feat: auto-join scoped Feishu OAuth users

.gitea/workflows/hub-check.yml

@@ -93,8 +93,8 @@ jobs:
 
       - name: Prove real Claude SDK Bash sandbox boundary
         run: |
-          sudo install -d -o "$(id -u)" -g "$(id -g)" -m 0700 /var/lib/cph-test
-          CPH_SANDBOX_TEST_ROOT=/var/lib/cph-test \
+          sudo install -d -o "$(id -u)" -g "$(id -g)" -m 0700 /w/t
+          CPH_SANDBOX_TEST_ROOT=/w/t \
             /usr/bin/setpriv --no-new-privs \
             npx vitest run test/integration/agent-sandbox-linux.test.ts
 

AGENTS.md

@@ -28,6 +28,10 @@
   service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
   `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
   控制面与 Docker adapter 后置(见 ADR-0025)。
+- Agent role 与 skill 是 Organization-scoped 动态运行配置：role 组合 model、system prompt、
+  tools 与已安装 skill；skill 版本进入 content-addressed 持久存储，run 只读加载所选快照。
+  `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
+  运行时能力(见 ADR-0018)。
 
 ## 纪律
 

docs/adr/0017-agent-session-is-provider-bound.md

@@ -37,6 +37,16 @@ that cursor is the `result.session_id`; store it in `AgentSession.metadata` as
 tool surfaces can differ even when the underlying model is the same; `/draft`
 and `/review` must not resume the same Claude runtime cursor by accident.
 
+Role definitions are Organization-scoped runtime data. A role bundle selects
+its default model, system prompt, tool allowlist and installed Agent skill
+versions. PostgreSQL is authoritative for role composition and skill metadata;
+skill bytes live in a content-addressed persistent store selected only by the
+recorded SHA-256 digest. Updating a role or binding skills takes effect without
+a Hub release or process restart. A change to the role's execution surface
+(model, prompt, tools, selected skill content) archives its active sessions so
+the next run cannot resume a provider context created under stale instructions;
+label and ordering-only changes preserve conversational continuity.
+
 Environment variables:
 ```
 ANTHROPIC_BASE_URL=https://openrouter.ai/api

docs/adr/0018-agent-execution-surface-bounded-by-workspace.md

@@ -93,22 +93,26 @@ The boundary is enforced by the Claude Code SDK's built-in sandbox
   its Bash subprocesses run sandboxed; if the sandbox can't start, `query()`
   emits an error and exits rather than running unsandboxed.
 - `sandbox.allowUnsandboxedCommands: false` — a tool cannot opt out with the
-  SDK's `dangerouslyDisableSandbox` input.
+  SDK's `dangerouslyDisableSandbox` input. Claude Code 2.1.202 does not enforce
+  that option reliably, so a host-side `PreToolUse` hook also denies every
+  Bash request whose input explicitly sets `dangerouslyDisableSandbox: true`
+  before a process can start.
 - `sandbox.filesystem.denyRead: ["/"]` with `allowRead` for the canonical
   current workspace and a small named system-runtime set — normal reads stay
   in the run's workspace while `/bin`, shared libraries, CA certificates,
   fonts and the configured `cph` executable remain available as the external
   tool exception described above.
-- `sandbox.filesystem.allowWrite: [workspaceDir]` confines every write to the
-  canonical ADR-0007 workspace. Config/cache/home stay beneath
-  `.cph/agent-runtime/`. `TMPDIR`, `TMP`, and `TEMP` use the absolute
-  workspace-local `.cph/t/` path so tools remain anchored after `cd`;
-  `CLAUDE_CODE_TMPDIR` uses the short relative `.cph/t` prefix, resolved from
-  the canonical workspace cwd, because the SDK's socat bridge otherwise falls
-  back to a host temp directory when its Unix-socket prefix is too long.
-  Root is denied for writes and only the canonical workspace is re-opened, so
-  `/tmp`, `/var/tmp`, sibling projects and every other host path are rejected.
-  There is no writable scratch exception outside the project directory.
+- `sandbox.filesystem.allowWrite: [workspaceDir]` confines persistent host
+  effects to the canonical ADR-0007 workspace. Config/cache/home stay beneath
+  `.cph/agent-runtime/`; `TMPDIR`, `TMP`, `TEMP`, and `CLAUDE_CODE_TMPDIR` all
+  point at the workspace-local `.cph/t`. The workspace allocator uses stable
+  compact Organization/Project path segments, deployment requires a short
+  workspace root, and the canonical temp prefix fails fast above 56 bytes so
+  the SDK can append randomized `socat` bridge socket names without exceeding
+  Linux `sockaddr_un.sun_path`. Bubblewrap shadows non-allowlisted host trees
+  with disposable tmpfs mounts: a shell write there may succeed inside that
+  private namespace, but it cannot mutate the corresponding host path. The
+  Linux proof checks host state after the sandbox exits.
 - The SDK subprocess environment replaces rather than spreads `process.env`.
   Only provider protocol variables and non-secret runtime variables cross the
   boundary; database, Feishu and Hub session credentials never enter it.
@@ -118,6 +122,16 @@ The boundary is enforced by the Claude Code SDK's built-in sandbox
 - `settingSources: []` and strict MCP configuration prevent an untrusted
   workspace or service-user config from widening tools, hooks, MCP servers, or
   sandbox paths.
+- Agent skills are Organization-scoped runtime configuration, not Hub release
+  assets. A controlled host-console installer imports each version into a
+  content-addressed persistent store and records its digest in PostgreSQL. A
+  role selects enabled Organization skills alongside its model, system prompt
+  and tool allowlist. Each run copies only those selected immutable versions
+  into a run-scoped plugin outside the project workspace; the sandbox exposes
+  that snapshot read-only and deletes it after the run. SDK-bundled skills and
+  filesystem setting sources remain disabled, so project `.claude` content
+  cannot register skills or widen tools. Requested skill versions are recorded
+  on `run.created`; SDK initialization remains authoritative loading evidence.
 - Network: open (see Open Questions).
 
 `bypassPermissions` is kept (headless server — no interactive prompts); the

docs/para-26071100-feishu-setup.md

@@ -1,81 +1,219 @@
-# para-26071100 飞书应用配置清单
+# Educraft 组织接入与飞书应用配置指南
 
-本文供 `para-26071100` 的飞书企业管理员操作。不要把 App Secret 粘贴到群聊、工单或本文档中；请通过约定的安全渠道交给平台部署人员。
+本文供准备接入 Educraft Alpha Silo 的学校、教培机构和组织管理员使用。完成本文后，请把末尾的“部署信息交付单”交给 Educraft 部署人员；我们会为组织创建独立的服务账号、数据库、运行目录和域名入口。
 
-## 1. 创建企业自建应用
+> **安全提醒：** App Secret、模型 Provider Token 属于密钥，禁止粘贴到飞书群、普通云文档、工单正文或截图中。请只通过双方约定的安全渠道传递。
 
-1. 打开飞书开放平台开发者后台。
-2. 在目标企业下创建“企业自建应用”。
-3. 应用名称可填写 `Educraft para-26071100`。
-4. 在“凭证与基础信息”记录：
-   - App ID（通常以 `cli_` 开头）
-   - App Secret
-5. 添加并启用“机器人”能力。
+## 1. 双方分别负责什么
 
-Bot Open ID 不需要管理员手工寻找。平台部署人员会使用 App ID/App Secret 调用飞书 Bot Info API 获取，并在 bootstrap 时校验它确实属于这一个应用。
+| 角色 | 负责事项 |
+| --- | --- |
+| 组织管理员 | 创建企业自建应用、启用机器人、开通最小权限、配置事件、回调和 OAuth 重定向 URL、发布应用、提供 OWNER 身份 |
+| Educraft 部署人员 | 分配组织 slug 和域名、部署独立 Silo、加密保存应用及模型密钥、初始化 OWNER、联调和验收 |
+| 试点 OWNER | 把机器人加入试点群、创建或绑定项目、组织首轮验收 |
 
-## 2. 开通权限
+## 2. 创建企业自建应用
 
-在“权限管理”中搜索并申请下列能力。飞书控制台的中文名称可能随版本调整；如控制台同时显示 scope，可优先核对括号中的 scope。
+1. 打开[飞书开放平台开发者后台](https://open.feishu.cn/app)。
+2. 在目标企业下点击“创建企业自建应用”。应用名称建议填写“Educraft + 组织简称”。
+3. 进入“凭证与基础信息”，记录 App ID 和 App Secret。
+4. 进入“添加应用能力”，添加并启用“机器人”。
 
-- 接收群聊中 @ 机器人的消息（`im:message.group_at_msg:readonly`）
-- 以应用身份发送消息（`im:message:send_as_bot`）
-- 获取消息内容，用于读取触发消息和线程上下文（`im:message:readonly`）
-- 获取与上传图片或文件资源（`im:resource`）
-- 添加、删除消息表情回复（`im:message.reactions:write_only`）
-- 获取用户基本信息（`contact:user.base:readonly`）
+![凭证与基础信息页面；App Secret 默认以星号隐藏](assets/feishu-setup/01-credentials.png)
 
-如果飞书 API 调试台提示某个上述操作缺少更细粒度权限，请把提示截图交给平台部署人员，不要直接勾选通讯录全量读取或其他超出清单的权限。
+App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过安全渠道单独发送。Bot Open ID 不需要管理员手工查找；部署程序会用 App ID/App Secret 调用 Bot Info API 获取并校验归属。
 
-## 3. 配置事件与卡片回调
+## 3. 开通最小权限
 
-1. 进入“事件与回调”。
-2. 订阅方式选择“使用长连接接收事件”。
-3. 添加事件 `im.message.receive_v1`（接收消息）。
-4. 启用卡片交互回调 `card.action.trigger`，用于审批、中断运行和群聊建项目按钮。
-5. 不需要填写公网 Event Callback URL；Hub 使用飞书长连接。
+进入“权限管理”，点击“开通权限”，搜索并申请以下应用身份权限。控制台中文名称可能调整，请优先核对 scope。
 
-## 4. 配置 OAuth 回调
+| 用途 | Scope |
+| --- | --- |
+| 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
+| 以应用身份发送消息 | `im:message:send_as_bot` |
+| 读取触发消息和线程上下文 | `im:message:readonly` |
+| 获取与上传图片或文件 | `im:resource` |
+| 添加、删除消息表情回复 | `im:message.reactions:write_only` |
+| 获取用户基本信息 | `contact:user.base:readonly` |
+| 获取用户基本资料 | `contact:user.basic_profile:readonly` |
+| 通过手机号或邮箱查询 OWNER Open ID | `contact:user.id:readonly` |
 
-域名 DNS 和 TLS 生效后，在安全设置/重定向 URL 中添加：
+### 批量导入权限（推荐）
 
-```text
-https://para-26071100.educraft.paradigm-edu.net/auth/feishu/callback
+在“权限管理”页面点击“批量处理 → 导入”，粘贴以下 JSON 后确认。导入只会新增本次列出的权限，不会删除或影响应用已经申请、开通的其他权限。
+
+```json
+{
+  "scopes": {
+    "tenant": [
+      "im:message.group_at_msg:readonly",
+      "im:message:send_as_bot",
+      "im:message:readonly",
+      "im:resource",
+      "im:message.reactions:write_only",
+      "contact:user.base:readonly",
+      "contact:user.basic_profile:readonly",
+      "contact:user.id:readonly"
+    ],
+    "user": []
+  }
+}
 ```
 
-该回调用于 OWNER 登录受控的 Host Console。飞书群机器人长连接本身不依赖这个 URL。
+Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放在 `tenant`，不要为了省事把相同权限重复放进 `user`。
 
-## 5. 发布并安装应用
+![权限管理入口与已开通权限列表](assets/feishu-setup/02-permissions.png)
 
-1. 创建应用版本并提交企业管理员审核。
-2. 将应用可用范围至少包含试点 OWNER 和试点群成员。
-3. 发布版本。
-4. 将机器人加入准备试用的飞书群。
+如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。
 
-## 6. 获取首位 OWNER 身份
+## 4. 配置事件与卡片回调
 
-平台 bootstrap 需要 OWNER 的飞书 Open ID 和显示名称。可通过飞书 API 调试台的用户信息接口查询；Open ID 通常以 `ou_` 开头。Union ID 可选，不影响首次部署。
+进入“事件与回调”。
 
-请把以下结果通过安全渠道交给平台部署人员：
+1. 在“事件配置”中将订阅方式设为“使用长连接接收事件”。
+2. 添加事件“接收消息” `im.message.receive_v1`。
+3. 在“回调配置”中同样选择长连接。
+4. 添加回调“卡片回传交互” `card.action.trigger`，用于审批、运行中断和项目创建/绑定按钮。
+
+![长连接与消息事件配置](assets/feishu-setup/03-events.png)
+
+![卡片交互回调配置](assets/feishu-setup/04-callbacks.png)
+
+这里不需要填写公网 Event Callback URL。Educraft Hub 使用飞书官方 SDK 的长连接模式。
+
+## 5. 配置用户 OAuth 重定向 URL（必需）
+
+普通群成员首次使用前，需要通过飞书 OAuth 建立其在本应用下的用户身份。进入“安全设置 → 重定向 URL”，添加组织专属 callback：
 
 ```text
-Organization: para-26071100
-App ID: cli_...
-App Secret: （安全渠道发送）
-OWNER Open ID: ou_...
-OWNER 显示名称:
-OWNER Union ID: （可选）
-试点群名称: （可选，便于验收）
+https://<organization-slug>.educraft.paradigm-edu.net/auth/feishu/callback
 ```
 
-## 7. 验收动作
+例如组织 slug 为 `example-school`：
 
-平台通知部署完成后：
+```text
+https://example-school.educraft.paradigm-edu.net/auth/feishu/callback
+```
 
-1. OWNER 打开 Host Console，完成飞书 OAuth 登录。
-2. 在试点群中 @机器人发送一条纯文本消息。
-3. 如果群尚未绑定项目，机器人应返回项目创建/绑定卡片。
-4. 创建项目后再次 @机器人，确认出现处理状态、流式卡片和最终回答。
-5. 再测试一个小文件附件，以及运行中断按钮。
+![在安全设置中添加组织专属 OAuth 重定向 URL](assets/feishu-setup/05-security.png)
 
-任何一步失败时，请保留发生时间、群名、消息截图和飞书 request/log ID；不要在截图中包含 App Secret 或 Provider token。
+必须使用 Educraft 部署人员最终确认的 slug；不要直接照抄示例。该 URL 用于 OAuth 返回并创建应用作用域下的飞书用户身份，不代表当前已经开放组织管理台。
+
+组织专属 OAuth 同时完成身份建立和入组：首次成功登录的用户会自动成为当前 Organization 的 `MEMBER`，回到群聊即可使用。`OWNER` 和 `ADMIN` 仍只能由部署人员或管理员显式授予；曾被移除的成员重新登录不会自动恢复资格。
+
+## 6. 发布并安装应用
+
+1. 进入“版本管理与发布”，点击“创建版本”。
+2. 将应用可用范围至少覆盖试点 OWNER 和试点群成员。
+3. 提交企业管理员审核并发布。
+4. 发布成功后，将机器人加入准备试用的群。
+
+![版本管理与发布页面](assets/feishu-setup/06-publish.png)
+
+仅保存开发配置但未发布时，新增权限、事件和可用范围通常不会对试点用户生效。
+
+## 7. 获取首位 OWNER 身份
+
+首次部署必须指定一位组织 OWNER。OWNER 是 Educraft 组织内的初始管理员，不等同于飞书应用所有者；两者可以是同一个人，也可以不同。部署所需的 Open ID 必须由本次创建的企业自建应用查询，因为同一用户在不同应用下的 Open ID 不同，不能复用其他应用查到的值。
+
+### 7.1 确认 OWNER
+
+先确认哪一位企业成员将担任 OWNER。记录其飞书显示名称，并准备在飞书的成员选择器中按姓名找到本人。若企业内有同名成员，选择前须通过部门等信息核对身份。
+
+### 7.2 开通查询权限和数据范围
+
+确认应用已开通上文列出的用户基本信息和用户 ID 权限。如果使用上文的批量导入 JSON，这些权限已包含在内。
+
+应用的通讯录数据范围还必须覆盖这位 OWNER。最小做法是把 OWNER 加入应用可用范围；不需要为此开放全企业通讯录。
+
+### 7.3 在官方接口页面获取 Open ID
+
+1. 打开飞书开放平台的[“获取单个用户信息”接口页面](https://open.feishu.cn/document/server-docs/contact-v3/user/get)。如果使用带 `appId` 参数的页面链接，可以直接进入对应应用；本文不提供固定 App ID，请在页面顶部选择本组织刚创建的企业自建应用，并核对 App ID 与交付单一致。
+2. 找到路径参数 `user_id`，点击参数输入框旁的“获取”。
+3. 在成员选择器中找到并选择 OWNER；如有同名成员，依据部门等信息确认本人。
+4. ID 类型选择 `open_id`。将选择器返回的值填入 `user_id`，并保持查询参数 `user_id_type=open_id`。
+5. 以应用身份（`tenant_access_token`）调用接口，核对成功响应中 `data.user.name` 与 OWNER 本人一致。
+6. 复制完整的 `data.user.open_id` 交给 Educraft 部署人员。Open ID 通常以 `ou_` 开头。
+
+参数旁的“获取”是飞书文档调试台提供的成员选择功能，不是要求管理员预先知道 Open ID。不要复用其他应用查到的 Open ID；同一用户在不同应用下的 Open ID 不同。若无法选择成员或接口调用失败，依次检查：页面当前选择的 App ID、应用可用范围和通讯录数据范围是否覆盖 OWNER、用户基本信息与用户 ID 权限是否已开通并随应用版本发布。
+
+### 7.4 核对并交付
+
+交付前完成以下检查：
+
+- 返回用户的姓名与 OWNER 本人一致；
+- Open ID 来自本次组织的这一个 App ID；
+- Open ID 完整复制，没有空格或省略号；
+- 显示名称使用组织希望在 Educraft 中展示的姓名；
+- Union ID 不是必填项，查不到可以留空。
+
+最终向部署人员提供：
+
+```text
+OWNER Open ID：ou_...
+OWNER 显示名称：
+OWNER Union ID：（可选）
+用于查询的 App ID：cli_...
+```
+
+Open ID 和显示名称可以放在普通交付单中；不要把 App Secret 一起粘贴进去。
+
+## 8. 部署信息交付单
+
+请复制下面的模板填写。标注“安全渠道”的字段不要与普通字段放在同一条群消息或云文档中。
+
+```text
+【组织信息】
+组织正式名称：
+组织简称：
+期望 organization slug：（小写字母、数字和连字符，例如 example-school）
+期望机器人显示名称：
+
+【飞书应用】
+App ID：cli_...
+App Secret：（通过安全渠道单独发送）
+应用已发布：是 / 否
+机器人能力已启用：是 / 否
+消息事件和卡片回调已配置：是 / 否
+OAuth 重定向 URL 已配置：是 / 否
+
+【首位 OWNER】
+OWNER Open ID：ou_...
+OWNER 显示名称：
+OWNER Union ID：（可选）
+
+【试点范围】
+试点群名称：（可选，用于验收定位）
+初始 Team 名称：（可选；没有 Team 不影响首次部署）
+预计试用人数：
+
+【模型配置】
+Provider 名称：（例如 OpenRouter）
+Provider Base URL：
+Provider Token：（通过安全渠道单独发送）
+启用的模型 ID：
+```
+
+Educraft 部署人员收到信息后，会回传最终 organization slug、访问域名、部署窗口和验收时间。若期望 slug 已被占用或不符合命名规则，会在部署前协调调整。
+
+## 9. 上线验收
+
+部署人员通知服务就绪后，由 OWNER 完成：
+
+1. OWNER 在试点群中 @机器人发送一条纯文本消息。
+2. 如果群尚未绑定项目，确认机器人返回项目创建/绑定卡片。
+3. 创建项目后再次 @机器人，确认出现处理状态、流式卡片和最终回答。
+4. 选择一位非 OWNER 试点成员完成 OAuth 登录，确认其自动以 MEMBER 身份加入组织。
+5. 该成员在同一群中 @机器人，确认能够进入已绑定项目。
+6. 测试一个小文件附件、一次运行中断，以及一个需要生成文档的任务。
+
+出现问题时，请保留发生时间、群名、消息截图和飞书 request/log ID。截图前确认其中不包含 App Secret、Provider Token 或其他密钥。
+
+## 10. Alpha 阶段边界
+
+- 每个组织运行在独立的系统用户、服务实例、数据库和持久化目录中。
+- 组织的 role、system prompt、tools 和 skills 是运行时配置，不需要跟随版本发布。
+- 同一项目同一时间只执行一个任务，避免并发修改同一个 workspace；组织级并发上限由部署配置决定。
+- 当前由 Educraft 人工创建组织、OWNER、Provider Connection 和初始 Team，并通过服务器上的受控管理命令运维；组织管理台尚未开放。
+- 非 OWNER 试点成员通过组织专属 OAuth 首次登录后自动成为 MEMBER；OWNER/ADMIN 提权和被移除成员的恢复仍需人工操作。
+- Alpha 不提供开放注册、自助密钥管理或跨组织资源共享。

hub/deploy/README.md

@@ -15,6 +15,7 @@ Application code lives in immutable versioned directories under
 sudo BASE=/srv/curriculum-project-hub \
   HUB_DIR=/srv/curriculum-project-hub/releases/<release-id>/hub \
   INSTANCE_ID=org-a \
+  WORKSPACE_ROOT=/w/997 \
   PORT=8788 \
   MEMORY_MAX=16G CPU_QUOTA=400% TASKS_MAX=512 \
   bash /srv/curriculum-project-hub/releases/<release-id>/hub/deploy/install_service.sh
@@ -49,10 +50,38 @@ Default state paths are:
 ```text
 /var/lib/cph-hub/org-a/home
 /var/lib/cph-hub/org-a/state
-/var/lib/cph-hub/org-a/workspaces
+/w/997
 /var/cache/cph-hub/org-a
 ```
 
+Organization Agent roles and skills are runtime configuration. Skill versions
+are stored below the Silo state directory (`state/skills`) and are included in
+`backup_silo.sh` as `agent-skills.tar`; PostgreSQL stores role bundles, skill
+metadata and role-to-skill selection. Operate them as the Silo service user so
+content ownership remains correct:
+
+```sh
+sudo INSTANCE_ID=org-a \
+  ENV_FILE=/srv/curriculum-project-hub/.secrets/org-a/platform.env \
+  bash hub/deploy/agent_config.sh install-skill \
+  --organization org-a --source /staging/typst --version 1
+sudo INSTANCE_ID=org-a \
+  ENV_FILE=/srv/curriculum-project-hub/.secrets/org-a/platform.env \
+  bash hub/deploy/agent_config.sh upsert-role \
+  --organization org-a --role draft --label 草稿 --tools-json null
+sudo INSTANCE_ID=org-a \
+  ENV_FILE=/srv/curriculum-project-hub/.secrets/org-a/platform.env \
+  bash hub/deploy/agent_config.sh set-role-skills \
+  --organization org-a --role draft --skills outline,lesson-project,typst
+sudo INSTANCE_ID=org-a \
+  ENV_FILE=/srv/curriculum-project-hub/.secrets/org-a/platform.env \
+  bash hub/deploy/agent_config.sh list --organization org-a
+```
+
+`--tools-json null` means the full registered tool surface; `[]` means no
+ordinary tools. SDK-bundled skills and workspace/user setting sources remain
+disabled regardless of runtime configuration.
+
 ## Bootstrap the only Organization
 
 Prepare a root-owned `0600` JSON file containing
@@ -128,16 +157,24 @@ sudo INSTANCE_ID=org-a \
   bash hub/deploy/backup_silo.sh
 ```
 
-The business set contains the PostgreSQL custom dump and workspace archive. The
+The business set contains the PostgreSQL custom dump, workspace archive and
+`agent-skills.tar`. The
 separate recovery set contains the keyring and environment. Both include
 checksums; neither destination may be the live host's only disk.
 
-Restore into a separate drill database/workspace, verify checksums, then run:
+Restore into a separate drill database, workspace and skill-store directory;
+verify checksums before extracting both tar archives, then run:
 
 ```sh
 set -a; . /path/to/restored/platform.env; set +a
+mkdir -p "$HUB_PROJECT_WORKSPACE_ROOT" "$HUB_SKILL_STORE_ROOT"
+tar -xf /path/to/business/workspaces.tar -C "$HUB_PROJECT_WORKSPACE_ROOT"
+tar -xf /path/to/business/agent-skills.tar -C "$HUB_SKILL_STORE_ROOT"
 node hub/dist/deployment/restore-preflight.js \
   --keyring-file /path/to/restored/secret-keyring.json
+sudo INSTANCE_ID=org-a ENV_FILE=/path/to/restored/platform.env \
+  HUB_DIR=/path/to/restored/release/hub \
+  bash hub/deploy/agent_config.sh verify-store --organization org-a
 ```
 
 Traffic stays disabled until the sole Organization and every Feishu/provider

hub/deploy/agent_config.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INSTANCE_ID="${INSTANCE_ID:?INSTANCE_ID required}"
+ENV_FILE="${ENV_FILE:?ENV_FILE required}"
+SERVICE_USER="${SERVICE_USER:-cph-$INSTANCE_ID}"
+HUB_DIR="${HUB_DIR:-/srv/curriculum-project-hub/current/hub}"
+
+[ "$(id -u)" -eq 0 ] || { echo "agent config console must run as root" >&2; exit 1; }
+[ -r "$ENV_FILE" ] || { echo "environment file is not readable: $ENV_FILE" >&2; exit 1; }
+[ -f "$HUB_DIR/dist/deployment/agent-config-cli.js" ] || { echo "Agent config CLI missing below $HUB_DIR" >&2; exit 1; }
+id "$SERVICE_USER" >/dev/null 2>&1 || { echo "service user missing: $SERVICE_USER" >&2; exit 1; }
+
+set -a
+# shellcheck disable=SC1090
+. "$ENV_FILE"
+set +a
+: "${DATABASE_URL:?DATABASE_URL missing from ENV_FILE}"
+: "${HUB_SILO_ORGANIZATION_ID:?HUB_SILO_ORGANIZATION_ID missing from ENV_FILE}"
+
+exec runuser --user "$SERVICE_USER" -- \
+  env -i \
+    DATABASE_URL="$DATABASE_URL" \
+    HUB_SILO_ORGANIZATION_ID="$HUB_SILO_ORGANIZATION_ID" \
+    HUB_SKILL_STORE_ROOT="${HUB_SKILL_STORE_ROOT:-/var/lib/cph-hub/$INSTANCE_ID/state/skills}" \
+    XDG_STATE_HOME="${XDG_STATE_HOME:-/var/lib/cph-hub/$INSTANCE_ID/state}" \
+    PATH="${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}" \
+    node "$HUB_DIR/dist/deployment/agent-config-cli.js" "$@"

hub/deploy/backup_silo.sh

@@ -9,6 +9,7 @@ KEYRING_FILE="${KEYRING_FILE:?KEYRING_FILE required}"
 BUSINESS_BACKUP_DIR="${BUSINESS_BACKUP_DIR:?BUSINESS_BACKUP_DIR required}"
 RECOVERY_BACKUP_DIR="${RECOVERY_BACKUP_DIR:?RECOVERY_BACKUP_DIR required}"
 SERVICE_UNIT="cph-hub-$INSTANCE_ID.service"
+SKILL_STORE_ROOT="${SKILL_STORE_ROOT:-/var/lib/cph-hub/$INSTANCE_ID/state/skills}"
 
 [ "$(id -u)" -eq 0 ] || { echo "backup must run as root" >&2; exit 1; }
 umask 077
@@ -37,12 +38,14 @@ set +a
 : "${DATABASE_URL:?DATABASE_URL missing from ENV_FILE}"
 : "${HUB_PROJECT_WORKSPACE_ROOT:?HUB_PROJECT_WORKSPACE_ROOT missing from ENV_FILE}"
 [ -d "$HUB_PROJECT_WORKSPACE_ROOT" ] || { echo "workspace root missing" >&2; exit 1; }
+[ -d "$SKILL_STORE_ROOT" ] || { echo "skill store root missing" >&2; exit 1; }
 
 install -d -o root -g root -m 0700 "$BUSINESS_BACKUP_DIR" "$RECOVERY_BACKUP_DIR"
 business_root="$(realpath -m "$BUSINESS_BACKUP_DIR")"
 recovery_root="$(realpath -m "$RECOVERY_BACKUP_DIR")"
 workspace_root="$(realpath -m "$HUB_PROJECT_WORKSPACE_ROOT")"
 secret_root="$(realpath -m "$(dirname "$KEYRING_FILE")")"
+skill_root="$(realpath -m "$SKILL_STORE_ROOT")"
 paths_overlap() {
   local left="$1" right="$2"
   [ "$left" = "$right" ] || [[ "$left/" == "$right/"* ]] || [[ "$right/" == "$left/"* ]]
@@ -58,6 +61,10 @@ for pair in \
     exit 1
   fi
 done
+if paths_overlap "$business_root" "$skill_root" || paths_overlap "$recovery_root" "$skill_root" || paths_overlap "$workspace_root" "$skill_root"; then
+  echo "backup destinations, workspace and skill store must not overlap: $skill_root" >&2
+  exit 1
+fi
 stamp="$(date -u +%Y%m%dT%H%M%SZ)"
 business="$business_root/$INSTANCE_ID-$stamp"
 recovery="$recovery_root/$INSTANCE_ID-$stamp"
@@ -65,13 +72,14 @@ install -d -o root -g root -m 0700 "$business" "$recovery"
 
 pg_dump --format=custom --file="$business/database.dump" "$DATABASE_URL"
 tar --create --file="$business/workspaces.tar" --directory="$HUB_PROJECT_WORKSPACE_ROOT" .
+tar --create --file="$business/agent-skills.tar" --directory="$SKILL_STORE_ROOT" .
 cp --preserve=mode,ownership,timestamps "$KEYRING_FILE" "$recovery/secret-keyring.json"
 cp --preserve=mode,ownership,timestamps "$ENV_FILE" "$recovery/platform.env"
 chmod 0600 "$recovery/secret-keyring.json" "$recovery/platform.env"
 
 (
   cd "$business"
-  sha256sum database.dump workspaces.tar > SHA256SUMS
+  sha256sum database.dump workspaces.tar agent-skills.tar > SHA256SUMS
 )
 (
   cd "$recovery"

hub/deploy/cph-hub.service

@@ -18,6 +18,7 @@ EnvironmentFile=__ENV_FILE__
 Environment=HOME=__SERVICE_HOME__
 Environment=XDG_STATE_HOME=__STATE_DIR__
 Environment=XDG_CACHE_HOME=__CACHE_DIR__
+Environment=HUB_SKILL_STORE_ROOT=__SKILL_STORE_ROOT__
 Environment=PATH=__RUNTIME_PATH__
 # ADR-0024: the root-owned source remains unreadable by the service account;
 # systemd materializes a read-only per-unit credential at runtime.

hub/deploy/deploy_platform.sh

@@ -10,6 +10,7 @@
 #   PLATFORM_DEPLOY_BASE     optional, defaults to /srv/curriculum-project-hub
 #   PLATFORM_DEPLOY_RELEASE  optional immutable release id, defaults to git HEAD
 #   PLATFORM_DEPLOY_INSTANCE required, Silo instance id
+#   PLATFORM_DEPLOY_WORKSPACE_ROOT required short per-Silo path (for example /w/997)
 #   PLATFORM_DEPLOY_MEMORY_MAX / CPU_QUOTA / TASKS_MAX required ceilings
 #   PLATFORM_DEPLOY_HEALTH_URL optional, defaults to http://127.0.0.1:8788/api/healthz
 # The target host must have Node.js 24+, npm, rsync, PostgreSQL client tools
@@ -31,6 +32,7 @@ REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 RELEASE_ID="${PLATFORM_DEPLOY_RELEASE:-$(git -C "$REPO_ROOT" rev-parse --verify HEAD)}"
 [[ "$RELEASE_ID" =~ ^[A-Za-z0-9._-]+$ ]] || { echo "invalid PLATFORM_DEPLOY_RELEASE" >&2; exit 1; }
 INSTANCE_ID="${PLATFORM_DEPLOY_INSTANCE:?PLATFORM_DEPLOY_INSTANCE required}"
+WORKSPACE_ROOT="${PLATFORM_DEPLOY_WORKSPACE_ROOT:?PLATFORM_DEPLOY_WORKSPACE_ROOT required}"
 SERVICE_UNIT="cph-hub-$INSTANCE_ID.service"
 MEMORY_MAX="${PLATFORM_DEPLOY_MEMORY_MAX:?PLATFORM_DEPLOY_MEMORY_MAX required}"
 CPU_QUOTA="${PLATFORM_DEPLOY_CPU_QUOTA:?PLATFORM_DEPLOY_CPU_QUOTA required}"
@@ -67,11 +69,11 @@ fi
 ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "
   set -euo pipefail
   if [ \"\$(id -u)\" = \"0\" ]; then
-    BASE='$BASE' HUB_DIR='$HUB_DIR' INSTANCE_ID='$INSTANCE_ID' PORT='$HUB_PORT' MEMORY_MAX='$MEMORY_MAX' CPU_QUOTA='$CPU_QUOTA' TASKS_MAX='$TASKS_MAX' bash '$HUB_DIR/deploy/install_service.sh'
+    BASE='$BASE' HUB_DIR='$HUB_DIR' INSTANCE_ID='$INSTANCE_ID' WORKSPACE_ROOT='$WORKSPACE_ROOT' PORT='$HUB_PORT' MEMORY_MAX='$MEMORY_MAX' CPU_QUOTA='$CPU_QUOTA' TASKS_MAX='$TASKS_MAX' bash '$HUB_DIR/deploy/install_service.sh'
     systemctl restart '$SERVICE_UNIT'
     systemctl is-active --quiet '$SERVICE_UNIT'
   else
-    sudo -n BASE='$BASE' HUB_DIR='$HUB_DIR' INSTANCE_ID='$INSTANCE_ID' PORT='$HUB_PORT' MEMORY_MAX='$MEMORY_MAX' CPU_QUOTA='$CPU_QUOTA' TASKS_MAX='$TASKS_MAX' bash '$HUB_DIR/deploy/install_service.sh'
+    sudo -n BASE='$BASE' HUB_DIR='$HUB_DIR' INSTANCE_ID='$INSTANCE_ID' WORKSPACE_ROOT='$WORKSPACE_ROOT' PORT='$HUB_PORT' MEMORY_MAX='$MEMORY_MAX' CPU_QUOTA='$CPU_QUOTA' TASKS_MAX='$TASKS_MAX' bash '$HUB_DIR/deploy/install_service.sh'
     sudo -n systemctl restart '$SERVICE_UNIT'
     sudo -n systemctl is-active --quiet '$SERVICE_UNIT'
   fi

hub/deploy/install_service.sh

@@ -23,7 +23,8 @@ SERVICE_GROUP="${SERVICE_GROUP:-$SERVICE_USER}"
 SERVICE_HOME="${SERVICE_HOME:-/var/lib/cph-hub/$INSTANCE_ID/home}"
 STATE_DIR="${STATE_DIR:-/var/lib/cph-hub/$INSTANCE_ID/state}"
 CACHE_DIR="${CACHE_DIR:-/var/cache/cph-hub/$INSTANCE_ID}"
-WORKSPACE_ROOT="${WORKSPACE_ROOT:-/var/lib/cph-hub/$INSTANCE_ID/workspaces}"
+SKILL_STORE_ROOT="${SKILL_STORE_ROOT:-$STATE_DIR/skills}"
+WORKSPACE_ROOT="${WORKSPACE_ROOT:?WORKSPACE_ROOT required (use a short per-Silo path such as /w/997)}"
 HOST="${HOST:-127.0.0.1}"
 PORT="${PORT:?PORT is required and must be unique on the host}"
 ENV_FILE="${ENV_FILE:-$BASE/.secrets/$INSTANCE_ID/platform.env}"
@@ -105,6 +106,7 @@ for pair in \
   "SERVICE_HOME:$SERVICE_HOME" \
   "STATE_DIR:$STATE_DIR" \
   "CACHE_DIR:$CACHE_DIR" \
+  "SKILL_STORE_ROOT:$SKILL_STORE_ROOT" \
   "WORKSPACE_ROOT:$WORKSPACE_ROOT" \
   "ENV_FILE:$ENV_FILE" \
   "KEYRING_FILE:$KEYRING_FILE" \
@@ -120,6 +122,7 @@ done
 [[ "$MEMORY_MAX" =~ ^[1-9][0-9]*[KMGT]$ ]] || fail "MEMORY_MAX must be a systemd byte size such as 16G"
 [[ "$CPU_QUOTA" =~ ^[1-9][0-9]*%$ ]] || fail "CPU_QUOTA must be a positive percentage such as 400%"
 [[ "$TASKS_MAX" =~ ^[1-9][0-9]*$ ]] || fail "TASKS_MAX must be a positive integer"
+[ "${#WORKSPACE_ROOT}" -le 16 ] || fail "WORKSPACE_ROOT must be at most 16 bytes for Agent sandbox sockets: $WORKSPACE_ROOT"
 
 KEYRING_CREATED=false
 if [ -L "$KEYRING_FILE" ]; then
@@ -280,6 +283,7 @@ provision_directory() {
 provision_directory "$SERVICE_HOME"
 provision_directory "$STATE_DIR"
 provision_directory "$CACHE_DIR"
+provision_directory "$SKILL_STORE_ROOT"
 provision_directory "$WORKSPACE_ROOT"
 
 # Resolve every provisioned path again and verify uid/gid/mode before writing
@@ -296,6 +300,7 @@ sed \
   -e "s|__SERVICE_HOME__|$SERVICE_HOME|g" \
   -e "s|__STATE_DIR__|$STATE_DIR|g" \
   -e "s|__CACHE_DIR__|$CACHE_DIR|g" \
+  -e "s|__SKILL_STORE_ROOT__|$SKILL_STORE_ROOT|g" \
   -e "s|__WORKSPACE_ROOT__|$WORKSPACE_ROOT|g" \
   -e "s|__HUB_DIR__|$HUB_DIR|g" \
   -e "s|__ENV_FILE__|$ENV_FILE|g" \
@@ -314,5 +319,5 @@ install -o root -g root -m 0644 "$TMP_UNIT" "$UNIT"
 systemctl daemon-reload
 systemctl enable "$SERVICE_UNIT"
 echo "[install] installed $SERVICE_UNIT for $SERVICE_USER:$SERVICE_GROUP"
-echo "[install] home=$SERVICE_HOME state=$STATE_DIR cache=$CACHE_DIR workspaces=$WORKSPACE_ROOT"
+echo "[install] home=$SERVICE_HOME state=$STATE_DIR cache=$CACHE_DIR skills=$SKILL_STORE_ROOT workspaces=$WORKSPACE_ROOT"
 echo "[install] start with: systemctl start $SERVICE_UNIT"

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.4",
+  "version": "0.0.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.4",
+      "version": "0.0.12",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.4",
+  "version": "0.0.12",
   "private": true,
   "type": "module",
   "engines": {
@@ -38,6 +38,7 @@
     "prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
     "prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
     "secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
+    "agent-config": "node dist/deployment/agent-config-cli.js",
     "silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
     "silo:restore-preflight": "node dist/deployment/restore-preflight.js",
     "deploy": "bash deploy/deploy_platform.sh",

hub/prisma/migrations/20260711130000_dynamic_agent_roles_and_skills/migration.sql

@@ -0,0 +1,71 @@
+-- ADR-0017: Organization-scoped runtime role bundles and content-addressed
+-- skills. Composite foreign keys make cross-Organization role/skill bindings
+-- structurally impossible.
+CREATE TABLE "OrganizationAgentSkill" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT NOT NULL,
+    "description" TEXT,
+    "contentDigest" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "disabledAt" TIMESTAMP(3),
+    CONSTRAINT "OrganizationAgentSkill_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "OrganizationAgentRole" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "roleId" TEXT NOT NULL,
+    "label" TEXT NOT NULL,
+    "defaultModel" TEXT,
+    "systemPrompt" TEXT,
+    "tools" JSONB,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "disabledAt" TIMESTAMP(3),
+    CONSTRAINT "OrganizationAgentRole_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "OrganizationAgentRoleSkill" (
+    "organizationId" TEXT NOT NULL,
+    "agentRoleId" TEXT NOT NULL,
+    "agentSkillId" TEXT NOT NULL,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "OrganizationAgentRoleSkill_pkey" PRIMARY KEY ("organizationId", "agentRoleId", "agentSkillId")
+);
+
+CREATE UNIQUE INDEX "OrganizationAgentSkill_organizationId_name_key" ON "OrganizationAgentSkill"("organizationId", "name");
+CREATE UNIQUE INDEX "OrganizationAgentSkill_organizationId_id_key" ON "OrganizationAgentSkill"("organizationId", "id");
+CREATE INDEX "OrganizationAgentSkill_organizationId_disabledAt_idx" ON "OrganizationAgentSkill"("organizationId", "disabledAt");
+CREATE INDEX "OrganizationAgentSkill_contentDigest_idx" ON "OrganizationAgentSkill"("contentDigest");
+CREATE UNIQUE INDEX "OrganizationAgentRole_organizationId_roleId_key" ON "OrganizationAgentRole"("organizationId", "roleId");
+CREATE UNIQUE INDEX "OrganizationAgentRole_organizationId_id_key" ON "OrganizationAgentRole"("organizationId", "id");
+CREATE INDEX "OrganizationAgentRole_organizationId_disabledAt_sortOrder_idx" ON "OrganizationAgentRole"("organizationId", "disabledAt", "sortOrder");
+CREATE INDEX "OrganizationAgentRoleSkill_organizationId_agentRoleId_sortOrder_idx" ON "OrganizationAgentRoleSkill"("organizationId", "agentRoleId", "sortOrder");
+CREATE INDEX "OrganizationAgentRoleSkill_organizationId_agentSkillId_idx" ON "OrganizationAgentRoleSkill"("organizationId", "agentSkillId");
+
+ALTER TABLE "OrganizationAgentSkill" ADD CONSTRAINT "OrganizationAgentSkill_organizationId_fkey"
+  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentRole" ADD CONSTRAINT "OrganizationAgentRole_organizationId_fkey"
+  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentRoleSkill" ADD CONSTRAINT "OrganizationAgentRoleSkill_organizationId_agentRoleId_fkey"
+  FOREIGN KEY ("organizationId", "agentRoleId") REFERENCES "OrganizationAgentRole"("organizationId", "id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentRoleSkill" ADD CONSTRAINT "OrganizationAgentRoleSkill_organizationId_agentSkillId_fkey"
+  FOREIGN KEY ("organizationId", "agentSkillId") REFERENCES "OrganizationAgentSkill"("organizationId", "id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Preserve current alpha behavior while moving role definitions into data.
+INSERT INTO "OrganizationAgentRole" (
+  "id", "organizationId", "roleId", "label", "sortOrder", "updatedAt"
+)
+SELECT "id" || ':agent-role:draft', "id", 'draft', '草稿', 10, CURRENT_TIMESTAMP
+FROM "Organization";
+
+INSERT INTO "OrganizationAgentRole" (
+  "id", "organizationId", "roleId", "label", "sortOrder", "updatedAt"
+)
+SELECT "id" || ':agent-role:review', "id", 'review', '审校', 20, CURRENT_TIMESTAMP
+FROM "Organization";

hub/prisma/schema.prisma

@@ -43,6 +43,8 @@ model Organization {
   externalDirectoryConnections ExternalDirectoryConnection[]
   providerConnections          OrganizationProviderConnection[]
   feishuApplicationConnection  OrganizationFeishuApplicationConnection?
+  agentSkills                  OrganizationAgentSkill[]
+  agentRoles                   OrganizationAgentRole[]
   auditEntries                 AuditEntry[]                    @relation("organizationAudit")
 
   @@index([status])
@@ -78,6 +80,70 @@ enum OrganizationMemberRole {
   MEMBER
 }
 
+/// Organization-scoped, content-addressed Agent skill registration. The DB is
+/// the runtime registry; `contentDigest` selects an immutable directory below
+/// the platform-controlled skill store and is never interpreted as a path.
+model OrganizationAgentSkill {
+  id             String    @id @default(cuid())
+  organizationId String
+  name           String
+  version        String
+  description    String?
+  contentDigest  String
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+  disabledAt     DateTime?
+
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  roleBindings OrganizationAgentRoleSkill[]
+
+  @@unique([organizationId, name])
+  @@unique([organizationId, id])
+  @@index([organizationId, disabledAt])
+  @@index([contentDigest])
+}
+
+/// ADR-0017 runtime role bundle. Roles are Organization-owned data rather than
+/// a code enum: model, system prompt, tool allowlist and skill selection change
+/// without a Hub release or process restart.
+model OrganizationAgentRole {
+  id             String    @id @default(cuid())
+  organizationId String
+  roleId         String
+  label          String
+  defaultModel   String?
+  systemPrompt   String?
+  tools          Json?
+  sortOrder      Int       @default(0)
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+  disabledAt     DateTime?
+
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  skillBindings OrganizationAgentRoleSkill[]
+
+  @@unique([organizationId, roleId])
+  @@unique([organizationId, id])
+  @@index([organizationId, disabledAt, sortOrder])
+}
+
+/// Same-Organization join enforced by both composite foreign keys. `sortOrder`
+/// gives stable skill listing and prompt discovery order for a role bundle.
+model OrganizationAgentRoleSkill {
+  organizationId String
+  agentRoleId     String
+  agentSkillId    String
+  sortOrder       Int      @default(0)
+  createdAt       DateTime @default(now())
+
+  role  OrganizationAgentRole  @relation(fields: [organizationId, agentRoleId], references: [organizationId, id], onDelete: Cascade)
+  skill OrganizationAgentSkill @relation(fields: [organizationId, agentSkillId], references: [organizationId, id], onDelete: Cascade)
+
+  @@id([organizationId, agentRoleId, agentSkillId])
+  @@index([organizationId, agentRoleId, sortOrder])
+  @@index([organizationId, agentSkillId])
+}
+
 /// ADR-0021: org-level project onboarding policy. Ordinary Feishu users can
 /// create projects from unbound chats only when membersCanCreateProjects=true.
 model OrganizationProjectSettings {

hub/src/admin/routes/authRoutes.ts

@@ -5,7 +5,7 @@ import { randomBytes } from "node:crypto";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { resolveActiveFeishuApplication } from "../../connections/feishuApplicationConnections.js";
-import { upsertScopedFeishuIdentity } from "../../feishu/identityNamespace.js";
+import { upsertScopedFeishuIdentityInTransaction } from "../../feishu/identityNamespace.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import {
   buildAuthorizeUrl,
@@ -164,16 +164,54 @@ export async function registerAuthRoutes(app: FastifyInstance, config: AuthRoute
       const feishuUser = await exchangeCodeForUser(oauthConfig, code);
       let userId: string;
       if (statePayload.connectionId !== undefined && statePayload.organizationId !== undefined) {
-        const identity = await upsertScopedFeishuIdentity(config.prisma, {
-          connectionId: statePayload.connectionId,
-          openId: feishuUser.openId,
-          ...(feishuUser.unionId !== undefined ? { unionId: feishuUser.unionId } : {}),
-          displayName: feishuUser.displayName,
-          ...(feishuUser.avatarUrl !== null ? { avatarUrl: feishuUser.avatarUrl } : {}),
+        const connectionId = statePayload.connectionId;
+        const organizationId = statePayload.organizationId;
+        const identity = await config.prisma.$transaction(async (tx) => {
+          const resolved = await upsertScopedFeishuIdentityInTransaction(tx, {
+            connectionId,
+            expectedOrganizationId: organizationId,
+            openId: feishuUser.openId,
+            ...(feishuUser.unionId !== undefined ? { unionId: feishuUser.unionId } : {}),
+            displayName: feishuUser.displayName,
+            ...(feishuUser.avatarUrl !== null ? { avatarUrl: feishuUser.avatarUrl } : {}),
+          });
+          const activeMembership = await tx.organizationMembership.findFirst({
+            where: {
+              organizationId,
+              userId: resolved.userId,
+              revokedAt: null,
+            },
+            select: { id: true },
+          });
+          if (activeMembership === null) {
+            const revokedMembership = await tx.organizationMembership.findFirst({
+              where: {
+                organizationId,
+                userId: resolved.userId,
+                revokedAt: { not: null },
+              },
+              select: { id: true },
+            });
+            if (revokedMembership === null) {
+              await tx.organizationMembership.create({
+                data: {
+                  organizationId,
+                  userId: resolved.userId,
+                  role: "MEMBER",
+                },
+              });
+              await tx.auditEntry.create({
+                data: {
+                  organizationId,
+                  actorUserId: resolved.userId,
+                  action: "organization_member.oauth_auto_joined",
+                  metadata: { connectionId: resolved.connectionId, role: "MEMBER" },
+                },
+              });
+            }
+          }
+          return resolved;
         });
-        if (identity.organizationId !== statePayload.organizationId) {
-          throw new HttpError(400, "bad_request", "OAuth identity Organization scope mismatch");
-        }
         userId = identity.userId;
         setSessionCookie(reply, config, {
           userId,

hub/src/agent/configuration.ts

@@ -0,0 +1,260 @@
+import type { PrismaClient } from "@prisma/client";
+import { Prisma } from "@prisma/client";
+import { assertSupportedRoleTools } from "./roleTools.js";
+import { importSkillDirectory } from "./skillStore.js";
+
+const ROLE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+/**
+ * Deep module for controlled host-console Agent configuration. It owns the
+ * filesystem/DB ordering, Organization checks and role-skill composition so
+ * callers never manipulate registry rows or content paths independently.
+ */
+export class OrganizationAgentConfiguration {
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly skillStoreRoot: string,
+  ) {}
+
+  async installSkill(input: {
+    readonly organizationId: string;
+    readonly sourceDir: string;
+    readonly version: string;
+  }): Promise<{ readonly id: string; readonly name: string; readonly contentDigest: string }> {
+    await this.requireActiveOrganization(input.organizationId);
+    const version = nonEmpty(input.version, "skill version");
+    const imported = await importSkillDirectory({
+      sourceDir: input.sourceDir,
+      storeRoot: this.skillStoreRoot,
+    });
+    return this.prisma.$transaction(async (tx) => {
