audit: reconcile all 23 independent-audit findings + land recovered skill content

.agents/skills/work-lab-workflow/SKILL.md

@@ -1,35 +1,77 @@
 <!-- GENERATED — DO NOT EDIT -->
 <!-- source: projections/agents/source/work-lab-workflow/SKILL.md -->
 <!-- generator: projections/agents/generate.py v1.0.0 -->
-<!-- content_hash: sha256:6b3e785cb184cba5212a7ee69e5ac3d65753bdf3214a171fe0e3610a796be9bb -->
+<!-- content_hash: sha256:528bdd0424de23886885ec4cb3c61e5ed97e407d3c914fa370fffc5c8d757fef -->
 ---
 name: work-lab-workflow
 description: "Use for WORK-LAB workflow tasks; follow the project ledger, module, and verification boundaries."
-version: 1.0.0
+version: 1.1.0
 ---
 
 # WORK-LAB Workflow Contract
 
 Use this skill only inside the WORK-LAB Git repository.
 
+## What this product is
+
+WORK-LAB is a client-neutral workflow control, governance, task, delivery and observability layer. It is not
+an agent, not a chat application, and not a model gateway; external software executes the business work. The
+repository is an auditable portable source, and Hermes, Codex, CC Switch, GitHub, OpenHuman and Open Design
+are replaceable Adapters behind one contract, not the product itself.
+
+## Three projects, one boundary each
+
+- WORK-LAB: project observation, reusable capability evaluation / adaptation / target verification, and
+  declared configuration governance. It is not a mandatory total dispatcher.
+- ArcheAxis-Knowledge-OS (AAOS): full knowledge lifecycle, human knowledge work, research and learning, AI
+  learning assets, bidirectional learning and long-term project memory.
+- DESIGN-LAB: professional design of all types, native assets, the design-specific execution core and
+  professional acceptance.
+
+Machine authority: `.project/governance/three-project-boundary.json`. A task in one project grants no write
+access to another. Design capability is neither collected nor managed here.
+
 ## Ownership
 
-- `services/` + `packages/` + `integrations/` owns workflow configuration, Task Ledger, Telemetry Ledger, sidecar, adapters, and delivery gates.
-- `apps/observer` is read-only. It may read Workflow-owned projections but must not execute, approve, retry, apply, rollback, change task state, or write the Telemetry Ledger.
-- Open Design and MINIGAME are archive/transferred scope and must not be restored as active modules.
+- Module roots are exactly two (`.project/governance/module-ownership.json`): `packages/client-neutral-core`
+  (Task Ledger, Telemetry Ledger, sidecar, adapters, delivery gates) and `apps/observer` (read-only
+  projection). `services/`, `integrations/`, `config/`, `apps/token-monitor/` and `scripts/` are active
+  supporting surfaces, not module roots.
+- `apps/observer` is read-only. It may read Workflow-owned projections but must not execute, approve, retry,
+  apply, rollback, change task state, or write the Telemetry Ledger.
+- Retired module paths must not be restored.
+
+## Desktop scope
+
+The product surface is the desktop Observer window plus the existing desktop floating HUD. Mobile is out of
+scope: it is not built, not queued, and not recorded as a deferred or frozen task.
+
+## Truth discipline
+
+- Unknown is never padded to zero, and an absent field is not an empty one; report PROJECTED, NULL_FIELD and
+  SOURCE_GAP as different origins.
+- A lost connection is not a stopped subject, and a `turn_end` signal is not the completion of a project.
+- Demo and fixture data never enter production code paths.
+- A colour or layout proposal from an inbound task pack becomes an opt-in theme
+  (`?palette=master`) and never overwrites the shipped default values.
 
 ## Writer boundary
 
-- One writer owns a checkout.
-- Parallel writers require separate worktrees.
+- One writer owns a checkout; parallel writers require separate worktrees.
 - Do not edit a checkout concurrently with another writer or reviewer.
-- Do not commit, push, publish, create a PR, merge, or modify global Codex/Hermes configuration unless the user explicitly authorizes that exact side effect.
+- Do not commit, push, publish, create a PR, merge, install software, or modify global client configuration
+  unless the user explicitly authorizes that exact side effect.
+- Whether an external client is actually deployed is recorded as unverified unless it was read back in this
+  session; an unverified claim is written as unverified, not as satisfied.
 
 ## Runtime and evidence
 
-- Keep temporary files, caches, logs, test environments, Task Ledger state, and generated evidence under the project `.project-local/` directory.
-- Never read or expose credentials, `.env` files, auth stores, private keys, browser data, tokens, prompt bodies, or response bodies.
-- Never access `E:\` without explicit authorization for the exact path and operation.
+- Keep temporary files, caches, logs, test environments, Task Ledger state and generated evidence under the
+  project `.project-local/` directory (`runs/` for transient state, `artifacts/` for evidence).
+- Never read, print, copy, commit or upload credentials, `.env` files, auth stores, private keys, browser
+  data, tokens, prompt bodies or response bodies.
+- Never access `E:\` or `F:\` — read or write — without explicit per-path, per-operation authorization
+  (`.project/governance/project-data-boundary.json`).
 
 ## Verification
 
@@ -39,8 +81,19 @@ Run checks from the exact module path. Prefer the canonical gate:
 python services/orchestration/run_quality_gate.py verify
 ```
 
-Distinguish structural checks, local runtime checks, exact-SHA CI, and release evidence. A local test pass is not proof of exact-SHA CI or publication.
+Distinguish structural checks, local runtime checks, exact-SHA CI, and release evidence. A local test pass is
+not proof of exact-SHA CI or publication. A render or measurement receipt must name the bytes it looked at.
 
 ## Task execution
 
-Before changing code, read the relevant `AGENTS.md`, inspect the project task contract, and locate the symbol or configuration owner. Use the Workflow-owned Task Ledger for durable task state when the task contract requires it. Observer projections are read-only and are never a second source of truth.
+Before changing code, read the relevant `AGENTS.md`, inspect the project task contract, and locate the symbol
+or configuration owner. The single live task register is `taskpacks/current/OPEN-TASK-REGISTER.md`, and the
+current taskpack for this round is `taskpacks/current/WORK-LAB-UI-PRIORITY-TASKPACK-20261009.md`. Use the
+Workflow-owned Task Ledger for durable task state when the task contract requires it. Observer projections
+are read-only and are never a second source of truth.
+
+## Scoped references
+
+Read repository-relative `docs/current/workflow-assistance/skill-references/observer.md` only for Observer
+delivery, or `docs/current/workflow-assistance/skill-references/external-clients.md` for Open Design /
+OpenHuman boundary work. Generic debugging or testing advice is not a separate required workflow.

.gitattributes

@@ -1,5 +1,9 @@
 * text=auto
 *.sh text eol=lf
+# Shell hooks have no extension, so `* text=auto` + core.autocrlf=true hands the working tree CRLF
+# bytes and `sh` mis-parses every line (the reason .githooks/pre-commit ran as a silent no-op until
+# 2026-10-10, ERR-261). Hooks must stay LF in the checkout, not just in the object.
+.githooks/** text eol=lf
 *.yml text eol=lf
 *.yaml text eol=lf
 *.json text eol=lf
@@ -8,3 +12,9 @@
 *.psd filter=lfs diff=lfs merge=lfs -text
 *.mp4 filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
+# Immutable 2026-10-09 input/snapshot bytes: preserve original line endings and hashes.
+taskpacks/history/UI-PRIORITY-CUTOVER-20261009/original-tree/** -text -diff
+docs/history/owner-inputs/20261009/ui-readable/** -text -diff
+docs/history/owner-inputs/20261009/final-readable/** -text -diff
+# Lossless owner-source bytes; authored indexes/registries outside originals remain text.
+docs/history/owner-inputs/record-20261009/originals/** -text -diff

.githooks/pre-commit

@@ -1,8 +1,17 @@
 #!/usr/bin/env bash
-# pre-commit hook — WORK-LAB 自动同步 CURRENT_STATE（免手动重生成）
+# pre-commit hook — keep .project/governance/generated/CURRENT_STATE.{json,md} in step with the commit.
 #
-# 背景: 手动重生成 CURRENT_STATE 是哈希噪音的来源（每次改 tracked 文件都要跑）。
-# 此 hook 在提交时自动检测 tracked 改动并重生成 digest + stage，开发者无感。
+# 背景: 手动重生成 CURRENT_STATE 是哈希噪音的来源（每次改 tracked 文件都要跑），所以放在提交时自动做。
+#
+# 2026-10-10 修复（ERR-261）: 这个 hook 曾经长期静默空转，两个原因叠在一起——
+#   1) 它调用裸 `python`。这台机器上 PATH 里没有 python（项目解释器是
+#      `.project-local/toolchains/wl-py311/Scripts/python.exe`，与 CI 一致），于是
+#      `if python … >/dev/null 2>&1` 为假，什么都不做；
+#   2) 即使跑成，它 `git add` 的是收敛前布局的 `00-governance/generated/CURRENT_STATE.*`，
+#      真实产物在 `.project/governance/generated/`，所以生成的字节从不进入提交。
