docs: add voice, question, and subagent rows to the Harness matrix

.agents/skills/codexhost-release/SKILL.md

@@ -17,6 +17,7 @@ description: 发布 codexhost 正式版、预览版，编写或确认 Release No
 - `.github/workflows/release-packages.yml` 与 `.github/workflows/ci.yml`
 - `packages/repository-automation/src/release.mjs`
 - `docs/operations/repository-maintenance.md`
+- 本仓库若是 fork `karlorz/codex-host`：先读 [fork versioning](../../../docs/operations/fork-versioning.md)（`0.13.3-0` / `0.13.3-1`…，控制台版本同源），再读本 Skill 的上游渠道表
 - 涉及更新提示时：`packages/update-manager/src/github-release.ts`
 
 源码和工作流是执行行为的依据。发现指南与当前实现不一致时，说明差异；不要假装已有不支持的发布能力。
@@ -38,6 +39,8 @@ description: 发布 codexhost 正式版、预览版，编写或确认 Release No
 
 用户意图不清楚时，先问清两个渠道的目标。最终执行前明确报告版本、npm dist-tag、GitHub 状态与是否提示更新。
 
+在 `karlorz/codex-host` 上，上表的 BytePioneer npm `@codexhost/cli` / 正式 GitHub latest **不适用**。Fork 标签跟随当前 upstream 版本加计数器（upstream 为 `0.13.3` 时用 `v0.13.3-0`、`v0.13.3-1`，不要写成 `0.13.3-cpa.1`）。不向 `upstream` 推送。Fork **必须**把同一版本发布为 `@karlorz/codexhost-cli@latest`（及对应平台包），并把 `karlorz/codex-host` 上的 GitHub Release 标成 latest，这样 Settings 的 `npm install -g @karlorz/codexhost-cli@latest` 和 in-app Update 才指向 fork。禁止发布 `@codexhost/*`。`Release packages` 已启用，Trusted Publisher 指向 `karlorz/codex-host`；数字计数（如 `0.13.3-0`、`0.13.3-1`）由工作流发成 npm `latest` + GitHub latest。控制台「codexhost 版本」必须与该准备版本一致。`gh pr create` / `gh release` 必须带 `-R karlorz/codex-host`。规则全文：[fork versioning](../../../docs/operations/fork-versioning.md)。
+
 ## 2. 检查现场与验证
 
 1. 检查工作区、当前分支、远端与已有标签；快进同步 `main`，不覆盖无关修改。

.agents/skills/codexhost-release/references/release-guide.md

@@ -20,7 +20,7 @@
 | 稳定 SemVer，默认发布 | `latest` | 正式 Release、latest |
 | 稳定 SemVer，手动发布且 `github_prerelease=true` | `latest` | Prerelease、非 latest |
 
-静默预览发行用于“小修复让用户自行下载，但不推送更新提示”：npm 正常发布到 `latest`，GitHub 标记为 Prerelease。当前更新检查读取 GitHub 正式 latest Release，不读取 npm dist-tag；预览发行仍公开可下载。SemVer 预发布则在 npm 使用 `next`，用户需显式安装 `@codexhost/cli@next`。
+静默预览发行用于“小修复让用户自行下载，但不推送更新提示”：npm 正常发布到 `latest`，GitHub 标记为 Prerelease。当前更新检查读取 GitHub 正式 latest Release，不读取 npm dist-tag；预览发行仍公开可下载。SemVer 预发布则在 npm 使用 `next`，用户需显式安装 `@karlorz/codexhost-cli@next`。
 
 ## 发布步骤
 
@@ -104,7 +104,7 @@ Composer 增加 Harness 命令按钮和模型搜索。Grok 支持自动或手动
 ### npm
 
 ```bash
-npm install -g @codexhost/cli
+npm install -g @karlorz/codexhost-cli
 codexhost
 ```
 
@@ -178,7 +178,7 @@ Tag 推送后，GitHub Actions 会自动：
 - 校验 Tag、npm 版本和 Cargo Workspace 版本一致。
 - 构建 Windows x64/arm64 EXE。
 - 构建 macOS x64/arm64 DMG。
-- 发布 macOS、Windows、Linux 的 x64/arm64 共六个平台 npm 包和 `@codexhost/cli` 元包。
+- 发布 macOS、Windows、Linux 的 x64/arm64 共六个平台 npm 包和 `@karlorz/codexhost-cli` 元包。
 - 根据版本及手动发布输入创建公开 GitHub Release Prerelease 或正式 Release；`test` 渠道不创建 GitHub Release。
 - GitHub Release 只上传四个安装包，不上传 npm tarball。
 

.agents/skills/codexhost-update-impact-audit/SKILL.md

@@ -89,7 +89,7 @@ Read the current call sites and follow each surface independently from discovery
 - sidebar decoration;
 - settings entry;
 - Fork;
-- Codex usage gate (`renderer-codex-usage-gate.ts`, driven by `renderComposerAgentControl`'s external-submission readiness);
+- Codex usage gate (`renderer-codex-usage-gate.ts`, driven by `renderComposerAgentControl`'s usage-gate allowance for Codex or a ready external Adapter);
 - Host create and subsequent-Turn routing.
 
 Prefer unique semantic candidates plus ownership checks. Record fail-closed behavior for absent or ambiguous candidates. Keep source relocation separate from an actual anchor or ownership change.
@@ -126,9 +126,11 @@ Use `tools/renderer-binding/run.mjs` only when a clean controlled lifecycle, rel
 
 The runner does not accept the `.app` directory. A controlled flow may verify Agent switching, stale-prewarm clearing, new Thread creation, title behavior, or Fork. State clearly when user interaction or creation boundaries were not exercised.
 
+For a requested live-voice fix on an already running Desktop, use the narrow live voice-hook refresh in [cpa-live-voice-desktop-hook.md](../../../docs/operations/cpa-live-voice-desktop-hook.md#live-voice-hook-debug-on-a-running-desktop) to validate the current document without a full Desktop restart. Keep the read-only probe first and skip mutation during an active or unknown call.
+
 ### Codex usage gate probe
 
-This surface lets an external Harness submit while the ChatGPT-signed-in Codex subscription is out of usage by projecting `false` for one Composer's two Desktop usage-gate subscriptions. It depends on private React/state-library internals, so check it on every update. `npm run audit:codex-desktop` reports its structure as the `codex-usage-gate` surface (see `tools/codex-desktop-contract-audit/README.md`); `codex-usage-account-gate-dormant` means the audit ran without a ChatGPT sign-in whose Account gate reads usage. The audit does not verify behavior.
+This surface lets a Composer submit while the ChatGPT-signed-in Codex subscription is out of usage by projecting `false` for one Composer's two Desktop usage-gate subscriptions. It depends on private React/state-library internals, so check it on every update. `npm run audit:codex-desktop` reports its structure as the `codex-usage-gate` surface (see `tools/codex-desktop-contract-audit/README.md`); `codex-usage-account-gate-dormant` means the audit ran without a ChatGPT sign-in whose Account gate reads usage. The audit does not verify behavior.
 
 Bundle evidence (evidence only, not contracts): the Composer owner combines `submitDisabled` from an Account rate-limit selector (`authMethod !== "chatgpt"` early return, then `rate_limit.allowed === false`, gated to host `local`) and a reserve `hardBlocked` selector. Confirm both still exist and still feed `submitDisabled`, and that no new Account-wide usage blocker was added beside them. If Desktop now exempts external models/Threads or stops blocking in the Renderer, report that the module can be removed.
 
@@ -141,7 +143,7 @@ Manual read-only live probe, when the audit surface is not `no-impact` or its co
 
 With codexhost running and an external Agent selected, bound gates show an instance `getSnapshot` of `() => false` for both hooks. The Agent control's hover title shows the "cannot separate from Codex usage" message when binding failed.
 
-Behavioral check requires a ChatGPT account that is out of Codex usage; API-key sign-in never triggers the gate. With non-empty text and an external Agent, Send is enabled in a new draft and an existing Thread; after switching to Codex it returns to disabled. Do not submit a message unless the user asks. Remove any temporary text without touching text the user typed. Report `unverified` when no exhausted account is available.
+Behavioral check requires a ChatGPT account that is out of Codex usage; API-key sign-in never triggers the gate. With non-empty text, Send and Enter are enabled in a new draft, an existing Thread, and a Codex Thread. Do not submit a message unless the user asks. Remove any temporary text without touching text the user typed. Report `unverified` when no exhausted account is available.
 
 Completion criterion: no surface receives a live verdict from bundle inspection alone.
 
@@ -161,7 +163,7 @@ For a requested fix:
 1. Add a regression test that models the observed DOM, Fiber, API-shape, visual relationship, or routing boundary.
 2. Run it red for the observed reason.
 3. Make one minimal production change in the owning module.
-4. Run it green and repeat the relevant live probe.
+4. Run it green and repeat the relevant live probe. For a requested live-voice fix, use the same narrow refresh linked under Controlled probe.
 
 A test that proves only that a control exists or a mock was called does not prove visual alignment, ownership, or routing.
 
@@ -205,5 +207,5 @@ Do not bury the answer in the evidence. “Frontend changed” and “codexhost
 - Declaring Host routing, title creation, or Fork healthy without exercising that boundary.
 - Updating multiple controls before isolating the failed ownership contract.
 - Reformatting, resetting, staging, or overwriting unrelated work while investigating.
-- Declaring the Codex usage gate healthy from a Codex-selected, empty, API-key-signed-in, or not-exhausted Composer; only the external Agent path with exhausted ChatGPT usage exercises it.
+- Declaring the Codex usage gate healthy from an empty, API-key-signed-in, or not-exhausted Composer; exhausted ChatGPT usage on a new draft, existing Thread, or Codex Thread exercises it.
 - Checking only the Send button's DOM `disabled`; Desktop also guards Enter and the submit function with the same `submitDisabled`.

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   pull_request:
     paths-ignore:
       - "docs/**"
@@ -92,6 +93,19 @@ jobs:
           --exclude 'packages/renderer-extension/test/**'
           --exclude 'tools/gate-claude-code/run.test.mjs'
 
+      # Asset pairs and export contracts differ even when About versions match.
+      - name: Test Windows native voice profiles
+        if: runner.os == 'Windows'
+        run: >
+          npx vitest run --config tests/vitest.config.js
+          packages/renderer-extension/test/renderer-voice-assets.test.ts
+          packages/renderer-extension/test/renderer-client-owned-voice.test.ts
+          packages/renderer-extension/test/renderer-native-chat-voice.test.ts
+          packages/renderer-extension/test/renderer-voice-settings.test.ts
+          packages/renderer-extension/test/renderer-voice-start-capability.test.ts
+          packages/renderer-extension/test/renderer-external-voice-launch.test.ts
+          packages/renderer-extension/test/renderer-voice-capability.test.ts
+
       # Rust formatting is already covered by the Linux x64 formatting step.
       - name: Check Rust
         run: >

.github/workflows/compat-daily.yml

@@ -0,0 +1,180 @@
+name: Compat Daily
+
+# Compare macOS ChatGPT/Codex Desktop Sparkle latest to Renderer voice pins.
+# Opens one GitHub issue per surface when a pin is behind. Does not download the .app.
+
+on:
+  schedule:
+    - cron: "17 7 * * *"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - tools/compat-daily/**
+      - .github/workflows/compat-daily.yml
+      - packages/renderer-extension/src/renderer-client-owned-voice.ts
+      - crates/platform/src/asar_metadata.rs
+      - crates/platform/src/installation.rs
+      - packages/renderer-extension/src/renderer-voice-assets.ts
+      - packages/renderer-extension/src/renderer-native-chat-voice-assets.ts
+      - packages/renderer-extension/src/renderer-native-chat-voice.ts
+      - packages/renderer-extension/src/renderer-voice-start-capability.ts
+  pull_request:
+    paths:
+      - tools/compat-daily/**
+      - .github/workflows/compat-daily.yml
+      - packages/renderer-extension/src/renderer-client-owned-voice.ts
+      - crates/platform/src/asar_metadata.rs
+      - crates/platform/src/installation.rs
+      - packages/renderer-extension/src/renderer-voice-assets.ts
+      - packages/renderer-extension/src/renderer-native-chat-voice-assets.ts
+      - packages/renderer-extension/src/renderer-native-chat-voice.ts
+      - packages/renderer-extension/src/renderer-voice-start-capability.ts
+
+permissions:
+  contents: read
+
+jobs:
+  pins:
+    name: macOS voice release pins
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+
+      - name: Unit-test pin parser
+        run: node --test tools/compat-daily/run.test.mjs
+
+      - name: Compare Sparkle latest to voice pins
+        id: compare
+        run: |
+          set -o pipefail
+          node tools/compat-daily/run.mjs | tee compat-daily.json
+
+      - name: Open or update issues on pin drift
+        if: failure() && steps.compare.outcome == 'failure' && github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const report = JSON.parse(fs.readFileSync('compat-daily.json', 'utf8'));
+            if (report.error) return;
+            const findings = Array.isArray(report.findings) ? report.findings : [];
+            if (findings.length === 0) return;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            for (const name of ['compat-broken', 'bug']) {
+              try {
+                await github.rest.issues.getLabel({ owner, repo, name });
+              } catch (error) {
+                if (error.status !== 404) throw error;
+                await github.rest.issues.createLabel({
+                  owner,
+                  repo,
+                  name,
+                  color: name === 'bug' ? 'd73a4a' : 'e4e669',
+                  description: name === 'bug' ? 'Something is broken' : 'compat-daily Desktop pin drift',
+                });
+              }
+            }
+
+            const { data: open } = await github.rest.issues.listForRepo({
+              owner,
+              repo,
+              state: 'open',
+              labels: 'compat-broken',
+              per_page: 100,
+            });
+            for (const finding of findings) {
+              const dup = open.find((issue) => issue.title === finding.title);
+              const body = [
+                finding.detail,
+                '',
+                `- macOS Desktop: \`${report.latest?.version ?? 'unknown'}\` build \`${report.latest?.build ?? 'unknown'}\``,
+                `- Event: \`${context.eventName}\``,
+                `- Checked commit: \`${context.sha}\` (\`${context.ref}\`)`,
+                `- Run: ${runUrl}`,
+                '',
+                'Auto-opened by `.github/workflows/compat-daily.yml` on this repository.',
+              ].join('\n');
+              if (dup) {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: dup.number,
+                  body: `macOS pin drift re-failed ${new Date().toISOString().slice(0, 10)} — ${runUrl}\n\nChecked commit: \`${context.sha}\` (\`${context.ref}\`)`,
+                });
+              } else {
+                await github.rest.issues.create({
+                  owner,
+                  repo,
+                  title: finding.title,
+                  labels: ['compat-broken', 'bug'],
+                  body,
+                });
+              }
+            }
+
+      - name: Comment on matching voice pins
+        if: always() && (steps.compare.outcome == 'success' || steps.compare.outcome == 'failure') && github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const report = JSON.parse(fs.readFileSync('compat-daily.json', 'utf8'));
+            if (report.error || !report.latest || !report.pins) return;
+            const { recoveredPinIssues } = await import(`${process.env.GITHUB_WORKSPACE}/tools/compat-daily/run.mjs`);
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner, repo, state: 'open', labels: 'compat-broken', per_page: 100,
+            });
+            for (const issue of recoveredPinIssues(report, issues)) {
+              const marker = `<!-- compat-daily:matched:${issue.surface}:${issue.version} -->`;
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                owner, repo, issue_number: issue.number, per_page: 100,
+              });
+              if (comments.some(comment => comment.user?.type === 'Bot' && comment.body?.includes(marker))) continue;
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: issue.number,
+                body: `${marker}\nThe macOS ${issue.surface} pin is now ${issue.version}, matching this issue's tracked Desktop target or the current macOS Sparkle release. Current macOS Sparkle: ${report.latest.version}. Any newer version drift is reported separately. This check does not verify microphone capture, connected audio or conversation lifecycle; the issue remains open for acceptance review.\n\nChecked commit: \`${context.sha}\` (\`${context.ref}\`)\nRun: ${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`,
+              });
+            }
+
+  windows-msix:
+    name: Windows MSIX metadata and voice contracts
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+      - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: npm ci --prefer-offline
+      - name: Test bounded ASAR metadata
+        run: cargo test --locked -p codexhost-platform asar_metadata
+      - name: Test MSIX identity and product detection
+        run: cargo test --locked -p codexhost-platform installation::windows_tests
+      - name: Build TypeScript
+        run: npm run build:typescript
+      - name: Test platform profile selection and bootstrap
+        run: >
+          npx vitest run --config tests/vitest.config.js
+          packages/renderer-extension/test/renderer-voice-assets.test.ts
+          packages/desktop-control/test/cpa-live-voice-hook.test.ts

Cargo.toml

@@ -15,7 +15,7 @@ default-members = [
 resolver = "3"
 
 [workspace.package]
-version = "0.14.0"
+version = "0.14.0-3"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false