Merge pull request 'Port the IAM permission-management API from the abandoned iam-perm-ux branch' (#240 ) from fix/iam-perm-ux-port into main

Merge remote-tracking branch 'origin/main' into fix/iam-perm-ux-port
Record port scope, build fix and PASS review for the IAM permission API
2026-10-21 15:38:14 +00:00 · 2026-10-21 15:14:16 +00:00 · 2026-10-21 15:13:59 +00:00 · 2026-10-21 15:13:33 +00:00 · 2026-10-21 15:05:03 +00:00 · 2026-10-21 15:02:15 +00:00
592 changed files with 74553 additions and 2650 deletions
@@ -0,0 +1,150 @@
+name: governance
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  governance:
+    runs-on: ubuntu-latest
+    env:
+      GOPROXY: https://goproxy.cn,direct
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 只物化两个治理 gitlink（Guidelines 与 deps/development-manager），非递归；
+          # 其它 gitlink 不物化、不取回。凭据只以 URL 限定的 extraheader 存在于本进程树内。
+          python3 - <<'PY_CHECKOUT'
+          import os
+          from pathlib import Path
+          import re
+          import subprocess
+          import sys
+          from urllib.parse import urlsplit
+
+          # 服务端基址取运行器注入的 GITHUB_SERVER_URL（平台控制、候选 PR 不可影响）。
+          SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
+          parsed_server = urlsplit(SERVER)
+          if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
+              sys.exit("Checkout server must be the platform-injected http(s) URL")
+          SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          # 审查过的白名单，独立于候选 .gitmodules：仅列出两个治理 gitlink。
+          REPOSITORIES = {
+              "deps/development-guidelines": "Development-Guidelines",
+              "deps/development-manager": "Development-Manager",
+          }
+          TARGET = "weichen/Agent-System-Backend"
+          root_token = os.environ.pop("TOKEN", "")
+          component_token = os.environ.pop("SUBMODULE_TOKEN", "")
+          if not root_token or not component_token:
+              sys.exit("Checkout requires TOKEN and SUBMODULE_TOKEN")
+          if os.environ.get("GITHUB_REPOSITORY") != TARGET:
+              sys.exit("Checkout repository is outside the reviewed allowlist")
+          sha = os.environ.get("GITHUB_SHA", "")
+          if not re.fullmatch(r"[0-9a-fA-F]{40}", sha):
+              sys.exit("Checkout requires a fixed commit SHA")
+
+          # 丢弃继承的 Git 追踪/配置/SSH 钩子；凭据只存在于单个 Git 进程树的精确 URL 头中。
+          clean_env = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
+          clean_env.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_SYSTEM="/dev/null",
+                           GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0")
+          config = {
+              "core.hooksPath": "/dev/null", "core.fsmonitor": "false",
+              "init.templateDir": "", "credential.helper": "",
+              "fetch.recurseSubmodules": "false", "submodule.recurse": "false",
+              "http.followRedirects": "false", "protocol.allow": "never",
+              "protocol." + urlsplit(SERVER).scheme + ".allow": "always",
+          }
+
+
+          def git(repo, *args, extra=None):
+              values = config | (extra or {})
+              env = clean_env | {"GIT_CONFIG_COUNT": str(len(values))}
+              for index, (key, value) in enumerate(values.items()):
+                  env[f"GIT_CONFIG_KEY_{index}"] = key
+                  env[f"GIT_CONFIG_VALUE_{index}"] = value
+              return subprocess.run(["git", "-C", str(repo), *args], env=env,
+                                    check=True, stdout=subprocess.PIPE).stdout
+
+
+          def materialize_governance(root):
+              # -r 列出任意深度的 gitlink，但不进入 submodule 内部；其它 gitlink 只记录、从不取回。
+              links = {}
+              for entry in git(root, "ls-tree", "-rz", "HEAD").split(b"\0"):
+                  if not entry:
+                      continue
+                  metadata, path = entry.split(b"\t", 1)
+                  mode, kind, commit = metadata.decode().split()
+                  if mode == "160000":
+                      links[path.decode()] = commit
+              for name in REPOSITORIES:
+                  if name not in links:
+                      raise ValueError("Governance gitlink is missing from the fixed commit")
+              raw = git(root, "config", "--no-includes", "--blob", "HEAD:.gitmodules", "--null", "--list")
+              entries = {}
+              for item in raw.split(b"\0"):
+                  if not item:
+                      continue
+                  key, value = item.decode().split("\n", 1)
+                  match = re.fullmatch(r"submodule\.(.+)\.(path|url)", key)
+                  if not match:
+                      continue
+                  name, field = match.groups()
+                  if name not in REPOSITORIES:
+                      continue
+                  if field in entries.setdefault(name, {}):
+                      raise ValueError("Duplicate candidate .gitmodules setting")
+                  entries[name][field] = value
+              # 先整体校验两个治理条目，再进行任何带凭据的取回。
+              for name, repository in REPOSITORIES.items():
+                  fields = entries.get(name, {})
+                  if fields.get("path") != name:
+                      raise ValueError("Governance submodule path is outside the reviewed allowlist")
+                  trusted_url = f"{SERVER}/weichen/{repository}.git"
+                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
+                      raise ValueError("Governance submodule URL is outside the reviewed allowlist")
+              for name, repository in REPOSITORIES.items():
+                  url = f"{SERVER}/weichen/{repository}.git"
+                  # 仅持久化审查过的公开 URL，使 Git 在进程级配置消失后仍识别该 submodule。
+                  git(root, "config", f"submodule.{name}.url", url)
+                  git(root, "submodule", "update", "--init", "--checkout", "--", name,
+                      extra={f"submodule.{name}.url": url,
+                             f"submodule.{name}.update": "checkout",
+                             f"http.{url}.extraheader": "AUTHORIZATION: token " + component_token})
+                  child = root / name
+                  if git(child, "rev-parse", "HEAD").decode().strip() != links[name]:
+                      raise ValueError("Materialized governance gitlink does not match the fixed SHA")
+
+
+          try:
+              root = Path.cwd()
+              # 必须是干净的临时工作区；不复用既有 Git 状态。
+              if (root / ".git").exists():
+                  raise ValueError("Checkout requires a fresh workspace")
+              git(root, "init", "-q")
+              url = f"{SERVER}/{TARGET}.git"
+              git(root, "remote", "add", "origin", url)
+              git(root, "fetch", "--depth=1", "origin", sha,
+                  extra={f"http.{url}.extraheader": "AUTHORIZATION: token " + root_token})
+              git(root, "checkout", "-q", "--detach", "FETCH_HEAD")
+              materialize_governance(root)
+          except (ValueError, OSError, subprocess.CalledProcessError) as error:
+              sys.exit(f"Checkout refused: {error}")
+          print("Checkout complete; credentials were not persisted in Git configuration")
+          PY_CHECKOUT
+          unset TOKEN SUBMODULE_TOKEN
+      - name: Install Go 1.27.1
+        run: |
+          set -euo pipefail
+          curl -fsSL -o "$RUNNER_TEMP/go.tgz" https://mirrors.aliyun.com/golang/go1.27.1.linux-amd64.tar.gz
+          tar -C /usr/local -xzf "$RUNNER_TEMP/go.tgz"
+          ln -sfn /usr/local/go/bin/go /usr/local/bin/go
+          ln -sfn /usr/local/go/bin/gofmt /usr/local/bin/gofmt
+      - name: Validate agent execution configuration
+        run: scripts/agent-exec validate --repo .
+      - name: Governance check
+        run: scripts/dm governance check --repo .
@@ -19,3 +19,12 @@
 [submodule "deps/agent-command"]
 	path = deps/agent-command
 	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Command.git
+[submodule "deps/agent-document-renderer"]
+	path = deps/agent-document-renderer
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Document-Renderer.git
+[submodule "deps/development-guidelines"]
+	path = deps/development-guidelines
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git
+[submodule "deps/development-manager"]
+	path = deps/development-manager
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Manager.git
@@ -0,0 +1,47 @@
+# Agent-System-Backend 采纳 development-governance-v2 治理套件 任务卡
+
+任务主记录：本文件随 PR 描述维护（PR 链接见下方"结果与验证"）。
+状态：进行中；owner：weichen。
+
+## 基线与授权
+
+- 权威仓：weichen/Agent-System-Backend；root_target：main；immediate_target：main
+- branch_kind：initiative；initiative_id：governance-adoption-Agent-System-Backend
+- R0（initial_main_sha）：7aa624370af347c3dd3740d7453b13af54ae3ed6；工作区：/home/weichen/projects/Agent-System-Backend-wt-feature-governance-adoption（worktree）；分支：feature/governance-adoption
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false（单仓采纳 initiative，范围固定为下列十步，不接收新需求）
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=development-governance-v2 Phase 6 每个正式仓库独立 initiative；triage 收据=无（本仓采纳前尚无 triage 入口）
+- 授权与交付终点：owner 已授权 development-governance-v2 全部实施（Agent-System-Dev 主记录 docs/superpowers/plans/2026-10-16-development-governance-v2-master.md）；终点为本 PR 合入 main 且采纳状态 active。分支保护与 tag 由用户执行。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+目标（Phase 6 十步）：固定 Guidelines SHA（deps/development-guidelines @ 2688fd2be6a52c0bf110e7e6366b6f291ab5e4eb）；增加 AGENT-EXECUTION.md；增加共享执行器薄入口（deps/development-manager @ bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c + scripts/dm、scripts/agent-exec、scripts/task）；四条路由（implementation/repair/test/review）；任务卡模板与分支元数据；CI 中启用 schema 校验（.gitea/workflows/governance.yml：agent-exec validate + governance check）；一次正例运行；负例（缺配置、坏收据、越界路径、未知副作用）；独立 Review + CI；采纳状态 active。
+
+非目标：不改业务代码与既有测试；不改分支保护（由用户执行）；不发布 tag。
+
+引导说明：AGENT-EXECUTION.md 由 host 以固定版本治理套件（dm-server governance init @ bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c）生成并作为引导配置提交（执行器运行前必须存在有效配置；沿用 DM 采纳先例）；其余文件由实施单元生成。
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| governance-adoption-Agent-System-Backend-r1 | 13 个允许路径（治理文件 + 两个 gitlink） | 39c17561 | implementation | cursor→antigravity→pi | run a1d7d74c（dm-server pinned，attempts=1） | cursor / not-observable | success | 472e5ab31331（apply 快进） | 否 | /tmp/gov-receipt-Agent-System-Backend-r1.json |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | 7aa624370af347c3dd3740d7453b13af54ae3ed6 | 7aa624370af347c3dd3740d7453b13af54ae3ed6 | 2026-10-17T06:53:54Z | 一致 |
+
+## 结果与验证（完成后填写）
+
+- 结果：NOT_RUN
+- 验证：见下表（命令输出由 /tmp/gov-neg/ev.sh 写入 .task/evidence/governance-adoption/，SELF 除非另注）。
+- 影响与剩余项：NOT_RUN
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| 20261017T071539Z | `scripts/dm governance check --repo .` | 472e5ab31331 | 0 | SELF | ok fixtures；[输出](evidence/governance-adoption/00-20261017T071539Z.log) sha256:f7016c2e2af62a17 |
+| 20261017T071539Z | `scripts/agent-exec validate --repo .` | 472e5ab31331 | 0 | SELF | validate: ok；[输出](evidence/governance-adoption/01-20261017T071539Z.log) sha256:6ded2d91ffdfe365 |
+| 20261017T071539Z | `python3 /tmp/gov-neg/adopt_cases.py .` | 472e5ab31331 | 0 | SELF | [verdict] ALL PASS cases=5；[输出](evidence/governance-adoption/02-20261017T071539Z.log) sha256:2834e3639ade85b8 |
@@ -0,0 +1,40 @@
+# W9 Backend project audit candidate
+
+- 状态：已完成（合入前闭合，2026-10-18）。本 W9 增量随统一渲染器 Backend 分支经 PR #209 合入 main；合入前已同步 Backend main `56a7f9f`（合并提交 `84a6f6f`，当前 HEAD CI vet-and-test/governance 成功）。同步时 main 的迁移 36 `instance_guard` 保持不变，本分支迁移整体顺延为 37–48（文中 v33/v34 等编号为同步前历史编号），跑过旧编号未合入构建的数据库须重建。用户 2026-10-18 授权按计划完成并收尾、业务验收在部署上自行进行；受信 tag `v0.6.0` 由用户亲手发布。
+- Scope: TT-A01/A02/A04/U04, approved stage 5 W9. Stage 6 local implementation; human review, formal acceptance, PR, CI, tag, and deployment are pending.
+- Branch/worktree: `feature/rdm-two-trees-project-audit` at `/home/weichen/projects/Agent-System-Backend-wt-feature-rdm-two-trees-project-audit`.
+- R0: Backend authoritative `origin/main` `5d5fc9891c0eb8994545ccb8b740535d9b99fb0e`; main was clean and equal to the fetched remote before this worktree was created. Core gitlink in this worktree is `5773e74086791731059730bd3726dc8c9cd1381f`.
+- Startup receipt: `/tmp/backend-w9-precheck-20261014-01.json` (SELF, exit 2, `SYNC_REQUIRED` for the separate Dev checkout `feature/rdm-increment-acceptance-note`, six commits behind Dev `origin/main`). This Backend task uses the independent-development path in Backend `AGENTS.md`; it does not write that Dev checkout or its task card. The receipt is preserved as a failure, not relabeled READY.
+- Approved affected design: `rdm-two-trees-stage6-audit-link-design-adjustment-r1.md`, SHA256 `385d9d7570217ddcce9fe60a60c99dc58c9a4875ad790584a724d09a210a6e52`; user approval in the task session covers this local Backend increment, not tag publication or Stage 7 acceptance.
+- Approved PostgreSQL cutoff adjustment: `rdm-two-trees-stage6-w9-pg-audit-cutoff-adjustment-r1.md`, SHA256 `2357b715a7c8f3451b34cc25a578d655e8a48f3f26d9cf7561ea7a13998ca857`; scope is isolated Backend implementation/testing, with no real database migration or release authorization.
+- Approved all-writers affected design: `rdm-two-trees-stage6-w9-all-writers-cutoff-adjustment-r1.md`, SHA256 `44f6f7cd34bf95a9c1eb844bfdd70a5c2233e1b5ffc89b3091359dcb5fc3b5d8`; the direct user approval allows the local v34 correction and isolated tests only.
+
+## Implemented local slice
+
+- Optional `ProjectAuditHost` and domain `audit.read` registration. A different plugin, absent registration, or unbound actor cannot read.
+- Store write snapshots the project from the owner-matched conversation; query requires the authenticated actor's owner and that immutable project. This deliberately excludes other members' private conversations and unbound historical rows, and does not move old receipts when a conversation changes projects.
+- Command audit stores the current verified account display name at write time; old rows expose `not-recorded`. Public receipts omit raw payload and parameter digest. Cursor uses project-and-owner scoped source cutoff.
+- Initial commit `c8dd169a1fdc1451fab3b475c14f9636a7f5bf6c` exposed only the actor-owned project slice. The next local increment fixes button actor propagation and adds a trusted domain-commit link publisher, verifier callback, exact linked metadata read, current `audit.read` and per-object metadata checks, and durable idempotency. Unlinked personal conversations remain private.
+- Trusted command dispatch now creates an operation ID before calling the compiled handler and passes that ID through `extension.Request`. The handler can commit the same ID with its domain event/outbox; the final Backend audit/receipt uses it. Client `params.operationId` is ignored. An outbox link request with `HostAuditOffset=0` resolves a unique committed host row by owner, fixed project, and operation ID; a missing row returns retryable `ErrProjectAuditPending`, while duplicate rows fail closed. The separate idempotency key still controls retry equivalence.
+- Independent review of `a8fa2fe` found two P2 security defects: clock-based operation IDs could collide; and `NewScopedHost(owner,"rdm")` let another compiled plugin self-report the publisher's plugin ID. The new local increment uses 192 bits from `crypto/rand` for each host-generated operation ID. Both zero-offset and explicit-offset publication require a unique committed row for owner/project/operation; a historical duplicate rejects publication, including attempts to link another private command. Verifier registration returns a private `ProjectAuditPublisherFactory` for the registering plugin's background outbox; a generic scoped Host has no publisher method. Fixed-clock concurrent IDs, forged params, ambiguous private offset, forged scoped Host, and legitimate registered publisher each have focused tests.
+- The minted publisher exposes only `ProjectAuditPublisher`, not the full owner-scoped `Host`; tests reject attempts to use `NewScopedHost` with a self-reported `rdm` string as publisher authority. A publisher is a registration-time capability, while `IdempotencyKey` remains the separate retry identity.
+- Exact-source linked reads do not enumerate hidden links or reveal raw payload, private conversation ID, or content. Body disclosure and a broad project link list are not implemented; the public coverage reports the narrower capability.
+- A PostgreSQL-only v33 default function takes a table-specific transaction advisory lock before assigning `command_audit.id`, making supported implicit-ID writes commit in source-offset order. Migration and each PG append/project page verify CACHE 1, ascending non-cyclic positive IDs, the exact guarded default expression, and the next ID above the committed maximum; unsafe drift fails closed. SQLite remains single-writer. The owner-only project page reports `committed-prefix` only after runtime checks. v34 below closes the explicit-ID bypass; online sequence maintenance remains prohibited.
+- Isolated PG RED receipt `/tmp/backend-w9-explicit-low-red-20261014-01.json` proved v33 still misreported `committed-prefix`: explicit ID 3 committed after normal ID 4 and disappeared across pages. Local v34 adds `ENABLE ALWAYS` insert and append-only mutation triggers. Every online INSERT checks READ COMMITTED, obtains the same transaction lock, and rejects a nonpositive, nonmonotone, or beyond-reserved ID. UPDATE/DELETE reject. PG append and every strong project page verify both trigger identities, exact event shape, and enablement; the existing default allocator also checks this guard. This is a local candidate, not yet independently reviewed or deployed.
+- `storage-migrate` now copies `command_audit` within one ACCESS EXCLUSIVE transaction: it disables only the named insert guard, copies explicit IDs, verifies count and checksum, advances the owned sequence only forward, restores and verifies the guard, and records done before commit. Failure rolls back table data, trigger state, and done; nontransactional `setval` may leave a safe forward gap. Idempotent done checks guard health before reporting success. Other tables retain their existing path.
+
+## Verification and remaining work
+
+- The session saw RED for the missing store and host interfaces, unscoped cutoff, cross-member private disclosure, and conversation-project reassignment before the respective fixes. These RED outputs were not captured by `make evidence`, so this card does not use them as formal evidence.
+- SELF receipt `/tmp/backend-w9-go-test-20261014-01.json`: `go test ./...`, exit 0, run on the pre-commit worktree based on R0.
+- SELF receipt `/tmp/backend-w9-build-20261014-01.json`: `CGO_ENABLED=0 go build ./cmd/agent-system`, exit 0, run on that pre-commit tree. Generated local binary removed after the build.
+- Historical SELF PostgreSQL receipt `/tmp/backend-w9-pg-cutoff-20261014-01.json`: isolated PostgreSQL 18.6 instance on port 55442 reproduced a low-ID transaction committing after a higher visible ID. `/tmp/backend-w9-pg-link-20261014-02.json` verifies the link table, retry/conflict behavior, and the pre-v33 cutoff counterexample. These receipts describe the old `offset-upper-bound-only` candidate, not the new v33 guarantee.
+- SELF PostgreSQL receipt `/tmp/backend-w9-pg-migrate-20261014-01.json`: isolated SQLite→PostgreSQL migration preserved one linked receipt and advanced its target sequence; the same migration ID replayed idempotently. The temporary PG instance was stopped and removed after verification.
+- SELF PostgreSQL receipt `/tmp/backend-w9-pg-operation-20261014-01.json`: a fresh isolated PG instance reran the link lookup, idempotency/conflict, and low-ID late-commit checks after trusted operation-offset resolution was added. The instance was stopped and removed.
+- New PG cross-page RED receipt `/tmp/backend-w9-pg-crosspage-red-20261014-01.json`: before v33, page 1 returned offsets 4 and 2, page 2 returned 1 after offset 3 committed, and the paged view omitted 3. The same test now passes with v33. Isolated PG tests also cover CACHE 10 counterexample/rejection, CACHE 1, sequence rewind into a vacant low ID, down/up with unchanged link IDs, advisory-lock timeout and rollback gaps, and SQLite→PG explicit-ID migration.
+- Historical pre-commit SELF load receipt `/tmp/backend-w9-pg-load-precommit-20261014-01.json` captured an initial v33 variant whose unlocked status function later produced false `cutoff unsafe` errors under concurrency; it is **not** valid performance acceptance evidence. The corrected status check reads committed MAX before non-MVCC sequence state and does not lock readers; the default ID allocator alone holds the transaction advisory lock and rechecks after `nextval`. `TestProjectAuditConcurrentReadWriteNeverReportsFalseDrift` and repeated PG load/cross-page runs protect that ordering. Three-condition pre-commit SELF raw receipts: `/tmp/backend-w9-pg-load-readlock-precommit-20261014-01.json` uses a test-only locked status wrapper, while `/tmp/backend-w9-pg-load-unlocked2-precommit-20261014-01.json` uses the final MAX-first unlocked status; each run also logs its v32 direct-INSERT baseline, PostgreSQL 18.6 version, 192 writes per mode/8 workers, elapsed time, p95, and throughput. The wrapper adds overhead and all measurements vary with hardware/load; no performance threshold has been approved, so they are Stage 6 cost evidence only.
+- Pre-commit SELF `/tmp/backend-w9-default-drift-red-20261014-01.json` showed that a replacement default containing the guarded function name but executing unguarded `nextval` was accepted; `/tmp/backend-w9-default-drift-green-20261014-01.json` verifies exact-expression rejection. Pre-commit SELF `/tmp/backend-w9-precommit-all-20261014-02.json` and `/tmp/backend-w9-precommit-pg-20261014-02.json` passed before this last guard tightening; fixed-HEAD runs are required below.
+- After the guard tightening, pre-commit SELF receipts `/tmp/backend-w9-precommit-all-final-20261014-01.json` (`go test ./... -count=1`), `/tmp/backend-w9-precommit-pg-final-20261014-01.json` (isolated PG store/storage-migrate), and `/tmp/backend-w9-precommit-pg-race-20261014-01.json` (cross-page/concurrent read-write with race detector) all exited 0. These still identify the dirty pre-commit tree, so they do not replace fixed-HEAD verification.
+- v34 pre-commit SELF `/tmp/backend-w9-allwriters-load-precommit-20261014-01.json` records isolated PostgreSQL 18.6, three runs of 192 writes per mode with 8 workers, comparing v32 direct INSERT with v34 guarded `Store.AppendAudit`; it also logs three mixed runs of 180 writes with 6 writers and 160 200-row pages with 4 readers. Protected write throughput ranged about 2.7–3.0k/s, write p95 6.4–6.6ms, and mixed large-page p95 1.2–1.9ms on this one host. These are SELF cost signals with no approved threshold and no Stage 7 acceptance meaning; fixed-HEAD tests still follow.
+- Integration constraint: this branch uses schema v31 (audit attribution), v32 (links), v33 (PG implicit cutoff), and v34 (all-writer guard), while the independent W6 Backend branch also has a local v31. Neither branch has consumed the other's unmerged work. After the first branch lands, the later branch owner must sync the new main, renumber its unpublished migrations without rewriting an already released version, and rerun fresh/old SQLite and PG migration plus combined regression on the actual merged source. These isolated tests do not prove W6+W9 compatibility.
+- Required next W9 work: real RDM committed-event verifier/outbox consumer, Backend project-event source, run ID propagation, model/tool/background receipts, body/detail disclosure, broad authorized linked-operation pagination, history/export, and combined product verification remain unfinished. A domain commit followed by a lost Backend audit append leaves the link pending; recovery must retain and reconcile that unknown state without claiming a host receipt. Exact-link and owner-only paging do not satisfy Stage 7 audit acceptance. PostgreSQL v33 adds a global command-audit append lock; its measured wait/throughput cost has no approved performance threshold and needs human Stage 6 review.
@@ -0,0 +1,30 @@
+# feature/regulations-kb-ext20 任务卡
+
+任务主记录：本文件随 PR 描述维护。
+状态：已完成（合入前闭合）；owner：weichen。已合入 （merge 56a7f9f440）；本卡随合入闭合，归档时移入 .task/archive/。
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main
+- branch_kind：standalone；跨仓总任务：Agent-System-Dev `feature/regulations-kb`（[Dev PR #614](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/614)）
+- R0（initial_main_sha）：cac60c0；工作区：/home/weichen/projects/Agent-System-Backend-wt-feature-regulations-kb-ext20；分支：feature/regulations-kb-ext20
+- 授权与交付终点：用户 2026-10-18 /goal 指示按法规知识库计划实现全部内容；本任务交付 U9 的基座公开契约 EXT-20（提案：Documents `docs/proposals/2026-10-18-ext-20-regulations-provider.md`，分支 `feature/regulations-kb-u9-contract`），经 PR 合入 main。不含法规提供方实现（属 KB 仓）与 RDM 消费（U6）。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+
+## 目标与非目标
+
+- 目标：`pkg/extension` 新增 `RegulationsProvider`/`RegulationsRegistrar`/`RegulationsHost` 与 DTO；进程内注册槽仅接受插件 `kbreg` 且只注册一次；分发 Host 实现四个方法并强制调用方身份、查询最小化（机密词拒绝、长度限制）、状态透传与无明文审计；快照、边界与契约/兼容测试。
+- 非目标：不实现搜索或语料检索；不改 `KnowledgeSearch` 语义。
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| backend-ext20-regulations-provider | pkg/extension、internal/app | implementation | cursor, antigravity, pi | 1 | cursor-agent-stable / auto（session not-observable，新进程） | success | refs/agent-exec/cfc2e055f212789112cf11716f5649c5/c04b36e76696 → aaed108（apply 快进） | 否 | /tmp/regkb-u9-receipt.json |
+
+## 结果与验证（完成后填写）
+
+- 结果：`pkg/extension/regulations.go`（EXT-20 接口、DTO、状态常量、`ErrRegulationsUnavailable`）、`surface.txt` 与 `SurfaceVersion` 2.15.0-experimental；`internal/app/regulations.go` 注册槽（仅 kbreg、一次、非 nil；声明式拒绝）与 inprocHost 四方法（有效账户检查、调用方取自分发上下文、schema 校验、查询去空白/1–256 字符/排除词拒绝且不调用提供方、状态透传、审计仅含修订/计数/状态/查询 sha256）；单元与兼容测试。
+- 验证（SELF，host 于 HEAD aaed108）：`go vet ./pkg/extension/ ./internal/app/` 与 `go test ./pkg/extension/... ./internal/app/...` PASS；全量 `GOWORK=off go vet ./... && go test -count=1 ./...` 40 包 ok，仅 `pkg/identity TestDSNFileMode` 失败——在未改动基线 cac60c0 上同样失败（本机环境问题，本变更未触及 pkg/identity），以 CI（GATE）为准。
+- Review：host 主模型审阅实际 diff（base 3187a00 / head aaed108），与提案第 2、4、5 节一致，无阻塞项。
+- 影响与剩余项：新增可选能力，未注册提供方时返回不可用，既有行为不变。
@@ -0,0 +1,85 @@
+# fix/ci-pg-flaky-tests 任务卡
+
+任务主记录：本文件随 Backend PR 描述维护；阻塞来源为 Dev PR #651。
+状态：已完成（合入前闭合）；owner：weichen。已合入 （PR #226，merge 508288fbed）；本卡随合入闭合，归档时移入 .task/archive/。
+
+## 基线与授权
+
+- 权威仓：ssh://git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main
+- branch_kind：standalone；initiative_id：
+- R0（initial_main_sha）：b5eb89c557e69d532c8d0a6e2e2cbe0258a7f086；工作区：/home/weichen/projects/Agent-System-Backend-wt-fix-ci-pg-flaky-tests（worktree）；分支：fix/ci-pg-flaky-tests
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/backend-ci-flakes-triage-20261020.json；receipt_sha256=21ec3e6337883b983cc00d6b798c30fff859a94b77e0be197744832acd9f35e1；requirement_sha256=1a3a7a2160a5c543f0ab9f7f766034de5b90a8984d99989454b340966758d50e
+- 授权与交付终点：用户授权排查和修复阻塞 Dev PR #651 合入的 Backend 测试失败，按项目门禁交付 Backend 修复；不部署、不改 CI、路由或其他业务。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+修复 CI 已观察到的门面卡锚点、后台完成等待、项目事件私有历史分页测试失败。保留断言与隐私边界，以真实异步完成条件消除竞态；不修改与这三个失败无关的功能、依赖或执行器。
+
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| stabilize-ci-pg-server-tests | 原工作包文件清单与误用的 ** 模式 | repair | cursor, antigravity, pi | 1 | cursor / auto | scope-expansion | 无 | false | /tmp/backend-ci-flakes-implementation-20261020.json |
+
+| ci-pg-async-completion-r2 | e2e_test.go / project_events_test.go / background_test.go | repair | cursor, antigravity, pi | 1 | cursor / auto (effective not-observable) | completed (controller success) | 2ee469011e66b6bedcf6e9d87c8b1c026f7a8cef | false | /tmp/pr651-repair-r2.json |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：仅修复三个测试文件的异步完成等待；门面卡等待 run.completed 持久事件，项目分页读到共享帧即结束，后台 idle 使用独立有界等待。生产代码、CI 与断言未修改。
+- 验证：worker red/green 对照与 focused count=10 通过；host 独立相关用例 count=3、go vet ./...、go test -count=1 ./... 通过（SELF）。完整原始收据由 Dev make evidence 捕获：/tmp/pr651-backend-host-full-20261020.json；源码对象 2ee469011e66b6bedcf6e9d87c8b1c026f7a8cef。当前最终 HEAD GATE 待运行，不以 SELF 放行。
+- 影响与剩余项：只影响测试等待；30s/20s 是基于磁盘实测及停顿注入的卡死上限，实际 CI 停顿时长仍不确定。AuthOwner 每帧持久写入的性能观察不在本次范围。旧 fail-stop 隔离现场保留。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
+
+## 恢复与重新定义单元（2026-10-20）
+
+- 用户在交接后明确“继续”；旧 run 290c8b13f4a4a9e5d67df066754ab3fd 已停止，不自动重试或接纳其诊断文件。
+- 现场已对账：唯一源文件差异为原隔离目录的 zz_diag_tmp_test.go；实际事件中仅有读源码、局部构建与本机测试/缓存操作，没有发现提交/推送、正式工作树修改或外部请求。原进程与现场写者已退出；隔离目录与本机诊断产物均保留。
+- 原执行器 allowed_paths 使用精确路径/目录前缀匹配，工作包的 ** 不起通配作用。新单元采用明确文件清单；诊断只能在这些现有测试中或仓外生成，禁止继续使用原会话。
+- 任务 worktree 已完整移至本卡登记位置，Git 与 development-manager 子模块路径已修复；没有删除文件。
+- Dev 启动 SELF 收据：/tmp/pr651-resume-20261020-a1.json（发现嵌套 worktree）、a2 至 a5（后续恢复检查，均未宣称通过）。原始完整文件在 /tmp。
+- 权威 Backend main 已由 API 核验并合入 c16495006dbf1cf6ee581b48d99bba1e7f9a377c；继承的 O2 改动仅为必需目标同步，不属本次修复。固定 Guidelines 与依赖已物化，配置与治理准入均通过。
+- 新单元目标：分别确认三项失败根因，在现有测试的精确路径内建立 red/green 证据；若确需修改生产逻辑，先形成能复现真实行为缺陷的失败测试。禁止弱化断言、仅拉长时间或不受控压力测试。
+
+## Review 与交付
+
+- 主协调者独立 Review：base c16495006dbf1cf6ee581b48d99bba1e7f9a377c，实现对象 2ee469011e66b6bedcf6e9d87c8b1c026f7a8cef；已核对真实完成事件的顺序、共享帧位于所有私有帧之后、等待仍有界、所有隐私与锚点断言保留；无阻塞发现。
+- 实施包与终态原始事件分开保存：/tmp/pr651-repair-unit-r2.json、/tmp/pr651-repair-r2.json、/tmp/agent-exec-1000/662a926e726431b930433273fc26f39a/raw-e8392e75611f.log；有效 completed 已在实际 result envelope 中核验。
+- 原始实验输出：/tmp/pr651-r2-red-anchor.txt、/tmp/pr651-r2-green-anchor-experiment.txt、/tmp/pr651-r2-stall-redgreen.txt。临时实验代码已撤除。
+- 交付：当前最终 HEAD 仍需自身 CI（ci/vet-and-test 与 governance），权威目标同步核验后经 PR 合入；GATE 与实际合入结果在源码外记录，不修改冻结候选。
@@ -0,0 +1,69 @@
+# fix/resolve-hitl-run-status-ordering 任务卡
+
+任务主记录：<Issue/PR 链接，或注明"本文件随 PR 描述维护">。
+状态：已完成（合入前闭合）。owner：weichen。已合入 PR #237（merge f084d10aa5）；本卡随合入闭合，归档时移入 .task/archive/。
+
+## 基线与授权
+
+- 权威仓：ssh://git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main
+- branch_kind：standalone；initiative_id：
+- R0（initial_main_sha）：07228aa38139d974e88573a84ad992fd66166168；工作区：/home/weichen/projects/Agent-System-Backend-wt-fix-resolve-hitl-run-status-ordering（worktree）；分支：fix/resolve-hitl-run-status-ordering
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/be-triage-runhitl-20261021.json；receipt_sha256=39dc1067007f31d2871e03c86a389f882925d5279198b0d3bdf9d8ccd253a6f7；requirement_sha256=2756850b023061065b52aac9b8f318a9802d56bdc97882ac24b749e940ea8559
+- 授权与交付终点：修复 Manager.ResolveHITL 的 run 状态写入顺序竞态并补回归测试；按 Backend 仓现行门禁完成 Review、PR、CI、合入、任务卡闭合与回收。不得改其它子系统、不得改 HTTP/server 层、不得放宽断言。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+目标：Manager.ResolveHITL 先向 `hitlCh` 投递答案、再无条件 `UpdateRun(running)`，会在 runner 已把 run 写成 `completed/ended_at` 之后被覆盖回 `running/ended_at=NULL`，导致 run 永久卡在 running（无执行者）、会话永不释放、后续每次提交都是 409。修复为先以条件更新 `WHERE status='waiting_hitl'` 把 run 推进到 running（由 store 报告是否命中），再交答案给 runner；交答案后该 run 行此后唯一写者是 runner，不会被反向覆盖。
+
+非目标：不改 HTTP/server 层、不改其它 store 表的写入语义、不放宽任何断言、不引入新依赖、不改 schema。
+
+验收条件：(1) 新回归测试在修复前红（runner 抢先结算后 DB 仍为 `completed/ended_at`）、修复后绿；(2) `go test ./internal/runmgr ./internal/store` 全绿；(3) 独立 Review 无阻塞项。
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：<交付了什么；未发生写无>。
+- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。
+- 影响与剩余项：<影响面、遗留风险、后续任务>。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
@@ -0,0 +1,19 @@
+command: scripts/dm governance check --repo . 
+cwd: /home/weichen/projects/Agent-System-Backend-wt-feature-governance-adoption
+head: 472e5ab313318181f1ecad1a351a0c612c453ac0
+exit: 0
+utc: 20261017T071539Z
+---
+ok gitlink deps/development-guidelines
+ok gitlink deps/development-manager
+ok agent-execution
+ok file AGENTS.md
+ok file PROJECT.md
+ok file policy/guidelines-adoption.md
+ok file .task/templates/task-card.md
+ok executable scripts/agent-exec
+ok executable scripts/hooks/pre-commit
+ok executable scripts/dm
+ok executable scripts/task
+ok adoption status
+ok fixtures
@@ -0,0 +1,7 @@
+command: scripts/agent-exec validate --repo . 
+cwd: /home/weichen/projects/Agent-System-Backend-wt-feature-governance-adoption
+head: 472e5ab313318181f1ecad1a351a0c612c453ac0
+exit: 0
+utc: 20261017T071539Z
+---
+validate: ok
@@ -0,0 +1,13 @@
+command: python3 /tmp/gov-neg/adopt_cases.py . 
+cwd: /home/weichen/projects/Agent-System-Backend-wt-feature-governance-adoption
+head: 472e5ab313318181f1ecad1a351a0c612c453ac0
+exit: 0
+utc: 20261017T071539Z
+---
+[object] Agent-System-Backend-wt-feature-governance-adoption HEAD=472e5ab313318181f1ecad1a351a0c612c453ac0
+PASS positive-run-apply: run exit=0 terminal=success apply exit=0 head=cb5172f341c9
+PASS missing-config: run exit=2 terminal=invalid-config validate exit=2
+PASS bad-receipt: apply exit=4 head_unchanged=True msg=apply: no local integrity record: changed paths do not match the transport diff
+PASS out-of-scope-path: run exit=5 terminal=scope-expansion transport=False
+PASS unknown-side-effect: run exit=4 terminal=failed-unknown transport=False
+[verdict] ALL PASS cases=5
@@ -0,0 +1,68 @@
+# fix/close-merged-task-cards 任务卡
+
+任务主记录：<Issue/PR 链接，或注明"本文件随 PR 描述维护">。
+状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main
+- branch_kind：standalone；initiative_id：
+- R0（initial_main_sha）：f084d10aa5ea2e4ad2ab4e6eb1268d3e83c6e991；工作区：/home/weichen/projects/Agent-System-Backend-wt-fix-close-merged-task-cards（worktree）；分支：fix/close-merged-task-cards
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/be-triage-cardclose-20261021.json；receipt_sha256=155aba399116f6e47f74df3198f749947a20d5974a2f130eb671cd55ce9cad73；requirement_sha256=a40da80ed0cd7d0bfa59ad4998f17307131c5149c3f9ee3c0575a7a654b1f2de
+- 授权与交付终点：把三张已合入但仍留在 `.task/` 顶层的任务卡回填合入事实并移入 `.task/archive/`，消除主检出的卡片欠账。终点为 PR 合入 main。不得改任何生产代码、不得改卡内历史记录内容（只补合入事实与状态）、不得动他人工作区。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+目标：Backend 主检出的 `.task/` 顶层留有三张 PR 已合并但未归档的任务卡，构成 precheck 的卡片欠账：`feature-regulations-kb-ext20`（PR #212，merge `56a7f9f440`）、`fix-ci-pg-flaky-tests`（PR #226，merge `508288fbed`）、`fix/resolve-hitl-run-status-ordering`（PR #237，merge `f084d10aa5`）。三张卡的合入事实来自 Gitea API（`state=closed, merged=true`）。本任务只做两件事：把状态行补成「已完成（合入前闭合）+ 已合入 PR/merge」并附归档注记，然后把三张卡 `git mv` 到 `.task/archive/`。
+
+非目标：不改任何生产代码或测试；不改卡内的需求、实施、验证、Review 等历史记录，只补状态行与合入事实；不动 `wt-pal-merge` 工作区（他人 PR #237 之外的进行中任务）；不改任何子模块 pin。
+
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：<交付了什么；未发生写无>。
+- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。
+- 影响与剩余项：<影响面、遗留风险、后续任务>。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
@@ -0,0 +1,68 @@
+# fix/iam-perm-ux-port 任务卡
+
+任务主记录：<Issue/PR 链接，或注明"本文件随 PR 描述维护">。
+状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git；root_target：main；immediate_target：main
+- branch_kind：standalone；initiative_id：
+- R0（initial_main_sha）：01f4c47a2b5798c9b43fffb9e298aa87138a1537；工作区：/home/weichen/projects/Agent-System-Backend-wt-fix-iam-perm-ux-port（worktree）；分支：fix/iam-perm-ux-port
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=no accepting initiative；triage 收据=/tmp/be-triage-iam-perm-ux-20261021.json；receipt_sha256=bb4a700446f22b5799e94f1c6efa488c4a30b65814a457b76ab41d30b0dc5038；requirement_sha256=9495f0dc1c3cbf04feb6c712bfa93c6bbb6803801285a518ae9f309c74ec836b
+- 授权与交付终点：把仅存在于被放弃分支 feature/iam-perm-ux-backend 的权限管理 API 移植到当前 main，使其可从主干维护与调用。冲突一律以 main 现状裁决，不照搬旧实现；不得绕过 main 的账户作用域写入围栏与授权检查；不得新增范围外功能或 schema 迁移。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+目标：main 此前不具备七个权限管理入口（PatchRolePermissionsBatch、PreviewRolePermissions、AssignUserRolesBatch、PreviewUserRoleAssignments、ListRoleMembersForActor、ActiveRolesForUsers、CreateRoleCopyAndAssign）与配套类型（RoleBinding、PolicyReceipt、RoleAdminView、CapabilityAssociation、RoleAuthorityImport*、RoleCreate/RolePatch、RolePermissionChange/Conflict）。本任务把这些能力移植到当前 main（其间 Backend 已合入 #228、#234），并保留其安全语义。
+
+非目标：不整条合并/cherry-pick 旧分支（其基线早于 #228/#234）；不新增范围外功能；不做无关重构；除移植确需新表外不改 schema；不改 Makefile/CI/子模块/文档。
+
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：七个权限管理入口（PatchRolePermissionsBatch、PreviewRolePermissions、AssignUserRolesBatch、PreviewUserRoleAssignments、ListRoleMembersForActor、ActiveRolesForUsers、CreateRoleCopyAndAssign）与配套类型（RoleBinding、PolicyReceipt、RoleAdminView、CapabilityAssociation、RoleAuthorityImport*、RoleCreate/RolePatch、RolePermissionChange/Conflict）全部移植到当前 main 的角色/权限模型上，8 文件 / +2184 行。移植首版并未编译通过（role_policy.go:2394 向 upsertRolePermissionsTx 传参错位：空 map 当 current、slice 当 after），已由独立 repair 单元按 main 的差量语义修正。
+- 验证：PASS——gofmt -l 干净；go build ./... 与 go vet ./internal/store/ ./internal/server/ ./internal/authz/... 均无输出（宿主独立执行）；go test -count=1 ./internal/store/ ./internal/server/ ./internal/authz/... 全绿（store 13.3s / server 29.5s / catalog ok）；独立 Review PASS、无阻塞项，逐 API 核对安全语义。
+- 影响与剩余项：只新增能力面，不改 schema（移植未引入新表），不改 Makefile/CI/子模块；未新增范围外功能。非阻塞遗留：Review 指出 PostgreSQL 下不同角色跨 batch 处理的潜在 lock-ordering 风险，以及若干测试缺口，两者已记入报告留作后续增量。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
@@ -0,0 +1,441 @@
+# 独立代码审查：fix/iam-perm-ux-port（IAM 权限管理 API 移植）
+
+- 审查基线（main 当前 HEAD）：01f4c47a2b5798c9b43fffb9e298aa87138a1537（merge #238 前一刻）
+- 审查终点（fix/iam-perm-ux-port HEAD）：f10fb2e
+- 审查 commit 范围：01f4c47a2b5..HEAD（3 提交，2 个 agent-exec transport + 1 个 task-start）
+- 受影响文件：8 个源码文件 / .task/fix-iam-perm-ux-port.md
+- 审查者：独立审查会话（未参与实现）
+- 审查时间：2026-10-21 UTC
+- 仓库：`/tmp/agent-exec-1000/5aab730b1b5c159f2ce8f0cf9b2c50b5/wt-5dfb74fd02f1`
+- 工作区状态：detached HEAD @ f10fb2e（无未提交修改）
+
+## 审查结论：PASS
+
+本审查未发现阻塞项。七个移植 API 在语义层与 main 现有 role_policy.go / roles.go / account_search.go
+一致；安全语义保持 main 现有的 `system.permissions.*` / `system.roles.*` 授权门 + 账户作用域写入围栏
+（含 `requireSuperAdminTargetAccess` / `roleGrantsAccountAdministrationTx` / `requireRoleAuthorityWritableTx` /
+`policyWriteBatch` 等）；事务与一致性、审计与回执、与 #228/#234 的关系、测试质量均无证据证明存在
+继承能力丢失或静默行为改变。仅有一处非阻塞担心（PostgreSQL 下不同角色跨 batch 的
+潜在 lock-ordering 风险）与若干测试缺口，已列入"非阻塞建议"。
+
+---
+
+## 1. 受影响文件与体量（依据：`git diff --stat`）
+
+```
+ .task/fix-iam-perm-ux-port.md              |   66 ++
+ internal/authz/catalog/catalog_test.go     |   16 +
+ internal/server/account_search.go          |  126 +++
+ internal/server/role_authorization_test.go |  226 ++++++
+ internal/server/roles.go                   |  162 +++
+ internal/server/server.go                  |    6 +
+ internal/store/role_policy.go              | 1141 ++++++++++++++++++++++++++++
+ internal/store/role_policy_test.go         |  494 ++++++++++++
+```
+
+实际为 8 个源码/任务文件（与 packet 的 8 文件一致）；packet 标的 "+2184" 略低于实际
+`+2237`，差异来自本盘点把 `.task/fix-iam-perm-ux-port.md` 计入或不算的口径差——本评审
+只把它当作任务卡，不审其内容。
+
+---
+
+## 2. 七个 API 与对应实现
+
+| # | 端点（routes，`server.go`） | handler（`server/roles.go` / `account_search.go`） | store（`store/role_policy.go`） | 授权闸 |
+|---|---|---|---|---|
+| 1 | `POST /api/admin/roles/permissions/preview` | `listRolePermissionPreview` | `PreviewRolePermissions` / `previewRolePermissionsTx` | `system.permissions.view` |
+| 2 | `POST /api/admin/roles/permissions/batch` | `batchPatchRolePermissions` | `PatchRolePermissionsBatch` / `patchRolePermissionsTx` / `upsertRolePermissionsTx` | `system.permissions.manage` |
+| 3 | `POST /api/admin/roles/copy-assign` | `copyAssignRole` | `CreateRoleCopyAndAssign` | `system.roles.manage`+`system.permissions.manage`+`system.roles.assign`（三同时） |
+| 4 | `GET /api/admin/roles/{roleId}/members` | `listRoleMembers` | `ListRoleMembersForActor` | `system.users.view`+`system.roles.view`（两同时） |
+| 5 | `POST /api/admin/users/role-assignments` | `assignUserRolesBatch` | `AssignUserRolesBatch` / `assignRolesTx` / `rebindUserRoleTx` / `checkRoleAssignmentTx` | `system.roles.assign` |
+| 6 | `POST /api/admin/users/role-assignments/preview` | `previewUserRoleAssignments` | `PreviewUserRoleAssignments` / `activeRoleTx` | `system.users.view`+`system.roles.view` |
+| 7 | `GET /api/admin/users/search`（追加 role 投影） | `searchAdminUsers`（修改） | `ActiveRolesForUsers` | `system.users.view`；role 字段附加条件 `system.roles.view`（`systemActionAllowed` 静默跳过） |
+
+类型承载面（`store/role_policy.go` 新增）：`RolePermissionPreviewInput`、`RolePermissionStateChange`、
+`RolePermissionConflict`、`RolePermissionPreview`、`RolePermissionPatchInput`、
+`RolePermissionBatchReceipt`、`RolePermissionBatch`、`UserRoleAssignmentInput`、
+`UserRoleAssignmentResult`、`UserRoleAssignmentBatch`、`UserRoleAssignmentPreview`、
+`RoleCopySource`、`RoleCopyAssignment`、`RoleCopyAssignResult`、`RoleMember`、`UserRoleSummary`。
+
+常量、错误：`RolePermissionPreviewReplace`/`Patch`、`permissionStateDenied/Project/Default/Invalid`、
+`linkedExpansionLinked`、`maxRolePermissionPreviewItem=100`、`maxRolePermissionBatch=20`、
+`maxRoleAssignmentBatch=100`、`roleAssignmentUserMissing/Disabled/StateChanged/RoleInvalid`、
+`rolePermissionChangeError`（带 `Unwrap()` 指向 `ErrInvalidRolePolicy`，与既有错误链兼容）。
+
+---
+
+## 3. 重点 1 —— 移植正确性（语义一致）
+
+主要结论：未发现语义丢失或静默改变；与 main 现有 role_policy.go / roles.go / account_search.go
+行为对齐。
+
+- `normalizePermissionChanges`（store/role_policy.go:1474-1504）：与 main 现有的
+  `ReplaceRolePermissions`（同文件 line 379）一样把"非 project.create"和"受保护动作"
+  在写入前拒绝；duplicate 拒绝；"Allowed=true && CapAllowed=false"非法组合拒绝。
+  对 `project.create` 之外的 audit 行保持原状（patch 语义），与
+  `TestRolePermissionsNormalizeLegacyRowsToProjectAccess`（main 既有的旧审计行单点投影测）
+  行为兼容。
+- `RolePermissionStateChange` 报告 `Before`/`After` 是按当前行 vs 合并后行计算的，并跳过
+  `ProjectAccessAction` 自身（`rolePermissionStateChanges` 把 expansion 跳过），所以预览
+  在关闭 project.create 时不会把 projection-row 误判为增删。
+- 关闭 project.create 后 `KeptLinkedActions` 仅列举"原本就显式有 row 的"linked 动作
+  （`keptLinkedRows`）；没有 row 的不会出现在 migration note 中，避免误导。
+- `CreateRoleCopyAndAssign` 选择 `current=nil` 作为新角色的 prior 状态（注释明确解释），
+  因为新角色行是在同一事务内插入的；这与原 feature 分支行为一致，避免在 helper 里
+  伪装既有行。
+- `AssignUserRolesBatch` 用与 `AssignUserRole` 同形态的 SQL
+  （`UPDATE user_role_bindings SET active=0 ... ; INSERT ... ; UPDATE users SET state_version=state_version+1 WHERE state_version=?`）
+  复用既有单用户路径所具备的乐观并发控制——`state_version` 重核确保 rebind 不覆盖并发变更。
+- `PolicyReceipt` 包含的 `ReceiptID` / `AuthorityEpoch` 直接读自 `PolicyReceipt` 结构
+  （已有），`RolePermissionBatchReceipt` 嵌入了该类型——回执格式与传统 `ReplaceRolePermissions`
+  完全对齐，没有改写 main 既有的回执 schema。
+- `RoleAdminView` 与既有的 `RoleAdmin`/`ListRoles` 投影共享 `RoleRecord + Permissions + ProjectAccess`
+  复合字段（`RoleCopyAssignResult.Role` 直接构造），不引入新读路径。
+
+未验证：原 feature 分支的代码已不在本仓（packet 注："唯一副本已备份"，且本工作区 detached HEAD
+无源分支 ref）。本评审只能与 main 现状 + diff 做对比，无法逐行比对其与原版的差异。这是结构性
+限制，已在"未验证"列出。
+
+---
+
+## 4. 重点 2 —— 安全语义（最高优先，逐 API 核对）
+
+| API | 入口授权 | store 内额外防御 | 是否绕过 main 既有 owner/admin 校验 / isAdmin 判定 / account-checked 写路径 |
+|---|---|---|---|
+| listRolePermissionPreview | `requireSystemAction("system.permissions.view")`（非 admin 路径同样拒绝） | `PreviewRolePermissions` 起手 `actor=="" → ErrAccountForbidden`；开 tx 后 `requireEnabledActorTx` 二次校验 actor 行；逐 item `previewRolePermissionsTx` 不写盘；没有走 `policyWrite`/`policyWriteBatch` | 否；纯读 |
+| batchPatchRolePermissions | `requireSystemAction("system.permissions.manage")` | `PatchRolePermissionsBatch` 走 `policyWriteBatch(actor, nil, …)` —— 即 `lockAccountUsers(actor)`，再 `requireRoleAuthorityWritableTx`，再 `replayReceipt`（同 key + 同 request_hash 才允许重放）；每 item 通过 `s.roleTx(item.RoleID, true)` 在 Postgres 上对 role row 加 `FOR UPDATE`；每个 item 走 `normalizePermissionChanges`（拒绝非 project.create / 受保护 / duplicate / 非法组合），`patchRolePermissionsTx` 内 `s.upsertRolePermissionsTx` 按 patch 语义 upsert，并对 `roles SET role_version=role_version+1 WHERE role_version=expected` 二次乐观并发 | 否；任何 `system.permissions.manage` 持有人都是该路径的合法写入者（与 `ReplaceRolePermissions` 对等，没有 target-side 校验，因为这是 system 层面的角色authority） |
+| assignUserRolesBatch | `requireSystemAction("system.roles.assign")` | `policyWriteBatch(actor, userIDs, …)` —— 同时锁 actor + 全部 target owner；`assignRolesTx` 内逐 item 调用 `requireSuperAdminTargetAccess(actorAccount, target)`（R5 抗 super-admin 篡改），非 super-admin 还检查 `roleGrantsAccountAdministrationTx(tx, item.RoleID)`（防止把 admin 角色批给用户形成提权路径，R4）；`checkRoleAssignmentTx` 校验 disabled / state_version / role enabled；`rebindUserRoleTx` 在 SQL 层再用 `state_version=? AND enabled=?` 重核；最后 `checkCapabilityAssociationTx`（project.create 联合关联门）；一笔失败全事务回滚 | 否；与单用户 `AssignUserRole` 同等保护，没有批量化造成的"开窗" |
+| previewUserRoleAssignments | `requireSystemAction("system.users.view")` + `system.roles.view`（双闸） | `PreviewUserRoleAssignments` 起手 `actor==""` 与 `validateRoleAssignmentItems`；开 tx 后 `requireEnabledActorTx` 二次校验 actor；逐 item 读 users 行并构造 preview，`account == nil` 通过 `roleAssignmentUserMissing` 区分；不写盘，不调 `policyWriteBatch` | 否；纯读；返回的字段范围与 `getUserRole` 视图对齐（owner/name/current role/状态匹配/错误原因） |
+| copyAssignRole | 三闸（`system.roles.manage`/`system.permissions.manage`/`system.roles.assign`） | `CreateRoleCopyAndAssign` 走 `policyWriteBatch(actor, userIDs, …)`；源 role `roleTx(..., true)` 行锁；`requireRoleAuthorityWritableTx`；按源 role 的 row 拷贝非受保护动作（`descriptor.Protected` 跳过），覆盖用 `normalizePermissionChanges`（同样拒绝非 project.create）；源 enabled project.create 但 merge 后 disabled 的情形被显式拒绝（`sourceWasCreator && !copyIsCreator → ErrInvalidRolePolicy`）；写后 `checkCapabilityAssociationTx`；最后通过 `assignRolesTx` —— 与 `assignUserRolesBatch` 完全相同的 anti-elevation + state-version 二次校验 | 否；copy 路径不会复制系统 grant（`copied` map 跳过 protected），不会复制 `IsSuperAdmin`/admin 身份（`CreateRole` 只插 roles 行），不会复制 project membership（不参与任何 project_* 表） |
+| listRoleMembers | `requireSystemAction("system.users.view")` + `system.roles.view`（双闸） | `ListRoleMembersForActor` 在 Postgres 走 `BeginTx(..., LevelRepeatableRead)`，SQLite 走普通 tx；起手 `lockAccountUsers(actor)`，对 actor 行 `FOR UPDATE`；然后 `requireSystemActionTx(tx, locked[actor], "system.users.view")` 与 `system.roles.view` 二次校验；`s.roleTx(roleID, false)` 校验 role 存在；SQL `SELECT ... FROM user_role_bindings b JOIN users u ON u.id=b.user_id WHERE b.role_id=? AND b.active=?`；附带 `account_directory_revision` 同一快照读 | 否；handler 层 cursor 用 `accountSearchKey` HMAC 绑定到 role/query/mode/status/private revision，不能跨 role/param 重放（`parseAdminCursor` `hmac.Equal` + version 比对） |
+| searchAdminUsers 的 role 投影 | 入口：既有 `system.users.view`（无变化） | 投影附加条件 `systemActionAllowed(actor, "system.roles.view")` —— 不开 reader 时静默跳过（无 role 字段），与既有的 read projection 模式一致 | 否；授权差异只在响应字段是否多一项 `role` 上，没有改变授权面。无 role 时一律为 `null`，无信息泄露 |
+
+关于越权路径的关键判断：
+
+- **检查 1：super-admin 保护**。`assignUserRolesBatch` 通过 `assignRolesTx` 强制 `requireSuperAdminTargetAccess`。
+  即便 actor 拿到 `system.roles.assign` 与 is_admin，把一个非自身的 super-admin 用户塞进
+  assignments 也立刻被拒绝。`copyAssignRole` 通过 `assignRolesTx` 走的是同一函数，复用同保护。
+- **检查 2：admin 角色 escalation**。`roleGrantsAccountAdministrationTx` 检查目标 role 是否
+  携带任何 `system.users.* / system.roles.* / system.permissions.*`，非 super-admin 一律拒绝。
+  与单用户 `AssignUserRole` 行为完全一致。无绕过。
+- **检查 3：account-checked 写路径**。三个写 API（`PatchRolePermissionsBatch` / `AssignUserRolesBatch` /
+  `CreateRoleCopyAndAssign`）通过 `policyWriteBatch` 借用 main 既有 account 锁路径
+  （`lockAccountUsers` `FOR UPDATE` + enabled 校验 + 一致 ID/owner 比对），与 `policyWrite`
+  是同一家族。可以理解为对现有单写围栏的"批量化"，没有引入新的、非现有围栏之外的捷径。
+- **检查 4：跨账户读取**。`ListRoleMembersForActor` / `PreviewUserRoleAssignments` /
+  `searchAdminUsers` 三个读取入口都已就授权闸；没有出现"通过 batch 路径可以读到他人 role-membership
+  但单 API 不可读"的二通道。
+- **检查 5：审计/回执旁路**。`policyWriteBatch` 包裹的写入最后都走 `saveReceipt`（除 `CreateRole`
+  类型既有的纯插入路径外），未发现可以既写盘又不留 `policy_receipts` 行的调用点 —— 审计门未开窗。
+
+---
+
+## 5. 重点 3 —— 事务与一致性
+
+`policyWriteBatch` 的事务结构与 `policyWrite`（同文件 line 181）严格同形态：
+
+1. 把 actor 与所有 target owner 加入 owner 集合；
+2. `s.db.Begin()`，defer Rollback；
+3. `lockAccountUsers(tx, owners...)` —— owner 字典序排序后逐个 `FOR UPDATE`，规避锁顺序；
+4. 校验 `actorAccount.Enabled` 与每个 target `target.Enabled && target.ID == userID`；
+5. 读 `authority_state.authority_epoch`（PG 下 `FOR UPDATE`）；
+6. 调用上层闭包；
+7. 闭包负责回写 epoch 与保存 receipt；
+8. `tx.Commit()`。
+
+提交或回滚边界：
+
+- `AssignUserRolesBatch`：验证循环 + rebind 循环均在同一事务；任何一次 `ErrAccountForbidden /
+  ErrConflict / ErrInvalidRolePolicy` 都立即返回事务回滚；`rebindUserRoleTx` 内的
+  `UPDATE users SET state_version=state_version+1 WHERE id=? AND state_version=? AND enabled=?`
+  在 SQL 层提供最后一道乐观并发；批内任意用户状态版本与 `expectedStateVersion` 不匹配即整批回滚。
+- `PatchRolePermissionsBatch`：每个 item 走 `patchRolePermissionsTx`，内部 `roleTx(... true)`；
+  `s.upsertRolePermissionsTx` 按 patch 语义只写 patch 列表中的行（未在 patch 列表的行保持原样
+  不动 —— 这与"显式 patch"语义对齐，不会误把删除当作新增）；`UPDATE roles SET role_version=role_version+1
+  WHERE role_id=? AND role_version=?` 拒绝过期；随后 `checkCapabilityAssociationTx(tx, nil, roleIDs, nil)`
+  —— 只检查涉及的 role 列表的 project.create + linked 关联。
+- `CreateRoleCopyAndAssign`：源 role row 锁、新 role insert、`upsertRolePermissionsTx(... nil ...)`、
+  重新把 `items[].RoleID = roleID`（设置后立即调用 `assignRolesTx`）然后 `checkCapabilityAssociationTx`。
+  关闭源已有的 project.create 又把 copy 设成非 creator 的情形被显式拒绝
+  （`sourceWasCreator && !copyIsCreator → ErrInvalidRolePolicy`），这避免了"复制即失去能力"
+  的伪操作混淆。
+
+`current→after` 增量计算是否会把删除误判为新增：
+
+- `previewRolePermissionsTx`：用 `current = s.rolePermissionBitsTx(tx, role.RoleID)` 与
+  `next = normalizePermissionChanges(item.Changes)`，合并 `after`，对所有 `catalog.Catalog()`
+  内动作比对 `Before/After` 状态不同者写入 `Changes`；删除本质上等同"原本某 row 状态 X，目标 Y"，
+  不会进入 `Changes` 错查为"add"（因为 `current` 中已有 row）。
+- `patchRolePermissionsTx`：以 `current` 为基础 `after` 起点，`patch` 覆盖 `after`；`upsertRolePermissionsTx`
+  对比 `current`/`after` 后只对真正变化者写。删除语义上等同于"原 row 留在 patch 之外即不动"
+  （patch 不写删除显式动作，故删除行为是 patch 之外的子集）—— 这是 patch 语义而非 replace 语义，
+  在端口注释里有显式说明 (`// Only listed actions change; every unlisted row of the role stays exactly as stored`)。
+
+回滚完整性（基于代码路径核查，每条都在收到 err 时让事务回到 Begin 状态，因为没有分支绕过 defer
+`tx.Rollback()`，且所有写入函数都用同一 `tx`）：
+
+- `policyWriteBatch`：`tx.Commit()` 之前的任何 error 都回滚；commit 失败由 defer 再 Rollback 兜底。
+- 三个写 store 函数都没有副作用排序的反向操作（除 rebindUserRoleTx 之外）。
+
+未验证：未运行 `go test ./...` —— 见"未验证"节。
+
+---
+
+## 6. 重点 4 —— 审计与回执
+
+- 三个写 API 都调用 `policyWriteBatch` 并在闭包内 `saveReceipt(tx, actorAccount.ID, key, operation, requestHash, out)`，
+  写入 `policy_receipts` 表（既有 main 表）。
+- 操作名分别用 `"role.permissions.batch_patch"`、`"user.role.assign.batch"`、`"role.copy.assign"`，
+  都是独有的操作标签；replay 通过 `(actor_user_id, idempotency_key)` 复合唯一索引保证幂等。
+- `replayReceipt` 在 hash 不一致时返回 `ErrConflict`；与 `TestRolePolicyIdempotencyKeyCannotChangeRequest`
+  既有的幂等语义一致 —— 同样 key + 不同 request 必然拒收。
+- `PolicyReceipt` 与 `RolePermissionBatchReceipt` 都嵌入了 `PreviousRoleVersion` / `Changes` /
+  `KeptLinkedActions` 等可复核字段。回执包含 `ReceiptID` (`newID("receipt")`) 与
+  `AuthorityEpoch = epoch+1`，方便把回执与下一次 authority epoch 增量对齐。
+- `CreateRoleCopyAndAssign` 在写盘后用 `s.roleTx(roleID, false)`（不带锁，二次 snapshot）+ 
+  `s.rolePermissionRecords(...)` 重新读 `role_permissions` 完整集合（含历史 audit 行），计算
+  `ProjectAccessOf`，保证回执中 `ProjectAccess` 与 `RoleAdmin`/`ListRoles` 共享投影。
+- `RolePermissionConflict` 仅在预览路径出现 —— 由 `state.conflicts()` 推导（既有的
+  `capabilityConflict`、`capabilityConflictReason`），与 `checkCapabilityAssociationTx` 共用同一
+  套冲突识别逻辑。冲突原因 `使用此角色的用户已直接获授创建项目...` / `创建项目需要本人项目...` 都是
+  user-facing 中文，不暴露内部 ID。
+- 审计旁路检查：grep 没有发现 `tx.Exec(...)` 后绕过 `saveReceipt` 的旁路；
+  `policyWriteBatch` 接受的是一个闭包，闭包内未调用 `tx.Commit()`（commit 由 `policyWriteBatch` 唯一持有），
+  这确保 batch 写后必须走 `saveReceipt` 才能 commit 落盘。
+
+未发现绕过审计的写入。
+
+---
+
+## 7. 重点 5 —— 与 #228/#234 的关系
+
+#228（Add read-only role options, a member roster directory and a removed-member send refusal）
+
+引入：
+- `pkg/extension/RoleOption` / `RoleOptionsProvider.ListRoleOptions`（read-only enabled
+  role directory；走 `h.caps.st.ListRoles` 投影为 `roleId+name`）
+- `pkg/extension.AccountDirectoryPurposeProjectRoster`（project roster 枚举）
+- `internal/server/server.go` postMessage 中 "not-project-member" 路径
+
+端口新增：
+
+- `RolePermissionPreviewInput` / `RolePermissionPreview`（管理员对角色权限的变更预览）；
+- `RolePermissionPatchInput` / `RolePermissionBatchReceipt` / `RolePermissionBatch`
+  （管理员的多角色权限 patch）；
+- `RoleCopySource` / `RoleCopyAssignment` / `RoleCopyAssignResult`（复制并指派）；
+- `UserRoleAssignmentInput` / `UserRoleAssignmentResult` / `UserRoleAssignmentBatch`
+  （多用户角色指派）；
+- `UserRoleAssignmentPreview`（指派预览）；
+- `RoleMember` / `UserRoleSummary`（admin 视角下的成员/角色摘要）；
+- 新增 API：permissions/preview、permissions/batch、copy-assign、{roleId}/members、
+  users/role-assignments、users/role-assignments/preview，并给 users/search 加上 role 投影。
+
+没有发现重复或冲突：#228 的 `RoleOptionsProvider.ListRoleOptions` 仍是非 admin 派发面
+（"trust a trusted Host"，且"callers still authorize their own domain action"），
+本端口的 7 个 admin API 在 main 当前路由表里尚不存在；`GET /api/admin/roles/{roleId}/members`
+是 admin 视角的成员名册，没有触及 `AccountDirectoryPurposeProjectRoster` 的项目名册枚举。
+`UserRoleSummary` 是 store-side projection 类型，没有出现在 `pkg/extension/surface.txt` 新增
+位置上（不污染扩展面）—— 这一点有意的：内部 store 投影不应进入扩展契约。
+
+#234（Land the project access and lifecycle role and work-state work on Backend main）
+
+引入：
+
+- `internal/app/hostcaps.go` 中 `RoleAdminProvider`、`CreateRole/UpdateRole/DeleteRole/...`、
+  `ReplaceRolePermissions` 的派发 Host 实现（与 AdminProvider 一起）；catalog 测试
+  `TestCatalogLinkedActionsStayProjectScopedAndUnprotected` 与 `R2` 的角色模型断言。
+- `internal/authz/service.go` 的 system action 决策函数、`ExplainCapabilities` 投影；
+- `internal/server/project_lifecycle.go` 中 `projectWork` / `lifecycleHost`；
+- 测试 `internal/server/project_iam_integration_test.go`、`role_authorization_test.go`、
+  `roles_test.go`、`explain_test.go` 等。
+
+端口新加的项目 1:1 与 #234 项目没有重叠：
+
+- 不动 `RoleAdminProvider` / `RoleAdminView` schema（仍由既有 `RoleAdmin` 函数读出来）。
+- 不动 `AuthorizeSystem`、`ProjectCreateAction`、`ProjectAccessAction`、`ProjectCreateLinkedActions()`。
+- 不动 `lifecycleHost`、`projectWork`、`ExplainCapabilities`。
+- `TestCatalogLinkedActionsStayProjectScopedAndUnprotected` 添加的测试（catalog_test.go 末尾
+  的 +16 行）仅是个保险钉——验证 catalog 中的 linked 动作仍为 project-scope 且非受保护，
+  与本端口在 `normalizePermissionChanges` / `CreateRoleCopyAndAssign` 里加的限制条件一致。
+- 既有的 `TestRoleProjectCreateLinksFullManagement`、`TestReplaceRolePermissionsAcceptsOnlyProjectAccessBoolean`、
+  `TestCapabilityAssociationRejectsStaleVersionAndMissingRole` 等 R2 / R4 锚点测试没有被
+  改写、删除或弱化（详见 §8）。
+
+---
+
+## 8. 重点 6 —— 测试质量
+
+新测试（14 项，全部新增，未删/未跳过既有断言）：
+
+store 层（`internal/store/role_policy_test.go`）：
+
+- `TestPatchRolePermissionsBatchEnablesAndDisablesAcrossRoles`（happy，双 role 同步切换）
+- `TestPatchRolePermissionsBatchAtomicityRejectsWholeBatch`（一坏拒整批 + 验证两 role
+  维持原样 + epoch 不前进）
+- `TestPatchRolePermissionsBatchStaleVersion`（过期 version 拒整批 + role 维持原样）
+- `TestPatchRolePermissionsBatchRejectsLimitAndIdempotency`（20 上限、空批、同 key 重放返回
+  同一 receipt/epoch）
+- `TestPreviewRolePermissionsMatchesCommitResult`（预览允许/拒绝与 commit 一致）
+- `TestPreviewRolePermissionsRejectsInvalidBatchItem`（非法动作仅在 item 级别报错，不写盘）
+- `TestAssignUserRolesBatchRebindsInOneTransaction`（两人 rebind 在一个事务中，epoch+1 + 
+  同 key 重放 epoch 不变）
+- `TestAssignUserRolesBatchRejectsWholeBatch`（一个用户 state_version 过时 → 整批回滚
+  + 两角色 binding_id 与 state_version 未被改写）
+- `TestPreviewUserRoleAssignmentsJudgesEachItem`（三种 case：成功、state_version 过时、
+  用户不存在；预览不写盘不前进 epoch）
+- `TestListRoleMembersForActorRequiresGrantsAndPaginates`（admin 看见、ordinary 被拒）
+- `TestActiveRolesForUsersReturnsActiveBindings`（仅返回 active binding；结束后不再见）
+- `TestCreateRoleCopyAndAssignCreatesRoleAndBindsInOneTransaction`（happy：新 role +
+  绑定 + epoch+1）
+- `TestCreateRoleCopyAndAssignRejectsWithoutResidue`（覆盖坏 overrides / 坏 name / 坏
+  state version 三种；检查 epoch 未进、新 role 未落盘）
+
+server 层（`internal/server/role_authorization_test.go`）：
+
+- `TestRolePermissionPreviewRequiresPermissionViewOverHTTP`（403 with only `system.roles.view`；
+  200 with admin；未知 role 单 item 报 `角色不存在或已停用`；空 roles 列表 400）
+- `TestBatchRolePermissionPatchOverHTTP`（403 with `roles.view+roles.manage`；200 提交；
+  过时 version → 409；非法变更（含 `system.users.view`）→ 400）
+- `TestBatchRoleAssignmentPreviewAndCommitOverHTTP`（happy 路径：preview + commit）
+- `TestCopyAssignRoleOverHTTP`（happy 路径：源 role 启用 → copy → 用户绑定）
+- `TestRoleMembersFilterBeforePagingAndBindCursor`（admin 列出 + filter `query=alice&mode=exact`
+  仅留 alice）
+- `TestAccountSearchIncludesRoleProjection`（search 结果中含 role 投影含 roleID）
+
+测试覆盖到的关键断言：
+
+- 每个写 API 都验证了 "atomic"（整批失败回滚写零）
+- `replayReceipt` 的 "同 key + 同 hash → 同 receipt/epoch" 显式断言
+- `PatchRolePermissionsBatch` 验证过期 role_version 走 `ErrInvalidRolePolicy` 并（按 HTTP
+  层）映射到 409
+- 端口的 `TestRolePermissionsNormalizeLegacyRowsToProjectAccess`、`TestReplaceRolePermissionsAcceptsOnlyProjectAccessBoolean`、
+  `TestRolePolicyRejectsNonProjectAccessRowsAtomically`、`TestCapabilityAssociationRejectsStaleVersionAndMissingRole`、
+  `TestCapabilityAssociationImportRejectsLinkedConflict`、`TestLinkedCapabilitiesSystemGrantWithoutRoleClosesLoop`、
+  `TestRolePolicyProjectAccessFailsClosedForDisabledRoleOrAccount`、`TestRolePolicyIdempotencyKeyCannotChangeRequest`、
+  `TestImportRoleAuthorityPreservesStableIDsAndBindingsAtomically` —— 全部
+  **未改写、未删除、未弱化**。
+
+测试未被覆盖到的几个点（详见 §10 非阻塞建议）。
+
+---
+
+## 9. 阻塞项
+
+无。
+
+---
+
+## 10. 非阻塞建议（advice，不阻断合入）
+
+按"安全优先 → 可靠性 → 测试"排列：
+
+1. **[安全] `assignUserRolesBatch` 缺少"非 admin 调用被 403"的 HTTP 层负测**。
+   `TestBatchRolePermissionPatchOverHTTP` 与 `TestRolePermissionPreviewRequiresPermissionViewOverHTTP`
+   已经验证了"持有弱权限的 actor 拿不到 403"。`assignUserRolesBatch` 与 `previewUserRoleAssignments`
+   仅在 happy 路径上测过（`TestBatchRoleAssignmentPreviewAndCommitOverHTTP`）。
+   建议补一条"持有 `system.roles.view` 但无 `system.roles.assign` 的 actor 调用
+   `/api/admin/users/role-assignments` 收到 403"的测试。预期实现确实会拒绝
+   （`assignUserRolesBatch` 起手 `requireSystemAction("system.roles.assign")`），但缺少语义钉。
+
+2. **[安全] `copyAssignRole` 缺少 HTTP 层负测（任一闸不足被拒）**。
+   当前只有 happy path。建议补：
+   - 仅 `system.roles.manage` + `system.permissions.manage`，缺 `system.roles.assign` → 403；
+   - 仅 `system.permissions.manage` + `system.roles.assign`，缺 `system.roles.manage` → 403；
+   - 仅 `system.roles.manage` + `system.roles.assign`，缺 `system.permissions.manage` → 403。
+   三个闸同时持有的语义在生产代码中已写明，但测试未钉死。
+
+3. **[安全/一致性] `assignUserRolesBatch` 缺 user-missing/role-missing/role-disabled 的负测**。
+   `TestAssignUserRolesBatchRejectsWholeBatch` 仅覆盖 stale-state-version 一种失败模式。
+   store 层 `assignRolesTx` 通过 `roleAssignmentUserMissing` / `roleAssignmentUserDisabled` /
+   `roleAssignmentRoleInvalid` 区分三种原因（preview 路径已经分别测过这三种原因，
+   `TestPreviewUserRoleAssignmentsJudgesEachItem`），但 commit 路径没有显式锁定
+   "bad userId / disabled user / disabled role" 都会回滚。
+
+4. **[可靠性] PostgreSQL 下潜在的锁顺序风险**。
+   `assignRolesTx` / `CreateRoleCopyAndAssign` 内部对每个 item 调用
+   `s.roleTx(tx, item.RoleID, true)`，锁定顺序由 items 切片顺序决定。
+   与 `policyWriteBatch` 内部 `lockAccountUsers` 的字典序 owner 锁不同，role-row 锁顺序
+   没有全局规范化。当两个并发 batch 提交 items 涉及交叠 role 集合但顺序相反时，
+   可能出现 PG 层 `40P01 deadlock_detected`，客户端表现为 500（因为 writeStoreErr 对
+   deadlock 没特殊映射）。SQLite 不受影响。
+   建议（任一）：
+   (a) 批前按 `item.RoleID` 排序后再 `roleTx`，让所有 batch 走同一序；
+   (b) 在 writeStoreErr 中对 deadlock 检测加一条 `502/503` 提示;
+   (c) 把 SQL 锁与 `policyWriteBatch` 的 owner 锁合并成同一把 `pg_advisory_xact_lock`
+       key。在评估其工作量后再决定。
+   当前批大小（≤100）下并发风险不大，但应在 batch 大小被放大或 PG 高并发场景重新审视。
+
+5. **[测试] `ListRoleMembersForActor` 缺跨越多 role 测试**。
+   `TestListRoleMembersForActorRequiresGrantsAndPaginates` 只在单 role + active-vs-inactive
+   验证成员计数；没有测 "两个 role，actor 同时查询 role-A，结果只包含 role-A 成员"。
+
+6. **[风格] handler 层 `listRolePermissionPreview` 的 400 路径**。
+   当 `roles` 为空时，handler 直接 400；store 里 `len(items) == 0 || len(items) > maxRolePermissionPreviewItem`
+   也会返回 `ErrInvalidRolePolicy`。两处都在做相同的合法性检查。这是
+   #228/#234 现有 pattern 的一致沿用，但建议未来统一只用一处。
+
+7. **[风格] `previewUserRoleAssignments` 与 `listRoleMembers` 重复了 cursor 计算**。
+   两处都用 SHA256 over `{Kind, Actor, RoleID, Query, Mode, Status, Revision}` 派生
+   version；HMAC 用 `accountSearchKey` 派 cursor token。建议抽 `roleMembersVersion(actor, roleID, query, mode, status, revision)` helper
+   到 `account_search.go`，避免后续在 `copyAssignRole`、`batchPatchRolePermissions` 等
+   写入响应里再次手写。
+
+---
+
+## 11. 依据与实际只读命令结果（evidence）
+
+| 命令 | 输出摘要 / 关键引用 |
+|---|---|
+| `git status` → `HEAD detached at f10fb2e; nothing to commit, working tree clean` | 工作区干净；fix/iam-perm-ux-port HEAD = f10fb2e |
+| `git log --oneline 01f4c47a2b5..HEAD` | `f10fb2e` / `76abebe` / `2d1e5f5` —— 与 packet 一致（2 transport + task-start） |
+| `git diff 01f4c47a2b5..HEAD --stat` | 8 文件 / +2237 行（packet 标 "+2184" 视为合理近似口径差异） |
+| `git diff ... -- internal/server/server.go` | 新增 6 条 `mux.HandleFunc` 注册（行 323-328），全部位于既有 `/api/admin/roles` 与 `/api/admin/users` 区间内，无路由表破坏 |
+| `git diff ... -- internal/store/role_policy.go`（约 +1141 行） | 新增 `RolePermissionPreviewInput/Patch/Batch`/`UserRoleAssignmentInput/Batch/Preview`/`RoleCopy*/RoleMember/UserRoleSummary`/`policyWriteBatch`/`PreviewRolePermissions`/`PatchRolePermissionsBatch`/`CreateRoleCopyAndAssign`/`AssignUserRolesBatch`/`PreviewUserRoleAssignments`/`ListRoleMembersForActor`/`ActiveRolesForUsers` —— 全部以 `policyWriteBatch` 或显式 tx/actor 校验为入口 |
+| `git diff ... -- internal/server/roles.go` | 6 个 handler（`listRolePermissionPreview`/`batchPatchRolePermissions`/`decodeRoleAssignments`/`assignUserRolesBatch`/`previewUserRoleAssignments`/`copyAssignRole`） + `systemActionAllowed` 静默判定辅助 |
+| `git diff ... -- internal/server/account_search.go` | `searchAdminUsers` 追加 `system.roles.view` 守门 role 投影（`systemActionAllowed` 静默跳过路径）；新增 `listRoleMembers` handler（角色过滤 + 绑定 cursor）|
+| `git diff ... -- internal/store/role_policy_test.go` | +494 行：14 新测试覆盖 happy / 原子回滚 / 过期版本 / 幂等重放 / 上限 / preview 一次 item level / user-missing 等；既有测试零修改 |
+| `git diff ... -- internal/server/role_authorization_test.go` | +226 行：6 新 HTTP 测试，含 `403 with weaker grant`、`409 on stale version`、`400 on invalid action`；既有测试零修改 |
+| `git diff ... -- internal/authz/catalog/catalog_test.go` | +16 行：仅加 `TestCatalogLinkedActionsStayProjectScopedAndUnprotected`，未改既有 |
+| `grep requireSuperAdminTargetAccess internal/store/*.go` | 定义于 `super_admin.go:36`，被既有 `AssignUserRole`/`ReplaceSystemGrants` 与本次新增 `assignRolesTx`（*Batch 路径）/ `CreateRoleCopyAndAssign` 内的 `assignRolesTx` 调用 |
+| `grep roleGrantsAccountAdministrationTx internal/store/role_policy.go` | 定义 line 743；被既有 `AssignUserRole`/`replaceSystemGrantsTx` 与新增 `assignRolesTx` 调用 |
+| `grep requireRoleAuthorityWritableTx internal/store/role_policy.go` | 定义 line 245（`FOR UPDATE` of `role_authority_import_state`）；被既有 `CreateRole`/`PatchRole`/`ReplaceRolePermissions`/`AssignUserRole` 与新增 `PatchRolePermissionsBatch`/`AssignUserRolesBatch`/`CreateRoleCopyAndAssign` 调用 |
+| `grep policyWriteBatch internal/store/role_policy.go` | 定义 line 1620；与既有 `policyWrite`（line 181）同形态（owner 字典序锁 + tx + epoch + 闭包 + commit）|
+| `grep mux.HandleFunc internal/server/server.go` | 路由按既有 admin/role/user 区段插入 |
+| `grep saveReceipt internal/store/role_policy.go` | 三个 batch 入口都调用 `saveReceipt`；store 没有 tx.Commit() 之外的提交途径 |
+| `grep CREATE.*user_role_bindings internal/store/migrate.go` | line 1284 的 `CREATE UNIQUE INDEX uq_user_role_bindings_active ON user_role_bindings(user_id) WHERE active=TRUE` —— 强制单 active binding/user；`Update user_role_bindings SET active=0 ... WHERE active=1` 不会同时关错多行 |
+| 跳过 | `git submodule init/update`（packet 禁用）/ `git add/commit/push` / `git config` / `git stash` —— 全部未执行 |
+| 跳过 | `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_shell_pipe_hazard` —— packet 在 test 列表中给出该命令，但本仓库不存在 `tests/` 目录也不存在 `test_shell_pipe_hazard` 测试。该命令不可执行，与端口内容无关（疑为模板残留），已在"未验证"列出 |
+
+---
+
+## 12. 未验证（structural limits of detached-HEAD review-only session）
+
+按 packet 第 3 项要求"未验证的结论写明未验证"。下列条目不是结论本身的缺失，而是本会话
+无法跑通验证路径：
+
+1. **未跑 `go test ./...`**：deps 子模块 gitlink 在本 detached-HEAD 工作区中尚未初始化
+   （worktree 内 `deps/*/` 是空目录），且 packet 禁用 `git submodule init/update`，
+   所以 `go build ./...` 也无法走通。所有"编译通过性"和"测试通过性"的结论均以**静态
+   diff/源码对比**为依据，不以运行为依据。评审者**未亲眼见到测试 PASS 输出**。
+
+2. **未对源 feature 分支作交叉比对**：packet 注明 `feature/iam-perm-ux-backend` "唯一副本
+   已备份"，本工作区没有该分支 ref 也无任何 transport 元数据用于追溯。本评审**仅按 diff
+   与 main 既有语义做正向校验**，不与原 feature 分支逐行比对。
+
+3. **PG dialect 下不跑 `go test ./... -tags pg`**：同上。
+
+4. **`tests.test_shell_pipe_hazard` 不可执行**：模板命令，本仓无对应目录与模块，已注明。
+
+5. **未跑 `make precheck`**：packet 在 Dev 仓推进；本仓为子仓，"独立开发"路径见
+   PROJECT.md 但 precheck 归属于 Dev 仓，本审查会话不对其做运行。
+
+---
+
+## 13. 决定
+
+- `terminal_status`: `completed`（独立审查产出完毕，未改动任何非报告文件；非"BLOCKED"）
+- 审查者 ID：iam-perm-ux-port-independent-review
+- 提交建议：可合入 main（前提是 §10 中 (1)(2)(3) 三条负测在合入前补齐或与跟进任务
+  挂钩 —— 推荐补齐后再合，以避免 main 出现"缺少 admin-grant 校准测试"的退化窗口）
+
+— end of review —
@@ -0,0 +1,66 @@
+# <任务标题> 任务卡
+
+任务主记录：<Issue/PR 链接，或注明"本文件随 PR 描述维护">。
+状态：<进行中 / 待审核 / 已合入 / 已放弃>；owner：<填写>。
+
+## 基线与授权
+
+- 权威仓：<仓 URL 或逻辑 ID>；root_target：main；immediate_target：<main 或 feature/initiative>
+- branch_kind：<initiative | child | standalone>；initiative_id：<稳定 ID，普通任务为空>
+- R0（initial_main_sha）：<完整 SHA>；工作区：<路径>（worktree / clone）；分支：<feature|fix|hotfix/...>
+- 父任务信息（仅子任务填写）：parent_branch=<父分支>；parent_head_sha=<SHA>；parent_pr=<父 PR>
+- accepting_requirements：<true | false>（仅 initiative 可为 true；冻结后为 false）
+- 需求分流：verdict=<JOIN | NEW>；selected_initiative=<分支或无>；候选=<分支@HEAD 列表或无>；理由=<不适配/适配依据>；triage 收据=<源码外路径与摘要>
+- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+<预期结果、受影响入口/模块/契约；明确不做什么。>
+
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：<交付了什么；未发生写无>。
+- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。
+- 影响与剩余项：<影响面、遗留风险、后续任务>。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
@@ -0,0 +1,70 @@
+# Project Agent Execution Configuration
+# 项目工程 Agent 执行路由配置
+
+适用范围：定义本项目中由 AI / Agent 主导的代码实施、修复、测试与审阅所调用的 Agent CLI 路由。
+解析器识别正文中唯一一个 ```agent-execution 代码块。正文外的说明文字可根据项目需要调整。
+
+通用硬规则见 Development-Guidelines 的 [Agent 执行与协作契约](deps/development-guidelines/standards/agent-execution.md)。
+本配置为项目本地路由权威，声明具体的候选 profile、尝试次数上限、超时、集成入口与豁免路径；
+代码块须通过 `deps/development-guidelines/templates/schemas/agent-execution.schema.json` 校验后才能登记为 active。
+`fallback_to_host` 只能为 `never`；旧值 `all-unavailable` 仅供迁移工具读取，不能通过准入。
+下例的 CLI 名称、命令与路径均为占位，按项目实际执行器替换。
+
+```agent-execution
+schema: agent-execution/v1
+
+execution:
+  fresh_process_per_unit: true
+  permission: run-everything
+  fallback_to_host: never
+  max_parallel: 3
+  timeout_seconds: 7200
+  idle_timeout_seconds: 600
+  summary_bytes: 16384
+  raw_output_bytes: 10485760
+  max_attempts_per_profile: 3
+  emergency_profile: codex
+
+roles:
+  implementation: [cursor, antigravity, pi]
+  repair: [cursor, antigravity, pi]
+  test: [pi, antigravity, cursor]
+  review: [pi, antigravity, cursor, codex]
+
+profiles:
+  cursor:
+    adapter: cursor
+    executable: "cursor-agent-stable"
+    model: auto
+    # 2026-10-20 临时禁用：cursor 账本月配额耗尽（重置 2026-11-10），原因记录于
+    # Dev U3 任务卡；恢复时改回 enabled: true。
+    enabled: false
+
+  antigravity:
+    adapter: antigravity
+    executable: agy
+    model: auto
+    # 2026-10-20 临时禁用：Gemini 端点连续 3 次在最终流式响应 EOF（长会话不稳定），恢复时改回 enabled: true。
+    enabled: false
+
+  pi:
+    adapter: pi
+    executable: pi
+    model: auto
+    enabled: true
+
+  codex:
+    adapter: codex
+    executable: codex
+    model: auto
+    enabled: true
+
+integration:
+  exempt_paths: [".task/**", "docs/superpowers/specs/**", "docs/superpowers/plans/**"]
+  transport:
+    command: "scripts/agent-exec apply"
+  admission:
+    command: "scripts/agent-exec admit"
+  cleanup:
+    command: "scripts/agent-exec cleanup"
+```
@@ -34,3 +34,21 @@
 - **SSH key**：`~/.ssh/home_gitea`（ED25519，公钥指纹
  `SHA256:GYXaOXIMeloQ1fKSfdJ/ndgPQzs/Ix7Hk62ekfkfQ20`，Gitea 侧密钥名 GMKtec）；
  `~/.ssh/config` 已有 `git-ssh.u1680832.nyat.app` 主机条目，克隆/推送直接可用。
+
+## Agent 执行与新项目准入（强制）
+
+1. 缺 Guidelines 固定版本（`deps/development-guidelines` gitlink 未就绪或 HEAD 不符）时，Agent 只能只读分析，不得实施。
+2. 缺有效 `AGENT-EXECUTION.md`（`scripts/dm governance check` 未通过）时禁止 AI 实施。
+3. 缺共享执行器（`scripts/agent-exec` 或 `deps/development-manager` 不可用）时，状态为 `blocked/unavailable`，不得改由 host 替代。
+4. 不允许 host 代写实施单元；实施、修复与测试必须经 `AGENT-EXECUTION.md` 登记的候选执行。
+5. 人类直接开发按其自身授权与项目规则进行，不受本条款约束。
+6. 分支保护与规范 tag 由用户负责设置与维护，Agent 不得代为设置。
+
+入口：
+
+- 需求分流：`scripts/task triage discover|decide|verify`
+- 任务启动：`scripts/task start …`
+- PR 检查：`scripts/task pr-check …`
+- Agent 执行：`scripts/agent-exec run|apply|admit|validate`
+
+AI 实施单元仅通过 `scripts/agent-exec run` 运行（见 AGENT-EXECUTION.md），其结果经 `scripts/agent-exec apply` 集成。
@@ -9,6 +9,8 @@

 - `go test ./...` — 单元 + 端到端（mock runner 全链路：流式/折叠部件/HITL 三分支/子代理任务树/工件/上传解析/中文检索/SSE 在线与重放/命令路由/插件装卸 fail-closed）。
 - `CGO_ENABLED=0 go build ./cmd/agent-system` — 单二进制（静态，内嵌前端后）。
+- `scripts/agent-exec validate --repo .` — 校验 AGENT-EXECUTION.md 执行路由配置。
+- `scripts/dm governance check --repo .` — 只读核验治理文件与 gitlink（CI：.gitea/workflows/governance.yml）。
 - 存储：嵌入式 SQLite（modernc.org/sqlite，纯 Go）；FTS5 全文 + CJK LIKE 兜底。
 - 依赖：agent-system-core（deps submodule + replace）、agent-native（runtime/llm 复用）。

@@ -0,0 +1,89 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+)
+
+func runCapabilities(args []string) int {
+	fs := flag.NewFlagSet("capabilities", flag.ExitOnError)
+	asJSON := fs.Bool("json", false, "以 JSON 打印能力，不打开数据库")
+	_ = fs.Parse(args)
+	caps := map[string]any{
+		"accountTransaction": true,
+		"accountAudit":       true,
+		"accountOpsOpen":     true,
+		"passwordStdin":      true,
+		"dsnFile":            true,
+		"outFile":            true,
+	}
+	if !*asJSON {
+		fmt.Fprintln(os.Stderr, "用法：agent-system capabilities --json")
+		return 2
+	}
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(caps); err != nil {
+		fmt.Fprintln(os.Stderr, "capabilities:", err)
+		return 1
+	}
+	return 0
+}
+
+func resolveAccountDSN(flagDSN, dsnFile string) (string, error) {
+	if flagDSN != "" {
+		fmt.Fprintln(os.Stderr, "warning: --dsn is deprecated; use AGENT_SYSTEM_DSN or --dsn-file")
+	}
+	if dsnFile != "" {
+		info, err := os.Stat(dsnFile)
+		if err != nil {
+			return "", err
+		}
+		if info.Mode().Perm() != 0o600 {
+			return "", fmt.Errorf("dsn file %s must be mode 0600", dsnFile)
+		}
+		raw, err := os.ReadFile(dsnFile)
+		if err != nil {
+			return "", err
+		}
+		return string(trimNewline(raw)), nil
+	}
+	if env := os.Getenv("AGENT_SYSTEM_DSN"); env != "" {
+		return env, nil
+	}
+	return flagDSN, nil
+}
+
+func resolveAccountPassword(flagPassword string, fromStdin bool) (string, error) {
+	if flagPassword != "" {
+		fmt.Fprintln(os.Stderr, "warning: --password is deprecated; use --password-stdin")
+	}
+	if !fromStdin {
+		return flagPassword, nil
+	}
+	raw, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		return "", err
+	}
+	return string(trimNewline(raw)), nil
+}
+
+func writeExclusiveSecret(path, body string) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, err = io.WriteString(f, body+"\n")
+	return err
+}
+
+func trimNewline(raw []byte) []byte {
+	for len(raw) > 0 && (raw[len(raw)-1] == '\n' || raw[len(raw)-1] == '\r') {
+		raw = raw[:len(raw)-1]
+	}
+	return raw
+}
@@ -0,0 +1,156 @@
+package main
+
+import (
+	"agent-system-backend/internal/store"
+	"bytes"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+func accountCLI(t *testing.T, args ...string) (int, string) {
+	t.Helper()
+	out, err := os.CreateTemp(t.TempDir(), "capture-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer out.Close()
+	oldOut, oldErr := os.Stdout, os.Stderr
+	os.Stdout = out
+	os.Stderr = out
+	defer func() { os.Stdout = oldOut; os.Stderr = oldErr }()
+	rc := runUser(args)
+	out.Seek(0, 0)
+	raw, err := io.ReadAll(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rc, string(raw)
+}
+func cliStore(t *testing.T) (string, *store.Store) {
+	t.Helper()
+	t.Setenv("AGENT_SYSTEM_DSN", "")
+	dir := t.TempDir()
+	s, e := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if e != nil {
+		t.Fatal(e)
+	}
+	t.Cleanup(func() { s.Close() })
+	if e := s.EnsureSystemIdentity("fixture", "sqlite"); e != nil {
+		t.Fatal(e)
+	}
+	return dir, s
+}
+func TestCreateAndInitializeAccountDoNotRequireCredentialOutput(t *testing.T) {
+	for _, sub := range []string{"create", "initialize-account"} {
+		t.Run(sub, func(t *testing.T) {
+			dir, s := cliStore(t)
+			if _, e := s.BootstrapFirstAdminWrite(store.AccountWrite{Owner: "root", Name: "Root", Actor: "test"}); e != nil {
+				t.Fatal(e)
+			}
+			args := []string{sub, "--data", dir, "--owner", "ada"}
+			if sub == "initialize-account" {
+				a, e := s.CreatePendingAccount("root", "ada", store.AccountProfile{Name: "Ada"})
+				if e != nil {
+					t.Fatal(e)
+				}
+				args = append(args, "--user-id", a.ID, "--expected-state-version", "1", "--expected-generation", "0")
+			}
+			rc, _ := accountCLI(t, args...)
+			if rc != 0 {
+				t.Fatalf("command failed without credential output file: %d", rc)
+			}
+		})
+	}
+}
+func TestExistingOutputAndConflictingFormatsRefuseBeforeMutation(t *testing.T) {
+	for _, kind := range []string{"existing", "conflicting"} {
+		t.Run(kind, func(t *testing.T) {
+			dir, s := cliStore(t)
+			out := filepath.Join(t.TempDir(), "secret")
+			args := []string{"create", "--data", dir, "--owner", "ada", "--out-file", out}
+			if kind == "existing" {
+				if e := os.WriteFile(out, []byte("existing"), 0600); e != nil {
+					t.Fatal(e)
+				}
+			} else {
+				args = append(args, "--out", filepath.Join(t.TempDir(), "json-secret"))
+			}
+			rc, _ := accountCLI(t, args...)
+			if rc == 0 {
+				t.Fatal("unsafe output selection succeeded")
+			}
+			if _, e := s.GetUser("ada"); e == nil {
+				t.Fatal("output refusal happened after account mutation")
+			}
+		})
+	}
+}
+
+func TestAPIKeyCreateUsesExclusivePrivateOutput(t *testing.T) {
+	if dir := os.Getenv("U7_APIKEY_CHILD_DIR"); dir != "" {
+		rc := runAPIKey([]string{"create", "--data", dir, "--owner", "ada", "--name", "fixture", "--out-file", os.Getenv("U7_APIKEY_CHILD_OUT")})
+		if rc != 0 {
+			t.Fatal("apikey create rejected its private output destination")
+		}
+		return
+	}
+	for _, existing := range []bool{false, true} {
+		name := "new"
+		if existing {
+			name = "existing"
+		}
+		t.Run(name, func(t *testing.T) {
+			dir, st := cliStore(t)
+			if err := st.CreateAccount("ada", "Ada", "", false); err != nil {
+				t.Fatal(err)
+			}
+			out := filepath.Join(t.TempDir(), "credential")
+			if existing {
+				if err := os.WriteFile(out, []byte("preserve"), 0600); err != nil {
+					t.Fatal(err)
+				}
+			}
+			cmd := exec.Command(os.Args[0], "-test.run=^TestAPIKeyCreateUsesExclusivePrivateOutput$")
+			cmd.Env = append(os.Environ(), "U7_APIKEY_CHILD_DIR="+dir, "U7_APIKEY_CHILD_OUT="+out)
+			var stdout, stderr bytes.Buffer
+			cmd.Stdout = &stdout
+			cmd.Stderr = &stderr
+			err := cmd.Run()
+			if existing {
+				if err == nil {
+					t.Fatal("existing output was overwritten or mutation succeeded")
+				}
+				raw, readErr := os.ReadFile(out)
+				if readErr != nil || string(raw) != "preserve" {
+					t.Fatal("existing output was modified")
+				}
+				keys, listErr := st.ListAPIKeys("ada")
+				if listErr != nil || len(keys) != 0 {
+					t.Fatal("mutation happened before output preflight")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal("new private output was rejected")
+			}
+			info, statErr := os.Stat(out)
+			if statErr != nil || info.Mode().Perm() != 0600 {
+				t.Fatal("credential output missing or not private")
+			}
+			raw, readErr := os.ReadFile(out)
+			if readErr != nil || len(raw) == 0 {
+				t.Fatal("credential output empty")
+			}
+			if bytes.Contains(stdout.Bytes(), bytes.TrimSpace(raw)) {
+				t.Fatal("credential was written to stdout")
+			}
+			keys, listErr := st.ListAPIKeys("ada")
+			if listErr != nil || len(keys) != 1 {
+				t.Fatal("successful issue was not committed")
+			}
+		})
+	}
+}
@@ -0,0 +1,150 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"agent-system-backend/internal/execenv"
+)
+
+func runEnv(args []string) int {
+	if len(args) == 0 {
+		fmt.Fprintln(os.Stderr, "用法：agent-system env <ensure|lock|gc|doctor|rebase|python> --root <dir>")
+		return 2
+	}
+	sub := args[0]
+	fs := flag.NewFlagSet("env "+sub, flag.ExitOnError)
+	rootPath := fs.String("root", "", "环境根目录")
+	ttl := fs.Duration("ttl", 7*24*time.Hour, "gc 保留窗口")
+	bin := fs.String("bin", "", "python link 要指向的解释器")
+	_ = fs.Parse(args[1:])
+	if *rootPath == "" {
+		fmt.Fprintln(os.Stderr, "env: --root 必填")
+		return 2
+	}
+	root, err := execenv.Open(*rootPath)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "env:", err)
+		return 1
+	}
+	ctx := context.Background()
+	switch sub {
+	case "ensure":
+		py, err := root.EnsurePython(ctx)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env ensure:", err)
+			return 1
+		}
+		id, err := execenv.NewBroker(root, nil, execenv.Pip{Python: py}).EnsureBase(ctx)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env ensure:", err)
+			return 1
+		}
+		fmt.Println(id)
+		return runDoctor(ctx, root, py, true)
+	case "lock":
+		id, err := root.CurrentBase()
+		if err != nil || id == "" {
+			fmt.Fprintln(os.Stderr, "env lock: 没有 current 基础层")
+			return 1
+		}
+		lock, err := root.ReadLock(id)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env lock:", err)
+			return 1
+		}
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		if err := enc.Encode(lock); err != nil {
+			fmt.Fprintln(os.Stderr, "env lock:", err)
+			return 1
+		}
+		return 0
+	case "gc":
+		removed, err := execenv.NewBroker(root, nil, execenv.Pip{}).GC(*ttl)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env gc:", err)
+			return 1
+		}
+		for _, id := range removed {
+			fmt.Println(id)
+		}
+		return 0
+	case "doctor":
+		py, ok := root.PythonBin()
+		if !ok {
+			py = "/usr/bin/python3"
+		}
+		return runDoctor(ctx, root, py, true)
+	case "rebase":
+		py, err := root.EnsurePython(ctx)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env rebase:", err)
+			return 1
+		}
+		id, err := execenv.NewBroker(root, nil, execenv.Pip{Python: py}).Rebase(ctx)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "env rebase:", err)
+			return 1
+		}
+		fmt.Println(id)
+		return 0
+	case "python":
+		action := "install"
+		if fs.NArg() > 0 {
+			action = fs.Arg(0)
+		}
+		switch action {
+		case "install":
+			py, err := root.EnsurePython(ctx)
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "env python:", err)
+				return 1
+			}
+			fmt.Println(py)
+			return 0
+		case "link":
+			if *bin == "" {
+				fmt.Fprintln(os.Stderr, "env python link: --bin 必填")
+				return 2
+			}
+			if err := root.LinkPython(*bin); err != nil {
+				fmt.Fprintln(os.Stderr, "env python link:", err)
+				return 1
+			}
+			fmt.Println(*bin)
+			return 0
+		default:
+			fmt.Fprintln(os.Stderr, "env python: install | link")
+			return 2
+		}
+	default:
+		fmt.Fprintf(os.Stderr, "env: 未知动作 %s\n", sub)
+		return 2
+	}
+}
+
+func runDoctor(ctx context.Context, root *execenv.Root, py string, sandbox bool) int {
+	var pyPath []string
+	if id, err := root.CurrentBase(); err == nil && id != "" {
+		pyPath = append(pyPath, root.LayerDir(id))
+	}
+	mounts := append([]string{}, pyPath...)
+	if prefix := root.PythonPrefix(); prefix != "" {
+		mounts = append(mounts, prefix)
+	}
+	if resolved, err := filepath.EvalSymlinks(py); err == nil {
+		py = resolved
+	}
+	if err := execenv.Doctor(ctx, py, pyPath, nil, sandbox, mounts); err != nil {
+		fmt.Fprintln(os.Stderr, "env doctor:", err)
+		return 1
+	}
+	fmt.Println("doctor ok")
+	return 0
+}
@@ -10,11 +10,11 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"time"

 	"agent-system-backend/internal/app"
 	"agent-system-backend/internal/config"
 	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
 	"agent-system-backend/pkg/identity"
 )

@@ -43,9 +43,15 @@ func main() {
 			os.Exit(runUser(os.Args[2:]))
 		case "identity":
 			os.Exit(runIdentity(os.Args[2:]))
+		case "capabilities":
+			os.Exit(runCapabilities(os.Args[2:]))
+		case "env":
+			os.Exit(runEnv(os.Args[2:]))
+		case "migrate":
+			os.Exit(runMigrate(os.Args[2:]))
 		default:
 			fmt.Fprintf(os.Stderr, "agent-system: 未知子命令 %s\n", os.Args[1])
-			fmt.Fprintln(os.Stderr, "用法：agent-system <serve|version|identity|user|apikey|config> [参数]")
+			fmt.Fprintln(os.Stderr, "用法：agent-system <serve|version|identity|user|apikey|config|capabilities|env|migrate> [参数]")
 			os.Exit(2)
 		}
 	}
@@ -65,20 +71,37 @@ func main() {
 	execBackend := fs.String("exec-backend", "", "执行后端：direct（默认，现状直启）| sandbox（bwrap 隔离档：断网、只读系统根、仅会话目录可写、进程数限额）")
 	execDepsDir := fs.String("exec-deps-dir", "", "sandbox 档只读依赖层目录（site-packages 等；空=不挂载）")
 	execWorkspace := fs.String("exec-workspace", "", "sandbox 档工作区模式：空=直写会话目录 | overlay=冻结基底+私有 upper+CAS 回收（S0）")
+	execEnvRoot := fs.String("exec-env-root", "", "分层 Python 环境根（解释器、基础层、扩展层；空=不启用）")
 	tier := fs.String("tier", "", "部署档：空=auto（DSN→PG，否则 SQLite）| local（SQLite，不允许 DSN）| team（PG fail-closed：缺 DSN/未认证拒绝启动，PG 故障拒绝就绪）")
 	pgMaxOpen := fs.Int("pg-max-open", 0, "PG 最大打开连接（0=默认 16）")
 	pgMaxIdle := fs.Int("pg-max-idle", 0, "PG 最大空闲连接（0=默认 8）")
 	pgIdleSec := fs.Int("pg-conn-max-idle-sec", 0, "PG 空闲连接回收秒数（0=默认 300）")
 	pgLifetimeSec := fs.Int("pg-conn-max-lifetime-sec", 0, "PG 连接最长生命周期秒数（0=不限）")
 	pgQueryTimeoutSec := fs.Int("pg-query-timeout-sec", 0, "PG statement_timeout 秒数（0=不限；覆盖全部业务查询）")
+	adoptGuard := fs.Bool("adopt-instance-guard", false, "数据库被替换或锁文件被重建后，显式重写 SQLite 活动服务守卫")
+	envFile := fs.String("env-file", "", "受保护 dotenv 文件（权限 600；补齐进程环境未设置的 SUPER_ADMIN_OWNER/SUPER_ADMIN_PASSWORD；空 = 取 AGENT_SYSTEM_ENV_FILE）")
+	extension.RegisterCLIFlags(fs)
 	fs.Parse(os.Args[1:])
+	handled, hookErr := extension.RunCLIHooks(extension.Options{
+		Addr: *addr, DataDir: *data, PluginsDir: *pluginsDir, Mock: *mock,
+		StorageDSN: *dsn, AuthMode: *auth, DisableExecTools: *noExec, ExecBackend: *execBackend,
+	})
+	if hookErr != nil {
+		fmt.Fprintln(os.Stderr, "agent-system:", hookErr)
+		os.Exit(1)
+	}
+	if handled {
+		return
+	}
 	cliSet := visited(fs)
+	delete(cliSet, "adopt-instance-guard")
+	delete(cliSet, "env-file")

 	resolved, err := config.Load(*cfgFile, os.LookupEnv, config.Config{
 		Addr: *addr, DataDir: *data, PluginsDir: *pluginsDir, Mock: *mock,
 		StorageDSN: *dsn, ArtifactsDir: *artifacts, AuthMode: *auth, Instance: *instance,
 		InsecureListen: *insecure, AllowedHostsRaw: *allowedHosts, DisableExecTools: *noExec,
-		ExecBackend: *execBackend, ExecDepsDir: *execDepsDir, ExecWorkspace: *execWorkspace,
+		ExecBackend: *execBackend, ExecDepsDir: *execDepsDir, ExecWorkspace: *execWorkspace, ExecEnvRoot: *execEnvRoot,
 		Tier: *tier, PGMaxOpen: *pgMaxOpen, PGMaxIdle: *pgMaxIdle,
 		PGConnMaxIdleSec: *pgIdleSec, PGConnMaxLifetimeSec: *pgLifetimeSec, PGQueryTimeoutSec: *pgQueryTimeoutSec,
 	}, cliSet)
@@ -92,13 +115,48 @@ func main() {
 		}
 		os.Exit(1)
 	}
+	superAdmin, err := config.LoadSuperAdmin(os.LookupEnv, *envFile, resolved.AuthEnabled())
+	if err == nil {
+		err = app.ValidateSuperAdmin(resolved.AuthEnabled(), superAdmin)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "agent-system:", err)
+		os.Exit(1)
+	}
+	pluginDefaults, merr := extension.MergeHostOptions(extension.Options{})
+	if merr != nil {
+		fmt.Fprintln(os.Stderr, "agent-system:", merr)
+		os.Exit(1)
+	}
+	disableExec := resolved.DisableExecTools
+	if !cliSet["disableExecTools"] {
+		disableExec = disableExec || pluginDefaults.DisableExecTools
+	}
+	execBackendResolved := resolved.ExecBackend
+	if !cliSet["execBackend"] && execBackendResolved == "" {
+		execBackendResolved = pluginDefaults.ExecBackend
+	}
+	extOpt := extension.Options{
+		Addr: resolved.Addr, DataDir: resolved.DataDir, PluginsDir: resolved.PluginsDir,
+		DisableUploadIndexing: pluginDefaults.DisableUploadIndexing,
+		DisableConvCardMirror: pluginDefaults.DisableConvCardMirror,
+		DisableExecTools:      disableExec, ExecBackend: execBackendResolved,
+	}
+	if err := extension.PrepareCompiled(&extOpt); err != nil {
+		fmt.Fprintln(os.Stderr, "agent-system:", err)
+		os.Exit(1)
+	}
 	if err := app.Run(app.Options{
 		Addr: resolved.Addr, DataDir: resolved.DataDir, PluginsDir: resolved.PluginsDir, ForceMock: resolved.Mock,
 		StorageDSN: resolved.StorageDSN, ArtifactsDir: resolved.ArtifactsDir, AuthMode: resolved.AuthMode,
 		InstanceID: resolved.Instance, InsecureListen: resolved.InsecureListen, AllowedHosts: resolved.AllowedHosts(),
-		DisableExecTools: resolved.DisableExecTools, ExecBackend: resolved.ExecBackend, ExecDepsDir: resolved.ExecDepsDir,
-		ExecWorkspace: resolved.ExecWorkspace,
-		Tier:          resolved.Tier,
+		DisableUploadIndexing: extOpt.DisableUploadIndexing,
+		DisableConvCardMirror: extOpt.DisableConvCardMirror,
+		DisableExecTools:      extOpt.DisableExecTools, ExecBackend: extOpt.ExecBackend, ExecDepsDir: resolved.ExecDepsDir,
+		ExecWorkspace: resolved.ExecWorkspace, ExecEnvRoot: resolved.ExecEnvRoot,
+		Tier:               resolved.Tier,
+		AdoptInstanceGuard: *adoptGuard,
+		SuperAdmin:         superAdmin,
 		PGPool: store.PoolOptions{
 			MaxOpenConn: resolved.PGMaxOpen, MaxIdleConn: resolved.PGMaxIdle,
 			ConnMaxIdleTimeSec: resolved.PGConnMaxIdleSec, ConnMaxLifetimeSec: resolved.PGConnMaxLifetimeSec,
@@ -122,6 +180,14 @@ func visited(fs *flag.FlagSet) map[string]bool {
 			name = "allowedHosts"
 		case "disable-exec-tools":
 			name = "disableExecTools"
+		case "exec-backend":
+			name = "execBackend"
+		case "exec-deps-dir":
+			name = "execDepsDir"
+		case "exec-workspace":
+			name = "execWorkspace"
+		case "exec-env-root":
+			name = "execEnvRoot"
 		case "pg-max-open":
 			name = "pgMaxOpen"
 		case "pg-max-idle":
@@ -160,6 +226,7 @@ func runConfig(args []string) int {
 	execBackend := fs.String("exec-backend", "", "")
 	execDepsDir := fs.String("exec-deps-dir", "", "")
 	execWorkspace := fs.String("exec-workspace", "", "")
+	execEnvRoot := fs.String("exec-env-root", "", "")
 	tier := fs.String("tier", "", "")
 	pgMaxOpen := fs.Int("pg-max-open", 0, "")
 	pgMaxIdle := fs.Int("pg-max-idle", 0, "")
@@ -171,7 +238,7 @@ func runConfig(args []string) int {
 		Addr: *addr, DataDir: *data, PluginsDir: *pluginsDir, Mock: *mock,
 		StorageDSN: *dsn, ArtifactsDir: *artifacts, AuthMode: *auth, Instance: *instance,
 		InsecureListen: *insecure, AllowedHostsRaw: *allowedHosts, DisableExecTools: *noExec,
-		ExecBackend: *execBackend, ExecDepsDir: *execDepsDir, ExecWorkspace: *execWorkspace,
+		ExecBackend: *execBackend, ExecDepsDir: *execDepsDir, ExecWorkspace: *execWorkspace, ExecEnvRoot: *execEnvRoot,
 		Tier: *tier, PGMaxOpen: *pgMaxOpen, PGMaxIdle: *pgMaxIdle,
 		PGConnMaxIdleSec: *pgIdleSec, PGConnMaxLifetimeSec: *pgLifetimeSec, PGQueryTimeoutSec: *pgQueryTimeoutSec,
 	}, visited(fs))
@@ -194,22 +261,47 @@ func runAPIKey(args []string) int {
 	fs := flag.NewFlagSet("apikey "+sub, flag.ExitOnError)
 	data := fs.String("data", "./data", "数据目录")
 	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式档）")
+	dsnFile := fs.String("dsn-file", "", "0600权限的PostgreSQL DSN文件")
 	owner := fs.String("owner", "", "租户名（owner）")
 	name := fs.String("name", "default", "密钥名称")
+	outFile := fs.String("out-file", "", "把明文密钥独占写入该文件（0600）")
 	fs.Parse(args[1:])
 	if *owner == "" {
 		fmt.Fprintln(os.Stderr, "apikey: --owner 必填")
 		return 2
 	}
+	if sub != "create" && *outFile != "" {
+		fmt.Fprintln(os.Stderr, "apikey: 此子命令不生成密钥")
+		return 2
+	}
+	resolvedDSN, err := resolveAccountDSN(*dsn, *dsnFile)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "apikey:", err)
+		return 1
+	}
+	*dsn = resolvedDSN
 	switch sub {
 	case "create":
+		delivery, err := reserveCredentialOutput(*outFile, "")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "apikey create:", err)
+			return 1
+		}
+		defer delivery.abort()
 		key, err := app.CreateAPIKey(*dsn, *data, *owner, *name)
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "apikey create:", err)
 			return 1
 		}
 		// 明文仅此一次输出；库中只存 SHA-256 摘要。
-		fmt.Println(key)
+		if delivery.file == nil {
+			fmt.Println(key) // Existing API-key CLI compatibility; owner grants require a file.
+			return 0
+		}
+		if err := delivery.deliver("api-key", *owner, key, nil); err != nil {
+			fmt.Fprintln(os.Stderr, "apikey create:", err)
+			return 1
+		}
 		return 0
 	case "list":
 		keys, err := app.ListAPIKeys(*dsn, *data, *owner)
@@ -238,12 +330,11 @@ func runAPIKey(args []string) int {
 	}
 }

-// deliverCredential 凭据单次交付（KTD14）：--out 时写 0600 JSON 文件，stdout 只报
-// 属主/用途/文件路径不含明文；缺省沿用 stdout 一次输出。文件含 expiresAt 便于交接。
+// deliverCredential writes only to a new private file. The secret never goes
+// to stdout or an existing path; a JSON payload may include expiresAt.
 func deliverCredential(outPath, kind, owner, plaintext string, expiresAt any) error {
 	if outPath == "" {
-		fmt.Println(plaintext)
-		return nil
+		return fmt.Errorf("protected credential delivery path required")
 	}
 	payload := map[string]any{"kind": kind, "owner": owner, "secret": plaintext}
 	if expiresAt != nil {
@@ -253,37 +344,162 @@ func deliverCredential(outPath, kind, owner, plaintext string, expiresAt any) er
 	if err != nil {
 		return err
 	}
-	if err := os.WriteFile(outPath, buf, 0o600); err != nil {
+	if err := writeExclusiveSecret(outPath, string(buf)); err != nil {
 		return err
 	}
 	fmt.Fprintf(os.Stderr, "凭据已写入 %s（0600，仅此一次生成；勿入库勿入日志）\n", outPath)
 	return nil
 }

-// runUser：create / reset-password / list / issue-login-key / revoke-login-key / bootstrap-admin。
-// 默认 create 无初始密码并签发激活 Key；--generate-password 兼容旧随机密码路径。
+type credentialOutput struct {
+	path    string
+	file    *os.File
+	json    bool
+	mutated bool
+}
+
+// Reserve the destination before changing the account. O_EXCL also rejects an
+// existing symlink, so an existing secret can never be overwritten.
+func reserveCredentialOutput(rawPath, jsonPath string) (*credentialOutput, error) {
+	if rawPath != "" && jsonPath != "" {
+		return nil, fmt.Errorf("--out and --out-file are mutually exclusive")
+	}
+	out := &credentialOutput{}
+	out.path, out.json = rawPath, false
+	if jsonPath != "" {
+		out.path, out.json = jsonPath, true
+	}
+	if out.path == "" {
+		return out, nil
+	}
+	f, err := os.OpenFile(out.path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	out.file = f
+	return out, nil
+}
+
+func (out *credentialOutput) abort() {
+	if out == nil || out.file == nil {
+		return
+	}
+	info, err := out.file.Stat()
+	_ = out.file.Close()
+	if out.mutated || err != nil {
+		return
+	}
+	pathInfo, pathErr := os.Stat(out.path)
+	if pathErr == nil && os.SameFile(info, pathInfo) {
+		_ = os.Remove(out.path)
+	}
+}
+
+func (out *credentialOutput) deliver(kind, owner, plaintext string, expiresAt any) error {
+	if out.file == nil {
+		return fmt.Errorf("protected credential delivery path required")
+	}
+	out.mutated = true // Keep the private recovery artifact if delivery fails after DB commit.
+	var body []byte
+	if out.json {
+		payload := map[string]any{"kind": kind, "owner": owner, "secret": plaintext}
+		if expiresAt != nil {
+			payload["expiresAt"] = expiresAt
+		}
+		var err error
+		body, err = json.MarshalIndent(payload, "", "  ")
+		if err != nil {
+			return err
+		}
+	} else {
+		body = []byte(plaintext)
+	}
+	body = append(body, '\n')
+	if _, err := out.file.Write(body); err != nil {
+		return err
+	}
+	if err := out.file.Sync(); err != nil {
+		return err
+	}
+	if err := out.file.Close(); err != nil {
+		return err
+	}
+	out.file = nil
+	fmt.Fprintf(os.Stderr, "凭据已写入 %s（0600，仅此一次生成；勿入库勿入日志）\n", out.path)
+	return nil
+}
+
+// runUser：本地 owner 账号初始化、续办和只读／撤销操作。
 func runUser(args []string) int {
 	if len(args) == 0 {
-		fmt.Fprintln(os.Stderr, "用法：agent-system user <create|reset-password|list|issue-login-key|revoke-login-key|bootstrap-admin> [flags]")
+		fmt.Fprintln(os.Stderr, "用法：agent-system user <create|initialize-account|list|revoke-login-key> [flags]")
 		return 2
 	}
 	sub := args[0]
 	fs := flag.NewFlagSet("user "+sub, flag.ExitOnError)
 	data := fs.String("data", "./data", "数据目录")
-	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式档）")
+	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式档；已弃用，优先 AGENT_SYSTEM_DSN 或 --dsn-file）")
+	dsnFile := fs.String("dsn-file", "", "0600 权限的 DSN 文件")
 	owner := fs.String("owner", "", "用户名（owner）")
+	userID := fs.String("user-id", "", "待初始化账号稳定ID")
+	expectedStateVersion := fs.Int64("expected-state-version", 0, "待初始化账号状态版本")
+	expectedGeneration := fs.Int64("expected-generation", -1, "待初始化账号代数")
 	name := fs.String("name", "", "显示名")
-	password := fs.String("password", "", "密码（create 空=激活 Key；加 --generate-password 则随机）")
-	admin := fs.Bool("admin", false, "管理员")
-	role := fs.String("role", "user", "角色 user|admin")
-	openExisting := fs.Bool("open-existing", false, "只打开既有存储")
-	generatePassword := fs.Bool("generate-password", false, "create 时生成随机初始密码")
-	purpose := fs.String("purpose", "recover", "issue-login-key：activate|recover")
-	ttlMin := fs.Int("ttl-minutes", 30, "登录 Key 有效分钟（5–120）")
-	revokeAll := fs.Bool("revoke-all-credentials", false, "签发时撤销全部长期 API Key 与会话")
+	password := fs.String("password", "", "密码（已弃用；请用 --password-stdin）")
+	passwordStdin := fs.Bool("password-stdin", false, "从 stdin 读取密码")
+	outFile := fs.String("out-file", "", "凭据交付文件（仅历史兼容子命令可用）")
+	instanceID := fs.String("instance-id", "", "严格核验库内服务身份")
+	admin := fs.Bool("admin", false, "管理员（现已拒绝：仅超级管理员可在服务端任命管理员）")
+	role := fs.String("role", "user", "角色 user|admin（admin 现已拒绝）")
+	openExisting := fs.Bool("open-existing", false, "兼容旧参数；账户命令始终只打开既有存储")
+	generatePassword := fs.Bool("generate-password", false, "旧随机初始密码参数（现已拒绝）")
+	fs.String("purpose", "recover", "旧 issue-login-key 参数（现已拒绝）")
+	fs.Int("ttl-minutes", 30, "旧 issue-login-key 参数（现已拒绝）")
+	fs.Bool("revoke-all-credentials", false, "旧 issue-login-key 参数（现已拒绝）")
 	keyID := fs.String("id", "", "revoke-login-key 凭据编号")
-	out := fs.String("out", "", "凭据交付文件（0600 JSON，代替 stdout 明文；非交互推荐）")
+	out := fs.String("out", "", "凭据交付文件（JSON；仅历史兼容子命令可用）")
 	fs.Parse(args[1:])
+	if sub == "reset-password" || sub == "issue-login-key" {
+		fmt.Fprintln(os.Stderr, "RECOVERY_CONTRACT_REPLACED: use POST /api/admin/users/{owner}/one-time-password")
+		return 2 // reject before DSN/password reads, storage opens or output reservation
+	}
+	if sub == "create" && (*password != "" || *passwordStdin || *generatePassword) {
+		fmt.Fprintln(os.Stderr, "RECOVERY_CONTRACT_REPLACED: local creation uses trusted activation only")
+		return 2
+	}
+	// No CLI path may appoint an administrator or establish the super
+	// administrator (R4, R5); reject before storage opens or output reservation.
+	if sub == "create" && (*admin || *role == "admin") {
+		fmt.Fprintln(os.Stderr, "user create:", app.ErrCLIAdminAppointment)
+		return 2
+	}
+	if sub == "bootstrap-admin" {
+		fmt.Fprintln(os.Stderr, "user bootstrap-admin:", app.ErrCLIBootstrapAdminDisabled)
+		return 2
+	}
+	resolvedDSN, err := resolveAccountDSN(*dsn, *dsnFile)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "user:", err)
+		return 1
+	}
+	resolvedPassword, err := resolveAccountPassword(*password, *passwordStdin)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "user:", err)
+		return 1
+	}
+	if *instanceID != "" {
+		_ = os.Setenv("AGENT_SYSTEM_INSTANCE_ID", *instanceID)
+	}
+	*dsn = resolvedDSN
+	*password = resolvedPassword
+	if (sub == "create" || sub == "initialize-account") && (*outFile != "" || *out != "") {
+		fmt.Fprintln(os.Stderr, "user:", "local activation redemption is removed; do not use --out/--out-file. Ask an administrator to issue POST /api/admin/users/{owner}/one-time-password")
+		return 2
+	}
+	if sub != "create" && sub != "initialize-account" && (*outFile != "" || *out != "") {
+		fmt.Fprintln(os.Stderr, "user: 此子命令不生成凭据")
+		return 2
+	}
 	switch sub {
 	case "create":
 		if *owner == "" {
@@ -299,41 +515,29 @@ func runUser(args []string) int {
 			fmt.Fprintf(os.Stderr, "user create: 未知角色 %q\n", *role)
 			return 2
 		}
-		pw, err := app.CreateUserAccount(*dsn, *data, *owner, *name, *password, isAdmin, *openExisting, *generatePassword)
+		_, opID, err := app.CreateUserAccount(*dsn, *data, *owner, *name, *password, isAdmin, *openExisting, *generatePassword)
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "user create:", err)
 			return 1
 		}
-		if err := deliverCredential(*out, "login-key", *owner, pw, nil); err != nil {
-			fmt.Fprintln(os.Stderr, "user create:", err)
-			return 1
-		}
-		if *out == "" {
-			if *password == "" && !*generatePassword {
-				fmt.Fprintln(os.Stderr, "一次性激活 Key 仅此一次输出；兑换后设置密码。")
-			} else if *password == "" {
-				fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
-			}
-		}
+		fmt.Fprintf(os.Stderr, "owner=%s created as pending; ask an administrator to issue POST /api/admin/users/%s/one-time-password\n", *owner, *owner)
+		fmt.Fprintf(os.Stderr, "operation_id=%s\n", opID)
 		return 0
-	case "reset-password":
-		if *owner == "" {
-			fmt.Fprintln(os.Stderr, "user reset-password: --owner 必填")
+	case "initialize-account":
+		if *userID == "" || *expectedStateVersion < 1 || *expectedGeneration < 0 {
+			fmt.Fprintln(os.Stderr, "user initialize-account: --user-id、--expected-state-version、--expected-generation 必填")
 			return 2
 		}
-		pw, err := app.ResetUserPassword(*dsn, *data, *owner, *password, *openExisting)
+		_, targetOwner, err := app.InitializeAccount(*dsn, *data, *userID, *expectedStateVersion, *expectedGeneration)
 		if err != nil {
-			fmt.Fprintln(os.Stderr, "user reset-password:", err)
+			fmt.Fprintln(os.Stderr, "user initialize-account:", err)
 			return 1
 		}
-		if err := deliverCredential(*out, "password", *owner, pw, nil); err != nil {
-			fmt.Fprintln(os.Stderr, "user reset-password:", err)
-			return 1
-		}
-		if *out == "" && *password == "" {
-			fmt.Fprintln(os.Stderr, "新密码仅此一次输出；该用户下次登录须修改密码（其余会话已吊销）。")
-		}
+		fmt.Fprintf(os.Stderr, "owner=%s remains pending; ask an administrator to issue POST /api/admin/users/%s/one-time-password\n", targetOwner, targetOwner)
 		return 0
+	case "reset-password":
+		fmt.Fprintln(os.Stderr, "RECOVERY_CONTRACT_REPLACED: use POST /api/admin/users/{owner}/one-time-password")
+		return 2
 	case "list":
 		users, err := app.ListUserAccounts(*dsn, *data, *openExisting)
 		if err != nil {
@@ -344,27 +548,8 @@ func runUser(args []string) int {
 		fmt.Println(string(out))
 		return 0
 	case "issue-login-key":
-		if *owner == "" {
-			fmt.Fprintln(os.Stderr, "user issue-login-key: --owner 必填")
-			return 2
-		}
-		if *purpose != store.LoginKeyPurposeActivate && *purpose != store.LoginKeyPurposeRecover {
-			fmt.Fprintf(os.Stderr, "user issue-login-key: 无效 purpose %q\n", *purpose)
-			return 2
-		}
-		plain, err := app.IssueUserLoginKey(*dsn, *data, *owner, *purpose, *openExisting, *revokeAll, time.Duration(*ttlMin)*time.Minute)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
-			return 1
-		}
-		if err := deliverCredential(*out, "login-key", *owner, plain, time.Now().Add(time.Duration(*ttlMin)*time.Minute).UTC()); err != nil {
-			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
-			return 1
-		}
-		if *out == "" {
-			fmt.Fprintln(os.Stderr, "一次性登录 Key 仅此一次输出。")
-		}
-		return 0
+		fmt.Fprintln(os.Stderr, "RECOVERY_CONTRACT_REPLACED: use POST /api/admin/users/{owner}/one-time-password")
+		return 2
 	case "revoke-login-key":
 		if *keyID == "" {
 			fmt.Fprintln(os.Stderr, "user revoke-login-key: --id 必填")
@@ -376,24 +561,6 @@ func runUser(args []string) int {
 		}
 		fmt.Println("revoked")
 		return 0
-	case "bootstrap-admin":
-		if *owner == "" {
-			fmt.Fprintln(os.Stderr, "user bootstrap-admin: --owner 必填")
-			return 2
-		}
-		plain, err := app.BootstrapAdmin(*dsn, *data, *owner, *openExisting)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
-			return 1
-		}
-		if err := deliverCredential(*out, "bootstrap-admin", *owner, plain, time.Now().Add(30*time.Minute).UTC()); err != nil {
-			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
-			return 1
-		}
-		if *out == "" {
-			fmt.Fprintln(os.Stderr, "首位管理员激活 Key 仅此一次输出。")
-		}
-		return 0
 	default:
 		fmt.Fprintln(os.Stderr, "user: 未知子命令", sub)
 		return 2
@@ -0,0 +1,30 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"agent-system-backend/internal/app"
+)
+
+func runMigrate(args []string) int {
+	fs := flag.NewFlagSet("migrate", flag.ExitOnError)
+	data := fs.String("data", "./data", "数据目录（SQLite 档）")
+	dsn := fs.String("dsn", "", "PostgreSQL DSN（空则读 AGENT_SYSTEM_DSN）")
+	adopt := fs.Bool("adopt-instance-guard", false, "数据库被替换或锁文件被重建后，显式重写守卫")
+	_ = fs.Parse(args)
+	storage := *dsn
+	if storage == "" {
+		storage = os.Getenv("AGENT_SYSTEM_DSN")
+	}
+	if err := app.Migrate(app.Options{
+		DataDir:            *data,
+		StorageDSN:         storage,
+		AdoptInstanceGuard: *adopt,
+	}); err != nil {
+		fmt.Fprintln(os.Stderr, "agent-system:", err)
+		return 1
+	}
+	return 0
+}
@@ -0,0 +1,115 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/store"
+)
+
+func TestLegacyUserCredentialCommandsStopBeforeOpeningStorage(t *testing.T) {
+	data := t.TempDir()
+	for _, args := range [][]string{
+		{"reset-password", "--data", data, "--owner", "victim", "--password", "attacker-password"},
+		{"issue-login-key", "--data", data, "--owner", "victim", "--purpose", "recover", "--revoke-all-credentials"},
+	} {
+		if code := runUser(args); code != 2 {
+			t.Fatalf("legacy command did not reject before storage: %v code=%d", args[0], code)
+		}
+	}
+	out := filepath.Join(data, "delivery.json")
+	if code := runUser([]string{"create", "--data", data, "--owner", "victim", "--password", "attacker-password", "--out", out}); code != 2 {
+		t.Fatalf("password-bearing local create accepted: %d", code)
+	}
+	if _, err := os.Stat(filepath.Join(data, "agent-system.db")); !os.IsNotExist(err) {
+		t.Fatalf("rejected commands opened/created a database: %v", err)
+	}
+	if _, err := os.Stat(out); !os.IsNotExist(err) {
+		t.Fatalf("rejected commands wrote a delivery file: %v", err)
+	}
+}
+
+func TestUserCLIRejectsAdministratorAppointmentBeforeOpeningStorage(t *testing.T) {
+	data := t.TempDir()
+	out := filepath.Join(data, "delivery.json")
+	for _, args := range [][]string{
+		{"create", "--data", data, "--owner", "mallory", "--admin", "--out", out},
+		{"create", "--data", data, "--owner", "mallory", "--role", "admin", "--out", out},
+		{"bootstrap-admin", "--data", data, "--owner", "mallory", "--out", out},
+	} {
+		if code := runUser(args); code != 2 {
+			t.Fatalf("administrator appointment accepted: %v code=%d", args, code)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(data, "agent-system.db")); !os.IsNotExist(err) {
+		t.Fatalf("rejected commands opened/created a database: %v", err)
+	}
+	if _, err := os.Stat(out); !os.IsNotExist(err) {
+		t.Fatalf("rejected commands wrote a delivery file: %v", err)
+	}
+}
+
+func TestUserCLIAdministratorAppointmentLeavesExistingStoreUnchanged(t *testing.T) {
+	dir, s := cliStore(t)
+	if _, err := s.BootstrapSuperAdmin("root", mustHash(t, "Root-Password-1")); err != nil {
+		t.Fatal(err)
+	}
+	for _, args := range [][]string{
+		{"create", "--data", dir, "--owner", "mallory", "--admin", "--out-file", filepath.Join(t.TempDir(), "a")},
+		{"create", "--data", dir, "--owner", "mallory", "--role", "admin", "--out-file", filepath.Join(t.TempDir(), "b")},
+		{"bootstrap-admin", "--data", dir, "--owner", "mallory", "--out-file", filepath.Join(t.TempDir(), "c")},
+	} {
+		rc, output := accountCLI(t, args...)
+		if rc != 2 || !strings.Contains(output, "super administrator") {
+			t.Fatalf("%v: rc=%d output=%q", args, rc, output)
+		}
+	}
+	if _, err := s.GetUser("mallory"); err == nil {
+		t.Fatal("rejected CLI appointment created an account")
+	}
+	rc, _ := accountCLI(t, "create", "--data", dir, "--owner", "ada")
+	if rc != 0 {
+		t.Fatalf("ordinary local create failed: %d", rc)
+	}
+	if ada, err := s.GetAccountByOwner("ada"); err != nil || ada.IsAdmin || ada.IsSuperAdmin {
+		t.Fatalf("ordinary local create: %+v %v", ada, err)
+	}
+}
+
+func mustHash(t *testing.T, password string) string {
+	t.Helper()
+	hash, err := store.HashPassword(password)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return hash
+}
+
+func TestCredentialDeliveryCreatesExclusive0600File(t *testing.T) {
+	dir := t.TempDir()
+	out := filepath.Join(dir, "credential.json")
+	if err := os.WriteFile(out, []byte("old"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := deliverCredential(out, "activation", "alice", "secret", nil); err == nil {
+		t.Fatal("existing permissive file was overwritten")
+	}
+	bytes, err := os.ReadFile(out)
+	if err != nil || string(bytes) != "old" {
+		t.Fatalf("existing file changed: %q %v", bytes, err)
+	}
+	out = filepath.Join(dir, "new.json")
+	if err := deliverCredential(out, "activation", "alice", "secret", nil); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(out)
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("delivery mode: %v %v", info, err)
+	}
+	bytes, err = os.ReadFile(out)
+	if err != nil || !strings.Contains(string(bytes), `"secret": "secret"`) {
+		t.Fatalf("delivery payload: %v", err)
+	}
+}
@@ -9,8 +9,78 @@ import (
 	"testing"

 	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
 )

+func TestMigrateTrustedContextManifestWithoutRawScope(t *testing.T) {
+	target, cleanup := pgSchemaDSN(t)
+	defer cleanup()
+	fixture := buildFixture(t)
+	src, err := store.OpenSQLite(fixture)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := extension.ProjectContextManifest{ProjectID: "p1", AttemptID: "model-attempt", InputSHA256: "request-hash", Delivery: "attempted",
+		Included: []extension.ProjectContextManifestEntry{{SourceID: "source-a", Revision: "r1", SourceHash: "ha", InputSHA256: "input-hash"}}}
+	if err := src.AppendContextManifestWithScope("alice", "r1", m, store.ContextManifestScope{Bound: true}); err != nil {
+		t.Fatal(err)
+	}
+	m.Delivery = "responded"
+	if err := src.AppendContextManifestWithScope("alice", "r1", m, store.ContextManifestScope{Bound: true}); err != nil {
+		t.Fatal(err)
+	}
+	task, err := src.CreateWorkTask("alice", "rdm", "p1", "c1", "document", "Prepare document")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stepHash := strings.Repeat("a", 64)
+	if _, err := src.DB().Exec(`INSERT INTO workflow_step_sources(run_id,step_id,owner,project_id,step_attempt_id,output_sha256,attempt_id,authorization_epoch,publication_epoch,watermark,version,created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`,
+		"r1", "draft", "alice", "p1", "step-attempt", stepHash, "model-attempt", "auth-1", "pub-1", "water-1", "v1", "2026-10-14T00:00:00Z"); err != nil {
+		t.Fatal(err)
+	}
+	if err := src.Close(); err != nil {
+		t.Fatal(err)
+	}
+	snapshot := filepath.Join(t.TempDir(), "snapshot.db")
+	if err := cmdBackup([]string{"--source", fixture, "--out", snapshot}); err != nil {
+		t.Fatal(err)
+	}
+	if err := cmdMigrate([]string{"--source", snapshot, "--target", target, "--migration-id", "context-copy"}); err != nil {
+		t.Fatal(err)
+	}
+	pg, err := store.OpenPostgres(target, filepath.Join(t.TempDir(), "artifacts"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pg.Close()
+	receipts, err := pg.ListContextManifests("alice", "r1")
+	if err != nil || len(receipts) != 2 || len(receipts[1].Included) != 1 || receipts[1].Included[0].SourceID != "source-a" {
+		t.Fatalf("content-free model receipts not copied: count=%d err=%v", len(receipts), err)
+	}
+	workScope, err := pg.WorkTaskScope("alice", "rdm", task.ID)
+	if err != nil || workScope.ProjectID != "p1" || workScope.ConversationID != "c1" {
+		t.Fatalf("trusted work task binding not copied: scope=%+v err=%v", workScope, err)
+	}
+	stepSource, err := pg.WorkflowStepSource("alice", "r1", "draft")
+	if err != nil || stepSource.StepAttemptID != "step-attempt" || stepSource.AttemptID != "model-attempt" || stepSource.ProjectID != "p1" {
+		t.Fatalf("workflow step source not copied: source=%+v err=%v", stepSource, err)
+	}
+	var rawColumns int
+	if err := pg.DB().QueryRow(`SELECT COUNT(*) FROM information_schema.columns WHERE table_schema=current_schema() AND table_name='context_manifests' AND column_name IN ('resolve_goal','resolve_target_id')`).Scan(&rawColumns); err != nil || rawColumns != 0 {
+		t.Fatalf("migrated PG schema has raw prompt columns: count=%d err=%v", rawColumns, err)
+	}
+	if err := cmdMigrate([]string{"--source", snapshot, "--target", target, "--migration-id", "context-copy"}); err != nil {
+		t.Fatalf("idempotent context migration rerun: %v", err)
+	}
+	receipts, err = pg.ListContextManifests("alice", "r1")
+	if err != nil || len(receipts) != 2 {
+		t.Fatalf("rerun duplicated or lost model receipts: count=%d err=%v", len(receipts), err)
+	}
+	if err := pg.DB().QueryRow(`SELECT COUNT(*) FROM information_schema.columns WHERE table_schema=current_schema() AND table_name='context_manifests' AND column_name IN ('resolve_goal','resolve_target_id')`).Scan(&rawColumns); err != nil || rawColumns != 0 {
+		t.Fatalf("rerun reintroduced raw prompt columns: count=%d err=%v", rawColumns, err)
+	}
+}
+
 // U4 集成（环境门控 AGENT_PG_TEST_DSN：CI test-pg job / 本机隔离实例）：
 // 夹具 → 受管迁移 → 校验和验证 → 幂等重跑 → 断点续传 → 非空目标拒绝 →
 // 未知 owner 阻塞。每用例独立 PG schema（与 store 测试同隔离约定）。
@@ -45,6 +115,18 @@ func TestMigrateEndToEndAndIdempotent(t *testing.T) {
 	target, cleanup := pgSchemaDSN(t)
 	defer cleanup()
 	fixture := buildFixture(t)
+	src, err := sql.Open("sqlite", fixture)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer src.Close()
+	var sourcePublic, sourceStaff, sourcePrivate, sourceSecret string
+	var sourceKeyVersion int64
+	if err := src.QueryRow(`SELECT public_revision,staff_no_revision,private_revision,cursor_key_version,cursor_secret FROM account_directory_revision WHERE id=1`).Scan(
+		&sourcePublic, &sourceStaff, &sourcePrivate, &sourceKeyVersion, &sourceSecret,
+	); err != nil {
+		t.Fatal(err)
+	}

 	if err := cmdMigrate([]string{"--source", fixture, "--target", target, "--migration-id", "mig-e2e"}); err != nil {
 		t.Fatalf("首次迁移：%v", err)
@@ -61,6 +143,16 @@ func TestMigrateEndToEndAndIdempotent(t *testing.T) {
 	}
 	defer st.Close()
 	db := st.DB()
+	var targetPublic, targetStaff, targetPrivate, targetSecret string
+	var targetKeyVersion int64
+	if err := db.QueryRow(`SELECT public_revision,staff_no_revision,private_revision,cursor_key_version,cursor_secret FROM account_directory_revision WHERE id=1`).Scan(
+		&targetPublic, &targetStaff, &targetPrivate, &targetKeyVersion, &targetSecret,
+	); err != nil {
+		t.Fatal(err)
+	}
+	if targetPublic != sourcePublic || targetStaff != sourceStaff || targetPrivate != sourcePrivate || targetKeyVersion != sourceKeyVersion || targetSecret != sourceSecret {
+		t.Fatal("迁移后的目录版本或游标密钥与源库不一致")
+	}
 	var pinned, archived bool
 	if err := db.QueryRow(`SELECT pinned, archived FROM conversations WHERE id='c1'`).Scan(&pinned, &archived); err != nil || !pinned || archived {
 		t.Fatalf("布尔映射：pinned=%v archived=%v err=%v", pinned, archived, err)
@@ -85,6 +177,15 @@ func TestMigrateEndToEndAndIdempotent(t *testing.T) {
 	if _, err := db.Exec(`INSERT INTO command_audit (time, command_id, source, entrance, state, operation_id, conversation_id, payload, owner) VALUES ('2026-10-11T03:00:00Z','cmd-2','http','chat','done','op-2','c1','{}','alice')`); err != nil {
 		t.Fatalf("序列推进失败（复制后插入撞主键）：%v", err)
 	}
+	var linkedResource string
+	if err := db.QueryRow(`SELECT resource_id FROM project_audit_links WHERE host_audit_offset=7 AND source_id='commit-1'`).Scan(&linkedResource); err != nil || linkedResource != "doc-1" {
+		t.Fatalf("审计链接迁移丢失: resource=%q err=%v", linkedResource, err)
+	}
+	var newLinkID int64
+	if err := db.QueryRow(`INSERT INTO project_audit_links(host_audit_offset,project_id,owner,source_kind,source_id,operation_id,resource_kind,resource_id,run_id,disclosure_class,idempotency_key,created_at)
+		VALUES (7,'p1','alice','domain-commit','commit-2','op-1','document','doc-2','','metadata','outbox-2','2026-10-11T03:00:01Z') RETURNING id`).Scan(&newLinkID); err != nil || newLinkID <= 3 {
+		t.Fatalf("审计链接序列未推进: id=%d err=%v", newLinkID, err)
+	}
 	// 报告不含秘密值。
 	var report string
 	if err := db.QueryRow(`SELECT report FROM migration_control WHERE migration_id='mig-e2e'`).Scan(&report); err != nil || strings.Contains(report, "sk-secret-value") {
@@ -92,6 +193,105 @@ func TestMigrateEndToEndAndIdempotent(t *testing.T) {
 	}
 }

+func TestCommandAuditExclusiveCopyRollsBackAndNeverRewindsSequence(t *testing.T) {
+	target, cleanup := pgSchemaDSN(t)
+	defer cleanup()
+	fixture := buildFixture(t)
+	src, err := openSourceRO(fixture)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer src.Close()
+	st, err := store.OpenPostgres(target, filepath.Join(t.TempDir(), "artifacts"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	db := st.DB()
+	if _, err := db.Exec(controlDDL); err != nil {
+		t.Fatal(err)
+	}
+	cols, pk, err := targetColumns(db, "command_audit")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bools, err := boolColumns(db, "command_audit", cols)
+	if err != nil {
+		t.Fatal(err)
+	}
+	count, checksum, err := sourceScan(src, "command_audit", cols, pk, bools)
+	if err != nil {
+		t.Fatal(err)
+	}
+	blocker, err := db.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var existing int
+	if err := blocker.QueryRow(`SELECT COUNT(*) FROM command_audit`).Scan(&existing); err != nil {
+		t.Fatal(err)
+	}
+	timeoutDB, err := sql.Open("pgx", store.AppendPGRuntimeParam(target, "lock_timeout", "100"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := migrateCommandAudit(timeoutDB, src, "retry-audit", cols, pk, bools, count, checksum); err == nil || !strings.Contains(err.Error(), "lock timeout") {
+		t.Fatalf("exclusive copy did not fail on a held reader: %v", err)
+	}
+	timeoutDB.Close()
+	if err := blocker.Rollback(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := migrateCommandAudit(db, src, "retry-audit", cols, pk, bools, count+1, checksum); err == nil {
+		t.Fatal("mismatched copy committed despite in-transaction target count check")
+	}
+	var rows, done int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM command_audit`).Scan(&rows); err != nil || rows != 0 {
+		t.Fatalf("failed copy left rows: %d %v", rows, err)
+	}
+	if err := db.QueryRow(`SELECT COUNT(*) FROM migration_table_state WHERE table_name='command_audit'`).Scan(&done); err != nil || done != 0 {
+		t.Fatalf("failed copy recorded done: %d %v", done, err)
+	}
+	var enabled string
+	if err := db.QueryRow(`SELECT tgenabled FROM pg_trigger WHERE tgrelid='command_audit'::regclass AND tgname='project_audit_insert_guard_v1'`).Scan(&enabled); err != nil || enabled != "A" {
+		t.Fatalf("failed copy left guard disabled: %q %v", enabled, err)
+	}
+	var seq string
+	if err := db.QueryRow(`SELECT pg_get_serial_sequence('command_audit','id')`).Scan(&seq); err != nil {
+		t.Fatal(err)
+	}
+	// setval is non-transactional; an interrupted offline attempt can leave a
+	// forward gap even though its rows and trigger-state changes roll back.
+	tx, err := db.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tx.Exec(`LOCK TABLE command_audit IN ACCESS EXCLUSIVE MODE`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tx.Exec(`ALTER TABLE command_audit DISABLE TRIGGER project_audit_insert_guard_v1`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tx.Exec(`SELECT setval($1::regclass,50,true)`, seq); err != nil {
+		t.Fatal(err)
+	}
+	if err := tx.Rollback(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := migrateCommandAudit(db, src, "retry-audit", cols, pk, bools, count, checksum); err != nil {
+		t.Fatalf("retry after rollback: %v", err)
+	}
+	var last int64
+	if err := db.QueryRow(`SELECT last_value FROM ` + seq).Scan(&last); err != nil || last < 50 {
+		t.Fatalf("copy rewound sequence: last=%d err=%v", last, err)
+	}
+	var nextID int64
+	if err := db.QueryRow(`INSERT INTO command_audit(time,command_id,source,entrance,state,operation_id,conversation_id,owner,payload)
+		VALUES ('2026-10-14T00:00:00Z','after-copy','','','committed','','','alice','{}') RETURNING id`).Scan(&nextID); err != nil || nextID <= 50 {
+		t.Fatalf("post-copy ID did not advance: id=%d err=%v", nextID, err)
+	}
+}
+
 func TestMigrateResumeAfterInterrupt(t *testing.T) {
 	target, cleanup := pgSchemaDSN(t)
 	defer cleanup()
@@ -242,6 +242,9 @@ func cmdBackup(args []string) error {
 		return err
 	}
 	defer db.Close()
+	if err := refuseCandidateRawContextScope(db); err != nil {
+		return err
+	}
 	if _, err := db.Exec(`VACUUM INTO ?`, *out); err != nil {
 		return fmt.Errorf("vacuum into: %w", err)
 	}
@@ -281,13 +284,15 @@ func cmdBackup(args []string) error {
 // copyOrder：按外键依赖排序的业务表全集（projects 最先，引用方在后）。
 // admission_leases 是运行态执行许可（迁移无意义），明确排除。
 var copyOrder = []string{
-	"projects", "users", "profiles", "settings", "plugins",
-	"conversations", "runs", "messages", "events", "artifacts",
-	"hitl_cards", "plans", "todos", "knowledge", "knowledge_vectors",
-	"activity_cards", "project_event_shares", "command_audit", "prompt_modules",
+	"projects", "users", "roles", "role_permissions", "user_role_bindings", "system_grants", "authority_state", "policy_receipts", "role_authority_import_state",
+	"account_directory_revision", "profiles", "settings", "plugins",
+	"conversations", "runs", "messages", "project_work_outbox", "events", "artifacts",
+	"document_render_deliveries",
+	"hitl_cards", "human_decisions", "plans", "todos", "knowledge", "knowledge_vectors",
+	"activity_cards", "project_event_shares", "command_audit", "project_audit_links", "prompt_modules",
 	"sessions", "api_keys",
-	"plugin_grants", "plugin_schema", "plugin_kv", "background_tasks",
-	"memory_entries", "audit_events", "pending_confirms", "llm_usage_daily",
+	"plugin_grants", "plugin_schema", "plugin_kv", "background_tasks", "work_task_bindings",
+	"memory_entries", "audit_events", "context_manifests", "workflow_step_sources", "pending_confirms", "llm_usage_daily",
 	"secret_keys", "settings_snapshots", "regen_pending", "context_entries",
 	"user_commands", "pending_notices", "recovery_holds",
 	"surfaces", "surface_revisions", "surface_actions", "plugin_activation",
@@ -297,6 +302,19 @@ var copyOrder = []string{
 	"agent_system_identity",
 	"account_events",
 	"redeem_attempts",
+	"recovery_proposals", "recovery_proposal_proofs",
+	// v35 分层 Python 环境（无外键；申请与会话绑定要随库迁走）
+	"exec_env_requests", "exec_env_bindings",
+	// U8：活动服务锁的库内标记（无外键；迁移须保留以免目标库丢掉锁根）
+	"instance_guard",
+}
+
+// schemaSeededSingletons：schema 迁移在每个新库上预置的单行表。它们不是目标
+// 业务数据，复制时须由源库的行替换。
+var schemaSeededSingletons = map[string]bool{
+	"account_directory_revision":  true,
+	"authority_state":             true,
+	"role_authority_import_state": true,
 }

 const controlDDL = `
@@ -336,6 +354,9 @@ func cmdMigrate(args []string) error {
 		return err
 	}
 	defer src.Close()
+	if err := refuseCandidateRawContextScope(src); err != nil {
+		return err
+	}
 	snapID, _, err := fileSHA256(*source)
 	if err != nil {
 		return err
@@ -344,6 +365,9 @@ func cmdMigrate(args []string) error {
 	if err != nil {
 		return err
 	}
+	if err := validateSourceMigrationLedger(src); err != nil {
+		return err
+	}

 	// 目标：先用 store 同款迁移器建 schema/扩展（OpenPostgres 会跑迁移与
 	// 未知版本门禁），再落控制表。DSN 不回显、不入报告。
@@ -410,6 +434,57 @@ func cmdMigrate(args []string) error {
 	return writeReport(rep, *out)
 }

+func validateSourceMigrationLedger(src *sql.DB) error {
+	rows, err := src.Query(`SELECT version,name FROM schema_migrations`)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var version int
+		var name string
+		if err := rows.Scan(&version, &name); err != nil {
+			return err
+		}
+		if err := store.ValidateMigrationIdentity(version, name); err != nil {
+			return fmt.Errorf("source %w", err)
+		}
+	}
+	return rows.Err()
+}
+
+// Candidate context-scope v35 may contain full model prompts in private columns.
+// Never copy or back up such a source implicitly; it must be migrated and
+// reviewed in an isolated Backend store before this tool accepts it.
+func refuseCandidateRawContextScope(db *sql.DB) error {
+	if !sqliteHasTable(db, "context_manifests") {
+		return nil
+	}
+	var columns int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM pragma_table_info('context_manifests') WHERE name IN ('resolve_goal','resolve_target_id')`).Scan(&columns); err != nil {
+		return err
+	}
+	if columns > 0 {
+		return fmt.Errorf("candidate context scope text columns remain; isolate and scrub source before backup or migration")
+	}
+	var version int
+	if sqliteHasTable(db, "schema_migrations") {
+		if err := db.QueryRow(`SELECT COALESCE(MAX(version),0) FROM schema_migrations`).Scan(&version); err != nil {
+			return err
+		}
+	}
+	if version >= 35 {
+		if !sqliteHasTable(db, "context_scope_scrub_state") {
+			return fmt.Errorf("candidate context physical scrub marker missing; isolate and scrub source before backup or migration")
+		}
+		var pending int
+		if err := db.QueryRow(`SELECT pending FROM context_scope_scrub_state WHERE id=1`).Scan(&pending); err != nil || pending != 0 {
+			return fmt.Errorf("candidate context physical scrub pending or unverified; isolate and scrub source before backup or migration")
+		}
+	}
+	return nil
+}
+
 // guardIdentity：目标非空且身份不同即拒绝（R7：不覆盖他人数据）。
 //   - 存在其他 migration_id 的完成记录 → 拒绝；
 //   - 同 migration_id 但 source_snapshot_id 不同（换了快照续传）→ 拒绝；
@@ -450,6 +525,11 @@ func guardIdentity(db *sql.DB, migrationID, snapID string, srcVersion int) error
 func businessRows(db *sql.DB) (int64, error) {
 	var total int64
 	for _, t := range copyOrder {
+		// Schema setup seeds these singletons before a migration starts. They are
+		// replaced from the source during copying and are not target business data.
+		if schemaSeededSingletons[t] {
+			continue
+		}
 		var n int64
 		if err := db.QueryRow(`SELECT COUNT(*) FROM "` + t + `"`).Scan(&n); err != nil {
 			if strings.Contains(err.Error(), "does not exist") {
@@ -508,9 +588,18 @@ func migrateTable(db *sql.DB, src *sql.DB, migrationID, table string) (map[strin
 		if countNow != srcCount || sumNow != srcChecksum {
 			return nil, fmt.Errorf("源与登记不符（疑似换快照）：count %d/%d checksum %s…/%s…", countNow, srcCount, sumNow[:12], srcChecksum[:12])
 		}
+		if table == "command_audit" {
+			var guarded bool
+			if err := db.QueryRow(`SELECT project_audit_cutoff_safe('command_audit'::regclass) AND project_audit_writers_guarded('command_audit'::regclass)`).Scan(&guarded); err != nil || !guarded {
+				return nil, fmt.Errorf("command_audit idempotent guard is unsafe: safe=%v err=%v", guarded, err)
+			}
+		}
 		entry := map[string]any{"table": table, "source_count": countNow, "target_count": dstCountStored, "checksum": sumNow, "state": "done(idempotent)"}
 		return entry, nil
 	}
+	if table == "command_audit" {
+		return migrateCommandAudit(db, src, migrationID, cols, pk, bools, countNow, sumNow)
+	}
 	if err := copyRows(db, src, table, cols); err != nil {
 		return nil, err
 	}
@@ -663,7 +752,11 @@ func sourceScan(src *sql.DB, table string, cols, pk []string, bools map[string]b
 	return scanChecksum(rows, cols, bools)
 }

-func targetScan(db *sql.DB, table string, cols, pk []string, bools map[string]bool) (int64, string, error) {
+type rowsQuerier interface {
+	Query(string, ...any) (*sql.Rows, error)
+}
+
+func targetScan(db rowsQuerier, table string, cols, pk []string, bools map[string]bool) (int64, string, error) {
 	rows, err := db.Query(`SELECT ` + quoteJoin(cols, `"`) + ` FROM "` + table + `" ORDER BY ` + quoteJoin(pk, `"`))
 	if err != nil {
 		return 0, "", err
@@ -686,6 +779,18 @@ func copyRows(db *sql.DB, src *sql.DB, table string, cols []string) error {
 	if err != nil {
 		return err
 	}
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if err := copyRowsInTx(tx, src, table, cols, bools); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func copyRowsInTx(tx *sql.Tx, src *sql.DB, table string, cols []string, bools map[string]bool) error {
 	colList := quoteJoin(cols, `"`)
 	ph := make([]string, len(cols))
 	for i := range ph {
@@ -702,11 +807,15 @@ func copyRows(db *sql.DB, src *sql.DB, table string, cols []string) error {
 	for i := range vals {
 		ptrs[i] = &vals[i]
 	}
-	tx, err := db.Begin()
-	if err != nil {
-		return err
+	// The destination migrator seeds fresh singletons (directory revision,
+	// authority epoch, role import state) at schema startup. Replace them with
+	// the source's rows so existing cursors/visible-change history and authority
+	// state remain tied to the migrated data.
+	if schemaSeededSingletons[table] {
+		if _, err := tx.Exec(`DELETE FROM "` + table + `"`); err != nil {
+			return err
+		}
 	}
-	defer tx.Rollback()
 	stmt, err := tx.Prepare(fmt.Sprintf(`INSERT INTO "%s" (%s) VALUES (%s) ON CONFLICT DO NOTHING`, table, colList, placeholders))
 	if err != nil {
 		return err
@@ -734,7 +843,76 @@ func copyRows(db *sql.DB, src *sql.DB, table string, cols []string) error {
 	if err := srcRows.Err(); err != nil {
 		return err
 	}
-	return tx.Commit()
+	return nil
+}
+
+// command_audit alone needs an offline transaction: explicit source IDs do not
+// pass the online monotone guard, and disabling it must never become visible
+// separately from the copied rows, sequence advance, or done marker.
+func migrateCommandAudit(db *sql.DB, src *sql.DB, migrationID string, cols, pk []string, bools map[string]bool, sourceCount int64, sourceChecksum string) (map[string]any, error) {
+	tx, err := db.Begin()
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback()
+	if _, err := tx.Exec(`LOCK TABLE command_audit IN ACCESS EXCLUSIVE MODE`); err != nil {
+		return nil, err
+	}
+	if _, err := tx.Exec(`ALTER TABLE command_audit DISABLE TRIGGER project_audit_insert_guard_v1`); err != nil {
+		return nil, err
+	}
+	if err := copyRowsInTx(tx, src, "command_audit", cols, bools); err != nil {
+		return nil, err
+	}
+	targetCount, targetChecksum, err := targetScan(tx, "command_audit", cols, pk, bools)
+	if err != nil {
+		return nil, err
+	}
+	if targetCount != sourceCount || targetChecksum != sourceChecksum {
+		return nil, fmt.Errorf("command_audit copy mismatch: count %d/%d checksum %s/%s", targetCount, sourceCount, targetChecksum, sourceChecksum)
+	}
+	if err := advanceCommandAuditSequence(tx); err != nil {
+		return nil, err
+	}
+	if _, err := tx.Exec(`ALTER TABLE command_audit ENABLE ALWAYS TRIGGER project_audit_insert_guard_v1`); err != nil {
+		return nil, err
+	}
+	var guarded bool
+	if err := tx.QueryRow(`SELECT project_audit_cutoff_safe('command_audit'::regclass) AND project_audit_writers_guarded('command_audit'::regclass)`).Scan(&guarded); err != nil || !guarded {
+		return nil, fmt.Errorf("command_audit guard not restored: safe=%v err=%v", guarded, err)
+	}
+	if _, err := tx.Exec(`INSERT INTO migration_table_state (migration_id, table_name, source_count, target_count, checksum, state, finished_at)
+		VALUES ($1,'command_audit',$2,$3,$4,'done',$5)
+		ON CONFLICT(migration_id, table_name) DO UPDATE SET source_count=excluded.source_count, target_count=excluded.target_count, checksum=excluded.checksum, state=excluded.state, finished_at=excluded.finished_at`,
+		migrationID, sourceCount, targetCount, sourceChecksum, nowISO()); err != nil {
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return map[string]any{"table": "command_audit", "source_count": sourceCount, "target_count": targetCount, "checksum": sourceChecksum, "state": "done"}, nil
+}
+
+func advanceCommandAuditSequence(tx *sql.Tx) error {
+	var seq string
+	if err := tx.QueryRow(`SELECT pg_get_serial_sequence('command_audit','id')`).Scan(&seq); err != nil || seq == "" {
+		return fmt.Errorf("command_audit sequence missing: %v", err)
+	}
+	var last int64
+	var called bool
+	if err := tx.QueryRow(fmt.Sprintf(`SELECT last_value,is_called FROM %s`, seq)).Scan(&last, &called); err != nil {
+		return err
+	}
+	var maxID sql.NullInt64
+	if err := tx.QueryRow(`SELECT MAX(id) FROM command_audit`).Scan(&maxID); err != nil {
+		return err
+	}
+	if maxID.Valid && (maxID.Int64 > last || (maxID.Int64 == last && !called)) {
+		if _, err := tx.Exec(`SELECT setval($1::regclass,$2,true)`, seq, maxID.Int64); err != nil {
+			return err
+		}
+	}
+	return nil
 }

 func sqliteBool(v any) bool {
@@ -752,30 +930,34 @@ func sqliteBool(v any) bool {
 // 后续应用插入会撞主键）。无序列表为空操作。
 func advanceSequences(db *sql.DB, table string) error {
 	rows, err := db.Query(`
-		SELECT pg_get_serial_sequence($1, column_name)
+		SELECT column_name, pg_get_serial_sequence(format('%I.%I',table_schema,table_name), column_name)
 		FROM information_schema.columns
-		WHERE table_schema=current_schema() AND table_name=$1
-		  AND (column_default LIKE 'nextval%' OR is_identity='YES')`, table)
+		WHERE table_schema=current_schema() AND table_name=$1`, table)
 	if err != nil {
 		return err
 	}
 	defer rows.Close()
-	var seqs []string
+	var seqs []struct{ name, column string }
 	for rows.Next() {
-		var s any
-		if err := rows.Scan(&s); err != nil {
+		var column string
+		var seq sql.NullString
+		if err := rows.Scan(&column, &seq); err != nil {
 			return err
 		}
-		if s != nil {
-			seqs = append(seqs, s.(string))
+		if seq.Valid {
+			seqs = append(seqs, struct{ name, column string }{seq.String, column})
 		}
 	}
 	if err := rows.Err(); err != nil {
 		return err
 	}
 	for _, s := range seqs {
-		if _, err := db.Exec(fmt.Sprintf(`SELECT setval('%s', COALESCE((SELECT MAX(id) FROM "%s"), 1))`, s, table)); err != nil {
-			return fmt.Errorf("setval %s: %w", s, err)
+		// Sequence ownership remains authoritative when a column's default is a
+		// guarded function rather than a literal nextval expression.
+		column := `"` + strings.ReplaceAll(s.column, `"`, `""`) + `"`
+		tableName := `"` + strings.ReplaceAll(table, `"`, `""`) + `"`
+		if _, err := db.Exec(fmt.Sprintf(`SELECT setval($1::regclass, COALESCE((SELECT MAX(%s) FROM %s), 1))`, column, tableName), s.name); err != nil {
+			return fmt.Errorf("setval %s (%s): %w", s.name, s.column, err)
 		}
 	}
 	return nil
@@ -784,7 +966,9 @@ func advanceSequences(db *sql.DB, table string) error {
 // checkOwners：业务行引用的 owner 必须存在于 users（单租户默认 ”/'local'
 // 除外）。未知 owner 阻塞迁移（U4/R7：不静默带过未知归属）。
 func checkOwners(db *sql.DB, src *sql.DB) error {
-	ownerTables := []string{"projects", "conversations", "runs", "artifacts", "knowledge", "hitl_cards", "profiles", "activity_cards", "project_event_shares", "command_audit"}
+	ownerTables := []string{"projects", "conversations", "runs", "artifacts", "knowledge", "hitl_cards", "profiles", "activity_cards",
+		"project_event_shares", "command_audit", "project_audit_links", "project_work_outbox", "work_task_bindings", "context_manifests", "workflow_step_sources",
+		"sessions", "api_keys", "login_keys", "account_events", "recovery_proposals"}
 	for _, t := range ownerTables {
 		if !sqliteHasTable(src, t) {
 			continue
@@ -1,7 +1,10 @@
 package main

 import (
+	"bytes"
+	"database/sql"
 	"encoding/json"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -27,6 +30,23 @@ func buildFixture(t *testing.T) string {
 	return path
 }

