升级 Trellis 并完成项目审查（07-26-trellis-upgrade-project-audit）

.trellis/config.yaml

@@ -74,12 +74,62 @@ session_auto_commit: false
 #-------------------------------------------------------------------------------
 # Codex (dispatch behavior)
 #-------------------------------------------------------------------------------
-# Codex-only knob; other platforms ignore it. Default ("inline") makes the
-# main Codex agent edit code directly because Codex sub-agents run with
-# `fork_turns="none"` isolation and can't inherit the parent session's
-# task context. Set to "sub-agent" to opt into the legacy dispatch model
-# (main agent spawns trellis-implement / trellis-check / trellis-research
-# sub-agents).
+# Codex-only knob; other platforms ignore it. Trellis 0.6.9 supports native
+# sub-agent context injection, but hyb-oa deliberately keeps the main session
+# in charge unless a task explicitly approves sub-agent work. "sub-agent" is
+# retained upstream as a backwards-compatible alias for "auto".
 #
 codex:
   dispatch_mode: inline  # keep Codex main-session edits until a task explicitly asks for sub-agents
+
+#-------------------------------------------------------------------------------
+# Channel worker OOM guard
+#-------------------------------------------------------------------------------
+# Default safeguards for `trellis channel spawn` workers. The guard runs
+# at spawn time (cleans expired idle workers, then enforces the live-worker
+# budget) and inside each supervisor (self-terminates a worker that stays
+# continuously idle past `idle_timeout`).
+#
+# Precedence: CLI flag > env var (TRELLIS_CHANNEL_WORKER_IDLE_TIMEOUT /
+# TRELLIS_CHANNEL_MAX_LIVE_WORKERS) > this config > built-in default.
+#
+# `idle_timeout: 0` disables idle cleanup (workers can sit idle forever
+# unless explicitly killed or given `--timeout`).
+# `max_live_workers: 0` disables the spawn-time budget check.
+#
+# `trusted_context_dirs` extends the `--file`/`--jsonl`/`--agent` containment
+# check beyond the worker cwd — useful when `.trellis/tasks` or
+# `.trellis/workspace` is a symlink to an external directory. Realpaths under
+# any listed dir are accepted in addition to cwd.
+# `auto_trust_trellis_symlinks: false` disables the narrow auto-trust of
+# `.trellis/tasks` / `.trellis/workspace` when either is itself a top-level
+# symlink (auto-trust is on by default).
+#
+channel:
+  worker_guard:
+    idle_timeout: 5m
+    max_live_workers: 6
+  # trusted_context_dirs:
+  #   - /work/user/trellis_workspace
+  # auto_trust_trellis_symlinks: false
+
+#-------------------------------------------------------------------------------
+# Sub-agent context injection limits
+#-------------------------------------------------------------------------------
+# Trellis 0.6.9 caps injected task artifacts and referenced context. Defaults
+# are sufficient for hyb-oa; keep them documented but implicit until a real
+# task proves they need tuning.
+#
+# context_injection:
+#   max_file_bytes: 32768
+#   max_artifact_bytes: 65536
+#   max_total_bytes: 131072
+
+#-------------------------------------------------------------------------------
+# Per-turn prompt injection
+#-------------------------------------------------------------------------------
+# Optional one-turn escape hatch. The project does not enable it by default so
+# Trellis task state remains deterministic.
+#
+# prompt_injection:
+#   skip_keyword: "no-trellis"