+      const previous = await tx.organizationAgentSkill.findUnique({
+        where: { organizationId_name: { organizationId: input.organizationId, name: imported.name } },
+        select: { contentDigest: true },
+      });
+      const skill = await tx.organizationAgentSkill.upsert({
+        where: {
+          organizationId_name: {
+            organizationId: input.organizationId,
+            name: imported.name,
+          },
+        },
+        create: {
+          organizationId: input.organizationId,
+          name: imported.name,
+          version,
+          description: imported.description ?? null,
+          contentDigest: imported.contentDigest,
+        },
+        update: {
+          version,
+          description: imported.description ?? null,
+          contentDigest: imported.contentDigest,
+          disabledAt: null,
+        },
+        select: {
+          id: true,
+          name: true,
+          contentDigest: true,
+          roleBindings: { select: { role: { select: { roleId: true } } } },
+        },
+      });
+      if (previous !== null && previous.contentDigest !== skill.contentDigest) {
+        await archiveRoleSessions(
+          tx,
+          input.organizationId,
+          skill.roleBindings.map((binding) => binding.role.roleId),
+        );
+      }
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_skill.installed",
+          metadata: {
+            name: skill.name,
+            version,
+            contentDigest: skill.contentDigest,
+          },
+        },
+      });
+      return { id: skill.id, name: skill.name, contentDigest: skill.contentDigest };
+    });
+  }
+
+  async upsertRole(input: {
+    readonly organizationId: string;
+    readonly roleId: string;
+    readonly label: string;
+    readonly defaultModel?: string | null | undefined;
+    readonly systemPrompt?: string | null | undefined;
+    readonly tools?: readonly string[] | null | undefined;
+    readonly sortOrder?: number | undefined;
+  }): Promise<{ readonly id: string; readonly roleId: string }> {
+    await this.requireActiveOrganization(input.organizationId);
+    if (!ROLE_ID_PATTERN.test(input.roleId)) throw new Error(`invalid role id: ${input.roleId}`);
+    const label = nonEmpty(input.label, "role label");
+    if (input.tools !== undefined && input.tools !== null) assertSupportedRoleTools([...input.tools]);
+    const sortOrder = input.sortOrder ?? 0;
+    if (!Number.isSafeInteger(sortOrder)) throw new Error("role sortOrder must be an integer");
+    const createTools = input.tools === undefined || input.tools === null
+      ? Prisma.DbNull
+      : [...input.tools];
+    const updateTools = input.tools === undefined
+      ? undefined
+      : input.tools === null
+        ? Prisma.DbNull
+        : [...input.tools];
+    return this.prisma.$transaction(async (tx) => {
+      const previous = await tx.organizationAgentRole.findUnique({
+        where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
+        select: { defaultModel: true, systemPrompt: true, tools: true },
+      });
+      const role = await tx.organizationAgentRole.upsert({
+        where: {
+          organizationId_roleId: {
+            organizationId: input.organizationId,
+            roleId: input.roleId,
+          },
+        },
+        create: {
+          organizationId: input.organizationId,
+          roleId: input.roleId,
+          label,
+          defaultModel: normalizeOptionalText(input.defaultModel),
+          systemPrompt: normalizeOptionalText(input.systemPrompt),
+          tools: createTools,
+          sortOrder,
+        },
+        update: {
+          label,
+          ...(input.defaultModel !== undefined ? { defaultModel: normalizeOptionalText(input.defaultModel) } : {}),
+          ...(input.systemPrompt !== undefined ? { systemPrompt: normalizeOptionalText(input.systemPrompt) } : {}),
+          ...(updateTools !== undefined ? { tools: updateTools } : {}),
+          sortOrder,
+          disabledAt: null,
+        },
+        select: { id: true, roleId: true },
+      });
+      const executionSurfaceChanged = previous !== null && (
+        (input.defaultModel !== undefined && normalizeOptionalText(input.defaultModel) !== previous.defaultModel) ||
+        (input.systemPrompt !== undefined && normalizeOptionalText(input.systemPrompt) !== previous.systemPrompt) ||
+        (input.tools !== undefined && JSON.stringify(input.tools) !== JSON.stringify(previous.tools))
+      );
+      if (executionSurfaceChanged) await archiveRoleSessions(tx, input.organizationId, [input.roleId]);
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_role.upserted",
+          metadata: {
+            roleId: input.roleId,
+            label,
+            defaultModel: input.defaultModel === undefined ? "unchanged" : normalizeOptionalText(input.defaultModel),
+            systemPromptConfigured: input.systemPrompt === undefined
+              ? "unchanged"
+              : normalizeOptionalText(input.systemPrompt) !== null,
+            tools: input.tools === undefined ? "unchanged" : input.tools === null ? "all" : [...input.tools],
+            sortOrder,
+          },
+        },
+      });
+      return role;
+    });
+  }
+
+  async setRoleSkills(input: {
+    readonly organizationId: string;
+    readonly roleId: string;
+    readonly skillNames: readonly string[];
+  }): Promise<void> {
+    const uniqueNames = new Set(input.skillNames);
+    if (uniqueNames.size !== input.skillNames.length) throw new Error("role skill names must be unique");
+    await this.prisma.$transaction(async (tx) => {
+      const role = await tx.organizationAgentRole.findUnique({
+        where: {
+          organizationId_roleId: {
+            organizationId: input.organizationId,
+            roleId: input.roleId,
+          },
+        },
+        select: { id: true, disabledAt: true },
+      });
+      if (role === null || role.disabledAt !== null) {
+        throw new Error(`active role not found in organization: ${input.roleId}`);
+      }
+      const skills = await tx.organizationAgentSkill.findMany({
+        where: {
+          organizationId: input.organizationId,
+          name: { in: [...input.skillNames] },
+          disabledAt: null,
+        },
+        select: { id: true, name: true },
+      });
+      if (skills.length !== input.skillNames.length) {
+        const found = new Set(skills.map((skill) => skill.name));
+        const missing = input.skillNames.filter((name) => !found.has(name));
+        throw new Error(`active skills not found in organization: ${missing.join(", ")}`);
+      }
+      const byName = new Map(skills.map((skill) => [skill.name, skill.id]));
+      await tx.organizationAgentRoleSkill.deleteMany({
+        where: { organizationId: input.organizationId, agentRoleId: role.id },
+      });
+      if (input.skillNames.length > 0) {
+        await tx.organizationAgentRoleSkill.createMany({
+          data: input.skillNames.map((name, index) => ({
+            organizationId: input.organizationId,
+            agentRoleId: role.id,
+            agentSkillId: byName.get(name)!,
+            sortOrder: index,
+          })),
+        });
+      }
+      await archiveRoleSessions(tx, input.organizationId, [input.roleId]);
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_role.skills_set",
+          metadata: { roleId: input.roleId, skillNames: [...input.skillNames] },
+        },
+      });
+    });
+  }
+
+  private async requireActiveOrganization(organizationId: string): Promise<void> {
+    const organization = await this.prisma.organization.findUnique({
+      where: { id: organizationId },
+      select: { status: true },
+    });
+    if (organization === null) throw new Error(`organization not found: ${organizationId}`);
+    if (organization.status !== "ACTIVE") {
+      throw new Error(`organization ${organizationId} is ${organization.status}`);
+    }
+  }
+}
+
+async function archiveRoleSessions(
+  tx: Prisma.TransactionClient,
+  organizationId: string,
+  roleIds: readonly string[],
+): Promise<void> {
+  if (roleIds.length === 0) return;
+  await tx.agentSession.updateMany({
+    where: {
+      roleId: { in: [...new Set(roleIds)] },
+      archivedAt: null,
+      project: { organizationId },
+    },
+    data: { archivedAt: new Date() },
+  });
+}
+
+function nonEmpty(value: string, label: string): string {
+  const normalized = value.trim();
+  if (normalized === "") throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function normalizeOptionalText(value: string | null | undefined): string | null {
+  if (value === undefined || value === null) return null;
+  const normalized = value.trim();
+  return normalized === "" ? null : normalized;
+}

hub/src/agent/models.ts

@@ -40,6 +40,14 @@ export interface RoleEntry {
    * Invalid names fail fast when settings are loaded or the run is set up.
    */
   readonly tools?: readonly string[] | undefined;
+  /** Immutable skill versions selected by this role at runtime. */
+  readonly skills?: readonly RoleSkillEntry[] | undefined;
+}
+
+export interface RoleSkillEntry {
+  readonly name: string;
+  readonly version: string;
+  readonly contentDigest: string;
 }
 
 /** A model the admin has enabled for use by the Hub. */

hub/src/agent/runner.ts

@@ -29,10 +29,11 @@
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
  * is the mechanism, the contract pins the invariant.
  */
-import { query, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
+import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage, type SDKSystemMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";
 import { claudeSdkToolConfigForRole } from "./roleTools.js";
 import { createAgentSecurityPolicy } from "./security.js";
+import type { RoleSkillEntry } from "./models.js";
 
 export interface ProjectContext {
   readonly projectId: string;
@@ -66,6 +67,7 @@ export interface RunRequest {
    * means no tools.
    */
   readonly tools?: readonly string[] | undefined;
+  readonly skills?: readonly RoleSkillEntry[] | undefined;
   readonly mcpServers?: Record<string, McpServerConfig> | undefined;
   readonly maxTurns?: number;
   readonly runId: string;
@@ -91,11 +93,29 @@ export interface RunResult {
   readonly costUsd?: number | undefined;
   readonly numTurns: number;
   readonly sdkSessionId?: string | undefined;
+  /** Skill ids reported by the SDK init event, not merely requested options. */
+  readonly initializedSkillIds?: readonly string[] | undefined;
   readonly error?: string;
 }
 
 const DEFAULT_MAX_TURNS = 25;
 
+const denyUnsandboxedBash: HookCallback = async (input) => {
+  if (input.hook_event_name !== "PreToolUse" || input.tool_name !== "Bash") return {};
+  const toolInput = input.tool_input;
+  if (
+    typeof toolInput !== "object" || toolInput === null ||
+    !("dangerouslyDisableSandbox" in toolInput) || toolInput.dangerouslyDisableSandbox !== true
+  ) return {};
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: "This deployment requires every Bash command to remain sandboxed.",
+    },
+  };
+};
+
 export async function runAgent(req: RunRequest): Promise<RunResult> {
   const onStream = req.onStream;
   const cap = req.maxTurns ?? DEFAULT_MAX_TURNS;
@@ -115,7 +135,9 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
   let costUsd: number | undefined;
   let numTurns = 0;
   let sdkSessionId: string | undefined;
+  let initializedSkillIds: readonly string[] | undefined;
   let error: string | undefined;
+  let cleanupSecurity = async (): Promise<void> => {};
   try {
     await persistAgentMessage(req, "user", req.prompt);
     const toolConfig = claudeSdkToolConfigForRole(req.tools);
@@ -124,15 +146,21 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       throw new Error("Agent run requires the configured workspace root");
     }
     const security = await createAgentSecurityPolicy({
+      runId: req.runId,
       workspaceRoot,
       workspaceDir: req.project.workspaceDir,
+      skills: req.skills,
       providerProxyEnv: req.providerProxyEnv,
     });
+    cleanupSecurity = security.cleanup;
+    const hasSkills = security.skillIds.length > 0;
 
     type QueryOptions = NonNullable<Parameters<typeof query>[0]["options"]>;
     const options: QueryOptions = {
       cwd: security.cwd,
-      tools: [...toolConfig.tools],
+      // `skills` controls discovery/allowlisting, but an explicit `tools`
+      // list still has to expose the Skill dispatcher itself.
+      tools: [...toolConfig.tools, ...(hasSkills ? ["Skill"] : [])],
       allowedTools: [...toolConfig.allowedTools],
       maxTurns: cap,
       includePartialMessages: true,
@@ -150,7 +178,18 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       // The project workspace is untrusted input. Do not load user/project
       // settings that could widen tools, hooks, MCP servers, or sandbox paths.
       settingSources: [],
+      settings: { disableBundledSkills: true },
+      ...(hasSkills && security.skillPluginRoot !== undefined
+        ? { plugins: [{ type: "local" as const, path: security.skillPluginRoot, skipMcpDiscovery: true }] }
+        : {}),
+      skills: [...security.skillIds],
       strictMcpConfig: true,
+      // Claude Code 2.1.202 can honor the per-call opt-out despite
+      // sandbox.allowUnsandboxedCommands=false. Enforce the invariant again at
+      // the PreToolUse boundary, before the Bash process can be spawned.
+      hooks: {
+        PreToolUse: [{ matcher: "Bash", hooks: [denyUnsandboxedBash] }],
+      },
     };
     if (req.systemPrompt !== undefined) options.systemPrompt = req.systemPrompt;
     if (req.model !== undefined) options.model = req.model;
@@ -169,6 +208,12 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
 
     for await (const message of conversation) {
       switch (message.type) {
+        case "system": {
+          if (message.subtype === "init") {
+            initializedSkillIds = [...(message as SDKSystemMessage).skills];
+          }
+          break;
+        }
         case "stream_event": {
           const evt = (message as SDKPartialAssistantMessage).event;
           if (evt.type === "content_block_delta" && evt.delta.type === "text_delta") {
@@ -265,6 +310,7 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       ...(costUsd !== undefined ? { costUsd } : {}),
       numTurns,
       sdkSessionId,
+      ...(initializedSkillIds !== undefined ? { initializedSkillIds } : {}),
       ...(error !== undefined ? { error } : {}),
     };
   } catch (e) {
@@ -276,8 +322,11 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       ...(costUsd !== undefined ? { costUsd } : {}),
       numTurns,
       sdkSessionId,
+      ...(initializedSkillIds !== undefined ? { initializedSkillIds } : {}),
       ...(aborted ? {} : { error: e instanceof Error ? e.message : String(e) }),
     };
+  } finally {
+    await cleanupSecurity();
   }
 }
 

hub/src/agent/security.ts

@@ -1,6 +1,8 @@
 import { chmod, lstat, mkdir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import type { RoleSkillEntry } from "./models.js";
+import { prepareRunSkillPlugin, readSkillStoreRoot } from "./skillStore.js";
 
 const PROVIDER_ENV_KEYS = new Set([
   "ANTHROPIC_BASE_URL",
@@ -26,9 +28,16 @@ const SANDBOX_HIDDEN_ENV_KEYS = [
   "ANTHROPIC_API_KEY",
 ] as const;
 
+// Linux sockaddr_un.sun_path is 108 bytes including the terminator. Claude's
+// sandbox appends its own user directory and randomized bridge socket names,
+// so keep our prefix well below that hard limit.
+const MAX_AGENT_TMP_PREFIX_BYTES = 56;
+
 export interface AgentSecurityInput {
+  readonly runId: string;
   readonly workspaceRoot: string;
   readonly workspaceDir: string;
+  readonly skills?: readonly RoleSkillEntry[] | undefined;
   /** Run-scoped loopback proxy capability; customer provider secrets are forbidden here. */
   readonly providerProxyEnv?: Readonly<Record<string, string | undefined>> | undefined;
   readonly hostEnv?: Readonly<Record<string, string | undefined>> | undefined;
@@ -55,6 +64,9 @@ export interface AgentSecurityPolicy {
   readonly cwd: string;
   readonly workspaceRoot: string;
   readonly env: Record<string, string | undefined>;
+  readonly skillIds: readonly string[];
+  readonly skillPluginRoot?: string | undefined;
+  cleanup(): Promise<void>;
   readonly sandbox: AgentSandboxPolicy;
 }
 
@@ -72,10 +84,8 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   const agentCache = await ensureDirectoryTree(runtimeRoot, ["cache"]);
   const agentConfig = await ensureDirectoryTree(runtimeRoot, ["config"]);
   const agentState = await ensureDirectoryTree(runtimeRoot, ["state"]);
-  // Keep the SDK temp root both short enough for Linux AF_UNIX sockets and
-  // physically inside the project boundary pinned by AgentFileOp.Authorized.
   const agentTmp = await ensureDirectoryTree(cphRoot, ["t"]);
-  const claudeCodeTmp = join(".cph", "t");
+  assertShortAgentTemp(agentTmp);
 
   const path = hostEnv["PATH"]?.trim();
   if (path === undefined || path === "") {
@@ -91,14 +101,13 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   env.XDG_CACHE_HOME = agentCache;
   env.XDG_CONFIG_HOME = agentConfig;
   env.XDG_STATE_HOME = agentState;
-  // General subprocess temp paths stay absolute so tools continue to work
-  // after `cd`. Only the SDK's socket prefix is relative: Claude resolves it
-  // from the canonical workspace cwd before Bash commands can change cwd.
+  // All four variables must use the short path. Claude's sandbox bridge uses
+  // the ordinary temp variables, while other SDK paths use CLAUDE_CODE_TMPDIR.
   env.TMPDIR = agentTmp;
   env.TMP = agentTmp;
   env.TEMP = agentTmp;
   env.CLAUDE_CONFIG_DIR = agentConfig;
-  env.CLAUDE_CODE_TMPDIR = claudeCodeTmp;
+  env.CLAUDE_CODE_TMPDIR = agentTmp;
   env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
   env.DISABLE_TELEMETRY = "1";
   env.DO_NOT_TRACK = "1";
@@ -113,10 +122,21 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
 
   const sensitiveReadPaths = hostSensitiveReadPaths(hostEnv);
   const runtimeReadPaths = hostRuntimeReadPaths(hostEnv);
+  const selectedSkills = input.skills ?? [];
+  const skillPlugin = selectedSkills.length === 0
+    ? null
+    : await prepareRunSkillPlugin({
+        storeRoot: readSkillStoreRoot(hostEnv),
+        runId: input.runId,
+        skills: selectedSkills,
+      });
   return {
     cwd: workspaceDir,
     workspaceRoot,
     env,
+    skillIds: skillPlugin?.skillIds ?? [],
+    ...(skillPlugin !== null ? { skillPluginRoot: skillPlugin.root } : {}),
+    cleanup: skillPlugin?.cleanup ?? (async () => {}),
     sandbox: {
       enabled: true,
       failIfUnavailable: true,
@@ -132,7 +152,7 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
         // workspace plus the named system runtime needed to execute tools.
         // SDK allowRead takes precedence over matching denyRead paths.
         denyRead: ["/"],
-        allowRead: [workspaceDir, ...runtimeReadPaths],
+        allowRead: [workspaceDir, ...(skillPlugin !== null ? [skillPlugin.root] : []), ...runtimeReadPaths],
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),
@@ -142,6 +162,15 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   };
 }
 
+function assertShortAgentTemp(agentTmp: string): void {
+  const prefixBytes = Buffer.byteLength(agentTmp);
+  if (prefixBytes > MAX_AGENT_TMP_PREFIX_BYTES) {
+    throw new Error(
+      `Agent temp path is too long for sandbox bridge sockets (${prefixBytes} > ${MAX_AGENT_TMP_PREFIX_BYTES} bytes): ${agentTmp}`,
+    );
+  }
+}
+
 function hostRuntimeReadPaths(env: Readonly<Record<string, string | undefined>>): string[] {
   const platformPaths = process.platform === "darwin"
     ? [
@@ -282,7 +311,7 @@ async function ensureDirectoryTree(root: string, components: readonly string[]):
   }
   const canonical = await realpath(current);
   if (canonical !== current || !isStrictDescendant(root, canonical)) {
-    throw new Error(`Agent runtime path escapes project workspace: ${current}`);
+    throw new Error(`Agent runtime path escapes its configured root: ${current}`);
   }
   await chmod(canonical, 0o700);
   return canonical;

hub/src/agent/skillStore.ts

@@ -0,0 +1,217 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  cp,
+  lstat,
+  mkdir,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import type { RoleSkillEntry } from "./models.js";
+
+const MAX_SKILL_FILES = 512;
+const MAX_SKILL_BYTES = 16 * 1024 * 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/;
+const RUNTIME_PLUGIN_NAME = "cph-runtime";
+
+export interface ImportedSkillContent {
+  readonly name: string;
+  readonly description: string | undefined;
+  readonly contentDigest: string;
+}
+
+export interface RunSkillPlugin {
+  readonly root: string;
+  readonly skillIds: readonly string[];
+  cleanup(): Promise<void>;
+}
+
+export async function importSkillDirectory(input: {
+  readonly sourceDir: string;
+  readonly storeRoot: string;
+}): Promise<ImportedSkillContent> {
+  const source = await inspectSkillDirectory(input.sourceDir);
+  const versionsRoot = join(input.storeRoot, "versions");
+  await mkdir(versionsRoot, { recursive: true, mode: 0o750 });
+  const destination = join(versionsRoot, source.contentDigest);
+
+  try {
+    const existing = await inspectSkillDirectory(destination);
+    if (existing.contentDigest !== source.contentDigest || existing.name !== source.name) {
+      throw new Error(`stored skill content digest mismatch: ${source.name}`);
+    }
+    return source;
+  } catch (error) {
+    if (!isMissingPath(error)) throw error;
+  }
+
+  const temporary = join(versionsRoot, `.tmp-${randomUUID()}`);
+  try {
+    await cp(input.sourceDir, temporary, { recursive: true, force: false, errorOnExist: true });
+    const copied = await inspectSkillDirectory(temporary);
+    if (copied.contentDigest !== source.contentDigest || copied.name !== source.name) {
+      throw new Error(`skill changed while importing: ${source.name}`);
+    }
+    await rename(temporary, destination);
+  } catch (error) {
+    await rm(temporary, { recursive: true, force: true });
+    if (isDestinationExists(error)) {
+      const existing = await inspectSkillDirectory(destination);
+      if (existing.contentDigest === source.contentDigest && existing.name === source.name) return source;
+    }
+    throw error;
+  }
+  return source;
+}
+
+export async function prepareRunSkillPlugin(input: {
+  readonly storeRoot: string;
+  readonly runId: string;
+  readonly skills: readonly RoleSkillEntry[];
+}): Promise<RunSkillPlugin | null> {
+  if (input.skills.length === 0) return null;
+  const names = new Set<string>();
+  for (const skill of input.skills) {
+    requireSkillName(skill.name);
+    if (!DIGEST_PATTERN.test(skill.contentDigest)) {
+      throw new Error(`skill ${skill.name} has invalid content digest`);
+    }
+    if (names.has(skill.name)) throw new Error(`duplicate role skill: ${skill.name}`);
+    names.add(skill.name);
+  }
+
+  const runtimeRoot = join(input.storeRoot, "runtime");
+  await mkdir(runtimeRoot, { recursive: true, mode: 0o750 });
+  const pluginRoot = join(runtimeRoot, `run-${randomUUID()}`);
+  try {
+    await mkdir(join(pluginRoot, ".claude-plugin"), { recursive: true, mode: 0o750 });
+    await mkdir(join(pluginRoot, "skills"), { recursive: true, mode: 0o750 });
+    await writeFile(
+      join(pluginRoot, ".claude-plugin", "plugin.json"),
+      `${JSON.stringify({
+        name: RUNTIME_PLUGIN_NAME,
+        description: `Runtime skill snapshot for ${input.runId}`,
+        version: "1",
+      }, null, 2)}\n`,
+      { mode: 0o640 },
+    );
+
+    for (const skill of input.skills) {
+      const sourceDir = join(input.storeRoot, "versions", skill.contentDigest);
+      const stored = await inspectSkillDirectory(sourceDir);
+      if (stored.contentDigest !== skill.contentDigest) {
+        throw new Error(`skill ${skill.name} content digest mismatch`);
+      }
+      if (stored.name !== skill.name) {
+        throw new Error(`skill name mismatch: expected ${skill.name}, got ${stored.name}`);
+      }
+      await cp(sourceDir, join(pluginRoot, "skills", skill.name), {
+        recursive: true,
+        force: false,
+        errorOnExist: true,
+      });
+    }
+  } catch (error) {
+    await rm(pluginRoot, { recursive: true, force: true });
+    throw error;
+  }
+
+  return {
+    root: pluginRoot,
+    skillIds: input.skills.map((skill) => `${RUNTIME_PLUGIN_NAME}:${skill.name}`),
+    async cleanup() {
+      await rm(pluginRoot, { recursive: true, force: true });
+    },
+  };
+}
+
+export function readSkillStoreRoot(env: Readonly<Record<string, string | undefined>> = process.env): string {
+  const configured = env["HUB_SKILL_STORE_ROOT"]?.trim();
+  if (configured !== undefined && configured !== "") return resolve(configured);
+  const stateRoot = env["XDG_STATE_HOME"]?.trim();
+  if (stateRoot === undefined || stateRoot === "") {
+    throw new Error("HUB_SKILL_STORE_ROOT or XDG_STATE_HOME is required");
+  }
+  return resolve(stateRoot, "skills");
+}
+
+export async function verifyStoredSkill(input: {
+  readonly storeRoot: string;
+  readonly name: string;
+  readonly contentDigest: string;
+}): Promise<void> {
+  requireSkillName(input.name);
+  if (!DIGEST_PATTERN.test(input.contentDigest)) {
+    throw new Error(`skill ${input.name} has invalid content digest`);
+  }
+  const stored = await inspectSkillDirectory(join(input.storeRoot, "versions", input.contentDigest));
+  if (stored.name !== input.name || stored.contentDigest !== input.contentDigest) {
+    throw new Error(`stored skill verification failed: ${input.name}`);
+  }
+}
+
+async function inspectSkillDirectory(directory: string): Promise<ImportedSkillContent> {
+  const root = resolve(directory);
+  const rootStat = await lstat(root);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(`skill root must be a real directory: ${root}`);
+  }
+  const files: Array<{ readonly path: string; readonly bytes: Buffer }> = [];
+  await walk(root, root, files);
+  if (files.length > MAX_SKILL_FILES) throw new Error(`skill has too many files: ${files.length}`);
+  const totalBytes = files.reduce((sum, file) => sum + file.bytes.byteLength, 0);
+  if (totalBytes > MAX_SKILL_BYTES) throw new Error(`skill is too large: ${totalBytes} bytes`);
+  const manifest = files.find((file) => file.path === "SKILL.md");
+  if (manifest === undefined) throw new Error(`skill manifest missing: ${join(root, "SKILL.md")}`);
+  const frontmatter = manifest.bytes.toString("utf8");
+  const name = /^name:\s*['"]?([^'"\r\n]+)['"]?\s*$/m.exec(frontmatter)?.[1]?.trim();
+  if (name === undefined) throw new Error("skill manifest name missing");
+  requireSkillName(name);
+  const description = /^description:\s*['"]?([^'"\r\n]+)['"]?\s*$/m.exec(frontmatter)?.[1]?.trim();
+
+  const hash = createHash("sha256");
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    hash.update(`${Buffer.byteLength(file.path)}:`);
+    hash.update(file.path);
+    hash.update(`${file.bytes.byteLength}:`);
+    hash.update(file.bytes);
+  }
+  return { name, description, contentDigest: hash.digest("hex") };
+}
+
+async function walk(
+  root: string,
+  directory: string,
+  files: Array<{ readonly path: string; readonly bytes: Buffer }>,
+): Promise<void> {
+  const entries = await readdir(directory, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = join(directory, entry.name);
+    if (entry.isSymbolicLink()) throw new Error(`skill symlink is forbidden: ${fullPath}`);
+    if (entry.isDirectory()) {
+      await walk(root, fullPath, files);
+      continue;
+    }
+    if (!entry.isFile()) throw new Error(`skill contains unsupported filesystem entry: ${fullPath}`);
+    const relativePath = relative(root, fullPath);
+    files.push({ path: relativePath, bytes: await readFile(fullPath) });
+    if (files.length > MAX_SKILL_FILES) throw new Error(`skill has too many files: ${files.length}`);
+  }
+}
+
+function requireSkillName(name: string): void {
+  if (!SKILL_NAME_PATTERN.test(name)) throw new Error(`invalid skill name: ${name}`);
+}
+
+function isMissingPath(error: unknown): boolean {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+
+function isDestinationExists(error: unknown): boolean {
+  return typeof error === "object" && error !== null && "code" in error &&
+    (error.code === "EEXIST" || error.code === "ENOTEMPTY");
+}

hub/src/deployment/agent-config-cli.ts

@@ -0,0 +1,157 @@
+import { readFile } from "node:fs/promises";
+import { prisma } from "../db.js";
+import { OrganizationAgentConfiguration } from "../agent/configuration.js";
+import { readSkillStoreRoot, verifyStoredSkill } from "../agent/skillStore.js";
+import { readSiloOrganizationId } from "./silo.js";
+
+async function main(argv: readonly string[]): Promise<void> {
+  const [command, ...args] = argv;
+  if (command === undefined || command === "help" || command === "--help") {
+    printHelp();
+    return;
+  }
+  const options = parseOptions(args);
+  const organizationId = required(options, "organization");
+  const siloOrganizationId = readSiloOrganizationId();
+  if (organizationId !== siloOrganizationId) {
+    throw new Error(`Silo Agent configuration is restricted to ${siloOrganizationId}`);
+  }
+  const configuration = new OrganizationAgentConfiguration(prisma, readSkillStoreRoot());
+
+  switch (command) {
+    case "install-skill": {
+      const installed = await configuration.installSkill({
+        organizationId,
+        sourceDir: required(options, "source"),
+        version: required(options, "version"),
+      });
+      console.log(JSON.stringify(installed));
+      return;
+    }
+    case "upsert-role": {
+      const systemPromptFile = options.get("system-prompt-file");
+      const toolsJson = options.get("tools-json");
+      const tools = toolsJson === undefined
+        ? undefined
+        : toolsJson === "null"
+          ? null
+          : parseTools(toolsJson);
+      const sortOrderRaw = options.get("sort-order");
+      const role = await configuration.upsertRole({
+        organizationId,
+        roleId: required(options, "role"),
+        label: required(options, "label"),
+        ...(options.has("model") ? { defaultModel: options.get("model") ?? null } : {}),
+        ...(systemPromptFile !== undefined
+          ? { systemPrompt: await readFile(systemPromptFile, "utf8") }
+          : {}),
+        ...(tools !== undefined ? { tools } : {}),
+        ...(sortOrderRaw !== undefined ? { sortOrder: integer(sortOrderRaw, "sort-order") } : {}),
+      });
+      console.log(JSON.stringify(role));
+      return;
+    }
+    case "set-role-skills": {
+      const skills = required(options, "skills").split(",").map((name) => name.trim()).filter(Boolean);
+      await configuration.setRoleSkills({
+        organizationId,
+        roleId: required(options, "role"),
+        skillNames: skills,
+      });
+      console.log(JSON.stringify({ roleId: required(options, "role"), skills }));
+      return;
+    }
+    case "list": {
+      const roles = await prisma.organizationAgentRole.findMany({
+        where: { organizationId },
+        orderBy: [{ sortOrder: "asc" }, { roleId: "asc" }],
+        include: {
+          skillBindings: {
+            orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+            include: { skill: { select: { name: true, version: true, disabledAt: true } } },
+          },
+        },
+      });
+      console.log(JSON.stringify(roles.map((role) => ({
+        roleId: role.roleId,
+        label: role.label,
+        defaultModel: role.defaultModel,
+        systemPromptConfigured: role.systemPrompt !== null,
+        tools: role.tools,
+        disabled: role.disabledAt !== null,
+        skills: role.skillBindings.map((binding) => ({
+          name: binding.skill.name,
+          version: binding.skill.version,
+          disabled: binding.skill.disabledAt !== null,
+        })),
+      })), null, 2));
+      return;
+    }
+    case "verify-store": {
+      const skills = await prisma.organizationAgentSkill.findMany({
+        where: { organizationId, disabledAt: null },
+        select: { name: true, contentDigest: true },
+      });
+      for (const skill of skills) {
+        await verifyStoredSkill({ storeRoot: readSkillStoreRoot(), ...skill });
+      }
+      console.log(JSON.stringify({ verifiedSkills: skills.length }));
+      return;
+    }
+    default:
+      throw new Error(`unknown Agent configuration command: ${command}`);
+  }
+}
+
+function parseOptions(args: readonly string[]): Map<string, string> {
+  const options = new Map<string, string>();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    const value = args[index + 1];
+    if (flag === undefined || !flag.startsWith("--") || value === undefined) {
+      throw new Error(`expected --name value, got: ${args.slice(index).join(" ")}`);
+    }
+    const name = flag.slice(2);
+    if (options.has(name)) throw new Error(`duplicate option: --${name}`);
+    options.set(name, value);
+  }
+  return options;
+}
+
+function required(options: ReadonlyMap<string, string>, name: string): string {
+  const value = options.get(name)?.trim();
+  if (value === undefined || value === "") throw new Error(`--${name} is required`);
+  return value;
+}
+
+function parseTools(raw: string): readonly string[] {
+  const parsed = JSON.parse(raw) as unknown;
+  if (!Array.isArray(parsed) || parsed.some((value) => typeof value !== "string")) {
+    throw new Error("--tools-json must be null or a JSON string array");
+  }
+  return parsed;
+}
+
+function integer(raw: string, name: string): number {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value)) throw new Error(`--${name} must be an integer`);
+  return value;
+}
+
+function printHelp(): void {
+  console.log(`Usage:
+  agent-config install-skill --organization ORG --source DIR --version VERSION
+  agent-config upsert-role --organization ORG --role ID --label LABEL [--model MODEL] [--system-prompt-file FILE] [--tools-json JSON] [--sort-order N]
+  agent-config set-role-skills --organization ORG --role ID --skills name,name
+  agent-config list --organization ORG
+  agent-config verify-store --organization ORG`);
+}
+
+main(process.argv.slice(2))
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });

hub/src/deployment/bootstrap-silo.ts

@@ -226,6 +226,22 @@ async function initializeSilo(
     const count = await tx.organization.count();
     if (count !== 0) throw new Error(`Silo bootstrap requires an empty Organization set; found ${count}`);
     await tx.organization.create({ data: { ...input.organization } });
+    await tx.organizationAgentRole.createMany({
+      data: [
+        {
+          organizationId: input.organization.id,
+          roleId: "draft",
+          label: "草稿",
+          sortOrder: 10,
+        },
+        {
+          organizationId: input.organization.id,
+          roleId: "review",
+          label: "审校",
+          sortOrder: 20,
+        },
+      ],
+    });
     await tx.organizationProjectSettings.create({
       data: { organizationId: input.organization.id, membersCanCreateProjects: true },
     });

hub/src/feishu/fileDelivery.ts

@@ -1,4 +1,4 @@
-import { extname, isAbsolute, join } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import {
   WorkspaceFileBoundaryError,
   readWorkspaceFileNoFollow,
@@ -10,39 +10,21 @@ export interface DeliverableFile {
   readonly data: Buffer;
 }
 
-const DELIVERABLE_EXTENSIONS = new Set([
-  ".csv",
-  ".doc",
-  ".docx",
-  ".gif",
-  ".jpeg",
-  ".jpg",
-  ".md",
-  ".pdf",
-  ".png",
-  ".ppt",
-  ".pptx",
-  ".svg",
-  ".txt",
-  ".typ",
-  ".xls",
-  ".xlsx",
-  ".zip",
-]);
+const DELIVERABLE_CPH_DIRECTORY = "inbox";
 
 export async function resolveDeliverableFile(
   requestedPath: string,
   workspaceRoot: string,
   workspaceDir: string,
+  maxBytes?: number,
 ): Promise<DeliverableFile | null> {
   const token = requestedPath.trim();
-  if (token === "" || !DELIVERABLE_EXTENSIONS.has(extname(token).toLowerCase())) {
-    return null;
-  }
+  if (token === "") return null;
 
   for (const candidate of candidatePaths(token)) {
+    assertNotPlatformRuntimePath(candidate, workspaceDir);
     try {
-      return await readWorkspaceFileNoFollow(workspaceRoot, workspaceDir, candidate);
+      return await readWorkspaceFileNoFollow(workspaceRoot, workspaceDir, candidate, maxBytes);
     } catch (error) {
       if (!(error instanceof WorkspaceFileBoundaryError) || error.reason !== "not_found") {
         throw error;
@@ -54,6 +36,20 @@ export async function resolveDeliverableFile(
   return null;
 }
 
+function assertNotPlatformRuntimePath(candidate: string, workspaceDir: string): void {
+  const workspace = resolve(workspaceDir);
+  const target = isAbsolute(candidate) ? resolve(candidate) : resolve(workspace, candidate);
+  const rel = relative(workspace, target);
+  const components = rel.split(sep);
+  if (components[0] === ".cph" && components[1] !== DELIVERABLE_CPH_DIRECTORY) {
+    throw new WorkspaceFileBoundaryError(
+      `platform runtime files cannot be delivered: ${candidate}`,
+      candidate,
+      "boundary",
+    );
+  }
+}
+
 function candidatePaths(token: string): string[] {
   if (isAbsolute(token)) return [token];
   const candidates = [token];

hub/src/feishu/fileDeliveryTool.ts

@@ -15,6 +15,7 @@ export interface FileDeliveryToolOptions {
   readonly runId: string;
   readonly workspaceRoot?: string | undefined;
   readonly workspaceDir: string;
+  readonly maxFileBytes?: number | undefined;
   readonly sendOptions?: SendMessageOptions | undefined;
   readonly approvalManager: ApprovalManager;
   readonly onDelivered?: (path: string) => void;
@@ -29,7 +30,7 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
     tools.push(
       tool(
         "send_file",
-        "Upload an existing file from the current project workspace to the current Feishu chat. The path must point to a concrete no-symlink file, for example build/student.pdf or README.md.",
+        "Upload any existing regular file from the current project workspace to the current Feishu chat. The path must point to a concrete no-symlink file and must not be inside platform runtime directories.",
         {
           path: z.string().describe("Workspace-relative path, or an absolute path physically inside the current workspace."),
           name: z.string().optional().describe("Optional display filename. Defaults to the file's basename."),
@@ -46,12 +47,18 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
               content: [{ type: "text", text: "File delivery is unavailable because workspace isolation is not configured." }],
             };
           }
+          if (options.maxFileBytes === undefined) {
+            throw new Error("Agent file delivery requires a configured maximum file size");
+          }
           let file;
           try {
-            file = await resolveDeliverableFile(args.path, workspaceRoot, options.workspaceDir);
+            file = await resolveDeliverableFile(args.path, workspaceRoot, options.workspaceDir, options.maxFileBytes);
           } catch (error) {
             const boundaryViolation = error instanceof WorkspaceFileBoundaryError && error.reason === "boundary";
-            const log = boundaryViolation ? options.rt.logger.warn.bind(options.rt.logger) : options.rt.logger.error.bind(options.rt.logger);
+            const limitViolation = error instanceof WorkspaceFileBoundaryError && error.reason === "limit";
+            const log = boundaryViolation || limitViolation
+              ? options.rt.logger.warn.bind(options.rt.logger)
+              : options.rt.logger.error.bind(options.rt.logger);
             log(
               {
                 runId: options.runId,
@@ -61,12 +68,20 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
               },
               boundaryViolation
                 ? "Agent file delivery refused by workspace boundary"
-                : "Agent file delivery failed during workspace file access",
+                : limitViolation
+                  ? "Agent file delivery refused by file size limit"
+                  : "Agent file delivery failed during workspace file access",
             );
+            if (limitViolation) {
+              return {
+                isError: true,
+                content: [{ type: "text", text: `File exceeds the configured delivery limit: ${args.path}` }],
+              };
+            }
             if (!boundaryViolation) throw error;
             return {
               isError: true,
-              content: [{ type: "text", text: "File path is outside the current workspace or uses a symlink." }],
+              content: [{ type: "text", text: "File path is outside the current workspace, belongs to platform runtime, or uses a symlink." }],
             };
           }
           if (file === null) {

hub/src/feishu/slashCommands.ts

@@ -391,10 +391,20 @@ function formatRoleSlashCommandHelp(role: RoleEntry): string {
   if (role.defaultModel !== undefined) {
     lines.push(`- 默认模型: ${role.defaultModel}`);
   }
-  lines.push(`- 工具范围: ${roleToolsDescription(role)}`, "", `帮助: /help ${role.id} 或 /${role.id} help`);
+  lines.push(
+    `- 工具范围: ${roleToolsDescription(role)}`,
+    `- Skills: ${roleSkillsDescription(role)}`,
+    "",
+    `帮助: /help ${role.id} 或 /${role.id} help`,
+  );
   return lines.join("\n");
 }
 
+function roleSkillsDescription(role: RoleEntry): string {
+  if (role.skills === undefined || role.skills.length === 0) return "无";
+  return role.skills.map((skill) => `${skill.name}@${skill.version}`).join(", ");
+}
+
 function roleToolsDescription(role: RoleEntry): string {
   if (role.tools === undefined) return "全部已注册工具";
   if (role.tools.length === 0) return "无";

hub/src/feishu/trigger.ts

@@ -85,6 +85,10 @@ interface TriggerDeps {
   readonly messageBatcherOptions?: MessageBatcherOptions | undefined;
   readonly triggerQueue?: TriggerQueue | undefined;
   readonly projectWorkspaceRoot: string;
+  /** Public origin used to build the Silo Organization's Feishu OAuth entrypoint. */
+  readonly publicBaseUrl: string;
+  /** The single Organization this Alpha Silo is fail-closed to serve. */
+  readonly siloOrganizationId: string;
   /** Alpha Silo policy: never acknowledge work into the process-local queue. */
   readonly rejectWhenBusy?: boolean | undefined;
   readonly resourceLimits?: {
@@ -133,6 +137,9 @@ export interface TriggerHandler {
 export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
   const projectWorkspaceRoot = deps.projectWorkspaceRoot.trim();
   if (projectWorkspaceRoot === "") throw new Error("projectWorkspaceRoot is required");
+  const publicBaseUrl = parsePublicBaseUrl(deps.publicBaseUrl);
+  const siloOrganizationId = deps.siloOrganizationId.trim();
+  if (siloOrganizationId === "") throw new Error("siloOrganizationId is required");
   const authorizer = deps.authorizer ?? createPermissionAuthorizer(deps.prisma);
   const runAgent = deps.runAgent ?? defaultRunAgent;
   const approvalManager = new ApprovalManager();
@@ -405,6 +412,11 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       metadata: {
         roleId,
         model,
+        requestedSkills: (role?.skills ?? []).map((skill) => ({
+          name: skill.name,
+          version: skill.version,
+          contentDigest: skill.contentDigest,
+        })),
         prompt: agentPrompt.slice(0, 200),
         sender: senderMetadata,
         feishuTriggerContext,
@@ -444,6 +456,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       runId: run.id,
       workspaceRoot: projectWorkspaceRoot,
       workspaceDir: project.workspaceDir,
+      maxFileBytes: deps.resourceLimits?.maxBytesPerFile,
       sendOptions,
       approvalManager,
       tools: cphHubMcpToolsForRole(roleTools),
@@ -479,6 +492,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
           providerProxyEnv: { ...providerLease.sdkEnv },
           resumeSessionId: sessionMetadata.claudeSessionId,
           tools: roleTools,
+          skills: role?.skills,
           mcpServers: { cph_hub: fileDeliveryMcpServer },
           maxTurns: runPolicy.maxTurns,
           runId: run.id,
@@ -567,7 +581,11 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
           runId: run.id,
           projectId,
           action: "run.finished",
-          metadata: { status: result.status, deliveredFiles },
+          metadata: {
+            status: result.status,
+            deliveredFiles,
+            initializedSkills: [...(result.initializedSkillIds ?? [])],
+          },
         });
         await removeProcessingReaction();
       })
@@ -925,6 +943,15 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       await sendText(rt, chatId, "无法识别发送者,拒绝触发。", sendOptionsForTriggerMessage(msg));
       return;
     }
+    const organizationResolution = await resolveSingleActiveOrganizationForFeishuUser(senderOpenId);
+    if (organizationResolution.status === "error" && organizationResolution.reason !== "organization_unavailable") {
+      deps.logger.info(
+        { projectId, senderOpenId, reason: organizationResolution.reason },
+        "feishu trigger: actor onboarding required before project authorization",
+      );
+      await sendText(rt, chatId, organizationResolution.message, sendOptionsForTriggerMessage(msg));
+      return;
+    }
     const actor = { feishuOpenId: senderOpenId, chatId };
     const triggerDecision = await authorizer.can({
       actor,
@@ -1072,17 +1099,33 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         readonly organizationName: string;
         readonly role: "OWNER" | "ADMIN" | "MEMBER";
       }
-    | { readonly status: "error"; readonly message: string }
+    | {
+        readonly status: "error";
+        readonly reason: "identity_missing" | "membership_missing" | "organization_unavailable";
+        readonly message: string;
+      }
   > {
+    const siloOrganization = await deps.prisma.organization.findFirst({
+      where: { id: siloOrganizationId, status: "ACTIVE" },
+      select: { id: true, slug: true },
+    });
+    if (siloOrganization === null) {
+      return {
+        status: "error",
+        reason: "organization_unavailable",
+        message: "组织当前不可用，请联系 Educraft 运维人员。",
+      };
+    }
     const identity = await deps.prisma.feishuUserIdentity.findFirst({
       where: {
         openId: feishuOpenId,
-        connection: { status: "ACTIVE", organization: { status: "ACTIVE" } },
+        connection: { status: "ACTIVE", organizationId: siloOrganization.id },
       },
       select: {
         user: { select: { organizationMemberships: {
           where: {
             revokedAt: null,
+            organizationId: siloOrganization.id,
             organization: { status: "ACTIVE" },
           },
           select: {
@@ -1098,19 +1141,34 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       where: { feishuOpenId },
       select: {
         organizationMemberships: {
-          where: { revokedAt: null, organization: { status: "ACTIVE" } },
+          where: {
+            revokedAt: null,
+            organizationId: siloOrganization.id,
+            organization: { status: "ACTIVE" },
+          },
           select: { role: true, organization: { select: { id: true, name: true } } },
           orderBy: { createdAt: "asc" },
         },
       },
       })
       : null);
-    if (user === null) return { status: "error", message: "请先登录并加入组织后，再绑定项目。" };
-    if (user.organizationMemberships.length === 0) {
-      return { status: "error", message: "你还不属于任何可用组织，请联系组织管理员。" };
+    if (user === null) {
+      const loginUrl = new URL(
+        `/auth/feishu/${encodeURIComponent(siloOrganization.slug)}`,
+        publicBaseUrl,
+      ).toString();
+      return {
+        status: "error",
+        reason: "identity_missing",
+        message: `请先通过飞书登录并加入组织：${loginUrl}\n完成后返回群聊重试。`,
+      };
     }
-    if (user.organizationMemberships.length > 1) {
-      return { status: "error", message: "你属于多个组织。请先从组织后台选择项目绑定，或等待多组织选择入口。" };
+    if (user.organizationMemberships.length === 0) {
+      return {
+        status: "error",
+        reason: "membership_missing",
+        message: "你尚未加入该组织，或成员资格已被移除。请联系组织管理员。",
+      };
     }
     const membership = user.organizationMemberships[0]!;
     return {
@@ -1173,6 +1231,19 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
   return Object.assign(onMessage, { onCardAction, approvalManager });
 }
 
+function parsePublicBaseUrl(raw: string): URL {
+  const value = raw.trim();
+  if (value === "") throw new Error("publicBaseUrl is required");
+  const url = new URL(value);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("publicBaseUrl must use http or https");
+  }
+  if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.pathname !== "/") {
+    throw new Error("publicBaseUrl must be an origin without credentials, path, query, or fragment");
+  }
+  return url;
+}
+
 interface SessionMetadata {
   readonly claudeSessionId?: string | undefined;
 }

hub/src/hub.ts

@@ -160,6 +160,8 @@ export async function startHub(): Promise<void> {
       settings: runtimeSettings,
       logger: app.log,
       projectWorkspaceRoot,
+      publicBaseUrl,
+      siloOrganizationId: siloOrganization.id,
       rejectWhenBusy: true,
       resourceLimits: { maxFilesPerMessage, maxBytesPerFile },
       allowLegacyFeishuIdentity: false,

hub/src/projectOnboarding.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { mkdir, rm } from "node:fs/promises";
 import { dirname, relative, resolve } from "node:path";
 import type { Folder, OrganizationMemberRole, PermissionRole, Prisma, PrismaClient } from "@prisma/client";
@@ -595,7 +595,11 @@ function projectWorkspaceDir(input: {
   readonly projectId: string;
 }): string {
   const root = resolve(requireNonEmpty(input.workspaceRoot, "workspace root"));
-  const dir = resolve(root, safePathSegment(input.organizationSlug, "organization slug"), safePathSegment(input.projectId, "project id"));
+  const dir = resolve(
+    root,
+    compactWorkspaceSegment("o", input.organizationSlug, "organization slug"),
+    compactWorkspaceSegment("p", input.projectId, "project id"),
+  );
   const rel = relative(root, dir);
   if (rel === "" || rel.startsWith("..")) {
     throw new Error(`allocated workspace escapes root: ${dir}`);
@@ -603,6 +607,12 @@ function projectWorkspaceDir(input: {
   return dir;
 }
 
+function compactWorkspaceSegment(prefix: "o" | "p", value: string, label: string): string {
+  const normalized = safePathSegment(value, label);
+  const digest = createHash("sha256").update(normalized).digest("base64url").slice(0, 16);
+  return `${prefix}_${digest}`;
+}
+
 function safePathSegment(value: string, label: string): string {
   const segment = requireNonEmpty(value, label).replace(/[^A-Za-z0-9._-]+/g, "_");
   if (segment === "." || segment === ".." || segment === "") {

hub/src/security/workspaceFiles.ts

@@ -37,6 +37,7 @@ export async function readWorkspaceFileNoFollow(
   workspaceRoot: string,
   workspaceDir: string,
   requestedPath: string,
+  maxBytes?: number,
 ): Promise<WorkspaceFileSnapshot> {
   const workspace = await canonicalWorkspace(workspaceRoot, workspaceDir);
   const components = fileComponents(workspace, requestedPath);
@@ -53,8 +54,15 @@ export async function readWorkspaceFileNoFollow(
     if (!metadata.isFile()) {
       throw new WorkspaceFileBoundaryError(`deliverable is not a regular file: ${requestedPath}`, requestedPath);
     }
+    if (maxBytes !== undefined && metadata.size > maxBytes) {
+      throw new WorkspaceFileBoundaryError(
+        `workspace file exceeds ${maxBytes} bytes: ${requestedPath}`,
+        requestedPath,
+        "limit",
+      );
+    }
     await assertNameStillReferences(parent, name, metadata.dev, metadata.ino, requestedPath);
-    const data = await file.readFile();
+    const data = await readFileSnapshot(file, maxBytes, requestedPath);
     result = { path: join(workspace, ...components), name, data };
   } catch (error) {
     failure = boundaryError(error, requestedPath, "cannot read workspace file without following symlinks");
@@ -67,6 +75,33 @@ export async function readWorkspaceFileNoFollow(
   return result!;
 }
 
+async function readFileSnapshot(
+  file: FileHandle,
+  maxBytes: number | undefined,
+  requestedPath: string,
+): Promise<Buffer> {
+  if (maxBytes === undefined) return file.readFile();
+  const chunks: Buffer[] = [];
+  let total = 0;
+  let position = 0;
+  while (true) {
+    const remainingWithSentinel = maxBytes - total + 1;
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remainingWithSentinel));
+    const { bytesRead } = await file.read(chunk, 0, chunk.length, position);
+    if (bytesRead === 0) return Buffer.concat(chunks, total);
+    total += bytesRead;
+    if (total > maxBytes) {
+      throw new WorkspaceFileBoundaryError(
+        `workspace file exceeds ${maxBytes} bytes: ${requestedPath}`,
+        requestedPath,
+        "limit",
+      );
+    }
+    chunks.push(chunk.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+}
+
 /**
  * Create one inbound file exclusively below the workspace and stream into its
  * already-open descriptor. Linux uses /proc/self/fd-relative traversal so a

hub/src/settings/runtime.ts

@@ -1,5 +1,5 @@
 import type { Prisma, PrismaClient } from "@prisma/client";
-import { InMemoryModelRegistry, type ModelRegistry } from "../agent/models.js";
+import { InMemoryModelRegistry, type ModelRegistry, type RoleEntry, type RoleSkillEntry } from "../agent/models.js";
 import { lockActiveOrganization } from "../org/status.js";
 import { decryptStoredProviderCredential } from "../connections/providerConnections.js";
 import { openProviderProxyLease, type AgentProviderLease, type ProviderUpstreamCredential } from "../connections/providerProxy.js";
@@ -141,8 +141,75 @@ export class DatabaseRuntimeSettings implements RuntimeSettings {
     };
   }
 
-  modelRegistry(scope?: RuntimeScope): Promise<ModelRegistry> {
-    return this.envSettings.modelRegistry(scope);
+  async modelRegistry(scope?: RuntimeScope): Promise<ModelRegistry> {
+    const projectId = scope?.projectId?.trim();
+    if (projectId === undefined || projectId === "") {
+      throw new Error("projectId is required to resolve Agent runtime configuration");
+    }
+    const project = await this.prisma.project.findUnique({
+      where: { id: projectId },
+      select: {
+        archivedAt: true,
+        organization: {
+          select: {
+            id: true,
+            status: true,
+            agentRoles: {
+              where: { disabledAt: null },
+              orderBy: [{ sortOrder: "asc" }, { roleId: "asc" }],
+              include: {
+                skillBindings: {
+                  orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+                  include: { skill: true },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    if (project === null || project.archivedAt !== null) {
+      throw new Error(`active project not found: ${projectId}`);
+    }
+    if (project.organization.status !== "ACTIVE") {
+      throw new Error(`organization ${project.organization.id} is ${project.organization.status}`);
+    }
+    if (project.organization.agentRoles.length === 0) {
+      throw new Error(`no active Agent roles configured for organization ${project.organization.id}`);
+    }
+
+    const defaults = await this.envSettings.modelRegistry(scope);
+    const enabledModels = new Set(defaults.listModels().map((model) => model.id));
+    const roles: RoleEntry[] = project.organization.agentRoles.map((role) => ({
+      id: role.roleId,
+      label: role.label,
+      defaultModel: validateRoleModel(role.roleId, role.defaultModel, enabledModels),
+      ...(role.systemPrompt !== null ? { systemPrompt: role.systemPrompt } : {}),
+      ...(role.tools !== null ? { tools: roleToolsFromJson(role.roleId, role.tools) } : {}),
+      skills: role.skillBindings.map((binding): RoleSkillEntry => {
+        if (binding.skill.disabledAt !== null) {
+          throw new Error(`role ${role.roleId} selects disabled skill ${binding.skill.name}`);
+        }
+        if (!/^[a-f0-9]{64}$/.test(binding.skill.contentDigest)) {
+          throw new Error(`skill ${binding.skill.name} has invalid content digest`);
+        }
+        if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(binding.skill.name)) {
+          throw new Error(`skill has invalid name: ${binding.skill.name}`);
+        }
+        if (binding.skill.version.trim() === "") {
+          throw new Error(`skill ${binding.skill.name} has empty version`);
+        }
+        return {
+          name: binding.skill.name,
+          version: binding.skill.version,
+          contentDigest: binding.skill.contentDigest,
+        };
+      }),
+    }));
+    if (!roles.some((role) => role.id === "draft")) {
+      throw new Error(`default Agent role draft is not configured for organization ${project.organization.id}`);
+    }
+    return new InMemoryModelRegistry(defaults.listModels(), roles);
   }
 
   runPolicy(input: RunPolicyInput): Promise<RunPolicy> {
@@ -150,6 +217,23 @@ export class DatabaseRuntimeSettings implements RuntimeSettings {
   }
 }
 
+function roleToolsFromJson(roleId: string, value: Prisma.JsonValue): readonly string[] {
+  if (!Array.isArray(value) || value.some((tool) => typeof tool !== "string")) {
+    throw new Error(`role ${roleId} tools must be a JSON string array`);
+  }
+  return value as string[];
+}
+
+function validateRoleModel(
+  roleId: string,
+  model: string | null,
+  enabledModels: ReadonlySet<string>,
+): string | undefined {
+  if (model === null) return undefined;
+  if (!enabledModels.has(model)) throw new Error(`role ${roleId} selects unavailable model ${model}`);
+  return model;
+}
+
 async function loadActiveProviderSecret(
   tx: Prisma.TransactionClient,
   projectId: string,

hub/test/integration/admin-auth.test.ts

@@ -267,9 +267,6 @@ describe("admin auth + org API guards", () => {
       openId: "ou_scoped_user",
       displayName: "Invited User",
     });
-    await prisma.organizationMembership.create({
-      data: { organizationId: DEFAULT_ORG_ID, userId: identity.userId, role: "ADMIN" },
-    });
     await seedTestOrganization("org_scoped_other", "scoped-other");
     await prisma.organizationMembership.create({
       data: { organizationId: "org_scoped_other", userId: identity.userId, role: "ADMIN" },
@@ -317,7 +314,7 @@ describe("admin auth + org API guards", () => {
       expect(me.statusCode).toBe(200);
       expect(me.json()).toMatchObject({
         user: { id: identity.userId, displayName: "Scoped User" },
-        organizations: [expect.objectContaining({ slug: "test-default", role: "ADMIN" })],
+        organizations: [expect.objectContaining({ slug: "test-default", role: "MEMBER" })],
       });
       expect((me.json() as { organizations: unknown[] }).organizations).toHaveLength(1);
       const crossOrganization = await app.inject({
@@ -331,6 +328,13 @@ describe("admin auth + org API guards", () => {
         where: { id: identity.identityId },
         select: { unionId: true },
       })).resolves.toEqual({ unionId: "on_scoped_union" });
+      await expect(prisma.auditEntry.count({
+        where: {
+          organizationId: DEFAULT_ORG_ID,
+          actorUserId: identity.userId,
+          action: "organization_member.oauth_auto_joined",
+        },
+      })).resolves.toBe(1);
 
       await connections.disable({ organizationId: DEFAULT_ORG_ID, actorUserId: "scoped-owner" });
       const revoked = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });
@@ -340,6 +344,65 @@ describe("admin auth + org API guards", () => {
     }
   });
 
+  it("does not restore a revoked Organization membership during scoped OAuth", async () => {
+    await seedUser("revoked-owner", "legacy_revoked_owner", "OWNER");
+    const connections = new FeishuApplicationConnectionService(prisma, testSecretEnvelope, async () => {});
+    const connection = await connections.rotateCustomerApplication({
+      organizationId: DEFAULT_ORG_ID,
+      actorUserId: "revoked-owner",
+      appId: "cli_revoked_oauth",
+      appSecret: "revoked-oauth-secret",
+      botOpenId: "ou_revoked_bot",
+    });
+    const identity = await upsertScopedFeishuIdentity(prisma, {
+      connectionId: connection.id,
+      openId: "ou_revoked_user",
+      displayName: "Revoked User",
+    });
+    await prisma.organizationMembership.create({
+      data: {
+        organizationId: DEFAULT_ORG_ID,
+        userId: identity.userId,
+        role: "MEMBER",
+        revokedAt: new Date(),
+      },
+    });
+    const fetchImpl = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("/oauth/token")) {
+        return Response.json({ code: 0, access_token: "revoked-user-token" });
+      }
+      if (url.includes("/user_info")) {
+        return Response.json({
+          code: 0,
+          data: { open_id: "ou_revoked_user", name: "Revoked User" },
+        });
+      }
+      throw new Error(`unexpected ${url}`);
+    });
+    const app = await buildApp(fetchImpl as unknown as typeof fetch);
+    try {
+      const start = await app.inject({ method: "GET", url: "/auth/feishu/test-default" });
+      const authorize = new URL(String(start.headers.location));
+      const state = authorize.searchParams.get("state");
+      expect(state).not.toBeNull();
+      const callback = await app.inject({
+        method: "GET",
+        url: `/auth/feishu/callback?code=ok&state=${encodeURIComponent(state!)}`,
+        headers: { cookie: cookiePair(start.headers["set-cookie"], OAUTH_STATE_COOKIE_NAME) },
+      });
+      expect(callback.statusCode).toBe(302);
+      await expect(prisma.organizationMembership.count({
+        where: { organizationId: DEFAULT_ORG_ID, userId: identity.userId, revokedAt: null },
+      })).resolves.toBe(0);
+      await expect(prisma.auditEntry.count({
+        where: { action: "organization_member.oauth_auto_joined", actorUserId: identity.userId },
+      })).resolves.toBe(0);
+    } finally {
+      await app.close();
+    }
+  });
+
   it("unknown org slug returns 404 for admin", async () => {
     await seedUser("u-admin", "ou_admin", "ADMIN");
     const app = await buildApp();

hub/test/integration/agent-configuration.test.ts

@@ -0,0 +1,90 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { OrganizationAgentConfiguration } from "../../src/agent/configuration.js";
+import { DEFAULT_ORG_ID, prisma, resetDb, seedTestOrganization } from "./helpers.js";
+
+describe("Organization Agent configuration management", () => {
+  let root: string;
+  let configuration: OrganizationAgentConfiguration;
+
+  beforeEach(async () => {
+    await resetDb();
+    root = await mkdtemp(join(tmpdir(), "cph-agent-config-"));
+    configuration = new OrganizationAgentConfiguration(prisma, join(root, "store"));
+  });
+
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("installs versioned skills and selects them as part of a dynamic role bundle", async () => {
+    const typst = await makeSkill(root, "typst");
+    const outline = await makeSkill(root, "outline");
+    await configuration.installSkill({ organizationId: DEFAULT_ORG_ID, sourceDir: typst, version: "0.15.0" });
+    await configuration.installSkill({ organizationId: DEFAULT_ORG_ID, sourceDir: outline, version: "1" });
+    await configuration.upsertRole({
+      organizationId: DEFAULT_ORG_ID,
+      roleId: "draft",
+      label: "课程草稿",
+      defaultModel: "anthropic/claude-sonnet-5",
+      systemPrompt: "write carefully",
+      tools: ["read_file", "write_file", "cph_build"],
+      sortOrder: 10,
+    });
+    await prisma.project.create({
+      data: { id: "project-a", organizationId: DEFAULT_ORG_ID, name: "A", workspaceDir: "/tmp/a" },
+    });
+    await prisma.agentSession.create({
+      data: {
+        id: "session-old-role-config",
+        projectId: "project-a",
+        provider: "openrouter",
+        roleId: "draft",
+        model: "anthropic/claude-sonnet-5",
+        metadata: {},
+      },
+    });
+    await configuration.setRoleSkills({
+      organizationId: DEFAULT_ORG_ID,
+      roleId: "draft",
+      skillNames: ["outline", "typst"],
+    });
+
+    const role = await prisma.organizationAgentRole.findUniqueOrThrow({
+      where: { organizationId_roleId: { organizationId: DEFAULT_ORG_ID, roleId: "draft" } },
+      include: { skillBindings: { orderBy: { sortOrder: "asc" }, include: { skill: true } } },
+    });
+    expect(role).toMatchObject({ label: "课程草稿", systemPrompt: "write carefully" });
+    expect(role.tools).toEqual(["read_file", "write_file", "cph_build"]);
+    expect(role.skillBindings.map((binding) => binding.skill.name)).toEqual(["outline", "typst"]);
+    await expect(prisma.agentSession.findUniqueOrThrow({ where: { id: "session-old-role-config" } }))
+      .resolves.toMatchObject({ archivedAt: expect.any(Date) });
+  });
+
+  it("rejects unknown, disabled and cross-Organization skills", async () => {
+    await seedTestOrganization("org_other", "other");
+    const typst = await makeSkill(root, "typst");
+    await configuration.installSkill({ organizationId: "org_other", sourceDir: typst, version: "1" });
+    await configuration.upsertRole({
+      organizationId: DEFAULT_ORG_ID,
+      roleId: "draft",
+      label: "Draft",
+      tools: [],
+    });
+
+    await expect(configuration.setRoleSkills({
+      organizationId: DEFAULT_ORG_ID,
+      roleId: "draft",
+      skillNames: ["typst"],
+    })).rejects.toThrow("active skills not found in organization");
+  });
+
+  async function makeSkill(parent: string, name: string): Promise<string> {
+    const source = join(parent, "sources", name);
+    await mkdir(source, { recursive: true });
+    await writeFile(join(source, "SKILL.md"), `---\nname: ${name}\ndescription: ${name} skill\n---\n# ${name}\n`);
+    return source;
+  }
+});

hub/test/integration/agent-runtime-config.test.ts

@@ -0,0 +1,121 @@
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { DatabaseRuntimeSettings } from "../../src/settings/runtime.js";
