Connect Pet to shared economy with recoverable purchases and migration

.development/README.md

@@ -12,3 +12,10 @@ Pet consumes `@oneworks/avatar-react` through `dependencies/avatar-react-a06ba84
 This is a package built from merged source, **not** an npm registry publication of Avatar React rc.9. The file dependency and lockfile identify its actual artifact. The former `f1a366c` feature-branch tarball has been removed. Machine-readable provenance and upstream validation are in [SOURCE.json](SOURCE.json).
 
 The merged renderer includes native preset/breed palette and coat resolution, bounded scene caching and a renderer-only entry. Keep the precise source record when integrating this checkout. Publishing another Pet release remains a separate delivery step requiring compatible dependency revisions and full package verification.
+
+## Experimental shared economy
+
+The shared-economy dependency set and its build provenance are recorded in
+[economy-dependencies.json](economy-dependencies.json). This separate experiment
+does not change the merged Avatar dependency above. Runtime/native availability
+and source/SDK test results are separate evidence.

.development/economy-dependencies.json

@@ -0,0 +1,41 @@
+{
+  "status": "Experimental source/SDK integration; not merged, published, deployed, or native-accepted",
+  "petBase": "9689fdb34a4e46e2102249df18012338a5a6a7cf",
+  "artifacts": [
+    {
+      "package": "cordisx",
+      "repository": "https://github.com/cordisx/cordisx",
+      "sourceCommit": "be2403c70664ff6624671224a405e409874d59c7",
+      "artifact": "dependencies/cordisx-be2403c.tgz",
+      "sha256": "abd300ccade96d095563f95f971164838237a376655a55b7f96bdccb3bf2dd46",
+      "sourceStatus": "experimental pushed provider branch; portable source SDK with complete Channel/CLIProxy bundles and shared Protocol module identity"
+    },
+    {
+      "package": "@cordisx/protocol",
+      "repository": "https://github.com/cordisx/cordisx-protocol",
+      "sourceCommit": "465c444c65eec1be8e337b94c2cf658ed536f49c",
+      "artifact": "dependencies/cordisx-protocol-465c444.tgz",
+      "sha256": "9576e28592b44c589aa847f3e57c02db1731a664c5cfa5a0f1fd5c4b5a3e21c8",
+      "sourceStatus": "experimental pushed provider branch; exact source-built artifact"
+    },
+    {
+      "package": "@cordisx/economy",
+      "repository": "https://github.com/cordisx/plugin-economy",
+      "sourceCommit": "5d688fc087f6dcad7a0ace5f90f328270078aa96",
+      "artifact": "dependencies/cordisx-economy-5d688fc.tgz",
+      "sha256": "2b932509322256e9296cf3dd1a19a9b3974d091c09f59e49604072236cbb206b",
+      "sourceStatus": "experimental pushed provider branch; exact source-built artifact"
+    }
+  ],
+  "rebuild": {
+    "economy": "checkout exact sourceCommit; npm ci --ignore-scripts; npm run build; npm pack --ignore-scripts",
+    "hostAndProtocol": "From exact Host be2403c70664ff6624671224a405e409874d59c7 checkout run node scripts/prepare-sdk.mjs /absolute/path/to/nonexistent-output; do not run npm ci first. Canonical recipe: https://github.com/cordisx/cordisx/blob/be2403c70664ff6624671224a405e409874d59c7/.agents/docs/sdk-source-packaging.md. Use packages/cordisx-0.1.0-beta.2.tgz and the Protocol package from the same output; verify sdk-evidence.json hashes. Provider full owner gate and native acceptance remain separate."
+  },
+  "runtimeLimitation": "Prior Host 69b consumer Linux CI passed as recorded; the new be2403c pin requires its own Linux CI. Native host-isolated startup previously reached a login page, then CDP discovery timed out before Pet/Keychain interaction; native retries are paused. Generation reload requires reauthorization.",
+  "priorConsumerEvidence": {
+    "petCommit": "637efcdf1f487b58346e928395fe6c7ec96b449c",
+    "hostCommit": "69b0146c4d4b6acd411758ae4ec3005ea74d0b89",
+    "url": "https://github.com/cordisx/plugin-pet/actions/runs/34291582664",
+    "result": "pass: exact artifact hashes, normal npm ci, SDK dependency resolution, full typecheck/build/package checks and 171 tests"
+  }
+}

.github/workflows/check.yml

@@ -0,0 +1,29 @@
+name: Pet checks
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: pet-check-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+jobs:
+  linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24.14.1'
+          cache: npm
+      - name: Verify exact SDK artifact hashes
+        run: node --test test/economy-dependencies.mjs
+      - name: Install complete dependency graph
+        run: npm ci
+      - name: Verify SDK dependency resolution
+        run: npm ls cordisx @cordisx/protocol @cordisx/channel @cordisx/plugin-cli-proxy-api
+      - name: Check types, package and behavior
+        run: npm run check

.gitignore

@@ -5,3 +5,8 @@ cordisx-package.json
 
 # Exact local Avatar candidate used by the development lockfile.
 !.development/dependencies/avatar-react-a06ba84-rc9.tgz
+
+# Exact experimental shared-economy consumer build inputs; see provenance record.
+!.development/dependencies/cordisx-be2403c.tgz
+!.development/dependencies/cordisx-protocol-465c444.tgz
+!.development/dependencies/cordisx-economy-5d688fc.tgz

README.md

@@ -15,7 +15,7 @@ A small pet system living on Composer, with 32 native OneWorks Avatar characters
 
 Open Pet from a companion's context menu or the settings navigation. Use food, water and owned outfits directly from the selected pet's care panel. Skins unlock once and can be equipped independently on compatible companions. Consumables support quantity purchases; species unlocks and companion adoption are separate transactions.
 
-Authorized local Token usage earns pet coins from newly observed, validated input and output totals. The first connection establishes a baseline; partial local coverage and unavailable states are shown explicitly, without creating a test balance. Pet coins do not consume model quota. See the [pet system guide](docs/pet-system.md) for care timing, recovery and implementation boundaries.
+Pet can bind an economy instance and account shared with games. Purchases use durable server receipts and recoverable local delivery. Existing saves are backed up before a controlled one-time import; local balances are not trusted cloud assets. Future attributed v2 root work keeps the original 10,000-token reward rate through a separately authorized, prefunded and capped sponsor source. Profile aggregates and unavailable periods never accrue deferred rewards. See [shared economy and migration](docs/shared-economy.md) and the [pet system guide](docs/pet-system.md).
 
 ## Development
 
@@ -25,7 +25,7 @@ npm run check
 npm run dev
 ```
 
-The `cordisx` development dependency is pinned to canonical merged Host `b75fa2c6f9563924feca271242e2709c136033a3`. This integration requires the Host revisions providing bounded Manager fill seats, verified local-development usage authorization and Composer menu v2. Protocol is merged at `04fb46ec758a89f58506fe5141f91a81d583f8e0`. Do not use the older release baseline below for this source tree.
+This experimental economy branch uses exact source-built package artifacts recorded in [the economy dependency record](.development/economy-dependencies.json): Host `4fb60431564931441927c474dd35188f6596274b`, Protocol `8adc1aab908263e692bd56ca6165b9aeadabe4b9`, and Economy `80aa91c6168126ac2b164446cd365d2f7c6249a2`. The Host package includes public HTTP authorization; native App/Keychain interaction has not been verified. Unit/HTTP integration evidence is separate from native acceptance. Do not use the older release baseline below for this source tree.
 
 Avatar dependency provenance is recorded in [the source dependency record](.development/README.md), including the exact source commit and tarball checksum. A tarball built from merged source is not an npm publication; the package manifest and lockfile identify the actual artifact. Avatar React rc.9 is built from canonical merged commit `a06ba84c123cf82e2b1a59c36b403392e22f9d08`; the core is pinned to registry rc.9.
 

README.zh-Hans.md

@@ -15,7 +15,7 @@
 
 从宠物右键菜单，或设置导航中的「宠物」进入。首页直接选择食物、饮水和已拥有的装扮；兼容宠物共享已解锁皮肤，但独立穿戴。消耗品支持批量购买，物种解锁和再次领养分别计费。
 
-授权后，新增且经过确认的本机输入与输出 Token 用量可以积累宠物币。首次连接只建立起点，部分覆盖与暂不可用状态会明确显示，不生成测试余额。宠物币不扣减模型额度。详细计时、恢复和开发边界见[宠物系统说明](docs/pet-system.md)。
+Pet 可绑定与游戏共用的经济实例和账户，购买使用服务端永久收据并支持本地恢复发货。旧存档先备份，再经受控的一次性迁移导入；本地余额不是可信云资产。未来可归因的 v2 正常根任务工作，通过独立授权、预注资且限额的赞助来源，保留每万 Token 一币的奖励；profile 汇总与不可用期间不积累待补收入。见[共享经济与迁移](docs/shared-economy.md)及[宠物系统说明](docs/pet-system.md)。
 
 ## 开发
 
@@ -25,7 +25,7 @@ npm run check
 npm run dev
 ```
 
-开发依赖精确固定为正式合入的 Host `b75fa2c6f9563924feca271242e2709c136033a3`。本次集成需要提供 Manager 内容填充、本地开发用量权限和 Composer 菜单 v2 的 Host 修订。Protocol 已合入 `04fb46ec758a89f58506fe5141f91a81d583f8e0`。 下方旧安装包的基线不适用于当前源码。
+本共享经济实验分支的精确源码构建产物见[经济依赖记录](.development/economy-dependencies.json)：Host `4fb60431564931441927c474dd35188f6596274b`、Protocol `8adc1aab908263e692bd56ca6165b9aeadabe4b9`、Economy `80aa91c6168126ac2b164446cd365d2f7c6249a2`。Host 包已包含公共 HTTP 授权；原生 App／Keychain 交互尚未验证。单元与 HTTP 集成测试和原生验收分别记录；下方旧安装包的基线不适用于当前源码。
 
 Avatar 依赖的源提交与压缩包校验值见[源码依赖记录](.development/README.md)。从正式合入源码打包不等于 npm 发布，实际产物以包清单和锁文件为准；Avatar React rc.9 来自正式合并提交 `a06ba84c123cf82e2b1a59c36b403392e22f9d08`，核心精确固定为 registry rc.9。
 

docs/pet-system.md

@@ -1,6 +1,6 @@
 # 宠物系统说明
 
-此页描述正在开发的源码，不代表 v0.1.1 安装包已经包含这些功能。
+此页描述正在开发的源码，不代表 v0.1.1 安装包已经包含这些功能。共享经济的绑定、旧存档保护和购买恢复见[共享经济与迁移](shared-economy.md)。
 
 ## 属性、状态与个体差异
 
@@ -38,17 +38,13 @@
 
 存档经公开 `ctx.documents` 保存，Host 按本机 profile、来源和插件身份隔离。换窗口、普通重载和同来源升级保留状态；不同来源或 profile 不自动继承，不宣称账号或跨设备同步。
 
-购买扣币、发货、喂食、安葬和复活均作为整份存档的原子事务提交。重复请求有幂等保护，多窗口冲突重试。损坏或未知版本存档拒绝覆盖，不以重置钱包的方式掩盖错误。经济记录保留，移动等高频操作只保存有限的近期记录。
+本地模式的购买扣币与发货，以及喂食、安葬和复活均作为整份存档的原子事务提交。共享模式的购买采用持久化意图、服务端订单和本地原子发货，详见共享经济指南。重复请求有幂等保护，多窗口冲突重试。损坏或未知版本存档拒绝覆盖，不以重置钱包的方式掩盖错误。经济记录保留，移动等高频操作只保存有限的近期记录。
 
 ## 开发边界
 
 Pet 负责目录、经济规则、照顾与动画；Avatar 负责模型、配色与花纹；Host 负责权限、原生操作、受控命中区域／菜单和持久化。插件不读取输入正文、原始鼠标事件、音频、原始会话文件或私有 Host 状态。
 
-Token 收入通过独立授权的公开 `ctx.usage` 接口获取。当前初始兑换比例是每 10,000 个新增有效 Token 获得 1 宠物币，余数保留；它不会消耗模型额度。第一次连接只建立基线，不把历史累计直接兑换。钱包与同一用量来源的结算进度一起保存，多窗口、重载和重复通知不能重复发币。
-
-当前覆盖本机可确认的 Codex 输入加输出用量，缓存输入和推理输出已包含在其中，不再次相加；这不是账号账单或跨设备总量。新发现文件的已有内容、来源不明、数据不连续等无法确认的区间不会估算奖励。接口明确标记为部分覆盖，界面显示最近同步时间。暂时不可用时保留钱包和结算进度，恢复后从已确认的累计进度继续同步；欢迎物品和亲密度解锁仍可体验。
-
-收益流水合并为累计记录，来源的结算进度永久保留。购买、喂食等经济记录仍分别保存；存档超过 Host 大小限制时明确拒绝新操作，不会默默丢弃收据或重置余额。
+当前公开 `ctx.usage` 的本机 profile 汇总不能区分 Agent 游戏推理，因此暂停这个来源的奖励，显示明确的归因不可用原因。不记录待补收入，不用前后差值补发。既有钱包、收入记录和用量游标仍完整保留，按[共享经济迁移政策](shared-economy.md)处理；正常照顾与已绑定钱包的消费不依赖使用奖励。
 
 ## 宠物管理界面
 
@@ -92,7 +88,7 @@ Token 收入通过独立授权的公开 `ctx.usage` 接口获取。当前初始
 
 同物种可以拥有多个个体，每只都有稳定的独立 ID、名字、性别、基础属性、性格、状态与已装备皮肤。新个体默认名字带序号，可独立改名和照顾；共享已解锁皮肤不意味着共享装备。性别在创建或旧存档迁移时按个体身份稳定初始化，重载不会重抽。旧个体 ID、名字、属性、钱包、背包和设备不变；其已有物种自动记为已解锁。
 
-领养与扣款在同一次存档事务中完成；并发领养生成不同 ID，同一操作重试不重复扣币或增加宠物。领养后可在伙伴管理中选择出场，仍受用户配置的同时出场数量限制。
+本地模式的领养与扣款在同一次存档事务中完成；共享模式先持久化领养意图，经服务端扣款收据确认后原子发放个体。同一操作重试不重复扣币或增加宠物。领养后可在伙伴管理中选择出场，仍受用户配置的同时出场数量限制。
 
 ## 浏览与详情