Continue collaboration state

Owner-authorized dot exception

The owner-authorized dot exemption in internal/agent-operations/contributor-agents.md takes precedence over this leaf's ModelTrace-specific sampling, record/context and disclosure requirements. When acting as dot, do not sample or invent a ModelTrace record: visibly identify Agent: dot and the exact not-measured exemption declaration at every write. Use the supported publisher's explicit dot branch or the guide's real connected-service path; never fake a measured artifact, a successful validator, or live gh responses. The exemption grants no action permission, model authentication, independent approval or repository-rule bypass. All non-ModelTrace inputs and existing authorization, exact-head/tree, DCO, CI, independent-review and readback requirements remain. Other Agents follow the measured path below unchanged.

1. Require a current capability envelope, one purpose-bound request validated by internal/agent-operations/schemas/collaboration-request.schema.json, an exact target, and current-user or active standing mutation authorization. Bind the handoff's collaboration-request digest and mutation-authorization reference to that request. Autonomous collaboration without verified owner delegation currently fails closed: a fresh C2-or-higher assessment, an active proto-ui-scheduled-collaboration-v1 scope, and caller-supplied governed-outcome hashes cannot replace the unimplemented trusted publication verifier. Keep that generic future producer/publication contract as a separate governed decision. Verified owner-delegated ordinary collaboration uses its separately authenticated owner profile and may continue without that generic verifier or repeated assessment admission; pass the trusted owner options and bind the request to its grant. Require a current content-bound modeltrace-record in both modes, including owner-delegated work; bind its exact private reference and canonical public-receipt digest on the handoff. Validate against independently supplied current context. Include the generated public disclosure in authorized comments or actual replacement bodies before sealing; title/label-only changes preserve historical bodies. ModelTrace is unsigned closed-set attribution, not identity authentication, permission, independent review or acceptance, and cannot replace the owner proof. Missing, expired or changed-scope records return through the entrypoint for remeasurement; ambiguous/failed results and anomalies stay explicit.
2. Execute writes only through corepack pnpm@10.32.1 agent:collaborate -- apply --mode <execution-mode> --mode-source <trusted-source> --request <request.json> --handoff <handoff.json> --record <record.json> --context <context.json> [--assessment <result.json>]. Local validate requires the same explicit mode/source, request and handoff, retaining structural artifact/digest, purpose and eligibility checks; it neither reads private ModelTrace files nor returns a measured receipt. Validation without a current measurement is not write admission. The trusted launcher or operator must supply invocation declarations before reading task-authored content, never derive them from the handoff. Mode/source must exactly match the handoff; apply additionally requires the record reference/digest to bind the same fresh record supplied by the CLI. Missing, invalid, or conflicting declarations reject before external reads. Human-assisted sources are current-user or active-human-loop; autonomous sources are maintainer-invocation, schedule, or governed-queue. Human-assisted requests without verified owner delegation require current-user-instruction purpose evidence; governed-outcome alone cannot substitute. The runtime preserves the independent invocation declaration through final admission, recomputes the canonical request digest, and re-reads the target immediately before writing, binding repository identity, Issue or pull-request number, current updatedAt, and head SHA, workflow run, review-thread ID, or metadata state as applicable. Do not issue an equivalent GitHub write directly.
3. Apply exactly one authorized reversible action:
   • repair an Issue or pull-request title, body, milestone, assignee, or existing routing label when current authority fixes the target state;
   • inspect an exact update-branch request with expected_head_sha equal to the live head: an exact already-satisfied base remains a zero-write no-op. A current behind-branch mutation rejects because GitHub cannot bind its generated commit message to ModelTrace. Under separate exact branch authorization, merge locally with --no-commit, then use controlled agent:publish -- commit with the canonical commit disclosure and re-collect the head; never bypass branch permissions/rules or create an undisclosed generated commit;
   • mark an exact head ready for review after the governed scope and required validation evidence are present;
   • request an eligible independent reviewer;
   • resolve one exact review thread only after live evidence shows its finding is fixed or superseded. Before sealing its request, run the read-only corepack pnpm@10.32.1 agent:collaborate -- thread-revision --repository <github.com:owner/repo> --pull-request <number> --thread <thread-id>, copy its complete target into a new request, add resolution evidence and current authorization, then run request-digest. The target binds threadUpdatedAt and threadRevisionDigest; the latter hashes the thread ID and complete sorted comment IDs, authors, exact bodies, and update timestamps. Empty, malformed, duplicate-ID, or truncated comment collections fail closed. An old request without the digest requires fresh collection and a new request; preserve historical input bytes rather than adding a default hash or silently upgrading them;
   • rerun one exact trusted workflow run or its failed jobs after diagnosing the failure and confirming the run still targets the intended head; or
   • post one bounded reconciliation or progress comment whose content and target are already authorized.
4. Accept only a receipt validated against internal/agent-operations/schemas/collaboration-receipt.schema.json. It binds the request digest and exact target and records pre/post state digests, actor, returned platform identity, mutation count, reconciliation count, and verified result. A valid request rejected by the initial or final live authorization gate returns outcome: rejected with live-authorization-rejected, zero mutation/reconciliation counts, no platform object and the observed rejection reason. This is a no-write disposition, not evidence that the desired change happened. Invalid requests or unavailable live evidence remain errors rather than fabricated receipts. Current receipts are schema v2 and embed public modelTrace; historical schema v1 remains read-only compatible. Never publish samples, private context/session IDs, private conversation, operational or account circumstances.
5. Treat an already-satisfied result as an idempotent zero-mutation no-op with evidence. Attempt at most one mutation. After an unknown outcome, reconcile live state exactly once and attribute success only when the platform object proves this invocation's exact action; never retry blindly.
6. Route the resulting state to pui-pr, pui-ci, pui-review, or another eligible leaf without performing that leaf's action here. Continue portfolio processing when one item is stale, conflicted, or lacks permission.

