feat: release terminal task assignments

Author: Howe829

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable public changes to Team First Development are documented here.
 
 ## Unreleased
 
+## 2.1.3 - 2026-07-26
+
+- Derive aligned Task participants from the sealed TaskDocument, assign all and only that exact set through a prospective roster validation, and keep legacy Tasks owner-only.
+- Release exact participants atomically when a Task reaches `DONE` or `CANCELLED`, with an idempotent `coordinator-release-task` repair command for pre-v2.1.3 terminal Tasks.
+- Render current execution bindings from the authoritative roster while preserving Task ownership as separate history, and retain runtime preparation as a fail-closed dispatch prerequisite.
+
 ## 2.1.2 - 2026-07-25
 
 - Show users only a short human fingerprint for conversational approval while retaining the complete canonical digest internally for the exact machine/operator `init-apply --approval-digest` boundary; changed, stale, expired, mismatched, or ambiguous proposals require renewed confirmation.

README-CN.md

@@ -59,7 +59,7 @@ git clone https://github.com/msitarzewski/agency-agents.git ~/.agency-agents
 
 ```bash
 python3 -m pip install --user --break-system-packages PyYAML==6.0.2
-codex plugin marketplace add Howe829/team-first-development --ref v2.1.2
+codex plugin marketplace add Howe829/team-first-development --ref v2.1.3
 codex plugin add tfd@team-first-development
 ```
 
@@ -135,6 +135,8 @@ Skill 审查明确区分已安装的 `BIND`、复制到项目缓存的 `INSTALL`
 
 既有 Workspace 可通过只读 `skill-bind-propose` 与原子 `skill-bind-apply` 增量授予已审查的 installed `BIND` Skill。Apply 需要完整 proposal digest 与当前具名用户，保留无关授权，使用普通 runtime packet 路径证明就绪，但仍不授权 dispatch。该服务不能安装 Skill、扩展权限、创建成员或任务，也不能授予网络、外部或付费权限。`plugins/tfd/scripts/fixtures/` 下的 Creave 命名 fixture 只是仓库内消费示例，不依赖任何 Creave 代码。
 
+aligned Task 在 sealed TaskDocument 中声明完整参与者集合。`coordinator-assign-task` 校验 prospective roster 后只绑定且必须绑定该精确集合，roster 不能反向发明参与者。进入 `DONE` 或 `CANCELLED` 会在同一事务中释放精确绑定；`coordinator-release-task` 用于修复已经终止的 pre-v2.1.3 Task。Current-task 视图由 roster 推导，dispatch 前仍必须重新 runtime preparation。
+
 若 apply 无法证明精确回滚，它会记录 `.tfd/.skill-bind-recovery.yaml`；在经授权的恢复流程完成事故核对前，后续绑定、Skill 校验与 runtime preparation 全部 fail closed。该标记不构成直接编辑 `.tfd` 修复的授权。
 
 Workspace 属于 local-only v1 边界：不包含 GitHub 或 Linear 工作流联动、网络编排、部署、发布和外部消息。命令、schema、批准边界、恢复与拒绝 payload 详见 [运维参考](plugins/tfd/references/workspace-protocol.md)。以下命令需在 `plugins/tfd/` 中执行：

README.md

@@ -59,7 +59,7 @@ For a released version, install the pinned runtime dependency, add the repositor
 
 ```bash
 python3 -m pip install --user --break-system-packages PyYAML==6.0.2
-codex plugin marketplace add Howe829/team-first-development --ref v2.1.2
+codex plugin marketplace add Howe829/team-first-development --ref v2.1.3
 codex plugin add tfd@team-first-development
 ```
 
@@ -144,6 +144,8 @@ Skill review distinguishes installed `BIND`, project-cached `INSTALL`, and Agent
 
 Existing Workspaces can add reviewed installed `BIND` Skills with the read-only `skill-bind-propose` and atomic `skill-bind-apply` services. Apply requires the complete proposal digest and exact named user, preserves unrelated authority, proves ordinary runtime packet readiness, and still does not authorize dispatch. It cannot install Skills, expand permissions, create roster members or Tasks, or grant network/external/paid authority. The Creave-named fixture under `plugins/tfd/scripts/fixtures/` is a repository-only consumer example and has no Creave code dependency.
 
+Aligned Tasks declare their complete participant set in the sealed TaskDocument. `coordinator-assign-task` binds all and only that exact set after validating the prospective roster; roster contents cannot invent participants. A `DONE` or `CANCELLED` transition releases the exact bindings in the same transaction, while `coordinator-release-task` repairs an already terminal pre-v2.1.3 Task. Current-task views are roster-derived, and runtime preparation remains mandatory before dispatch.
+
 If exact rollback cannot be proved, apply records `.tfd/.skill-bind-recovery.yaml`; subsequent binding, Skill verification, and runtime preparation fail closed until an authorized recovery procedure reconciles the incident. The marker is not permission to repair `.tfd` by direct editing.
 
 Workspace is a local-only v1 boundary: it has no GitHub or Linear workflow integration, network orchestration, deployment, publishing, or external messaging. See [the operator reference](plugins/tfd/references/workspace-protocol.md) for commands, schemas, approval boundaries, recovery, and denial payloads. Run the following commands from `plugins/tfd/`: