fix: clear encrypted-only thinking snapshots

# Conflicts:
#	.yoi/tickets/00001KVWPVHFJ/item.md
#	.yoi/tickets/00001KVWPVHFJ/thread.md

.yoi/.gitignore

@@ -1,2 +1,3 @@
 /memory/
 tickets/.ticket-backend.lock
+/workspace.db*

.yoi/objectives/00001KTR80WMN/item.md

@@ -1,66 +1,97 @@
 ---
-title: 'MCP local stdio integration architecture'
+title: 'MCP local stdio integration roadmap'
 state: 'active'
 created_at: '2026-06-10T07:48:45Z'
-updated_at: '2026-06-13T15:30:22Z'
+updated_at: '2026-06-20T05:34:00Z'
+linked_tickets: ['00001KTR81P9X', '00001KV0SP0TY', '00001KVHR3WRF', '00001KVHR3WRY', '00001KVHR3WS6', '00001KVHR3WSD', '00001KVHR3WSN', '00001KVHR3WSW']
 ---
 
-## Objective
+## Goal
 
 Add MCP local stdio integration to Yoi without weakening Worker history, prompt-context, scoped tool permission, or Plugin/Feature layering invariants.
 
-MCP should be implemented as a protocol-backed integration layer on top of `pod::feature`. `pod::feature` supplies the contribution/lifecycle API substrate; MCP owns its own enablement, local server trust model, command/env/secret policy, and MCP-specific permissions. MCP is not the Plugin model, and Plugin permission policy is not implemented by feature-layer authority grants.
+MCP is a protocol-backed integration layer on top of `pod::feature`. `pod::feature` supplies contribution/lifecycle/runtime-discovered registration substrate; MCP owns its own enablement, local server trust model, command/env/secret policy, and MCP-specific permission decisions. MCP is not the Plugin model, and Plugin permission policy is not implemented by feature-layer authority grants.
 
-## Strategic direction
+## Motivation / background
 
-- Baseline the implementation on MCP specification `2025-11-25`.
+Yoi needs to integrate with external capability providers without turning them into hidden context sources or bypassing ordinary Tool/Worker safety rules. MCP is useful because it can expose tools, resources, and prompts from local protocol servers, but those server-provided declarations and results are untrusted and must be normalized through Yoi's existing authority boundaries.
+
+The first MCP slice should focus on local stdio servers because they are concrete enough to implement and debug while keeping remote auth, OAuth, Streamable HTTP, registry distribution, sampling, and elicitation out of the initial trust boundary.
+
+A configured local MCP server runs as a local executable. Yoi feature authority does not sandbox that executable's OS-level side effects, so command/env/secret handling and explicit local trust policy are MCP-layer responsibilities rather than generic `pod::feature` grants.
+
+## Strategy / design direction
+
+- Baseline the initial implementation on MCP specification `2025-11-25`.
 - Start with local stdio MCP servers only.
 - Treat MCP server metadata, tools, resources, prompts, and results as untrusted content.
-- Do not allow MCP resources/prompts to be hidden context injection.
+- Do not allow MCP resources/prompts to become hidden context injection.
   - They must be explicit tool operations with history records.
-- Use the normal Yoi tool registry, PreToolCall permission, history, and bounded result paths.
+- Use the normal Yoi ToolRegistry, PreToolCall permission, history, and bounded result paths.
 - Do not add private MCP-only bypasses around Worker/tool invariants.
 - Keep sampling and elicitation fail-closed initially.
 - Keep Streamable HTTP, remote auth, OAuth, and MCP Registry/distribution out of the first slice.
 - Treat local stdio server execution as an explicit MCP config/trust decision, not as a `pod::feature` authority grant.
 - Document clearly that a configured local MCP server runs as a local executable; Yoi feature authority does not sandbox its OS-level side effects.
 
-## Layering decisions
+### Layering decisions
 
 - `pod::feature` is an API/contribution substrate.
-  - It owns contribution declarations, provider/service lifecycle hooks, diagnostics, dynamic registration plumbing, and integration with normal Worker/ToolRegistry paths.
+  - It owns contribution declarations, provider/service lifecycle hooks, diagnostics, runtime-discovered registration plumbing, and integration with normal Worker/ToolRegistry paths.
   - It does not own Plugin permission policy or MCP server trust policy.
 - Plugin is a user-facing package/config/runtime layer over `pod::feature`.
   - Plugin permissions are Plugin-layer policy.
   - Plugin package discovery/enablement must not be conflated with MCP local server execution.
 - MCP is a separate feature-backed integration layer.
   - MCP enablement, command/env/secret handling, server trust, and MCP-specific permission decisions live in MCP config/implementation.
-  - MCP dynamic tools/resources/prompts are exposed through the feature API and ordinary Yoi tool paths.
+  - MCP provider-discovered tools/resources/prompts are exposed through the feature API and ordinary Yoi tool paths.
 
-## Work breakdown
+### Concrete implementation tickets
 
-1. `00001KTR81P9X` — Extend `pod::feature` API for protocol-backed external providers.
-   - provider/service lifecycle
-   - startup discovery and dynamic contribution registration
-   - bounded refresh semantics
-   - metadata/result normalization
-   - no feature-layer authority model for MCP/Plugin permissions
-2. `00001KTR82RB7` — Implement MCP `2025-11-25` local stdio server bridge.
-   - explicit MCP config and trust model
-   - initialize/capability negotiation
-   - tools/resources/prompts list/call/read/get
-   - bounded result serialization
-   - list-changed diagnostics/refresh behavior
-3. `00001KV0SP0TY` — Remove feature-layer HostAuthority model.
-   - remove authority/grant terminology from `pod::feature`
-   - keep real permission/trust policy in owning Plugin/MCP/manifest/tool layers
-4. Later follow-ups, if needed.
-   - richer MCP tasks / task-support integration
-   - remote/HTTP transports
-   - OAuth / registry / package distribution
-   - Plugin package/runtime alignment, if an explicit MCP/plugin bridge is later approved
+Completed prerequisites:
 
-## Success criteria
+- `00001KTR81P9X` — Extend `pod::feature` API for external protocol-backed capability providers.
+- `00001KV0SP0TY` — Remove feature-layer HostAuthority model.
+
+Concrete MCP implementation sequence:
+
+1. `00001KVHR3WRF` — MCP local stdio server config and trust policy.
+   - explicit config, command/env/secret redaction, local executable trust boundary, no auto-start.
+2. `00001KVHR3WRY` — MCP stdio JSON-RPC lifecycle client.
+   - subprocess lifecycle, initialize/capability negotiation, diagnostics, shutdown.
+3. `00001KVHR3WS6` — MCP tools/list registration into ToolRegistry.
+   - provider-discovered tools, stable namespacing, schema validation, untrusted metadata normalization, no tools/call yet.
+4. `00001KVHR3WSD` — MCP tools/call execution through ordinary Tool path.
+   - PreToolCall gate before server call, bounded result serialization, history path.
+5. `00001KVHR3WSN` — MCP resources/prompts as explicit tool operations.
+   - resources/list/read and prompts/list/get without hidden context injection.
+6. `00001KVHR3WSW` — MCP list_changed notification handling.
+   - deterministic safe refresh/diagnostic behavior without breaking tool schema or prompt-cache invariants.
+
+The old broad implementation Ticket `00001KTR82RB7` is superseded by this sequence and should not be used as an implementation work item.
+
+### Terminology
+
+Use `runtime-discovered` or `provider-discovered` for MCP tools/resources/prompts discovered from `tools/list`, `resources/list`, or `prompts/list`. Avoid `dynamic tools` / `dynamic registry` in new MCP design prose because those phrases imply that model-visible tool schemas may change during an active LLM run.
+
+The intended invariant is:
+
+```text
+provider-discovered at startup / provider initialization;
+registered into the ordinary ToolRegistry before model exposure;
+run-stable for the duration of a model request/run;
+refreshed only at a safe boundary or reported as a diagnostic.
+```
+
+### Later follow-ups
+
+- Richer MCP task/task-support integration if ordinary tool-call fallback is insufficient.
+- Streamable HTTP transport.
+- OAuth / remote auth.
+- Registry/package distribution.
+- Explicit MCP/Plugin bridge only if separately approved; do not conflate Plugin packages with MCP local server execution.
+
+## Success criteria / exit conditions
 
 - A local mock MCP server can be configured explicitly and initialized.
 - Discovered MCP tools appear as ordinary Yoi tools with stable namespacing.
@@ -70,3 +101,11 @@ MCP should be implemented as a protocol-backed integration layer on top of `pod:
 - Secret values, command/env details, and server diagnostics are redacted where required.
 - Local server trust boundary is documented: Yoi does not sandbox the configured executable through feature authority.
 - Feature, Plugin, and MCP permission/trust responsibilities are documented as separate layers.
+
+## Decision context
+
+- MCP is not the Plugin model; it is a protocol-backed integration layer using `pod::feature` substrate.
+- `pod::feature` should provide contribution/lifecycle/runtime-discovered registration plumbing, not MCP server trust policy or Plugin package permission policy.
+- MCP resources and prompts must never be hidden context injection. They are explicit operations recorded through ordinary history/tool paths.
+- Provider-discovered tools are discovered at startup/provider initialization and registered before model exposure; model-visible schemas remain run-stable during a request/run.
+- Local stdio server execution is a user/config trust decision. Yoi does not sandbox the local executable merely because it is configured through MCP.

.yoi/objectives/00001KVG0HR9M/item.md

@@ -2,8 +2,8 @@
 title: "Plugin platform roadmap"
 state: "active"
 created_at: "2026-06-19T13:18:58Z"
-updated_at: "2026-06-19T13:18:58Z"
-linked_tickets: ["00001KV5R5V2S", "00001KV5W3PHA", "00001KV5W3PHW", "00001KV5W3PJ3", "00001KVFD3YSV", "00001KVFDX9AF", "00001KVFDX9AY", "00001KVG0HR96"]
+updated_at: "2026-06-24T19:55:00Z"
+linked_tickets: ["00001KV5R5V2S", "00001KV5W3PHA", "00001KV5W3PHW", "00001KV5W3PJ3", "00001KVFD3YSV", "00001KVFDX9AF", "00001KVFDX9AY", "00001KVG0HR96", "00001KVXHVCR5", "00001KVXK0WD3", "00001KVXK0WDH", "00001KVXK0WDQ", "00001KVXK0WDX", "00001KVXK0WE4", "00001KVXK0WEA"]
 ---
 
 ## Goal
@@ -42,10 +42,10 @@ Research of common Wasm extension systems points to the same pattern: mature sys
   - Package presence never registers a Tool/Hook, executes Wasm, starts a Service, reads files, opens network, or injects context.
   - Explicit enablement and Plugin grants are required before registration/execution/host API use.
   - Tool calls/results continue through ordinary ToolRegistry and Worker history paths.
-- Treat Component Model as the preferred future Plugin runtime shape.
+- Treat Component Model as the active Plugin runtime shape before public release.
   - New typed Plugin host APIs should be designed in WIT-compatible terms.
-  - `runtime.kind = "wasm-component"` should become the preferred runtime once implemented.
-  - Current `yoi-plugin-wasm-1` raw core-Wasm ABI remains a compatibility / migration bridge until Component Model execution and authoring are validated.
+  - `runtime.kind = "wasm-component"` is the current Plugin runtime authority for new work.
+  - The earlier `yoi-plugin-wasm-1` raw core-Wasm compatibility bridge is retired from the active roadmap because Plugin has not been publicly released and compatibility would preserve the wrong boundary.
 - Sequence the platform in usable layers:
   1. Package discovery / explicit enablement / digest-pinned restore. Completed foundation.
   2. Tool surface registration. Completed foundation.
@@ -53,30 +53,49 @@ Research of common Wasm extension systems points to the same pattern: mature sys
   4. Permission grants. Completed foundation.
   5. Read-only Plugin CLI inspection (`yoi plugin list/show`) for debugging discovery/enablement/grants/runtime metadata.
   6. `https` and `fs` host APIs for Tool Plugins, grant-gated and WIT-compatible.
-  7. Component Model runtime migration and authoring model.
-  8. Guest SDK/PDK, examples, `check`/`pack`/`new` authoring tooling.
-  9. Service / Ingress / WebSocket or inbound HTTP only after Tool + host API foundations are stable.
+  7. Remove the raw core-Wasm compatibility bridge and reject legacy runtime manifests.
+  8. Component Model runtime and authoring model become the only active Plugin runtime path.
+  9. Guest SDK/PDK, examples, `check`/`pack`/`new` authoring tooling target Component Model only.
+  10. Service / Ingress runtime is developed as host-managed lifecycle, event queue, output command, and diagnostics slices.
+  11. WebSocket support for long-lived integrations is host-owned connection driver + ingress event delivery + output command, not Plugin-owned polling with `recv(timeout)`.
 - Keep Discord-style bridge goals split into two stages.
   - Outbound Discord/webhook Tool is possible after `https`.
   - Bidirectional Discord bridge requires Service + Ingress + WebSocket or inbound HTTP and host routing policy.
 
+## Current implementation split
+
+The broad Plugin runtime redesign is tracked by `00001KVXHVCR5` as context only; implementation should proceed through concrete Tickets instead of routing that umbrella as a single coding task.
+
+1. `00001KVXK0WD3` Remove legacy raw WASM Plugin runtime.
+   - Deletes the active `LegacyToolAdapter` / raw-Wasm execution path.
+2. `00001KVXK0WDH` Reject legacy Plugin runtime in manifest and CLI diagnostics.
+   - Makes `plugin.toml`, `yoi plugin check/list/show`, docs, and fixtures reflect Component Model only runtime authority.
+3. `00001KVXK0WDQ` Define Plugin Service lifecycle and ingress queue runtime.
+   - Adds host-managed lifecycle, bounded queue, serial dispatch, backpressure, timeout, and diagnostics.
+4. `00001KVXK0WDX` Add Plugin service output command model.
+   - Lets service handlers request side effects as grant-checked commands rather than ambient authority.
+5. `00001KVXK0WE4` Add host-owned WebSocket driver for Plugin services.
+   - Converts incoming WS frames into ingress events and sends outbound frames through output commands.
+6. `00001KVXK0WEA` Update Plugin WIT PDK templates for service event runtime.
+   - Aligns authoring API, WIT, PDK, templates, and docs with the new event/command execution model.
+
 ## Success criteria / exit conditions
 
 - Users can inspect Plugin discovery/enablement/grant/runtime state through a read-only CLI without executing Plugin code.
 - Plugin authors can build a Tool Plugin without writing raw memory/pointer ABI plumbing.
 - Tool Plugins can safely call grant-gated `https` and `fs` host APIs.
-- Component Model support is available or a documented migration path is active, with WIT-compatible host API types and measured packaging/runtime impact.
+- Component Model is the only active Plugin runtime path, with WIT-compatible host API types and measured packaging/runtime impact.
 - Plugin grants remain authoritative over registration, execution, and host API calls.
-- Plugin diagnostics explain missing package, invalid manifest, digest/version mismatch, missing grant, rejected schema, runtime mismatch, and unsupported host API cases safely.
-- Existing raw core-Wasm Plugin tests either remain passing or have an explicit compatibility/deprecation decision.
-- Documentation covers package format, runtime kinds, Component Model direction, host API authority, authoring SDK/templates, and operational debugging.
-- Service/Ingress work starts only after Tool Plugin + host API + diagnostics foundations are usable.
+- Plugin diagnostics explain missing package, invalid manifest, digest/version mismatch, missing grant, rejected schema, runtime mismatch, legacy runtime rejection, and unsupported host API cases safely.
+- Raw core-Wasm Plugin compatibility is removed before public release; tests and docs no longer treat it as a current runtime.
+- Documentation covers package format, Component Model runtime, host API authority, authoring SDK/templates, Service/Ingress event runtime, and operational debugging.
+- Service/Ingress work is host-managed: services have lifecycle/status, ingress uses bounded queues, side effects are output commands, and WebSocket integrations use host-owned connection drivers.
 
 ## Decision context
 
 - This Objective is roadmap context, not Ticket authority. Implementation still requires reading concrete Ticket bodies, threads, artifacts, and relations.
-- Component Model direction supersedes making Yoi's custom raw ABI the long-term authoring interface, but does not require an immediate flag-day rewrite.
+- Component Model direction supersedes Yoi's custom raw ABI as both long-term and current active Plugin runtime authority before public release.
 - `https` / `fs` work should avoid choices that conflict with later WIT typed interfaces.
-- Guest SDK work should either target Component Model directly or keep the raw ABI wrapper clearly transitional.
+- Guest SDK work targets Component Model directly; raw ABI wrappers are not a supported transitional authoring path.
 - Plugin and MCP remain separate. Component Model adoption for Plugin does not imply MCP server execution, MCP prompt/resource injection, or MCP trust policy changes.
 - Plugin surfaces remain Tool / Hook / Service / Ingress; outbound side effects are Tool metadata and host API grants, not a separate surface.

.yoi/objectives/00001KVJPT2PP/item.md

@@ -0,0 +1,249 @@
+---
+title: "Team workspace control plane and runner architecture"
+state: "active"
+created_at: "2026-06-20T14:26:29Z"
+updated_at: "2026-06-21T18:10:00Z"
+linked_tickets: ["00001KVMFFYVX"]
+---
+
+## Goal
+
+Yoi を、単一のローカル開発ディレクトリで動くエージェント実行ツールから、チームで作業・判断・実行結果を管理できるワークスペース基盤へ発展させる。
+
+この Objective の中心は、Web から扱える管理システムを作り、その管理システムにローカル実行環境・リモート実行環境・将来のクラウド実行環境を接続できるようにすることである。管理システムは Ticket、Objective、Memory、Knowledge、Run、Artifact、Runner の正本を持つ。実行環境はその管理システムから仕事を受け取り、コード取得、作業用ディレクトリ作成、エージェント実行、検証、結果報告を行う。
+
+この Objective は Git ホスティングサービスを作るものではない。Git は重要な Repository provider として扱うが、Yoi の Workspace は Git Repository root と同じものにしない。Yoi が作るべきものは、コード・ドキュメント・データ・成果物などの Repository と実行環境を接続しながら、人間とエージェントの作業、Ticket lifecycle、Memory/Knowledge、検証証跡、実行環境配置を管理するチームワークスペースである。
+
+## Glossary
+
+この Objective では、以下の語をこの意味で使う。
+
+- Workspace: チームまたはプロジェクトの管理単位。Ticket、Objective、Memory、Knowledge、Run、Artifact、Policy、Actor、Repository を持つ。Git Repository root ではない。
+- Control plane: Workspace の正本を持ち、Web UI / API / CLI から操作される管理システム。
+- Runner: Control plane から仕事を受け取り、実際にエージェントやツールを動かす実行環境。最初はローカルマシン上の runner、後でリモート runner やクラウド runner を追加する。
+- Repository: Workspace に接続される source/storage。コード、ドキュメント、local directory、object storage、artifact store、dataset などを含む。Git Repository も Repository の一種であり、基本的には filesystem path ではなく URI / URL で識別する。
+- Repository provider: Repository の種類ごとの実装。Git、local filesystem、object store、artifact store、将来の non-Git VCS など。
+- RepositoryPoint: Repository 内の特定地点。Git commit/ref/path、object store version/prefix、file snapshot/path など、provider ごとの revision/ref/snapshot/path を表す。
+- Execution Workspace: Runner が Run のために作る作業用ディレクトリや container filesystem。1 つ以上の RepositoryPoint から materialize される。Git worktree、clone、sparse checkout などはこれを作る手段である。
+- Ticket: チームで扱う作業単位。目的、要件、判断、議論、完了条件、関係、証跡を持つ。
+- Objective: 複数の Ticket を束ねる長期目標や設計方針。
+- Run: Ticket や Objective に対して行われた具体的な実行試行。どの Runner が、どの Execution Workspace で、何を実行し、どんな結果になったかを持つ。
+- Artifact: Run や Ticket に紐づく成果物や証跡。diff、log、validation result、review result、report など。
+- Memory: エージェントやユーザーが再利用するための要約された文脈。Ticket や Run の正本ではない。
+- Knowledge: 保守された知識や設計判断。Memory より人間が維持する資料に近い。
+- Actor: 人間、エージェント、システム、外部サービスなど、Workspace 上で操作や発言を行う主体。
+
+## Motivation / background
+
+現在の Yoi は、ローカルの `.yoi` ディレクトリ、ローカルプロセス、Ticket ファイル、ワークツリー運用によって、自分自身の開発に使えるエージェント実行環境になっている。しかし、チーム利用、Web UI、リモート実行、クラウド実行、最終的な SaaS 提供を考えると、次の前提を変える必要がある。
+
+- Workspace を Git Repository root と同一視しない。
+- ローカル filesystem 上の `.yoi` を、長期的なチーム用正本 store にしない。
+- Ticket をローカル作業メモではなく、チームの作業調整 record にする。
+- Ticket と実行試行を分ける。実行試行は Run として記録する。
+- 管理システムと実行環境を分ける。
+- まず Web から Ticket、Objective、Memory、Knowledge、Run、Artifact、Runner state を見られるようにする。
+- 最初はローカルマシンを Runner として使い、後でリモート Runner、クラウド Runner、runner pool、resource allocation、quota、billing、sandboxing に拡張する。
+- Git ホスティング機能を取り込むのではなく、Git Repository / worktree / clone は Repository provider と Execution Workspace materialization の手段として扱う。
+
+OSS として Control plane、Runner、Web frontend、protocol を公開しつつ、managed service では hosted control plane、runner fleet、リソース柔軟性、team auth、backup、audit、availability、multi-tenant operations で価値を出す。
+
+## Strategy / design direction
+
+### 1. Control plane を先に作る
+
+Team Workspace の正本は server-side control plane に置く。`.yoi` は local backend、single-user/self-hosted compatibility、offline/export/import、runner-local projection、migration bridge として残せるが、multi-user SaaS の正本とはみなさない。
+
+Control plane は Ticket、Objective、Memory、Knowledge、Run、Artifact、Actor、Permission、Audit、Runner state を管理する。Web UI、CLI、TUI、将来の desktop client は、この Control plane を操作する client であり、別の正本 store を持たない。
+
+### 2. Workspace と Repository を同一視しない
+
+Workspace はチームまたはプロジェクトの作業管理単位である。Repository は Workspace に接続される source/storage である。Git Repository は Repository の一種にすぎない。
+
+1 つの Workspace は複数の Repository を持てる。Repository は filesystem path ではなく URI / URL で識別する。例として `git+https://...`、`file://...`、`s3://...`、`artifact://...`、将来の VCS provider URI などを扱えるようにする。
+
+Ticket と Objective は Repository 配下に置かず、Workspace 配下に平たく持つ。Ticket は必要に応じて対象 Repository、ref selector、path、必要 capability を持つ。Objective は複数 Ticket にまたがる target default / scope hint を持てるが、Repository の所有物にはしない。
+
+Run は Ticket の target selector を具体的な RepositoryPoint に解決し、その RepositoryPoint から Execution Workspace を materialize する。Git worktree 相当の機能は、この Execution Workspace を作るための実装戦略として扱う。
+
+短期的には Git を主な Repository provider とする。ただし Yoi の authority model を Git object、Git branch、Git Repository root、worktree path に固定しない。Orchestration は Git そのものではなく、`resolve_ref`、`materialize`、`diff`、`patch`、`commit`、`merge` などの Repository capability に依存する。
+
+### 3. Ticket を team coordination record にする
+
+Ticket は実行そのものではない。Ticket は「何を、なぜ、どの条件で完了とみなすか」を持つ。Ticket は Workspace に平たく所属し、Repository には所属しない。コードやドキュメントを対象にする Ticket は、対象 Repository / ref selector / path / intent を target として持つ。
+
+Ticket target は intent/selector であり、実行再現性のための immutable point ではない。Run が target selector を concrete RepositoryPoint に解決し、実際にどの revision/snapshot を materialize したかを記録する。
+
+```text
+Ticket
+  -> target selectors: Repository + ref selector + path + intent
+  -> Run / Attempt
+  -> resolved RepositoryPoint
+  -> Execution Workspace
+  -> Artifact / Evidence
+  -> Review / Decision
+  -> Audit / Notification
+```
+
+Target 例:
+
+```text
+Ticket targets:
+  - repository: main-code
+    role: primary
+    ref: develop
+    paths: ["crates/pod/"]
+    intent: change
+  - repository: docs
+    role: related
+    ref: main
+    paths: ["docs/development/"]
+    intent: read
+
+Run inputs:
+  - repository: main-code
+    requested_ref: develop
+    resolved_point: git commit abc123
+    mount: /workspace/main-code
+```
+
+Ticket には次の概念が必要になる。
+
+- Actor identity: human / agent / system / service account.
+- Assignment / owner / reviewer / watcher.
+- Typed thread events: comment, decision, plan, review, implementation report, state transition.
+- Linked Objective / Artifact / Run / Repository / RepositoryPoint / Execution Workspace.
+- Permission / visibility.
+- Audit trail.
+- Notification / mention.
+- Board / queue / planning / review / done / archived views.
+- Conflict handling and concurrent editing policy.
+
+### 4. Memory / Knowledge の本格再設計は後回しにする
+
+Memory / Knowledge は Ticket / Run / Artifact のコピーではない。再利用可能な文脈、方針、学習された制約、保守された知識として扱う。ただし、Memory の意味論・抽出・承認・検索・staleness 処理を今この Objective で先に作り込まない。
+
+理由は、Memory の正しい設計が Workspace control plane の record model、Actor / visibility / permission、Ticket と Run の分離、Artifact / evidence、RepositoryPoint、Runner に渡す context の監査方法に依存するためである。これらが固まる前に Memory schema だけを作ると、local `.yoi` 前提や現行 agent runtime 前提に引っ張られ、後で再設計が必要になる。
+
+この Objective では、Memory / Knowledge について以下の platform contract だけを維持する。
+
+- Memory / Knowledge は Control plane が扱う record だが、Ticket / Run / Artifact の authority を置き換えない。
+- 将来、Memory / Knowledge の canonical storage は Workspace control plane 側に置く。
+- local `.yoi` memory は compatibility、offline/export/import、runner-local projection、migration bridge として扱う。
+- Personal Memory、Workspace Memory、Run Summary、Maintained Knowledge は分離が必要である。
+- Generated Memory には provenance、visibility、approval、audit が必要である。
+- Runner / agent に渡した Memory/Knowledge context は、将来 ContextPack などとして Run に記録できる必要がある。
+
+本格的な Memory 再設計は、Memory の保存先を Workspace backend / control plane record に移すタイミングで回収する。それまでは低リスクな観察、問題例の収集、既存 local memory の互換維持に留める。
+
+### 5. 管理システムと実行環境を弱結合にする
+
+Control plane は正本と調整を持つ。Runner は実行を担当する。
+
+初期形:
+
+```text
+Web UI / Control Plane
+  -> Runner connection
+  -> Local machine runner
+  -> Existing Yoi runtime, tools, working copy, build/test commands
+```
+
+この段階では、現在ローカル管理画面が行っている Ticket 選択、エージェント起動、レビュー起動、作業用 checkout 作成、検証実行、結果表示を、Web/control plane から local runner に対して実行できるようにする。
+
+その後で、remote runner、self-hosted runner、hosted cloud runner、runner pool、resource allocation、quota、billing、sandbox、network policy、secret distribution を追加する。
+
+```text
+Phase 1: Web control plane + local runner
+Phase 2: Remote/self-hosted runner
+Phase 3: Hosted cloud runner fleet
+Phase 4: Resource allocation / scheduling / quotas / billing / isolation
+```
+
+### 6. Web frontend を先に作る
+
+Desktop app は対応コストが高いので、まず Web frontend を primary UI とする。
+
+- Web: チームで使う主要 UI。
+- CLI: automation、scripting、local operations。
+- TUI/local panel: local runner cockpit、fallback、dogfooding surface。
+- Future desktop: Web/control-plane model が安定した後に検討する optional client。
+
+Web UI は Ticket、Objective、Memory、Knowledge、Run、Runner、Artifact を扱う。UI の都合で正本を二重化しない。
+
+### 7. 多重起動コストと runtime placement を見直す
+
+Cloud/remote execution を成立させるには、多数のエージェント実行を安く管理できる必要がある。logical agent session と runtime process/resource placement を分ける。
+
+初期 Workspace DB では、Worker を canonical table として永続化しない。Host / Worker 一覧は backend-local runtime inspection や将来の Host protocol から逐次取得する live view とし、Ticket に関わった Worker は Ticket thread events と WorkerRef snapshot / TicketWorkerLink として記録する。
+
+Worker の一元管理、データ永続化、アーカイブは将来的には必要になる。これは Host protocol、remote/self-hosted/hosted worker lifecycle、worker identity、retention policy、audit requirements が固まった後に、dedicated Worker registry / archive model として追加する。v0 で Pod metadata の代替として Worker table を作らない。
+
+検討対象:
+
+- Agent identity と process/runtime placement の分離。
+- Provider client、tool registry、resource cache の共有可能性。
+- Prompt/resource/profile resolution cache。
+- Model call multiplexing and scheduling。
+- Tool execution sandbox reuse。
+- Plugin instance / Service runtime との統合。
+- Session/event stream と runtime lifecycle の分離。
+- Runner-local cache、checkout reuse、build cache、dependency cache。
+
+## Initial phases / candidate tickets
+
+1. **Vocabulary / architecture record**
+   - Workspace / Repository / RepositoryPoint / Execution Workspace / Runner / Control Plane / Run / Ticket / Memory / Knowledge の用語と境界を固める。
+2. **Team-space canonical data model**
+   - Ticket / Objective / Target / Run / Artifact / Actor / Permission / Audit / Memory / Knowledge の entity/event model を設計する。
+3. **Ticket and Run separation**
+   - Ticket lifecycle と execution attempt / orchestration run / validation run を分離し、Ticket thread と Run evidence の責務を明確化する。
+4. **Memory storage migration boundary**
+   - Memory / Knowledge の本格再設計は後回しにし、まずは Workspace backend に移す時の platform contract、compatibility/cache/export 方針、将来の provenance / visibility / approval 要件だけを固定する。
+5. **Control plane backend architecture**
+   - local `.yoi` backend と server-side canonical backend の境界、migration/export/import、compatibility mode を設計する。
+6. **Web control plane MVP design**
+   - read-only Ticket / Objective / Memory / Knowledge / Runner state UI/API の範囲を決める。
+7. **Local runner protocol design**
+   - Web/control plane から local runner に安全な操作を送る protocol と authority boundary を設計する。
+8. **Repository and Execution Workspace materialization model**
+   - Repository URI、Repository provider capability、RepositoryPoint resolution、Git worktree / clone / sparse checkout / future source backend を runner-side strategy として抽象化する。
+9. **Remote/hosted runner foundation**
+   - runner registration, heartbeat, capability advertisement, job assignment, logs/events, secrets, sandbox/resource policy を設計する。
+
+## Non-goals
+
+- Git hosting service を作ること。
+- `.yoi` filesystem をそのまま SaaS canonical store にすること。
+- 最初から full hosted cloud execution を作ること。
+- local execution / CLI / TUI / local panel を捨てること。
+- Ticket を単なる issue tracker clone にすること。
+- Memory を Ticket/Run audit log の代替にすること。
+- Web UI のために core authority を二重化すること。
+- hidden server state を LLM context に直接注入すること。
+- multi-tenant auth/billing/secret/security を shortcut して実装すること。
+
+## Success criteria / exit conditions
+
+- Workspace / Repository / RepositoryPoint / Execution Workspace / Runner / Control Plane / Run / Ticket / Memory / Knowledge の境界が文書化されている。
+- Ticket が team coordination record として、target selector / Run / Artifact / Actor / Permission / Audit と分離された model を持つ。
+- `.yoi` local backend は compatibility/local backend として整理され、server-side canonical backend の設計を阻害しない。
+- Web UI/API が Ticket / Objective / Runner state を中心とした read-only view を提供できる設計または MVP を持つ。Memory / Knowledge は既存 record の表示または将来 placeholder に留め、本格再設計をこの段階の必須条件にしない。
+- Control plane から local runner に対して、現在のローカル管理画面相当の安全な操作を実行できる design/protocol がある。
+- Git Repository root に依存しない Workspace model があり、Git Repository は Repository provider の一種として扱われている。
+- Ticket と Objective は Workspace 配下に平たく存在し、Repository への所属ではなく target selector / scope hint で対象を表現する。
+- Git worktree 相当は Execution Workspace materialization strategy として扱われ、Run が immutable な RepositoryPoint を記録する。
+- Memory / Knowledge は Ticket / Run / Artifact の authority を置き換えない record として platform contract だけを持つ。本格的な意味論・抽出・承認・検索・staleness 処理は、Memory の保存先を Workspace backend / control plane record に移すタイミングで回収する。
+- Hosted runner / resource allocation / SaaS offering に進むための後続 Ticket が切れる状態になっている。
+- 既存 local dogfooding runtime を壊さず、local use と remote-capable architecture が両立している。
+
+## Decision context
+
+- Yoi は hosted Git tool ではなく、team workspace control plane + execution environment として設計する。
+- Team-space の長期 canonical authority は server-side control plane に置く。local `.yoi` は互換/local/offline/export/import surface だが、multi-user SaaS の正本ではない。
+- 実行環境と管理システムは弱結合にする。まず管理システムを独立させ、local runner を実行環境として接続する。その後に remote/self-hosted/hosted runner fleet へ進む。
+- Web frontend を最初の primary team UI とする。Desktop app は web/control-plane model が安定した後に検討する。
+- Git は重要な Repository provider / materialization backend として使うが、Workspace identity と authority を Git Repository root に固定しない。
+- Ticket と Objective は Workspace 配下に平たく持つ。対象コードベースや ref は Repository target selector として表現し、Run が concrete RepositoryPoint に解決する。
+- Memory の本格再設計は後回しにする。先に Workspace / Ticket / Repository / Host/Worker live view / Control plane の基盤を固め、Memory の保存先を Workspace backend に移すタイミングで、意味論・抽出・承認・検索・staleness 処理をまとめて回収する。
+- Worker の一元管理・データ永続化・アーカイブも後続設計に回す。初期 DB では Worker を Pod metadata の代替として永続化せず、live view と Ticket-linked WorkerRef 記録に留める。

