Prepare accepted inputs before delegating native text work

VERSION

@@ -1 +1 @@
-0.1.15
+0.1.16

agent-ops/factory-agent-ops/SKILL.md

@@ -3,7 +3,7 @@ name: factory-agent-ops
 description: Act as a project's lead for ideas, research, accepted tasks or an approved backlog; coordinate native workers, independent review and authorized delivery.
 license: MIT
 metadata:
-  version: "0.1.15"
+  version: "0.1.16"
   updated: "2026-10-15"
 ---
 

agent-ops/factory-agent-ops/references/t3.md

@@ -1,6 +1,6 @@
 # Operating through T3 Code
 
-Revision: 0.1.11 · Updated: 2026-10-11
+Revision: 0.1.16 · Updated: 2026-10-15
 
 Use the tools actually exposed by the installed T3/provider versions. This guide
 was written for **0.0.46-nightly.20261009.2861** (V2), with upstream source checked
@@ -61,6 +61,33 @@ answer only within existing authority, and never add an automatic self-approval
 bridge. A superseded question can be dismissed through the native route without
 inventing the owner's answer; a declined operation stays declined.
 
+Decide before dispatch who prepares inputs, runs checks and owns generated
+artifacts. When the lead is already authorized for that preparation, it may
+validate an accepted archive's provenance, hash and safe regular members, confirm
+the output is absent, and place the exact inputs and scratch in the worker's
+verified task worktree through its own permitted route. Give the worker explicit
+paths and the manifest. Prefer native Read/Edit for text work; the lead may keep
+its authorized checks and artifact delivery. Sandbox and read/edit guards stay as
+configured. Preparation is not a way to run a refused call as another actor, widen
+roots or grants, or move an operation only to avoid a denial; new, unknown,
+out-of-scope or denied actions stay held.
+
+Detecting a waiting request is not authority to answer it. A T3 desktop/Connect
+input or approval alert opens the thread; it does not wake an agent or grant a
+decision. A native scheduled webhook is inbound and does not emit approval events.
+The official [Claude](https://code.claude.com/docs/en/hooks) and
+[Codex](https://learn.chatgpt.com/docs/hooks) hook references both document
+`PermissionRequest` and direct MCP-tool hooks; Claude also documents `Notification`
+with `permission_prompt` and HTTP hooks. These are candidate signals, not
+installed or qualified here. The actual launch's setting sources, any SDK
+override and the exact mapping to a T3 request still need qualification. Missing
+parent wait notifications are tracked upstream in
+[t3code #15082](https://github.com/pingdotgg/t3code/issues/15082); add to it rather
+than filing another issue. Only a holder already authorized for that decision
+may answer, after freshly checking the environment, project, thread, run, request,
+full input and live callback. Never late-approve an aborted or resolved request.
+Report one concrete handoff instead of polling or auto-confirming.
+
 A completed run need not end a worker's task: a harness background command,
 monitor or child notification can start another turn in the same thread. Before
 cleanup, restart, archiving or a completion claim, reconcile the worker's known

docs/qualification.md

@@ -1,6 +1,6 @@
 # Qualification
 
-Revision: 0.1.15 · Updated: 2026-10-15
+Revision: 0.1.16 · Updated: 2026-10-15
 
 This record distinguishes source review, disposable exercises and observed native
 operation. A package release does not qualify another host, every future update
@@ -10,6 +10,7 @@ remain with the installation; public issues track the remaining acceptance work.
 | Boundary | Observed evidence | Limit / next check |
 | --- | --- | --- |
 | Package | Eight portable skills, metadata/link checks and staging tests | Mechanical checks do not establish agent decisions |
+| Lead-prepared inputs (0.1.16 candidate) | 2026-10-15: separately, an OPD worker's archive preparation waited 15 m 12 s for approval and was resolved once in the native UI (operator report, not reproduced here). In this [Factory #32](https://github.com/arcitai/factory/issues/32) trial the lead prepared harmless inputs in the worker's task worktree; the same Claude worker used native Read and Edit for one result-file change and the AgentOps text change. The lead independently verified the inputs unchanged and the expected result hash; the run ended terminal with nothing pending, and its native timeline showed no approval request or worker shell command | One same-worker prepared-input text task, not a fresh-context comparison, measured wait reduction, general prompt-free operation, worker build/test permission, permission wake or decision authority, or isolation. A separate compound Python edit and Node/shell check request in that same OPD run remains held at this observation; its lead has a recovery handoff, not a passing recovery. Source checks and independent review are recorded in the delivery PR |
 | Foundation readiness handoff (0.1.12 candidate) | 2026-10-11: [Factory #27](https://github.com/arcitai/factory/issues/27) source change after an AIOS assessment accepted a stale mandatory authoring self-dependency, its disabled private reporting was found only by readback, its lead could not read its private record, and Project1's current README kept stale pre-delivery claims (coordinator observations, not reproduced here). Package, unit and staging checks only | Behavioral evidence and independent review are pending in the delivery PR. Native binding/authentication behavior stays with [Factory #3](https://github.com/arcitai/factory/issues/3); Markdown does not repair it |
 | English deliverables (0.1.15 candidate) | 2026-10-15: owner instruction that GitHub issues, PRs and Factory documentation default to English, and that Danish brainstorming does not request Danish deliverables. AgentOps and the Implement review handoff now state this default and its explicit-request exception. On the same owner instruction the lead published the runtime audit in English as [Factory #39](https://github.com/arcitai/factory/issues/39) and rewrote the [#32](https://github.com/arcitai/factory/issues/32) and [#34](https://github.com/arcitai/factory/issues/34) descriptions in English, each independently read back in English | Source change plus real reporting corrections made on owner instruction; not proof that a model applies the rule on its own. Source checks and independent review are recorded in the delivery PR |
 | Human-facing updates (0.1.14 candidate) | 2026-10-15: [Factory #36](https://github.com/arcitai/factory/issues/36) after the lead's [#35 comment](https://github.com/arcitai/factory/issues/35#issuecomment-6193954207) opened with a native version line, a five-row terminology table and long source paragraphs. The same comment was rewritten and read back to open with the finding in plain words and one before/after of the guide, with checks and the freshness limit visible and sources in optional details. AgentOps source clarified for issue openings, progress updates and final handoffs | One authored issue revision, not a comprehension measurement, future agent reliability, native permission or app UI change. Source checks and independent review are recorded in the delivery PR |