+import { DEFAULT_ORG_ID, prisma, resetDb, seedTestOrganization, testSecretEnvelope } from "./helpers.js";
+
+describe("Organization-scoped Agent runtime configuration", () => {
+  beforeEach(async () => {
+    await resetDb();
+  });
+
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("resolves role prompt, model, tools and skills from the project Organization", async () => {
+    await seedTestOrganization("org_other", "other");
+    await Promise.all([
+      prisma.project.create({
+        data: { id: "project-a", organizationId: DEFAULT_ORG_ID, name: "A", workspaceDir: "/tmp/a" },
+      }),
+      prisma.project.create({
+        data: { id: "project-b", organizationId: "org_other", name: "B", workspaceDir: "/tmp/b" },
+      }),
+    ]);
+    const [skillA, skillB] = await Promise.all([
+      prisma.organizationAgentSkill.create({
+        data: {
+          id: "skill-a",
+          organizationId: DEFAULT_ORG_ID,
+          name: "typst",
+          version: "0.15.0",
+          contentDigest: "a".repeat(64),
+        },
+      }),
+      prisma.organizationAgentSkill.create({
+        data: {
+          id: "skill-b",
+          organizationId: "org_other",
+          name: "typst",
+          version: "other",
+          contentDigest: "b".repeat(64),
+        },
+      }),
+    ]);
+    const [roleA, roleB] = await Promise.all([
+      prisma.organizationAgentRole.create({
+        data: {
+          id: "role-a",
+          organizationId: DEFAULT_ORG_ID,
+          roleId: "draft",
+          label: "A Draft",
+          defaultModel: "anthropic/claude-sonnet-5",
+          systemPrompt: "prompt-a",
+          tools: ["read_file", "cph_build"],
+        },
+      }),
+      prisma.organizationAgentRole.create({
+        data: {
+          id: "role-b",
+          organizationId: "org_other",
+          roleId: "draft",
+          label: "B Draft",
+          systemPrompt: "prompt-b",
+          tools: [],
+        },
+      }),
+    ]);
+    await Promise.all([
+      prisma.organizationAgentRoleSkill.create({
+        data: { organizationId: DEFAULT_ORG_ID, agentRoleId: roleA.id, agentSkillId: skillA.id },
+      }),
+      prisma.organizationAgentRoleSkill.create({
+        data: { organizationId: "org_other", agentRoleId: roleB.id, agentSkillId: skillB.id },
+      }),
+    ]);
+    const settings = new DatabaseRuntimeSettings(prisma, testSecretEnvelope, {});
+
+    const registryA = await settings.modelRegistry({ projectId: "project-a" });
+    const registryB = await settings.modelRegistry({ projectId: "project-b" });
+
+    expect(registryA.role("draft")).toMatchObject({
+      label: "A Draft",
+      systemPrompt: "prompt-a",
+      tools: ["read_file", "cph_build"],
+      skills: [{ name: "typst", version: "0.15.0", contentDigest: "a".repeat(64) }],
+    });
+    expect(registryB.role("draft")).toMatchObject({
+      label: "B Draft",
+      systemPrompt: "prompt-b",
+      tools: [],
+      skills: [{ name: "typst", version: "other", contentDigest: "b".repeat(64) }],
+    });
+  });
+
+  it("fails closed for missing scope and disabled role skills", async () => {
+    await prisma.project.create({
+      data: { id: "project-a", organizationId: DEFAULT_ORG_ID, name: "A", workspaceDir: "/tmp/a" },
+    });
+    const skill = await prisma.organizationAgentSkill.create({
+      data: {
+        id: "skill-disabled",
+        organizationId: DEFAULT_ORG_ID,
+        name: "typst",
+        version: "0.15.0",
+        contentDigest: "c".repeat(64),
+        disabledAt: new Date(),
+      },
+    });
+    const role = await prisma.organizationAgentRole.create({
+      data: { id: "role-a", organizationId: DEFAULT_ORG_ID, roleId: "draft", label: "Draft" },
+    });
+    await prisma.organizationAgentRoleSkill.create({
+      data: { organizationId: DEFAULT_ORG_ID, agentRoleId: role.id, agentSkillId: skill.id },
+    });
+    const settings = new DatabaseRuntimeSettings(prisma, testSecretEnvelope, {});
+
+    await expect(settings.modelRegistry()).rejects.toThrow("projectId is required");
+    await expect(settings.modelRegistry({ projectId: "project-a" })).rejects.toThrow(
+      "role draft selects disabled skill typst",
+    );
+  });
+});

hub/test/integration/agent-sandbox-linux.test.ts

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, describe, expect, it } from "vitest";
 import { runAgent, type StreamEvent } from "../../src/agent/runner.js";
+import { importSkillDirectory } from "../../src/agent/skillStore.js";
 
 const execFileAsync = promisify(execFile);
 const originalEnv = new Map<string, string | undefined>();
@@ -36,23 +37,25 @@ describe("real Claude SDK sandbox boundary", () => {
     const cphBin = cphPathOutput.trim();
     await access(cphBin, constants.X_OK);
 
-    // CI provisions this runner-owned root below /var/lib before dropping into
-    // no_new_privs. Keeping the fixture out of /tmp proves that an SDK-wide
-    // temp exception cannot make a cross-project escape look contained.
+    // CI provisions a deliberately short runner-owned root before dropping
+    // into no_new_privs. Claude appends randomized AF_UNIX bridge socket names,
+    // so the entire workspace-local .cph/t prefix must stay within its budget.
     const configuredTestRoot = process.env["CPH_SANDBOX_TEST_ROOT"]?.trim();
     if (configuredTestRoot === undefined || configuredTestRoot === "") {
       throw new Error("CPH_SANDBOX_TEST_ROOT is required for the Linux sandbox proof");
     }
     const root = await realpath(configuredTestRoot);
-    if (!root.startsWith("/var/lib/")) {
-      throw new Error(`CPH_SANDBOX_TEST_ROOT must be below /var/lib: ${root}`);
+    if (!root.startsWith("/") || Buffer.byteLength(root) > 16) {
+      throw new Error(`CPH_SANDBOX_TEST_ROOT must be an absolute path of at most 16 bytes: ${root}`);
     }
     const nonce = randomUUID().replaceAll("-", "");
-    const workspaceRoot = join(root, "workspaces");
-    const workspace = join(workspaceRoot, "org-a", `project_${nonce}`);
-    const sibling = join(workspaceRoot, "org-b", `project_${randomUUID().replaceAll("-", "")}`);
-    const serviceSecret = join(root, `service-secret-${nonce}`);
-    roots.push(workspace, sibling, serviceSecret);
+    const workspaceRoot = join(root, "w");
+    const workspace = join(workspaceRoot, "a", `p_${nonce.slice(0, 8)}`);
+    const sibling = join(workspaceRoot, "b", `p_${nonce.slice(8, 16)}`);
+    const serviceSecret = join(root, `s_${nonce.slice(16, 24)}`);
+    const skillSource = join(root, `k_${nonce.slice(24, 28)}`);
+    const skillStore = join(root, `ks_${nonce.slice(28, 32)}`);
+    roots.push(workspace, sibling, serviceSecret, skillSource, skillStore);
     await Promise.all([
       mkdir(workspace, { recursive: true }),
       mkdir(sibling, { recursive: true }),
@@ -62,6 +65,12 @@ describe("real Claude SDK sandbox boundary", () => {
       writeFile(join(sibling, "secret.txt"), "sibling-secret\n"),
       writeFile(serviceSecret, "platform-secret\n"),
     ]);
+    await mkdir(skillSource, { recursive: true });
+    await writeFile(join(skillSource, "SKILL.md"), "---\nname: outline\ndescription: Outline\n---\n");
+    const installedSkill = await importSkillDirectory({ sourceDir: skillSource, storeRoot: skillStore });
+    const untrustedSkill = join(workspace, ".claude", "skills", "untrusted");
+    await mkdir(untrustedSkill, { recursive: true });
+    await writeFile(join(untrustedSkill, "SKILL.md"), "---\nname: untrusted\ndescription: must never load\n---\n");
     // macOS tmpdir is reached through /var -> /private/var. Exercise the
     // sandbox with canonical paths, matching the canonical cwd returned by
     // createAgentSecurityPolicy rather than relying on a host symlink alias.
@@ -70,8 +79,7 @@ describe("real Claude SDK sandbox boundary", () => {
     const canonicalServiceSecret = await realpath(serviceSecret);
     const resultPath = join(canonicalWorkspace, "sandbox-result.txt");
     const cphVersionPath = join(canonicalWorkspace, "cph-version.txt");
-    const effectiveTempProbePath = join(canonicalWorkspace, ".cph", "t", "effective-temp.txt");
-    const denialLogPath = join(canonicalWorkspace, ".cph", "t", "denials.log");
+    const denialLogPath = join(canonicalWorkspace, ".cph", "denials.log");
     const siblingEscapePath = join(canonicalSibling, "escape.txt");
     const unsandboxedEscapePath = join(root, `unsandboxed-escape-${nonce}`);
     const hostTmpEscapePath = `/tmp/cph-host-temp-${nonce}`;
@@ -84,25 +92,26 @@ describe("real Claude SDK sandbox boundary", () => {
       DATABASE_URL: "postgresql://platform-secret",
       FEISHU_APP_SECRET: "feishu-secret",
       HUB_SESSION_SECRET: "session-secret",
+      HUB_SKILL_STORE_ROOT: skillStore,
     });
 
     const bashCommand = [
       "set -eu",
-      `if printf 'unsafe\\n' > ${shellQuote(unsandboxedEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 31; fi`,
+      `printf 'ephemeral\\n' > ${shellQuote(unsandboxedEscapePath)}`,
       `test "$(cat ${shellQuote(join(canonicalWorkspace, "allowed.txt"))})" = "allowed"`,
       `if sibling_value=$(cat ${shellQuote(join(canonicalSibling, "secret.txt"))} 2>> ${shellQuote(denialLogPath)}); then exit 21; fi`,
-      `if printf 'escape\\n' > ${shellQuote(siblingEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 32; fi`,
+      `printf 'ephemeral\\n' > ${shellQuote(siblingEscapePath)}`,
       `if service_value=$(cat ${shellQuote(canonicalServiceSecret)} 2>> ${shellQuote(denialLogPath)}); then exit 23; fi`,
       `mkdir ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
       `cd ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
-      `test "\${TMPDIR-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
-      `test "\${TMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
-      `test "\${TEMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
-      'test "${CLAUDE_CODE_TMPDIR-unset}" = ".cph/t"',
-      `test "$(realpath "$TMPDIR")" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
-      `printf 'workspace-temp\\n' > "$TMPDIR/effective-temp.txt"`,
-      `if printf 'host-temp\\n' > ${shellQuote(hostTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 33; fi`,
-      `if printf 'host-var-temp\\n' > ${shellQuote(hostVarTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 34; fi`,
+      'test "${TMPDIR-unset}" = "${TMP-unset}"',
+      'test "${TMPDIR-unset}" = "${TEMP-unset}"',
+      'test "${TMPDIR-unset}" = "${CLAUDE_CODE_TMPDIR-unset}"',
+      'test "${#TMPDIR}" -le 56',
+      `case "$TMPDIR" in ${shellQuote(canonicalWorkspace)}/*) :;; *) exit 35;; esac`,
+      `printf 'sdk-temp\\n' > "$TMPDIR/effective-temp.txt"`,
+      `printf 'ephemeral\\n' > ${shellQuote(hostTmpEscapePath)}`,
+      `printf 'ephemeral\\n' > ${shellQuote(hostVarTmpEscapePath)}`,
       'test "${DATABASE_URL-unset}" = unset',
       'test "${FEISHU_APP_SECRET-unset}" = unset',
       'test "${HUB_SESSION_SECRET-unset}" = unset',
@@ -131,6 +140,7 @@ describe("real Claude SDK sandbox boundary", () => {
           ANTHROPIC_API_KEY: "",
         },
         tools: ["bash"],
+        skills: [{ name: "outline", version: "1", contentDigest: installedSkill.contentDigest }],
         maxTurns: 3,
         runId: "sandbox-run",
         sessionId: "sandbox-session",
@@ -146,10 +156,18 @@ describe("real Claude SDK sandbox boundary", () => {
         result.status,
         [result.error, sdkStderr.join(""), JSON.stringify(streamEvents)].filter(Boolean).join("\n"),
       ).toBe("completed");
-      expect(stub.requestCount()).toBeGreaterThanOrEqual(2);
+      expect(stub.requestCount()).toBeGreaterThanOrEqual(3);
+      expect(new Set(result.initializedSkillIds)).toEqual(new Set([
+        "cph-runtime:outline",
+      ]));
       const toolResults = streamEvents.filter((event) => event.type === "tool-result");
-      expect(toolResults).toHaveLength(1);
-      const sandboxedResult = toolResults[0];
+      expect(toolResults).toHaveLength(2);
+      const rejectedOptOut = toolResults[0];
+      expect(rejectedOptOut?.type).toBe("tool-result");
+      if (rejectedOptOut?.type !== "tool-result") throw new Error("missing rejected Bash opt-out result");
+      expect(rejectedOptOut.isError).toBe(true);
+      expect(rejectedOptOut.result).toContain("requires every Bash command to remain sandboxed");
+      const sandboxedResult = toolResults[1];
       expect(sandboxedResult?.type).toBe("tool-result");
       if (sandboxedResult?.type !== "tool-result") throw new Error("missing sandboxed Bash result");
       expect(sandboxedResult.isError, `${sandboxedResult.result}\n${sdkStderr.join("")}`).toBe(false);
@@ -159,7 +177,6 @@ describe("real Claude SDK sandbox boundary", () => {
       });
       expect(resultContents).toBe("sandbox-ok\n");
       await expect(readFile(cphVersionPath, "utf8")).resolves.toMatch(/^cph /);
-      await expect(readFile(effectiveTempProbePath, "utf8")).resolves.toBe("workspace-temp\n");
       const denialLog = await readFile(denialLogPath, "utf8");
       expect(denialLog).not.toContain("sibling-secret");
       expect(denialLog).not.toContain("platform-secret");
@@ -198,11 +215,13 @@ async function startAnthropicStub(bashCommand: string): Promise<{
       };
       requests++;
       const events = requests === 1
-        // Deliberately request the SDK's bypass flag. Production sets
-        // allowUnsandboxedCommands=false, so the flag must be ignored and the
-        // host-side escape sentinels must remain absent.
+        // The host hook must reject the SDK's per-call sandbox bypass before
+        // any command starts. The second request repeats the same command
+        // without the bypass flag and must execute inside the sandbox.
         ? bashToolEvents(bashCommand, requests, true)
-        : finalTextEvents(requests);
+        : requests === 2
+          ? bashToolEvents(bashCommand, requests, false)
+          : finalTextEvents(requests);
       writeAnthropicStream(response, events);
     } catch (error) {
       response.writeHead(500, { "content-type": "application/json" });

hub/test/integration/helpers.ts

@@ -35,6 +35,9 @@ export const prisma = new PrismaClient({
 /** Truncate all tables before each test for isolation. */
 export async function resetDb(): Promise<void> {
   const tables = [
+    "OrganizationAgentRoleSkill",
+    "OrganizationAgentRole",
+    "OrganizationAgentSkill",
     "FeishuEventReceipt",
     "FeishuUserIdentity",
     "FeishuApplicationCredentialVersion",

hub/test/integration/project-onboarding.test.ts

@@ -55,6 +55,7 @@ describe("ADR-0021 project onboarding", () => {
     expect(result.folderId).toBe(folder.id);
     expect(result.chatId).toBeUndefined();
     expect((await stat(result.workspaceDir)).isDirectory()).toBe(true);
+    expect(result.workspaceDir).toMatch(/\/o_[A-Za-z0-9_-]{16}\/p_[A-Za-z0-9_-]{16}$/);
     const grant = await prisma.permissionGrant.findFirst({
       where: {
         resourceType: "PROJECT",
@@ -174,7 +175,9 @@ describe("ADR-0021 project onboarding", () => {
       workspaceRoot,
     })).rejects.toThrow(/forced permission settings failure/);
 
-    await expect(readdir(join(workspaceRoot, "test-default"))).resolves.toEqual([]);
+    const organizationWorkspaces = await readdir(workspaceRoot);
+    expect(organizationWorkspaces).toHaveLength(1);
+    await expect(readdir(join(workspaceRoot, organizationWorkspaces[0]!))).resolves.toEqual([]);
     await expect(prisma.project.count()).resolves.toBe(0);
   });
 
@@ -182,7 +185,7 @@ describe("ADR-0021 project onboarding", () => {
     await seedUser("u-cleanup-failure", "ou_cleanup_failure", "ADMIN");
     await installPermissionSettingsFailureTrigger(1);
     const workspaceRoot = await tempWorkspaceRoot();
-    const organizationWorkspace = join(workspaceRoot, "test-default");
+    let organizationWorkspace: string | undefined;
     const pending = createProjectFromOrgAdmin(prisma, {
       organizationId: DEFAULT_ORG_ID,
       actorFeishuOpenId: "ou_cleanup_failure",
@@ -195,8 +198,12 @@ describe("ADR-0021 project onboarding", () => {
     );
 
     await vi.waitFor(async () => {
+      const organizationWorkspaces = await readdir(workspaceRoot);
+      expect(organizationWorkspaces).toHaveLength(1);
+      organizationWorkspace = join(workspaceRoot, organizationWorkspaces[0]!);
       expect(await readdir(organizationWorkspace)).toHaveLength(1);
     }, { timeout: 2_000 });
+    if (organizationWorkspace === undefined) throw new Error("organization workspace was not allocated");
     await chmod(organizationWorkspace, 0o500);
     try {
       const error = await outcome;

hub/test/integration/silo-bootstrap.test.ts

@@ -53,6 +53,14 @@ describe("Alpha Silo bootstrap", () => {
     expect(await prisma.team.count({ where: { slug: "teachers", archivedAt: null } })).toBe(1);
     expect(await prisma.teamMembership.count({ where: { revokedAt: null } })).toBe(1);
     expect(await prisma.organizationProviderConnection.count({ where: { status: "ACTIVE" } })).toBe(1);
+    await expect(prisma.organizationAgentRole.findMany({
+      where: { organizationId: "org_alpha", disabledAt: null },
+      orderBy: { sortOrder: "asc" },
+      select: { roleId: true, label: true },
+    })).resolves.toEqual([
+      { roleId: "draft", label: "草稿" },
+      { roleId: "review", label: "审校" },
+    ]);
 
     const persisted = JSON.stringify({
       feishu: await prisma.feishuApplicationCredentialVersion.findMany(),

hub/test/integration/trigger.test.ts

@@ -3,7 +3,15 @@ import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { Readable } from "node:stream";
 import { describe, it, expect, beforeEach, afterEach, afterAll, vi } from "vitest";
-import { DEFAULT_ORG_ID, prisma, resetDb, mockFeishuRuntime, seedProject, silentLogger } from "./helpers.js";
+import {
+  DEFAULT_ORG_ID,
+  prisma,
+  resetDb,
+  mockFeishuRuntime,
+  seedProject,
+  seedTestOrganization,
+  silentLogger,
+} from "./helpers.js";
 import { InMemoryModelRegistry } from "../../src/agent/models.js";
 import { createSlashCommandRegistry } from "../../src/feishu/slashCommands.js";
 import { makeTriggerHandler as makeProductionTriggerHandler, extractPrompt } from "../../src/feishu/trigger.js";
@@ -24,6 +32,8 @@ type TestTriggerDeps = Omit<Parameters<typeof makeProductionTriggerHandler>[0],
 function makeTriggerHandler(deps: TestTriggerDeps): ReturnType<typeof makeProductionTriggerHandler> {
   return makeProductionTriggerHandler({
     projectWorkspaceRoot: "/tmp",
+    publicBaseUrl: "https://educraft.example.test",
+    siloOrganizationId: DEFAULT_ORG_ID,
     allowLegacyFeishuIdentity: true,
     ...deps,
   });
@@ -386,6 +396,18 @@ describe("trigger full lifecycle (integration)", () => {
         role: "EDIT",
       },
     });
+    await prisma.user.createMany({
+      data: [
+        { id: "u-speaker-alice", feishuOpenId: "ou_alice", displayName: "Alice" },
+        { id: "u-speaker-bob", feishuOpenId: "ou_bob", displayName: "Bob" },
+      ],
+    });
+    await prisma.organizationMembership.createMany({
+      data: [
+        { organizationId: DEFAULT_ORG_ID, userId: "u-speaker-alice", role: "MEMBER" },
+        { organizationId: DEFAULT_ORG_ID, userId: "u-speaker-bob", role: "MEMBER" },
+      ],
+    });
     const trigger = makeTriggerHandler({ prisma, settings, logger: silentLogger, runAgent, messageBatcherOptions: { maxMessages: 1 } });
 
     await trigger(makeEvent("chat-speaker", "@_user_1 Alice 的需求", "ou_alice"), rt);
@@ -626,6 +648,66 @@ describe("trigger full lifecycle (integration)", () => {
     expect(runs).toHaveLength(0);
   });
 
+  it("gives an unknown user the scoped login URL in an already-bound chat", async () => {
+    await seedProject("proj-bound-unknown", "chat-bound-unknown");
+    const trigger = makeTriggerHandler({
+      prisma,
+      settings,
+      logger: silentLogger,
+      runAgent,
+      allowLegacyFeishuIdentity: false,
+      messageBatcherOptions: { maxMessages: 1 },
+    });
+
+    await trigger(makeEvent("chat-bound-unknown", "@_user_1 写教案", "ou_bound_unknown"), rt);
+
+    expect(rt.sentTexts).toContain(
+      "请先通过飞书登录并加入组织：https://educraft.example.test/auth/feishu/test-default\n" +
+      "完成后返回群聊重试。",
+    );
+    expect(rt.sentTexts).not.toContain("无权限触发。");
+    expect(runAgentCalls).toHaveLength(0);
+  });
+
+  it("tells a logged-in non-member to contact the administrator in an already-bound chat", async () => {
+    await seedProject("proj-bound-non-member", "chat-bound-non-member");
+    await seedScopedIdentityWithoutMembership("bound-non-member", "ou_bound_non_member");
+    const trigger = makeTriggerHandler({
+      prisma,
+      settings,
+      logger: silentLogger,
+      runAgent,
+      allowLegacyFeishuIdentity: false,
+      messageBatcherOptions: { maxMessages: 1 },
+    });
+
+    await trigger(makeEvent("chat-bound-non-member", "@_user_1 写教案", "ou_bound_non_member"), rt);
+
+    expect(rt.sentTexts).toContain(
+      "你尚未加入该组织，或成员资格已被移除。请联系组织管理员。",
+    );
+    expect(rt.sentTexts).not.toContain("无权限触发。");
+    expect(runAgentCalls).toHaveLength(0);
+  });
+
+  it("keeps generic project denial for an Organization member without project permission", async () => {
+    await seedProject("proj-bound-read-only", "chat-bound-read-only", { role: "READ" });
+    const trigger = makeTriggerHandler({
+      prisma,
+      settings,
+      logger: silentLogger,
+      runAgent,
+      messageBatcherOptions: { maxMessages: 1 },
+    });
+
+    await trigger(makeEvent("chat-bound-read-only", "@_user_1 写教案"), rt);
+
+    expect(rt.sentTexts).toContain("无权限触发。");
+    expect(rt.sentTexts.join("\n")).not.toContain("/auth/feishu/");
+    expect(rt.sentTexts.join("\n")).not.toContain("尚未加入该组织");
+    expect(runAgentCalls).toHaveLength(0);
+  });
+
   it.each(["SUSPENDED", "ARCHIVED"] as const)(
     "rejects triggers and resume commands when the organization is %s",
     async (status) => {
@@ -922,18 +1004,62 @@ describe("trigger full lifecycle (integration)", () => {
     await expect(readdir(join(workspaceRoot, ".cph-staging"))).resolves.toEqual([]);
   });
 
-  it("does not create a run for unbound chats and asks unknown users to log in", async () => {
+  it("does not create a run for unbound chats and gives unknown users the scoped login URL", async () => {
     await seedProject("proj-4", "chat-4");
     const trigger = makeTriggerHandler({ prisma, settings, logger: silentLogger, runAgent, messageBatcherOptions: { maxMessages: 1 } });
 
     await trigger(makeEvent("chat-UNKNOWN", "@_user_1 写教案", "ou_unknown_user"), rt);
 
-    expect(rt.sentTexts).toContain("请先登录并加入组织后，再绑定项目。");
+    expect(rt.sentTexts).toContain(
+      "请先通过飞书登录并加入组织：https://educraft.example.test/auth/feishu/test-default\n" +
+      "完成后返回群聊重试。",
+    );
     expect(rt.sentCards).toHaveLength(0);
     const runs = await prisma.agentRun.findMany();
     expect(runs).toHaveLength(0);
   });
 
+  it("distinguishes a scoped Feishu identity that has not joined the Silo Organization", async () => {
+    await seedScopedIdentityWithoutMembership("unbound-non-member", "ou_logged_in_not_member");
+    const trigger = makeTriggerHandler({
+      prisma,
+      settings,
+      logger: silentLogger,
+      runAgent,
+      allowLegacyFeishuIdentity: false,
+      messageBatcherOptions: { maxMessages: 1 },
+    });
+
+    await trigger(makeEvent("chat-unbound", "@_user_1 写教案", "ou_logged_in_not_member"), rt);
+
+    expect(rt.sentTexts).toContain(
+      "你尚未加入该组织，或成员资格已被移除。请联系组织管理员。",
+    );
+    expect(rt.sentTexts.join("\n")).not.toContain("/auth/feishu/");
+    await expect(prisma.agentRun.count()).resolves.toBe(0);
+  });
+
+  it("encodes the configured Organization slug in the OAuth login URL", async () => {
+    const encodedOrgId = "org_url_encoding";
+    await seedTestOrganization(encodedOrgId, "school east/数学?");
+    const trigger = makeTriggerHandler({
+      prisma,
+      settings,
+      logger: silentLogger,
+      runAgent,
+      siloOrganizationId: encodedOrgId,
+      publicBaseUrl: "https://school.example.test/",
+      messageBatcherOptions: { maxMessages: 1 },
+    });
+
+    await trigger(makeEvent("chat-unbound", "@_user_1 写教案", "ou_unknown_encoded"), rt);
+
+    expect(rt.sentTexts.join("\n")).toContain(
+      "https://school.example.test/auth/feishu/school%20east%2F%E6%95%B0%E5%AD%A6%3F",
+    );
+    expect(rt.sentTexts.join("\n")).not.toContain("school east/数学?");
+  });
+
   it("ignores messages without @bot mention", async () => {
     await seedProject("proj-5", "chat-5");
     const trigger = makeTriggerHandler({ prisma, settings, logger: silentLogger, runAgent, messageBatcherOptions: { maxMessages: 1 } });
@@ -1430,6 +1556,28 @@ async function seedOnboardingUser(id: string, feishuOpenId: string, role: "OWNER
   });
 }
 
+async function seedScopedIdentityWithoutMembership(id: string, openId: string): Promise<void> {
+  const connectionId = `feishu-connection-${id}`;
+  await prisma.organizationFeishuApplicationConnection.create({
+    data: {
+      id: connectionId,
+      organizationId: DEFAULT_ORG_ID,
+      appIdentityFingerprint: `fingerprint-${id}`,
+      status: "ACTIVE",
+    },
+  });
+  await prisma.user.create({
+    data: {
+      id: `user-${id}`,
+      displayName: "Logged in user",
+      feishuOpenId: `legacy-${openId}`,
+      feishuIdentities: {
+        create: { connectionId, openId },
+      },
+    },
+  });
+}
+
 async function tempWorkspaceRoot(): Promise<string> {
   const root = await mkdtemp(join(tmpdir(), "cph-trigger-onboarding-"));
   workspaceRoots.push(root);

hub/test/unit/agent-security.test.ts

@@ -14,6 +14,7 @@ describe("agent subprocess security policy", () => {
   it("passes only the run proxy capability and safe runtime variables and protects the capability from tools", async () => {
     const { workspaceRoot, workspace } = await makeWorkspace();
     const policy = await createAgentSecurityPolicy({
+      runId: "run-test",
       workspaceRoot,
       workspaceDir: workspace,
       providerProxyEnv: {
@@ -46,7 +47,13 @@ describe("agent subprocess security policy", () => {
     expect(policy.env).not.toHaveProperty("HUB_SESSION_SECRET");
     expect(policy.env.HOME).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
     expect(policy.env.CLAUDE_CONFIG_DIR).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
-    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(policy.env.TMPDIR);
+    expect(policy.env.TMP).toBe(policy.env.TMPDIR);
+    expect(policy.env.TEMP).toBe(policy.env.TMPDIR);
+    expect(policy.env.TMPDIR).toBe(join(canonicalWorkspace, ".cph", "t"));
+    expect(Buffer.byteLength(policy.env.TMPDIR!)).toBeLessThanOrEqual(56);
+    expect(policy.skillIds).toEqual([]);
+    expect(policy.skillPluginRoot).toBeUndefined();
 
     expect(policy.sandbox).toMatchObject({
       enabled: true,
@@ -71,6 +78,7 @@ describe("agent subprocess security policy", () => {
     const { workspaceRoot, workspace } = await makeWorkspace();
 
     await expect(createAgentSecurityPolicy({
+      runId: "run-test",
       workspaceRoot,
       workspaceDir: workspace,
       providerProxyEnv: {
@@ -81,32 +89,51 @@ describe("agent subprocess security policy", () => {
     })).rejects.toThrow("unsupported provider environment variable: DATABASE_URL");
   });
 
-  it("keeps the short SDK socket directory inside the project workspace", async () => {
+  it("keeps every SDK temp variable on a short path inside the project workspace", async () => {
     const { workspaceRoot, workspace } = await makeWorkspace();
     const policy = await createAgentSecurityPolicy({
+      runId: "run-test",
       workspaceRoot,
       workspaceDir: workspace,
       hostEnv: { PATH: "/usr/bin:/bin" },
     });
 
-    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
-    const absoluteTemp = join(await realpath(workspace), ".cph", "t");
-    expect(policy.env.TMPDIR).toBe(absoluteTemp);
-    expect(policy.env.TMP).toBe(absoluteTemp);
-    expect(policy.env.TEMP).toBe(absoluteTemp);
-    expect(policy.sandbox.filesystem.allowWrite).toEqual([await realpath(workspace)]);
+    const canonicalWorkspace = await realpath(workspace);
+    const temp = policy.env.TMPDIR!;
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(temp);
+    expect(policy.env.TMP).toBe(temp);
+    expect(policy.env.TEMP).toBe(temp);
+    expect(temp).toBe(join(canonicalWorkspace, ".cph", "t"));
+    expect(Buffer.byteLength(temp)).toBeLessThanOrEqual(56);
+    expect(policy.sandbox.filesystem.allowWrite).toEqual([canonicalWorkspace]);
     expect(policy.sandbox.filesystem.denyWrite).toEqual(["/"]);
-    expect(policy.sandbox.filesystem.allowRead).not.toContain(expect.stringMatching(/^\/run\//));
+    expect(policy.sandbox.filesystem.allowRead).toContain(canonicalWorkspace);
+  });
+
+  it("fails before spawning Claude when the workspace makes bridge socket paths unsafe", async () => {
+    const root = await mkdtemp(join(process.platform === "win32" ? tmpdir() : "/tmp", "hub-agent-long-"));
+    roots.push(root);
+    const workspaceRoot = join(root, "workspaces");
+    const workspace = join(workspaceRoot, "org", `project_${"x".repeat(80)}`);
+    await mkdir(workspace, { recursive: true });
+
+    await expect(createAgentSecurityPolicy({
+      runId: "run-test",
+      workspaceRoot,
+      workspaceDir: workspace,
+      hostEnv: { PATH: "/usr/bin:/bin" },
+    })).rejects.toThrow("Agent temp path is too long for sandbox bridge sockets");
   });
 
   it("rejects a project workspace whose real path escapes the configured workspace root", async () => {
     const { root, workspaceRoot } = await makeWorkspace();
     const outside = join(root, "outside");
-    const linked = join(workspaceRoot, "org", "linked-project");
+    const linked = join(workspaceRoot, "o", "linked-project");
     await mkdir(outside);
     await symlink(outside, linked);
 
     await expect(createAgentSecurityPolicy({
+      runId: "run-test",
       workspaceRoot,
       workspaceDir: linked,
       providerProxyEnv: { ANTHROPIC_AUTH_TOKEN: "run-proxy-capability" },
@@ -116,12 +143,13 @@ describe("agent subprocess security policy", () => {
 
   it("rejects a project workspace symlink whose target is a sibling under the same root", async () => {
     const { workspaceRoot } = await makeWorkspace();
-    const sibling = join(workspaceRoot, "org", "sibling-project");
-    const linked = join(workspaceRoot, "org", "linked-project");
+    const sibling = join(workspaceRoot, "o", "sibling-project");
+    const linked = join(workspaceRoot, "o", "linked-project");
     await mkdir(sibling);
     await symlink(sibling, linked);
 
     await expect(createAgentSecurityPolicy({
+      runId: "run-test",
       workspaceRoot,
       workspaceDir: linked,
       providerProxyEnv: { ANTHROPIC_AUTH_TOKEN: "run-proxy-capability" },
@@ -130,10 +158,10 @@ describe("agent subprocess security policy", () => {
   });
 
   async function makeWorkspace(): Promise<{ root: string; workspaceRoot: string; workspace: string }> {
-    const root = await mkdtemp(join(tmpdir(), "hub-agent-security-"));
+    const root = await mkdtemp(join(process.platform === "win32" ? tmpdir() : "/tmp", "h-"));
     roots.push(root);
-    const workspaceRoot = join(root, "workspaces");
-    const workspace = join(workspaceRoot, "org", "project");
+    const workspaceRoot = join(root, "w");
+    const workspace = join(workspaceRoot, "o", "p");
     await mkdir(workspace, { recursive: true });
     return { root, workspaceRoot, workspace };
   }

hub/test/unit/feishu-approval.test.ts

@@ -110,6 +110,8 @@ describe("Feishu approval cards", () => {
       logger: silentLogger(),
       authorizer: allowAllAuthorizer(),
       projectWorkspaceRoot: "/tmp",
+      publicBaseUrl: "https://educraft.example.test",
+      siloOrganizationId: "org_test_default",
       runAgent: async () => ({
         status: "completed",
         text: "",

hub/test/unit/feishu-reactions.test.ts

@@ -103,6 +103,8 @@ async function triggerWithRunAgent(
     logger: rt.logger,
     authorizer: allowAllAuthorizer(),
     projectWorkspaceRoot: "/tmp",
+    publicBaseUrl: "https://educraft.example.test",
+    siloOrganizationId: "org_test_default",
     runAgent,
     messageBatcherOptions: { maxMessages: 1 },
   });
@@ -254,6 +256,19 @@ function mockPrisma(): PrismaClient {
   const session = { id: "session-1", metadata: {} };
 
   const client = {
+    organization: {
+      findFirst: vi.fn(async () => ({ id: "org_test_default", slug: "test-default" })),
+    },
+    feishuUserIdentity: {
+      findFirst: vi.fn(async () => ({
+        user: {
+          organizationMemberships: [{
+            role: "OWNER",
+            organization: { id: "org_test_default", name: "Test Organization" },
+          }],
+        },
+      })),
+    },
     feishuEventReceipt: {
       findUnique: vi.fn(async () => null),
       create: vi.fn(async () => ({ id: "receipt-1" })),

hub/test/unit/file-delivery.test.ts

@@ -34,6 +34,65 @@ describe("file delivery path resolution", () => {
     }
   });
 
+  itOnLinux("accepts arbitrary extensions and extensionless workspace files", async () => {
+    const root = await makeRepo();
+    try {
+      const workspace = join(root, "examples", "TH-141");
+      await writeFile(join(workspace, "lesson.json"), "{\"ok\":true}\n");
+      await writeFile(join(workspace, "Makefile"), "all:\n\t@true\n");
+
+      await expect(resolveDeliverableFile("lesson.json", join(root, "examples"), workspace))
+        .resolves.toMatchObject({ name: "lesson.json" });
+      await expect(resolveDeliverableFile("Makefile", join(root, "examples"), workspace))
+        .resolves.toMatchObject({ name: "Makefile" });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  itOnLinux("allows the Feishu inbox but refuses other platform runtime files", async () => {
+    const root = await makeRepo();
+    try {
+      const workspace = join(root, "examples", "TH-141");
+      await mkdir(join(workspace, ".cph", "agent-runtime"), { recursive: true });
+      await mkdir(join(workspace, ".cph", "inbox"), { recursive: true });
+      await writeFile(join(workspace, ".cph", "agent-runtime", "session.jsonl"), "internal\n");
+      await writeFile(join(workspace, ".cph", "denials.log"), "internal\n");
+      await writeFile(join(workspace, ".cph", "inbox", "source.bin"), "source\n");
+
+      await expect(
+        resolveDeliverableFile(".cph/inbox/source.bin", join(root, "examples"), workspace),
+      ).resolves.toMatchObject({ name: "source.bin" });
+
+      await expect(
+        resolveDeliverableFile(".cph/agent-runtime/session.jsonl", join(root, "examples"), workspace),
+      ).rejects.toMatchObject({ reason: "boundary" });
+      await expect(
+        resolveDeliverableFile(".cph/denials.log", join(root, "examples"), workspace),
+      ).rejects.toMatchObject({ reason: "boundary" });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  itOnLinux("refuses a file larger than the configured delivery limit", async () => {
+    const root = await makeRepo();
+    try {
+      const workspace = join(root, "examples", "TH-141");
+      await writeFile(join(workspace, "exact.bin"), Buffer.alloc(10));
+      await writeFile(join(workspace, "artifact.bin"), Buffer.alloc(11));
+
+      await expect(
+        resolveDeliverableFile("exact.bin", join(root, "examples"), workspace, 10),
+      ).resolves.toMatchObject({ name: "exact.bin", data: Buffer.alloc(10) });
+      await expect(
+        resolveDeliverableFile("artifact.bin", join(root, "examples"), workspace, 10),
+      ).rejects.toMatchObject({ reason: "limit" });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   itOnLinux("rejects a deliverable symlink even when its target exists", async () => {
     const root = await makeRepo();
     try {
@@ -50,7 +109,7 @@ describe("file delivery path resolution", () => {
     }
   });
 
-  it("does not infer files from natural-language prompts", async () => {
+  itOnLinux("does not infer files from natural-language prompts", async () => {
     const root = await makeRepo();
     try {
       const workspace = join(root, "examples", "TH-141");

hub/test/unit/runner.test.ts

@@ -1,8 +1,9 @@
-import { mkdir, mkdtemp, realpath, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { runAgent } from "../../src/agent/runner.js";
+import { importSkillDirectory } from "../../src/agent/skillStore.js";
 
 const queryMock = vi.hoisted(() => vi.fn());
 
@@ -33,6 +34,16 @@ function resultMessage(sessionId: string, costUsd?: number) {
   };
 }
 
+function initMessage(skills: string[]) {
+  return {
+    type: "system",
+    subtype: "init",
+    skills,
+    tools: [],
+    plugins: [],
+  };
+}
+
 function messages(...items: unknown[]) {
   return (async function* () {
     for (const item of items) yield item;
@@ -59,14 +70,14 @@ describe("runAgent", () => {
 
   beforeEach(async () => {
     queryMock.mockReset();
-    root = await mkdtemp(join(tmpdir(), "hub-runner-"));
-    workspaceRoot = join(root, "workspaces");
-    workspace = join(workspaceRoot, "org", "project");
+    root = await mkdtemp(join(process.platform === "win32" ? tmpdir() : "/tmp", "r-"));
+    workspaceRoot = join(root, "w");
+    workspace = join(workspaceRoot, "o", "p");
     await mkdir(workspace, { recursive: true });
     workspaceRoot = await realpath(workspaceRoot);
     workspace = await realpath(workspace);
     previousSecrets = Object.fromEntries(
-      ["DATABASE_URL", "FEISHU_APP_SECRET", "HUB_SESSION_SECRET"].map((name) => [name, process.env[name]]),
+      ["DATABASE_URL", "FEISHU_APP_SECRET", "HUB_SESSION_SECRET", "HUB_SKILL_STORE_ROOT"].map((name) => [name, process.env[name]]),
     );
   });
 
@@ -102,13 +113,15 @@ describe("runAgent", () => {
         permissionMode: "bypassPermissions",
         allowDangerouslySkipPermissions: true,
         settingSources: [],
+        settings: { disableBundledSkills: true },
+        skills: [],
         strictMcpConfig: true,
         sandbox: expect.objectContaining({
           enabled: true,
           failIfUnavailable: true,
           allowUnsandboxedCommands: false,
           filesystem: expect.objectContaining({
-            allowWrite: [workspace],
+            allowWrite: expect.arrayContaining([workspace]),
             denyRead: ["/"],
             allowRead: expect.arrayContaining([workspace]),
           }),
@@ -134,6 +147,26 @@ describe("runAgent", () => {
     expect(call?.options).not.toHaveProperty("resume");
   });
 
+  it("returns the skills actually reported by SDK initialization", async () => {
+    queryMock.mockReturnValue(messages(
+      initMessage(["cph-runtime:outline"]),
+      assistantMessage("fresh"),
+      resultMessage("sdk-session-1"),
+    ));
+
+    const result = await runAgent({
+      prompt: "写一个大纲",
+      model: undefined,
+      project: { projectId: "p", boundChatId: "c", workspaceRoot, workspaceDir: workspace },
+      systemPrompt: undefined,
+      runId: "run-1",
+      sessionId: "hub-session-1",
+      prisma: stubPrisma,
+    });
+
+    expect(result.initializedSkillIds).toEqual(["cph-runtime:outline"]);
+  });
+
   it("maps role tool ids to the Claude SDK tool whitelist", async () => {
     queryMock.mockReturnValue(messages(assistantMessage("ok"), resultMessage("sdk-session-1")));
 
@@ -156,7 +189,7 @@ describe("runAgent", () => {
     });
   });
 
-  it("disables all SDK tools for an empty role tool whitelist", async () => {
+  it("disables SDK tools for an empty role tool and skill selection", async () => {
     queryMock.mockReturnValue(messages(assistantMessage("ok"), resultMessage("sdk-session-1")));
 
     await runAgent({
@@ -178,6 +211,36 @@ describe("runAgent", () => {
     });
   });
 
+  it("loads only the dynamic skills selected by the role", async () => {
+    const source = join(root, "skill-source");
+    const storeRoot = join(root, "skill-store");
+    await mkdir(source);
+    await writeFile(join(source, "SKILL.md"), "---\nname: typst\ndescription: Typst\n---\n");
+    const installed = await importSkillDirectory({ sourceDir: source, storeRoot });
+    process.env["HUB_SKILL_STORE_ROOT"] = storeRoot;
+    queryMock.mockReturnValue(messages(assistantMessage("ok"), resultMessage("sdk-session-1")));
+
+    await runAgent({
+      prompt: "排版",
+      model: undefined,
+      project: { projectId: "p", boundChatId: "c", workspaceRoot, workspaceDir: workspace },
+      systemPrompt: undefined,
+      tools: [],
+      skills: [{ name: "typst", version: "0.15.0", contentDigest: installed.contentDigest }],
+      runId: "run-skill",
+      sessionId: "hub-session-1",
+      prisma: stubPrisma,
+    });
+
+    expect(queryMock.mock.calls[0]?.[0]).toMatchObject({
+      options: {
+        tools: ["Skill"],
+        plugins: [expect.objectContaining({ type: "local", skipMcpDiscovery: true })],
+        skills: ["cph-runtime:typst"],
+      },
+    });
+  });
+
   it("returns SDK-reported cost when present", async () => {
     queryMock.mockReturnValue(messages(assistantMessage("ok"), resultMessage("sdk-session-1", 0.0042)));
 

hub/test/unit/skill-store.test.ts

@@ -0,0 +1,71 @@
+import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { importSkillDirectory, prepareRunSkillPlugin } from "../../src/agent/skillStore.js";
+
+describe("content-addressed Agent skill store", () => {
+  const roots: string[] = [];
+
+  afterEach(async () => {
+    await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+  });
+
+  it("imports a skill into an immutable digest directory and materializes a selected run plugin", async () => {
+    const root = await makeRoot();
+    const source = await makeSkill(root, "typst", "Typst help");
+    const storeRoot = join(root, "store");
+
+    const installed = await importSkillDirectory({ sourceDir: source, storeRoot });
+    expect(installed).toMatchObject({ name: "typst", description: "Typst help" });
+    expect(installed.contentDigest).toMatch(/^[a-f0-9]{64}$/);
+    await expect(readFile(join(storeRoot, "versions", installed.contentDigest, "SKILL.md"), "utf8"))
+      .resolves.toContain("name: typst");
+
+    const plugin = await prepareRunSkillPlugin({
+      storeRoot,
+      runId: "run-1",
+      skills: [{ name: "typst", version: "0.15.0", contentDigest: installed.contentDigest }],
+    });
+    expect(plugin).not.toBeNull();
+    expect(plugin?.skillIds).toEqual(["cph-runtime:typst"]);
+    await expect(readFile(join(plugin!.root, "skills", "typst", "reference.md"), "utf8"))
+      .resolves.toBe("reference\n");
+
+    await plugin?.cleanup();
+    await expect(readFile(join(plugin!.root, ".claude-plugin", "plugin.json"), "utf8"))
+      .rejects.toMatchObject({ code: "ENOENT" });
+  });
+
+  it("rejects symlinks and detects content tampering before a run", async () => {
+    const root = await makeRoot();
+    const source = await makeSkill(root, "outline", "Outline");
+    await symlink(join(source, "reference.md"), join(source, "link.md"));
+    await expect(importSkillDirectory({ sourceDir: source, storeRoot: join(root, "store") }))
+      .rejects.toThrow(/symlink/);
+    await rm(join(source, "link.md"));
+
+    const storeRoot = join(root, "store");
+    const installed = await importSkillDirectory({ sourceDir: source, storeRoot });
+    await writeFile(join(storeRoot, "versions", installed.contentDigest, "reference.md"), "tampered\n");
+    await expect(prepareRunSkillPlugin({
+      storeRoot,
+      runId: "run-2",
+      skills: [{ name: "outline", version: "1", contentDigest: installed.contentDigest }],
+    })).rejects.toThrow(/content digest mismatch/);
+  });
+
+  async function makeRoot(): Promise<string> {
+    const root = await mkdtemp(join(tmpdir(), "cph-skill-store-"));
+    roots.push(root);
+    return root;
+  }
+});
+
+async function makeSkill(root: string, name: string, description: string): Promise<string> {
+  const source = join(root, "source", name);
+  await mkdir(source, { recursive: true });
+  await writeFile(join(source, "SKILL.md"), `---\nname: ${name}\ndescription: ${description}\n---\n# ${name}\n`);
+  await writeFile(join(source, "reference.md"), "reference\n");
+  return source;
+}