 wheels. Direct crates.io metadata returned HTTP 403, so Cargo evidence is the Actions record. The existing plan records all links and limits; no fresh local artifact download verification occurred. Publication is complete within the standalone CLI lane, while this broader task remains active for baseline/Host dependencies and unclosed qualification. External catalogs, installed Host/Hook/browser/collaboration, full replacement and 1.x/Desktop retirement are not accepted by distribution success. The answer-bound implementation at 7c843870 repairs that test and records two synthetic supplied-entry observations, with structural/semantic results separate and the initial projection failure retained. The C-to-F increment at 7e3de537 now preserves both the initial timeout (1/2) and separate completed attempt (2/2) with source-bound coordinator self-review, not installed-Host qualification or acceptance. Distribution scan fix ec3d700b passes all 38 related checks without changing package content, but the retried full suite was stopped with other failures visible and remains incomplete/unqualified. Architecture fix c91773e5 registers existing ADRs 0226/0227 and passes all 23 architecture checks without changing accepted ADRs or the frozen inventory. Full discovery was not rerun. Delivery fix e6a89ea0 and publisher assertion fix f76b406d now pass their focused checks without relaxing approval/release authority; installed-Host and broader qualification remain open. The 46 accepted records remain unchanged. September 15 source increment dc2500c3 implements stable qiongli versus Alpha/Beta qiongli-next identities and receipt-compatible migration under ADR 0228. Isolated real Codex cancellation, confirmed migration and full old/new cache hashes pass, including the hidden old-ID configuration case. Existing model settings and live user installations are unchanged. The current plan records focused checks and remaining release/session qualification; published 2.0.0 and all 46 accepted rows retain their existing evidence. ADR 0229 retains Next/v1 in 2.0.1 and moves v1 output retirement and stable identity migration to 2.1 without removing verified legacy receipt readers. The current transition execution plan records the gpt-6-astra / low implementation, two coordinator review repair rounds and development port 60f2cf37. Final compatible main 789b0bbe is qualified-unpublished on macOS ARM64: 47 CLI/MCP tests, archive/npm/wheel/two Plugin checks, five artifact hashes and actual both-Host v1/Next evidence pass. Isolated real 2.0.0 source upgrades, repeat/refusal/drift retry and old-CLI restoration/reupgrade pass for Codex and Claude. Exact source, artifact hashes, commands and limits are in the plan. Windows/Linux, real combined packet, Cargo/public installs, remote refs, publication and installed-Host acceptance remain pending. One unchanged diagnostic negative and full-suite gaps remain disclosed. All task states/dependencies and 46 accepted rows are unchanged. The subsequent CI policy increment (21e3f43b / 86714195; compatible main 4ebd1825) moves all macOS checks to manual local execution with receipts while retaining Linux/Windows Actions and the exact three-target release gate. 165 development and 144 compatible-main tooling checks pass after independent release-file review; minimal workflow-only maintenance patches are prepared. Prior 789b0bbe release evidence remains historical. The changed candidate needs fresh release qualification. Remote synchronization and removal of the obsolete required macOS context in ruleset 18800504 remain pending separate authority; no push, rule update or publication occurred. ADR 0230 and the current plan record scope and limits. September 22: ADR 0231 restores hosted macOS/Linux/Windows CI under the maintainer decision (9e1f575d, compatible main 370e250f); 158 development and 140 main checks pass. The previous local-only patches and remote macOS-context removal proposal are withdrawn. Exact-source release qualification and separate publication authority remain required; no remote action occurred. October 3: the maintainer reports Ubuntu 24.04 aarch64 selecting only 1.x through pip. Official-index reproduction confirms missing Linux ARM64 wheels in published 2.1.1 and missing npm ARM64 dispatch. The existing release owners now cover four targets under ADR 0232, with schema-2 completeness and preserved historical packet readers. The current plan records focused resolver/integrity/compatibility checks and actual isolated ARM64 pip/npm/DSH/Plugin installs from an audited Ubuntu 22.04, Rust 1.97 build. This is local development at the unchanged version; a new version, exact-source hosted four-target qualification and public registry installs remain separate release work. No task state, dependency or accepted-evidence promotion. October 3 release freeze: merge 24d05560 combines the maintainer research branch 24ec2f04 with ARM64 repair 52a8705b. The current plan and v2.2.0 notes freeze existing features, stable identities, platform and receipt rollback limits; retrieval-list persistence moves to the next version. Fix 3bdf0c3e validates Cargo archives against the application lockfile and selects the canonical native Skill-doc generator. 160 focused Python checks, version consistency, pinned Rust 1.97 formatting and Clippy pass. Ten actual unpublished Cargo archives match the lockfile; installation is still pending. The broad validator retains 18 failures. CLI library tests are incomplete/failed (198 passed, 25 failed, one ignored and one barrier test terminated); independent crates finish with 586 passed, 50 failed and two ignored. Focused failures identify group-writable checkout ancestors, without weakening security or attributing every failure to the environment. Candidate remains Not ready pending stage-2 triage and same-source installed-package/four-target qualification. Source push is authorized; publication, tags, external catalog changes and announcement are not. All task states, dependencies and accepted records remain unchanged. October 3 blocker cleanup: 80c0c305 clears all 18 broad-validator failures through native guide/wrapper/materialization owners; 6132 checks pass with zero failures and 11 warnings. Secure isolated reruns separate directory/process-container limitations from the actual update-state read race fixed in 6fe18848. Final CLI library: 224 passed, zero failed, one ignored; config: 46 passed; Rust 1.97 formatting and Clippy pass. 97d8621a adds actual pip/npm predecessor-upgrade and byte-retention qualification, plus ARM64 Cargo jobs, without changing publisher authority. The plan records negative coverage, pack identity and local evidence limits. Local source blockers are cleared; same-commit hosted Native CI, four-target distribution/upgrade and Cargo qualification remain the artifact/platform gate. No task state/dependency/accepted-evidence promotion, publication, tag or protected-branch mutation. October 3 hosted qualification: candidate 7a78998b passes four-target distribution/install/upgrade run 37122518753 and Cargo archive qualification run 37122520347; downloaded packet verification and receipts pass, with all publication jobs skipped. Native CI 37122517256 exposes Linux process-environment and Windows private-directory fixture failures; the unsuccessful run is cancelled before macOS completes. Bounded fixes retain fail-closed process/ACL checks, distinguish complete zombies from exited leaders with live siblings, and isolate Linux test PID visibility. The repaired isolated CLI library passes 225 tests with zero failures and one ignored; nine boundary checks pass. Final repair source still requires exact-source Native CI and rebuilt package qualification. Task states/dependencies and accepted evidence remain unchanged. The ed8b65c4 four-target packet/upgrade run 37123788432 and Cargo run 37123789994 also pass. Subsequent full Native CI passes Windows library and CLI integration checks but exposes a stable-version/Alpha activation fixture and Linux process-snapshot test interference. The bounded test repair derives the activation channel, canonicalizes the process fixture temp root and serializes Linux test cases; eight focused process/recovery/activation cases and pinned Clippy pass. Final exact-source full CI remains pending, with no new production/content changes or publication. At 3434d0ab, four-target distribution/upgrade 37124720678 and Cargo 37124722404 pass; full Native CI 37124719241 clears the prior process and activation failures but all three platforms stop at additional stale Alpha artifact fixtures. A bounded audit repairs native artifact/archive/candidate/Desktop fixture identities and the stale embedded Companion version assertion. Five real-byte artifact integration cases, pinned Clippy, actual Cargo runner forwarding and 20 workflow contracts pass locally. CI collects all executable failures, serializes only process-sensitive application tests and allows the observed long manual matrix to finish without weakening gates. New same-source full qualification remains required; no accepted-state or publication change. At 1723c349, four-target CLI/upgrade 37126287836 and Cargo 37126289228 pass again. Full Linux/Windows headless collection exposes two retained alpha-only example fixtures and a Windows transaction-lock cleanup failure. Explicit internal release identity injection preserves alpha signer boundaries and workspace-bound executable identity; the rollback fixture releases its owner only after byte-retention assertions. Eleven focused Rust tests, seven version-contract checks and pinned Clippy pass. Locked frontend checks pass: App API 38, Desktop 254 (one skipped), retained npm 82, type checks and production bundle validation. Final same-source full Native CI and rebuilt artifacts remain required; no publication or accepted-state promotion. October 3 post-release reconciliation: GitHub API confirms v2.2.1 published at 17:51:15 UTC with draft=false and prerelease=false. Earlier 2.2 candidate qualification notes above remain historical, not the current development queue. New retrieval-manifest work is local post-release development and is absent from the published 2.2.1 CLI. Public Release metadata alone adds no registry-install, platform, Host or academic acceptance; accepted records and dependencies are unchanged. October 5 maintainer authorizes development through 2.4.0 release readiness. Upgrade qualification 13548357 accepts an explicit predecessor via the shared version owner, preserves historical defaults and records unavailable/failed checks without substitution. The four-target workflow adds a separate 2.3.0 upgrade and retains failure receipts. Eleven upgrade regressions pass, including multiple Cargo archives and integrity/data-retention negatives. Canonical candidate e4b05659 and pack 2693f17f report 2.4.0; candidate release notes retain open Host/platform gates. The current 2.4 plan records 70 focused passes and successful ordinary rootless glibc 2.35 startup after retained old-runtime/runroot failures. Next run exact-source local packaging/upgrade and separately close live Host and four-target qualification. No release acceptance, remote synchronization or publication. October 5 local 2.4 qualification: clean native source 84bc1079 passes the existing Linux ARM64 release owner in isolated glibc 2.35: 46 CLI and nine MCP tests, strict Clippy, formatting/version, archive smoke, wheel audit and npm/wheel installs. Codex/Claude archives and the DeepSeek projection pass; actual public pip/npm 2.3.0 upgrades retain all three synthetic canaries without fallback. Ten Cargo archives validate and install successfully, including qiongli/ql and Lite 15/Full 35 checks. All five release asset checksums verify. The 2.4 plan binds receipts and preserves initial failures; later observation-tool/docs source is not substituted for 84bc. Release remains Not ready pending actual Codex/AGY quality, save/restart/held-out and final-source four-target/Cargo qualification. No push, tag, publication, task-state/dependency or accepted-evidence change. October 6: installed-Codex regression now passes structure/review 3/3 on 85758cac after two separately retained 2/3 cohorts and bounded content fixes. This test-profile candidate has new content source f26ee4a5 / pack 1d84ed12; prior 84bc1079 glibc2.35 artifacts do not qualify it. The 2.4 plan binds exact results and unchanged public-validation authority. Save/restart, fresh held-out, AGY and final frozen-source four-target/Cargo/package checks still gate readiness. No remote synchronization, publication or acceptance promotion. October 6 follow-up: actual new-note save/restart passes 1/1 and the frozen fresh synthetic cohort passes 3/3 on unchanged 85758cac. The 2.4 plan binds independent review, negative cases and cleanup. Codex scoped quality gates are observed; AGY complete-result/clean-shutdown/read-recovery and final-source local plus four-target/Cargo qualification remain open. Release remains Not ready; no remote action, publication or acceptance promotion. October 6 final-content local qualification: clean c2cae736 / content f26ee4a5 / pack 1d84ed12 passes the glibc 2.35 Linux ARM64 release owner, 46 CLI and nine MCP tests, strict lint/format, five verified assets, Codex/Claude archives and DeepSeek projection. Actual 2.3.0 pip/npm upgrades and ten Cargo archive installs pass; qiongli/ql, Lite 15/Full 35 and content identities match. The plan binds new receipts and retains source-path/mode setup corrections and the detached-branch guard refusal. AGY isolated installation passes but actual Host login is unavailable, so complete-result/recovery and separately authorized final-source four-target/Cargo remote qualification remain open. Release stays Not ready; no publication or accepted-evidence change. October 6 remote authorization: the maintainer authorizes source synchronization, the existing protected PR route, Native CI and four-target CLI/Cargo qualification. PR 183 synchronizes released main history plus the 2.4 increment; initial runs bind 8a0403c4. A local documentation build exposes an out-of-root research-journey link; the canonical link is repaired and the build passes, without weakening validation. Authenticated AGY returns valid native data and exits normally, but its omitted MCP envelope keeps the strict result gate failed. Final-source qualification and this Host gate remain open. Publication, tags, main cutover, announcement and remote-rule changes are not authorized; task states/dependencies and accepted evidence remain unchanged. Initial PR Native CI exposes an obsolete three-Host assertion and Windows AGY/project fixture failures. Bounded test repairs assert four actual Hosts, reuse owner-only Windows AGY directory creation and canonicalize temporary project bases. Production guards remain unchanged; fresh hosted checks are required for the repair. macOS reproduces the stale assertion/noncanonical fixture failures and exhausts the 30-minute PR budget during later archive tests. The bounded CI repair raises only the PR native-job budget to 60 minutes, preserving manual 120 minutes, required contexts, full test selection and failure propagation. The initial run is failed/incomplete. Repair 843766f6 passes 21 affected Rust checks, strict Clippy/formatting and 20 branch-policy checks. Integrated f97b5f7a is pushed to PR 183; Evaluation Truth 37481012601 and Cloudflare Pages pass, while fresh Native CI 37481012794 runs separately from the initial failure. Metadata-assisted AGY recovery still fails its complete criteria despite exact native body reconstruction. Experimental AGY scope is proposed but not authorized; original release gates remain active. On f97b5f7a, Windows passes; macOS finishes with one retrieval-manifest fixture AlreadyExists failure. Three timestamp-only project fixture helpers now add the existing atomic-counter pattern while retaining exclusive creation and canonicalization. The plan retains the failed run and separate fresh hosted qualification requirement. PR 183 merges after all required checks pass on 1df769f9. Frozen merge 8fd774a05f5fc08fd0b61b0857fe869e87cd3af0 passes four-target CLI distribution 37494107157, combined installs, historical and explicit 2.3.0 upgrades, and Cargo qualification 37494107269; downloaded packet exact-source CI verification and all four install/archive receipt sets pass. The 2.4 plan binds 42 receipt/artifact files. Separately dispatched manual Native CI 37494133020 completes with all three foundations, boundary and Lite passing, but overall failure from seven retained Alpha/Desktop product jobs on stable 2.4.0; Community Alpha promotion is skipped; those failures are not relabelled passes, and existing CLI release boundaries do not require App/Community Alpha promotion. Strict AGY gates still fail and the experimental scope proposal awaits the maintainer. Readiness stays Not ready; publication and accepted evidence are unchanged. The subsequent b2d52413 writing-guidance increment changes canonical content and its regenerated pack. Four-target artifacts and installed-Host observations remain scoped to their older named sources; they do not qualify this changed candidate. The current plan records local checks and the remaining candidate qualification. Publication and the proposed experimental AGY scope remain unauthorized. The maintainer expands the main 2.4.0 outcome to source-traceable literature and writing under the updated A-E execution plan. Native/content increment 6970da52 changes the release candidate again; earlier final-source package and Host results do not qualify it. Retain original release gates, pending AGY scope decision and publication authority while local implementation progresses. Slice B source 8da74df2 and pack b4e70b64 add saved-passage discovery to the candidate. Local CLI/MCP and content checks remain separate from final-source packages and installed-Host qualification; C/D/E and original release gates remain open. No publication or pending AGY scope decision changes. Manuscript-first content 8e25df35 and regenerated pack 2e154819 change the candidate again. The current plan separates bounded materialized-guidance/self-review/native-read observations from installed-Host and final-source package qualification. Prior packages do not qualify these new bytes; D/E, strict AGY gaps and publication boundaries remain unchanged. D source f469c8e6 and excerpt-scope repair 56ee4916 change candidate content again. Its regenerated pack and bounded content/continuation checks remain local observations; prior published or four-target artifacts do not qualify the new bytes. The plan retains original output imperfections and prompted repair separately. E installed continuity, final-source packages and strict AGY gaps remain open; acceptance and publication/scope authority are unchanged. October 7 local candidate qualification binds clean ff6ce4db/content56ee4916/packd421f2ee separately from the test-profile installed Host binary. The Linux ARM64 glibc2.35 release owner passes strict Clippy, 46 CLI and nine MCP tests, five verified assets and isolated npm/wheel/Plugin checks; explicit public 2.3.0 pip/npm upgrades and installation from ten actual Cargo archives pass. The fixed installed regression is 3/3, but the new original writing/recovery pair is not a complete pass (compound claim row and inadequate summary-discovery prerequisite). The plan retains exact outputs and failures; final-source four-target/Cargo, strict AGY and representative writing qualification remain open. Release stays Not ready; publication/scope authority and all accepted records remain unchanged. October 7 real-sample guidance source71765313 changes canonical content again. The prior ff6ce4db LinuxARM64 release/2.3.0 upgrade/Cargo qualification remains bound to its original bytes. Targeted synthetic writing/content checks do not qualify the new installed or release candidate, or verify the private manuscript sources. The plan records the regenerated pack and retained E discovery/recovery, final-source multi-platform and strict AGY gaps. Release stays Not ready; acceptance, pending scope decision and publication authority remain unchanged. October 7 readability source c6313177 changes shared writing content and its pack. Targeted synthetic output/content and embedded-pack checks remain separate from installed-Host and release qualification. The plan binds their results; earlier package evidence retains its old source identity. Final-source packaging, E continuation and strict AGY gates remain open; release readiness, acceptance and publication/scope authority are unchanged. October 7 maintainer explicitly authorizes completion, reviewed main cutover and 2.4.0 publication-task dispatch, with no follow-up monitoring. Experimental AGY scope is separately approved, retaining failures for later promotion. Source c9748636 and pack bc44f8b5 add saved-writing recovery; old-source artifacts do not qualify these bytes. Current Codex continuation, package/upgrade and immutable-tag four-target gates remain mandatory; program acceptance and remote rules are unchanged. Candidate 3fa02b17 passes local Linux ARM64 glibc2.35 release construction, strict Clippy, 46 CLI/nine MCP tests, five asset checksum checks, explicit 2.3.0 pip/npm upgrades and ten Cargo archive installs. Installed reviewed-writing recovery closes its scoped gap, retaining original failures and separately reviewed corrections. Final documentation-only integration will use the existing main/immutable-tag release task with four-target verification before publication; a dispatch does not establish completed registries. Maintainer-approved experimental AGY and all accepted task records remain unchanged. October 8 maintainer authorizes 2.5.0 source synchronization, reviewed main cutover, immutable tag and release-task dispatch, then no monitoring. Candidate includes writing corrections and prior installation features; Candidate cfbb897c passes strict Linux ARM64 release qualification, CLI47/MCP9, five-asset audit, public2.4 npm/pip upgrades and checked Cargo archive installation. Final bookkeeping leaves product bytes unchanged; the immutable-tag four-target publication workflow remains the final gate. Dispatch is not completed publication. Existing acceptance records are unchanged.
CLI-411	proposed	CLI	Qualify and separately authorize the local collaboration release after real two-Host and fault evidence (LF-Q11).	CLI-407 CLI-408 CLI-410	—
CLI-412	deferred	CLI	Evaluate optional cross-device migration/synchronization only after local collaboration and a new scope decision (LF-Q12).	CLI-411	blocker: Optional cross-device work requires completed local collaboration and a new scope decision.