Current authority and repository rules determine the target state; this leaf does not invent semantic readiness, dismiss active findings, bypass DCO or CI, force-update a branch, or weaken protection. Use pui-review for COMMENT, REQUEST_CHANGES, or APPROVE, and pui-integrate for merge. Publication, release, access, secrets, applications, rulesets, branch protection, security disclosure, provenance exceptions, and other privileged or difficult-to-reverse operations remain outside this scope.

The standalone CLI mode arguments and purpose evidence are operator declarations, not runtime attestation or authenticated user instructions. This repository cannot authenticate a caller that forges matching arguments and files, and the CLI is not a token sandbox. A trusted launcher must control invocation context and credential access independently of task content. These admission checks do not activate the blocked autonomous publication path.

threadRevisionDigest detects collected comment changes, including replies, edits, and deletions sharing a timestamp. It is not identity, authorization, or proof that a finding is fixed. Preflight, final pre-write admission, already-resolved no-op, and post-write verification retain the existing head, permission, and timestamp boundaries and compare the digest. Collection remains bounded to one complete page of at most 100 comments; a truncated page is rejected. Neither collection nor the read-to-write interval is an atomic snapshot or server-side compare-and-swap guarantee.

Explicit handoff

Do not load or execute another skill. Return exactly one handoff conforming to internal/agent-operations/schemas/skill-handoff.schema.json. Carry required prior artifacts by reference, include the registered mutation receipt, and set nextSkillId to one eligible registered leaf or null.

Communicate with the user in the user's current language. Keep repository, Issue, pull-request, thread, workflow, and revision identifiers exact.

Durable owner continuation

Read internal/agent-operations/handoff.md when a trusted runner supplies durable owner delegation. Pass its --owner-authorization, --owner-key and --owner-grant options to supported commands; bind mutation authorization to the same grant ID. Covered ordinary work continues across turns without repeated human confirmation or assessment admission. Keep the actual mode/source, exact target, live permissions, evidence and independent review. Reference strings and task-authored files cannot activate delegation. Privileged and unresolved semantic decisions remain separate.