Sync upstream workspace protocol and preserve beta suspension

.env.example

@@ -4,46 +4,3 @@ OAC_WEB_DEV_PROXY_TARGET=http://127.0.0.1:8091
 
 # Core reads its own environment, not this file. Core settings, including
 # Runtime history sampling and export, are in docs/configuration.md.
-
-# Public, non-secret opt-in for the reviewed Codex self_hosted Session profile.
-# Leave unset unless Core execution, its executor registry, and executor origin
-# are configured. This flag is presentation policy, not capability discovery.
-# OAC_WEB_SELF_HOSTED_SESSIONS=1
-
-# Public, non-secret opt-in for the operator-qualified basic Codex
-# openai_hosted Session profile. Leave unset unless Core was started with a
-# qualified managed Runtime provider. This flag does not probe runtime readiness.
-# OAC_WEB_OPENAI_HOSTED_SESSIONS=1
-
-# Public, non-secret opt-in for the complete Environment Files profile. Leave
-# unset for older Core revisions. Enable only after the connected Core has been
-# qualified for Files.list and managed Files.create; self_hosted reads use its
-# exact workspace_directory root.
-# OAC_WEB_ENVIRONMENT_FILES=1
-
-# Optional local-only Docker backend recovery guide shown in the connection
-# panel. Web renders copyable `docker start` and loopback health commands; it
-# never accesses the Docker socket or executes them. Values are compiled into
-# the browser bundle and must contain non-secret container names only.
-# OAC_WEB_DOCKER_BACKEND_GUIDE=1
-# OAC_WEB_DOCKER_DATABASE_CONTAINER=oac-web-smoke-db
-# OAC_WEB_DOCKER_API_CONTAINER=oac-web-smoke-api
-# OAC_WEB_DOCKER_DAEMON_CONTAINER=oac-web-smoke-daemon
-# OAC_WEB_DOCKER_CORE_PORT=8091
-
-# Optional local-only Docker connection recipe. This renders a copyable command;
-# it never gives the browser Docker access or reads the credential file. Every
-# value below is compiled into the browser bundle, so values must be non-secret.
-# Enable only for the matching operator-controlled local stack.
-# OAC_WEB_DOCKER_GUIDE=1
-# OAC_WEB_DOCKER_IMAGE=oac-web-smoke-executor:2b34ea46-codex-0.153.4
-# OAC_WEB_DOCKER_API_CONTAINER=oac-web-smoke-api
-# OAC_WEB_DOCKER_USER=501:20
-# OAC_WEB_DOCKER_CREDENTIALS_HOME_PATH=.oac/web-smoke/executor-key.json
-# OAC_WEB_DOCKER_RUNTIME_HOME_PATH=.oac/web-smoke/executors
-
-# Public, non-secret suggestions shown by the Create Agent model picker. The
-# first entry is the default unless VITE_AGENT_DEFAULT_MODEL overrides it. These
-# do not claim live availability; the connected runtime remains authoritative.
-VITE_AGENT_MODEL_PRESETS=gpt-6-astra,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna,gpt-5.5,gpt-5.3-codex-spark
-VITE_AGENT_DEFAULT_MODEL=gpt-5.6-sol

.github/workflows/api-acceptance.yml

@@ -62,8 +62,9 @@ jobs:
           OAC_TEST_SERVER_BIN: ${{ runner.temp }}/oac-core-build/oac-core
           OAC_TEST_OFFICIAL_SDK_PYTHON: python
         run: |
+          python services/core/tests/official_schema_test.py
           python services/core/tests/official_client.py
-          go test ./services/core/internal/store -run '^(TestFunctionStateOfficialClientReadsAndLiveEvents|TestSavedReferenceRetryOfficialClient|TestAgentUpdateOfficialClient|TestAgentDeletionOfficialClient|TestSessionAgentFilterOfficialClient|TestSessionDeletionOfficialClient|TestEnvironmentInitialFailureOfficialClient|TestSelfHostedInitialCreationOfficialClient|TestSelfHostedCancellationOfficialClient|TestSelfHostedFunctionsOfficialClient|TestSelfHostedSteeringOfficialClient)$' -count=1
+          go test ./services/core/tests/integration -run '^(TestFunctionStateOfficialClientReadsAndLiveEvents|TestSavedReferenceRetryOfficialClient|TestAgentUpdateOfficialClient|TestAgentDeletionOfficialClient|TestSessionAgentFilterOfficialClient|TestSessionDeletionOfficialClient|TestEnvironmentInitialFailureOfficialClient|TestSelfHostedInitialCreationOfficialClient|TestSelfHostedCancellationOfficialClient)$' -count=1
       - uses: ./.github/actions/e2b-provider
         if: inputs.container
       - name: Verify the distribution's Core image

.github/workflows/check.yml

@@ -52,7 +52,7 @@ jobs:
       - name: Verify names, documentation and CI selection invariants
         run: make check-names check-docs check-ci
 
-  # Parts run in parallel; the serial store integration package is split into deterministic shards.
+  # Parts run in parallel; the serial integration package is split into deterministic shards.
   backend:
     needs: plan
     if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'backend')
@@ -62,11 +62,11 @@ jobs:
         include:
           - part: runtime
           - part: core
-          - part: store
+          - part: integration
             shard: 1/3
-          - part: store
+          - part: integration
             shard: 2/3
-          - part: store
+          - part: integration
             shard: 3/3
     name: backend (${{ matrix.part }}${{ matrix.shard && format(' {0}', matrix.shard) || '' }})
     runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
@@ -138,9 +138,9 @@ jobs:
       - name: Build standalone Core and test services and clients
         if: matrix.part == 'core'
         run: make build-core check-core-packages
-      - name: Test Core persistence shard ${{ matrix.shard }}
-        if: matrix.part == 'store'
-        run: make check-core-store OAC_CORE_STORE_SHARD=${{ matrix.shard }}
+      - name: Test Core integration shard ${{ matrix.shard }}
+        if: matrix.part == 'integration'
+        run: make check-core-integration OAC_CORE_INTEGRATION_SHARD=${{ matrix.shard }}
 
   distribution:
     needs: plan
@@ -184,15 +184,30 @@ jobs:
   compose:
     needs: plan
     if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'compose')
-    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
-    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            architecture: amd64
+          - runner: ubuntu-24.04-arm
+            architecture: arm64
+    runs-on: ${{ matrix.runner }}
+    env:
+      GOARCH: ${{ matrix.architecture }}
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
+      - name: Test the native Core installation lifecycle
+        run: go test ./services/core/cmd/oac -count=1 -timeout=3m
+      - uses: ./.github/actions/e2b-provider
+      - name: Build and verify the architecture-matched E2B helper
+        run: bash scripts/build-e2b-provider.sh
       - name: Allocate an isolated Compose project
         run: python3 -c 'import uuid; print("COMPOSE_SMOKE_PROJECT=oac-smoke-" + uuid.uuid4().hex)' >> "$GITHUB_ENV"
       - name: Build the images, start the installation and verify it

.github/workflows/ci-review.yml

@@ -16,12 +16,28 @@ permissions:
 
 jobs:
   review:
+    name: ${{ matrix.name }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - kind: code
+            name: Code review
+            instructions: |
+              检查本次代码改动的正确性、仓库设计规则及已有 CI 结果。先读取 AGENTS.md 和 CONTRIBUTING.md，再查看相关实现和测试。
+              用 gh pr checks 查询这个 PR 已有的检查结果，必要时读取 Actions 日志。检查失败、缺失或尚未完成时如实报告，不把合并当作检查通过的证据。
+              报告包括实际行为变化（1–3 条）、代码审查结论和 CI 状态。全部正常时保持简短；有问题时给出文件与行号、证据和最小修改建议。
+          - kind: docs
+            name: Docs review
+            instructions: |
+              每次都检查文档与本次代码变化是否一致，即使 PR 没改文档。读取相关实现、测试和完整文档，核对平台、命令、配置、路径、默认值、接口和操作流程，找出遗漏更新或已经过时的说明。
+              文档有修改（包括新增、删除和重命名）时，再检查文档内部及同主题文档间的矛盾、重复维护的事实、主题归属和中英文含义。按 AGENTS.md 和 CONTRIBUTING.md 的 Documentation ownership 表判断位置。必要的概述加链接、中英文对照和同一来源生成的文档不算重复。
+              分别报告“文档与代码一致性”和“文档矛盾、重复与归属”。未改文档时，第二项写“本次未修改文档”。只报告本次修改引入或使之过时的、有依据的问题，给出文件与行号、对应代码或文档依据，以及最小修改建议。测试或链接检查通过不代表语义一致。只报告影响读者理解或操作的具体问题，不把未穷举实现细节当作文档缺陷。
     if: github.event.pull_request.merged == true
     runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
     timeout-minutes: 30
     env:
-      # allowed_non_write_users turns on a subprocess secret scrub; opt out so Claude's
-      # commands can read GH_TOKEN and the Feishu webhook.
+      # Keep GH_TOKEN available to read the PR and Actions logs.
       CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: '0'
     steps:
       # The triggering revision is already on main, so its rules and code are trusted.
@@ -30,14 +46,15 @@ jobs:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: 2
           persist-credentials: false
-      - name: Review and send Feishu card with Claude Code
-        # Notification is best effort: a failed review or delivery never fails the job.
+      - name: Prepare the report schema
+        id: schema
+        run: python3 scripts/ci_review.py schema "${{ matrix.kind }}" >> "$GITHUB_OUTPUT"
+      - name: Review with Claude Code
+        id: llm
         continue-on-error: true
         timeout-minutes: 25
         uses: anthropics/claude-code-action@12dd8d74c712f5f3669365b2369b558c495b1104 # v1
         env:
-          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_WEBHOOK_URL }}
-          FEISHU_WEBHOOK_SECRET: ${{ secrets.FEISHU_WEBHOOK_SECRET }}
           ANTHROPIC_BASE_URL: https://api.minimax.cn/anthropic
           ANTHROPIC_AUTH_TOKEN: ${{ secrets.MINIMAX_API_KEY }}
           CLAUDE_CODE_AUTO_COMPACT_WINDOW: '524288'
@@ -54,29 +71,57 @@ jobs:
           allowed_bots: '*'
           allowed_non_write_users: '*'
           prompt: |
-            你是 CI 的负责人，负责审核 CI 结果并给出结论。
-            仓库 ${{ github.repository }} 的 PR #${{ github.event.pull_request.number }} 已合入 main：
-            - PR：https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}
-            - 合并 commit：${{ github.event.pull_request.merge_commit_sha }}（已 checkout 到当前目录）
-
-            用 gh pr checks ${{ github.event.pull_request.number }} --repo ${{ github.repository }} 查询这个 PR 已有的检查结果，必要时读取对应 Actions 日志。不要触发新的 CI，也不要把合并本身当作检查通过的证据；管理员可能绕过门禁。检查失败、缺失或尚未完成时如实报告。
+            你负责本次 PR 的 ${{ matrix.name }}，在独立上下文中完成审查。
+            仓库：${{ github.repository }}；PR：#${{ github.event.pull_request.number }}。
+            合并提交：${{ github.event.pull_request.merge_commit_sha }}，已检出到当前目录。
+            先用 gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} 读取变更清单与完整差异，再检查相关文件。
 
-            任务：给飞书群发一张中文卡片（Card 2.0）总结这次 CI，尽量在 10 轮以内给出结论，工具调用尽可能的并行。
-            环境里有 gh（已登录，GH_TOKEN）、git、node 和完整的仓库代码。
+            ${{ matrix.instructions }}
 
-            卡片要让手机上的读者快速看懂，如果一切正常，表达的尽可能简单，如果没有问题，尽量简洁：
-            1. 哪个 PR（github id + PR 标题 + 链接）
-              - 如：`github id: jing332, PR 标题: 添加一个新功能, 链接: https://github.com/org/repo/pull/123`
-            2. 改了什么（实际行为变化，1–3 条）
-              - 如：`添加了一个新功能、修改了 web 和 backend 的 CI`
-            3. 是否符合仓库规则（AGENTS.md、CONTRIBUTING.md 及相关文档）：未发现明确违规 / 发现需修复问题 / 信息不足，无法确认
-              - 如：`符合仓库规则`
-            4. CI 哪里失败、可能的原因（可以看日志），全部通过就直接说通过，不要给出细节。如果 CI 失败，则详细说明。
-              - 如：`CI 失败，具体是哪几个失败；全部通过 ✅`
-
-            发送：webhook 地址在环境变量 FEISHU_WEBHOOK_URL。
-            响应 code=0 才算成功，失败就排查并重试，直到发出去。最后用一句中文说明结果，如：`CI 结果已发送至飞书群`。
-            不要在输出里打印 webhook 地址和密钥。
+            按 JSON schema 返回中文报告。status 为 ok（未发现问题）、issues（发现有证据的问题）或 incomplete（审查失败、范围未检查完整或检查结果尚未完成）。有问题且仍有未检查项时，用 issues 并在对应字段中说明缺项。按 schema 把各项结论分别填入字段，不要重复标题；changes 用 1–3 条 Markdown 列表，其他字段无问题时一句话，有问题时保留依据和建议，遵守各字段长度限制。
+            围绕本次 diff 和受影响的文档展开，证据充分后输出结果，避免重复核对同一结论。
+            只读审查，不修改仓库，不触发新的 CI，不发送消息。两份报告会由后续 job 合并发送。
           claude_args: >-
-            --allowedTools Bash Read Write Edit Glob Grep WebFetch WebSearch
-            --max-turns 30
+            --allowedTools Bash Read Glob Grep
+            --json-schema '${{ steps.schema.outputs.schema }}'
+      - name: Save the review result
+        if: always()
+        env:
+          REVIEW_OUTCOME: ${{ steps.llm.outcome }}
+          REVIEW_RESULT: ${{ steps.llm.outputs.structured_output }}
+        run: python3 scripts/ci_review.py collect "${{ matrix.kind }}" "$RUNNER_TEMP/review-${{ matrix.kind }}.json"
+      - uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: ci-review-${{ matrix.kind }}
+          path: ${{ runner.temp }}/review-${{ matrix.kind }}.json
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 7
+
+  notify:
+    name: Combined Feishu notification
+    needs: review
+    if: always() && github.event.pull_request.merged == true
+    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          persist-credentials: false
+      - uses: actions/download-artifact@v6
+        continue-on-error: true
+        with:
+          pattern: ci-review-*
+          merge-multiple: true
+          path: ${{ runner.temp }}/reviews
+      - name: Send one card with both results
+        continue-on-error: true
+        env:
+          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_WEBHOOK_URL }}
+          FEISHU_WEBHOOK_SECRET: ${{ secrets.FEISHU_WEBHOOK_SECRET }}
+        run: python3 scripts/ci_review.py notify "$RUNNER_TEMP/reviews"