EVAL

ID	State	Owner	Description	Dependencies	Evidence / blocker
EVAL-401	accepted	EVAL	Mark every expected artifact as required or optional; missing required artifacts fail.	—	evidence: .trellis/tasks/archive/2026-08/08-12-close-eval-false-green-v1/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-402	accepted	EVAL	Replace free-form validation strings with versioned typed assertions.	EVAL-401	evidence: .trellis/tasks/archive/2026-08/08-12-close-eval-false-green-v1/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-403	accepted	EVAL	Reject unknown assertion types instead of silently ignoring them.	EVAL-402	evidence: .trellis/tasks/archive/2026-08/08-12-close-eval-false-green-v1/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-404	accepted	EVAL	Require executed_assertions > 0 for a successful case.	EVAL-403	evidence: .trellis/tasks/archive/2026-08/08-12-close-eval-false-green-v1/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-405	accepted	EVAL	Treat required SKIP, BLOCKED, parse error and unavailable validator as non-success.	EVAL-404	evidence: .trellis/tasks/archive/2026-08/08-12-close-eval-false-green-v1/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-406	accepted	EVAL	Implement initial validators: schema, field constraint, count conservation, cross-artifact consistency, locator syntax, citation identity and file digest.	EVAL-405	evidence: .trellis/tasks/archive/2026-08/08-12-implement-eval-406-validators/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-407	accepted	EVAL	Emit deterministic JSON and JUnit receipts with case, assertion, evidence, status and reason code.	EVAL-406	evidence: .trellis/tasks/archive/2026-08/08-12-implement-eval-407-receipts/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-408	accepted	EVAL	Add empty-project, missing-artifact, malformed, keyword-only, contradictory and stale-artifact fixtures.	EVAL-407	evidence: .trellis/tasks/archive/2026-08/08-15-make-one-eval-command-own-ci/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-409	accepted	EVAL	Convert academic-quality fixtures from declared scores into executable inputs and expected findings.	EVAL-407	evidence: .trellis/tasks/archive/2026-08/08-13-make-plugin-quality-executable/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-410	accepted	EVAL	Make one canonical eval command own CI; legacy Python entry points become tested compatibility shims or are removed.	EVAL-408 EVAL-409	evidence: .trellis/tasks/archive/2026-08/08-15-make-one-eval-command-own-ci/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266
EVAL-411	accepted	EVAL	Add mutation tests proving that deleting evidence or changing a count makes a previously passing case fail.	EVAL-410	evidence: .trellis/tasks/archive/2026-08/08-15-prove-evaluation-mutations-fail/prd.md .github/workflows/evaluation-truth.yml commit 237de9ba9e23 run 31984053266

