@@ -2698,6 +2698,23 @@
                       "POST /safari/a2a-agent/delete"
                     ]
                   },
+                  {
+                    "group": "产物",
+                    "icon": "images",
+                    "pages": [
+                      "POST /safari/artifact/gallery/list",
+                      "POST /safari/artifact/gallery/get",
+                      "POST /safari/artifact/gallery/file-state",
+                      "POST /safari/artifact/sign",
+                      "GET /safari/artifact/stream",
+                      "POST /safari/artifact/gallery/publish-from-file",
+                      "POST /safari/artifact/gallery/update",
+                      "POST /safari/artifact/gallery/delete",
+                      "POST /safari/artifact/gallery/share/enable",
+                      "POST /safari/artifact/gallery/share/sync",
+                      "POST /safari/artifact/gallery/share/revoke"
+                    ]
+                  },
                   {
                     "group": "知识",
                     "icon": "book",
@@ -4083,6 +4100,23 @@
                       "POST /safari/a2a-agent/delete"
                     ]
                   },
+                  {
+                    "group": "Artifacts",
+                    "icon": "images",
+                    "pages": [
+                      "POST /safari/artifact/gallery/list",
+                      "POST /safari/artifact/gallery/get",
+                      "POST /safari/artifact/gallery/file-state",
+                      "POST /safari/artifact/sign",
+                      "GET /safari/artifact/stream",
+                      "POST /safari/artifact/gallery/publish-from-file",
+                      "POST /safari/artifact/gallery/update",
+                      "POST /safari/artifact/gallery/delete",
+                      "POST /safari/artifact/gallery/share/enable",
+                      "POST /safari/artifact/gallery/share/sync",
+                      "POST /safari/artifact/gallery/share/revoke"
+                    ]
+                  },
                   {
                     "group": "Knowledge",
                     "icon": "book",
 
@@ -24,7 +24,7 @@ sidebarTitle: Agent
   </Card>
 </CardGroup>
 
-Delegation does not make you wait: after AI SRE hands a task to a remote agent, the conversation continues immediately, so you can keep working or delegate several tasks at once. When the remote agent finishes, its result appears in the conversation as a new message. Each A2A delegation appears in the conversation stream as a **task card** carrying an `A2A` badge, showing the remote agent name, task intent, run status (initializing / in progress / completed / failed / interrupted), and usage metrics such as tool call count, tokens, and elapsed time. Click the card to view the full delegation trace in the right-hand panel.
+Delegation does not make you wait: after AI SRE hands a task to a remote agent, the conversation continues immediately, so you can keep working or delegate several tasks at once. When the remote agent finishes, its result appears in the conversation as a new message. Each A2A delegation appears in the conversation stream as a **task card** carrying an `A2A` badge, showing the remote agent name, task intent, run status (initializing / in progress / awaiting input / awaiting authorization / completed / failed (including orphaned) / interrupted / killed), and usage metrics such as tool call count, tokens, and elapsed time. Click the card to view the full delegation trace in the right-hand panel.
 
 <Tip>
 **Instructions have two levels and act as the agent-selection signal.** Before delegating, AI SRE sees a list of available agents where each entry is just `name: summary` — the summary comes from a `summary:` line at the top of the instructions (if omitted, the beginning of the body is excerpted automatically). AI SRE uses it to decide **whether and when** to delegate to this agent, so state clearly when to prefer it, what it excels at, and what it is not suited for. The body that follows the summary is not kept in the list — it is delivered to AI SRE in full only the **first time it delegates to this agent**, so you can write it as long and detailed as needed (procedures, hard rules, examples) without slowing down everyday conversations. See "[Writing Instructions](#writing-instructions)" below for the format.
@@ -49,7 +49,7 @@ The platform ships several **bootstrap Subagents** that work out of the box:
 | `general` | General-purpose worker with full tool access. Use it to offload work whose intermediate steps would otherwise pollute the parent's context (long reports, multi-file edits, end-to-end builds, repeated probing). Dispatch several in parallel for independent units of work |
 | `explore` | Read-only investigator restricted to `grep` / `glob` / `read`; it cannot write or execute. Returns a compact summary rather than raw search output — ideal for locating evidence inside a codebase or knowledge dump |
 
-**In the conversation**: each dispatch also appears as a **task card** in the conversation stream and shares the same status lifecycle as an A2A delegation (initializing / in progress / completed / failed / interrupted). The difference is the badge — a Subagent task card carries an `Agent` badge, whereas an A2A delegation carries an `A2A` badge.
+**In the conversation**: each dispatch also appears as a **task card** in the conversation stream and shares the same status lifecycle as an A2A delegation (initializing / in progress / awaiting input / awaiting authorization / completed / failed (including orphaned) / interrupted / killed). The difference is the badge — a Subagent task card carries an `Agent` badge, whereas an A2A delegation carries an `A2A` badge.
 
 **Runtime limits**:
 
@@ -69,7 +69,7 @@ On the A2A Agents list page, click **Add A2A Agent** and fill in the form:
 | Field | Type | Default | Description |
 | --- | --- | --- | --- |
 | Name | string | — | A2A agent identifier (e.g., `metrics-analyzer`). Required |
-| Scope | Account / Team | — | Scope: **Account** (visible account-wide) or a specific **Team** (visible and editable only to members of that team). Required — see "Scope" below |
+| Scope | Shared / Team | — | Scope: **Shared** (i.e., account level — visible account-wide) or a specific **Team** (visible and editable only to members of that team). Required — see "Scope" below |
 | Execution Environment | Cloud / BYOC Runners (multiple) | All environments | Controls where this A2A agent is available. Select Cloud and one or more visible BYOC Runners; leave empty to make it available everywhere. It does not route delegated calls: an A2A call still runs in the current AI SRE session's environment. For a remote agent available only on a private network, select only the Runner(s) that can reach it |
 | Instructions | string | — | The agent-selection signal shown to AI SRE, as **a single document**: an optional `summary:` frontmatter block plus a body. The summary appears in the available-agent list; the body is delivered in full only on first delegation. Required; the whole document is at most 50 KB, and `summary` is at most 1,024 characters and must not contain `<` or `>`. See "[Writing Instructions](#writing-instructions)" below for the format |
 | Card URL | string | — | The Agent Card URL of the remote A2A agent, or just the service origin for agents that follow the default well-known location (for example, `https://agents.example.com`). If the URL includes a path, the platform reads that exact URL; if only an origin is provided, it resolves `/.well-known/agent-card.json` by A2A convention. Required. The platform only validates that the URL is well-formed (scheme is http/https, host is non-empty) — it does not classify hosts or IPs; actual network reachability and egress restrictions depend on the current AI SRE session's execution environment. The Execution Environment field above only limits where this agent is available. The remote agent must implement A2A Protocol 1.0 — see "[Protocol Version and Agent Card Requirements](#protocol-version-and-agent-card-requirements)" below |
@@ -185,7 +185,7 @@ After FlashAI is prepared, enter the **FlashAI domain** in the panel (for exampl
 https://demo.flashcat.cloud/api/fc-model/a2a/.well-known/agent-card.json
 ```
 
-The template only prefills common values. You still choose the **Scope** (Account or Team) and configure authentication in the form. A2A agents can be installed multiple times for different scopes, so the FlashAI panel does not disappear just because one FlashAI agent already exists. Agent names must still be unique within the account; if the same FlashAI domain needs to be installed more than once, adjust the name in the form.
+The template only prefills common values. You still choose the **Scope** (Shared or Team) and configure authentication in the form. A2A agents can be installed multiple times for different scopes, so the FlashAI panel does not disappear just because one FlashAI agent already exists. Agent names must still be unique within the account; if the same FlashAI domain needs to be installed more than once, adjust the name in the form.
 
 <Tip>
   Do not remove the instructions generated by the FlashAI template, especially the `summary:` line at the top — once registered, FlashAI always appears in the available-agent list, but whether AI SRE actually delegates to it hinges directly on that summary line. When the instructions are too short or too generic, AI SRE may keep reasoning locally or incorrectly delegate ordinary metrics / logs questions to FlashAI.
@@ -283,7 +283,7 @@ The full lifecycle of A2A agents is managed on the **Plugins → Agents** page.
 
 <AccordionGroup>
   <Accordion title="Create" icon="plus">
-    Click **Add A2A Agent**, fill in the name, scope, instructions, Card URL, auth settings, and save. You must select a definite scope (account or team) before submitting — the submit button remains disabled until a scope is chosen.
+    Click **Add A2A Agent**, fill in the name, scope, instructions, Card URL, auth settings, and save. You must select a definite scope (shared or team) before submitting — the submit button remains disabled until a scope is chosen.
   </Accordion>
   <Accordion title="Enable / Disable" icon="toggle-on">
     Use the toggle in the list to switch an A2A agent's enabled state. Only **enabled** agents appear in AI SRE's available-agent list and can receive delegated tasks; disabling one makes it immediately invisible to delegation.
@@ -295,15 +295,15 @@ The full lifecycle of A2A agents is managed on the **Plugins → Agents** page.
     Remove an A2A agent from the current scope. **Active sessions that delegated to it will fail.** Deletion requires confirmation.
   </Accordion>
   <Accordion title="Filter by scope and search" icon="filter">
-    The scope filter bar at the top of the list lets you switch between "All", "Account only", and "Specific team", making it easy to focus on relevant resources when managing many. Each row also has a label showing its scope (account / team name). The search box to the right of the filter bar filters the list by keywords in the name, instructions, or Card URL.
+    The scope filter bar at the top of the list lets you switch between "All", "Shared", and "Specific team", making it easy to focus on relevant resources when managing many. Each row also has a label showing its scope (shared / team name). The search box to the right of the filter bar filters the list by keywords in the name, instructions, or Card URL.
   </Accordion>
 </AccordionGroup>
 
 ## Scope
 
 ---
 
-A2A agents share the same **two-level scope** model as other resources (skills, Knowledge Packs, MCP, environments), divided into account level and team level:
+A2A agents share the same **two-level scope** model as other resources (skills, Knowledge Packs, MCP, environments), divided into account level and team level. In the console UI, the account-level option is labeled "**Shared**" / "**Shared scope**" — synonymous with account level (visible account-wide):
 
 | Scope | Visibility |
 | --- | --- |
 
@@ -239,7 +239,7 @@ Automation rules share the same two-level scope model as the other resources und
 
 | Dimension | Rule |
 |---|---|
-| Ownership | **Personal rules** (`team_id=0`) belong to their creator; **team rules** (`team_id>0`) belong to that team. To create a team rule or move a rule into a team, the **operator themselves** must be a real member of the target team (join-to-govern); account Owners and admins have no exemption. You can change a rule's scope: personal rules can be moved to a team and team rules to another team — these moves into a team verify the **current operator's** membership in the target team, not the rule Owner's membership. The reverse conversion, a **team rule to personal, is reserved for the rule Owner alone**: when a non-owner edits a team rule, the scope selector does not offer the "Personal" option, and the backend likewise rejects the conversion from anyone but the Owner. If you need a personal copy, use the **Clone** button on the rule's detail page and pick the Personal scope in the prefilled create form before saving. A team rule does not stop with its creator: even after the creator has left the team, the team carries on running the rule. Only personal rules are disabled when their Owner is no longer an active account member — the system disables the rule automatically once a trigger attempt's preflight finds the Owner inactive. |
+| Ownership | **Personal rules** (`team_id=0`) belong to their creator; **team rules** (`team_id>0`) belong to that team. **Scope is fixed at creation and cannot be changed afterward**: when editing a rule, the scope selector is disabled with the hint "Scope can't be changed after creation. To use a different one, clone this automation and pick a new scope for the copy." To switch scopes, use the **Clone** button on the rule's detail page — cloning opens a prefilled create form where you pick the new scope for the copy before saving (the update API no longer accepts `team_id`, so the scope cannot be changed even by bypassing the UI). To create a team rule, the **operator themselves** must be a real member of the target team (join-to-govern); account Owners and admins have no exemption. A team rule does not stop with its creator: even after the creator has left the team, the team carries on running the rule. Only personal rules are disabled when their Owner is no longer an active account member — the system disables the rule automatically once a trigger attempt's preflight finds the Owner inactive. |
 | Visibility / list | The account Owner and admins see all rules; ordinary members see rules they created and rules of teams they belong to. |
 | Edit / manage (team rules) | Only **current members** of the rule's owning team can act on the rule (enable / disable, edit, delete, run now); once the creator has left the team, they keep no standing privilege. The account Owner and admins have no exemption and must join the team first. |
 | Edit / manage (personal rules) | Only the creator can manage a personal rule. The account Owner and admins have **no** exemption for other members' personal rules — they cannot even view its detail page; opening one returns "access denied" outright, not just a grayed-out button. |