docs: record privacy-safe AUR checkpoint

Author: speak-agent

.agents/docs/2026-08-09-mcpp-template-runtime-graphics-aur-validation.md

@@ -249,11 +249,13 @@ Task 8 focused local evidence:
 ### 5.8 mcpp-bin-only AUR reconciliation (Task 9)
 
 - State-machine/contract suite: `python3 -m unittest tests/scripts/test_aur_reconcile.py`
-  passes **11/11**. It covers no-op/upgrade/repair/RPC-lag/refused-downgrade,
+  passes **12/12**. It covers no-op/upgrade/repair/RPC-lag/refused-downgrade,
   missing or mismatched release material, bounded maintenance retry, permanent
   auth failure, failed known-package clone without repo initialization, exact
   latest-complete release selection, workflow recovery triggers, and the pinned
-  AUR ED25519 fingerprint.
+  AUR ED25519 fingerprint. It also requires both the rendered `mcpp-bin`
+  maintainer and reconciler commits to use the public `speak-agent` GitHub
+  noreply identity rather than a personal address.
 - Release fixture: the real public `v2026.8.8.4` payloads/sidecars and locally
   generated immutable manifest validate as desired `2026.8.8.4-1`; both Linux
   digests match manifest and sidecar. The first Arch render attempt classified
@@ -322,9 +324,11 @@ documentation-only handoff commit re-queued latest-head CI:
 
 The xlings boundary is tracked by
 [openxlings/xlings#521](https://github.com/openxlings/xlings/pull/521), whose
-eight native/cross checks pass. It remains Draft and REVIEW_REQUIRED. The
-documentation-only handoff commit `9f6161a` is now the latest mcpp PR head, so
-its re-queued matrix must reach terminal state before any latest-head claim.
+eight native/cross checks pass. It remains Draft and REVIEW_REQUIRED. After the
+handoff (`9f6161a`) and validation-ledger (`6e42d6c`) commits, privacy review
+produced `cf39cb2`: the AUR reconciler and rendered `mcpp-bin` now use the public
+`speak-agent` noreply identity, with a RED/GREEN contract regression. That
+latest-head matrix must reach terminal state before any latest-head claim.
 
 The Chinese operator handoff is
 `.agents/docs/2026-08-09-pr400-handoff-zh.md`. It records implementation scope,

.agents/docs/2026-08-09-pr400-handoff-zh.md

@@ -1,6 +1,6 @@
 # PR #400 中文交接文档
 
-> 更新时间：2026-08-09 23:53 CST
+> 更新时间：2026-08-10 00:06 CST
 >
 > 维护身份：`speak-agent`
 >
@@ -45,9 +45,11 @@ Draft PR [openxlings/xlings#521](https://github.com/openxlings/xlings/pull/521)
 | xlings Draft PR | [#521](https://github.com/openxlings/xlings/pull/521)，Draft | 精确声明 `compat.ftxui`、`compat.gtest` 并刷新 lock，8/8 CI 通过 |
 
 mcpp 分支为 `feat/template-runtime-graphics-aur`，基线为
-`80291ca01a982c1e8c00e43bfa97ffe68516e6d7`，本文生成前的远端和本地 HEAD 都是
-`ed4cf64279a5da94c736742338e5b01d90e297b8`。相对基线共有 26 个可追溯 commit，
-改动 109 个文件，约 14,485 行新增、1,691 行删除。
+`80291ca01a982c1e8c00e43bfa97ffe68516e6d7`。核心实现和原生诊断 checkpoint 是
+`ed4cf64279a5da94c736742338e5b01d90e297b8`；随后增加中文交接、验证账本和公共发布身份，
+隐私修复 checkpoint 为 `cf39cb2`。截至该 checkpoint，相对基线共有 29 个可追溯
+commit，改动 111 个文件，约 14,976 行新增、1,692 行删除。接手时仍须重新比较本地与
+远端 HEAD，不要把本文快照当成可变分支的永久 HEAD。
 
 设计和验证文档按以下顺序阅读：
 
@@ -193,6 +195,9 @@ mcpp 分支为 `feat/template-runtime-graphics-aur`，基线为
 | `4e39a8e` | Draft PR 流程和文档隐私清理 |
 | `0cc6a2a` | libc poison fixture 尊重隔离 `MCPP_HOME` |
 | `ed4cf64` | workspace 继承相对 index 时使用 lexical root anchor |
+| `9f6161a` | 新增完整中文 PR 交接文档 |
+| `6e42d6c` | 同步 Arch、CI 和跨仓库验证账本 |
+| `cf39cb2` | AUR 使用 `speak-agent` 公共 noreply 身份，并增加隐私回归 |
 
 每个逻辑 commit push 后都在 PR #400 留有 checkpoint。issue #380、#392、#396 也已经
 收到“实现已进入 Draft、但发布前不关闭”的状态评论。
@@ -271,7 +276,7 @@ mcpp，而没有进入目标 nested-tool regression。fixture 现在使用
 - 重点 E2E 已覆盖 package/template、事务 scaffold、RuntimeBinding、root-local SubOS、
   Rule A/B、provider provenance、stored `why runtime`、AUR/release 脚本。
 - release manifest contract：12/12。
-- AUR state-machine/contract：11/11。
+- AUR state-machine/contract：12/12，包括公共 `speak-agent` 发布身份契约。
 - 所有变更 shell 通过 `bash -n`，Python generator/tests 通过 bytecode compile，workflow YAML
   可解析，`git diff --check` 通过。
 - 公开 `v2026.8.8.4` 四平台 payload/sidecar replay 生成的 manifest 字节稳定；manifest