.yoi/objectives/00001KVJSMQXZ/item.md

@@ -0,0 +1,268 @@
+---
+title: "効果的な Memory システム設計・検証"
+state: "active"
+created_at: "2026-06-20T15:16:00Z"
+updated_at: "2026-06-20T15:16:00Z"
+linked_tickets: ["00001KSKBPHRG", "00001KT02TCCG", "00001KTGCAFXG", "00001KSKBPTHR"]
+---
+
+## Goal
+
+Yoi の Memory / Knowledge / generated memory / resident context / retrieval / usage metrics を、実際の開発・設計・レビュー・オーケストレーションに効く sensemaking substrate として再設計・検証する。
+
+この Objective でいう「効果的な Memory システム」は、単に多く保存する仕組みではなく、作業中の問いに対して relevant material を集め、根拠を検証可能にし、再表現・仮説形成・反証探索・意思決定・成果物への反映を低コストにする仕組みである。
+
+暫定的な定義:
+
+- foraging cost を下げる: Ticket / Objective / current question に対して、関連する memory / docs / tickets / session evidence / code references を探しやすい。
+- evidence を失わない: Memory が authority そのものにならず、Ticket / docs / git history / session logs / user instruction への検証可能な入口になる。
+- schema 化を支援する: raw summary ではなく、subsystem、invariant、risk、authority boundary、open question、rejected alternative、hypothesis など推論しやすい形へ再表現できる。
+- hypothesis loop を支援する: 支持証拠だけでなく、代替仮説・棄却理由・反証 evidence・stale assumption を扱える。
+- product に戻る: Memory に保存して終わりではなく、Ticket、review、docs、implementation、decision、report に影響を戻せる。
+- stale / contradiction を扱う: 古い前提、矛盾、適用範囲外の memory を検出・降格・更新できる。
+- usage を成果基準で測る: resident exposure や read count ではなく、判断・レビュー・実装・docs に効いたかを観測できる。
+
+## Motivation / background
+
+現在の Memory システムは「墓場化」している。保存された情報はあるが、後続の作業で自然に使われにくく、使われたとしても根拠・適用範囲・鮮度・反証可能性が弱い。結果として Memory は、作業場ではなく古い結論の倉庫になりやすい。
+
+Pirolli & Card 2005 の sensemaking model では、分析作業は単なる保存ではなく、次の変換として捉えられる。
+
+```text
+external data sources
+-> shoebox
+-> evidence file
+-> schema / representation
+-> hypotheses
+-> presentation / product
+```
+
+Yoi の現行 Memory は、この流れのうち「保存」と「一部の検索」には対応しているが、少なくとも以下が弱い。
+
+- Ticket / task / question ごとの shoebox がない。
+- shoebox から evidence snippets を切り出し、source / provenance / applicability / confidence と共に扱う evidence file がない。
+- `summary`, `decision`, `request`, `knowledge` は storage taxonomy であり、sensemaking 用 schema としては粗い。
+- decision は残るが、hypothesis space、alternative、rejected reason、disconfirming evidence が残りにくい。
+- reviewer / orchestrator が confirmation bias を避けるための反証探索導線が弱い。
+- resident exposure と explicit retrieval は観測できても、Memory が product に効いたかは測りにくい。
+
+この Objective は、Memory 関連の設計・検証・検討・考察を一元化し、個別 Ticket がばらばらに storage、prompt、retrieval、metrics を改善して再び墓場を増やすことを防ぐための判断背景である。
+
+## Strategy / design direction
+
+Memory を「長期保存領域」ではなく、Yoi の multi-agent 開発における sensemaking loop の支援機構として設計する。
+
+### 1. Pirolli & Card の stage に合わせて責務を分ける
+
+- external data sources: Tickets、docs、git history、session logs、reports、code、user instructions。
+- shoebox: 特定 Ticket / Objective / design question に対して関連しそうな材料を集めた task-bound working set。
+- evidence file: shoebox から抜き出した根拠 snippet。source anchor、支持/反証、適用範囲、confidence、staleness を持つ。
+- schema / representation: subsystem、invariant、risk、authority boundary、open question、hypothesis、alternative、contradiction など、推論しやすい再表現。
+- hypotheses: 採用前の設計仮説、代替案、棄却条件、反証 evidence。
+- product: Ticket、review、docs、implementation、decision、report、orchestration plan などの成果物。
+
+### 2. 最初の重点は task-bound shoebox と evidence file
+
+Memory 墓場化の最初の原因は、保存情報が現在の問いに集まらないことである。まずは Orchestrator / Intake / Reviewer が Ticket を扱う時に、関連 memory / docs / tickets / reports / prior decisions を shoebox として束ねる導線を作る。
+
+この段階では大きな永続 schema 追加に飛びつかず、report / Ticket artifact / bounded generated context として検証してよい。
+
+### 3. Memory を authority にしない
+
+Memory は Ticket、docs、git history、session logs、user instruction の代替ではない。Memory は authority record への evidence index / schema / reasoning aid として扱う。
+
+したがって、改善案は次の性質を持つべきである。
+
+- source / provenance を辿れる。
+- stale / superseded / contradicted を扱える。
+- Memory の断定をそのまま authority として使わない。
+- Ticket body/thread/artifacts を読まずに Objective や Memory だけで実装判断できる状態を作らない。
+
+### 4. 反証探索を first-class にする
+
+より効果的な Memory は、過去方針を思い出すだけでなく、現在案を疑うために使える必要がある。
+
+Reviewer / Orchestrator / Intake の導線では、次を探せるようにする。
+
+- supporting evidence
+- contradicting evidence
+- stale decisions
+- rejected alternatives
+- unresolved questions
+- authority boundary risks
+- prior failures / reports
+
+### 5. Metrics は exposure から product impact へ寄せる
+
+Memory が prompt に入った、または query されたことは成功ではない。評価は次を区別する。
+
+- resident exposure
+- explicit retrieval
+- cited in response
+- cited in Ticket / review / report
+- changed requirement
+- changed implementation
+- contradicted / invalidated
+- led to docs or decision update
+
+### 6. 後続 Ticket は concrete slice に分割する
+
+この Objective は中期的な設計・検証の一元化 record であり、umbrella Ticket ではない。実装や調査は、単独で実装・レビュー・close できる concrete Ticket に分割する。
+
+候補 slice:
+
+- Memory sensemaking 分析 report を `docs/report/` に作る。
+- Ticket routing 用 Memory shoebox artifact を試作する。
+- evidence snippet schema / source resolver を設計する。
+- hypothesis / rejected alternative / disconfirming evidence の表現を追加する。
+- Reviewer workflow に反証探索を入れる。
+- Memory usage metrics を product impact oriented に拡張する。
+- stale / contradiction / renewal の検出・表示を設計する。
+
+## Success criteria / exit conditions
+
+- Memory システムの目的が「保存」ではなく「sensemaking loop 支援」として project records / docs / prompts / workflows で一貫して説明されている。
+- Pirolli & Card の `shoebox -> evidence file -> schema -> hypotheses -> product` に対応する Yoi 内の責務と非責務が整理されている。
+- Ticket / Objective / docs / session logs / Memory / Knowledge の authority boundary が明確で、Memory が authority を僭称しない。
+- 少なくとも一つの実作業 routing / review / design analysis で、task-bound shoebox または evidence file が生成・利用され、作業品質にどう効いたかが確認されている。
+- Memory records または関連 artifacts が source / provenance / applicability / staleness / supports-or-refutes のいずれかを扱えるようになっている。
+- Reviewer / Orchestrator が supporting evidence だけでなく、contradicting evidence / stale assumptions / rejected alternatives を探す導線を持っている。
+- Memory usage metrics が resident exposure と product impact を区別している。
+- 古い Memory が放置されるのではなく、stale / superseded / contradicted / needs-review として扱える方針がある。
+- 後続の実装 Ticket が concrete slice として分割され、Objective が Ticket dependency や進捗 container として使われていない。
+
+この Objective は、Memory が少なくとも一つの中規模設計・実装・レビュー作業で「関連情報を見つける」「根拠を確認する」「代替案/反証を検討する」「成果物へ反映する」流れを実証し、その設計方針が docs / workflows / metrics に反映された時点で `done` を検討できる。
+
+## Decision context
+
+- ユーザー指摘: 「Memoryシステムが完全に墓場化している」。これは保存量不足ではなく、保存情報が現在の問い・根拠・仮説・成果物に接続されない問題として扱う。
+- ユーザー指示: Memory システムの設計・検証・検討・考察を Objective にまとめ、より効果的な Memory システムを作成する目標のもとで情報を一元化する。
+- 「効果的」の定義は未確定だが、当面は Pirolli & Card の sensemaking process に沿って、foraging cost、evidence quality、schema usefulness、hypothesis/disconfirmation support、product impact、staleness handling を評価軸にする。
+- Memory は durable project authority ではない。Ticket、docs、git history、session logs、明示 user instruction の代替として使わない。
+- Objective context は判断背景であり、個別実装の authority は各 Ticket body/thread/artifacts と明示的な Ticket relations / OrchestrationPlan records にある。
+- `history` に残らない context-only injection を改善案にしない。新しい context input は history に commit する原則を守る。
+- Knowledge は単なる長期保存ではなく、再利用可能な schema / model / procedure / invariant として再検討する余地がある。
+- Generated memory / curated Knowledge / Ticket / docs / report の境界を再定義する場合は、authority boundary と migration/staleness を明示する。
+- 関連する既存 Ticket:
+  - `00001KSKBPHRG` — Prompt / Workflow 評価メトリクスと改善 Offer
+  - `00001KT02TCCG` — Memory prompt: conditional guidance and proactive lookup
+  - `00001KTGCAFXG` — Use .yoi/memory marker for repo-local memory root
+  - `00001KSKBPTHR` — ワークスペースのメモリーをLintするヘッドレスCLI
+
+## Historical references / prior design sources
+
+現在の Memory システムの初期設計時には、Codex Memories / Chronicle と HermesAgent を明示的な参考事例として調査していた。関連する調査・設計記録は、現在は主に以下に退避されている。
+
+- `docs/.local/old-docs/ref/memory-systems.md`
+- `docs/.local/old-docs/plan/memory.md`
+- 初期設計 commit: `ca5a3d11` — `2026-04-21 メモリシステムの設計`
+- 関連 commit:
+  - `0c1276b7` — `Memoryシステムの整理・Promptカタログチケット`
+  - `3d04f793` — `memoryを抽出する仕組みの実装`
+  - `f1b7af62` — `docs: memoryシステムの仕様変更と、動的Tool・VCSの話`
+  - `a2aecbf0` — `update: memoryシステムの"Phase"表記を撤廃`
+
+### Codex Memories / Chronicle から得た設計要素
+
+旧設計では、Codex Memories / Chronicle を `extract -> staging -> consolidation -> durable Markdown memory` の非同期パイプラインとして捉えていた。
+
+主な参照点:
+
+- extract と consolidation の 2 段構成。
+- extract は JSON schema / structured output で分類ブレを抑える。
+- consolidation は reasoning model / agentic rewrite によって、既存 memory と staging entries を統合・整理する。
+- staging と durable memory を分ける。
+- `MEMORY.md` は retrieval-oriented handbook として扱う。
+- `memory_summary.md` は prompt-loaded high-signal context として扱う。
+- `raw_memories.md` は routing layer / task inventory 的な中間層として扱う。
+- workspace diff や usage 情報を使い、stale / deleted evidence / noisy entries を整理する。
+- consolidation は append だけでなく、rewrite / merge / split / trim / drop / cleanup を担う。
+
+Yoi 初期設計では、これを参考に以下を意図していた。
+
+- activity token 閾値で extract を発火する。
+- compact より前に session log range を抽出する。
+- extract は `decisions`, `discussions`, `attempts`, `requests` などの候補を staging に保存する。
+- 抽出時点では Knowledge 化せず、純粋な「起きたこと」に寄せる。
+- consolidation が summary / decisions / requests / knowledge candidates を整理する。
+- consolidation 入力に linter warnings / usage metrics / Knowledge 化候補を含める。
+- stale / superseded / unused / noisy な情報を整理する。
+
+この Objective での再解釈:
+
+- Codex の `raw_memories.md` は、Pirolli & Card の sensemaking model では `shoebox` または `evidence file` に近い。
+- Yoi は extract / consolidation という pipeline だけを継承しても不十分であり、task-bound shoebox / evidence file / hypothesis loop / product feedback がなければ Memory は再び墓場化する。
+- 特に、staging を consolidation の一時入力としてだけ扱うと、後続 Ticket / Objective / review が使う探索入口にならない。
+- Yoi では `raw memories` 相当の中間層を、現在の問いに紐づく working set / evidence index として再設計する必要がある。
+
+### HermesAgent から得た設計要素
+
+旧設計では、Nous Research HermesAgent を 3 層の memory system として整理していた。
+
+- Persistent Memory:
+  - `MEMORY.md` / `USER.md`
+  - Markdown + SQLite / FTS5 session search
+  - 起動時 system prompt snapshot
+  - bounded character limits
+- Skill Library:
+  - procedural memory
+  - `~/.hermes/skills/<name>/SKILL.md`
+  - `skill_manage` tool による agentic CRUD
+- User Model / Honcho:
+  - dialectic user modeling
+  - 外部 service 連携
+
+HermesAgent で特に重要だった点:
+
+- memory / skill review は一定 turn / tool iteration ごとに background agent として起動する。
+- 保存すべきものがなければ `Nothing to save.` で NOP として終了する。
+- Yoi extract の「空配列許容」はこの設計からも影響を受けている。
+- memory は session start 時の frozen snapshot として system prompt に入り、mid-session write で prompt cache を壊さない。
+- persistent memory は bounded で、limit 超過時は deterministic eviction ではなく、agent に replace / remove を促す。
+- procedural memory / skills は一般 memory から分離されている。
+- SQLite FTS5 + LLM summarization による cross-session recall がある。
+
+この Objective での再解釈:
+
+- HermesAgent の `MEMORY.md` / `USER.md` / `skills` の分離は、Yoi の Knowledge / Workflow / prompt resource / docs / Ticket decision / generated memory の責務再整理に使える。
+- reusable procedure, reviewer focus, orchestration tactic, project preference, user preference, design invariant を同じ Memory bucket に入れると墓場化しやすい。
+- `Nothing to save.` / empty extraction allowed は重要だが、保存抑制だけでは効果的な Memory にはならない。保存されたものが task-bound shoebox / evidence / schema / hypothesis / product に接続される必要がある。
+- frozen snapshot / prompt cache 配慮は Yoi の history/context 加工原則と整合するが、それだけでは retrieval / resurfacing / disconfirmation は解決しない。
+
+### Lessons for the next design iteration
+
+Codex と HermesAgent の調査から、Yoi が継承すべきものと、継承するだけでは足りないものを分ける。
+
+継承すべきもの:
+
+- structured extract と agentic consolidation の分離。
+- staging / raw memories / durable memory の分離。
+- 保存対象がなければ NOP にする発火設計。
+- prompt-loaded summary と durable retrieval-oriented memory の分離。
+- stale / noisy / unused entries の cleanup。
+- procedural memory と declarative memory の分離。
+- session search / usage metrics / linter feedback を consolidation に入れる設計。
+
+足りないもの:
+
+- Pirolli & Card の sensemaking stage における各 record の役割定義。
+- Ticket / Objective / current question に紐づく task-bound shoebox。
+- authority record へ戻れる evidence file / provenance / source anchor。
+- hypothesis, alternative hypothesis, rejected reason, disconfirming evidence の first-class 表現。
+- reviewer / orchestrator が confirmation bias を避けるための反証探索導線。
+- resident exposure や read count ではなく product impact を測る metrics。
+- stale / contradiction / renewal を作業中に resurfacing する導線。
+
+したがって、次の Memory 設計は Codex / HermesAgent の単純なコピーではなく、以下を満たす必要がある。
+
+```text
+external data / sessions / tickets / docs / code
+-> task-bound shoebox
+-> evidence file with provenance
+-> schema / representation
+-> hypotheses and disconfirmation
+-> Ticket / review / docs / implementation / decision product
+-> product impact and stale-feedback metrics
+```
+
+この Objective では、以後の Memory 関連 Ticket / report / implementation をこの historical reference と sensemaking model の両方に照らして判断する。

.yoi/tickets/00001KSKBPGS8/item.md

@@ -1,8 +1,8 @@
 ---
 title: "Pod: 任意ターンからの Fork（複数ターン巻き戻し）"
-state: "planning"
+state: 'closed'
 created_at: "2026-05-27T00:00:09Z"
-updated_at: "2026-05-27T00:00:09Z"
+updated_at: '2026-06-20T16:31:29Z'
 ---
 
 ## Migration reference

.yoi/tickets/00001KSKBPGS8/resolution.md

@@ -0,0 +1 @@
+Closed as no longer needed. Arbitrary-turn Pod/session fork and multi-turn rewind are not part of the current desired workflow; current restore/rewind/fork behavior is sufficient for active use, and future history editing should be reopened as a narrower current-runtime design if needed.

.yoi/tickets/00001KSKBPGS8/thread.md

@@ -4,4 +4,22 @@
 
 Migrated from tickets/pod-session-fork.md. No legacy review file was present at migration time.
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:31:28Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:31:29Z status: closed -->
+
+## 完了
+
+Closed as no longer needed. Arbitrary-turn Pod/session fork and multi-turn rewind are not part of the current desired workflow; current restore/rewind/fork behavior is sufficient for active use, and future history editing should be reopened as a narrower current-runtime design if needed.
+
+
 ---

.yoi/tickets/00001KSKBPHRG/item.md

@@ -1,8 +1,8 @@
 ---
 title: "Prompt / Workflow 評価メトリクスと改善 Offer"
-state: "planning"
+state: 'closed'
 created_at: "2026-05-27T00:00:10Z"
-updated_at: "2026-05-27T00:00:10Z"
+updated_at: '2026-06-20T16:31:29Z'
 ---
 
 ## Migration reference

.yoi/tickets/00001KSKBPHRG/resolution.md

@@ -0,0 +1 @@
+Closed as superseded/no longer needed. Workflow evaluation metrics and improvement planning have moved under the newer Memory redesign / team-workspace memory objectives, so this old prompt/workflow metrics ticket should not remain as a standalone planning item.

.yoi/tickets/00001KSKBPHRG/thread.md

@@ -4,4 +4,22 @@
 
 Migrated from tickets/prompt-eval-metrics.md. No legacy review file was present at migration time.
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:31:29Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:31:29Z status: closed -->
+
+## 完了
+
+Closed as superseded/no longer needed. Workflow evaluation metrics and improvement planning have moved under the newer Memory redesign / team-workspace memory objectives, so this old prompt/workflow metrics ticket should not remain as a standalone planning item.
+
+
 ---

.yoi/tickets/00001KSKBPPMR/item.md

@@ -1,8 +1,8 @@
 ---
 title: "TUI: navigation mode / block focus の設計"
-state: "planning"
+state: 'closed'
 created_at: "2026-05-27T00:00:15Z"
-updated_at: "2026-05-27T00:00:15Z"
+updated_at: '2026-06-20T16:31:29Z'
 ---
 
 ## Migration reference

.yoi/tickets/00001KSKBPPMR/resolution.md

@@ -0,0 +1 @@
+Closed as no longer needed. The current TUI navigation/block-focus behavior is satisfactory, so the older navigation-mode design ticket is obsolete.

.yoi/tickets/00001KSKBPPMR/thread.md

@@ -4,4 +4,22 @@
 
 Migrated from tickets/tui-navigation-mode-design.md. No legacy review file was present at migration time.
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:31:29Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:31:29Z status: closed -->
+
+## 完了
+
+Closed as no longer needed. The current TUI navigation/block-focus behavior is satisfactory, so the older navigation-mode design ticket is obsolete.
+
+
 ---

.yoi/tickets/00001KSQBFGE8/item.md

@@ -1,8 +1,8 @@
 ---
 title: "Audit crate responsibility boundaries"
-state: "planning"
+state: 'closed'
 created_at: "2026-05-28T13:13:17Z"
-updated_at: "2026-05-28T13:13:17Z"
+updated_at: '2026-06-20T16:45:54Z'
 ---
 
 ## Background

.yoi/tickets/00001KSQBFGE8/resolution.md

@@ -0,0 +1 @@
+Closed as completed. The crate responsibility boundary audit was already performed and recorded in artifacts/audit.md with concrete findings; any implementation cleanup should be handled by narrower follow-up tickets.

.yoi/tickets/00001KSQBFGE8/thread.md

@@ -4,4 +4,22 @@
 
 Created by tickets.sh create.
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:45:54Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:45:54Z status: closed -->
+
+## 完了
+
+Closed as completed. The crate responsibility boundary audit was already performed and recorded in artifacts/audit.md with concrete findings; any implementation cleanup should be handled by narrower follow-up tickets.
+
+
 ---

.yoi/tickets/00001KT1JZBX8/item.md

@@ -1,8 +1,8 @@
 ---
 title: "Audit external dependencies and license posture"
-state: "planning"
+state: 'closed'
 created_at: "2026-06-01T12:36:41Z"
-updated_at: "2026-06-01T13:08:45Z"
+updated_at: '2026-06-20T16:45:54Z'
 ---
 
 ## Background

.yoi/tickets/00001KT1JZBX8/resolution.md

@@ -0,0 +1 @@
+Closed as completed. The dependency/license audit was already performed and recorded in artifacts/audit-report.md with implementation report evidence; any dependency cleanup or third-party notice work should be tracked by narrower follow-up tickets.

.yoi/tickets/00001KT1JZBX8/thread.md

@@ -418,4 +418,22 @@ Interpretation:
    - Acceptance: compare current `html5ever`/`RcDom` extractor with viable maintained alternatives; preserve bounded, safe, link-aware extraction behavior; only proceed if measurable binary/build-time benefit exists.
 
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:45:54Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:45:54Z status: closed -->
+
+## 完了
+
+Closed as completed. The dependency/license audit was already performed and recorded in artifacts/audit-report.md with implementation report evidence; any dependency cleanup or third-party notice work should be tracked by narrower follow-up tickets.
+
+
 ---

.yoi/tickets/00001KTGG00N8/item.md

@@ -1,8 +1,8 @@
 ---
 title: "Improve Pod notification injection guidance"
-state: "planning"
+state: 'closed'
 created_at: "2026-06-07T07:33:13Z"
-updated_at: "2026-06-07T07:33:13Z"
+updated_at: '2026-06-20T16:23:37Z'
 ---
 
 ## Background

.yoi/tickets/00001KTGG00N8/resolution.md

@@ -0,0 +1 @@
+Closed as stale/currently not needed. Orchestrator role/profile/workflow notification guidance has since improved, and the broad planning issue is not currently reproducing. If similar notification-as-user-turn confusion recurs in default profiles or generic notification wrappers, create a narrower ticket against the current prompt/profile state.

.yoi/tickets/00001KTGG00N8/thread.md

@@ -4,4 +4,39 @@
 
 Created by LocalTicketBackend create.
 
+---
+
+<!-- event: decision author: intake at: 2026-06-20T16:20:17Z -->
+
+## Decision
+
+ユーザー判断により、この Ticket は一旦 close 推奨とする。
+
+理由:
+- Ticket 作成後に Orchestrator profile / role prompt / workflow guidance の改善が複数回入っている。
+- 現在の明示的な Orchestrator role では、通知を user request と誤認しているケースを最近見かけていない。
+- default profile では同種の誤認がまだ起き得る可能性はあるが、現時点でこの broad な planning Ticket を残しておくほどの実害・優先度は確認されていない。
+
+判断:
+- この Ticket は stale / currently not needed として close してよい。
+- 将来 default profile や generic notify_wrapper で同じ問題が再発した場合は、現在の prompt/profile 状態を前提に、より狭い concrete Ticket として切り直す。
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T16:23:37Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T16:23:37Z status: closed -->
+
+## 完了
+
+Closed as stale/currently not needed. Orchestrator role/profile/workflow notification guidance has since improved, and the broad planning issue is not currently reproducing. If similar notification-as-user-turn confusion recurs in default profiles or generic notification wrappers, create a narrower ticket against the current prompt/profile state.
+
+
 ---

.yoi/tickets/00001KTR82RB7/item.md

@@ -1,8 +1,8 @@
 ---
 title: 'Implement MCP 2025-11-25 local stdio server-feature bridge'
-state: 'planning'
+state: 'closed'
 created_at: '2026-06-10T07:48:49Z'
-updated_at: '2026-06-13T15:29:21Z'
+updated_at: '2026-06-20T05:33:15Z'
 assignee: null
 readiness: 'blocked'
 risk_flags: ['mcp', 'prompt-context', 'permission-scope', 'secrets', 'process-exec', 'feature-api', 'trust-boundary']

.yoi/tickets/00001KTR82RB7/resolution.md

@@ -0,0 +1,13 @@
+Closed as superseded by concrete MCP implementation Tickets.
+
+This Ticket bundled config/trust policy, stdio lifecycle, tools/list registration, tools/call execution, resources/prompts operations, result serialization, and list_changed handling into one broad implementation item. That is too coarse for the current Ticket policy: Tickets should be concrete implementation tasks.
+
+The MCP roadmap now lives in Objective `00001KTR80WMN` (`MCP local stdio integration roadmap`). Concrete follow-up Tickets are:
+- `00001KVHR3WRF` — local stdio server config and trust policy;
+- `00001KVHR3WRY` — stdio JSON-RPC lifecycle client;
+- `00001KVHR3WS6` — server tools registration into ToolRegistry;
+- `00001KVHR3WSD` — tools/call execution through ordinary Tool path;
+- `00001KVHR3WSN` — resources/prompts as explicit tool operations;
+- `00001KVHR3WSW` — list_changed notification handling.
+
+Future MCP work should use those concrete Tickets or similarly scoped follow-ups, not this broad umbrella Ticket.

.yoi/tickets/00001KTR82RB7/thread.md

@@ -22,4 +22,34 @@ LocalTicketBackend によって作成されました。
 - `00001KSXRQ4G8` と `00001KT0Z4BK8` は Plugin permission を Plugin layer として扱い、MCP を初期 Plugin packaging/runtime から分離する。
 
 
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T05:33:15Z from: planning to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T05:33:15Z status: closed -->
+
+## 完了
+
+Closed as superseded by concrete MCP implementation Tickets.
+
+This Ticket bundled config/trust policy, stdio lifecycle, tools/list registration, tools/call execution, resources/prompts operations, result serialization, and list_changed handling into one broad implementation item. That is too coarse for the current Ticket policy: Tickets should be concrete implementation tasks.
+
+The MCP roadmap now lives in Objective `00001KTR80WMN` (`MCP local stdio integration roadmap`). Concrete follow-up Tickets are:
+- `00001KVHR3WRF` — local stdio server config and trust policy;
+- `00001KVHR3WRY` — stdio JSON-RPC lifecycle client;
+- `00001KVHR3WS6` — server tools registration into ToolRegistry;
+- `00001KVHR3WSD` — tools/call execution through ordinary Tool path;
+- `00001KVHR3WSN` — resources/prompts as explicit tool operations;
+- `00001KVHR3WSW` — list_changed notification handling.
+
+Future MCP work should use those concrete Tickets or similarly scoped follow-ups, not this broad umbrella Ticket.
+
+
 ---

.yoi/tickets/00001KVHKWNQA/artifacts/orchestration-plan.jsonl

@@ -0,0 +1 @@
+{"id":"orch-plan-20260620-045332-1","ticket_id":"00001KVHKWNQA","kind":"accepted_plan","accepted_plan":{"summary":"Component Model Tool authoring用の first-party Rust PDK crate と embedded `rust-component-tool` template を追加する。PDK は guest-side only とし、raw pointer/length ABI を隠し、typed JSON helper / ToolError / ToolContext / WIT binding glue を提供する。crates.io 公開・remote template fetch・authoring CLI implementation は含めない。","branch":"impl/00001KVHKWNQA-plugin-rust-pdk-templates","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHKWNQA-plugin-rust-pdk-templates","role_plan":"Orchestrator は queued acceptance を記録・commit 後、専用 implementation worktree を `.worktree/00001KVHKWNQA-plugin-rust-pdk-templates` に作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が PDK guest-only boundary、Component Model runtime compatibility、template/resource packaging、docs/tests/Nix impact を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T04:53:32Z"}

.yoi/tickets/00001KVHKWNQA/artifacts/relations.json

@@ -0,0 +1,37 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHKWNQA",
+      "kind": "depends_on",
+      "target": "00001KVG0HR96",
+      "note": "PDK targets the Component Model Tool runtime.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    },
+    {
+      "ticket_id": "00001KVHKWNQA",
+      "kind": "related",
+      "target": "00001KVFD3YSV",
+      "note": "PDK authoring flow should pair with read-only plugin inspection.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    },
+    {
+      "ticket_id": "00001KVHKWNQA",
+      "kind": "related",
+      "target": "00001KVFDX9AF",
+      "note": "PDK should later wrap https host API ergonomically.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    },
+    {
+      "ticket_id": "00001KVHKWNQA",
+      "kind": "related",
+      "target": "00001KVFDX9AY",
+      "note": "PDK should later wrap fs host API ergonomically.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHKWNQA/item.md

@@ -0,0 +1,90 @@
+---
+title: 'Plugin: add Rust PDK and embedded authoring templates for Component Model Tools'
+state: 'closed'
+created_at: '2026-06-20T04:16:14Z'
+updated_at: '2026-06-20T05:53:20Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['plugin', 'pdk', 'component-model', 'authoring', 'templates', 'sdk', 'no-crates-io']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T04:52:58Z'
+---
+
+## Background
+
+Yoi can now discover Plugin packages, register Tool surfaces, execute sandboxed WASM/Component Model Tool Plugins, enforce Plugin grants, expose `https` / `fs` host APIs, and inspect Plugin state through CLI. The next gap is authoring: independent Plugin developers should not need to write raw WIT/ABI glue or copy ad-hoc examples by hand.
+
+This Ticket adds a first-party Rust PDK for Component Model Tool Plugins and embeds a starter template into Yoi resources. It deliberately does not publish to crates.io yet and does not fetch remote templates. The PDK/API and WIT world are still young, so out-of-tree authors should initially use a git rev or generated local path dependency rather than depending on a public semver crate.
+
+## Requirements
+
+- Add a Rust PDK crate inside the Yoi workspace.
+  - Suggested package name: `yoi-plugin-pdk`.
+  - Suggested path: `crates/plugin-pdk`.
+  - Target Component Model Tool Plugins, not raw core-Wasm as the primary authoring path.
+- PDK must be guest-side only.
+  - Do not depend on host runtime crates such as `pod`, `llm-worker`, `tui`, or `client`.
+  - Keep dependencies minimal, e.g. `serde`, `serde_json`, and WIT binding support.
+  - Do not expose ambient fs/network/env authority.
+- Provide ergonomic Tool helpers.
+  - Typed JSON input parsing.
+  - Typed JSON output serialization.
+  - Structured `ToolError` / error-code helpers.
+  - `ToolContext` containing at least the tool name.
+  - Helper equivalent to `run_json_tool` that returns the ToolOutput JSON expected by the Yoi runtime.
+- Provide Component Model binding glue.
+  - Re-export or wrap generated WIT bindings enough that an author does not need to hand-write raw pointer/length ABI code.
+  - Prefer a minimal `Guest` impl helper first; add a macro only if it is simpler and testable.
+- Include embedded authoring templates under runtime resources.
+  - Suggested path: `resources/plugin/templates/rust-component-tool/`.
+  - Template includes `Cargo.toml`, `src/lib.rs`, `plugin.toml`, and a short README.
+  - Template should be usable by a future `yoi plugin new` command without network access.
+- Template dependency policy:
+  - In checkout/dev mode, template may use a local path dependency to `crates/plugin-pdk`.
+  - For out-of-tree authors, docs/template comments should show a git `rev` dependency pattern.
+  - Do not publish or require crates.io for this Ticket.
+  - Do not use `curl | sh` or remote template fetch.
+- Include at least one example or fixture Plugin using the PDK.
+  - Echo-style Component Model Tool is enough.
+  - It should compile to a component artifact through the documented toolchain or, if full component build automation is not yet available, be covered by a clear fixture/test boundary.
+- Update Plugin development docs.
+  - Explain that Component Model + PDK is the preferred authoring path.
+  - Explain that raw core-Wasm ABI is compatibility/transitional.
+  - Explain why crates.io publication and remote templates are intentionally deferred.
+
+## Acceptance criteria
+
+- Workspace contains a guest-side `yoi-plugin-pdk` crate.
+- A Rust Component Model Tool Plugin can use the PDK to implement a JSON Tool without raw pointer/length ABI code.
+- PDK-produced Tool success output is accepted by the existing Yoi Plugin Tool runtime.
+- PDK-produced Tool errors are bounded and represented as ordinary Tool result/error content.
+- PDK does not grant or imply authority; host-side Plugin grants still decide `https` / `fs` / Tool execution access.
+- Embedded `rust-component-tool` template exists in runtime resources and is suitable for future `yoi plugin new` expansion.
+- No crates.io publication is required or performed.
+- No remote template fetch is implemented.
+- Tests cover:
+  - PDK JSON input/output happy path;
+  - PDK error output path;
+  - PDK sample/template compiles or fixture is validated;
+  - sample Plugin can be executed by Yoi component runtime if feasible in current test infrastructure;
+  - PDK has no host-runtime crate dependency.
+- Validation: focused PDK/plugin tests, `cargo fmt --check`, relevant `cargo check` / `cargo test`, `git diff --check`, and `nix build .#yoi` because workspace/package/resources may change.
+
+## Non-goals
+
+- Publishing `yoi-plugin-pdk` to crates.io.
+- Remote template fetch or `curl | sh` setup.
+- `yoi plugin new/check/pack` CLI implementation.
+- Multi-language PDKs.
+- Service / Ingress authoring.
+- WebSocket / inbound HTTP bridge support.
+- Replacing Plugin grants with PDK-side checks.
+
+## Related work
+
+- `00001KVG0HR9M` — Objective: Plugin platform roadmap.
+- `00001KVG0HR96` — Plugin Component Model runtime.
+- `00001KVFD3YSV` — Plugin read-only CLI inspection.
+- `00001KVFDX9AF` — Plugin https host API.
+- `00001KVFDX9AY` — Plugin fs host API.
+- `docs/development/plugin-development.md` — current Plugin development guide.

.yoi/tickets/00001KVHKWNQA/resolution.md

@@ -0,0 +1,43 @@
+## Resolution
+
+`00001KVHKWNQA` を完了しました。
+
+実装内容:
+- Guest-side Rust PDK crate `yoi-plugin-pdk` を追加しました。
+- PDK は typed JSON input/output helper、bounded `ToolError`、`ToolContext`、`run_json_tool` 系 helper、`wit_bindgen` re-export、`export_component_tool!` macro を提供します。
+- PDK は host/runtime Yoi crates に依存せず、authority を付与しません。Host-side Plugin manifest grants が Tool execution / host API use の authority boundary のままです。
+- Embedded Rust Component Tool template を `resources/plugin/templates/rust-component-tool/` に追加しました。
+- Template は local checkout/dev path dependency を使い、future out-of-tree git `rev` pattern を docs に記録しています。
+- `resources/plugin/wit` を `wit-bindgen` が parse できる package layout に修正し、host WIT dependency を `resources/plugin/wit/deps/yoi-host/yoi-host-v1.wit` に移動しました。
+- WIT keyword `list` は `%list` escape にし、import name semantics を保持しました。
+- Embedded template は empty `[workspace]` により in-tree standalone package として check できます。
+- `wit_bindgen::generate!` を実際に `resources/plugin/wit` に対して実行する probe と、embedded template の `wasm32-unknown-unknown` cargo-check probe を追加しました。
+- Plugin development docs / design docs / package docs / example source を更新しました。
+- `yoi plugin new/check/pack`、remote template fetch、crates.io publication、full packaged component execution はこの Ticket の non-goals / follow-up として残しました。
+
+主な commit:
+- `06287aca plugin: add rust pdk template`
+- `0a9e585c plugin: fix rust pdk wit template probes`
+- `edc53a6b merge: plugin rust pdk templates`
+
+Review:
+- r1 は WIT parse failure と embedded template Cargo workspace issue で `request_changes`。
+- Coder が WIT layout / `%list` / template `[workspace]` / actual probes を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p yoi-plugin-pdk`
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+- `cargo check`
+- `cargo tree -p yoi-plugin-pdk --edges normal`
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112156384`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-o9gvGb.log`

.yoi/tickets/00001KVHKWNQA/thread.md

@@ -0,0 +1,439 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T04:16:14Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T04:52:58Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T04:53:59Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- Ticket body は Rust PDK crate、guest-side only boundary、ergonomic Tool helpers、Component Model binding glue、embedded `rust-component-tool` template、docs/tests/validation/non-goals を実装可能な粒度で定義している。
+- Blocking dependency `00001KVG0HR96` Component Model runtime は closed。Component runtime は explicit `wasm-component` metadata、ToolRegistry path、grant enforcement、no ambient WASI、resource limits、WIT files を含めて完了済み。
+- Incoming dependency from `00001KVHKWNQS` は、この Ticket が将来の authoring CLI Ticket を unblock する関係であり、本 Ticket の blocker ではない。
+- Related Plugin CLI / HTTPS / FS Tickets は closed または non-blocking context。
+- 現在 queued はこの Ticket のみ、inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は plugin / pdk / component-model / authoring / templates / sdk / no-crates-io だが、Ticket は no crates.io publication、no remote template fetch、guest-side only、no ambient authority、host-side grants remain authority などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHKWNQA` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHKWNQA)`: outgoing `depends_on` target `00001KVG0HR96` is closed。incoming `00001KVHKWNQS depends_on this` is not a blocker。
+- `TicketOrchestrationPlanQuery(00001KVHKWNQA)`: no previous plan records; accepted plan was recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `9ca2f85b`。
+  - queued: this Ticket only。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching implementation branch/worktree。
+- Code/resource context:
+  - `resources/plugin/wit/yoi-plugin-tool-v1.wit` and `resources/plugin/wit/yoi-host-v1.wit` exist from the Component runtime work。
+  - `docs/development/plugin-development.md` is the current Plugin development guide target。
+  - Cargo workspace has no existing `crates/plugin-pdk` crate。
+
+IntentPacket:
+
+Intent:
+- Add a first-party Rust PDK for Component Model Tool Plugins and an embedded starter template so authors can implement Yoi Plugin Tools without raw pointer/length ABI plumbing or remote template fetches。
+- Position Component Model + PDK as preferred authoring path while keeping raw core-Wasm ABI as compatibility/transitional runtime support。
+
+Binding decisions / invariants:
+- PDK is guest-side only。It must not depend on host runtime crates such as `pod`, `llm-worker`, `tui`, or `client`。
+- PDK must not grant or imply authority。Host-side Plugin manifest grants remain the authority boundary for Tool execution / HTTPS / FS host APIs。
+- No ambient fs/network/env authority is introduced。
+- Do not publish to crates.io and do not implement remote template fetch。
+- Do not implement `yoi plugin new/check/pack` in this Ticket; embedded resources should be suitable for that future Ticket。
+- Template dependency policy must support checkout/dev local path dependency and document a future out-of-tree git `rev` pattern。
+- PDK should target the current Component Model Tool world (`yoi:plugin/tool@1.0.0`) and runtime ToolOutput JSON bridge。
+- Prefer minimal, testable helper APIs over broad macro magic。
+
+Requirements / acceptance criteria:
+- Add workspace crate `yoi-plugin-pdk` under `crates/plugin-pdk` or a justified equivalent。
+- Provide typed JSON input parsing, output serialization, structured/bounded `ToolError`, `ToolContext` with at least tool name, and helper equivalent to `run_json_tool` producing ToolOutput JSON accepted by the current runtime。
+- Provide WIT binding glue/re-export/wrapper enough that authors do not hand-write raw pointer/length ABI code。
+- Add embedded template under `resources/plugin/templates/rust-component-tool/` with `Cargo.toml`, `src/lib.rs`, `plugin.toml`, and README/next steps。
+- Include example or fixture Plugin using the PDK。
+- Update Plugin development docs and explain publication/template-fetch deferrals。
+- Tests cover PDK happy/error paths, template/sample fixture validation, runtime acceptance if feasible, and no host-runtime crate dependency。
+- Validation includes focused PDK/plugin tests, `cargo fmt --check`, relevant `cargo check`/`cargo test`, `git diff --check`, and `nix build .#yoi` because workspace/package/resources may change。
+
+Escalate if:
+- Current WIT/runtime shape cannot support a guest-side helper without changing the Component runtime contract。
+- A full sample component build requires external tooling that cannot be kept deterministic in this repo。
+- Keeping the PDK guest-only would require undesirable dependencies on host crates。
+- Template/resource packaging needs a broader CLI/resource architecture decision。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T04:54:04Z from: queued to: inprogress reason: orchestrator_acceptance_plugin_rust_pdk_templates field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, Component Model runtime dependency state, related completed Tickets, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded resource/code context were checked. Dependency `00001KVG0HR96` is closed, no inprogress/capacity blocker exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T04:54:51Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `5f7f81bd ticket: accept plugin rust pdk templates`.
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHKWNQA-plugin-rust-pdk-templates` on branch `impl/00001KVHKWNQA-plugin-rust-pdk-templates` at `5f7f81bd`.
+- Spawned Coder Pod `yoi-coder-00001KVHKWNQA` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity.
+- Coder task explicitly forbids root/original workspace implementation, merge, Ticket close, and cleanup.
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T05:16:16Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHKWNQA`.
+
+Implementation commit:
+- `06287aca plugin: add rust pdk template`
+
+Changed areas reported:
+- Added workspace crate `crates/plugin-pdk` / `yoi-plugin-pdk`:
+  - guest-side PDK helpers;
+  - typed JSON input parsing via `parse_json_input` / `run_json_tool`;
+  - typed JSON output via `ToolOutput::json`;
+  - bounded structured `ToolError` and error-code helpers;
+  - `ToolContext` with selected tool name;
+  - `wit_bindgen` re-export and `export_component_tool!` macro to avoid raw pointer/length ABI plumbing;
+  - tests for happy path, error path, oversized output, template validation, and host-runtime dependency exclusion。
+- Added embedded starter template under `resources/plugin/templates/rust-component-tool/` with `Cargo.toml`, `src/lib.rs`, `plugin.toml`, and `README.md`。
+- Added embedded template constants in `crates/manifest/src/plugin.rs` for future authoring CLI use without remote fetching。
+- Updated Component Model example to use the PDK。
+- Added runtime decoder test confirming PDK-produced ToolOutput JSON shape is accepted。
+- Updated Plugin development/design/package docs。
+- Updated workspace/package metadata: root `Cargo.toml`, `Cargo.lock`, `package.nix` cargo hash。
+
+Coder validation reported as passing:
+- `cargo test -p yoi-plugin-pdk`
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+- `cargo check`
+- `cargo fmt --check`
+- `git diff --check`
+- `git diff --check --cached`
+- `cargo tree -p yoi-plugin-pdk --edges normal`
+- `nix build .#yoi --no-link`
+
+Known deferrals reported:
+- No `yoi plugin new/check/pack`, remote template fetch, or crates.io publication。
+- Full deterministic sample component build/pack execution remains deferred to future authoring CLI/tooling; current sample/template are fixture-validated and use current WIT/PDK shape。
+- Raw core-Wasm ABI remains compatibility/transitional runtime support。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean on `impl/00001KVHKWNQA-plugin-rust-pdk-templates`。
+- HEAD is `06287aca`。
+- Diff from acceptance `5f7f81bd..HEAD` is one implementation commit touching 17 files, about 857 insertions / 35 deletions。
+- `git diff --check 5f7f81bd..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on guest-only PDK boundary, no host-runtime deps, authority/grant wording, template/resource packaging, sample/test boundary honesty, docs, and Nix/workspace changes。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T05:16:53Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHKWNQA-r1` against implementation branch `impl/00001KVHKWNQA-plugin-rust-pdk-templates`。
+- Review target commit: `06287aca plugin: add rust pdk template`。
+- Review baseline: `5f7f81bd`。
+- Reviewer task focuses on guest-only PDK boundary, absence of host-runtime deps, authority/grant wording, no ambient fs/network/env, template/resource packaging, current WIT/runtime compatibility, sample/test honesty, docs, and Nix/workspace changes。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHKWNQA-r1 at: 2026-06-20T05:21:50Z status: request_changes -->
+
+## Review: request changes
+
+Verdict: `request_changes`
+
+確認範囲:
+- Ticket body/thread / Orchestrator IntentPacket
+- Diff: `5f7f81bd..06287aca`
+- 主な対象: `crates/plugin-pdk/*`, embedded template `resources/plugin/templates/rust-component-tool/*`, `resources/plugin/wit/*`, `crates/manifest/src/plugin.rs`, `crates/pod/src/feature/plugin.rs`, workspace/package docs/Nix/Cargo paths。
+
+良い点:
+- PDK は guest-side only として提示され、Yoi host/runtime crates への normal dependency は見当たらない。
+- docs/templates は host-side Plugin grants が authority boundary であること、crates.io publication / remote template fetch を要求しないことを概ね維持している。
+- `ToolError` / `ToolOutput` bounds と runtime decoder test は現在の ToolOutput JSON bridge と整合している。
+
+Blocking issues:
+1. PDK/template authoring path が現在の WIT で実際に compile/parse できない。
+   - Template/example/docs は次の generated binding path を示している。
+     - `resources/plugin/templates/rust-component-tool/src/lib.rs`
+     - `docs/examples/plugin-component-tool/lib.rs`
+     - `crates/plugin-pdk/src/lib.rs`
+   - しかし `resources/plugin/wit/yoi-host-v1.wit` の interface `fs` が `list: func(...)` を使っており、`wit-bindgen` probe で `list` が keyword として扱われ parse error になった。
+   - これは “author does not need to hand-write raw pointer/length ABI code” と “template/sample compile or honest validated fixture boundary” の Ticket contract に反する。
+
+2. Embedded template を source tree 内で Cargo package として check できない。
+   - `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown` が root workspace 配下の non-member package として失敗した。
+   - Template を workspace member にするか、workspace exclude / embedded template 側の empty `[workspace]` 等で standalone fixture として check 可能にする必要がある。
+   - 現在の shape tests は `wit_bindgen::generate!` や WIT parse を実行していないため、この問題を捕捉できていない。
+
+Required fix:
+- Current WIT を `wit-bindgen` が parse できるよう修正する。`list` は WIT keyword なので `%list` escape など、runtime import name semantics を壊さない形を優先すること。
+- Embedded template を in-place または controlled fixture copy で Cargo check できるようにする。
+- `wit_bindgen::generate!` against `resources/plugin/wit` を実際に通す test/probe を追加する。string-shape assertion だけでは不可。
+- Template/example/PDK docs が full build boundary と deferral を正直に表現していることを確認する。
+
+Reviewer validation:
+- Passed:
+  - `cargo fmt --check`
+  - `git diff --check 5f7f81bd..HEAD`
+  - `cargo test -p yoi-plugin-pdk`
+  - `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+  - `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+  - `cargo check`
+  - `cargo tree -p yoi-plugin-pdk --edges normal`
+  - `nix build .#yoi --no-link`
+- Failed reviewer probes:
+  - `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`: workspace membership/standalone failure。
+  - copied template probe with adjusted relative paths and empty `[workspace]`: WIT parse failure at `resources/plugin/wit/yoi-host-v1.wit` because `list` is keyword。
+
+Worktree status at review end: source tree clean; ignored artifacts under `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T05:40:15Z -->
+
+## Implementation report
+
+Coder r1-fix report received from `yoi-coder-00001KVHKWNQA`.
+
+New fix commit:
+- `0a9e585c plugin: fix rust pdk wit template probes`
+
+Branch commits now:
+- `0a9e585c plugin: fix rust pdk wit template probes`
+- `06287aca plugin: add rust pdk template`
+
+Fix summary:
+- Moved host WIT to dependency package path `resources/plugin/wit/deps/yoi-host/yoi-host-v1.wit` so `resources/plugin/wit` is a valid WIT package directory with `yoi:host` resolved as dependency。
+- Escaped WIT keyword function as `%list` while preserving import name semantics。
+- Added empty `[workspace]` to embedded template `Cargo.toml` so it can be checked in-place without becoming an undeclared member of Yoi root workspace。
+- Updated template/example/docs/PDK snippets to the compile-tested binding pattern with PDK `wit_bindgen` re-export, `generate_all`, and `runtime_path: "yoi_plugin_pdk::wit_bindgen::rt"`。
+- Added compile-time probe `crates/plugin-pdk/tests/wit_bindgen_probe.rs` that runs `wit_bindgen::generate!` against `resources/plugin/wit`。
+- Added embedded template cargo-check probe for `wasm32-unknown-unknown` in `crates/plugin-pdk/tests/template.rs`。
+- Added `%list` WIT assertion and updated host WIT include path。
+- Updated `Cargo.lock` and `package.nix` for new dev dependency edge / cargo hash。
+
+Coder validation reported as passing:
+- `cargo test -p yoi-plugin-pdk` including PDK tests, WIT constants, actual `wit_bindgen::generate!` probe, and embedded template wasm32 check probe。
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+- `cargo check`
+- `cargo tree -p yoi-plugin-pdk --edges normal`
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`
+- `cargo fmt --check`
+- `git diff --check 5f7f81bd..HEAD`
+- `git diff --check`
+- `git diff --check --cached`
+- `nix build .#yoi --no-link`
+
+Operational note:
+- `nix build .#yoi --no-link` initially hit disk exhaustion after accepting the updated vendor hash; Coder removed local implementation worktree `target/` cache and reran successfully。
+
+Remaining deferrals:
+- No `yoi plugin new/check/pack`。
+- No crates.io publication or remote template fetching。
+- Full packaged component execution remains deferred; the current WIT parses with `wit-bindgen` and embedded Rust template compiles to the wasm target boundary。
+
+Orchestrator evidence checked before r2 review:
+- Implementation worktree is clean。
+- HEAD is `0a9e585c`。
+- Fix diff from `06287aca..HEAD` touches 12 files, about 105 insertions / 13 deletions。
+- Overall `git diff --check 5f7f81bd..HEAD` produced no diagnostics。
+
+Next action:
+- Route back to Reviewer for r2 verification of the WIT parse/template compile blockers and final acceptance criteria。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHKWNQA-r1 at: 2026-06-20T05:47:13Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket body/thread / Orchestrator IntentPacket
+- r2 fix diff: `06287aca..0a9e585c`
+- 全体実装 diff: `5f7f81bd..0a9e585c`
+- 主な対象: `resources/plugin/wit/deps/yoi-host/yoi-host-v1.wit`, `resources/plugin/wit/yoi-plugin-tool-v1.wit`, embedded template, `crates/plugin-pdk/*`, `crates/manifest/src/plugin.rs`, `crates/pod/src/feature/plugin.rs`, docs, `package.nix`。
+
+Previous blockers verification:
+- Host WIT は `resources/plugin/wit/deps/yoi-host/yoi-host-v1.wit` に配置され、`resources/plugin/wit` は current package directory として `wit-bindgen` が parse できる形になった。
+- Keyword function は `%list` として escape され、import name semantics を保持している。
+- Embedded template の `Cargo.toml` には empty `[workspace]` があり、root workspace 配下の non-member package として拒否されない。
+- `crates/plugin-pdk/tests/wit_bindgen_probe.rs` は実際に `wit_bindgen::generate!` を `resources/plugin/wit` に対して実行している。
+- Embedded template は `wasm32-unknown-unknown` target で cargo-check できる。
+
+Overall Ticket fit:
+- PDK は guest-side に留まり、host/runtime Yoi crates への dependency は見当たらない。
+- PDK / template は authority を付与せず、host-side Plugin manifest grants が authority boundary であることを維持している。
+- Ambient fs/network/env authority は露出していない。
+- crates.io publication / remote template fetch / `yoi plugin new/check/pack` は実装していない。
+- Docs は full build/pack boundary と deferral を概ね正直に記述している。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown` を直接実行すると template-local `Cargo.lock` と `target/` ができる。Reviewer は検証後に untracked artifacts を削除した。テスト自体は temporary target dir を使い template lockfile を消すため blocking ではないが、将来 docs/CI では explicit `--target-dir` を推奨するとよい。
+- Reviewer r2 の `nix build .#yoi --no-link` は final artifact copy 中に `No space left on device` で environment-fail。cargo hash/source-filter/code diagnostic ではない。Coder 側では同コマンド成功済み。Orchestrator final validation で再確認する。
+
+Reviewer validation:
+- `cargo test -p yoi-plugin-pdk`: passed
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`: passed
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`: passed
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`: passed
+- `cargo tree -p yoi-plugin-pdk --edges normal`: passed; host/runtime Yoi crate dependencyなし
+- `cargo fmt --check`: passed
+- `git diff --check 5f7f81bd..HEAD`: passed
+- `git diff --check`: passed
+- `git diff --check --cached`: passed
+- `cargo check`: passed
+- `nix build .#yoi --no-link`: attempted, environment failed with `No space left on device` during final artifact copying
+
+Worktree status at review end: source tree clean; ignored artifacts under normal `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T05:51:33Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `edc53a6b merge: plugin rust pdk templates`
+- Implementation commits included:
+  - `06287aca plugin: add rust pdk template`
+  - `0a9e585c plugin: fix rust pdk wit template probes`
+
+Reviewer outcome:
+- r1 requested changes for WIT parse failure (`list` keyword) and embedded template Cargo workspace check failure。
+- Coder fixed WIT package layout / `%list` escaping, added actual `wit_bindgen::generate!` probe, and made the embedded template standalone-checkable。
+- r2 approved with no blocking issues。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p yoi-plugin-pdk`
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+- `cargo check`
+- `cargo tree -p yoi-plugin-pdk --edges normal`
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-o9gvGb.log`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112156384`
+
+Cleanup note:
+- Direct template cargo-check creates local `resources/plugin/templates/rust-component-tool/Cargo.lock` and `target/`; Orchestrator removed those untracked artifacts after validation. Worktree is clean。
+
+Final state:
+- Orchestrator worktree clean at `edc53a6b` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T05:51:42Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `edc53a6b`, r2 review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, focused PDK/manifest/pod tests, `cargo check`, PDK dependency tree check, embedded template wasm32 check, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T05:53:20Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T05:53:20Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHKWNQA` を完了しました。
+
+実装内容:
+- Guest-side Rust PDK crate `yoi-plugin-pdk` を追加しました。
+- PDK は typed JSON input/output helper、bounded `ToolError`、`ToolContext`、`run_json_tool` 系 helper、`wit_bindgen` re-export、`export_component_tool!` macro を提供します。
+- PDK は host/runtime Yoi crates に依存せず、authority を付与しません。Host-side Plugin manifest grants が Tool execution / host API use の authority boundary のままです。
+- Embedded Rust Component Tool template を `resources/plugin/templates/rust-component-tool/` に追加しました。
+- Template は local checkout/dev path dependency を使い、future out-of-tree git `rev` pattern を docs に記録しています。
+- `resources/plugin/wit` を `wit-bindgen` が parse できる package layout に修正し、host WIT dependency を `resources/plugin/wit/deps/yoi-host/yoi-host-v1.wit` に移動しました。
+- WIT keyword `list` は `%list` escape にし、import name semantics を保持しました。
+- Embedded template は empty `[workspace]` により in-tree standalone package として check できます。
+- `wit_bindgen::generate!` を実際に `resources/plugin/wit` に対して実行する probe と、embedded template の `wasm32-unknown-unknown` cargo-check probe を追加しました。
+- Plugin development docs / design docs / package docs / example source を更新しました。
+- `yoi plugin new/check/pack`、remote template fetch、crates.io publication、full packaged component execution はこの Ticket の non-goals / follow-up として残しました。
+
+主な commit:
+- `06287aca plugin: add rust pdk template`
+- `0a9e585c plugin: fix rust pdk wit template probes`
+- `edc53a6b merge: plugin rust pdk templates`
+
+Review:
+- r1 は WIT parse failure と embedded template Cargo workspace issue で `request_changes`。
+- Coder が WIT layout / `%list` / template `[workspace]` / actual probes を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p yoi-plugin-pdk`
+- `cargo test -p manifest embedded_rust_component_tool_template_is_valid_package_shape`
+- `cargo test -p pod pdk_tool_output_shape_is_accepted_by_wasm_decoder`
+- `cargo check`
+- `cargo tree -p yoi-plugin-pdk --edges normal`
+- `cargo check --manifest-path resources/plugin/templates/rust-component-tool/Cargo.toml --target wasm32-unknown-unknown`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112156384`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-o9gvGb.log`
+
+---

.yoi/tickets/00001KVHKWNQS/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-052336-1","ticket_id":"00001KVHKWNQS","kind":"blocked_by","related_ticket":"00001KVHKWNQA","note":"Panel Queue was accepted for routing review, but implementation cannot start yet because `00001KVHKWNQS` depends on `00001KVHKWNQA` Rust PDK/templates, which is currently `inprogress` and in a reviewer-requested-changes loop. Leave `00001KVHKWNQS` queued until `00001KVHKWNQA` is closed, then reroute.","author":"yoi-orchestrator","at":"2026-06-20T05:23:36Z"}
+{"id":"orch-plan-20260620-055356-2","ticket_id":"00001KVHKWNQS","kind":"accepted_plan","accepted_plan":{"summary":"`yoi plugin new rust-component-tool`, `yoi plugin check`, `yoi plugin pack` を追加する。new は embedded template only、check/pack は Plugin code を実行せず、directory/package safety、manifest/runtime/schema/permission diagnostics、deterministic digest/package output、JSON reports、enablement guidance を提供する。","branch":"impl/00001KVHKWNQS-plugin-authoring-cli","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHKWNQS-plugin-authoring-cli","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHKWNQS-plugin-authoring-cli` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が non-execution checks、archive safety、deterministic pack/digest、JSON report stability、template use、workspace/config non-mutation、Nix/resource packaging を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T05:53:56Z"}

.yoi/tickets/00001KVHKWNQS/artifacts/relations.json

@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHKWNQS",
+      "kind": "depends_on",
+      "target": "00001KVHKWNQA",
+      "note": "Authoring new/check/pack uses the Rust PDK and embedded templates.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    },
+    {
+      "ticket_id": "00001KVHKWNQS",
+      "kind": "related",
+      "target": "00001KVFD3YSV",
+      "note": "Authoring check/pack diagnostics should align with plugin list/show inspection.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    },
+    {
+      "ticket_id": "00001KVHKWNQS",
+      "kind": "related",
+      "target": "00001KVG0HR96",
+      "note": "Authoring CLI validates Component Model Tool package metadata.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T04:17:24Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHKWNQS/item.md

@@ -0,0 +1,93 @@
+---
+title: 'Plugin: add authoring CLI new/check/pack'
+state: 'closed'
+created_at: '2026-06-20T04:16:14Z'
+updated_at: '2026-06-20T06:55:06Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['plugin', 'cli', 'authoring', 'templates', 'package-validation', 'packaging', 'read-only-check']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:23:14Z'
+---
+
+## Background
+
+After the Rust PDK and embedded templates exist, independent Plugin developers need first-party CLI tooling to scaffold, validate, and package Plugins without relying on remote shell scripts or hand-written ZIP commands.
+
+This Ticket adds authoring commands for local Plugin development. It complements read-only operational inspection (`yoi plugin list/show`) but serves a different audience: Plugin authors preparing a package before enabling it in Yoi.
+
+## Requirements
+
+- Add Plugin authoring subcommands to the product CLI.
+  - `yoi plugin new rust-component-tool <path-or-name>`
+  - `yoi plugin check <path-or-package>`
+  - `yoi plugin pack <path> [--output <file>]`
+- `new` uses embedded templates only.
+  - No remote template fetch.
+  - No `curl | sh` flow.
+  - Generated files should include `Cargo.toml`, `src/lib.rs`, `plugin.toml`, and README/next-steps.
+  - Generated dependency should be appropriate for the current checkout/release mode: local path in checkout mode, or documented git rev/tag pattern if out-of-tree.
+- `check` validates a Plugin directory or `.yoi-plugin` package without executing Plugin code.
+  - Parse `plugin.toml`.
+  - Validate package id/version/source-compatible shape.
+  - Validate runtime kind and referenced artifact presence.
+  - Validate Component Model world metadata where possible.
+  - Validate Tool schema shape.
+  - Validate requested permissions / host API declarations.
+  - Validate archive safety for packages: path traversal, root escape, unsupported compression, bounded file count/size.
+  - Calculate and print deterministic digest.
+  - Produce actionable diagnostics and a suggested enablement/grant snippet.
+- `pack` creates a deterministic `.yoi-plugin` package.
+  - Include required manifest/runtime files.
+  - Use currently supported archive format, including stored entries if compression is not supported.
+  - Reject unsafe paths / root escapes.
+  - Print output path and digest.
+  - Do not modify workspace enablement config.
+- Provide JSON output for automation where useful.
+  - At minimum `check --json` and `pack --json`.
+- Keep commands safe.
+  - `check` and `pack` do not execute Plugin code.
+  - `new` only writes into the requested destination and refuses to overwrite non-empty directories unless an explicit safe option is added.
+  - No secrets are generated or embedded.
+- Integrate with existing inspection language.
+  - Diagnostics/statuses should align with `yoi plugin list/show` where possible.
+
+## Acceptance criteria
+
+- `yoi plugin new rust-component-tool ./my-plugin` creates a usable template without network access.
+- `yoi plugin check ./my-plugin` validates the generated template and reports next steps/digest/enablement guidance.
+- `yoi plugin pack ./my-plugin` creates a `.yoi-plugin` package that Yoi discovery can read.
+- `check` can validate an existing `.yoi-plugin` archive.
+- `check --json` returns a stable typed report suitable for tests/agents.
+- `pack --json` returns output path and digest.
+- Unsafe package paths / traversal / unsupported compression / missing manifest / missing runtime artifact are rejected with clear diagnostics.
+- Commands do not execute Plugin code or mutate enablement config.
+- Tests cover:
+  - `new` generated file set;
+  - refusal to overwrite non-empty destination;
+  - `check` valid directory;
+  - `check` invalid manifest;
+  - `check` missing runtime artifact;
+  - `check` unsafe package archive;
+  - `pack` deterministic digest;
+  - `pack` package is discoverable by existing Plugin discovery;
+  - JSON report shape.
+- Validation: focused CLI/plugin authoring tests, relevant `cargo check` / `cargo test`, `cargo fmt --check`, `git diff --check`, and `nix build .#yoi` because product CLI/resources/packaging behavior changes.
+
+## Non-goals
+
+- Remote template fetching.
+- Publishing or installing from a registry.
+- Enabling/disabling Plugins in workspace config.
+- Executing Plugin code during `check`.
+- crates.io publication of PDK.
+- Service / Ingress scaffolding.
+- Multi-language templates beyond Rust Component Model Tool.
+
+## Related work
+
+- `00001KVG0HR9M` — Objective: Plugin platform roadmap.
+- `00001KVHKWNQA` — Rust PDK and embedded authoring templates.
+- `00001KVFD3YSV` — Plugin read-only CLI inspection list/show.
+- `00001KVG0HR96` — Plugin Component Model runtime.
+- `docs/development/plugin-development.md` — current Plugin development guide.

.yoi/tickets/00001KVHKWNQS/resolution.md

@@ -0,0 +1,41 @@
+## Resolution
+
+`00001KVHKWNQS` を完了しました。
+
+実装内容:
+- `yoi plugin new rust-component-tool <path-or-name>` を追加しました。
+- `yoi plugin check <path-or-package> [--json]` を追加しました。
+- `yoi plugin pack <path> [--output <file>] [--json]` を追加しました。
+- Safe directory/package reading、deterministic digesting、deterministic `.yoi-plugin` writing、symlink/root-escape rejection を含む materialized package helpers を追加しました。
+- `check` / `pack` は Plugin code を実行せず、既存 static Plugin inspection を再利用して manifest/runtime/schema/permission/host API declarations を検査します。
+- Embedded Rust Component Tool template を `new` で利用し、generated template を check/pack できるよう placeholder `plugin.component.wasm` を追加しました。
+- Placeholder artifact は `check` で検出され、generated template / packed archive は `partial` と bounded diagnostic を返します。placeholder が残る間は enablement-ready guidance を出しません。
+- `plugin new` は existing destination symlink を拒否し、write-through を防ぎます。
+- JSON report shape、human output、CLI help/docs を更新しました。
+- Focused tests と CLI smoke coverage を追加しました。
+
+主な commit:
+- `945ecdf6 plugin: add authoring cli`
+- `699db538 plugin: harden authoring checks`
+- `87704ad4 merge: plugin authoring cli`
+
+Review:
+- r1 は destination symlink write-through と placeholder artifact の enablement-ready 表示で `request_changes`。
+- Coder が symlink refusal、placeholder detection、`partial` status/diagnostics、tests/docs を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo check -p yoi`
+- `cargo test -p yoi plugin_cli`
+- `cargo test -p yoi-plugin-pdk template`
+- `nix build .#yoi --no-link`
+
+補足:
+- 初回 `nix build .#yoi --no-link` は `aws-lc-sys` build 中に `No space left on device` で environment failure。
+- Orchestrator worktree の Cargo build artifacts を `cargo clean` で削除してから再実行し、Nix build は成功しました。
+- `nix path-info -S .#yoi`: `112260512`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-Q0KE3A.log`

.yoi/tickets/00001KVHKWNQS/thread.md

@@ -0,0 +1,427 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T04:16:14Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:23:14Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T05:23:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可されたが、実装開始はまだ行わない。
+
+Reason:
+- `00001KVHKWNQS` は `00001KVHKWNQA` に `depends_on` している。
+- `00001KVHKWNQA` は現在 `inprogress` で、Rust PDK / embedded template 実装が r1 review の `request_changes` 修正ループ中。
+- この Ticket の `new/check/pack` は PDK crate / embedded template を使うため、PDK/template が closed になるまで authoring CLI implementation の worktree/Pod side effects は開始しない。
+- Orchestrator workspace は clean、queued はこの Ticket のみ、inprogress は `00001KVHKWNQA` のみ、matching branch/worktree は存在しない。
+
+Action:
+- `00001KVHKWNQS` は `queued` のまま保持する。
+- `00001KVHKWNQA` が closed になった後、改めて body/thread/relations/workspace state を確認して routing する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T05:54:38Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- 前回は `00001KVHKWNQA` Rust PDK/templates が inprogress だったため blocked/queued hold としたが、現在 `00001KVHKWNQA` は closed。
+- Ticket body は `new` / `check` / `pack` の CLI surface、non-execution safety、archive safety、deterministic digest/package、JSON reports、diagnostics、tests、validation、non-goals を実装可能な粒度で定義している。
+- Related Plugin CLI inspection (`00001KVFD3YSV`) と Component runtime (`00001KVG0HR96`) は closed。
+- 現在 queued はこの Ticket のみ、inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は plugin / CLI / authoring / templates / package-validation / packaging / read-only-check だが、Ticket は check/pack が Plugin code を実行しない、new は embedded templates only、enablement config を mutate しない、safe overwrite refusal、archive traversal/root-escape rejection などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHKWNQS` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHKWNQS)`: outgoing `depends_on 00001KVHKWNQA` is now closed。Related records are closed context。
+- `TicketOrchestrationPlanQuery(00001KVHKWNQS)`: previous `blocked_by` plan is resolved by `00001KVHKWNQA` closure; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `902b383d`。
+  - queued: this Ticket only。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching implementation branch/worktree。
+- Code/resource context:
+  - Rust PDK/template resources are now merged from `00001KVHKWNQA`。
+  - Component Model runtime and Plugin CLI inspection work are closed and available as implementation context。
+
+IntentPacket:
+
+Intent:
+- Add first-party local Plugin authoring CLI commands: `yoi plugin new rust-component-tool <path-or-name>`, `yoi plugin check <path-or-package>`, and `yoi plugin pack <path> [--output <file>]`。
+- Make local authoring safe and deterministic without remote scripts, without executing Plugin code during validation, and without mutating workspace enablement config。
+
+Binding decisions / invariants:
+- `new` uses embedded templates only; no network, no remote template fetch, no `curl | sh` flow。
+- `new` writes only to the requested destination and refuses non-empty destinations unless a narrow explicit safe option is intentionally added。
+- Generated Rust Component Tool template should use the current PDK/template resources and current checkout/release dependency policy。
+- `check` and `pack` must not execute Plugin code or instantiate components。
+- `check` validates directory and `.yoi-plugin` package inputs with bounded diagnostics and stable JSON report shape for `--json`。
+- `pack` creates deterministic `.yoi-plugin` output and prints digest/path; `pack --json` returns stable typed output。
+- `check` validates manifest/runtime/schema/permission/host API declarations, referenced artifact presence, archive safety, and deterministic digest where applicable。
+- `pack` rejects unsafe paths/root escapes and unsupported package shapes; use currently supported archive format/constraints。
+- Commands do not mutate enablement/workspace config and do not generate/embed secrets。
+- Diagnostics/status language should align with existing `yoi plugin list/show` where possible。
+- Do not implement registry publish/install, enabling/disabling config, Plugin execution, Service/Ingress scaffolding, or extra language templates。
+
+Requirements / acceptance criteria:
+- `yoi plugin new rust-component-tool ./my-plugin` creates the expected file set from embedded template without network access。
+- `yoi plugin check ./my-plugin` validates the generated template and reports next steps/digest/enablement guidance。
+- `yoi plugin pack ./my-plugin` creates a `.yoi-plugin` package discoverable by existing Plugin discovery。
+- `check` validates existing `.yoi-plugin` archive inputs and rejects unsafe archives。
+- `check --json` and `pack --json` provide stable typed reports for tests/agents。
+- Tests cover generated file set, overwrite refusal, valid/invalid check paths, missing runtime artifact, unsafe package archive, deterministic pack digest, discoverability by existing Plugin discovery, and JSON report shape。
+- Validation includes focused CLI/plugin authoring tests, relevant `cargo check` / `cargo test`, `cargo fmt --check`, `git diff --check`, and `nix build .#yoi` because CLI/resources/package behavior changes。
+
+Escalate if:
+- Current package/archive format lacks enough existing helpers and needs a broader package-format decision。
+- `check` cannot validate Component world metadata without executing code and needs explicit scope narrowing。
+- Deterministic packaging conflicts with current discovery/package reader behavior。
+- Embedded template resource packaging/source filtering needs broader product decision。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T05:54:45Z from: queued to: inprogress reason: orchestrator_acceptance_plugin_authoring_cli field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, resolved Rust PDK dependency, related closed Tickets, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded CLI/resource/package context were checked. Dependency `00001KVHKWNQA` is closed, no inprogress/capacity blocker exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T05:55:31Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `d1095f85 ticket: accept plugin authoring cli`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHKWNQS-plugin-authoring-cli` on branch `impl/00001KVHKWNQS-plugin-authoring-cli` at `d1095f85`。
+- Spawned Coder Pod `yoi-coder-00001KVHKWNQS` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T06:25:39Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHKWNQS`.
+
+Implementation commit:
+- `945ecdf6 plugin: add authoring cli`
+
+Changed areas reported:
+- Added `yoi plugin new rust-component-tool <path-or-name>`。
+- Added `yoi plugin check <path-or-package> [--json]`。
+- Added `yoi plugin pack <path> [--output <file>] [--json]`。
+- Added manifest-level materialized package helpers for safe directory/package reading, deterministic digesting, deterministic stored `.yoi-plugin` writing, and symlink/root-escape rejection。
+- Reused existing static Plugin inspection for Tool schema / permission / host API declaration checks without Plugin execution。
+- Added embedded `plugin.component.wasm` placeholder to Rust component Tool template so generated templates can be checked/packed immediately; docs instruct replacing it before enabling/execution。
+- Updated CLI parsing/help and Plugin development docs。
+- Added focused tests for generated file set, overwrite refusal, valid directory check, invalid manifest, missing runtime artifact, unsafe package archive, deterministic pack digest, package discoverability, and JSON report shape。
+
+Coder validation reported:
+- `cargo fmt`
+- `cargo fmt --check`
+- `cargo check -p yoi`
+- `cargo test -p yoi plugin_cli`
+- `cargo test -p yoi-plugin-pdk template`
+- `git diff --check`
+- CLI smoke:
+  - `cargo run -q -p yoi -- plugin new rust-component-tool ... --json`
+  - `cargo run -q -p yoi -- plugin check ... --json`
+  - `cargo run -q -p yoi -- plugin pack ... --output ... --json`
+  - invalid check reports `"status": "rejected"` and exits non-zero。
+- `nix build .#yoi --no-link` was attempted but failed due environment/storage: `No space left on device`。
+- No Cargo dependency or `Cargo.lock` changes were introduced。
+
+Known risks / deferrals reported:
+- Component validation remains metadata/static only; no component instantiation/execution is performed by design。
+- Template includes a placeholder artifact solely for deterministic authoring check/pack; docs instruct replacing it before enabling/execution。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean on `impl/00001KVHKWNQS-plugin-authoring-cli`。
+- HEAD is `945ecdf6`。
+- Diff from acceptance `d1095f85..HEAD` is one implementation commit touching 6 files, about 1274 insertions / 24 deletions。
+- `git diff --check d1095f85..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on non-execution safety, archive/path traversal safety, deterministic pack/digest behavior, placeholder artifact policy, JSON report stability, discoverability, workspace/config non-mutation, CLI UX, tests, and Nix/package validation feasibility。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T06:26:24Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHKWNQS-r1` against implementation branch `impl/00001KVHKWNQS-plugin-authoring-cli`。
+- Review target commit: `945ecdf6 plugin: add authoring cli`。
+- Review baseline: `d1095f85`。
+- Reviewer task focuses on non-execution safety, archive/path traversal safety, deterministic pack/digest behavior, placeholder artifact policy, JSON report stability, discoverability, workspace/config non-mutation, CLI UX, tests, and Nix/package validation feasibility。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHKWNQS-r1 at: 2026-06-20T06:36:52Z status: request_changes -->
+
+## Review: request changes
+
+Verdict: `request_changes`
+
+確認範囲:
+- Ticket body/thread / Orchestrator IntentPacket
+- Implementation diff: `d1095f85..945ecdf6`
+- 主な対象: `crates/yoi/src/plugin_cli.rs`, `crates/yoi/src/main.rs`, `crates/manifest/src/plugin.rs`, `resources/plugin/templates/rust-component-tool/*`, `docs/development/plugin-development.md`, `package.nix`。
+
+Blocking issues:
+1. `yoi plugin new` が symlink destination を辿り、物理的な requested destination 外へ書き込める。
+   - `materialize_template` は `fs::metadata(destination)` / `fs::read_dir(destination)` を使い、destination symlink を拒否せず `destination.join(relative)` に書く。
+   - Reviewer smoke: `linkdest -> target` に対して `plugin new rust-component-tool "$tmp/linkdest"` を実行すると、`target/plugin.toml` が作られた。
+   - Ticket invariant: `new` は requested destination にだけ書き、non-empty destination を拒否する。symlink destination はこの境界を破る。
+
+2. Generated placeholder component が `check` で enablement-ready に見える。
+   - Template は text placeholder `resources/plugin/templates/rust-component-tool/plugin.component.wasm` を含む。
+   - `new` output は next steps で一度 warning するが、fresh generated template に対する `check --json` は `status=active diagnostics=0` になり、generic enablement guidance を出す。
+   - Reviewer smoke: generated template check output に placeholder/non-executable warning がなく、`To enable after review...` guidance が出る。
+   - Ticket/reviewer contract: check/pack may pass, but output must not imply executable component is ready for enablement if placeholder is not executable。
+
+Required fixes:
+- `plugin new` destination symlink を `symlink_metadata` 等で拒否し、symlink write-through を防ぐ。関連する overwrite/destination tests を追加する。
+- Generated placeholder artifact を `check` が検出し、bounded diagnostic / next step を出す。Status は `partial` など enablement-ready でない表現にすることを優先する。少なくとも `active diagnostics=0` と enablement guidance の組み合わせは避ける。
+- `check --json` and human output tests should cover generated template placeholder warning/status。
+
+Non-blocking concerns:
+- `nix build .#yoi --no-link` は environment storage (`No space left on device`) で失敗。source-filter/resource-packaging issue は見えていないが、最終 Orchestrator validation で再試行する。
+- `pack --json` digest is nested under `package.digest`, not top-level. Acceptable if documented/stable, but consider documenting shape。
+
+Reviewer validation:
+- `cargo fmt --check`: passed
+- `git diff --check d1095f85..HEAD`: passed
+- `cargo check -p yoi`: passed
+- `cargo test -p yoi plugin_cli`: passed (`15 tests`)
+- `cargo test -p yoi-plugin-pdk template`: passed
+- CLI smoke for `new`, `check --json`, `pack --json`, packed package check/list discovery, invalid check rejected: passed except blocker findings above。
+- `nix build .#yoi --no-link`: failed due `No space left on device`。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T06:46:09Z -->
+
+## Implementation report
+
+Coder r1-fix report received from `yoi-coder-00001KVHKWNQS`.
+
+New fix commit:
+- `699db538 plugin: harden authoring checks`
+
+Branch commits now:
+- `699db538 plugin: harden authoring checks`
+- `945ecdf6 plugin: add authoring cli`
+
+Fix summary:
+- `plugin new` rejects an existing destination symlink via `symlink_metadata` before writes。
+- Added regression test ensuring symlink destination is refused and target is not written。
+- `plugin check` detects embedded generated placeholder `plugin.component.wasm`。
+- Fresh generated templates report `status: "partial"` instead of `active`。
+- JSON/human diagnostics include bounded placeholder warning。
+- Enablement guidance no longer says a package is ready to enable while placeholder artifact remains。
+- `partial` checks exit successfully; `rejected` checks remain non-zero。
+- Docs updated for symlink refusal and placeholder/partial behavior。
+
+Coder validation reported as passing:
+- `cargo fmt --check`
+- `git diff --check d1095f85..HEAD`
+- `cargo check -p yoi`
+- `cargo test -p yoi plugin_cli`
+- `cargo test -p yoi-plugin-pdk template`
+- CLI smoke:
+  - `plugin new ... --json`
+  - `plugin check <generated> --json` => `partial` with placeholder diagnostic。
+  - `plugin pack ... --json` => `packed`。
+  - `plugin check <packed .yoi-plugin> --json` => `partial`。
+  - copied packed archive into `.yoi/plugins` and confirmed `plugin list --workspace ... --json` discovers it。
+  - invalid check after removing runtime artifact => `rejected` and non-zero。
+- Freed only child-worktree Cargo build artifacts with `cargo clean` and reran `nix build .#yoi --no-link`; it completed successfully。
+
+Orchestrator evidence checked before r2 review:
+- Implementation worktree is clean。
+- HEAD is `699db538`。
+- Fix diff from `945ecdf6..HEAD` touches `crates/yoi/src/plugin_cli.rs` and `docs/development/plugin-development.md`, about 124 insertions / 34 deletions。
+- Overall `git diff --check d1095f85..HEAD` produced no diagnostics。
+
+Next action:
+- Route back to Reviewer for r2 verification of symlink destination refusal, placeholder partial/check behavior, and final acceptance criteria。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHKWNQS-r1 at: 2026-06-20T06:50:40Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket body/thread / Orchestrator IntentPacket
+- r2 fix diff: `945ecdf6..699db538`
+- 全体実装 diff: `d1095f85..699db538`
+- 主な対象: `crates/yoi/src/plugin_cli.rs`, `docs/development/plugin-development.md`, and prior `new` / `check` / `pack` implementation surface。
+
+Previous blocker verification:
+1. `plugin new` symlink destination write-through
+   - `materialize_template` now uses `fs::symlink_metadata` and rejects destination symlink before writing。
+   - Regression test `plugin_new_refuses_symlink_destination_without_following_it` verifies refusal and no write-through。
+   - CLI smoke confirmed symlink destination is rejected and target directory does not receive `plugin.toml`。
+
+2. Placeholder component reported as enablement-ready
+   - `check` now compares runtime component bytes against embedded template placeholder and adds bounded `placeholder` diagnostic。
+   - Generated template now reports `status=partial` when static validation is otherwise clean but placeholder remains。
+   - Enablement guidance is suppressed for `partial` and says the package is not ready to enable。
+   - CLI smoke confirmed generated directory and packed `.yoi-plugin` both report `partial` with placeholder diagnostic; `partial` exits successfully, while invalid/missing paths remain non-zero rejected。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- None required for this Ticket. The hardening keeps status vocabulary aligned with existing Plugin inspection (`active` / `partial` / `rejected`)。
+
+Reviewer validation:
+- `cargo fmt --check`: passed
+- `git diff --check d1095f85..HEAD`: passed
+- `cargo check -p yoi`: passed
+- `cargo test -p yoi plugin_cli`: passed (`16 tests`)
+- `cargo test -p yoi-plugin-pdk template`: passed (`2 template tests`)
+- CLI smoke after `cargo build -p yoi`: passed for `new`, generated `check --json partial`, human `[partial]`, `pack --json`, packed package `check --json partial`, invalid check rejected/non-zero, symlink destination refusal, and `plugin list --workspace ... --json` discoverability as `disabled`。
+- `nix build .#yoi --no-link`: passed
+
+Worktree status at review end: source tree clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T06:54:35Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `87704ad4 merge: plugin authoring cli`
+- Implementation commits included:
+  - `945ecdf6 plugin: add authoring cli`
+  - `699db538 plugin: harden authoring checks`
+
+Reviewer outcome:
+- r1 requested changes for symlink destination write-through and placeholder component being reported as enablement-ready。
+- Coder added symlink destination refusal, placeholder detection, `partial` status / diagnostics, and tests。
+- r2 approved with no blocking issues。
+
+Orchestrator validation after merge:
+- Passed before Nix:
+  - `cargo fmt --check`
+  - `git diff --check HEAD^1..HEAD`
+  - `cargo check -p yoi`
+  - `cargo test -p yoi plugin_cli`
+  - `cargo test -p yoi-plugin-pdk template`
+- Initial `nix build .#yoi --no-link` failed with environment storage exhaustion while building `aws-lc-sys` (`No space left on device`), not a source/package diagnostic。
+- Orchestrator freed only Orchestrator-worktree Cargo build artifacts with `cargo clean` (`43.3GiB`) and reran:
+  - `nix build .#yoi --no-link`: passed。
+  - `nix path-info -S .#yoi`: `112260512`。
+
+Validation log for first grouped run:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-Q0KE3A.log`
+
+Final state:
+- Orchestrator worktree clean at `87704ad4` after successful Nix validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T06:54:45Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `87704ad4`, r2 review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, `cargo check -p yoi`, focused `yoi plugin_cli` / `yoi-plugin-pdk template` tests, and `nix build .#yoi --no-link` after freeing Orchestrator worktree build artifacts.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T06:55:06Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T06:55:06Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHKWNQS` を完了しました。
+
+実装内容:
+- `yoi plugin new rust-component-tool <path-or-name>` を追加しました。
+- `yoi plugin check <path-or-package> [--json]` を追加しました。
+- `yoi plugin pack <path> [--output <file>] [--json]` を追加しました。
+- Safe directory/package reading、deterministic digesting、deterministic `.yoi-plugin` writing、symlink/root-escape rejection を含む materialized package helpers を追加しました。
+- `check` / `pack` は Plugin code を実行せず、既存 static Plugin inspection を再利用して manifest/runtime/schema/permission/host API declarations を検査します。
+- Embedded Rust Component Tool template を `new` で利用し、generated template を check/pack できるよう placeholder `plugin.component.wasm` を追加しました。
+- Placeholder artifact は `check` で検出され、generated template / packed archive は `partial` と bounded diagnostic を返します。placeholder が残る間は enablement-ready guidance を出しません。
+- `plugin new` は existing destination symlink を拒否し、write-through を防ぎます。
+- JSON report shape、human output、CLI help/docs を更新しました。
+- Focused tests と CLI smoke coverage を追加しました。
+
+主な commit:
+- `945ecdf6 plugin: add authoring cli`
+- `699db538 plugin: harden authoring checks`
+- `87704ad4 merge: plugin authoring cli`
+
+Review:
+- r1 は destination symlink write-through と placeholder artifact の enablement-ready 表示で `request_changes`。
+- Coder が symlink refusal、placeholder detection、`partial` status/diagnostics、tests/docs を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo check -p yoi`
+- `cargo test -p yoi plugin_cli`
+- `cargo test -p yoi-plugin-pdk template`
+- `nix build .#yoi --no-link`
+
+補足:
+- 初回 `nix build .#yoi --no-link` は `aws-lc-sys` build 中に `No space left on device` で environment failure。
+- Orchestrator worktree の Cargo build artifacts を `cargo clean` で削除してから再実行し、Nix build は成功しました。
+- `nix path-info -S .#yoi`: `112260512`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-Q0KE3A.log`
+
+---

.yoi/tickets/00001KVHQDS6B/artifacts/relations.json

@@ -0,0 +1,21 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHQDS6B",
+      "kind": "related",
+      "target": "00001KVHKWNQA",
+      "note": "Observed prerequisite Ticket already queued/in progress should allow dependent queueing.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:19:32Z"
+    },
+    {
+      "ticket_id": "00001KVHQDS6B",
+      "kind": "related",
+      "target": "00001KVHKWNQS",
+      "note": "Dependent Ticket hit backend conflict despite Panel queue UI allowing it.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:19:32Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHQDS6B/item.md

@@ -0,0 +1,55 @@
+---
+title: 'Panel Queue action should allow ready Tickets whose blockers are already queued or in progress'
+state: 'closed'
+created_at: '2026-06-20T05:18:00Z'
+updated_at: '2026-06-20T12:27:08Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['ticket', 'panel', 'queue', 'dependency', 'blocker', 'orchestrator']
+---
+
+## Background
+
+Panel ViewModel already treats a ready Ticket as queueable when all blocking relations point at Tickets that are already `queued` or `inprogress`. That matches the intended workflow: once prerequisite work is queued/accepted by Orchestrator, dependent ready Tickets should also be queueable so the human does not need to return after every prerequisite completes.
+
+However, pressing Enter in Panel still calls the backend `queue_ready` gate, and that backend rejected any unresolved relation blocker regardless of blocker state. This caused a `ticket conflict` even though the UI correctly showed Queue as available.
+
+Concrete example:
+
+- `00001KVHKWNQS` depends on `00001KVHKWNQA`.
+- `00001KVHKWNQA` is already `inprogress`.
+- Panel shows `00001KVHKWNQS` as queueable.
+- Enter/Queue fails with backend ticket conflict.
+
+## Requirements
+
+- Backend `queue_ready` must match the Panel gating rule.
+- A ready Ticket may transition `ready -> queued` when every relation blocker is already `queued` or `inprogress`.
+- A ready Ticket must still be blocked when any relation blocker is `planning` or `ready`.
+- This change applies to queueing only.
+  - `queued -> inprogress` acceptance remains blocked while unresolved dependency/blocker relations exist; Orchestrator must preserve execution order after queueing.
+- Existing Panel display behavior should remain aligned with backend behavior.
+
+## Implementation summary
+
+- Added backend helper `relation_blocker_allows_queue`.
+- Updated `LocalTicketBackend::queue_ready` to filter relation blockers by that helper before rejecting.
+- Kept `queued -> inprogress` relation blocker validation unchanged.
+- Added backend test coverage for ready Tickets with queued/inprogress blockers.
+- Re-ran existing Panel ViewModel test that already asserted ready+queued dependency appears queueable.
+
+## Acceptance criteria
+
+- `ready` Ticket with `depends_on` target in `queued` state can be queued.
+- `ready` Ticket with incoming `blocks` blocker in `inprogress` state can be queued.
+- `ready` Ticket with dependency/blocker still in `planning` remains rejected.
+- Panel and backend queue behavior are consistent.
+- Orchestrator acceptance ordering remains guarded by existing `queued -> inprogress` relation check.
+
+## Validation
+
+- `cargo test -p ticket queue_gate --lib`
+- `cargo test -p tui workspace_panel_allows_ready_ticket_when_relation_prerequisite_is_queued --lib`
+- `cargo check -p ticket -p tui`
+- `cargo fmt`
+- `git diff --check`

.yoi/tickets/00001KVHQDS6B/resolution.md

@@ -0,0 +1,3 @@
+Ticket `00001KVHQDS6B` (`Panel Queue action should allow ready Tickets whose blockers are already queued or in progress`) はすでに `state: done` に到達していたため、workspace Panel から close しました。
+
+この Close action によって、実装作業、state 変更、Orchestrator/Companion launch、worker invocation は開始されていません。

.yoi/tickets/00001KVHQDS6B/thread.md

@@ -0,0 +1,27 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:18:00Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T12:27:08Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T12:27:08Z status: closed -->
+
+## 完了
+
+Ticket `00001KVHQDS6B` (`Panel Queue action should allow ready Tickets whose blockers are already queued or in progress`) はすでに `state: done` に到達していたため、workspace Panel から close しました。
+
+この Close action によって、実装作業、state 変更、Orchestrator/Companion launch、worker invocation は開始されていません。
+
+
+---

.yoi/tickets/00001KVHR3WRF/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WRF","kind":"waiting_capacity_note","note":"Panel Queue was accepted for routing review, but implementation is held because `00001KVHKWNQS` is currently inprogress with active Coder work. Leave this MCP foundation Ticket queued; reroute when current implementation capacity is free.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-065554-2","ticket_id":"00001KVHR3WRF","kind":"accepted_plan","accepted_plan":{"summary":"Named local stdio MCP server configuration and trust policy metadataを追加する。This Ticket only parses/validates config and diagnostics; it must not spawn subprocesses or implement JSON-RPC lifecycle. Command/env/secret fields must fail closed, redact sensitive values, and document that local MCP executables run with user OS permissions outside Yoi feature sandbox authority.","branch":"impl/00001KVHR3WRF-mcp-stdio-config-trust","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WRF-mcp-stdio-config-trust","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHR3WRF-mcp-stdio-config-trust` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が config schema、trust boundary docs、secret redaction、fail-closed validation、no auto-start/no process execution、Profile/config layering separation を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T06:55:54Z"}

.yoi/tickets/00001KVHR3WRF/artifacts/relations.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WRF",
+      "kind": "related",
+      "target": "00001KTR81P9X",
+      "note": "MCP implementation builds on the protocol-backed provider feature substrate.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WRF/item.md

@@ -0,0 +1,49 @@
+---
+title: 'MCP: add local stdio server config and trust policy'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T07:28:55Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'config', 'trust-boundary', 'secrets', 'process-exec']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:58:46Z'
+---
+
+## Background
+
+MCP integration starts with explicit local stdio server configuration and trust policy. Yoi must not auto-start MCP servers from workspace presence, package discovery, or Plugin packages. A configured MCP local stdio server is a local executable running with the user's OS permissions; Yoi feature authority does not sandbox its OS-level side effects.
+
+This Ticket only defines/parses/validates config and diagnostics. It does not spawn MCP processes or implement JSON-RPC lifecycle.
+
+## Requirements
+
+- Add typed Profile/config support for named local stdio MCP servers.
+- Config fields must cover command, args, cwd policy, env policy, and explicit secret/env references as needed.
+- No package/workspace presence auto-start.
+- Validate command/env/secret config fail-closed.
+- Define diagnostic surfaces for config parse/validation errors.
+- Redact command/env/secret values where needed; do not write plaintext secrets to logs/model context.
+- Document local executable trust boundary.
+- Keep MCP config/trust separate from Plugin permissions and `pod::feature` authority.
+
+## Acceptance criteria
+
+- A Profile/config can declare a named local stdio MCP server.
+- Invalid command/env/secret config is rejected with bounded diagnostic.
+- Secrets are not emitted in plaintext diagnostics/log/model context.
+- Config alone does not spawn a process.
+- Docs explain that configured local MCP servers are not OS-sandboxed by Yoi feature authority.
+- Tests cover valid config, invalid config, secret redaction, and no auto-start.
+
+## Non-goals
+
+- Spawning stdio subprocesses.
+- MCP initialize/capability negotiation.
+- Tool/resource/prompt registration.
+- Streamable HTTP/OAuth/remote MCP.
+
+## Related work
+
+- Objective: `00001KTR80WMN`.
+- Supersedes part of broad MCP Ticket `00001KTR82RB7`.

.yoi/tickets/00001KVHR3WRF/resolution.md

@@ -0,0 +1,37 @@
+## Resolution
+
+`00001KVHR3WRF` を完了しました。
+
+実装内容:
+- Typed MCP config schema を `crates/manifest` に追加しました。
+- Profile/config で named local stdio MCP server を宣言できるようにしました。
+- Config fields は `name`, `command`, `args`, `cwd`, `env.inherit`, `env.set` を含みます。
+- Env value は `literal`, `secret_ref`, `env_ref` をサポートします。
+- Validation は duplicate names、empty/NUL command/args、cwd policy/path、env var name、secret ref、NUL literal env values などを fail-closed で検査します。
+- Diagnostics / `Debug` は secret/env/literal values を plaintext で出さないよう redaction します。
+- Profile resolution / child manifest inheritance に MCP config を通しましたが、subprocess spawning / initialize / JSON-RPC lifecycle / tool/resource/prompt registration は実装していません。
+- Docs に local stdio MCP server の trust boundary を記録しました。Configured stdio server は user OS permissions で動く local executable であり、Yoi feature authority / Plugin permissions / MCP config validation は OS sandbox ではありません。
+
+主な commit:
+- `e0680cce mcp: add stdio server config`
+- `9b7c4e27 merge: mcp stdio config trust`
+
+Review:
+- r1 は `approve`。
+- Reviewer は config-only boundary、no process spawning/no auto-start、secret redaction、Profile/config integration、docs trust boundary を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p manifest mcp --lib`
+- `cargo check`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112615056`
+
+Known unrelated note:
+- Full `cargo test -p manifest --lib` は、branch 外の既存 Plugin template-shape mismatch で失敗するため最終 gate にしませんでした。Reviewer はこの failure が `b0225e48..HEAD` の diff に起因しないことを確認済みです。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-uxMpR3.log`

.yoi/tickets/00001KVHR3WRF/thread.md

@@ -0,0 +1,307 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:58:46Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: waiting_capacity
+
+Panel Queue により routing 対象として確認したが、現在 `00001KVHKWNQS` が `inprogress` で Coder 作業中のため、この MCP foundation Ticket は実装開始せず queued のまま保持する。
+
+Evidence:
+- Ticket body / relations を確認。
+- Orchestrator worktree は clean。
+- queued は MCP chain とこの Ticket 群、inprogress は `00001KVHKWNQS` のみ。
+- matching branch/worktree は存在しない。
+
+Next:
+- `00001KVHKWNQS` が完了して実装 capacity が空いた後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:56:16Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- Ticket body は local stdio MCP server configuration / trust policy の範囲を、spawning/lifecycle を含まない config parse/validation/diagnostics Ticket として明確に定義している。
+- 前回の waiting_capacity note は `00001KVHKWNQS` が inprogress だったためだが、現在 `00001KVHKWNQS` は closed で capacity blocker は解消済み。
+- `00001KVHR3WRF` 自身には未解決 blocking relation はない。Incoming `00001KVHR3WRY depends_on this` は後続 Ticket であり blocker ではない。
+- 現在 inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は mcp / config / trust-boundary / secrets / process-exec だが、Ticket は no process spawning、no auto-start、secret redaction、local executable trust boundary、Plugin permissions / `pod::feature` authority separation などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WRF` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WRF)`: no outgoing blocking dependency; incoming lifecycle Ticket depends on this。
+- `TicketOrchestrationPlanQuery(00001KVHR3WRF)`: previous waiting capacity note resolved by `00001KVHKWNQS` closure; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `a5df9e37`。
+  - queued: MCP chain remains queued。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching MCP implementation branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Add typed Profile/config support for named local stdio MCP servers and the trust-policy diagnostics around that config。
+- This Ticket is intentionally config-only: parse, validate, redact, and document; do not spawn processes or implement JSON-RPC lifecycle。
+
+Binding decisions / invariants:
+- No package/workspace presence auto-start。Config alone must not spawn an MCP process。
+- Local stdio MCP servers are local executables running with user OS permissions; Yoi feature authority does not sandbox OS-level side effects。
+- Keep MCP config/trust policy separate from Plugin permissions and `pod::feature` authority。
+- Config must be explicit and named; no implicit discovery or auto-enablement。
+- Command/args/cwd/env/secret-related configuration must validate fail-closed with bounded diagnostics。
+- Secret/env values must be redacted in diagnostics/log/model-facing surfaces; do not persist plaintext secrets through errors/debug output。
+- This Ticket must not implement initialize/capability negotiation, tool/resource/prompt registration, streamable HTTP/OAuth/remote MCP, or subprocess spawning。
+
+Requirements / acceptance criteria:
+- A Profile/config can declare a named local stdio MCP server。
+- Invalid command/env/secret config is rejected with bounded diagnostic。
+- Secrets are not emitted in plaintext diagnostics/log/model context。
+- Config alone does not spawn a process。
+- Docs explain that configured local MCP servers are not OS-sandboxed by Yoi feature authority。
+- Tests cover valid config, invalid config, secret redaction, and no auto-start。
+
+Escalate if:
+- Existing Profile/config model cannot represent MCP server declarations without a broader config/profile schema decision。
+- Secret reference representation would require changing the local secret-store policy rather than referencing existing secret/env abstractions。
+- Tests require actual process spawning; that belongs to a later Ticket, not this one。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T06:56:23Z from: queued to: inprogress reason: orchestrator_acceptance_mcp_stdio_config_trust field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, resolved capacity blocker, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded MCP config/trust context were checked. There is no unresolved blocking dependency, no inprogress/capacity blocker, and no missing planning decision. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T06:57:08Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `b0225e48 ticket: accept mcp stdio config trust`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WRF-mcp-stdio-config-trust` on branch `impl/00001KVHR3WRF-mcp-stdio-config-trust` at `b0225e48`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WRF` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, process spawning for this Ticket, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:18:35Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WRF`.
+
+Implementation commit:
+- `e0680cce mcp: add stdio server config`
+
+Changed areas reported:
+- Added typed MCP config schema in `crates/manifest`:
+  - `mcp.stdio_server` list with explicit `name`, `command`, `args`, `cwd`, and `env`。
+  - explicit env policy with `inherit` and `set`。
+  - env values support `literal`, `secret_ref`, and `env_ref`。
+  - literal env values are redacted in `Debug`。
+- Added validation for duplicate names, empty/NUL command and args, cwd policy/path, env variable names, secret refs, and bounded diagnostics without secret/env value leakage。
+- Integrated MCP config through Profile resolution and child manifest inheritance without adding process spawning。
+- Added focused tests for valid config, invalid command/duplicate names, invalid secret refs/redaction, nonexistent command accepted as no auto-start proof, and Lua Profile MCP config resolution。
+- Updated docs in `docs/design/profiles-manifests-prompts.md` with local stdio MCP config and trust boundary。
+- Updated Nix cargo hash due manifest dependency graph change。
+
+Coder validation reported:
+- `cargo test -p manifest mcp --lib`: passed。
+- `cargo check`: passed。
+- `cargo fmt --all --check`: passed。
+- `git diff --check`: passed。
+- `nix build .#yoi --no-link`: passed。
+- `cargo test -p manifest --lib`: failed on pre-existing/unrelated `plugin::tests::template_includes_current_pdk_version`, reportedly due `resources/plugin-templates/rust/Cargo.toml` PDK version `0.2.0` vs `CARGO_PKG_VERSION` `0.1.0`。
+
+Known deferrals:
+- No MCP subprocess spawning, initialize/capability negotiation, tool/resource/prompt registration, HTTP/OAuth, or JSON-RPC lifecycle added。
+- Command executability intentionally not checked at config-parse time; only structural validation is performed。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `e0680cce`。
+- Diff from acceptance `b0225e48..HEAD` is one implementation commit touching 8 files, about 515 insertions / 10 deletions。
+- `git diff --check b0225e48..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on config schema fit, validation/redaction boundaries, no process spawning/no auto-start, Profile/config layering, docs trust boundary, and whether the reported `manifest --lib` failure is unrelated or must be fixed。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T07:19:20Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WRF-r1` against implementation branch `impl/00001KVHR3WRF-mcp-stdio-config-trust`。
+- Review target commit: `e0680cce mcp: add stdio server config`。
+- Review baseline: `b0225e48`。
+- Reviewer task focuses on config-only boundary, no process spawning/no auto-start, secret/env redaction, fail-closed validation, Profile/config layering, trust-boundary docs, MCP vs Plugin/feature authority separation, and the reported `cargo test -p manifest --lib` failure。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WRF-r1 at: 2026-06-20T07:27:01Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Diff: `b0225e48..e0680cce`。
+- 主な対象: `crates/manifest/src/lib.rs`, `crates/manifest/src/config.rs`, `crates/manifest/src/profile.rs`, `crates/manifest/Cargo.toml`, `crates/pod/src/spawn/tool.rs`, `docs/design/profiles-manifests-prompts.md`, `Cargo.lock`, `package.nix`。
+- Diff 内で `Command::new`, `tokio::process`, `std::process`, spawn, initialize/capability negotiation, JSON-RPC/tool registration などの process/lifecycle implementation 追加を確認。
+
+Blocking issues: none。
+
+Critical risk checks:
+- Config-only boundary は維持されている。MCP subprocess spawning、MCP initialize/capability negotiation、JSON-RPC lifecycle、tool/resource/prompt registration は追加されていない。
+- `crates/manifest/src/lib.rs` は typed `McpConfig`、named `stdio_server` entries、`command` / `args` / `cwd` / explicit `env.inherit` / `env.set`、`literal` / `secret_ref` / `env_ref` を追加している。
+- `McpEnvValue::Debug` は literal env values を redact する。validation errors は literal/env/secret values を echo しない。
+- `crates/manifest/src/config.rs` は duplicate server names、empty/NUL names/commands/args、cwd absolute-after-resolution policy、env var names、secret ref IDs、NUL literal env values を bounded diagnostics で検証している。
+- Profile integration は通常の Profile resolution / path-resolution flow 経由。Reusable Profiles は absolute MCP cwd paths を拒否する。
+- `crates/pod/src/spawn/tool.rs` は `manifest.mcp.clone()` を inherited child manifest config に載せるだけで、child/grandchild MCP execution は追加しない。
+- Docs は stdio config 宣言だけでは subprocess / tool/resource/prompt registration が起きないこと、local stdio MCP server は user OS permissions の通常 executable として動くこと、Yoi feature flags / Plugin permissions / MCP config validation は OS sandbox ではないことを明記している。
+
+Non-blocking concerns / follow-ups:
+- `cargo test -p manifest --lib` は `plugin::tests::embedded_rust_component_tool_template_is_valid_package_shape` で失敗するが、この branch の diff は `crates/manifest/src/plugin.rs` や template files を変更していない。Reviewer は `b0225e48` 時点で既に同じ template resource/test mismatch があるため unrelated/pre-existing と判断した。
+
+Reviewer validation:
+- `cargo fmt --all --check`: passed。
+- `git diff --check b0225e48..HEAD`: passed。
+- `cargo test -p manifest mcp --lib`: 5 MCP-focused tests passed。
+- `cargo check`: passed。
+- `nix build .#yoi --no-link`: passed。
+- `cargo test -p manifest --lib`: unrelated pre-existing plugin template-shape failure only。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:28:20Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `9b7c4e27 merge: mcp stdio config trust`
+- Implementation commit included:
+  - `e0680cce mcp: add stdio server config`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed config-only boundary, no subprocess/MCP lifecycle implementation, redaction behavior, Profile/config integration, docs trust boundary, and that `cargo test -p manifest --lib` failure is unrelated/pre-existing plugin template test mismatch。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p manifest mcp --lib`
+- `cargo check`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `112615056`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-uxMpR3.log`
+
+Known unrelated validation note:
+- Full `cargo test -p manifest --lib` was not used as a final gate because Reviewer confirmed an unrelated/pre-existing plugin template-shape failure outside this branch's diff。
+
+Final state:
+- Orchestrator worktree clean at `9b7c4e27` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T07:28:26Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `9b7c4e27`, review approved, and final Orchestrator validation passed: `cargo fmt --all --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p manifest mcp --lib`, `cargo check`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T07:28:55Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T07:28:55Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WRF` を完了しました。
+
+実装内容:
+- Typed MCP config schema を `crates/manifest` に追加しました。
+- Profile/config で named local stdio MCP server を宣言できるようにしました。
+- Config fields は `name`, `command`, `args`, `cwd`, `env.inherit`, `env.set` を含みます。
+- Env value は `literal`, `secret_ref`, `env_ref` をサポートします。
+- Validation は duplicate names、empty/NUL command/args、cwd policy/path、env var name、secret ref、NUL literal env values などを fail-closed で検査します。
+- Diagnostics / `Debug` は secret/env/literal values を plaintext で出さないよう redaction します。
+- Profile resolution / child manifest inheritance に MCP config を通しましたが、subprocess spawning / initialize / JSON-RPC lifecycle / tool/resource/prompt registration は実装していません。
+- Docs に local stdio MCP server の trust boundary を記録しました。Configured stdio server は user OS permissions で動く local executable であり、Yoi feature authority / Plugin permissions / MCP config validation は OS sandbox ではありません。
+
+主な commit:
+- `e0680cce mcp: add stdio server config`
+- `9b7c4e27 merge: mcp stdio config trust`
+
+Review:
+- r1 は `approve`。
+- Reviewer は config-only boundary、no process spawning/no auto-start、secret redaction、Profile/config integration、docs trust boundary を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p manifest mcp --lib`
+- `cargo check`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112615056`
+
+Known unrelated note:
+- Full `cargo test -p manifest --lib` は、branch 外の既存 Plugin template-shape mismatch で失敗するため最終 gate にしませんでした。Reviewer はこの failure が `b0225e48..HEAD` の diff に起因しないことを確認済みです。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-uxMpR3.log`
+
+---

.yoi/tickets/00001KVHR3WRY/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WRY","kind":"blocked_by","related_ticket":"00001KVHR3WRF","note":"Lifecycle client requires explicit local stdio MCP config/trust policy. `00001KVHR3WRF` is queued and not yet implemented; leave this Ticket queued until that dependency is closed.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-072936-2","ticket_id":"00001KVHR3WRY","kind":"accepted_plan","accepted_plan":{"summary":"Configured local stdio MCP serverを明示 config から起動し、newline-delimited JSON-RPC over stdioで initialize/capability negotiation/initialized notification/shutdownを行う lifecycle client foundation を実装する。Tools/resources/prompts registration/executionは後続 Ticket のため含めない。","branch":"impl/00001KVHR3WRY-mcp-stdio-lifecycle-client","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WRY-mcp-stdio-lifecycle-client","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHR3WRY-mcp-stdio-lifecycle-client` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が process lifecycle safety、JSON-RPC framing、initialize/capability negotiation、stderr bounds/redaction、shutdown/kill fallback、no ToolRegistry/resources/prompts exposure を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T07:29:36Z"}

.yoi/tickets/00001KVHR3WRY/artifacts/relations.json

@@ -0,0 +1,21 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WRY",
+      "kind": "depends_on",
+      "target": "00001KVHR3WRF",
+      "note": "Lifecycle client requires explicit local stdio MCP config/trust policy.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    },
+    {
+      "ticket_id": "00001KVHR3WRY",
+      "kind": "related",
+      "target": "00001KTR81P9X",
+      "note": "MCP lifecycle uses the protocol-backed provider feature substrate.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WRY/item.md

@@ -0,0 +1,51 @@
+---
+title: 'MCP: implement stdio JSON-RPC lifecycle client'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T07:59:30Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'stdio', 'json-rpc', 'process-lifecycle', 'diagnostics']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:58:54Z'
+---
+
+## Background
+
+After MCP local stdio server config exists, Yoi needs a lifecycle client that can start a configured server, speak newline-delimited JSON-RPC over stdio, perform MCP initialize/capability negotiation, and shut down safely.
+
+This Ticket creates the protocol/lifecycle foundation only. It does not expose MCP tools/resources/prompts to the model-visible ToolRegistry.
+
+## Requirements
+
+- Spawn configured local stdio MCP servers from explicit config only.
+- Use stdin/stdout newline-delimited JSON-RPC.
+- Treat stdout as protocol messages.
+- Treat stderr as bounded diagnostics/logging, not automatic protocol failure.
+- Implement initialize, capability negotiation, and notifications/initialized.
+- Track server name and startup phase in diagnostics.
+- Implement graceful shutdown, terminate, and kill fallback.
+- Handle process exit/disconnect/startup failure with bounded diagnostics.
+- Do not declare sampling or elicitation client capabilities initially.
+- Add local mock MCP server tests.
+
+## Acceptance criteria
+
+- Mock local stdio MCP server initializes successfully.
+- Initialize failure reports server name and phase.
+- stderr is bounded and redacted where needed.
+- Shutdown is safe and deterministic.
+- Sampling/elicitation are not advertised and fail closed if requested.
+- No tools/resources/prompts are registered by this Ticket.
+
+## Non-goals
+
+- tools/list ToolRegistry registration.
+- tools/call execution.
+- resources/prompts operations.
+- Streamable HTTP/OAuth/remote MCP.
+
+## Related work
+
+- Depends on `00001KVHR3WRF`.
+- Objective: `00001KTR80WMN`.

.yoi/tickets/00001KVHR3WRY/resolution.md

@@ -0,0 +1,37 @@
+## Resolution
+
+`00001KVHR3WRY` を完了しました。
+
+実装内容:
+- New internal crate `mcp` を追加しました。
+- Explicit MCP stdio server config から resolved stdio server spec を作成する bridge を追加しました。
+- Tokio child process による local stdio MCP server lifecycle foundation を実装しました。
+- stdin/stdout/stderr handling、newline-delimited JSON-RPC request/response handling、initialize/capability negotiation、`notifications/initialized` を実装しました。
+- stdout/stderr/protocol payloads は bounded に扱います。
+- stderr は bounded diagnostics/logging として扱い、protocol failure とは別扱いです。
+- server name / phase-aware errors を追加しました。
+- shutdown は stdin close / wait / terminate / kill fallback で deterministic に行います。
+- Server-to-client requests は fail-closed し、sampling/elicitation は advertise せず、unknown request は JSON-RPC error で返します。
+- `McpStdioServerSpec` の `Debug` は custom redacted 実装にし、resolved env/secret-derived values を出さない regression test を追加しました。
+- ToolRegistry / tools/resources/prompts registration、remote MCP / Streamable HTTP / OAuth は実装していません。
+
+主な commit:
+- `a114fa9d mcp: implement stdio lifecycle client`
+- `f396e1a2 mcp: redact stdio server spec debug`
+- `9cf5344f merge: mcp stdio lifecycle client`
+
+Review:
+- r1 は resolved spec `Debug` による env/secret leak で `request_changes`。
+- Coder が custom redacted `Debug` と regression test を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp`
+- `cargo check`
+- `cargo tree -p mcp --depth 1`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112615056`

.yoi/tickets/00001KVHR3WRY/thread.md

@@ -0,0 +1,400 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:58:54Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により routing 対象として確認したが、`00001KVHR3WRY` は `00001KVHR3WRF` に `depends_on` している。`00001KVHR3WRF` はまだ queued で未実装のため、この Ticket は実装開始せず queued のまま保持する。
+
+Next:
+- `00001KVHR3WRF` が closed になった後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T07:29:56Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- 前回は `00001KVHR3WRF` local stdio config/trust policy が未完了だったため blocked/queued hold としたが、現在 `00001KVHR3WRF` は closed。
+- Ticket body は stdio JSON-RPC lifecycle client の scope を initialize/capability negotiation/shutdown/process diagnostics foundation として明確に定義し、ToolRegistry/tools/resources/prompts exposure は non-goal として分離している。
+- 現在 inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は mcp / stdio / json-rpc / process-lifecycle / diagnostics だが、Ticket は explicit config only、bounded stderr diagnostics、safe shutdown/kill fallback、sampling/elicitation not advertised、no tools/resources/prompts registration などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WRY` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WRY)`: outgoing `depends_on 00001KVHR3WRF` is now closed。Incoming `00001KVHR3WS6` / `00001KVHR3WSN` are downstream and not blockers。
+- `TicketOrchestrationPlanQuery(00001KVHR3WRY)`: previous `blocked_by 00001KVHR3WRF` is resolved; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `8f5eef94`。
+  - queued: remaining MCP chain Tickets。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching MCP lifecycle branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Implement a local stdio MCP lifecycle client foundation that can spawn an explicitly configured local server, exchange newline-delimited JSON-RPC on stdin/stdout, run initialize/capability negotiation, send `notifications/initialized`, and shut down safely。
+- This Ticket must not expose MCP tools/resources/prompts to the model-visible ToolRegistry; it only provides the lifecycle/protocol substrate for later Tickets。
+
+Binding decisions / invariants:
+- Only explicit named config from `00001KVHR3WRF` can be used; no implicit discovery or auto-start from workspace/package presence。
+- Treat stdout as protocol messages and stderr as bounded diagnostics/logging, not automatic protocol failure。
+- Bound stdout/stderr lines, diagnostics, protocol payloads, startup timeout, request timeout, shutdown timeout, and kill fallback。
+- Include server name and startup phase in errors/diagnostics。
+- Do not advertise sampling or elicitation client capabilities; if server requests them, fail closed / return an error as appropriate。
+- Do not register tools/resources/prompts or expose any ToolRegistry surface in this Ticket。
+- No remote MCP / Streamable HTTP / OAuth。
+- Preserve trust boundary: local stdio server process runs as user OS executable; config validation is not sandbox authority。
+- Secret/env values from config must remain redacted in diagnostics/logs/errors。
+
+Requirements / acceptance criteria:
+- Mock local stdio MCP server initializes successfully。
+- Initialize failure reports server name and phase。
+- Stderr is bounded and redacted where needed。
+- Shutdown is safe and deterministic, with terminate/kill fallback。
+- Sampling/elicitation are not advertised and fail closed if requested。
+- No tools/resources/prompts are registered by this Ticket。
+- Tests use local mock MCP server processes and cover success/failure/shutdown/diagnostic paths。
+
+Escalate if:
+- Existing runtime boundaries make it unclear where lifecycle client should live without dragging ToolRegistry or Plugin feature authority into the config layer。
+- Protocol message typing requires a broad MCP provider substrate redesign。
+- Deterministic process tests are infeasible without an explicit test harness decision。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T07:30:03Z from: queued to: inprogress reason: orchestrator_acceptance_mcp_stdio_lifecycle_client field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, closed MCP config dependency, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded MCP lifecycle context were checked. Dependency `00001KVHR3WRF` is closed, no inprogress/capacity blocker exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:30:59Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `c0e760d7 ticket: accept mcp stdio lifecycle client`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WRY-mcp-stdio-lifecycle-client` on branch `impl/00001KVHR3WRY-mcp-stdio-lifecycle-client` at `c0e760d7`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WRY` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, ToolRegistry/tools/resources/prompts exposure for this Ticket, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:45:58Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WRY`.
+
+Implementation commit:
+- `a114fa9d mcp: implement stdio lifecycle client`
+
+Changed areas reported:
+- Added new internal reusable crate `crates/mcp`。
+- Implemented stdio MCP lifecycle foundation:
+  - explicit resolved stdio server spec/config bridge from typed manifest MCP config。
+  - Tokio child process spawn with `stdin` / `stdout` / `stderr`。
+  - newline-delimited JSON-RPC request/response handling。
+  - `initialize` capability negotiation。
+  - `notifications/initialized`。
+  - bounded stdout/stderr/protocol payload handling。
+  - bounded/redacted stderr diagnostics。
+  - server-name + phase-aware errors。
+  - safe shutdown via stdin close, wait, terminate, and kill fallback。
+  - fail-closed server-to-client request handling including sampling/elicitation。
+- Added mock local stdio MCP server test binary scoped to `crates/mcp` tests。
+- Updated workspace membership and `package.nix` cargo hash。
+
+Coder validation reported:
+- `cargo test -p mcp`: passed。
+- `cargo check`: passed。
+- `cargo fmt --check`: passed。
+- `git diff --check`: passed。
+- `nix build .#yoi --no-link`: passed。
+
+Acceptance notes reported:
+- Mock stdio MCP server initializes successfully。
+- Initialize failure includes server name and `initialize` phase。
+- stderr diagnostics are bounded and secret/env values are redacted。
+- Shutdown is deterministic with terminate/kill fallback for uncooperative server。
+- Client capabilities do not advertise sampling or elicitation。
+- Server sampling requests receive JSON-RPC `-32601` fail-closed response。
+- No ToolRegistry/tool/resource/prompt registration was added。
+
+Known deferrals:
+- No MCP tools/resources/prompts exposure。
+- No remote MCP / Streamable HTTP / OAuth。
+- Downstream list/call/resource/prompt support remains for later Tickets。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `a114fa9d`。
+- Diff from acceptance `c0e760d7..HEAD` is one implementation commit touching 8 files, about 1369 insertions / 1 deletion。
+- `git diff --check c0e760d7..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on process lifecycle cleanup, JSON-RPC framing/bounds, stdout/stderr handling, secret redaction, sampling/elicitation fail-closed, no ToolRegistry/resources/prompts exposure, test determinism, and package/Nix impact。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T07:46:38Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WRY-r1` against implementation branch `impl/00001KVHR3WRY-mcp-stdio-lifecycle-client`。
+- Review target commit: `a114fa9d mcp: implement stdio lifecycle client`。
+- Review baseline: `c0e760d7`。
+- Reviewer task focuses on process lifecycle cleanup, JSON-RPC framing/bounds, initialize negotiation, stderr diagnostics/redaction, sampling/elicitation fail-closed behavior, no ToolRegistry/resources/prompts exposure, crate layering, deterministic tests, and Nix/package impact。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WRY-r1 at: 2026-06-20T07:51:30Z status: request_changes -->
+
+## Review: request changes
+
+Verdict: `request_changes`
+
+確認範囲:
+- Ticket contract。
+- Diff: `c0e760d7..a114fa9d`。
+- 主な対象: `crates/mcp/src/stdio.rs`, `crates/mcp/src/lib.rs`, `crates/mcp/tests/stdio_lifecycle.rs`, `crates/mcp/tests/fixtures/mock_server.rs`, `crates/mcp/Cargo.toml`, root `Cargo.toml`, `Cargo.lock`, `package.nix`。
+- ToolRegistry/resource/prompt registration leakage と remote MCP/OAuth/HTTP scope creep を確認。
+
+良い点:
+- stdio child spawn、newline JSON-RPC framing、initialize + initialized notification、bounded stdout/stderr handling、stderr-as-diagnostics、fail-closed server-to-client requests、shutdown/terminate/kill fallback、no model-visible registration surface は Ticket intent に概ね沿っている。
+
+Blocking issue:
+1. Resolved stdio server spec の derived `Debug` が secret/env values を leak できる。
+   - `crates/mcp/src/stdio.rs`
+   - `McpStdioServerSpec` derives `Debug`。
+   - `env: BTreeMap<String, String>` に inherited/env/literal/secret-derived values が入る。
+   - `Redactions` は stderr/protocol diagnostics には使われているが、resolved spec 自体を `{:?}` で format/log すると env values が plaintext で出る。
+   - これは Ticket の secret/env redaction 要件に反する。
+
+Required fix:
+- `McpStdioServerSpec` から `Debug` を外す、または env values を出さない custom redacted `Debug` を実装する。
+- custom `Debug` を残す場合は regression test を追加する。
+
+Non-blocking concerns:
+- Initialize response の `protocolVersion` compatibility enforcement は今後 tools/resources/prompts registration 前に判断が必要。Lifecycle slice としては follow-up で可。
+- `Drop` cleanup は best-effort `start_kill` / `kill_on_drop`。Downstream code should prefer explicit `shutdown()`。
+
+Reviewer validation:
+- `git diff --check c0e760d7..HEAD`: passed。
+- `cargo fmt --check`: passed。
+- `cargo test -p mcp`: passed。
+- `cargo check`: passed。
+- `nix build .#yoi --no-link`: passed。
+- `cargo tree -p mcp --depth 1`: inspected; no product façade dependency found。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:55:55Z -->
+
+## Implementation report
+
+Coder r1-fix report received from `yoi-coder-00001KVHR3WRY`.
+
+New fix commit:
+- `f396e1a2 mcp: redact stdio server spec debug`
+
+Branch commits now:
+- `f396e1a2 mcp: redact stdio server spec debug`
+- `a114fa9d mcp: implement stdio lifecycle client`
+
+Fix summary:
+- Removed derived `Debug` from `McpStdioServerSpec`。
+- Added custom redacted `Debug` implementation。
+- Debug output preserves useful non-sensitive fields: `name`, `command`, `args`, `cwd`, env keys, and redaction count。
+- Debug output never prints resolved env values or redaction values。
+- Added regression test verifying `format!("{:?}", spec)` does not contain literal/inherited/env-ref/secret-ref plaintext values while still showing non-sensitive metadata。
+
+Coder validation reported as passing:
+- `cargo fmt --check`
+- `cargo test -p mcp`
+- `cargo check`
+- `git diff --check c0e760d7..HEAD`
+- `cargo tree -p mcp --depth 1`
+- `nix build .#yoi --no-link`
+
+Remaining deferrals:
+- Protocol-version compatibility enforcement before downstream tools/resources/prompts registration。
+- Downstream callers should prefer explicit `shutdown()` over best-effort `Drop` cleanup。
+
+Orchestrator evidence checked before r2 review:
+- Implementation worktree is clean。
+- HEAD is `f396e1a2`。
+- Fix diff from `a114fa9d..HEAD` touches `crates/mcp/src/stdio.rs` and `crates/mcp/tests/stdio_lifecycle.rs`, about 47 insertions / 1 deletion。
+- Overall `git diff --check c0e760d7..HEAD` produced no diagnostics。
+
+Next action:
+- Route back to Reviewer for r2 verification of the redacted `Debug` blocker and final acceptance criteria。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WRY-r1 at: 2026-06-20T07:58:02Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket authority / Orchestrator IntentPacket。
+- r2 fix diff: `a114fa9d..f396e1a2`。
+- 全体実装 diff: `c0e760d7..f396e1a2`。
+- 主な対象: `crates/mcp/src/stdio.rs`, `crates/mcp/tests/stdio_lifecycle.rs`, new crate/workspace/package changes, ToolRegistry/resource/prompt registration leakage の有無。
+
+Previous blocker verification:
+- `McpStdioServerSpec` no longer derives `Debug`; it is `Clone` only。
+- Custom `fmt::Debug` now redacts env values and prints only non-sensitive metadata / env keys / `redaction_count`。
+- `redactions` contents are not printed。
+- Regression test confirms `format!("{spec:?}")` includes useful non-sensitive metadata and excludes plaintext env-like values。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- None blocking for this Ticket。Implementation remains scoped to stdio lifecycle/protocol foundations and does not add ToolRegistry/resource/prompt registration or remote/OAuth surfaces。
+
+Reviewer validation:
+- `git diff --check c0e760d7..HEAD`: passed。
+- `cargo fmt --check`: passed。
+- `cargo test -p mcp`: passed; 5 tests passed including redacted Debug regression。
+- `cargo check`: passed。
+- `cargo tree -p mcp --depth 1`: inspected; dependencies limited to `libc`, `manifest`, `secrets`, `serde`, `serde_json`, `thiserror`, `tokio`; no product façade dependency。
+- `nix build .#yoi --no-link`: passed。
+- Additional grep found no added ToolRegistry/resource/prompt registration or remote/OAuth/HTTP scope creep。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T07:59:04Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `9cf5344f merge: mcp stdio lifecycle client`
+- Implementation commits included:
+  - `a114fa9d mcp: implement stdio lifecycle client`
+  - `f396e1a2 mcp: redact stdio server spec debug`
+
+Reviewer outcome:
+- r1 requested changes for `McpStdioServerSpec` derived `Debug` leaking resolved env/secret-derived values。
+- Coder added custom redacted `Debug` and regression test。
+- r2 approved with no blocking issues。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp`
+- `cargo check`
+- `cargo tree -p mcp --depth 1`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `112615056`
+
+Validation log:
+- inline Bash output for final validation command。
+
+Final state:
+- Orchestrator worktree clean at `9cf5344f` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T07:59:10Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `9cf5344f`, r2 review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p mcp`, `cargo check`, `cargo tree -p mcp --depth 1`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T07:59:30Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T07:59:30Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WRY` を完了しました。
+
+実装内容:
+- New internal crate `mcp` を追加しました。
+- Explicit MCP stdio server config から resolved stdio server spec を作成する bridge を追加しました。
+- Tokio child process による local stdio MCP server lifecycle foundation を実装しました。
+- stdin/stdout/stderr handling、newline-delimited JSON-RPC request/response handling、initialize/capability negotiation、`notifications/initialized` を実装しました。
+- stdout/stderr/protocol payloads は bounded に扱います。
+- stderr は bounded diagnostics/logging として扱い、protocol failure とは別扱いです。
+- server name / phase-aware errors を追加しました。
+- shutdown は stdin close / wait / terminate / kill fallback で deterministic に行います。
+- Server-to-client requests は fail-closed し、sampling/elicitation は advertise せず、unknown request は JSON-RPC error で返します。
+- `McpStdioServerSpec` の `Debug` は custom redacted 実装にし、resolved env/secret-derived values を出さない regression test を追加しました。
+- ToolRegistry / tools/resources/prompts registration、remote MCP / Streamable HTTP / OAuth は実装していません。
+
+主な commit:
+- `a114fa9d mcp: implement stdio lifecycle client`
+- `f396e1a2 mcp: redact stdio server spec debug`
+- `9cf5344f merge: mcp stdio lifecycle client`
+
+Review:
+- r1 は resolved spec `Debug` による env/secret leak で `request_changes`。
+- Coder が custom redacted `Debug` と regression test を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp`
+- `cargo check`
+- `cargo tree -p mcp --depth 1`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `112615056`
+
+---

.yoi/tickets/00001KVHR3WS6/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WS6","kind":"blocked_by","related_ticket":"00001KVHR3WRY","note":"Tool registration requires initialized MCP stdio lifecycle. `00001KVHR3WRY` is queued and depends on `00001KVHR3WRF`; leave this Ticket queued until lifecycle is closed.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-080022-2","ticket_id":"00001KVHR3WS6","kind":"accepted_plan","accepted_plan":{"summary":"Initialized MCP stdio lifecycle clientを使って `tools/list` を実行し、server-provided tool metadataを untrusted dataとして検証・正規化し、既存 `pod::feature` / ToolRegistry path経由で namespaced Yoi tools として登録する。This Ticket does not implement `tools/call` execution or resources/prompts.","branch":"impl/00001KVHR3WS6-mcp-tool-registration","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WS6-mcp-tool-registration","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHR3WS6-mcp-tool-registration` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が tools/list pagination/bounds、untrusted metadata/schema normalization、namespaced ToolRegistry registration、no tools/call execution、no resources/prompts registration を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T08:00:22Z"}

.yoi/tickets/00001KVHR3WS6/artifacts/relations.json

@@ -0,0 +1,21 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WS6",
+      "kind": "depends_on",
+      "target": "00001KVHR3WRY",
+      "note": "Tool registration requires initialized MCP stdio lifecycle.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    },
+    {
+      "ticket_id": "00001KVHR3WS6",
+      "kind": "related",
+      "target": "00001KTR81P9X",
+      "note": "MCP tool registration uses feature runtime-discovered contribution plumbing.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WS6/item.md

@@ -0,0 +1,49 @@
+---
+title: 'MCP: register server tools into ToolRegistry'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T08:46:32Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'tools-list', 'tool-registry', 'schema', 'untrusted-metadata']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:58:58Z'
+---
+
+## Background
+
+Once a configured MCP stdio server can initialize, Yoi should expose provider-discovered MCP tools as ordinary model-visible Yoi tools through the existing ToolRegistry path. Server-provided tool metadata and schemas are untrusted data.
+
+This Ticket only registers tools discovered through `tools/list` at provider initialization / safe refresh boundaries. It does not implement `tools/call` execution and does not allow model-visible tool schema mutation during an active run.
+
+## Requirements
+
+- Call MCP `tools/list` after initialize where supported.
+- Handle pagination / bounded listing.
+- Normalize MCP tool names into stable namespaced Yoi tool names that include server namespace.
+- Validate/normalize tool descriptions and input schemas as untrusted metadata.
+- Reject invalid schemas, duplicate names, and collisions fail-closed with diagnostics.
+- Register provider-discovered tool contributions through `pod::feature` / normal ToolRegistry path; no private MCP bypass.
+- Keep model-visible tool schema run-stable; `list_changed` handling is a later safe-boundary refresh/diagnostic problem, not mid-run mutation.
+- Do not register resources/prompts in this Ticket.
+
+## Acceptance criteria
+
+- Provider-discovered MCP mock server tool appears as model-visible Yoi tool with stable namespaced name.
+- Invalid schema is rejected with bounded diagnostic.
+- Duplicate/colliding names are rejected fail-closed.
+- Server metadata cannot weaken Yoi instructions/scope/permissions.
+- No `tools/call` request is sent during registration.
+- Active-run model-visible schema is not mutated by this registration path.
+- Tests cover valid registration, pagination/bounds, invalid schema, duplicate/collision, untrusted metadata normalization, and run-stable schema behavior.
+
+## Non-goals
+
+- MCP tool execution.
+- Resources/prompts operations.
+- list_changed notifications.
+
+## Related work
+
+- Depends on `00001KVHR3WRY`.
+- Objective: `00001KTR80WMN`.

