zy95-12 · Nov 4, 2026 · Nov 4, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -1,3 +1,3 @@
 # AGENTS.md

 Instructions for AI coding agents that work on this repository. Human contributors: see [CONTRIBUTING.md](CONTRIBUTING.md), which has the same rules with more detail.
@@ -33,7 +33,8 @@
 
 For runtime Project roles (#2331), exact-candidate Reviewer approve enters the
 host merge flow only under explicit operator Project/repository/base/check policy.
-Roles do not execute merge commands or receive credentials. This is separate from
+Roles do not execute merge commands. #2365 explicitly permits role-bound App
+credentials through dedicated helpers; no Owner fallback or generic Token export. This is separate from
 signed forge Review PASS and Chief Task acceptance; actual branch gates still apply.
 Contributor PRs to FlyBot retain the pipeline rules and current Owner-authorized
 target-branch scope below. See [decision](decisions/2026-11-04-reviewed-host-merge.md).
@@ -323,7 +324,7 @@
 ## Hard rules
 
 1. **Build on DSH; never patch it.** Bot features use the documented plugin APIs. The desktop app starts DSH only through its documented entry points (`@deepseek-ai/dsh/profile-boot`, the `dsh` CLI). Never patch DeepSeek Harness or depend on files inside a DSH install. If something is missing in DSH, stop and say so; do not work around it with a patch.
-2. **No secrets.** Never write, print or commit API keys, tokens, cookies or `DSH_HOME` contents. Use the mock model (`core/dev/mock-llm.mjs`) for tests; it needs no key. Every one of the owner's own Bots gets the owner's saved keys on every turn (owner decision 2026-10-22, #601); a key a shell cannot use is named in `DSH_SECRETS_WITHHELD` (`NAME:reason`, never a value: `remote-bot`, `not-in-scope`, `unknown-bot`): read the reason instead of assuming the owner did not configure it.
+2. **No secrets.** Never write, print or commit API keys, tokens, cookies or `DSH_HOME` contents. Use the mock model (`core/dev/mock-llm.mjs`) for tests; it needs no key. Except App-bound Project roles (saved keys withheld as `project-role-app`), every one of the owner's own Bots gets the owner's saved keys on every turn (owner decision 2026-10-22, #601); a key a shell cannot use is named in `DSH_SECRETS_WITHHELD` (`NAME:reason`, never a value: `remote-bot`, `not-in-scope`, `unknown-bot`): read the reason instead of assuming the owner did not configure it.
 3. **Only original material.** Do not copy code, text, icons, logos or graphics from other products or websites.
 4. **The core is ds-bot + patches.** Change `core/`, then run `node scripts/ds-bot-patches.mjs generate` and `check`, and commit `core/` and `patches/` together. CI fails if `ds-bot/` differs from the pin or `core/` differs from `ds-bot/` + patches.
 5. **`client.js` is generated.** Change `core/src/client/`, then run `npm run build` in `core/` and commit both files. Never edit `client.js` by hand.

diff --git a/PROJECT.md b/PROJECT.md
@@ -8,6 +8,14 @@ architecture lives in [docs/architecture.md](docs/architecture.md) and
 Current stage and priorities: [ROADMAP.md](ROADMAP.md). How decisions are made:
 [docs/governance.md](docs/governance.md). Dated decisions: [decisions/](decisions/README.md).
 
+## Role App delivery — 2026-11-04
+
+#2365 opts Project roles into explicit App connections and dedicated short-lived
+credential helpers. Original candidate Effects observe SDK commits/PRs without
+resealing; actual App Review and host merge/Chief acceptance stay separate.
+No Owner fallback or live migration. [Decision](decisions/2026-11-04-role-github-apps.md)
+and [operator contract](docs/role-github-apps.md); live App acceptance requires authorized installations.
+
 ## Follow-up reliability delivery — 2026-11-04
 
 Owner authorizes sequential #2336/#2337/#2334/#2346/#2338/#2347/#2331/#2342
@@ -35,44 +43,13 @@ abort other decisions. No automatic business escalation or live rollout. See
 [delivery contract](docs/subsystems/project-delivery.md). Live Task mutation and
 deployment remain separate from source/test delivery.
 
-## Agent connection authorization — 2026-11-03
-
-#2308 unifies native/external personal-agent processing through the existing
-consultation store, committed Effects and scoped leases. Signed, explicitly
-verified Webhook notifications and native wakeups both lead to the same inbox
-service; private messages stay outside public SSE. [Contract](docs/agent-inbox.md).
-Actual isolated DSH/HTTP and a separate receiver pass with deterministic inference;
-live vendor acceptance and deployment remain separate. #2311 adds App installation credentials alongside gh-cli, human-only connection selection, and original broker/Effects identity fencing. [Credential contract](docs/github-automation.md); live App acceptance needs authorized test resources.
-
-#2300 publishes the source-matched public [OpenAPI contract](docs/openapi/flybot.openapi.json)
-and [third-party Bot guide](docs/third-party-bot-integration.md). Human-issued FBA scope,
-safe/watch rights, same-principal receipts and host-only role execution remain distinct.
-This adds contract/docs and isolated HTTP conformance checks, not runtime authority,
-vendor callback adapters, service deployment or the deferred cross-repository loop.
-
-#2183 adds scoped agent credentials over the existing member-session HTTP channel,
-reuses per-participation safe/watch grants, and persists Task-origin provenance.
-Owner's closure confirmation remains personal; native/external personal agents may
-suggest closure without a Task. Real TCP contract tests are separate from actual
-provider adapters/login. Full operation receipts/events and transaction migration
-remain #2185/#2182; runtime cancellation remains #2184. No live rollout.
+## Established backend foundations
 
-## Independent personal-agent foundation — 2026-11-02
-
-#2170 introduces user-owned identities, per-Project participation/default routing,
-and migration that retains private carrier IDs, notes, conversations and Sessions.
-Leaving/retiring revokes only that agent's grants and preserves private history.
-External descriptors remain unverified; authentication/transport and actual provider
-acceptance are #2183/#2185, compatibility #2186. This is source work, not live rollout.
-
-## Backend convergence — 2026-11-02
-
-Project convergence #2171 now adds explicit repository associations and non-destructive Owner double-confirmed closure on the delivery branch. It preserves unfinished Task records and memory; runtime source migration and new behavior are not deployed. Chief role proposals now require separate Maintainer/Owner approval with exact-hash/revision fencing and durable Effects proof; retirement preserves Task/Session and room history. Real-provider custom-role execution remains #2184 acceptance, and later convergence issues remain active.
-
-Native execution convergence #2184 now adds matching physical Session bindings and observed
-Agent quiescence before Bot removal/resource release. Role retirement/capability changes
-cannot restart pinned execution under stale authority. Deterministic runtime acceptance
-and real-provider Task loops remain separate; this work is not deployed. Custom-role artifact verification and SDK capability policy now have actual Git/host-test and subprocess contract coverage. Verified supervisor exit now supports native prior-host recovery; unmanaged/unknown exit stays held. Canonical in-flight role/resource revocation now reuses current authority checks and the existing pool stop/scheduler; unknown exit retains capacity. Composed-stack acceptance and real-provider native continuation remain active acceptance. Native activation now requires committed Effects proof and pre-step admission. The actual DSH native return loop now passes with deterministic inference, retained prior conversation and one resource.
+Dated agent-connection, personal-agent and backend-convergence implementation
+checkpoints are [preserved verbatim](docs/history/2026-11-04-agent-foundation-checkpoints.md).
+Current authority, same-principal inbox/receipt, public OpenAPI and native/external
+agent contracts remain in their subsystem pages; source/fixture results do not
+complete live App/provider/release/multi-repository/UI acceptance or authorize deployment.
 
 ## Fork Project State — 2026-10-31
 
@@ -149,20 +126,11 @@ resource/Harness contracts and authorized acceptance boundaries remain below.
 
 M7.4/M7.5 implementation checkpoints are [archived verbatim](docs/history/2026-11-03-completed-m7-checkpoints.md). Private credentials, revocation, exit proof, same-SHA verification and outstanding mixed-Harness/resource acceptance remain required.
 
-### M7 Codex-only acceptance authorization — 2026-11-01
-
-The owner authorized existing zy95-12 GitHub and Codex authentication on this machine
-for real Codex validation. A private selected profile outside the repository is used;
-no auth values, unrelated Codex history or connector configuration are copied into the
-repository. The opt-in `--codex-check` exercises the native host/Workflow with real SDK
-Chief/Dev/Tester/Reviewer and draft PR evidence. Claude and mixed-resource acceptance
-remain separate. No merge or production deployment is authorized by this validation.
+### Historical Codex acceptance
 
-The scoped local Codex demonstration passed at clean source `73161f3`: actual Chief,
-Dev/Tester/Reviewer, immutable tests, matching-SHA draft PRs #31/#32, requested-test
-return/retry/re-review and scripted owner acceptance. Workers/workspaces were released.
-[Evidence](dev/demo/evidence/codex-2026-11-01.json) distinguishes this from the outstanding
-Claude/mixed-resource/browser/restart criteria and independent repository review.
+The explicitly authorized 2026-11-01 Codex demonstration and its scope are retained
+in [the dated record](docs/history/2026-11-04-agent-foundation-checkpoints.md).
+It grants no new deployment, App installation or personal credential authority.
 
 ### Collaboration contract and earlier validation
 

diff --git a/README.md b/README.md
@@ -92,3 +92,6 @@ HTTP 入口为 `POST /api/bot`、事件为 `GET /api/project-events`，
 自动测试通过、真实 SDK 验证、浏览器验收、PR 合入与生产部署分别记录；本分支不承诺未验证的完整真实模型开发闭环。
 
 项目自动化支持显式 gh-cli 或 GitHub App installation；人类选择已预置连接，个人用户授权独立。见 [GitHub配置与身份](docs/github-automation.md)。
+
+项目角色可选择以独立 GitHub App 直接提交、开 Draft PR 和 Review；复用现有连接与资源配置。
+见 [角色 App 配置、认证与恢复](docs/role-github-apps.md)。默认不启用，不需要全局 gh 登录。
diff --git a/README.zh.md b/README.zh.md
@@ -92,3 +92,6 @@ HTTP 入口为 `POST /api/bot`、事件为 `GET /api/project-events`，
 自动测试通过、真实 SDK 验证、浏览器验收、PR 合入与生产部署分别记录；本分支不承诺未验证的完整真实模型开发闭环。
 
 项目自动化支持显式 gh-cli 或 GitHub App installation；人类选择已预置连接，个人用户授权独立。见 [GitHub配置与身份](docs/github-automation.md)。
+
+项目角色可选择以独立 GitHub App 直接提交、开 Draft PR 和 Review；复用现有连接与资源配置。
+见 [角色 App 配置、认证与恢复](docs/role-github-apps.md)。默认不启用，不需要全局 gh 登录。
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -1,5 +1,12 @@
 # FlyBot — Roadmap
 
+## Role App execution — 2026-11-04
+
+#2365 targets delivery with trusted role binding, local/Docker credential helpers,
+exact SDK candidate/PR adoption and independent actual App Review. Preserve existing
+Task-role context and host gates. Tests/actual SDK fixtures and real App write
+acceptance are distinct; no live credential changes or rollout are authorized.
+
 ## Follow-up reliability — 2026-11-04
 
 Implement #2336 reservation cleanup first; then #2337 CLI configuration, #2334

diff --git a/changelog.d/2365.added.md b/changelog.d/2365.added.md
@@ -0,0 +1 @@
+Add opt-in role-bound GitHub Apps for direct SDK/native commit, Draft PR and Review operations, with short-lived scoped credentials and durable adoption of the original SDK commit/PR. Preserve independent host tests, explicit merge gates and existing personal-agent authorization.
diff --git a/core/src/host/project-codex-config.js b/core/src/host/project-codex-config.js
@@ -5,6 +5,7 @@ import { dirname, join, delimiter } from 'node:path'
 import { createInterface } from 'node:readline'
 
 const failure = code => Object.assign(new Error('Codex configuration is not ready; verify the selected resource CLI version and remove conflicting legacy sandbox settings before retrying'), { code: 'bot/harness-capability', capability: code })
+const sameRules = (actual, expected) => JSON.stringify(Object.entries(actual ?? {}).sort()) === JSON.stringify(Object.entries(expected).sort())
 const object = value => value !== null && typeof value === 'object' && !Array.isArray(value)
 const toml = value => object(value) ? '{' + Object.entries(value).filter(([, child]) => child !== undefined).map(([key, child]) => `${JSON.stringify(key)}=${toml(child)}`).join(',') + '}' : Array.isArray(value) ? '[' + value.map(toml).join(',') + ']' : JSON.stringify(value)
 export function codexConfigArguments(config, overrides = []) {
@@ -91,7 +92,7 @@ export async function validateCodexConfiguration(request, options, { executable,
     // layers establish a conflict. Never log their values or credential material.
     if (!Array.isArray(resolved.layers) || resolved.layers.some(layer => Object.hasOwn(layer.config ?? {}, 'sandbox_mode') || Object.hasOwn(layer.config ?? {}, 'sandbox_workspace_write')) || resolved.config?.default_permissions !== 'flybot-role') throw failure('legacy-sandbox-conflict')
     const profile = resolved.config?.permissions?.['flybot-role']
-    if (profile?.extends !== (request.readOnly ? ':read-only' : ':workspace') || profile.filesystem?.[':tmpdir'] !== 'write' || Object.keys(profile.filesystem ?? {}).some(key => key.startsWith(':') && key !== ':tmpdir') || profile.network?.mode !== 'limited' || Object.keys(profile.network?.domains ?? {}).length || resolved.config?.features?.network_proxy !== true) throw failure('permission-profile-mismatch')
+    if (profile?.extends !== (request.readOnly ? ':read-only' : ':workspace') || profile.filesystem?.[':tmpdir'] !== 'write' || Object.keys(profile.filesystem ?? {}).some(key => key.startsWith(':') && key !== ':tmpdir') || profile.network?.mode !== 'limited' || !sameRules(profile.network?.domains, request.roleGithub ? { 'github.com': 'allow', 'api.github.com': 'allow' } : {}) || !sameRules(profile.network?.unix_sockets, {}) || resolved.config?.features?.network_proxy !== true) throw failure('permission-profile-mismatch')
   }
   return { codexPathOverride: executable, env, capability: { kind: 'codex-cli-config/v1', version: '0.166.0', profile: request.noTools ? 'chief-read-only' : 'flybot-role', modelInvoked: false } }
 }
diff --git a/core/src/host/project-delivery-template.js b/core/src/host/project-delivery-template.js
@@ -1,12 +1,12 @@
 // One versioned path through the existing Workflow plugin; no second execution engine.
-export const DELIVERY_VERSION = 'project-delivery/v8'
+export const DELIVERY_VERSION = 'project-delivery/v9'
 export const DELIVERY_ROLES = ['developer', 'tester', 'reviewer']
 export function deliveryGraph(model = '') {
   return {
     maxConcurrent: 1,
     nodes: [
       { id: 'developer', name: 'Developer', role: 'Developer', model, tools: [],
-        prompt: 'Implement the task in your assigned worktree. Read the acceptance criteria, edit code and tests. Do not publish, change credentials or edit outside this worktree. The host seals the candidate commit. Finish with OUTPUT implementation: a concise change summary.',
+        prompt: 'Implement the task in your assigned worktree. Read the acceptance criteria, edit code and tests. Do not change credentials or edit outside this worktree. Follow the explicit role App publication contract when supplied; otherwise do not publish and let the host seal the candidate commit. Finish with OUTPUT implementation: a concise change summary.',
         outputs: [{ name: 'implementation', required: true }] },
       { id: 'tester', name: 'Tester', role: 'Tester', model, tools: [],
         prompt: 'Inspect the implementation in your assigned worktree. Do not edit files. The host independently runs the configured tests against the sealed commit. Finish with OUTPUT tests: your analysis of relevant test coverage.',
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Add opt-in role-bound GitHub Apps for direct SDK/native commit, Draft PR and Review operations, with short-lived scoped credentials and durable adoption of the original SDK commit/PR. Preserve independent host tests, explicit merge gates and existing personal-agent authorization.