GOV

ID	State	Owner	Description	Dependencies	Evidence / blocker
GOV-320	accepted	GOV	Publish the replacement matrix and three-tier verification policy; keep unverified user journeys open and preserve exact historical evidence for its original scope.	GOV-404 GOV-407	evidence: .trellis/tasks/archive/2026-08/08-20-qiongli2-migration-roadmap-rebaseline/prd.md .trellis/tasks/archive/2026-08/08-20-qiongli2-migration-roadmap-rebaseline/research/current-roadmap-and-verification-audit.md commit 41accaf04075 run 32651745050
GOV-401	accepted	GOV	Create a machine-readable program ledger with id, state, owner, dependencies, evidence, commit, run, updated_at and blocker.	EVAL-411	evidence: .trellis/tasks/archive/2026-08/08-18-program-ledger-current-index/prd.md docs/superpowers/roadmaps/qiongli-program-ledger-v1.json commit f75297d968b7 run 32119219347
GOV-402	accepted	GOV	Restrict states to proposed, active, accepted, blocked, deferred and superseded.	GOV-401	evidence: .trellis/spec/product/control/program-ledger-v1.md tests/test_program_roadmap.py commit f75297d968b7 run 32119219347
GOV-403	accepted	GOV	Require evidence for accepted; unchecked boxes in historical plans have no status authority.	GOV-401 GOV-402	evidence: .trellis/spec/product/control/program-ledger-v1.md tests/test_program_roadmap.py commit f75297d968b7 run 32119219347
GOV-404	accepted	GOV	Generate the current roadmap index from the program ledger.	GOV-401 GOV-402 GOV-403	evidence: docs/superpowers/roadmaps/qiongli-current-program-index.md tooling/scripts/update_program_roadmap.py tests/test_program_roadmap.py commit f75297d968b7 run 32119219347
GOV-405	accepted	GOV	Correct the architecture overview to Tauri/Svelte, Rust native and host-driven execution.	—	evidence: docs/architecture.md tests/test_arc_201_adrs.py .github/workflows/evaluation-truth.yml commit 6c165695bdc1 run 32138527566
GOV-406	accepted	GOV	repair the ADR registry, resolve the duplicate ADR 0208 identifier and update the machine-readable decision inventory.	—	evidence: tooling/architecture/current-decisions.json tooling/scripts/validate_arc_201_adrs.py tests/test_arc_201_adrs.py commit 6c165695bdc1 run 32138527566
GOV-407	accepted	GOV	Audit the 1.x parity ledger so “classified” is not reported as “implemented”.	—	evidence: tooling/migration/qiongli-1x-product-parity.json tooling/migration/qiongli-1x-product-parity.schema.json packages/qiongli-native/crates/qiongli-platform/tests/product_parity_ledger.rs commit 6c165695bdc1 run 32138527426
GOV-408	accepted	GOV	Record one schema-authority ADR: Rust domain types generate versioned JSON Schema; TypeScript/Zod, MCP and public CLI schemas consume generated contracts and golden fixtures.	—	evidence: docs/architecture/decisions/0216-rust-owned-public-schema-authority.md tooling/architecture/public-schema-policy.json tooling/scripts/validate_public_schema_policy.py tests/test_public_schema_policy.py .github/workflows/evaluation-truth.yml commit 401f1d5acb50 run 32148437765
GOV-409	accepted	GOV	Add compatibility classification for every public schema change: additive, migratable-breaking or unsupported-breaking.	—	evidence: tooling/architecture/public-schema-policy.json tooling/scripts/validate_public_schema_policy.py tests/test_public_schema_policy.py commit 401f1d5acb50 run 32148437765
GOV-410	accepted	GOV	Publish one versioned authorization matrix covering research mutations, restricted-data movement, local repository writes, Git push/PR/merge and release publication.	—	evidence: tooling/architecture/authorization-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit 18cad9db19b8 run 32159058368
GOV-411	accepted	GOV	Encode non-transitive authority: edit does not imply commit, commit does not imply push, push does not imply merge, and green CI does not imply release.	—	evidence: tooling/architecture/authorization-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py commit 18cad9db19b8 run 32159058368
GOV-412	accepted	GOV	Define a redacted authorization-receipt schema bound to action, object scope, actor role, project/source revision, plan or artifact digest, decision, constraints, issue time and expiry.	—	evidence: tooling/architecture/authorization-receipt-v1.schema.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py commit 18cad9db19b8 run 32159058368
GOV-413	blocked	GOV	Configure protected-branch and CODEOWNER/reviewer policy for security, schema, migration, release, research-Gate and authorization changes.	—	evidence: .github/CODEOWNERS .trellis/spec/product/control/authorization-policy-v1.md tooling/architecture/repository-review-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py blocker: Independent CODEOWNER approval cannot be enforced while @jxpeng98 is the only write-authorized human; GitHub forbids PR authors from approving their own changes.
GOV-414	accepted	GOV	Add version-controlled pre-commit, pre-push, PR and release checklists with machine-verifiable evidence where possible.	—	evidence: .github/delivery-checklists.md .github/pull_request_template.md tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit ee67cf737050 run 33399396977
GOV-415	accepted	GOV	Define exact-head evidence invalidation, feature-branch history-rewrite limits and an absolute no-force-push rule for protected branches, release branches and tags.	—	evidence: .github/delivery-checklists.md .github/pull_request_template.md .trellis/spec/product/control/authorization-policy-v1.md tooling/architecture/repository-review-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit 4334c23e5d1d run 33419443552
GOV-416	accepted	GOV	Keep merge authorization, release authorization and public-announcement authorization as separate decisions and receipts.	—	evidence: .github/delivery-checklists.md .github/pull_request_template.md .trellis/spec/product/control/authorization-policy-v1.md tooling/architecture/authorization-policy-v1.json tooling/architecture/authorization-receipt-v1.schema.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit 17166c2cf6e3 run 33445439506
GOV-417	accepted	GOV	Define authorization denial, expiry, revocation, emergency hotfix and post-incident reconciliation paths.	—	evidence: .github/delivery-checklists.md .trellis/spec/product/control/authorization-policy-v1.md tooling/architecture/authorization-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit bf6bc8c5ceb4 run 33499159433
GOV-418	accepted	GOV	Add policy-as-code negative tests proving that an Agent, CI job or successful check cannot approve its own privileged action or widen its granted scope.	—	evidence: .trellis/spec/product/control/authorization-policy-v1.md tooling/architecture/authorization-policy-v1.json tooling/scripts/validate_authorization_policy.py tests/test_authorization_policy.py .github/workflows/evaluation-truth.yml commit 8be7affced27 run 33510501239

PLT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PLT-401	accepted	PLT	Build deterministic small, medium and product-limit fixtures using the actual 512-project, 1,024-capture and graph/portfolio bounds.	—	evidence: docs/superpowers/acceptance/2026-09-04-qiongli-plt401-plt403-platform-capacity.md commit 3ab9d3f5c2d4 run 33876294769
PLT-402	accepted	PLT	Record startup, snapshot, project refresh, Capture load, Graph build/query, Portfolio rebuild, import/export, memory and IPC payload P50/P95.	—	evidence: docs/superpowers/acceptance/2026-09-04-qiongli-plt401-plt403-platform-capacity.md commit 3ab9d3f5c2d4 run 33876294769
PLT-403	accepted	PLT	Add one-over-limit rejection fixtures so bounds remain explicit and fail closed.	—	evidence: docs/superpowers/acceptance/2026-09-04-qiongli-plt401-plt403-platform-capacity.md commit 3ab9d3f5c2d4 run 33876294769
PLT-404	deferred	PLT	Complete the bounded ACP v1 lifecycle for pinned Codex and Claude: participant-scoped session identity, unknown-session rejection, capability/auth negotiation, repeated turns, interactive permission and wakeable cancellation, preserving External Host mode.	PLT-408	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: App/ACP follow-up deferred by ADR 0218; completed source retained, live and packaged journeys remain unaccepted.
PLT-405	deferred	PLT	Deliver one recoverable single-Agent App research journey: private All Chat persistence, snapshot/control/stream contracts, Workflow/Skills and Full MCP context, source-linked candidates, approved project changes, stale-state rejection and resume.	PLT-404 SEC-403	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: App/ACP follow-up deferred by ADR 0218; completed source retained, live and packaged journeys remain unaccepted.
PLT-406	deferred	PLT	Extend the deterministic single-Agent research journey to one coordinator and at most two bounded worker/reviewer sessions; project existing task/handoff/evidence transitions and prove child cancellation, adapter loss, crash and restart recovery.	PLT-405	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: App/ACP follow-up deferred by ADR 0218; completed source retained, live and packaged journeys remain unaccepted.
PLT-407	deferred	PLT	Define latency, memory, UI-blocking and IPC budgets from measured results; do not invent absolute SLOs before this step.	PLT-406	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: App/ACP follow-up deferred by ADR 0218; completed source retained, live and packaged journeys remain unaccepted.
PLT-408	deferred	PLT	Define the narrow ACP session/job ownership, lock order, permission-response, timeout and cancellation contract before long-running App commands; keep general job-system changes in M6.	—	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: App/ACP follow-up deferred by ADR 0218; completed source retained, live and packaged journeys remain unaccepted.

SEC

ID	State	Owner	Description	Dependencies	Evidence / blocker
SEC-401	active	SEC	Mark PDF, web, repository, data documentation and imported notes as untrusted content.	—	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: Host packet and packaged adapters label external sources untrusted; complete source-boundary and adversarial evidence remains unaccepted.
SEC-402	active	SEC	Separate research content from control instructions at every Host/Tool boundary.	SEC-401	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: Host read scope and evidence-reference separation have local negative tests; full boundary qualification remains unaccepted.
SEC-403	active	SEC	Prove external content cannot expand ToolHost permissions or satisfy approvals.	SEC-402	evidence: docs/superpowers/plans/2026-09-06-cli-first-closeout-and-extraction.md blocker: Embedded approval claims cannot expand orchestration tool access or replace capture approval in local fixtures; human-origin and real Host adversarial evidence remain open.
SEC-404	proposed	SEC	Add prompt-injection, embedded-object, oversized-document, archive and path-escape adversarial fixtures.	SEC-403	—
SEC-405	proposed	SEC	Add quarantine and safe-inspection states for suspicious or unsupported imported content.	SEC-404	—

M2 — v2.0.0-beta replacement and migrated-project dogfood

PLT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PLT-320	accepted	PLT	Prove the shared native CLI -> Plugin/Skills -> Lite/Full MCP -> Zotero replacement vertical against current supported Hosts without duplicate canonical content or App-owned product logic.	GOV-320	evidence: docs/superpowers/acceptance/2026-08-23-qiongli-plt320-replacement-vertical.md commit f3c2c0edea04 run 32653636419
PLT-321	accepted	PLT	Stabilize App setup, status, recovery and critical workflow as a client of the same native contracts, with explicit stale/error states.	PLT-320	evidence: docs/superpowers/acceptance/2026-08-23-qiongli-plt321-app-full-mcp.md commit 670478ccf7c5 run 32664187366
PLT-322	accepted	PLT	Accept Graph v1 on one representative migrated 1.19 project with source-bound scholarly semantics, useful query and visualization, deterministic rebuild, and truthful empty/sparse diagnostics.	PLT-320	evidence: docs/superpowers/acceptance/2026-08-24-qiongli-plt322-migrated-graph-v1.md commit e01ad446e3b6 run 32681304659

M3 — v2.0.0 RC, Stable and 1.19 cutover

REL

ID	State	Owner	Description	Dependencies	Evidence / blocker
REL-901	accepted	REL	Freeze public schema IDs, semantic meanings and compatibility window.	PLT-320 PLT-321 PLT-322	evidence: docs/superpowers/acceptance/2026-08-24-qiongli-rel901-public-contract-freeze.md commit 9e750e055104 run 32744003560
REL-902	accepted	REL	Prove N-2 supported project and global-state migration with rollback.	REL-901	evidence: docs/superpowers/acceptance/2026-08-25-qiongli-rel902-persisted-state-migration.md commit dbe1d57dac8b run 32904225002
REL-903	accepted	REL	Prove forward-version files fail closed and remain unmodified.	REL-901	evidence: docs/superpowers/acceptance/2026-08-29-qiongli-rel903-forward-version-immutability.md commit fc6a4eed9bbf run 33218045142
REL-904	accepted	REL	Run disaster recovery for interrupted migration, missing index, corrupted derived state, lost registration and partial update.	REL-902 REL-903	evidence: docs/superpowers/acceptance/2026-08-29-qiongli-rel904-disaster-recovery.md commit bc6aa9febf07 run 33267605850
REL-905	accepted	REL	Publish data ownership, backup, export, uninstall and end-of-support policy, including the existing 90-day post-Stable 1.x support window.	REL-904	evidence: docs/superpowers/acceptance/2026-08-29-qiongli-rel905-data-lifecycle-policy.md commit f046376890ef run 33270228293
REL-906	proposed	REL	Retire legacy 1.x source paths only after packaged replacement, representative migration and rollback acceptance prove no recovery dependency remains; retain the immutable 1.19 oracle.	REL-905 REL-913 PILOT-903	—

SEC

ID	State	Owner	Description	Dependencies	Evidence / blocker
SEC-901	proposed	SEC	Complete threat-model review for Host, MCP, imported content, ToolHost, update, project and classified-data boundaries used by the 2.0 claim.	—	—
SEC-902	proposed	SEC	Run property, fuzz and fault-injection suites for changed schemas, IDs, paths, locks, transactions, archives and network inputs.	—	—
SEC-903	proposed	SEC	Run the bounded release-candidate soak required by the declared 2.0 limits.	—	—

PLT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PLT-901	proposed	PLT	Meet frozen P50/P95 latency, memory, payload, cancellation and UI-blocking budgets on supported targets.	—	—
PLT-902	proposed	PLT	Complete packaged real-IPC, crash/restart, concurrent CLI/Desktop and external-file-change matrices for claimed workflows.	—	—

UX

ID	State	Owner	Description	Dependencies	Evidence / blocker
UX-901	proposed	UX	Complete automated and human WCAG 2.2 AA-oriented acceptance for supported Desktop surfaces.	—	—

SEC

ID	State	Owner	Description	Dependencies	Evidence / blocker
SEC-904	proposed	SEC	Confirm zero secret, path, prompt, response, conversation and restricted-content leakage in release artifacts and receipts.	—	—

REL

ID	State	Owner	Description	Dependencies	Evidence / blocker
REL-910	accepted	REL	Produce reproducible or fully provenance-bound macOS, Windows and Linux artifacts from one accepted source.	—	evidence: docs/superpowers/acceptance/2026-08-30-qiongli-rel910-provenance-bound-tier1-artifacts.md commit cf23c6f1286f run 33288394060
REL-911	proposed	REL	Complete macOS Developer ID/notarization and Windows Authenticode/timestamping for production claims.	—	—
REL-912	proposed	REL	Publish Homebrew arm64/Intel, Scoop and WinGet projections from the same immutable asset digests.	—	—
REL-913	accepted	REL	Prove clean install, upgrade, repair, rollback and uninstall without deleting user projects or unmanaged state.	REL-910	evidence: docs/superpowers/acceptance/2026-08-30-qiongli-rel913-installation-lifecycle.md commit ca0a4a5d530c run 33311931096 blocker: Beta.6 at 375a69ab passed local macOS CLI release qualification; the current plan records its scope and checks. Candidate/tag push and Release Automation dispatch at v2.0.0-beta.6 are authorized, with termination after dispatch and no tracking. Final-tag CI and public publication remain unobserved. Existing accepted evidence and program states are unchanged.
REL-914	proposed	REL	Verify checksums, SBOM, provenance, signatures and public downloads independently.	—	—
REL-915	proposed	REL	Publish a bounded revocation, withdrawal and replacement process.	—	—

