macstudio-3 · Nov 4, 2026 · Nov 3, 2026
diff --git a/README.md b/README.md
@@ -2,9 +2,9 @@
 
 English canonical public documentation. [Chinese companion](./README.zh-CN.md).
 
-`consensus-rnd` publishes Agent Skills for Claude Code, Codex, Cursor, and Gemini. Its `sshx` skill brings isolated worker perspectives to a high-risk decision or implementation task, converges on a concrete plan, and checks the result through independent review. The deliverable is a prompt contract and its supporting files, shared across platform manifests.
+`consensus-rnd` publishes Agent Skills for Claude Code, Codex, Cursor, and Gemini. Its `sshx` skill brings isolated worker perspectives to an authorized decision or implementation task, converges on a concrete plan, and checks the result through independent review. The deliverable is a prompt contract and its supporting files, shared across platform manifests.
 
-Use it when product, architecture, correctness, safety, or cost risks justify separate perspectives. Routine one-step answers whose outcome would not change do not justify the protocol's cost. See the [trigger and exclusions](./skills/sshx/SKILL.md#trigger).
+Activate it only for an explicit request for consensus, multi-angle thinking or delegated review, or an applicable host/repository mandate. Risk alone and a generic architecture review request do not activate it; within authorization, weigh whether separate perspectives justify the cost. See the [trigger and exclusions](./skills/sshx/SKILL.md#trigger).
 
 ## What It Provides
 
@@ -57,6 +57,8 @@ The [review triplet](./skills/sshx/SKILL.md#review-triplet) applies the [review
 
 A [termination gate](./skills/sshx/SKILL.md#termination-gate) applies inside the final stage only when the host has positively declared a goal-driven continuation mechanism in the [goal contract](./skills/sshx/SKILL.md#goal-contract), and an affirmative satisfaction claim is being considered. It is not an eighth stage and grants no control over the host mechanism.
 
+Only confirmed defects against the current goal or an existing contract enter automatic repairs. Findings retain `evidence_status` and `user_goal_basis`; uncertain changes to product or permission semantics go to their owner for clarification. A user correction cancels dependent stale plan, review and repair authority while preserving history and active-job protection. See [goal corrections](./skills/sshx/SKILL.md#goal-contract) and [admission](./skills/sshx/SKILL.md#reasoning-discipline).
+
 ## Risks and Limits
 
 - **Broad execution access:** the Codex runner defaults to `danger-full-access`. Read the [invocation contract](./skills/sshx/CODEX_WORKER_SPEC.md#invocation) and [threat model](./skills/sshx/CODEX_WORKER_SPEC.md#threat-model) before supplying a work target.
@@ -106,6 +108,24 @@ The plugin identity is declared in the [marketplace](./.claude-plugin/marketplac
 
 The [Codex](./.codex-plugin/plugin.json) and [Cursor](./.cursor-plugin/plugin.json) manifests both declare `"skills": "./skills/"`. Use the platform's plugin support to load the repository and read the [skill contract](./skills/sshx/SKILL.md); installation and invocation details depend on the host.
 
+### Verify the effective copy and refresh manually
+
+Before dispatch, [worker delegation](./skills/sshx/SKILL.md#worker-delegation) records the actually read skill path, SHA-256, available checkout revision/dirty state, and current Heca policy in existing gate evidence. A manifest version or upstream release cannot identify a copied or locally edited skill, or prove an open session adopted it. Explicit user disable wins opt-in on every route, including retry, fallback, repair and resume; tools alone never opt in.
+
+Inspect the path reported by the host, following any symlink, rather than assuming an installation directory. For a checkout, these read-only commands distinguish bytes from revision and manifest metadata:
+
+```bash
+shasum -a 256 <effective-skill-root>/SKILL.md
+git -C <source-checkout> rev-parse HEAD
+git -C <source-checkout> status --short
+```
+
+Compare the effective file with the intended checkout's `skills/sshx/SKILL.md` using `diff`; also compare supporting files because the whole skill directory is the distribution unit. A copied installation may have no Git revision: report that limitation and keep the content hash. None of these observations proves current-session adoption. Confirm the newly read path/hash and policy in the next run; if the host cannot expose that association, label adoption `ASSUMED-UNVERIFIED`.
+
+Manual refresh is an owner action, never automatic sshx behavior. For a direct-folder installation, refresh the entire resolved skill directory from a verified checkout using the host's supported skill installation procedure, then compare again. [Official Codex skills guidance](https://developers.openai.com/codex/skills/) documents discovery locations, symlink support and automatic change detection; restart Codex if an update does not appear. When multiple copies exist, verify the selected path. This does not assert that a legacy `~/.codex/skills` copy is the selected source or that an existing session reloaded it.
+
+For the Claude marketplace installation above, [official plugin guidance](https://code.claude.com/docs/en/discover-plugins#update-plugins-now) documents `claude plugin update consensus-rnd@consensus-rnd`, then `/reload-plugins` to apply updated disk content to the session. Use the installed host's supported UI if that command is unavailable. For Cursor and Gemini, use their installed plugin/extension manager and confirm the effective source again; no reload command or adoption behavior is claimed here. These official owner procedures were not exercised on this host: local refresh/reload remains `ASSUMED-UNVERIFIED`. The skill executes no refresh or host/global setting change.
+
 ### Gemini CLI
 