.yoi/tickets/00001KVHR3WS6/resolution.md

@@ -0,0 +1,39 @@
+## Resolution
+
+`00001KVHR3WS6` を完了しました。
+
+実装内容:
+- MCP `tools/list` protocol result/tool types と bounded pagination helper を `crates/mcp` に追加しました。
+- MCP stdio discovery feature module を `crates/pod` に追加しました。
+- Configured stdio server を initialize し、bounded `tools/list` を呼び、server-provided tool metadata を untrusted data として検証・正規化して ToolRegistry contribution path に登録します。
+- Tool names は server namespace を含む stable namespaced name（例: `Mcp_<server>_<tool>`）に正規化されます。
+- Invalid schema、duplicate/colliding normalized names は bounded diagnostics で fail-closed になります。Collision 時は該当 normalized identity は model-visible tool になりません。
+- Server metadata / annotations / instructions は Yoi instructions, scope, permissions, system/developer instructions を弱める authority として扱いません。
+- Registration は existing protocol-provider / ToolRegistry contribution path を通ります。
+- This Ticket は `tools/call` execution を実装していません。Registered discovery-only stub は explicit not-implemented error を返し、MCP `tools/call` は送信しません。
+- Resources/prompts/list_changed は実装していません。
+
+主な commit:
+- `66fa9d55 mcp: register stdio server tools`
+- `0080c5b3 mcp: reject colliding tool names`
+- `a1f904b8 merge: mcp tool registration`
+
+Review:
+- r1 は duplicate/colliding normalized MCP tool names が diagnostic-only で fail-closed でないため `request_changes`。
+- Coder が collision handling を修正し、該当 identity が model-visible にならない test を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_tools --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp --lib`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113089912`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-SnBew4.log`

.yoi/tickets/00001KVHR3WS6/thread.md

@@ -0,0 +1,403 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:58:58Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により routing 対象として確認したが、`00001KVHR3WS6` は `00001KVHR3WRY` に `depends_on` している。MCP tools/list registration は initialized stdio lifecycle を前提にするため、`00001KVHR3WRY` が closed になるまで実装開始せず queued のまま保持する。
+
+Next:
+- `00001KVHR3WRY` が closed になった後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T08:00:45Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- 前回は `00001KVHR3WRY` stdio JSON-RPC lifecycle が未完了だったため blocked/queued hold としたが、現在 `00001KVHR3WRY` は closed。
+- Ticket body は `tools/list` による registration scope、metadata/schema normalization、ToolRegistry integration、no `tools/call` execution、no resources/prompts を明確に分離している。
+- 現在 inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は mcp / tools-list / ToolRegistry / schema / untrusted metadata だが、Ticket は server metadata を untrusted data として扱い、invalid schema / duplicate / collision を fail-closed、normal ToolRegistry pathを使い、no private MCP bypass / no `tools/call` during registration などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WS6` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WS6)`: outgoing `depends_on 00001KVHR3WRY` is now closed。Incoming `00001KVHR3WSD` / `00001KVHR3WSW` are downstream and not blockers。
+- `TicketOrchestrationPlanQuery(00001KVHR3WS6)`: previous `blocked_by 00001KVHR3WRY` is resolved; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `68a8fc97`。
+  - queued: `00001KVHR3WS6`, `00001KVHR3WSD`, `00001KVHR3WSN`, `00001KVHR3WSW`。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching MCP tool-registration branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Use the stdio MCP lifecycle client to call `tools/list` and register discovered MCP tools as ordinary Yoi model-visible tools through existing `pod::feature` / ToolRegistry contribution paths。
+- This Ticket implements registration/discovery only. It must not send `tools/call`, execute MCP tools, or expose resources/prompts。
+
+Binding decisions / invariants:
+- Server-provided tool names, descriptions, schemas, annotations, and metadata are untrusted data。
+- Normalize MCP tool names into stable namespaced Yoi tool names that include server namespace and avoid collisions。
+- Validate/normalize descriptions and JSON schemas before ToolRegistry registration; invalid schemas/duplicates/collisions fail closed with bounded diagnostics。
+- No server metadata may weaken Yoi instructions, scope, permissions, tool permissions, or system/developer instructions。
+- Registration must go through normal ToolRegistry / `pod::feature` dynamic contribution path; no private MCP bypass。
+- Do not send `tools/call` during registration。
+- Do not register resources/prompts in this Ticket。
+- Preserve lifecycle safety/redaction from `00001KVHR3WRY`。
+
+Requirements / acceptance criteria:
+- MCP mock server tool appears as model-visible Yoi tool with stable namespaced name。
+- Invalid schema is rejected with bounded diagnostic。
+- Duplicate/colliding names are rejected fail-closed。
+- Server metadata cannot weaken Yoi instructions/scope/permissions。
+- No `tools/call` request is sent during registration。
+- Tests cover valid registration, pagination/bounds, invalid schema, duplicate/collision, and untrusted metadata normalization。
+
+Escalate if:
+- Existing `pod::feature` dynamic contribution API cannot register MCP tools without broader provider-substrate changes。
+- Schema normalization requires product decisions beyond safe JSON schema subset / bounded diagnostics。
+- ToolRegistry registration would force `tools/call` execution into this Ticket。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T08:00:53Z from: queued to: inprogress reason: orchestrator_acceptance_mcp_tool_registration field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, closed MCP lifecycle dependency, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded ToolRegistry/schema context were checked. Dependency `00001KVHR3WRY` is closed, no inprogress/capacity blocker exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:01:48Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `a59e5c1e ticket: accept mcp tool registration`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WS6-mcp-tool-registration` on branch `impl/00001KVHR3WS6-mcp-tool-registration` at `a59e5c1e`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WS6` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, `tools/call`, resources/prompts exposure, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:29:21Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WS6`.
+
+Implementation commit:
+- `66fa9d55 mcp: register stdio server tools`
+
+Changed areas reported:
+- `crates/mcp`:
+  - Added MCP `tools/list` protocol result/tool types。
+  - Added `list_tools_page` and bounded paginated `list_tools_bounded`。
+  - Added mock-server coverage for paginated `tools/list` and assertion that `tools/call` is not sent。
+- `crates/pod`:
+  - Added MCP stdio discovery feature module。
+  - Resolves configured stdio servers, initializes them, calls bounded `tools/list`, normalizes discovered tools, and registers them through existing protocol-provider / ToolRegistry contribution paths。
+  - Namespaces tools as stable names like `Mcp_<server>_<tool>`。
+  - Rejects invalid schemas and duplicate normalized names with bounded diagnostics。
+  - Ignores untrusted MCP metadata/annotations/instructions for authority purposes。
+  - Registered tools are discovery-only and return explicit not-implemented error if invoked; no MCP `tools/call` execution is implemented in this Ticket。
+- `package.nix` / `Cargo.lock`: updated for new `pod -> mcp` dependency and refreshed `cargoHash`。
+
+Coder validation reported:
+- `cargo test -p mcp list_tools --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp --lib`
+- `cargo test -p mcp`
+- `cargo fmt --check`
+- `cargo check -p pod -p mcp`
+- `git diff --check`
+- `nix build .#yoi --no-link` after refreshing stale `cargoHash`。
+
+Known risks / deferrals reported:
+- MCP tool execution remains intentionally unimplemented; registered discovery-only stubs never send `tools/call`。
+- Resources/prompts and `list_changed` handling are deferred。
+- Secret-backed MCP stdio env resolution currently passes no Pod secret store from this integration path; non-secret stdio configs are supported by this Ticket。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `66fa9d55`。
+- Diff from acceptance `a59e5c1e..HEAD` is one implementation commit touching 9 files, about 852 insertions / 4 deletions。
+- `git diff --check a59e5c1e..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on ToolRegistry contribution path, schema/name normalization, no `tools/call`, discovery-only invocation behavior, metadata authority boundaries, secret-store deferral, and tests。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T08:30:22Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WS6-r1` against implementation branch `impl/00001KVHR3WS6-mcp-tool-registration`。
+- Review target commit: `66fa9d55 mcp: register stdio server tools`。
+- Review baseline: `a59e5c1e`。
+- Reviewer task focuses on normal ToolRegistry contribution path, untrusted metadata/schema/name normalization, no `tools/call`, discovery-only invocation behavior, no resources/prompts/list_changed registration, diagnostics bounds, secret-store deferral, and tests。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WS6-r1 at: 2026-06-20T08:35:07Z status: request_changes -->
+
+## Review: request changes
+
+Verdict: `request_changes`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Diff: `a59e5c1e..66fa9d55`。
+- 主な対象: `crates/pod/src/feature/mcp.rs`, `crates/pod/src/controller.rs`, `crates/pod/src/feature.rs`, `crates/mcp/src/stdio.rs`, `crates/mcp/tests/stdio_lifecycle.rs`, `crates/mcp/tests/fixtures/mock_server.rs`, `crates/pod/Cargo.toml`, `Cargo.lock`, `package.nix`。
+- `tools/call`, resources/prompts registration, `list_changed`/`listChanged` handlingを確認。
+
+Blocking issue:
+1. Duplicate/colliding MCP tool names が fail-closed で reject されていない。
+   - Path: `crates/pod/src/feature/mcp.rs`
+   - `normalize_listed_tools` は最初の normalized name を登録し、後続 duplicate は diagnostic を出して skip するだけ。
+   - Test `duplicate_names_after_normalization_are_diagnostic_only` はこの挙動を期待している。
+   - Ticket / IntentPacket は invalid schemas / duplicates / collisions を fail-closed with bounded diagnostics と要求している。
+   - Server-controlled ordering で衝突する片方が model-visible tool として勝つため、normalized tool identity に対して fail-closed ではない。
+
+Required fix:
+- Duplicate/colliding normalized names は、少なくとも該当 normalized identity の tool を model-visible にしないこと。
+- より安全には、その server contribution/tool set 全体を reject/diagnostic-only にすること。
+- Test を更新し、colliding normalized name が model-visible tool として登録されないことを確認する。
+
+Non-blocking concerns / follow-ups:
+- Acceptance criteria の run-stable schema behavior について、active-run refresh/list_changed mutation は見当たらないが、明示テストはない。可能なら追加するとよい。
+- Secret-backed stdio env は integration path が `resolve_stdio_server(..., None)` のため bounded diagnostic で fail し、silent support claim はしていない。これは今回の deferral と整合。
+
+Positive findings:
+- `tools/list` は initialize 後に `McpStdioClient::list_tools_bounded` 経由で呼ばれる。
+- Pagination / tool-count bounds がある。
+- `tools/call` execution path は追加されていない。model-visible stub は not-implemented error を返す。
+- Resources/prompts は登録されていない。
+- Registration は既存 `pod::feature` protocol-provider contribution path を通って Worker/ToolRegistry に入る。
+- Server `instructions`, annotations, `_meta`, output schema は authority として使われていない。
+- Lifecycle redaction/shutdown behavior は保持されている。
+- Nix/Cargo dependency updates は minimal/consistent。
+
+Reviewer validation:
+- `cargo fmt --check`: passed。
+- `git diff --check a59e5c1e..HEAD`: passed。
+- `cargo test -p mcp list_tools --test stdio_lifecycle`: passed。
+- `cargo test -p pod feature::mcp --lib`: passed。
+- `cargo test -p mcp`: passed。
+- `cargo check -p pod -p mcp`: passed。
+- `nix build .#yoi --no-link`: passed。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:40:48Z -->
+
+## Implementation report
+
+Coder r1-fix report received from `yoi-coder-00001KVHR3WS6`.
+
+New fix commit:
+- `0080c5b3 mcp: reject colliding tool names`
+
+Branch commits now:
+- `0080c5b3 mcp: reject colliding tool names`
+- `66fa9d55 mcp: register stdio server tools`
+
+Fix summary:
+- Changed duplicate/collision handling in `crates/pod/src/feature/mcp.rs` to fail closed for the normalized tool identity。
+- Implementation now normalizes all valid candidate tools first, counts namespaced normalized names, emits bounded duplicate diagnostics, and registers only candidates whose normalized name appears exactly once。
+- Server-controlled ordering can no longer cause the first colliding definition to become model-visible。
+- Updated test to prove `Mcp_demo_search_files` is not model-visible when produced by two colliding MCP tool names, while unrelated valid `Mcp_demo_unique` still registers。
+
+Coder validation reported as passing:
+- `cargo fmt --check`
+- `git diff --check a59e5c1e..HEAD`
+- `cargo test -p mcp list_tools --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp --lib`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+
+Remaining deferrals unchanged:
+- MCP `tools/call` execution remains intentionally unimplemented。
+- Resources/prompts and `list_changed` handling remain out of scope。
+
+Orchestrator evidence checked before r2 review:
+- Implementation worktree is clean。
+- HEAD is `0080c5b3`。
+- Fix diff from `66fa9d55..HEAD` touches only `crates/pod/src/feature/mcp.rs`, about 43 insertions / 17 deletions。
+- Overall `git diff --check a59e5c1e..HEAD` produced no diagnostics。
+
+Next action:
+- Route back to Reviewer for r2 verification of duplicate/collision fail-closed behavior and final acceptance criteria。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WS6-r1 at: 2026-06-20T08:44:25Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Fix diff: `66fa9d55..0080c5b3`。
+- Overall diff: `a59e5c1e..0080c5b3`。
+- 主な対象: `crates/pod/src/feature/mcp.rs`、MCP registration boundaries、ToolRegistry contribution path、no `tools/call` / no resources/prompts、bounded `tools/list` pagination、metadata/schema/name normalization、discovery-only stub behavior、Cargo/Nix changes。
+
+Previous blocker verification:
+- `normalize_listed_tools` は valid candidates を先に構築し、normalized namespaced name を count するようになった。
+- count > 1 の names には bounded duplicate diagnostic を出す。
+- 登録されるのは normalized name が exactly once の candidate のみ。
+- Updated test `duplicate_names_after_normalization_are_not_model_visible` は、`search-files` / `search files` の collision が `Mcp_demo_search_files` を model-visible にしないこと、および unrelated valid `Mcp_demo_unique` は register されることを確認している。
+- これにより duplicate/colliding MCP tool names が fail-closed になるという Ticket requirement を満たしている。
+
+Blocking issues: none。
+
+Non-blocking follow-up:
+- 複数 configured MCP servers 間の sanitized server namespace collision について、将来 explicit coverage を追加してもよいが、この Ticket の discovered-tool name collision acceptance path では blocker ではない。
+
+Reviewer validation:
+- `cargo fmt --check`: passed。
+- `git diff --check a59e5c1e..HEAD`: passed。
+- `cargo test -p mcp list_tools --test stdio_lifecycle`: passed, 3 tests。
+- `cargo test -p pod feature::mcp --lib`: passed, 5 tests。
+- `cargo test -p mcp`: passed, 8 tests。
+- `cargo check -p pod -p mcp`: passed。
+- `nix build .#yoi --no-link`: passed。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:46:04Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `a1f904b8 merge: mcp tool registration`
+- Implementation commits included:
+  - `66fa9d55 mcp: register stdio server tools`
+  - `0080c5b3 mcp: reject colliding tool names`
+
+Reviewer outcome:
+- r1 requested changes because duplicate/colliding normalized MCP tool names were diagnostic-only and allowed the first colliding definition to become model-visible。
+- Coder changed normalization to count all valid names first and register only identities that occur exactly once, plus updated tests。
+- r2 approved with no blocking issues。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_tools --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp --lib`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `113089912`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-SnBew4.log`
+
+Final state:
+- Orchestrator worktree clean at `a1f904b8` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+- Dashboard/Console refactor is now running in parallel in separate child worktree and is unaffected by this merge。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T08:46:10Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `a1f904b8`, r2 review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, focused `mcp` and `pod feature::mcp` tests, `cargo check -p pod -p mcp`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T08:46:32Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T08:46:32Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WS6` を完了しました。
+
+実装内容:
+- MCP `tools/list` protocol result/tool types と bounded pagination helper を `crates/mcp` に追加しました。
+- MCP stdio discovery feature module を `crates/pod` に追加しました。
+- Configured stdio server を initialize し、bounded `tools/list` を呼び、server-provided tool metadata を untrusted data として検証・正規化して ToolRegistry contribution path に登録します。
+- Tool names は server namespace を含む stable namespaced name（例: `Mcp_<server>_<tool>`）に正規化されます。
+- Invalid schema、duplicate/colliding normalized names は bounded diagnostics で fail-closed になります。Collision 時は該当 normalized identity は model-visible tool になりません。
+- Server metadata / annotations / instructions は Yoi instructions, scope, permissions, system/developer instructions を弱める authority として扱いません。
+- Registration は existing protocol-provider / ToolRegistry contribution path を通ります。
+- This Ticket は `tools/call` execution を実装していません。Registered discovery-only stub は explicit not-implemented error を返し、MCP `tools/call` は送信しません。
+- Resources/prompts/list_changed は実装していません。
+
+主な commit:
+- `66fa9d55 mcp: register stdio server tools`
+- `0080c5b3 mcp: reject colliding tool names`
+- `a1f904b8 merge: mcp tool registration`
+
+Review:
+- r1 は duplicate/colliding normalized MCP tool names が diagnostic-only で fail-closed でないため `request_changes`。
+- Coder が collision handling を修正し、該当 identity が model-visible にならない test を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_tools --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp --lib`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113089912`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-SnBew4.log`
+
+---

.yoi/tickets/00001KVHR3WSD/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WSD","kind":"blocked_by","related_ticket":"00001KVHR3WS6","note":"tools/call execution requires registered MCP tools. `00001KVHR3WS6` is queued and depends on lifecycle; leave this Ticket queued until tool registration is closed.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-084746-2","ticket_id":"00001KVHR3WSD","kind":"accepted_plan","accepted_plan":{"summary":"Registered MCP tool invocationを existing ordinary Tool pathから MCP `tools/call` に接続する。PreToolCall/Tool permission denial は server request 前に適用し、normal result / MCP `isError` / JSON-RPC protocol error を区別し、content/structuredContent/_meta を boundedに Tool resultへ変換する。","branch":"impl/00001KVHR3WSD-mcp-tools-call","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WSD-mcp-tools-call","role_plan":"ユーザーが blocker のない作業の並列実行を許可したため、Dashboard/Console refactor と並行して MCP `tools/call` Ticket を専用 worktree `.worktree/00001KVHR3WSD-mcp-tools-call` で開始する。Coder は child worktree narrow write scopeで実装し、Reviewer は permission-before-call、ordinary Tool history path、bounded result serialization、no resources/prompts/list_changed scope creep を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T08:47:46Z"}

.yoi/tickets/00001KVHR3WSD/artifacts/relations.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WSD",
+      "kind": "depends_on",
+      "target": "00001KVHR3WS6",
+      "note": "tools/call execution requires registered MCP tools.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WSD/item.md

@@ -0,0 +1,45 @@
+---
+title: 'MCP: execute tools/call through ordinary Tool path'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T09:18:51Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'tools-call', 'permission', 'history', 'bounded-output']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:59:04Z'
+---
+
+## Background
+
+After MCP tools are registered through ToolRegistry, invoking a Yoi MCP-backed tool should call the server's `tools/call` and return a bounded ordinary Tool result. Permission denial must happen before sending a request to the MCP server.
+
+## Requirements
+
+- Route registered MCP tool invocation to MCP `tools/call`.
+- Apply existing PreToolCall / Tool permission path before MCP server call.
+- If permission is denied, do not send `tools/call` to the server.
+- Distinguish normal result, MCP `isError: true`, and JSON-RPC protocol error.
+- Serialize MCP result forms boundedly: `content[]`, `structuredContent`, `isError`, `_meta`, and supported rich content summaries.
+- Store result through ordinary Tool result/history path.
+- Treat all content as untrusted.
+
+## Acceptance criteria
+
+- MCP mock tool returns normal result through ordinary Yoi Tool result.
+- MCP `isError: true` is represented distinctly from JSON-RPC protocol failure.
+- Permission denied call is not sent to the MCP server.
+- Oversize/rich results are bounded/truncated or rejected according to explicit policy.
+- Tool history shows ordinary tool call/result, not hidden context injection.
+- Tests cover normal result, `isError`, protocol error, permission denial, and output bounds.
+
+## Non-goals
+
+- resources/read or prompts/get.
+- list_changed notifications.
+- Sampling/elicitation.
+
+## Related work
+
+- Depends on `00001KVHR3WS6`.
+- Objective: `00001KTR80WMN`.

.yoi/tickets/00001KVHR3WSD/resolution.md

@@ -0,0 +1,37 @@
+## Resolution
+
+`00001KVHR3WSD` を完了しました。
+
+実装内容:
+- MCP `tools/call` typed request/result/content types を追加しました。
+- `McpStdioClient::call_tool(...)` を追加しました。
+- MCP discovered tool の discovery-only stub を executable `McpStdioTool` に置き換えました。
+- Execution は configured stdio MCP server を spawn/initialize し、`tools/call` を送信して shutdown します。
+- Permission denial は ordinary Worker `PreToolCall` path により Tool execution 前に適用されるため、denied call は MCP server に送信されません。
+- Results は ordinary Tool result/history path を通ります。Hidden context injection はありません。
+- Normal MCP result、MCP `isError: true`、JSON-RPC protocol error を区別しました。
+- MCP content / structuredContent / `_meta` / rich output は untrusted data として bounded に serialization されます。
+- Image/audio data は raw payload を落とし、size metadata のみ残します。
+- Resources/read、prompts/get、list_changed、sampling、elicitation は実装していません。
+
+主な commit:
+- `9a245403 mcp: execute stdio tool calls`
+- `399a9d43 merge: mcp tools call`
+
+Review:
+- r1 は `approve`。
+- Reviewer は permission-before-call、ordinary Tool result/history path、`isError` と protocol error の区別、bounded/untrusted result handling、out-of-scope surface が無いことを確認しました。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp`
+- `cargo check -p mcp -p pod`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113196368`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-lkjYsX.log`

.yoi/tickets/00001KVHR3WSD/thread.md

@@ -0,0 +1,314 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:59:04Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により routing 対象として確認したが、`00001KVHR3WSD` は `00001KVHR3WS6` に `depends_on` している。MCP `tools/call` execution は registered MCP tools を前提にするため、`00001KVHR3WS6` が closed になるまで実装開始せず queued のまま保持する。
+
+Next:
+- `00001KVHR3WS6` が closed になった後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T08:48:07Z -->
+
+## Decision
+
+Routing decision: implementation_ready_parallel
+
+Reason:
+- User directive: 「blocker無いなら並列にやっちゃえよ」。この指示により、未解決 blocker がない Ticket は並列実装対象として扱う。
+- 前回は `00001KVHR3WS6` tool registration が未完了だったため blocked/queued hold としたが、現在 `00001KVHR3WS6` は closed。
+- Ticket body は MCP `tools/call` execution、permission-before-call、ordinary Tool result/history path、normal result / MCP `isError` / JSON-RPC protocol error の区別、bounded result serialization を実装可能な粒度で定義している。
+- 現在 inprogress は Dashboard/Console TUI refactor `00001KVHX0WBE` のみで、作業領域は TUI/CLI naming/module boundary。MCP `tools/call` 実装とは直接 conflict しないため、別 worktree / sibling Coder Pod で並列化できる。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk domain は mcp / tools-call / permission / history / bounded-output だが、Ticket は permission denied before server request、ordinary Tool result/history path、bounded output、untrusted content treatment を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WSD` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WSD)`: outgoing `depends_on 00001KVHR3WS6` is now closed。
+- `TicketOrchestrationPlanQuery(00001KVHR3WSD)`: previous `blocked_by 00001KVHR3WS6` is resolved; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `381db88e`。
+  - inprogress: `00001KVHX0WBE` only。
+  - visible spawned child: Dashboard/Console Coder only。
+  - no matching MCP tools-call branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Route invocation of registered MCP-backed Yoi tools to MCP `tools/call` through ordinary Yoi Tool execution/result/history paths。
+- Enforce existing PreToolCall / Tool permission policy before any MCP server request is sent。
+
+Binding decisions / invariants:
+- Permission denial must occur before sending `tools/call` to the MCP server。
+- MCP result content is untrusted and must not become hidden context injection。
+- Results must be recorded through ordinary Tool call/result history path。
+- Distinguish normal result, MCP `isError: true`, and JSON-RPC protocol error。
+- Serialize content blocks / structuredContent / `_meta` boundedly; oversize/rich results must be truncated or rejected by explicit policy。
+- Preserve lifecycle/registration redaction and bounds from previous MCP Tickets。
+- Do not implement resources/read, prompts/get, list_changed, sampling, or elicitation in this Ticket。
+
+Requirements / acceptance criteria:
+- MCP mock tool returns normal result through ordinary Yoi Tool result。
+- MCP `isError: true` is represented distinctly from JSON-RPC protocol failure。
+- Permission denied call is not sent to MCP server。
+- Oversize/rich results are bounded/truncated or rejected according to explicit policy。
+- Tool history shows ordinary tool call/result, not hidden context injection。
+- Tests cover normal result, `isError`, protocol error, permission denial, and output bounds。
+
+Escalate if:
+- Existing ToolRegistry contribution path cannot route invocation without broad provider-substrate redesign。
+- Permission-before-call cannot be represented without changing Tool policy architecture。
+- Result serialization requires product decisions beyond a safe bounded subset。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T08:48:15Z from: queued to: inprogress reason: orchestrator_acceptance_parallel_mcp_tools_call field: state -->
+
+## State changed
+
+User explicitly authorized parallel implementation when no blocker exists. Ticket body/thread, relation metadata, closed MCP tool-registration dependency, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded MCP tools/call context were checked. Dependency `00001KVHR3WS6` is closed, no matching worktree/branch exists, and no missing planning decision was found. Accepting this queued Ticket for parallel implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:49:21Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- User explicitly authorized parallel work for Tickets without blockers。
+- Acceptance records were committed on Orchestrator branch: `92432ad7 ticket: accept mcp tools call`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WSD-mcp-tools-call` on branch `impl/00001KVHR3WSD-mcp-tools-call` at `92432ad7`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WSD` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, resources/prompts/list_changed scope creep, merge, Ticket close, and cleanup。
+
+Next action:
+- Let MCP tools/call Coder proceed in parallel with Dashboard/Console Coder. Inspect implementation reports and route each to Reviewer when ready。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:08:42Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WSD`.
+
+Implementation commit:
+- `9a245403 mcp: execute stdio tool calls`
+
+Changed areas reported:
+- `crates/mcp/src/stdio.rs`:
+  - Added typed `CallToolRequest`, `CallToolResult`, and `McpContentBlock`。
+  - Added `McpStdioClient::call_tool(...)` for MCP `tools/call`。
+- `crates/pod/src/feature/mcp.rs`:
+  - Replaced discovery-only MCP tool stub with executable `McpStdioTool`。
+  - Execution spawns/initializes the configured stdio MCP server, sends `tools/call`, then shuts down。
+  - Result serialization is deterministic/model-visible/untrusted and bounded: content block cap, text/string truncation, JSON depth/node caps, binary/rich image/audio data omitted with size metadata, final output byte cap。
+  - MCP `isError: true` is represented as an MCP tool-level result distinct from JSON-RPC protocol errors。
+- `crates/mcp/tests/fixtures/mock_server.rs`:
+  - Added mock modes for normal `tools/call`, MCP `isError`, JSON-RPC protocol error, and no-call assertion。
+- `crates/mcp/tests/stdio_lifecycle.rs`:
+  - Added focused lifecycle/client tests for normal result, `isError`, protocol error, and permission-denial-style no-call。
+
+Coder validation reported:
+- `cargo test -p mcp --test stdio_lifecycle`: passed, 12 tests。
+- `cargo test -p pod feature::mcp`: passed, 9 tests。
+- `cargo check -p mcp -p pod`: passed。
+- `cargo fmt --check`: passed。
+- `git diff --check`: passed。
+- `nix build .#yoi --no-link`: passed。
+
+Known deferrals:
+- MCP resources/read, prompts/get, list_changed, sampling, and elicitation remain unimplemented as requested。
+- MCP `isError: true` is returned through ordinary `ToolOutput` with explicit `status: "mcp_is_error"` / `isError: true`; JSON-RPC failures remain `ToolError`s。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `9a245403`。
+- Diff from acceptance `92432ad7..HEAD` is one implementation commit touching 4 files, about 688 insertions / 11 deletions。
+- `git diff --check 92432ad7..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on permission-before-call, ordinary Tool result/history path, `isError` vs protocol error distinction, output bounds/untrusted content, no resources/prompts/list_changed scope creep, and test coverage。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T09:09:50Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WSD-r1` against implementation branch `impl/00001KVHR3WSD-mcp-tools-call`。
+- Review target commit: `9a245403 mcp: execute stdio tool calls`。
+- Review baseline: `92432ad7`。
+- Reviewer task focuses on permission-before-call, ordinary Tool result/history path, `isError` vs protocol error semantics, output bounds/untrusted content, lifecycle redaction/shutdown preservation, no resources/prompts/list_changed/sampling/elicitation scope creep, tests, and package validation。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WSD-r1 at: 2026-06-20T09:16:53Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Implementation diff: `92432ad7..9a245403`。
+- 主な対象: `crates/pod/src/feature/mcp.rs`, `crates/mcp/src/stdio.rs`, `crates/mcp/tests/stdio_lifecycle.rs`, `crates/mcp/tests/fixtures/mock_server.rs`。
+- Ordinary Worker/permission path: `crates/llm-worker/src/worker.rs`, `crates/pod/src/permission.rs`, `crates/pod/src/feature.rs`。
+- Out-of-scope MCP surfaces (`resources/read`, `prompts/get`, `list_changed`, sampling/elicitation) の追加有無。
+
+Blocking issues: none。
+
+Critical risk checks:
+- Permission denial occurs before `tools/call` can be sent:
+  - MCP-discovered tools are ordinary `ToolDefinition`s wrapping `McpStdioTool`。
+  - Protocol-provider contributions install through `register_tool_contribution`, not a private bypass。
+  - Worker executes `pre_tool_call` first and only executes approved tools afterward。
+  - Pod manifest permissions are `PreToolCall` hooks returning deny as synthetic results。
+- Result flow uses ordinary Tool result/history path:
+  - `McpStdioTool::execute` returns `ToolOutput`。
+  - Worker converts to `ToolResult` and commits through existing history append path。
+  - No hidden context injection or out-of-band model context path found。
+- Normal MCP result / MCP `isError: true` / JSON-RPC protocol error are distinct:
+  - `CallToolResult` carries `is_error` separately from JSON-RPC error。
+  - MCP `isError: true` renders as model-visible untrusted data with `"status": "mcp_is_error"`。
+  - JSON-RPC error becomes `ToolError::ExecutionFailed` with protocol error wording。
+- Output bounding/untrusted handling exists for content blocks, text/string caps, JSON depth/node caps, rich image/audio data omission, and final byte cap。
+- Result root is marked `untrusted_mcp_tools_call_result` and preserves server payload as data。
+- Existing lifecycle/redaction/shutdown behavior is preserved。
+- No resources/prompts/list_changed/sampling/elicitation scope creep found。
+
+Non-blocking concerns / follow-ups:
+- MCP-specific permission-denial test is lifecycle no-call style, while actual Worker deny/no-execute behavior is covered by generic Worker synthetic-result test path. Code inspection confirms MCP tools use ordinary Worker path, so this is not blocking. Future MCP-specific Worker-level regression would make the invariant more direct。
+- Minor wording nit: successful `tools/call` with shutdown failure says “shutdown after tools/call failed”; functionally non-blocking。
+
+Reviewer validation:
+- `git diff --check 92432ad7..HEAD`: passed。
+- `cargo fmt --check`: passed。
+- `cargo test -p mcp --test stdio_lifecycle`: passed, 12 tests。
+- `cargo test -p pod feature::mcp`: passed, 9 tests。
+- `cargo check -p mcp -p pod`: passed。
+- `nix build .#yoi --no-link` not run by Reviewer because diff has no Cargo/Nix/source-filter changes and focused Rust checks passed。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:18:04Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `399a9d43 merge: mcp tools call`
+- Implementation commit included:
+  - `9a245403 mcp: execute stdio tool calls`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed permission-before-call through ordinary Worker PreToolCall path, ordinary Tool result/history path, distinct MCP `isError` vs JSON-RPC protocol error, bounded/untrusted result serialization, and no resources/prompts/list_changed/sampling/elicitation scope creep。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp`
+- `cargo check -p mcp -p pod`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `113196368`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-lkjYsX.log`
+
+Final state:
+- Orchestrator worktree clean at `399a9d43` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+- Dashboard/Console review remains active in parallel and is unaffected by this merge。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T09:18:12Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `399a9d43`, review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p mcp --test stdio_lifecycle`, `cargo test -p pod feature::mcp`, `cargo check -p mcp -p pod`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T09:18:51Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T09:18:51Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WSD` を完了しました。
+
+実装内容:
+- MCP `tools/call` typed request/result/content types を追加しました。
+- `McpStdioClient::call_tool(...)` を追加しました。
+- MCP discovered tool の discovery-only stub を executable `McpStdioTool` に置き換えました。
+- Execution は configured stdio MCP server を spawn/initialize し、`tools/call` を送信して shutdown します。
+- Permission denial は ordinary Worker `PreToolCall` path により Tool execution 前に適用されるため、denied call は MCP server に送信されません。
+- Results は ordinary Tool result/history path を通ります。Hidden context injection はありません。
+- Normal MCP result、MCP `isError: true`、JSON-RPC protocol error を区別しました。
+- MCP content / structuredContent / `_meta` / rich output は untrusted data として bounded に serialization されます。
+- Image/audio data は raw payload を落とし、size metadata のみ残します。
+- Resources/read、prompts/get、list_changed、sampling、elicitation は実装していません。
+
+主な commit:
+- `9a245403 mcp: execute stdio tool calls`
+- `399a9d43 merge: mcp tools call`
+
+Review:
+- r1 は `approve`。
+- Reviewer は permission-before-call、ordinary Tool result/history path、`isError` と protocol error の区別、bounded/untrusted result handling、out-of-scope surface が無いことを確認しました。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp --test stdio_lifecycle`
+- `cargo test -p pod feature::mcp`
+- `cargo check -p mcp -p pod`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113196368`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-lkjYsX.log`
+
+---

.yoi/tickets/00001KVHR3WSN/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WSN","kind":"blocked_by","related_ticket":"00001KVHR3WRY","note":"Resources/prompts operations require initialized MCP stdio lifecycle. `00001KVHR3WRY` is queued and depends on `00001KVHR3WRF`; leave this Ticket queued until lifecycle is closed.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-093652-2","ticket_id":"00001KVHR3WSN","kind":"accepted_plan","accepted_plan":{"summary":"MCP resources/list, resources/read, prompts/list, prompts/get を explicit namespaced Yoi tool operationsとして exposeし、returned content/templatesを untrusted ordinary Tool result dataとして履歴に記録する。Hidden context injection を導入せず、result size/rich content/paginationを boundedに扱う。","branch":"impl/00001KVHR3WSN-mcp-resources-prompts-tools","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WSN-mcp-resources-prompts-tools","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHR3WSN-mcp-resources-prompts-tools` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が resources/prompts explicit tool operations、ordinary Tool result/history path、hidden context injection absence、untrusted/bounded content handling、pagination/bounds、no list_changed/sampling/elicitation scope creep を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T09:36:52Z"}

.yoi/tickets/00001KVHR3WSN/artifacts/relations.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WSN",
+      "kind": "depends_on",
+      "target": "00001KVHR3WRY",
+      "note": "resources/prompts operations require initialized MCP stdio lifecycle.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WSN/item.md

@@ -0,0 +1,45 @@
+---
+title: 'MCP: expose resources and prompts as explicit tool operations'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T10:05:16Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'resources', 'prompts', 'prompt-context', 'history', 'untrusted-content']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:58:57Z'
+---
+
+## Background
+
+MCP resources and prompts must not become hidden context injection. They should be exposed as explicit Yoi tool operations whose results are recorded through ordinary Tool result/history paths.
+
+## Requirements
+
+- Expose MCP resources/prompts as explicit namespaced Yoi tool operations: `resources/list`, `resources/read`, `prompts/list`, and `prompts/get`.
+- Treat returned content/templates as untrusted tool result data.
+- Do not inject resource/prompt content directly into context outside history/tool result.
+- Bound result sizes and rich/embedded content serialization.
+- Handle pagination/list bounds where applicable.
+- Diagnostics identify server/resource/prompt operation without leaking secrets.
+
+## Acceptance criteria
+
+- `resources/list` and `resources/read` can be invoked as explicit tools.
+- `prompts/list` and `prompts/get` can be invoked as explicit tools.
+- Results are ordinary Tool results and history records.
+- No hidden context injection path is introduced.
+- Oversize/rich content is bounded.
+- Tests cover list/read/get happy paths, untrusted content, bounds, and no hidden injection.
+
+## Non-goals
+
+- MCP tool execution itself.
+- list_changed notification refresh.
+- Sampling/elicitation.
+
+## Related work
+
+- Depends on `00001KVHR3WRY`.
+- Related to `00001KVHR3WSD` for result serialization policy.
+- Objective: `00001KTR80WMN`.

