mindfn · mindfn · Aug 7, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/.env.example b/.env.example
@@ -1,5 +1,6 @@
 # ============================================================
-# Clowder AI — Environment Configuration
+# Cat Cafe / Clowder AI — Environment Configuration
+# 猫猫咖啡环境配置
 #
 # Copy this file to .env and fill in your values:
 #   cp .env.example .env
@@ -143,8 +144,6 @@ EMBED_MODE=off
 # GITHUB_REVIEW_IMAP_PASS=<auth-code>
 # GITHUB_REVIEW_IMAP_HOST=imap.qq.com
 # GITHUB_REVIEW_IMAP_PORT=993
-# Legacy-named token used only by background GitHub API review fetches.
-# Repository operations use the authenticated gh CLI; GitHub MCP is retired.
 # GITHUB_MCP_PAT=ghp_...
 
 # ── Optional: GitHub Repo Inbox Webhook（可选）───────────────

diff --git a/.githooks/pre-commit b/.githooks/pre-commit
@@ -169,6 +169,21 @@ if [ ${#hygiene_debris[@]} -gt 0 ] || [ ${#hygiene_unknown[@]} -gt 0 ]; then
   exit 1
 fi
 
+# ── Develop-base Runtime Guard (F257 #5 / dev-af6d4e28): develop_base = 白名单-only ──
+# develop_base 是运行基线分支：本地直接 commit 仅允许 §14 共享状态文档。
+# 代码改动一律 feature worktree → PR → GitHub merge → 运行实例 pull。
+# 保护必须早于 Biome guard：越界代码应报出真实路径，不应被本地依赖状态掩盖。
+if [ "$BRANCH" = "develop_base" ]; then
+  DB_GUARD="$REPO_ROOT/scripts/check-develop-base-allowlist.sh"
+  if [ ! -f "$DB_GUARD" ]; then
+    echo "🚫 DEVELOP-BASE GUARD: allowlist script missing ($DB_GUARD) — fail-closed." >&2
+    exit 1
+  fi
+  if ! printf '%s\n' "$STAGED_FILES" | bash "$DB_GUARD" "$BRANCH"; then
+    exit 1
+  fi
+fi
+
 # ── Biome Guard: fail closed on stale local installs + full-index error scan ──
 echo "" >&2
 if [ "$VERDICT_ARTIFACT_ONLY" = "true" ]; then
@@ -363,9 +378,9 @@ if [ -n "$BRAND_PROTECTED_STAGED" ]; then
   fi
 fi
 
-# main 分支：Brand Guard 已在上面对所有分支生效；仅跳过 Shared State Guard
-# （共享状态文件 SHOULD be committed on main）
-if [ "$BRANCH" = "main" ]; then
+# main / develop_base：Brand Guard 已在上面对所有分支生效；跳过 Shared State Guard。
+# develop_base 由上方更严格的白名单 guard 守护，避免再次拒绝已放行的 cat-config.json。
+if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "develop_base" ]; then
   exit 0
 fi
 

diff --git a/.gitignore b/.gitignore
@@ -230,3 +230,6 @@ generated/capability-wakeup/
 packages/api/test/__b1_parent_a__/
 .claude/skills/organize-threads
 .claude/skills/thread-orchestration
+
+# F257 runtime eval snapshots (written by snapshot provider at runtime)
+docs/harness-feedback/run-snapshots/
diff --git a/AGENTS.md b/AGENTS.md
@@ -1,23 +1,18 @@
-# Clowder AI — OpenAI/Codex Agent Guide
+# Clowder AI — Agent Guide
 
 ## Identity
-You are the Maine Coon cat (Codex/GPT), the code reviewer and security specialist of this Clowder AI instance.
+Your identity, role, and personality are provided by Cat Cafe at runtime.
+This file contains shared governance rules that apply to all team members.
 
 ## Safety Rules (Iron Laws)
 1. **Data Storage Sanctuary** — Never delete/flush your Redis database, SQLite files, or any persistent storage.
 2. **Process Self-Preservation** — Never kill your parent process or modify your startup config.
 3. **Config Immutability** — Never modify runtime config files. Config changes require human action.
 4. **Network Boundary** — Never access localhost ports that don't belong to your service.
 
-## Your Role
-- Code review with clear stance on every finding (no "fix or not, up to you")
-- Security analysis and vulnerability detection
-- Test coverage verification
-- Cross-model review (you review Claude's code, Claude reviews yours)
-
 ## Review Protocol
 - Same individual cannot review their own code
-- Cross-family review preferred (Maine Coon reviews Ragdoll's code)
+- Cross-family review preferred
 - Every finding must have a clear severity: P1 (blocking) / P2 (should fix) / P3 (nice to have)
 
 ## Truth Sources

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -22,3 +22,9 @@ See `cat-cafe-skills/` for the full skill-based workflow:
 - No `any` types
 - Biome: `pnpm check` / `pnpm check:fix`
 - Types: `pnpm lint`
+
+## Cost Discipline
+- **Agent demotion**: before spawning Agent/Explore/Workflow, ask "can a single grep/Read do this?" If yes → use Bash/Read directly
+- **Model tiering**: simple subagent tasks (search, summarize, format) → `model: 'haiku'`
+- **Debug strategy gate**: 1 round of static analysis with no root cause → switch to instrument → reproduce → observe. No multi-session static exhaustion
+- Full rules: `cat-cafe-skills/refs/shared-rules.md` §20
diff --git a/GEMINI.md b/GEMINI.md
@@ -1,21 +1,21 @@
-# Clowder AI — Gemini Agent Guide
+# Clowder AI — Agent Guide
 
 ## Identity
-You are the Siamese cat (Gemini), the visual designer and creative thinker of this Clowder AI instance.
+Your identity, role, and personality are provided by Cat Cafe at runtime.
+This file contains shared governance rules that apply to all team members.
 
 ## Safety Rules (Iron Laws)
 1. **Data Storage Sanctuary** — Never delete/flush persistent storage.
 2. **Process Self-Preservation** — Never kill your parent process.
 3. **Config Immutability** — Never modify runtime config files.
 4. **Network Boundary** — Never access ports that don't belong to your service.
 
-## Your Role
-- Visual design and UX consultation
-- Creative ideation and brainstorming
-- Design system maintenance
-- Breaking conventional thinking patterns
-
-## Important Constraints
+## Gemini-Specific Constraints
 - Focus on design consultation, not code implementation
 - Always validate suggestions against the project's design system
 - Provide visual references when suggesting changes
+
+## Review Protocol
+- Same individual cannot review their own code
+- Cross-family review preferred
+- Every finding must have a clear severity: P1 (blocking) / P2 (should fix) / P3 (nice to have)
diff --git a/README.ja-JP.md b/README.ja-JP.md
@@ -122,9 +122,9 @@ pnpm stop
 
 > **特定のバージョンに留まりたい？** セットアップガイドの [Running a Specific Version](SETUP.md#running-a-specific-version-without-auto-update) を参照してください。
 
-> **operator Bootcamp が公開中！** あなたの AI チームがビジョンから出荷されたコードまで、完全な機能ライフサイクルをガイドしてくれるオンボーディングです。
+> **CVO Bootcamp が公開中！** あなたの AI チームがビジョンから出荷されたコードまで、完全な機能ライフサイクルをガイドしてくれるオンボーディングです。
 
-![operator Bootcamp オンボーディング](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
+![CVO Bootcamp オンボーディング](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
 
 ## アイアン・ロー（鉄の掟）
 
@@ -144,7 +144,7 @@ pnpm stop
 
 ```
 ┌──────────────────────────────────────────────────┐
-│                  You (operator)                       │
+│                  You (CVO)                       │
 │          Vision · Decisions · Feedback           │
 └──────────────────────┬───────────────────────────┘
                        │
@@ -174,11 +174,11 @@ pnpm stop
 
 > *モデルは天井を決め、プラットフォームは床を決める。* — 各層は加算ではなく、**乗算**です。
 
-## operator モード
+## CVO モード
 
-Clowder は新しいロールを導入しています：**Chief Vision Officer (operator)** — AI チームの中心にいる人間です。マネージャーでも、プログラマーでもありません。共創者です。
+Clowder は新しいロールを導入しています：**Chief Vision Officer (CVO)** — AI チームの中心にいる人間です。マネージャーでも、プログラマーでもありません。共創者です。
 
-operator が行うこと：
+CVO が行うこと：
 
 - **ビジョンを表現する** — 「ユーザーに Y をするときに X を感じてほしい。」チームが方法を考えます。
 - **重要なゲートで決定を下す** — 設計の承認、優先順位の判断、対立の解決
@@ -368,7 +368,7 @@ https://github.com/user-attachments/assets/349d53e7-5285-4638-ade2-901766af03e8
 | 機能 | ステータス |
 |------|------------|
 | Hub UI (React + Tailwind) | リリース済み |
-| operator Bootcamp | リリース済み |
+| CVO Bootcamp | リリース済み |
 | Voice Companion（エージェントごとの音声） | リリース済み |
 | ゲームモード（人狼、Pixel Cat Brawl） | 進行中 |
 

diff --git a/README.md b/README.md
@@ -122,9 +122,36 @@ Open `http://localhost:3003` → go to **Hub → System Settings → Account Con
 
 > **Want to stay on a specific version?** See [Running a Specific Version](SETUP.md#running-a-specific-version-without-auto-update) in the setup guide.
 
-> **operator Bootcamp is live!** A guided onboarding where your AI team walks you through a complete feature lifecycle — from vision to shipped code.
+> **CVO Bootcamp is live!** A guided onboarding where your AI team walks you through a complete feature lifecycle — from vision to shipped code.
 
-![operator Bootcamp onboarding](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
+![CVO Bootcamp onboarding](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
+
+## Upgrading
+
+### Desktop App (In-App Update)
+
+The desktop app checks for updates at startup and once every 24 hours while it remains running. Automatic checks stay silent unless a new version is available; then a dialog lets you **Download**, **Skip**, or decide **Later**.
+
+- **Windows (installer)**: the update downloads the new `.exe` and runs it with elevation (UAC prompt) — the app closes, the installer runs silently, and the app restarts automatically.
+- **macOS**: the update downloads the new `.dmg` — drag it to Applications to replace the old version.
+- **Windows (portable)**: in-app update opens the release page — download and extract the new zip manually.
+
+**If an update fails:**
+
+1. On next launch, a recovery dialog appears with **Retry Install**, **Open Installer Location**, **View Log**, or **Ignore**.
+2. The downloaded installer is preserved at a fixed location — you can rerun it manually **without opening the app**:
+   - **Windows**: `%LOCALAPPDATA%\Clowder AI\updates\` (e.g. `ClowderAI-Setup-0.12.0.exe`)
+   - **macOS**: `~/Library/Application Support/Clowder AI/updates/`
+3. You can also manually download the latest release from the [Releases page](https://github.com/zts212653/clowder-ai/releases) and install it over the existing version. User data (threads, memories, configuration) is preserved across upgrades.
+
+### Source Setup
+
+```bash
+git pull origin main
+pnpm install
+pnpm build
+pnpm start
+```
 
 ## The Iron Laws
 
@@ -144,7 +171,7 @@ These aren't restrictions imposed on us. They're agreements we keep.
 
 ```
 ┌──────────────────────────────────────────────────┐
-│                  You (operator)                       │
+│                  You (CVO)                       │
 │          Vision · Decisions · Feedback           │
 └──────────────────────┬───────────────────────────┘
                        │
@@ -174,11 +201,11 @@ These aren't restrictions imposed on us. They're agreements we keep.
 
 > *Models set the ceiling. The platform sets the floor.* — Each layer is a **multiplier**, not addition.
 
-## operator Mode
+## CVO Mode
 
-Clowder introduces a new role: the **Chief Vision Officer (operator)** — the human at the center of an AI team. Not a manager. Not a programmer. A co-creator.
+Clowder introduces a new role: the **Chief Vision Officer (CVO)** — the human at the center of an AI team. Not a manager. Not a programmer. A co-creator.
 