+func TestMigrateRejectsSourceLedgerNameCollisionBeforeTargetOpen(t *testing.T) {
+	source := buildFixture(t)
+	db, err := sql.Open("sqlite", source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`UPDATE schema_migrations SET name='work_task_bindings' WHERE version=35`); err != nil {
+		db.Close()
+		t.Fatal(err)
+	}
+	db.Close()
+	err = cmdMigrate([]string{"--source", source, "--target", "invalid://target", "--migration-id", "name-collision"})
+	if err == nil || !strings.Contains(err.Error(), "source migration identity mismatch") || !strings.Contains(err.Error(), "legacy feature migration numbering") {
+		t.Fatalf("candidate branch ledger was not rejected before opening target: %v", err)
+	}
+}
+
 func seedEdgeRows(t *testing.T, st *store.Store) {
 	t.Helper()
 	// users（含 is_admin/must_change 布尔）与单租户默认身份。
@@ -70,8 +90,10 @@ func seedEdgeRows(t *testing.T, st *store.Store) {
 	mustExec(t, st, `INSERT INTO activity_cards (id, project_id, conversation_id, ref, owner, payload, status, pinned, created_at, updated_at, version) VALUES
 		('ac1', 'p1', 'c1', '', 'alice', '{"title":"卡"}', 'active', 1, '2026-10-11T01:00:00Z', '2026-10-11T01:00:00Z', 2)`)
 	// 命令审计（SERIAL 主键：显式 id 插入）。
-	mustExec(t, st, `INSERT INTO command_audit (id, time, command_id, source, entrance, state, operation_id, conversation_id, payload, owner) VALUES
-		(7, '2026-10-11T01:00:00Z', 'cmd-1', 'http', 'chat', 'done', 'op-1', 'c1', '{"actor":"alice"}', 'alice')`)
+	mustExec(t, st, `INSERT INTO command_audit (id, time, command_id, source, entrance, state, operation_id, conversation_id, payload, owner, project_id, actor_name) VALUES
+		(7, '2026-10-11T01:00:00Z', 'cmd-1', 'http', 'chat', 'committed', 'op-1', 'c1', '{"actor":"alice","commandId":"cmd-1","operationId":"op-1","state":"committed","conversationId":"c1"}', 'alice', 'p1', '爱丽丝')`)
+	mustExec(t, st, `INSERT INTO project_audit_links (id,host_audit_offset,project_id,owner,source_kind,source_id,operation_id,resource_kind,resource_id,run_id,disclosure_class,idempotency_key,created_at) VALUES
+		(3,7,'p1','alice','domain-commit','commit-1','op-1','document','doc-1','','metadata','outbox-1','2026-10-11T01:00:01Z')`)
 	// 设置（'' 默认租户 scope）。
 	mustExec(t, st, `INSERT INTO settings (owner, scope, "values") VALUES ('', 'runtime', '{"rateLimitPerMin":0}')`)
 	// 秘密字段（值不外泄：迁移按行复制，报告无正文）。
@@ -170,7 +192,8 @@ func TestCopyOrderCoversAllFixtureTables(t *testing.T) {
 	for _, t := range copyOrder {
 		known[t] = true
 	}
-	known["schema_migrations"] = true // 迁移器管理，不随迁
+	known["schema_migrations"] = true         // 迁移器管理，不随迁
+	known["context_scope_scrub_state"] = true // SQLite 候选原文物理清理状态，不随迁
 	// 运行态表不随迁：执行许可是进程瞬态；执行租约与跨实例命令属当前
 	// 实例的调度现场（接管语义在 U5 内由 lease/fencing 处理，不复制历史）。
 	for _, rt := range []string{"admission_leases", "conversation_executions", "run_commands"} {
@@ -195,3 +218,108 @@ func TestCopyOrderCoversAllFixtureTables(t *testing.T) {
 		t.Fatalf("copyOrder 漏表（新表加入 schema 后须同步工具清单）：%v", missing)
 	}
 }
+
+func TestBackupAndMigrateRejectCandidateRawContextScope(t *testing.T) {
+	path := buildFixture(t)
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`ALTER TABLE context_manifests ADD COLUMN resolve_goal TEXT NOT NULL DEFAULT ''`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`ALTER TABLE context_manifests ADD COLUMN resolve_target_id TEXT NOT NULL DEFAULT ''`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`DELETE FROM schema_migrations WHERE version=41`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`INSERT INTO context_manifests(id,attempt_id,owner,target_id,project_id,input_sha256,delivery,manifest_json,created_at,scope_bound,resolve_goal,resolve_target_id) VALUES('candidate-ctx','candidate-attempt','alice','r1','p1','input-hash','attempted','{}','2026-10-14T00:00:00Z',1,'OLD_RESTRICTED_BODY','doc-private')`); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatal(err)
+	}
+	out := filepath.Join(t.TempDir(), "unsafe-backup.db")
+	if err := cmdBackup([]string{"--source", path, "--out", out}); err == nil || !strings.Contains(err.Error(), "candidate context scope text") {
+		t.Fatalf("backup accepted candidate v38 raw scope: %v", err)
+	}
+	if _, err := os.Stat(out); !os.IsNotExist(err) {
+		t.Fatalf("rejected backup still created output: %v", err)
+	}
+	if err := cmdMigrate([]string{"--source", path, "--target", "postgres://invalid", "--migration-id", "unsafe"}); err == nil || !strings.Contains(err.Error(), "candidate context scope text") {
+		t.Fatalf("migration accepted candidate v38 raw source: %v", err)
+	}
+	scrubbed, err := store.OpenSQLite(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := scrubbed.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := cmdBackup([]string{"--source", path, "--out", out}); err != nil {
+		t.Fatalf("scrubbed source rejected: %v", err)
+	}
+	data, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(data, []byte("OLD_RESTRICTED_BODY")) {
+		t.Fatal("backup retained candidate raw scope body")
+	}
+}
+
+func TestBackupAndMigrateRejectPendingOrMissingContextScrubMarker(t *testing.T) {
+	path := buildFixture(t)
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, query := range []string{
+		`CREATE TABLE IF NOT EXISTS context_scope_scrub_state(id INTEGER PRIMARY KEY,pending INTEGER NOT NULL)`,
+		`INSERT OR REPLACE INTO context_scope_scrub_state(id,pending) VALUES(1,1)`,
+	} {
+		if _, err := db.Exec(query); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := db.Close(); err != nil {
+		t.Fatal(err)
+	}
+	assertRejected := func(name string) {
+		t.Helper()
+		out := filepath.Join(t.TempDir(), name+".db")
+		if err := cmdBackup([]string{"--source", path, "--out", out}); err == nil {
+			t.Fatalf("backup accepted %s context scrub state", name)
+		}
+		if _, err := os.Stat(out); !os.IsNotExist(err) {
+			t.Fatalf("rejected %s backup created output: %v", name, err)
+		}
+		if err := cmdMigrate([]string{"--source", path, "--target", "postgres://invalid", "--migration-id", name}); err == nil {
+			t.Fatalf("migration accepted %s context scrub state", name)
+		}
+	}
+	assertRejected("pending")
+	db, err = sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`DROP TABLE context_scope_scrub_state`); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatal(err)
+	}
+	assertRejected("missing")
+	db, err = sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Exec(`DELETE FROM schema_migrations WHERE version=41`); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatal(err)
+	}
+	assertRejected("v38-missing")
+}
@@ -0,0 +1,101 @@
+package main
+
+import (
+	"database/sql"
+	"path/filepath"
+	"testing"
+
+	"agent-system-backend/internal/store"
+)
+
+// 新库 schema 预置的单行表：必须在 copyOrder 内、确由迁移预置、不计入
+// businessRows，且复制时由源库行替换（而非 ON CONFLICT 保留目标预置行）。
+
+func openFreshStore(t *testing.T, name string) *store.Store {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st
+}
+
+func tableColumns(t *testing.T, db *sql.DB, table string) []string {
+	t.Helper()
+	rows, err := db.Query(`SELECT name FROM pragma_table_info(?) ORDER BY cid`, table)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var cols []string
+	for rows.Next() {
+		var c string
+		if err := rows.Scan(&c); err != nil {
+			t.Fatal(err)
+		}
+		cols = append(cols, c)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	if len(cols) == 0 {
+		t.Fatalf("%s 无列", table)
+	}
+	return cols
+}
+
+func TestSchemaSeededSingletonsAreSeededAndCopied(t *testing.T) {
+	inOrder := map[string]bool{}
+	for _, tbl := range copyOrder {
+		inOrder[tbl] = true
+	}
+	fresh := openFreshStore(t, "fresh.db").DB()
+	for tbl := range schemaSeededSingletons {
+		if !inOrder[tbl] {
+			t.Errorf("%s 不在 copyOrder 内", tbl)
+		}
+		var n int
+		if err := fresh.QueryRow(`SELECT COUNT(*) FROM "` + tbl + `"`).Scan(&n); err != nil {
+			t.Fatal(err)
+		}
+		if n != 1 {
+			t.Errorf("%s 新库预置行数=%d，期望 1", tbl, n)
+		}
+	}
+	n, err := businessRows(fresh)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("新库 businessRows=%d，预置单行表不得计为业务数据", n)
+	}
+}
+
+func TestCopyReplacesSeededAuthorityState(t *testing.T) {
+	src := openFreshStore(t, "src.db").DB()
+	if _, err := src.Exec(`UPDATE authority_state SET authority_epoch=7, catalog_version=9 WHERE id=1`); err != nil {
+		t.Fatal(err)
+	}
+	dst := openFreshStore(t, "dst.db").DB()
+	cols := tableColumns(t, src, "authority_state")
+	tx, err := dst.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tx.Rollback()
+	if err := copyRowsInTx(tx, src, "authority_state", cols, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := tx.Commit(); err != nil {
+		t.Fatal(err)
+	}
+	var count int
+	var epoch, catalog int64
+	if err := dst.QueryRow(`SELECT COUNT(*), MAX(authority_epoch), MAX(catalog_version) FROM authority_state`).Scan(&count, &epoch, &catalog); err != nil {
+		t.Fatal(err)
+	}
+	if count != 1 || epoch != 7 || catalog != 9 {
+		t.Fatalf("目标 authority_state 未被源行替换：count=%d epoch=%d catalog=%d", count, epoch, catalog)
+	}
+}
@@ -0,0 +1,120 @@
+# IAM U3 A1: account write fence inventory
+
+Status: stage 4–5 implementation inventory; the fixed candidate is the commit containing this file, and stage 6 human review remains pending. The route table records the **4053c4d baseline finding** and the intended final sink; its `Now` column is historical, not a claim about the amended candidate. Scope follows the approved Documents A1–A4 amendment `fb3a8214df963697ebd745ad11eb852ed9444fe3` and approved delegated-actor amendment `5783940e4c434102cbca8c22bd282d87b28fa840`.
+
+The 66 non-GET `/api` registrations were enumerated from `internal/server/server.go`. Paths below omit `/api`. `A` means `s.owner(r)` (auth-off: implicit `store.OwnerDefault`); `B` means body owner, `K` redeemed-key owner, `S` current password-session owner. Target resource owner never substitutes for actor. In the historical `Now` column, `T` means the baseline already had a final Store check; `M` means a Backend DB write lacked one; `E` means an external or process-local effect; `—` means no business mutation or permitted credential cleanup. `D` means a short Store transaction with actor account lock and enabled read **before** resource/scope/conversation locks; `F` means stage immutable bytes, then `D` for the visible DB reference; `X` means last effective-state check before external action plus cancellation; `C` means `D` at each command handler's actual sink; `P` means `D` for Backend projection and `X` at the separate RDM callback. `Vnn` identifies the route for traceability; verification uses representative concurrency cases and complete source-to-sink review, rather than one duplicate test per route.
+
+| # | Route → handler (source line) | Actor | Final sink | Now | Required fence | Verify |
+|---:|---|---|---|---|---|---|
+| 01 | `POST /auth/login` → `login` (`accounts.go:148`) | B | `CreateSessionVerified` | T | retain account/version transaction check | V01 |
+| 02 | `POST /auth/login-key/redeem` → `redeemLoginKey` (`accounts.go:106`) | K | `RedeemLoginKey`; failed-attempt security counter | T | retain account/grant transaction check | V02 |
+| 03 | `POST /auth/recovery-grants/redeem` → `redeemLoginKey` (`accounts.go:106`) | K | same as 02 | T | same as 02 | V03 |
+| 04 | `POST /auth/logout` → `logout` (`accounts.go:202`) | A | `DeleteSession` credential cleanup | — | permit cleanup after disable | V04 |
+| 05 | `POST /auth/password` → `changePassword` (`accounts.go:214`) | S | checked setup/forced/active password Store transaction | T | retain session/account recheck | V05 |
+| 06 | `POST /admin/users` → `createAdminUser` (`accounts.go:321`) | A | `CreatePendingAccount` | T | retain actor enabled/admin transaction check | V06 |
+| 07 | `PATCH /me/profile` → `patchMeProfile` (`accounts.go:394`) | S | `PatchAccountProfile` | T | retain actor/target transaction check | V07 |
+| 08 | `PATCH /admin/users/{userId}/profile` → `patchAdminAccountProfile` (`accounts.go:419`) | A | `PatchAccountProfile` | T | retain actor/target transaction check | V08 |
+| 09 | `PUT /admin/users/{userId}/state` → `setAdminAccountState` (`accounts.go:444`) | A | `SetAccountEnabled` | T | retain shared account lock and in-tx actor check | V09 |
+| 10 | `POST /admin/users/{userId}/recovery-proposals` → `createAdminRecoveryProposal` (`recovery.go:7`) | A | `CreateRecoveryProposal` | T | retain actor/target transaction check | V10 |
+| 11 | `DELETE /admin/users/{userId}/recovery-proposals/{id}` → `revokeAdminRecoveryProposal` (`recovery.go:47`) | A | `RevokeRecoveryProposal` | T | retain actor/target transaction check | V11 |
+| 12 | `POST /auth/recovery-proposals/{id}/confirm` → `confirmRecoveryProposal` (`recovery.go:81`) | S | `ConfirmRecoveryProposal` | T | retain owner/session proof in transaction | V12 |
+| 13 | `POST /auth/recovery-proposals/{id}/rotate-grant` → `rotateRecoveryGrant` (`recovery.go:105`) | S | `RotateRecoveryGrant` | T | retain owner/session proof in transaction | V13 |
+| 14 | `POST /admin/users/{owner}/password` → `resetAdminUserPassword` (`accounts.go:468`) | A | 410 response only | — | no business sink | V14 |
+| 15 | `POST /admin/users/{owner}/login-keys` → `issueAdminLoginKey` (`accounts.go:478`) | A | 410 response only | — | no business sink | V15 |
+| 16 | `DELETE /admin/users/{owner}/login-keys/{id}` → `revokeAdminLoginKey` (`accounts.go:494`) | A | `RevokeLoginKeyCascade` | M | D: lock/recheck admin actor too, then target/grant | V16 |
+| 17 | `POST /projects` → `createProject` (`server.go:713`) | A | `CreateProject` or RDM `Create` + Host projection | M/E | P | V17 |
+| 18 | `PATCH /projects/{id}` → `patchProject` (`server.go:734`) | A | RDM `Rename` or `RenameProject`; `UpdateProjectSettings` | M/E | P; D for every settings write | V18 |
+| 19 | `DELETE /projects/{id}` → `deleteProject` (`server.go:812`) | A | RDM `Archive` or `DeleteProject` | M/E | P | V19 |
+| 20 | `POST /projects/{id}/conversations` → `createConversation` (`server.go:875`) | A | `CreateConversation[InProject]`; RDM `Work` precheck | M | D; keep domain work check | V20 |
+| 21 | `PATCH /conversations/{id}` → `patchConversation` (`server.go:914`) | A | update, permission, note, flags: separate Store writes | M | D at each final write | V21 |
+| 22 | `DELETE /conversations/{id}` → `deleteConversation` (`server.go:950`) | A | `DeleteConversation` | M | D | V22 |
+| 23 | `POST /conversations/{id}/messages` → `postMessage` (`server.go:956`) | A | message, run, message-run link; optional Bus dispatch | M/E | D per write; C for command; actor lock before conversation lock | V23 |
+| 24 | `POST /conversations/{id}/rewind` → `rewindFiles` (`rewind.go:27`) | A | checkpoint files, then `AppendMessage` | M/E | X for rewind, D for message | V24 |
+| 25 | `POST /conversations/{id}/regenerate` → `regenerateMessage` (`borrow.go:159`) | A | message flags/exclusion, regen marker, rewind files, new run | M/E | D per write, X for rewind | V25 |
+| 26 | `POST /messages/{id}/exclude` → `excludeMessage` (`borrow.go:122`) | A | `ExcludeRunGroup(messageID)` | M | D; derive conversation owner in transaction | V26 |
+| 27 | `POST /messages/{id}/variant` → `selectVariant` (`borrow.go:146`) | A | `SelectVariant(messageID)` | M | D; derive conversation owner in transaction | V27 |
+| 28 | `POST /secrets` → `createSecret` (`borrow.go:21`) | A | `AddSecret` | M | D | V28 |
+| 29 | `POST /secrets/{id}/activate` → `activateSecret` (`borrow.go:39`) | A | `ActivateSecret` | M | D | V29 |
+| 30 | `PATCH /secrets/{id}` → `renameSecret` (`borrow.go:43`) | A | `RenameSecret` | M | D | V30 |
+| 31 | `DELETE /secrets/{id}` → `deleteSecret` (`borrow.go:54`) | A | `DeleteSecret` | M | D | V31 |
+| 32 | `POST /context-entries` → `saveContextEntry` (`borrow.go:64`) | A | `SaveContextEntry` | M | D | V32 |
+| 33 | `DELETE /context-entries/{id}` → `deleteContextEntry` (`borrow.go:78`) | A | `DeleteContextEntry` | M | D | V33 |
+| 34 | `POST /prompt-commands` → `saveUserPromptCommand` (`borrow.go:87`) | A | `SaveUserCommand`, then process Bus register | M/E | D; X before Bus mutation | V34 |
+| 35 | `DELETE /prompt-commands/{id}` → `deleteUserPromptCommand` (`borrow.go:102`) | A | `DeleteUserCommand`, then Bus unregister | M/E | D; X before Bus mutation | V35 |
+| 36 | `POST /runs/{id}/cancel` → `cancelRun` (`server.go:1278`) | A | PG `EnqueueCommand` or local cancel handle | M/E | D for enqueue with in-tx run owner; X locally | V36 |
+| 37 | `POST /hitl/{id}/resolve` → `resolveHITL` (`server.go:1314`) | A | local HITL/card/event writes or PG `EnqueueCommand` | M | D at each Store sink, including queue | V37 |
+| 38 | `POST /cards/{id}/actions/{actionId}` → `cardAction` (`server.go:1401`) | A | Cards action or Bus confirm, then receipt message | M/E | D for card/message; C for confirmed handler | V38 |
+| 39 | `POST /cards/{id}/pin` → `cardPin` (`server.go:1453`) | A | card version write | M | D | V39 |
+| 40 | `POST /cards/{id}/dismiss` → `cardDismiss` (`server.go:1462`) | A | card version/event write | M | D | V40 |
+| 41 | `POST /cards/{id}/to_project` → `cardToProject` (`server.go:1386`) | A | project card copy and original dismissal | M | D at both writes | V41 |
+| 42 | `POST /projects/{id}/uploads` → `upload` (`server.go:1469`) | A | Blob + artifact row, card, knowledge/vector index | M/E | F; D at later card/index writes | V42 |
+| 43 | `PUT /artifacts/{id}/content` → `putArtifactContent` (`server.go:1651`) | A | **in-place Blob overwrite before SQL UPDATE** | M/E | F using new immutable blob ref, guarded DB pointer swap | V43 |
+| 44 | `DELETE /artifacts/{id}` → `deleteArtifact` (`server.go:1656`) | A | metadata, index/vector rows, Blob deletion | M/E | D for visible rows; X for post-commit GC | V44 |
+| 45 | `POST /profiles` → `saveProfile` (`server.go:1667`) | A | profile Store row | M | D | V45 |
+| 46 | `DELETE /profiles/{id}` → `deleteProfile` (`server.go:1683`) | A | profile Store row | M | D | V46 |
+| 47 | `POST /prompts` → `savePromptModule` (`server.go:2023`) | A | prompt Store row | M | D | V47 |
+| 48 | `DELETE /prompts/{id}` → `deletePromptModule` (`server.go:2044`) | A | prompt Store row | M | D | V48 |
+| 49 | `PUT /settings/user` → `putSettingsUser` (`server.go:1717`) | A | settings transaction, then separate snapshot row | M | D for settings and snapshot | V49 |
+| 50 | `PUT /settings/project/{id}` → `putSettingsProject` (`server.go:1726`) | A | settings transaction, then separate snapshot row | M | D for settings and snapshot | V50 |
+| 51 | `PUT /settings/system` → `putSettingsSystem` (`server.go:1782`) | A | system settings and snapshot under synthetic owner | M | D with **request actor**, not `OwnerSystemRow` | V51 |
+| 52 | `POST /tools` → `createUserTool` (`server.go:1815`) | A | process Registry register; future HTTP tool execution | E | X for registration and each tool execution | V52 |
+| 53 | `DELETE /tools/{name}` → `deleteUserTool` (`server.go:1834`) | A | process Registry unregister | E | X | V53 |
+| 54 | `POST /plugins/{id}/enabled` → `setPluginEnabled` (`platform_api.go:132`) | A | `SetPluginEnabled` upsert | M | D | V54 |
+| 55 | `POST /plugins/{id}/activation` → `setSurfaceActivation` (`platform_api.go:251`) | A | activation transaction, separate audit row | M | D for both writes | V55 |
+| 56 | `POST /surfaces` → `submitSurface` (`platform_api.go:194`) | A | snapshot transaction, then event/pending row | M | D for snapshot/event writes | V56 |
+| 57 | `POST /surfaces/{id}/actions` → `submitSurfaceAction` (`platform_api.go:271`) | A | action insert, Bus dispatch, action-state update | M/E | D for both action writes; C for dispatch | V57 |
+| 58 | `POST /plugins/reload` → `reloadPlugins` (`server.go:1908`) | A | process registry/sidecar changes and `UpsertPlugin` | M/E | X for process changes; D for DB writes | V58 |
+| 59 | `POST /commands/{id}` → `execCommand` (`server.go:1211`) | A | Bus audit/card/pending or arbitrary command handler/RDM | M/E | C, X for external handler | V59 |
+| 60 | `POST /projects/{id}/knowledge` → `addKnowledge` (`server.go:2055`) | A | `AddKnowledge` batch transaction | M | D; in-tx project/owner check | V60 |
+| 61 | `POST /tasks` → `createBackgroundTask` (`platform_api.go:16`) | A | task insert | M | D | V61 |
+| 62 | `POST /tasks/{id}` → `updateBackgroundTask` (`platform_api.go:52`) | A | task update | M | D | V62 |
+| 63 | `POST /memory` → `putMemory` (`platform_api.go:69`) | A | memory upsert | M | D | V63 |
+| 64 | `POST /audit` → `postAudit` (`platform_api.go:112`) | A | client-origin business audit row | M | D; security-denial audit is a separate exception | V64 |
+| 65 | `POST /admin/backup` → `backup` (`server.go:2224`) | A | directory + SQLite backup file | E | X and explicit admin authorization | V65 |
+| 66 | `POST /admin/recovery-holds/{runId}/release` → `releaseRecoveryHold` (`accounts.go:526`) | A | recovery-hold UPDATE | M | D with actor admin check and run/hold owner lookup | V66 |
+
+The route count is not a full write count. `GET /api/llm/budget` → `llmBudget` (`platform_api.go`) calls `AccountTokens(owner, 0, budget)`; the amended Store returns a read-only total when tokens are zero. **V67** therefore has no business write. Ordinary authenticated GETs can refresh session `last_seen_at` as credential maintenance; session/API-key in-flight revocation remains a separate impact analysis.
+
+## Host and run manager exits
+
+| ID | Entry and actor | Final sink | Now → required fence | Verify |
+|---|---|---|---|---|
+| H01 | `inprocHost.KVPut`, host owner (`hostcaps.go:295`) | `PutPluginKV` | M → D | VH01 |
+| H02 | `inprocHost.Audit`, host owner; actor label is `plugin:<id>` (`hostcaps.go:309`) | `AppendAuditEvent` | M → D using host owner | VH02 |
+| H03 | `KnowledgeWrite/Publish/Delete`, host owner (`hostcaps.go:350-424`) | knowledge rows, vector rows; publish deletes then writes | M/E → D at every DB sink; X before embedding/remote model | VH03 |
+| H04 | `TaskCreate/Update`, host owner (`hostcaps.go:427-443`) | background-task rows | M → D | VH04 |
+| H05 | `EnsureProject/RenameOwnedProject`, host owner (`project_lifecycle.go:125-135`) | Backend projection rows, RDM callback upstream | M/E → actor D before project-name lock; X at callback | VH05 |
+| H06 | `SurfaceSave`, host owner (`hostcaps.go:481`) | `surfacesvc.Submit` snapshot/event | M → D at Store sinks | VH06 |
+| H07 | `Complete`, host owner (`hostcaps.go:319`) | external LLM request | E → X with context cancellation | VH07 |
+| H08 | scoped Host reconstructed from owner/plugin ID (`hostcaps.go:103`) | same H01-H07 methods | M/E → same final sink fences; early `requireEffective` alone is insufficient | VH08 |
+| G01 | `startClaimedRun`/subagent spawn, run owner (`runmgr.go:1443,1924`) | `CreateRun`, `UpdateRun` and admission rows | M → D for business state; keep failure-only cleanup explicit | VG01 |
+| G02 | `Emit`, `AskHITL`, cards, plan/todos (`runmgr.go:676-935`) | events, HITL/card, plan/todo rows | M → D at each final Store write | VG02 |
+| G03 | `WriteArtifact`, run owner (`runmgr.go:968`) | Blob, artifact, event, knowledge/vector rows | M/E → F then D for each later write | VG03 |
+| G04 | `ExecuteTool`, run owner (`runmgr.go:1080-1167`) | Registry HTTP/command/filesystem side effects, output artifacts | E/M → X before external call; C/D for command and output sinks | VG04 |
+| G05 | `stageInputs`, checkpoint recording/rewind and subagent transcript (`inputs.go:17-90`, `rewind.go:37-99`, `subagent_transcript.go:46-84`) | workspace files | E → X before each effect and cancellation; no cross-system atomic claim | VG05 |
+| G06 | `ResolveHITL`, run/card owner (`runmgr.go:1780-1860`) | HITL/card/event and possible run writes | M → D | VG06 |
+| G07 | background notice delivery and subagent completion (`runmgr.go:1982-2041,2444-2455`) | run/message/event plus transcript files | M/E → D for business rows, X for files | VG07 |
+| G08 | `settleRunWithFence`, run owner (`runmgr.go:1700-1722`) | final run + assistant message | T for enabled check in `store/recovery.go:184-220`; retain narrow failure-state exception | VG08 |
+| G09 | `OnUsage`, run owner (`app.go:668-680`) | usage and budget audit rows | M → D or documented accounting-only exception | VG09 |
+
+At the 4053c4d baseline, Host/runmgr effective-account queries were early checks, Bus confirmation and Surface writes had separate sinks, and artifact content could be overwritten in place before a checked SQL update. These are the reasons for the sink-level mapping below; file paths and old line numbers in the historical tables are navigational rather than final-SHA evidence.
+
+## Amended candidate mapping and limits
+
+This section supersedes the historical `Now` column when checking the amended candidate. V01–V15 retain their existing account/credential transaction or response-only behavior; V16 uses actor-checked login-key revocation. V17–V23 route project, conversation, message, run creation and link writes through account-checked Store entries. V24–V35 use guarded file/message and borrow/secret/context/command entries; V25 prepares the message exclusion and regeneration marker in one checked transaction, then consumes the marker only with successful run settlement. V36–V44 guard command queue, HITL, card, surface/event, artifact metadata and index writes. Artifact content updates switch immutable blob references in the checked transaction. V45–V51 guard profile, prompt, settings and snapshot writes, using the **request actor** for system settings. V52–V59 combine last checks for process/HTTP/tool effects with guarded plugin, surface, card, command pending and audit DB writes. V60–V66 use guarded knowledge, task, memory, audit and hold updates. V65 refuses whole-database backup under authenticated mode because administrator status does not grant access to other owners' business content; auth-off backup has a last check. V67 is read-only at zero tokens.
+
+VH01–VH04/VH06/VH08 use the Host owner and final Store account checks for Backend-owned rows. H05 delegated rename now derives a **single-project** projection from the current authenticated lifecycle or command Host; its final Store transaction locks the real operator and creator in stable order, checks both effective states and verifies the persisted project owner. The global `NewScopedHost` cannot derive this delegated capability; its original creator-owned methods remain. VH07 checks immediately before its external model call and passes the caller context. VG01–VG09 use checked run, admission/lease, event, HITL, card, artifact, index, notice, command and settle sinks. File staging, transcript, tool HTTP/search/code execution and overlay writeback check just before effects and propagate cancellation. Failed/cancelled/interrupted run sealing, lease release, notice deletion and failed-start marker deletion are narrowly scoped safety cleanup; positive token usage is accounting for model work already incurred.
+
+The H05/V17–V19 late-write blocker was reproduced in the earlier candidate and repaired under the separately approved Documents `5783940` plan. Tests cover creator/operator effective state, a disable between early check and final write on SQLite/PG, a two-process PG disable, opposite lock order progress, and both HTTP PATCH and no-conversation command Host sources. The RDM database authorization/intent commit is still separate from Backend's account/project transaction; a permission withdrawal or cross-database failure is handled by the existing I1 failure intent and recovery path rather than a zero-window assertion. Completion and stage 6 claims require exact-HEAD receipts and human review.
+
+The account lock closes the **account-enabled versus Backend-owned business write** race on the same database. It does not prove that a session or API key revoked after request authentication cannot complete a write while that account remains enabled; that is a distinct credential-version fence and outside this amendment's promise. RDM commits in its own database and external requests, processes and files cannot share the Backend transaction. The last check can race with those effects, and a multi-file operation can leave earlier files committed when a later check fails. No cross-database or external zero-window claim is made.
+
+**Sink discovery still required:** Backend source alone cannot enumerate every dynamically registered Bus handler, plugin sidecar command, or the RDM callback's independent database writes. V17–V19, V23, V38, V57–V59 and VH05 must record the actual composed handlers and their final sinks in the tested composition; an unknown or unguarded handler blocks the A1 completion claim. The external HTTP tool destination and filesystem actions depend on runtime configuration, so VG04/VG05 must verify the actual enabled tool set and cancellation points.
+
+## Common implementation and verification gate
+
+1. Build one short Store write-transaction primitive: `Begin` → PG actor advisory lock (`account:<owner>`) → `SELECT enabled ... FOR UPDATE` → existing resource/scope/conversation/admission locks → resource authorization and write → commit. The actor lock must precede all other PG locks, including project-name locks; participating account owners use sorted order, then bootstrap lock where required. `SetAccountEnabled` already takes the account lock (`store/account_state.go:20-45`); `lockAccountUsers` supplies sorted PG account locking (`store/account_model.go:115-145`). SQLite uses `_txlock=immediate` (`store/store.go:188-199`). In auth-off mode, only a missing `OwnerDefault` row is implicitly enabled; an existing disabled row rejects (`app/account_guard.go:10-23`). No DB connection or transaction spans request body decoding, embedding, tool execution, RDM callback, or full HTTP lifetime.
+2. Make methods with only resource IDs derive owner inside the guarded transaction. Pass actor separately for system settings (`OwnerSystemRow`), delegated Host calls, commands, queue commands, audit and background jobs. Preserve project/duty authorization as a separate condition; account enabled does not grant resource access. For files, stage invisible immutable bytes and switch the visible DB reference in `D`; failed transaction deletes staged bytes, post-commit old-blob GC may continue. RDM's independent database keeps the explicit cross-database window from the amendment.
+3. Review **every** V/VH/VG route against its final sink on the fixed candidate SHA. Use deterministic pause-and-disable tests for representative project, message/run, artifact, settings, command/surface and Host/runmgr paths on SQLite and isolated PostgreSQL. Test account lock ordering with two PG connections. Verify the existing credential routes' in-transaction ordering. For external effects, verify the last check and cancellation and state the remaining check-to-effect window. Record exact command, tested SHA and output in the Dev task card; local SELF is not independent REPLAY or CI GATE.
+
+Stage 6 stops if any Backend-owned business write lacks a final actor-enabled transaction fence, if artifact content remains visibly mutable after disable via in-place overwrite, or if an external/RDM effect is described as same-DB atomic. Session/API-key in-flight revocation is a separate amendment impact analysis; enabled checks do not prove credential-revocation fencing.
@@ -0,0 +1,235 @@
+# W6-X1 Source-Recheck Review (r1)
+
+**Reviewer:** independent (read-only)
+**Branch:** `feature/w6-x1-source-recheck` @ `8c410b9`
+**Base:** `b4399e3` (merge of candidate `6ba53e4` + `main`)
+**Scope (per packet):** `pkg/extension/project_context.go`, `internal/store/context_manifest*`,
+`internal/runmgr/project_context*`, `internal/app/project_context*.go`,
+`internal/workflow` (judge + consumption points), `internal/ctxasm/`,
+`cmd/storage-migrate/`
+**Methodology:** static code review of the diff vs base, no file mutation, no git operation;
+test files were read as evidence of behaviour, not run.
+
+---
+
+## 0. What the diff actually changed
+
+`git diff --stat 689e176..8c410b9` (also equals `b4399e3..8c410b9`):
+
+```
+cmd/storage-migrate/integration_test.go        |  10 +
+internal/app/project_source_recheck_test.go    |  97 +++++++
+internal/runmgr/project_context.go             |  24 +-
+internal/runmgr/project_context_test.go        |   2 +-
+internal/runmgr/project_source_recheck_test.go | 349 +++++++++++++++++++++++++
+internal/store/context_manifest.go             |  24 ++
+internal/store/context_manifest_gate_test.go   |  45 +++
+```
+
+The patch is **purely additive / strengthening** of the r1 (candidate `6ba53e4`) revision. The
+only existing-file edits are:
+
+1. `internal/runmgr/project_context.go` — three narrow inserts inside `recheckManifest`:
+   * `ctx.Err()` re-check before the textual-claim walk,
+   * the textual-claim walk itself (recomputes `sha256(item.Text)` for every `current.Items[i]`
+     and refuses if it doesn't equal `used.InputSHA256`),
+   * final `return ctx.Err()` after a successful recheck (fail-closed on late cancellation).
+   No removal of any prior safety; nothing in `ProjectContext`, `SaveContextManifest`,
+   `BindProjectStepOutput`, `VerifyProjectStepOutput` was changed.
+
+2. `internal/store/context_manifest.go` — adds `requireRecheckableSources` and a single
+   call in `appendContextManifest`. No existing branch removed.
+
+3. `internal/runmgr/project_context_test.go` — one line tightened: `SourceHash: "h2"`
+   added to a fixture so the gate would let a benign receipt through. The test was being
+   held by the new gate and the fixture now mirrors `requireRecheckableSources`'s
+   minimum-identity rule; the original assertion logic is unchanged.
+
+Everything else (`internal/app`, `cmd/storage-migrate`, all new `*_test.go` files) is
+either strictly new test coverage or an idempotency assertion in an existing test.
+
+---
+
+## 1. Hard-requirement verdict (PASS / FAIL / NOT_RUN)
+
+| # | Hard requirement                                                                                                                                                                                                                                                                                                                                                                                                                  | Verdict | Evidence                                                                                              |
+| - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-----: | ----------------------------------------------------------------------------------------------------- |
+| 1 | Recheck request is constructed **only** from a trusted persisted run/step/attempt + Manifest that was actually included; client/model/plugin cannot supplement; **no Goal/prompt/output/body** in the recheck.                                                                                                                                                                                                                    | **PASS** | `internal/runmgr/project_context.go:80–116`; `internal/app/project_context.go:118–139`; `TestProjectSourceRecheckRequestCarriesOnlyTrustedIdentities` (runmgr). |
+| 2 | Per-item identity check (count/ID/revision/sourceHash); Backend **recomputes** `Text → InputSHA256` instead of trusting provider echo; `EvidenceRef` is reauthorized and `ReadEvidence` re-reads the body; `Text` does not enter generic receipts/logs.                                                                                                                                                                                   | **PASS** | `internal/runmgr/project_context.go:138–163`; `internal/store/context_manifest.go:88–108`; `TestProjectSourceRecheckRejectsUnrelatedOrDuplicateSource`; `TestSaveContextManifestRejectsUnrecheckableModelInput`. |
+| 3 | All consumption points (judge, second prompt, blackboard, `{{steps.X.output}}` interpolation, background resume) are gated. Unidentifiable old machine provenance ⇒ project state refuses to send; one recheck request must re-validate **every** early-round and **every** parallel source.                                                                                                                                                | **PASS** | `internal/wfcompile/project_sources.go:18–56`; `internal/wfcompile/host.go:102–110,440–500,559–584`; `internal/runtime/project_stream.go:71–107,107–160`; `TestProjectCrossGuardRechecksEarlierRoundAfterLaterSource`. |
+| 4 | **Receipt gate**: `Included` lacks `sourceID` / `revision` / `sourceHash` **or** `OfferedReferences` lacks a re-authorizable identity ⇒ round is rejected.                                                                                                                                                                                                                                                                         | **PASS** | `internal/store/context_manifest.go:87–107` (`requireRecheckableSources`); `internal/store/context_manifest_gate_test.go` (`TestContextManifestRejectsSourcesWithoutStableIdentity`). |
+| 5 | Storage: fresh install has no `resolve_goal`/`resolve_target_id` columns; legacy migrations condition-ally purge them; `cmdBackup` refuses old v34/v35 sources; SQLite→isolated PG migration ⇒ target schema has no raw columns and is idempotent.                                                                                                                                                                                       | **PASS** | `internal/store/context_manifest_test.go` (`TestCandidateV35RawScopeColumnsAreScrubbedOnUpgrade`, `…CommittedDrop…`, `…WithoutMarker…`, `…PostgresRawScopeScrub…`); `cmd/storage-migrate/main.go:295–329` (`refuseCandidateRawContextScope`, also invoked from `cmdBackup`); `cmd/storage-migrate/integration_test.go:72–83` (idempotent re-run assertion). |
+| 6 | Fail-closed: missing item / same-id different text / cross-project / provider refusal / >3 s timeout / mixed `attempted`+`unknown` / epoch drift ⇒ reject; **candidate resolve must not impersonate actually-seen items**; current-turn user-typed input does **not** inherit old fragment permissions.                                                                                                                                  | **PASS** | `internal/runmgr/project_context.go:130–184`; `internal/app/project_context.go:136–143` (3 s deadline + project/status guard); `internal/store/workflow_step_source.go:65–110` (`states` bitmask 3 forbids any attempt without attempted+responded); `TestProjectSourceRecheckFailsClosedAtThreeSecondCeiling` (app); `TestProjectSourceRecheckFailsClosedOnRefusalDenialAndCancellation`; `TestProjectStepOutputRejectsUnsettledAttemptInSameStep`. |
+| 7 | Compatibility: non-project flows untouched; project runs whose provider does **not** expose the optional `Recheck` method fail-closed at the first attempt instead of being silently admitted.                                                                                                                                                                                                                                 | **PASS** | `internal/runmgr/project_context.go:83–85` (`c.mgr.projectSourceRechecker == nil`); `internal/app/project_context.go:128–132` (`p.(extension.ProjectContextSourceRechecker)` type assertion, returns explicit unavailable error). Verified by `TestProjectSourceRecheckUsesSameRegisteredProviderAndDeadline` (legacy provider rejected). |
+
+All seven requirements pass on code evidence. None are NOT_RUN; all are reproducible
+through the unit tests added in this r1.
+
+---
+
+## 2. Findings
+
+### BLOCKING
+
+*None.*
+
+The r1 patch threads the three previously identified gaps:
+
+1. (Provider echo) the textual-claim walk in
+   `internal/runmgr/project_context.go:138–163` plus
+   `internal/runmgr/project_context.go:144–148` (sha recompute) closes it.
+2. (Receipt gate) `requireRecheckableSources` in
+   `internal/store/context_manifest.go:87–107` enforces identities on **every**
+   append.
+3. (Failure modes) `ctx.Err()` is now consulted **twice** in `recheckManifest`
+   (lines 113 and 183) so late cancellation after a successful structural pass
+   still rejects; the deadline-bounded call to `Recheck` in
+   `internal/app/project_context.go:136–143` enforces the 3 s ceiling from the
+   host side.
+
+### MAJOR
+
+*None.* The recheck call site in `internal/wfcompile/project_sources.go:18–56`
+correctly enumerates each persisted prompt step attempt and delegates to
+`VerifyProjectStepOutput`, which itself calls `recheckManifest`. The
+`{{steps.X.output}}` interpolation in `internal/wfcompile/host.go:559–584` is
+rendered **after** `verifyPriorWorkflowOutputs` has already bound and revalidated
+every prompt step's source — see `host.go:102–110` for the strict-mode gate.
+
+### MINOR
+
+| # | File:line | Concern | Suggested treatment |
+|---|-----------|---------|---------------------|
+| M-1 | `internal/runmgr/project_context.go:142` | `if len(current.Items) != len(m.Included) || len(current.Evidence) != len(expectedRefs) || !slices.Equal(current.Missing, m.Missing)` — `current.Missing` ordering is required to be *identical*, not just set-equal. A benign reorder would fail closed, which the spec endorses but is worth flagging because it impacts provider update paths. | Document the fail-closed contract on `ProjectContextSourceRechecker`; or sort `m.Missing` before comparison. |
+| M-2 | `internal/runmgr/project_context.go:170–175` | The `projectEvidenceReader` `break` after a hash mismatch falls through to the **outer** `for _, used := range m.ReadEvidence`. Each `used` is then matched against `current.Evidence` once. Correct, but the inner break on the *no-match* path (`continue` is implicit because the body never executes `break`) could trigger `match` zero times for a `used` whose `current.Evidence` carries a newer `SourceID` revision. The test matrix covers the common cases; consider negative-testing the "revoked source but same ReferenceID" case explicitly. | Add an explicit negative test asserting `VerifyProjectStepOutput` rejects when `current.Evidence` carries a same-ID ref whose `Hash` differs from `used.SourceHash`. |
+| M-3 | `internal/runmgr/project_context.go:182` | `return ctx.Err()` is the final statement after a successful structural pass. This is fail-closed and the spec wants it, but it makes the function *noisy* in unit tests that cancel between passes — it returns `context.Canceled` rather than `nil` for a *successful* recheck whose context expired post-check. | If a future change relaxes the rule, comment this line as load-bearing. |
+| M-4 | `internal/app/project_context.go:118–120` | `s == nil`, `Actor==""`, `ProjectID==""`, *and* `Goal!=""` all return the same generic error. Helpful for the spec but harder to diagnose. | Differentiate the four conditions for host-side observability. |
+| M-5 | `internal/store/context_manifest.go:67–80` | The terminal-state match query requires `attempt_id=? AND delivery='attempted' AND owner=? AND target_id=? AND project_id=? AND input_sha256=?` — but `input_sha256` is not the canonical identity of a model request; the actual identity is `(attempt_id, project_id, owner, target_id, input_sha256)`. That is fine, but a malicious plugin that could write a same-`input_sha256` row with a different `attempt_id` would be blocked by the `attempt_id` equality check; however, **the test for cross-`attempt_id` reuse** is in `internal/store/context_manifest_test.go:45` (attempt reused across target) and not for the other columns. | Add unit coverage that confirms re-using `attempt_id` across `project_id` or `owner` also fails. |
+| M-6 | `internal/wfcompile/host.go:559–584` (`renderRefs`) | `renderRefs` is a runtime resolver used by `doTool` and `doArtifact` (both `strict=true`). `doCard` and `doScript` also reach `renderRefs` indirectly via the `out_<id>` field population; if `doScript` ever feeds `{{steps.X.output}}` into a non-strict step, the trust barrier is the early guard. Currently strict covers every consumer; this is an *invariant*, not a defect. | Document this invariant on `renderRefs`. |
+
+### Observations (informational)
+
+* **Test coverage added in r1 is comprehensive against the spec.** Each requirement
+  has at least one named test whose prefix matches the requirement number:
+  timeout (3 s) → `TestProjectSourceRecheckFailsClosedAtThreeSecondCeiling`,
+  refused/denied/cancellation → `…RefusalDenialAndCancellation`,
+  cross-guard multi-round → `TestProjectCrossGuardRechecksEarlierRoundAfterLaterSource`,
+  receipt gate → `TestSaveContextManifestRejectsUnrecheckableModelInput`.
+* **`internal/ctxasm/` is not in the change set.** The code there is the
+  general-purpose context assembly; the project context manifest construction
+  happens in `internal/projectcontext/Assemble` and `internal/app/project_context.go`
+  (`assembleWorkCompletionWithEvidence`). `ctxasm.AssembleInput` does not
+  reconstruct or re-authorize project sources, and it has not been changed. The
+  two layers do not overlap in their trust boundary: ctxasm consumes agent
+  messages for the engine-level call, project-context generates the trusted
+  receipt the judge revalidates.
+* **`internal/workflow/`** contains only the `Render` / `RenderRaw` /
+  `RenderStep` placeholder expansion. The judge's actual call into
+  `VerifyProjectStepOutput` lives in `internal/wfcompile/host.go` (`doCritic`,
+  `applyScriptPlan`) and `internal/wfcompile/project_sources.go`
+  (`verifyPriorWorkflowOutputs`). The workflow render path runs **before** the
+  host step in `Run`; for project runs the host step calls
+  `verifyPriorWorkflowOutputs(strict=true)` first, so a stale `{{steps.X.output}}`
+  interpolated string never reaches the model without `VerifyProjectStepOutput`
+  having revalidated its source. This matches requirement (3).
+* **`cmd/storage-migrate/main.go` interactions:** `cmdBackup` and `cmdMigrate`
+  both call `refuseCandidateRawContextScope` at lines 295–329 before doing
+  anything else. The new `TestMigrateTrustedContextManifestWithoutRawScope`
+  integration test exercises an idempotent re-run (`cmdMigrate` called twice
+  with same `--migration-id --source --target`) and asserts `len(receipts) == 2`
+  and the absence of `resolve_goal`/`resolve_target_id` columns on the PG side.
+  The PG schema bootstrap (`store.OpenPostgres`) is unchanged and already creates
+  the trustworthy schema without those columns; the `refuseCandidate…` guard
+  blocks any source that still has them.
+* **Concurrency / resume paths:** `recheckManifest` and `VerifyProjectStepOutput`
+  are stateless on the `runCtx` (they only read `c.run`, `c.mgr.st`,
+  `c.mgr.projectSourceRechecker`, `c.mgr.projectEvidenceReader`). Concurrent
+  goroutines are safe modulo a stateful provider; the new
+  `TestProjectSourceRecheckConcurrentCancellationFailsEveryWaiter` exercises 6
+  workers on a shared `runCtx` and asserts every waiter observes the
+  cancellation. Background resume is exercised through re-reading the run row
+  from the store (`trustedProjectContextRequest`) on every recheck call — there
+  is no path that can resurrect a stale in-memory run identity.
+
+---
+
+## 3. Per-file reviewed verdict
+
+| File | Change in r1 | Findings |
+|------|--------------|----------|
+| `pkg/extension/project_context.go` | No change since r0 (candidate `6ba53e4`) — already added `ProjectContextSourceRechecker` interface, `ProjectContextSourceRecheckRequest`/`Result`, never-contains-text contract on `Bundle`. | Pre-existing contract matches requirement (1); no r1 regression. |
+| `internal/store/context_manifest.go` | `+24`: `requireRecheckableSources` + call site. | **PASS** for (4), (5). |
+| `internal/store/context_manifest_gate_test.go` | New file, `+45`. | **PASS** — exercises every missing-identity variant (incl. `OfferedReferences` w/o `ID`, `ReadEvidence` w/o `ReferenceID`/`Revision`). |
+| `internal/runmgr/project_context.go` | `+24/-2`: 3 narrow inserts into `recheckManifest`. | **PASS** for (1)–(7). Minor M-1/M-2/M-3 above. |
+| `internal/runmgr/project_context_test.go` | `+1/-1`: one fixture row received `SourceHash` to satisfy the new gate. | **PASS** — change keeps the assertion intent intact. |
+| `internal/runmgr/project_source_recheck_test.go` | New file, `+349`. | **PASS** — covers (1)/(2)/(3)/(6). The concurrent-cancel test specifically exercises M-3's intent. |
+| `internal/app/project_source_recheck_test.go` | New file, `+97`. | **PASS** — addresses the 3 s deadline, provider refusal, cross-project, missing-actor rejection, and the registered-vs-typed PluginID enforcement (M-4 covered). |
+| `internal/app/project_context.go` | No change in r1 — the existing `recheck` slot already wired the `extension.ProjectContextSourceRechecker` interface and the 3 s deadline. | **PASS** for (3)/(6)/(7). |
+| `cmd/storage-migrate/integration_test.go` | `+10`: idempotency assertion for context manifests. | **PASS** for (5). |
+| `cmd/storage-migrate/main.go` | No change in r1 — `refuseCandidateRawContextScope` already gates v34/v35 sources. | **PASS** for (5). |
+| `internal/workflow/` (render.go, validate.go, registry.go) | No change in r1. | Render is called via `RenderStep` in `wfcompile`, then host `Run` calls `verifyPriorWorkflowOutputs`. **PASS** for (3). |
+| `internal/wfcompile/host.go`, `project_sources.go`, `project_backend.go` | No change in r1 — strict-mode `verifyPriorWorkflowOutputs`, `doCritic` (`judge`), and the `{{steps.X.output}}` `renderRefs` runtime path are already gated. | **PASS** for (3). |
+| `internal/ctxasm/` | No change in r1 — `ctxasm` is not part of the project trust boundary. | **PASS** (out of scope by design). |
+
+---
+
+## 4. Concurrency & recovery deep dive (per spec)
+
+* **Race on `c.projectContextReq`.** Guarded by `c.projectContextMu`
+  (`internal/runmgr/project_context.go:187–196`). `recheckManifest` calls
+  `trustedProjectContextRequest` which builds a fresh `req` value and returns
+  it; the assignment to `c.projectContextReq` happens via `setContextRequest`
+  **only** when a fresh `Resolve` runs. A recheck that races a fresh `Resolve`
+  could observe the *prior* scope value, but the recheck compares against
+  `m.AttemptID`/`m.ProjectID` (persisted) — never against the in-memory scope
+  identity.
+
+* **Read reauthorization races.** `projectEvidenceReader` is called inside
+  `recheckManifest` and `SaveContextManifest`. Both compare the freshly-read
+  `sha256(evidence.Text)` against the persisted `used.InputSHA256`. The reader
+  cannot impersonate a previously-recorded body because the hash is recomputed
+  every time.
+
+* **In-flight cancellation.** `recheckManifest` consults `ctx.Err()` **before**
+  the textual-claim walk (line 113) and **after** (line 183). The `Recheck`
+  provider call itself is wrapped in a 3 s `context.WithTimeout` in
+  `internal/app/project_context.go:136–143`. `TestProjectSourceRecheckConcurrentCancellationFailsEveryWaiter`
+  exercises 6 concurrent rechecks against a single shared `runCtx` and confirms
+  cancellation propagates to every waiter.
+
+* **Backend resume path.** `trustedProjectContextRequest` re-reads the run and
+  conversation from `c.mgr.st` on every call. `internal/runmgr/project_context_test.go`
+  has `TestProjectContextResumeReloadsCurrentVersionAndAuthorization` which
+  constructs a *second* `runCtx{mgr:m, run:reloaded}` for an `Interrupted` run
+  and confirms the resume path uses the current authorization (not the
+  frozen-in-memory snapshot).
+
+* **Workflow sink ambiguity.** `internal/wfcompile/project_sources.go:88–141`
+  records the step start, *invalidates* any prior `WorkflowStepSource` binding
+  on each start, and marks the step `ambiguous` whenever two start events
+  coexist in the in-progress set. The downstream `BindProjectStepOutput` is a
+  no-op when `ambiguous`, leaving the judge to fail closed.
+  `internal/store/workflow_step_source.go:65–110` enforces a bitmask
+  `state == 3` (bits `attempted` + `responded`) for every attempt ID covered
+  by the step; `TestProjectStepOutputRejectsUnsettledAttemptInSameStep`
+  exercises the `attempted` and `unknown` mixed storage cases.
+
+* **Recovery store under interruption.** The recheck call re-reads from
+  `ListContextManifests` every time (`internal/runmgr/project_context.go:52`),
+  so a row committed by an in-flight `SaveContextManifest` is visible to the
+  next cross-guard call but invisible to a prior one. There is no `BEGIN/END`
+  window during which `recheckManifest` could observe an inconsistent set of
+  receipts because each row's gate (`requireRecheckableSources`) is applied
+  in the same SQL transaction as the insert.
+
+---
+
+## 5. Verdict
+
+**APPROVED for merge into `feature/w6-x1-source-recheck`** as far as the reviewer's
+evidence permits. No blocking or major issues identified. The single grade-M
+observations are refinements, not corrections; none block the safety property
+the revision claims.
+
+The reviewer makes no claim about CI green-ness; that requires running the
+test suite. Tests were read; not run.
@@ -0,0 +1,40 @@
+//go:build live
+
+package live
+
+import (
+	"database/sql"
+	"fmt"
+	"path/filepath"
+	"testing"
+)
+
+func TestPersistedRunningCheckpointMaxDoesNotMissShortWindow(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "checkpoint.db")
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if _, err = db.Exec(`CREATE TABLE events (conversation_id TEXT, seq INTEGER, type TEXT, payload TEXT)`); err != nil {
+		t.Fatal(err)
+	}
+	for seq, item := range []struct {
+		conversation, status, state string
+		checkpoint                  int
+	}{
+		{"wanted", "active", "running", 1},
+		{"other", "active", "running", 9},
+		{"wanted", "active", "running", 2},
+		{"wanted", "failed", "failed", 99},
+	} {
+		payload := fmt.Sprintf(`{"card":{"status":%q,"task":{"executionState":%q,"checkpointSeq":%d}}}`, item.status, item.state, item.checkpoint)
+		if _, err = db.Exec(`INSERT INTO events(conversation_id,seq,type,payload) VALUES(?,?,?,?)`, item.conversation, seq+1, "card.updated", payload); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := persistedRunningCheckpointMax(path, "wanted")
+	if err != nil || got != 2 {
+		t.Fatalf("persisted in-flight checkpoints: max=%d err=%v; want 2", got, err)
+	}
+}
@@ -0,0 +1,307 @@
+//go:build live
+
+package live
+
+import (
+	core "agent-system-core"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+type checkpointManifest struct {
+	PID                                                           int `json:"pid"`
+	Binary, BinarySHA256, BackendSHA, DevSHA, Base, DataDir, Mode string
+}
+
+func checkpointEvalOutputName(filter, authorization string) (string, bool) {
+	if filter == "A01" && authorization == "approved-20261013" {
+		return "candidate-extra-a01", true
+	}
+	if filter == "A01" && authorization == "approved-followup-20261013" {
+		return "candidate-followup-a01", true
+	}
+	if filter == "A01" && authorization == "approved-r02-20261013" {
+		return "candidate-r02-a01", true
+	}
+	if filter == "A01" && authorization == "approved-r03-20261013" {
+		return "candidate-r03-a01", true
+	}
+	if filter == "A01" && authorization == "approved-r04-20261014" {
+		return "candidate-r04-a01", true
+	}
+	if filter == "A01" && authorization == "approved-o2-a01-evidence" {
+		return "candidate-o2-a01-evidence", true
+	}
+	if filter == "A01" && authorization == "approved-o2-a01-final" {
+		return "candidate-o2-a01-final", true
+	}
+	if filter == "A02,A04" {
+		return "candidate-remaining", true
+	}
+	return "", false
+}
+
+func persistedRunningCheckpointMax(path, conversationID string) (int, error) {
+	db, err := sql.Open("sqlite", "file:"+path+"?mode=ro")
+	if err != nil {
+		return 0, err
+	}
+	defer db.Close()
+	rows, err := db.Query(`SELECT payload FROM events WHERE conversation_id = ? AND type = 'card.updated' ORDER BY seq`, conversationID)
+	if err != nil {
+		return 0, err
+	}
+	defer rows.Close()
+	maximum := 0
+	for rows.Next() {
+		var raw []byte
+		if err = rows.Scan(&raw); err != nil {
+			return 0, err
+		}
+		var event struct {
+			Card struct {
+				Status string `json:"status"`
+				Task   struct {
+					ExecutionState string `json:"executionState"`
+					CheckpointSeq  int    `json:"checkpointSeq"`
+				} `json:"task"`
+			} `json:"card"`
+		}
+		if err = json.Unmarshal(raw, &event); err != nil {
+			return 0, err
+		}
+		if event.Card.Status == "active" && event.Card.Task.ExecutionState == "running" && event.Card.Task.CheckpointSeq > maximum {
+			maximum = event.Card.Task.CheckpointSeq
+		}
+	}
+	return maximum, rows.Err()
+}
+
+func TestFollowupA01KeepsItsOwnOneShotResult(t *testing.T) {
+	for _, tc := range []struct {
+		filter, authorization, name string
+		allowed                     bool
+	}{
+		{"A01", "approved-20261013", "candidate-extra-a01", true},
+		{"A01", "approved-followup-20261013", "candidate-followup-a01", true},
+		{"A01", "approved-r02-20261013", "candidate-r02-a01", true},
+		{"A01", "approved-r03-20261013", "candidate-r03-a01", true},
+		{"A01", "approved-r04-20261014", "candidate-r04-a01", true},
+		{"A01", "approved-o2-a01-evidence", "candidate-o2-a01-evidence", true},
+		{"A01", "approved-o2-a01-final", "candidate-o2-a01-final", true},
+		{"A02,A04", "approved-r03-20261013", "candidate-remaining", true},
+		{"A01", "", "", false},
+		{"A01", "unknown", "", false},
+		{"A02,A04", "", "candidate-remaining", true},
+	} {
+		name, allowed := checkpointEvalOutputName(tc.filter, tc.authorization)
+		if name != tc.name || allowed != tc.allowed {
+			t.Fatalf("filter=%q authorization=%q: got %q/%v; want %q/%v", tc.filter, tc.authorization, name, allowed, tc.name, tc.allowed)
+		}
+	}
+}
+
+func verifiedCheckpointManifest(t *testing.T) checkpointManifest {
+	t.Helper()
+	path := os.Getenv("WORK_CHECKPOINT_EVAL_OWNERSHIP_MANIFEST")
+	if path == "" {
+		t.Fatal("explicit task-owned process manifest required")
+	}
+	raw, e := os.ReadFile(path)
+	if e != nil {
+		t.Fatal(e)
+	}
+	var m checkpointManifest
+	if json.Unmarshal(raw, &m) != nil {
+		t.Fatal("invalid manifest")
+	}
+	u, e := url.Parse(m.Base)
+	if e != nil || u.Hostname() != "127.0.0.1" || m.Base != os.Getenv("AGENT_EVAL_BASE") || m.PID <= 0 || !filepath.IsAbs(m.DataDir) || !strings.Contains(m.DataDir, "fast-slow-u2-u3-") {
+		t.Fatal("manifest scope mismatch")
+	}
+	if e = syscall.Kill(m.PID, 0); e != nil {
+		t.Fatal("owned process is not live")
+	}
+	actual, e := os.Readlink(fmt.Sprintf("/proc/%d/exe", m.PID))
+	if e != nil || actual != m.Binary {
+		t.Fatal("process executable mismatch")
+	}
+	bytes, e := os.ReadFile(actual)
+	if e != nil {
+		t.Fatal(e)
+	}
+	sum := sha256.Sum256(bytes)
+	if hex.EncodeToString(sum[:]) != m.BinarySHA256 {
+		t.Fatal("binary hash mismatch")
+	}
+	if _, e = os.Stat(filepath.Join(m.DataDir, "agent-system.db")); e != nil {
+		t.Fatal("isolated data missing")
+	}
+	return m
+}
+
+// The batch driver invokes this once per baseline/candidate, using the same
+// three synthetic materials, route and profile. It never resolves a business HITL.
+func TestWorkCheckpoints(t *testing.T) {
+	m := verifiedCheckpointManifest(t)
+	if m.Mode != "model" {
+		t.Fatal("real model evaluation requires model mode")
+	}
+	materials := os.Getenv("AGENT_EVAL_MATERIALS")
+	outDir := os.Getenv("AGENT_EVAL_OUT")
+	if materials == "" || outDir == "" {
+		t.Fatal("explicit external material and evidence directories required")
+	}
+	if e := os.MkdirAll(outDir, 0700); e != nil {
+		t.Fatal(e)
+	}
+	c := &client{base: m.Base, http: &http.Client{Timeout: 30 * time.Second}, t: t}
+	label := os.Getenv("WORK_CHECKPOINT_EVAL_LABEL")
+	if label != "baseline" && label != "candidate" {
+		t.Fatal("fixed baseline/candidate label required")
+	}
+	caseFilter := os.Getenv("WORK_CHECKPOINT_EVAL_CASES")
+	outputName := label
+	if caseFilter != "" {
+		if label != "candidate" {
+			t.Fatal("candidate cases only")
+		}
+		var allowed bool
+		outputName, allowed = checkpointEvalOutputName(caseFilter, os.Getenv("WORK_CHECKPOINT_EXTRA_A01"))
+		if !allowed {
+			t.Fatal("explicitly authorized case selection required")
+		}
+	}
+	if _, err := os.Stat(filepath.Join(outDir, outputName+".json")); err == nil {
+		t.Fatal("sample already exists; do not retry")
+	}
+	all := []map[string]any{}
+	total := 0
+	for _, testCase := range []struct {
+		id, focus string
+		files     []string
+	}{{"A01", "", []string{"需求.txt", "会议.txt", "评审.txt"}}, {"A02", "重点核对预算、外部依赖和交付日期；请保留限制", []string{"需求.txt", "会议.txt", "评审.txt"}}, {"A04", "", []string{"需求.txt", "会议.txt", "扫描.pdf"}}} {
+		if caseFilter != "" && !strings.Contains(caseFilter, testCase.id) {
+			continue
+		}
+		if total >= 120000 {
+			t.Fatal("instance reported token budget exhausted")
+		}
+		var project struct {
+			ID string `json:"id"`
+		}
+		if e := c.do("POST", "/api/projects", map[string]any{"name": "checkpoint-" + label + "-" + testCase.id}, &project); e != nil {
+			t.Fatal(e)
+		}
+		var conv struct {
+			ID string `json:"id"`
+		}
+		if e := c.do("POST", "/api/projects/"+project.ID+"/conversations", map[string]any{"title": testCase.id, "profileId": "checkpoint-eval"}, &conv); e != nil {
+			t.Fatal(e)
+		}
+		ids := []string{}
+		for _, name := range testCase.files {
+			bytes, e := os.ReadFile(filepath.Join(materials, name))
+			if e != nil {
+				t.Fatal(e)
+			}
+			ids = append(ids, c.upload(t, project.ID, name, bytes))
+		}
+		var send map[string]any
+		if e := c.do("POST", "/api/conversations/"+conv.ID+"/messages", map[string]any{"text": testCase.focus, "attachmentIds": ids, "requestId": "checkpoint-" + label + "-" + testCase.id}, &send); e != nil {
+			t.Fatal(e)
+		}
+		deadline := time.Now().Add(300 * time.Second)
+		var snapshot struct {
+			Cards     []core.ActivityCard `json:"cards"`
+			ReplaySeq int64               `json:"replaySeq"`
+		}
+		observations := []map[string]any{}
+		seen := map[string]bool{}
+		for {
+			// Decode into fresh storage: reusing a slice lets JSON overwrite Task
+			// pointers already saved as historical observations.
+			snapshot.Cards = nil
+			if e := c.do("GET", "/api/conversations/"+conv.ID+"/cards", nil, &snapshot); e != nil {
+				t.Fatal(e)
+			}
+			terminal := false
+			for _, card := range snapshot.Cards {
+				if card.Kind != core.CardKindProgress {
+					continue
+				}
+				if card.Task != nil {
+					key := fmt.Sprintf("%s:%d", card.ID, card.Task.Revision)
+					if !seen[key] {
+						seen[key] = true
+						observations = append(observations, map[string]any{"observedAt": time.Now().UTC(), "card": card, "replaySeq": snapshot.ReplaySeq})
+					}
+					terminal = card.Task.Terminal()
+				} else {
+					terminal = card.Status == core.CardDone || card.Status == core.CardFailed
+				}
+			}
+			if terminal {
+				break
+			}
+			if label == "baseline" && time.Until(deadline) < 298*time.Second && len(snapshot.Cards) == 0 {
+				runObj, ok := send["run"].(map[string]any)
+				if ok {
+					var state struct {
+						Run core.Run `json:"run"`
+					}
+					if c.do("GET", "/api/runs/"+fmt.Sprint(runObj["id"]), nil, &state) == nil && state.Run.Status == core.RunCompleted {
+						break
+					}
+				}
+			}
+			if time.Now().After(deadline) {
+				t.Fatalf("%s background did not finish within budget", testCase.id)
+			}
+			time.Sleep(250 * time.Millisecond)
+		}
+		var detail map[string]json.RawMessage
+		if e := c.do("GET", "/api/conversations/"+conv.ID, nil, &detail); e != nil {
+			t.Fatal(e)
+		}
+		var runs []core.Run
+		_ = json.Unmarshal(detail["runs"], &runs)
+		for _, r := range runs {
+			if r.Usage != nil {
+				total += r.Usage.TotalTokens
+			}
+		}
+		record := map[string]any{"case": testCase.id, "projectId": project.ID, "conversationId": conv.ID, "send": send, "observations": observations, "finalCards": snapshot.Cards, "detail": detail, "reportedTokensCumulative": total, "quality": "requires independent comparison against provided materials; quote existence is not semantic proof"}
+		all = append(all, record)
+		raw, _ := json.MarshalIndent(map[string]any{"manifest": m, "label": label, "cases": all, "reportedTokens": total, "noticeModelTurns": "disabled equally in controlled comparison"}, "", "  ")
+		if e := os.WriteFile(filepath.Join(outDir, outputName+".json"), raw, 0600); e != nil {
+			t.Fatal(e)
+		}
+		if label == "candidate" && testCase.id == "A01" {
+			maximum, err := persistedRunningCheckpointMax(filepath.Join(m.DataDir, "agent-system.db"), conv.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if maximum < 2 {
+				t.Fatal("A01 has fewer than two persisted running checkpoints; inspect raw evidence")
+			}
+		}
+		if total > 120000 {
+			t.Fatal("reported instance token target exceeded; no further sample started")
+		}
+	}
+	t.Logf("%s: %d material tasks, cumulative reported tokens=%d; raw quality evidence=%s", label, len(all), total, filepath.Join(outDir, outputName+".json"))
+}
@@ -4,6 +4,7 @@ go 1.27

 require (
 	agent-command v0.0.0
+	agent-document-renderer v0.0.0
 	agent-intent v0.0.0
 	agent-native v0.0.0
 	agent-squad v0.0.0
@@ -26,12 +27,15 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.77.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
@@ -52,3 +56,5 @@ replace error-code-system => ./deps/error-code-system
 replace logging-system => ./deps/logging-system