PILOT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PILOT-901	proposed	PILOT	Complete blinded expert review across the five core research types claimed by 2.0.	—	—
PILOT-902	proposed	PILOT	Measure expert agreement, unsupported-claim escape rate, correction effort and reproduction success for claimed behavior.	—	—
PILOT-903	accepted	PILOT	Complete a representative migrated real-project pilot without storing Host conversations.	PLT-322	evidence: docs/superpowers/acceptance/2026-08-30-qiongli-pilot903-real-project-pilot.md docs/superpowers/acceptance/2026-08-30-qiongli-pilot903-real-project-receipt.json commit d0b411336445 run 33280296497
PILOT-904	proposed	PILOT	Resolve every critical methodological or evidence disagreement in the 2.0 claim, or document an explicit non-claim.	—	—
PILOT-905	accepted	PILOT	Publish a model/Host capability matrix based on observed receipts, not marketing equivalence.	—	evidence: docs/superpowers/acceptance/2026-08-30-qiongli-pilot905-host-capability-matrix.md docs/superpowers/acceptance/2026-08-30-qiongli-pilot905-host-capability-matrix.json commit 73d33932f8be run 33283608007

M4 — Post-2.0 Typed Research and Evidence Kernel

KRN

ID	State	Owner	Description	Dependencies	Evidence / blocker
KRN-501	deferred	KRN	Publish a Kernel ADR defining authority, migration, projection and extension rules.	—	—
KRN-502	deferred	KRN	Define stable semantic IDs separately from capture, timeline and revision event IDs.	—	—
KRN-503	deferred	KRN	Define versioned objects for ResearchQuestion, Hypothesis, Claim, Source, EvidenceAssertion, Locator, Decision, Method, Dataset, Variable, Outcome, AnalysisRun, Result, Artifact, GateResult, Approval and Waiver.	—	—
KRN-504	deferred	KRN	Define typed relations including supports, weakens, contradicts, derived-from, uses-method, operationalizes, produced-by, supersedes and bounded-by.	—	—
KRN-505	deferred	KRN	Declare field-level authority when the same object appears in Markdown, CSV, BibTeX and JSONL.	—	—
KRN-506	deferred	KRN	Keep narrative prose portable; only machine-verifiable fields become mandatory typed records.	—	—
KRN-507	deferred	KRN	Provide adapters for all Alpha 3 canonical graph sources and explicit diagnostics for unsupported files.	—	—
KRN-508	deferred	KRN	Add deterministic canonical serialization, stable digest and rebuild tests.	—	—
KRN-509	deferred	KRN	Add forward migration, backup, rollback and read-only downgrade behavior.	—	—
KRN-510	deferred	KRN	Add round-trip tests proving no silent loss of decisions, limitations, citations, anchors or provenance.	—	—
KRN-511	deferred	KRN	Preserve domain extensions through namespaced fields; core validators reject unregistered changes to core semantics.	—	—

EVD

ID	State	Owner	Description	Dependencies	Evidence / blocker
EVD-501	deferred	EVD	Normalize DOI, PMID, PMCID, arXiv, ISBN, Zotero key, URL, citation key and local artifact identities.	—	—
EVD-502	deferred	EVD	Store immutable metadata snapshots with provider, retrieval time, query or lookup identity, content digest and license/access state.	—	—
EVD-503	deferred	EVD	Separate source identity state from availability, version/status, locator validity and claim support.	—	—
EVD-504	deferred	EVD	Support verified, unresolved, conflicting, corrected, retracted, unavailable and stale source states.	—	—
EVD-505	deferred	EVD	Verify identifier-to-title/author/venue matching instead of treating a resolvable DOI as sufficient.	—	—
EVD-506	deferred	EVD	Model preprint, version-of-record, correction and retraction relations without overwriting history.	—	—
EVD-507	deferred	EVD	Verify page, section, paragraph, table, figure, dataset row or analysis-output anchors when access permits.	—	—
EVD-508	deferred	EVD	Store support direction, directness, claim-strength limit, independence and limitations for every EvidenceAssertion.	—	—
EVD-509	deferred	EVD	Distinguish citation presence, source authenticity, relevance and actual support.	—	—
EVD-510	deferred	EVD	Put unresolved identity, unavailable full text and unsupported claims into explicit queues; never upgrade them to verified automatically.	—	—
EVD-511	deferred	EVD	Add human adjudication receipts for support/contradiction disputes and waivers.	—	—
EVD-512	deferred	EVD	Propagate correction, retraction and source-version changes to affected claims, gates and submission freezes.	—	—

KRN

ID	State	Owner	Description	Dependencies	Evidence / blocker
KRN-520	deferred	KRN	Add Study, Dataset, Variable, Outcome, AnalysisRun and Result nodes only after Kernel identities are frozen.	—	—
KRN-521	deferred	KRN	Generate Graph v2 exclusively from Kernel/canonical records plus explicit semantic links.	—	—
KRN-522	deferred	KRN	Preserve asserted, inferred, disputed, superseded and rejected relation states.	—	—
KRN-523	deferred	KRN	Require source anchor and evidence limit for every non-structural scholarly edge.	—	—
KRN-524	deferred	KRN	Produce deterministic Graph v1-to-v2 migration and revision diff.	—	—
KRN-525	deferred	KRN	Prove Graph, Portfolio and Timeline can be deleted and rebuilt without changing canonical research records.	—	—

M5 — Post-2.0 Reproducibility and Executable Gates

RPR

ID	State	Owner	Description	Dependencies	Evidence / blocker
RPR-601	deferred	RPR	Define a native, versioned ReproducibilityManifest and immutable RunReceipt.	—	—
RPR-602	deferred	RPR	Record input identities, digests, provenance, license/access state and research-data classification.	—	—
RPR-603	deferred	RPR	Record code, notebook, script, configuration and dependency-lock digests.	—	—
RPR-604	deferred	RPR	Record OS, architecture, runtime/tool versions, locale, relevant environment identity and container/lockfile where used.	—	—
RPR-605	deferred	RPR	Record command, arguments, execution order, working-directory class, random seeds and deterministic/nondeterministic declaration.	—	—
RPR-606	deferred	RPR	Record expected and observed outputs, result identity, digest, comparison method and scientific tolerance.	—	—
RPR-607	deferred	RPR	Link every result used by a claim to its producing run and exact output anchor.	—	—
RPR-608	deferred	RPR	Record model Host, workflow/profile/task digests and approvals without storing prompts, responses or conversations.	—	—
RPR-609	deferred	RPR	Distinguish reproducible, partially reproducible, non-reproducible-by-design, blocked and not-attempted states.	—	—
RPR-610	deferred	RPR	Build a bounded replay runner with clean-environment, timeout, cancellation and output-comparison receipts.	—	—
RPR-611	deferred	RPR	Treat unavailable private data, proprietary software and nondeterminism as explicit limits, not automatic failure or invented success.	—	—
RPR-612	deferred	RPR	Add clean-room reference runs for at least one Python, R, Stata-compatible specification or native method path according to declared project support.	—	—