.github/workflows/e2b-template.yml

@@ -125,7 +125,6 @@ jobs:
           revision="$(git rev-parse HEAD)"
           for harness in codex claude mcode; do
             builder="scripts/build-$harness-runtime.sh"
-            if [[ "$harness" == codex ]]; then builder=scripts/build-agents-runtime.sh; fi
             AGENTS_RUNTIME_BUILD_DIR="$output_root/$harness" bash "$builder"
             docker build --platform linux/amd64 --tag "oac-e2b-$harness:$revision" "$output_root/$harness"
             image="$(docker image inspect --format '{{.Id}}' "oac-e2b-$harness:$revision")"

.github/workflows/native.yml

@@ -63,6 +63,14 @@ jobs:
         run: |
           go build -ldflags "-X github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/cli.Version=$(git rev-parse HEAD)" -o "$RUNNER_TEMP/oac-daemon${{ runner.os == 'Windows' && '.exe' || '' }}" ./apps/daemon/cmd/oac-daemon
           node --test scripts/build-native-installer.test.mjs
+      - name: Build and test the shared Core installer
+        run: |
+          go build -o "$RUNNER_TEMP/oac${{ runner.os == 'Windows' && '.exe' || '' }}" ./services/core/cmd/oac
+          go test ./services/core/cmd/oac -count=1 -timeout=3m
+      - name: Exercise the Windows Core launcher
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./deploy/test_install.ps1 -Binary "$env:RUNNER_TEMP/oac.exe"
       - name: Verify native download bootstrap and recovery
         run: go test ./services/core/internal/nativeinstaller -count=1 -timeout=3m
       - name: Native filesystem, authentication and process lifecycle
@@ -163,3 +171,17 @@ jobs:
           path: ${{ runner.temp }}/native-ci-diagnostics/
           retention-days: 7
           if-no-files-found: ignore
+
+  core-intel-mac:
+    name: Core installer (macOS Intel)
+    runs-on: macos-15-intel
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      - run: go test ./services/core/cmd/oac -count=1 -timeout=3m
+      - run: go build -o "$RUNNER_TEMP/oac" ./services/core/cmd/oac

.github/workflows/release.yml

@@ -114,6 +114,9 @@ jobs:
           path: ${{ runner.temp }}/native-artifacts
       - name: Assemble the native installation catalog
         run: node scripts/build-native-catalog.mjs "$RUNNER_TEMP/native-artifacts" "$RUNNER_TEMP/native-installers"
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
       - uses: ./.github/actions/e2b-provider
       - name: Build matched artifacts
         env:
@@ -124,17 +127,17 @@ jobs:
           CORE_DISTRIBUTION_OFFLINE: ${{ (github.event_name == 'push' || inputs.offline) && '1' || '0' }}
         run: |
           inputs="$HOME/.oac/build/release-inputs/inputs.json"
-          AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+          CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
           MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
-          export AGENTS_RUNTIME_CODEX_PACKAGE MCODE_HARNESS_BUILD_DIR
+          export CODEX_CLI_DIR MCODE_HARNESS_BUILD_DIR
           export CORE_DISTRIBUTION_RELEASE_BASE_URL="https://github.com/$RELEASE_REPOSITORY/releases/download/$RELEASE_TAG"
           bash scripts/build-core-distribution.sh
           mkdir -p "$HOME/.oac/build/release-upload"
           for asset in "$HOME/.oac/build/core-distribution/"*; do
             if [[ -f "$asset" ]]; then ln "$asset" "$HOME/.oac/build/release-upload/"; fi
           done
-          cp deploy/install.sh "$HOME/.oac/build/release-upload/install.sh"
-          (cd "$HOME/.oac/build/release-upload" && sha256sum install.sh > install.sh.sha256)
+          cp deploy/install.sh deploy/install.ps1 "$HOME/.oac/build/release-upload/"
+          (cd "$HOME/.oac/build/release-upload" && sha256sum install.sh > install.sh.sha256 && sha256sum install.ps1 > install.ps1.sha256)
       - name: Sign in to GHCR
         if: github.event_name == 'push' || inputs.draft_release
         env: