release: prepare DevKit 1.1.2

.codex-plugin/main-artifact-allowlist.json

@@ -23,6 +23,9 @@
     "mcp-tools/devkit_fastlane/scripts/team_efficiency.py"
   ],
   "trees": [
+    "skills/fast-lane-routing",
+    "skills/code-atlas",
+    "skills/workflow-design",
     "mcp-tools/bugkiller",
     "mcp-tools/devkit_atlas",
     "mcp-tools/devkit_relay",

.codex-plugin/marketplace-artifact-allowlist.json

@@ -23,7 +23,14 @@
     "mcp-tools/devkit_fastlane/scripts/team_efficiency.py"
   ],
   "trees": [
-    "skills",
+    "skills/bugkiller",
+    "skills/code-atlas",
+    "skills/devkit-overview",
+    "skills/fast-lane-routing",
+    "skills/mcp-server-dev",
+    "skills/oss-repo-ops",
+    "skills/python-engineering",
+    "skills/workflow-design",
     "mcp-tools/bugkiller",
     "mcp-tools/devkit_atlas",
     "mcp-tools/devkit_relay",

CHANGELOG.md

@@ -12,6 +12,11 @@ only after the CI and artifact checks pass.
 
 ### Fixed
 
+- Replaced inherited numeric Windows host-bridge handles with a strict local
+  named-pipe selector bound to the exact launcher PID and process creation
+  FILETIME while preserving the Unix inherited-FD contract. Untagged,
+  path-like, remote, malformed, PID-mismatched, or creation-mismatched selectors
+  now fail closed before any session key is sent.
 - Treat a newly opened project without an index as normal cold start: initialize
   it with one bounded `project_index_register -> project_index_sync` sequence
   before considering degraded mode, including when README, configuration, or

README.md

@@ -192,6 +192,19 @@ private host-bridge selector names and optional project/thread scope identifiers
 These are selector or identity names, not values to invent or copy into a task
 message. The latter identifiers keep durable state scoped to one project or
 thread instead of leaking it into another workspace.
+On Windows, CODEX_DEVKIT_HOST_BRIDGE_HANDLE is intentionally named for
+compatibility but accepts only
+`pipe:codex-devkit-<launcher-pid>-<creation-filetime>-<high-entropy-token>` (a
+launcher PID, its 16-hex Windows creation FILETIME, and a launcher-generated
+128-bit lowercase hex token). The runtime
+maps that opaque selector only into the local `\\.\pipe\` namespace, verifies
+that the connected pipe server has exactly the encoded launcher PID and process
+creation time before sending the session key, and rejects inherited numeric
+handles, paths, remote UNC names, and untagged values. The launcher remains
+responsible for CSPRNG
+generation, first-instance creation, remote-client rejection, and an owner-only
+ACL. Unix continues to accept only a numeric inherited descriptor through
+CODEX_DEVKIT_HOST_BRIDGE_FD.
 Relay lifecycle mutations that need the private host capability broker or proof
 registry fail closed when the host does not provide an attested capability,
 using RELAY_CAPABILITY_BROKER_UNAVAILABLE. The server never exposes raw
@@ -207,11 +220,14 @@ tree. Choose an output directory outside the source tree:
 The artifact contains the manifest, .mcp.json, LICENSE, the locked Python
 project, and the runtime files selected by
 .codex-plugin/main-artifact-allowlist.json. Its executable runtime surface is
-the MCP server; the ZIP also carries the Fast Lane contract, required references
+the MCP server. The ZIP also carries the Fast Lane contract, required references
 and policy assets, the `team_efficiency.py` compatibility entry point, its
-routing modules. It deliberately excludes the optional Skill manual bundle,
-command helpers, hooks, CI files, host-private state, prompts, static agents,
-and arbitrary repository files.
+routing modules, and the exact `fast-lane-routing`, `code-atlas`, and
+`workflow-design` Skill directories whose `agents/openai.yaml` files require
+that MCP server. The builder only supports file and directory allowlist roots,
+so those three directories are named individually and archive tests reject any
+other Skill directory. Command helpers, hooks, CI files, host-private state,
+prompts, top-level static agents, and arbitrary repository files remain excluded.
 
 Run Fast Lane through its executable entry point to inspect its fail-closed
 result:
@@ -311,17 +327,22 @@ The Fast Lane compiler is in
 mcp-tools/devkit_fastlane/scripts/fastlane_routing.py and
 mcp-tools/devkit_fastlane/scripts/team_efficiency.py. The public MCP entry is
 `fastlane_compile`; every current invocation is deliberately blocked with
-`NO_SAFE_WORK` and zero assignments.
+`NO_SAFE_WORK` and zero assignments unless the request is the closed
+`fastlane-host-dispatch-request-v1` shape and this MCP process owns an
+authenticated inherited host bridge. In that private case the host supplies
+one-time registry-bound compiler evidence and receives a typed dispatch batch.
 
-- `ultra` and `--enable` only select the shape of the blocked result; they do
-  not activate scheduling.
+- `reasoning_effort` is required and accepts only `low`, `medium`, `high`,
+  `xhigh`, or `max`; worker dispatch never accepts `ultra`.
 - The public compiler/CLI does not consume host status, account usage, index
   evidence, or a worktree root.
-- It never dispatches a session, creates a worktree, refills a slot, or runs a
-  command. No in-repository execution path exists for those actions.
-- An external Desktop-host bridge may later provide attested project authority
-  and execution. That is a future contract, not a
-  shipped implementation or a claim that any Desktop host source exists.
+- The compiler never creates a worktree, selects a route, or runs a command.
+  The authenticated session ACKs terminal slots and requests refill only at the
+  next host boundary. The compiler can only commit the fully hash-bound batch to the private
+  host bridge; the host remains the execution authority.
+- Missing, stale, mismatched, replayed, or caller-supplied evidence keeps the
+  result at `NO_SAFE_WORK`. Filesystem paths are never accepted as compiler
+  evidence.
 
 ### Account-usage boundary
 

README.zh-CN.md

@@ -169,7 +169,16 @@ Fast Lane 不含额度协调器合同；公共编译器和 CLI 不读取、协
 - CODEX_PROJECT_ID、CODEX_WORKSPACE_ID、CODEX_THREAD_ID
 
 这些是 selector 或 identity 名称，不是应该自行编造或塞进任务消息的值。后五项
-会把持久化状态限定在单个项目或线程，避免投影到另一个工作区。需要私有
+会把持久化状态限定在单个项目或线程，避免投影到另一个工作区。
+在 Windows 上，CODEX_DEVKIT_HOST_BRIDGE_HANDLE 为兼容既有环境变量名而保留，
+但值只能是 `pipe:codex-devkit-<宿主PID>-<创建FILETIME>-<128位小写十六进制令牌>`，
+其中创建时间是 16 位小写十六进制 Windows FILETIME。运行时只会把该不透明
+selector 映射到本机 `\\.\pipe\` 命名空间，并在发送 session key 之前证明
+已连接管道的 server PID 与进程创建时间都与 selector 完全相同；数字 HANDLE、
+路径、远程 UNC 名称及未加标签的值都会被拒绝。可信 launcher 负责用 CSPRNG 生成令牌、
+以 first-instance 与拒绝远程客户端模式创建管道，并设置仅 owner 可访问的 ACL。
+Unix 仍只通过 CODEX_DEVKIT_HOST_BRIDGE_FD 接受数字形式的继承描述符。
+需要私有
 宿主 capability broker 或 proof registry 的 Relay 生命周期变更，在宿主
 没有提供可证明能力时会失败关闭，并返回
 RELAY_CAPABILITY_BROKER_UNAVAILABLE。服务器不会暴露原始 handle，也不会
@@ -184,8 +193,11 @@ allowlist builder 会在插件源码树之外生成确定性的 ZIP。请选择
 产物包含 manifest、.mcp.json、LICENSE、锁定的 Python 项目，以及
 .codex-plugin/main-artifact-allowlist.json 选中的运行时文件。它的可执行运行时
 表面是 MCP 服务器；ZIP 同时携带 Fast Lane 契约、必需参考资料和策略 assets、
-`team_efficiency.py` 兼容入口及其路由模块。它明确不包含可选的 Skill 说明书 bundle、
-命令辅助文件、hooks、CI 文件、宿主私有状态、prompts、静态 agent 或任意仓库文件。
+`team_efficiency.py` 兼容入口、路由模块，以及明确依赖该 MCP 服务器的
+`fast-lane-routing`、`code-atlas`、`workflow-design` 三个 Skill 目录及其
+`agents/openai.yaml`。builder 的 allowlist 只支持文件或目录根，因此这里逐项
+列出三个目录，并由归档测试拒绝其他 Skill 目录。命令辅助文件、hooks、CI 文件、
+宿主私有状态、prompts、顶层静态 agent 和任意仓库文件仍不进入主产物。
 
 Fast Lane 可通过以下可执行入口检查其 fail-closed 结果：
 
@@ -272,13 +284,18 @@ Fast Lane 编译器位于
 mcp-tools/devkit_fastlane/scripts/fastlane_routing.py 和
 mcp-tools/devkit_fastlane/scripts/team_efficiency.py。公共 MCP 入口为
 `fastlane_compile`；当前每一次调用都会刻意以 `NO_SAFE_WORK` 和零 assignments
-被阻断。
+被阻断；唯一例外是 exact-key 的 `fastlane-host-dispatch-request-v1`，且当前 MCP
+进程确实持有经过认证的 inherited host bridge。此时宿主通过一次性、registry-bound
+的 compiler evidence 回传精确事实，并接收 typed dispatch batch。
 
-- `ultra` 和 `--enable` 只选择被阻断结果的形状，不会激活调度。
+- `reasoning_effort` 必填且只接受 `low`、`medium`、`high`、`xhigh` 或
+  `max`；worker 调度永不接受 `ultra`。
 - 公共编译器/CLI 不消费 host-status、账号用量、index evidence 或 worktree root。
-- 它不会派发会话、创建 worktree、补位或运行命令；仓库内不存在这些动作的执行路径。
-- 外部 Desktop-host bridge 未来可以提供经证明的项目权限和执行能力。
-  这只是未来合同，不是已交付实现，也不是任何 Desktop host 源码已经存在的声明。
+- 编译器不会创建 worktree、选择路由或运行命令；认证 session 只在 terminal ACK
+  后请求下一宿主边界补位。编译器只能把完整 hash-bound batch 提交给私有宿主桥，
+  真正执行权限仍属于宿主。
+- evidence 缺失、过期、错配、重放或来自 caller 自报时仍保持 `NO_SAFE_WORK`；
+  filesystem path 永远不能充当 compiler evidence。
 
 ### 账号用量边界
 

mcp-tools/devkit_fastlane/FASTLANE_CONTRACT.md

@@ -106,8 +106,9 @@ does not weaken host capability, lease, worktree, review, or safety gates.
 source-plan hash 必须包含该整个 binding，因此相同 task/workflow 在不同项目、workspace 或输入
 snapshot 下不能共用计划、lease、receipt 或恢复状态。
 
-manifest 中的 fence 只是可验证的结构与 hash 输入，绝不是 authority。当前仓库没有 Desktop-host
-durable registry 或真正私有的跨边界 authority bridge，因此没有任何同进程 provider、module
+manifest 中的 fence 只是可验证的结构与 hash 输入，绝不是 authority。DevKit 不拥有 Desktop-host
+durable registry；已认证 inherited host bridge 只能按一次性 nonce/expiry 向宿主 registry 请求
+compiler evidence。因此没有任何同进程 provider、module
 attribute、closure、环境变量、请求 JSON、repo/task root、路径名或 caller-supplied ID 可被当作
 live authority。公开 `compile_fast_lane` 与 `fast-lane` CLI 对 structurally valid V2 一律产出
 `NO_SAFE_WORK/PROJECT_AUTHORITY_UNAVAILABLE`，零本地 assignment、零队列、零外部派发；V2
@@ -117,18 +118,18 @@ envelope/hash 无效、其内层 canonical v1 `package` 不能完成纯诊断解
 公开 MCP request 若试图携带明确的 host-private 字段（如 `host_status`、账号用量或 index
 evidence），则是适配器输入违规，必须在编译前以 `FASTLANE_REQUEST_INVALID` 拒绝，而不是把
 该值当作可诊断的计划输入。
-增加
-Desktop-host durable registry、跨进程 authority 传递或公开 MCP 参数属于后续外部 host 合同，不能由
-工作包 JSON 或 Python 私有命名假装已经存在。
+`compiler-evidence-request-v1/response-v1` 与 typed dispatch batch 是唯一跨进程
+authority 通道：request/response 必须 exact-key、同 bridge generation、一次性且完整绑定 route、
+lease、scope、context、predecessor、worktree identity 与 registry hash。它不接受 actual path，
+也不能由工作包 JSON、环境变量值或 Python 私有命名伪造。
 
 同一限制覆盖 `bootstrap --apply` 及 import-callable `apply_bootstrap_plan`：当前公开入口在构建
 caller-supplied bootstrap plan 或调用 worktree mutation 前，无条件以
 `NO_SAFE_WORK/PROJECT_AUTHORITY_UNAVAILABLE` 失败关闭，因而不能到达
 `git worktree add`。不带 `--apply` 的 `bootstrap` 仍只输出 dry-run 诊断计划；其中的 project、
-root、worktree 和任何 JSON 都不是 sealed V2 execution context。仓库当前不存在可执行的
-host-authorized worktree path：没有 module-private capability、runner、Git probe 或 adapter 可绕过
-该关闭结果。Desktop host registry 与真正私有的跨边界 execution bridge 是外部前置条件；它们尚未在
-本仓库实现，也不能用 Python module attribute、closure 或 caller-supplied JSON 伪装。
+root、worktree 和任何 JSON 都不是 sealed V2 execution context。DevKit 仍不存在自行创建 worktree
+的可执行路径；authenticated compiler evidence 只允许将 typed batch 提交给宿主，不能绕过宿主的
+worktree broker、Git probe 或 coordinator gate。
 
 ### 4. 接地后再写
 
@@ -140,13 +141,13 @@ host-authorized worktree path：没有 module-private capability、runner、Git
 
 #### Ultra Fast Lane
 
-下面是未来外部 Desktop bridge 的 host 合同形状：
+下面的 CLI host-status 仍是未启用的外部合同形状；已交付的 inherited bridge 不读取该文件：
 
 ```text
 python scripts/team_efficiency.py fast-lane --input <fast-lane-request.json> --host-status <fast-lane-host-status.json> --reasoning-effort ultra
 ```
 
-`ultra` 自动激活（Ultra automatic activation）；低于 Ultra 的 effort 必须由 host 显式传入 `--enable`，否则得到 inactive plan。当前仓库的公开 `fast-lane` CLI/API 不消费 host-status、额度或 index 输入来激活该合同：在外部 Desktop authority bridge 实现并验收前，它始终输出 `NO_SAFE_WORK/PROJECT_AUTHORITY_UNAVAILABLE` 的零 assignment/队列预览。下文的 descriptor、route 与 host dispatch 约束只定义未来 bridge 的接入要求，不是本仓库存在的执行通路。`fast-lane` 本身不调用模型、不启动 agent、不创建会话或工作树、不运行 gate、不改写 Git、不领取或完成 workflow。协调器 lane 保有设计、集成、风险决策和最终验收责任；是否需要 Sol 设计/独立终审由精确的 host-attested route 决定，编译器不硬锁某个模型。
+`ultra` 自动激活（Ultra automatic activation）；低于 Ultra 的 effort 必须由 host 显式传入 `--enable`，否则得到 inactive plan。公开 `fast-lane` CLI/API 不消费 host-status、额度或 index 输入，因此仍输出 `NO_SAFE_WORK/PROJECT_AUTHORITY_UNAVAILABLE` 的零 assignment/队列预览。只有 MCP 进程持有已认证 inherited bridge 且宿主返回 exact registry binding 时，私有 adapter 才能机械提交 `dispatch_all`；worker effort 禁止 `ultra`。编译器本身不调用模型、不启动 agent、不创建会话或工作树、不运行 gate、不改写 Git、不领取或完成 workflow。协调器 lane 保有设计、集成、风险决策和最终验收责任。
 
 host 通过不超过 3 MiB、有 exact-key 的 `--host-status` 传入 `workflow_id`、当前 lease/binding 与
 `routing_context`。后者按 `(task_id, scheduler_role)` 唯一关联完整

mcp-tools/devkit_fastlane/assets/fastlane-routing-policy-v5.json

@@ -31,7 +31,7 @@
     "maximum_cache_entries": 128,
     "maximum_gate_reason_codes": 16,
     "maximum_host_models": 8,
-    "maximum_total_slots": 8,
+    "maximum_total_slots": 9,
     "maximum_scope_items": 8,
     "maximum_dependency_items": 32
   },