GATE

ID	State	Owner	Description	Dependencies	Evidence / blocker
GATE-601	deferred	GATE	Define a versioned GateEvidenceBundle with checks, evidence refs, digests, findings, blockers, reviewer and waiver lineage.	—	—
GATE-602	deferred	GATE	Q1 verifies RQ/hypothesis -> design -> data -> measurement -> method -> outcome -> analysis mapping and claim-strength compatibility.	—	—
GATE-603	deferred	GATE	Q2 verifies every central claim -> EvidenceAssertion -> source/result -> locator -> limitation path.	—	—
GATE-604	deferred	GATE	Q3 loads a reporting profile by paper type, method, venue and applicable standard; missing required items block or require explicit waiver.	—	—
GATE-605	deferred	GATE	Q4 verifies manifest completeness, input/code/environment presence, result lineage, rerun state and declared limitations.	—	—
GATE-606	deferred	GATE	Recompute all evidence and artifact digests immediately before a PASS or submission freeze.	—	—
GATE-607	deferred	GATE	Reject a Gate bundle when a required verifier is unavailable, stale or based on a different project revision.	—	—
GATE-608	deferred	GATE	Make waivers scoped, expiring, reasoned and bound to a human role; a waiver never rewrites underlying evidence state.	—	—
GATE-609	deferred	GATE	Store Gate history so a later source correction or result change invalidates affected PASS states.	—	—
GATE-610	deferred	GATE	Add deterministic PRISMA conservation, inclusion/exclusion coverage, duplicate screening and retrieval-trace validators.	—	—
GATE-611	deferred	GATE	Add causal-claim/design fit, effect-direction, sample-overlap, missing-anchor, unsupported-page and citation-status adversarial validators.	—	—
GATE-612	deferred	GATE	Add paper-type profiles for systematic review, empirical/causal, qualitative, computational/methods and theory workflows.	—	—

ORC

ID	State	Owner	Description	Dependencies	Evidence / blocker
ORC-601	deferred	ORC	Separate Proposer, Executor and Verifier responsibilities in handoff metadata and acceptance policy.	—	—
ORC-602	deferred	ORC	Prevent the same role from self-approving high-risk research changes unless an explicit, visible solo-mode policy permits only non-critical work.	—	—
ORC-603	deferred	ORC	Require human approval for research-question scope changes, locked-decision overrides, evidence deletion, inclusion-criteria changes, causal-strength upgrades, ethics claims and submission freeze.	—	—
ORC-604	deferred	ORC	Represent multi-Agent disagreement as factual, methodological, interpretive or scope disagreement with evidence for each position.	—	—
ORC-605	deferred	ORC	Resolve disagreement by evidence and method risk, never by simple majority vote.	—	—
ORC-606	deferred	ORC	Keep candidate creation, Gate review, artifact preview and artifact apply as distinct state transitions.	—	—
ORC-607	deferred	ORC	Bind every transition to run, task, role, generation, project revision, document digest and evidence bundle.	—	—
ORC-608	deferred	ORC	Propagate cancellation through Host handoff, ToolHost, replay runner, validators and owned operations.	—	—
ORC-609	deferred	ORC	Expose recoverable blocked state and next actions when Host, verifier, evidence or approval is missing.	—	—

PILOT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PILOT-601	deferred	PILOT	Systematic-review fixture with executable search, screening, PRISMA and retraction cases.	—	—
PILOT-602	deferred	PILOT	Causal/DiD fixture with parallel-trend failure, staggered-treatment and overclaim cases.	—	—
PILOT-603	deferred	PILOT	Qualitative fixture with codebook, audit trail, reflexivity and contradictory theme cases.	—	—
PILOT-604	deferred	PILOT	Computational/NLP fixture with data version, environment, seed, leakage and replay cases.	—	—
PILOT-605	deferred	PILOT	Theory fixture with mechanism, boundary condition, citation support and unfalsifiable-claim cases.	—	—
PILOT-606	deferred	PILOT	Long-running dissertation/revision fixture for cross-stage and cross-Host semantic continuity.	—	—
PILOT-607	deferred	PILOT	Add false DOI, mismatched title, retracted source, preprint/version conflict, nonexistent page, duplicate sample and PDF prompt-injection cases.	—	—
PILOT-608	deferred	PILOT	Store expert-judged expected findings and permissible uncertainty rather than one generated “gold answer”.	—	—

M6 — Post-2.0 Integrated Research Harness

PLT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PLT-701	deferred	PLT	Add a project-change channel with revision, affected object classes and redacted reason.	—	—
PLT-702	deferred	PLT	Combine native change events with revision checks on window focus and reconnect; the revision remains final authority.	—	—
PLT-703	deferred	PLT	Invalidate or reload Capture, Evidence, Graph, Portfolio, Timeline, Gate and artifact views after an external change.	—	—
PLT-704	deferred	PLT	Show “changed outside this Desktop session” and the exact safe recovery action.	—	—
PLT-705	deferred	PLT	Invalidate every pending preview whose project, library, evidence or Gate base revision changed.	—	—
PLT-706	deferred	PLT	Add mixed-revision guards so a page never combines old Graph, new Evidence and stale Gate state.	—	—
PLT-707	deferred	PLT	Add App/CLI/MCP golden journeys for create, capture, consolidate, gate, replay, archive, migrate and export.	—	—
PLT-710	deferred	PLT	Split short queries/commits from long scan, hash, import/export, graph, portfolio, verification and replay work.	—	—
PLT-711	deferred	PLT	Introduce one bounded job protocol: start, inspect/poll, progress event, cancel, terminal receipt and recover/expire.	—	—
PLT-712	deferred	PLT	Move measured long blocking work outside process-global mutex critical sections.	—	—
PLT-713	deferred	PLT	Use project-scoped or domain-scoped queues where concurrency is safe; freeze and test lock ordering.	—	—
PLT-714	deferred	PLT	Revalidate revision, plan digest and approval at commit after background work completes.	—	—
PLT-715	deferred	PLT	Make cancellation idempotent and prove that cancelled work cannot publish a partial canonical result.	—	—
PLT-716	deferred	PLT	Replace one implicit pending slot with operation identities bound to project, base revision, expiry and state.	—	—
PLT-717	deferred	PLT	Use page/operation-scoped busy state; unrelated read-only work remains available.	—	—
PLT-718	deferred	PLT	Add timeout and status lookup for read/preview operations; never automatically retry apply without an operation receipt.	—	—
PLT-720	deferred	PLT	Cache revision-keyed project overview, health and semantic digest projections.	—	—
PLT-721	deferred	PLT	Use bootstrap snapshot plus revisioned deltas and paginated detail queries for large collections.	—	—
PLT-722	deferred	PLT	Fall back to a complete snapshot when a delta sequence is missing or incompatible.	—	—
PLT-723	deferred	PLT	Generate App API schemas and TypeScript/Zod from the accepted wire authority.	—	—
PLT-724	deferred	PLT	Publish versioned CLI JSON schema only for declared public output; internal debug output is not a compatibility promise.	—	—
PLT-725	deferred	PLT	Validate Full MCP, CLI and Desktop against shared golden fixtures and semantic invariants.	—	—
PLT-726	deferred	PLT	Fail CI on unclassified schema drift or incompatible fixture changes.	—	—

