Support tools and structured text in protected Local Apps

.agents/skills/nimi-app-acceptance/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: nimi-app-acceptance
+description: Run Desktop-supervised Nimi App acceptance or debug an App renderer through its exact CDP target. Use when the task requires real App interaction or renderer observation.
+---
+
+# Nimi App acceptance
+
+Verify the requested behavior in the real supported App. Start from the affected consumer and its direct contract; use the applicable AGENTS.md chain and the App's package manifest to choose the existing launch command.
+
+## Launch and target
+
+- Launch through the guarded package script with Desktop-supervised Electron. Attach to the exact App named by the task; do not open its Vite renderer directly or attach to Desktop or another App as a substitute.
+- Generic `nimi-app dev` selects and prints an ephemeral loopback CDP port. When a stable port is needed, use `pnpm --filter <app-package> dev -- --cdp-port <free-port>` with the actual package and an available port.
+- Root `pnpm dev:desktop`, `dev:zhiyu`, `dev:lab`, and `dev:avatar` own deterministic default ports. Generic dev may read the exact `NIMI_APP_DEV_CDP_PORT` override from the project `.env`; `--cdp-port` overrides either path and `--no-cdp` disables CDP.
+- Keep CDP loopback-only, development-only, and ephemeral. Native and owner UI remain outside CDP; use their supported owner paths when the task requires them.
+
+## Observe and complete
+
+- Reproduce the reported behavior or exercise the newly requested interaction, repair failures within scope, and rerun the affected journey. A missing prerequisite blocks only dependent work.
+- Use the existing browser/CDP tooling for observation. Do not add alternative CDP defaults, acceptance harnesses, Playwright projects, helper endpoints, recordings, fixtures, baselines, or evidence systems.
+- Run checks that cover the changed behavior. CDP visibility, screenshots, and fixture output do not establish the full product result.
+- Report the observed outcome and mark relevant unexecuted paths `NOT-VERIFIED`. Put any necessary local artifacts under `.nimi/local/**`.

.agents/skills/nimi-authority-work/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: nimi-authority-work
+description: Author or review Nimi canonical authority changes and diagnose authority-command failures. Use for .authority.yaml/.authority.md work, not ordinary implementation that follows settled contracts.
+---
+
+# Nimi authority work
+
+Use the project's existing authoring workflow; the host owns task state and product decisions.
+
+- Read the [authority authoring guide](../../../.nimi/methodology/authority-authoring.yaml) for the relevant operation. Reuse task authority and already sufficient context; do not preload the authority corpus or package-internal specifications.
+- Invoke Nimi-coding from the repository root through `pnpm exec nimicoding`. Follow the guide's complete-input, query-budget, format, validation, and semantic-change requirements for the operation actually needed.
+- Treat query scope and declared impact as bounded evidence, not proof of implementation conformance or task completion. Missing, refused, or incomplete results pause dependent decisions; continue independent authorized work without inventing replacement context.
+- Keep product meaning in `.nimi/spec/**`. Local reports and generated results remain non-authoritative; finish with the actual change and validation outcome.

.github/copilot-instructions.md

@@ -5,7 +5,9 @@ This file is a compatibility entry for Copilot.
 Authoritative project rules are defined in:
 
 1. [`AGENTS.md`](../AGENTS.md)
-2. Path-scoped `*/AGENTS.md` files
+2. Every `AGENTS.md` on the path from the repository root to the target, including intermediate ancestors
+
+Read guidance when entering its scope and reuse it while unchanged; do not enumerate unrelated subtrees.
 
 If this file and any `AGENTS.md` content conflict, `AGENTS.md` always wins.
 Do not invent tool-specific workflow rules outside the AGENTS hierarchy.

.gitignore

@@ -48,9 +48,6 @@ coverage/
 .ruff_cache/
 
 _external/
-.claude/settings.local.json
-.claude/launch.json
-**/.claude/launch.json
 /$HOME/
 
 # legacy execution-doc roots are archive/local-only
@@ -95,7 +92,6 @@ venv/
 env/
 ENV/
 
-.claude/scheduled_tasks.lock
 .playwright-cli/
 .codex-temp/
 outputs/

.nimi/spec/platform/core-protocol.authority.yaml

@@ -390,7 +390,7 @@ units:
     kind: rule
     title: P-PROTO-047 scenario consumption App operation family
     modality: must
-    statement: runtime.ai.text-turn.stream, runtime.ai.scenario.execute, runtime.ai.scenario-job.submit, runtime.ai.scenario-job.get, runtime.ai.scenario-job.subscribe, runtime.ai.scenario-job.cancel, runtime.ai.artifact.read, runtime.ai.artifact.upload, runtime.ai.artifact.adopt-to-app-storage, and runtime.ai.voice-assets.list are runtime.consume operations that consume the calling App owner's committed AIConfig without caller-selected route, provider, model, target, connector, credential, grant, tool, background authority, allowed-use selector, or fallback; Local App Job submit captures a Runtime-private immutable owner composed only of current AccountID plus Registered App Subject, and get, subscribe, cancel, artifact metadata, and bounded typed transcription text projection authorize that owner while AppID remains non-authorizing producer or catalog metadata; artifact read, adoption, and artifact-reference scenario input use one owner authorizer over the same tuple and exact Runtime-selected typed operation, historical subject-unbound Jobs and artifacts fail closed without AppID fallback, absent, foreign-owner, and subject-unbound artifact read or artifact-ref identifiers return one non-disclosing forbidden result, and adoption collapses missing, foreign, unbound, expired, and corrupt sources to one artifact-unavailable result without target mutation; runtime.ai.artifact.read returns at most 32 MiB of inline bytes, runtime.ai.artifact.upload preserves its bounded inline contract, scenario-specific inline audio bytes are admitted or rejected by their exact typed byte cap rather than a generic per-byte structural-node count, streamed custody, adoption, metadata, and Base asset streaming do not use that ceiling, and every response returns only the operation-specific typed projection with trace correlation.
+    statement: runtime.ai.text-turn.stream, runtime.ai.scenario.execute, runtime.ai.scenario-job.submit, runtime.ai.scenario-job.get, runtime.ai.scenario-job.subscribe, runtime.ai.scenario-job.cancel, runtime.ai.artifact.read, runtime.ai.artifact.upload, runtime.ai.artifact.adopt-to-app-storage, and runtime.ai.voice-assets.list are runtime.consume operations that consume the calling App owner's committed AIConfig without caller-selected route, provider, model, target, connector, credential, grant, background authority, allowed-use selector, or fallback; Local App Job submit captures a Runtime-private immutable owner composed only of current AccountID plus Registered App Subject, and get, subscribe, cancel, artifact metadata, and bounded typed transcription text projection authorize that owner while AppID remains non-authorizing producer or catalog metadata; artifact read, adoption, and artifact-reference scenario input use one owner authorizer over the same tuple and exact Runtime-selected typed operation, historical subject-unbound Jobs and artifacts fail closed without AppID fallback, absent, foreign-owner, and subject-unbound artifact read or artifact-ref identifiers return one non-disclosing forbidden result, and adoption collapses missing, foreign, unbound, expired, and corrupt sources to one artifact-unavailable result without target mutation; runtime.ai.artifact.read returns at most 32 MiB of inline bytes, runtime.ai.artifact.upload preserves its bounded inline contract, scenario-specific inline audio bytes are admitted or rejected by their exact typed byte cap rather than a generic per-byte structural-node count, streamed custody, adoption, metadata, and Base asset streaming do not use that ceiling, and every response returns only the operation-specific typed projection with trace correlation. The text.generate variant of runtime.ai.scenario.execute and runtime.ai.text-turn.stream additionally carry bounded function ToolSpec, ordered text and ToolCall output, later external-host ToolResult transcript, exact tool choice, and structured response format through the existing operation identities; these are model input and output values rather than permission or workflow authority, while provider tools, raw provider fields, tool execution and multi-turn state remain outside Runtime App consumption. Successful text.embed output also carries a Runtime-issued opaque space_id for vector compatibility, derived from the inputs captured for that execution and never usable as a route, model, configuration or authorization selector. Exact text adapters may carry bounded opaque ReasoningContinuityCarrier values for stateless tool-result round trips through the same typed text operations; the external Host preserves these values without inspecting or displaying them, and this exception exposes no raw reasoning or new authority selector.
     condition: Whenever one of the ten scenario-consumption App operations is invoked or a Local App Job or artifact consumer is authorized.
     failure: Deny the exact operation on missing runtime.consume coverage, invalid bounded input, unsupported artifact upload MIME, cross-owner or historical-unbound Job or artifact access, oversized inline artifact read or upload, owner AIConfig composition failure, or execution failure, return the admitted non-disclosing public result for artifact lookup or adoption, and never expose route, provider, model, account, subject, connector, credential, grant, or internal owner facts in any request or response field.
     relations: