Continue collaboration state

Owner-authorized dot exception

The owner-authorized dot exemption in internal/agent-operations/contributor-agents.md takes precedence over this leaf's ModelTrace-specific sampling, record/context and disclosure requirements. When acting as dot, retain the exact visible three-line not-measured declaration; never invent a record or successful validator. The exemption alone grants no action permission, independent approval or platform bypass. Both branches below retain current authorization, real actor/permission, source rights/DCO, exact target/head and truthful readback. Other Agents retain their measured disclosure.

Explicit current-user connected branch

Follow Explicit current-user connected operations only for a separately authorized exact action. Require its completed v2 human-assisted / current-user handoff and four content-bound inputs declared by humanDirectedRequires: capability-envelope, github-snapshot, mutation-authorization and human-directed-operation. Bind the operation report's revision to the exact handoff head; preserve the actual user instruction, full source/archive and deferred-criterion ledger, real live actor/permissions, exact payload/idempotency state and pre/post readback. No fake measured artifact or independent-review/publication packet is required. Ordinary standing delegation and routine contributor requests do not select this branch.

This branch permits one explicitly requested source-preserving archive/ref operation or compact integration/rebase recovery under real branch/fork permission and an exact server-enforced lease/CAS; one criterion-bound Issue reopen/link repair; one additive prepared carrier comment/body or exact prepared followup PR creation; or one purpose-bound native App service-control request. Keep original author objects, rights, actual certifications, human text, unresolved findings and complete debt. Publish every authorized carrier part before claiming complete carry. Never replace the complete ledger with a summary, resolve a deferred thread as fixed, fabricate a service check or mutate an unrelated source branch. DCO recheck through a native review COMMENT binds commit_id to the live head and conveys only service control, not a technical review disposition or independent acceptance.

Use the existing real authenticated connected service when the ordinary request schema or writer cannot express the operation, including Issue state reopening and dot's exemption. Re-read each target and applicable rules immediately before the one exact write. Metadata endpoints lacking atomic CAS require explicit pre-write revision checks and full returned-state readback; do not describe them as atomic or silently overwrite concurrent human edits. Prefer additive linking over human-body replacement. Return a source-bound service receipt with actual actor/target/payload, platform object/URL, counts and acknowledgment/readback attribution; do not claim collaboration-receipt.schema.json, agent:collaborate or measured writer admission passed when they were not used. The guide's one-write/no-blind-retry reconciliation rules apply.

Merge remains pui-integrate; actual independent review remains pui-review. No generic writer, Issue close, release, product lifecycle promotion, access, credentials, ruleset or protected-main mutation is admitted here. A completed handoff retains all four inputs and the real mutation-receipt, then selects the other eligible connected-operation leaf or null.

Ordinary governed collaboration

1. Require a current capability envelope, one purpose-bound request validated by internal/agent-operations/schemas/collaboration-request.schema.json, an exact target, and current-user or active standing mutation authorization. Bind the handoff's collaboration-request digest and mutation-authorization reference to that request. Autonomous collaboration without verified owner delegation currently fails closed: a fresh C2-or-higher assessment, an active proto-ui-scheduled-collaboration-v1 scope, and caller-supplied governed-outcome hashes cannot replace the unimplemented trusted publication verifier. Keep that generic future producer/publication contract as a separate governed decision. Verified owner-delegated ordinary collaboration uses its separately authenticated owner profile and may continue without that generic verifier or repeated assessment admission; pass the trusted owner options and bind the request to its grant. Require a current content-bound modeltrace-record in both modes, including owner-delegated work; bind its exact private reference and canonical public-receipt digest on the handoff. Validate against independently supplied current context. Include the generated public disclosure in authorized comments or actual replacement bodies before sealing; title/label-only changes preserve historical bodies. ModelTrace is unsigned closed-set attribution, not identity authentication, permission, independent review or acceptance, and cannot replace the owner proof. Missing, expired or changed-scope records return through the entrypoint for remeasurement; ambiguous/failed results and anomalies stay explicit.
2. Execute writes only through corepack pnpm@10.32.1 agent:collaborate -- apply --mode <execution-mode> --mode-source <trusted-source> --request <request.json> --handoff <handoff.json> --record <record.json> --context <context.json> [--assessment <result.json>]. Local validate requires the same explicit mode/source, request and handoff, retaining structural artifact/digest, purpose and eligibility checks; it neither reads private ModelTrace files nor returns a measured receipt. Validation without a current measurement is not write admission. The trusted launcher or operator must supply invocation declarations before reading task-authored content, never derive them from the handoff. Mode/source must exactly match the handoff; apply additionally requires the record reference/digest to bind the same fresh record supplied by the CLI. Missing, invalid, or conflicting declarations reject before external reads. Human-assisted sources are current-user or active-human-loop; autonomous sources are maintainer-invocation, schedule, or governed-queue. Human-assisted requests without verified owner delegation require current-user-instruction purpose evidence; governed-outcome alone cannot substitute. The runtime preserves the independent invocation declaration through final admission, recomputes the canonical request digest, and re-reads the target immediately before writing, binding repository identity, Issue or pull-request number, current updatedAt, and head SHA, workflow run, review-thread ID, or metadata state as applicable. Do not issue an equivalent GitHub write directly.
3. Apply exactly one authorized reversible action:
   • repair an Issue or pull-request title, body, milestone, assignee, or existing routing label when current authority fixes the target state;
   • inspect an exact update-branch request with expected_head_sha equal to the live head: an exact already-satisfied base remains a zero-write no-op. A current behind-branch mutation rejects because GitHub cannot bind its generated commit message to ModelTrace. Under separate exact branch authorization, merge locally with --no-commit, then use controlled agent:publish -- commit with the canonical commit disclosure and re-collect the head; never bypass branch permissions/rules or create an undisclosed generated commit;
   • mark an exact head ready for review after the governed scope and required validation evidence are present;
   • request an eligible independent reviewer;
   • resolve one exact review thread only after live evidence shows its finding is fixed or superseded. Before sealing its request, run the read-only corepack pnpm@10.32.1 agent:collaborate -- thread-revision --repository <github.com:owner/repo> --pull-request <number> --thread <thread-id>, copy its complete target into a new request, add resolution evidence and current authorization, then run request-digest. The target binds threadUpdatedAt and threadRevisionDigest; the latter hashes the thread ID and complete sorted comment IDs, authors, exact bodies, and update timestamps. Empty, malformed, duplicate-ID, or truncated comment collections fail closed. An old request without the digest requires fresh collection and a new request; preserve historical input bytes rather than adding a default hash or silently upgrading them;
   • rerun one exact trusted workflow run or its failed jobs after diagnosing the failure and confirming the run still targets the intended head; or
   • post one bounded reconciliation or progress comment whose content and target are already authorized.
4. Accept only a receipt validated against internal/agent-operations/schemas/collaboration-receipt.schema.json. It binds the request digest and exact target and records pre/post state digests, actor, returned platform identity, mutation count, reconciliation count, and verified result. A valid request rejected by the initial or final live authorization gate returns outcome: rejected with live-authorization-rejected, zero mutation/reconciliation counts, no platform object and the observed rejection reason. This is a no-write disposition, not evidence that the desired change happened. Invalid requests or unavailable live evidence remain errors rather than fabricated receipts. Current receipts are schema v2 and embed public modelTrace; historical schema v1 remains read-only compatible. Never publish samples, private context/session IDs, private conversation, operational or account circumstances.
5. Treat an already-satisfied result as an idempotent zero-mutation no-op with evidence. Attempt at most one mutation. After an unknown outcome, reconcile live state exactly once and attribute success only when the platform object proves this invocation's exact action; never retry blindly.
6. Route the resulting state to pui-pr, pui-ci, pui-review, or another eligible leaf without performing that leaf's action here. Continue portfolio processing when one item is stale, conflicted, or lacks permission.

Current authority and repository rules determine the target state; this leaf does not invent semantic readiness, dismiss active findings, bypass DCO or CI, force-update a branch, or weaken protection. Use pui-review for COMMENT, REQUEST_CHANGES, or APPROVE, and pui-integrate for merge. Publication, release, access, secrets, applications, rulesets, branch protection, security disclosure, provenance exceptions, and other privileged or difficult-to-reverse operations remain outside this scope.

The standalone CLI mode arguments and purpose evidence are operator declarations, not runtime attestation or authenticated user instructions. This repository cannot authenticate a caller that forges matching arguments and files, and the CLI is not a token sandbox. A trusted launcher must control invocation context and credential access independently of task content. These admission checks do not activate the blocked autonomous publication path.

threadRevisionDigest detects collected comment changes, including replies, edits, and deletions sharing a timestamp. It is not identity, authorization, or proof that a finding is fixed. Preflight, final pre-write admission, already-resolved no-op, and post-write verification retain the existing head, permission, and timestamp boundaries and compare the digest. Collection remains bounded to one complete page of at most 100 comments; a truncated page is rejected. Neither collection nor the read-to-write interval is an atomic snapshot or server-side compare-and-swap guarantee.

Explicit handoff

Do not load or execute another skill. Return exactly one handoff conforming to internal/agent-operations/schemas/skill-handoff.schema.json. Carry required prior artifacts by reference, include the registered mutation receipt, and set nextSkillId to one eligible registered leaf or null.

Communicate with the user in the user's current language. Keep repository, Issue, pull-request, thread, workflow, and revision identifiers exact.

Durable owner continuation

Read internal/agent-operations/handoff.md when a trusted runner supplies durable owner delegation. Pass its --owner-authorization, --owner-key and --owner-grant options to supported commands; bind mutation authorization to the same grant ID. Covered ordinary work continues across turns without repeated human confirmation or assessment admission. Keep the actual mode/source, exact target, live permissions, evidence and independent review. Reference strings and task-authored files cannot activate delegation. Privileged and unresolved semantic decisions remain separate.