UX

ID	State	Owner	Description	Dependencies	Evidence / blocker
UX-701	deferred	UX	Separate Software Health from Scientific Health.	—	—
UX-702	deferred	UX	Show claim-evidence coverage as counts, not one opaque quality score.	—	—
UX-703	deferred	UX	Show unverified, conflicting, corrected, retracted, unavailable and stale sources separately.	—	—
UX-704	deferred	UX	Show unsupported claims, claim-strength mismatch, unresolved contradictions and protocol deviations.	—	—
UX-705	deferred	UX	Show reproducibility state, last replay, output comparison and declared limits.	—	—
UX-706	deferred	UX	Show pending human decisions, waivers, source changes and submission-freeze validity.	—	—
UX-707	deferred	UX	For every finding, show trigger, affected object, evidence, severity, next action and waiver/approval authority.	—	—
UX-708	deferred	UX	Update Graph inspection to reveal Kernel object, source anchor, relation status, limitation and Gate impact.	—	—
UX-709	deferred	UX	Preserve accessible keyboard, screen-reader, reduced-motion, contrast and narrow-layout behavior in packaged App tests.	—	—

PILOT

ID	State	Owner	Description	Dependencies	Evidence / blocker
PILOT-701	deferred	PILOT	Run all six reference projects through App, CLI and Full MCP on the same revisions.	—	—
PILOT-702	deferred	PILOT	Exercise qualified local External Hosts through integrated Kernel/Evidence/Gate research journeys, sharing source-bound tasks/candidates while retaining private conversations; build on CLI-411 collaboration acceptance.	CLI-411	—
PILOT-703	deferred	PILOT	Test cross-Host capture, conflict, decision and evidence continuity over multiple weeks.	—	—
PILOT-704	deferred	PILOT	Have domain researchers review claims, evidence paths, method findings and reproduction receipts blind to Host/model identity.	—	—
PILOT-705	deferred	PILOT	Track correction rate, unsupported-claim escapes, time-to-understand and manual revision effort.	—	—

SEC

ID	State	Owner	Description	Dependencies	Evidence / blocker
SEC-801	deferred	SEC	Add portable data classification: public, internal, confidential, restricted, regulated.	—	—
SEC-802	deferred	SEC	Define Open Research, Restricted Research and Offline Research policy profiles.	—	—
SEC-803	deferred	SEC	Bind classification to allowed Hosts, model/network routes, tools, export, logs, backups and retention.	—	—
SEC-804	deferred	SEC	Require explicit de-identification or approval before classified data can cross a remote-model boundary.	—	—
SEC-805	deferred	SEC	Make Offline mode technically disable network/provider routes and prove it in target-native tests.	—	—
SEC-806	deferred	SEC	Add Restricted mode domain/provider allowlists and fail closed when policy cannot be proven.	—	—
SEC-807	deferred	SEC	Exclude restricted content from ordinary diagnostics, receipts, telemetry and crash bundles.	—	—
SEC-808	deferred	SEC	Add encrypted backup/restore, key-loss and secure-delete policy receipts appropriate to supported targets.	—	—
SEC-810	deferred	SEC	Define typed ethics/IRB identity, status, authority, effective date, expiry and document anchor.	—	—
SEC-811	deferred	SEC	Model consent scope, data-use agreement, permitted purpose, processing region and retention/deletion obligation.	—	—
SEC-812	deferred	SEC	Model de-identification method, residual risk, responsible person and approval evidence.	—	—
SEC-813	deferred	SEC	Prevent Qiongli or an Agent from declaring ethics approval without an explicit institution/human record.	—	—
SEC-814	deferred	SEC	Make expired, withdrawn or scope-incompatible approvals invalidate affected runs and submission freezes.	—	—
SEC-815	deferred	SEC	Add PI, Reviewer, Data Steward and Researcher approval roles locally without implying remote identity federation.	—	—
SEC-816	deferred	SEC	Separate actor identity, local role, capability, object scope, policy decision and human/institutional approval in the authorization model.	—	—
SEC-817	deferred	SEC	Bind every sensitive approval to the exact project revision, operation-plan digest, data classification, permitted destination, constraints and expiry.	—	—
SEC-818	deferred	SEC	Deny expired, revoked, scope-mismatched, revision-mismatched and digest-mismatched authorization; never silently downgrade the requested action.	—	—
SEC-819	deferred	SEC	Add a review surface showing what will change, why approval is required, what data crosses which boundary, rollback implications and the redacted receipt before confirm.	—	—
SEC-820	deferred	SEC	Add adversarial tests for role escalation, confused deputy, approval replay, stale approval, destination substitution and Agent/CI self-authorization.	—	—

GATE

ID	State	Owner	Description	Dependencies	Evidence / blocker
GATE-801	deferred	GATE	Freeze project revision, Kernel schema, sources/status, Gate bundles, run receipts, artifacts and approvals for submission.	—	—
GATE-802	deferred	GATE	Invalidate the freeze when any bound source, result, decision, waiver or artifact changes.	—	—
GATE-803	deferred	GATE	Generate a human-readable readiness report and machine-verifiable freeze manifest.	—	—
GATE-804	deferred	GATE	Keep “ready for package assembly” distinct from journal acceptance, ethics approval or scientific correctness.	—	—

INT

ID	State	Owner	Description	Dependencies	Evidence / blocker
INT-801	deferred	INT	Export a self-contained audit package with hashes, schema, migrations, limitations and verification instructions.	—	—
INT-810	deferred	INT	Map provenance to a PROV-compatible export without making external ontology the internal authority.	—	—
INT-811	deferred	INT	Export a research-object package compatible with RO-Crate concepts and declared omissions.	—	—
INT-812	deferred	INT	Map resource metadata to DataCite-compatible fields where known.	—	—
INT-813	deferred	INT	Support CRediT contribution roles, ORCID and ROR identifiers as verified or unresolved identities.	—	—
INT-814	deferred	INT	Preserve Zotero as reference-library authority while exporting/importing versioned evidence links.	—	—
INT-815	deferred	INT	Produce a deterministic loss report whenever an external format cannot represent a Qiongli field.	—	—
INT-816	deferred	INT	Add round-trip and independent-validator fixtures for every advertised adapter.	—	—

GOV

ID	State	Owner	Description	Dependencies	Evidence / blocker
GOV-801	deferred	GOV	Define a profile/validator extension contract with namespace, version, dependencies and security capabilities.	—	—
GOV-802	deferred	GOV	Require domain/method/reporting packs to ship positive, negative and near-miss fixtures.	—	—
GOV-803	deferred	GOV	Prevent an extension from weakening core evidence, Gate, safety or privacy rules.	—	—
GOV-804	deferred	GOV	Freeze broad domain-pack expansion until the certification harness is active.	—	—

M7 — Post-Stable 2.1+ horizon

COL

ID	State	Owner	Description	Dependencies	Evidence / blocker
COL-1001	deferred	COL	Signed multi-device events and project-level encryption.	—	—
COL-1002	deferred	COL	RBAC with researcher, reviewer, PI, data-steward and administrator roles.	—	—
COL-1003	deferred	COL	Revision-based merge and semantic conflict queue; never last-write-wins for research meaning.	—	—
COL-1004	deferred	COL	Authenticated remote Capture relay with separate privacy, abuse, deletion and incident-recovery threat model.	—	—
COL-1005	deferred	COL	Institution-managed identity, policy, keys, retention and audit integration.	—	—
COL-1006	deferred	COL	Long-term source monitoring for corrections, retractions, version changes and broken links.	—	—
COL-1007	deferred	COL	Public Plugin/Profile SDK with certification and compatibility tooling.	—	—
COL-1008	deferred	COL	Additional Hosts, providers and subject packs only through the certified extension path.	—	—
COL-1009	deferred	COL	Optional remote MCP/cloud execution as an independently secured product boundary.	—	—