+# 两者都带 `exit 0`，所以本地门一直绿，而 CI 的 `--check-current` 在 47d13507 上读到
+# recorded=3992b069931e / recomputed=55f3237b0127。现在：解释器按声明的顺序解析，路径改成真实
+# 产物，任何一步失败都让提交失败并说明原因——把“投影过期”静默发布出去正是这个 hook 存在的理由的反面。
 #
 # 启用: git config core.hooksPath .githooks
 # 跳过: git commit --no-verify（不推荐，需显式理由）
@@ -12,13 +21,42 @@ ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
 # 空提交/无 staged 改动则跳过
 git diff --cached --quiet 2>/dev/null && exit 0
 
-# 收集 staged 的 tracked 改动（排除 CURRENT_STATE 自身，避免循环）
-CHANGED="$(git diff --cached --name-only 2>/dev/null | grep -vE '^00-governance/generated/CURRENT_STATE\.(json|md)$' | grep -vE '^\.hermes/')"
+PROJECTION_JSON=".project/governance/generated/CURRENT_STATE.json"
+PROJECTION_MD=".project/governance/generated/CURRENT_STATE.md"
+GENERATOR="$ROOT/scripts/ci/generate_current_state.py"
+
+# 收集 staged 的 tracked 改动（排除投影自身，避免循环）
+CHANGED="$(git diff --cached --name-only 2>/dev/null | grep -vE "^\.project/governance/generated/CURRENT_STATE\.(json|md)$" | grep -vE '^\.hermes/')"
+
+if [ -z "$CHANGED" ]; then
+  exit 0
+fi
 
-if [ -n "$CHANGED" ]; then
-  # 重生成 CURRENT_STATE（失败不阻断提交，仅记录）
-  if python "$ROOT/scripts/ci/generate_current_state.py" --root "$ROOT" >/dev/null 2>&1; then
-    git add 00-governance/generated/CURRENT_STATE.json 00-governance/generated/CURRENT_STATE.md 2>/dev/null
+PY=""
+for candidate in "$ROOT/.project-local/toolchains/wl-py311/Scripts/python.exe" \
+                 "$ROOT/.project-local/toolchains/wl-py311/bin/python" \
+                 python python3; do
+  if command -v "$candidate" >/dev/null 2>&1 || [ -x "$candidate" ]; then
+    PY="$candidate"
+    break
   fi
+done
+if [ -z "$PY" ]; then
+  echo "PRE_COMMIT_FAIL no python interpreter: expected the declared project toolchain" >&2
+  echo "  (.project-local/toolchains/wl-py311/Scripts/python.exe) or python/python3 on PATH." >&2
+  echo "  Refusing to commit a tree whose CURRENT_STATE projection would go stale." >&2
+  exit 1
+fi
+
+if ! "$PY" "$GENERATOR" --root "$ROOT"; then
+  echo "PRE_COMMIT_FAIL $PY $GENERATOR --root $ROOT exited non-zero;" >&2
+  echo "  the projection was NOT regenerated — fix the generator, do not commit past it." >&2
+  exit 1
+fi
+
+if ! git add -- "$PROJECTION_JSON" "$PROJECTION_MD"; then
+  echo "PRE_COMMIT_FAIL git add -- $PROJECTION_JSON $PROJECTION_MD failed;" >&2
+  echo "  regenerated bytes would not reach the commit." >&2
+  exit 1
 fi
 exit 0

.github/workflows/wlr-060-gates.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Validate all JSON schemas
-        run: python -c "import json,glob; [json.load(open(f)) for f in glob.glob('packages/contracts/schemas/**/*.json',recursive=True)]; print('ALL SCHEMAS VALID')"
+        run: python -c "import json,glob; [json.load(open(f, encoding='utf-8')) for f in sorted(glob.glob('packages/contracts/schemas/**/*.json', recursive=True))]; print('ALL SCHEMAS VALID')"
 
   observer-readonly:
     name: observer-readonly
@@ -62,7 +62,7 @@ jobs:
           python - <<'PY'
           import json, pathlib
           p = pathlib.Path(pathlib.os.environ["CAPSULE_TMP"]) / "capsule.json"
-          cap = json.loads(p.read_text())
+          cap = json.loads(p.read_text(encoding="utf-8"))
           cap["content"]["body"] += "tampered"
           (pathlib.Path(pathlib.os.environ["CAPSULE_TMP"]) / "bad-hash.json").write_text(json.dumps(cap))
           PY
@@ -72,7 +72,7 @@ jobs:
           # negative control 2: wrong schema_version must fail closed
           python - <<'PY'
           import json, pathlib, os
-          cap = json.loads((pathlib.Path(os.environ["CAPSULE_TMP"]) / "capsule.json").read_text())
+          cap = json.loads((pathlib.Path(os.environ["CAPSULE_TMP"]) / "capsule.json").read_text(encoding="utf-8"))
           cap["schema_version"] = "work-lab/context-capsule/v999"
           (pathlib.Path(os.environ["CAPSULE_TMP"]) / "bad-version.json").write_text(json.dumps(cap))
           PY
@@ -96,7 +96,7 @@ jobs:
           mkdir -p "$CC_TMP"
           # positive chain up to approval: create -> plan -> approve
           python services/policy/config_compiler.py create \
-            --client hermes --type field --target display.language \
+            --client hermes --type set-field --target display.language \
             --value '"zh"' --output "$CC_TMP/intent.json"
           python services/policy/config_compiler.py plan --intent "$CC_TMP/intent.json"
           python services/policy/config_compiler.py approve --intent "$CC_TMP/intent.json"

.github/workflows/work-lab-gate.yml

@@ -79,6 +79,12 @@ jobs:
           python services/orchestration/run_quality_gate.py context-pack
           python services/orchestration/run_quality_gate.py client-neutral-manifest
           python services/orchestration/run_quality_gate.py core-schemas
+          # ERR-261/263/264 recorded the same blind spot three times: this stage runs the root tests/ci
+          # governance suite (44 modules -- the register's table shape and commit pins, the authority-index
+          # reference checks, the tool inventory) and no workflow invoked it, so a red there was invisible on
+          # push while every CI check stayed green. The chain above stops at its first failure, which is why
+          # a stage list has to be named in full rather than assumed covered.
+          python services/orchestration/run_quality_gate.py root-governance-suite
           python tests/workflow-assistance/test_platform_identity.py
           python tests/workflow-assistance/test_instance_reconciler.py
           python tests/workflow-assistance/test_config_ownership.py
@@ -207,9 +213,23 @@ jobs:
       - name: Build the real Tauri desktop binary (MSVC, for U19 E2E)
         working-directory: apps/observer/src-tauri
         run: cargo build --release --locked
+      - name: Record the artifact input receipt
+        # ERR-105: the receipt must be written by the build side, immediately
+        # after the compiler, so it attests to a build that was observed. The
+        # gate only reads it. Without it the gate falls back to content
+        # evidence and says so in its own report.
+        working-directory: .
+        run: python apps/observer/scripts/write_artifact_receipt.py
       - name: U19 real-WebView E2E readback (WINDOWS_TAURI_E2E)
         working-directory: apps/observer
         run: python scripts/u19_webview_e2e.py
+      # G3: required now that the instrument has produced a real GEOMETRY_GATE_PASS readback (ERR-146 states
+      # the condition). It measures the bundle this job just built, at each window's declared shape: the main
+      # shell at 1280x820 and the floating panel at 440x780. A refusal exits 3 and names why, which is a red
+      # on purpose — the gate cannot report green without a measurement.
+      - name: Desktop geometry gate (CDP measurement of the built shell)
+        working-directory: .
+        run: python scripts/audit/topbar_geometry_via_cdp.py --json-out .project-local/runs/ci/geometry_gate.json
 
   supply-chain-security:
     name: supply-chain-security
@@ -272,6 +292,18 @@ jobs:
         run: python scripts/ci/verify_project_data_boundary.py
       - name: Verify authority-reference integrity (A03)
         run: python scripts/ci/verify_project_authority_reference.py
+      - name: Verify blueprint coverage matrix and its projection
+        # The matrix under .project/governance is the single mutable source; the
+        # docs/future projection must match it, AG and U rows are re-extracted
+        # from the live files so no row can be dropped or invented, anchors must
+        # resolve, and no artifact may carry its own digest.
+        run: python scripts/ci/verify_blueprint_coverage.py
+      - name: Verify the future-candidate pool has row-level coverage
+        # The §16 table is landed with row keys 16.NN, so registry coverage is a
+        # name-level check instead of the count arithmetic (19 - 14 = 5) that hid
+        # six unregistered rows. A row with no candidate, or a candidate naming a
+        # row that does not exist, fails the gate.
+        run: python scripts/ci/verify_future_candidate_registry.py
       - name: Run authority-reference negative controls
         run: python tests/ci/test_project_authority_reference.py
       - name: Verify supply-chain pins

.gitignore

@@ -44,3 +44,11 @@ config/.backups/
 
 # UI design-reference assets (extracted from the UI kit; design reference, not shipped source)
 .ui-reference/
+
+# Git LFS writes these four into core.hooksPath (.githooks) when `git lfs install` runs.
+# They are per-clone tooling, not work product: .githooks/pre-commit stays tracked, and
+# committing the LFS stubs would bake one machine's LFS state into every other clone.
+.githooks/post-checkout
+.githooks/post-commit
+.githooks/post-merge
+.githooks/pre-push