 The [extension manifest](./gemini-extension.json) selects `GEMINI.md` as its context file. [GEMINI.md](./GEMINI.md) lists the available skill and directs the agent to read its contract on demand.

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -2,9 +2,9 @@
 
 中文公开文档。英文 canonical：[README.md](./README.md)。
 
-`consensus-rnd` 为 Claude Code、Codex、Cursor 和 Gemini 发布 Agent Skills。`sshx` 用隔离的 worker 视角处理高风险决策或实现任务，收敛出具体方案，再由独立 review 检查产物。交付物是 prompt 合同及其配套文件，由各平台清单共享。
+`consensus-rnd` 为 Claude Code、Codex、Cursor 和 Gemini 发布 Agent Skills。`sshx` 用隔离的 worker 视角处理获授权的决策或实现任务，收敛出具体方案，再由独立 review 检查产物。交付物是 prompt 合同及其配套文件，由各平台清单共享。
 
-当产品、架构、正确性、安全或成本风险值得投入多个视角时使用。若常规一步式回答不会因增加视角而改变结果，就不值得承担协议成本。详见[触发条件与排除项](./skills/sshx/SKILL.md#trigger)。
+仅在用户明确要求共识、多角度思考或委派 review，或适用的 host/仓库规则要求该流程时激活。风险或一般架构 review 请求本身不构成授权；获得授权后，再判断多个视角是否值得其成本。详见[触发条件与排除项](./skills/sshx/SKILL.md#trigger)。
 
 ## 提供什么
 
@@ -57,6 +57,8 @@
 
 只有 host 在[目标合同](./skills/sshx/SKILL.md#goal-contract)中明确声明了目标驱动的继续执行机制，且 caller 正准备肯定目标已满足时，最后阶段内部才适用[终止闸门](./skills/sshx/SKILL.md#termination-gate)。它不是第八阶段，也不授予控制 host 机制的权限。
 
+只有违反当前目标或既有合同的已确认缺陷进入自动修复。发现项保留 `evidence_status` 与 `user_goal_basis`；涉及产品或权限语义的不确定改动向 owner 澄清。用户纠正立即撤销依赖旧方案的 plan、review 与 repair 权限，同时保留历史及 active job 保护。详见[目标纠正](./skills/sshx/SKILL.md#goal-contract)与[准入](./skills/sshx/SKILL.md#reasoning-discipline)。
+
 ## 风险与限制
 
 - **宽执行权限：** Codex runner 默认使用 `danger-full-access`。提供工作目标前，请阅读[调用合同](./skills/sshx/CODEX_WORKER_SPEC.md#invocation)和[威胁模型](./skills/sshx/CODEX_WORKER_SPEC.md#threat-model)。
@@ -106,6 +108,24 @@ Host 必须为 runner 派发提供带完成通知的后台执行、超时和整
 
 [Codex](./.codex-plugin/plugin.json) 与 [Cursor](./.cursor-plugin/plugin.json) 清单都声明 `"skills": "./skills/"`。通过平台插件支持加载仓库并阅读 [skill 合同](./skills/sshx/SKILL.md)；安装与调用细节取决于 host。
 
+### 核对有效副本与手动刷新
+
+派发前，[worker delegation](./skills/sshx/SKILL.md#worker-delegation) 在已有 gate 证据中记录实际读取的 skill 路径、SHA-256、可用的 checkout 修订/脏状态与本轮 Heca 政策。清单版本或上游 release 不能标识复制或本地修改的副本，也不能证明当前会话已经采用。用户明确禁用优先于 opt-in，覆盖重试、fallback、修复与恢复；仅工具暴露永不构成 opt-in。
+
+检查 host 报告的路径并跟随符号链接，不预设安装目录。对于 checkout，可用以下只读命令区分内容、修订与清单元数据：
+
+```bash
+shasum -a 256 <effective-skill-root>/SKILL.md
+git -C <source-checkout> rev-parse HEAD
+git -C <source-checkout> status --short
+```
+
+用 `diff` 将有效文件与目标 checkout 的 `skills/sshx/SKILL.md` 比较，同时核对配套文件：整个 skill 目录才是分发单位。复制安装可能没有 Git 修订，应报告此限制并保留内容 hash。这些观察均不能证明当前会话已采用；下一次运行须确认新读取的路径/hash 和政策。host 无法提供这一关联时，采用状态标为 `ASSUMED-UNVERIFIED`。
+
+手动刷新由 owner 执行，不是 sshx 自动行为。直接目录安装应通过 host 支持的 skill 安装流程，从已核对的 checkout 刷新整个已解析目录，然后重新比较。[Codex 官方 skills 文档](https://developers.openai.com/codex/skills/) 说明发现位置、符号链接支持与自动检测变更；更新未出现时重启 Codex。存在多个副本时，须确认选中的路径；这不意味着旧 `~/.codex/skills` 副本就是有效来源，也不证明已有会话已重载。
+
+上述 Claude marketplace 安装的[官方 plugin 文档](https://code.claude.com/docs/en/discover-plugins#update-plugins-now) 给出 `claude plugin update consensus-rnd@consensus-rnd`，再用 `/reload-plugins` 将磁盘更新应用到会话；所装 host 无此命令时使用其支持的 UI。Cursor 与 Gemini 使用已安装的 plugin/extension manager，再核对有效来源；此处不声明其重载命令或采用行为。上述官方 owner 流程未在本 host 实测，本地刷新/重载仍为 `ASSUMED-UNVERIFIED`；skill 不执行刷新命令，不修改 host/全局设置。
+
 ### Gemini CLI
 
 [扩展清单](./gemini-extension.json)选择 `GEMINI.md` 作为上下文文件。[GEMINI.md](./GEMINI.md) 列出可用 skill，并指示 agent 按需读取合同。

diff --git a/skills/sshx/CODEX_WORKER_SPEC.md b/skills/sshx/CODEX_WORKER_SPEC.md
@@ -142,6 +142,20 @@ atomic rename for those artifacts. It also states the envelope's structural
 acceptance conditions and includes one runner-rendered, stage-specific minimum
 valid envelope example.
 
+The actual injected brief must convey exclusive ownership: worker writes only result,
+sentinel and their same-directory publication temporaries; stdout/stderr/last-message,
+brief/status/exit and their temporaries are runner-owned and must not be created,
+overwritten, appended, repaired, normalized or forged by the worker. `log_ref` is copied
+as an opaque reference to the existing diagnostic sink, without opening its body or
+creating a narrative log; another existing reference needs explicit task supply.
+All work/checks precede publication. The last worker tool action atomically publishes
+result then sentinel, and the worker immediately returns its compact final reply with
+no further tool, artifact inspection or rewrite. These prompt obligations do not impose
+same-user filesystem protection. Simulation may demonstrate violations; it does not
+prove real workers comply, nor establish timeout causality. A post-sentinel rewrite or
+log overwrite cannot replace successful terminal carrier observation. The runner does
+not audit write history or strengthen/weaken the completion predicate to do so.
+
 Launch receipts and pure queries are the only sanctioned path discovery mechanisms for the
 batch, status-read, cleanup, and sweep scripts and for the oracle runner. Those scripts contain no
 run-layout formula, attempt naming rule, or artifact basename and do not parse