feat(python-sdk): log stream

.agents/skills/apply-triage-action/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: apply-triage-action
+description: Apply, reject, or defer exactly one issue or CI recommendation from a local triage queue report. Use when the on-duty engineer explicitly supplies an item ID.
+metadata:
+  internal: true
+---
+
+# Apply Triage Action
+
+Process exactly one item ID from a queue-review report. Do not accept a natural-language approval without an ID. PRs are informational in v1.
+
+## Locate and validate
+
+1. Read the checkpoint and action records under `.agents/triage-duty/`; reconcile dispositions using the [local-state rules](../review-triage-queue/SKILL.md#local-state).
+2. Use the named report, or the latest report containing the ID. Read the recommendation and current disposition. Material changes to a previously selected recommendation require fresh review and selection.
+3. Reject missing, superseded, already-final, or ambiguous recommendations without making a write. Never substitute another item.
+4. Append every explicit disposition or attempted action to a dated local action record. Record repository, target, source report, ID, timestamp, disposition, reason, confirmed payload, and outcome; update the checkpoint afterward. Keep sensitive content out of the record; use `private reason withheld` for private reasons.
+
+## Reject or defer
+
+For **reject** or **defer**, require the engineer to give a reason. Record the local disposition.
+
+- **Reject** is terminal locally. Do not recommend the item again unless material new evidence changes the case.
+- **Defer** is non-terminal. Preserve its original priority and carry it into the next review's carried **Needs your decision** section.
+
+For shareable deferrals, draft a GitHub issue comment with reason, public links, and next step, or link existing waiting context. Use the confirmation rule below; declined posting leaves a local-only deferral. Keep private reasons out of external payloads and committable files. For missing reporter evidence, also propose the awaiting-information assessment state using `triage-issue`; unrelated dependency waits do not change lifecycle labels.
+
+## Apply
+
+Before any external write, re-read the target and determine whether it materially changed. Follow [Label Discovery](../../../CONTRIBUTING.md#label-discovery), retrieving all pages of current definitions before proposing a label change; use [`triage-issue`](../triage-issue/SKILL.md) for assessment states and maintainer authority.
+
+- If the action is already complete or would be a harmless no-op, make no external write and record the reason.
+- If new information makes the action unsafe or substantially different, stop and request a fresh review/selection.
+
+You MUST ALWAYS preview the exact payload, item ID, source report, and canonical target, then receive explicit confirmation for each individual external write. Selecting or deferring an item is not confirmation; comments, label changes, and closures require separate confirmations. Revalidate immediately before execution; changed payloads require a new preview and confirmation. Never reuse confirmation for a later invocation.
+
+After confirmation, perform only the approved action and record its outcome and public URL; mark applied only after success.
+
+Supported v1 actions:
+
+- Add the discovered triage-queue label to an open substantive community issue; recheck the [intake eligibility rules](../review-triage-queue/SKILL.md#gather-intake) and exclude duplicates, spam, and security disclosures.
+- Create one GitHub issue using [`create-github-issue`](../create-github-issue/SKILL.md).
+- Post one public issue comment, including waiting context or a duplicate explanation.
+- Change an issue's assessment state to awaiting information.
+- Close one issue with an evidenced reason; identify the canonical issue for duplicates.
+
+Never create a public GitHub issue for a security finding. Follow [SECURITY.md](../../../SECURITY.md).

.agents/skills/build-from-issue/SKILL.md

@@ -27,8 +27,10 @@ Use a single issue comment beginning with `> **🏗️ build-plan**` when a plan
 1. Check the current branch and working tree. Preserve unrelated work. Create an issue-specific branch or worktree as needed, following Branch Names in `CONTRIBUTING.md`.
 2. Implement the smallest coherent change that fulfills the acceptance criteria. Update relevant skills when behavior or commands change. Keep published documentation minimal: explain exactly what users need, avoid duplication across pages, and omit internal details with no user impact.
 3. Add meaningful tests for changed behavior and follow the verification guidance in `CONTRIBUTING.md`. Select format, lint, compile or type checks, and tests for affected components and their dependencies. Run the relevant E2E lane for infrastructure, sandbox, or policy changes. Guidance and template edits need applicable Markdown, YAML, link, and consistency checks. Do not require full Rust, SDK, or repository CI solely because a commit or PR is being created; broaden checks only for a concrete remaining risk or failed check.
-4. Review the diff, use a signed-off Conventional Commit, and prepare a PR following `create-github-pr`.
+4. Before pushing, apply the contributor access and issue acceptance check in `create-github-pr`. If blocked, preserve local work and report the reason. Review the diff, use a signed-off Conventional Commit, and prepare the PR.
 
 Every PR from this issue-backed workflow must have its own existing issue and use `Closes #<id>` in its Related Issue section. For work needing multiple PRs, split the scope into a closable issue per PR. A high-level issue may track those issues but should not be closed by an incomplete PR. Report the implementation, verification, and any remaining limitation in the PR description, rather than copying earlier issue diagnostics.
 
 Do not apply acceptance or roadmap decisions on behalf of a maintainer. Do not introduce `agent:*` workflow labels.
+
+For first-party security-sensitive crypto, use `openshell-crypto` and extend its facade/backend contracts when needed. Follow the [crypto architecture](../../../crates/openshell-crypto/CRYPTO.md) for compatibility, failure handling, and explicit coverage exceptions.

.agents/skills/build-openshell-mxc-windows/SKILL.md

@@ -21,6 +21,18 @@ Windows MSVC for the supported deliverables:
 It intentionally does not make Windows a Docker, Kubernetes, Podman, or VM
 runtime host.
 
+The supervisor and supervisor-process libraries participate in native Windows
+checks and tests. Their gateway session, boundary attachment, and TCP readiness
+are portable; only the optional Unix SSH/readiness socket adapters are gated.
+This is compile and control-plane coverage, not Windows isolation qualification.
+Preserve readiness gating on authenticated gateway acceptance and reconnection.
+The supervisor process-access multiplexer consumes boundary-provided streams;
+do not restore local PID, PTY, or process-group operations there. Native process
+mechanics belong to the sandbox or isolation backend. Keep the optional Unix
+SSH access adapter separate from portable session orchestration.
+Shared Sandbox Protocol audit validation defaults to strict Linux evidence;
+concrete platform validators must be selected by the implementing backend.
+
 ## Current Repository Shape
 
 The Windows build lane is implemented by these tracked files:

.agents/skills/build-openshell-mxc-windows/reference.md

@@ -111,8 +111,6 @@ top-level workspace targets for check/test:
 --exclude openshell-driver-vault
 --exclude openshell-driver-vm
 --exclude openshell-sandbox
---exclude openshell-supervisor
---exclude openshell-supervisor-process
 --exclude openshell-vfio
 ```
 
@@ -124,6 +122,10 @@ egress proxy. The Kubernetes Secrets and Vault libraries still compile as
 gateway dependencies; only their standalone Unix-socket binaries and
 package-level tests are excluded as top-level targets.
 
+The supervisor and supervisor-process packages now participate as top-level
+native check/test targets. Their portable session, attachment, and TCP readiness
+coverage does not enable a Windows isolation runtime.
+
 ## Common Errors
 
 ### Unix imports leak into Windows builds

.agents/skills/create-github-pr/SKILL.md

@@ -17,6 +17,26 @@ Create pull requests on GitHub using the `gh` CLI.
 
 ## Before Creating a PR
 
+### Verify Contributor Access and Issue Acceptance
+
+Before pushing or creating a PR (including a draft), verify the author's access
+to the target repository, not their fork. For the authenticated `gh` user:
+
+```bash
+gh repo view OWNER/REPO --json nameWithOwner,viewerPermission
+gh issue view ISSUE_NUMBER --repo OWNER/REPO --json number,url,labels
+```
+
+Authors with verified `WRITE`, `MAINTAIN`, or `ADMIN` access may proceed without
+`state:accepted`; keep the issue link and note the missing label. Everyone else
+must link at least one target-repository issue and have `state:accepted` on each.
+Otherwise, preserve local work and report which issue needs acceptance. A direct
+request, roadmap placement, other labels, or vouch status does not bypass this gate.
+
+When acting for another author, verify their permissions. Resolve failed lookups
+before proceeding; retry sandbox network failures outside the sandbox before
+reporting an authentication problem. Vouch requirements still apply separately.
+
 ### Check Config Documentation
 
 If the branch changes gateway TOML parsing, `[openshell.gateway]` fields,
@@ -156,6 +176,9 @@ PR descriptions must follow the project's [PR template](.github/PULL_REQUEST_TEM
 ## Changes
 <!-- Bullet list of key changes -->
 
+## Release Notes
+<!-- Optional: a few short, easy-to-read sentences about the user-facing change -->
+
 ## Testing
 <!-- What testing was done? -->
 - [ ] Checks appropriate to the affected code and behavior pass
@@ -168,6 +191,8 @@ PR descriptions must follow the project's [PR template](.github/PULL_REQUEST_TEM
 ```
 
 Populate the testing checklist based on what was actually run. Check boxes for steps that were completed.
+Keep the Release Notes section concise, with only a few easy-to-read sentences.
+Leave it empty when the summary already captures the user-facing change.
 
