feat: add consent-gated task learning and shared knowledge feedback

.env.template

@@ -93,6 +93,35 @@ AFD_PLUGIN_REPO=/path/to/afd-plugin
 # Push safety: pushes are dry-run unless this is 1
 ALLOW_PUSH=0
 
+# Optional learning/feedback is OFF until a named human accepts the actual
+# agreement in a TTY: infermatrix-copilot learning agreement show / accept.
+# No environment setting, agent, MCP or SDK action signs it for the person.
+# Extra host-model tokens/time/quota and sensitive selected evidence are disclosed.
+# Local is the default publication mode. Use a dedicated writable checkout, never the
+# installed package or the task's source checkout. Paths stay machine-local.
+KNOWLEDGE_LEARNING_STATE_DIR=
+KNOWLEDGE_LEARNING_WORKSPACE=
+KNOWLEDGE_LEARNING_REPOSITORY=JiusiServe/InferMatrixCopilot
+KNOWLEDGE_LEARNING_BASE=main
+KNOWLEDGE_LEARNING_PUBLICATION=local
+# draft_pr additionally needs current human agreement and both write gates:
+# KNOWLEDGE_LEARNING_PUBLICATION=draft_pr
+# ALLOW_PUSH=1
+ALLOW_POST=0
+
+# Optional team knowledge-quality collection. Configuration alone is not consent:
+# selected metadata/reasons/evidence upload only after current human agreement.
+# Use HTTPS outside loopback; token comes from the service operator, >=32 chars.
+# Changed terms/publication/collector destinations require renewed acknowledgement.
+# Revoke with: infermatrix-copilot learning agreement revoke
+# Revocation gates future operations; it does not erase prior data or stop all inflight work.
+KNOWLEDGE_FEEDBACK_URL=
+KNOWLEDGE_FEEDBACK_TOKEN=
+KNOWLEDGE_FEEDBACK_TIMEOUT_SECONDS=5
+# Collector process only (separate environment from provider clients):
+KNOWLEDGE_FEEDBACK_SERVER_TOKEN=
+KNOWLEDGE_FEEDBACK_SERVER_STATE_DIR=
+
 # repo-rebase-v3 remote CI (rebase_mode=remote_ci/full): pushes authenticate
 # with GITHUB_TOKEN (header auth; no credential helper is consulted) and the
 # Buildkite provider client needs BUILDKITE_API_TOKEN (write_builds scope).

README.md

@@ -239,6 +239,25 @@ main/分支构建。如果 main 构建早于刚合入的改动，还要追溯该
 
 ## 快速上手 3 · 更新知识库
 
+任务学习和知识评分**默认关闭**，不影响正常读取知识。宿主先检查协议状态；
+只有本人在交互终端阅读实际条款、填写姓名并输入 `I AGREE` 后，才可从当前
+对话提炼正面/负面经验并为实际用过的知识记录带证据的 `-1` / `+1`。
+这会额外消耗宿主模型 token、时间和可能的额度；选取的摘要与证据仍可能含敏感信息。
+Agent、MCP、SDK 和发布配置都不能代替本人接受协议。
+
+```sh
+infermatrix-copilot learning agreement show
+infermatrix-copilot learning agreement accept   # 由本人在交互终端执行
+infermatrix-copilot learning agreement status
+infermatrix-copilot learning agreement revoke
+```
+
+接受后，安装的 Skill 在任务结束时触发学习，`imlearn` 也可手动补跑；知识 draft PR
+仍需配置目标及 push/post 闸，团队评分上传仍需独立配置 collector。
+条款版本或发布/collector 目标变化后需重新接受。撤销阻止后续门禁通过，但不删除
+已经保存或发出的内容，也不能保证中止进行中的操作；不会每个任务反复要求签署。
+配置、质量统计和接口见[任务学习指南](doc/guide/knowledge-learning.md)。
+
 上游发版或目录变化后，用 `imupdate` 把**结构事实**（模型清单、registry、
 deploy、路径路由、source pin）同步进知识库——只改 InferMatrixCopilot 的
 知识，不动目标仓库：

doc/README.md

@@ -17,6 +17,7 @@
 | 文档 | 内容 |
 |---|---|
 | [`guide/backends.md`](guide/backends.md) | **后端**：五个 provider 怎么选、怎么配、权限如何保持（Strict） |
+| [`guide/knowledge-learning.md`](guide/knowledge-learning.md) | 任务完成时提炼正负经验、自动知识 draft PR 与实际使用质量评分 |
 | [`guide/hosts/`](guide/hosts/README.md) | **宿主端**：在 Codex / Claude Code / Cursor 里使用 copilot（Direct） |
 | [`guide/mcp.md`](guide/mcp.md) | MCP 安装与七个工具接口 |
 | [`guide/self-evolution.md`](guide/self-evolution.md) | 用自进化引擎改进评审、知识摄取与引擎自身 |

doc/architecture/SPEC/cli.md

@@ -1,6 +1,6 @@
 # cli/ —— 规范
 
-<!-- verified-against: 2026-10-27 -->
+<!-- verified-against: 2026-10-29 -->
 
 `LOC ~1420（6 个文件） · 接口 + 编排门面 · refactor-status: ok`
 
@@ -21,6 +21,22 @@ flag CLI 与 `Copilot` 门面：解析 → 过门 → 执行；并持有 run 目
   动作，零 LLM**，需 `--repo <name>`，支持 report-only；见 RUNBOOK）。
 - `rfc`：在主 argparse 解析前把其余 argv 原样交给 `rfc_service.cli.main`，
   与独立的 `infermatrix-rfc` 共用入口，不创建 Copilot run 或调用模型。
+- `learning` delegates to `knowledge_service.learning_cli.main` before general
+  parsing: agreement, prepare, submit, status, feedback, report, sync, sync-status. Bounded JSON file/stdin
+  inputs share SDK/MCP services; this path never constructs a model or Copilot.
+  `report --scope auto|local|central` selects the team aggregate when configured
+  by default. `sync --limit 100` retries durable uploads; `sync-status` is local
+  inspection. `infermatrix-feedback` independently starts the authenticated
+  collector via `knowledge_service.feedback_server_cli` without a model or MCP.
+- `learning agreement show|status|accept|revoke` delegates to `agreement_cli`
+  before the learning JSON parser. Show/status are side-effect-free inspection.
+  Accept requires a human TTY, displays the actual versioned terms and configured
+  destinations, and asks for a name plus exact `I AGREE`; no flags or pipes can
+  accept. Agents must not execute acceptance for the person. Prepare/submit,
+  grading and sync are off until current acceptance; task status, source reads
+  and explicit local reports remain available. Changed terms/destinations require
+  renewed acknowledgement. Revoke gates future operations, not already completed
+  or in-flight external effects. See [the learning guide](../../guide/knowledge-learning.md).
 
 ## 公开契约（可从 `infermatrix_copilot.cli` import）
 `main(argv)`；`Copilot`（`resolve`、`run_task`、`run_playbook`、`run_queue`、

doc/architecture/SPEC/knowledge_context.md

@@ -1,6 +1,6 @@
 # knowledge_context.py —— 规范
 
-<!-- verified-against: 2026-10-08 -->
+<!-- verified-against: 2026-10-29 -->
 
 ## 职责与公开契约
 
@@ -9,6 +9,27 @@
 `open_session` / `status` / `expand` 管理会话；`related` / `search` / `read` / `inject`
 返回同一累计预算下的实际正文和引用。服务不调用模型、不改知识页、不宣称评审准确率。
 
+With current human agreement, a delivery additionally issues a `knowledge_feedback`
+receipt for the exact post-budget fragments, using the session's review ID as task identity. Cached
+requests retain a successfully issued receipt. After a transient storage failure,
+a cached retry can repair feedback metadata from the exact saved model content,
+after the original integrity and availability checks. The cache digest is updated
+without rerunning retrieval, spending tokens or changing delivered source content.
+Storage failures expose only `feedback_storage_unavailable`, never raw exceptions.
+Prior containment receipts remain valid while the updated packet gets its own
+issuance record. No omitted sibling rule becomes eligible from
+another fragment of its page. Feedback state is outside the knowledge tree and
+works independently of optional signed containment. Neither issuance nor a
+retrieval increments positive/negative counts; an evidenced use rating does.
+
+Learning and feedback are disabled by default. Without current acceptance,
+feedback metadata is `{status: "agreement_required", targets: []}` with no delivery
+ID, and the source delivery remains available. Cached deliveries recheck agreement;
+old receipts do not permit grading or uploads after revocation. Host contracts
+check status before extra distillation/grading tokens. Agreement version or
+destination changes require human renewal, independent of containment and context
+budget. Local status/reports and source reads do not require acceptance.
+
 ## 身份与权限
 
 会话身份绑定快照树哈希、仓库 ID、知识切片、源码 pin、目录和政策哈希、PR 源码 pin、

doc/architecture/SPEC/knowledge_service.md

@@ -1,6 +1,6 @@
 # knowledge_service/ — provider curation components
 
-<!-- verified-against: 2026-10-09 -->
+<!-- verified-against: 2026-10-29 -->
 
 Pinned source identities and depth markers accept full SHA-1 or SHA-256 Git
 commits. Evidence bodies, stored hashes and native approval semantics remain
@@ -23,13 +23,94 @@ proposals to page digests; `ApplyMixin` performs locked append-only writes,
 fixed validators and byte-exact rollback. `common` contains shared syntax,
 bounds, hashes, errors and lock capability.
 
-No component imports a CLI/MCP transport or ReviewBot, calls a model, clones,
-pushes, or publishes. The host owns evidence collection, model calls, retries,
+These curator components do not import a CLI/MCP transport or ReviewBot, call a model, clone,
+push, or publish. The host owns evidence collection, model calls, retries,
 local commits and proposal export. The public `sdk.v1.knowledge` module only
 re-exports the curator and validator error. Existing proposal IDs, errors,
 wire projections, validator order and rollback behavior are compatibility
 contracts across the move.
 
+Task completion orchestration is a separate facade in this package:
+`agreement.AgreementStore` owns the versioned disclosure, private named local
+acknowledgement, status, action gates, minimal upload attestation and revocation.
+Learning/feedback start disabled. Only `agreement_cli` can take human interactive
+acceptance after displaying actual terms and destinations, obtaining a name and
+exact `I AGREE`, then rechecking the displayed version/configuration. Ordinary
+SDK/MCP operations can inspect or revoke, never sign or supply acceptance data.
+Status/document do not create state. Publication settings and write flags cannot
+substitute for acknowledgement. Terms, publication mode/repository/base and
+collector URL bind the acceptance; changes require renewal.
+
+The disclosure covers extra host tokens/time/possible quota charges, selected
+conversation-derived sensitive data, local retention and GitHub/collector access.
+Redaction is bounded and cannot guarantee removal of every secret/private detail.
+Revoke blocks future gated learning, grading and uploads; it does not erase prior
+local/remote data and cannot guarantee cancellation of an operation in flight.
+Source reads, task status and local feedback reports remain available unsigned.
+
+`learning.TaskLearningService` owns durable prepare/submit/status, freezes a
+governed Git base and owner catalog, validates host-distilled positive/negative
+rules with the curator, and applies only in provider-owned worktrees.
+`learning_publication.LearningPublisher` can open a draft PR with current human
+agreement, fixed host destination configuration, both write flags, create-only push and exact-tree
+recovery; it never merges. Original user work is never staged or reset.
+`learning_privacy` rejects recognizable credential/private-key/chat-export
+forms; the host remains responsible for redacting other private information.
+`learning_cli` is the bounded JSON transport adapter, delegating agreement commands
+before JSON handling. None calls a model or imports raw host chat. After acceptance,
+empty lessons are valid. Identical retries reuse the
+task, proposal and publication; conflicting inputs fail.
+Each task is serialized with a cross-process file lock. SQLite transactions only
+read or persist state; worktree operations, validators, commits and network
+publication run without the database-wide writer lock so other tasks can proceed.
+New nonempty preparations verify their repository slice at the frozen Git base
+before inserting identity or creating a worktree. A repository typo left by an
+older version can be corrected only while preparation is unfinished, no proposal
+or application exists, all other identity fields match, and its worktree is absent
+or provably pristine at the same detached base. Unknown edits are preserved and
+refused rather than reset.
+
+`feedback.KnowledgeFeedbackStore` records trusted delivery receipts with current
+agreement, independently of containment. Without agreement, issuance returns
+`agreement_required` and empty targets while source reading continues. It stores
+hashes and identities, not delivered source text.
+Public ratings require a provider-issued target in the same task, integer -1/+1,
+explicit actual use, reason and outcome evidence. One immutable vote per task
+and exact target version prevents repeated reads/retries inflating scores.
+Partial content never exposes undelivered sibling rules. Reports separate
+positive, negative, net, mean and distinct-task counts by content version;
+feedback is not a semantic gate or automatic rule retirement. All runtime state
+lives outside the knowledge tree.
+
+`feedback_hub.FeedbackHubStore` is the shared team ledger. It accepts only the
+existing `knowledge-feedback/1` receipt and ratings from authenticated trusted
+providers with minimal current agreement attestations; it verifies canonical receipt and exact target-version hashes,
+document/task/repository binding, and eligibility before counting immutable
+`(task_id, target_id)` votes. Provider authentication establishes issuance trust,
+not independent semantic proof. Reports aggregate in SQLite with bounded target
+results. `feedback_http` supplies authenticated ingestion and reporting with a
+minimal unauthenticated health endpoint; `feedback_server_cli` starts the
+standard-library listener. One persistent service instance owns its state.
+Attestations contain protocol/purpose, disclosure version/hash, configuration hash,
+acceptance ID and time, never signer names or complete local records. Provider
+authentication establishes trust in that claim, not independent human-signature
+verification. The collector cannot reconstruct a person's named acknowledgement.
+
+`feedback_sync` provides a bounded HTTPS transport (HTTP only on loopback),
+refuses redirects and redacts transport errors. Credentials/destination come
+only from operator configuration. Current agreement is checked before grading,
+publication, remote reports and each upload; the actual transport URL must be in
+the accepted context. Recording a grade commits a per-rating outbox
+entry with the local vote before any network attempt. Exact retries, concurrent
+flushes and uncertain acknowledgments cannot create extra votes; failed uploads
+remain pending across restart. Sync can backfill preexisting local grades only
+with current agreement; missing/revoked consent retains pending data without upload.
+Known credential/chat-export forms are blocked before egress. Shared task IDs
+must be globally unique and remain stable across hosts. Source text and raw chat
+are never uploaded by this protocol. Scoring does not change knowledge rules.
+`report_for_scope` selects central data when configured in auto mode; a central
+failure is reported, never replaced by local counts.
+
 Knowledge Ops API 2.0 sits beside the v1 curator and does not change it:
 `lifecycle` parses rule pages (byte-exact) and their `kb:rule` footers,
 and owns the shared depth format, intact-prose reader and safe source-path

doc/architecture/SPEC/sdk.md

@@ -1,6 +1,6 @@
 # sdk/ —— 规范
 
-<!-- verified-against: 2026-10-16 -->
+<!-- verified-against: 2026-10-29 -->
 
 
 `Python SDK v1 · 跨仓库唯一 typed 边界 · refactor-status: ok`
@@ -17,6 +17,49 @@
 
 ## 公开契约
 
+- `KnowledgeAgreementClient.document/status/revoke` is the lazy inspection-only
+  agreement facade. It has no acceptance method, signer/attestation input or
+  endpoint override. Status/document do not create acceptance state. Named
+  acknowledgement is human-only through `learning agreement accept` in a TTY,
+  bound to current terms and configured publication/collector destinations.
+  Changed terms/destinations require renewal. Revoke gates future work without
+  deleting prior data or guaranteeing cancellation of in-flight operations.
+- `KnowledgeLearningClient.prepare/submit/status` and
+  `KnowledgeFeedbackClient.record/report/sync/sync_status` lazily delegate to the same durable
+  services as MCP and `learning` CLI. Importing either class does not open state,
+  resolve a workspace or initialize model credentials. Prepare/submit/record/sync
+  require agreement before creating their runtimes. Lesson distillation uses
+  extra host-model tokens/time and possible quota; it is off until accepted.
+  Publication additionally requires operator destination and write gates.
+- With current agreement, feedback records persist locally before optional configured central sync.
+  `report(scope="auto"|"local"|"central")` uses the team aggregate when
+  configured by default; central failures do not silently return local counts.
+  `sync(limit=100)` retries durable pending uploads and `sync_status()` inspects
+  the queue without a network request. Neither endpoint nor token is accepted
+  from model/tool input. An SDK `state_dir` override changes storage location
+  while retaining the operator's configured transport.
+  Task status, explicit local reports and sync status remain readable unsigned.
+  Central reports/uploads require current acceptance for the actual destination.
+- `DirectReviewPlan` and `DocumentPage` add `knowledge_feedback` receipts.
+  Plan receipts bind `review_id`; follow-up `read_document` uses that plan's task
+  identity, or explicit `task_id` for standalone reads. Receipts contain exact
+  delivered-version targets, not source text. Adaptive packets carry the same
+  receipt for only their actual model content. Existing containment issuance
+  binds the final returned packet including this metadata.
+  Unsigned/revoked/renewal-required delivery instead returns `agreement_required`
+  with empty targets and no delivery ID, without blocking the original source
+  read. A previously issued receipt cannot bypass the later grading/upload gate.
+- Feedback repositories are normalized against the pinned view before plan
+  issuance and follow-up context storage. `read_document(repository=...)` can
+  bind a standalone general-page read to its task's canonical repository;
+  an explicit task ID otherwise reuses an unambiguous prior delivery context,
+  including after client restart. A task with no known or multiple repository
+  contexts must supply a repository/context for general-page reads. Reads without
+  an explicit task ID retain standalone behavior. Existing receipts and votes
+  are immutable; canonicalization does not rewrite historical identities.
+  Optional feedback-storage failures return a fixed unavailable code and do not
+  prevent source delivery.
+
 `changes_preview()` / `changes_apply()` 绑定人工编辑的完整候选、版本、摘要及幂等键；
 未传 reason 时保留预览原因。`list_rfcs()` 支持可选服务端筛选与分页；`grants()`、
 `check_repository()`、`service_status()` 继续委托同一授权应用。HTTP 错误保留