 replace agent-command => ./deps/agent-command
+
+replace agent-document-renderer => ./deps/agent-document-renderer
@@ -4,6 +4,7 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -25,6 +26,10 @@ github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
 github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/ledongthuc/pdf v0.0.0-20260907135840-6c8c28e0e8a0 h1:7Q+xNAZFmnfYOMweHN3c/PDFUKKfY1pVJ26K++QvVfU=
 github.com/ledongthuc/pdf v0.0.0-20260907135840-6c8c28e0e8a0/go.mod h1:1fEHWurg7pvf5SG6XNE5Q8UZmOwex51Mkx3SLhrW5B4=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
@@ -37,6 +42,8 @@ github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01j
 github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -55,6 +62,8 @@ golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
 golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -0,0 +1,415 @@
+package app
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"sort"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+type accountDirectorySlot struct {
+	mu         sync.RWMutex
+	pluginID   string
+	resolver   extension.AccountDirectoryScopeResolver
+	secret     [32]byte
+	keyVersion int
+}
+
+func newAccountDirectorySlot(st *store.Store) (*accountDirectorySlot, error) {
+	key, err := st.GetAccountCursorKey()
+	if err != nil {
+		return nil, err
+	}
+	return &accountDirectorySlot{secret: key.Secret, keyVersion: key.Version}, nil
+}
+
+func (s *accountDirectorySlot) register(pluginID string, fn extension.AccountDirectoryScopeResolver) error {
+	if fn == nil || pluginID != "rdm" {
+		return store.ErrAccountForbidden
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.resolver != nil {
+		return errors.New("account directory resolver already registered")
+	}
+	s.pluginID, s.resolver = pluginID, fn
+	return nil
+}
+
+type directoryPolicy struct {
+	allowed    map[string]bool
+	match      []string
+	candidates map[string]bool
+	owners     map[string]bool
+	rows       []store.DirectoryAccountRow
+	all        bool
+	status     string
+	version    string
+}
+
+type directoryCursor struct {
+	KeyVersion int    `json:"k"`
+	Version    string `json:"v"`
+	Owner      string `json:"o"`
+	UserID     string `json:"u"`
+}
+
+type directoryVisibleRow struct {
+	UserID  string
+	Owner   string
+	Enabled bool
+	Name    string
+	StaffNo string
+}
+
+func knownDirectoryField(field string) bool {
+	return field == "owner" || field == "name" || field == "staffNo"
+}
+
+func (h inprocHost) directoryPolicy(ctx context.Context, q extension.AccountDirectoryQuery, loadRows bool) (directoryPolicy, error) {
+	var p directoryPolicy
+	if err := h.requireEffective(); err != nil {
+		return p, err
+	}
+	if h.actor == "" || h.caps.st == nil || h.caps.directory == nil || q.SchemaVersion != extension.AccountDirectorySchemaVersion {
+		return p, store.ErrAccountForbidden
+	}
+	actor, err := h.caps.st.GetUserAuthState(h.actor)
+	if err != nil || !actor.Enabled {
+		return p, store.ErrAccountForbidden
+	}
+	if q.Mode != extension.AccountDirectoryModeExact && q.Mode != extension.AccountDirectoryModeFuzzy {
+		return p, store.ErrInvalidAccountProfile
+	}
+	if !utf8.ValidString(q.Query) || utf8.RuneCountInString(q.Query) > 128 {
+		return p, store.ErrInvalidAccountProfile
+	}
+	for _, r := range q.Query {
+		if unicode.IsControl(r) {
+			return p, store.ErrInvalidAccountProfile
+		}
+	}
+	p.status = q.Status
+	if p.status == "" {
+		p.status = "enabled"
+	}
+	if p.status != "enabled" && p.status != "disabled" && p.status != "all" {
+		return p, store.ErrInvalidAccountProfile
+	}
+	var scope extension.AccountDirectoryScope
+	switch q.Purpose {
+	case extension.AccountDirectoryPurposeSystemUsers:
+		if !actor.IsAdmin || q.ProjectID != "" || q.DocumentID != "" {
+			return p, store.ErrAccountForbidden
+		}
+		scope = extension.AccountDirectoryScope{AllowedFields: []string{"owner", "name", "staffNo"},
+			MatchFields: []string{"owner", "name", "staffNo"}, AllCandidates: true, ScopeVersion: "system.users.v1"}
+	case extension.AccountDirectoryPurposeProjectMembers, extension.AccountDirectoryPurposeProjectRoster, extension.AccountDirectoryPurposeDocumentDuties:
+		// project.member-roster is an explicit enumeration of current project
+		// members: only the trusted RDM resolver may name them, every account
+		// status is allowed and an empty query lists the whole roster.
+		roster := q.Purpose == extension.AccountDirectoryPurposeProjectRoster
+		if h.pluginID != "rdm" || q.ProjectID == "" || (q.Purpose == extension.AccountDirectoryPurposeDocumentDuties && q.DocumentID == "") ||
+			(q.Purpose == extension.AccountDirectoryPurposeProjectMembers && q.DocumentID != "") || (roster && q.DocumentID != "") ||
+			(!roster && p.status != "enabled") {
+			return p, store.ErrAccountForbidden
+		}
+		h.caps.directory.mu.RLock()
+		resolver, pluginID := h.caps.directory.resolver, h.caps.directory.pluginID
+		h.caps.directory.mu.RUnlock()
+		if resolver == nil || pluginID != h.pluginID {
+			return p, store.ErrAccountForbidden
+		}
+		scope, err = resolver(ctx, extension.AccountDirectoryScopeRequest{
+			Actor: h.actor, PluginID: h.pluginID, Purpose: q.Purpose, ProjectID: q.ProjectID, DocumentID: q.DocumentID,
+		})
+		if err != nil {
+			return p, store.ErrAccountForbidden
+		}
+		if (q.Purpose == extension.AccountDirectoryPurposeDocumentDuties || roster) && scope.AllCandidates {
+			return p, store.ErrAccountForbidden
+		}
+	default:
+		return p, store.ErrAccountForbidden
+	}
+	if scope.ScopeVersion == "" {
+		return p, store.ErrAccountForbidden
+	}
+	p.allowed = map[string]bool{"owner": true}
+	for _, field := range scope.AllowedFields {
+		if !knownDirectoryField(field) {
+			return p, store.ErrAccountForbidden
+		}
+		p.allowed[field] = true
+	}
+	matchAllowed := map[string]bool{}
+	for _, field := range scope.MatchFields {
+		if !knownDirectoryField(field) || !p.allowed[field] {
+			return p, store.ErrAccountForbidden
+		}
+		matchAllowed[field] = true
+	}
+	requested := q.SearchFields
+	if len(requested) == 0 {
+		requested = []string{"owner", "name"}
+	}
+	for _, field := range requested {
+		if !matchAllowed[field] {
+			return p, store.ErrAccountForbidden
+		}
+		p.match = append(p.match, field)
+	}
+	sort.Strings(p.match)
+	p.candidates = make(map[string]bool, len(scope.CandidateIDs))
+	p.owners = make(map[string]bool, len(scope.CandidateOwners))
+	for _, id := range scope.CandidateIDs {
+		if id == "" {
+			return p, store.ErrAccountForbidden
+		}
+		p.candidates[id] = true
+	}
+	for _, owner := range scope.CandidateOwners {
+		if owner == "" {
+			return p, store.ErrAccountForbidden
+		}
+		p.owners[owner] = true
+	}
+	p.all = scope.AllCandidates
+	if q.Purpose == extension.AccountDirectoryPurposeSystemUsers {
+		p.all = true
+	}
+	visible := make([]directoryVisibleRow, 0)
+	if loadRows {
+		rows, err := h.caps.st.ListDirectoryAccountRows()
+		if err != nil {
+			return p, err
+		}
+		for _, row := range rows {
+			if !directoryRowAllowed(row, p) {
+				continue
+			}
+			p.rows = append(p.rows, row)
+			item := directoryVisibleRow{UserID: row.UserID, Owner: row.Owner, Enabled: row.Enabled}
+			if p.allowed["name"] {
+				item.Name = row.Name
+			}
+			if p.allowed["staffNo"] {
+				item.StaffNo = row.StaffNo
+			}
+			visible = append(visible, item)
+		}
+	}
+	ids := make([]string, 0, len(p.candidates))
+	for id := range p.candidates {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids)
+	owners := make([]string, 0, len(p.owners))
+	for owner := range p.owners {
+		owners = append(owners, owner)
+	}
+	sort.Strings(owners)
+	allowed := make([]string, 0, len(p.allowed))
+	for field := range p.allowed {
+		allowed = append(allowed, field)
+	}
+	sort.Strings(allowed)
+	fingerprint := struct {
+		Actor, Plugin, Purpose, Project, Document, Mode, Query, Status, Scope string
+		Match, Allowed, IDs, Owners                                           []string
+		Visible                                                               []directoryVisibleRow
+		All                                                                   bool
+	}{Actor: h.actor, Plugin: h.pluginID, Purpose: q.Purpose, Project: q.ProjectID, Document: q.DocumentID,
+		Mode: q.Mode, Query: strings.TrimSpace(q.Query), Status: p.status,
+		Scope: scope.ScopeVersion, Match: p.match, Allowed: allowed, IDs: ids, Owners: owners, Visible: visible, All: p.all}
+	encoded, err := json.Marshal(fingerprint)
+	if err != nil {
+		return p, err
+	}
+	digest := sha256.Sum256(encoded)
+	p.version = hex.EncodeToString(digest[:])
+	return p, nil
+}
+
+func (s *accountDirectorySlot) encodeCursor(c directoryCursor) (string, error) {
+	c.KeyVersion = s.keyVersion
+	data, err := json.Marshal(c)
+	if err != nil {
+		return "", err
+	}
+	mac := hmac.New(sha256.New, s.secret[:])
+	_, _ = mac.Write([]byte("iam-directory-cursor-v1\x00"))
+	_, _ = mac.Write(data)
+	return base64.RawURLEncoding.EncodeToString(data) + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil)), nil
+}
+
+func (s *accountDirectorySlot) decodeCursor(token, version string) (directoryCursor, error) {
+	var c directoryCursor
+	payload, signature, found := strings.Cut(token, ".")
+	if !found {
+		return c, store.ErrConflict
+	}
+	data, err := base64.RawURLEncoding.DecodeString(payload)
+	if err != nil || len(data) > 1024 {
+		return c, store.ErrConflict
+	}
+	provided, err := base64.RawURLEncoding.DecodeString(signature)
+	if err != nil {
+		return c, store.ErrConflict
+	}
+	mac := hmac.New(sha256.New, s.secret[:])
+	_, _ = mac.Write([]byte("iam-directory-cursor-v1\x00"))
+	_, _ = mac.Write(data)
+	if !hmac.Equal(provided, mac.Sum(nil)) || json.Unmarshal(data, &c) != nil || c.KeyVersion != s.keyVersion || c.Version != version || c.Owner == "" || c.UserID == "" {
+		return directoryCursor{}, store.ErrConflict
+	}
+	return c, nil
+}
+
+func directoryEntry(row store.DirectoryAccountRow, p directoryPolicy) extension.AccountDirectoryEntry {
+	entry := extension.AccountDirectoryEntry{UserID: row.UserID, Owner: row.Owner, Valid: row.Enabled}
+	if p.allowed["name"] {
+		entry.Name = row.Name
+	}
+	if p.allowed["staffNo"] {
+		entry.StaffNo = row.StaffNo
+	}
+	return entry
+}
+
+func directoryMatches(row store.DirectoryAccountRow, fields []string, mode, query string) bool {
+	for _, field := range fields {
+		value := row.Owner
+		switch field {
+		case "name":
+			value = row.Name
+		case "staffNo":
+			value = row.StaffNo
+		}
+		if mode == extension.AccountDirectoryModeExact && strings.EqualFold(value, query) {
+			return true
+		}
+		if mode == extension.AccountDirectoryModeFuzzy && strings.Contains(strings.ToLower(value), strings.ToLower(query)) {
+			return true
+		}
+	}
+	return false
+}
+
+func directoryRowAllowed(row store.DirectoryAccountRow, p directoryPolicy) bool {
+	if !p.all && !p.candidates[row.UserID] && !p.owners[row.Owner] {
+		return false
+	}
+	return p.status == "all" || (p.status == "enabled" && row.Enabled) || (p.status == "disabled" && !row.Enabled)
+}
+
+func (h inprocHost) QueryAccountDirectory(ctx context.Context, q extension.AccountDirectoryQuery) (extension.AccountDirectoryPage, error) {
+	query := strings.TrimSpace(q.Query)
+	// project.member-roster enumerates the resolved members: an empty query
+	// lists every row inside the scope with normal limit/cursor paging.
+	enumerate := query == "" && q.Purpose == extension.AccountDirectoryPurposeProjectRoster
+	p, err := h.directoryPolicy(ctx, q, query != "" || enumerate)
+	if err != nil {
+		return extension.AccountDirectoryPage{}, err
+	}
+	maxLimit := 50
+	if q.Purpose == extension.AccountDirectoryPurposeSystemUsers {
+		maxLimit = 100
+	}
+	if q.Limit == 0 {
+		q.Limit = 20
+	}
+	if q.Limit < 1 || q.Limit > maxLimit {
+		return extension.AccountDirectoryPage{}, store.ErrInvalidAccountProfile
+	}
+	page := extension.AccountDirectoryPage{Entries: []extension.AccountDirectoryEntry{}, DirectoryVersion: p.version}
+	if query == "" && !enumerate {
+		if q.Cursor != "" {
+			return extension.AccountDirectoryPage{}, store.ErrConflict
+		}
+		return page, nil
+	}
+	if query != "" && q.Mode == extension.AccountDirectoryModeFuzzy && utf8.RuneCountInString(query) < 2 {
+		return extension.AccountDirectoryPage{}, store.ErrInvalidAccountProfile
+	}
+	var after directoryCursor
+	if q.Cursor != "" {
+		after, err = h.caps.directory.decodeCursor(q.Cursor, p.version)
+		if err != nil {
+			return extension.AccountDirectoryPage{}, err
+		}
+	}
+	matched := make([]store.DirectoryAccountRow, 0, q.Limit+1)
+	for _, row := range p.rows {
+		if !enumerate && !directoryMatches(row, p.match, q.Mode, query) {
+			continue
+		}
+		if after.Owner != "" && (row.Owner < after.Owner || (row.Owner == after.Owner && row.UserID <= after.UserID)) {
+			continue
+		}
+		matched = append(matched, row)
+		if len(matched) > q.Limit {
+			break
+		}
+	}
+	more := len(matched) > q.Limit
+	if more {
+		matched = matched[:q.Limit]
+	}
+	for _, row := range matched {
+		page.Entries = append(page.Entries, directoryEntry(row, p))
+	}
+	if more {
+		last := matched[len(matched)-1]
+		page.NextCursor, err = h.caps.directory.encodeCursor(directoryCursor{Version: p.version, Owner: last.Owner, UserID: last.UserID})
+		if err != nil {
+			return extension.AccountDirectoryPage{}, err
+		}
+	}
+	return page, nil
+}
+
+func (h inprocHost) LookupAccountDirectory(ctx context.Context, q extension.AccountDirectoryQuery, userID string) (extension.AccountDirectoryLookup, error) {
+	if userID == "" || q.Cursor != "" {
+		return extension.AccountDirectoryLookup{}, store.ErrInvalidAccountProfile
+	}
+	p, err := h.directoryPolicy(ctx, q, true)
+	if err != nil {
+		return extension.AccountDirectoryLookup{}, err
+	}
+	for _, row := range p.rows {
+		if row.UserID == userID {
+			return extension.AccountDirectoryLookup{Entry: directoryEntry(row, p), DirectoryVersion: p.version}, nil
+		}
+	}
+	return extension.AccountDirectoryLookup{}, store.ErrNotFound
+}
+
+func (h inprocHost) LookupAccountDirectoryOwner(ctx context.Context, q extension.AccountDirectoryQuery, owner string) (extension.AccountDirectoryLookup, error) {
+	if owner == "" || q.Cursor != "" {
+		return extension.AccountDirectoryLookup{}, store.ErrInvalidAccountProfile
+	}
+	p, err := h.directoryPolicy(ctx, q, true)
+	if err != nil {
+		return extension.AccountDirectoryLookup{}, err
+	}
+	for _, row := range p.rows {
+		if row.Owner == owner {
+			return extension.AccountDirectoryLookup{Entry: directoryEntry(row, p), DirectoryVersion: p.version}, nil
+		}
+	}
+	return extension.AccountDirectoryLookup{}, store.ErrNotFound
+}
+
+var _ extension.AccountDirectoryProvider = inprocHost{}
@@ -0,0 +1,317 @@
+package app
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+func openDirectoryTestStore(t *testing.T) *store.Store {
+	t.Helper()
+	dsn := os.Getenv("AGENT_PG_TEST_DSN")
+	if dsn == "" {
+		st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "directory.db"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { st.Close() })
+		return st
+	}
+	admin, err := sql.Open("pgx", dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	schema := "t_" + strings.ToLower(store.NewID("dir"))
+	if _, err := admin.Exec(`CREATE EXTENSION IF NOT EXISTS pg_trgm`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := admin.Exec(`CREATE SCHEMA ` + schema); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = admin.Exec(`DROP SCHEMA IF EXISTS ` + schema + ` CASCADE`)
+		_ = admin.Close()
+	})
+	separator := "?"
+	if strings.Contains(dsn, "?") {
+		separator = "&"
+	}
+	st, err := store.OpenPostgres(dsn+separator+"search_path="+schema+",public", filepath.Join(t.TempDir(), "artifacts"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st
+}
+
+func TestAccountDirectoryAppliesDomainScopeBeforeSearchAndCursor(t *testing.T) {
+	st := openDirectoryTestStore(t)
+	t.Logf("directory provider dialect=%s", st.Dialect())
+	if err := st.CreateAccount("admin", "", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	alice, err := st.CreatePendingAccount("admin", "alice", store.AccountProfile{Name: "同名", StaffNo: "hidden-a"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	bob, err := st.CreatePendingAccount("admin", "bob", store.AccountProfile{Name: "同名", StaffNo: "hidden-b"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	outsider, err := st.CreatePendingAccount("admin", "outsider", store.AccountProfile{Name: "同名", StaffNo: "hidden-x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	slot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st, directory: slot}, pluginID: "rdm", actor: "admin", owner: "admin"}
+	query := extension.AccountDirectoryQuery{SchemaVersion: extension.AccountDirectorySchemaVersion,
+		Purpose: extension.AccountDirectoryPurposeProjectMembers, ProjectID: "project-1",
+		Mode: extension.AccountDirectoryModeFuzzy, Query: "同名", Limit: 1}
+	if _, err := h.QueryAccountDirectory(context.Background(), query); err == nil {
+		t.Fatal("domain directory ran without trusted resolver")
+	}
+	if err := (pluginRegistry{pluginID: "rdm", caps: h.caps}).RegisterAccountDirectoryScopeResolver(func(context.Context, extension.AccountDirectoryScopeRequest) (extension.AccountDirectoryScope, error) {
+		return extension.AccountDirectoryScope{AllowedFields: []string{"owner", "name"}, MatchFields: []string{"owner", "name"},
+			CandidateIDs: []string{alice.ID, bob.ID}, ScopeVersion: "scope-1"}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	page, err := h.QueryAccountDirectory(context.Background(), query)
+	if err != nil || len(page.Entries) != 1 || page.Entries[0].UserID != alice.ID || page.Entries[0].StaffNo != "" || page.NextCursor == "" {
+		t.Fatalf("first scoped page: %+v %v", page, err)
+	}
+	query.Cursor = page.NextCursor
+	otherSlot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	otherSlot.pluginID, otherSlot.resolver = slot.pluginID, slot.resolver
+	otherHost := h
+	otherHost.caps.directory = otherSlot
+	second, err := otherHost.QueryAccountDirectory(context.Background(), query)
+	if err != nil || len(second.Entries) != 1 || second.Entries[0].UserID != bob.ID || second.NextCursor != "" {
+		t.Fatalf("second scoped page on another host: %+v %v", second, err)
+	}
+	query.Cursor = ""
+	query.Query = "hidden-x"
+	if found, err := h.QueryAccountDirectory(context.Background(), query); err != nil || len(found.Entries) != 0 {
+		t.Fatalf("hidden staff number matched: %+v %v", found, err)
+	}
+	query.SearchFields = []string{"staffNo"}
+	if _, err := h.QueryAccountDirectory(context.Background(), query); err == nil {
+		t.Fatal("hidden staff number accepted as search field")
+	}
+	query.SearchFields = nil
+	query.Query = "同名"
+	if hit, err := h.LookupAccountDirectoryOwner(context.Background(), query, "alice"); err != nil || hit.Entry.UserID != alice.ID {
+		t.Fatalf("explicit owner lookup failed to resolve stable ID: %+v %v", hit, err)
+	}
+	if _, err := h.LookupAccountDirectoryOwner(context.Background(), query, "outsider"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("owner lookup leaked outsider: %v", err)
+	}
+	if _, err := h.LookupAccountDirectory(context.Background(), query, "not-in-scope"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("exact lookup leaked outsider: %v", err)
+	}
+	page, err = h.QueryAccountDirectory(context.Background(), query)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.PatchAccountProfile("admin", alice.ID, alice.ProfileVersion, map[string]string{"phone": "private-edit"}); err != nil {
+		t.Fatal(err)
+	}
+	query.Cursor = page.NextCursor
+	if _, err := h.QueryAccountDirectory(context.Background(), query); err != nil {
+		t.Fatalf("private edit invalidated candidate cursor: %v", err)
+	}
+	if _, err := st.PatchAccountProfile("admin", alice.ID, alice.ProfileVersion+1, map[string]string{"staffNo": "still-hidden"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.QueryAccountDirectory(context.Background(), query); err != nil {
+		t.Fatalf("unavailable field invalidated candidate cursor: %v", err)
+	}
+	if _, err := st.PatchAccountProfile("admin", outsider.ID, outsider.ProfileVersion, map[string]string{"name": "out-of-scope-change"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.QueryAccountDirectory(context.Background(), query); err != nil {
+		t.Fatalf("out-of-scope edit invalidated candidate cursor: %v", err)
+	}
+	if _, err := st.PatchAccountProfile("admin", alice.ID, alice.ProfileVersion+2, map[string]string{"name": "changed"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.QueryAccountDirectory(context.Background(), query); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("visible edit did not invalidate cursor: %v", err)
+	}
+}
+
+// project.member-roster：可信 RDM 解析方点名的项目成员清单。空 query 枚举作用域内
+// 全部行（含已停用账号），limit/游标翻页照旧；非 rdm 插件、带 documentId、
+// AllCandidates 解析结果一律拒绝；member-candidate 的空 query 仍是空页。
+func TestAccountDirectoryProjectRosterEnumeratesResolvedMembers(t *testing.T) {
+	st := openDirectoryTestStore(t)
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	alice, err := st.CreatePendingAccount("admin", "alice", store.AccountProfile{Name: "阿丽", StaffNo: "hidden-a"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	bob, err := st.CreatePendingAccount("admin", "bob", store.AccountProfile{Name: "小博", StaffNo: "hidden-b"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.CreatePendingAccount("admin", "outsider", store.AccountProfile{Name: "局外人", StaffNo: "hidden-x"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetAccountEnabled("admin", bob.ID, bob.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	var requests []extension.AccountDirectoryScopeRequest
+	resolver := func(_ context.Context, req extension.AccountDirectoryScopeRequest) (extension.AccountDirectoryScope, error) {
+		requests = append(requests, req)
+		return extension.AccountDirectoryScope{AllowedFields: []string{"owner", "name"}, MatchFields: []string{"owner", "name"},
+			CandidateOwners: []string{alice.Owner, bob.Owner}, ScopeVersion: "roster-1"}, nil
+	}
+	slot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	slot.pluginID, slot.resolver = "rdm", resolver
+	h := inprocHost{caps: hostcaps{st: st, directory: slot}, pluginID: "rdm", actor: "admin", owner: "admin"}
+	roster := extension.AccountDirectoryQuery{SchemaVersion: extension.AccountDirectorySchemaVersion,
+		Purpose: extension.AccountDirectoryPurposeProjectRoster, ProjectID: "project-1",
+		Mode: extension.AccountDirectoryModeFuzzy, Status: "all"}
+	page, err := h.QueryAccountDirectory(context.Background(), roster)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page.Entries) != 2 || page.NextCursor != "" {
+		t.Fatalf("roster page=%+v", page)
+	}
+	if page.Entries[0] != (extension.AccountDirectoryEntry{UserID: alice.ID, Owner: "alice", Name: "阿丽", Valid: true}) ||
+		page.Entries[1] != (extension.AccountDirectoryEntry{UserID: bob.ID, Owner: "bob", Name: "小博", Valid: false}) {
+		t.Fatalf("roster entries=%+v", page.Entries)
+	}
+	if len(requests) != 1 || requests[0].Purpose != extension.AccountDirectoryPurposeProjectRoster ||
+		requests[0].ProjectID != "project-1" || requests[0].DocumentID != "" || requests[0].Actor != "admin" {
+		t.Fatalf("resolver requests=%+v", requests)
+	}
+	// 游标翻页：同一签名游标，limit 1 两页走完。
+	roster.Limit = 1
+	first, err := h.QueryAccountDirectory(context.Background(), roster)
+	if err != nil || len(first.Entries) != 1 || first.Entries[0].UserID != alice.ID || first.NextCursor == "" {
+		t.Fatalf("roster first page=%+v %v", first, err)
+	}
+	roster.Cursor = first.NextCursor
+	second, err := h.QueryAccountDirectory(context.Background(), roster)
+	if err != nil || len(second.Entries) != 1 || second.Entries[0].UserID != bob.ID || second.NextCursor != "" {
+		t.Fatalf("roster second page=%+v %v", second, err)
+	}
+	roster.Cursor, roster.Limit = "", 0
+	// 非检索目的的空 query 依旧空页：member-candidate 行为不变。
+	roster.Purpose, roster.Status = extension.AccountDirectoryPurposeProjectMembers, "enabled"
+	if page, err := h.QueryAccountDirectory(context.Background(), roster); err != nil || len(page.Entries) != 0 {
+		t.Fatalf("member candidate empty query=%+v %v", page, err)
+	}
+	roster.Purpose = extension.AccountDirectoryPurposeProjectRoster
+	// 非 rdm 插件、documentId 限定、全量作用域解析结果：均拒绝。
+	other := h
+	other.pluginID = "genui"
+	if _, err := other.QueryAccountDirectory(context.Background(), roster); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("non-rdm roster: %v", err)
+	}
+	withDocument := roster
+	withDocument.DocumentID = "doc-1"
+	if _, err := h.QueryAccountDirectory(context.Background(), withDocument); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("document roster: %v", err)
+	}
+	wideSlot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wideSlot.pluginID, wideSlot.resolver = "rdm", func(context.Context, extension.AccountDirectoryScopeRequest) (extension.AccountDirectoryScope, error) {
+		return extension.AccountDirectoryScope{AllowedFields: []string{"owner", "name"}, MatchFields: []string{"owner", "name"},
+			AllCandidates: true, ScopeVersion: "roster-wide"}, nil
+	}
+	wide := h
+	wide.caps.directory = wideSlot
+	if _, err := wide.QueryAccountDirectory(context.Background(), roster); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("all-candidate roster: %v", err)
+	}
+}
+
+func TestPGDirectoryCursorContinuesInAnotherProcess(t *testing.T) {
+	baseDSN := os.Getenv("AGENT_PG_TEST_DSN")
+	if baseDSN == "" {
+		t.Skip("isolated PostgreSQL test DSN required")
+	}
+	if os.Getenv("IAM_U3_DIRECTORY_CHILD") == "1" {
+		schema := os.Getenv("IAM_U3_DIRECTORY_SCHEMA")
+		separator := "?"
+		if strings.Contains(baseDSN, "?") {
+			separator = "&"
+		}
+		st, err := store.OpenExistingPostgres(baseDSN+separator+"search_path="+schema+",public", filepath.Join(t.TempDir(), "artifacts"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer st.Close()
+		slot, err := newAccountDirectorySlot(st)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h := inprocHost{caps: hostcaps{st: st, directory: slot}, actor: "admin", owner: "admin"}
+		q := extension.AccountDirectoryQuery{SchemaVersion: extension.AccountDirectorySchemaVersion,
+			Purpose: extension.AccountDirectoryPurposeSystemUsers, Mode: extension.AccountDirectoryModeFuzzy,
+			Query: "same", Limit: 1, Cursor: os.Getenv("IAM_U3_DIRECTORY_CURSOR")}
+		page, err := h.QueryAccountDirectory(context.Background(), q)
+		if err != nil || len(page.Entries) != 1 || page.Entries[0].Owner != "beta" {
+			t.Fatalf("cross-process page: %+v %v", page, err)
+		}
+		return
+	}
+	st := openDirectoryTestStore(t)
+	if err := st.EnsureSystemIdentity("u3-directory-cross-process", "pg"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	for _, owner := range []string{"alpha", "beta"} {
+		if _, err := st.CreatePendingAccount("admin", owner, store.AccountProfile{Name: "same"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	slot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st, directory: slot}, actor: "admin", owner: "admin"}
+	q := extension.AccountDirectoryQuery{SchemaVersion: extension.AccountDirectorySchemaVersion,
+		Purpose: extension.AccountDirectoryPurposeSystemUsers, Mode: extension.AccountDirectoryModeFuzzy,
+		Query: "same", Limit: 1}
+	page, err := h.QueryAccountDirectory(context.Background(), q)
+	if err != nil || len(page.Entries) != 1 || page.Entries[0].Owner != "alpha" || page.NextCursor == "" {
+		t.Fatalf("initial page: %+v %v", page, err)
+	}
+	var schema string
+	if err := st.DB().QueryRow(`SELECT current_schema()`).Scan(&schema); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command(os.Args[0], "-test.run=^TestPGDirectoryCursorContinuesInAnotherProcess$")
+	cmd.Env = append(os.Environ(), "IAM_U3_DIRECTORY_CHILD=1", "IAM_U3_DIRECTORY_SCHEMA="+schema,
+		"IAM_U3_DIRECTORY_CURSOR="+page.NextCursor)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("cross-process cursor failed: %v: %s", err, strings.ReplaceAll(string(out), baseDSN, "[REDACTED]"))
+	}
+}
@@ -0,0 +1,24 @@
+package app
+
+import (
+	"context"
+	"errors"
+
+	"agent-system-backend/internal/store"
+)
+
+// accountEffectiveAuthorization is shared by runmgr and in-process Host
+// capabilities. The implicit local singleton is the only auth-off missing-row
+// exception; an existing disabled local account remains denied.
+func accountEffectiveAuthorization(st *store.Store, authOn bool) func(context.Context, string) (bool, error) {
+	return func(_ context.Context, owner string) (bool, error) {
+		account, err := st.GetAccountByOwner(owner)
+		if errors.Is(err, store.ErrNotFound) && !authOn && owner == store.OwnerDefault {
+			return true, nil
+		}
+		if err != nil {
+			return false, err
+		}
+		return account.Enabled, nil
+	}
+}
@@ -0,0 +1,117 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+)
+
+func TestInprocHostRechecksEffectiveAccountOnEveryCapability(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/host.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.CreateAccount("alice", "", "", false); err != nil {
+		t.Fatal(err)
+	}
+	check := accountEffectiveAuthorization(st, true)
+	h := inprocHost{caps: hostcaps{st: st, accountGuard: func(owner string) error {
+		valid, err := check(context.Background(), owner)
+		if err != nil {
+			return err
+		}
+		if !valid {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	}}, owner: "alice", actor: "alice", pluginID: "rdm"}
+	if err := h.KVPut("before", "allowed"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.DB().Exec(`UPDATE users SET enabled=FALSE WHERE owner=?`, "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.KVPut("after", "denied"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host wrote KV: %v", err)
+	}
+	if _, _, err := h.KVGet("before"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host read KV: %v", err)
+	}
+	if _, err := h.TaskCreate("test", "denied", ""); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host created task: %v", err)
+	}
+	if _, err := h.ProjectNameAvailable("denied", ""); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host used project capability: %v", err)
+	}
+	if err := h.Audit("action", "target", ""); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host wrote audit: %v", err)
+	}
+	if _, err := h.Complete(context.Background(), "denied"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host reached model completion: %v", err)
+	}
+	if _, err := h.KnowledgeSearch(context.Background(), "", "denied", 1); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled host read knowledge: %v", err)
+	}
+}
+
+func TestHostCompletionChecksAgainAfterModelSettingsRead(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/host-complete.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	requests := 0
+	model := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		requests++
+		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"late"}}]}`))
+	}))
+	defer model.Close()
+	set := settings.NewService(st)
+	set.SetSystemOverride(map[string]any{"models": map[string]any{"chat": map[string]any{"model": "test", "baseUrl": model.URL}}})
+	checks := 0
+	h := inprocHost{caps: hostcaps{st: st, set: set, accountGuard: func(string) error {
+		checks++
+		if checks >= 3 {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	}}, owner: "alice", actor: "alice", pluginID: "rdm"}
+	if _, err := h.Complete(context.Background(), "late"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("completion after disable: %v", err)
+	}
+	if checks != 3 || requests != 0 {
+		t.Fatalf("late completion reached model: checks=%d requests=%d", checks, requests)
+	}
+}
+
+func TestImplicitLocalAccountExceptionIsAuthOffOnly(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/local.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	allowed, err := accountEffectiveAuthorization(st, false)(context.Background(), store.OwnerDefault)
+	if err != nil || !allowed {
+		t.Fatalf("implicit local denied: %v %v", allowed, err)
+	}
+	allowed, err = accountEffectiveAuthorization(st, true)(context.Background(), store.OwnerDefault)
+	if !errors.Is(err, store.ErrNotFound) || allowed {
+		t.Fatalf("auth-on missing account allowed: %v %v", allowed, err)
+	}
+	if err := st.EnsureUser(store.OwnerDefault, ""); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.DB().Exec(`UPDATE users SET enabled=FALSE WHERE owner=?`, store.OwnerDefault); err != nil {
+		t.Fatal(err)
+	}
+	allowed, err = accountEffectiveAuthorization(st, false)(context.Background(), store.OwnerDefault)
+	if err != nil || allowed {
+		t.Fatalf("disabled existing local account allowed: %v %v", allowed, err)
+	}
+}
@@ -16,11 +16,20 @@ func TestInprocHostListAccounts(t *testing.T) {
 	}
 	t.Cleanup(func() { st.Close() })
 	for _, o := range []string{"carol", "alice", "bob", "dave"} {
+		if err := st.EnsureUser(o, ""); err != nil {
+			t.Fatal(err)
+		}
 		if _, err := st.CreateAPIKey(o, "e2e"); err != nil {
 			t.Fatal(err)
 		}
 	}
-	h := inprocHost{caps: hostcaps{st: st}}
+	if _, err := st.DB().Exec(`UPDATE users SET is_admin=TRUE WHERE owner='alice'`); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, owner: "alice", actor: "alice"}
+	if _, _, err := (inprocHost{caps: hostcaps{st: st}}).ListAccounts("", 2); err == nil {
+		t.Fatal("legacy directory allowed a host without a trusted dispatch actor")
+	}

 	// 首页（limit=2）：alice/bob，next=bob。
 	page, next, err := h.ListAccounts("", 2)
@@ -50,6 +59,12 @@ func TestInprocHostListAccounts(t *testing.T) {
 	if _, _, err := h.ListAccounts("", 999); err != nil {
 		t.Fatalf("limit 超限应钳制不报错: %v", err)
 	}
+	if _, err := st.DB().Exec(`UPDATE users SET enabled=FALSE WHERE owner='alice'`); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := h.ListAccounts("", 2); err == nil {
+		t.Fatal("disabled administrator retained legacy directory access")
+	}
 }

 // TestInprocHostSearchAccounts：EXT-19 扩展 SearchAccounts——账号/姓名子串
@@ -65,7 +80,7 @@ func TestInprocHostSearchAccounts(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := st.CreateAccount("alice", "王小明", hash, false); err != nil {
+	if err := st.CreateAccount("alice", "王小明", hash, true); err != nil {
 		t.Fatal(err)
 	}
 	if err := st.CreateAccount("bob", "李大明", hash, false); err != nil {
@@ -74,7 +89,10 @@ func TestInprocHostSearchAccounts(t *testing.T) {
 	if err := st.CreateAccount("carol", "", hash, false); err != nil {
 		t.Fatal(err)
 	}
-	h := inprocHost{caps: hostcaps{st: st}}
+	h := inprocHost{caps: hostcaps{st: st}, owner: "alice", actor: "alice"}
+	if _, err := (inprocHost{caps: hostcaps{st: st}, owner: "bob", actor: "bob"}).SearchAccounts("alice", 50); err == nil {
+		t.Fatal("ordinary actor gained legacy system directory search")
+	}

 	// 姓名子串（同名区分场景）：两个"大明/小明"都以"明"命中。
 	got, err := h.SearchAccounts("明", 50)
@@ -0,0 +1,58 @@
+package app
+
+import (
+	"agent-system-backend/internal/store"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestAccountMaintenanceDefaultsToNonCreatingOpen(t *testing.T) {
+	t.Setenv("AGENT_SYSTEM_DSN", "")
+	for _, tc := range []struct {
+		name string
+		run  func(string) error
+	}{
+		{"user", func(dir string) error {
+			_, _, err := CreateUserAccount("", dir, "ada", "Ada", "", false, false, false)
+			return err
+		}},
+		{"apikey", func(dir string) error {
+			_, err := CreateAPIKey("", dir, "ada", "test")
+			return err
+		}},
+		{"identity verify", func(dir string) error {
+			_, err := VerifySystemIdentity("", dir, "fixture", "sqlite")
+			return err
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := filepath.Join(t.TempDir(), "absent")
+			if err := tc.run(dir); err == nil {
+				t.Error("maintenance created a missing database")
+			}
+			if _, err := os.Stat(dir); !os.IsNotExist(err) {
+				t.Error("failed maintenance created a directory")
+			}
+		})
+	}
+}
+func TestAccountMaintenanceCannotImplicitlyMigrate(t *testing.T) {
+	t.Setenv("AGENT_SYSTEM_DSN", "")
+	dir := t.TempDir()
+	st, err := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.EnsureSystemIdentity("test", "sqlite"); err != nil {
+		t.Fatal(err)
+	}
+	// Roll back the newest additive migration in this private fixture only.
+	if err := st.MigrateDown(store.SchemaTarget() - 1); err != nil {
+		t.Fatal(err)
+	}
+	st.Close()
+	if _, _, err := CreateUserAccount("", dir, "ada", "Ada", "", false, false, false); err == nil {
+		t.Error("account command implicitly migrated an older schema")
+	}
+}
@@ -5,6 +5,7 @@ package app
 import (
 	"context"
 	"crypto/rand"
+	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -30,7 +31,6 @@ import (
 	"agent-native/runtime/telemetry"
 	agenttools "agent-native/runtime/tools"
 	nativeadp "agent-squad/adapters/native"
-	"agent-system-backend/internal/blobstore"
 	"agent-system-backend/internal/bus"
 	"agent-system-backend/internal/cardsvc"
 	"agent-system-backend/internal/cmdbus"
@@ -60,16 +60,17 @@ import (
 )

 type Options struct {
-	Addr           string
-	DataDir        string
-	PluginsDir     string
-	ForceMock      bool
-	StorageDSN     string // 空 = 嵌入式 SQLite 档；非空 = PostgreSQL 档（多用户/多实例）
-	ArtifactsDir   string // PG 档工件对象目录（空 = <DataDir>/artifacts）
-	AuthMode       string // auto（默认：PG 档开、嵌入式关）| on | off
-	InstanceID     string // 空 = 主机名:监听地址；写入 runs.instance_id，启动对账只收口本实例
-	InsecureListen bool
-	AllowedHosts   []string
+	Addr                  string
+	DataDir               string
+	PluginsDir            string
+	ForceMock             bool
+	StorageDSN            string // 空 = 嵌入式 SQLite 档；非空 = PostgreSQL 档（多用户/多实例）
+	ArtifactsDir          string // PG 档工件对象目录（空 = <DataDir>/artifacts）
+	AuthMode              string // auto（默认：PG 档开、嵌入式关）| on | off
+	RequireProjectContext bool
+	InstanceID            string // 空 = 主机名:监听地址；写入 runs.instance_id，启动对账只收口本实例
+	InsecureListen        bool
+	AllowedHosts          []string
 	// DisableUploadIndexing EXT-9：true 时上传端点不自动写检索索引（发布决定
 	// 移交下游命令层）；零值=false=现状。由 link 层自 extension.Options 透传。
 	DisableUploadIndexing bool
@@ -86,6 +87,9 @@ type Options struct {
 	// ExecDepsDir sandbox 档只读依赖层（site-packages 等，空=不挂）：修复
 	// --tmpfs /home 遮蔽 ~/.local 导致交付物生成链路不可用（F3）。
 	ExecDepsDir string
+	// ExecEnvRoot 分层 Python 环境根（解释器、基础层、扩展层、白名单）。
+	// 设置后，未显式给出 ExecDepsDir 时使用其中的 current 基础层。
+	ExecEnvRoot string
 	// ExecWorkspace = "overlay" 时 sandbox 档启用 S0 工作区（冻结基底+私有
 	// upper+CAS 回收）；空 = EXT-16 现状直写会话目录。
 	ExecWorkspace string
@@ -94,6 +98,11 @@ type Options struct {
 	Tier string
 	// PGPool PG 连接预算（KTD12；零值走默认）。仅 PG 档生效。
 	PGPool store.PoolOptions
+	// AdoptInstanceGuard 在数据库被替换或锁文件被重建后，显式重写守卫记录。
+	AdoptInstanceGuard bool
+	// SuperAdmin 启动期超级管理员凭据（R1）：开启认证时必填且启动即引导；
+	// 口令只留在进程内存，不落库、不进日志。
+	SuperAdmin config.SuperAdmin
 }

 // instanceTag 稳定执行身份：tier=team 时强制 host:addr（多实例互异），
@@ -172,48 +181,16 @@ func Run(opt Options) error {
 	if opt.InsecureListen && !config.IsLoopbackListen(opt.Addr) && !resolved.AuthEnabled() {
 		log.Printf("warning: listening on %s without authentication because insecureListen is set", opt.Addr)
 	}
-	var st *store.Store
-	var err error
-	if opt.StorageDSN != "" {
-		artifacts := opt.ArtifactsDir
-		if artifacts == "" {
-			artifacts = filepath.Join(opt.DataDir, "artifacts")
-		}
-		// 共享工件（U5/KTD9）：配置了 S3 兼容对象存储时注入（多实例共享）；
-		// 未配置回落本地目录（单实例/共享卷）。凭据只经环境（不入库不入报告）。
-		blobs, berr := blobstore.NewS3FromEnv()
-		if berr != nil {
-			return fmt.Errorf("blobstore s3: %w", berr)
-		}
-		if blobs != nil {
-			log.Printf("artifacts: shared via S3-compatible object storage (prefix %q)", blobs.Prefix)
-		}
-		st, err = store.OpenPostgresWithOptions(opt.StorageDSN, artifacts, opt.PGPool, blobs)
-		if err != nil && opt.Tier == "team" {
-			// team 档拒绝就绪（R2）：PG 故障不回落 SQLite，错误必须明说。
-			return fmt.Errorf("team 档打开 PostgreSQL 失败，拒绝就绪（不回落 SQLite）: %w", err)
-		}
-	} else {
-		st, err = store.OpenSQLite(filepath.Join(opt.DataDir, "agent-system.db"))
+	if err := ValidateSuperAdmin(resolved.AuthEnabled(), opt.SuperAdmin); err != nil {
+		return err
 	}
+	st, releaseStore, err := openServiceStore(opt)
 	if err != nil {
-		return fmt.Errorf("open store: %w", err)
+		return err
 	}
-	defer st.Close()
-	// U1 I3：svc 注入的服务实例身份（manifest.instance_id）与库内 marker 对齐；
-	// 未设置则跳过（兼容未接线旧调用方）。与 --instance（runs 进程标识）无关。
-	if sysID := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_INSTANCE_ID")); sysID != "" {
-		dbref := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_DBREF"))
-		if dbref == "" {
-			if opt.StorageDSN != "" {
-				dbref = "pg"
-			} else {
-				dbref = "sqlite"
-			}
-		}
-		if err := st.VerifySystemIdentity(sysID, dbref); err != nil {
-			return fmt.Errorf("system identity: %w", err)
-		}
+	defer releaseStore()
+	if err := BootstrapSuperAdmin(st, resolved.AuthEnabled(), opt.SuperAdmin); err != nil {
+		return err
 	}
 	pool := st.Pool()
 	if versions, verr := st.MigrationStatus(); verr == nil {
@@ -249,9 +226,17 @@ func Run(opt Options) error {
 	if tools.ExecBackendName() == "sandbox" {
 		log.Printf("exec tools: backend=sandbox (bwrap: no network, ro root, session-only writes, proc limit)")
 	}
+	broker, err := wireExecEnv(st, &opt)
+	if err != nil {
+		return fmt.Errorf("exec env: %w", err)
+	}
 	if opt.ExecDepsDir != "" {
 		tools.SetExecDepsDir(opt.ExecDepsDir)
 		log.Printf("exec tools: sandbox deps layer=%s", opt.ExecDepsDir)
+		if err := tools.ExecDoctor(); err != nil {
+			return fmt.Errorf("exec doctor: %w", err)
+		}
+		log.Printf("exec tools: doctor ok (docx/openpyxl/pptx)")
 	}
 	if opt.ExecWorkspace == "overlay" {
 		tools.SetWorkspaceOverlay(true)
@@ -292,16 +277,19 @@ func Run(opt Options) error {
 	if err := setSvc.SnapshotAndMigrateSecrets(); err != nil {
 		return fmt.Errorf("migrate secrets: %w", err)
 	}
-	runtime.SecretLookup = func(owner, service string) (string, bool) {
+	runtime.SecretLookup = func(owner, service string) (string, string, bool) {
 		if owner == "" {
 			owner = store.OwnerDefault
 		}
 		if v, ok := st.ActiveSecret(owner, service); ok {
-			return v, true
+			return v, "owner", true
 		}
 		// P2 受管：密钥统一迁入 secrets 表后，系统层受管密钥挂在系统行
 		//（owner=settings.OwnerSystemRow）；租户未单独配置时回退系统密钥。
-		return st.ActiveSecret(settings.OwnerSystemRow, service)
+		if v, ok := st.ActiveSecret(settings.OwnerSystemRow, service); ok {
+			return v, "system", true
+		}
+		return "", "", false
 	}
 	rag.SecretLookup = func(service, fallback string) string {
 		return runtime.LookupSecret(store.OwnerDefault, service, fallback)
@@ -311,11 +299,7 @@ func Run(opt Options) error {
 	// 未配置时调用返回明确的「未配置」提示，不静默降级为空结果。
 	if err := tools.RegisterLazySearchTools(reg, func() agenttools.SearchProvider {
 		effNow := setSvc.Effective(store.OwnerDefault, "")
-		tavilyNow := effNow.GetString("tools.tavily.apiKeys", "")
-		if active, ok := st.ActiveSecret(store.OwnerDefault, "tools.tavily"); ok {
-			tavilyNow = active
-		}
-		keys := splitKeyPool(tavilyNow)
+		keys := tavilyKeyPool(st, effNow.GetString("tools.tavily.apiKeys", ""))
 		if len(keys) == 0 {
 			return nil
 		}
@@ -380,11 +364,8 @@ func Run(opt Options) error {
 				return nil
 			},
 		}
-		tavilyNow := effNow.GetString("tools.tavily.apiKeys", "")
-		if active, ok := st.ActiveSecret(store.OwnerDefault, "tools.tavily"); ok {
-			tavilyNow = active
-		}
-		if keys := splitKeyPool(tavilyNow); len(keys) > 0 {
+		cfg.Stream = runtime.GuardProjectStream(rc, "", cfg.Client.Stream)
+		if keys := tavilyKeyPool(st, effNow.GetString("tools.tavily.apiKeys", "")); len(keys) > 0 {
 			cfg.Search = agenttools.NewTavilyProvider(effNow.GetString("tools.tavily.endpoint", ""), keys)
 		}
 		if effNow.GetBool("runtime.exec", true) {
@@ -400,7 +381,17 @@ func Run(opt Options) error {
 		if mgr := mcpManagerFor(rawMCP, strings.TrimSpace(effNow.GetString("tools.mcp.overrides", ""))); mgr != nil {
 			cfg.MCP = mgr
 		}
-		cfg.CodeOrchestration = effNow.GetBool("runtime.codeOrchestration", false)
+		// Native squad tools do not yet expose a fail-closed result hook to the
+		// project observation outbox. Project runs therefore use the audited
+		// runCtx retrieval/tool path only; enabling these direct providers would
+		// let their results reach the next model turn without source analysis.
+		if rc.Run().ProjectID != "" {
+			cfg.Search = nil
+			cfg.Exec = nil
+			cfg.Fetch = nil
+			cfg.MCP = nil
+		}
+		cfg.CodeOrchestration = rc.Run().ProjectID == "" && effNow.GetBool("runtime.codeOrchestration", false)
 		if ask, ok := rc.(interface {
 			AskUser(card core.HITLCard) (core.HITLResponse, error)
 		}); ok {
@@ -450,6 +441,18 @@ func Run(opt Options) error {
 	subRunner := &runtime.SubLLMRunner{Prompts: promptSvc, Trace: traceFn}
 	mockRunner := &runtime.MockRunner{}
 	mgr := runmgr.New(st, b, reg, profSvc, setSvc, convRunner, subRunner, mockRunner, &runtime.MockSubagent{})
+	if broker != nil {
+		mgr.SetExecEnvDecider(func(actor, id string, allow, isolate bool) (string, error) {
+			out, err := broker.Decide(context.Background(), id, actor, false, allow, isolate)
+			if err != nil {
+				return "", err
+			}
+			return out.Detail, nil
+		})
+	}
+	authOn := resolved.AuthEnabled()
+	effectiveAccount := accountEffectiveAuthorization(st, authOn)
+	mgr.SetAccountEffectiveAuthorization(effectiveAccount, !authOn)
 	instanceID := opt.InstanceID
 	if instanceID == "" {
 		host, err := os.Hostname()
@@ -460,11 +463,6 @@ func Run(opt Options) error {
 	}
 	st.SetInstanceID(instanceID)
 	mgr.SetInstanceID(instanceID)
-	if err := mgr.ReconcileInterrupted(); err != nil {
-		return fmt.Errorf("reconcile interrupted runs: %w", err)
-	}
-	// 后台子代理通知重启重投（N2 WP5）：未投递结果装回队列并按空闲语义投递。
-	mgr.LoadPendingNotices()
 	mgr.SetSquadRunner(&runtime.SquadRunner{})

 	// 意图闸门：插件意图 overlay → agent-intent 注册表（未装载意图 = 行为回退）。
@@ -523,15 +521,15 @@ func Run(opt Options) error {
 	}
 	// fs 预留能力沙箱根：<DataDir>/workspaces/<owner>/<conversationID>/。
 	mgr.SetWorkspaceRoot(filepath.Join(opt.DataDir, "workspaces"))
-	// 中断子代理续跑（N2 WP5）：依赖转录目录（workspaceRoot）与派生请求。
-	mgr.ResumeInterruptedChildren()

 	// 收件箱任务卡：事件走会话事件管道（持久化/seq/重放）；关闭即 T0 基线。
 	cardSvc := cardsvc.New(st, mgr.EmitCardEvent)
+	cardSvc.SetAccountCheckedEmitter(mgr.EmitCardEventAccountChecked)
 	cardSvc.SetProjectSharedEmitter(mgr.EmitProjectSharedCardEvent)
 	surfaceSvc := surfacesvc.New(st, mgr.EmitCardEvent)
+	surfaceSvc.SetAccountCheckedEmitter(mgr.EmitCardEventAccountChecked)
 	go func() { // 启动恢复：重发「快照已落盘、事件未发出」的待恢复投影（KTD）。
-		if n, err := surfaceSvc.RecoverPendingEvents(context.Background()); err == nil && n > 0 {
+		if n, err := surfaceSvc.RecoverPendingEventsAccountChecked(context.Background(), !authOn); err == nil && n > 0 {
 			log.Printf("surface: recovered %d pending events", n)
 		}
 	}()
@@ -539,8 +537,6 @@ func Run(opt Options) error {
 	// 执行身份与命令消费（协作存储 U5）：PG 档启动跨实例命令轮询；
 	// SQLite 本地档无跨实例命令（StartCommandConsumer 自行短路）。
 	mgr.SetInstanceTag(instanceTag(opt), opt.Addr)
-	stopCommands := mgr.StartCommandConsumer(context.Background())
-	defer stopCommands()
 	// 执行预算（协作存储 U3，R8）：runtime.execBudgetGlobal / runtime.execBudgetPerUser
 	// 全零=不限（本地档默认，行为不变）；开启后执行许可共享账本生效，
 	// 待执行队列上限 runtime.execQueueMax（默认 200，容量合同数值待 U7 实测调整）。
@@ -554,20 +550,21 @@ func Run(opt Options) error {

 	// 命令总线（提案 T3/D27/D30）：四入口同源分发 + 审计 + 危险内联确认卡。
 	bus := cmdbus.New(st, cardSvc, func() time.Time { return time.Now().UTC() })
+	bus.SetEffectiveAccountGuard(func(ctx context.Context, actor string) error {
+		valid, err := effectiveAccount(ctx, actor)
+		if err != nil {
+			return err
+		}
+		if !valid {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	})
+	bus.RequireAccountCheckedWrites(!authOn)
 	// U5：页面动作分发口——surfacesvc.SubmitAction 经命令总线四入口同源分发
 	//（审计信封、参数校验、DangerHigh 内联确认卡全复用；Confirmed 不透传）。
 	surfaceSvc.SetDispatcher(func(ctx context.Context, d surfacesvc.ActionDispatch) (surfacesvc.ActionOutcome, error) {
-		resp := bus.Dispatch(ctx, cmdbus.Request{ID: d.CommandID, Params: d.Params,
-			Entrance: "button", Owner: d.Owner, ConversationID: d.ConversationID})
-		state := "committed"
-		if resp.Receipt.State != "" {
-			state = string(resp.Receipt.State)
-		}
-		cardID := ""
-		if resp.Card != nil {
-			cardID = string(resp.Card.ID)
-		}
-		return surfacesvc.ActionOutcome{State: state, CardID: cardID, Receipt: resp.Receipt, Payload: resp.Payload}, nil
+		return dispatchSurfaceAction(ctx, bus, d)
 	})
 	// U3：generative-ui 工具注入闸——activation 台账关闭时命令不投影给该 owner
 	// 的模型（禁用即不注入能力；执行端守卫仍在 surfacesvc）。
@@ -595,9 +592,60 @@ func Run(opt Options) error {
 	bus.SetPendingStore(st)
 	pluginHost.OnCommands = bus.RegisterPluginCommands
 	// hostcaps：hostapi 闭包与进程内插件句柄共用的 owner 作用域能力（EXT-1 批注 1）。
-	authzSlot := &projectAuthz{}
+	authzSlot := &projectAuthz{enrich: func(q extension.ResourceAuthzQuery) (extension.ResourceAuthzQuery, error) {
+		account, err := st.GetAccountByOwner(q.Actor)
+		if err != nil {
+			return q, err
+		}
+		snapshot, err := rolePolicySnapshotForUser(st, account.ID)
+		if err != nil {
+			return q, err
+		}
+		q.AuthorityEpoch = snapshot.AuthorityEpoch
+		q.RolePolicy = &snapshot
+		return q, nil
+	}}
 	projectSlot := &projectLifecycleSlot{}
-	caps := hostcaps{projects: projectSlot, st: st, pipe: pipe, set: setSvc, authz: authzSlot, surfaces: surfaceSvc}
+	workObserverSlot := &projectWorkObserverSlot{}
+	directorySlot, err := newAccountDirectorySlot(st)
+	if err != nil {
+		return err
+	}
+	contextSlot := &projectContextSlot{}
+	caps := hostcaps{projects: projectSlot, workObserver: workObserverSlot, contexts: contextSlot, projectAudit: &projectAuditSlot{}, directory: directorySlot, regulations: &regulationsSlot{}, st: st, pipe: pipe, set: setSvc, authz: authzSlot, surfaces: surfaceSvc, allowImplicitLocal: !authOn,
+		accountGuard: func(owner string) error {
+			valid, err := effectiveAccount(context.Background(), owner)
+			if err != nil {
+				return err
+			}
+			if !valid {
+				return store.ErrAccountForbidden
+			}
+			return nil
+		}}
+	bus.SetProjectWorkPreflight(func(ctx context.Context, req cmdbus.Request) error {
+		if req.Actor == "" || req.Actor != req.Owner || req.ConversationID == "" || req.AnchorMessageID == "" || req.HostProjectID == "" {
+			return fmt.Errorf("formal project command requires an authenticated conversation source")
+		}
+		conv, err := st.GetConversation(req.Owner, req.ConversationID)
+		if err != nil || string(conv.ProjectID) != req.HostProjectID {
+			return fmt.Errorf("formal project command conversation binding changed")
+		}
+		raw, err := json.Marshal(req.Params)
+		if err != nil {
+			return err
+		}
+		digest := sha256.Sum256(raw)
+		decision, err := preflightProjectMessage(ctx, st, workObserverSlot, projectSlot.work(), req.AnchorMessageID,
+			"project-command:"+req.ID, req.Owner, req.ConversationID, req.HostProjectID, req.ID, hex.EncodeToString(digest[:]))
+		if err != nil {
+			return err
+		}
+		if decision.State != extension.ProjectWorkProceed || decision.DecisionID == "" {
+			return fmt.Errorf("source analysis did not commit a proceed decision")
+		}
+		return nil
+	})
 	// EXT-13：回合内检索（knowledge_search / @knowledge 注入）与 HTTP/Host 检索面
 	// 同一适配器授权；槽为共享指针，扩展在 applyCompiled 期间注册后即生效。
 	mgr.SetSharedKnowledgeAllow(func(owner string, projectID core.ID) bool {
@@ -610,7 +658,20 @@ func Run(opt Options) error {
 	// EXT-11：公开受限 Host 工厂（下游恢复路径经 extension.NewScopedHost 重建句柄）。
 	wireScopedHostFactory(caps)
 	compiledSummary := applyCompiled(skillsRoot, bus, caps)
+	// EXT-20：法规检索作为内置只读注册表工具暴露给模型（走 inprocHost 审计路径）。
+	if err := registerRegulationsTools(reg, caps); err != nil {
+		return fmt.Errorf("regulations tools: %w", err)
+	}
+	if err := requireProjectContextProvider(opt.RequireProjectContext, contextSlot); err != nil {
+		return err
+	}
 	mgr.SetProjectWorkAuthorization(projectSlot.work())
+	wireProjectWorkGate(mgr, st, caps, workObserverSlot, projectSlot.work())
+	if contextSlot.active() {
+		mgr.SetProjectContextResolver(contextSlot.resolve)
+		mgr.SetProjectEvidenceReader(contextSlot.readEvidence)
+		mgr.SetProjectContextSourceRechecker(contextSlot.recheck)
+	}
 	mgr.SetKnowledgeProjectScope(func(ctx context.Context, actor string, id core.ID) (core.ID, error) {
 		return projectSlot.resolve(ctx, caps, actor, id)
 	})
@@ -633,6 +694,9 @@ func Run(opt Options) error {
 		}
 	}
 	hostSrv.Dispatch = func(ctx context.Context, pluginID, owner, commandID string, params map[string]any) error {
+		if err := caps.accountGuard(owner); err != nil {
+			return err
+		}
 		resp := bus.Dispatch(ctx, cmdbus.Request{ID: commandID, Params: params, Entrance: "api", Actor: pluginID, Owner: owner})
 		if resp.Receipt.State == "rejected" || resp.Receipt.State == "unknown" {
 			return fmt.Errorf("%s", resp.Receipt.Reason)
@@ -652,6 +716,7 @@ func Run(opt Options) error {
 	}

 	srv := server.New(st, mgr, reg, profSvc, setSvc, pluginHost)
+	srv.ExecEnv = broker
 	projectSlot.wire(srv, caps)
 	// EXT-8：装载期注册的资源授权适配器注入读取入口（未注册=默认拒绝，行为不变）。
 	srv.SetProjectAuthorizer(authzSlot.Authorize)
@@ -693,26 +758,15 @@ func Run(opt Options) error {
 		return int(setSvc.Effective(store.OwnerDefault, "").GetNumber("runtime.rateLimitPerMin", 0))
 	})
 	// 认证策略（auto）：PG 档默认开启（多用户面不能裸奔）；嵌入式档默认关闭（本地单用户）。
-	authOn := resolved.AuthEnabled()
 	srv.Auth = server.NewAuthenticator(st, authOn)
 	if authOn {
+		srv.Auth.SetSuperAdminFallback(opt.SuperAdmin.Owner, opt.SuperAdmin.Password())
 		log.Printf("auth: API key required (create with: agent-system apikey create --owner <name>)")
 	}
 	srv.Subscribe = func(conversationID string) (<-chan core.StreamEvent, func()) {
 		return b.Subscribe(conversationID)
 	}

-	httpSrv := &http.Server{Addr: opt.Addr, ReadHeaderTimeout: 10 * time.Second, Handler: server.RequestGuard{
-		AuthOn: authOn, AllowedHosts: opt.AllowedHosts, Next: srv.Handler(),
-	}}
-
-	go func() {
-		log.Printf("agent-system serving on http://%s (data: %s, plugins: %s)", opt.Addr, opt.DataDir, opt.PluginsDir)
-		if err := httpSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			log.Fatalf("http: %v", err)
-		}
-	}()
-
 	// PG 档：事件跨实例扇出（NOTIFY/LISTEN；SQLite 档不需要）。
 	if st.Dialect() == "postgres" {
 		mgr.SetEventNotifier(pgbus.NewNotifier(st).Notify)
@@ -723,6 +777,35 @@ func Run(opt Options) error {
 		defer listener.Close(context.Background())
 		log.Printf("pgbus: LISTEN agent_events（跨实例事件扇出）")
 	}
+	// Recovery may execute model turns. All card, policy, command, budget and
+	// authorization ports must be ready before recovery or public intake begins.
+	if err := mgr.ReconcileInterrupted(); err != nil {
+		return fmt.Errorf("reconcile interrupted runs: %w", err)
+	}
+	mgr.LoadPendingNotices()
+	// 中断子代理续跑（N2 WP5）：依赖转录目录（workspaceRoot）与派生请求。
+	mgr.ResumeInterruptedChildrenChecked(context.Background(), func(ctx context.Context, owner string) error {
+		valid, err := effectiveAccount(ctx, owner)
+		if err != nil {
+			return err
+		}
+		if !valid {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	})
+	stopCommands := mgr.StartCommandConsumer(context.Background())
+	defer stopCommands()
+
+	httpSrv := &http.Server{Addr: opt.Addr, ReadHeaderTimeout: 10 * time.Second, Handler: server.RequestGuard{
+		AuthOn: authOn, AllowedHosts: opt.AllowedHosts, Next: srv.Handler(),
+	}}
+	go func() {
+		log.Printf("agent-system serving on http://%s (data: %s, plugins: %s)", opt.Addr, opt.DataDir, opt.PluginsDir)
+		if err := httpSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("http: %v", err)
+		}
+	}()

 	stop := make(chan os.Signal, 1)
 	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
@@ -738,55 +821,72 @@ func Run(opt Options) error {
 	return nil
 }

-// CreateUserAccount CLI 建号。
-// password 空且 generatePassword=false：无初始密码，同事务签发 activate Key，返回明文 Key。
-// generatePassword=true 或显式 password：兼容旧路径（随机/给定密码 + must_change）。
-func CreateUserAccount(storageDSN, dataDir, owner, name, password string, isAdmin, openExisting, generatePassword bool) (string, error) {
-	var out string
-	err := withStoreMode(storageDSN, dataDir, openExisting, func(st *store.Store) error {
-		if password != "" || generatePassword {
-			pw := password
-			if pw == "" {
-				pw = server.RandomPassword()
-			}
-			hash, err := store.HashPassword(pw)
-			if err != nil {
-				return err
-			}
-			if err := st.CreateAccount(owner, name, hash, isAdmin); err != nil {
-				return err
-			}
-			out = pw
-			return nil
+func assertLocalAccountOwner(st *store.Store, storageDSN, dataDir string) error {
+	if storageDSN == "" {
+		storageDSN = os.Getenv("AGENT_SYSTEM_DSN")
+	}
+	if storageDSN != "" {
+		var isOwner bool
+		err := st.DB().QueryRow(`SELECT current_user = pg_get_userbyid(c.relowner) FROM pg_class c WHERE c.oid='users'::regclass`).Scan(&isOwner)
+		if err != nil || !isOwner {
+			return store.ErrAccountForbidden
 		}
-		if err := st.CreateAccount(owner, name, "", isAdmin); err != nil {
+		return nil
+	}
+	info, err := os.Stat(filepath.Join(dataDir, "agent-system.db"))
+	if err != nil {
+		return err
+	}
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || (os.Geteuid() != 0 && stat.Uid != uint32(os.Geteuid())) {
+		return store.ErrAccountForbidden
+	}
+	return nil
+}
+
+// CreateUserAccount is the local owner-only, audited pending-account path.
+// Password-bearing creation is rejected before storage is opened.
+func CreateUserAccount(storageDSN, dataDir, owner, name, password string, isAdmin, openExisting, generatePassword bool) (string, string, error) {
+	if password != "" || generatePassword {
+		return "", "", fmt.Errorf("RECOVERY_CONTRACT_REPLACED: local creation uses trusted activation only")
+	}
+	if isAdmin {
+		return "", "", ErrCLIAdminAppointment
+	}
+	var out store.AccountOutcome
+	err := withStoreMode(storageDSN, dataDir, openExisting, func(st *store.Store) error {
+		if err := assertLocalAccountOwner(st, storageDSN, dataDir); err != nil {
 			return err
 		}
-		plain, _, err := st.IssueLoginKey(owner, store.LoginKeyPurposeActivate, "cli", 0)
+		_, next, err := st.CreateLocalPendingAccountWithAudit(owner, name, isAdmin, accountInstanceID())
+		out = next
+		return err
+	})
+	return out.Plain, out.OperationID, err
+}
+
+// IssueUserLoginKey is retained only as a rejecting compatibility entry.
+func IssueUserLoginKey(storageDSN, dataDir, owner, purpose string, openExisting, revokeAllCreds bool, ttl time.Duration) (string, error) {
+	return "", fmt.Errorf("RECOVERY_CONTRACT_REPLACED: use owner initialization or owner-confirmed recovery")
+}
+
+// InitializeAccount resumes a specific pending account. The operator identity
+// comes from the local OS UID; the target is fixed by stable user ID and CAS.
+func InitializeAccount(storageDSN, dataDir, userID string, expectedStateVersion, expectedGeneration int64) (string, string, error) {
+	var plain, owner string
+	err := withStoreMode(storageDSN, dataDir, true, func(st *store.Store) error {
+		if err := assertLocalAccountOwner(st, storageDSN, dataDir); err != nil {
+			return err
+		}
+		account, err := st.GetAccount(userID)
 		if err != nil {
 			return err
 		}
-		out = plain
-		return nil
-	})
-	return out, err
-}
-
-// IssueUserLoginKey CLI 签发激活/恢复 Key。
-func IssueUserLoginKey(storageDSN, dataDir, owner, purpose string, openExisting, revokeAllCreds bool, ttl time.Duration) (string, error) {
-	var plain string
-	err := withStoreMode(storageDSN, dataDir, openExisting, func(st *store.Store) error {
-		if revokeAllCreds {
-			if err := st.RevokeAllAPIKeys(owner); err != nil {
-				return err
-			}
-			st.DeleteUserSessions(owner, "")
-		}
-		p, _, err := st.IssueLoginKey(owner, purpose, "cli", ttl)
-		plain = p
+		out, err := st.InitializePendingAccountWithAudit(userID, expectedStateVersion, expectedGeneration, accountInstanceID())
+		plain, owner = out.Plain, account.Owner
 		return err
 	})
-	return plain, err
+	return plain, owner, err
 }

 // RevokeUserLoginKey CLI 撤销未使用登录 Key。
@@ -798,32 +898,16 @@ func RevokeUserLoginKey(storageDSN, dataDir, id string, openExisting bool) error

 // BootstrapAdmin 首位管理员引导：单事务串行（KTD12——PG 咨询锁/SQLite 插入后复查），
 // 建号、激活 Key 与审计共同提交；库内已有用户即拒绝接管。
+// 现已停用：超级管理员只由服务启动按 SUPER_ADMIN_OWNER/SUPER_ADMIN_PASSWORD
+// 引导，其余管理员只由超级管理员在服务端任命；此入口在打开存储前拒绝。
 func BootstrapAdmin(storageDSN, dataDir, owner string, openExisting bool) (string, error) {
-	var plain string
-	err := withStoreMode(storageDSN, dataDir, openExisting, func(st *store.Store) error {
-		p, err := st.BootstrapFirstAdmin(owner, owner, "cli-bootstrap")
-		plain = p
-		return err
-	})
-	return plain, err
+	return "", ErrCLIBootstrapAdminDisabled
 }

 // ResetUserPassword CLI 重置密码：单事务写 must_change=1、bump 认证版本、
 // 作废未用登录 Key、吊销全部会话并审计。
 func ResetUserPassword(storageDSN, dataDir, owner, password string, openExisting bool) (string, error) {
-	if password == "" {
-		password = server.RandomPassword()
-	}
-	hash, err := store.HashPassword(password)
-	if err != nil {
-		return "", err
-	}
-	if err := withStoreMode(storageDSN, dataDir, openExisting, func(st *store.Store) error {
-		return st.AdminResetUserPassword(owner, hash, "cli", "cli")
-	}); err != nil {
-		return "", err
-	}
-	return password, nil
+	return "", fmt.Errorf("RECOVERY_CONTRACT_REPLACED: administrators cannot set another user's password")
 }

 // ListUserAccounts CLI 用户列表。
@@ -851,83 +935,85 @@ func withIdentityStore(storageDSN, dataDir string, fn func(*store.Store) error)
 	return fn(st)
 }

-func withStoreMode(storageDSN, dataDir string, openExisting bool, fn func(*store.Store) error) error {
+func withStoreMode(storageDSN, dataDir string, _ bool, fn func(*store.Store) error) error {
 	var st *store.Store
 	var err error
 	// DSN 等价安全输入（KTD14）：argv 缺省时回落环境变量——凭据不落 shell history。
 	if storageDSN == "" {
 		storageDSN = os.Getenv("AGENT_SYSTEM_DSN")
 	}
+	// Account maintenance never initializes or migrates storage; the retained
+	// CLI compatibility flag cannot opt this operation into service initialization.
 	if storageDSN != "" {
-		if openExisting {
-			st, err = store.OpenExistingPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
-		} else {
-			st, err = store.OpenPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
-		}
+		st, err = store.OpenExistingPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
 	} else {
-		dbPath := filepath.Join(dataDir, "agent-system.db")
-		if openExisting {
-			st, err = store.OpenExistingSQLite(dbPath)
-		} else {
-			st, err = store.OpenSQLite(dbPath)
-		}
+		st, err = store.OpenExistingSQLite(filepath.Join(dataDir, "agent-system.db"))
 	}
+
 	if err != nil {
 		return err
 	}
 	defer st.Close()
+	if id := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_INSTANCE_ID")); id != "" {
+		dbref := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_DBREF"))
+		if dbref == "" {
+			if storageDSN != "" {
+				dbref = "pg"
+			} else {
+				dbref = "sqlite"
+			}
+		}
+		if err := st.VerifySystemIdentity(id, dbref); err != nil {
+			return err
+		}
+	}
 	return fn(st)
 }

 // CreateAPIKey 是 apikey 子命令的实现：在指定存储档上为 owner 创建密钥（明文仅打印一次）。
 func CreateAPIKey(storageDSN, dataDir, owner, name string) (string, error) {
-	var st *store.Store
-	var err error
-	if storageDSN != "" {
-		st, err = store.OpenPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
-	} else {
-		st, err = store.OpenSQLite(filepath.Join(dataDir, "agent-system.db"))
-	}
-	if err != nil {
-		return "", err
-	}
-	defer st.Close()
-	return st.CreateAPIKey(owner, name)
+	var plain string
+	err := withStoreMode(storageDSN, dataDir, true, func(st *store.Store) error {
+		if err := assertLocalAccountOwner(st, storageDSN, dataDir); err != nil {
+			return err
+		}
+		account, err := st.GetAccountByOwner(owner)
+		if err != nil {
+			return err
+		}
+		if !account.Enabled || account.InitializationState == store.InitializationPending {
+			return store.ErrAccountForbidden
+		}
+		p, e := st.CreateAPIKey(owner, name)
+		plain = p
+		return e
+	})
+	return plain, err
 }

 // ListAPIKeys 列出租户密钥（摘要视图）。
 func ListAPIKeys(storageDSN, dataDir, owner string) ([]store.APIKeyInfo, error) {
-	var st *store.Store
-	var err error
-	if storageDSN != "" {
-		st, err = store.OpenPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
-	} else {
-		st, err = store.OpenSQLite(filepath.Join(dataDir, "agent-system.db"))
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer st.Close()
-	if _, err := st.GetUser(owner); err != nil {
-		return nil, fmt.Errorf("owner %q 不存在（先 apikey create 创建）", owner)
-	}
-	return st.ListAPIKeys(owner)
+	var out []store.APIKeyInfo
+	err := withStoreMode(storageDSN, dataDir, true, func(st *store.Store) error {
+		if _, err := st.GetUser(owner); err != nil {
+			return fmt.Errorf("owner %q 不存在（先建立账号）", owner)
+		}
+		var e error
+		out, e = st.ListAPIKeys(owner)
+		return e
+	})
+	return out, err
 }

 // RevokeAPIKey 撤销指定名称密钥。
 func RevokeAPIKey(storageDSN, dataDir, owner, name string) (bool, error) {
-	var st *store.Store
-	var err error
-	if storageDSN != "" {
-		st, err = store.OpenPostgres(storageDSN, filepath.Join(dataDir, "artifacts"))
-	} else {
-		st, err = store.OpenSQLite(filepath.Join(dataDir, "agent-system.db"))
-	}
-	if err != nil {
-		return false, err
-	}
-	defer st.Close()
-	return st.RevokeAPIKeyByName(owner, name)
+	var ok bool
+	err := withStoreMode(storageDSN, dataDir, true, func(st *store.Store) error {
+		var e error
+		ok, e = st.RevokeAPIKeyByName(owner, name)
+		return e
+	})
+	return ok, err
 }

 // EnsureSystemIdentity CLI：显式建立库内服务身份（svc init / I2→I3 引导）。
@@ -956,6 +1042,14 @@ func VerifySystemIdentity(storageDSN, dataDir, instanceID, dbref string) (int, e
 	return schemaVersion, err
 }

+func cliActor() string {
+	return fmt.Sprintf("%d", os.Getuid())
+}
+
+func accountInstanceID() string {
+	return strings.TrimSpace(os.Getenv("AGENT_SYSTEM_INSTANCE_ID"))
+}
+
 // cachedInt 带短 TTL 的整型缓存读（限流值热读取免打库）。
 func cachedInt(ttl time.Duration, fn func() int) func() int {
 	var mu sync.Mutex
@@ -64,10 +64,12 @@ func (r pluginRegistry) AddCommandHandler(spec json.RawMessage, h extension.Hand
 		return fmt.Errorf("extension: command spec: %w", err)
 	}
 	return r.bus.RegisterPluginCommand(s, func(ctx context.Context, req cmdbus.Request) (any, error) {
-		host := inprocHost{caps: r.caps, pluginID: r.pluginID, owner: req.Owner, actor: req.Actor}
+		host := requestBoundHost{inprocHost{caps: r.caps, pluginID: r.pluginID, owner: req.Owner, actor: req.Actor,
+			conversationID: core.ID(req.ConversationID), hostProjectID: core.ID(req.HostProjectID),
+			entrance: req.Entrance, humanGrant: req.HumanGrant}}
 		return h(ctx, host, extension.Request{
 			ID: req.ID, Params: req.Params, Entrance: req.Entrance,
-			Actor: req.Actor, Owner: req.Owner, ConversationID: req.ConversationID,
+			Actor: req.Actor, Owner: req.Owner, ConversationID: req.ConversationID, OperationID: req.OperationID,
 			HostProjectID: req.HostProjectID,
 		})
 	})
@@ -116,6 +118,28 @@ func (r compiledRegistry) RegisterResourceAuthorizer(extension.ResourceAuthorize
 	return errors.New("extension: declarative plugins cannot register resource authorizers")
 }

+func (r compiledRegistry) RegisterAccountDirectoryScopeResolver(extension.AccountDirectoryScopeResolver) error {
+	return errors.New("extension: declarative plugins cannot register account directory authorization")
+}
+
+func (r pluginRegistry) RegisterAccountDirectoryScopeResolver(fn extension.AccountDirectoryScopeResolver) error {
+	if r.pluginID != "rdm" || r.caps.directory == nil {
+		return errors.New("extension: account directory resolver requires trusted RDM registration")
+	}
+	return r.caps.directory.register(r.pluginID, fn)
+}
+
+func (r compiledRegistry) RegisterRegulationsProvider(extension.RegulationsProvider) error {
+	return errors.New("extension: declarative plugins cannot register a regulations provider")
+}
+
+func (r pluginRegistry) RegisterRegulationsProvider(p extension.RegulationsProvider) error {
+	if r.caps.regulations == nil {
+		return errors.New("extension: regulations provider registration unavailable")
+	}
+	return r.caps.regulations.register(r.pluginID, p)
+}
+
 // RegisterResourceAuthorizer 进程内扩展（EXT-1）：填充 EXT-8 适配器槽
 // （hostcaps.authz 共享指针；首个注册者生效，组合根已装配进 Server/runmgr）。
 // 此前 pluginRegistry 未覆盖该方法——进程内插件注册适配器会命中声明式分支的
@@ -150,6 +174,22 @@ type recordRegistry struct {
 	sum *server.CompiledPlugin
 }

+func (r recordRegistry) RegisterAccountDirectoryScopeResolver(fn extension.AccountDirectoryScopeResolver) error {
+	registrar, ok := r.Registry.(extension.AccountDirectoryRegistrar)
+	if !ok {
+		return errors.New("extension: account directory registration unavailable")
+	}
+	return registrar.RegisterAccountDirectoryScopeResolver(fn)
+}
+
+func (r recordRegistry) RegisterRegulationsProvider(p extension.RegulationsProvider) error {
+	registrar, ok := r.Registry.(extension.RegulationsRegistrar)
+	if !ok {
+		return errors.New("extension: regulations provider registration unavailable")
+	}
+	return registrar.RegisterRegulationsProvider(p)
+}
+
 func (r recordRegistry) AddCommand(spec json.RawMessage) error {
 	if err := r.Registry.AddCommand(spec); err != nil {
 		return err
@@ -0,0 +1,122 @@
+package app
+
+import (
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+// requestBoundHost is created only for a current lifecycle or command request.
+// A reconstructed global ScopedHost is a plain inprocHost and cannot expose
+// the delegated projection method by type assertion.
+type requestBoundHost struct{ inprocHost }
+
+// ProjectProjectionForCreator only derives from a live request Host of the
+// registered RDM provider. The operator is inherited from that Host, never
+// accepted as a caller-supplied field. RDM's project.settings decision remains
+// its own domain authority; this capability fences the Backend projection.
+func (bound requestBoundHost) ProjectProjectionForCreator(creator, projectID string) (extension.ProjectHost, error) {
+	h := bound.inprocHost
+	if h.actor == "" || h.actor != h.owner || h.pluginID != "rdm" ||
+		h.caps.projects == nil || h.caps.st == nil || creator == "" || projectID == "" {
+		return nil, store.ErrAccountForbidden
+	}
+	slot := h.caps.projects
+	slot.mu.Lock()
+	registered := slot.provider != nil && slot.holder == h.pluginID
+	slot.mu.Unlock()
+	if !registered {
+		return nil, store.ErrAccountForbidden
+	}
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
+	if h.caps.accountGuard != nil {
+		if err := h.caps.accountGuard(creator); err != nil {
+			return nil, err
+		}
+	}
+	project, err := h.caps.st.ProjectMetadata(projectID)
+	if err != nil {
+		return nil, err
+	}
+	if string(project.Owner) != creator || string(project.ID) != projectID {
+		return nil, store.ErrNotFound
+	}
+	return delegatedProjectProjection{caps: h.caps, pluginID: h.pluginID,
+		actor: h.actor, creator: creator, projectID: projectID}, nil
+}
+
+// delegatedProjectProjection exposes only ProjectHost, and every method is
+// confined to the bound project. It cannot be cast to the broader Host.
+type delegatedProjectProjection struct {
+	caps      hostcaps
+	pluginID  string
+	actor     string
+	creator   string
+	projectID string
+}
+
+var _ extension.ProjectHost = delegatedProjectProjection{}
+
+func (p delegatedProjectProjection) Owner() string { return p.creator }
+
+func (p delegatedProjectProjection) check() error {
+	if p.caps.accountGuard == nil {
+		return nil
+	}
+	if err := p.caps.accountGuard(p.actor); err != nil {
+		return err
+	}
+	return p.caps.accountGuard(p.creator)
+}
+
+func (p delegatedProjectProjection) target(id string) error {
+	if id == "" || id != p.projectID {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func (p delegatedProjectProjection) OwnedProjects() ([]core.Project, error) {
+	return nil, store.ErrAccountForbidden
+}
+
+func (p delegatedProjectProjection) OwnedProject(string) (core.Project, error) {
+	return core.Project{}, store.ErrAccountForbidden
+}
+
+func (p delegatedProjectProjection) EnsureProject(string, string) (core.Project, error) {
+	return core.Project{}, store.ErrAccountForbidden
+}
+
+func (p delegatedProjectProjection) ProjectMetadata(id string) (core.Project, error) {
+	if err := p.target(id); err != nil {
+		return core.Project{}, err
+	}
+	if err := p.check(); err != nil {
+		return core.Project{}, err
+	}
+	view := inprocHost{caps: p.caps, pluginID: p.pluginID, owner: p.creator, actor: p.actor}
+	return view.ProjectMetadata(id)
+}
+
+func (p delegatedProjectProjection) ProjectNameAvailable(name, exceptID string) (bool, error) {
+	if err := p.target(exceptID); err != nil {
+		return false, err
+	}
+	if err := p.check(); err != nil {
+		return false, err
+	}
+	return p.caps.st.ProjectNameAvailable(name, exceptID)
+}
+
+func (p delegatedProjectProjection) RenameOwnedProject(id, name string) (core.Project, error) {
+	if err := p.target(id); err != nil {
+		return core.Project{}, err
+	}
+	if err := p.check(); err != nil {
+		return core.Project{}, err
+	}
+	return p.caps.st.RenameOwnedProjectAccountChecked(p.actor, p.creator, p.projectID, name, p.caps.allowImplicitLocal)
+}
@@ -0,0 +1,108 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/server"
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+func TestDelegatedProjectionIsBoundAtHTTPAndCommandEntries(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/entries.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	for _, owner := range []string{"alice", "bob"} {
+		if err := st.EnsureUser(owner, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	httpProject, err := st.CreateProject("alice", "HTTP original")
+	if err != nil {
+		t.Fatal(err)
+	}
+	commandProject, err := st.CreateProject("alice", "Command original")
+	if err != nil {
+		t.Fatal(err)
+	}
+	check := func(owner string) error {
+		state, err := st.GetUserAuthState(owner)
+		if err != nil {
+			return err
+		}
+		if !state.Enabled {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	}
+	projectFromRequest := func(h extension.Host, id, name string) (core.Project, error) {
+		bound, ok := h.(extension.DelegatedProjectProjectionHost)
+		if !ok {
+			return core.Project{}, errors.New("request Host lost operator-bound projection")
+		}
+		projection, err := bound.ProjectProjectionForCreator("alice", id)
+		if err != nil {
+			return core.Project{}, err
+		}
+		return projection.RenameOwnedProject(id, name)
+	}
+	slot := &projectLifecycleSlot{}
+	caps := hostcaps{st: st, set: settings.NewService(st), projects: slot, accountGuard: check}
+	provider := completeLifecycle()
+	provider.Rename = func(_ context.Context, h extension.Host, id, name string) (core.Project, error) {
+		return projectFromRequest(h, id, name)
+	}
+	if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(provider); err != nil {
+		t.Fatal(err)
+	}
+	srv := server.New(st, nil, nil, nil, caps.set, nil)
+	srv.Auth = server.NewAuthenticator(st, true)
+	slot.wire(srv, caps)
+	key, err := st.CreateAPIKey("bob", "delegate-entry")
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPatch, "/api/projects/"+string(httpProject.ID), strings.NewReader(`{"name":"via HTTP"}`))
+	req.Header.Set("Authorization", "Bearer "+key)
+	rec := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("HTTP lifecycle rename: status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	bus := cmdbus.New(st, nil, nil)
+	bus.SetEffectiveAccountGuard(func(_ context.Context, owner string) error { return check(owner) })
+	bus.RequireAccountCheckedWrites(false)
+	reg := pluginRegistry{pluginID: "rdm", caps: caps, compiledRegistry: compiledRegistry{bus: bus}}
+	err = reg.AddCommandHandler(json.RawMessage(`{"id":"rdm.fixture.rename","title":"Rename"}`),
+		func(_ context.Context, h extension.Host, req extension.Request) (any, error) {
+			id, _ := req.Params["id"].(string)
+			name, _ := req.Params["name"].(string)
+			return projectFromRequest(h, id, name)
+		})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := bus.Dispatch(context.Background(), cmdbus.Request{ID: "rdm.fixture.rename", Owner: "bob", Actor: "bob",
+		Params: map[string]any{"id": string(commandProject.ID), "name": "via command"}})
+	if result.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("command rename: %+v", result.Receipt)
+	}
+	for _, tc := range []struct{ id, want string }{{string(httpProject.ID), "via HTTP"}, {string(commandProject.ID), "via command"}} {
+		project, err := st.ProjectMetadata(tc.id)
+		if err != nil || project.Name != tc.want {
+			t.Fatalf("entry %s did not reach bound projection: %+v %v", tc.id, project, err)
+		}
+	}
+}
@@ -0,0 +1,135 @@
+package app
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/store"
+)
+
+// Two processes share one isolated PostgreSQL schema. The child has already
+// accepted a stale early account read when the parent commits disable; only
+// the final Backend transaction can stop the physical rename.
+func TestPGDelegatedProjectionDisableAcrossProcesses(t *testing.T) {
+	baseDSN := os.Getenv("AGENT_PG_TEST_DSN")
+	if baseDSN == "" {
+		t.Skip("isolated PostgreSQL DSN required")
+	}
+	separator := "?"
+	if strings.Contains(baseDSN, "?") {
+		separator = "&"
+	}
+	if os.Getenv("IAM_U3_DELEGATE_CHILD") == "1" {
+		dsn := baseDSN + separator + "search_path=" + os.Getenv("IAM_U3_DELEGATE_SCHEMA") + ",public"
+		st, err := store.OpenExistingPostgres(dsn, filepath.Join(t.TempDir(), "artifacts"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer st.Close()
+		var bobChecks atomic.Int32
+		check := func(owner string) error {
+			state, err := st.GetUserAuthState(owner)
+			if err != nil {
+				return err
+			}
+			if !state.Enabled {
+				return store.ErrAccountForbidden
+			}
+			if owner == "bob" && bobChecks.Add(1) == 2 {
+				if err := os.WriteFile(os.Getenv("IAM_U3_DELEGATE_READY"), []byte("ready"), 0o600); err != nil {
+					return err
+				}
+				deadline := time.Now().Add(5 * time.Second)
+				for {
+					if _, err := os.Stat(os.Getenv("IAM_U3_DELEGATE_RELEASE")); err == nil {
+						break
+					}
+					if time.Now().After(deadline) {
+						return errors.New("parent did not release paused child")
+					}
+					time.Sleep(10 * time.Millisecond)
+				}
+			}
+			return nil
+		}
+		slot := &projectLifecycleSlot{}
+		caps := hostcaps{st: st, projects: slot, accountGuard: check}
+		if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
+			t.Fatal(err)
+		}
+		host := requestBoundHost{inprocHost{caps: caps, pluginID: "rdm", owner: "bob", actor: "bob"}}
+		projection, err := host.ProjectProjectionForCreator("alice", os.Getenv("IAM_U3_DELEGATE_PROJECT"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := projection.RenameOwnedProject(os.Getenv("IAM_U3_DELEGATE_PROJECT"), "late"); !errors.Is(err, store.ErrAccountForbidden) {
+			t.Fatalf("late physical rename was not fenced: %v", err)
+		}
+		return
+	}
+	st := openDirectoryTestStore(t)
+	if err := st.EnsureSystemIdentity("u3-delegate-two-process", "pg"); err != nil {
+		t.Fatal(err)
+	}
+	for _, account := range []struct {
+		owner string
+		admin bool
+	}{{"admin", true}, {"alice", false}, {"bob", false}} {
+		if err := st.CreateAccount(account.owner, "", "", account.admin); err != nil {
+			t.Fatal(err)
+		}
+	}
+	project, err := st.CreateProject("alice", "before")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var schema string
+	if err := st.DB().QueryRow(`SELECT current_schema()`).Scan(&schema); err != nil {
+		t.Fatal(err)
+	}
+	barrier := t.TempDir()
+	ready, release := filepath.Join(barrier, "ready"), filepath.Join(barrier, "release")
+	cmd := exec.Command(os.Args[0], "-test.run=^TestPGDelegatedProjectionDisableAcrossProcesses$")
+	cmd.Env = append(os.Environ(), "IAM_U3_DELEGATE_CHILD=1", "IAM_U3_DELEGATE_SCHEMA="+schema,
+		"IAM_U3_DELEGATE_PROJECT="+string(project.ID), "IAM_U3_DELEGATE_READY="+ready, "IAM_U3_DELEGATE_RELEASE="+release)
+	var output bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &output, &output
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		if _, err := os.Stat(ready); err == nil {
+			break
+		}
+		if time.Now().After(deadline) {
+			_ = cmd.Process.Kill()
+			t.Fatalf("child did not reach stale early check: %s", strings.ReplaceAll(output.String(), baseDSN, "[REDACTED]"))
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	bob, err := st.GetAccountByOwner("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetAccountEnabled("admin", bob.ID, bob.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(release, []byte("release"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := cmd.Wait(); err != nil {
+		t.Fatalf("child failed: %v: %s", err, strings.ReplaceAll(output.String(), baseDSN, "[REDACTED]"))
+	}
+	got, err := st.ProjectMetadata(string(project.ID))
+	if err != nil || got.Name != "before" {
+		t.Fatalf("disabled operator's project rename persisted: %+v %v", got, err)
+	}
+}
@@ -0,0 +1,132 @@
+package app
+
+import (
+	"agent-system-backend/internal/execenv"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/internal/tools"
+	core "agent-system-core"
+)
+
+// envStore 把 store 的行类型适配成 execenv.Store。
+type envStore struct{ *store.Store }
+
+func (s envStore) InsertExecEnvRequest(r execenv.Request) error {
+	return s.Store.InsertExecEnvRequest(store.ExecEnvRequest{
+		ID: r.ID, ConversationID: r.ConversationID, Owner: r.Owner, Spec: r.Spec,
+		Reason: r.Reason, Status: r.Status, LayerID: r.LayerID, Detail: r.Detail,
+		Approver: r.Approver, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
+}
+
+func (s envStore) GetExecEnvRequest(id string) (execenv.Request, error) {
+	r, err := s.Store.GetExecEnvRequest(id)
+	if err != nil {
+		return execenv.Request{}, err
+	}
+	return execenv.Request{
+		ID: r.ID, ConversationID: r.ConversationID, Owner: r.Owner, Spec: r.Spec,
+		Reason: r.Reason, Status: r.Status, LayerID: r.LayerID, Detail: r.Detail,
+		Approver: r.Approver, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	}, nil
+}
+
+func (s envStore) ListExecEnvRequests(conversationID string, limit int) ([]execenv.Request, error) {
+	rows, err := s.Store.ListExecEnvRequests(conversationID, limit)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]execenv.Request, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, execenv.Request{
+			ID: r.ID, ConversationID: r.ConversationID, Owner: r.Owner, Spec: r.Spec,
+			Reason: r.Reason, Status: r.Status, LayerID: r.LayerID, Detail: r.Detail,
+			Approver: r.Approver, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+		})
+	}
+	return out, nil
+}
+
+func (s envStore) UpdateExecEnvRequest(id, status, layerID, detail, approver string) error {
+	return s.Store.UpdateExecEnvRequest(id, status, layerID, detail, approver)
+}
+
+func (s envStore) GetExecEnvBinding(conversationID string) (execenv.Binding, error) {
+	b, err := s.Store.GetExecEnvBinding(conversationID)
+	if err != nil {
+		return execenv.Binding{}, err
+	}
+	return execenv.Binding{
+		ConversationID: b.ConversationID, BaseID: b.BaseID, Extensions: b.Layers,
+		Isolated: b.Isolated, UpdatedAt: b.UpdatedAt,
+	}, nil
+}
+
+func (s envStore) PutExecEnvBinding(b execenv.Binding) error {
+	return s.Store.PutExecEnvBinding(store.ExecEnvBinding{
+		ConversationID: b.ConversationID, BaseID: b.BaseID, Layers: b.Extensions,
+		Isolated: b.Isolated, UpdatedAt: b.UpdatedAt,
+	})
+}
+
+func (s envStore) ListExecEnvBindings() ([]execenv.Binding, error) {
+	rows, err := s.Store.ListExecEnvBindings()
+	if err != nil {
+		return nil, err
+	}
+	out := make([]execenv.Binding, 0, len(rows))
+	for _, b := range rows {
+		out = append(out, execenv.Binding{
+			ConversationID: b.ConversationID, BaseID: b.BaseID, Extensions: b.Layers,
+			Isolated: b.Isolated, UpdatedAt: b.UpdatedAt,
+		})
+	}
+	return out, nil
+}
+
+func (s envStore) InsertExecEnvAudit(owner, action, actor, target, outcome, entry string) error {
+	return s.Store.InsertExecEnvAudit(owner, action, actor, target, outcome, entry)
+}
+
+// wireExecEnv 打开环境根，把基础层交给执行器，并接上申请代理。
+// 两者都空时不改变现状（解释器仍固定为 /usr/bin/python3，避免 linuxbrew 路径）。
+func wireExecEnv(st *store.Store, opt *Options) (*execenv.Broker, error) {
+	if opt.ExecEnvRoot == "" {
+		return nil, nil
+	}
+	root, err := execenv.Open(opt.ExecEnvRoot)
+	if err != nil {
+		return nil, err
+	}
+	if bin, ok := root.PythonBin(); ok {
+		tools.SetExecPython(bin, root.PythonPrefix())
+	}
+	tools.SetExecShimDir(root.BinDir())
+	if opt.ExecDepsDir == "" {
+		if id, err := root.CurrentBase(); err != nil {
+			return nil, err
+		} else if id != "" {
+			opt.ExecDepsDir = root.LayerDir(id)
+		}
+	}
+	py, _ := root.PythonBin()
+	if py == "" {
+		py = "/usr/bin/python3"
+	}
+	broker := execenv.NewBroker(root, envStore{st}, execenv.Pip{Python: py})
+	tools.SetEnvBroker(broker)
+	tools.SetExecLayers(broker.LayersFor)
+	tools.SetEnvApproval(func(owner, conv, requestID, detail string) error {
+		card := &core.HITLCard{
+			ID: core.ID("hitl_" + requestID), RunID: "execenv", ConversationID: core.ID(conv),
+			Question: "批准为这个会话安装额外的 Python 包？", Kind: core.HITLKindChoice,
+			Detail: "exec-env:" + requestID + "\n" + detail,
+			Choices: []core.HITLChoice{
+				{ID: "approve", Label: "批准", Description: detail, Impact: "只挂到这个会话，不改变基础层", Recommended: true},
+				{ID: "isolate", Label: "批准并使用隔离层", Description: "与基础层版本冲突时用这份独立闭包", Impact: "这个会话不再叠基础层"},
+				{ID: "reject", Label: "拒绝", Description: "不安装", Impact: "会话保持现状"},
+			},
+		}
+		return st.SaveHITLCard(owner, card)
+	})
+	return broker, nil
+}
@@ -23,6 +23,9 @@ func newExt9Host(t *testing.T) (interface {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { st.Close() })
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
 	set := settings.NewService(st)
 	pipe := rag.NewPipeline(st, set, nil, nil)
 	h := inprocHost{caps: hostcaps{st: st, pipe: pipe, set: set}, pluginID: "rdm", owner: "alice"}
@@ -0,0 +1,201 @@
+//go:build unix
+
+package app
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/instanceguard"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+func TestSecondProcessRejectedBeforeOpen(t *testing.T) {
+	if os.Getenv("U8_APP_ROLE") == "hold" {
+		holdService(t)
+		return
+	}
+	dir := t.TempDir()
+	ready := filepath.Join(dir, "ready")
+	cmd := exec.Command(os.Args[0], "-test.run=TestSecondProcessRejectedBeforeOpen")
+	cmd.Env = append(os.Environ(), "U8_APP_ROLE=hold", "U8_APP_DIR="+dir, "U8_APP_READY="+ready)
+	cmd.Dir = t.TempDir()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+			_, _ = cmd.Process.Wait()
+		}
+	})
+	waitReady(t, ready)
+	_, _, err := openServiceStore(Options{DataDir: dir, Addr: ":1"})
+	if !errors.Is(err, instanceguard.ErrBusy) {
+		t.Fatalf("second open: %v", err)
+	}
+	if err := Migrate(Options{DataDir: dir}); !errors.Is(err, instanceguard.ErrBusy) {
+		t.Fatalf("migrate while held: %v", err)
+	}
+	cli, err := store.OpenExistingSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	run, err := cli.GetRunByID("run_u8_hold")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if run.Status != core.RunWaitingHITL {
+		t.Fatalf("run changed while second process was refused: %s", run.Status)
+	}
+	if _, err := cli.CreateProject("owner", "short"); err != nil {
+		t.Fatalf("account-style write while service holds the guard: %v", err)
+	}
+	if err := cli.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := cmd.Process.Kill(); err != nil {
+		t.Fatal(err)
+	}
+	_, _ = cmd.Process.Wait()
+	st, release, err := openServiceStore(Options{DataDir: dir, Addr: ":2"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer release()
+	run, err = st.GetRunByID("run_u8_hold")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if run.Status != core.RunWaitingHITL {
+		t.Fatalf("restart reconciled a run the second process never opened: %s", run.Status)
+	}
+}
+
+func TestCopiedBinaryStillSharesGuard(t *testing.T) {
+	if os.Getenv("U8_APP_ROLE") == "copy-hold" {
+		holdService(t)
+		return
+	}
+	bin, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	copyPath := filepath.Join(t.TempDir(), "agent-system-test-copy")
+	raw, err := os.ReadFile(bin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(copyPath, raw, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	ready := filepath.Join(dir, "ready")
+	cmd := exec.Command(copyPath, "-test.run=TestCopiedBinaryStillSharesGuard")
+	cmd.Env = append(os.Environ(), "U8_APP_ROLE=copy-hold", "U8_APP_DIR="+dir, "U8_APP_READY="+ready)
+	cmd.Dir = t.TempDir()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+			_, _ = cmd.Process.Wait()
+		}
+	})
+	waitReady(t, ready)
+	if _, _, err := openServiceStore(Options{DataDir: dir}); !errors.Is(err, instanceguard.ErrBusy) {
+		t.Fatalf("copied binary: %v", err)
+	}
+}
+
+func holdService(t *testing.T) {
+	t.Helper()
+	dir := os.Getenv("U8_APP_DIR")
+	st, _, err := openServiceStore(Options{DataDir: dir})
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := &core.Run{
+		ID: "run_u8_hold", ConversationID: "c", ProjectID: "p", Owner: "o",
+		Kind: core.RunConversation, Status: core.RunWaitingHITL,
+	}
+	if err := st.CreateRun(run); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(os.Getenv("U8_APP_READY"), []byte("ready"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(30 * time.Second)
+}
+
+func waitReady(t *testing.T, ready string) {
+	t.Helper()
+	deadline := time.Now().Add(20 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(ready); err == nil {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Fatal("child did not become ready")
+}
+
+func TestAdoptDoesNotCreateMissingDatabase(t *testing.T) {
+	dir := t.TempDir()
+	_, release, err := openServiceStore(Options{DataDir: dir})
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	db := filepath.Join(dir, "agent-system.db")
+	if err := os.Remove(db); err != nil {
+		t.Fatal(err)
+	}
+	_, _, err = openServiceStore(Options{DataDir: dir, AdoptInstanceGuard: true})
+	if !errors.Is(err, instanceguard.ErrDBMissing) {
+		t.Fatalf("adopt missing: %v", err)
+	}
+	if _, err := os.Stat(db); !os.IsNotExist(err) {
+		t.Fatalf("adopt created a database: %v", err)
+	}
+}
+
+func TestIdentityFailureDoesNotStick(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("AGENT_SYSTEM_INSTANCE_ID", "wrong")
+	if _, _, err := openServiceStore(Options{DataDir: dir}); err == nil {
+		t.Fatal("missing identity row was accepted")
+	}
+	t.Setenv("AGENT_SYSTEM_INSTANCE_ID", "")
+	st, err := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	marker, ok, err := st.LoadInstanceGuard()
+	if err != nil || ok || marker.InstanceID != "" {
+		t.Fatalf("failed start wrote a guard id: ok=%v id=%q err=%v", ok, marker.InstanceID, err)
+	}
+	if err := st.EnsureSystemIdentity("right", "sqlite"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Close(); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("AGENT_SYSTEM_INSTANCE_ID", "right")
+	opened, release, err := openServiceStore(Options{DataDir: dir})
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	_ = opened
+}
@@ -5,9 +5,14 @@ import (
 	"context"
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
+	"time"

+	authzsvc "agent-system-backend/internal/authz"
+	"agent-system-backend/internal/authz/catalog"
+	"agent-system-backend/internal/cmdbus"
 	"agent-system-backend/internal/ingest"
 	"agent-system-backend/internal/rag"
 	"agent-system-backend/internal/runtime"
@@ -21,12 +26,20 @@ import (
 // 同一实现同时服务 hostapi.Server 的 Search/Complete 闭包与进程内
 // inprocHost（EXT-1 批注 1：复用现有 owner 作用域函数，不新造句柄）。
 type hostcaps struct {
-	projects *projectLifecycleSlot
-	st       *store.Store
-	pipe     *rag.Pipeline
-	set      *settings.Service
-	authz    *projectAuthz       // EXT-8 适配器槽（共享指针；首个注册者生效）
-	surfaces *surfacesvc.Service // EXT-17 Surface 能力槽（nil = 未装配，明确拒绝）
+	projects           *projectLifecycleSlot
+	workObserver       *projectWorkObserverSlot
+	directory          *accountDirectorySlot
+	contexts           *projectContextSlot
+	projectAudit       *projectAuditSlot
+	regulations        *regulationsSlot // EXT-20 法规提供方槽（共享指针；nil/未注册＝不可用）
+	accountGuard       func(string) error
+	allowImplicitLocal bool
+	st                 *store.Store
+	pipe               *rag.Pipeline
+	set                *settings.Service
+	authz              *projectAuthz       // EXT-8 适配器槽（共享指针；首个注册者生效）
+	surfaces           *surfacesvc.Service // EXT-17 Surface 能力槽（nil = 未装配，明确拒绝）
+	now                func() time.Time
 }

 // projectAuthz EXT-8 资源授权适配器槽：进程内扩展注册，组合根装配进 Server。
@@ -36,6 +49,7 @@ type projectAuthz struct {
 	fn      extension.ResourceAuthorizer
 	holder2 string // EXT-8b 资源级持有者（首个注册者生效）
 	fn2     extension.ResourceAuthorizerV2
+	enrich  func(extension.ResourceAuthzQuery) (extension.ResourceAuthzQuery, error)
 }

 func (a *projectAuthz) set(pluginID string, fn extension.ResourceAuthorizer) {
@@ -61,12 +75,19 @@ func (a *projectAuthz) setV2(pluginID string, fn extension.ResourceAuthorizerV2)
 // 布尔（兼容现行行为）。查询字段由执行端受信构造。
 func (a *projectAuthz) AuthorizeResource(q extension.ResourceAuthzQuery) (bool, error) {
 	a.mu.Lock()
-	fn2, fn1 := a.fn2, a.fn
+	fn2, fn1, enrich := a.fn2, a.fn, a.enrich
 	a.mu.Unlock()
 	if fn2 != nil {
 		if q.Actor == "" || q.Action == "" || q.ResourceType == "" || q.ResourceID == "" {
 			return false, nil // 受信上下文字段缺失＝不可判定＝拒绝
 		}
+		if enrich != nil {
+			var err error
+			q, err = enrich(q)
+			if err != nil {
+				return false, err
+			}
+		}
 		return fn2(q)
 	}
 	if fn1 == nil || q.Owner == "" || q.ProjectID == "" {
@@ -109,6 +130,11 @@ type sharedRetriever interface {
 }

 func (c hostcaps) search(ctx context.Context, owner string, projectID core.ID, text string, topK int) ([]core.RetrievalHit, error) {
+	if c.accountGuard != nil {
+		if err := c.accountGuard(owner); err != nil {
+			return nil, err
+		}
+	}
 	q := core.RetrievalQuery{ProjectID: projectID, Text: text, TopK: topK}
 	if c.projects != nil && projectID != "" {
 		id, err := c.projects.resolve(ctx, c, owner, projectID)
@@ -143,10 +169,23 @@ func (c hostcaps) searchDefault(ctx context.Context, owner, text string) ([]core

 // complete 经基座 LLM 路由补全（owner 的模型配置生效；未配置报错）。
 func (c hostcaps) complete(ctx context.Context, owner, prompt string) (string, error) {
+	if c.accountGuard != nil {
+		if err := c.accountGuard(owner); err != nil {
+			return "", err
+		}
+	}
 	route := runtime.ResolveChatModel(core.AgentProfile{}, c.set.Effective(owner, ""))
 	if route.Model == "" || route.Base == "" {
 		return "", fmt.Errorf("llm route not configured")
 	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if c.accountGuard != nil {
+		if err := c.accountGuard(owner); err != nil {
+			return "", err
+		}
+	}
 	return completeChat(ctx, route.Base, route.Key, route.Model, prompt)
 }

@@ -170,10 +209,21 @@ func (c hostcaps) parse(ctx context.Context, filename, mime string, content []by
 // actor 是本次分发主体（通常等于 owner）；AdminProvider 能力经 actor 查询
 // （EXT-18）。非 dispatch 上下文（EXT-11 scoped host）actor 为空——IsAdmin 恒 false。
 type inprocHost struct {
-	caps     hostcaps
-	pluginID string
-	owner    string
-	actor    string // EXT-18：分发主体（空＝非 dispatch 上下文）
+	caps           hostcaps
+	pluginID       string
+	owner          string
+	actor          string  // EXT-18：分发主体（空＝非 dispatch 上下文）
+	conversationID core.ID // dispatch-bound, never taken from completion arguments
+	hostProjectID  core.ID // dispatch project; rechecked against stored conversation
+	entrance       string  // dispatch entrance; model tools are "agent"
+	humanGrant     *cmdbus.HumanGrant
+}
+
+func (h inprocHost) requireEffective() error {
+	if h.caps.accountGuard != nil {
+		return h.caps.accountGuard(h.owner)
+	}
+	return nil
 }

 func (h inprocHost) PluginID() string { return h.pluginID }
@@ -190,14 +240,26 @@ func (h inprocHost) IsAdmin() bool {
 	if err != nil {
 		return false
 	}
-	return state.IsAdmin
+	return state.Enabled && state.IsAdmin
 }

-// ListAccounts 实现 EXT-19 AccountLister（最小账号目录）：仅授权管理读面用。
-// 有效态＝账号存在且非停用（当前 users 表无停用位——must_change_password 不影响
-// 有效性；后续加停用位在此映射）。P3（2026-10-13）：携带 Name 供同名区分。
-// 游标＝owner 升序偏移。
+func (h inprocHost) legacySystemDirectoryAuthorized() bool {
+	if h.requireEffective() != nil {
+		return false
+	}
+	if h.actor == "" {
+		return false
+	}
+	state, err := h.caps.st.GetUserAuthState(h.actor)
+	return err == nil && state.Enabled && state.IsAdmin
+}
+
+// ListAccounts 保留 EXT-19 旧签名，仅供有受信分发主体的系统管理上下文；
+// 项目和文档候选必须走带 locator 的 AccountDirectoryProvider。
 func (h inprocHost) ListAccounts(cursor string, limit int) ([]extension.AccountEntry, string, error) {
+	if !h.legacySystemDirectoryAuthorized() {
+		return nil, "", store.ErrAccountForbidden
+	}
 	if limit <= 0 || limit > 200 {
 		limit = 50
 	}
@@ -207,7 +269,7 @@ func (h inprocHost) ListAccounts(cursor string, limit int) ([]extension.AccountE
 	}
 	entries := make([]extension.AccountEntry, 0, len(users))
 	for _, u := range users {
-		entries = append(entries, extension.AccountEntry{Owner: u.Owner, Name: u.Name, Valid: true})
+		entries = append(entries, extension.AccountEntry{Owner: u.Owner, Name: u.Name, Valid: u.Enabled})
 	}
 	// 排序+游标（owner 升序；cursor 为上一页末 owner，空＝首页）。
 	for i := 0; i < len(entries); i++ {
@@ -238,6 +300,9 @@ func (h inprocHost) ListAccounts(cursor string, limit int) ([]extension.AccountE
 // 姓名子串检索（大小写不敏感；空 query ＝ 首页候选）。结果按 owner 升序，
 // 有效态口径与 ListAccounts 一致。
 func (h inprocHost) SearchAccounts(query string, limit int) ([]extension.AccountEntry, error) {
+	if !h.legacySystemDirectoryAuthorized() {
+		return nil, store.ErrAccountForbidden
+	}
 	if limit <= 0 || limit > 200 {
 		limit = 50
 	}
@@ -253,7 +318,7 @@ func (h inprocHost) SearchAccounts(query string, limit int) ([]extension.Account
 			!strings.Contains(strings.ToLower(u.Name), q) {
 			continue
 		}
-		entries = append(entries, extension.AccountEntry{Owner: u.Owner, Name: u.Name, Valid: true})
+		entries = append(entries, extension.AccountEntry{Owner: u.Owner, Name: u.Name, Valid: u.Enabled})
 	}
 	sort.Slice(entries, func(i, j int) bool { return entries[i].Owner < entries[j].Owner })
 	if len(entries) > limit {
@@ -262,26 +327,503 @@ func (h inprocHost) SearchAccounts(query string, limit int) ([]extension.Account
 	return entries, nil
 }

+func (h inprocHost) rolePolicyActor() (store.Account, error) {
+	if h.actor == "" {
+		return store.Account{}, store.ErrAccountForbidden
+	}
+	account, err := h.caps.st.GetAccountByOwner(h.actor)
+	if err != nil || !account.Enabled {
+		return store.Account{}, store.ErrAccountForbidden
+	}
+	return account, nil
+}
+
+func (h inprocHost) CurrentRolePolicy(ctx context.Context) (extension.RolePolicySnapshot, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	actor, err := h.rolePolicyActor()
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	return h.RolePolicyForUser(ctx, actor.ID)
+}
+
+func (h inprocHost) RolePolicyForUser(ctx context.Context, userID string) (extension.RolePolicySnapshot, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	if _, err := h.rolePolicyActor(); err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	return rolePolicySnapshotForUser(h.caps.st, userID)
+}
+
+func rolePolicySnapshotForUser(st *store.Store, userID string) (extension.RolePolicySnapshot, error) {
+	account, err := st.GetAccount(userID)
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	epoch, err := st.AuthorityEpoch()
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	snapshot := extension.RolePolicySnapshot{SchemaVersion: extension.RolePolicySchemaVersion,
+		UserID: account.ID, Owner: account.Owner, AccountEnabled: account.Enabled,
+		AuthorityEpoch: epoch, Permissions: map[string]extension.RolePermission{}}
+	linked, err := authzsvc.NewService(st).EffectiveLinkedCapabilities(account.Owner)
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	snapshot.Linked = extension.LinkedCapabilities{ProjectCreate: linked.ProjectCreate, Source: linked.Source,
+		Actions: linked.LinkedActions, Conflicts: linked.Conflicts}
+	view, err := st.RoleForUser(userID)
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	if view.Binding == nil || view.Role == nil {
+		return snapshot, nil
+	}
+	snapshot.BindingID = view.Binding.BindingID
+	snapshot.RoleID = view.Role.RoleID
+	snapshot.RoleName = view.Role.Name
+	snapshot.RoleDescription = view.Role.Description
+	snapshot.RoleEnabled = view.Role.Enabled
+	snapshot.RoleVersion = view.Role.RoleVersion
+	permissions, err := st.RolePermissions(view.Role.RoleID)
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	for _, permission := range permissions {
+		snapshot.Permissions[permission.ActionID] = extension.RolePermission{Allowed: permission.Allowed, CapAllowed: permission.CapAllowed}
+	}
+	return snapshot, nil
+}
+
+func (h inprocHost) RolePolicyForOwner(ctx context.Context, owner string) (extension.RolePolicySnapshot, error) {
+	if _, err := h.rolePolicyActor(); err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	account, err := h.caps.st.GetAccountByOwner(owner)
+	if err != nil {
+		return extension.RolePolicySnapshot{}, err
+	}
+	return h.RolePolicyForUser(ctx, account.ID)
+}
+
+func (h inprocHost) CheckRoleAction(ctx context.Context, userID, actionID string) (extension.RoleActionDecision, error) {
+	decision := extension.RoleActionDecision{ActionID: actionID}
+	if _, ok := catalog.DescriptorByID(actionID); !ok {
+		decision.Reason = "unknown-action"
+		return decision, nil
+	}
+	snapshot, err := h.RolePolicyForUser(ctx, userID)
+	if err != nil {
+		return decision, err
+	}
+	decision.RoleID = snapshot.RoleID
+	decision.AuthorityEpoch = snapshot.AuthorityEpoch
+	if !snapshot.AccountEnabled {
+		decision.Reason = "account-disabled"
+		return decision, nil
+	}
+	if snapshot.RoleID == "" {
+		decision.Reason = "role-unassigned"
+		return decision, nil
+	}
+	if !snapshot.RoleEnabled {
+		decision.Reason = "role-disabled"
+		return decision, nil
+	}
+	permission, ok := snapshot.Permissions[actionID]
+	if !ok {
+		decision.Reason = "action-unconfigured"
+		return decision, nil
+	}
+	decision.Allowed = permission.Allowed
+	decision.CapAllowed = permission.CapAllowed
+	if !permission.CapAllowed {
+		decision.Reason = "role-cap"
+	} else if !permission.Allowed {
+		decision.Reason = "role-default-deny"
+	}
+	return decision, nil
+}
+
+func (h inprocHost) CheckCurrentSystemAction(ctx context.Context, actionID string) (extension.SystemActionDecision, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.SystemActionDecision{}, err
+	}
+	if _, err := h.rolePolicyActor(); err != nil {
+		return extension.SystemActionDecision{}, err
+	}
+	decision := authzsvc.NewService(h.caps.st).AuthorizeSystem(h.actor, actionID)
+	return extension.SystemActionDecision{ActionID: actionID, Allowed: decision.Allowed,
+		AuthorityEpoch: decision.AuthorityEpoch, Reason: decision.Reason}, nil
+}
+
+func (h inprocHost) currentCapabilityExplanation(ctx context.Context) (store.CapabilityExplanation, extension.CapabilitySubject, error) {
+	if err := ctx.Err(); err != nil {
+		return store.CapabilityExplanation{}, extension.CapabilitySubject{}, err
+	}
+	if _, err := h.rolePolicyActor(); err != nil {
+		return store.CapabilityExplanation{}, extension.CapabilitySubject{}, err
+	}
+	explanation, err := authzsvc.NewService(h.caps.st).ExplainCapabilities(h.actor)
+	if err != nil {
+		return store.CapabilityExplanation{}, extension.CapabilitySubject{}, err
+	}
+	subject := extension.CapabilitySubject{SchemaVersion: extension.CapabilityExplainSchemaVersion,
+		UserID: explanation.UserID, Owner: explanation.Owner, AuthorityEpoch: explanation.AuthorityEpoch,
+		RoleID: explanation.RoleID, RoleName: explanation.RoleName, RoleEnabled: explanation.RoleEnabled}
+	return explanation, subject, nil
+}
+
+func capabilityActionExplains(in []store.CapabilityActionExplain) []extension.CapabilityActionExplain {
+	out := make([]extension.CapabilityActionExplain, 0, len(in))
+	for _, action := range in {
+		out = append(out, extension.CapabilityActionExplain(action))
+	}
+	return out
+}
+
+func (h inprocHost) CurrentCapabilityExplain(ctx context.Context) (extension.CapabilityExplain, error) {
+	explanation, subject, err := h.currentCapabilityExplanation(ctx)
+	if err != nil {
+		return extension.CapabilityExplain{}, err
+	}
+	capability := explanation.Capability
+	return extension.CapabilityExplain{CapabilitySubject: subject,
+		ProjectCreate: extension.CapabilityActionExplain(capability.ProjectCreate),
+		Linked:        capabilityActionExplains(capability.Linked),
+		Conflicts:     append([]string{}, capability.Conflicts...), MigrationNote: capability.MigrationNote}, nil
+}
+
+func (h inprocHost) CurrentMemberBasicCollaborate(ctx context.Context) (extension.MemberBasicCollaborate, error) {
+	explanation, subject, err := h.currentCapabilityExplanation(ctx)
+	if err != nil {
+		return extension.MemberBasicCollaborate{}, err
+	}
+	return extension.MemberBasicCollaborate{CapabilitySubject: subject,
+		Actions: capabilityActionExplains(explanation.MemberBasicCollaborate.Actions)}, nil
+}
+
+func (h inprocHost) CurrentDocumentQualify(ctx context.Context) (extension.DocumentQualify, error) {
+	explanation, subject, err := h.currentCapabilityExplanation(ctx)
+	if err != nil {
+		return extension.DocumentQualify{}, err
+	}
+	duties := make([]extension.DocumentDutyQualify, 0, len(explanation.DocumentQualify.Duties))
+	for _, duty := range explanation.DocumentQualify.Duties {
+		duties = append(duties, extension.DocumentDutyQualify(duty))
+	}
+	return extension.DocumentQualify{CapabilitySubject: subject, Duties: duties}, nil
+}
+
+func (h inprocHost) requireRoleAdminAction(actionID string) error {
+	if h.actor == "" || h.owner != h.actor {
+		return store.ErrAccountForbidden
+	}
+	decision := authzsvc.NewService(h.caps.st).AuthorizeSystem(h.actor, actionID)
+	if !decision.Allowed {
+		return store.ErrAccountForbidden
+	}
+	return nil
+}
+
+func roleAdminRecord(view store.RoleAdminView) extension.RoleAdminRecord {
+	out := extension.RoleAdminRecord{RoleID: view.RoleID, Name: view.Name, Description: view.Description,
+		Enabled: view.Enabled, RoleVersion: view.RoleVersion, BindingCount: view.BindingCount,
+		Permissions: map[string]extension.RolePermission{}}
+	for _, permission := range view.Permissions {
+		out.Permissions[permission.ActionID] = extension.RolePermission{Allowed: permission.Allowed, CapAllowed: permission.CapAllowed}
+	}
+	return out
+}
+
+func (h inprocHost) ListRoles(ctx context.Context) ([]extension.RoleAdminRecord, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	if err := h.requireRoleAdminAction("system.roles.view"); err != nil {
+		return nil, err
+	}
+	result := []extension.RoleAdminRecord{}
+	cursor := ""
+	for {
+		roles, next, err := h.caps.st.ListRoles("", "fuzzy", "all", "", cursor, 100)
+		if err != nil {
+			return nil, err
+		}
+		for _, role := range roles {
+			result = append(result, roleAdminRecord(role))
+		}
+		if next == "" {
+			return result, nil
+		}
+		cursor = next
+	}
+}
+
+// ListRoleOptions is the read-only role directory for non-admin dispatch
+// actors: enabled roles only, projected as roleId+name, sorted by name then
+// roleId. It never requires system.roles.view and never exposes permissions,
+// bindings or counts; callers still authorize their own domain action.
+func (h inprocHost) ListRoleOptions(ctx context.Context) ([]extension.RoleOption, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
+	if _, err := h.rolePolicyActor(); err != nil {
+		return nil, err
+	}
+	result := []extension.RoleOption{}
+	cursor := ""
+	for {
+		roles, next, err := h.caps.st.ListRoles("", "fuzzy", "all", "", cursor, 100)
+		if err != nil {
+			return nil, err
+		}
+		for _, role := range roles {
+			if !role.Enabled {
+				continue
+			}
+			result = append(result, extension.RoleOption{RoleID: role.RoleID, Name: role.Name})
+		}
+		if next == "" {
+			sort.Slice(result, func(i, j int) bool {
+				if result[i].Name != result[j].Name {
+					return result[i].Name < result[j].Name
+				}
+				return result[i].RoleID < result[j].RoleID
+			})
+			return result, nil
+		}
+		cursor = next
+	}
+}
+
+var _ extension.RoleOptionsProvider = inprocHost{}
+
+func (h inprocHost) CreateRole(ctx context.Context, name, description string) (extension.RoleAdminRecord, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	if err := h.requireRoleAdminAction("system.roles.manage"); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	role, err := h.caps.st.CreateRole(h.actor, store.RoleCreate{Name: name, Description: description})
+	if err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	view, err := h.caps.st.RoleAdmin(role.RoleID)
+	return roleAdminRecord(view), err
+}
+
+func (h inprocHost) SetRolePermission(ctx context.Context, roleID, actionID string, allowed, capAllowed bool, key string) (extension.RoleAdminRecord, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	if err := h.requireRoleAdminAction("system.permissions.manage"); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	view, err := h.caps.st.RoleAdmin(roleID)
+	if err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	changes := make([]store.RolePermissionChange, 0, len(view.Permissions)+1)
+	found := false
+	for _, permission := range view.Permissions {
+		if permission.ActionID == actionID {
+			found = true
+			if permission.Allowed == allowed && permission.CapAllowed == capAllowed {
+				return roleAdminRecord(view), nil
+			}
+			permission.Allowed, permission.CapAllowed = allowed, capAllowed
+		}
+		changes = append(changes, store.RolePermissionChange{ActionID: permission.ActionID, Allowed: permission.Allowed, CapAllowed: permission.CapAllowed})
+	}
+	if !found {
+		changes = append(changes, store.RolePermissionChange{ActionID: actionID, Allowed: allowed, CapAllowed: capAllowed})
+	}
+	if key == "" {
+		return extension.RoleAdminRecord{}, store.ErrInvalidRolePolicy
+	}
+	if _, err := h.caps.st.ReplaceRolePermissions(h.actor, roleID, view.RoleVersion, changes, key+":"+strconv.FormatInt(view.RoleVersion, 10)); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	view, err = h.caps.st.RoleAdmin(roleID)
+	return roleAdminRecord(view), err
+}
+
+func (h inprocHost) AssignRoleByOwner(ctx context.Context, owner, roleID, key string) (extension.RoleBindingResult, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleBindingResult{}, err
+	}
+	if err := h.requireRoleAdminAction("system.roles.assign"); err != nil {
+		return extension.RoleBindingResult{}, err
+	}
+	target, err := h.caps.st.GetAccountByOwner(owner)
+	if err != nil {
+		return extension.RoleBindingResult{}, err
+	}
+	current, err := h.caps.st.RoleForUser(target.ID)
+	if err != nil {
+		return extension.RoleBindingResult{}, err
+	}
+	if current.Binding != nil && current.Binding.RoleID == roleID {
+		return extension.RoleBindingResult{BindingID: current.Binding.BindingID, UserID: target.ID, RoleID: roleID,
+			UserStateVersion: current.Binding.UserStateVersion, AuthorityEpoch: current.Binding.AuthorityEpoch}, nil
+	}
+	if key == "" {
+		return extension.RoleBindingResult{}, store.ErrInvalidRolePolicy
+	}
+	binding, err := h.caps.st.AssignUserRole(h.actor, target.ID, roleID, target.StateVersion, key+":"+strconv.FormatInt(target.StateVersion, 10))
+	if err != nil {
+		return extension.RoleBindingResult{}, err
+	}
+	return extension.RoleBindingResult{BindingID: binding.BindingID, UserID: binding.UserID, RoleID: binding.RoleID,
+		UserStateVersion: binding.UserStateVersion, AuthorityEpoch: binding.AuthorityEpoch}, nil
+}
+
+func (h inprocHost) SetRoleEnabled(ctx context.Context, roleID string, enabled bool) (extension.RoleAdminRecord, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	if err := h.requireRoleAdminAction("system.roles.manage"); err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	view, err := h.caps.st.RoleAdmin(roleID)
+	if err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	if view.Enabled == enabled {
+		return roleAdminRecord(view), nil
+	}
+	role, err := h.caps.st.PatchRole(h.actor, roleID, view.RoleVersion, store.RolePatch{Enabled: &enabled})
+	if err != nil {
+		return extension.RoleAdminRecord{}, err
+	}
+	view, err = h.caps.st.RoleAdmin(role.RoleID)
+	return roleAdminRecord(view), err
+}
+
+func (h inprocHost) ImportRoleAuthority(ctx context.Context, in extension.RoleAuthorityImport, key string) (extension.RoleAuthorityImportResult, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	if err := h.requireRoleAdminAction("system.permissions.manage"); err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	roles := make([]store.RoleAuthorityImportRole, 0, len(in.Roles))
+	for _, role := range in.Roles {
+		permissions := make([]store.RolePermissionChange, 0, len(role.Permissions))
+		for actionID, permission := range role.Permissions {
+			permissions = append(permissions, store.RolePermissionChange{ActionID: actionID,
+				Allowed: permission.Allowed, CapAllowed: permission.CapAllowed})
+		}
+		sort.Slice(permissions, func(i, j int) bool { return permissions[i].ActionID < permissions[j].ActionID })
+		roles = append(roles, store.RoleAuthorityImportRole{RoleID: role.RoleID, Name: role.Name,
+			Description: role.Description, Enabled: role.Enabled, RoleVersion: role.RoleVersion,
+			Permissions: permissions, Owners: append([]string(nil), role.Owners...)})
+	}
+	result, err := h.caps.st.ImportRoleAuthority(h.actor, store.RoleAuthorityImport{
+		SourceSchemaVersion: in.SourceSchemaVersion, SourceSHA256: in.SourceSHA256, Roles: roles}, key)
+	if err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	return extension.RoleAuthorityImportResult{AuthorityEpoch: result.AuthorityEpoch,
+		ImportedRoles: result.ImportedRoles, ImportedUsers: result.ImportedUsers}, nil
+}
+
+func (h inprocHost) ReadRoleAuthorityImport(ctx context.Context, sourceSHA string) (extension.RoleAuthorityImportProjection, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAuthorityImportProjection{}, err
+	}
+	if err := h.requireRoleAdminAction("system.permissions.manage"); err != nil {
+		return extension.RoleAuthorityImportProjection{}, err
+	}
+	staged, err := h.caps.st.ReadRoleAuthorityImport(h.actor, sourceSHA)
+	if err != nil {
+		return extension.RoleAuthorityImportProjection{}, err
+	}
+	roles := make([]extension.RoleAdminRecord, 0, len(staged.Roles))
+	bindings := map[string]string{}
+	for _, role := range staged.Roles {
+		permissions := map[string]extension.RolePermission{}
+		for _, permission := range role.Permissions {
+			permissions[permission.ActionID] = extension.RolePermission{Allowed: permission.Allowed, CapAllowed: permission.CapAllowed}
+		}
+		roles = append(roles, extension.RoleAdminRecord{RoleID: role.RoleID, Name: role.Name,
+			Description: role.Description, Enabled: role.Enabled, RoleVersion: role.RoleVersion,
+			BindingCount: len(role.Owners), Permissions: permissions})
+		for _, owner := range role.Owners {
+			bindings[owner] = role.RoleID
+		}
+	}
+	epoch, err := h.caps.st.AuthorityEpoch()
+	if err != nil {
+		return extension.RoleAuthorityImportProjection{}, err
+	}
+	return extension.RoleAuthorityImportProjection{SourceSHA256: staged.SourceSHA256,
+		AuthorityEpoch: epoch, Roles: roles, Bindings: bindings}, nil
+}
+
+func (h inprocHost) ActivateRoleAuthorityImport(ctx context.Context, sourceSHA string, expectedEpoch int64) (extension.RoleAuthorityImportResult, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	if err := h.requireRoleAdminAction("system.permissions.manage"); err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	result, err := h.caps.st.ActivateRoleAuthorityImport(h.actor, sourceSHA, expectedEpoch)
+	if err != nil {
+		return extension.RoleAuthorityImportResult{}, err
+	}
+	return extension.RoleAuthorityImportResult{AuthorityEpoch: result.AuthorityEpoch,
+		ImportedRoles: result.ImportedRoles, ImportedUsers: result.ImportedUsers}, nil
+}
+
 func (h inprocHost) KVPut(key, value string) error {
-	return h.caps.st.PutPluginKV(h.pluginID, h.owner, key, value)
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
+	return h.caps.st.PutPluginKVAccountChecked(h.owner, h.pluginID, key, value, h.caps.allowImplicitLocal)
 }

 func (h inprocHost) KVGet(key string) (string, bool, error) {
+	if err := h.requireEffective(); err != nil {
+		return "", false, err
+	}
 	return h.caps.st.GetPluginKV(h.pluginID, h.owner, key)
 }

 func (h inprocHost) Audit(action, target, evidence string) error {
-	return h.caps.st.AppendAuditEvent(store.AuditEvent{
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
+	if strings.HasPrefix(action, "model.context_manifest") {
+		return fmt.Errorf("extension: model context manifest is a reserved host receipt")
+	}
+	return h.caps.st.AppendAuditEventAccountChecked(h.owner, store.AuditEvent{
 		Owner: h.owner, Actor: "plugin:" + h.pluginID,
 		Action: action, Target: target, Evidence: evidence,
-	})
+	}, h.caps.allowImplicitLocal)
 }

 func (h inprocHost) Complete(ctx context.Context, prompt string) (string, error) {
+	if err := h.requireEffective(); err != nil {
+		return "", err
+	}
 	return h.caps.complete(ctx, h.owner, prompt)
 }

 func (h inprocHost) KnowledgeSearch(ctx context.Context, projectID core.ID, text string, topK int) ([]core.RetrievalHit, error) {
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
 	return h.caps.search(ctx, h.owner, projectID, text, topK)
 }

@@ -303,6 +845,9 @@ func (h inprocHost) knowledgeSource(source string) error {
 // "plugin:<id>"；embed=false 只写全文行，embed=true 走 IndexChunks 建向量
 // （embedding 失败降级纯全文，不阻断写入）。
 func (h inprocHost) KnowledgeWrite(ctx context.Context, docs []core.KnowledgeDoc, embed bool) error {
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
 	if len(docs) == 0 {
 		return nil
 	}
@@ -317,20 +862,21 @@ func (h inprocHost) KnowledgeWrite(ctx context.Context, docs []core.KnowledgeDoc
 		}
 	}
 	if !embed {
-		return h.caps.st.AddKnowledge(docs...)
+		return h.caps.st.AddKnowledgeAccountChecked(h.owner, h.caps.allowImplicitLocal, docs...)
 	}
-	return h.caps.pipe.IndexChunks(ctx, core.ID(h.owner), docs)
+	return h.caps.pipe.IndexChunksAccountChecked(ctx, core.ID(h.owner), docs, h.caps.allowImplicitLocal)
 }

 // KnowledgePublish replaces refs and their vectors within the publication scope.
 // A registered lifecycle scopes replacement to the exact owner/project/plugin;
 // ordinary unregistered Hosts retain the legacy cross-source ref semantics.
 func (h inprocHost) KnowledgePublish(ctx context.Context, docs []core.KnowledgeDoc, embed bool) error {
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
 	if len(docs) == 0 {
 		return nil
 	}
-	type publicationRef struct{ projectID, ref string }
-	refs := map[publicationRef]bool{}
 	for i := range docs {
 		docs[i].Owner = core.ID(h.owner)
 		if docs[i].Source == "" {
@@ -339,39 +885,33 @@ func (h inprocHost) KnowledgePublish(ctx context.Context, docs []core.KnowledgeD
 		if err := h.knowledgeSource(docs[i].Source); err != nil {
 			return err
 		}
-		if docs[i].Ref != "" {
-			refs[publicationRef{docs[i].ProjectID, docs[i].Ref}] = true
-		}
 	}
 	scoped := h.caps.projects != nil && h.caps.projects.active()
-	for ref := range refs {
-		var err error
-		if scoped {
-			err = h.caps.st.DeletePluginProjectKnowledgeByRef(ctx, h.owner, ref.projectID, ref.ref, h.pluginID)
-		} else {
-			err = h.caps.st.DeleteProjectKnowledgeByRef(ctx, h.owner, ref.projectID, ref.ref)
-		}
-		if err != nil {
-			return err
-		}
+	if embed {
+		return h.caps.pipe.PublishChunksAccountChecked(ctx, core.ID(h.owner), h.pluginID, scoped, docs, h.caps.allowImplicitLocal)
 	}
-
-	return h.KnowledgeWrite(ctx, docs, embed)
+	return h.caps.st.ReplaceKnowledgeAccountChecked(ctx, h.owner, h.pluginID, scoped, h.caps.allowImplicitLocal, docs...)
 }

 // KnowledgeDelete 撤销本插件来源（EXT-9）：前缀强制 plugin:<自身ID>——manual
 // 或他人来源拒绝（fail-closed）；删行+向量，幂等。
 func (h inprocHost) KnowledgeDelete(ctx context.Context, sourcePrefix string) error {
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
 	if sourcePrefix != "plugin:"+h.pluginID {
 		return fmt.Errorf("ext-9: plugins may only delete their own source prefix, want %q", "plugin:"+h.pluginID)
 	}
-	_, err := h.caps.st.DeleteKnowledgeBySource(ctx, h.owner, sourcePrefix)
+	_, err := h.caps.st.DeleteKnowledgeBySourceAccountChecked(ctx, h.owner, sourcePrefix, h.caps.allowImplicitLocal)
 	return err
 }

 // TaskCreate/TaskUpdate 后台任务台账：基座只记进度/状态，执行体由下游自跑（H5）。
 func (h inprocHost) TaskCreate(kind, title, conversationID string) (string, error) {
-	t, err := h.caps.st.CreateBackgroundTask(h.owner, kind, title, conversationID)
+	if err := h.requireEffective(); err != nil {
+		return "", err
+	}
+	t, err := h.caps.st.CreateBackgroundTaskAccountChecked(h.owner, kind, title, conversationID, h.caps.allowImplicitLocal)
 	if err != nil {
 		return "", err
 	}
@@ -379,27 +919,42 @@ func (h inprocHost) TaskCreate(kind, title, conversationID string) (string, erro
 }

 func (h inprocHost) TaskUpdate(taskID, status string, progress int, errText string) error {
-	return h.caps.st.UpdateBackgroundTask(h.owner, taskID, status, progress, errText)
+	if err := h.requireEffective(); err != nil {
+		return err
+	}
+	return h.caps.st.UpdateBackgroundTaskAccountChecked(h.owner, taskID, status, progress, errText, h.caps.allowImplicitLocal)
 }

 // ArtifactGet/ArtifactContent 工件只读（R1-3 ingest 读原件；写入属完整集）。
 func (h inprocHost) ArtifactGet(artifactID string) (core.Artifact, error) {
+	if err := h.requireEffective(); err != nil {
+		return core.Artifact{}, err
+	}
 	return h.caps.st.GetArtifact(h.owner, artifactID)
 }

 func (h inprocHost) ArtifactContent(artifactID string) ([]byte, error) {
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
 	return h.caps.st.ArtifactContent(h.owner, artifactID)
 }

 // ParseDocument 内置文档解析（EXT-5）：委托 hostcaps.parse；纯计算不经存储，
 // owner 作用域由调用方经 ArtifactContent 取字节时保证。
 func (h inprocHost) ParseDocument(ctx context.Context, filename, mime string, content []byte) (core.ParsedDocument, error) {
+	if err := h.requireEffective(); err != nil {
+		return core.ParsedDocument{}, err
+	}
 	return h.caps.parse(ctx, filename, mime, content)
 }

 // ---- EXT-17 Surface 能力（可选）：nil 槽=能力缺失，明确拒绝不降级 ----

 func (h inprocHost) surface() (*surfacesvc.Service, error) {
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
 	if h.caps.surfaces == nil {
 		return nil, surfacesvc.ErrUnavailable
 	}
@@ -411,11 +966,11 @@ func (h inprocHost) SurfaceSave(ctx context.Context, req extension.SurfaceSaveRe
 	if err != nil {
 		return core.SurfaceSnapshot{}, err
 	}
-	return svc.Submit(ctx, h.owner, h.pluginID, surfacesvc.SubmitRequest{
+	return svc.SubmitAccountChecked(ctx, h.owner, h.pluginID, surfacesvc.SubmitRequest{
 		SurfaceID: req.SurfaceID, ConversationID: req.ConversationID, SourceRunID: req.SourceRunID,
 		BaseRevision: req.BaseRevision, ObservedEpoch: req.ObservedEpoch,
 		ContextVersion: req.ContextVersion, SemanticText: req.SemanticText, Spec: req.Spec,
-	})
+	}, h.caps.allowImplicitLocal)
 }

 func (h inprocHost) SurfaceGet(ctx context.Context, surfaceID core.ID) (core.SurfaceSnapshot, error) {
@@ -0,0 +1,109 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+func TestCapabilityExplainProviderExplainsBoundActorOnly(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/capability-explain.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil {
+		t.Fatal(err)
+	}
+	alice, _ := st.GetAccountByOwner("alice")
+	role, err := st.CreateRole("admin", store.RoleCreate{Name: "项目负责人"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 收窄模型（R2）：职位角色只携带单一 project.create 行；document.* /
+	// project.* 等其他动作由系统授权或项目成员关系承担，写到角色行被
+	// ReplaceRolePermissions 拒绝（ErrInvalidRolePolicy）。fixture 只设
+	// project.create，断言围绕这条窄权限：CreateAuthority 投影到四个
+	// ProjectCreateLinkedActions、MemberBasicCollaborate 全 action-unconfigured、
+	// DocumentQualify 三职责都 action-unconfigured。
+	if _, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion,
+		[]store.RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}},
+		"explain-provider"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "explain-provider-assign"); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "alice", actor: "alice"}
+	provider, ok := any(h).(extension.CapabilityExplainProvider)
+	if !ok {
+		t.Fatal("dispatch host missing CapabilityExplainProvider")
+	}
+	ctx := context.Background()
+	capability, err := provider.CurrentCapabilityExplain(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if capability.SchemaVersion != extension.CapabilityExplainSchemaVersion || capability.UserID != alice.ID || capability.Owner != "alice" ||
+		capability.RoleID != role.RoleID || !capability.ProjectCreate.Allowed || capability.ProjectCreate.Source != extension.CapabilitySourceRole ||
+		len(capability.Linked) != 4 || len(capability.Conflicts) != 0 {
+		t.Fatalf("capability=%+v", capability)
+	}
+	snapshot, err := any(h).(extension.RolePolicyProvider).CurrentRolePolicy(ctx)
+	if err != nil || snapshot.Linked.Source != capability.ProjectCreate.Source || len(snapshot.Linked.Actions) != len(capability.Linked) {
+		t.Fatalf("snapshot linked=%+v err=%v", snapshot.Linked, err)
+	}
+	member, err := provider.CurrentMemberBasicCollaborate(ctx)
+	if err != nil || member.UserID != alice.ID || len(member.Actions) == 0 {
+		t.Fatalf("member=%+v err=%v", member, err)
+	}
+	// 角色权限投影：document.read 不在职位权限（只有 project.create），因此不能
+	// 被 Source=CapabilitySourceRole 标记为允许；来源必须是空、Reason 必须是
+	// "action-unconfigured"——这条边界保护正是窄模型的保护意图。
+	for _, action := range member.Actions {
+		if action.ActionID == "document.read" && (action.Allowed || action.Source == extension.CapabilitySourceRole || action.Reason != "action-unconfigured") {
+			t.Fatalf("document.read=%+v", action)
+		}
+	}
+	document, err := provider.CurrentDocumentQualify(ctx)
+	if err != nil || document.UserID != alice.ID || len(document.Duties) != 3 {
+		t.Fatalf("document=%+v err=%v", document, err)
+	}
+	// 三职责不被职位权限（project.create）直接资格化，因此 Qualified=false、
+	// DefaultAllowed=false、Source 空、Reason 为 action-unconfigured；这与
+	// 历史上「Allowed=false CapAllowed=true 单独写入」的职责资格语义不同——
+	// 那条路径已被 ReplaceRolePermissions 拒绝，本测试在不依赖该历史路径的
+	// 前提下保留职责资格投影的边界验证。
+	for _, duty := range document.Duties {
+		if duty.ActionID == "document.review" && (duty.Qualified || duty.DefaultAllowed || duty.Source == extension.CapabilitySourceRole || duty.Reason != "action-unconfigured") {
+			t.Fatalf("document.review=%+v", duty)
+		}
+	}
+
+	// A scoped Host without a dispatch actor cannot explain anyone.
+	scoped := any(inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "alice"}).(extension.CapabilityExplainProvider)
+	if _, err := scoped.CurrentCapabilityExplain(ctx); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("scoped capability: %v", err)
+	}
+	if _, err := scoped.CurrentMemberBasicCollaborate(ctx); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("scoped member: %v", err)
+	}
+	if _, err := scoped.CurrentDocumentQualify(ctx); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("scoped document: %v", err)
+	}
+	ghost := any(inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "ghost", actor: "ghost"}).(extension.CapabilityExplainProvider)
+	if _, err := ghost.CurrentCapabilityExplain(ctx); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("unknown actor: %v", err)
+	}
+	canceled, cancel := context.WithCancel(ctx)
+	cancel()
+	if _, err := provider.CurrentCapabilityExplain(canceled); !errors.Is(err, context.Canceled) {
+		t.Fatalf("canceled: %v", err)
+	}
+}
@@ -0,0 +1,104 @@
+package app
+
+import (
+	"fmt"
+	"time"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+func (h inprocHost) clock() time.Time {
+	if h.caps.now != nil {
+		return h.caps.now()
+	}
+	return time.Now()
+}
+
+func humanCommand(audience string) (string, error) {
+	if audience == extension.HumanDecisionAudienceStructure {
+		return "rdm.structure.decide", nil
+	}
+	return "", fmt.Errorf("extension: human decision audience is not issued for this host")
+}
+
+func humanEntranceAllowed(entrance string) bool {
+	switch entrance {
+	case "button", "card", "api":
+		return true
+	default:
+		return false
+	}
+}
+
+// IssueHumanDecision opens a pending card for the authenticated person.
+// Model-tool, chat, and slash entrances cannot open one.
+func (h inprocHost) IssueHumanDecision(binding extension.HumanDecisionBinding, question string) (extension.HumanDecisionCard, error) {
+	if h.caps.st == nil || h.actor == "" || h.actor != binding.Actor || !humanEntranceAllowed(h.entrance) {
+		return extension.HumanDecisionCard{}, fmt.Errorf("extension: human decision cannot be issued on this dispatch")
+	}
+	commandID, err := humanCommand(binding.Audience)
+	if err != nil {
+		return extension.HumanDecisionCard{}, err
+	}
+	if binding.ProjectID == "" || binding.ProposalID == "" || binding.ProposalRevision < 1 || binding.PayloadHash == "" {
+		return extension.HumanDecisionCard{}, fmt.Errorf("extension: human decision binding is incomplete")
+	}
+	rec, err := h.caps.st.IssueHumanDecision(store.HumanDecision{
+		PluginID: h.pluginID, Audience: binding.Audience, CommandID: commandID,
+		HumanActor: binding.Actor, Owner: h.owner, ProjectID: binding.ProjectID,
+		ProposalID: binding.ProposalID, ProposalRevision: binding.ProposalRevision,
+		PayloadHash: binding.PayloadHash, Question: question, ConversationID: string(h.conversationID),
+	}, h.clock())
+	if err != nil {
+		return extension.HumanDecisionCard{}, err
+	}
+	return extension.HumanDecisionCard{CardID: rec.ID, Question: rec.Question, ExpiresAt: rec.ExpiresAt}, nil
+}
+
+// VerifyHumanDecision reports the persisted human response for this dispatch.
+// A model tool, a forged entrance, a mismatched binding, an expired card, or
+// a revoked card fails closed. The record stays answered; it is not consumed.
+func (h inprocHost) VerifyHumanDecision(expected extension.HumanDecisionBinding) (extension.HumanDecisionProof, error) {
+	if h.caps.st == nil || h.humanGrant == nil || h.entrance == "agent" || h.actor == "" || h.actor != h.humanGrant.Actor {
+		return extension.HumanDecisionProof{}, fmt.Errorf("extension: this dispatch has no authenticated human decision")
+	}
+	rec, err := h.caps.st.HumanDecision(h.humanGrant.CardID)
+	if err != nil {
+		return extension.HumanDecisionProof{}, fmt.Errorf("extension: human decision card is not pending for this dispatch")
+	}
+	now := h.clock()
+	if rec.Status != "responded" || rec.PluginID != h.pluginID || rec.ProofID == "" || rec.ProofID != h.humanGrant.ProofID ||
+		rec.HumanActor != expected.Actor || rec.HumanActor != h.actor || rec.Decision != expected.Decision ||
+		rec.Audience != expected.Audience || rec.ProjectID != expected.ProjectID || rec.ProposalID != expected.ProposalID ||
+		rec.ProposalRevision != expected.ProposalRevision || rec.PayloadHash != expected.PayloadHash ||
+		!now.Before(rec.ExpiresAt) {
+		return extension.HumanDecisionProof{}, fmt.Errorf("extension: human decision does not match this dispatch")
+	}
+	return extension.HumanDecisionProof{
+		ProofID: rec.ProofID, Issuer: "agent-system-backend", HumanActor: rec.HumanActor,
+		Audience: rec.Audience, ProjectID: rec.ProjectID, ProposalID: rec.ProposalID,
+		Revision: rec.ProposalRevision, PayloadHash: rec.PayloadHash, Decision: rec.Decision,
+		IssuedAt: rec.IssuedAt, ExpiresAt: rec.ExpiresAt, ConversationID: rec.ConversationID,
+		HITLResponseRef: rec.ID,
+	}, nil
+}
+
+// RevokeHumanDecision invalidates a still-pending card. Answered proofs stay
+// available until they expire; consumption is not a host concern.
+func (h inprocHost) RevokeHumanDecision(cardID string) error {
+	if h.caps.st == nil || h.actor == "" || !humanEntranceAllowed(h.entrance) {
+		return fmt.Errorf("extension: human decision cannot be revoked on this dispatch")
+	}
+	return h.caps.st.RevokeHumanDecision(h.pluginID, h.actor, cardID)
+}
+
+// HumanGrantFromRecord copies the persisted response onto a dispatch.
+// Callers must set it only after an authenticated response or session retry.
+func HumanGrantFromRecord(rec store.HumanDecision) *cmdbus.HumanGrant {
+	if rec.ProofID == "" || rec.Status != "responded" {
+		return nil
+	}
+	return &cmdbus.HumanGrant{CardID: rec.ID, ProofID: rec.ProofID, Actor: rec.HumanActor, Decision: rec.Decision}
+}
@@ -0,0 +1,170 @@
+package app
+
+import (
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+func openDecisionStore(t *testing.T) *store.Store {
+	t.Helper()
+	st, err := store.OpenSQLite(t.TempDir() + "/decision.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st
+}
+
+func decisionHost(st *store.Store, plugin, actor, entrance string, now time.Time, grant *cmdbus.HumanGrant) inprocHost {
+	return inprocHost{
+		caps:     hostcaps{st: st, now: func() time.Time { return now }},
+		pluginID: plugin, owner: actor, actor: actor, entrance: entrance, humanGrant: grant,
+	}
+}
+
+func binding(decision, hash string, revision int) extension.HumanDecisionBinding {
+	return extension.HumanDecisionBinding{
+		Audience: extension.HumanDecisionAudienceStructure, Actor: "alice", ProjectID: "p1",
+		ProposalID: "prop-1", ProposalRevision: revision, PayloadHash: hash, Decision: decision,
+	}
+}
+
+func TestHumanDecisionAuthenticatedResponse(t *testing.T) {
+	st := openDecisionStore(t)
+	now := time.Date(2026, 10, 15, 1, 0, 0, 0, time.UTC)
+	host := decisionHost(st, "rdm", "alice", "button", now, nil)
+	card, err := host.IssueHumanDecision(binding("", "hash-1", 1), "确认结构变更")
+	if err != nil {
+		t.Fatal(err)
+	}
+	answered, err := st.RespondHumanDecision("alice", card.CardID, "accept", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	host.humanGrant = &cmdbus.HumanGrant{CardID: answered.ID, ProofID: answered.ProofID, Actor: "alice", Decision: "accept"}
+	host.entrance = "card"
+	proof, err := host.VerifyHumanDecision(binding("accept", "hash-1", 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if proof.ProofID == "" || proof.Issuer != "agent-system-backend" || proof.HumanActor != "alice" ||
+		proof.HITLResponseRef != card.CardID || proof.PayloadHash != "hash-1" {
+		t.Fatalf("proof = %+v", proof)
+	}
+	again, err := host.VerifyHumanDecision(binding("accept", "hash-1", 1))
+	if err != nil || again.ProofID != proof.ProofID {
+		t.Fatalf("second verify consumed or changed the proof: %v %+v", err, again)
+	}
+	stored, err := st.HumanDecision(card.CardID)
+	if err != nil || stored.Status != "responded" {
+		t.Fatalf("host consumed the proof, status=%s err=%v", stored.Status, err)
+	}
+}
+
+func TestHumanDecisionRejectsUntrustedDispatch(t *testing.T) {
+	st := openDecisionStore(t)
+	now := time.Date(2026, 10, 15, 1, 0, 0, 0, time.UTC)
+	host := decisionHost(st, "rdm", "alice", "button", now, nil)
+	card, err := host.IssueHumanDecision(binding("", "hash-1", 1), "确认")
+	if err != nil {
+		t.Fatal(err)
+	}
+	answered, err := st.RespondHumanDecision("alice", card.CardID, "accept", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	grant := &cmdbus.HumanGrant{CardID: answered.ID, ProofID: answered.ProofID, Actor: "alice", Decision: "accept"}
+	expect := binding("accept", "hash-1", 1)
+
+	agent := decisionHost(st, "rdm", "alice", "agent", now, grant)
+	if _, err := agent.VerifyHumanDecision(expect); err == nil {
+		t.Fatal("model tool dispatch verified a human decision")
+	}
+	forged := decisionHost(st, "rdm", "alice", "card", now, nil)
+	if _, err := forged.VerifyHumanDecision(expect); err == nil {
+		t.Fatal("forged entrance verified without a host grant")
+	}
+	if _, err := decisionHost(st, "rdm", "alice", "agent", now, nil).IssueHumanDecision(binding("", "hash-2", 1), "x"); err == nil {
+		t.Fatal("model tool issued a human decision card")
+	}
+	if _, err := decisionHost(st, "other", "alice", "card", now, grant).VerifyHumanDecision(expect); err == nil {
+		t.Fatal("another plugin reused the proof")
+	}
+	other := expect
+	other.ProposalID = "prop-2"
+	if _, err := decisionHost(st, "rdm", "alice", "card", now, grant).VerifyHumanDecision(other); err == nil {
+		t.Fatal("proof authorized a second proposal")
+	}
+	wrongActor := expect
+	wrongActor.Actor = "bob"
+	if _, err := decisionHost(st, "rdm", "bob", "card", now, grant).VerifyHumanDecision(wrongActor); err == nil {
+		t.Fatal("wrong actor verified")
+	}
+	wrongProject := expect
+	wrongProject.ProjectID = "p2"
+	if _, err := decisionHost(st, "rdm", "alice", "card", now, grant).VerifyHumanDecision(wrongProject); err == nil {
+		t.Fatal("wrong project verified")
+	}
+	wrongRev := expect
+	wrongRev.ProposalRevision = 2
+	if _, err := decisionHost(st, "rdm", "alice", "card", now, grant).VerifyHumanDecision(wrongRev); err == nil {
+		t.Fatal("wrong revision verified")
+	}
+	wrongHash := expect
+	wrongHash.PayloadHash = "hash-changed"
+	if _, err := decisionHost(st, "rdm", "alice", "card", now, grant).VerifyHumanDecision(wrongHash); err == nil {
+		t.Fatal("wrong payload hash verified")
+	}
+	if _, err := decisionHost(st, "rdm", "alice", "button", now, nil).IssueHumanDecision(
+		extension.HumanDecisionBinding{Audience: "other.plugin", Actor: "alice", ProjectID: "p1", ProposalID: "prop-1", ProposalRevision: 1, PayloadHash: "h"},
+		"x"); err == nil {
+		t.Fatal("foreign audience was issued")
+	}
+}
+
+func TestHumanDecisionCardChangeExpiryAndRevoke(t *testing.T) {
+	st := openDecisionStore(t)
+	now := time.Date(2026, 10, 15, 1, 0, 0, 0, time.UTC)
+	host := decisionHost(st, "rdm", "alice", "api", now, nil)
+	first, err := host.IssueHumanDecision(binding("", "hash-1", 1), "旧卡")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := host.IssueHumanDecision(binding("", "hash-2", 2), "新卡"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.RespondHumanDecision("alice", first.CardID, "accept", now); err == nil {
+		t.Fatal("changed card still accepted the old confirmation")
+	}
+	current, err := host.IssueHumanDecision(binding("", "hash-3", 3), "待撤销")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := host.RevokeHumanDecision(current.CardID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.RespondHumanDecision("alice", current.CardID, "accept", now); err == nil {
+		t.Fatal("revoked card was answered")
+	}
+	live, err := host.IssueHumanDecision(binding("", "hash-4", 4), "会过期")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.RespondHumanDecision("alice", live.CardID, "accept", now.Add(16*time.Minute)); err == nil {
+		t.Fatal("expired card was answered")
+	}
+}
+
+func TestMissingHumanDecisionStoreFailsClosed(t *testing.T) {
+	host := decisionHost(nil, "rdm", "alice", "button", time.Now(), nil)
+	if _, err := host.IssueHumanDecision(binding("", "hash-1", 1), "x"); err == nil {
+		t.Fatal("missing store issued a card")
+	}
+	if _, err := host.VerifyHumanDecision(binding("accept", "hash-1", 1)); err == nil {
+		t.Fatal("missing store verified a decision")
+	}
+}
@@ -78,6 +78,9 @@ func TestInprocHostOwnerScope(t *testing.T) {
 	bus, st := newInprocTestApp(t, nil) // embedder nil：embed=true 仍只落全文（IndexChunks 降级路径）

 	for _, owner := range []string{"alice", "bob"} {
+		if err := st.EnsureUser(owner, ""); err != nil {
+			t.Fatal(err)
+		}
 		resp := bus.Dispatch(context.Background(), cmdbus.Request{
 			ID: "tst.record", Params: map[string]any{"ref": owner + "-ref"}, Owner: owner, Actor: "ui", Entrance: "chat",
 		})
@@ -157,6 +160,9 @@ func TestInprocHostKnowledgeWriteEmbedHash(t *testing.T) {
 		},
 	})
 	bus, st := newInprocTestApp(t, func() string { return "hash" })
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}

 	resp := bus.Dispatch(context.Background(), cmdbus.Request{
 		ID: "tst.embed", Params: map[string]any{"text": "Hash 向量内容"}, Owner: "alice", Entrance: "api",
@@ -16,6 +16,11 @@ func TestHostKnowledgeV2AndProjectReplacement(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
+	for _, owner := range []string{"alice", "bob"} {
+		if err := st.EnsureUser(owner, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
 	pipe := rag.NewPipeline(st, settings.NewService(st), nil, nil)
 	auth := &projectAuthz{}
 	alice := inprocHost{owner: "alice", pluginID: "rdm", caps: hostcaps{st: st, pipe: pipe, authz: auth}}
@@ -76,6 +81,9 @@ func TestRegisteredProjectHostRejectsForeignKnowledgeSource(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
 	slot := &projectLifecycleSlot{}
 	caps := hostcaps{st: st, projects: slot}
 	if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
@@ -110,6 +118,9 @@ func TestProjectPublishPreservesForeignPluginAndScope(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
 	slot := &projectLifecycleSlot{}
 	caps := hostcaps{st: st, projects: slot}
 	if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
@@ -150,6 +161,9 @@ func TestUnregisteredPublishRetainsLegacyRefScope(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
 	if err := st.AddKnowledge(core.KnowledgeDoc{ID: "legacy", Owner: "alice", ProjectID: "old-project", Source: "manual", Ref: "same", Chunk: "legacyneedle"}); err != nil {
 		t.Fatal(err)
 	}
@@ -0,0 +1,98 @@
+package app
+
+import (
+	"errors"
+	"path/filepath"
+	"testing"
+
+	"agent-system-backend/internal/store"
+)
+
+func TestLocalOwnerAccountCreationAndReissuePreserveIdentity(t *testing.T) {
+	dir := t.TempDir()
+	seed, err := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := seed.EnsureSystemIdentity("test-local-owner", "sqlite"); err != nil {
+		t.Fatal(err)
+	}
+	bootstrap, err := seed.BootstrapFirstAdmin("root", "root", "test")
+	if err != nil || bootstrap == "" {
+		t.Fatalf("bootstrap: %v", err)
+	}
+	seed.Close()
+	first, _, err := CreateUserAccount("", dir, "alice", "", "", false, true, false)
+	if err != nil || first == "" {
+		t.Fatalf("local pending create: %v", err)
+	}
+	st, err := store.OpenExistingSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	account, err := st.GetAccountByOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	st.Close()
+	second, owner, err := InitializeAccount("", dir, account.ID, account.StateVersion, account.InitializationGeneration)
+	if err != nil || owner != "alice" || second == first {
+		t.Fatalf("owner reissue: owner=%s err=%v", owner, err)
+	}
+	st, err = store.OpenExistingSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	current, err := st.GetAccount(account.ID)
+	if err != nil || current.Owner != account.Owner || current.ID != account.ID || current.InitializationGeneration != account.InitializationGeneration+1 {
+		t.Fatalf("reissue changed account identity: %+v %v", current, err)
+	}
+	if _, _, err := st.RedeemLoginKey(first); err == nil {
+		t.Fatal("old activation grant survived reissue")
+	}
+	if _, _, err := st.RedeemLoginKey(second); err != nil {
+		t.Fatalf("new activation grant failed: %v", err)
+	}
+}
+
+func TestAPIKeyCLIRequiresExistingInitializedAccount(t *testing.T) {
+	dir := t.TempDir()
+	st, err := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.EnsureSystemIdentity("test-api-key-admission", "sqlite"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := CreateAPIKey("", dir, "alice", "integration"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing account was implicitly created: %v", err)
+	}
+	grant, err := st.BootstrapFirstAdmin("alice", "alice", "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	st.Close()
+	if _, err := CreateAPIKey("", dir, "alice", "integration"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("pending account received a full API key: %v", err)
+	}
+	st, err = store.OpenExistingSQLite(filepath.Join(dir, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	token, _, err := st.RedeemLoginKey(grant)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash, err := store.HashPassword("trusted-owner-password")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.CompleteSetPasswordChecked(token, hash); err != nil {
+		t.Fatal(err)
+	}
+	if key, err := CreateAPIKey("", dir, "alice", "integration"); err != nil || key == "" {
+		t.Fatalf("initialized account could not receive its API key: %v", err)
+	}
+}
@@ -0,0 +1,336 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+// projectAuditSlot binds the audit.read policy to its registering domain plugin.
+// A different plugin cannot borrow that policy through its own Host handle.
+type projectAuditSlot struct {
+	mu             sync.RWMutex
+	holder         string
+	check          extension.ProjectAuditAuthorizer
+	verifier       extension.ProjectAuditLinkVerifier
+	disclose       extension.ProjectAuditDisclosureAuthorizer
+	publisherToken *auditPublisherToken
+}
+
+// This identity is available only to the publisher factory returned at
+// registration. A caller-provided pluginID cannot manufacture the pointer.
+type auditPublisherToken struct{ marker byte }
+
+type projectAuditPublisherFactory struct {
+	caps     hostcaps
+	pluginID string
+	token    *auditPublisherToken
+}
+
+func (f projectAuditPublisherFactory) ForOwner(owner string) (extension.ProjectAuditPublisher, error) {
+	if owner == "" || f.token == nil {
+		return nil, extension.ErrProjectAuditDenied
+	}
+	return projectAuditPublisher{caps: f.caps, owner: owner, pluginID: f.pluginID, token: f.token}, nil
+}
+
+type projectAuditPublisher struct {
+	caps     hostcaps
+	owner    string
+	pluginID string
+	token    *auditPublisherToken
+}
+
+func (p projectAuditPublisher) PublishProjectAuditLink(ctx context.Context, req extension.ProjectAuditLinkRequest) (extension.ProjectAuditLinkReceipt, error) {
+	h := inprocHost{caps: p.caps, owner: p.owner, pluginID: p.pluginID}
+	return h.publishProjectAuditLink(ctx, req, p.token)
+}
+
+func (s *projectAuditSlot) register(pluginID string, check extension.ProjectAuditAuthorizer) error {
+	if pluginID == "" || check == nil {
+		return extension.ErrProjectAuditUnsupported
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.check != nil || (s.holder != "" && s.holder != pluginID) {
+		return errors.New("extension: project audit authorizer already registered")
+	}
+	s.holder, s.check = pluginID, check
+	return nil
+}
+
+func (s *projectAuditSlot) registerVerifier(pluginID string, verify extension.ProjectAuditLinkVerifier) (*auditPublisherToken, error) {
+	if pluginID == "" || verify == nil {
+		return nil, extension.ErrProjectAuditUnsupported
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.verifier != nil || (s.holder != "" && s.holder != pluginID) {
+		return nil, errors.New("extension: project audit verifier already registered")
+	}
+	s.holder, s.verifier = pluginID, verify
+	s.publisherToken = &auditPublisherToken{marker: 1}
+	return s.publisherToken, nil
+}
+
+func (s *projectAuditSlot) registerDisclosure(pluginID string, disclose extension.ProjectAuditDisclosureAuthorizer) error {
+	if pluginID == "" || disclose == nil {
+		return extension.ErrProjectAuditUnsupported
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.disclose != nil || (s.holder != "" && s.holder != pluginID) {
+		return errors.New("extension: project audit disclosure authorizer already registered")
+	}
+	s.holder, s.disclose = pluginID, disclose
+	return nil
+}
+
+func (r compiledRegistry) RegisterProjectAuditAuthorizer(extension.ProjectAuditAuthorizer) error {
+	return errors.New("extension: declarative plugins cannot register project audit authorizers")
+}
+
+func (r pluginRegistry) RegisterProjectAuditAuthorizer(check extension.ProjectAuditAuthorizer) error {
+	if r.caps.projectAudit == nil {
+		return extension.ErrProjectAuditUnsupported
+	}
+	return r.caps.projectAudit.register(r.pluginID, check)
+}
+
+func (r recordRegistry) RegisterProjectAuditAuthorizer(check extension.ProjectAuditAuthorizer) error {
+	reg, ok := r.Registry.(extension.ProjectAuditRegistry)
+	if !ok {
+		return extension.ErrProjectAuditUnsupported
+	}
+	return reg.RegisterProjectAuditAuthorizer(check)
+}
+
+func (r compiledRegistry) RegisterProjectAuditLinkVerifier(extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
+	return nil, errors.New("extension: declarative plugins cannot register project audit link verifiers")
+}
+func (r compiledRegistry) RegisterProjectAuditDisclosureAuthorizer(extension.ProjectAuditDisclosureAuthorizer) error {
+	return errors.New("extension: declarative plugins cannot register project audit disclosure authorizers")
+}
+func (r pluginRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
+	if r.caps.projectAudit == nil {
+		return nil, extension.ErrProjectAuditUnsupported
+	}
+	token, err := r.caps.projectAudit.registerVerifier(r.pluginID, verify)
+	if err != nil {
+		return nil, err
+	}
+	return projectAuditPublisherFactory{caps: r.caps, pluginID: r.pluginID, token: token}, nil
+}
+func (r pluginRegistry) RegisterProjectAuditDisclosureAuthorizer(disclose extension.ProjectAuditDisclosureAuthorizer) error {
+	if r.caps.projectAudit == nil {
+		return extension.ErrProjectAuditUnsupported
+	}
+	return r.caps.projectAudit.registerDisclosure(r.pluginID, disclose)
+}
+func (r recordRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
+	reg, ok := r.Registry.(extension.ProjectAuditLinkRegistry)
+	if !ok {
+		return nil, extension.ErrProjectAuditUnsupported
+	}
+	return reg.RegisterProjectAuditLinkVerifier(verify)
+}
+func (r recordRegistry) RegisterProjectAuditDisclosureAuthorizer(disclose extension.ProjectAuditDisclosureAuthorizer) error {
+	reg, ok := r.Registry.(extension.ProjectAuditLinkRegistry)
+	if !ok {
+		return extension.ErrProjectAuditUnsupported
+	}
+	return reg.RegisterProjectAuditDisclosureAuthorizer(disclose)
+}
+
+var _ extension.ProjectAuditHost = inprocHost{}
+var _ extension.ProjectAuditPublisher = projectAuditPublisher{}
+var _ extension.ProjectAuditPublisherFactory = projectAuditPublisherFactory{}
+
+func (h inprocHost) publishProjectAuditLink(ctx context.Context, req extension.ProjectAuditLinkRequest, capability *auditPublisherToken) (extension.ProjectAuditLinkReceipt, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	if h.caps.projectAudit == nil || h.caps.st == nil {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditUnsupported
+	}
+	slot := h.caps.projectAudit
+	slot.mu.RLock()
+	holder, verify, registeredToken := slot.holder, slot.verifier, slot.publisherToken
+	slot.mu.RUnlock()
+	if holder != h.pluginID || verify == nil || registeredToken == nil || capability != registeredToken {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditUnsupported
+	}
+	if h.owner == "" || (h.actor != "" && h.actor != h.owner) || req.HostAuditOffset < 0 || req.ProjectID == "" || req.SourceKind != "domain-commit" || req.SourceID == "" || req.OperationID == "" || req.ResourceKind == "" || req.ResourceID == "" || req.DisclosureClass != "metadata" || req.IdempotencyKey == "" {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+	}
+	// An explicit offset is only a locator. A historical collision or a forged
+	// offset must not turn a private command with the same operation ID into a
+	// published project receipt.
+	resolved, err := h.caps.st.CommittedAuditOffset(h.owner, string(req.ProjectID), req.OperationID)
+	if errors.Is(err, store.ErrNotFound) {
+		if req.HostAuditOffset == 0 {
+			return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditPending
+		}
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+	}
+	if errors.Is(err, store.ErrConflict) {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+	}
+	if err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	if req.HostAuditOffset != 0 && req.HostAuditOffset != resolved {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+	}
+	req.HostAuditOffset = resolved
+	row, projectID, err := h.caps.st.CommandAuditForLink(h.owner, req.HostAuditOffset)
+	if errors.Is(err, store.ErrNotFound) {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+	}
+	if err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	if projectID != string(req.ProjectID) || row.Envelope.Actor != h.owner || row.Envelope.OperationID != req.OperationID || string(row.Envelope.State) != "committed" || row.Envelope.RunID != req.RunID {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+	}
+	if req.RunID != "" {
+		bound, err := h.caps.st.RunBoundToAudit(h.owner, projectID, row.Envelope.ConversationID, req.RunID)
+		if err != nil {
+			return extension.ProjectAuditLinkReceipt{}, err
+		}
+		if !bound {
+			return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+		}
+	}
+	previous, lookupErr := h.caps.st.ProjectAuditLinkByKey(h.owner, req.IdempotencyKey)
+	if lookupErr == nil {
+		if previous.HostAuditOffset != req.HostAuditOffset || previous.ProjectID != string(req.ProjectID) || previous.SourceKind != req.SourceKind || previous.SourceID != req.SourceID || previous.OperationID != req.OperationID || previous.ResourceKind != req.ResourceKind || previous.ResourceID != req.ResourceID || previous.RunID != req.RunID || previous.DisclosureClass != req.DisclosureClass {
+			return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+		}
+		return extension.ProjectAuditLinkReceipt{LinkID: previous.ID, HostAuditOffset: previous.HostAuditOffset}, nil
+	}
+	if !errors.Is(lookupErr, store.ErrNotFound) {
+		return extension.ProjectAuditLinkReceipt{}, lookupErr
+	}
+	proof := extension.ProjectAuditLinkProof{ProjectAuditLinkRequest: req, Owner: h.owner}
+	ok, err := verify(ctx, proof)
+	if err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	if !ok {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
+	}
+	if err := ctx.Err(); err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	link := store.ProjectAuditLink{HostAuditOffset: req.HostAuditOffset, ProjectID: projectID, Owner: h.owner,
+		SourceKind: req.SourceKind, SourceID: req.SourceID, OperationID: req.OperationID, ResourceKind: req.ResourceKind,
+		ResourceID: req.ResourceID, RunID: req.RunID, DisclosureClass: req.DisclosureClass, IdempotencyKey: req.IdempotencyKey}
+	saved, err := h.caps.st.SaveProjectAuditLink(link)
+	if errors.Is(err, store.ErrConflict) {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+	}
+	if err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	return extension.ProjectAuditLinkReceipt{LinkID: saved.ID, HostAuditOffset: saved.HostAuditOffset}, nil
+}
+
+func (h inprocHost) QueryProjectAudit(ctx context.Context, q extension.ProjectAuditQuery) (extension.ProjectAuditPage, error) {
+	if err := ctx.Err(); err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	if h.actor == "" || h.actor != h.owner || q.ProjectID == "" {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditDenied
+	}
+	if h.caps.projectAudit == nil || h.caps.st == nil {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditUnsupported
+	}
+	slot := h.caps.projectAudit
+	slot.mu.RLock()
+	holder, check := slot.holder, slot.check
+	slot.mu.RUnlock()
+	if holder != h.pluginID || check == nil {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditUnsupported
+	}
+	ok, err := check(h.actor, core.ID(q.ProjectID))
+	if err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	if !ok {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditDenied
+	}
+	if err := ctx.Err(); err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	if q.LinkedSourceKind != "" || q.LinkedSourceID != "" || q.LinkedHostOffset != 0 {
+		return h.queryLinkedProjectAudit(ctx, q, slot)
+	}
+	rows, cutoff, next, err := h.caps.st.ListProjectCommandAudits(h.owner, string(q.ProjectID), q.BeforeOffset, q.CutoffOffset, q.Limit)
+	if err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	page := extension.ProjectAuditPage{
+		Receipts:   make([]extension.HostAuditReceipt, 0, len(rows)),
+		NextOffset: next, CutoffOffset: cutoff,
+		Coverage: extension.ProjectAuditCoverage{
+			CommandAudit: "actor-owned-project-bound-only", CutoffConsistency: "committed-prefix", CrossMember: "unsupported", LegacyProjectBinding: "not-recorded", RunRelations: "unsupported", ModelReceipts: "unsupported",
+			BackgroundReceipts: "unsupported", ResourceBodies: "unsupported",
+		},
+	}
+	for _, row := range rows {
+		nameStatus := "not-recorded"
+		if row.ActorName != "" {
+			nameStatus = "recorded"
+		}
+		page.Receipts = append(page.Receipts, extension.HostAuditReceipt{
+			SourceOffset: row.Offset, Time: row.Envelope.Time, ActorID: row.Envelope.Actor,
+			ActorName: row.ActorName, ActorNameStatus: nameStatus,
+			CommandID: row.Envelope.CommandID, State: string(row.Envelope.State),
+			OperationID: row.Envelope.OperationID, ConversationID: row.Envelope.ConversationID,
+		})
+	}
+	return page, nil
+}
+
+func (h inprocHost) queryLinkedProjectAudit(ctx context.Context, q extension.ProjectAuditQuery, slot *projectAuditSlot) (extension.ProjectAuditPage, error) {
+	if q.LinkedSourceKind != "domain-commit" || q.LinkedSourceID == "" || q.LinkedHostOffset <= 0 || q.BeforeOffset != 0 || q.CutoffOffset != 0 {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditUnsupported
+	}
+	slot.mu.RLock()
+	disclose := slot.disclose
+	slot.mu.RUnlock()
+	if disclose == nil {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditUnsupported
+	}
+	link, row, err := h.caps.st.ProjectAuditLinkedReceipt(string(q.ProjectID), q.LinkedSourceKind, q.LinkedSourceID, q.LinkedHostOffset)
+	if errors.Is(err, store.ErrNotFound) {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditDenied
+	}
+	if err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	resource := extension.ProjectAuditLinkedResource{ProjectID: q.ProjectID, Owner: link.Owner, SourceKind: link.SourceKind, SourceID: link.SourceID,
+		OperationID: link.OperationID, ResourceKind: link.ResourceKind, ResourceID: link.ResourceID, RunID: link.RunID, DisclosureClass: link.DisclosureClass}
+	allowed, err := disclose(ctx, h.actor, resource)
+	if err != nil {
+		return extension.ProjectAuditPage{}, err
+	}
+	if !allowed.Metadata {
+		return extension.ProjectAuditPage{}, extension.ErrProjectAuditDenied
+	}
+	nameStatus := "not-recorded"
+	if row.ActorName != "" {
+		nameStatus = "recorded"
+	}
+	return extension.ProjectAuditPage{Receipts: []extension.HostAuditReceipt{{SourceOffset: row.Offset, Time: row.Envelope.Time,
+		ActorID: row.Envelope.Actor, ActorName: row.ActorName, ActorNameStatus: nameStatus, CommandID: row.Envelope.CommandID,
+		State: string(row.Envelope.State), OperationID: row.Envelope.OperationID}},
+		Coverage: extension.ProjectAuditCoverage{CommandAudit: "verified-exact-link-only", CrossMember: "verified-exact-link-only",
+			CutoffConsistency: "exact-link", LegacyProjectBinding: "not-recorded", RunRelations: "unsupported",
+			ModelReceipts: "unsupported", BackgroundReceipts: "unsupported", ResourceBodies: "unsupported"}}, nil
+}
@@ -0,0 +1,184 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+func TestProjectAuditLinkSharesOnlyVerifiedCommittedMetadata(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "audit.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice at action"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.EnsureUser("bob", "Bob"); err != nil {
+		t.Fatal(err)
+	}
+	p, err := st.CreateProject("alice", "A")
+	if err != nil {
+		t.Fatal(err)
+	}
+	otherProject, err := st.CreateProject("alice", "B")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := st.CreateConversation("alice", string(p.ID), "private", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.AppendAudit("alice", agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: "rdm.confirm", OperationID: "op-1", ConversationID: string(c.ID), State: agentcommand.StateCommitted, ParamsDigest: "secret-digest"}); err != nil {
+		t.Fatal(err)
+	}
+	private, _, _, err := st.ListProjectCommandAudits("alice", string(p.ID), 0, 0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	offset := private[0].Offset
+	slot := &projectAuditSlot{}
+	caps := hostcaps{st: st, projectAudit: slot}
+	reg := pluginRegistry{pluginID: "rdm", caps: caps}
+	auditAllowed := true
+	if err := reg.RegisterProjectAuditAuthorizer(func(actor string, projectID core.ID) (bool, error) {
+		return auditAllowed && actor == "bob" && projectID == p.ID, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	publisherFactory, err := (recordRegistry{Registry: reg}).RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
+		return proof.Owner == "alice" && proof.ProjectID == p.ID && proof.SourceKind == "domain-commit" && proof.SourceID == "commit-1" && proof.OperationID == "op-1" && proof.ResourceKind == "document" && proof.ResourceID == "doc-1", nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	metadataAllowed := true
+	if err := reg.RegisterProjectAuditDisclosureAuthorizer(func(_ context.Context, actor string, resource extension.ProjectAuditLinkedResource) (extension.ProjectAuditDisclosure, error) {
+		return extension.ProjectAuditDisclosure{Metadata: metadataAllowed && actor == "bob" && resource.ResourceID == "doc-1"}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	bob := inprocHost{caps: caps, pluginID: "rdm", owner: "bob", actor: "bob"}
+	q := extension.ProjectAuditQuery{ProjectID: p.ID, LinkedSourceKind: "domain-commit", LinkedSourceID: "commit-1", LinkedHostOffset: offset}
+	if _, err := bob.QueryProjectAudit(context.Background(), q); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("unlinked private audit: %v", err)
+	}
+	alicePublisher, err := publisherFactory.ForOwner("alice") // capability retained by trusted RDM outbox
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := alicePublisher.(extension.Host); ok {
+		t.Fatal("publisher factory exposed a full owner-scoped Host")
+	}
+	linkReq := extension.ProjectAuditLinkRequest{ProjectID: p.ID, SourceKind: "domain-commit", SourceID: "commit-1", OperationID: "op-1", ResourceKind: "document", ResourceID: "doc-1", DisclosureClass: "metadata", IdempotencyKey: "outbox-1"}
+	// A different compiled plugin can call the public scoped-host factory with
+	// "rdm" as text. That must not mint RDM's audit publication authority.
+	wireScopedHostFactory(caps)
+	t.Cleanup(func() { extension.SetScopedHostFactory(nil) })
+	forged, err := extension.NewScopedHost("alice", "rdm")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publisher, ok := forged.(extension.ProjectAuditPublisher); ok {
+		if _, err := publisher.PublishProjectAuditLink(context.Background(), linkReq); !errors.Is(err, extension.ErrProjectAuditUnsupported) {
+			t.Fatalf("self-reported plugin ID minted audit publisher: %v", err)
+		}
+	}
+	if rows, err := bob.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: p.ID}); err != nil || len(rows.Receipts) != 0 {
+		t.Fatalf("private owner row visible without exact link: %+v %v", rows, err)
+	}
+	wrongProject := linkReq
+	wrongProject.ProjectID = otherProject.ID
+	wrongProject.HostAuditOffset = offset
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), wrongProject); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("wrong host project: %v", err)
+	}
+	uncommitted := linkReq
+	uncommitted.SourceID, uncommitted.IdempotencyKey = "uncommitted", "outbox-uncommitted"
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), uncommitted); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("uncommitted source: %v", err)
+	}
+	if _, err := (pluginRegistry{pluginID: "other", caps: caps}).RegisterProjectAuditLinkVerifier(func(context.Context, extension.ProjectAuditLinkProof) (bool, error) { return true, nil }); err == nil {
+		t.Fatal("other plugin replaced the registered verifier")
+	}
+	pending := linkReq
+	pending.OperationID, pending.IdempotencyKey = "op-not-yet-recorded", "outbox-pending"
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), pending); !errors.Is(err, extension.ErrProjectAuditPending) {
+		t.Fatalf("host receipt race must be retryable: %v", err)
+	}
+	first, err := alicePublisher.PublishProjectAuditLink(context.Background(), linkReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.HostAuditOffset != offset {
+		t.Fatalf("trusted resolved offset: got %d want %d", first.HostAuditOffset, offset)
+	}
+	retry, err := alicePublisher.PublishProjectAuditLink(context.Background(), linkReq)
+	if err != nil || retry.LinkID != first.LinkID {
+		t.Fatalf("idempotent retry: first=%+v retry=%+v err=%v", first, retry, err)
+	}
+	page, err := bob.QueryProjectAudit(context.Background(), q)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page.Receipts) != 1 || page.Receipts[0].CommandID != "rdm.confirm" || page.Receipts[0].ActorName != "Alice at action" || page.Receipts[0].ConversationID != "" || page.Coverage.CrossMember != "verified-exact-link-only" {
+		t.Fatalf("linked page: %+v", page)
+	}
+	raw, err := json.Marshal(page)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "secret-digest") || strings.Contains(string(raw), string(c.ID)) {
+		t.Fatalf("private receipt fields leaked: %s", raw)
+	}
+	if err := st.AppendAudit("alice", agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: "private.note", OperationID: "op-1", ConversationID: string(c.ID), State: agentcommand.StateCommitted}); err != nil {
+		t.Fatal(err)
+	}
+	duplicates, _, _, err := st.ListProjectCommandAudits("alice", string(p.ID), 0, 0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	privateOffset := duplicates[0].Offset
+	mislink := linkReq
+	mislink.HostAuditOffset, mislink.IdempotencyKey = privateOffset, "outbox-private"
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), mislink); !errors.Is(err, extension.ErrProjectAuditLinkConflict) {
+		t.Fatalf("ambiguous operation linked a private command: %v", err)
+	}
+	privateQuery := q
+	privateQuery.LinkedHostOffset = privateOffset
+	if _, err := bob.QueryProjectAudit(context.Background(), privateQuery); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("private command disclosed through ambiguous operation: %v", err)
+	}
+	metadataAllowed = false
+	if _, err := bob.QueryProjectAudit(context.Background(), q); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("revoked object metadata: %v", err)
+	}
+	metadataAllowed, auditAllowed = true, false
+	if _, err := bob.QueryProjectAudit(context.Background(), q); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("revoked audit.read: %v", err)
+	}
+	linkReq.ResourceID = "doc-2"
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), linkReq); !errors.Is(err, extension.ErrProjectAuditLinkConflict) {
+		t.Fatalf("same key different link: %v", err)
+	}
+	metadataAllowed, auditAllowed = true, true
+	if err := st.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), linkReq); err == nil || errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("storage outage during publish must remain retryable: %v", err)
+	}
+	if _, err := bob.QueryProjectAudit(context.Background(), q); err == nil || errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("storage outage during linked read must be explicit: %v", err)
+	}
+}
@@ -0,0 +1,238 @@
+package app
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+func TestProjectAuditHostChecksDomainReadAndProjectsStoredReceipts(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "audit.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	for _, owner := range []string{"alice", "bob"} {
+		if err := st.EnsureUser(owner, strings.ToUpper(owner)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	a, err := st.CreateProject("alice", "A")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := st.CreateProject("alice", "B")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ac, err := st.CreateConversation("alice", string(a.ID), "A", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bc, err := st.CreateConversation("alice", string(b.ID), "B", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	shared, err := st.CreateConversationInProject("bob", string(a.ID), "A shared", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, item := range []struct{ owner, conversation, command string }{
+		{"alice", string(ac.ID), "a.command"},
+		{"alice", string(bc.ID), "b.command"},
+		{"bob", string(shared.ID), "shared.command"},
+	} {
+		if err := st.AppendAudit(item.owner, agentcommand.AuditEnvelope{Time: time.Now(), Actor: item.owner, CommandID: item.command, ConversationID: item.conversation, State: agentcommand.StateCommitted, ParamsDigest: "sensitive-digest"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	slot := &projectAuditSlot{}
+	caps := hostcaps{st: st, projectAudit: slot}
+	reg := pluginRegistry{pluginID: "rdm", caps: caps}
+	allowed := true
+	if err := reg.RegisterProjectAuditAuthorizer(func(actor string, projectID core.ID) (bool, error) {
+		return allowed && actor == "bob" && projectID == a.ID, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: caps, owner: "bob", actor: "bob", pluginID: "rdm"}
+	page, err := h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: a.ID, Limit: 10})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page.Receipts) != 1 || page.Receipts[0].CommandID != "shared.command" {
+		t.Fatalf("A page: %+v", page)
+	}
+	if page.Coverage.CommandAudit != "actor-owned-project-bound-only" || page.Coverage.CrossMember != "unsupported" || page.Coverage.LegacyProjectBinding != "not-recorded" || page.Coverage.RunRelations != "unsupported" || page.Coverage.ModelReceipts != "unsupported" || page.Coverage.CutoffConsistency != "committed-prefix" {
+		t.Fatalf("coverage: %+v", page.Coverage)
+	}
+	if page.Receipts[0].ActorName != "BOB" {
+		t.Fatalf("actor names: %+v", page.Receipts)
+	}
+	raw, err := json.Marshal(page)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "sensitive-digest") || strings.Contains(string(raw), "paramsDigest") || strings.Contains(string(raw), "payload") {
+		t.Fatalf("raw audit payload leaked: %s", raw)
+	}
+	if _, err := h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: b.ID}); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("project B: %v", err)
+	}
+	if _, err := (inprocHost{caps: caps, owner: "bob", actor: "bob", pluginID: "other"}).QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: a.ID}); !errors.Is(err, extension.ErrProjectAuditUnsupported) {
+		t.Fatalf("other plugin: %v", err)
+	}
+	if _, err := (inprocHost{caps: caps, owner: "bob", pluginID: "rdm"}).QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: a.ID}); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("unbound actor: %v", err)
+	}
+	allowed = false
+	if _, err := h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: a.ID, BeforeOffset: page.NextOffset, CutoffOffset: page.CutoffOffset}); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("revoked audit.read: %v", err)
+	}
+}
+
+// A direct explicit ID bypasses the v39 default allocator. This must never
+// yield a committed-prefix page that permanently skips the late lower row.
+func TestProjectAuditPostgresExplicitLowIDCannotHideAcrossPages(t *testing.T) {
+	dsn := os.Getenv("AGENT_PG_TEST_DSN")
+	if dsn == "" {
+		t.Skip("AGENT_PG_TEST_DSN unset: isolated PostgreSQL check NOT_RUN")
+	}
+	admin, err := sql.Open("pgx", dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { admin.Close() })
+	if _, err := admin.Exec(`CREATE EXTENSION IF NOT EXISTS pg_trgm`); err != nil {
+		t.Fatal(err)
+	}
+	schema := "w9_" + strings.ToLower(string(store.NewID("audit")))
+	if _, err := admin.Exec(`CREATE SCHEMA ` + schema); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { admin.Exec(`DROP SCHEMA IF EXISTS ` + schema + ` CASCADE`) })
+	st, err := store.OpenPostgres(store.AppendPGRuntimeParam(dsn, "search_path", schema+",public"), filepath.Join(t.TempDir(), "artifacts"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "A")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conversation, err := st.CreateConversation("alice", string(project.ID), "work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, command := range []string{"first", "second"} {
+		if err := st.AppendAudit("alice", agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: command, ConversationID: string(conversation.ID), State: agentcommand.StateCommitted}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	insert := `INSERT INTO command_audit(time,command_id,source,entrance,state,operation_id,conversation_id,owner,payload,actor_name,project_id)
+		VALUES ($1,$2,'','','committed','',$3,'alice',$4,'Alice',$5) RETURNING id`
+	gap, err := st.DB().Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer gap.Rollback()
+	var gapID int64
+	if err := gap.QueryRow(insert, time.Now().UTC().Format(time.RFC3339Nano), "rolled-back-gap", string(conversation.ID), `{}`, string(project.ID)).Scan(&gapID); err != nil {
+		t.Fatal(err)
+	}
+	if gapID != 3 {
+		t.Fatalf("rollback gap ID=%d want=3", gapID)
+	}
+	if err := gap.Rollback(); err != nil {
+		t.Fatal(err)
+	}
+	a, err := st.DB().Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Rollback()
+	env := agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: "explicit-late", ConversationID: string(conversation.ID), State: agentcommand.StateCommitted}
+	raw, err := json.Marshal(env)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = a.Exec(`INSERT INTO command_audit(id,time,command_id,source,entrance,state,operation_id,conversation_id,owner,payload,actor_name,project_id)
+		VALUES (3,$1,$2,'','','committed','',$3,'alice',$4,'Alice',$5)`, env.Time.UTC().Format(time.RFC3339Nano), env.CommandID, string(conversation.ID), string(raw), string(project.ID))
+	if err != nil {
+		// Rejecting the online explicit ID is also a safe outcome.
+		t.Logf("online explicit low ID rejected: %v", err)
+		return
+	}
+	slot := &projectAuditSlot{}
+	caps := hostcaps{st: st, projectAudit: slot}
+	reg := pluginRegistry{pluginID: "rdm", caps: caps}
+	if err := reg.RegisterProjectAuditAuthorizer(func(actor string, projectID core.ID) (bool, error) {
+		return actor == "alice" && projectID == project.ID, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: caps, owner: "alice", actor: "alice", pluginID: "rdm"}
+	committed := make(chan error, 1)
+	started := make(chan struct{})
+	go func() {
+		close(started)
+		committed <- st.AppendAudit("alice", agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: "implicit-high", ConversationID: string(conversation.ID), State: agentcommand.StateCommitted})
+	}()
+	<-started
+	var first extension.ProjectAuditPage
+	highCommittedEarly := false
+	select {
+	case err := <-committed:
+		if err != nil {
+			t.Fatal(err)
+		}
+		highCommittedEarly = true
+	case <-time.After(500 * time.Millisecond):
+	}
+	if highCommittedEarly {
+		first, err = h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: project.ID, Limit: 2})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(first.Receipts) != 2 || first.Receipts[0].SourceOffset != 4 || first.Receipts[1].SourceOffset != 2 || first.CutoffOffset != 4 || first.NextOffset != 2 || first.Coverage.CutoffConsistency != "committed-prefix" {
+			t.Fatalf("counterexample first page changed: %+v", first)
+		}
+	}
+	if err := a.Commit(); err != nil {
+		t.Fatal(err)
+	}
+	if !highCommittedEarly {
+		if err := <-committed; err != nil {
+			t.Fatal(err)
+		}
+		first, err = h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: project.ID, Limit: 2})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	second, err := h.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: project.ID, BeforeOffset: first.NextOffset, CutoffOffset: first.CutoffOffset, Limit: 2})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[int64]bool{}
+	for _, receipt := range append(first.Receipts, second.Receipts...) {
+		seen[receipt.SourceOffset] = true
+	}
+	if !seen[3] || len(seen) != 4 {
+		t.Fatalf("committed-prefix omitted explicit low ID 3: early=%v first=%+v second=%+v", highCommittedEarly, first, second)
+	}
+}
@@ -0,0 +1,355 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"agent-system-backend/internal/projectcontext"
+	"agent-system-backend/internal/runtime"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+type projectContextSlot struct {
+	mu       sync.RWMutex
+	holder   string
+	provider extension.ProjectContextProvider
+}
+
+func (s *projectContextSlot) active() bool {
+	if s == nil {
+		return false
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.provider != nil
+}
+
+func requireProjectContextProvider(required bool, slot *projectContextSlot) error {
+	if required && !slot.active() {
+		return errors.New("extension: required project context provider not assembled")
+	}
+	return nil
+}
+
+func (r compiledRegistry) RegisterProjectContextProvider(extension.ProjectContextProvider) error {
+	return errors.New("extension: declarative plugins cannot register project context providers")
+}
+
+func (r pluginRegistry) RegisterProjectContextProvider(p extension.ProjectContextProvider) error {
+	if r.caps.contexts == nil || r.pluginID == "" || p == nil {
+		return errors.New("extension: project context provider unavailable")
+	}
+	slot := r.caps.contexts
+	slot.mu.Lock()
+	defer slot.mu.Unlock()
+	if slot.provider != nil {
+		return errors.New("extension: project context provider already registered")
+	}
+	slot.holder, slot.provider = r.pluginID, p
+	return nil
+}
+
+func (r recordRegistry) RegisterProjectContextProvider(p extension.ProjectContextProvider) error {
+	reg, ok := r.Registry.(extension.ProjectContextRegistry)
+	if !ok {
+		return errors.New("extension: project context registration unavailable")
+	}
+	return reg.RegisterProjectContextProvider(p)
+}
+
+func (s *projectContextSlot) resolve(ctx context.Context, req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+	if s == nil {
+		return extension.ProjectContextBundle{}, errors.New("extension: project context provider missing")
+	}
+	s.mu.RLock()
+	p, holder := s.provider, s.holder
+	s.mu.RUnlock()
+	if p == nil {
+		return extension.ProjectContextBundle{}, errors.New("extension: project context provider missing")
+	}
+	if req.Actor == "" || req.ProjectID == "" {
+		return extension.ProjectContextBundle{}, errors.New("extension: trusted project scope missing")
+	}
+	req.PluginID = holder
+	bounded, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	b, err := p.Resolve(bounded, req)
+	if err != nil {
+		return extension.ProjectContextBundle{}, err
+	}
+	if err := bounded.Err(); err != nil {
+		return extension.ProjectContextBundle{}, err
+	}
+	if b.ProjectID != req.ProjectID || b.Status != extension.ProjectContextReady {
+		return extension.ProjectContextBundle{}, fmt.Errorf("extension: project context unavailable: %s", b.Status)
+	}
+	return b, nil
+}
+
+func (s *projectContextSlot) readEvidence(ctx context.Context, req extension.ProjectEvidenceRequest) (extension.ProjectEvidence, error) {
+	if s == nil || req.Scope.Actor == "" || req.Scope.ProjectID == "" || req.Reference.ID == "" {
+		return extension.ProjectEvidence{}, errors.New("extension: trusted evidence scope missing")
+	}
+	s.mu.RLock()
+	p, holder := s.provider, s.holder
+	s.mu.RUnlock()
+	if p == nil {
+		return extension.ProjectEvidence{}, errors.New("extension: project context provider missing")
+	}
+	req.Scope.PluginID = holder
+	bounded, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	evidence, err := p.ReadEvidence(bounded, req)
+	if err != nil {
+		return extension.ProjectEvidence{}, err
+	}
+	if err := bounded.Err(); err != nil {
+		return extension.ProjectEvidence{}, err
+	}
+	if evidence.Reference != req.Reference || len([]rune(evidence.Text)) > req.Scope.BudgetChars {
+		return extension.ProjectEvidence{}, errors.New("extension: project evidence response mismatches reference or budget")
+	}
+	return evidence, nil
+}
+
+func (s *projectContextSlot) recheck(ctx context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+	if s == nil || req.Scope.Actor == "" || req.Scope.ProjectID == "" || req.Scope.Goal != "" {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: trusted source recheck scope missing")
+	}
+	s.mu.RLock()
+	p, holder := s.provider, s.holder
+	s.mu.RUnlock()
+	rechecker, ok := p.(extension.ProjectContextSourceRechecker)
+	if !ok {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: project source rechecker unavailable")
+	}
+	req.Scope.PluginID = holder
+	bounded, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	result, err := rechecker.Recheck(bounded, req)
+	if err != nil {
+		return extension.ProjectContextSourceRecheckResult{}, err
+	}
+	if err := bounded.Err(); err != nil {
+		return extension.ProjectContextSourceRecheckResult{}, err
+	}
+	if result.Bundle.ProjectID != req.Scope.ProjectID || result.Bundle.Status != extension.ProjectContextReady {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: project sources no longer authorized")
+	}
+	return result, nil
+}
+
+const workContextBudgetChars = 12000
+
+// TaskCreateForWork fixes the project binding while the authenticated command
+// dispatch still owns its conversation. Legacy TaskCreate has no such binding.
+func (h inprocHost) TaskCreateForWork(kind, title string) (string, error) {
+	if h.actor == "" || h.actor != h.owner || h.pluginID == "" || h.conversationID == "" || h.caps.st == nil || !h.caps.contexts.active() {
+		return "", errors.New("extension: trusted project work dispatch required")
+	}
+	conv, err := h.caps.st.GetConversation(h.owner, string(h.conversationID))
+	if err != nil {
+		return "", err
+	}
+	if conv.ProjectID == "" || (h.hostProjectID != "" && h.hostProjectID != conv.ProjectID) || h.caps.projects == nil || h.caps.projects.work() == nil {
+		return "", errors.New("extension: trusted project work scope missing")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	allowed, err := h.caps.projects.work()(ctx, h.actor, conv.ProjectID)
+	if err != nil || !allowed {
+		return "", errors.New("extension: project work denied")
+	}
+	task, err := h.caps.st.CreateWorkTask(h.owner, h.pluginID, string(conv.ProjectID), string(conv.ID), kind, title)
+	return task.ID, err
+}
+
+// completeForWork is the dispatch-scoped completion path. The conversation is
+// reloaded so a plugin's goal/target and a stale dispatch project cannot select
+// another project's context. Work authorization is checked on every call.
+func (h inprocHost) CompleteForWork(ctx context.Context, req extension.WorkCompletionRequest) (extension.WorkCompletionResult, error) {
+	if strings.TrimSpace(req.Goal) == "" {
+		return extension.WorkCompletionResult{}, errors.New("extension: work goal required")
+	}
+	if h.caps.st == nil {
+		return extension.WorkCompletionResult{}, errors.New("extension: trusted work store missing")
+	}
+	actor, convID, targetID := h.actor, h.conversationID, string(h.conversationID)
+	var boundProjectID core.ID
+	if actor == "" {
+		if req.TaskID == "" || convID != "" {
+			return extension.WorkCompletionResult{}, errors.New("extension: persisted work task required for scoped host")
+		}
+		binding, err := h.caps.st.WorkTaskScope(h.owner, h.pluginID, req.TaskID)
+		if err != nil {
+			return extension.WorkCompletionResult{}, err
+		}
+		if binding.Status == "done" || binding.Status == "completed" || binding.Status == "failed" || binding.Status == "cancelled" {
+			return extension.WorkCompletionResult{}, errors.New("extension: work task already terminal")
+		}
+		actor, convID, boundProjectID, targetID = binding.Owner, core.ID(binding.ConversationID), core.ID(binding.ProjectID), binding.TaskID
+	} else if actor != h.owner || convID == "" || req.TaskID != "" {
+		return extension.WorkCompletionResult{}, errors.New("extension: trusted work dispatch required")
+	}
+	conv, err := h.caps.st.GetConversation(h.owner, string(convID))
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	if conv.ProjectID == "" || (h.hostProjectID != "" && h.hostProjectID != conv.ProjectID) || (boundProjectID != "" && boundProjectID != conv.ProjectID) {
+		return extension.WorkCompletionResult{}, errors.New("extension: trusted project scope mismatch")
+	}
+	if h.caps.projects == nil || h.caps.projects.work() == nil {
+		return extension.WorkCompletionResult{}, errors.New("extension: project work authorization missing")
+	}
+	allowed, err := h.caps.projects.work()(ctx, actor, conv.ProjectID)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	if !allowed {
+		return extension.WorkCompletionResult{}, errors.New("extension: project work denied")
+	}
+	requested := extension.ProjectContextRequest{
+		Actor: actor, ProjectID: conv.ProjectID, ConversationID: conv.ID, TaskID: core.ID(req.TaskID),
+		Goal: req.Goal, TargetID: req.TargetID, BudgetChars: workContextBudgetChars,
+	}
+	bundle, err := h.caps.contexts.resolve(ctx, requested)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	evidenceText, usedEvidence, err := h.readWorkEvidence(ctx, requested, bundle, req.EvidenceRefs)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	prompt, manifest, err := assembleWorkCompletionWithEvidence(req.Goal, bundle, workContextBudgetChars, evidenceText, usedEvidence)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	manifest.ProjectID = conv.ProjectID
+	manifest.TaskID = req.TaskID
+	route := runtime.ResolveChatModel(core.AgentProfile{}, h.caps.set.Effective(h.owner, ""))
+	manifest.Model = route.Model
+	if route.Model == "" || route.Base == "" {
+		return extension.WorkCompletionResult{}, errors.New("llm route not configured")
+	}
+	// Resolve can be slow. A member may be revoked while the provider is
+	// assembling summaries, so check the live work policy again at send time.
+	allowed, err = h.caps.projects.work()(ctx, actor, conv.ProjectID)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	if !allowed {
+		return extension.WorkCompletionResult{}, errors.New("extension: project work denied")
+	}
+	current, err := h.caps.contexts.resolve(ctx, requested)
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	if err := projectcontext.ValidateCurrent(manifest, current); err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	for _, used := range manifest.ReadEvidence {
+		found := false
+		for _, ref := range current.Evidence {
+			if ref.ID != used.ReferenceID || ref.SourceID != used.SourceID || ref.Revision != used.Revision || ref.Hash != used.SourceHash {
+				continue
+			}
+			scope := requested
+			scope.BudgetChars = 8000
+			now, err := h.caps.contexts.readEvidence(ctx, extension.ProjectEvidenceRequest{Scope: scope, Reference: ref})
+			if err != nil {
+				return extension.WorkCompletionResult{}, err
+			}
+			if fmt.Sprintf("%x", sha256.Sum256([]byte(now.Text))) == used.InputSHA256 {
+				found = true
+			}
+			break
+		}
+		if !found {
+			return extension.WorkCompletionResult{}, errors.New("extension: requested work evidence changed before model send")
+		}
+	}
+	attemptID, err := projectcontext.NewAttemptID()
+	if err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	manifest.AttemptID, manifest.Delivery = attemptID, "attempted"
+	if err := h.caps.st.AppendContextManifest(h.owner, targetID, manifest); err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	text, err := completeChat(ctx, route.Base, route.Key, route.Model, prompt)
+	if err != nil {
+		manifest.Delivery = "unknown"
+		_ = h.caps.st.AppendContextManifest(h.owner, targetID, manifest)
+		return extension.WorkCompletionResult{}, err
+	}
+	manifest.Delivery = "responded"
+	if err := h.caps.st.AppendContextManifest(h.owner, targetID, manifest); err != nil {
+		return extension.WorkCompletionResult{}, err
+	}
+	return extension.WorkCompletionResult{Text: text, Manifest: manifest}, nil
+}
+
+func assembleWorkCompletion(goal string, bundle extension.ProjectContextBundle, budget int) (string, extension.ProjectContextManifest, error) {
+	return assembleWorkCompletionWithEvidence(goal, bundle, budget, "", nil)
+}
+
+func assembleWorkCompletionWithEvidence(goal string, bundle extension.ProjectContextBundle, budget int, evidenceText string, used []extension.ProjectContextManifestEntry) (string, extension.ProjectContextManifest, error) {
+	prefix := "Work goal:\n" + goal + "\n\n"
+	ref, m, err := projectcontext.Assemble(bundle, budget-len([]rune(prefix))-len([]rune(evidenceText)))
+	if err != nil {
+		return "", m, err
+	}
+	prompt := prefix + ref + evidenceText
+	m.BudgetChars = budget
+	m.ReadEvidence = used
+	m.InputSHA256 = fmt.Sprintf("%x", sha256.Sum256([]byte(prompt)))
+	return prompt, m, nil
+}
+
+func (h inprocHost) readWorkEvidence(ctx context.Context, scope extension.ProjectContextRequest, bundle extension.ProjectContextBundle, ids []string) (string, []extension.ProjectContextManifestEntry, error) {
+	if len(ids) > 4 {
+		return "", nil, errors.New("extension: too many work evidence references")
+	}
+	var b strings.Builder
+	var used []extension.ProjectContextManifestEntry
+	seen := make(map[string]bool, len(ids))
+	for _, id := range ids {
+		if id == "" || seen[id] {
+			return "", nil, errors.New("extension: invalid or duplicate work evidence reference")
+		}
+		seen[id] = true
+		var selected extension.ProjectEvidenceRef
+		for _, ref := range bundle.Evidence {
+			if ref.ID == id {
+				selected = ref
+				break
+			}
+		}
+		if selected.ID == "" {
+			return "", nil, errors.New("extension: work evidence reference not in current bundle")
+		}
+		readScope := scope
+		readScope.BudgetChars = 8000
+		evidence, err := h.caps.contexts.readEvidence(ctx, extension.ProjectEvidenceRequest{Scope: readScope, Reference: selected})
+		if err != nil {
+			return "", nil, err
+		}
+		b.WriteString("\n[Evidence ")
+		b.WriteString(selected.ID)
+		b.WriteString(" source ")
+		b.WriteString(selected.SourceID)
+		b.WriteString(" revision ")
+		b.WriteString(selected.Revision)
+		b.WriteString("]\n")
+		b.WriteString(evidence.Text)
+		used = append(used, extension.ProjectContextManifestEntry{ReferenceID: selected.ID, SourceID: selected.SourceID, Revision: selected.Revision, SourceHash: selected.Hash,
+			InputSHA256: fmt.Sprintf("%x", sha256.Sum256([]byte(evidence.Text)))})
+	}
+	return b.String(), used, nil
+}
@@ -0,0 +1,420 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+type testProjectContextProvider struct {
+	resolve func(extension.ProjectContextRequest) (extension.ProjectContextBundle, error)
+	read    func(extension.ProjectEvidenceRequest) (extension.ProjectEvidence, error)
+}
+
+type testSourceRecheckProvider struct {
+	testProjectContextProvider
+	called *bool
+}
+
+func (p testSourceRecheckProvider) Recheck(ctx context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+	if _, ok := ctx.Deadline(); !ok || req.Scope.PluginID != "rdm" || req.Scope.Actor != "alice" || req.Scope.ProjectID != "p1" || req.Scope.Goal != "" {
+		return extension.ProjectContextSourceRecheckResult{}, fmt.Errorf("untrusted or unbounded recheck scope")
+	}
+	*p.called = true
+	return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.Scope.ProjectID}}, nil
+}
+
+func TestProjectSourceRecheckUsesSameRegisteredProviderAndDeadline(t *testing.T) {
+	called := false
+	slot := &projectContextSlot{}
+	provider := testSourceRecheckProvider{called: &called}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: slot}}).RegisterProjectContextProvider(provider); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}}); err != nil || !called {
+		t.Fatalf("registered source rechecker unavailable: called=%v err=%v", called, err)
+	}
+	if _, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1", Goal: "OLD_RESTRICTED_BODY"}}); err == nil {
+		t.Fatal("raw Goal entered source recheck provider")
+	}
+	cancelled, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, err := slot.recheck(cancelled, extension.ProjectContextSourceRecheckRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}}); err == nil {
+		t.Fatal("cancelled source recheck returned authorized context")
+	}
+	legacy := &projectContextSlot{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: legacy}}).RegisterProjectContextProvider(testProjectContextProvider{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := legacy.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}}); err == nil {
+		t.Fatal("provider without optional rechecker silently accepted old sources")
+	}
+}
+
+type deadlineContextProvider struct{ sawDeadline *bool }
+
+func (p deadlineContextProvider) Resolve(ctx context.Context, req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+	_, *p.sawDeadline = ctx.Deadline()
+	return extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.ProjectID}, nil
+}
+func (p deadlineContextProvider) ReadEvidence(ctx context.Context, req extension.ProjectEvidenceRequest) (extension.ProjectEvidence, error) {
+	_, *p.sawDeadline = ctx.Deadline()
+	return extension.ProjectEvidence{Reference: req.Reference, Text: "detail"}, nil
+}
+
+func TestProjectContextProviderCallsHaveBoundedDeadline(t *testing.T) {
+	seen := false
+	slot := &projectContextSlot{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: slot}}).RegisterProjectContextProvider(deadlineContextProvider{sawDeadline: &seen}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := slot.resolve(context.Background(), extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}); err != nil || !seen {
+		t.Fatalf("Resolve missing bounded context: seen=%v err=%v", seen, err)
+	}
+	seen = false
+	if _, err := slot.readEvidence(context.Background(), extension.ProjectEvidenceRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1", BudgetChars: 100}, Reference: extension.ProjectEvidenceRef{ID: "r1"}}); err != nil || !seen {
+		t.Fatalf("ReadEvidence missing bounded context: seen=%v err=%v", seen, err)
+	}
+}
+
+func (p testProjectContextProvider) Resolve(_ context.Context, req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+	return p.resolve(req)
+}
+
+func (p testProjectContextProvider) ReadEvidence(_ context.Context, req extension.ProjectEvidenceRequest) (extension.ProjectEvidence, error) {
+	if p.read != nil {
+		return p.read(req)
+	}
+	return extension.ProjectEvidence{}, nil
+}
+
+func TestProjectContextRegistryOptionalAndSingleOwner(t *testing.T) {
+	slot := &projectContextSlot{}
+	reg := recordRegistry{Registry: pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: slot}}}
+	optional, ok := any(reg).(extension.ProjectContextRegistry)
+	if !ok {
+		t.Fatal("record registry hides optional project context registration")
+	}
+	provider := testProjectContextProvider{resolve: func(extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+		return extension.ProjectContextBundle{Status: extension.ProjectContextReady}, nil
+	}}
+	if err := optional.RegisterProjectContextProvider(provider); err != nil {
+		t.Fatal(err)
+	}
+	if err := optional.RegisterProjectContextProvider(provider); err == nil {
+		t.Fatal("duplicate provider replaced the first provider")
+	}
+	if err := (compiledRegistry{}).RegisterProjectContextProvider(provider); err == nil {
+		t.Fatal("declarative provider accepted")
+	}
+}
+
+func TestRequiredProjectContextFailsWhenProviderNotAssembled(t *testing.T) {
+	slot := &projectContextSlot{}
+	if err := requireProjectContextProvider(true, slot); err == nil {
+		t.Fatal("required project context silently degraded")
+	}
+	if err := requireProjectContextProvider(false, slot); err != nil {
+		t.Fatalf("optional legacy path blocked: %v", err)
+	}
+	provider := testProjectContextProvider{resolve: func(extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+		return extension.ProjectContextBundle{}, nil
+	}}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: slot}}).RegisterProjectContextProvider(provider); err != nil {
+		t.Fatal(err)
+	}
+	if err := requireProjectContextProvider(true, slot); err != nil {
+		t.Fatalf("registered provider rejected: %v", err)
+	}
+}
+
+func TestCompleteForWorkUsesStoredScopeAndActualInputManifest(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	p, err := st.CreateProject("alice", "Project")
+	if err != nil {
+		t.Fatal(err)
+	}
+	other, err := st.CreateProject("alice", "Other")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", p.ID, "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sent string
+	modelCalls := 0
+	model := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		modelCalls++
+		var payload struct {
+			Messages []struct {
+				Content string `json:"content"`
+			} `json:"messages"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			t.Error(err)
+		}
+		for _, m := range payload.Messages {
+			sent += m.Content
+		}
+		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"done"}}]}`))
+	}))
+	defer model.Close()
+	set := settings.NewService(st)
+	set.SetSystemOverride(map[string]any{"models": map[string]any{"chat": map[string]any{"baseUrl": model.URL, "model": "test-model"}}})
+	projects := &projectLifecycleSlot{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{projects: projects}}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
+		t.Fatal(err)
+	}
+	contexts := &projectContextSlot{}
+	called := 0
+	oversized := false
+	revokeDuringResolve := false
+	revokeDocDuringResolve := false
+	authEpoch := "duty-1"
+	provider := testProjectContextProvider{resolve: func(req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+		called++
+		if req.Actor != "alice" || req.ProjectID != core.ID(p.ID) || req.ConversationID != core.ID(conv.ID) || req.PluginID != "rdm" {
+			t.Errorf("untrusted scope: %+v", req)
+		}
+		item := extension.ProjectContextItem{SourceID: "decision-1", Revision: "r3", Hash: "source-hash", Text: "Authorized summary", Required: true}
+		if oversized {
+			item.Text = strings.Repeat("x", workContextBudgetChars+1)
+		}
+		if revokeDuringResolve {
+			projects.mu.Lock()
+			projects.provider.Work = func(context.Context, string, core.ID) (bool, error) { return false, nil }
+			projects.mu.Unlock()
+		}
+		epoch := authEpoch
+		if revokeDocDuringResolve {
+			authEpoch = "duty-2"
+			revokeDocDuringResolve = false
+		}
+		return extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: core.ID(p.ID), Version: "v7", AuthorizationEpoch: epoch, Items: []extension.ProjectContextItem{item}}, nil
+	}}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: contexts}}).RegisterProjectContextProvider(provider); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st, set: set, projects: projects, contexts: contexts}, pluginID: "rdm", owner: "alice", actor: "alice", conversationID: conv.ID, hostProjectID: p.ID}
+	work := any(h).(extension.WorkCompletionHost)
+	result, err := work.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Text != "done" || !strings.Contains(sent, "Authorized summary") || !strings.Contains(sent, "Draft report") || result.Manifest.InputSHA256 == "" || len(result.Manifest.Included) != 1 {
+		t.Fatalf("input or manifest mismatch: result=%+v sent=%q", result, sent)
+	}
+	if want := fmt.Sprintf("%x", sha256.Sum256([]byte(sent))); result.Manifest.InputSHA256 != want {
+		t.Fatalf("manifest input hash %q differs from actual request content hash %q", result.Manifest.InputSHA256, want)
+	}
+	if got, want := result.Manifest.Included[0].InputSHA256, fmt.Sprintf("%x", sha256.Sum256([]byte("Authorized summary"))); got != want || result.Manifest.Included[0].SourceHash != "source-hash" {
+		t.Fatalf("manifest does not distinguish source hash and actual text hash: %+v", result.Manifest.Included[0])
+	}
+	if called != 2 {
+		t.Fatalf("provider called %d times, want initial and pre-send reads", called)
+	}
+	stored, err := st.ListContextManifests("alice", string(conv.ID))
+	if err != nil || len(stored) != 2 || stored[0].Delivery != "attempted" || stored[1].Delivery != "responded" || stored[0].AttemptID != stored[1].AttemptID || stored[1].InputSHA256 != result.Manifest.InputSHA256 {
+		t.Fatalf("work completion manifest not persisted: got=%+v err=%v", stored, err)
+	}
+	h.hostProjectID = other.ID
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || called != 2 {
+		t.Fatal("forged project scope reached provider")
+	}
+	h.hostProjectID = p.ID
+	h.conversationID = ""
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || called != 2 {
+		t.Fatal("scoped host without dispatch scope reached provider")
+	}
+	h.conversationID = conv.ID
+	projects.mu.Lock()
+	projects.provider.Work = func(context.Context, string, core.ID) (bool, error) { return false, nil }
+	projects.mu.Unlock()
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || called != 2 {
+		t.Fatal("revoked project work reached provider")
+	}
+	projects.mu.Lock()
+	projects.provider.Work = func(context.Context, string, core.ID) (bool, error) { return true, nil }
+	projects.mu.Unlock()
+	oversized = true
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || modelCalls != 1 {
+		t.Fatal("required context was dropped and model still called")
+	}
+	oversized = false
+	revokeDuringResolve = true
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || modelCalls != 1 {
+		t.Fatal("revocation during context resolution reached model")
+	}
+	projects.mu.Lock()
+	projects.provider.Work = func(context.Context, string, core.ID) (bool, error) { return true, nil }
+	projects.mu.Unlock()
+	revokeDuringResolve = false
+	revokeDocDuringResolve = true
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Draft report"}); err == nil || modelCalls != 1 {
+		t.Fatal("document duty revoked while project membership remains reached model")
+	}
+	taskHost := any(h).(extension.WorkTaskHost)
+	taskID, err := taskHost.TaskCreateForWork("compose", "Draft report")
+	if err != nil {
+		t.Fatal(err)
+	}
+	scoped := inprocHost{caps: h.caps, pluginID: "rdm", owner: "alice"}
+	if _, err := scoped.TaskCreateForWork("compose", "Forged"); err == nil {
+		t.Fatal("scoped host created a work task without dispatch scope")
+	}
+	if _, err := scoped.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Resume report", TaskID: taskID}); err != nil || modelCalls != 2 {
+		t.Fatalf("persisted plugin task did not restore trusted work scope: err=%v calls=%d", err, modelCalls)
+	}
+	otherPlugin := inprocHost{caps: h.caps, pluginID: "other", owner: "alice"}
+	if _, err := otherPlugin.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Steal task", TaskID: taskID}); err == nil || modelCalls != 2 {
+		t.Fatal("other plugin reused task binding")
+	}
+	otherOwner := inprocHost{caps: h.caps, pluginID: "rdm", owner: "bob"}
+	if _, err := otherOwner.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Steal task", TaskID: taskID}); err == nil || modelCalls != 2 {
+		t.Fatal("other owner reused task binding")
+	}
+	legacyTaskID, err := h.TaskCreate("legacy", "Unbound", string(conv.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := scoped.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Old task", TaskID: legacyTaskID}); err == nil || modelCalls != 2 {
+		t.Fatal("old unbound task was treated as trusted work scope")
+	}
+	if _, err := st.DB().Exec(`UPDATE conversations SET project_id=? WHERE id=?`, other.ID, conv.ID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := scoped.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Moved project", TaskID: taskID}); err == nil || modelCalls != 2 {
+		t.Fatal("task silently followed a conversation to another project")
+	}
+}
+
+func TestWorkContextBudgetKeepsRequiredEvidenceFirst(t *testing.T) {
+	bundle := extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: "project-1", Items: []extension.ProjectContextItem{
+		{SourceID: "optional", Revision: "r1", Hash: "h1", Text: "12345678"},
+		{SourceID: "required", Revision: "r1", Hash: "h2", Text: "must keep", Required: true},
+	}}
+	prompt, manifest, err := assembleWorkCompletion("goal", bundle, 140)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(prompt, "must keep") || strings.Contains(prompt, "12345678") {
+		t.Fatalf("required evidence lost to optional evidence: %q", prompt)
+	}
+	if len([]rune(prompt)) > 140 {
+		t.Fatalf("final prompt exceeded the budget: %d", len([]rune(prompt)))
+	}
+	if len(manifest.Included) != 1 || manifest.Included[0].SourceID != "required" || len(manifest.Dropped) != 1 || manifest.Dropped[0].SourceID != "optional" {
+		t.Fatalf("manifest does not match selected input: %+v", manifest)
+	}
+}
+
+func TestCompleteForWorkReadsOnlyCurrentBundleEvidence(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "evidence.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	p, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", p.ID, "C", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sent []string
+	model := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var body struct {
+			Messages []struct {
+				Content string `json:"content"`
+			} `json:"messages"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&body)
+		var input string
+		for _, m := range body.Messages {
+			input += m.Content
+		}
+		sent = append(sent, input)
+		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"done"}}]}`))
+	}))
+	defer model.Close()
+	set := settings.NewService(st)
+	set.SetSystemOverride(map[string]any{"models": map[string]any{"chat": map[string]any{"baseUrl": model.URL, "model": "test-model"}}})
+	projects := &projectLifecycleSlot{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{projects: projects}}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
+		t.Fatal(err)
+	}
+	contexts := &projectContextSlot{}
+	ref := extension.ProjectEvidenceRef{ID: "ref-1", SourceID: "doc-1", Revision: "r2", Hash: "source-hash"}
+	readCalls := 0
+	readText, authEpoch := "current restricted detail", "duty-1"
+	provider := testProjectContextProvider{
+		resolve: func(req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+			return extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.ProjectID, AuthorizationEpoch: authEpoch, PublicationEpoch: "pub-1", Evidence: []extension.ProjectEvidenceRef{ref}}, nil
+		},
+		read: func(req extension.ProjectEvidenceRequest) (extension.ProjectEvidence, error) {
+			readCalls++
+			if req.Reference != ref || req.Scope.ProjectID != core.ID(p.ID) {
+				t.Errorf("untrusted evidence scope: %+v", req)
+			}
+			return extension.ProjectEvidence{Reference: req.Reference, Text: readText}, nil
+		},
+	}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: contexts}}).RegisterProjectContextProvider(provider); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st, set: set, projects: projects, contexts: contexts}, pluginID: "rdm", owner: "alice", actor: "alice", conversationID: conv.ID, hostProjectID: p.ID}
+	result, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Write", EvidenceRefs: []string{"ref-1"}})
+	if err != nil || len(sent) != 1 || !strings.Contains(sent[0], "current restricted detail") || len(result.Manifest.ReadEvidence) != 1 || readCalls != 2 {
+		t.Fatalf("requested evidence did not reach model under reauthorization: err=%v sent=%q manifest=%+v reads=%d", err, sent, result.Manifest, readCalls)
+	}
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Write", EvidenceRefs: []string{"arbitrary-path"}}); err == nil || readCalls != 2 {
+		t.Fatal("arbitrary evidence reference reached provider")
+	}
+	readText, authEpoch = "new public detail", "duty-2"
+	if _, err := h.CompleteForWork(context.Background(), extension.WorkCompletionRequest{Goal: "Write", EvidenceRefs: []string{"ref-1"}}); err != nil || len(sent) != 2 || strings.Contains(sent[1], "current restricted detail") || !strings.Contains(sent[1], "new public detail") {
+		t.Fatalf("same Host reused old evidence after duty change: err=%v sent=%q", err, sent)
+	}
+}
+
+func TestPluginAuditCannotForgeOrCorruptContextManifest(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "manifest.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	good := extension.ProjectContextManifest{ProjectID: "p1", AttemptID: "attempt-1", Delivery: "attempted", InputSHA256: "sha-good"}
+	if err := st.AppendContextManifest("alice", "run-1", good); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "malicious", owner: "alice"}
+	if err := h.Audit("model.context_manifest", "run-1", `{"Delivery":"responded","InputSHA256":"forged"}`); err == nil {
+		t.Fatal("plugin forged a trusted model manifest action")
+	}
+	if err := st.AppendAuditEvent(store.AuditEvent{Owner: "alice", Action: "model.context_manifest", Target: "run-1", Evidence: "not-json"}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := st.ListContextManifests("alice", "run-1")
+	if err != nil || len(got) != 1 || got[0].InputSHA256 != "sha-good" {
+		t.Fatalf("untrusted audit row corrupted manifest reader: got=%+v err=%v", got, err)
+	}
+}
@@ -51,7 +51,7 @@ func (slot *projectLifecycleSlot) wire(srv *server.Server, caps hostcaps) {
 	}
 	holder := slot.holder
 	srv.SetProjectLifecycle(*slot.provider, func(owner string) extension.Host {
-		return inprocHost{caps: caps, owner: owner, actor: owner, pluginID: holder}
+		return requestBoundHost{inprocHost{caps: caps, owner: owner, actor: owner, pluginID: holder}}
 	})
 }

@@ -84,6 +84,9 @@ func (slot *projectLifecycleSlot) resolve(ctx context.Context, caps hostcaps, ow
 var _ extension.ProjectHost = inprocHost{}

 func (h inprocHost) OwnedProjects() ([]core.Project, error) {
+	if err := h.requireEffective(); err != nil {
+		return nil, err
+	}
 	ps, err := h.caps.st.ListProjects(h.owner)
 	for i := range ps {
 		ps[i].Owner = h.owner
@@ -91,9 +94,15 @@ func (h inprocHost) OwnedProjects() ([]core.Project, error) {
 	return ps, err
 }
 func (h inprocHost) OwnedProject(id string) (core.Project, error) {
+	if err := h.requireEffective(); err != nil {
+		return core.Project{}, err
+	}
 	return h.caps.st.GetProject(h.owner, id)
 }
 func (h inprocHost) ProjectMetadata(id string) (core.Project, error) {
+	if err := h.requireEffective(); err != nil {
+		return core.Project{}, err
+	}
 	p, err := h.caps.st.ProjectMetadata(id)
 	if err != nil {
 		return core.Project{}, err
@@ -114,11 +123,29 @@ func (h inprocHost) ProjectMetadata(id string) (core.Project, error) {
 	return p, nil
 }
 func (h inprocHost) EnsureProject(id, name string) (core.Project, error) {
-	return h.caps.st.EnsureProject(h.owner, id, name)
+	if err := h.requireEffective(); err != nil {
+		return core.Project{}, err
+	}
+	if h.actor != "" && h.actor != h.owner {
+		return core.Project{}, store.ErrAccountForbidden
+	}
+	// A creator-scoped Host is the approved I1 projection capability. RDM
+	// authorizes a delegated operator before invoking it; cross-database
+	// commit fencing remains outside U3's guarantee.
+	return h.caps.st.EnsureProjectAccountChecked(h.owner, h.owner, id, name, h.caps.allowImplicitLocal)
 }
 func (h inprocHost) RenameOwnedProject(id, name string) (core.Project, error) {
-	return h.caps.st.RenameOwnedProject(h.owner, id, name)
+	if err := h.requireEffective(); err != nil {
+		return core.Project{}, err
+	}
+	if h.actor != "" && h.actor != h.owner {
+		return core.Project{}, store.ErrAccountForbidden
+	}
+	return h.caps.st.RenameOwnedProjectAccountChecked(h.owner, h.owner, id, name, h.caps.allowImplicitLocal)
 }
 func (h inprocHost) ProjectNameAvailable(name, exceptID string) (bool, error) {
+	if err := h.requireEffective(); err != nil {
+		return false, err
+	}
 	return h.caps.st.ProjectNameAvailable(name, exceptID)
 }
@@ -11,7 +11,12 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
 )

 func completeLifecycle() extension.ProjectLifecycle {
@@ -55,6 +60,11 @@ func TestProjectHostMetadataDoesNotGrantMutation(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
+	for _, owner := range []string{"alice", "bob"} {
+		if err := st.EnsureUser(owner, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
 	alice := inprocHost{owner: "alice", caps: hostcaps{st: st}}
 	p, err := alice.EnsureProject("stable", "Shared")
 	if err != nil {
@@ -131,6 +141,9 @@ func TestProjectHostMetadataMasksSharedSecretsWithoutMutation(t *testing.T) {
 	srv := server.New(st, nil, nil, nil, svc, nil)
 	srv.Auth = server.NewAuthenticator(st, true)
 	slot.wire(srv, caps)
+	if err := st.EnsureUser("bob", ""); err != nil {
+		t.Fatal(err)
+	}
 	key, err := st.CreateAPIKey("bob", "test")
 	if err != nil {
 		t.Fatal(err)
@@ -161,3 +174,180 @@ func TestProjectHostMetadataMasksSharedSecretsWithoutMutation(t *testing.T) {
 		t.Fatal("metadata read mutated persisted owner settings")
 	}
 }
+
+func TestRequestBoundDelegatedProjectionFencesRealOperator(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/delegated-project.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	for _, account := range []struct {
+		owner string
+		admin bool
+	}{{"admin", true}, {"alice", false}, {"bob", false}} {
+		if err := st.CreateAccount(account.owner, "", "", account.admin); err != nil {
+			t.Fatal(err)
+		}
+	}
+	project, err := st.CreateProject("alice", "original")
+	if err != nil {
+		t.Fatal(err)
+	}
+	guard := accountEffectiveAuthorization(st, true)
+	check := func(owner string) error {
+		valid, err := guard(context.Background(), owner)
+		if err != nil {
+			return err
+		}
+		if !valid {
+			return store.ErrAccountForbidden
+		}
+		return nil
+	}
+	slot := &projectLifecycleSlot{}
+	caps := hostcaps{st: st, projects: slot, accountGuard: check}
+	if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
+		t.Fatal(err)
+	}
+	request := requestBoundHost{inprocHost{caps: caps, pluginID: "rdm", owner: "bob", actor: "bob"}}
+	delegator, ok := any(request).(interface {
+		ProjectProjectionForCreator(creator, projectID string) (extension.ProjectHost, error)
+	})
+	if !ok {
+		t.Fatal("request-bound delegated projection capability missing")
+	}
+	projection, err := delegator.ProjectProjectionForCreator("alice", string(project.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if projection.Owner() != "alice" {
+		t.Fatalf("trusted projection owner=%s", projection.Owner())
+	}
+	if _, ok := projection.(extension.Host); ok {
+		t.Fatal("single-project projection exposed broad creator Host capabilities")
+	}
+	if _, err := projection.RenameOwnedProject(string(project.ID), "delegated"); err != nil {
+		t.Fatalf("active delegated rename: %v", err)
+	}
+	if _, err := projection.RenameOwnedProject("another-project", "hijack"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("projection escaped bound project: %v", err)
+	}
+	if _, err := projection.EnsureProject("another-project", "hijack"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("projection created another project: %v", err)
+	}
+	bob, err := st.GetAccountByOwner("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetAccountEnabled("admin", bob.ID, bob.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := projection.RenameOwnedProject(string(project.ID), "late"); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled real operator renamed creator project: %v", err)
+	}
+	got, err := st.ProjectMetadata(string(project.ID))
+	if err != nil || got.Name != "delegated" {
+		t.Fatalf("late rename changed project: %+v %v", got, err)
+	}
+}
+
+func TestDelegatedProjectionRejectsDisableBetweenEarlyCheckAndWrite(t *testing.T) {
+	var st, other *store.Store
+	var err error
+	if baseDSN := os.Getenv("AGENT_PG_TEST_DSN"); baseDSN != "" {
+		st = openDirectoryTestStore(t)
+		if err := st.EnsureSystemIdentity("u3-delegated-projection", "pg"); err != nil {
+			t.Fatal(err)
+		}
+		var schema string
+		if err := st.DB().QueryRow(`SELECT current_schema()`).Scan(&schema); err != nil {
+			t.Fatal(err)
+		}
+		separator := "?"
+		if strings.Contains(baseDSN, "?") {
+			separator = "&"
+		}
+		other, err = store.OpenExistingPostgres(baseDSN+separator+"search_path="+schema+",public", filepath.Join(t.TempDir(), "other-artifacts"))
+	} else {
+		db := filepath.Join(t.TempDir(), "shared.db")
+		st, err = store.OpenSQLite(db)
+		if err == nil {
+			other, err = store.OpenExistingSQLite(db)
+		}
+		if st != nil {
+			defer st.Close()
+		}
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer other.Close()
+	for _, account := range []struct {
+		owner string
+		admin bool
+	}{{"admin", true}, {"alice", false}, {"bob", false}} {
+		if err := st.CreateAccount(account.owner, "", "", account.admin); err != nil {
+			t.Fatal(err)
+		}
+	}
+	project, err := st.CreateProject("alice", "before")
+	if err != nil {
+		t.Fatal(err)
+	}
+	entered, release := make(chan struct{}), make(chan struct{})
+	var bobChecks atomic.Int32
+	check := func(owner string) error {
+		state, err := st.GetUserAuthState(owner)
+		if err != nil {
+			return err
+		}
+		if !state.Enabled {
+			return store.ErrAccountForbidden
+		}
+		if owner == "bob" && bobChecks.Add(1) == 2 {
+			close(entered)
+			<-release
+		}
+		return nil
+	}
+	slot := &projectLifecycleSlot{}
+	caps := hostcaps{st: st, projects: slot, accountGuard: check}
+	if err := (pluginRegistry{pluginID: "rdm", caps: caps}).RegisterProjectLifecycle(completeLifecycle()); err != nil {
+		t.Fatal(err)
+	}
+	host := requestBoundHost{inprocHost{caps: caps, pluginID: "rdm", owner: "bob", actor: "bob"}}
+	projection, err := host.ProjectProjectionForCreator("alice", string(project.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	written := make(chan error, 1)
+	go func() {
+		_, err := projection.RenameOwnedProject(string(project.ID), "late")
+		written <- err
+	}()
+	select {
+	case <-entered:
+	case <-time.After(3 * time.Second):
+		t.Fatal("rename did not reach paused early account check")
+	}
+	bob, err := st.GetAccountByOwner("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := other.SetAccountEnabled("admin", bob.ID, bob.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	close(release)
+	select {
+	case err := <-written:
+		if !errors.Is(err, store.ErrAccountForbidden) {
+			t.Fatalf("late delegated rename committed: %v", err)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("late rename did not return")
+	}
+	got, err := st.ProjectMetadata(string(project.ID))
+	if err != nil || got.Name != "before" {
+		t.Fatalf("project changed after disable: %+v %v", got, err)
+	}
+}
@@ -0,0 +1,97 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"agent-system-backend/pkg/extension"
+)
+
+type scriptedRecheckProvider struct {
+	testProjectContextProvider
+	recheck func(context.Context, extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error)
+}
+
+func (p scriptedRecheckProvider) Recheck(ctx context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+	return p.recheck(ctx, req)
+}
+
+func registeredRecheckSlot(t *testing.T, recheck func(context.Context, extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error)) *projectContextSlot {
+	t.Helper()
+	slot := &projectContextSlot{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{contexts: slot}}).RegisterProjectContextProvider(scriptedRecheckProvider{recheck: recheck}); err != nil {
+		t.Fatal(err)
+	}
+	return slot
+}
+
+func TestProjectSourceRecheckFailsClosedAtThreeSecondCeiling(t *testing.T) {
+	var remaining time.Duration
+	slot := registeredRecheckSlot(t, func(ctx context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+		deadline, ok := ctx.Deadline()
+		if !ok {
+			return extension.ProjectContextSourceRecheckResult{}, errors.New("unbounded recheck")
+		}
+		remaining = time.Until(deadline)
+		select {
+		case <-ctx.Done():
+		case <-time.After(10 * time.Second):
+		}
+		// A late success must not authorize old machine context.
+		return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.Scope.ProjectID}}, nil
+	})
+	started := time.Now()
+	_, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}})
+	if err == nil {
+		t.Fatal("source recheck past its deadline returned authorized context")
+	}
+	if remaining <= 0 || remaining > 3*time.Second {
+		t.Fatalf("source recheck deadline is not bounded by 3s: %v", remaining)
+	}
+	if elapsed := time.Since(started); elapsed > 5*time.Second {
+		t.Fatalf("source recheck outlived its 3s ceiling: %v", elapsed)
+	}
+}
+
+func TestProjectSourceRecheckRejectsProviderRefusalAndForeignBundles(t *testing.T) {
+	scope := extension.ProjectContextRequest{Actor: "alice", ProjectID: "p1"}
+	answers := map[string]func(extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error){
+		"refused": func(extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+			return extension.ProjectContextSourceRecheckResult{}, errors.New("provider refused")
+		},
+		"denied": func(req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+			return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextDenied, ProjectID: req.Scope.ProjectID}}, nil
+		},
+		"incomplete": func(req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+			return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextIncomplete, ProjectID: req.Scope.ProjectID}}, nil
+		},
+		"other project": func(extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+			return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: "p2"}}, nil
+		},
+	}
+	for name, answer := range answers {
+		slot := registeredRecheckSlot(t, func(_ context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+			return answer(req)
+		})
+		if _, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: scope}); err == nil {
+			t.Fatalf("%s source recheck accepted", name)
+		}
+	}
+	var sawPlugin string
+	slot := registeredRecheckSlot(t, func(_ context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+		sawPlugin = req.Scope.PluginID
+		return extension.ProjectContextSourceRecheckResult{Bundle: extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.Scope.ProjectID}}, nil
+	})
+	forged := scope
+	forged.PluginID = "forged-plugin"
+	if _, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: forged}); err != nil || sawPlugin != "rdm" {
+		t.Fatalf("recheck scope plugin was not the registered holder: plugin=%q err=%v", sawPlugin, err)
+	}
+	for _, missing := range []extension.ProjectContextRequest{{ProjectID: "p1"}, {Actor: "alice"}} {
+		if _, err := slot.recheck(context.Background(), extension.ProjectContextSourceRecheckRequest{Scope: missing}); err == nil {
+			t.Fatalf("recheck without trusted actor/project accepted: %+v", missing)
+		}
+	}
+}
@@ -0,0 +1,381 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+
+	"agent-system-backend/internal/runmgr"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+type projectWorkObserverSlot struct {
+	mu       sync.RWMutex
+	provider *extension.ProjectWorkObserver
+}
+
+func (s *projectWorkObserverSlot) get() *extension.ProjectWorkObserver {
+	if s == nil {
+		return nil
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if s.provider == nil {
+		return nil
+	}
+	copy := *s.provider
+	return &copy
+}
+
+func (s *projectWorkObserverSlot) active() bool { return s.get() != nil }
+
+func wireProjectWorkGate(mgr *runmgr.Manager, st *store.Store, caps hostcaps, slot *projectWorkObserverSlot,
+	work func(context.Context, string, core.ID) (bool, error),
+) {
+	provider := slot.get()
+	if provider == nil || work == nil {
+		return
+	}
+	verify := func(ctx context.Context, row store.ProjectWorkObservationRow) error {
+		switch row.SourceKind {
+		case "retrieval-hit":
+			return verifyProjectKnowledgeObservation(ctx, caps, row)
+		case "tool-result", "visible-analysis":
+			return verifyProjectTransientObservation(ctx, st, row)
+		default:
+			return fmt.Errorf("project work source %s: unsupported run source kind %q", row.EventID, row.SourceKind)
+		}
+	}
+	mgr.SetProjectWorkGate(
+		func(ctx context.Context, runID, action string) (extension.ProjectWorkDecision, error) {
+			return preflightProjectRun(ctx, st, slot, work, verify, runID, action)
+		},
+		provider.Respond,
+	)
+}
+
+func (r compiledRegistry) RegisterProjectWorkObserver(extension.ProjectWorkObserver) error {
+	return errors.New("extension: declarative plugins cannot register project work observers")
+}
+
+func (r pluginRegistry) RegisterProjectWorkObserver(p extension.ProjectWorkObserver) error {
+	if r.pluginID != "rdm" || r.caps.workObserver == nil {
+		return errors.New("extension: project work observer requires trusted RDM registration")
+	}
+	if p.Observe == nil || p.Preflight == nil || p.Respond == nil {
+		return errors.New("extension: project work observer requires all callbacks")
+	}
+	s := r.caps.workObserver
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.provider != nil {
+		return errors.New("extension: project work observer already registered")
+	}
+	copy := p
+	s.provider = &copy
+	return nil
+}
+
+func (r recordRegistry) RegisterProjectWorkObserver(p extension.ProjectWorkObserver) error {
+	reg, ok := r.Registry.(extension.ProjectWorkObservationRegistry)
+	if !ok {
+		return errors.New("extension: project work observation registration unavailable")
+	}
+	return reg.RegisterProjectWorkObserver(p)
+}
+
+// deliverProjectWorkObservations replays only committed source parts, rechecking
+// their owner and current project work authority before disclosing text to RDM.
+// An Observe ACK is an intake receipt, not a preflight or publication decision.
+// Failures leave the row pending for a later idempotent retry.
+func deliverProjectWorkObservations(ctx context.Context, st *store.Store, slot *projectWorkObserverSlot,
+	work func(context.Context, string, core.ID) (bool, error), limit int, verify ...func(context.Context, store.ProjectWorkObservationRow) error,
+) (int, error) {
+	provider := slot.get()
+	if provider == nil || work == nil {
+		return 0, errors.New("extension: trusted project work observer unavailable")
+	}
+	rows, err := st.PendingProjectWorkObservations(limit)
+	if err != nil {
+		return 0, err
+	}
+	return deliverProjectWorkRows(ctx, st, provider, work, rows, verify...)
+}
+
+func deliverProjectWorkRows(ctx context.Context, st *store.Store, provider *extension.ProjectWorkObserver,
+	work func(context.Context, string, core.ID) (bool, error), rows []store.ProjectWorkObservationRow,
+	verify ...func(context.Context, store.ProjectWorkObservationRow) error,
+) (int, error) {
+	completed := 0
+	for _, row := range rows {
+		if row.State != "pending" {
+			continue
+		}
+		if row.SourceKind != "user-message" && row.SourceKind != "assistant-message" {
+			if len(verify) != 1 || verify[0] == nil {
+				return completed, fmt.Errorf("project work source %s: current resource status verifier unavailable", row.EventID)
+			}
+			if err := verify[0](ctx, row); err != nil {
+				return completed, err
+			}
+		}
+		if err := ctx.Err(); err != nil {
+			return completed, err
+		}
+		conv, err := st.GetConversation(row.Owner, row.ConversationID)
+		if err != nil || string(conv.ProjectID) != row.ProjectID {
+			return completed, fmt.Errorf("project work source %s: current conversation binding unavailable", row.EventID)
+		}
+		allowed, err := work(ctx, row.Owner, core.ID(row.ProjectID))
+		if err != nil || !allowed {
+			return completed, fmt.Errorf("project work source %s: current project authorization denied", row.EventID)
+		}
+		account, err := st.GetAccountByOwner(row.Owner)
+		authorizationEpoch := ""
+		if err == nil && account.Enabled {
+			authorizationEpoch = fmt.Sprintf("account:%d:project:%s", account.AuthVersion, row.ProjectID)
+		} else if row.Owner == store.OwnerDefault {
+			// Auth-off local mode has no enabled account model. The project-work
+			// callback above is still authoritative for this process.
+			authorizationEpoch = "auth-off-local:project:" + row.ProjectID
+		} else {
+			return completed, fmt.Errorf("project work source %s: current account authorization unavailable", row.EventID)
+		}
+		observation := extension.WorkObservation{
+			EventID: row.EventID, Phase: "source-committed", Actor: row.Owner, Owner: row.Owner,
+			ProjectID: core.ID(row.ProjectID), ConversationID: core.ID(row.ConversationID), RunID: core.ID(row.RunID),
+			SourceKind: row.SourceKind, SourceID: row.SourceID, SourceVersion: row.SourceVersion,
+			SourceSHA256: row.SourceSHA256, PartIndex: row.PartIndex, SpanStart: row.SpanStart, SpanEnd: row.SpanEnd,
+			Text: row.Text, Scope: row.Scope, Delivery: row.Delivery, DeliveryReason: row.Reason, Metadata: row.Metadata,
+			AuthorizationEpoch: authorizationEpoch, ObservedAt: row.ObservedAt,
+		}
+		result, err := provider.Observe(ctx, observation)
+		if err != nil {
+			return completed, err
+		}
+		switch result.State {
+		case extension.WorkObservationPending:
+			continue
+		case extension.WorkObservationAccepted, extension.WorkObservationPartial, extension.WorkObservationDenied:
+			if err := st.FinishProjectWorkObservation(row.EventID, result.ReceiptID, string(result.State)); err != nil {
+				return completed, err
+			}
+			completed++
+		default:
+			return completed, fmt.Errorf("project work source %s: invalid observer result %q", row.EventID, result.State)
+		}
+	}
+	return completed, nil
+}
+
+func verifyProjectKnowledgeObservation(_ context.Context, caps hostcaps, row store.ProjectWorkObservationRow) error {
+	if row.SourceKind != "retrieval-hit" || caps.st == nil {
+		return errors.New("project work source: unsupported resource verification")
+	}
+	doc, err := caps.st.ProjectWorkKnowledgeSource(row.SourceID)
+	if err != nil {
+		return errors.New("project work source: current knowledge source unavailable")
+	}
+	hash := sha256.Sum256([]byte(doc.Chunk))
+	actualHash := fmt.Sprintf("%x", hash)
+	if actualHash != row.SourceVersion || actualHash != row.SourceSHA256 || doc.Chunk != row.Text ||
+		(row.Metadata["ref"] != "" && row.Metadata["ref"] != doc.Ref) ||
+		(row.Metadata["source"] != "" && row.Metadata["source"] != doc.Source) ||
+		(doc.ProjectID != "" && string(doc.ProjectID) != row.ProjectID) {
+		return errors.New("project work source: knowledge version or scope changed")
+	}
+	if caps.authz != nil && caps.authz.hasV2() {
+		allowed, err := caps.authz.AuthorizeResource(extension.ResourceAuthzQuery{
+			Actor: row.Owner, Action: "model-context", ResourceType: "knowledge", ResourceID: doc.ID,
+			Owner: string(doc.Owner), ProjectID: doc.ProjectID, Source: doc.Source,
+		})
+		if err != nil || !allowed {
+			return errors.New("project work source: current knowledge authorization denied")
+		}
+	} else if string(doc.Owner) != row.Owner {
+		return errors.New("project work source: shared knowledge authorization unavailable")
+	}
+	return nil
+}
+
+// A transient tool result has no external source authority to recheck. Its
+// committed private outbox bytes and stored run are the only reliable source;
+// RDM must keep it a candidate until a separately verifiable evidence source
+// or human confirmation supports a formal project claim.
+func verifyProjectTransientObservation(_ context.Context, st *store.Store, row store.ProjectWorkObservationRow) error {
+	toolSource := row.SourceKind == "tool-result" && row.Metadata["sourceStatus"] == "transient" && row.Metadata["toolName"] != ""
+	visibleAnalysis := row.SourceKind == "visible-analysis" && row.Metadata["stage"] == "assistant-final" && row.Metadata["partType"] != ""
+	if (!toolSource && !visibleAnalysis) || row.RunID == "" {
+		return errors.New("project work source: transient result lacks trusted provenance")
+	}
+	run, err := st.GetRunByID(core.ID(row.RunID))
+	if err != nil || string(run.Owner) != row.Owner || string(run.ProjectID) != row.ProjectID || string(run.ConversationID) != row.ConversationID {
+		return errors.New("project work source: transient run binding unavailable")
+	}
+	return nil
+}
+
+// preflightProjectMessage delivers this committed message's pending parts
+// inline, then asks RDM to prove that every exact source part was analyzed for
+// the pending action. A durable intake ACK alone never permits the action.
+func preflightProjectMessage(ctx context.Context, st *store.Store, slot *projectWorkObserverSlot,
+	work func(context.Context, string, core.ID) (bool, error), messageID, action, expectedOwner, expectedConversation, expectedProject, targetID, targetVersion string,
+) (extension.ProjectWorkDecision, error) {
+	pending := extension.ProjectWorkDecision{State: extension.ProjectWorkPending, Reason: "project source awaiting analysis"}
+	provider := slot.get()
+	if provider == nil || work == nil {
+		return pending, errors.New("extension: trusted project work observer unavailable")
+	}
+	rows, err := st.ProjectMessageObservations(messageID)
+	if err != nil {
+		return pending, err
+	}
+	if len(rows) == 0 {
+		return pending, errors.New("extension: committed project message has no source manifest")
+	}
+	if _, err := deliverProjectWorkRows(ctx, st, provider, work, rows); err != nil {
+		return pending, err
+	}
+	rows, err = st.ProjectMessageObservations(messageID)
+	if err != nil {
+		return pending, err
+	}
+	manifest := make([]extension.ProjectWorkSource, 0, len(rows))
+	for _, row := range rows {
+		if row.State != "accepted" || row.Delivery != "complete" {
+			return pending, nil
+		}
+		manifest = append(manifest, extension.ProjectWorkSource{
+			EventID: row.EventID, SourceKind: row.SourceKind, SourceID: row.SourceID,
+			SourceVersion: row.SourceVersion, SourceSHA256: row.SourceSHA256, PartIndex: row.PartIndex,
+		})
+	}
+	first := rows[0]
+	if first.Owner != expectedOwner || first.ConversationID != expectedConversation || first.ProjectID != expectedProject {
+		return pending, errors.New("extension: source message is not bound to this actor, conversation, and project")
+	}
+	for _, row := range rows[1:] {
+		if row.Owner != first.Owner || row.ProjectID != first.ProjectID || row.ConversationID != first.ConversationID {
+			return pending, errors.New("extension: mixed project source manifest")
+		}
+	}
+	conv, err := st.GetConversation(first.Owner, first.ConversationID)
+	if err != nil || string(conv.ProjectID) != first.ProjectID {
+		return pending, errors.New("extension: project binding changed before preflight")
+	}
+	allowed, err := work(ctx, first.Owner, conv.ProjectID)
+	if err != nil || !allowed {
+		return pending, errors.New("extension: current project work denied before preflight")
+	}
+	raw, err := json.Marshal(manifest)
+	if err != nil {
+		return pending, err
+	}
+	watermark := fmt.Sprintf("%x", sha256.Sum256(raw))
+	decision, err := provider.Preflight(ctx, extension.ProjectWorkAction{
+		Actor: first.Owner, Owner: first.Owner, ProjectID: conv.ProjectID,
+		ConversationID: conv.ID, RunID: core.ID(first.RunID), Action: action, TargetID: targetID, TargetVersion: targetVersion,
+		Manifest: manifest, SourceWatermark: watermark,
+	})
+	if err != nil {
+		return pending, err
+	}
+	switch decision.State {
+	case extension.ProjectWorkProceed:
+		if decision.DecisionID == "" || decision.SourceWatermark != watermark {
+			return pending, errors.New("extension: project preflight decision did not bind current sources")
+		}
+	case extension.ProjectWorkClarify, extension.ProjectWorkPending, extension.ProjectWorkDenied:
+		// A non-proceed decision is a real result, never an implied approval.
+	default:
+		return pending, errors.New("extension: invalid project preflight decision")
+	}
+	return decision, nil
+}
+
+// preflightProjectRun binds all committed user, retrieval, tool, and visible
+// analysis parts of one run before a later model or business action consumes
+// them. Missing/partial parts keep the action pending. The domain provider
+// decides whether the complete source set contains a blocking risk.
+func preflightProjectRun(ctx context.Context, st *store.Store, slot *projectWorkObserverSlot,
+	work func(context.Context, string, core.ID) (bool, error), verify func(context.Context, store.ProjectWorkObservationRow) error,
+	runID, action string,
+) (extension.ProjectWorkDecision, error) {
+	pending := extension.ProjectWorkDecision{State: extension.ProjectWorkPending, Reason: "run sources awaiting analysis"}
+	provider := slot.get()
+	if provider == nil || work == nil || verify == nil {
+		return pending, errors.New("extension: trusted project run observer unavailable")
+	}
+	run, err := st.GetRunByID(core.ID(runID))
+	if err != nil || run.ProjectID == "" {
+		return pending, errors.New("extension: trusted project run unavailable")
+	}
+	rows, err := st.ProjectRunObservations(runID)
+	if err != nil {
+		return pending, err
+	}
+	if len(rows) == 0 {
+		return pending, errors.New("extension: project run has no trusted source manifest")
+	}
+	if _, err := deliverProjectWorkRows(ctx, st, provider, work, rows, verify); err != nil {
+		return pending, err
+	}
+	rows, err = st.ProjectRunObservations(runID)
+	if err != nil {
+		return pending, err
+	}
+	manifest := make([]extension.ProjectWorkSource, 0, len(rows))
+	for _, row := range rows {
+		if row.State != "accepted" || row.Delivery != "complete" {
+			return pending, nil
+		}
+		if row.RunID != runID || row.Owner != string(run.Owner) || row.ProjectID != string(run.ProjectID) || row.ConversationID != string(run.ConversationID) {
+			return pending, errors.New("extension: mixed run source manifest")
+		}
+		if row.SourceKind != "user-message" && row.SourceKind != "assistant-message" {
+			if err := verify(ctx, row); err != nil {
+				return pending, err
+			}
+		}
+		manifest = append(manifest, extension.ProjectWorkSource{
+			EventID: row.EventID, SourceKind: row.SourceKind, SourceID: row.SourceID,
+			SourceVersion: row.SourceVersion, SourceSHA256: row.SourceSHA256, PartIndex: row.PartIndex,
+		})
+	}
+	conv, err := st.GetConversation(string(run.Owner), string(run.ConversationID))
+	if err != nil || conv.ProjectID != run.ProjectID {
+		return pending, errors.New("extension: run project binding changed before preflight")
+	}
+	allowed, err := work(ctx, string(run.Owner), run.ProjectID)
+	if err != nil || !allowed {
+		return pending, errors.New("extension: current run project work denied")
+	}
+	raw, err := json.Marshal(manifest)
+	if err != nil {
+		return pending, err
+	}
+	watermark := fmt.Sprintf("%x", sha256.Sum256(raw))
+	decision, err := provider.Preflight(ctx, extension.ProjectWorkAction{
+		Actor: string(run.Owner), Owner: string(run.Owner), ProjectID: run.ProjectID,
+		ConversationID: run.ConversationID, RunID: run.ID, Action: action,
+		Manifest: manifest, SourceWatermark: watermark,
+	})
+	if err != nil {
+		return pending, err
+	}
+	switch decision.State {
+	case extension.ProjectWorkProceed:
+		if decision.DecisionID == "" || decision.SourceWatermark != watermark {
+			return pending, errors.New("extension: run preflight decision did not bind current sources")
+		}
+	case extension.ProjectWorkClarify, extension.ProjectWorkPending, extension.ProjectWorkDenied:
+	default:
+		return pending, errors.New("extension: invalid project run preflight decision")
+	}
+	return decision, nil
+}
@@ -0,0 +1,332 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"path/filepath"
+	"testing"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+func workObserverForTest() extension.ProjectWorkObserver {
+	return extension.ProjectWorkObserver{
+		Observe: func(context.Context, extension.WorkObservation) (extension.WorkObservationResult, error) {
+			return extension.WorkObservationResult{State: extension.WorkObservationPending}, nil
+		},
+		Preflight: func(context.Context, extension.ProjectWorkAction) (extension.ProjectWorkDecision, error) {
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkPending}, nil
+		},
+		Respond: func(context.Context, extension.ProjectRiskAnswer) (extension.ProjectWorkDecision, error) {
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkPending}, nil
+		},
+	}
+}
+
+func TestProjectWorkDeliveryRechecksCurrentAuthorityAndACKsOnce(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "work.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", string(project.ID), "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	msg := core.Message{ConversationID: conv.ID, Role: core.RoleUser, Parts: []core.Part{{Type: core.PartText, Text: "要求效率和成本都低于人工"}}}
+	if err := st.AppendMessageWithRequestAccountChecked("alice", false, &msg, "req-1"); err != nil {
+		t.Fatal(err)
+	}
+	called := 0
+	slot := &projectWorkObserverSlot{}
+	observer := workObserverForTest()
+	observer.Observe = func(_ context.Context, source extension.WorkObservation) (extension.WorkObservationResult, error) {
+		called++
+		if source.Owner != "alice" || source.Actor != "alice" || source.ProjectID != project.ID || source.SourceID != string(msg.ID) || source.Text != msg.Parts[0].Text || source.Scope != "private" {
+			t.Fatalf("provider received forged or wrong source: %+v", source)
+		}
+		return extension.WorkObservationResult{State: extension.WorkObservationAccepted, ReceiptID: "rdm-receipt-1"}, nil
+	}
+	if err := (pluginRegistry{pluginID: "rdm", caps: hostcaps{workObserver: slot}}).RegisterProjectWorkObserver(observer); err != nil {
+		t.Fatal(err)
+	}
+	denied := func(context.Context, string, core.ID) (bool, error) { return false, nil }
+	if _, err := deliverProjectWorkObservations(context.Background(), st, slot, denied, 10); err == nil || called != 0 {
+		t.Fatalf("revoked source was disclosed: calls=%d err=%v", called, err)
+	}
+	allowed := func(_ context.Context, actor string, id core.ID) (bool, error) {
+		return actor == "alice" && id == project.ID, nil
+	}
+	if delivered, err := deliverProjectWorkObservations(context.Background(), st, slot, allowed, 10); err != nil || delivered != 1 || called != 1 {
+		t.Fatalf("authorized source delivery failed: delivered=%d calls=%d err=%v", delivered, called, err)
+	}
+	if delivered, err := deliverProjectWorkObservations(context.Background(), st, slot, allowed, 10); err != nil || delivered != 0 || called != 1 {
+		t.Fatalf("delivered source was replayed without need: delivered=%d calls=%d err=%v", delivered, called, err)
+	}
+}
+
+func TestProjectMessagePreflightRequiresAnalysisAndExactManifest(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "preflight.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", string(project.ID), "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	msg := core.Message{ConversationID: conv.ID, Role: core.RoleUser, Parts: []core.Part{{Type: core.PartText, Text: "要求效率和成本都低于人工"}}}
+	if err := st.AppendMessageWithRequestAccountChecked("alice", false, &msg, "req-1"); err != nil {
+		t.Fatal(err)
+	}
+	ready, observations, decisions := false, 0, 0
+	observer := workObserverForTest()
+	observer.Observe = func(context.Context, extension.WorkObservation) (extension.WorkObservationResult, error) {
+		observations++
+		return extension.WorkObservationResult{State: extension.WorkObservationAccepted, ReceiptID: "intake-1"}, nil
+	}
+	observer.Preflight = func(_ context.Context, action extension.ProjectWorkAction) (extension.ProjectWorkDecision, error) {
+		decisions++
+		if action.Actor != "alice" || action.ProjectID != project.ID || action.ConversationID != conv.ID || action.RunID != "" || action.Action != "conversation.run" || len(action.Manifest) != 1 {
+			t.Fatalf("preflight did not receive exact trusted source manifest: %+v", action)
+		}
+		if !ready {
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkPending}, nil
+		}
+		return extension.ProjectWorkDecision{State: extension.ProjectWorkProceed, DecisionID: "decision-1", SourceWatermark: action.SourceWatermark}, nil
+	}
+	slot := &projectWorkObserverSlot{provider: &observer}
+	work := func(_ context.Context, actor string, id core.ID) (bool, error) {
+		return actor == "alice" && id == project.ID, nil
+	}
+	decision, err := preflightProjectMessage(context.Background(), st, slot, work, string(msg.ID), "conversation.run", "alice", string(conv.ID), string(project.ID), "conversation.run", "v1")
+	if err != nil || decision.State != extension.ProjectWorkPending || observations != 1 || decisions != 1 {
+		t.Fatalf("durable intake was confused with completed analysis: %+v observations=%d decisions=%d err=%v", decision, observations, decisions, err)
+	}
+	ready = true
+	decision, err = preflightProjectMessage(context.Background(), st, slot, work, string(msg.ID), "conversation.run", "alice", string(conv.ID), string(project.ID), "conversation.run", "v1")
+	if err != nil || decision.State != extension.ProjectWorkProceed || observations != 1 || decisions != 2 {
+		t.Fatalf("same source did not proceed after domain analysis: %+v observations=%d decisions=%d err=%v", decision, observations, decisions, err)
+	}
+	if _, err := st.DB().Exec(`UPDATE messages SET parts=? WHERE id=?`, `[{"type":"text","text":"changed"}]`, msg.ID); err != nil {
+		t.Fatal(err)
+	}
+	decision, err = preflightProjectMessage(context.Background(), st, slot, work, string(msg.ID), "conversation.run", "alice", string(conv.ID), string(project.ID), "conversation.run", "v1")
+	if err != nil || decision.State != extension.ProjectWorkPending || decisions != 2 {
+		t.Fatalf("source changed after ACK but stale decision still passed: %+v decisions=%d err=%v", decision, decisions, err)
+	}
+	partial := core.Message{ConversationID: conv.ID, Role: core.RoleUser, Parts: []core.Part{{Type: core.PartArtifactRef, Artifact: &core.ArtifactRef{ArtifactID: "file-1"}}}}
+	if err := st.AppendMessageWithRequestAccountChecked("alice", false, &partial, "req-2"); err != nil {
+		t.Fatal(err)
+	}
+	decision, err = preflightProjectMessage(context.Background(), st, slot, work, string(partial.ID), "conversation.run", "alice", string(conv.ID), string(project.ID), "conversation.run", "v1")
+	if err != nil || decision.State != extension.ProjectWorkPending || decisions != 2 {
+		t.Fatalf("partial attachment reached project action preflight: %+v decisions=%d err=%v", decision, decisions, err)
+	}
+}
+
+func TestRetrievalObservationRechecksCurrentSourceBeforeDisclosure(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "source.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", string(project.ID), "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := core.Run{ConversationID: conv.ID, ProjectID: project.ID, Owner: "alice", Kind: core.RunConversation, Status: core.RunRunning, Phase: core.PhaseThinking}
+	if err := st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	doc := core.KnowledgeDoc{ID: "knowledge-1", Owner: "alice", ProjectID: project.ID, Source: "upload", Ref: "https://example.test/a", Chunk: "actual source"}
+	if err := st.AddKnowledge(doc); err != nil {
+		t.Fatal(err)
+	}
+	observation := store.RunWorkObservationInput{RunID: string(run.ID), SourceKind: "retrieval-hit", SourceID: string(doc.ID),
+		SourceVersion: fmt.Sprintf("%x", sha256.Sum256([]byte(doc.Chunk))), Text: doc.Chunk, Delivery: "complete",
+		Metadata: map[string]string{"ref": doc.Ref, "source": doc.Source}}
+	if _, err := st.AppendRunWorkObservation(observation); err != nil {
+		t.Fatal(err)
+	}
+	called := 0
+	provider := workObserverForTest()
+	provider.Observe = func(context.Context, extension.WorkObservation) (extension.WorkObservationResult, error) {
+		called++
+		return extension.WorkObservationResult{State: extension.WorkObservationAccepted, ReceiptID: "rdm-1"}, nil
+	}
+	slot := &projectWorkObserverSlot{provider: &provider}
+	work := func(context.Context, string, core.ID) (bool, error) { return true, nil }
+	verify := func(ctx context.Context, row store.ProjectWorkObservationRow) error {
+		return verifyProjectKnowledgeObservation(ctx, hostcaps{st: st}, row)
+	}
+	if n, err := deliverProjectWorkObservations(context.Background(), st, slot, work, 10, verify); err != nil || n != 1 || called != 1 {
+		t.Fatalf("current owned source was not delivered: n=%d calls=%d err=%v", n, called, err)
+	}
+	if _, err := st.AppendRunWorkObservation(observation); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.DB().Exec(`DELETE FROM knowledge WHERE id=?`, doc.ID); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := deliverProjectWorkObservations(context.Background(), st, slot, work, 10, verify); err == nil || n != 0 || called != 1 {
+		t.Fatalf("deleted source text crossed into observer: n=%d calls=%d err=%v", n, called, err)
+	}
+}
+
+func TestTransientToolSourceKeepsCurrentRunAndCandidateStatus(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "tool.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", string(project.ID), "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := core.Run{ConversationID: conv.ID, ProjectID: project.ID, Owner: "alice", Kind: core.RunConversation, Status: core.RunRunning, Phase: core.PhaseThinking}
+	if err := st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	_, err = st.AppendRunWorkObservation(store.RunWorkObservationInput{RunID: string(run.ID), SourceKind: "tool-result", SourceID: "call-1", SourceVersion: "v1",
+		Text: "实际工具返回", Delivery: "complete", Metadata: map[string]string{"sourceStatus": "transient", "toolName": "lookup"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rows, err := st.PendingProjectWorkObservations(10)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("tool source missing: %+v %v", rows, err)
+	}
+	if err := verifyProjectTransientObservation(context.Background(), st, rows[0]); err != nil {
+		t.Fatalf("committed private tool source rejected: %v", err)
+	}
+	if _, err := st.DB().Exec(`DELETE FROM runs WHERE id=?`, run.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := verifyProjectTransientObservation(context.Background(), st, rows[0]); err == nil {
+		t.Fatal("deleted run still authorized its transient source")
+	}
+}
+
+func TestRunPreflightWaitsForAllCommittedSourceParts(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "run-preflight.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "P")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", string(project.ID), "Work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := core.Run{ConversationID: conv.ID, ProjectID: project.ID, Owner: "alice", Kind: core.RunConversation, Status: core.RunRunning, Phase: core.PhaseThinking}
+	if err := st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	msg := core.Message{ConversationID: conv.ID, Role: core.RoleUser, Parts: []core.Part{{Type: core.PartText, Text: "检查成本和效率"}}}
+	if err := st.AppendMessageWithRequestAccountChecked("alice", false, &msg, "req"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SetMessageRunIDAccountChecked("alice", string(msg.ID), string(run.ID), false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AppendRunWorkObservation(store.RunWorkObservationInput{RunID: string(run.ID), SourceKind: "tool-result", SourceID: "call-1",
+		SourceVersion: "v1", Text: "工具中的测量结果", Delivery: "complete", Metadata: map[string]string{"sourceStatus": "transient", "toolName": "measure"}}); err != nil {
+		t.Fatal(err)
+	}
+	ready, preflights, observed, verified := false, 0, 0, 0
+	provider := workObserverForTest()
+	provider.Observe = func(_ context.Context, observation extension.WorkObservation) (extension.WorkObservationResult, error) {
+		observed++
+		if observation.AuthorizationEpoch == "" {
+			t.Fatal("observation omitted the current authorization epoch")
+		}
+		return extension.WorkObservationResult{State: extension.WorkObservationAccepted, ReceiptID: fmt.Sprintf("receipt-%d", observed)}, nil
+	}
+	provider.Preflight = func(_ context.Context, action extension.ProjectWorkAction) (extension.ProjectWorkDecision, error) {
+		preflights++
+		if action.RunID != run.ID || action.ProjectID != project.ID || len(action.Manifest) != 2 {
+			t.Fatalf("run manifest omitted a committed source: %+v", action)
+		}
+		if !ready {
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkPending}, nil
+		}
+		return extension.ProjectWorkDecision{State: extension.ProjectWorkProceed, DecisionID: "approved-risk-check", SourceWatermark: action.SourceWatermark}, nil
+	}
+	slot := &projectWorkObserverSlot{provider: &provider}
+	work := func(context.Context, string, core.ID) (bool, error) { return true, nil }
+	verify := func(ctx context.Context, row store.ProjectWorkObservationRow) error {
+		verified++
+		return verifyProjectTransientObservation(ctx, st, row)
+	}
+	decision, err := preflightProjectRun(context.Background(), st, slot, work, verify, string(run.ID), "model.consume.tool")
+	if err != nil || decision.State != extension.ProjectWorkPending || observed != 2 || preflights != 1 || verified != 2 {
+		t.Fatalf("intake ACK was mistaken for finished risk analysis: %+v observed=%d preflights=%d err=%v", decision, observed, preflights, err)
+	}
+	ready = true
+	decision, err = preflightProjectRun(context.Background(), st, slot, work, verify, string(run.ID), "model.consume.tool")
+	if err != nil || decision.State != extension.ProjectWorkProceed || observed != 2 || preflights != 2 || verified != 3 {
+		t.Fatalf("fully analyzed run was not released once: %+v observed=%d verified=%d preflights=%d err=%v", decision, observed, verified, preflights, err)
+	}
+}
+
+func TestProjectWorkObservationRegistrationIsTrustedAndUnique(t *testing.T) {
+	slot := &projectWorkObserverSlot{}
+	trusted := pluginRegistry{pluginID: "rdm", caps: hostcaps{workObserver: slot}}
+	other := pluginRegistry{pluginID: "other", caps: hostcaps{workObserver: slot}}
+	if err := other.RegisterProjectWorkObserver(workObserverForTest()); err == nil {
+		t.Fatal("untrusted plugin registered project observer")
+	}
+	if err := (compiledRegistry{}).RegisterProjectWorkObserver(workObserverForTest()); err == nil {
+		t.Fatal("declarative plugin registered live observer callback")
+	}
+	if err := trusted.RegisterProjectWorkObserver(extension.ProjectWorkObserver{}); err == nil {
+		t.Fatal("partial observer registered")
+	}
+	if err := trusted.RegisterProjectWorkObserver(workObserverForTest()); err != nil {
+		t.Fatal(err)
+	}
+	if err := trusted.RegisterProjectWorkObserver(workObserverForTest()); err == nil {
+		t.Fatal("second observer replaced the trusted provider")
+	}
+	if got := slot.get(); got == nil || got.Observe == nil || got.Preflight == nil || got.Respond == nil {
+		t.Fatal("registered observer not available to host")
+	}
+}
@@ -0,0 +1,220 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"unicode/utf8"
+
+	"agent-system-backend/pkg/extension"
+)
+
+// EXT-20：共享法规检索与网络证据。提供方由受信插件 kbreg 进程内注册；基座只
+// 填写调用方身份、做查询最小化校验并审计，不改写提供方返回的状态。
+
+const (
+	regulationsPluginID = "kbreg"
+	maxWebQueryRunes    = 256
+
+	auditRegulationsSearch   = "regulations.search"
+	auditRegulationsEvidence = "regulations.evidence"
+	auditWebSearch           = "web.search"
+	auditWebCapture          = "web.capture"
+
+	regulationsAuditInvalid = "invalid"
+	regulationsAuditError   = "error"
+	regulationsAuditOK      = "ok"
+)
+
+var (
+	errRegulationsSchema = errors.New("extension: unsupported regulations schema version")
+	errWebQueryInvalid   = errors.New("extension: web search query must be 1-256 characters")
+)
+
+type regulationsSlot struct {
+	mu       sync.RWMutex
+	provider extension.RegulationsProvider
+}
+
+func (s *regulationsSlot) register(pluginID string, p extension.RegulationsProvider) error {
+	if p == nil || pluginID != regulationsPluginID {
+		return errors.New("extension: regulations provider requires trusted kbreg registration")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.provider != nil {
+		return errors.New("extension: regulations provider already registered")
+	}
+	s.provider = p
+	return nil
+}
+
+func (s *regulationsSlot) get() extension.RegulationsProvider {
+	if s == nil {
+		return nil
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.provider
+}
+
+// regulationsAudit is the only content written to the audit trail: never the
+// query text, excerpts or captured page text.
+type regulationsAudit struct {
+	Revision    string `json:"revision,omitempty"`
+	Count       int    `json:"count"`
+	State       string `json:"state"`
+	QuerySHA256 string `json:"querySha256,omitempty"`
+}
+
+func regulationsQueryDigest(query string) string {
+	if query == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(query))
+	return hex.EncodeToString(sum[:])
+}
+
+// regulations resolves the provider and the trusted caller. Without an audit
+// store the capability is unavailable: calls must never run unaudited.
+func (h inprocHost) regulations() (extension.RegulationsProvider, extension.RegulationsCaller, error) {
+	if err := h.requireEffective(); err != nil {
+		return nil, extension.RegulationsCaller{}, err
+	}
+	p := h.caps.regulations.get()
+	if p == nil || h.caps.st == nil {
+		return nil, extension.RegulationsCaller{}, extension.ErrRegulationsUnavailable
+	}
+	return p, extension.RegulationsCaller{PluginID: h.pluginID, Actor: h.actor, Owner: h.owner}, nil
+}
+
+// auditRegulations appends one event per call. A call error takes precedence;
+// otherwise an audit failure withholds the result.
+func (h inprocHost) auditRegulations(action string, rec regulationsAudit, callErr error) error {
+	if callErr != nil && rec.State == "" {
+		rec.State = regulationsAuditError
+	}
+	evidence, err := json.Marshal(rec)
+	if err == nil {
+		err = h.Audit(action, regulationsPluginID, string(evidence))
+	}
+	if callErr != nil {
+		return callErr
+	}
+	return err
+}
+
+func (h inprocHost) SearchRegulations(ctx context.Context, req extension.RegulationsSearchRequest) (extension.RegulationsSearchResult, error) {
+	p, caller, err := h.regulations()
+	if err != nil {
+		return extension.RegulationsSearchResult{}, err
+	}
+	rec := regulationsAudit{Revision: req.CorpusRevision, QuerySHA256: regulationsQueryDigest(req.Query)}
+	if req.SchemaVersion != extension.RegulationsSchemaVersion {
+		rec.State = regulationsAuditInvalid
+		return extension.RegulationsSearchResult{}, h.auditRegulations(auditRegulationsSearch, rec, errRegulationsSchema)
+	}
+	res, err := p.SearchRegulations(ctx, caller, req)
+	if err == nil {
+		rec.Revision, rec.Count, rec.State = res.CorpusRevision, len(res.Hits), res.State
+	}
+	if err := h.auditRegulations(auditRegulationsSearch, rec, err); err != nil {
+		return extension.RegulationsSearchResult{}, err
+	}
+	return res, nil
+}
+
+func (h inprocHost) ResolveRegulationEvidence(ctx context.Context, req extension.RegulationEvidenceRequest) (extension.RegulationEvidence, error) {
+	p, caller, err := h.regulations()
+	if err != nil {
+		return extension.RegulationEvidence{}, err
+	}
+	rec := regulationsAudit{Revision: req.CorpusRevision}
+	if req.SchemaVersion != extension.RegulationsSchemaVersion {
+		rec.State = regulationsAuditInvalid
+		return extension.RegulationEvidence{}, h.auditRegulations(auditRegulationsEvidence, rec, errRegulationsSchema)
+	}
+	ev, err := p.ResolveRegulationEvidence(ctx, caller, req)
+	if err == nil {
+		rec.Count, rec.State = 1, regulationsAuditOK
+		if ev.CorpusRevision != "" {
+			rec.Revision = ev.CorpusRevision
+		}
+	}
+	if err := h.auditRegulations(auditRegulationsEvidence, rec, err); err != nil {
+		return extension.RegulationEvidence{}, err
+	}
+	return ev, nil
+}
+
+// webQueryExcluded reports whether query contains any non-empty exclusion
+// term, case-insensitively.
+func webQueryExcluded(query string, exclusions []string) bool {
+	lower := strings.ToLower(query)
+	for _, term := range exclusions {
+		term = strings.ToLower(strings.TrimSpace(term))
+		if term != "" && strings.Contains(lower, term) {
+			return true
+		}
+	}
+	return false
+}
+
+func (h inprocHost) SearchWeb(ctx context.Context, req extension.WebSearchRequest) (extension.WebSearchResult, error) {
+	p, caller, err := h.regulations()
+	if err != nil {
+		return extension.WebSearchResult{}, err
+	}
+	req.Query = strings.TrimSpace(req.Query)
+	rec := regulationsAudit{QuerySHA256: regulationsQueryDigest(req.Query)}
+	if req.SchemaVersion != extension.RegulationsSchemaVersion {
+		rec.State = regulationsAuditInvalid
+		return extension.WebSearchResult{}, h.auditRegulations(auditWebSearch, rec, errRegulationsSchema)
+	}
+	if req.Query == "" || !utf8.ValidString(req.Query) || utf8.RuneCountInString(req.Query) > maxWebQueryRunes {
+		rec.State = regulationsAuditInvalid
+		return extension.WebSearchResult{}, h.auditRegulations(auditWebSearch, rec, errWebQueryInvalid)
+	}
+	if webQueryExcluded(req.Query, req.Exclusions) {
+		res := extension.WebSearchResult{State: extension.WebSearchStateRejected, Reason: "query contains an excluded term"}
+		rec.State = res.State
+		if err := h.auditRegulations(auditWebSearch, rec, nil); err != nil {
+			return extension.WebSearchResult{}, err
+		}
+		return res, nil
+	}
+	res, err := p.SearchWeb(ctx, caller, req)
+	if err == nil {
+		rec.Count, rec.State = len(res.Results), res.State
+	}
+	if err := h.auditRegulations(auditWebSearch, rec, err); err != nil {
+		return extension.WebSearchResult{}, err
+	}
+	return res, nil
+}
+
+func (h inprocHost) CaptureWeb(ctx context.Context, req extension.WebCaptureRequest) (extension.WebCapture, error) {
+	p, caller, err := h.regulations()
+	if err != nil {
+		return extension.WebCapture{}, err
+	}
+	rec := regulationsAudit{QuerySHA256: regulationsQueryDigest(strings.TrimSpace(req.SearchQuery))}
+	if req.SchemaVersion != extension.RegulationsSchemaVersion {
+		rec.State = regulationsAuditInvalid
+		return extension.WebCapture{}, h.auditRegulations(auditWebCapture, rec, errRegulationsSchema)
+	}
+	capture, err := p.CaptureWeb(ctx, caller, req)
+	if err == nil {
+		rec.Count, rec.State = len(capture.Candidates), capture.State
+	}
+	if err := h.auditRegulations(auditWebCapture, rec, err); err != nil {
+		return extension.WebCapture{}, err
+	}
+	return capture, nil
+}
+
+var _ extension.RegulationsHost = inprocHost{}
@@ -0,0 +1,134 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+// compatRegulationsPlugin stands in for the external kbreg repository: it uses
+// only pkg/extension types and registers through the optional Registrar.
+type compatRegulationsPlugin struct{ seen []extension.RegulationsCaller }
+
+func (p *compatRegulationsPlugin) Register(reg extension.Registry) error {
+	registrar, ok := reg.(extension.RegulationsRegistrar)
+	if !ok {
+		return errors.New("regulations registrar unavailable")
+	}
+	return registrar.RegisterRegulationsProvider(p)
+}
+
+func (p *compatRegulationsPlugin) SearchRegulations(_ context.Context, c extension.RegulationsCaller, req extension.RegulationsSearchRequest) (extension.RegulationsSearchResult, error) {
+	p.seen = append(p.seen, c)
+	return extension.RegulationsSearchResult{CorpusRevision: "rev-compat", State: extension.RegulationsStateOK,
+		Hits: []extension.RegulationHit{{RegulationID: "r", EditionID: "e", NodeID: "n", Disclosure: extension.RegulationDisclosureExcerpt}}}, nil
+}
+
+func (p *compatRegulationsPlugin) ResolveRegulationEvidence(_ context.Context, c extension.RegulationsCaller, req extension.RegulationEvidenceRequest) (extension.RegulationEvidence, error) {
+	p.seen = append(p.seen, c)
+	return extension.RegulationEvidence{CorpusRevision: req.CorpusRevision, NodeID: req.NodeID, Disclosure: extension.RegulationDisclosureFull, HashVerified: true}, nil
+}
+
+func (p *compatRegulationsPlugin) SearchWeb(_ context.Context, c extension.RegulationsCaller, req extension.WebSearchRequest) (extension.WebSearchResult, error) {
+	p.seen = append(p.seen, c)
+	return extension.WebSearchResult{Provider: "compat", SentQuery: req.Query, State: extension.WebSearchStateEmpty}, nil
+}
+
+func (p *compatRegulationsPlugin) CaptureWeb(_ context.Context, c extension.RegulationsCaller, req extension.WebCaptureRequest) (extension.WebCapture, error) {
+	p.seen = append(p.seen, c)
+	return extension.WebCapture{FinalURL: req.URL, State: extension.WebCaptureStateFailed, Reason: "offline"}, nil
+}
+
+// compatRegulationsConsumer is a second compiled plugin that reaches the
+// provider only through the dispatch Host type assertion.
+func compatRegulationsConsumer(reg extension.Registry) error {
+	return reg.AddCommandHandler(json.RawMessage(`{"id":"consumer.regs","title":"regs"}`),
+		func(ctx context.Context, h extension.Host, req extension.Request) (any, error) {
+			regs, ok := h.(extension.RegulationsHost)
+			if !ok {
+				return nil, errors.New("regulations host capability missing")
+			}
+			search, err := regs.SearchRegulations(ctx, extension.RegulationsSearchRequest{SchemaVersion: extension.RegulationsSchemaVersion, Query: "注册检验"})
+			if err != nil {
+				return nil, err
+			}
+			web, err := regs.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: extension.RegulationsSchemaVersion, Query: "注册检验 指导原则"})
+			if err != nil {
+				return nil, err
+			}
+			return map[string]any{"revision": search.CorpusRevision, "webState": web.State}, nil
+		})
+}
+
+func newRegulationsCompatApp(t *testing.T, plugins ...extension.InProc) (*cmdbus.Bus, *store.Store, hostcaps) {
+	t.Helper()
+	extension.ResetCompiled()
+	t.Cleanup(extension.ResetCompiled)
+	for _, p := range plugins {
+		extension.RegisterCompiled(p)
+	}
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "compat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
+	bus := cmdbus.New(st, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	caps := hostcaps{st: st, regulations: &regulationsSlot{}}
+	applyCompiled("", bus, caps)
+	return bus, st, caps
+}
+
+func TestRegulationsCompiledPluginCompatibility(t *testing.T) {
+	provider := &compatRegulationsPlugin{}
+	impostor := &compatRegulationsPlugin{}
+	bus, st, caps := newRegulationsCompatApp(t,
+		extension.InProc{ID: "impostor", Register: impostor.Register},
+		extension.InProc{ID: "kbreg", Register: provider.Register},
+		extension.InProc{ID: "consumer", Register: compatRegulationsConsumer},
+	)
+	if caps.regulations.get() != extension.RegulationsProvider(provider) {
+		t.Fatal("compiled kbreg provider was not the registered provider")
+	}
+	resp := bus.Dispatch(context.Background(), cmdbus.Request{ID: "consumer.regs", Owner: "alice", Actor: "alice", Entrance: "button"})
+	if resp.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("dispatch = %+v", resp.Receipt)
+	}
+	payload, _ := resp.Payload.(map[string]any)
+	if payload["revision"] != "rev-compat" || payload["webState"] != extension.WebSearchStateEmpty {
+		t.Fatalf("payload = %+v", resp.Payload)
+	}
+	want := extension.RegulationsCaller{PluginID: "consumer", Actor: "alice", Owner: "alice"}
+	if len(provider.seen) != 2 || provider.seen[0] != want || provider.seen[1] != want || len(impostor.seen) != 0 {
+		t.Fatalf("provider callers = %+v impostor = %+v", provider.seen, impostor.seen)
+	}
+	evs, err := st.ListAuditEvents("alice", 20)
+	if err != nil {
+		t.Fatal(err)
+	}
+	actions := map[string]bool{}
+	for _, ev := range evs {
+		actions[ev.Action] = true
+	}
+	if !actions[auditRegulationsSearch] || !actions[auditWebSearch] {
+		t.Fatalf("host audit missing: %+v", evs)
+	}
+}
+
+func TestRegulationsCompiledConsumerWithoutProvider(t *testing.T) {
+	bus, _, _ := newRegulationsCompatApp(t, extension.InProc{ID: "consumer", Register: compatRegulationsConsumer})
+	resp := bus.Dispatch(context.Background(), cmdbus.Request{ID: "consumer.regs", Owner: "alice", Actor: "alice", Entrance: "button"})
+	if resp.Receipt.State == agentcommand.StateCommitted {
+		t.Fatalf("consumer succeeded without a regulations provider: %+v", resp.Payload)
+	}
+}
@@ -0,0 +1,347 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+type fakeRegulationsProvider struct {
+	callers    []extension.RegulationsCaller
+	webQueries []string
+	search     extension.RegulationsSearchResult
+	evidence   extension.RegulationEvidence
+	web        extension.WebSearchResult
+	capture    extension.WebCapture
+	err        error
+}
+
+func (f *fakeRegulationsProvider) SearchRegulations(_ context.Context, c extension.RegulationsCaller, _ extension.RegulationsSearchRequest) (extension.RegulationsSearchResult, error) {
+	f.callers = append(f.callers, c)
+	return f.search, f.err
+}
+
+func (f *fakeRegulationsProvider) ResolveRegulationEvidence(_ context.Context, c extension.RegulationsCaller, _ extension.RegulationEvidenceRequest) (extension.RegulationEvidence, error) {
+	f.callers = append(f.callers, c)
+	return f.evidence, f.err
+}
+
+func (f *fakeRegulationsProvider) SearchWeb(_ context.Context, c extension.RegulationsCaller, req extension.WebSearchRequest) (extension.WebSearchResult, error) {
+	f.callers = append(f.callers, c)
+	f.webQueries = append(f.webQueries, req.Query)
+	return f.web, f.err
+}
+
+func (f *fakeRegulationsProvider) CaptureWeb(_ context.Context, c extension.RegulationsCaller, _ extension.WebCaptureRequest) (extension.WebCapture, error) {
+	f.callers = append(f.callers, c)
+	return f.capture, f.err
+}
+
+func newRegulationsTestHost(t *testing.T) (inprocHost, *store.Store) {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "regulations.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
+	caps := hostcaps{st: st, regulations: &regulationsSlot{}}
+	return inprocHost{caps: caps, pluginID: "rdm", owner: "alice", actor: "alice"}, st
+}
+
+func registerFakeRegulations(t *testing.T, h inprocHost) *fakeRegulationsProvider {
+	t.Helper()
+	p := &fakeRegulationsProvider{}
+	if err := (pluginRegistry{pluginID: "kbreg", caps: h.caps}).RegisterRegulationsProvider(p); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+const regV = extension.RegulationsSchemaVersion
+
+func callAllRegulations(h inprocHost, version int) []error {
+	ctx := context.Background()
+	_, e1 := h.SearchRegulations(ctx, extension.RegulationsSearchRequest{SchemaVersion: version, Query: "医疗器械 临床评价"})
+	_, e2 := h.ResolveRegulationEvidence(ctx, extension.RegulationEvidenceRequest{SchemaVersion: version, CorpusRevision: "rev-1", NodeID: "n1"})
+	_, e3 := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: version, Query: "临床评价 指导原则"})
+	_, e4 := h.CaptureWeb(ctx, extension.WebCaptureRequest{SchemaVersion: version, URL: "https://www.nmpa.gov.cn/x", SearchQuery: "临床评价 指导原则"})
+	return []error{e1, e2, e3, e4}
+}
+
+func TestRegulationsUnavailableWithoutProvider(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	for i, err := range callAllRegulations(h, regV) {
+		if !errors.Is(err, extension.ErrRegulationsUnavailable) {
+			t.Fatalf("method %d without provider: %v", i, err)
+		}
+	}
+	h.caps.regulations = nil
+	for i, err := range callAllRegulations(h, regV) {
+		if !errors.Is(err, extension.ErrRegulationsUnavailable) {
+			t.Fatalf("method %d without slot: %v", i, err)
+		}
+	}
+	if evs, err := st.ListAuditEvents("alice", 10); err != nil || len(evs) != 0 {
+		t.Fatalf("unavailable calls audited: %+v %v", evs, err)
+	}
+}
+
+func TestRegulationsRegistrationOnlyTrustedKbregOnce(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	first, second := &fakeRegulationsProvider{}, &fakeRegulationsProvider{}
+	if err := (pluginRegistry{pluginID: "rdm", caps: h.caps}).RegisterRegulationsProvider(first); err == nil {
+		t.Fatal("non-kbreg plugin registered a regulations provider")
+	}
+	kbreg := pluginRegistry{pluginID: "kbreg", caps: h.caps}
+	if err := kbreg.RegisterRegulationsProvider(nil); err == nil {
+		t.Fatal("nil provider registered")
+	}
+	if err := kbreg.RegisterRegulationsProvider(first); err != nil {
+		t.Fatal(err)
+	}
+	if err := kbreg.RegisterRegulationsProvider(second); err == nil {
+		t.Fatal("duplicate registration accepted")
+	}
+	if h.caps.regulations.get() != first {
+		t.Fatal("duplicate registration replaced the first provider")
+	}
+	if err := (pluginRegistry{pluginID: "kbreg"}).RegisterRegulationsProvider(first); err == nil {
+		t.Fatal("registration without a host slot accepted")
+	}
+}
+
+func TestRegulationsDeclarativeRegistrationRejected(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := &fakeRegulationsProvider{}
+	if err := (compiledRegistry{}).RegisterRegulationsProvider(p); err == nil {
+		t.Fatal("declarative registry accepted a regulations provider")
+	}
+	if err := (recordRegistry{Registry: pluginRegistry{pluginID: "kbreg", caps: h.caps}}).RegisterRegulationsProvider(p); err != nil {
+		t.Fatalf("record registry did not forward kbreg registration: %v", err)
+	}
+	if h.caps.regulations.get() != p {
+		t.Fatal("forwarded registration did not fill the slot")
+	}
+}
+
+func TestRegulationsCallerFilledFromDispatchContext(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	h.actor = "alice-session"
+	p := registerFakeRegulations(t, h)
+	p.web.State = extension.WebSearchStateOK
+	for i, err := range callAllRegulations(h, regV) {
+		if err != nil {
+			t.Fatalf("method %d: %v", i, err)
+		}
+	}
+	want := extension.RegulationsCaller{PluginID: "rdm", Actor: "alice-session", Owner: "alice"}
+	if len(p.callers) != 4 {
+		t.Fatalf("provider calls = %d", len(p.callers))
+	}
+	for i, got := range p.callers {
+		if got != want {
+			t.Fatalf("call %d caller = %+v, want %+v", i, got, want)
+		}
+	}
+}
+
+func TestRegulationsRejectsOtherSchemaVersions(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	for _, version := range []int{0, regV + 1} {
+		for i, err := range callAllRegulations(h, version) {
+			if !errors.Is(err, errRegulationsSchema) {
+				t.Fatalf("schema %d method %d: %v", version, i, err)
+			}
+		}
+	}
+	if len(p.callers) != 0 {
+		t.Fatalf("provider reached with unsupported schema: %d calls", len(p.callers))
+	}
+}
+
+func TestRegulationsWebQueryBounds(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	ctx := context.Background()
+	for _, q := range []string{"", "   \t\n", strings.Repeat("法", maxWebQueryRunes+1)} {
+		if _, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: q}); !errors.Is(err, errWebQueryInvalid) {
+			t.Fatalf("query of %d runes accepted: %v", len([]rune(q)), err)
+		}
+	}
+	if len(p.callers) != 0 {
+		t.Fatal("provider reached with an invalid query")
+	}
+	maxQuery := strings.Repeat("法", maxWebQueryRunes)
+	if _, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: "  " + maxQuery + " "}); err != nil {
+		t.Fatalf("256-rune query rejected: %v", err)
+	}
+	if len(p.webQueries) != 1 || p.webQueries[0] != maxQuery {
+		t.Fatalf("provider query was not trimmed: %q", p.webQueries)
+	}
+}
+
+func TestRegulationsExclusionRejectedBeforeProvider(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	ctx := context.Background()
+	query := "Project-Falcon 临床评价 指导原则"
+	res, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: query,
+		Exclusions: []string{"", "  ", "project-falcon"}})
+	if err != nil || res.State != extension.WebSearchStateRejected || res.SentQuery != "" || len(res.Results) != 0 {
+		t.Fatalf("excluded query result = %+v %v", res, err)
+	}
+	if len(p.callers) != 0 {
+		t.Fatal("provider received a query containing an excluded term")
+	}
+	evs, err := st.ListAuditEvents("alice", 10)
+	if err != nil || len(evs) != 1 || evs[0].Action != auditWebSearch {
+		t.Fatalf("rejection audit: %+v %v", evs, err)
+	}
+	if strings.Contains(strings.ToLower(evs[0].Evidence), "falcon") || !strings.Contains(evs[0].Evidence, `"state":"rejected"`) {
+		t.Fatalf("rejection audit evidence = %s", evs[0].Evidence)
+	}
+	if _, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: query, Exclusions: []string{"", " "}}); err != nil {
+		t.Fatal(err)
+	}
+	if len(p.callers) != 1 {
+		t.Fatal("blank exclusions blocked an allowed query")
+	}
+}
+
+func TestRegulationsProviderStatesPassThroughUnchanged(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	at := time.Date(2026, 10, 18, 9, 0, 0, 0, time.UTC)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-7", State: extension.RegulationsStateDegraded,
+		DegradedReasons: []string{"vector_index_unavailable"},
+		Hits: []extension.RegulationHit{{RegulationID: "r1", EditionID: "e1", NodeID: "n1",
+			Disclosure: extension.RegulationDisclosureWithheld, WithheldReason: "rights"},
+			{RegulationID: "r2", EditionID: "e2", NodeID: "n2", Disclosure: extension.RegulationDisclosureMetadataOnly}}}
+	p.evidence = extension.RegulationEvidence{CorpusRevision: "rev-7", NodeID: "n1",
+		Disclosure: extension.RegulationDisclosureWithheld, WithheldReason: "rights", HashVerified: false}
+	p.web = extension.WebSearchResult{Provider: "fake", SentQuery: "q", SearchedAt: at,
+		State: extension.WebSearchStateRateLimited, Reason: "quota"}
+	p.capture = extension.WebCapture{CaptureID: "c1", FetchedAt: at, Retention: extension.WebRetentionMetadataOnly,
+		State: extension.WebCaptureStateRejected, Reason: "robots"}
+	ctx := context.Background()
+	search, err := h.SearchRegulations(ctx, extension.RegulationsSearchRequest{SchemaVersion: regV, Query: "q"})
+	if err != nil || !reflect.DeepEqual(search, p.search) {
+		t.Fatalf("search = %+v %v", search, err)
+	}
+	evidence, err := h.ResolveRegulationEvidence(ctx, extension.RegulationEvidenceRequest{SchemaVersion: regV, CorpusRevision: "rev-7", NodeID: "n1"})
+	if err != nil || !reflect.DeepEqual(evidence, p.evidence) {
+		t.Fatalf("evidence = %+v %v", evidence, err)
+	}
+	web, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: "q"})
+	if err != nil || !reflect.DeepEqual(web, p.web) {
+		t.Fatalf("web = %+v %v", web, err)
+	}
+	p.web.State = extension.WebSearchStateRejected
+	web, err = h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: "q"})
+	if err != nil || web.State != extension.WebSearchStateRejected {
+		t.Fatalf("provider rejection rewritten: %+v %v", web, err)
+	}
+	capture, err := h.CaptureWeb(ctx, extension.WebCaptureRequest{SchemaVersion: regV, URL: "https://example.org"})
+	if err != nil || !reflect.DeepEqual(capture, p.capture) {
+		t.Fatalf("capture = %+v %v", capture, err)
+	}
+	p.err = errors.New("provider failure")
+	if _, err := h.SearchRegulations(ctx, extension.RegulationsSearchRequest{SchemaVersion: regV, Query: "q"}); !errors.Is(err, p.err) {
+		t.Fatalf("provider failure wrapped as success: %v", err)
+	}
+}
+
+func TestRegulationsAuditEvidenceOmitsQueryAndText(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	const (
+		secretQuery   = "第十七条 secret-query-text"
+		secretExcerpt = "SECRET-EXCERPT 原文片段"
+		secretPage    = "SECRET-PAGE 网页全文"
+	)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-9", State: extension.RegulationsStateOK,
+		Hits: []extension.RegulationHit{{NodeID: "n1", Excerpt: secretExcerpt, Disclosure: extension.RegulationDisclosureExcerpt}}}
+	p.evidence = extension.RegulationEvidence{CorpusRevision: "rev-9", NodeID: "n1", Excerpt: secretExcerpt,
+		Disclosure: extension.RegulationDisclosureFull, HashVerified: true}
+	p.web = extension.WebSearchResult{SentQuery: secretQuery, State: extension.WebSearchStateOK,
+		Results: []extension.WebSearchHit{{Rank: 1, URL: "https://example.org", Snippet: secretExcerpt}}}
+	p.capture = extension.WebCapture{State: extension.WebCaptureStateCaptured, Retention: extension.WebRetentionFull,
+		Text: secretPage, Candidates: []extension.WebClauseCandidate{{Excerpt: secretExcerpt}}}
+	ctx := context.Background()
+	if _, err := h.SearchRegulations(ctx, extension.RegulationsSearchRequest{SchemaVersion: regV, Query: secretQuery}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.ResolveRegulationEvidence(ctx, extension.RegulationEvidenceRequest{SchemaVersion: regV, CorpusRevision: "rev-9", NodeID: "n1"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.SearchWeb(ctx, extension.WebSearchRequest{SchemaVersion: regV, Query: " " + secretQuery + " "}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.CaptureWeb(ctx, extension.WebCaptureRequest{SchemaVersion: regV, URL: "https://example.org", SearchQuery: secretQuery}); err != nil {
+		t.Fatal(err)
+	}
+	evs, err := st.ListAuditEvents("alice", 10)
+	if err != nil || len(evs) != 4 {
+		t.Fatalf("audit events = %+v %v", evs, err)
+	}
+	sum := sha256.Sum256([]byte(secretQuery))
+	digest := hex.EncodeToString(sum[:])
+	want := map[string]regulationsAudit{
+		auditRegulationsSearch:   {Revision: "rev-9", Count: 1, State: "ok", QuerySHA256: digest},
+		auditRegulationsEvidence: {Revision: "rev-9", Count: 1, State: "ok"},
+		auditWebSearch:           {Count: 1, State: "ok", QuerySHA256: digest},
+		auditWebCapture:          {Count: 1, State: "captured", QuerySHA256: digest},
+	}
+	for _, ev := range evs {
+		for _, secret := range []string{"secret-query-text", "第十七条", "SECRET-EXCERPT", "原文片段", "SECRET-PAGE", "网页全文"} {
+			if strings.Contains(ev.Evidence, secret) || strings.Contains(ev.Target, secret) {
+				t.Fatalf("%s audit leaks %q: %s", ev.Action, secret, ev.Evidence)
+			}
+		}
+		var fields map[string]any
+		if err := json.Unmarshal([]byte(ev.Evidence), &fields); err != nil {
+			t.Fatal(err)
+		}
+		for k := range fields {
+			if k != "revision" && k != "count" && k != "state" && k != "querySha256" {
+				t.Fatalf("%s audit has unexpected field %q", ev.Action, k)
+			}
+		}
+		var got regulationsAudit
+		if err := json.Unmarshal([]byte(ev.Evidence), &got); err != nil {
+			t.Fatal(err)
+		}
+		if w, ok := want[ev.Action]; !ok || got != w || ev.Owner != "alice" {
+			t.Fatalf("%s audit = %+v owner=%s, want %+v", ev.Action, got, ev.Owner, w)
+		}
+		delete(want, ev.Action)
+	}
+}
+
+func TestRegulationsRequireEffectiveAccount(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerFakeRegulations(t, h)
+	h.caps.accountGuard = func(string) error { return store.ErrAccountForbidden }
+	for i, err := range callAllRegulations(h, regV) {
+		if !errors.Is(err, store.ErrAccountForbidden) {
+			t.Fatalf("method %d ignored the account guard: %v", i, err)
+		}
+	}
+	if len(p.callers) != 0 {
+		t.Fatal("provider reached for an ineffective account")
+	}
+}
@@ -0,0 +1,268 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"agent-system-backend/internal/tools"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+// EXT-20 内置对话工具：模型经工具注册表只读检索共享法规知识库。执行走
+// inprocHost 的审计路径（有效账号校验 + regulations.* 审计），调用方身份为
+// 运行属主本人与固定的内置工具调用方 ID。
+
+const (
+	regulationsToolCallerID       = "agent-tools"
+	regulationsToolTimeout        = 60 * time.Second
+	regulationsSearchDefaultLimit = 5
+	regulationsSearchMaxLimit     = 10
+
+	toolRegulationsSearch  = "regulations_search"
+	toolRegulationEvidence = "regulation_evidence"
+	toolKnowledgeSearch    = "knowledge_search"
+
+	knowledgeRegulationsFallbackPrefix = "项目资料无命中；以下为法规知识库命中（可用 regulation_evidence 取原文）：\n"
+)
+
+func registerRegulationsTools(reg *tools.Registry, caps hostcaps) error {
+	if err := registerRegulationsSearchTools(reg, caps); err != nil {
+		return err
+	}
+	return wrapKnowledgeSearchWithRegulations(reg, caps)
+}
+
+// wrapKnowledgeSearchWithRegulations 让 knowledge_search 在项目资料无命中时回退
+// 法规知识库；未注册 knowledge_search 时不做任何事。
+func wrapKnowledgeSearchWithRegulations(reg *tools.Registry, caps hostcaps) error {
+	desc, inner, ok := reg.Get(toolKnowledgeSearch)
+	if !ok {
+		return nil
+	}
+	return reg.Register(desc, func(rc tools.ToolExecCtx, args json.RawMessage) (string, error) {
+		out, err := inner(rc, args)
+		if err != nil || out != tools.KnowledgeSearchNoHits {
+			return out, err
+		}
+		if fallback, ok := knowledgeRegulationsFallback(caps, rc, args); ok {
+			return knowledgeRegulationsFallbackPrefix + fallback, nil
+		}
+		return out, nil
+	})
+}
+
+func knowledgeRegulationsFallback(caps hostcaps, rc tools.ToolExecCtx, args json.RawMessage) (string, bool) {
+	var a struct {
+		Query string `json:"query"`
+	}
+	if json.Unmarshal(args, &a) != nil {
+		return "", false
+	}
+	q, err := json.Marshal(map[string]string{"query": a.Query})
+	if err != nil {
+		return "", false
+	}
+	res, err := regulationsSearchTool(caps, rc, q)
+	if err != nil {
+		return "", false
+	}
+	var parsed regulationsToolSearchOutput
+	if json.Unmarshal([]byte(res), &parsed) != nil || parsed.State == extension.RegulationsStateUnavailable || len(parsed.Hits) == 0 {
+		return "", false
+	}
+	return res, true
+}
+
+func registerRegulationsSearchTools(reg *tools.Registry, caps hostcaps) error {
+	if err := reg.Register(core.ToolDesc{
+		Name:        toolRegulationsSearch,
+		Description: "检索已发布的医疗器械法规、标准（GB/YY/YY/T 等）、指导原则、通告等共享法规知识库；用户提到标准号、法规名称、条款或监管要求时优先调用本工具，再考虑网络搜索；命中后可用 regulation_evidence 取条款原文以精确引用",
+		Source:      core.SourceBuiltin, ReadOnly: true,
+		Parameters: json.RawMessage(`{"type":"object","properties":{` +
+			`"query":{"type":"string","description":"检索词"},` +
+			`"docNo":{"type":"string","description":"标准号/文号，如 GB 9706.1-2020"},` +
+			`"clauseNo":{"type":"string","description":"条款号，如 7.2.1"},` +
+			`"kinds":{"type":"array","items":{"type":"string"},"description":"文献类别过滤"},` +
+			`"currentOnly":{"type":"boolean","description":"仅现行有效版本"},` +
+			`"limit":{"type":"integer","minimum":1,"maximum":10,"description":"返回条数，默认 5"}},` +
+			`"required":["query"]}`),
+	}, func(rc tools.ToolExecCtx, args json.RawMessage) (string, error) {
+		return regulationsSearchTool(caps, rc, args)
+	}); err != nil {
+		return err
+	}
+	return reg.Register(core.ToolDesc{
+		Name:        toolRegulationEvidence,
+		Description: "按 regulations_search 返回的 corpusRevision 与 nodeId 取条款原文区间与哈希，用于精确引用",
+		Source:      core.SourceBuiltin, ReadOnly: true,
+		Parameters: json.RawMessage(`{"type":"object","properties":{` +
+			`"corpusRevision":{"type":"string","description":"regulations_search 返回的语料修订号"},` +
+			`"nodeId":{"type":"string","description":"regulations_search 命中的 nodeId"},` +
+			`"start":{"type":"integer","description":"原文区间起点（可选）"},` +
+			`"end":{"type":"integer","description":"原文区间终点（可选）"}},` +
+			`"required":["corpusRevision","nodeId"]}`),
+	}, func(rc tools.ToolExecCtx, args json.RawMessage) (string, error) {
+		return regulationEvidenceTool(caps, rc, args)
+	})
+}
+
+type regulationsToolHit struct {
+	RegulationID   string   `json:"regulationId"`
+	EditionID      string   `json:"editionId"`
+	NodeID         string   `json:"nodeId"`
+	DocNo          string   `json:"docNo,omitempty"`
+	Title          string   `json:"title,omitempty"`
+	EditionLabel   string   `json:"editionLabel,omitempty"`
+	LegalStatus    string   `json:"legalStatus,omitempty"`
+	ClauseNo       string   `json:"clauseNo,omitempty"`
+	HeadingPath    []string `json:"headingPath,omitempty"`
+	Excerpt        string   `json:"excerpt,omitempty"`
+	Disclosure     string   `json:"disclosure"`
+	WithheldReason string   `json:"withheldReason,omitempty"`
+	PageStart      int      `json:"pageStart,omitempty"`
+	PageEnd        int      `json:"pageEnd,omitempty"`
+	IsSummary      bool     `json:"isSummary,omitempty"`
+	MatchKinds     []string `json:"matchKinds,omitempty"`
+}
+
+type regulationsToolSearchOutput struct {
+	CorpusRevision  string               `json:"corpusRevision"`
+	State           string               `json:"state"`
+	DegradedReasons []string             `json:"degradedReasons,omitempty"`
+	Hits            []regulationsToolHit `json:"hits"`
+}
+
+type regulationsToolUnavailable struct {
+	State  string `json:"state"`
+	Reason string `json:"reason"`
+}
+
+func regulationsSearchTool(caps hostcaps, rc tools.ToolExecCtx, args json.RawMessage) (string, error) {
+	var a struct {
+		Query       string   `json:"query"`
+		DocNo       string   `json:"docNo"`
+		ClauseNo    string   `json:"clauseNo"`
+		Kinds       []string `json:"kinds"`
+		CurrentOnly bool     `json:"currentOnly"`
+		Limit       int      `json:"limit"`
+	}
+	if len(args) > 0 {
+		if err := json.Unmarshal(args, &a); err != nil {
+			return "", fmt.Errorf("%s: bad args: %w", toolRegulationsSearch, err)
+		}
+	}
+	a.Query = strings.TrimSpace(a.Query)
+	if a.Query == "" {
+		return "", fmt.Errorf("%s: query is required", toolRegulationsSearch)
+	}
+	limit := a.Limit
+	if limit <= 0 {
+		limit = regulationsSearchDefaultLimit
+	} else if limit > regulationsSearchMaxLimit {
+		limit = regulationsSearchMaxLimit
+	}
+	h, err := regulationsToolHost(caps, rc, toolRegulationsSearch)
+	if err != nil {
+		return "", err
+	}
+	ctx, cancel := regulationsToolContext(rc)
+	defer cancel()
+	res, err := h.SearchRegulations(ctx, extension.RegulationsSearchRequest{
+		SchemaVersion: extension.RegulationsSchemaVersion,
+		Query:         a.Query,
+		Kinds:         a.Kinds,
+		CurrentOnly:   a.CurrentOnly,
+		DocNo:         strings.TrimSpace(a.DocNo),
+		ClauseNo:      strings.TrimSpace(a.ClauseNo),
+		Limit:         limit,
+	})
+	if err != nil {
+		return regulationsToolError(toolRegulationsSearch, err)
+	}
+	out := regulationsToolSearchOutput{CorpusRevision: res.CorpusRevision, State: res.State,
+		DegradedReasons: res.DegradedReasons, Hits: make([]regulationsToolHit, 0, len(res.Hits))}
+	for _, hit := range res.Hits {
+		out.Hits = append(out.Hits, regulationsToolHit{
+			RegulationID: hit.RegulationID, EditionID: hit.EditionID, NodeID: hit.NodeID,
+			DocNo: hit.DocNo, Title: hit.Title, EditionLabel: hit.EditionLabel, LegalStatus: hit.LegalStatus,
+			ClauseNo: hit.ClauseNo, HeadingPath: hit.HeadingPath, Excerpt: hit.Excerpt,
+			Disclosure: hit.Disclosure, WithheldReason: hit.WithheldReason,
+			PageStart: hit.PageStart, PageEnd: hit.PageEnd, IsSummary: hit.IsSummary, MatchKinds: hit.MatchKinds,
+		})
+	}
+	return regulationsToolJSON(out)
+}
+
+func regulationEvidenceTool(caps hostcaps, rc tools.ToolExecCtx, args json.RawMessage) (string, error) {
+	var a struct {
+		CorpusRevision string `json:"corpusRevision"`
+		NodeID         string `json:"nodeId"`
+		Start          int    `json:"start"`
+		End            int    `json:"end"`
+	}
+	if len(args) > 0 {
+		if err := json.Unmarshal(args, &a); err != nil {
+			return "", fmt.Errorf("%s: bad args: %w", toolRegulationEvidence, err)
+		}
+	}
+	a.CorpusRevision, a.NodeID = strings.TrimSpace(a.CorpusRevision), strings.TrimSpace(a.NodeID)
+	if a.CorpusRevision == "" || a.NodeID == "" {
+		return "", fmt.Errorf("%s: corpusRevision and nodeId are required", toolRegulationEvidence)
+	}
+	h, err := regulationsToolHost(caps, rc, toolRegulationEvidence)
+	if err != nil {
+		return "", err
+	}
+	ctx, cancel := regulationsToolContext(rc)
+	defer cancel()
+	ev, err := h.ResolveRegulationEvidence(ctx, extension.RegulationEvidenceRequest{
+		SchemaVersion:  extension.RegulationsSchemaVersion,
+		CorpusRevision: a.CorpusRevision,
+		NodeID:         a.NodeID,
+		Start:          a.Start,
+		End:            a.End,
+	})
+	if err != nil {
+		return regulationsToolError(toolRegulationEvidence, err)
+	}
+	return regulationsToolJSON(ev)
+}
+
+// regulationsToolHost binds the audited host to the run owner, who is both the
+// owner and the actor of an agent tool call.
+func regulationsToolHost(caps hostcaps, rc tools.ToolExecCtx, name string) (inprocHost, error) {
+	owner := rc.OwnerID()
+	if owner == "" {
+		return inprocHost{}, fmt.Errorf("%s: run owner is required", name)
+	}
+	return inprocHost{caps: caps, pluginID: regulationsToolCallerID, owner: owner, actor: owner}, nil
+}
+
+func regulationsToolContext(rc tools.ToolExecCtx) (context.Context, context.CancelFunc) {
+	parent := context.Background()
+	if c, ok := rc.(interface{ Context() context.Context }); ok && c.Context() != nil {
+		parent = c.Context()
+	}
+	return context.WithTimeout(parent, regulationsToolTimeout)
+}
+
+func regulationsToolError(name string, err error) (string, error) {
+	if errors.Is(err, extension.ErrRegulationsUnavailable) {
+		return regulationsToolJSON(regulationsToolUnavailable{State: extension.RegulationsStateUnavailable,
+			Reason: "shared regulations knowledge base is not available"})
+	}
+	return "", fmt.Errorf("%s: %w", name, err)
+}
+
+func regulationsToolJSON(v any) (string, error) {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
@@ -0,0 +1,318 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/tools"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+type regulationsToolCtx struct{ owner string }
+
+func (c regulationsToolCtx) ProjectID() string      { return "" }
+func (c regulationsToolCtx) ConversationID() string { return "" }
+func (c regulationsToolCtx) Retrieve(core.RetrievalQuery) ([]core.RetrievalHit, error) {
+	return nil, nil
+}
+func (c regulationsToolCtx) WriteArtifact(string, string, string, []byte) (core.Artifact, error) {
+	return core.Artifact{}, errors.New("read-only")
+}
+func (c regulationsToolCtx) PeerConversations() ([]core.Conversation, error) { return nil, nil }
+func (c regulationsToolCtx) PeerConversationMessages(string, int) ([]core.Message, error) {
+	return nil, nil
+}
+func (c regulationsToolCtx) OwnerID() string                   { return c.owner }
+func (c regulationsToolCtx) WorkspaceRoot() string             { return "" }
+func (c regulationsToolCtx) SettingBool(_ string, d bool) bool { return d }
+
+type recordingRegulationsProvider struct {
+	*fakeRegulationsProvider
+	searches  []extension.RegulationsSearchRequest
+	evidences []extension.RegulationEvidenceRequest
+}
+
+func (p *recordingRegulationsProvider) SearchRegulations(ctx context.Context, c extension.RegulationsCaller, req extension.RegulationsSearchRequest) (extension.RegulationsSearchResult, error) {
+	p.searches = append(p.searches, req)
+	return p.fakeRegulationsProvider.SearchRegulations(ctx, c, req)
+}
+
+func (p *recordingRegulationsProvider) ResolveRegulationEvidence(ctx context.Context, c extension.RegulationsCaller, req extension.RegulationEvidenceRequest) (extension.RegulationEvidence, error) {
+	p.evidences = append(p.evidences, req)
+	return p.fakeRegulationsProvider.ResolveRegulationEvidence(ctx, c, req)
+}
+
+func newRegulationsToolsRegistry(t *testing.T, h inprocHost) *tools.Registry {
+	t.Helper()
+	reg := tools.NewRegistry()
+	if err := registerRegulationsTools(reg, h.caps); err != nil {
+		t.Fatal(err)
+	}
+	return reg
+}
+
+func registerRecordingRegulations(t *testing.T, h inprocHost) *recordingRegulationsProvider {
+	t.Helper()
+	p := &recordingRegulationsProvider{fakeRegulationsProvider: &fakeRegulationsProvider{}}
+	if err := (pluginRegistry{pluginID: "kbreg", caps: h.caps}).RegisterRegulationsProvider(p); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+func callRegulationsTool(reg *tools.Registry, name, args string) core.ToolCallResult {
+	return reg.Execute(regulationsToolCtx{owner: "alice"}, core.ToolCallRequest{CallID: "c1", Name: name, Arguments: json.RawMessage(args)})
+}
+
+func TestRegulationsToolsRegisteredAsReadOnlyBuiltins(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	reg := newRegulationsToolsRegistry(t, h)
+	for _, name := range []string{toolRegulationsSearch, toolRegulationEvidence} {
+		desc, _, ok := reg.Get(name)
+		if !ok || desc.Source != core.SourceBuiltin || !desc.ReadOnly || desc.Edits || desc.Hidden {
+			t.Fatalf("%s desc = %+v ok=%v", name, desc, ok)
+		}
+		var schema struct {
+			Type     string         `json:"type"`
+			Required []string       `json:"required"`
+			Props    map[string]any `json:"properties"`
+		}
+		if err := json.Unmarshal(desc.Parameters, &schema); err != nil || schema.Type != "object" || len(schema.Required) == 0 {
+			t.Fatalf("%s schema = %s %v", name, desc.Parameters, err)
+		}
+		for _, req := range schema.Required {
+			if _, ok := schema.Props[req]; !ok {
+				t.Fatalf("%s required %q not declared", name, req)
+			}
+		}
+	}
+}
+
+func TestRegulationsSearchToolMapsHitsAndClampsLimit(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-3", State: extension.RegulationsStateDegraded,
+		DegradedReasons: []string{"vector_index_unavailable"},
+		Hits: []extension.RegulationHit{{RegulationID: "r1", EditionID: "e1", NodeID: "n1", DocNo: "GB 9706.1-2020",
+			Title: "医用电气设备", EditionLabel: "2020", LegalStatus: "current", ClauseNo: "7.2.1",
+			HeadingPath: []string{"7", "7.2"}, Excerpt: "条款片段", ExcerptStart: 3, NodeSHA256: "abc",
+			Disclosure: extension.RegulationDisclosureWithheld, WithheldReason: "rights", PageStart: 12, PageEnd: 13,
+			IsSummary: true, MatchKinds: []string{"docNo", "text"}, Score: 0.9}}}
+	reg := newRegulationsToolsRegistry(t, h)
+	res := callRegulationsTool(reg, toolRegulationsSearch,
+		`{"query":" 电气安全 ","docNo":"GB 9706.1-2020","clauseNo":"7.2.1","kinds":["standard"],"currentOnly":true,"limit":50}`)
+	if res.Status != "ok" {
+		t.Fatalf("search result = %+v", res)
+	}
+	want := regulationsToolSearchOutput{CorpusRevision: "rev-3", State: extension.RegulationsStateDegraded,
+		DegradedReasons: []string{"vector_index_unavailable"},
+		Hits: []regulationsToolHit{{RegulationID: "r1", EditionID: "e1", NodeID: "n1", DocNo: "GB 9706.1-2020",
+			Title: "医用电气设备", EditionLabel: "2020", LegalStatus: "current", ClauseNo: "7.2.1",
+			HeadingPath: []string{"7", "7.2"}, Excerpt: "条款片段",
+			Disclosure: extension.RegulationDisclosureWithheld, WithheldReason: "rights", PageStart: 12, PageEnd: 13,
+			IsSummary: true, MatchKinds: []string{"docNo", "text"}}}}
+	var got regulationsToolSearchOutput
+	if err := json.Unmarshal([]byte(res.Output), &got); err != nil || !reflect.DeepEqual(got, want) {
+		t.Fatalf("search output = %s %v", res.Output, err)
+	}
+	if strings.Contains(res.Output, "score") || strings.Contains(res.Output, "nodeSha256") {
+		t.Fatalf("search output leaks unlisted fields: %s", res.Output)
+	}
+	wantReq := extension.RegulationsSearchRequest{SchemaVersion: regV, Query: "电气安全", Kinds: []string{"standard"},
+		CurrentOnly: true, DocNo: "GB 9706.1-2020", ClauseNo: "7.2.1", Limit: regulationsSearchMaxLimit}
+	if len(p.searches) != 1 || !reflect.DeepEqual(p.searches[0], wantReq) {
+		t.Fatalf("provider request = %+v", p.searches)
+	}
+	wantCaller := extension.RegulationsCaller{PluginID: regulationsToolCallerID, Actor: "alice", Owner: "alice"}
+	if len(p.callers) != 1 || p.callers[0] != wantCaller {
+		t.Fatalf("caller = %+v", p.callers)
+	}
+	callRegulationsTool(reg, toolRegulationsSearch, `{"query":"q"}`)
+	callRegulationsTool(reg, toolRegulationsSearch, `{"query":"q","limit":-3}`)
+	callRegulationsTool(reg, toolRegulationsSearch, `{"query":"q","limit":7}`)
+	for i, want := range []int{regulationsSearchDefaultLimit, regulationsSearchDefaultLimit, 7} {
+		if got := p.searches[i+1].Limit; got != want {
+			t.Fatalf("limit case %d = %d, want %d", i, got, want)
+		}
+	}
+	evs, err := st.ListAuditEvents("alice", 10)
+	if err != nil || len(evs) != 4 {
+		t.Fatalf("audit events = %+v %v", evs, err)
+	}
+	for _, ev := range evs {
+		if ev.Action != auditRegulationsSearch || ev.Actor != "plugin:"+regulationsToolCallerID || strings.Contains(ev.Evidence, "电气安全") {
+			t.Fatalf("search audit = %+v", ev)
+		}
+	}
+}
+
+func TestRegulationEvidenceToolMapsFields(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	p.evidence = extension.RegulationEvidence{CorpusRevision: "rev-3", RegulationID: "r1", EditionID: "e1", NodeID: "n1",
+		ClauseNo: "7.2.1", Excerpt: "原文", Start: 4, End: 10, NodeSHA256: "abc", SourceAssetSHA256: "def",
+		PageStart: 12, PageEnd: 12, Disclosure: extension.RegulationDisclosureFull, HashVerified: true}
+	reg := newRegulationsToolsRegistry(t, h)
+	res := callRegulationsTool(reg, toolRegulationEvidence, `{"corpusRevision":"rev-3","nodeId":"n1","start":4,"end":10}`)
+	if res.Status != "ok" {
+		t.Fatalf("evidence result = %+v", res)
+	}
+	var got extension.RegulationEvidence
+	if err := json.Unmarshal([]byte(res.Output), &got); err != nil || got != p.evidence {
+		t.Fatalf("evidence output = %s %v", res.Output, err)
+	}
+	wantReq := extension.RegulationEvidenceRequest{SchemaVersion: regV, CorpusRevision: "rev-3", NodeID: "n1", Start: 4, End: 10}
+	if len(p.evidences) != 1 || p.evidences[0] != wantReq {
+		t.Fatalf("provider request = %+v", p.evidences)
+	}
+	if evs, err := st.ListAuditEvents("alice", 10); err != nil || len(evs) != 1 || evs[0].Action != auditRegulationsEvidence {
+		t.Fatalf("evidence audit = %+v %v", evs, err)
+	}
+}
+
+func TestRegulationsToolsRejectMissingArgs(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	reg := newRegulationsToolsRegistry(t, h)
+	for _, c := range []struct{ name, args string }{
+		{toolRegulationsSearch, `{}`},
+		{toolRegulationsSearch, `{"query":"   "}`},
+		{toolRegulationEvidence, `{"corpusRevision":"rev-3"}`},
+		{toolRegulationEvidence, `{"nodeId":"n1"}`},
+		{toolRegulationEvidence, `{"corpusRevision":"rev-3","nodeId":" "}`},
+	} {
+		if res := callRegulationsTool(reg, c.name, c.args); res.Status != "error" {
+			t.Fatalf("%s %s accepted: %+v", c.name, c.args, res)
+		}
+	}
+	if len(p.callers) != 0 {
+		t.Fatal("provider reached with missing arguments")
+	}
+}
+
+func TestRegulationsToolsReportUnavailable(t *testing.T) {
+	h, st := newRegulationsTestHost(t)
+	reg := newRegulationsToolsRegistry(t, h)
+	assertUnavailable := func(label string) {
+		t.Helper()
+		for _, c := range []struct{ name, args string }{
+			{toolRegulationsSearch, `{"query":"q"}`},
+			{toolRegulationEvidence, `{"corpusRevision":"rev-3","nodeId":"n1"}`},
+		} {
+			res := callRegulationsTool(reg, c.name, c.args)
+			var out regulationsToolUnavailable
+			if res.Status != "ok" || json.Unmarshal([]byte(res.Output), &out) != nil ||
+				out.State != extension.RegulationsStateUnavailable || out.Reason == "" {
+				t.Fatalf("%s %s = %+v", label, c.name, res)
+			}
+		}
+	}
+	assertUnavailable("no provider")
+	if evs, err := st.ListAuditEvents("alice", 10); err != nil || len(evs) != 0 {
+		t.Fatalf("unavailable calls audited: %+v %v", evs, err)
+	}
+	p := registerRecordingRegulations(t, h)
+	p.err = extension.ErrRegulationsUnavailable
+	assertUnavailable("provider unavailable")
+	p.err = errors.New("provider failure")
+	if res := callRegulationsTool(reg, toolRegulationsSearch, `{"query":"q"}`); res.Status != "error" {
+		t.Fatalf("provider failure reported as success: %+v", res)
+	}
+}
+
+type knowledgeHitsCtx struct {
+	regulationsToolCtx
+	hits []core.RetrievalHit
+}
+
+func (c knowledgeHitsCtx) Retrieve(core.RetrievalQuery) ([]core.RetrievalHit, error) {
+	return c.hits, nil
+}
+
+func newKnowledgeFallbackRegistry(t *testing.T, h inprocHost) *tools.Registry {
+	t.Helper()
+	reg := tools.NewRegistry()
+	if err := reg.RegisterBuiltin(); err != nil {
+		t.Fatal(err)
+	}
+	before, _, _ := reg.Get(toolKnowledgeSearch)
+	if err := registerRegulationsTools(reg, h.caps); err != nil {
+		t.Fatal(err)
+	}
+	if after, _, _ := reg.Get(toolKnowledgeSearch); !reflect.DeepEqual(after, before) {
+		t.Fatalf("knowledge_search desc changed: %+v", after)
+	}
+	return reg
+}
+
+func callKnowledgeSearch(reg *tools.Registry, hits []core.RetrievalHit) core.ToolCallResult {
+	rc := knowledgeHitsCtx{regulationsToolCtx: regulationsToolCtx{owner: "alice"}, hits: hits}
+	return reg.Execute(rc, core.ToolCallRequest{CallID: "c1", Name: toolKnowledgeSearch, Arguments: json.RawMessage(`{"query":"电气安全"}`)})
+}
+
+func TestKnowledgeSearchFallsBackToRegulationsHits(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-9", State: extension.RegulationsStateOK,
+		Hits: []extension.RegulationHit{{RegulationID: "r1", EditionID: "e1", NodeID: "n1", DocNo: "GB 9706.1-2020",
+			Excerpt: "法规条款片段", Disclosure: extension.RegulationDisclosureFull}}}
+	reg := newKnowledgeFallbackRegistry(t, h)
+	res := callKnowledgeSearch(reg, nil)
+	if res.Status != "ok" || !strings.HasPrefix(res.Output, knowledgeRegulationsFallbackPrefix) ||
+		!strings.Contains(res.Output, "法规条款片段") || !strings.Contains(res.Output, "GB 9706.1-2020") {
+		t.Fatalf("fallback result = %+v", res)
+	}
+	if len(p.searches) != 1 || p.searches[0].Query != "电气安全" {
+		t.Fatalf("regulations request = %+v", p.searches)
+	}
+}
+
+func TestKnowledgeSearchKeepsNoHitsWhenRegulationsEmpty(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-9", State: extension.RegulationsStateOK}
+	reg := newKnowledgeFallbackRegistry(t, h)
+	if res := callKnowledgeSearch(reg, nil); res.Status != "ok" || res.Output != tools.KnowledgeSearchNoHits {
+		t.Fatalf("empty regulations result = %+v", res)
+	}
+	if len(p.searches) != 1 {
+		t.Fatalf("regulations not consulted: %+v", p.searches)
+	}
+}
+
+func TestKnowledgeSearchKeepsNoHitsWhenRegulationsUnavailable(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	reg := newKnowledgeFallbackRegistry(t, h)
+	if res := callKnowledgeSearch(reg, nil); res.Status != "ok" || res.Output != tools.KnowledgeSearchNoHits {
+		t.Fatalf("no provider result = %+v", res)
+	}
+	p := registerRecordingRegulations(t, h)
+	for _, err := range []error{extension.ErrRegulationsUnavailable, errors.New("provider failure")} {
+		p.err = err
+		if res := callKnowledgeSearch(reg, nil); res.Status != "ok" || res.Output != tools.KnowledgeSearchNoHits {
+			t.Fatalf("provider %v result = %+v", err, res)
+		}
+	}
+}
+
+func TestKnowledgeSearchProjectHitSkipsRegulations(t *testing.T) {
+	h, _ := newRegulationsTestHost(t)
+	p := registerRecordingRegulations(t, h)
+	p.search = extension.RegulationsSearchResult{CorpusRevision: "rev-9", State: extension.RegulationsStateOK,
+		Hits: []extension.RegulationHit{{RegulationID: "r1", EditionID: "e1", NodeID: "n1", Excerpt: "法规条款片段"}}}
+	reg := newKnowledgeFallbackRegistry(t, h)
+	hits := []core.RetrievalHit{{Doc: core.KnowledgeDoc{Title: "项目说明书", Source: "upload", Chunk: "项目片段"}, Score: 0.8}}
+	res := callKnowledgeSearch(reg, hits)
+	if res.Status != "ok" || !strings.Contains(res.Output, "项目片段") ||
+		strings.Contains(res.Output, knowledgeRegulationsFallbackPrefix) || strings.Contains(res.Output, "法规条款片段") {
+		t.Fatalf("project hit result = %+v", res)
+	}
+	if len(p.searches) != 0 {
+		t.Fatalf("regulations consulted on project hit: %+v", p.searches)
+	}
+}
@@ -71,3 +71,19 @@ func TestCompiledRegistryRejectsV2(t *testing.T) {
 		t.Fatal("声明式扩展不得注册资源级授权回调（fail-closed）")
 	}
 }
+
+func TestAuthorizeResourceEnrichesEveryInProcessQueryWithCurrentRolePolicy(t *testing.T) {
+	snapshot := extension.RolePolicySnapshot{SchemaVersion: extension.RolePolicySchemaVersion,
+		Owner: "alice", AccountEnabled: true, RoleID: "role_1", RoleEnabled: true, AuthorityEpoch: 7}
+	a := projectAuthz{enrich: func(q extension.ResourceAuthzQuery) (extension.ResourceAuthzQuery, error) {
+		q.AuthorityEpoch = snapshot.AuthorityEpoch
+		q.RolePolicy = &snapshot
+		return q, nil
+	}}
+	a.setV2("rdm", func(q extension.ResourceAuthzQuery) (bool, error) {
+		return q.AuthorityEpoch == 7 && q.RolePolicy != nil && q.RolePolicy.Owner == q.Actor, nil
+	})
+	if ok, err := a.AuthorizeResource(extension.ResourceAuthzQuery{Actor: "alice", Action: "search", ResourceType: "knowledge", ResourceID: "k1"}); err != nil || !ok {
+		t.Fatalf("enriched query ok=%v err=%v", ok, err)
+	}
+}
@@ -0,0 +1,215 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+)
+
+func TestRoleProviderReturnsVersionedNonSecretPolicy(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/role-provider.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil {
+		t.Fatal(err)
+	}
+	alice, _ := st.GetAccountByOwner("alice")
+	role, err := st.CreateRole("admin", store.RoleCreate{Name: "软件工程师", Description: "负责软件研发"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	receipt, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion,
+		[]store.RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "provider-policy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "provider-binding"); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "admin", actor: "admin"}
+	provider, ok := any(h).(extension.RolePolicyProvider)
+	if !ok {
+		t.Fatal("dispatch host missing RolePolicyProvider")
+	}
+	snapshot, err := provider.RolePolicyForUser(context.Background(), alice.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	byOwner, err := provider.RolePolicyForOwner(context.Background(), "alice")
+	if err != nil || byOwner.UserID != alice.ID || byOwner.RoleID != role.RoleID {
+		t.Fatalf("owner policy=%+v err=%v", byOwner, err)
+	}
+	if snapshot.SchemaVersion != extension.RolePolicySchemaVersion || snapshot.UserID != alice.ID || !snapshot.AccountEnabled ||
+		snapshot.RoleID != role.RoleID || snapshot.RoleName != "软件工程师" || snapshot.RoleDescription != "负责软件研发" ||
+		!snapshot.RoleEnabled || snapshot.RoleVersion != receipt.RoleVersion || snapshot.AuthorityEpoch < receipt.AuthorityEpoch {
+		t.Fatalf("snapshot=%+v", snapshot)
+	}
+	permission := snapshot.Permissions["project.create"]
+	if len(snapshot.Permissions) != 1 || !permission.Allowed || !permission.CapAllowed {
+		t.Fatalf("permissions=%+v", snapshot.Permissions)
+	}
+	decision, err := provider.CheckRoleAction(context.Background(), alice.ID, "project.create")
+	if err != nil || !decision.Allowed || !decision.CapAllowed || decision.RoleID != role.RoleID {
+		t.Fatalf("decision=%+v err=%v", decision, err)
+	}
+	legacy, err := provider.CheckRoleAction(context.Background(), alice.ID, "document.read")
+	if err != nil || legacy.Allowed || legacy.Reason != "action-unconfigured" {
+		t.Fatalf("non-project role action=%+v err=%v", legacy, err)
+	}
+	systemProvider, ok := any(h).(extension.SystemActionProvider)
+	if !ok {
+		t.Fatal("dispatch host missing SystemActionProvider")
+	}
+	systemDecision, err := systemProvider.CheckCurrentSystemAction(context.Background(), "system.permissions.manage")
+	if err != nil || !systemDecision.Allowed || systemDecision.AuthorityEpoch < 1 {
+		t.Fatalf("system decision=%+v err=%v", systemDecision, err)
+	}
+	updated, err := st.ReplaceRolePermissions("admin", role.RoleID, snapshot.RoleVersion,
+		[]store.RolePermissionChange{{ActionID: "project.create", Allowed: false, CapAllowed: true}}, "provider-policy-update")
+	if err != nil {
+		t.Fatal(err)
+	}
+	refreshed, err := provider.RolePolicyForUser(context.Background(), alice.ID)
+	if err != nil || refreshed.AuthorityEpoch != updated.AuthorityEpoch || refreshed.RoleVersion != updated.RoleVersion {
+		t.Fatalf("refreshed=%+v receipt=%+v err=%v", refreshed, updated, err)
+	}
+	if denied := refreshed.Permissions["project.create"]; len(refreshed.Permissions) != 1 || denied.Allowed || denied.CapAllowed {
+		t.Fatalf("refreshed permissions=%+v", refreshed.Permissions)
+	}
+	revoked, err := provider.CheckRoleAction(context.Background(), alice.ID, "project.create")
+	if err != nil || revoked.Allowed || revoked.CapAllowed {
+		t.Fatalf("revoked decision=%+v err=%v", revoked, err)
+	}
+}
+
+func TestRoleProviderRejectsUntrustedScopedHost(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/role-provider.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil {
+		t.Fatal(err)
+	}
+	alice, _ := st.GetAccountByOwner("alice")
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "alice", actor: ""}
+	provider := any(h).(extension.RolePolicyProvider)
+	if _, err := provider.RolePolicyForUser(context.Background(), alice.ID); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("empty actor provider: %v", err)
+	}
+}
+
+func TestRolePolicyAdminUsesBoundActorAndStableOwnerCompatibility(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/role-admin.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "admin", actor: "admin"}
+	admin, ok := any(h).(extension.RolePolicyAdmin)
+	if !ok {
+		t.Fatal("dispatch host missing RolePolicyAdmin")
+	}
+	role, err := admin.CreateRole(context.Background(), "软件工程师", "负责软件研发")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := admin.SetRolePermission(context.Background(), role.RoleID, "document.read", true, true, "legacy-action"); !errors.Is(err, store.ErrInvalidRolePolicy) {
+		t.Fatalf("non-project role action accepted: %v", err)
+	}
+	role, err = admin.SetRolePermission(context.Background(), role.RoleID, "project.create", true, true, "project-access")
+	access := role.Permissions["project.create"]
+	if err != nil || len(role.Permissions) != 1 || !access.Allowed || !access.CapAllowed {
+		t.Fatalf("role=%+v err=%v", role, err)
+	}
+	binding, err := admin.AssignRoleByOwner(context.Background(), "alice", role.RoleID, "legacy-assign")
+	if err != nil || binding.RoleID != role.RoleID {
+		t.Fatalf("binding=%+v err=%v", binding, err)
+	}
+	roles, err := admin.ListRoles(context.Background())
+	if err != nil || len(roles) != 1 || roles[0].BindingCount != 1 {
+		t.Fatalf("roles=%+v err=%v", roles, err)
+	}
+}
+
+// 非管理员分发主体（项目创建者）只读已启用职位：roleId+name，按 name→roleId 排序，
+// 不含权限/绑定/计数；空 actor（scoped host）与已停用账号一律拒绝。
+func TestRoleOptionsExposeEnabledRolesToNonAdminActor(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/role-options.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("admin", "Admin", "hash", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("alice", "Alice", "hash", false); err != nil {
+		t.Fatal(err)
+	}
+	alice, err := st.GetAccountByOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	beta, err := st.CreateRole("admin", store.RoleCreate{Name: "Beta 职位", Description: "停用前"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	alpha, err := st.CreateRole("admin", store.RoleCreate{Name: "Alpha 职位"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	retired, err := st.CreateRole("admin", store.RoleCreate{Name: "Gamma 职位"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	disabled := false
+	if _, err := st.PatchRole("admin", retired.RoleID, retired.RoleVersion, store.RolePatch{Enabled: &disabled}); err != nil {
+		t.Fatal(err)
+	}
+	h := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "alice", actor: "alice"}
+	options, ok := any(h).(extension.RoleOptionsProvider)
+	if !ok {
+		t.Fatal("dispatch host missing RoleOptionsProvider")
+	}
+	// 管理面仍然拒绝非管理员：只读目录不放大权限。
+	if _, err := any(h).(extension.RolePolicyAdmin).ListRoles(context.Background()); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("non-admin ListRoles: %v", err)
+	}
+	got, err := options.ListRoleOptions(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || got[0] != (extension.RoleOption{RoleID: alpha.RoleID, Name: "Alpha 职位"}) ||
+		got[1] != (extension.RoleOption{RoleID: beta.RoleID, Name: "Beta 职位"}) {
+		t.Fatalf("options=%+v", got)
+	}
+	scoped := inprocHost{caps: hostcaps{st: st}, pluginID: "rdm", owner: "alice"}
+	if _, err := any(scoped).(extension.RoleOptionsProvider).ListRoleOptions(context.Background()); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("empty actor options: %v", err)
+	}
+	if _, err := st.SetAccountEnabled("admin", alice.ID, alice.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := options.ListRoleOptions(context.Background()); !errors.Is(err, store.ErrAccountForbidden) {
+		t.Fatalf("disabled actor options: %v", err)
+	}
+	cancelled, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, err := options.ListRoleOptions(cancelled); !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancelled context: %v", err)
+	}
+}
@@ -24,6 +24,9 @@ func TestScopedHostFactory(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { st.Close() })
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
 	set := settings.NewService(st)
 	pipe := rag.NewPipeline(st, set, nil, nil)
 	caps := hostcaps{st: st, pipe: pipe, set: set}
@@ -39,6 +42,9 @@ func TestScopedHostFactory(t *testing.T) {
 	if h.Owner() != "alice" || h.PluginID() != "rdm" {
 		t.Fatalf("Owner/PluginID = %s/%s, want alice/rdm", h.Owner(), h.PluginID())
 	}
+	if _, ok := h.(extension.DelegatedProjectProjectionHost); ok {
+		t.Fatal("globally reconstructed Host exposed request-bound projection authority")
+	}
 	// KV 往返落 owner 作用域。
 	if err := h.KVPut("k1", "v1"); err != nil {
 		t.Fatal(err)
@@ -0,0 +1,111 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"agent-system-backend/internal/blobstore"
+	"agent-system-backend/internal/instanceguard"
+	"agent-system-backend/internal/store"
+)
+
+// openServiceStore 打开活动服务使用的存储。
+// SQLite 档先取活动服务锁，再打开（打开即迁移），然后核对守卫标记。
+// 返回的函数先关存储再放锁。
+func openServiceStore(opt Options) (*store.Store, func(), error) {
+	nop := func() {}
+	if opt.StorageDSN != "" {
+		artifacts := opt.ArtifactsDir
+		if artifacts == "" {
+			artifacts = filepath.Join(opt.DataDir, "artifacts")
+		}
+		// 共享工件（U5/KTD9）：配置了 S3 兼容对象存储时注入（多实例共享）；
+		// 未配置回落本地目录（单实例/共享卷）。凭据只经环境（不入库不入报告）。
+		blobs, berr := blobstore.NewS3FromEnv()
+		if berr != nil {
+			return nil, nop, fmt.Errorf("blobstore s3: %w", berr)
+		}
+		if blobs != nil {
+			log.Printf("artifacts: shared via S3-compatible object storage (prefix %q)", blobs.Prefix)
+		}
+		st, err := store.OpenPostgresWithOptions(opt.StorageDSN, artifacts, opt.PGPool, blobs)
+		if err != nil && opt.Tier == "team" {
+			// team 档拒绝就绪（R2）：PG 故障不回落 SQLite，错误必须明说。
+			return nil, nop, fmt.Errorf("team 档打开 PostgreSQL 失败，拒绝就绪（不回落 SQLite）: %w", err)
+		}
+		if err != nil {
+			return nil, nop, fmt.Errorf("open store: %w", err)
+		}
+		if err := verifyConfiguredIdentity(st, "pg"); err != nil {
+			_ = st.Close()
+			return nil, nop, err
+		}
+		return st, func() { _ = st.Close() }, nil
+	}
+
+	lease, err := instanceguard.Acquire(opt.DataDir)
+	if err != nil {
+		return nil, nop, fmt.Errorf("instance guard: %w", err)
+	}
+	releaseLease := func() { lease.Release() }
+	if err := lease.AutomaticRefusal(); err != nil {
+		adoptable := opt.AdoptInstanceGuard && (errors.Is(err, instanceguard.ErrDBReplaced) || errors.Is(err, instanceguard.ErrLockCorrupt))
+		if !adoptable {
+			releaseLease()
+			return nil, nop, fmt.Errorf("instance guard: %w", err)
+		}
+	}
+	st, err := store.OpenSQLite(lease.DBPath())
+	if err != nil {
+		releaseLease()
+		return nil, nop, fmt.Errorf("open store: %w", err)
+	}
+	if err := verifyConfiguredIdentity(st, "sqlite"); err != nil {
+		_ = st.Close()
+		releaseLease()
+		return nil, nop, err
+	}
+	if err := instanceguard.Bind(st, lease, instanceguard.BindOptions{
+		Adopt:      opt.AdoptInstanceGuard,
+		InstanceID: strings.TrimSpace(os.Getenv("AGENT_SYSTEM_INSTANCE_ID")),
+	}); err != nil {
+		_ = st.Close()
+		releaseLease()
+		return nil, nop, fmt.Errorf("instance guard: %w", err)
+	}
+	return st, func() {
+		_ = st.Close()
+		lease.Release()
+	}, nil
+}
+
+// verifyConfiguredIdentity U1 I3：svc 注入的服务实例身份（manifest.instance_id）与库内 marker 对齐；
+// 未设置则跳过（兼容未接线旧调用方）。与 --instance（runs 进程标识）无关。
+func verifyConfiguredIdentity(st *store.Store, defaultRef string) error {
+	sysID := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_INSTANCE_ID"))
+	if sysID == "" {
+		return nil
+	}
+	dbref := strings.TrimSpace(os.Getenv("AGENT_SYSTEM_DBREF"))
+	if dbref == "" {
+		dbref = defaultRef
+	}
+	if err := st.VerifySystemIdentity(sysID, dbref); err != nil {
+		return fmt.Errorf("system identity: %w", err)
+	}
+	return nil
+}
+
+// Migrate 执行显式迁移。SQLite 必须先取得活动服务锁，有服务占用则拒绝。
+func Migrate(opt Options) error {
+	_, release, err := openServiceStore(opt)
+	if err != nil {
+		return err
+	}
+	release()
+	return nil
+}
@@ -0,0 +1,58 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"log"
+
+	"agent-system-backend/internal/config"
+	"agent-system-backend/internal/server"
+	"agent-system-backend/internal/store"
+)
+
+// ErrCLIAdminAppointment rejects every local CLI attempt to create an
+// administrator (R4, R5): only the server-side super administrator appoints.
+var ErrCLIAdminAppointment = errors.New("administrator appointment is reserved to the super administrator; no CLI path may create an administrator")
+
+// ErrCLIBootstrapAdminDisabled rejects the retired local bootstrap-admin path:
+// only service startup establishes the super administrator (KTD4).
+var ErrCLIBootstrapAdminDisabled = errors.New("bootstrap-admin is disabled; the super administrator is established at service startup from SUPER_ADMIN_OWNER and SUPER_ADMIN_PASSWORD")
+
+// ValidateSuperAdmin is the startup gate for R1: with authentication enabled,
+// missing, partial or policy-violating configuration refuses startup. The
+// unauthenticated embedded mode neither requires nor uses the credentials.
+func ValidateSuperAdmin(authOn bool, sa config.SuperAdmin) error {
+	if !authOn {
+		return nil
+	}
+	if err := sa.Validate(server.ValidatePassword); err != nil {
+		return fmt.Errorf("super admin: %w", err)
+	}
+	return nil
+}
+
+// BootstrapSuperAdmin establishes the configured super administrator in
+// persistent account state (KTD4). Identity conflicts stop startup; logs carry
+// the owner only, never the password or its hash.
+func BootstrapSuperAdmin(st *store.Store, authOn bool, sa config.SuperAdmin) error {
+	if !authOn {
+		return nil
+	}
+	if err := ValidateSuperAdmin(authOn, sa); err != nil {
+		return err
+	}
+	hash, err := store.HashPassword(sa.Password())
+	if err != nil {
+		return fmt.Errorf("super admin: hash password: %w", err)
+	}
+	out, err := st.BootstrapSuperAdmin(sa.Owner, hash)
+	if err != nil {
+		return fmt.Errorf("super admin %q: %w", sa.Owner, err)
+	}
+	if out.Created {
+		log.Printf("super admin: established account %q", sa.Owner)
+	} else {
+		log.Printf("super admin: account %q already established", sa.Owner)
+	}
+	return nil
+}
@@ -0,0 +1,129 @@
+package app
+
+import (
+	"bytes"
+	"errors"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/config"
+	"agent-system-backend/internal/store"
+)
+
+const appSuperAdminPassword = "Sup3r-Secret-Value"
+
+func openSuperAdminStore(t *testing.T) *store.Store {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st
+}
+
+func captureLog(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var buf bytes.Buffer
+	prev, flags := log.Writer(), log.Flags()
+	log.SetOutput(&buf)
+	t.Cleanup(func() { log.SetOutput(prev); log.SetFlags(flags) })
+	return &buf
+}
+
+func TestValidateSuperAdminStartupGate(t *testing.T) {
+	cases := []struct {
+		name string
+		sa   config.SuperAdmin
+	}{
+		{"both absent", config.SuperAdmin{}},
+		{"owner only", config.NewSuperAdmin("root", "")},
+		{"password only", config.NewSuperAdmin("", appSuperAdminPassword)},
+		{"invalid password", config.NewSuperAdmin("root", "short")},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := ValidateSuperAdmin(true, tc.sa)
+			if !errors.Is(err, config.ErrSuperAdminConfig) {
+				t.Fatalf("authentication-enabled startup accepted %s: %v", tc.name, err)
+			}
+			if err := ValidateSuperAdmin(false, tc.sa); err != nil {
+				t.Fatalf("unauthenticated mode must not require credentials: %v", err)
+			}
+		})
+	}
+	if err := ValidateSuperAdmin(true, config.NewSuperAdmin("root", appSuperAdminPassword)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBootstrapSuperAdminStartup(t *testing.T) {
+	st := openSuperAdminStore(t)
+	logs := captureLog(t)
+	sa := config.NewSuperAdmin("root", appSuperAdminPassword)
+	for i := 0; i < 2; i++ {
+		if err := BootstrapSuperAdmin(st, true, sa); err != nil {
+			t.Fatalf("bootstrap %d: %v", i, err)
+		}
+	}
+	account, err := st.GetAccountByOwner("root")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !account.IsSuperAdmin || !account.IsAdmin {
+		t.Fatalf("startup did not establish super admin: %+v", account)
+	}
+	if strings.Contains(logs.String(), appSuperAdminPassword) || strings.Contains(logs.String(), "argon2") {
+		t.Fatalf("startup log leaks credential material: %s", logs.String())
+	}
+	if !strings.Contains(logs.String(), "established account") || !strings.Contains(logs.String(), "already established") {
+		t.Fatalf("startup log lacks bootstrap outcome: %s", logs.String())
+	}
+}
+
+func TestBootstrapSuperAdminStartupFailsClosed(t *testing.T) {
+	st := openSuperAdminStore(t)
+	if err := st.CreateAccount("root", "", "", false); err != nil {
+		t.Fatal(err)
+	}
+	err := BootstrapSuperAdmin(st, true, config.NewSuperAdmin("root", appSuperAdminPassword))
+	if !errors.Is(err, store.ErrSuperAdminConflict) {
+		t.Fatalf("conflicting owner did not stop startup: %v", err)
+	}
+	if strings.Contains(err.Error(), appSuperAdminPassword) {
+		t.Fatalf("startup error leaks password: %v", err)
+	}
+	if err := BootstrapSuperAdmin(st, true, config.NewSuperAdmin("root", "short")); !errors.Is(err, config.ErrSuperAdminConfig) {
+		t.Fatalf("invalid password reached storage: %v", err)
+	}
+}
+
+func TestBootstrapSuperAdminSkippedWithoutAuthentication(t *testing.T) {
+	st := openSuperAdminStore(t)
+	if err := BootstrapSuperAdmin(st, false, config.SuperAdmin{}); err != nil {
+		t.Fatal(err)
+	}
+	users, err := st.ListUsersAdmin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(users) != 0 {
+		t.Fatalf("unauthenticated mode created accounts: %d", len(users))
+	}
+}
+
+func TestCLIAccountPathsCannotAppointAdministrators(t *testing.T) {
+	dir := t.TempDir()
+	if _, _, err := CreateUserAccount("", dir, "mallory", "", "", true, true, false); !errors.Is(err, ErrCLIAdminAppointment) {
+		t.Fatalf("CLI create --admin: %v", err)
+	}
+	if _, err := BootstrapAdmin("", dir, "mallory", false); !errors.Is(err, ErrCLIBootstrapAdminDisabled) {
+		t.Fatalf("CLI bootstrap-admin: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "agent-system.db")); !os.IsNotExist(err) {
+		t.Fatalf("rejected CLI paths touched storage: %v", err)
+	}
+}
@@ -0,0 +1,115 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/internal/surfacesvc"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+func TestSurfaceButtonDispatchUsesAuthenticatedActor(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "audit.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if err := st.EnsureUser("alice", "Alice at action"); err != nil {
+		t.Fatal(err)
+	}
+	p, err := st.CreateProject("alice", "A")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := st.CreateConversation("alice", string(p.ID), "work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bus := cmdbus.New(st, nil, func() time.Time { return time.Now().UTC() })
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.submit", Title: "Submit"}, "", func(context.Context, cmdbus.Request) (any, error) { return "ok", nil }); err != nil {
+		t.Fatal(err)
+	}
+	result, err := dispatchSurfaceAction(context.Background(), bus, surfacesvc.ActionDispatch{CommandID: "demo.submit", Owner: "alice", ConversationID: string(c.ID)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.State != "committed" {
+		t.Fatalf("state: %s", result.State)
+	}
+	rows, _, _, err := st.ListProjectCommandAudits("alice", string(p.ID), 0, 0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || rows[0].Envelope.Actor != "alice" || rows[0].ActorName != "Alice at action" {
+		t.Fatalf("button audit actor: %+v", rows)
+	}
+}
+
+func TestCompiledHandlerReceivesHostOperationID(t *testing.T) {
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "audit.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	p, err := st.CreateProject("alice", "A")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := st.CreateConversation("alice", string(p.ID), "work", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bus := cmdbus.New(st, nil, func() time.Time { return time.Now().UTC() })
+	slot := &projectAuditSlot{}
+	caps := hostcaps{st: st, projectAudit: slot}
+	reg := pluginRegistry{compiledRegistry: compiledRegistry{bus: bus}, pluginID: "rdm", caps: caps}
+	var seen string
+	if err := reg.AddCommandHandler(json.RawMessage(`{"id":"rdm.confirm","title":"Confirm"}`), func(_ context.Context, _ extension.Host, req extension.Request) (any, error) {
+		seen = req.OperationID
+		return "domain-committed", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), cmdbus.Request{ID: "rdm.confirm", Actor: "alice", Owner: "alice", ConversationID: string(c.ID)})
+	rows, _, _, err := st.ListProjectCommandAudits("alice", string(p.ID), 0, 0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if seen == "" || resp.Receipt.OperationID != seen || len(rows) != 1 || rows[0].Envelope.OperationID != seen {
+		t.Fatalf("handler/domain correlation: seen=%q receipt=%+v rows=%+v", seen, resp.Receipt, rows)
+	}
+	if err := reg.RegisterProjectAuditAuthorizer(func(actor string, project core.ID) (bool, error) { return actor == "bob" && project == p.ID, nil }); err != nil {
+		t.Fatal(err)
+	}
+	publisherFactory, err := (recordRegistry{Registry: reg}).RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
+		return proof.Owner == "alice" && proof.ProjectID == p.ID && proof.OperationID == seen && proof.SourceID == "domain-commit-1" && proof.ResourceID == "doc-1", nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.RegisterProjectAuditDisclosureAuthorizer(func(_ context.Context, actor string, r extension.ProjectAuditLinkedResource) (extension.ProjectAuditDisclosure, error) {
+		return extension.ProjectAuditDisclosure{Metadata: actor == "bob" && r.ResourceID == "doc-1"}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	publisher, err := publisherFactory.ForOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	linked, err := publisher.PublishProjectAuditLink(context.Background(), extension.ProjectAuditLinkRequest{ProjectID: p.ID, OperationID: seen, SourceKind: "domain-commit", SourceID: "domain-commit-1", ResourceKind: "document", ResourceID: "doc-1", DisclosureClass: "metadata", IdempotencyKey: "outbox-1"})
+	if err != nil || linked.HostAuditOffset != rows[0].Offset {
+		t.Fatalf("publish by trusted operation: %+v %v", linked, err)
+	}
+	bob := inprocHost{caps: caps, owner: "bob", actor: "bob", pluginID: "rdm"}
+	page, err := bob.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: p.ID, LinkedSourceKind: "domain-commit", LinkedSourceID: "domain-commit-1", LinkedHostOffset: linked.HostAuditOffset})
+	if err != nil || len(page.Receipts) != 1 || page.Receipts[0].OperationID != seen {
+		t.Fatalf("linked read: %+v %v", page, err)
+	}
+}
@@ -0,0 +1,29 @@
+package app
+
+import (
+	"context"
+	"fmt"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/surfacesvc"
+)
+
+// dispatchSurfaceAction receives Owner from SurfaceService's authenticated
+// caller. The button is acting for that user, so both Actor and Owner must be
+// populated before the command bus writes its audit envelope.
+func dispatchSurfaceAction(ctx context.Context, bus *cmdbus.Bus, d surfacesvc.ActionDispatch) (surfacesvc.ActionOutcome, error) {
+	if cmdbus.RequiresProjectWorkDecision(d.CommandID) {
+		return surfacesvc.ActionOutcome{}, fmt.Errorf("project formal action requires a committed conversation source preflight")
+	}
+	resp := bus.Dispatch(ctx, cmdbus.Request{ID: d.CommandID, Params: d.Params,
+		Entrance: "button", Actor: d.Owner, Owner: d.Owner, ConversationID: d.ConversationID})
+	state := "committed"
+	if resp.Receipt.State != "" {
+		state = string(resp.Receipt.State)
+	}
+	cardID := ""
+	if resp.Card != nil {
+		cardID = string(resp.Card.ID)
+	}
+	return surfacesvc.ActionOutcome{State: state, CardID: cardID, Receipt: resp.Receipt, Payload: resp.Payload}, nil
+}
@@ -0,0 +1,96 @@
+package app
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+func TestTaskStartupReconcilesQueueBeforeServing(t *testing.T) {
+	if os.Getenv("TASK_STARTUP_CHILD") == "1" {
+		if err := Run(Options{Addr: os.Getenv("TASK_STARTUP_ADDR"), DataDir: os.Getenv("TASK_STARTUP_DATA"), PluginsDir: filepath.Join(os.Getenv("TASK_STARTUP_DATA"), "plugins"), ForceMock: true, InstanceID: "startup-test", DisableExecTools: true, DisableConvCardMirror: true}); err != nil {
+			t.Fatal(err)
+		}
+		return
+	}
+	data := t.TempDir()
+	st, err := store.OpenSQLite(filepath.Join(data, "agent-system.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	p, err := st.CreateProject(store.OwnerDefault, "startup")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation(store.OwnerDefault, p.ID, "startup", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	card := core.ActivityCard{ID: "card-startup", ProjectID: p.ID, ConversationID: conv.ID, Kind: core.CardKindProgress, Status: core.CardActive, Title: "整理"}
+	card.Task = &core.TaskSnapshot{SchemaVersion: 1, TaskID: "task-startup", AttemptID: "attempt-startup", CardID: card.ID, ProjectID: p.ID, ConversationID: conv.ID, OwnerInstanceID: "startup-test", Revision: 1, StreamScope: "conversation:" + conv.ID, ExecutionState: "queued", OutcomeCompleteness: "none", DeliveryState: "pending", Title: "整理"}
+	if _, err = st.CommitTaskProjection(store.TaskProjectionWrite{Owner: conv.Owner, Card: card}); err != nil {
+		t.Fatal(err)
+	}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addr := ln.Addr().String()
+	ln.Close()
+	cmd := exec.Command(os.Args[0], "-test.run=^TestTaskStartupReconcilesQueueBeforeServing$")
+	cmd.Env = append(os.Environ(), "TASK_STARTUP_CHILD=1", "TASK_STARTUP_ADDR="+addr, "TASK_STARTUP_DATA="+data)
+	logfile, err := os.Create(filepath.Join(t.TempDir(), "startup.log"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logfile.Close()
+	cmd.Stdout, cmd.Stderr = logfile, logfile
+	if err = cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = cmd.Process.Signal(syscall.SIGTERM)
+		done := make(chan error, 1)
+		go func() { done <- cmd.Wait() }()
+		select {
+		case <-done:
+		case <-time.After(5 * time.Second):
+			_ = cmd.Process.Kill()
+			<-done
+		}
+	})
+	client := &http.Client{Timeout: time.Second}
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) {
+		resp, err := client.Get("http://" + addr + "/api/conversations/" + conv.ID + "/cards")
+		if err == nil {
+			resp.Body.Close()
+			if resp.StatusCode == http.StatusOK {
+				got, err := st.GetCard(conv.Owner, card.ID)
+				if err != nil || got.Task == nil || got.Task.ExecutionState != "interrupted" || got.Task.RunID != "" {
+					t.Fatalf("service became ready with orphan queue: %+v, %v", got.Task, err)
+				}
+				if got.Task.Conclusion != "排队任务未恢复，未开始执行" {
+					t.Fatal(got.Task.Conclusion)
+				}
+				projectEvents, err := st.EventsAfter("project:"+p.ID, 0, 100)
+				if err != nil || len(projectEvents) != 0 {
+					t.Fatalf("recovery ignored disabled card mirroring: %v %v", projectEvents, err)
+				}
+				return
+			}
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	b, _ := os.ReadFile(logfile.Name())
+	t.Fatalf("startup did not become ready: %s", b)
+}
@@ -0,0 +1,23 @@
+package app
+
+import (
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+)
+
+const tavilySecretService = "tools.tavily"
+
+type activeSecretSource interface {
+	ActiveSecret(owner, service string) (string, bool)
+}
+
+// tavilyKeyPool 解析 Tavily 密钥池：默认属主受管密钥 → 系统行受管密钥
+// （owner=settings.OwnerSystemRow）→ 设置明文 tools.tavily.apiKeys。
+func tavilyKeyPool(secrets activeSecretSource, plaintext string) []string {
+	for _, owner := range []string{store.OwnerDefault, settings.OwnerSystemRow} {
+		if active, ok := secrets.ActiveSecret(owner, tavilySecretService); ok {
+			return splitKeyPool(active)
+		}
+	}
+	return splitKeyPool(plaintext)
+}
@@ -0,0 +1,53 @@
+package app
+
+import (
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+)
+
+func newTavilyKeysStore(t *testing.T) *store.Store {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "tavily.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st
+}
+
+func TestTavilyKeyPoolFallsBackToSystemRowSecret(t *testing.T) {
+	st := newTavilyKeysStore(t)
+	if _, err := st.AddSecret(settings.OwnerSystemRow, tavilySecretService, "system", "fake-sys-a, fake-sys-b"); err != nil {
+		t.Fatal(err)
+	}
+	if got, want := tavilyKeyPool(st, "fake-plain"), []string{"fake-sys-a", "fake-sys-b"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("system-row key pool = %v, want %v", got, want)
+	}
+}
+
+func TestTavilyKeyPoolPrefersOwnerRowSecret(t *testing.T) {
+	st := newTavilyKeysStore(t)
+	if _, err := st.AddSecret(settings.OwnerSystemRow, tavilySecretService, "system", "fake-sys"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AddSecret(store.OwnerDefault, tavilySecretService, "owner", "fake-owner"); err != nil {
+		t.Fatal(err)
+	}
+	if got, want := tavilyKeyPool(st, "fake-plain"), []string{"fake-owner"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("owner-row key pool = %v, want %v", got, want)
+	}
+}
+
+func TestTavilyKeyPoolFallsBackToPlaintextSetting(t *testing.T) {
+	st := newTavilyKeysStore(t)
+	if got, want := tavilyKeyPool(st, " fake-plain-a ,, fake-plain-b"), []string{"fake-plain-a", "fake-plain-b"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("plaintext key pool = %v, want %v", got, want)
+	}
+	if got := tavilyKeyPool(st, ""); len(got) != 0 {
+		t.Fatalf("empty key pool = %v", got)
+	}
+}
@@ -0,0 +1,98 @@
+// Package catalog owns the trusted action catalog used by system, role, and
+// project authorization. Callers cannot invent an action or its scope.
+package catalog
+
+type Scope string
+
+const (
+	ScopeSystem  Scope = "system"
+	ScopeProject Scope = "project"
+)
+
+// ProjectAccessAction is the only action a position role carries (R2). Every
+// other catalog action comes from system grants or project membership; role
+// rows naming them are retained for audit but never authorize anything.
+const ProjectAccessAction = "project.create"
+
+type Descriptor struct {
+	ActionID    string `json:"actionId"`
+	Label       string `json:"label"`
+	Description string `json:"description"`
+	Group       string `json:"group"`
+	Scope       Scope  `json:"scope"`
+	Protected   bool   `json:"protected"`
+}
+
+var descriptors = []Descriptor{
+	{ActionID: "system.settings.read", Label: "查看系统设置", Description: "查看系统范围的受管配置", Group: "系统设置", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.settings.write", Label: "修改系统设置", Description: "修改系统范围的受管配置", Group: "系统设置", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.users.view", Label: "查看用户", Description: "查看账号目录及获准资料", Group: "用户管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.users.create", Label: "创建用户", Description: "创建普通账号", Group: "用户管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.users.edit", Label: "编辑用户", Description: "编辑账号的非凭据资料", Group: "用户管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.users.disable", Label: "停用用户", Description: "停用或重新启用账号", Group: "用户管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.roles.view", Label: "查看角色", Description: "查看职位角色及绑定人数", Group: "角色管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.roles.manage", Label: "管理角色", Description: "创建、编辑和停用职位角色", Group: "角色管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.roles.assign", Label: "分配角色", Description: "替换用户唯一生效职位角色", Group: "角色管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.permissions.view", Label: "查看系统权限", Description: "查看系统授权、角色默认与上限", Group: "权限管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "system.permissions.manage", Label: "管理系统权限", Description: "配置明确系统授权与平台上限", Group: "权限管理", Scope: ScopeSystem, Protected: true},
+	{ActionID: "project.create", Label: "创建项目", Description: "创建新的项目", Group: "项目入口", Scope: ScopeSystem},
+	{ActionID: "project.settings", Label: "项目设置", Description: "修改本项目设置", Group: "项目管理", Scope: ScopeProject},
+	{ActionID: "project.archive", Label: "归档项目", Description: "归档或恢复本人创建的项目", Group: "项目管理", Scope: ScopeProject},
+	{ActionID: "project.stage.advance", Label: "推进项目阶段", Description: "推进本人创建项目的阶段", Group: "项目管理", Scope: ScopeProject},
+	{ActionID: "project.members.manage", Label: "管理项目成员", Description: "维护本项目成员", Group: "项目管理", Scope: ScopeProject},
+	{ActionID: "project.permissions.manage", Label: "管理项目权限", Description: "维护本项目成员权限覆盖", Group: "项目管理", Scope: ScopeProject},
+	{ActionID: "document.duties.assign", Label: "分配文档三权", Description: "分配本项目文档编制、审核和批准职责", Group: "文档职责", Scope: ScopeProject},
+	{ActionID: "document.read", Label: "读取文档", Description: "读取获准的项目文档", Group: "文档动作", Scope: ScopeProject},
+	{ActionID: "document.author", Label: "编制文档", Description: "履行已分配的文档编制职责", Group: "文档动作", Scope: ScopeProject},
+	{ActionID: "document.review", Label: "审核文档", Description: "履行已分配的文档审核职责", Group: "文档动作", Scope: ScopeProject},
+	{ActionID: "document.approve", Label: "批准文档", Description: "履行已分配的文档批准职责", Group: "文档动作", Scope: ScopeProject},
+	{ActionID: "document.publish", Label: "发布文档", Description: "发布已完成审签的项目文档", Group: "文档动作", Scope: ScopeProject},
+	{ActionID: "trace.edit", Label: "编辑追溯网", Description: "编辑本项目追溯关系", Group: "项目内容", Scope: ScopeProject},
+	{ActionID: "knowledge.publish", Label: "发布项目知识", Description: "发布或撤销本项目知识", Group: "项目内容", Scope: ScopeProject},
+	{ActionID: "project.audit.read", Label: "读取业务审计", Description: "读取获准项目的业务审计", Group: "项目内容", Scope: ScopeProject},
+}
+
+var descriptorByID = func() map[string]Descriptor {
+	out := make(map[string]Descriptor, len(descriptors))
+	for _, descriptor := range descriptors {
+		out[descriptor.ActionID] = descriptor
+	}
+	return out
+}()
+
+func DescriptorByID(id string) (Descriptor, bool) {
+	descriptor, ok := descriptorByID[id]
+	return descriptor, ok
+}
+
+func Catalog() []Descriptor {
+	out := make([]Descriptor, len(descriptors))
+	copy(out, descriptors)
+	return out
+}
+
+// ProjectCreateAction is the system action whose holder manages the projects
+// they create. Enabling it links ProjectCreateLinkedActions for those projects.
+const ProjectCreateAction = "project.create"
+
+var projectCreateLinkedActions = []string{
+	"project.settings",
+	"project.members.manage",
+	"project.permissions.manage",
+	"document.duties.assign",
+}
+
+// ProjectCreateLinkedActions returns the own-project management capabilities
+// that a project creator receives together with project.create.
+func ProjectCreateLinkedActions() []string {
+	return append([]string(nil), projectCreateLinkedActions...)
+}
+
+func IsProjectCreateLinkedAction(id string) bool {
+	for _, linked := range projectCreateLinkedActions {
+		if linked == id {
+			return true
+		}
+	}
+	return false
+}
@@ -0,0 +1,72 @@
+package catalog
+
+import "testing"
+
+func TestCatalogRejectsUnknownAndProtectsManagementActions(t *testing.T) {
+	if _, ok := DescriptorByID("invented.action"); ok {
+		t.Fatal("unknown action registered")
+	}
+	got, ok := DescriptorByID("system.roles.manage")
+	if !ok || got.Scope != ScopeSystem || !got.Protected {
+		t.Fatalf("descriptor=%+v", got)
+	}
+	create, ok := DescriptorByID("project.create")
+	if !ok || create.Scope != ScopeSystem || create.Protected {
+		t.Fatalf("project.create=%+v", create)
+	}
+}
+
+func TestCatalogProjectAccessIsTheOnlyRoleAction(t *testing.T) {
+	access, ok := DescriptorByID(ProjectAccessAction)
+	if !ok || access.ActionID != "project.create" || access.Scope != ScopeSystem || access.Protected {
+		t.Fatalf("project access descriptor=%+v ok=%v", access, ok)
+	}
+}
+
+func TestProjectCreateLinkedActionsAreCatalogedProjectActions(t *testing.T) {
+	linked := ProjectCreateLinkedActions()
+	if len(linked) != 4 {
+		t.Fatalf("linked=%v", linked)
+	}
+	for _, actionID := range linked {
+		descriptor, ok := DescriptorByID(actionID)
+		if !ok || descriptor.Scope != ScopeProject || descriptor.Protected || !IsProjectCreateLinkedAction(actionID) {
+			t.Fatalf("linked action %s descriptor=%+v ok=%v", actionID, descriptor, ok)
+		}
+	}
+	if IsProjectCreateLinkedAction(ProjectCreateAction) || IsProjectCreateLinkedAction("document.read") {
+		t.Fatal("unlinked action reported as linked")
+	}
+	linked[0] = "mutated"
+	if ProjectCreateLinkedActions()[0] == "mutated" {
+		t.Fatal("linked actions exposed mutable storage")
+	}
+}
+
+func TestCatalogReturnsIndependentCopies(t *testing.T) {
+	first := Catalog()
+	if len(first) == 0 {
+		t.Fatal("empty catalog")
+	}
+	first[0].Label = "mutated"
+	second := Catalog()
+	if second[0].Label == "mutated" {
+		t.Fatal("Catalog exposed mutable registry storage")
+	}
+}
+
+// TestCatalogLinkedActionsStayProjectScopedAndUnprotected pins the narrowing
+// that the ported batch writers enforce: project.create remains the single
+// role authority, and the linked own-project management actions stay
+// project-scoped and never protected so the role cannot inherit them.
+func TestCatalogLinkedActionsStayProjectScopedAndUnprotected(t *testing.T) {
+	for _, actionID := range ProjectCreateLinkedActions() {
+		descriptor, ok := DescriptorByID(actionID)
+		if !ok || descriptor.Scope != ScopeProject || descriptor.Protected {
+			t.Fatalf("linked %s descriptor=%+v ok=%v", actionID, descriptor, ok)
+		}
+		if IsProjectCreateLinkedAction(ProjectAccessAction) {
+			t.Fatal("project.create reported as a linked action of itself")
+		}
+	}
+}
@@ -0,0 +1,114 @@
+package authz
+
+import (
+	"agent-system-backend/internal/authz/catalog"
+	"agent-system-backend/internal/store"
+)
+
+type Descriptor = catalog.Descriptor
+type Scope = catalog.Scope
+
+const (
+	ScopeSystem  = catalog.ScopeSystem
+	ScopeProject = catalog.ScopeProject
+)
+
+func Catalog() []Descriptor { return catalog.Catalog() }
+
+type Decision struct {
+	Allowed        bool   `json:"allowed"`
+	ActionID       string `json:"actionId"`
+	Source         string `json:"source,omitempty"`
+	Reason         string `json:"reason,omitempty"`
+	AuthorityEpoch int64  `json:"authorityEpoch"`
+}
+
+type Service struct {
+	store *store.Store
+}
+
+func NewService(st *store.Store) *Service { return &Service{store: st} }
+
+func (s *Service) AuthorizeSystem(actor, actionID string) Decision {
+	decision := Decision{ActionID: actionID}
+	descriptor, ok := catalog.DescriptorByID(actionID)
+	if !ok || descriptor.Scope != catalog.ScopeSystem || s == nil || s.store == nil {
+		decision.Reason = "unknown-system-action"
+		return decision
+	}
+	epoch, err := s.store.AuthorityEpoch()
+	if err != nil {
+		decision.Reason = "authority-unavailable"
+		return decision
+	}
+	decision.AuthorityEpoch = epoch
+	account, err := s.store.GetAccountByOwner(actor)
+	if err != nil || !account.Enabled {
+		decision.Reason = "account-unavailable"
+		return decision
+	}
+	// Project access comes only from the actor's role (R2): neither is_admin
+	// nor a system grant confers it.
+	if actionID == catalog.ProjectAccessAction {
+		roleAllowed, _, err := s.store.RolePermissionAllowed(actor, actionID)
+		if err != nil {
+			decision.Reason = "authority-unavailable"
+			return decision
+		}
+		if roleAllowed {
+			decision.Allowed, decision.Source = true, "role"
+			return decision
+		}
+		decision.Reason = "not-granted"
+		return decision
+	}
+	// is_admin remains the narrow bootstrap/root recovery source. Ordinary
+	// delegated management uses explicit system_grants.
+	if account.IsAdmin {
+		decision.Allowed, decision.Source = true, "bootstrap-admin"
+		return decision
+	}
+	allowed, err := s.store.SystemGrantAllowed(actor, actionID)
+	if err != nil {
+		decision.Reason = "authority-unavailable"
+		return decision
+	}
+	if allowed {
+		decision.Allowed, decision.Source = true, "system-grant"
+		return decision
+	}
+	decision.Reason = "not-granted"
+	return decision
+}
+
+// EffectiveLinkedCapabilities returns the own-project management actions that
+// the actor's project.create links. HTTP and command readers share this call
+// so the link is computed once per actor from the Backend authority.
+func (s *Service) EffectiveLinkedCapabilities(actor string) (store.CapabilityAssociation, error) {
+	if s == nil || s.store == nil {
+		return store.CapabilityAssociation{LinkedActions: []string{}}, store.ErrAccountForbidden
+	}
+	return s.store.LinkedCapabilities(actor)
+}
+
+// ExplainCapabilities explains only the actor's own creator, member and
+// document-duty capabilities; HTTP and Host providers share this call.
+func (s *Service) ExplainCapabilities(actor string) (store.CapabilityExplanation, error) {
+	if s == nil || s.store == nil {
+		return store.CapabilityExplanation{}, store.ErrAccountForbidden
+	}
+	return s.store.ExplainCapabilities(actor)
+}
+
+func (s *Service) EffectiveSystemActions(actor string) []string {
+	actions := []string{}
+	for _, descriptor := range catalog.Catalog() {
+		if descriptor.Scope != catalog.ScopeSystem {
+			continue
+		}
+		if decision := s.AuthorizeSystem(actor, descriptor.ActionID); decision.Allowed {
+			actions = append(actions, descriptor.ActionID)
+		}
+	}
+	return actions
+}
@@ -0,0 +1,249 @@
+package cardsvc
+
+import (
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+	"errors"
+)
+
+func (s *Service) requireAccountCheckedEmitter() error {
+	if s.emit != nil && s.accountCheckedEmit == nil {
+		return ErrGuardedEmitterRequired
+	}
+	return nil
+}
+
+func (s *Service) ResolveByRefAccountChecked(actor, ref, actionID, answer string, allowImplicitDefault bool) error {
+	if err := s.requireAccountCheckedEmitter(); err != nil {
+		return err
+	}
+	id, err := s.st.CardIDByRef(actor, ref)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	card, version, err := s.st.GetCardVersion(actor, id)
+	if err != nil {
+		return err
+	}
+	if card.Status.Terminal() {
+		return nil
+	}
+	card.Status = core.CardResolved
+	recordAnswer(&card, actionID, answer)
+	if err := s.UpdateVersionedAccountChecked(actor, card, version, allowImplicitDefault); errors.Is(err, store.ErrConflict) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	return s.emitCardAccountChecked(actor, card, core.EvCardResolved,
+		core.CardResolvedPayload{CardID: card.ID, ActionID: actionID, Answer: answer})
+}
+
+// AppendAccountChecked preserves stream-card throttling while fencing its
+// durable body update against account disable.
+func (s *Service) AppendAccountChecked(actor, id, text string, allowImplicitDefault bool) error {
+	if err := s.requireAccountCheckedEmitter(); err != nil {
+		return err
+	}
+	card, version, err := s.st.GetCardVersion(actor, id)
+	if err != nil {
+		return err
+	}
+	if card.Task != nil {
+		return ErrNoAction
+	}
+	if text != "" {
+		if n := len(card.Body); n > 0 && card.Body[n-1].Type == core.UIMarkdown {
+			card.Body[n-1].Markdown += text
+		} else {
+			card.Body = append(card.Body, core.UINode{Type: core.UIMarkdown, Markdown: text})
+		}
+	}
+	card.UpdatedAt = s.now().UTC()
+	if err := s.st.SaveCardVersionedAccountChecked(actor, &card, "", version, allowImplicitDefault); err != nil {
+		return err
+	}
+	if card.ConversationID == "" && card.ProjectID == "" {
+		return nil
+	}
+	s.emitMu.Lock()
+	last, seen := s.lastEmit[id]
+	emit := !seen || s.now().Sub(last) >= cardAppendWindow
+	if emit {
+		s.lastEmit[id] = s.now()
+	}
+	s.emitMu.Unlock()
+	if !emit {
+		return nil
+	}
+	return s.emitCardAccountChecked(actor, card, core.EvCardUpdated, core.CardPayload{Card: card})
+}
+
+func (s *Service) emitCardAccountChecked(actor string, card core.ActivityCard, typ core.StreamEventType, payload any) error {
+	if s.accountCheckedEmit == nil || (card.ConversationID == "" && card.ProjectID == "") {
+		return nil
+	}
+	if card.ConversationID != "" {
+		if err := s.accountCheckedEmit(actor, card.ConversationID, card.SourceRunID, typ, payload); err != nil {
+			return err
+		}
+		if !s.MirrorConvCards {
+			return nil
+		}
+	}
+	if card.ProjectID != "" {
+		return s.accountCheckedEmit(actor, string(core.ProjectChannelKey(card.ProjectID)), card.SourceRunID, typ, payload)
+	}
+	return nil
+}
+
+// CreateAccountChecked creates a card under the actor's final Store fence.
+func (s *Service) CreateAccountChecked(actor string, card core.ActivityCard, ref string, allowImplicitDefault bool) (core.ActivityCard, error) {
+	if err := s.requireAccountCheckedEmitter(); err != nil {
+		return card, err
+	}
+	if card.Task != nil {
+		return card, store.ErrConflict
+	}
+	if card.ID != "" {
+		if existing, err := s.st.GetCard(actor, card.ID); err == nil && existing.Task != nil {
+			return card, store.ErrConflict
+		}
+	}
+	if card.ID == "" {
+		card.ID = store.NewID("card")
+	}
+	now := s.now().UTC()
+	card.CreatedAt, card.UpdatedAt = now, now
+	if card.Status == "" {
+		card.Status = core.CardActive
+	}
+	if err := s.st.SaveCardAccountChecked(actor, &card, ref, allowImplicitDefault); err != nil {
+		return card, err
+	}
+	return card, s.emitCardAccountChecked(actor, card, core.EvCardCreated, core.CardPayload{Card: card})
+}
+
+func (s *Service) updateVersionedAccountChecked(actor string, card core.ActivityCard, expectedVersion int, allowImplicitDefault bool) (core.ActivityCard, error) {
+	if err := s.requireAccountCheckedEmitter(); err != nil {
+		return card, err
+	}
+	if card.Task == nil {
+		if current, err := s.st.GetCard(actor, card.ID); err == nil && current.Task != nil {
+			return card, store.ErrConflict
+		}
+	}
+	if card.Task != nil {
+		// Task cards keep their revision-checked projection and its in-transaction
+		// card events; the account fence covers that same transaction.
+		if err := s.commitProjection(store.TaskProjectionWrite{Owner: actor, Card: card, ExpectedCardVersion: expectedVersion,
+			ExpectedTaskRevision: card.Task.Revision, Channels: s.taskChannels(card), AccountActor: actor, AllowImplicitDefault: allowImplicitDefault}); err != nil {
+			return card, err
+		}
+		return s.Get(actor, card.ID)
+	}
+	card.UpdatedAt = s.now().UTC()
+	if err := s.st.SaveCardVersionedAccountChecked(actor, &card, "", expectedVersion, allowImplicitDefault); err != nil {
+		return card, err
+	}
+	return card, s.emitCardAccountChecked(actor, card, core.EvCardUpdated, core.CardPayload{Card: card})
+}
+
+func (s *Service) UpdateVersionedAccountChecked(actor string, card core.ActivityCard, expectedVersion int, allowImplicitDefault bool) error {
+	_, err := s.updateVersionedAccountChecked(actor, card, expectedVersion, allowImplicitDefault)
+	return err
+}
+
+func (s *Service) SetPinnedAccountChecked(actor, id string, pinned, allowImplicitDefault bool) (core.ActivityCard, error) {
+	card, version, err := s.st.GetCardVersion(actor, id)
+	if err != nil {
+		return card, err
+	}
+	card.Pinned = pinned
+	card, err = s.updateVersionedAccountChecked(actor, card, version, allowImplicitDefault)
+	if err != nil {
+		return card, err
+	}
+	return card, nil
+}
+
+func (s *Service) SetStatusAccountChecked(actor, id string, status core.CardStatus, tone, note string, allowImplicitDefault bool) (core.ActivityCard, error) {
+	card, version, err := s.st.GetCardVersion(actor, id)
+	if err != nil {
+		return card, err
+	}
+	card.Status = status
+	if tone != "" {
+		card.Tone = tone
+	}
+	card, err = s.updateVersionedAccountChecked(actor, card, version, allowImplicitDefault)
+	if err != nil {
+		return card, err
+	}
+	if card.Task != nil {
+		return card, nil
+	}
+	return card, s.emitCardAccountChecked(actor, card, core.EvCardStatus,
+		core.CardStatusPayload{CardID: card.ID, Status: status, Tone: card.Tone, Note: note})
+}
+
+func (s *Service) DismissAccountChecked(actor, id string, allowImplicitDefault bool) (core.ActivityCard, error) {
+	return s.SetStatusAccountChecked(actor, id, core.CardDismissed, "", "dismissed by user", allowImplicitDefault)
+}
+
+func (s *Service) ActionAccountChecked(actor, id, actionID, freeText string, allowImplicitDefault bool) (core.ActivityCard, string, error) {
+	card, version, err := s.st.GetCardVersion(actor, id)
+	if err != nil {
+		return card, "", err
+	}
+	if card.Status != core.CardActionRequired {
+		return card, "", ErrNotAwaiting
+	}
+	label, found := actionID, false
+	for _, action := range card.Actions {
+		if action.ID == actionID {
+			label, found = action.Label, true
+			break
+		}
+	}
+	if !found {
+		if actionID == "" && freeText != "" {
+			label = freeText
+		} else {
+			return card, "", ErrNoAction
+		}
+	}
+	card.Status = core.CardResolved
+	recordAnswer(&card, actionID, freeText)
+	card, err = s.updateVersionedAccountChecked(actor, card, version, allowImplicitDefault)
+	if err != nil {
+		return card, "", err
+	}
+	err = s.emitCardAccountChecked(actor, card, core.EvCardResolved,
+		core.CardResolvedPayload{CardID: card.ID, ActionID: actionID, Answer: freeText})
+	return card, label, err
+}
+
+// ToProjectAccountChecked performs the copy and dismissal in one transaction.
+// Events are published after commit through the actor-aware event sink.
+func (s *Service) ToProjectAccountChecked(actor, id string, allowImplicitDefault bool) (core.ActivityCard, error) {
+	if err := s.requireAccountCheckedEmitter(); err != nil {
+		return core.ActivityCard{}, err
+	}
+	archived, origin, created, err := s.st.ArchiveCardToProjectAccountChecked(actor, id, s.now().UTC(), allowImplicitDefault)
+	if err != nil || !created {
+		return archived, err
+	}
+	if err := s.emitCardAccountChecked(actor, archived, core.EvCardCreated, core.CardPayload{Card: archived}); err != nil {
+		return archived, err
+	}
+	if err := s.emitCardAccountChecked(actor, origin, core.EvCardUpdated, core.CardPayload{Card: origin}); err != nil {
+		return archived, err
+	}
+	err = s.emitCardAccountChecked(actor, origin, core.EvCardStatus,
+		core.CardStatusPayload{CardID: origin.ID, Status: core.CardDismissed, Tone: origin.Tone, Note: "已留档到项目"})
+	return archived, err
+}
@@ -0,0 +1,109 @@
+package cardsvc
+
+import (
+	"errors"
+	"testing"
+
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+func TestAccountCheckedCardActionsUseActorEventSinkAndRespectDisable(t *testing.T) {
+	st, err := store.OpenSQLite(t.TempDir() + "/cards.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("admin", "", "", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("alice", "", "", false); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "cards")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversation("alice", project.ID, "cards", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacyCalls := 0
+	svc := New(st, func(string, string, core.StreamEventType, any) error {
+		legacyCalls++
+		return nil
+	})
+	type emitted struct {
+		actor, channel string
+		typ            core.StreamEventType
+	}
+	var guarded []emitted
+	svc.SetAccountCheckedEmitter(func(actor, channel, runID string, typ core.StreamEventType, payload any) error {
+		guarded = append(guarded, emitted{actor, channel, typ})
+		return nil
+	})
+	base := core.ActivityCard{ProjectID: project.ID, ConversationID: conv.ID, Title: "Action",
+		Status: core.CardActionRequired, Actions: []core.UIAction{{ID: "yes", Label: "Approve"}}}
+	action, err := svc.CreateAccountChecked("alice", base, "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, label, err := svc.ActionAccountChecked("alice", action.ID, "yes", "", false); err != nil || label != "Approve" {
+		t.Fatalf("guarded action: label=%q err=%v", label, err)
+	}
+	pending, err := svc.CreateAccountChecked("alice", base, "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pin, err := svc.CreateAccountChecked("alice", core.ActivityCard{ProjectID: project.ID, ConversationID: conv.ID, Title: "Pin"}, "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.SetPinnedAccountChecked("alice", pin.ID, true, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.DismissAccountChecked("alice", pin.ID, false); err != nil {
+		t.Fatal(err)
+	}
+	archive, err := svc.CreateAccountChecked("alice", core.ActivityCard{ProjectID: project.ID, ConversationID: conv.ID, Title: "Archive"}, "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	archived, err := svc.ToProjectAccountChecked("alice", archive.ID, false)
+	if err != nil || archived.ConversationID != "" {
+		t.Fatalf("guarded archive: %+v %v", archived, err)
+	}
+	if legacyCalls != 0 {
+		t.Fatalf("guarded card operations used unguarded emitter %d times", legacyCalls)
+	}
+	if len(guarded) == 0 {
+		t.Fatal("guarded operations published no events")
+	}
+	for _, event := range guarded {
+		if event.actor != "alice" {
+			t.Fatalf("event actor lost: %+v", event)
+		}
+	}
+	before := len(guarded)
+	account, err := st.GetAccountByOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetAccountEnabled("admin", account.ID, account.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	for _, mutate := range []func() error{
+		func() error { _, err := svc.CreateAccountChecked("alice", base, "", false); return err },
+		func() error { _, _, err := svc.ActionAccountChecked("alice", pending.ID, "yes", "", false); return err },
+		func() error { _, err := svc.SetPinnedAccountChecked("alice", pin.ID, false, false); return err },
+		func() error { _, err := svc.DismissAccountChecked("alice", pin.ID, false); return err },
+		func() error { _, err := svc.ToProjectAccountChecked("alice", archive.ID, false); return err },
+	} {
+		if err := mutate(); !errors.Is(err, store.ErrAccountForbidden) {
+			t.Fatalf("disabled actor mutated card: %v", err)
+		}
+	}
+	if len(guarded) != before {
+		t.Fatalf("disabled actor published %d events", len(guarded)-before)
+	}
+}
@@ -17,19 +17,27 @@ import (
 // 获得持久化、seq 排序、断线重放与终态对账（Stream 契约）。
 type Emitter func(conversationID, runID string, typ core.StreamEventType, payload any) error

+// AccountCheckedEmitter persists an actor-attributed event through its own
+// final account-checked Store transaction. The card write and event emission
+// are separate commits; the application wires this to its guarded event sink.
+type AccountCheckedEmitter func(actor, conversationID, runID string, typ core.StreamEventType, payload any) error
+
 var (
-	ErrNotFound    = store.ErrNotFound // 语义对齐存储层：跨租户/不存在一律 NotFound
-	ErrNoAction    = errors.New("card: action not found")
-	ErrNotAwaiting = errors.New("card: not awaiting action")
+	ErrNotFound               = store.ErrNotFound // 语义对齐存储层：跨租户/不存在一律 NotFound
+	ErrNoAction               = errors.New("card: action not found")
+	ErrNotAwaiting            = errors.New("card: not awaiting action")
+	ErrGuardedEmitterRequired = errors.New("card: account-checked emitter required")
 )

 // cardAppendWindow 是流式追加（Append）的 card.updated 发布节流窗口（D45）。
 const cardAppendWindow = 250 * time.Millisecond

 type Service struct {
-	st                *store.Store
-	emit              Emitter
-	projectSharedEmit ProjectSharedEmitter
+	TaskCommitter      func(store.TaskProjectionWrite) ([]core.StreamEvent, error)
+	st                 *store.Store
+	emit               Emitter
+	accountCheckedEmit AccountCheckedEmitter
+	projectSharedEmit  ProjectSharedEmitter
 	// MirrorConvCards EXT-12：会话卡是否镜像进项目公共流（缺省 true=现状全量
 	// 镜像；false 时会话卡只进本人会话流，项目级卡不受影响）。
 	MirrorConvCards bool
@@ -42,6 +50,10 @@ func New(st *store.Store, emit Emitter) *Service {
 	return &Service{st: st, emit: emit, now: time.Now, lastEmit: map[string]time.Time{}, MirrorConvCards: true}
 }

+func (s *Service) SetAccountCheckedEmitter(emit AccountCheckedEmitter) {
+	s.accountCheckedEmit = emit
+}
+
 // ProjectSharedEmitter is an internal trusted publication adapter. It is never
 // bound to model arguments or exposed as a mandatory extension capability.
 type ProjectSharedEmitter func(owner, producer, channel, runID string, typ core.StreamEventType, payload any) error
@@ -108,6 +120,14 @@ func (s *Service) emitCard(c core.ActivityCard, typ core.StreamEventType, payloa
 // （HITL 投影卡 = "hitl:<id>"，to_project 留档副本 = "to_project:<原卡ID>"）；
 // ConversationID 为空的项目级卡发布到项目流。
 func (s *Service) Create(owner string, card core.ActivityCard, ref string) (core.ActivityCard, error) {
+	if card.Task != nil {
+		return card, store.ErrConflict
+	}
+	if card.ID != "" {
+		if existing, err := s.st.GetCard(owner, card.ID); err == nil && existing.Task != nil {
+			return card, store.ErrConflict
+		}
+	}
 	if card.ID == "" {
 		card.ID = store.NewID("card")
 	}
@@ -124,16 +144,53 @@ func (s *Service) Create(owner string, card core.ActivityCard, ref string) (core
 }

 // Get 读取单卡。
-func (s *Service) Get(owner, id string) (core.ActivityCard, error) { return s.st.GetCard(owner, id) }
+func (s *Service) Get(owner, id string) (core.ActivityCard, error) {
+	c, err := s.st.GetCard(owner, id)
+	if err == nil {
+		c = s.present(owner, c)
+	}
+	return c, err
+}

 // List 按会话列出（updated_at 降序；置顶与待办排序是前端关注点）。
 func (s *Service) List(owner, conversationID string) ([]core.ActivityCard, error) {
-	return s.st.ListCards(owner, conversationID)
+	cards, err := s.st.ListCards(owner, conversationID)
+	if err == nil {
+		cards = s.PresentCards(owner, cards)
+	}
+	return cards, err
+}
+
+// PresentCards applies the read-time projections to cards read elsewhere
+// (for example a cursor snapshot), in place.
+func (s *Service) PresentCards(owner string, cards []core.ActivityCard) []core.ActivityCard {
+	for i := range cards {
+		cards[i] = s.present(owner, cards[i])
+	}
+	return cards
+}
+
+// present applies every read-time projection: resolved HITL answers and
+// task source visibility.
+func (s *Service) present(owner string, c core.ActivityCard) core.ActivityCard {
+	return s.VisibleTaskCard(owner, s.presentResolved(owner, c))
 }

 // Update 保存整卡变更（流式 Body 增量等）并发布 card.updated；ref 保持原值。
 // 系统镜像路径（同会话 run 的顺序行为）沿用盲写；用户态裁决走 UpdateVersioned。
 func (s *Service) Update(owner string, card core.ActivityCard) error {
+	if card.Task == nil {
+		if old, e := s.st.GetCard(owner, card.ID); e == nil && old.Task != nil {
+			return store.ErrConflict
+		}
+	}
+	if card.Task != nil {
+		_, ver, err := s.st.GetCardVersion(owner, card.ID)
+		if err != nil {
+			return err
+		}
+		return s.UpdateVersioned(owner, card, ver)
+	}
 	card.UpdatedAt = s.now().UTC()
 	if err := s.st.SaveCard(owner, &card, ""); err != nil {
 		return err
@@ -144,6 +201,14 @@ func (s *Service) Update(owner string, card core.ActivityCard) error {
 // UpdateVersioned 乐观并发保存（U3，KTD7）：版本不匹配透传 store.ErrConflict，
 // HTTP 层映射 409；客户端重读卡后重试。
 func (s *Service) UpdateVersioned(owner string, card core.ActivityCard, expectedVersion int) error {
+	if card.Task == nil {
+		if current, err := s.st.GetCard(owner, card.ID); err == nil && current.Task != nil {
+			return store.ErrConflict
+		}
+	}
+	if card.Task != nil {
+		return s.commitProjection(store.TaskProjectionWrite{Owner: owner, Card: card, ExpectedCardVersion: expectedVersion, ExpectedTaskRevision: card.Task.Revision, Channels: s.taskChannels(card)})
+	}
 	card.UpdatedAt = s.now().UTC()
 	if err := s.st.SaveCardVersioned(owner, &card, "", expectedVersion); err != nil {
 		return err
@@ -160,6 +225,9 @@ func (s *Service) Append(owner, id, text string) error {
 	if err != nil {
 		return err
 	}
+	if c.Task != nil {
+		return ErrNoAction
+	}
 	if text != "" {
 		if n := len(c.Body); n > 0 && c.Body[n-1].Type == core.UIMarkdown {
 			c.Body[n-1].Markdown += text
@@ -200,6 +268,9 @@ func (s *Service) SetStatus(owner, id string, status core.CardStatus, tone, note
 	if err := s.UpdateVersioned(owner, c, ver); err != nil {
 		return c, err
 	}
+	if c.Task != nil {
+		return s.Get(owner, c.ID)
+	}
 	return c, s.emitCard(c, core.EvCardStatus, core.CardStatusPayload{CardID: c.ID, Status: status, Tone: c.Tone, Note: note})
 }

@@ -210,7 +281,10 @@ func (s *Service) SetPinned(owner, id string, pinned bool) (core.ActivityCard, e
 		return c, err
 	}
 	c.Pinned = pinned
-	return c, s.UpdateVersioned(owner, c, ver)
+	if e := s.UpdateVersioned(owner, c, ver); e != nil {
+		return c, e
+	}
+	return s.Get(owner, c.ID)
 }

 // Dismiss 关闭卡（非确认语义，留痕）。
@@ -245,6 +319,7 @@ func (s *Service) Action(owner, id, actionID, freeText string) (core.ActivityCar
 		return c, "", ErrNoAction
 	}
 	c.Status = core.CardResolved
+	recordAnswer(&c, actionID, freeText)
 	if err := s.UpdateVersioned(owner, c, ver); err != nil {
 		return c, "", err
 	}
@@ -264,6 +339,9 @@ func (s *Service) ToProject(owner, id string) (core.ActivityCard, error) {
 	if c.ConversationID == "" {
 		return c, errors.New("card: already project-level")
 	}
+	if c.Task != nil {
+		return c, errors.New("card: keep the original task reference in its conversation")
+	}
 	if ref, rerr := s.st.CardRef(owner, c.ID); rerr == nil {
 		if strings.HasPrefix(ref, "hitl:") || strings.HasPrefix(ref, "cmd:") {
 			return c, errors.New("card: flow-bound card cannot be archived to project")
@@ -306,6 +384,7 @@ func (s *Service) ResolveByRef(owner, ref, actionID, answer string) error {
 		return nil // 已决（双现任一侧先到）
 	}
 	c.Status = core.CardResolved
+	recordAnswer(&c, actionID, answer)
 	if err := s.UpdateVersioned(owner, c, ver); err != nil {
 		if errors.Is(err, store.ErrConflict) {
 			return nil // 双现任一侧先到（版本竞争败者）：不重试，卡以先到侧为准
@@ -0,0 +1,59 @@
+package cardsvc
+
+import (
+	core "agent-system-core"
+	"strings"
+)
+
+func recordAnswer(card *core.ActivityCard, actionID, answer string) {
+	label := actionID
+	for _, action := range card.Actions {
+		if action.ID == actionID {
+			label = action.Label
+			break
+		}
+	}
+	body := []core.UINode{}
+	for _, node := range card.Body {
+		if node.Type == core.UIMarkdown && (strings.Contains(node.Markdown, "可在输入框自由输入") || strings.Contains(node.Markdown, "自由输入回应")) {
+			continue
+		}
+		body = append(body, node)
+	}
+	pairs := [][2]string{}
+	if label != "" {
+		pairs = append(pairs, [2]string{"你的选择", label})
+	}
+	if strings.TrimSpace(answer) != "" && answer != label {
+		pairs = append(pairs, [2]string{"补充说明", answer})
+	}
+	if len(pairs) > 0 {
+		body = append(body, core.UINode{Type: core.UIKV, KV: pairs})
+	}
+	card.Body = body
+}
+
+func (s *Service) presentResolved(owner string, card core.ActivityCard) core.ActivityCard {
+	if card.Status != core.CardResolved {
+		return card
+	}
+	// Already-recorded answers survive unchanged; old projections are repaired
+	// from their owner-scoped persisted HITL resolution without changing history.
+	for _, node := range card.Body {
+		for _, pair := range node.KV {
+			if pair[0] == "你的选择" || pair[0] == "补充说明" {
+				return card
+			}
+		}
+	}
+	ref, err := s.st.CardRef(owner, card.ID)
+	if err != nil || !strings.HasPrefix(ref, "hitl:") {
+		return card
+	}
+	resolution, err := s.st.HITLResolution(owner, strings.TrimPrefix(ref, "hitl:"))
+	if err != nil {
+		return card
+	}
+	recordAnswer(&card, "", resolution.Answer)
+	return card
+}
@@ -0,0 +1,41 @@
+package cardsvc
+
+import (
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+	"strings"
+	"testing"
+)
+
+func TestHistoricalResolvedChoiceDisplaysPersistedAnswer(t *testing.T) {
+	st, svc, _ := openTest(t)
+	hitl := core.HITLCard{ID: "old-choice", ConversationID: "cnv_1"}
+	if err := st.SaveHITLCard(store.OwnerDefault, &hitl); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.ResolveHITLCard(store.OwnerDefault, hitl.ID, core.HITLResolvedPayload{CardID: hitl.ID, Answer: "生成摘要", Kind: "choice"}); err != nil {
+		t.Fatal(err)
+	}
+	card, err := svc.Create(store.OwnerDefault, core.ActivityCard{Kind: core.CardKindConfirm, Status: core.CardResolved, Body: []core.UINode{{Type: core.UIMarkdown, Markdown: "_可在输入框自由输入回应。_"}}}, "hitl:"+hitl.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := svc.Get(store.OwnerDefault, card.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, node := range got.Body {
+		if strings.Contains(node.Markdown, "输入框") {
+			t.Fatal("stale input hint retained")
+		}
+		for _, pair := range node.KV {
+			if pair[1] == "生成摘要" {
+				found = true
+			}
+		}
+	}
+	if !found {
+		t.Fatal("stored choice answer missing")
+	}
+}
@@ -0,0 +1,63 @@
+package cardsvc
+
+import (
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+	"time"
+)
+
+func taskCardState(task core.TaskSnapshot) (core.CardStatus, string) {
+	switch task.ExecutionState {
+	case "completed":
+		return core.CardDone, "ok"
+	case "failed", "interrupted":
+		return core.CardFailed, "danger"
+	case "awaiting_user":
+		return core.CardActionRequired, "warn"
+	default:
+		return core.CardActive, "info"
+	}
+}
+func (s *Service) commitProjection(w store.TaskProjectionWrite) error {
+	if s.TaskCommitter != nil {
+		_, err := s.TaskCommitter(w)
+		return err
+	}
+	_, err := s.st.CommitTaskProjection(w)
+	return err
+}
+func (s *Service) taskChannels(card core.ActivityCard) []string {
+	channels := []string{card.ConversationID}
+	if s.MirrorConvCards && card.ProjectID != "" {
+		channels = append(channels, string(core.ProjectChannelKey(card.ProjectID)))
+	}
+	return channels
+}
+func (s *Service) CommitTask(owner string, next core.TaskSnapshot, expectedRevision int64) error {
+	return s.CommitTaskSources(owner, next, expectedRevision, nil)
+}
+func (s *Service) CommitTaskSources(owner string, next core.TaskSnapshot, expectedRevision int64, witnesses []store.ArtifactWitness) error {
+	c, version, err := s.st.GetCardVersion(owner, next.CardID)
+	if err != nil {
+		return err
+	}
+	c.Task = &next
+	c.SourceRunID = next.RunID
+	c.Body = next.SummaryBody()
+	c.Status, c.Tone = taskCardState(next)
+	c.UpdatedAt = time.Now().UTC()
+	return s.commitProjection(store.TaskProjectionWrite{Owner: owner, Card: c, ExpectedCardVersion: version, ExpectedTaskRevision: expectedRevision, SourceWitnesses: witnesses, Channels: s.taskChannels(c)})
+}
+func (s *Service) CreateTask(owner string, card core.ActivityCard, ref string) (core.ActivityCard, error) {
+	if card.Task == nil {
+		return card, store.ErrConflict
+	}
+	card.Status, card.Tone = taskCardState(*card.Task)
+	card.Body = card.Task.SummaryBody()
+	card.CreatedAt = time.Now().UTC()
+	card.UpdatedAt = card.CreatedAt
+	if err := s.commitProjection(store.TaskProjectionWrite{Owner: owner, Card: card, Ref: ref, Channels: s.taskChannels(card)}); err != nil {
+		return card, err
+	}
+	return s.st.GetCard(owner, card.ID)
+}
@@ -0,0 +1,63 @@
+package cardsvc
+
+import (
+	core "agent-system-core"
+	"testing"
+)
+
+func TestTaskProjectionPreservesUserReadingPreferences(t *testing.T) {
+	st, svc, _ := openTest(t)
+	c := core.ActivityCard{ID: "card-task", ProjectID: "p1", ConversationID: "c1", Title: "任务", Kind: core.CardKindProgress}
+	c.Task = &core.TaskSnapshot{SchemaVersion: 1, TaskID: "t1", AttemptID: "a1", CardID: c.ID, ProjectID: "p1", ConversationID: "c1", OwnerInstanceID: "i1", StreamScope: "conversation:c1", Revision: 1, ExecutionState: "queued", OutcomeCompleteness: "none", DeliveryState: "pending", Title: "任务"}
+	if _, e := svc.CreateTask("o", c, ""); e != nil {
+		t.Fatal(e)
+	}
+	current, e := st.GetCard("o", c.ID)
+	if e != nil {
+		t.Fatal("task card not saved", e)
+	}
+	current.Pinned = true
+	current.Status = core.CardDismissed
+	if e = st.SaveCard("o", &current, ""); e != nil {
+		t.Fatal(e)
+	}
+	next := *current.Task
+	next.Revision = 2
+	next.ExecutionState = "completed"
+	next.Conclusion = "有用成果"
+	if e = svc.CommitTask("o", next, 1); e != nil {
+		t.Fatal(e)
+	}
+	got, e := st.GetCard("o", c.ID)
+	if e != nil || !got.Pinned || got.Status != core.CardDismissed || got.Task.ExecutionState != "completed" {
+		t.Fatal("work update stole user state", got, e)
+	}
+}
+
+func TestTaskProjectionUserPinHasAtomicEventWatermark(t *testing.T) {
+	st, svc, _ := openTest(t)
+	c := core.ActivityCard{ID: "card-pin", ProjectID: "p1", ConversationID: "c1", Title: "任务", Kind: core.CardKindProgress}
+	c.Task = &core.TaskSnapshot{SchemaVersion: 1, TaskID: "t1", AttemptID: "a1", CardID: c.ID, ProjectID: "p1", ConversationID: "c1", OwnerInstanceID: "i1", StreamScope: "conversation:c1", Revision: 1, ExecutionState: "queued", OutcomeCompleteness: "none", DeliveryState: "pending", Title: "任务"}
+	if _, e := svc.CreateTask("o", c, ""); e != nil {
+		t.Fatal(e)
+	}
+	if _, e := svc.SetPinned("o", c.ID, true); e != nil {
+		t.Fatal(e)
+	}
+	snapshot, e := st.CardsAtCursor("o", "c1")
+	if e != nil || snapshot.ReplaySeq != 2 || len(snapshot.Cards) != 1 || !snapshot.Cards[0].Pinned {
+		t.Fatal("pin not atomically replayable", snapshot, e)
+	}
+}
+
+func TestTaskProjectionCannotCreateSecondExecutionOwner(t *testing.T) {
+	_, svc, _ := openTest(t)
+	c := core.ActivityCard{ID: "card-archive", ProjectID: "p1", ConversationID: "c1", Title: "任务", Kind: core.CardKindProgress}
+	c.Task = &core.TaskSnapshot{SchemaVersion: 1, TaskID: "t1", AttemptID: "a1", CardID: c.ID, ProjectID: "p1", ConversationID: "c1", OwnerInstanceID: "i1", StreamScope: "conversation:c1", Revision: 1, ExecutionState: "queued", OutcomeCompleteness: "none", DeliveryState: "pending", Title: "任务"}
+	if _, e := svc.CreateTask("o", c, ""); e != nil {
+		t.Fatal(e)
+	}
+	if _, e := svc.ToProject("o", c.ID); e == nil {
+		t.Fatal("task was copied with a second execution owner")
+	}
+}
@@ -0,0 +1,106 @@
+package cardsvc
+
+import (
+	core "agent-system-core"
+	"crypto/sha256"
+	"encoding/hex"
+)
+
+// Task source authorization is conservative: same owner and same project.
+// The host rechecks it on every fresh read and stream replay, without an ACL cache.
+func (s *Service) taskSourceState(owner, project string, src core.TaskSourceRef) string {
+	art, e := s.st.GetArtifact(owner, src.ArtifactID)
+	if e != nil || art.ProjectID != project {
+		return "unavailable"
+	}
+	data, e := s.st.ArtifactContent(owner, src.ArtifactID)
+	if e != nil {
+		return "unavailable"
+	}
+	sum := sha256.Sum256(data)
+	if hex.EncodeToString(sum[:]) != src.ContentHash {
+		return "changed"
+	}
+	return "available"
+}
+func (s *Service) VisibleTaskCard(owner string, c core.ActivityCard) core.ActivityCard {
+	if c.Task == nil {
+		return c
+	}
+	task := *c.Task
+	denied := false
+	changed := false
+	if _, e := s.st.GetCard(owner, c.ID); e != nil {
+		denied = true
+	}
+	refs := append([]core.TaskSourceRef(nil), task.Inputs...)
+	for _, f := range task.Findings {
+		refs = append(refs, f.Sources...)
+	}
+	for _, src := range refs {
+		switch s.taskSourceState(owner, c.ProjectID, src) {
+		case "unavailable":
+			denied = true
+		case "changed":
+			changed = true
+		}
+	}
+	// Result refs must also be owned and accessible before exposing generated names.
+	for _, ref := range task.ResultRefs {
+		if ref.ArtifactID != "" {
+			a, e := s.st.GetArtifact(owner, ref.ArtifactID)
+			if e != nil || a.ProjectID != c.ProjectID {
+				denied = true
+			}
+		}
+	}
+	if !denied && !changed {
+		return c
+	}
+	task.Goal = ""
+	task.Focus = ""
+	task.Coverage = ""
+	task.Remaining = ""
+	task.NextStep = ""
+	task.Conclusion = ""
+	task.CheckpointKeys = nil
+	task.Limitations = nil
+	task.Phase.Label = ""
+	task.Actions = nil
+	task.ResultRefs = nil
+	if denied {
+		c.Title = "后台任务"
+		task.Title = c.Title
+		task.Inputs = nil
+		task.Findings = nil
+		task.Conclusion = "相关来源当前不可用，结果暂不展示"
+		task.Limitations = []string{"相关来源当前不可用，请核实访问权限与文件状态"}
+		task.Remaining = "请核实材料访问权限与文件是否仍可读取"
+	} else {
+		task.Findings = append([]core.TaskFinding(nil), task.Findings...)
+		for i := range task.Findings {
+			f := &task.Findings[i]
+			f.Status = "superseded"
+			f.Sources = append([]core.TaskSourceRef(nil), f.Sources...)
+			for j := range f.Sources {
+				f.Sources[j].Availability = s.taskSourceState(owner, c.ProjectID, f.Sources[j])
+			}
+		}
+		task.Conclusion = "依据文件已更新，当前结论需要重新核验"
+		task.Limitations = []string{"依据文件已更新，历史发现不能直接作为当前结论"}
+		task.Remaining = "展开历史记录可查看处理时的合法引用；当前文件与当时版本可能不同"
+	}
+	task.OutcomeCompleteness = "partial"
+	c.Task = &task
+	c.Actions = nil
+	c.Body = task.SummaryBody()
+	// The durable work result and its follow-up choice derive from the same
+	// sources, so they follow the task conclusion's visibility.
+	if c.Work != nil {
+		work := *c.Work
+		work.Result = ""
+		work.Decision = nil
+		c.Work = &work
+	}
+	return c
+}
@@ -0,0 +1,41 @@
+package cardsvc
+
+import (
+	core "agent-system-core"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestTaskVisibilityHidesAllDerivedTextOnSourceRevocation(t *testing.T) {
+	st, svc, _ := openTest(t)
+	data := []byte("private input")
+	art := core.Artifact{Owner: "o", ProjectID: "p", Name: "private name"}
+	if e := st.CreateArtifact(&art, data); e != nil {
+		t.Fatal(e)
+	}
+	sum := sha256.Sum256(data)
+	src := core.TaskSourceRef{ID: "s", ArtifactID: art.ID, ContentHash: hex.EncodeToString(sum[:]), Label: art.Name, Quote: string(data)}
+	c := core.ActivityCard{ID: "ct", ProjectID: "p", ConversationID: "c", Title: "private title", Kind: core.CardKindProgress}
+	c.Task = &core.TaskSnapshot{SchemaVersion: 1, TaskID: "t", AttemptID: "a", CardID: c.ID, ProjectID: "p", ConversationID: "c", OwnerInstanceID: "i", Revision: 1, StreamScope: "conversation:c", ExecutionState: "queued", OutcomeCompleteness: "none", DeliveryState: "pending", Title: c.Title, Focus: "private focus", Coverage: "private coverage", Remaining: "private remaining", NextStep: "private advice", Conclusion: "private conclusion", Inputs: []core.TaskSourceRef{src}, Findings: []core.TaskFinding{{ID: "f", Revision: 1, Status: "active", Kind: "material_record", Text: "private finding", Sources: []core.TaskSourceRef{src}}}}
+	if _, e := svc.CreateTask("o", c, ""); e != nil {
+		t.Fatal(e)
+	}
+	if e := st.UpdateArtifactContent("o", art.ID, []byte("updated")); e != nil {
+		t.Fatal(e)
+	}
+	changed := svc.VisibleTaskCard("o", c)
+	if changed.Task.Findings[0].Status != "superseded" || changed.Task.Findings[0].Sources[0].Availability != "changed" {
+		t.Fatal("old evidence masquerades as current")
+	}
+	if e := st.DeleteArtifact("o", art.ID); e != nil {
+		t.Fatal(e)
+	}
+	hidden := svc.VisibleTaskCard("o", c)
+	raw, _ := json.Marshal(hidden)
+	if strings.Contains(string(raw), "private") {
+		t.Fatal("derived information leaked", string(raw))
+	}
+}
@@ -0,0 +1,169 @@
+package cmdbus
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	agentcommand "agent-command"
+)
+
+func TestEffectiveAccountGuardRejectsBeforeDispatchEffects(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		req  Request
+		err  error
+		want string
+	}{
+		{"disabled handler", Request{ID: "demo.ping", Owner: "alice", Actor: "alice"}, errors.New("disabled"), "alice"},
+		{"failed lookup", Request{ID: "demo.ping", Owner: "alice", Actor: "alice"}, errors.New("database unavailable"), "alice"},
+		{"plugin actor uses account owner", Request{ID: "demo.ping", Owner: "alice", Actor: "plugin:rdm"}, errors.New("disabled"), "alice"},
+		{"actor fallback", Request{ID: "demo.ping", Actor: "alice"}, errors.New("disabled"), "alice"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			audit, cards := &memAudit{}, &memCards{}
+			b := newTestBus(audit, cards)
+			called := 0
+			b.SetEffectiveAccountGuard(func(_ context.Context, actor string) error {
+				called++
+				if actor != tc.want {
+					t.Fatalf("guard actor = %q, want %q", actor, tc.want)
+				}
+				return tc.err
+			})
+			resp := b.Dispatch(context.Background(), tc.req)
+			if resp.Receipt.State != agentcommand.StateRejected || !strings.Contains(resp.Receipt.Reason, "effective account") {
+				t.Fatalf("guard rejection: %+v", resp.Receipt)
+			}
+			if called != 1 || len(audit.logs) != 0 || len(cards.created) != 0 {
+				t.Fatalf("guard calls=%d audits=%d cards=%d", called, len(audit.logs), len(cards.created))
+			}
+		})
+	}
+}
+
+func TestEffectiveAccountGuardRejectsBeforePendingConfirmAndRechecks(t *testing.T) {
+	audit, cards := &memAudit{}, &memCards{}
+	b := newTestBus(audit, cards)
+	allowed := false
+	b.SetEffectiveAccountGuard(func(_ context.Context, actor string) error {
+		if actor != "alice" {
+			t.Fatalf("guard actor = %q", actor)
+		}
+		if !allowed {
+			return errors.New("disabled")
+		}
+		return nil
+	})
+	req := Request{ID: "demo.risky", Owner: "alice", Actor: "alice", ConversationID: "cnv_1", Params: map[string]any{"target": "prod"}}
+	if r := b.Dispatch(context.Background(), req); r.Receipt.State != agentcommand.StateRejected {
+		t.Fatalf("disabled dispatch: %+v", r.Receipt)
+	}
+	if len(cards.created) != 0 || len(b.pending) != 0 || len(audit.logs) != 0 {
+		t.Fatal("disabled dispatch created confirmation effects")
+	}
+	allowed = true
+	r := b.Dispatch(context.Background(), req)
+	if r.Receipt.State != agentcommand.StateAccepted || len(cards.created) != 1 || len(b.pending) != 1 {
+		t.Fatalf("enabled dispatch: %+v", r.Receipt)
+	}
+	allowed = false
+	before := len(audit.logs)
+	if r := b.Confirm("alice", "card_x1", "confirm"); r.Receipt.State != agentcommand.StateRejected {
+		t.Fatalf("disabled confirm: %+v", r.Receipt)
+	}
+	if len(b.pending) != 1 || len(audit.logs) != before {
+		t.Fatal("disabled confirm consumed pending request or wrote audit")
+	}
+	allowed = true
+	if r := b.Confirm("alice", "card_x1", "confirm"); r.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("re-enabled confirm: %+v", r.Receipt)
+	}
+}
+
+func TestEffectiveAccountGuardStopsConfirmedHandlerAfterStateChanges(t *testing.T) {
+	b := New(&memAudit{}, &memCards{}, nil)
+	executed := 0
+	if err := b.RegisterPluginCommand(agentcommand.CommandSpec{ID: "demo.effect", Title: "Effect"}, func(context.Context, Request) (any, error) {
+		executed++
+		return "done", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	checks := 0
+	b.SetEffectiveAccountGuard(func(_ context.Context, actor string) error {
+		checks++
+		if actor != "alice" {
+			t.Fatalf("guard actor = %q", actor)
+		}
+		if checks == 4 {
+			return errors.New("disabled after confirmation started")
+		}
+		return nil
+	})
+	// Confirm passes its own check, then Dispatch must check once more before
+	// invoking the handler. A direct confirmed request takes the same path.
+	if err := b.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.high", Title: "High", Danger: agentcommand.DangerHigh}, "", func(context.Context, Request) (any, error) {
+		executed++
+		return "done", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	r := b.Dispatch(context.Background(), Request{ID: "demo.high", Owner: "alice", ConversationID: "cnv_1"})
+	if r.Receipt.State != agentcommand.StateAccepted {
+		t.Fatalf("initial dispatch: %+v", r.Receipt)
+	}
+	// Dispatch checks again before creating the confirmation card. Confirm's
+	// check passes; its nested Dispatch catches the fourth-state change.
+	if r := b.Confirm("alice", "card_x1", "confirm"); r.Receipt.State != agentcommand.StateRejected {
+		t.Fatalf("confirm after disable: %+v", r.Receipt)
+	}
+	if executed != 0 || len(b.pending) != 0 {
+		t.Fatalf("executed=%d pending=%d", executed, len(b.pending))
+	}
+	// Direct confirmed execution also passes through the same guard.
+	checks = 3
+	if r := b.Dispatch(context.Background(), Request{ID: "demo.effect", Owner: "alice", Confirmed: true}); r.Receipt.State != agentcommand.StateRejected || executed != 0 {
+		t.Fatalf("direct confirmed dispatch: %+v executed=%d", r.Receipt, executed)
+	}
+}
+
+type trackingPendingStore struct {
+	owner, payload string
+	takes          int
+}
+
+func (p *trackingPendingStore) SavePendingConfirm(_ string, owner, payload string) error {
+	p.owner, p.payload = owner, payload
+	return nil
+}
+func (p *trackingPendingStore) TakePendingConfirm(string) (string, string, bool, error) {
+	p.takes++
+	return p.owner, p.payload, p.payload != "", nil
+}
+
+func TestEffectiveAccountGuardDoesNotConsumeStoredPendingOnDeniedConfirm(t *testing.T) {
+	b := newTestBus(&memAudit{}, &memCards{})
+	pendingStorage := &trackingPendingStore{}
+	b.SetPendingStore(pendingStorage)
+	allowed := true
+	b.SetEffectiveAccountGuard(func(_ context.Context, actor string) error {
+		if actor != "alice" {
+			t.Fatalf("guard actor = %q", actor)
+		}
+		if !allowed {
+			return errors.New("database unavailable")
+		}
+		return nil
+	})
+	r := b.Dispatch(context.Background(), Request{ID: "demo.risky", Owner: "alice", ConversationID: "cnv_1", Params: map[string]any{"target": "prod"}})
+	if r.Receipt.State != agentcommand.StateAccepted || pendingStorage.payload == "" {
+		t.Fatalf("pending setup: %+v", r.Receipt)
+	}
+	b.pending = map[string]pending{} // force the restored path
+	allowed = false
+	if r := b.Confirm("alice", "card_x1", "confirm"); r.Receipt.State != agentcommand.StateRejected || pendingStorage.takes != 0 {
+		t.Fatalf("denied confirm: %+v takes=%d", r.Receipt, pendingStorage.takes)
+	}
+}
--- a/Show More
+++ b/Show More