 ## Example PR (Complete)
 
@@ -189,6 +214,10 @@ Closes #456
 - Default page size is 100, max is 1,000
 - Structured responses include `next_page_token`
 
+## Release Notes
+
+Sandbox list results can now be paged through with `--page-size` and `--page-token`.
+
 ## Testing
 
 - [x] Relevant CLI format, lint, and unit checks pass
@@ -220,6 +249,9 @@ EOF
 
 The command outputs the PR URL and number.
 
+Rerun `PR Issue Acceptance` after linked issue labels change; it does not refresh
+automatically on issue-label events.
+
 **Display the URL using markdown link syntax** so it's easily clickable:
 
 ```

.agents/skills/fix-security-issue/SKILL.md

@@ -16,3 +16,5 @@ Use this skill after an authorized `review-security-issue` review identifies an
 5. Follow `create-github-pr` and use `Closes #<id>` for the reviewed issue. Every PR from this issue-backed remediation workflow must close its own issue; split multi-PR remediations into separate issues in the authorized security workflow. Keep the PR description appropriately scoped to its disclosure venue.
 
 Begin any fix comments with `> **🔧 security-fix-agent**`. Do not change human disposition or introduce `agent:*` workflow labels.
+
+For first-party security-sensitive crypto, use `openshell-crypto` and extend its facade/backend contracts when needed. Follow the [crypto architecture](../../../crates/openshell-crypto/CRYPTO.md) for compatibility, failure handling, and explicit coverage exceptions.

.agents/skills/launch-openshell-gator/SKILL.md

@@ -109,7 +109,7 @@ gateway_name="<selected-gateway-name>"
 openshell --gateway "$gateway_name" sandbox list
 ```
 
-Look for names like `gator-pr-<number>-supervised`. If one exists, inspect its log before deleting or relaunching.
+Look for names like `gtr-pr-<number>-watch`. If one exists, inspect its log before deleting or relaunching.
 
 ## Input Normalization
 
@@ -129,11 +129,14 @@ pr_number="<digits-only>"
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
 ```
 
-Use the portable Kubernetes DNS-1123 sandbox-name format even when the selected gateway currently uses another driver:
+Sandbox names must be DNS-1123 labels of at most **19 characters**, including
+any suffix. The gateway reserves room for workspace, sandbox, and service
+segments in one DNS label; this limit applies to every compute driver. Use
+short names and validate them before launching:
 
 ```bash
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 ```
 
 For local image contexts passed to `--from`, use an agent-created path such as `mktemp -d`; do not pass raw user-supplied paths without validating that they are expected local Dockerfile contexts.
@@ -149,8 +152,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -171,8 +174,8 @@ gateway_name="<selected-gateway-name>"
 issue_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
-sandbox_name="gator-issue-${issue_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-i-${issue_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -191,8 +194,8 @@ issue_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
 [[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -211,8 +214,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -231,8 +234,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-exp"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 CODEX_MODEL=gpt-5.6-sol \
 ./scripts/agents/run.sh \
@@ -244,6 +247,8 @@ CODEX_MODEL=gpt-5.6-sol \
 ```
 
 If the installed Codex CLI is too old for a model, create a temporary copy of `scripts/agents/gator/`, adjust only that temporary Dockerfile, and launch with that generated context. Keep the repo Dockerfile unchanged unless the version bump is the intended code change.
+The short `-exp` suffix below identifies an experimental watcher; keep its full
+name within 19 characters.
 
 Example shape:
 
@@ -252,8 +257,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-exp"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 tmp_context="$(mktemp -d "${TMPDIR:-/tmp}/gator-codex-XXXXXX")"
 cp -R scripts/agents/gator/. "$tmp_context"/
 
@@ -286,14 +291,19 @@ The launcher streams image-build and provisioning output to the terminal. Import
   size-limited full-diff endpoint. An unavailable patch ID alone does not block
   the ledger; it disables rebase-equivalence shortcuts. Reviewers should inspect
   oversized changes file-by-file locally.
+- Security regressions introduced or newly exposed by an unmerged PR belong
+  in its normal review findings. Private follow-up under `SECURITY.md` is for
+  pre-existing vulnerabilities independent of the PR; security classification
+  alone is not a private-triage or test-dispatch gate. Gator must not initiate
+  external security reporting without explicit operator authorization.
 
 ### Inspect Active Sandboxes
 
 ```bash
 gateway_name="<selected-gateway-name>"
 sandbox_name="<safe-sandbox-name>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 openshell --gateway "$gateway_name" sandbox list
 openshell --gateway "$gateway_name" sandbox get "$sandbox_name"
@@ -333,7 +343,7 @@ Before deleting, check that the sandbox is truly stale or that the operator aske
 gateway_name="<selected-gateway-name>"
 sandbox_name="<safe-sandbox-name>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 openshell --gateway "$gateway_name" sandbox delete "$sandbox_name"
 ./scripts/agents/run.sh \