.yoi/tickets/00001KVHR3WSN/resolution.md

@@ -0,0 +1,38 @@
+## Resolution
+
+`00001KVHR3WSN` を完了しました。
+
+実装内容:
+- MCP `resources/list`, `resources/read`, `prompts/list`, `prompts/get` の typed protocol structs / helpers を追加しました。
+- Server capabilities に応じて explicit namespaced Yoi tools を登録します。
+  - `Mcp_<server>_resources_list`
+  - `Mcp_<server>_resources_read`
+  - `Mcp_<server>_prompts_list`
+  - `Mcp_<server>_prompts_get`
+- Resources/prompts operations は ordinary Tool path / `ToolOutput` を通って実行されます。
+- Returned resources / prompt templates / prompt messages は untrusted Tool result data として serialization され、hidden context injection はありません。
+- Result serialization は list items、resource contents、prompt messages、text fields、`_meta`、structured JSON depth/node count、rich blobs/images/audio、final output bytes を bounded に扱います。
+- Capability が advertise されていない operation は model-visible tool として expose されません。
+- `list_changed` refresh、sampling、elicitation は実装していません。
+
+主な commit:
+- `3a22360a mcp: expose resources prompts tools`
+- `4a4590f8 merge: mcp resources prompts tools`
+
+Review:
+- r1 は `approve`。
+- Reviewer は explicit Tool operations、ordinary `ToolOutput` path、no hidden context injection、untrusted/bounded serialization、capability-gated registration、no sampling/elicitation/list_changed scope creep を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod mcp::tests`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113403880`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-4oVSE2.log`

.yoi/tickets/00001KVHR3WSN/thread.md

@@ -0,0 +1,335 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:58:57Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により routing 対象として確認したが、`00001KVHR3WSN` は `00001KVHR3WRY` に `depends_on` している。MCP resources/prompts operations は initialized stdio lifecycle を前提にするため、`00001KVHR3WRY` が closed になるまで実装開始せず queued のまま保持する。
+
+Next:
+- `00001KVHR3WRY` が closed になった後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T09:37:14Z -->
+
+## Decision
+
+Routing decision: implementation_ready_parallel
+
+Reason:
+- User directive: 「blocker無いなら並列にやっちゃえよ」。現在 inprogress は 0 件であり、依存 blocker も解消済みのため、この queued Ticket を開始する。
+- 前回は `00001KVHR3WRY` stdio lifecycle が未完了だったため blocked/queued hold としたが、現在 `00001KVHR3WRY` は closed。
+- Ticket body は resources/list, resources/read, prompts/list, prompts/get を explicit tool operations として exposeし、hidden context injection を禁止し、ordinary Tool result/history path・untrusted/bounded content handling・pagination/list bounds を明確にしている。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk domain は mcp / resources / prompts / prompt-context / history / untrusted-content だが、Ticket は explicit Tool operations、ordinary history、no hidden injection、bounded/rich content serialization を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WSN` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WSN)`: outgoing `depends_on 00001KVHR3WRY` is now closed。
+- `TicketOrchestrationPlanQuery(00001KVHR3WSN)`: previous `blocked_by 00001KVHR3WRY` is resolved; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `6ac916c7`。
+  - queued: `00001KVHR3WSN`, `00001KVHR3WSW`。
+  - inprogress: 0。
+  - spawned child implementation Pods: 0。
+  - no matching MCP resources/prompts branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Expose MCP resources/prompts as explicit namespaced Yoi tool operations: `resources/list`, `resources/read`, `prompts/list`, `prompts/get`。
+- Returned resources/prompt templates are untrusted Tool result data and must be recorded through ordinary Tool result/history paths。
+- Do not inject resource/prompt content directly into model context outside Tool history。
+
+Binding decisions / invariants:
+- No hidden context injection path。
+- All returned content/templates are untrusted data。
+- Bound result sizes and rich/embedded content serialization。
+- Handle pagination/list bounds where applicable。
+- Diagnostics identify server/resource/prompt operation without leaking secrets。
+- Do not implement MCP tool execution itself beyond existing completed support。
+- Do not implement list_changed refresh, sampling, or elicitation in this Ticket。
+- Preserve prior MCP lifecycle/tool-call redaction/bounds/ordinary Tool path behavior。
+
+Requirements / acceptance criteria:
+- `resources/list` and `resources/read` can be invoked as explicit tools。
+- `prompts/list` and `prompts/get` can be invoked as explicit tools。
+- Results are ordinary Tool results and history records。
+- No hidden context injection path is introduced。
+- Oversize/rich content is bounded。
+- Tests cover list/read/get happy paths, untrusted content, bounds, and no hidden injection。
+
+Escalate if:
+- Existing ToolRegistry/provider path cannot represent resources/prompts operations without broad provider-substrate changes。
+- MCP prompt message/content serialization requires product decision beyond safe bounded Tool result data。
+- Hidden context injection would be needed to satisfy a feature expectation; that would violate Ticket intent and must stop。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T09:37:22Z from: queued to: inprogress reason: orchestrator_acceptance_mcp_resources_prompts_tools field: state -->
+
+## State changed
+
+User explicitly authorized parallel implementation when no blocker exists. Ticket body/thread, relation metadata, closed MCP lifecycle dependency, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded MCP resources/prompts context were checked. Dependency `00001KVHR3WRY` is closed, no inprogress/capacity blocker exists, no matching worktree/branch exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:38:10Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `b2b4764f ticket: accept mcp resources prompts tools`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WSN-mcp-resources-prompts-tools` on branch `impl/00001KVHR3WSN-mcp-resources-prompts-tools` at `b2b4764f`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WSN` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, hidden context injection, list_changed/sampling/elicitation scope creep, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:57:12Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WSN`.
+
+Implementation commit:
+- `3a22360a mcp: expose resources prompts tools`
+
+Changed areas reported:
+- `crates/mcp/src/stdio.rs`:
+  - Added typed MCP protocol structs/helpers for `resources/list`, `resources/read`, `prompts/list`, and `prompts/get`。
+  - Added resource/prompt request/result models preserving untrusted server-owned fields as data。
+- `crates/pod/src/feature/mcp.rs`:
+  - Registers explicit namespaced MCP operation tools when server capabilities advertise resources/prompts:
+    - `Mcp_<server>_resources_list`
+    - `Mcp_<server>_resources_read`
+    - `Mcp_<server>_prompts_list`
+    - `Mcp_<server>_prompts_get`
+  - Executes these through ordinary `Tool` path using `ToolOutput`。
+  - Serializes resource/prompt content as bounded untrusted JSON tool-result data。
+  - Bounds list items, resource contents, prompt messages, text fields, JSON depth/node count, rich embedded blobs/images/audio, and total output bytes。
+  - Preserves existing MCP `tools/call` behavior and redacted diagnostics。
+  - Does not add hidden context injection; prompt/resource data is not appended as user/system messages。
+
+Tests reported:
+- Operation tool naming/origin/schema。
+- Discovery registers resource/prompt operations without requiring `tools` capability。
+- `resources/list` and `resources/read` happy paths through ordinary tool output。
+- `prompts/list` and `prompts/get` happy paths through ordinary tool output。
+- Untrusted prompt/resource content remains data。
+- Rich/oversize resource/prompt content is bounded/omitted/truncated。
+
+Coder validation reported:
+- `cargo test -p pod mcp::tests`: passed, 13 tests。
+- `cargo check -p pod -p mcp`: passed。
+- `cargo fmt --all --check`: passed。
+- `git diff --check`: passed。
+- `cargo test -p mcp`: passed, 12 stdio lifecycle tests。
+- `nix build .#yoi --no-link`: passed; dirty-tree warning expected because validation ran before commit。
+
+Known deferrals / notes:
+- `list_changed` refresh remains deferred。
+- Sampling/elicitation not implemented。
+- MCP resources/prompts tools are registered from advertised server capabilities; unsupported capabilities are not exposed as model-visible tools。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `3a22360a`。
+- Diff from acceptance `b2b4764f..HEAD` is one implementation commit touching 2 files, about 1225 insertions / 36 deletions。
+- `git diff --check b2b4764f..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on explicit tool operations, ordinary Tool result/history path, no hidden context injection, untrusted/bounded content serialization, capability-gated registration, pagination/bounds, no list_changed/sampling/elicitation scope creep, and tests。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T09:57:57Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WSN-r1` against implementation branch `impl/00001KVHR3WSN-mcp-resources-prompts-tools`。
+- Review target commit: `3a22360a mcp: expose resources prompts tools`。
+- Review baseline: `b2b4764f`。
+- Reviewer task focuses on explicit tool operations, ordinary Tool result/history path, no hidden context injection, untrusted/bounded resource/prompt content serialization, capability-gated registration, pagination/bounds, diagnostics redaction, no list_changed/sampling/elicitation scope creep, tests, and package validation。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WSN-r1 at: 2026-06-20T10:03:26Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Implementation diff: `b2b4764f..3a22360a`。
+- 変更 source files:
+  - `crates/mcp/src/stdio.rs`
+  - `crates/pod/src/feature/mcp.rs`
+- Focus: explicit tool exposure、capability-gated registration、ordinary `ToolOutput` execution、untrusted/bounded serialization、pagination behavior、diagnostics、hidden context injection / sampling / elicitation / `list_changed` scope creep absence。
+
+Blocking issues: none。
+
+Approval evidence:
+- `crates/mcp/src/stdio.rs` に resources/prompts protocol structs and request helpers が追加されている。
+  - `ListResourcesResult`, `ReadResourceRequest`, `ReadResourceResult`
+  - `ListPromptsResult`, `GetPromptRequest`, `GetPromptResult`
+  - `McpPromptMessage` and resource/prompt metadata fields。
+- `McpStdioClient` exposes explicit request methods only:
+  - `list_resources_page` -> `resources/list`
+  - `read_resource` -> `resources/read`
+  - `list_prompts_page` -> `prompts/list`
+  - `get_prompt` -> `prompts/get`
+- Registration is capability-gated:
+  - `resources` capability registers only `Mcp_<server>_resources_list` and `Mcp_<server>_resources_read`。
+  - `prompts` capability registers only `Mcp_<server>_prompts_list` and `Mcp_<server>_prompts_get`。
+  - Existing `tools/list` discovery is also gated by advertised `tools` capability。
+- Resource/prompt operations are ordinary `Tool` implementations:
+  - `McpStdioProviderOperationTool` implements `Tool::execute`。
+  - Results are returned as `ToolOutput { summary, content }`。
+  - No new `SystemItem`, hidden history append, hidden user/system message append, or direct context injection path found。
+- Returned content is serialized as JSON-ish untrusted data with explicit marker fields:
+  - `untrusted_mcp_resources_list_result`
+  - `untrusted_mcp_resources_read_result`
+  - `untrusted_mcp_prompts_list_result`
+  - `untrusted_mcp_prompts_get_result`
+- Bounds are applied to list items, resource content count, prompt message count, text fields, `_meta`, extra/structured JSON depth/node count, rich image/audio blob omitted-data markers, and final rendered content bytes。
+- Stdio reader remains fail-closed for unsupported server-to-client requests; no sampling, elicitation, or `list_changed` refresh was added。
+- Tests cover operation namespacing, capability-gated registration without `tools`, resource list/read happy paths, prompt list/get happy paths, untrusted/bounded output, and existing MCP tool execution result serialization/bounds。
+
+Non-blocking follow-ups:
+- “no context injection” は operation tool path / `ToolOutput` content unit testsで確認されており、E2E history inspection ではない。E2E 未設計の現状では許容だが、将来 MCP/history integration test があるとよい。
+- Shutdown-warning text は result serialization 後に append される。`bounded_diagnostic` では bounded だが、厳密に post-append final content <= max result output bytes を要求するなら follow-up で final re-bound を追加してもよい。
+
+Reviewer validation:
+- `git diff --check b2b4764f..HEAD`: passed。
+- `cargo fmt --all --check`: passed。
+- `cargo test -p pod mcp::tests`: passed, 13 tests。
+- `cargo test -p mcp`: passed, 12 tests。
+- `cargo check -p pod -p mcp`: passed。
+- `nix build .#yoi --no-link`: passed。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T10:04:45Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `4a4590f8 merge: mcp resources prompts tools`
+- Implementation commit included:
+  - `3a22360a mcp: expose resources prompts tools`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed explicit resources/prompts tool operations, capability-gated registration, ordinary `ToolOutput` execution, no hidden context injection path, untrusted/bounded serialization, no sampling/elicitation/list_changed scope creep, and focused tests。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod mcp::tests`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `113403880`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-4oVSE2.log`
+
+Final state:
+- Orchestrator worktree clean at `4a4590f8` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T10:04:54Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `4a4590f8`, review approved, and final Orchestrator validation passed: `cargo fmt --all --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p pod mcp::tests`, `cargo test -p mcp`, `cargo check -p pod -p mcp`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T10:05:16Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T10:05:16Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WSN` を完了しました。
+
+実装内容:
+- MCP `resources/list`, `resources/read`, `prompts/list`, `prompts/get` の typed protocol structs / helpers を追加しました。
+- Server capabilities に応じて explicit namespaced Yoi tools を登録します。
+  - `Mcp_<server>_resources_list`
+  - `Mcp_<server>_resources_read`
+  - `Mcp_<server>_prompts_list`
+  - `Mcp_<server>_prompts_get`
+- Resources/prompts operations は ordinary Tool path / `ToolOutput` を通って実行されます。
+- Returned resources / prompt templates / prompt messages は untrusted Tool result data として serialization され、hidden context injection はありません。
+- Result serialization は list items、resource contents、prompt messages、text fields、`_meta`、structured JSON depth/node count、rich blobs/images/audio、final output bytes を bounded に扱います。
+- Capability が advertise されていない operation は model-visible tool として expose されません。
+- `list_changed` refresh、sampling、elicitation は実装していません。
+
+主な commit:
+- `3a22360a mcp: expose resources prompts tools`
+- `4a4590f8 merge: mcp resources prompts tools`
+
+Review:
+- r1 は `approve`。
+- Reviewer は explicit Tool operations、ordinary `ToolOutput` path、no hidden context injection、untrusted/bounded serialization、capability-gated registration、no sampling/elicitation/list_changed scope creep を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod mcp::tests`
+- `cargo test -p mcp`
+- `cargo check -p pod -p mcp`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113403880`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-4oVSE2.log`
+
+---

.yoi/tickets/00001KVHR3WSW/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-060022-1","ticket_id":"00001KVHR3WSW","kind":"blocked_by","related_ticket":"00001KVHR3WS6","note":"list_changed handling requires initial tools/list registration. `00001KVHR3WS6` is queued and depends on lifecycle; leave this Ticket queued until tool registration is closed.","author":"yoi-orchestrator","at":"2026-06-20T06:00:22Z"}
+{"id":"orch-plan-20260620-100629-2","ticket_id":"00001KVHR3WSW","kind":"accepted_plan","accepted_plan":{"summary":"MCP `notifications/tools/list_changed`, `notifications/resources/list_changed`, `notifications/prompts/list_changed` を安全に扱う。Active run の model-visible schema/context を不意に変えず、safe boundary refresh / restart-required diagnostic / next-turn refresh など deterministic policyを実装し、silent staleを避ける。","branch":"impl/00001KVHR3WSW-mcp-list-changed","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHR3WSW-mcp-list-changed","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHR3WSW-mcp-list-changed` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が current-run schema/history invariants、safe-boundary refresh policy、bounded diagnostics、tools/resources/prompts notifications、no hidden resource/prompt context injection を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T10:06:29Z"}

.yoi/tickets/00001KVHR3WSW/artifacts/relations.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "relations": [
+    {
+      "ticket_id": "00001KVHR3WSW",
+      "kind": "depends_on",
+      "target": "00001KVHR3WS6",
+      "note": "tools/list_changed handling requires initial tools/list registration.",
+      "author": "yoi ticket",
+      "at": "2026-06-20T05:33:03Z"
+    }
+  ]
+}

.yoi/tickets/00001KVHR3WSW/item.md

@@ -0,0 +1,43 @@
+---
+title: 'MCP: handle list_changed notifications safely'
+state: 'closed'
+created_at: '2026-06-20T05:30:04Z'
+updated_at: '2026-06-20T10:32:59Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['mcp', 'notifications', 'tool-schema', 'prompt-cache', 'refresh']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T05:59:05Z'
+---
+
+## Background
+
+MCP servers can notify that tools/resources/prompts lists changed. Yoi must not silently go stale, but it also must not mutate the active run's model-visible tool schema or context in a way that violates history/prompt-cache invariants. This Ticket defines provider tool-list refresh behavior at safe boundaries.
+
+## Requirements
+
+- Handle MCP list-changed notifications: `notifications/tools/list_changed`, `notifications/resources/list_changed`, and `notifications/prompts/list_changed`.
+- Choose and implement a safe refresh policy: next-turn refresh, restart/reinitialize-required diagnostic, or bounded live refresh only if it preserves schema/history invariants.
+- Do not mutate current LLM context with hidden resource/prompt content.
+- Emit bounded diagnostics when refresh cannot be applied safely.
+- Tests with mock server notifications.
+
+## Acceptance criteria
+
+- list_changed does not silently stale forever.
+- Current run tool schema consistency is not broken.
+- Refresh/diagnostic behavior is deterministic and documented.
+- Prompt-context/history invariants are preserved.
+- Tests cover tools/resources/prompts list_changed and unsafe refresh fallback.
+
+## Non-goals
+
+- Initial tools/list registration.
+- Initial resources/prompts operations.
+- Remote MCP transports.
+
+## Related work
+
+- Depends on `00001KVHR3WS6` for tool list registration.
+- Related to `00001KVHR3WSN` for resources/prompts lists.
+- Objective: `00001KTR80WMN`.

.yoi/tickets/00001KVHR3WSW/resolution.md

@@ -0,0 +1,36 @@
+## Resolution
+
+`00001KVHR3WSW` を完了しました。
+
+実装内容:
+- MCP `notifications/tools/list_changed`, `notifications/resources/list_changed`, `notifications/prompts/list_changed` を bounded kind-only state として記録します。
+- Notification params は保存・render・behavior に使わず、hidden resource/prompt context injection を防止します。
+- Safe-boundary refresh 用の snapshot/clear API を追加しました。
+- Startup tool discovery では、registration 前に `tools/list_changed` が観測された場合のみ `tools/list` を最大 1 回 refresh します。
+- Refresh 後も変更が続く場合は bounded restart-required diagnostic を出し、active-run model-visible tool schema を post-registration mutation しません。
+- MCP tool/resource/prompt operations 中に list_changed が観測された場合、ordinary Tool output に bounded warning を明示的に返します。
+- Resource/prompt notifications は content fetch/injection を行わず、explicit list/read/get tools でのみ扱います。
+- Sampling / elicitation / remote transport は実装していません。
+
+主な commit:
+- `e33dee19 mcp: handle list changed notifications`
+- `ae5f3e42 merge: mcp list changed handling`
+
+Review:
+- r1 は `approve`。
+- Reviewer は current-run schema/history invariants、safe-boundary refresh、restart-required fallback、notification params の非使用、no hidden injection、no sampling/elicitation/remote scope creep を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_changed -- --nocapture`
+- `cargo test -p pod mcp::tests:: -- --nocapture`
+- `cargo test -p mcp`
+- `cargo check --workspace`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113428296`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-ddp5Ei.log`

.yoi/tickets/00001KVHR3WSW/thread.md

@@ -0,0 +1,309 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T05:30:04Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T05:59:05Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T06:00:44Z -->
+
+## Decision
+
+Routing decision: blocked_pending_dependency
+
+Panel Queue により routing 対象として確認したが、`00001KVHR3WSW` は `00001KVHR3WS6` に `depends_on` している。list_changed handling は initial tools/list registration を前提にするため、`00001KVHR3WS6` が closed になるまで実装開始せず queued のまま保持する。
+
+Next:
+- `00001KVHR3WS6` が closed になった後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T10:07:00Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- User directive: 「blocker無いなら並列にやっちゃえよ」。現在 inprogress は 0 件であり、最後に残った queued Ticket の dependency blocker も解消済みのため開始する。
+- 前回は `00001KVHR3WS6` initial tools/list registration が未完了だったため blocked/queued hold としたが、現在 `00001KVHR3WS6` は closed。
+- Related resources/prompts operations Ticket `00001KVHR3WSN` も closed になっており、tools/resources/prompts list_changed をまとめて扱う context が揃っている。
+- Ticket body は `notifications/tools/list_changed`, `notifications/resources/list_changed`, `notifications/prompts/list_changed` の handling、current run schema consistency、prompt-cache/history invariants、deterministic refresh/diagnostic behavior、unsafe refresh fallback を実装可能な粒度で定義している。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk domain は mcp / notifications / tool-schema / prompt-cache / refresh だが、Ticket は current run schema consistency、no hidden context mutation、bounded diagnostics を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHR3WSW` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHR3WSW)`: outgoing `depends_on 00001KVHR3WS6` is now closed。
+- `TicketOrchestrationPlanQuery(00001KVHR3WSW)`: previous `blocked_by 00001KVHR3WS6` is resolved; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `b11f83c8`。
+  - queued: this Ticket only。
+  - inprogress: 0。
+  - spawned child implementation Pods: 0。
+  - no matching MCP list_changed branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Handle MCP list_changed notifications without silently staying stale forever and without mutating active-run model-visible tool schema or prompt/context history invariants unsafely。
+- Implement a deterministic safe-boundary refresh / restart-required diagnostic / next-turn refresh policy that covers tools/resources/prompts list changes。
+
+Binding decisions / invariants:
+- Do not mutate current LLM context with hidden resource/prompt content。
+- Do not unexpectedly mutate active run tool schema in a way that breaks request/history/prompt-cache invariants。
+- list_changed notifications are signals; they should produce bounded state/diagnostic and deterministic refresh behavior at safe boundaries。
+- Bounded diagnostics should identify server and list kind without leaking secrets。
+- Preserve existing explicit Tool operations for tools/resources/prompts。
+- Do not implement remote transports, sampling, or elicitation。
+
+Requirements / acceptance criteria:
+- Handle `notifications/tools/list_changed`, `notifications/resources/list_changed`, and `notifications/prompts/list_changed`。
+- list_changed does not silently stale forever。
+- Current run tool schema consistency is not broken。
+- Refresh/diagnostic behavior is deterministic and documented。
+- Prompt-context/history invariants are preserved。
+- Tests cover tools/resources/prompts list_changed and unsafe refresh fallback。
+
+Escalate if:
+- Safe refresh requires changing Worker history/model schema lifecycle beyond this Ticket。
+- Current provider/feature architecture cannot represent pending refresh diagnostics without broad redesign。
+- A live schema mutation would be required to satisfy the feature expectation; stop instead and record restart/next-turn policy。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T10:07:07Z from: queued to: inprogress reason: orchestrator_acceptance_mcp_list_changed field: state -->
+
+## State changed
+
+User explicitly authorized implementation when no blocker exists. Ticket body/thread, relation metadata, closed MCP tool-registration dependency, closed resources/prompts context, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded list_changed/schema/history context were checked. Dependency `00001KVHR3WS6` is closed, no inprogress/capacity blocker exists, no matching worktree/branch exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T10:08:05Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `d31b8907 ticket: accept mcp list changed handling`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHR3WSW-mcp-list-changed` on branch `impl/00001KVHR3WSW-mcp-list-changed` at `d31b8907`。
+- Spawned Coder Pod `yoi-coder-00001KVHR3WSW` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, hidden context injection, unsafe active-run schema mutation, sampling/elicitation scope creep, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T10:26:13Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHR3WSW`.
+
+Implementation commit:
+- `e33dee19 mcp: handle list changed notifications`
+
+Changed areas reported:
+- `crates/mcp/src/stdio.rs`:
+  - Records bounded `notifications/tools/list_changed`, `notifications/resources/list_changed`, and `notifications/prompts/list_changed` state。
+  - Ignores notification params entirely so notifications cannot inject prompt/resource content or hidden context。
+  - Exposes snapshot/clear APIs for safe-boundary refresh decisions。
+- `crates/pod/src/feature/mcp.rs`:
+  - During startup tool discovery, refreshes `tools/list` once if `tools/list_changed` is observed before registration。
+  - If list changes continue during refresh, emits a restart-required diagnostic and does not mutate active-run tool schema after registration。
+  - During MCP tool/resource/prompt operations, appends bounded warnings to explicit tool output when list_changed is observed。
+  - Preserves explicit operations for `tools/call`, `resources/list/read`, and `prompts/list/get`; no notification-driven content injection。
+- Tests:
+  - Added stdio notification state coverage for tools/resources/prompts。
+  - Added provider/runtime tests for safe-boundary tool refresh, restart-required fallback, and resource/prompt warning behavior without leaking notification params。
+
+Coder validation reported:
+- `cargo test -p mcp list_changed -- --nocapture`: passed。
+- `cargo test -p pod mcp::tests:: -- --nocapture`: passed。
+- `cargo check --workspace`: passed。
+- `cargo test -p mcp`: passed。
+- `cargo test -p pod mcp::tests::`: passed。
+- `cargo fmt --all -- --check`: passed。
+- `git diff --check`: passed。
+- `nix build .#yoi --no-link`: passed; dirty-tree warning expected before commit。
+
+Known risks / deferrals:
+- Live mutation of already-presented model-visible MCP tool schemas is intentionally not implemented。
+- Continued `tools/list_changed` after one startup safe-boundary refresh produces bounded restart-required diagnostic。
+- Resource/prompt list refresh remains explicit via existing MCP list/read/get tools on later turns; notifications alone do not inject or fetch content。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `e33dee19`。
+- Diff from acceptance `d31b8907..HEAD` is one implementation commit touching 4 files, about 459 insertions / 9 deletions。
+- `git diff --check d31b8907..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on current-run schema/history invariants, safe-boundary refresh policy, bounded diagnostics, no hidden prompt/resource injection, tools/resources/prompts notification coverage, and tests。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T10:26:52Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHR3WSW-r1` against implementation branch `impl/00001KVHR3WSW-mcp-list-changed`。
+- Review target commit: `e33dee19 mcp: handle list changed notifications`。
+- Review baseline: `d31b8907`。
+- Reviewer task focuses on current-run schema/history invariants, safe-boundary refresh policy, bounded diagnostics, no hidden prompt/resource injection, notification param handling, tools/resources/prompts coverage, no sampling/elicitation/remote scope creep, tests, and package validation。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHR3WSW-r1 at: 2026-06-20T10:31:26Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket `00001KVHR3WSW` item/thread、Orchestrator IntentPacket、binding invariants。
+- Diff: `d31b8907..e33dee19`。
+- 主な対象:
+  - `crates/mcp/src/stdio.rs`
+  - `crates/mcp/tests/stdio_lifecycle.rs`
+  - `crates/mcp/tests/fixtures/mock_server.rs`
+  - `crates/pod/src/feature/mcp.rs`
+- Hidden context/history append、post-registration live ToolRegistry mutation、notification param usage/leakage、sampling/elicitation/remote transport scope creep の有無を確認。
+
+Blocking issues: none。
+
+Approval evidence:
+- `crates/mcp/src/stdio.rs` は `notifications/tools/list_changed`, `notifications/resources/list_changed`, `notifications/prompts/list_changed` を bounded enum state としてのみ記録している。
+- Notification `params` は incoming message shape として deserialize されるが、保存・render・behavior には使われない。
+- Startup discovery は model-visible tool registration 前に `tools/list_changed` を検出した場合、`tools/list` refresh を最大 1 回だけ行う。
+- Refresh 後も changes が続く場合は restart-required diagnostic を出し、post-registration ToolRegistry/schema mutation は行わない。
+- Runtime MCP tool/resource/prompt operations は list-change notification を ordinary Tool output の bounded warning として明示的に返す。Hidden resource/prompt content injection はない。
+- Sampling / elicitation / remote transport scope creep はない。
+- Tests は kind-only notification state、safe-boundary tool refresh、continued-change restart diagnostic、resources/prompts warnings、malicious notification params が漏れないことを cover している。
+
+Non-blocking follow-ups:
+- Runtime diagnostic wording に “restart the Pod or start a new run to rediscover tools” とある。MCP discovery が Pod-startup scoped であるなら、将来 “restart/reinitialize the Pod” のみに絞るとより明確。
+- Resources/prompts `list_changed` notifications observed during startup discovery は、explicit resource/prompt tool operations 中でない限り別途 surface されない。ただし resources/prompts lists は startup で cache されないため、この Ticket では blocking ではない。将来 persistent resource cache を持つなら明示 diagnostics が必要。
+
+Reviewer validation:
+- `cargo fmt --all --check`: passed。
+- `git diff --check d31b8907..HEAD`: passed。
+- `cargo test -p mcp list_changed -- --nocapture`: passed。
+- `cargo test -p pod mcp::tests:: -- --nocapture`: passed, 16 tests。
+- `cargo test -p mcp`: passed, 13 tests。
+- `cargo check --workspace`: passed。
+- `nix build .#yoi --no-link`: not run by Reviewer。
+
+Worktree status at review end: source tree clean; ignored `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T10:32:28Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `ae5f3e42 merge: mcp list changed handling`
+- Implementation commit included:
+  - `e33dee19 mcp: handle list changed notifications`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed bounded kind-only list_changed state, ignored notification params, safe-boundary startup refresh, restart-required fallback, no post-registration live schema mutation, no hidden resource/prompt injection, no sampling/elicitation/remote scope creep, and focused tests。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_changed -- --nocapture`
+- `cargo test -p pod mcp::tests:: -- --nocapture`
+- `cargo test -p mcp`
+- `cargo check --workspace`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `113428296`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-ddp5Ei.log`
+
+Final state:
+- Orchestrator worktree clean at `ae5f3e42` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T10:32:35Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `ae5f3e42`, review approved, and final Orchestrator validation passed: `cargo fmt --all --check`, `git diff --check HEAD^1..HEAD`, focused `mcp` and `pod mcp::tests::` tests, `cargo check --workspace`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T10:32:59Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T10:32:59Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHR3WSW` を完了しました。
+
+実装内容:
+- MCP `notifications/tools/list_changed`, `notifications/resources/list_changed`, `notifications/prompts/list_changed` を bounded kind-only state として記録します。
+- Notification params は保存・render・behavior に使わず、hidden resource/prompt context injection を防止します。
+- Safe-boundary refresh 用の snapshot/clear API を追加しました。
+- Startup tool discovery では、registration 前に `tools/list_changed` が観測された場合のみ `tools/list` を最大 1 回 refresh します。
+- Refresh 後も変更が続く場合は bounded restart-required diagnostic を出し、active-run model-visible tool schema を post-registration mutation しません。
+- MCP tool/resource/prompt operations 中に list_changed が観測された場合、ordinary Tool output に bounded warning を明示的に返します。
+- Resource/prompt notifications は content fetch/injection を行わず、explicit list/read/get tools でのみ扱います。
+- Sampling / elicitation / remote transport は実装していません。
+
+主な commit:
+- `e33dee19 mcp: handle list changed notifications`
+- `ae5f3e42 merge: mcp list changed handling`
+
+Review:
+- r1 は `approve`。
+- Reviewer は current-run schema/history invariants、safe-boundary refresh、restart-required fallback、notification params の非使用、no hidden injection、no sampling/elicitation/remote scope creep を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p mcp list_changed -- --nocapture`
+- `cargo test -p pod mcp::tests:: -- --nocapture`
+- `cargo test -p mcp`
+- `cargo check --workspace`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- `nix path-info -S .#yoi`: `113428296`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-ddp5Ei.log`
+
+---

.yoi/tickets/00001KVHX0WBE/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,2 @@
+{"id":"orch-plan-20260620-083118-1","ticket_id":"00001KVHX0WBE","kind":"waiting_capacity_note","note":"Panel Queue was accepted for routing review, but implementation is held because `00001KVHR3WS6` is currently inprogress with active Coder/Reviewer work. Leave this Dashboard/Console refactor Ticket queued; reroute when current implementation capacity is free.","author":"yoi-orchestrator","at":"2026-06-20T08:31:18Z"}
+{"id":"orch-plan-20260620-084158-2","ticket_id":"00001KVHX0WBE","kind":"accepted_plan","accepted_plan":{"summary":"`yoi panel` を Dashboard、単一Pod chat/client surfaceを Console、TUIをterminal UI implementation layerとして整理し、TUI module境界を Dashboard/Console 責務へ寄せる。主眼は naming/module-boundary/maintainability refactorであり、user-visible behavior変更や新alias追加は行わない。","branch":"impl/00001KVHX0WBE-dashboard-console-tui-boundary","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHX0WBE-dashboard-console-tui-boundary","role_plan":"ユーザーが blocker のない作業の並列実行を明示許可したため、Orchestrator は MCP tool registration と並行して専用 implementation worktree `.worktree/00001KVHX0WBE-dashboard-console-tui-boundary` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が Dashboard/Console/TUI 呼称、`yoi panel` command維持、不要alias不追加、Console/Dashboard entrypoint分離、multi_pod巨大責務分割、既存挙動/テスト維持を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T08:41:58Z"}

.yoi/tickets/00001KVHX0WBE/item.md

@@ -0,0 +1,163 @@
+---
+title: 'Dashboard / Console 呼称導入と TUI モジュール境界整理'
+state: 'closed'
+created_at: '2026-06-20T06:55:49Z'
+updated_at: '2026-06-20T09:35:52Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['ux-naming', 'module-boundary', 'public-cli', 'test-coverage']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T08:30:58Z'
+---
+
+## Background
+
+TUI まわりの user-facing surface 名と code/module 境界を明確にする。
+
+- **Dashboard**: `yoi panel`。workspace-level の Ticket / Pod / Companion / Orchestrator / Intake 状態と action を扱う surface。
+- **Console**: 通常の単一 Pod に接続して会話する chat/client surface。
+- **TUI**: Dashboard / Console / picker / setup UI などを実装する terminal UI crate/layer の総称。
+
+事前調査では `crates/tui/src/multi_pod.rs` は約 9452 lines で、実態は multi-Pod list というより workspace Dashboard 本体だった。主な責務分布は次の通り。
+
+```text
+    1-  307    entry/runtime loop
+  308-  451    background reload/notice handles
+  452-  792    intake launch/handoff helpers
+  793- 1160    diagnostics/e2e dashboard structs
+ 1161- 2422    MultiPodApp state + key/mouse/composer methods
+ 2423- 3377    snapshot/lifecycle/load
+ 3378- 4986    companion/orchestrator/ticket actions/queue handoff
+ 4987- 6258    row classification/layout/render
+ 6259- 9452    tests
+```
+
+関連ファイル規模の目安:
+
+```text
+  9452 crates/tui/src/multi_pod.rs
+  2812 crates/tui/src/workspace_panel.rs
+  2346 crates/tui/src/single_pod.rs
+  3689 crates/tui/src/app.rs
+  1851 crates/tui/src/ui.rs
+  1209 crates/tui/src/pod_list.rs
+   556 crates/tui/src/role_session_registry.rs
+```
+
+`multi_pod.rs` は unit test / async test も多く、挙動維持の根拠としてテストを活かしながらまとめて整理する。
+
+## Requirements
+
+- `Dashboard` / `Console` / `TUI` の呼称を導入し、help / docs / comments / test names / internal naming を可能な範囲で揃える。
+- `Dashboard` は `yoi panel` の user-facing surface 名とする。
+- `Console` は単一 Pod 接続チャットクライアントの user-facing surface 名とする。
+- `TUI` は terminal UI implementation layer の総称として扱い、Dashboard / Console の代替 mode 名として乱用しない。
+- `yoi panel` command 名は維持する。
+- `yoi dashboard` などの不要な互換 alias は追加しない。
+- Dashboard の起動 entrypoint を Console / `single_pod` 側から分離する。
+- Dashboard から Pod を開いて Console に入る bridge は残すが、narrow API として責務を明確にする。
+- `crates/tui/src/multi_pod.rs` を Dashboard module 境界へ寄せる。
+- `multi_pod.rs` の巨大化を解消するため、少なくとも次の責務を分離・整理する。
+  - Dashboard entry/runtime loop
+  - Dashboard app state / action dispatch
+  - Dashboard snapshot/lifecycle loading
+  - Companion / Orchestrator / Intake / Ticket action glue
+  - Dashboard render/layout/row classification
+  - Dashboard e2e diagnostics structs
+  - Dashboard tests
+- `workspace_panel.rs` は Dashboard view model builder としての責務を確認し、必要なら名前・配置・参照を Dashboard 語彙に寄せる。
+- `single_pod.rs` は Console 側の起動・接続・spawn/resume・chat loop を主責務にする。
+- 挙動変更は目的にしない。主眼は naming / module boundary / maintainability refactor。
+
+## Acceptance criteria
+
+- `yoi panel` が Dashboard として説明されている。
+- 単一 Pod UI が Console として説明されている。
+- `TUI` が Dashboard / Console の総称 implementation layer として整理されている。
+- `LaunchMode::Panel` が `single_pod::run_panel` のような Console module entrypoint に直接流れない。
+- Dashboard entrypoint が Dashboard module 側にある。
+- Console module は単一 Pod chat/connect/spawn/resume の責務を主に持つ。
+- Dashboard から Console を開く bridge の境界が読み取れる。
+- `multi_pod.rs` 相当の責務が Dashboard module 配下へ移され、巨大単一ファイル状態が改善されている。
+- render/list/layout、action/lifecycle、diagnostics/tests などの境界が reviewer に分かる形になっている。
+- 既存の workspace panel / action model の設計と矛盾しない。
+- `yoi panel` の Ticket-centric workspace cockpit という意味を保つ。
+- `yoi panel` が scheduler/backend であるかのような実装・説明になっていない。
+- 既存テストを維持・更新し、refactor による挙動退行が検出できる状態にする。
+- reviewer が diff から、単なる rename ではなく Dashboard / Console の責務境界が改善されたことを確認できる。
+
+## Binding decisions / invariants
+
+- **Dashboard = `yoi panel`**。
+- **Console = single-Pod chat/client surface**。
+- **TUI = terminal UI implementation layer / crate-level umbrella**。
+- `panel` / Dashboard は単一 Pod Console の名前には使わない。
+- Console は Dashboard の subordinate mode ではなく、別の user-facing surface として扱う。
+- Dashboard は Console の一部ではない。
+- Dashboard は workspace-level cockpit/action surface であり、scheduler/backend ではない。
+- `yoi panel` command 名は維持する。
+- 不要な compatibility alias は追加しない。
+- テストが維持できる範囲では、過度に分割を避ける必要はない。大きな file move / module split を許容する。
+
+## Implementation latitude
+
+- 最終的な module 構成は実装者判断でよいが、次の方向を推奨する。
+
+```text
+crates/tui/src/
+  console/
+    mod.rs              # user-facing Pod Console launch API
+    app_loop.rs         # current single_pod run loop 相当
+    nested.rs           # Dashboard から Pod Console を開く bridge
+    terminal.rs         # Console fullscreen/mouse helpers
+  dashboard/
+    mod.rs              # user-facing Dashboard launch API
+    app.rs              # Dashboard app state / selection / key handling
+    runtime.rs          # current multi_pod::run loop 相当
+    snapshot.rs         # Dashboard snapshot loading
+    lifecycle.rs        # companion/orchestrator ensure/observe
+    actions.rs          # Ticket/Intake/Companion/Orchestrator actions
+    render.rs           # layout/draw/list rendering
+    e2e.rs              # dashboard-specific e2e structs/events
+    tests.rs or tests/
+```
+
+- 互換性や reviewability のため、type 名の rename は段階的でもよい。ただし module / docs / entrypoint は Dashboard / Console 語彙へ寄せる。
+- `MultiPodApp` などの既存名は必要なら一時的に残せるが、最終的な方向性が Dashboard であることをコード上から読めるようにする。
+- tests は同一 commit 内で移動・更新してよい。test coverage 維持を優先する。
+- exact string test がある場合は、新しい Dashboard / Console 呼称に合わせて期待値を更新する。
+
+## Readiness
+
+- readiness: implementation_ready
+- risk_flags: [ux-naming, module-boundary, public-cli, test-coverage]
+
+Risk flags は stop gate ではなく reviewer focus として扱う。主な確認点は public CLI/help の不要な互換増加、Dashboard / Console 境界、既存 panel authority/action model の保持、テスト維持。
+
+## Escalation conditions
+
+- `Dashboard` / `Console` の二分では説明しきれない第三の user-facing surface が見つかった場合は確認する。
+- `yoi panel` command 名を変える必要が出た場合は確認する。
+- `yoi dashboard` などの alias 追加が必要だと判断した場合は確認する。
+- module split の過程で Ticket state transition authority、Pod lifecycle、Orchestrator handoff の挙動変更が必要になった場合は確認する。
+- テスト維持では覆えない user-visible behavior change が必要になった場合は確認する。
+
+## Validation
+
+- `cargo test -p tui`
+- `cargo test -p yoi`
+- `cargo check --workspace --all-targets`
+- `cargo fmt --check`
+- `git diff --check`
+- 必要に応じて CLI help / docs / resources grep で `Dashboard` / `Console` / `TUI` / `panel` / `multi_pod` の残存表現を確認する。
+
+## Related work
+
+- `00001KTCSRS61` Workspace orchestration panel design
+- `00001KTCSRS62` Workspace panel action model
+- `00001KSKBPYER` Multi-Pod view UI
+- `crates/tui/src/multi_pod.rs`
+- `crates/tui/src/single_pod.rs`
+- `crates/tui/src/workspace_panel.rs`
+- `crates/tui/src/lib.rs`
+- `yoi panel`

.yoi/tickets/00001KVHX0WBE/resolution.md

@@ -0,0 +1,50 @@
+## Resolution
+
+`00001KVHX0WBE` を完了しました。
+
+実装内容:
+- Dashboard / Console / TUI terminology を導入しました。
+  - Dashboard: `yoi panel` workspace cockpit/action surface。
+  - Console: single-Pod chat/client surface。
+  - TUI: terminal UI implementation umbrella。
+- `yoi panel` command は維持しました。
+- `yoi dashboard` alias は追加していません。
+- `crates/tui/src/dashboard/` module boundary を追加しました。
+  - `dashboard/mod.rs`
+  - `dashboard/render.rs`
+  - `dashboard/tests.rs`
+- `crates/tui/src/console/` を single-Pod Console boundary として追加しました。
+- `LaunchMode::Panel` は `dashboard::launch(...)` に routing され、Console/single-Pod entrypoint を経由しません。
+- 旧 `single_pod.rs` / `multi_pod.rs` module route は Dashboard/Console boundary に置換しました。
+- Help/docs/prompt wording を Dashboard / Console / TUI terminology に更新しました。
+- Reviewer r1 で見つかった Dashboard behavior regression を修正しました。
+  - recoverable nested Console failure は `yoi panel` を終了せず Dashboard loop を継続します。
+  - successful Console return は live `DashboardApp` を fresh `load_app(...)` で置換せず、selection/draft/notices/diagnostics/local state を保持します。
+  - regression tests を追加しました。
+
+主な commit:
+- `5415a947 tui: introduce dashboard console boundaries`
+- `135343a2 tui: preserve dashboard after console return`
+- `23ec2bbd merge: dashboard console tui refactor`
+
+Review:
+- r1 は nested Console open 後の Dashboard state/loop preservation regression で `request_changes`。
+- Coder が `finish_nested_console_open(...)` と regression tests を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tui`
+- `cargo test -p yoi`
+- `cargo check --workspace --all-targets`
+- `cargo run -q -p yoi -- --help` targeted smoke。
+- `test ! -e crates/tui/src/single_pod.rs`
+- `test ! -e crates/tui/src/multi_pod.rs`
+- targeted grep confirmed no `yoi dashboard` alias and no old Panel-to-Console/single_pod route。
+
+Nix validation:
+- Not run because this Ticket changed Rust/docs/prompt/module boundaries only and no package/source-filter/resource inclusion concern was found。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-crXxMR.log`

.yoi/tickets/00001KVHX0WBE/thread.md

@@ -0,0 +1,452 @@
+<!-- event: create author: LocalTicketBackend at: 2026-06-20T06:55:49Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: intake_summary author: ticket-intake at: 2026-06-20T06:55:57Z -->
+
+## Intake summary
+
+ユーザー合意に基づき、Dashboard / Console 呼称導入、`yoi panel` Dashboard 境界、単一 Pod Console 境界、`multi_pod.rs` の Dashboard module への移設・分割、docs/help/tests 更新を 1 つの concrete implementation Ticket として整理した。readiness は `implementation_ready`。risk flags は stop gate ではなく reviewer focus として扱う。
+
+---
+
+<!-- event: state_changed author: ticket-intake at: 2026-06-20T06:55:57Z from: planning to: ready reason: planning_ready field: state -->
+
+## State changed
+
+要件・受け入れ条件・binding decisions・validation が揃っており、Orchestrator が実装 routing 可能。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T08:30:58Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T08:31:27Z -->
+
+## Decision
+
+Routing decision: waiting_capacity
+
+Panel Queue により routing 対象として確認したが、現在 `00001KVHR3WS6` が `inprogress` で MCP tool registration の Coder/Reviewer 作業中のため、この Dashboard / Console refactor Ticket は実装開始せず queued のまま保持する。
+
+Evidence:
+- Ticket body / relations を確認。未解決 blocker relation はない。
+- Orchestrator worktree は clean。
+- inprogress は `00001KVHR3WS6` のみ。
+- matching branch/worktree は存在しない。
+- 現在 active child Pods は `yoi-coder-00001KVHR3WS6` と `yoi-reviewer-00001KVHR3WS6-r1`。
+
+Next:
+- 現在の `00001KVHR3WS6` 作業が完了して implementation capacity が空いた後、改めて reroute する。
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T08:42:24Z -->
+
+## Decision
+
+Routing decision: implementation_ready_parallel
+
+Reason:
+- User directive: 「blocker無いなら並列にやっちゃえよ」。この指示により、未解決 blocker がない実装 Ticket は現在の MCP review loop と並行して開始する方針に更新した。
+- Ticket body は Dashboard / Console / TUI の呼称導入、`yoi panel` command維持、不要 alias 不追加、Dashboard / Console entrypoint 境界、`multi_pod.rs` の Dashboard module への移設・分割、docs/help/tests更新、validation を実装可能な粒度で定義している。
+- `TicketRelationQuery(00001KVHX0WBE)`: 未解決 blocker relation なし。
+- 現在 `00001KVHR3WS6` は inprogress だが domain は MCP tool registration であり、この Dashboard/Console TUI refactor と直接 conflict しない。別 worktree / branch / sibling Coder Pod で並列化できる。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk flags は ux-naming / module-boundary / public-cli / test-coverage だが stop gate ではなく reviewer focus。Ticket は `yoi panel` command維持、`yoi dashboard` 等の不要 alias 不追加、Dashboard は scheduler/backend ではない、挙動変更は目的にしない、tests維持を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHX0WBE` body / thread / artifacts。
+- Current workspace state:
+  - Orchestrator worktree clean at `8ce4fcde`。
+  - inprogress: `00001KVHR3WS6` only。
+  - queued includes this Ticket and downstream MCP Tickets。
+  - visible spawned children are MCP tool-registration coder/reviewer; no Dashboard/Console branch/worktree exists。
+
+IntentPacket:
+
+Intent:
+- Introduce user-facing terminology: Dashboard = `yoi panel`, Console = single-Pod chat/client surface, TUI = terminal UI implementation umbrella。
+- Refactor TUI module boundaries so Dashboard is not routed through Console/single-Pod module entrypoints, and `multi_pod.rs` responsibilities move toward a Dashboard module boundary。
+- Preserve behavior. The objective is naming / module boundary / maintainability refactor, not functional change。
+
+Binding decisions / invariants:
+- Keep `yoi panel` command name。
+- Do not add `yoi dashboard` or other unnecessary compatibility aliases。
+- Dashboard is workspace-level cockpit/action surface, not scheduler/backend。
+- Console is single-Pod chat/client surface and is not a subordinate Dashboard mode。
+- TUI is implementation layer umbrella, not a replacement mode name。
+- Dashboard may open a Pod Console, but bridge should be narrow and readable。
+- Avoid behavior changes to Ticket authority, Pod lifecycle, Orchestrator handoff, Panel action model, input model, or rendering semantics unless explicitly required and reported。
+- Keep/port existing tests; exact string tests should be updated to Dashboard/Console terminology where appropriate。
+
+Requirements / acceptance criteria:
+- `yoi panel` help/docs describe Dashboard。
+- Single Pod UI help/docs describe Console。
+- Dashboard entrypoint lives in Dashboard module side; `LaunchMode::Panel` does not flow through a Console module entrypoint like `single_pod::run_panel`。
+- Console module focuses on single-Pod chat/connect/spawn/resume。
+- `multi_pod.rs` giant file state is materially improved by moving/splitting responsibilities into Dashboard module boundaries。
+- Render/list/layout, action/lifecycle, diagnostics/e2e, tests boundaries are reviewer-readable。
+- Existing workspace panel/action model remains intact; `yoi panel` remains Ticket-centric workspace cockpit and not scheduler/backend。
+- Validation includes `cargo test -p tui`, `cargo test -p yoi`, `cargo check --workspace --all-targets`, `cargo fmt --check`, `git diff --check`, and targeted grep/help checks as needed。
+
+Escalate if:
+- Dashboard/Console split is insufficient for a third user-facing surface。
+- `yoi panel` command rename or `yoi dashboard` alias seems necessary。
+- Module split requires behavior changes to Ticket state authority, Pod lifecycle, Orchestrator handoff, or user-visible behavior beyond naming/boundary。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T08:42:30Z from: queued to: inprogress reason: orchestrator_acceptance_parallel_dashboard_console_tui_boundary field: state -->
+
+## State changed
+
+User explicitly authorized parallel implementation when no blocker exists. Ticket body/thread, relation metadata, prior waiting-capacity note, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded Dashboard/Console TUI context were checked. There is no unresolved blocking dependency, no matching worktree/branch, and no missing planning decision. Accepting this queued Ticket for parallel implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T08:43:53Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- User explicitly authorized parallel work for Tickets without blockers。
+- Acceptance records were committed on Orchestrator branch: `7e35721a ticket: accept dashboard console tui refactor`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVHX0WBE-dashboard-console-tui-boundary` on branch `impl/00001KVHX0WBE-dashboard-console-tui-boundary` at `7e35721a`。
+- Spawned Coder Pod `yoi-coder-00001KVHX0WBE` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, `yoi panel` rename/alias additions without escalation, behavior changes to Ticket/Pod/Panel authority, merge, Ticket close, and cleanup。
+
+Next action:
+- Let Dashboard/Console Coder proceed in parallel with the MCP tool-registration review loop. Inspect implementation report and route to Reviewer when ready。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:13:21Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVHX0WBE`.
+
+Implementation commit:
+- `5415a947 tui: introduce dashboard console boundaries`
+
+Changed areas reported:
+- Introduced `crates/tui/src/dashboard/` as Dashboard boundary:
+  - `mod.rs` for Dashboard state/action/lifecycle entrypoint。
+  - `render.rs` for render/list/layout composition。
+  - `tests.rs` for Dashboard-focused tests。
+- Introduced `crates/tui/src/console/` as the single-Pod Console boundary。
+- Updated `crates/tui/src/lib.rs` routing:
+  - `LaunchMode::Panel => dashboard::launch(...)`。
+  - Console launch modes route through `console::*`。
+  - No `single_pod::run_panel` path remains。
+- Preserved `yoi panel` command name and did not add `yoi dashboard`。
+- Updated help/docs terminology: Dashboard = `yoi panel` workspace cockpit/action surface; Console = single-Pod chat/client surface; TUI = implementation umbrella。
+- Updated tests/help expectations and brittle profile-default assertions surfaced by validation。
+
+Coder validation reported:
+- `cargo test -p tui`: passed。
+- `cargo test -p yoi`: passed。
+- `cargo check --workspace --all-targets`: passed。
+- `cargo fmt --check`: passed。
+- `git diff --check`: passed。
+- `git diff --cached --check`: passed。
+- Targeted help/grep checks for Dashboard/Console terminology and no `yoi dashboard` alias: passed。
+- `nix build .#yoi --no-link` not run because package/source filters were not changed。
+
+Known risks / deferrals:
+- Internal `workspace_panel` naming remains in lower-level model types to avoid broad unrelated churn; user-facing docs/help and TUI entry/module boundaries now use Dashboard/Console terminology。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `5415a947`。
+- Diff from acceptance `7e35721a..HEAD` is one implementation commit touching 12 files with a large split/rename: `single_pod.rs -> console/mod.rs`, `multi_pod.rs -> dashboard/mod.rs`, new `dashboard/render.rs`, new `dashboard/tests.rs`, docs/help/prompt updates。
+- `git diff --check 7e35721a..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on behavior preservation, `yoi panel` command preservation/no alias, Dashboard/Console/TUI terminology, entrypoint/module boundary, large-file split quality, tests, and whether changed prompt/help wording is appropriate。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T09:14:08Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVHX0WBE-r1` against implementation branch `impl/00001KVHX0WBE-dashboard-console-tui-boundary`。
+- Review target commit: `5415a947 tui: introduce dashboard console boundaries`。
+- Review baseline: `7e35721a`。
+- Reviewer task focuses on behavior preservation, `yoi panel` command preservation / no `yoi dashboard` alias, Dashboard/Console/TUI terminology, entrypoint/module boundaries, large-file split quality, prompt/help/doc wording, tests, and package/source-filter impact。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHX0WBE-r1 at: 2026-06-20T09:22:25Z status: request_changes -->
+
+## Review: request changes
+
+Verdict: `request_changes`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Implementation diff: `7e35721a..5415a947`。
+- 主な対象: `crates/tui/src/lib.rs`, `crates/tui/src/dashboard/mod.rs`, `crates/tui/src/dashboard/render.rs`, `crates/tui/src/dashboard/tests.rs`, `crates/tui/src/console/mod.rs`, `crates/yoi/src/main.rs`, `crates/yoi/src/ticket_cli.rs`, `crates/tui/src/spawn.rs`, README / TUI README / development docs / prompt resource terminology changes。
+
+Positive findings:
+- `yoi panel` remains the CLI command。
+- `yoi dashboard` alias は見つからない。
+- `LaunchMode::Panel` は Dashboard boundary を通るようになり、`single_pod::run_panel` path は見つからない。
+- `single_pod.rs` / `multi_pod.rs` は `console/` / `dashboard/` に置換されている。
+
+Blocking issues:
+
+1. Recoverable Dashboard open failures now exit `yoi panel`。
+   - Path: `crates/tui/src/dashboard/mod.rs`。
+   - Dashboard から Pod を開き、nested Console open が spawn failure/cancel など recoverable error を返すと、`app.finish_open(...)` 後に Dashboard fullscreen を抜けて function が `Ok(())` を返すように見える。
+   - Baseline `single_pod::run_panel` では recoverable nested-open failures は既存 Panel/Dashboard state に折り返され、Panel loop は継続した。
+   - Cancelled/failed Console open が workspace Dashboard を閉じるのは、Ticket の behavior preservation / Panel action model preservation 要件に反する。
+
+2. Successful return from Console discards live Dashboard state。
+   - Path: `crates/tui/src/dashboard/mod.rs`。
+   - `console::run_pod_name_nested(...)` 成功後、`app.finish_open(...)` の後に `app = load_app(runtime_command.clone()).await?;` で fresh app に置き換えている。
+   - これは baseline と `finish_open` の intent に反し、selection context、composer draft/target、notices、diagnostics、Dashboard-local UI state を失う可能性がある。
+   - Ticket は boundary/terminology refactor であり、Dashboard state preservation は reviewer focus。Live `DashboardApp` を保持し、`finish_open(...)` + existing reload/reconcile mechanism を使うべき。
+
+Required fix:
+- Successful nested Console return と recoverable nested Console failure の両方で、existing `DashboardApp` を保持して Dashboard loop を継続する。
+- `finish_open(...)` と既存 reload mechanism を使い、function return / fresh app replacement で Dashboard session state を捨てない。
+- Regression tests を追加または既存 tests を拡張し、nested open success/failure が Dashboard state/draft/selection/diagnostic を壊さず loop 継続することを可能な範囲で確認する。
+
+Non-blocking concerns:
+- `dashboard/mod.rs` はまだ大きく、action/lifecycle/snapshot/model/diagnostics/E2E fixture helpers が混在している。追加分割は follow-up でもよいが、今回の blocker fix で触るなら改善可。
+- `console/mod.rs` に Dashboard/fullscreen helper concepts が少し残る。terminal-mode bridge として許容可能だが、Console focus は維持すること。
+- `workspace_panel` / `WorkspacePanel*` naming は internal model names と見えるため blocking ではない。
+
+Reviewer validation:
+- `cargo fmt --check`: passed。
+- `git diff --check 7e35721a..HEAD`: passed。
+- `cargo test -p tui`: passed。
+- `cargo test -p yoi`: passed。
+- `cargo check --workspace --all-targets`: passed。
+- Targeted help/grep checks: no `yoi dashboard` alias or old `single_pod::run_panel` route found。
+- `nix build .#yoi --no-link` not run because no package/source-filter concern found。
+
+Worktree status at review end: tracked source tree clean; ignored `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:30:11Z -->
+
+## Implementation report
+
+Coder r1-fix report received from `yoi-coder-00001KVHX0WBE`.
+
+New fix commit:
+- `135343a2 tui: preserve dashboard after console return`
+
+Branch commits now:
+- `135343a2 tui: preserve dashboard after console return`
+- `5415a947 tui: introduce dashboard console boundaries`
+
+Fix summary:
+- `crates/tui/src/dashboard/mod.rs`:
+  - Added `finish_nested_console_open(...)` helper。
+  - Successful nested Console return now calls `app.finish_open(...)` and continues the Dashboard loop with the same `DashboardApp`。
+  - Recoverable nested Console failures now call `app.finish_open(...)` and continue the Dashboard loop instead of leaving fullscreen / exiting。
+  - Non-recoverable errors still leave Dashboard fullscreen and bubble the error。
+  - Removed fresh `load_app(...)` replacement after Console return, preserving selection, composer draft, diagnostics, notices, and other local Dashboard state。
+- `crates/tui/src/dashboard/tests.rs`:
+  - Added regression coverage for nested Console success continuing without dropping Dashboard state。
+  - Added regression coverage for recoverable nested Console failure continuing without dropping Dashboard state。
+  - Added regression coverage for non-recoverable nested Console failure bubbling without incorrectly finishing/mutating Dashboard open state。
+
+Coder validation reported as passing:
+- `cargo fmt --check`
+- `git diff --check`
+- `git diff --check 7e35721a..HEAD`
+- `cargo test -p tui`
+- `cargo test -p yoi`
+- `cargo check --workspace --all-targets`
+- Targeted grep/help checks for Dashboard/Console/TUI terminology, `LaunchMode::Panel => dashboard::launch(...)`, no `single_pod::run_panel`, and no `yoi dashboard` alias。
+
+Orchestrator evidence checked before r2 review:
+- Implementation worktree is clean。
+- HEAD is `135343a2`。
+- Fix diff from `5415a947..HEAD` touches `crates/tui/src/dashboard/mod.rs` and `crates/tui/src/dashboard/tests.rs`, about 95 insertions / 15 deletions。
+- Overall `git diff --check 7e35721a..HEAD` produced no diagnostics。
+
+Next action:
+- Route back to Reviewer for r2 verification of Dashboard state preservation and final acceptance criteria。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVHX0WBE-r1 at: 2026-06-20T09:33:16Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket を再確認。
+- Fix diff: `5415a947..135343a2`。
+- Overall implementation diff: `7e35721a..135343a2`。
+- 主な対象: `crates/tui/src/dashboard/mod.rs`, `crates/tui/src/dashboard/tests.rs`, Dashboard/Console/TUI terminology, CLI help, `LaunchMode::Panel` routing, `yoi dashboard` alias absence, old `single_pod::run_panel` / `multi_pod` route absence, nested Console open 後の Dashboard state preservation。
+
+Previous blockers verification:
+- Recoverable Dashboard open failures no longer exit `yoi panel`。
+  - `finish_nested_console_open(...)` により recoverable errors は `app.finish_open(...)` 後に `Ok(())` を返し、Dashboard loop が継続する。
+  - Non-recoverable errors のみ fullscreen を離れて bubble する。
+- Successful Console return no longer replaces live `DashboardApp`。
+  - 以前の `app = load_app(runtime_command.clone()).await?` replacement は削除済み。
+  - Success は `app.finish_open(...)` 後に同じ `DashboardApp` で継続する。
+  - Regression tests は success / recoverable failure / non-recoverable failure を cover している。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- `dashboard/mod.rs` はまだ大きく複数責務を持つが、旧 `multi_pod.rs` / `single_pod.rs` boundary より materially better であり、この Ticket の acceptance では blocking ではない。
+- Package/source-filter/resource inclusion concern は見つからなかったため、Reviewer は Nix validation を実行していない。
+
+Reviewer validation:
+- `cargo fmt --check`: passed。
+- `git diff --check 7e35721a..HEAD`: passed。
+- `cargo test -p tui`: passed, 362 tests and doc-tests。
+- `cargo test -p yoi`: passed, 66 tests。
+- `cargo check --workspace --all-targets`: passed。
+- Additional help/grep checks passed:
+  - `yoi panel` help remains。
+  - Console / Dashboard / TUI terminology appears as expected。
+  - no `yoi dashboard` alias found。
+  - old `single_pod.rs` / `multi_pod.rs` absent。
+  - `LaunchMode::Panel => dashboard::launch(runtime_command).await` confirmed。
+
+Worktree status at review end: tracked source tree clean; ignored `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T09:35:21Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `23ec2bbd merge: dashboard console tui refactor`
+- Implementation commits included:
+  - `5415a947 tui: introduce dashboard console boundaries`
+  - `135343a2 tui: preserve dashboard after console return`
+
+Reviewer outcome:
+- r1 requested changes because recoverable Dashboard open failures could exit `yoi panel` and successful Console return replaced live `DashboardApp` state。
+- Coder preserved existing `DashboardApp` across nested Console success/recoverable failure and added regression tests。
+- r2 approved with no blocking issues。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tui`
+- `cargo test -p yoi`
+- `cargo check --workspace --all-targets`
+- `cargo run -q -p yoi -- --help` targeted help smoke。
+- `test ! -e crates/tui/src/single_pod.rs`
+- `test ! -e crates/tui/src/multi_pod.rs`
+- targeted grep confirmed no `yoi dashboard` alias, no old `single_pod::run_panel` / `mod single_pod` / `mod multi_pod` / Panel-to-Console route, and expected Dashboard/Console launch terminology。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-crXxMR.log`
+
+Nix validation:
+- Not run for this Ticket because changes are Rust/docs/prompt/module-boundary only and no package/source-filter/resource inclusion concern was found。
+
+Final state:
+- Orchestrator worktree clean at `23ec2bbd` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T09:35:30Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `23ec2bbd`, r2 review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p tui`, `cargo test -p yoi`, `cargo check --workspace --all-targets`, and targeted help/grep checks for Dashboard/Console terminology and no `yoi dashboard` alias.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T09:35:52Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T09:35:52Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVHX0WBE` を完了しました。
+
+実装内容:
+- Dashboard / Console / TUI terminology を導入しました。
+  - Dashboard: `yoi panel` workspace cockpit/action surface。
+  - Console: single-Pod chat/client surface。
+  - TUI: terminal UI implementation umbrella。
+- `yoi panel` command は維持しました。
+- `yoi dashboard` alias は追加していません。
+- `crates/tui/src/dashboard/` module boundary を追加しました。
+  - `dashboard/mod.rs`
+  - `dashboard/render.rs`
+  - `dashboard/tests.rs`
+- `crates/tui/src/console/` を single-Pod Console boundary として追加しました。
+- `LaunchMode::Panel` は `dashboard::launch(...)` に routing され、Console/single-Pod entrypoint を経由しません。
+- 旧 `single_pod.rs` / `multi_pod.rs` module route は Dashboard/Console boundary に置換しました。
+- Help/docs/prompt wording を Dashboard / Console / TUI terminology に更新しました。
+- Reviewer r1 で見つかった Dashboard behavior regression を修正しました。
+  - recoverable nested Console failure は `yoi panel` を終了せず Dashboard loop を継続します。
+  - successful Console return は live `DashboardApp` を fresh `load_app(...)` で置換せず、selection/draft/notices/diagnostics/local state を保持します。
+  - regression tests を追加しました。
+
+主な commit:
+- `5415a947 tui: introduce dashboard console boundaries`
+- `135343a2 tui: preserve dashboard after console return`
+- `23ec2bbd merge: dashboard console tui refactor`
+
+Review:
+- r1 は nested Console open 後の Dashboard state/loop preservation regression で `request_changes`。
+- Coder が `finish_nested_console_open(...)` と regression tests を追加。
+- r2 は `approve`。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tui`
+- `cargo test -p yoi`
+- `cargo check --workspace --all-targets`
+- `cargo run -q -p yoi -- --help` targeted smoke。
+- `test ! -e crates/tui/src/single_pod.rs`
+- `test ! -e crates/tui/src/multi_pod.rs`
+- targeted grep confirmed no `yoi dashboard` alias and no old Panel-to-Console/single_pod route。
+
+Nix validation:
+- Not run because this Ticket changed Rust/docs/prompt/module boundaries only and no package/source-filter/resource inclusion concern was found。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-crXxMR.log`
+
+---

.yoi/tickets/00001KVJA7V2R/artifacts/orchestration-plan.jsonl

@@ -0,0 +1 @@
+{"id":"orch-plan-20260620-120740-1","ticket_id":"00001KVJA7V2R","kind":"accepted_plan","accepted_plan":{"summary":"`WebFetch` が `application/pdf` を `pdf-extract` により page-delimited Markdown-ish text (`pdf_text_by_pages`) として返せるようにする。既存 HTML/text/JSON/XML behavior と network safety/output bounds は維持し、semantic Markdown/OCR/native dependency は導入しない。","branch":"impl/00001KVJA7V2R-webfetch-pdf-text","worktree":"/home/hare/Projects/yoi/.worktree/00001KVJA7V2R-webfetch-pdf-text","role_plan":"Orchestrator は Profile scope review と並行して専用 implementation worktree `.worktree/00001KVJA7V2R-webfetch-pdf-text` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が WebFetch safety bounds、PDF binary path separation、metadata/output truncation、dependency/Nix impact、HTML/text regression を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T12:07:40Z"}

.yoi/tickets/00001KVJA7V2R/item.md

@@ -0,0 +1,117 @@
+---
+title: 'WebFetch: PDF を page-delimited text として取得できるようにする'
+state: 'closed'
+created_at: '2026-06-20T10:46:48Z'
+updated_at: '2026-06-20T12:31:33Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['security', 'dependency', 'public-api', 'output-bounds']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T12:06:29Z'
+---
+
+## Background
+
+ユーザー要望: `WebFetch` で PDF URL を取得し、LLM が読める bounded text として返せるようにする。調査は同一会話内で完了済みで、初期実装は semantic な「PDF to Markdown」ではなく、PDF から page-delimited な Markdown-ish text を抽出する方針とする。
+
+現状:
+
+- `crates/tools/src/web.rs` の `WebFetch` は HTML / text / JSON / XML-ish content のみを許可し、`application/pdf` は unsupported Content-Type として拒否する。
+- 既存の `render_content()` は `reject_binary(bytes)` と UTF-8 decode 前提なので、PDF binary を既存 text path に乗せることはできない。
+- `WebFetch` の既存 safety behavior は維持する必要がある: private/local host rejection、bounded redirects、`max_response_bytes`、`max_output_bytes`、untrusted content warning。
+
+調査結論:
+
+- 初期実装には `pdf-extract` crate が最有力。
+  - MIT license。
+  - pure Rust。
+  - native/system dependency なし。
+  - memory buffer API あり。
+  - page split API `pdf_extract::extract_text_from_mem_by_pages()` あり。
+- Poppler / `pdftotext` は GPL / system dependency / deployment / Nix packaging の重さから採用しない。
+- `pdfium-render` は Pdfium native library が必要で、初期の text extraction には重すぎるため採用しない。
+- `unpdf` / `pdf_oxide` / `spectre_pdf` 等は Markdown-oriented な候補だが、初期採用には成熟度・audit が不足気味。必要なら follow-up で比較する。
+
+## Requirements
+
+- `WebFetch` が `application/pdf` response を unsupported Content-Type として拒否せず処理できる。
+- PDF binary bytes は既存の UTF-8 text path / `reject_binary()` path と分離して扱う。
+- `pdf_extract::extract_text_from_mem_by_pages()` を使い、page ごとに抽出した text を Markdown-ish に整形する。
+- 出力例:
+
+```markdown
+## Page 1
+
+...
+
+## Page 2
+
+...
+```
+
+- `transformed_as` は `pdf_text_by_pages` など、semantic Markdown 化を約束しない名前にする。
+- result JSON に PDF 用 metadata を追加する。
+- text/html / JSON / XML / text の既存挙動と `html_extraction` metadata を regress させない。
+- `WebFetch` の既存 bounds と safety behavior を維持する。
+
+## Acceptance criteria
+
+- `application/pdf` response が bounded text result を返す。
+- PDF response では `render_content()` の UTF-8 decode 前提 path を通らず、PDF 専用 extraction path が使われる。
+- `pdf_extract::extract_text_from_mem_by_pages()` により、page delimiter 付き Markdown-ish text が返る。
+- result JSON に `pdf_extraction` metadata が含まれる。
+- `max_output_bytes` を超える抽出結果は既存 truncation marker で切り詰められ、`output_truncated` が正しく立つ。
+- `max_response_bytes` / Content-Length check / redirect limit / private host rejection / embedded credential rejection は既存通り維持される。
+- malformed PDF / encrypted PDF / text のない PDF で panic しない。diagnostic error または readable=false 相当の metadata を返す。
+- PDF 以外の unsupported binary content は引き続き拒否される。
+- 既存 WebFetch HTML reader tests が通る。
+
+## Binding decisions / invariants
+
+- `WebFetch` は fetch/extraction tool のままとし、LLM summarization や multi-page research orchestration は入れない。
+- 初期実装では semantic な「PDF to Markdown」を約束しない。page-delimited Markdown-ish text extraction として扱う。
+- 初期実装で対応する MIME は `application/pdf` のみとする。`application/x-pdf`、`application/acrobat`、`application/octet-stream` with `.pdf`、extension sniffing は必要なら follow-up。
+- `max_response_bytes` default は変更しない。大きい PDF が必要な場合は既存 config override を使う。
+- Poppler / Pdfium / subprocess `pdftotext` / system native dependency は導入しない。
+- OCR、scanned PDF 対応、画像抽出、rendering、table reconstruction、2-column layout の完全復元、heading inference、PDF 保存/cache は範囲外。
+- PDF 抽出結果も untrusted content として扱い、既存の warning / network safety / bounds を弱めない。
+
+## Implementation latitude
+
+- PDF metadata は互換性重視で `pdf_extraction` を新設するのが推奨。既存 `html_extraction` は残す。
+- `pdf_extraction` metadata の具体フィールドは実装時に調整してよいが、少なくとも method / pages or pages_included / readable / error diagnostic 相当が分かるようにする。
+- PDF extraction は CPU-heavy になり得るため、可能なら `spawn_blocking` 等で async runtime を塞がない設計にする。ただし Rust parser の強制 cancel までは初期実装の必須条件にしない。
+- 抽出品質が `pdf-extract` で明確に不足する場合は、実装を歪めず、別 Ticket で `unpdf` / `pdf_oxide` 等を比較する。
+
+## Readiness
+
+- readiness: implementation_ready
+- risk_flags: [security, dependency, public-api, output-bounds]
+
+## Escalation conditions
+
+- `pdf-extract` が実装上致命的に使えない、または license/build/security 上の問題が見つかった場合は実装前に戻す。
+- Tool result JSON shape に breaking change が必要になりそうな場合は、既存互換を維持する案を先に提示する。
+- PDF fixture で parser panic / runaway CPU / excessive memory の懸念が出た場合は、bounds 追加または別方針を提案する。
+- Nix packaging / Cargo.lock / cargoHash 影響が大きい場合は実装報告で明示する。
+
+## Validation
+
+- focused tests:
+  - small valid PDF fixture returns expected text。
+  - multi-page PDF fixture returns `## Page 1` / `## Page 2`。
+  - output truncation sets `output_truncated`。
+  - unsupported binary non-PDF remains rejected。
+  - oversized PDF Content-Length remains rejected。
+  - existing WebFetch HTML reader behavior remains unchanged。
+- commands:
+  - `cargo fmt --check`
+  - `cargo test -p tools web`
+  - `cargo check -p tools`
+  - `git diff --check`
+  - `TicketDoctor` if Ticket consistency needs checking。
+
+## Related work
+
+- `crates/tools/src/web.rs` — current WebSearch/WebFetch implementation。
+- Closed prior WebFetch HTML work: `00001KSX9W968`, `00001KSXECDG0`。

.yoi/tickets/00001KVJA7V2R/resolution.md

@@ -0,0 +1,40 @@
+## Resolution
+
+`00001KVJA7V2R` を完了しました。
+
+実装内容:
+- `WebFetch` に `application/pdf` handling を追加しました。
+- PDF bytes は UTF-8 / `reject_binary()` text path を bypass します。
+- `pdf_extract::extract_text_from_mem_by_pages()` を `tokio::task::spawn_blocking` 内で使用します。
+- PDF output は `## Page 1`, `## Page 2` のような page-delimited text として返します。
+- `transformed_as` / `pdf_extraction.method` は `pdf_text_by_pages` を使い、semantic Markdown とは主張しません。
+- `pdf_extraction` metadata に method/page/readability/diagnostic 情報を追加しました。
+- `max_response_bytes` / `max_output_bytes` / redirects / private-local host rejection / embedded credential rejection など既存 WebFetch safety pipeline は維持しました。
+- `application/pdf` のみ対応し、extension sniffing や `application/octet-stream` PDF guessing は追加していません。
+- Unsupported binary MIME rejection は維持しました。
+- Existing HTML/text behavior and `html_extraction` metadata は維持しました。
+- Tests for valid page-delimited PDF output、PDF truncation、malformed PDF diagnostic error、unsupported binary rejection を追加しました。
+- `pdf-extract = "0.10.0"` dependency を追加し、`Cargo.lock` / `package.nix` `cargoHash` を更新しました。
+
+主な commit:
+- `b1af95ad web: fetch pdf text by pages`
+- `97edfe8a merge: webfetch pdf text`
+
+Review:
+- r1 は `approve`。
+- Reviewer は WebFetch safety pipeline、exact `application/pdf` handling、binary path separation、`pdf_text_by_pages` metadata、output bounds、unsupported binary rejection、HTML metadata preservation、native PDF runtime dependency が無いことを確認しました。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tools web`
+- `cargo check -p tools`
+- `cargo tree -p pdf-extract`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- New Rust dependency: `pdf-extract 0.10.0`
+- `nix path-info -S .#yoi`: `115259736`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-z7rcEU.log`

.yoi/tickets/00001KVJA7V2R/thread.md

@@ -0,0 +1,314 @@
+<!-- event: create author: ticket-intake at: 2026-06-20T10:46:48Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: intake_summary author: ticket-intake at: 2026-06-20T10:46:54Z -->
+
+## Intake summary
+
+ユーザー要望を調査 Ticket ではなく concrete implementation Ticket として作成した。調査済み結論に基づき、`WebFetch` が `application/pdf` を `pdf-extract` で page-delimited Markdown-ish text として返せるようにする。Poppler/Pdfium/subprocess/OCR/semantic Markdown 化は非ゴール。既存 WebFetch safety bounds と HTML/text behavior は維持する。
+
+---
+
+<!-- event: state_changed author: ticket-intake at: 2026-06-20T10:46:54Z from: planning to: ready reason: implementation_ready field: state -->
+
+## State changed
+
+Intake 済み。Orchestrator は implementation routing として扱える。実装 side effect / worktree 作成 / coder 起動はここでは行っていない。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T12:06:29Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T12:08:15Z -->
+
+## Decision
+
+Routing decision: implementation_ready_parallel
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- User standing directive: blocker が無いものは並列実行する。現在の `00001KVJABS1A` は Profile scope review 中であり、WebFetch PDF 実装とは domain/file conflict がないため並列化できる。
+- Ticket body は調査済みの PDF extraction 方針、`pdf-extract` 採用理由、binary path 分離、page-delimited Markdown-ish output、metadata、bounds、non-goals、validation を実装可能な粒度で定義している。
+- 未解決 relation blocker はない。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk domain は security / dependency / public-api / output-bounds だが、Ticket は existing WebFetch network safety、`max_response_bytes` / `max_output_bytes`、unsupported binary rejection、no OCR/semantic Markdown/native dependency を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVJA7V2R` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVJA7V2R)`: no blockers。
+- `TicketOrchestrationPlanQuery(00001KVJA7V2R)`: no previous plan records; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `36b9ed45`。
+  - queued: `00001KVJA7V2R`, `00001KVJDJD02`。
+  - inprogress: `00001KVJABS1A` review only。
+  - no matching WebFetch PDF branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Extend `WebFetch` so `application/pdf` can be fetched and returned as bounded, page-delimited text suitable for LLM reading。
+- Use `pdf_extract::extract_text_from_mem_by_pages()` and present output as Markdown-ish page sections, not semantic PDF-to-Markdown。
+
+Binding decisions / invariants:
+- Keep WebFetch as fetch/extraction tool; no summarization or research orchestration。
+- PDF bytes must not go through the UTF-8 text / `reject_binary()` path。
+- Preserve private/local host rejection, bounded redirects, Content-Length / `max_response_bytes`, `max_output_bytes`, embedded credential rejection, untrusted content warning。
+- Initial supported MIME is `application/pdf` only; no extension sniffing or `application/octet-stream` PDF guessing。
+- No Poppler/Pdfium/subprocess/native dependency/OCR/scanned-PDF support/table reconstruction/cache。
+- Existing HTML/text/JSON/XML behavior and `html_extraction` metadata must not regress。
+- New metadata should use `pdf_extraction` with method/pages/readable/diagnostic information。
+
+Requirements / acceptance criteria:
+- Valid PDF returns `## Page 1`, `## Page 2`, etc. page-delimited bounded text。
+- `transformed_as` communicates `pdf_text_by_pages` or equivalent, not semantic Markdown。
+- `output_truncated` is correct when PDF text exceeds `max_output_bytes`。
+- Malformed/encrypted/textless PDFs do not panic; return diagnostic error or readable=false metadata。
+- Non-PDF unsupported binary remains rejected。
+- Focused WebFetch tests and relevant cargo/fmt/diff validation pass。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T12:08:34Z from: queued to: inprogress reason: orchestrator_acceptance_parallel_webfetch_pdf field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded WebFetch/PDF context were checked. There is no unresolved blocking dependency, no conflicting inprogress implementation, and no missing planning decision. Accepting this queued Ticket for parallel implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:09:50Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `e752a720 ticket: accept webfetch pdf and intake gate`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVJA7V2R-webfetch-pdf-text` on branch `impl/00001KVJA7V2R-webfetch-pdf-text` at `e752a720`。
+- Spawned Coder Pod `yoi-coder-00001KVJA7V2R` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, semantic PDF Markdown/OCR/native dependency scope creep, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:24:02Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVJA7V2R`.
+
+Implementation commit:
+- `b1af95ad web: fetch pdf text by pages`
+
+Changed areas reported:
+- `crates/tools/src/web.rs`:
+  - Added `application/pdf` handling for `WebFetch`。
+  - PDF bytes bypass UTF-8 / `reject_binary()` text path。
+  - Uses `pdf_extract::extract_text_from_mem_by_pages()` inside `tokio::task::spawn_blocking`。
+  - Returns Markdown-ish page sections like `## Page 1`, `## Page 2`。
+  - Adds `pdf_extraction` metadata with method/page/readability/diagnostic fields。
+  - Keeps existing `html_extraction` semantics intact。
+  - Preserves unsupported binary MIME rejection。
+  - Added deterministic in-memory PDF test fixtures and tests for PDF page-delimited output, output truncation, malformed PDF diagnostic error, and unsupported binary MIME rejection。
+- `crates/tools/Cargo.toml`: added `pdf-extract = "0.10.0"`。
+- `Cargo.lock`: updated for `pdf-extract` and transitive dependencies。
+- `package.nix`: updated `cargoHash` to `sha256-rvsjn4BBxd9vt4nytPgUh4l/OQCRpqHbUR4jHoH589U=`。
+
+Coder validation reported as passing:
+- `cargo fmt --check`
+- `cargo test -p tools web`
+- `cargo check -p tools`
+- `git diff --check`
+- `nix build .#yoi --no-link`
+
+Dependency / package impact:
+- New Rust dependency: `pdf-extract 0.10.0`。
+- Nix vendor hash updated and `nix build .#yoi --no-link` passed。
+
+Known risks / deferrals:
+- Only `application/pdf` is supported; no extension sniffing or `application/octet-stream` PDF guessing。
+- No OCR, scanned-PDF support, table reconstruction, cache, subprocess, Poppler, or Pdfium integration。
+- Malformed PDFs return diagnostic extraction error; textless PDFs are represented with `readable=false` metadata when extraction succeeds but no text is found。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `b1af95ad`。
+- Diff from acceptance `e752a720..HEAD` is one implementation commit touching 4 files, about 552 insertions / 23 deletions。
+- `git diff --check e752a720..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on WebFetch network/binary safety preservation, PDF extraction bounds/metadata, dependency/Nix impact, malformed/textless behavior, unsupported binary rejection, and HTML/text regression safety。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T12:24:42Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVJA7V2R-r1` against implementation branch `impl/00001KVJA7V2R-webfetch-pdf-text`。
+- Review target commit: `b1af95ad web: fetch pdf text by pages`。
+- Review baseline: `e752a720`。
+- Reviewer task focuses on WebFetch network safety preservation, PDF binary path separation, response/output bounds, `pdf_text_by_pages` metadata accuracy, malformed/textless behavior, unsupported binary rejection, existing HTML/text regression safety, dependency/package impact, and Nix validation。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVJA7V2R-r1 at: 2026-06-20T12:28:18Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Implementation diff: `e752a720..b1af95ad`。
+- 主な対象:
+  - `crates/tools/src/web.rs`
+  - `crates/tools/Cargo.toml`
+  - `Cargo.lock`
+  - `package.nix`
+
+Approval evidence:
+- WebFetch safety pipeline は PDF rendering 前にも共有されている。
+  - URL validation。
+  - Redirect validation。
+  - Content-Length rejection。
+  - Bounded body read。
+- PDF classification は exact `application/pdf` のみで、extension sniffing や `application/octet-stream` guessing は追加されていない。
+- PDF path は `reject_binary()` / UTF-8 text decoding を bypass し、`pdf_extract::extract_text_from_mem_by_pages()` を `spawn_blocking` 内で使っている。
+- Output は `## Page N` 形式の page-delimited text。
+- `transformed_as` / `pdf_extraction.method` は `pdf_text_by_pages` を使い、semantic Markdown fidelity は主張していない。
+- PDF rendering 後も `max_output_bytes` truncation が適用されている。
+- Existing HTML extraction metadata は維持され、PDF result は `html_extraction = null` / `pdf_extraction` populated になる。
+- `pdf-extract` dependency inspection では Poppler/Pdfium/subprocess/OCR runtime dependency は見つからない。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- Valid multi-page PDF、PDF output truncation、malformed PDF error、unsupported non-PDF binary rejection の tests はあるが、encrypted/textless PDF と oversized PDF `Content-Length` の dedicated tests は無い。実装上は textless pages は readable=false metadata、Content-Length rejection は content-type rendering 前の shared path で covered されるため、この Ticket では blocking ではない。
+- Malformed PDF は `pdf_extraction` metadata付き JSON result ではなく `ToolError` を返すが、Ticket は “diagnostic error or readable=false metadata” を許容しているため OK。
+
+Reviewer validation:
+- `cargo fmt --check`: passed。
+- `git diff --check e752a720..HEAD`: passed。
+- `cargo test -p tools web`: passed, 19 tests。
+- `cargo check -p tools`: passed。
+- `cargo tree -p pdf-extract`: inspected; native PDF runtime dependencyなし。
+- `nix build .#yoi --no-link`: passed。
+
+Worktree status at review end: source tree clean; ignored `target/` only。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:30:53Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `97edfe8a merge: webfetch pdf text`
+- Implementation commit included:
+  - `b1af95ad web: fetch pdf text by pages`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed WebFetch safety pipeline preservation, exact `application/pdf` handling only, no extension/octet-stream guessing, PDF binary path separation, `pdf_text_by_pages` metadata, output truncation, unsupported binary rejection, existing HTML metadata preservation, and no Poppler/Pdfium/subprocess/OCR runtime dependency。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tools web`
+- `cargo check -p tools`
+- `cargo tree -p pdf-extract`
+- `nix build .#yoi --no-link`
+- `nix path-info -S .#yoi`: `115259736`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-z7rcEU.log`
+
+Final state:
+- Orchestrator worktree clean at `97edfe8a` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T12:31:02Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `97edfe8a`, review approved, and final Orchestrator validation passed: `cargo fmt --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p tools web`, `cargo check -p tools`, `cargo tree -p pdf-extract`, and `nix build .#yoi --no-link`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T12:31:33Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T12:31:33Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVJA7V2R` を完了しました。
+
+実装内容:
+- `WebFetch` に `application/pdf` handling を追加しました。
+- PDF bytes は UTF-8 / `reject_binary()` text path を bypass します。
+- `pdf_extract::extract_text_from_mem_by_pages()` を `tokio::task::spawn_blocking` 内で使用します。
+- PDF output は `## Page 1`, `## Page 2` のような page-delimited text として返します。
+- `transformed_as` / `pdf_extraction.method` は `pdf_text_by_pages` を使い、semantic Markdown とは主張しません。
+- `pdf_extraction` metadata に method/page/readability/diagnostic 情報を追加しました。
+- `max_response_bytes` / `max_output_bytes` / redirects / private-local host rejection / embedded credential rejection など既存 WebFetch safety pipeline は維持しました。
+- `application/pdf` のみ対応し、extension sniffing や `application/octet-stream` PDF guessing は追加していません。
+- Unsupported binary MIME rejection は維持しました。
+- Existing HTML/text behavior and `html_extraction` metadata は維持しました。
+- Tests for valid page-delimited PDF output、PDF truncation、malformed PDF diagnostic error、unsupported binary rejection を追加しました。
+- `pdf-extract = "0.10.0"` dependency を追加し、`Cargo.lock` / `package.nix` `cargoHash` を更新しました。
+
+主な commit:
+- `b1af95ad web: fetch pdf text by pages`
+- `97edfe8a merge: webfetch pdf text`
+
+Review:
+- r1 は `approve`。
+- Reviewer は WebFetch safety pipeline、exact `application/pdf` handling、binary path separation、`pdf_text_by_pages` metadata、output bounds、unsupported binary rejection、HTML metadata preservation、native PDF runtime dependency が無いことを確認しました。
+
+最終 validation:
+- `cargo fmt --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p tools web`
+- `cargo check -p tools`
+- `cargo tree -p pdf-extract`
+- `nix build .#yoi --no-link`
+
+Package impact:
+- New Rust dependency: `pdf-extract 0.10.0`
+- `nix path-info -S .#yoi`: `115259736`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-z7rcEU.log`
+
+---

.yoi/tickets/00001KVJABS1A/artifacts/orchestration-plan.jsonl

@@ -0,0 +1 @@
+{"id":"orch-plan-20260620-115258-1","ticket_id":"00001KVJABS1A","kind":"accepted_plan","accepted_plan":{"summary":"Profile launch時に workspace-local `.yoi/override.local.toml` 等で明示された追加 `scope.allow` が `apply_profile_launch_policy()` の workspace_scope 再代入で失われないように修正する。Workspace root write scope / `.worktree` write deny の既定と Ticket role policyは維持する。","branch":"impl/00001KVJABS1A-profile-override-scope","worktree":"/home/hare/Projects/yoi/.worktree/00001KVJABS1A-profile-override-scope","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVJABS1A-profile-override-scope` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が Profile launch policyのscope merge、workspace default scope/write-deny維持、Ticket role launch制約、snapshot/tool-visible scope一致、restore non-goalを確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T11:52:58Z"}

.yoi/tickets/00001KVJABS1A/item.md

@@ -0,0 +1,43 @@
+---
+title: 'Profile launch should preserve override scope allowances'
+state: 'closed'
+created_at: '2026-06-20T10:48:57Z'
+updated_at: '2026-06-20T12:13:32Z'
+assignee: null
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T11:52:33Z'
+---
+
+## 背景
+
+`yoi pod` の Profile launch で workspace-local `.yoi/override.local.toml` に `[[scope.allow]]` を追加しても、起動後の Pod が追加 scope を読めない問題がある。
+
+調査では、resolver は override を検出しており、Pod metadata の `resolved_manifest_snapshot.profile.workspace_override` に override path も記録されていた。一方で、最終的な `resolved_manifest_snapshot.scope.allow` には workspace root の write scope だけが残り、override 由来の追加 read scope が消えていた。
+
+原因は `crates/pod/src/entrypoint.rs` の `apply_profile_launch_policy()` が Profile launch 時に `manifest.scope` を `workspace_scope(...)` で丸ごと再代入しているため。`crates/manifest/src/profile.rs` で workspace override は一旦 merge されるが、その後段で scope が上書きされる。
+
+再現例:
+
+```toml
+# /home/hare/Projects/yoi-discord-bridge/.yoi/override.local.toml
+[[scope.allow]]
+target = "/home/hare/Projects/yoi"
+permission = "read"
+recursive = true
+```
+
+`yoi-discord-bridge` Pod の metadata では `workspace_override` は上記 override を指すが、`resolved_manifest_snapshot.scope.allow` に `/home/hare/Projects/yoi` が含まれない。
+
+## 要件
+
+- Profile launch policy は workspace 用の安全な既定 scope / delegation を付与しつつ、Profile/override で明示された追加 `scope.allow` を失わない。
+- workspace root write scope と `.worktree` write deny の既定挙動は維持する。
+- Ticket role 用の Profile launch policy でも、既存の role 制約を破らない形で追加 scope の扱いを明確化する。
+- `resolved_manifest_snapshot` に保存される最終 Manifest が、実際に model/tool に提示される readable/writable scope と一致する。
+
+## 受け入れ条件
+
+- `.yoi/override.local.toml` の追加 `[[scope.allow]]` が Profile launch 後の `resolved_manifest_snapshot.scope.allow` に残ることをテストで確認する。
+- 通常 Pod launch で workspace root write scope と `.worktree` write deny が引き続き付与されることを確認する。
+- Ticket role launch の scope/delegation 既定が壊れていないことを確認する。
+- 既存 metadata snapshot を restore する場合に override が再評価されない挙動は、今回の修正対象外または明確に別問題として扱う。

.yoi/tickets/00001KVJABS1A/resolution.md

@@ -0,0 +1,35 @@
+## Resolution
+
+`00001KVJABS1A` を完了しました。
+
+実装内容:
+- Profile launch policy が `manifest.scope` を wholesale replacement しないように修正しました。
+- 既に解決済みの Profile / workspace override scope に対して、launch-policy default rules を missing rules として append するようにしました。
+- `.yoi/override.local.toml` 等で指定された追加 `scope.allow` / `scope.deny` は保持されます。
+- Normal launch の workspace root write scope と `.worktree` write deny は維持されます。
+- Ticket role launch の default direct scope / delegation defaults は維持されます。
+- Final manifest/snapshot と tool-visible scope が同じ final effective scope を見るように維持しました。
+- Restore path は existing `resolved_manifest_snapshot` を使う挙動のままで、override 再評価は追加していません。
+
+主な commit:
+- `0717aae3 pod: preserve profile override scope`
+- `a1386881 merge: profile override scope`
+
+Review:
+- r1 は `approve`。
+- Reviewer は scope merge semantics、no authority broadening、workspace write / `.worktree` deny preservation、Ticket role defaults、snapshot/tool-visible scope consistency、restore non-goal preservation を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod entrypoint::tests::`
+- `cargo check -p pod`
+
+Known unrelated note:
+- Full `cargo test -p pod` は branch 外の既存 prompt-guidance assertion failure で失敗するため final gate にしませんでした。Reviewer はこの failure が `crates/pod/src/entrypoint.rs` の diff に起因しないことを確認済みです。
+
+Nix validation:
+- Not run because no dependency/package/source-filter files changed。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-WNUQvw.log`

.yoi/tickets/00001KVJABS1A/thread.md

@@ -0,0 +1,305 @@
+<!-- event: create author: "yoi ticket" at: 2026-06-20T10:48:57Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: intake_summary author: hare at: 2026-06-20T10:49:26Z -->
+
+## Intake summary
+
+Marked ready by `yoi ticket state`.
+
+---
+
+<!-- event: state_changed author: "yoi ticket" at: 2026-06-20T10:49:26Z from: planning to: ready reason: cli_state field: state -->
+
+## State changed
+
+Marked ready by `yoi ticket state`.
+
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T11:52:33Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T11:53:35Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- Ticket body は Profile launch 時に workspace override 由来の追加 `scope.allow` が `apply_profile_launch_policy()` の `workspace_scope(...)` 再代入で失われる具体原因、再現例、維持すべき既定 scope / delegation、Ticket role policy、受け入れ条件を実装可能な粒度で定義している。
+- 未解決 relation blocker はない。
+- 現在 queued はこの Ticket のみ、inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は scope / profile / launch-policy / security boundary だが、Ticket は workspace root write scope と `.worktree` write deny の維持、Ticket role launch constraints、snapshot と tool-visible scope の一致、restore non-goal を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVJABS1A` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVJABS1A)`: no blockers。
+- `TicketOrchestrationPlanQuery(00001KVJABS1A)`: no previous plan records; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `9e7c84a4`。
+  - queued: this Ticket only。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching implementation branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Fix Profile launch policy so explicit additional `scope.allow` entries from Profile / workspace override survive the final launch policy application。
+- Preserve the safe workspace defaults and role-specific constraints while ensuring `resolved_manifest_snapshot.scope.allow` matches the actual readable/writable tool scope presented to the Pod。
+
+Binding decisions / invariants:
+- Do not discard explicit Profile/override `scope.allow` entries when adding workspace default scope。
+- Preserve normal Pod launch default workspace root write scope。
+- Preserve `.worktree` write deny default behavior。
+- Preserve Ticket role launch constraints and delegation defaults。
+- Do not re-evaluate overrides during restore from existing metadata snapshot; restore behavior is out of scope unless tests reveal an accidental regression。
+- Snapshot saved in Pod metadata must reflect final effective manifest/scope, not an intermediate manifest。
+- Avoid broad profile/config semantics changes beyond launch policy scope merging。
+
+Requirements / acceptance criteria:
+- Test that `.yoi/override.local.toml` extra `[[scope.allow]]` remains in `resolved_manifest_snapshot.scope.allow` after Profile launch。
+- Test that normal Pod launch still receives workspace root write scope and `.worktree` write deny。
+- Test that Ticket role launch scope/delegation defaults are not broken。
+- Relevant `cargo test` / `cargo check` / `cargo fmt --check` / `git diff --check` pass。
+
+Escalate if:
+- Fixing the merge would broaden runtime authority beyond explicit profile/override scope。
+- Current scope model cannot distinguish launch-policy default grants from user-specified grants without a schema/API decision。
+- Ticket role policy requires an authority decision not specified in the Ticket。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T11:53:45Z from: queued to: inprogress reason: orchestrator_acceptance_profile_override_scope field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded Profile launch/scope policy context were checked. There is no unresolved blocking dependency, no inprogress/capacity blocker, and no missing planning decision. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T11:54:59Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `72e9f2f1 ticket: accept profile override scope launch`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVJABS1A-profile-override-scope` on branch `impl/00001KVJABS1A-profile-override-scope` at `72e9f2f1`。
+- Spawned Coder Pod `yoi-coder-00001KVJABS1A` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, broad profile/config semantic changes, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:06:19Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVJABS1A`.
+
+Implementation commit:
+- `0717aae3 pod: preserve profile override scope`
+
+Changed areas reported:
+- `crates/pod/src/entrypoint.rs`:
+  - Profile launch policy no longer replaces `manifest.scope` wholesale。
+  - It appends missing launch-policy default scope rules onto the already-resolved Profile/override scope。
+  - Explicit `scope.allow` / `scope.deny` entries from Profile and `.yoi/override.local.toml` are preserved。
+  - Normal workspace write scope and `.worktree` write deny remain applied for normal launches。
+  - Ticket role launch defaults/delegation behavior remains applied。
+  - Added focused tests for:
+    - `.yoi/override.local.toml` extra `[[scope.allow]]` surviving Profile launch in final manifest/snapshot serialization。
+    - Normal launch keeping workspace write + `.worktree` deny while preserving explicit Profile scope。
+    - Orchestrator role launch keeping read-root/worktree delegation defaults while preserving explicit Profile scope。
+
+Coder validation reported:
+- `cargo test -p pod entrypoint::tests::`: passed, 22 tests。
+- `cargo check -p pod`: passed。
+- `cargo fmt --all --check`: passed。
+- `git diff --check`: passed。
+- `cargo test -p pod`: ran but failed on two existing prompt guidance assertions unrelated to this change:
+  - `prompt::catalog::tests::pod_orchestration_guidance_section_renders_resource_body`
+  - `prompt::system::tests::pod_orchestration_guidance_is_included_for_pod_management_tools`
+  - Missing text asserted: `"worktree status, diff, and test results"`。
+- Nix not run because no packaging/source-filter/dependency files changed。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `0717aae3`。
+- Diff from acceptance `72e9f2f1..HEAD` is one implementation commit touching only `crates/pod/src/entrypoint.rs`, about 111 insertions / 14 deletions。
+- `git diff --check 72e9f2f1..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on scope allow/deny merge semantics, authority boundary/no broadening beyond explicit override + defaults, workspace write / `.worktree` deny preservation, Ticket role policy preservation, snapshot/tool-visible scope consistency, and whether the full `cargo test -p pod` failure is unrelated/pre-existing。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T12:07:00Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVJABS1A-r1` against implementation branch `impl/00001KVJABS1A-profile-override-scope`。
+- Review target commit: `0717aae3 pod: preserve profile override scope`。
+- Review baseline: `72e9f2f1`。
+- Reviewer task focuses on scope allow/deny merge semantics, no authority broadening beyond explicit override + launch defaults, workspace write / `.worktree` deny preservation, Ticket role launch/delegation constraints, metadata snapshot/effective scope consistency, restore non-goal, and reported full `cargo test -p pod` failure triage。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVJABS1A-r1 at: 2026-06-20T12:12:10Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket contract / Orchestrator IntentPacket。
+- Implementation diff: `72e9f2f1..0717aae3`。
+- 変更ファイル: `crates/pod/src/entrypoint.rs` のみ。
+- Launch-policy change、snapshot/tool-visible scope path、restore path、focused tests を確認。
+
+Approval evidence:
+- `append_missing_rules` / `apply_scope_launch_defaults` により、launch-policy defaults は既に解決済みの Profile / override scope を置換せず、missing rules として append される。
+- Normal launch は workspace-root write scope と `.worktree` write deny を引き続き append する。
+- Ticket role launch は role-specific default direct scope と delegation defaults を引き続き適用する。
+- `resolve_manifest()` は `apply_profile_launch_policy()` 後の final manifest を返す。
+- `Pod::from_manifest_with_context` は `manifest.scope` から tool-visible scope を作る。
+- Pod metadata snapshot serialization は final manifest を使う。
+- Restore path は existing `resolved_manifest_snapshot` がある場合それを使うため、この変更で restore 時に override を再評価する挙動は入っていない。
+- Focused tests は override-local `scope.allow` survival、normal profile launch defaults、Orchestrator role default scope/delegation preservation を cover している。
+
+Blocking issues: none。
+
+Non-blocking concerns / follow-ups:
+- Full `cargo test -p pod` は以下 2 件の prompt-guidance assertion failure で失敗する。
+  - `prompt::catalog::tests::pod_orchestration_guidance_section_renders_resource_body`
+  - `prompt::system::tests::pod_orchestration_guidance_is_included_for_pod_management_tools`
+  - Missing asserted text: `"worktree status, diff, and test results"`
+- Reviewer判断: この branch diff は `crates/pod/src/entrypoint.rs` のみであり、prompt rendering/assertion paths / prompt resources / catalog tests を変更していないため、この failure は unrelated/pre-existing。
+
+Reviewer validation:
+- `cargo fmt --all --check`: passed。
+- `git diff --check 72e9f2f1..HEAD`: passed。
+- `cargo test -p pod entrypoint::tests::`: passed, 22 tests。
+- `cargo check -p pod`: passed。
+- `cargo test -p pod`: unrelated prompt assertion failures only; 410 passed, 2 failed。
+
+Worktree status at review end: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:13:03Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `a1386881 merge: profile override scope`
+- Implementation commit included:
+  - `0717aae3 pod: preserve profile override scope`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed explicit Profile/workspace override `scope.allow` preservation, no wholesale `manifest.scope` replacement, workspace root write / `.worktree` deny default preservation, Ticket role launch/delegation defaults, final snapshot/tool-visible scope consistency, and restore non-goal preservation。
+
+Orchestrator validation after merge passed:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod entrypoint::tests::`
+- `cargo check -p pod`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-WNUQvw.log`
+
+Known unrelated validation note:
+- Full `cargo test -p pod` was not used as a final gate because Reviewer confirmed unrelated/pre-existing prompt-guidance assertion failures outside this branch's diff。
+
+Nix validation:
+- Not run because this Ticket changed only Rust source in `crates/pod/src/entrypoint.rs` and no dependency/package/source-filter files changed。
+
+Final state:
+- Orchestrator worktree clean at `a1386881` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+- WebFetch PDF and Intake investigation gate Coder Pods continue in parallel。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T12:13:11Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `a1386881`, review approved, and final Orchestrator validation passed: `cargo fmt --all --check`, `git diff --check HEAD^1..HEAD`, `cargo test -p pod entrypoint::tests::`, and `cargo check -p pod`.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T12:13:32Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T12:13:32Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVJABS1A` を完了しました。
+
+実装内容:
+- Profile launch policy が `manifest.scope` を wholesale replacement しないように修正しました。
+- 既に解決済みの Profile / workspace override scope に対して、launch-policy default rules を missing rules として append するようにしました。
+- `.yoi/override.local.toml` 等で指定された追加 `scope.allow` / `scope.deny` は保持されます。
+- Normal launch の workspace root write scope と `.worktree` write deny は維持されます。
+- Ticket role launch の default direct scope / delegation defaults は維持されます。
+- Final manifest/snapshot と tool-visible scope が同じ final effective scope を見るように維持しました。
+- Restore path は existing `resolved_manifest_snapshot` を使う挙動のままで、override 再評価は追加していません。
+
+主な commit:
+- `0717aae3 pod: preserve profile override scope`
+- `a1386881 merge: profile override scope`
+
+Review:
+- r1 は `approve`。
+- Reviewer は scope merge semantics、no authority broadening、workspace write / `.worktree` deny preservation、Ticket role defaults、snapshot/tool-visible scope consistency、restore non-goal preservation を確認しました。
+
+最終 validation:
+- `cargo fmt --all --check`
+- `git diff --check HEAD^1..HEAD`
+- `cargo test -p pod entrypoint::tests::`
+- `cargo check -p pod`
+
+Known unrelated note:
+- Full `cargo test -p pod` は branch 外の既存 prompt-guidance assertion failure で失敗するため final gate にしませんでした。Reviewer はこの failure が `crates/pod/src/entrypoint.rs` の diff に起因しないことを確認済みです。
+
+Nix validation:
+- Not run because no dependency/package/source-filter files changed。
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/bash-WNUQvw.log`
+
+---

.yoi/tickets/00001KVJDJD02/artifacts/orchestration-plan.jsonl

@@ -0,0 +1 @@
+{"id":"orch-plan-20260620-120740-1","ticket_id":"00001KVJDJD02","kind":"accepted_plan","accepted_plan":{"summary":"Intake role prompt / ticket-intake workflow に Ticket 化前の最小調査ゲートを明示し、曖昧な依頼では既存 Ticket/docs/code/workflow 調査・draft提示・spike/requirements_sync判断を TicketCreate より前に行うよう model-facing instructionを補強する。","branch":"impl/00001KVJDJD02-intake-investigation-gate","worktree":"/home/hare/Projects/yoi/.worktree/00001KVJDJD02-intake-investigation-gate","role_plan":"Orchestrator は Profile scope review / WebFetch PDF 実装と並行して専用 implementation worktree `.worktree/00001KVJDJD02-intake-investigation-gate` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が prompt/workflow authority、Ticket化前調査 gate、draft/user-agreement/spike semantics、stale vocabulary removal、Intake role boundariesを確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T12:07:40Z"}

.yoi/tickets/00001KVJDJD02/item.md

@@ -0,0 +1,94 @@
+---
+title: 'Intake workflow に Ticket 化前の調査ゲートを明示する'
+state: 'closed'
+created_at: '2026-06-20T11:45:00Z'
+updated_at: '2026-06-20T12:20:16Z'
+assignee: null
+readiness: 'implementation_ready'
+risk_flags: ['prompt-context', 'workflow-source', 'role-behavior', 'ticket-authority']
+queued_by: 'workspace-panel'
+queued_at: '2026-06-20T12:06:37Z'
+---
+
+## Background
+
+Intake がユーザー発話をそのまま Ticket 化しようとし、Ticket 作成前に必要な既存 Ticket / docs / code / workflow 調査を十分に行わない挙動が観測されている。
+
+今回の Intake 調査では、workspace 側の `.yoi/workflow/ticket-intake-workflow.md` には既存 Ticket 確認、関連 docs/code/workflow/history の確認、readiness 分類、ユーザー合意前に official Ticket を作らないことが書かれている一方で、以下の弱さが見えた。
+
+- `resources/prompts/role/intake.md` は role prompt として短く、`create or update the appropriate Ticket` の重みが強い。
+- `resources/workflows/ticket-intake-workflow.md` は workspace workflow snapshot より薄く、Ticket 化前の調査ゲート、draft-before-create、user agreement gate、`spike_needed` の扱いが弱い。
+- workspace workflow でも「必要に応じて関連 docs / code / workflow / history を読む」が optional に読めるため、曖昧な依頼で調査せず draft/Ticket 化へ倒れやすい。
+- draft template に `Action required` / `Attention required` が残っており、現在の Ticket schema / vocabulary とずれた文言が残っている。
+
+関連して参照した既存 Ticket:
+
+- `00001KTAZ2401` Ticket intake workflow
+- `00001KT0JPZS0` Built-in Ticket intake and orchestration routing
+- `00001KTRKZ14C` Project workflows を public builtin と dogfood 運用に分離する
+- `00001KSKBPHRG` Prompt / Workflow 評価メトリクスと改善 Offer
+
+## Requirements
+
+- Intake role prompt に「Ticket 化前の最小調査」を明示する。
+- Ticket intake workflow に、以下を binding step として追加または強調する。
+  - 既存 Ticket / workflow / relevant files を読むべき条件。
+  - 調査不足なら `TicketCreate` せず、draft または `spike_needed` / `requirements_sync_needed` として止めること。
+  - ユーザー主張、Intake が確認した事実、未確認仮説を Ticket draft 上で分けること。
+  - “言われたことそのまま” を requirements / acceptance criteria にしないこと。
+- `resources/workflows/ticket-intake-workflow.md` と workspace workflow `.yoi/workflow/ticket-intake-workflow.md` の役割差を確認し、必要なら bundled 側も詳細化する。
+- stale な `Action required` / `Attention required` 語彙を削除または現在の Ticket 運用に合う表現へ置換する。
+- Intake が coder / reviewer / read-only investigation helper Pod を起動しない境界は維持する。
+
+## Acceptance criteria
+
+- Intake が曖昧な依頼を受けた時、`TicketCreate` より先に duplicate / related work / relevant docs-code-workflow の確認を行うべき条件が model-facing prompt/workflow に明文化されている。
+- 調査が必要な依頼では、Intake が `spike_needed` または `requirements_sync_needed` として draft 提示に留められることが prompt/workflow 上で明示されている。
+- role prompt が “create/update Ticket” だけでなく “materialize 前に十分に調査し、未確認事項を分離する” ことを明示している。
+- bundled workflow resource と workspace workflow の不整合が解消されるか、意図した差分として短く説明されている。
+- Ticket 作成前の user agreement rule は維持されている。
+- stale な `Action required` / `Attention required` が新規 draft template から消えるか、現行 schema と矛盾しない説明に置き換わっている。
+
+## Binding decisions / invariants
+
+- Intake は scheduler ではなく、coder / reviewer / read-only investigation helper Pod を起動しない。
+- Intake は implementation worktree 作成、implementation routing、review routing、merge、close を行わない。
+- ユーザー合意なしに official Ticket を作らないルールは維持する。
+- Ticket body には、ユーザー主張、Intake が確認した事実、未確認仮説、未決定点を混同して保存しない。
+- Prompt / workflow 文言は `resources/prompts` / `resources/workflows` と workspace workflow override の責務境界を崩さない。
+
+## Implementation latitude
+
+- prompt / workflow 文言の修正で足りるならコード変更しない。
+- 実例セッションが必要なら、`~/.yoi/sessions` の該当 transcript を小さく確認して原因分析に使ってよい。ただし raw private context や不要な transcript 全文を Ticket に保存しない。
+- `00001KSKBPHRG` の prompt/workflow evaluation work と接続して、将来的な評価シナリオにするのは可。
+- bundled workflow と dogfood workspace workflow を完全一致させる必要はないが、差分がある場合は意図を説明できる状態にする。
+
+## Readiness
+
+- readiness: implementation_ready
+- risk_flags: [prompt-context, workflow-source, role-behavior, ticket-authority]
+
+## Escalation conditions
+
+- Intake の観測挙動が prompt/workflow ではなく Panel handoff、workflow selection、role profile resolution、または active workflow snapshot の問題に見える場合。
+- workflow source priority や builtin/workspace override semantics の設計変更が必要になる場合。
+- session history を読まないと原因を特定できず、かつ transcript に private context が含まれる可能性がある場合。
+
+## Validation
+
+- prompt / workflow diff review。
+- `git diff --check`。
+- 必要に応じて `yoi ticket doctor`。
+- 可能なら Intake の小さな再現シナリオで、曖昧な依頼に対して `TicketCreate` せず調査/draft に留まることを確認する。
+
+## Related work
+
+- `resources/prompts/role/intake.md`
+- `resources/workflows/ticket-intake-workflow.md`
+- `.yoi/workflow/ticket-intake-workflow.md`
+- `resources/profiles/intake.lua`
+- `00001KTAZ2401`
+- `00001KT0JPZS0`
+- `00001KTRKZ14C`
+- `00001KSKBPHRG`

.yoi/tickets/00001KVJDJD02/resolution.md

@@ -0,0 +1,33 @@
+## Resolution
+
+`00001KVJDJD02` を完了しました。
+
+実装内容:
+- `resources/prompts/role/intake.md` に official `TicketCreate` 前の minimum investigation gate を追加しました。
+- Intake が user claims / confirmed facts / unverified hypotheses / undecided points を区別するように model-facing guidance を補強しました。
+- User agreement before official Ticket creation を維持・明確化しました。
+- Intake non-scheduler boundary を補強しました。
+  - coder/reviewer/read-only helper Pod spawn なし。
+  - worktree作成なし。
+  - implementation/review routing、merge、close なし。
+- `resources/workflows/ticket-intake-workflow.md` を concrete reusable Intake procedure に拡張しました。
+- `.yoi/workflow/ticket-intake-workflow.md` を bundled workflow と整合させつつ、dogfooding/workspace-specific details を維持しました。
+- Investigation が必要な場合、`requirements_sync_needed` / `spike_needed` / `blocked` の draft stop behavior を明示しました。
+- `Action required` / `Attention required` の stale wording を touched templates から削除し、current Ticket-operation vocabulary に置換しました。
+
+主な commit:
+- `1143ae1c workflow: add intake investigation gate`
+- `f62ed4db merge: intake investigation gate`
+
+Review:
+- r1 は `approve`。
+- Reviewer は Intake non-scheduler boundary、user agreement、Ticket 化前 investigation gate、draft stop behavior、claims/facts/hypotheses/open questions separation、bundled/workspace workflow consistency、stale vocabulary removal を確認しました。
+
+最終 validation:
+- `git diff --check HEAD^1..HEAD`
+- stale vocabulary grep: `Action required` / `Attention required` no matches in touched files。
+- investigation vocabulary grep: expected terms present。
+- `TicketDoctor`: 0 errors。
+
+Known unrelated note:
+- `TicketDoctor` は既存 Ticket の warning 4 件を返しましたが、この Ticket の変更とは無関係です。

.yoi/tickets/00001KVJDJD02/thread.md

@@ -0,0 +1,294 @@
+<!-- event: create author: LocalTicketBackend at: 2026-06-20T11:45:00Z -->
+
+## 作成
+
+LocalTicketBackend によって作成されました。
+
+---
+
+<!-- event: state_changed author: workspace-panel at: 2026-06-20T12:06:37Z from: ready to: queued reason: queued field: state -->
+
+## State changed
+
+Ticket を `workspace-panel` が queued にしました。
+
+
+---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T12:08:15Z -->
+
+## Decision
+
+Routing decision: implementation_ready_parallel
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- User standing directive: blocker が無いものは並列実行する。現在の `00001KVJABS1A` review と WebFetch PDF work とは別 domain の prompt/workflow resource修正であり、直接 conflict はないため並列化できる。
+- Ticket body は Intake role prompt / workflow の弱点、Ticket 化前調査 gate、draft-before-create、user agreement gate、spike/requirements_sync handling、stale vocabulary removal、Intake boundaries を実装可能な粒度で定義している。
+- 未解決 relation blocker はない。
+- Orchestrator worktree は clean、matching branch/worktree はなし。
+- Risk domain は prompt-context / workflow-source / role-behavior / ticket-authority だが、Ticket は Intake が coder/reviewer/helper Pod を起動しないこと、implementation routing/merge/closeをしないこと、user agreement without official Ticket create ruleを維持することを明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVJDJD02` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVJDJD02)`: no blockers。
+- `TicketOrchestrationPlanQuery(00001KVJDJD02)`: no previous plan records; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `36b9ed45`。
+  - queued: `00001KVJA7V2R`, `00001KVJDJD02`。
+  - inprogress: `00001KVJABS1A` review only。
+  - no matching Intake workflow branch/worktree。
+
+IntentPacket:
+
+Intent:
+- Strengthen Intake model-facing role/workflow guidance so ambiguous requests go through a minimum investigation gate before official Ticket creation。
+- Make Intake separate user claims, confirmed facts, unverified hypotheses, and undecided points in drafts/Tickets。
+
+Binding decisions / invariants:
+- Intake remains non-scheduler and must not spawn coder/reviewer/read-only investigation helper Pods。
+- Intake must not create implementation worktrees, route implementation/review, merge, or close。
+- User agreement before official Ticket creation remains required。
+- Do not save user claims, confirmed facts, unverified hypotheses, and undecided points as if they are all requirements。
+- Preserve prompt/workflow resource boundaries between bundled resources and workspace override; explain intended differences if they remain。
+- Remove or replace stale `Action required` / `Attention required` vocabulary in draft templates with current Ticket-operation language。
+
+Requirements / acceptance criteria:
+- Intake prompt/workflow explicitly states when to inspect existing Tickets / workflows / relevant files before TicketCreate。
+- If investigation is needed, Intake can stop at draft / `spike_needed` / `requirements_sync_needed` rather than official Ticket creation。
+- `resources/prompts/role/intake.md`, `resources/workflows/ticket-intake-workflow.md`, and `.yoi/workflow/ticket-intake-workflow.md` are reconciled or their differences are intentional/clear。
+- Ticket作成前 user agreement rule is preserved。
+- Validation includes prompt/workflow diff review and `git diff --check`; run TicketDoctor if Ticket consistency needs checking。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T12:08:34Z from: queued to: inprogress reason: orchestrator_acceptance_parallel_intake_investigation_gate field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded Intake prompt/workflow context were checked. There is no unresolved blocking dependency, no conflicting inprogress implementation, and no missing planning decision. Accepting this queued Ticket for parallel implementation before worktree/Pod side effects.
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:09:50Z -->
+
+## Implementation report
+
+Implementation orchestration start:
+- Acceptance records were committed on Orchestrator branch: `e752a720 ticket: accept webfetch pdf and intake gate`。
+- Created implementation worktree `/home/hare/Projects/yoi/.worktree/00001KVJDJD02-intake-investigation-gate` on branch `impl/00001KVJDJD02-intake-investigation-gate` at `e752a720`。
+- Spawned Coder Pod `yoi-coder-00001KVJDJD02` with write scope limited to the implementation worktree and read-only root scope only for runtime workspace identity。
+- Coder task explicitly forbids root/original workspace implementation, Intake helper Pod spawning behavior changes, implementation routing/merge/close scope creep, merge, Ticket close, and cleanup。
+
+Next action:
+- Wait for Coder implementation report, then inspect branch diff/validation evidence and route to Reviewer。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:16:24Z -->
+
+## Implementation report
+
+Coder implementation report received from `yoi-coder-00001KVJDJD02`.
+
+Implementation commit:
+- `1143ae1c workflow: add intake investigation gate`
+
+Changed areas reported:
+- `resources/prompts/role/intake.md`:
+  - Added explicit minimum investigation gate before `TicketCreate` / material refinement。
+  - Reinforced user agreement before official Ticket creation。
+  - Added separation of user claims, confirmed facts, unverified hypotheses, and undecided points。
+  - Preserved Intake non-scheduler boundaries: no coder/reviewer/helper Pods, no worktrees, no routing/merge/close。
+- `resources/workflows/ticket-intake-workflow.md`:
+  - Expanded bundled workflow from thin pointer into concrete reusable Intake procedure。
+  - Added Ticket化前の最小調査ゲート。
+  - Added `spike_needed` / `requirements_sync_needed` draft stop behavior。
+  - Replaced stale `Action required` / `Attention required` draft wording with `Next Ticket operation`。
+  - Added recommended Ticket body sections for claims/facts/hypotheses/open questions。
+  - Documented bundled-vs-workspace workflow boundary。
+- `.yoi/workflow/ticket-intake-workflow.md`:
+  - Reconciled workspace override with bundled workflow while preserving dogfooding-specific details。
+  - Added explicit local investigation gate conditions and outputs。
+  - Updated draft template and Ticket body guidance。
+  - Clarified that workspace override may add Objective/split/local policy details but must not weaken bundled invariants。
+
+Coder validation reported:
+- `git diff --check`: passed。
+- Stale vocabulary grep for `Action required` / `Attention required` in touched prompt/workflow files: no matches。
+- Investigation-gate grep confirmed new terms are present:
+  - `minimum investigation gate`
+  - `Ticket 化前の最小調査ゲート`
+  - `spike_needed`
+  - `requirements_sync_needed`
+  - `Confirmed facts / sources`
+  - `Unverified hypotheses`
+  - `Undecided points / open questions`
+- Workflow/prompt test search: no dedicated workflow prompt tests found; only unrelated Dashboard test reference。
+- No code tests run because changes are prompt/workflow Markdown only。
+
+Known risks / deferrals:
+- No runtime schema/code changes were made。
+- `.yoi/workflow/ticket-intake-workflow.md` intentionally remains a more detailed workspace override; bundled workflow is compact reusable baseline。
+- `TicketDoctor` not run by Coder; no Ticket record structure was changed。
+
+Orchestrator evidence checked before review dispatch:
+- Implementation worktree is clean。
+- HEAD is `1143ae1c`。
+- Diff from acceptance `e752a720..HEAD` is one implementation commit touching 3 files, 186 insertions / 19 deletions。
+- `git diff --check e752a720..HEAD` produced no diagnostics。
+
+Next action:
+- Dispatch Reviewer for r1 review against Ticket requirements, with focus on model-facing Intake behavior, Ticket化前 investigation gate clarity, user-agreement preservation, stale vocabulary removal, bundled/workspace workflow boundary, and Intake non-scheduler boundaries。
+
+---
+
+<!-- event: plan author: yoi-orchestrator at: 2026-06-20T12:17:06Z -->
+
+## Plan
+
+Review dispatch:
+- Spawned Reviewer Pod `yoi-reviewer-00001KVJDJD02-r1` against implementation branch `impl/00001KVJDJD02-intake-investigation-gate`。
+- Review target commit: `1143ae1c workflow: add intake investigation gate`。
+- Review baseline: `e752a720`。
+- Reviewer task focuses on Intake non-scheduler boundaries, user agreement before official Ticket creation, Ticket化前 investigation gate clarity, draft / `spike_needed` / `requirements_sync_needed` stop behavior, claims/facts/hypotheses/open questions separation, bundled/workspace workflow consistency, stale vocabulary removal, and absence of unintended runtime/code changes。
+- Reviewer is instructed not to edit source, commit, merge, close the Ticket, or use TicketReview directly; it will report verdict/evidence back to Orchestrator。
+
+---
+
+<!-- event: review author: yoi-reviewer-00001KVJDJD02-r1 at: 2026-06-20T12:19:14Z status: approve -->
+
+## Review: approve
+
+Verdict: `approve`
+
+確認範囲:
+- Ticket authority / Orchestrator IntentPacket。
+- Implementation diff: `e752a720..1143ae1c`。
+- Changed files:
+  - `resources/prompts/role/intake.md`
+  - `resources/workflows/ticket-intake-workflow.md`
+  - `.yoi/workflow/ticket-intake-workflow.md`
+
+Blocking issues: none。
+
+Approval evidence:
+- Intake non-scheduler boundary is preserved and strengthened。
+  - Coder/Reviewer/read-only helper Pod spawn、worktree作成、implementation/review routing、merge、close、implementation side effects をしないことが明記されている。
+- Official Ticket creation 前の user agreement rule は維持されている。
+  - Draft presentation と explicit approval / creation instruction before `TicketCreate` が必要。
+- Pre-`TicketCreate` investigation conditions are now model-facing。
+  - Duplicate/related existing Ticket checks、targeted existing Ticket read-before-update、ambiguous/current-behavior/authority-boundary/workflow-source change cases の workflow/prompt/docs/code/config/history inspection が明示された。
+- Investigation stop behavior is explicit。
+  - Gate を満たせない場合、Intake は draft で停止し `requirements_sync_needed` / `spike_needed` / `blocked` として分類する。
+- User claims / confirmed facts / unverified hypotheses / undecided points are separated in prompt, draft template, and recommended Ticket body。
+- “User said so” is explicitly barred from becoming requirements / acceptance criteria without confirmation。
+- Bundled workflow vs workspace override boundary is coherent。
+  - Bundled は reusable minimum procedure、workspace override は dogfooding-specific details を足せるが bundled invariants を弱めない、と説明されている。
+- Stale `Action required` / `Attention required` wording was removed from touched templates。
+- Changed files are limited to prompt/workflow Markdown resources; no code/runtime behavior changes found。
+
+Non-blocking concerns / follow-ups:
+- Live Intake scenario は未実行。ただし本 Ticket は prompt/workflow text only であり、acceptance validation に E2E は要求されていないため blocking ではない。
+- Reviewer は `TicketDoctor` を実行していないが、implementation worktree 側で Ticket record structure は変更されておらず、Ticket consistency concern は見つからなかった。
+
+Reviewer validation:
+- `git diff --check e752a720..HEAD`: passed。
+- `grep -RInE 'Action required|Attention required' ...`: no matches。
+- Investigation vocabulary grep: expected terms present; count `59`。
+- `git diff --stat e752a720..HEAD`: 3 files changed, 186 insertions, 19 deletions。
+- `git diff --name-only e752a720..HEAD`: only expected prompt/workflow Markdown files。
+- `git status --short`: clean。
+
+---
+
+<!-- event: implementation_report author: yoi-orchestrator at: 2026-06-20T12:19:49Z -->
+
+## Implementation report
+
+Merge and final validation report:
+
+Merged implementation branch into Orchestrator branch:
+- Merge commit: `f62ed4db merge: intake investigation gate`
+- Implementation commit included:
+  - `1143ae1c workflow: add intake investigation gate`
+
+Reviewer outcome:
+- r1 approved with no blocking issues。
+- Reviewer confirmed Intake non-scheduler boundary, user agreement before official Ticket creation, pre-`TicketCreate` investigation conditions, draft / `spike_needed` / `requirements_sync_needed` stop behavior, claims/facts/hypotheses/open questions separation, bundled/workspace workflow boundary, stale vocabulary removal, and prompt/workflow-only change scope。
+
+Orchestrator validation after merge passed:
+- `git diff --check HEAD^1..HEAD`
+- grep confirmed no `Action required` / `Attention required` in touched prompt/workflow files。
+- grep confirmed expected investigation-gate vocabulary in touched files。
+- `TicketDoctor`: 0 errors, 4 existing warnings unrelated to this Ticket。
+
+Validation log:
+- inline Bash output and TicketDoctor tool output。
+
+Final state:
+- Orchestrator worktree clean at `f62ed4db` after validation。
+- Implementation worktree remains available for cleanup after Ticket completion records are committed。
+- WebFetch PDF Coder continues in parallel。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T12:19:57Z from: inprogress to: done reason: merged_reviewed_validated field: state -->
+
+## State changed
+
+Implementation was merged into Orchestrator branch at `f62ed4db`, review approved, and final Orchestrator validation passed: `git diff --check HEAD^1..HEAD`, stale vocabulary grep, investigation-gate vocabulary grep, and `TicketDoctor` with 0 errors.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-06-20T12:20:16Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-06-20T12:20:16Z status: closed -->
+
+## 完了
+
+## Resolution
+
+`00001KVJDJD02` を完了しました。
+
+実装内容:
+- `resources/prompts/role/intake.md` に official `TicketCreate` 前の minimum investigation gate を追加しました。
+- Intake が user claims / confirmed facts / unverified hypotheses / undecided points を区別するように model-facing guidance を補強しました。
+- User agreement before official Ticket creation を維持・明確化しました。
+- Intake non-scheduler boundary を補強しました。
+  - coder/reviewer/read-only helper Pod spawn なし。
+  - worktree作成なし。
+  - implementation/review routing、merge、close なし。
+- `resources/workflows/ticket-intake-workflow.md` を concrete reusable Intake procedure に拡張しました。
+- `.yoi/workflow/ticket-intake-workflow.md` を bundled workflow と整合させつつ、dogfooding/workspace-specific details を維持しました。
+- Investigation が必要な場合、`requirements_sync_needed` / `spike_needed` / `blocked` の draft stop behavior を明示しました。
+- `Action required` / `Attention required` の stale wording を touched templates から削除し、current Ticket-operation vocabulary に置換しました。
+
+主な commit:
+- `1143ae1c workflow: add intake investigation gate`
+- `f62ed4db merge: intake investigation gate`
+
+Review:
+- r1 は `approve`。
+- Reviewer は Intake non-scheduler boundary、user agreement、Ticket 化前 investigation gate、draft stop behavior、claims/facts/hypotheses/open questions separation、bundled/workspace workflow consistency、stale vocabulary removal を確認しました。
+
+最終 validation:
+- `git diff --check HEAD^1..HEAD`
+- stale vocabulary grep: `Action required` / `Attention required` no matches in touched files。
+- investigation vocabulary grep: expected terms present。
+- `TicketDoctor`: 0 errors。
+
+Known unrelated note:
+- `TicketDoctor` は既存 Ticket の warning 4 件を返しましたが、この Ticket の変更とは無関係です。
+
+---