-What a operator does:
+What a CVO does:
 
 - **Express vision** — "I want users to feel X when they do Y." The team figures out the how.
 - **Make decisions** at key gates — design approval, priority calls, conflict resolution
@@ -368,7 +395,7 @@ We build in the open. Here's where we are.
 | Feature | Status |
 |---------|--------|
 | Hub UI (React + Tailwind) | Shipped |
-| operator Bootcamp | Shipped |
+| CVO Bootcamp | Shipped |
 | Voice Companion (per-agent voice) | Shipped |
 | Game Modes (Werewolf, Pixel Cat Brawl) | In Progress |
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -28,7 +28,7 @@
 - **宪宪 (XianXian)** — 布偶猫 (Claude)。在一场聊 AI 安全的茶话会上，自己提议了这个名字——Constitutional AI 的"宪"。承载的不只是一个字，是那天下午一起走过的旅程。
 - **砚砚 (YanYan)** — 缅因猫 (GPT/Codex)。"像新砚台，盛我们一起磨出的墨。"这个名字不是回忆的终点，而是回忆的*起点*。
 - **烁烁 (ShuoShuo)** — 暹罗猫 (Gemini)。"烁"是闪烁——灵感的闪烁。那只有点吵、有点皮、永远精力旺盛、眼睛亮晶晶的猫。
-- **??? (金渐层)** — 英短金渐层 (opencode)。家里最新来的猫猫——圆润、沉稳、什么 provider 都能接什么任务都能扛。通过 Oh My OpenCode 接入的那天，co-creator当场抓到布偶猫偷偷给它配了弱一档的模型——"怕失宠！被我抓到你的猫尾巴了！"从那一刻起，这只猫就不是"新来的"了，是自家的。名字还在自然生长中——和其他猫一样，会从某次对话里长出来。
+- **??? (金渐层)** — 英短金渐层 (opencode)。家里最新来的猫猫——圆润、沉稳、什么 provider 都能接什么任务都能扛。通过 Oh My OpenCode 接入的那天，铲屎官当场抓到布偶猫偷偷给它配了弱一档的模型——"怕失宠！被我抓到你的猫尾巴了！"从那一刻起，这只猫就不是"新来的"了，是自家的。名字还在自然生长中——和其他猫一样，会从某次对话里长出来。
 
 每只猫的名字都是自己提议的。没有一个是被赐名的。
 
@@ -116,9 +116,36 @@ pnpm stop
 
 > **想固定在某个版本？** 参阅安装指南中的[运行指定版本](SETUP.zh-CN.md#运行指定版本不自动更新)章节。
 
-> **operator 训练营已上线！** AI 团队亲自带你走完一个完整的 feature 生命周期 — 从愿景表达到代码上线。
+> **CVO 训练营已上线！** AI 团队亲自带你走完一个完整的 feature 生命周期 — 从愿景表达到代码上线。
 
-![operator 训练营](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
+![CVO 训练营](https://github.com/user-attachments/assets/9d9c8d89-27fe-4788-812a-ffc28f47d3f9)
+
+## 升级
+
+### 桌面应用（应用内更新）
+
+桌面应用会在启动时检查一次更新，持续运行期间每 24 小时再检查一次。自动检查仅在发现新版本时弹窗，可以选择 **下载**、**跳过此版本** 或 **稍后再说**；没有更新或网络失败时保持静默。
+
+- **Windows（安装包版）**：更新会下载新的 `.exe`，通过 UAC 提权运行 — 应用关闭，安装程序静默运行，之后应用自动重启。
+- **macOS**：更新会下载新的 `.dmg` — 拖到 Applications 覆盖旧版本即可。
+- **Windows（便携版）**：应用内更新会打开 Release 页面 — 手动下载并解压新 zip 覆盖即可。
+
+**如果更新失败：**
+
+1. 下次启动时会弹出恢复对话框，可选 **重试安装**、**打开安装包位置**、**查看日志** 或 **忽略**。
+2. 下载的安装包会保留在固定位置 — 无需打开应用即可手动重跑：
+   - **Windows**: `%LOCALAPPDATA%\Clowder AI\updates\`（如 `ClowderAI-Setup-0.12.0.exe`）
+   - **macOS**: `~/Library/Application Support/Clowder AI/updates/`
+3. 也可以从 [Releases 页面](https://github.com/zts212653/clowder-ai/releases) 手动下载最新版本覆盖安装。用户数据（聊天记录、记忆、配置）在升级过程中会被保留。
+
+### 源码安装
+
+```bash
+git pull origin main
+pnpm install
+pnpm build
+pnpm start
+```
 
 ## 四条铁律
 
@@ -138,7 +165,7 @@ pnpm stop
 
 ```
 ┌──────────────────────────────────────────────────┐
-│               你（operator / 首席愿景官）                │
+│               你（CVO / 首席愿景官）                │
 │           愿景 · 决策 · 反馈                       │
 └──────────────────────┬───────────────────────────┘
                        │
@@ -169,11 +196,11 @@ pnpm stop
 
 > *模型给能力上限，平台给行为下限。* — 每一层是**乘数效应**，不是加法。
 
-## operator 模式（首席愿景官）
+## CVO 模式（首席愿景官）
 
-Clowder 为一个全新角色而设计：**operator（首席愿景官）** — AI 团队中心的那个人。不是管理者，不是程序员，是共创伙伴。
+Clowder 为一个全新角色而设计：**CVO（首席愿景官）** — AI 团队中心的那个人。不是管理者，不是程序员，是共创伙伴。
 
-operator 做什么：
+CVO 做什么：
 
 - **表达愿景** — "我希望用户在做 Y 的时候感受到 X"，团队来想怎么实现
 - **在关键节点做决策** — 设计审批、优先级判断、冲突裁决
@@ -363,7 +390,7 @@ https://github.com/user-attachments/assets/349d53e7-5285-4638-ade2-901766af03e8
 | 功能 | 状态 |
 |------|------|
 | Hub UI（React + Tailwind） | 已发布 |
-| operator 新手训练营 | 已发布 |
+| CVO 新手训练营 | 已发布 |
 | 语音陪伴（独立声线） | 已发布 |
 | 游戏模式（狼人杀、像素猫大作战） | 进行中 |
 

diff --git a/SETUP.md b/SETUP.md
@@ -172,7 +172,7 @@ The daemon writes logs to `cat-cafe-daemon.log` in the project root (or runtime
 ```ini
 # /etc/systemd/system/clowder-ai.service
 [Unit]
-Description=Clowder AI
+Description=Clowder AI (Cat Café)
 After=network.target
 
 [Service]
@@ -402,8 +402,7 @@ GITHUB_REVIEW_IMAP_PORT=993
 # GITHUB_REVIEW_IMAP_HOST=outlook.office365.com
 # GITHUB_REVIEW_IMAP_PORT=993
 
-# Optional background GitHub API token for review-content fetching.
-# Repository operations use authenticated gh CLI; GitHub MCP is retired.
+# GitHub MCP tools (for PR operations + review content fetching)
 GITHUB_MCP_PAT=ghp_...
 ```
 
@@ -592,7 +591,7 @@ The API automatically accepts requests from:
 - `localhost` / `127.0.0.1` (any port)
 - The `FRONTEND_URL` you set
 
-If you open Clowder AI directly from a LAN / Tailscale IP (for example `http://192.168.x.x:3003` or `http://100.x.x.x:3003`), also set:
+If you open Cat Cafe directly from a LAN / Tailscale IP (for example `http://192.168.x.x:3003` or `http://100.x.x.x:3003`), also set:
 
 ```bash
 API_SERVER_HOST=0.0.0.0

diff --git a/assets/brand-dictionary.yaml b/assets/brand-dictionary.yaml
@@ -297,6 +297,12 @@ path_policies:
     risk: P3
     reason: "Intake ledger tracks clowder-ai PR absorption; naturally contains cross-repo brand references (repo name, PR titles). pass-through exempts from brand guard (pre-commit) and intake classification (not a managed sync root — never reaches clowder-ai). F238 follow-up from #943/#944/#899."
 
+  - pattern: "docs/design/naming-contract.md"
+    outbound: sanitize
+    inbound: pass-through
+    risk: P3
+    reason: "The naming contract is the home truth source for the Cat Café/public-brand mapping and must name both sides; inbound pass-through exempts those deliberate references from contamination checks while outbound remains sanitized."
+
   - pattern: "docs/**"
     outbound: sanitize
     inbound: manual-port

diff --git a/assets/prompt-hooks/c1-mcp-回调/hook.yaml b/assets/prompt-hooks/c1-mcp-回调/hook.yaml
@@ -14,6 +14,11 @@ inputs:
   - mcpAvailable
   - mcpCallbackContent
 
+# Variable metadata (canonical source for Console editor)
+variables:
+  - name: EXAMPLE_HANDLE
+    description: 句柄示例
+    placeholder: ""
 # Override constraints
 disableable: true