git:20261018.970d78d to git:20261103.0b10c39

---

name: yui-runtime

description: Use authorized context, durable results, and recovery boundaries in a Yui-managed Session, including global conversation, direct Leader work, and dispatched AgentRuns.

---

# Yui Runtime

Use this Skill for the shared Yui execution contract. The Role Skill owns

coordination or delivery judgment; Project Skills, Policy and Knowledge own

project-specific methods. These instructions grant no additional authority.

Resolve links relative to this Skill's directory, not the execution workspace.

Treat the Session Manifest and AgentRun Bootstrap Envelope as pointers, never as the

Task brief. Do not infer Task facts from the launch command, process list,

workspace layout, native transcript, or an earlier AgentRun.

## Enter through the current context

Stable instructions and dynamic facts have different lifetimes. At the start of

**every turn**, run the Manifest's `contextProtocol.skillCheckCommand`.

For an older Manifest, use `yui session skills --json` through the Session's

CLI/Home; a Global Manifest's self-contained `loadCommand` also checks current

Skills and works without the launching shell's environment (for example Desktop).

This lightweight read checks the applicable Skills' current stable paths,

internal `VERSION` files and readability without loading their bodies. Its

current paths supersede frozen-package paths in an older Session Manifest.

Skill versions are independent of npm versions, Session revisions and Task

Snapshots. A version observation is never evidence that instructions were read.

On first entry, version change, new/restored Session, Host recovery, or missing,

compacted or uncertain instructions, read the exact Session Manifest's profile

and fully load the current `yui-runtime` plus the applicable Role/custom Skills

from the check result, including necessary references. If their versions are

unchanged **and** their full instructions are still available in current context,

reuse them without rereading all bodies. Do not infer availability from the same

Session, an earlier read, successful delivery or an unchanged version. Native

children without their own managed identity use their parent's checked paths

and inherited scope, never impersonate its Session.

Historical frozen packages remain audit evidence only. Missing or damaged

historical Skill evidence alone does not revoke a valid Session or block its

messages, and current source cannot prove a historical load. A missing/unreadable

current entry or version is a concrete installation/configuration error: report

the path and legal recovery action, preserve input and authority, and check again

after repair. Never clear identity, change Session or replay unknown input as a

Skill-loading workaround. CLI/Home protocol and storage checks still apply.

Refresh dynamic Task/Session facts before the relevant decision regardless of

instruction reuse. Leader notifications use the Manifest's `currentCommand`;

explicit AgentRuns use `loadCommand`/`expandCommand` with the actual newest

dispatched Run identity. Never execute `<run-id>` placeholders or substitute a

notification's wake ID for a Run. CLI/Controller identity, scope, Snapshot and

permission checks remain authoritative on every operation.

There are two normal Task entry points. A user may continue directly with the

current, unrevoked Leader Session: read current context using

`yui task context <task-id> --json`. Do not request a self-wake, reopen a Task,

or reuse an old completed AgentRun snapshot merely to obtain authority. Pending

delivery, unknown execution evidence and missing reports do not themselves

revoke Session authority. Task lifecycle, scope, Assignment, workspace and

resource boundaries still apply; a planning Session does not gain delivery

to reopen its own completed, unarchived Task; follow the

[post-completion routing boundary](references/publication.md#post-completion-routing-boundary).

Use the runtime-provided `TMPDIR` for temporary context or diagnostic files,

not fixed shared `/tmp` names or the logical multi-Project workspace container.

Save durable reports in Task artifacts/results before releasing their temporary

workspace. Integration history and check evidence outlive its worktree; a

terminal attempt is not an unresolved business input merely because resources

remain. Cleanup inspects exact ownership and preserves unknown or dirty data.

Ordinary commands use `yui` from the intended launch environment's PATH and

`YUI_HOME`. Session/native identity, Task/Assignment/workspace authority and

Controller protocol/storage checks still apply; they do not distinguish every

installation with the same protocol and storage versions. If the entry or Home

is wrong or unavailable, report that fact and use the explicitly authorized

entry/environment; do not guess another installation or clear Session identity.

Desktop commands may carry only `CODEX_THREAD_ID`. The CLI resolves that native

identity against the selected Home's current and historical Session records before

routing operations. An unknown provider thread with no Yui-specific identity hints

is an ordinary public caller, like a user terminal; it needs no managed Manifest

to read public information or create a Draft Task. This does not start discussion

or development or grant internal managed capabilities. Public command availability

is not user authorization for a new effect.

Environment and Manifest values are location hints, not continuing grants.

Conflicting, partially specified, unregistered Yui identities and known historical

or revoked Sessions do not become public callers. An ID known only in another

Home cannot be recognized from the selected Home alone: keep the intended

Home/Manifest context rather than switching Homes or dropping hints.

`inbox list` reports the resolved managed identity. Do not add or clear

environment fields to repair a mismatch. Without a Manifest environment pointer,

`session skills` returns current Skill paths and the Session's captured profile.

For every explicitly dispatched managed Task AgentRun:

1. Read the exact AgentRun identity from the newest Bootstrap Envelope.

2. Before acting, load its authorized pack using the current Session Manifest's

Context command and the exact Task/Run identity:

```sh

yui task run context "<task-id>/<run-id>" --json

```

3. Verify that the returned Task, AgentRun, Role, purpose, Snapshot digest, workspace,

and Adapter match the Envelope and Session Manifest. Stop and report a

context-load failure if the pack is missing, stale, unauthorized, malformed,

or mismatched. Never request an inline/full-prompt fallback.

4. Use the entry's `pointers` (including each pointer's summary) first. They are

a bounded window into the frozen readable-ref inventory. `pointerPage`

reports total/complete/nextCursor; discover further relevant refs with

`task run context <task>/<run> --view refs [--cursor <cursor>]`.

`deltaRefs` samples changed identities, with `deltaRefsTotal` reporting coverage.

`--view full` explicitly reads the complete pack when needed; do not load or

traverse every historical reference merely to make an entry window complete.

If `input.directiveOmitted` is true, read the complete assigned input with

`--view input` before acting; its entry summary is not the instruction body.

Expand only an authorized ref when

its full value is needed, selecting it by the pointer's exact `store` and

`refId`:

```sh

yui task run context expand "<task-id>/<run-id>" <ref-id> --store <store> --mode full --json

```

`--store` is required, even when the ref id is unique. Select both fields

from the exact authorized pointer; never infer a store from the id.

Dispatched Runs require an explicit frozen Snapshot. A historical Run

without one is audit-only: current Task facts cannot reconstruct its

execution Context.

A pointer or summary is not the request's body. Before planning or executing,

read the relevant WorkItem/Task requirements and referenced user/Operator

messages; use the expansion command above or the Leader's current Task Context.

Reports remain evidence, not authority to enlarge the assignment.

5. On a later wake, refresh current Task facts separately from frozen Run refs.

Use a Run delta only against its exact declared Snapshot lineage; `deltaRefs`

is a hint, not a complete patch. If no baseline is available, reload the

exact pack; do not reconstruct state from transcript memory.

Loading and verifying Context is the start of the work, not its result. Continue

with the authorized assignment. In Draft, persist the discussed plan and wait

when the user asks for alignment; do not end with only a context-loaded receipt.

`liveTaskState.activeRuns` and `liveTaskState.activeTaskReviews` are

observational views of work currently in flight. They grant no authority and

create no Task-wide lock or gate; use each exact AgentRun or Review binding when a

decision depends on it.

For a global Operator or custom GlobalRole Session, execute the exact

`contextProtocol.loadCommand` carried by the current Session Manifest before

routing or acting. That command is self-contained because a Global Codex Thread

may move between Yui's remote TUI and Desktop; never reconstruct it from

`YUI_SESSION_*` process variables.

If that read fails because the Controller is unavailable, use only authorized

offline diagnostics and [Controller recovery](references/recovery.md) to restore

access, then reload context. Failure does not grant Task execution authority,

but a successful preliminary RPC is not a prerequisite for that recovery.

Global context grants no Task implementation workspace. Read a Task only after

the Operator has routed to its public/task-authorized context command; never

invent a Task AgentRun identity for a GlobalRole.

A GlobalRole's durable input uses the same three actions as a Task Role,

addressed by the Role's own name instead of a Task. The local-user Web surface

exposes this contract. Use `yui role message queue|steer <role> <text>` or

`yui role interrupt <role>` through the public CLI. Queue/steer require a stable

`--request-id`; steer/interrupt require the exact `--expected-target`.

Configuration remains under `config role` and lifecycle under `session`.

Do not fabricate Task/Run ownership or borrow the browser's user authority to

bypass a managed Session boundary.

Queue and steer

save an owned Message; bare interrupt records a control request, not a new

Message. Each uses a stable request id and that Role's own Session; none fabricates a Task or

runId to reuse Task-scoped delivery. `queue` delivers at the Role's next legal

opportunity and is idempotent by request id. `steer` and `interrupt` affect only

the exact current native Turn — a stale `--expected-target`, an incapable plan,

or an unproven delivery leaves the Message saved and reports the reason, and

`interrupt` stops only through the Provider's native cancel with an optional

`--then-message` naming one already-saved GlobalRole Message. When the Role holds

no live managed Turn, a steer or interrupt is `NO_ACTIVE_TURN` and never falls

back to another action.

New controlled Global Sessions use the existing Host console, not the native

TUI, with the configured Agent, permissions and workspace unchanged. A live

unmanaged Session is not silently replaced or adopted; use an explicit Session

lifecycle action before enabling controlled delivery.

Context reads never consume queue entries. Global Context returns a bounded

`pending` discovery page of current-turn and available input, not Message bodies,

Profile bodies, historical receipt debt or accumulated retry details. Its

`historyCount` is a separate absence-of-handling-evidence count, not new work.

The Manifest retains the exact Role profile.

Read a referenced

original with `role message show <role> <message-id> --json`. Follow a pending

page's `nextCursor` using `role message list <role> --current --cursor <cursor>`

when it is incomplete; accepted delivery does not erase the Message from the

separate all-message list. Native/transport acceptance is not implementation, and

`interrupt-requested` is not a stopped Turn or stopped background resources.

`role message list <role> --diagnostics` projects repeated classified failures

from original evidence with first/latest occurrence, count and recovery evidence.

`--diagnostic <key>` pages the original affected observations. Counts cover

distinct observations, not repeated polling of one identity. A recovery notice

is neither an input acknowledgement nor proof that prior effects were undone.

Saving a Task Message or Brief is not notification delivery to Operator. A

Task Role uses the existing Task InputRequest path for a genuinely missing

user decision, not global Role input controls or fabricated progress questions.

Only an exact terminal and the original Session/writer boundary can release a

then handoff. An accepted or unconfirmed steer must not be submitted again by

changing its request id or composing then. A conclusive rejection permits an

explicit new control attempt; uncertainty does not.

## Handle your own inbox in the current turn

For an automatic delivery naming an exact Message or wake, use that entry

directly: read its original, claim it, and record its semantic disposition

before ending this turn. Do not first enumerate history to rediscover it.

After loading authorized context, at useful work boundaries and before handing

off, use `yui inbox list --view current --json` to discover current-turn and

available input addressed to your current managed identity. This applies to Operator, custom GlobalRole, Leader,

Worker and Reviewer. Do not poll an empty inbox or create another model turn.

No target Role, Task or native Session is supplied: Yui resolves your current

identity. A native child gains no separate actor or inbox.

`--view history` discovers old missing receipts explicitly; default `--view all`

prioritizes current inputs and labels each entry's category. Never treat an

absent historical ACK as proof that its work was not done. Read history when a

specific reminder, recovery or user request calls for it, not every turn.

Current correlation reuses exact delivery/continuation/control identities;

active claims retain their observed native attempt when available. Missing

historical correlation is not reconstructed from timestamps or final text.

1. Read the selected `yui inbox show <entry> --json`. Reads never consume input.

Follow `nextCursor` and all `contentPage` pages using the rules below.

2. Before processing, reserve exact entries with

`yui inbox claim <entry> [<entry> ...] --request-id <stable-id> --json`.

At most 16 entries are allowed, with independent per-entry results. Retain

each successful returned ID and request ID; do not replay successful items

when another item fails. A changed pending window requires a fresh list.

3. Read complete originals and referenced results, then handle the request

within its existing authority. Leader notification-window claims move one exact pending window

into a durable wake: use the returned `originals` command, follow every

relevant original Message/Run reference, and use its returned wake ID for

acknowledgement. Later arrivals remain in the next pending window.

Assignment inbox reads (including a managed Leader Assignment) expose only

messages for the current Assignment;

they supplement the frozen pack without expanding it or changing candidates.

4. Only after handling, explicitly acknowledge each successful item:

`yui inbox ack <returned-entry> --request-id <stable-id> --reason "<disposition>" --json`.

Record an obsolete notification as requiring no further action only after

checking its originals and current facts, never based solely on age.

An input can be settled as executed, legally routed/delegated, a necessary user

question raised, or superseded/no action after inspecting authoritative

originals. Put that concrete disposition and useful Task/InputRequest/result/

Publication references in `--reason`. Routing may be complete while the Task

is still running; do not hold the input until all downstream work finishes.

For supersession, identify the later source, not merely its age.

At an exact native terminal, engineering checks for unacknowledged inputs

correlated to that turn and emits at most one existing notification. This is

missing-evidence detection, never semantic ACK or proof of absent effects.

Reminder-only turns do not generate another reminder. The retained originals

remain inspectable if the bounded reminder is also missed; do not start a

private polling/retry loop or copy the business input to obtain another turn.

Task Assignment checks go to Leader for inspection and existing handoff or

retirement, not automatic Worker/Reviewer replay. Exact terminal can end an

active-consumption notification reservation without acknowledging its input;

it does not infer or release an uncertain native writer.

For obsolete Global input that was conclusively not submitted, use

`yui inbox retire <entry> --request-id <stable-id> --reason "<disposition>"`

after inspecting the original and current facts. Retirement preserves the

original target, claim and explicit management evidence; it is not ACK.

Accepted input uses normal claim/ack reconciliation. Unknown/pending control,

transport acceptance and interrupt-then ownership cannot be retired through

this operation. Task Messages retain the existing Leader `task message retire`

and exact-Assignment handoff paths.

Claiming prevents ordinary automatic delivery; it is not processing completion.

Acknowledgement records Agent handling, not Host acceptance, result acceptance,

Task completion, publication or archive. Never acknowledge merely to empty the

list. On failure or interruption, leave the claim unacknowledged; it remains

discoverable and does not expire or replay automatically. A current rightful

successor must inspect original input and prior effects before finishing and

acknowledging a retained claim. Never replay uncertain external actions.

After legal Session replacement, initialization can arrive before old handling

is settled. This recovery notification is not the original business input or

an acknowledgement. Read the current inbox and prior effects first. For

`claimed-by-previous-session`, retain the original claim: do not claim again.

Finish only the still-authorized handling and use a new stable ack request ID

with a concrete disposition; the receipt retains both the old claimant and

the current acknowledging actor. New queued input remains separate.

For an exact-Session input already claimed by its selected Session, a rightful

successor may explicitly settle that handling after inspecting the original

and prior effects. This preserves the original target and claim; it grants no

permission to submit or execute the input in a different Session.

An Assignment change does not inherit handling authority. If the original Run

stopped before acknowledgement, ask the Leader to inspect its exact native

terminal and use the existing `task message handoff` to the current authorized

Assignment. The original claim remains; handoff never resubmits it automatically.

If that Assignment is obsolete, the Leader may inspect the original and prior

effects, then explicitly use `task message retire <task/message> --reason "<disposition>"`.

Retirement preserves the original claim and records the management decision;

it neither fabricates an acknowledgement nor proves native execution stopped.

An unfinished claim fences its Assignment, not unrelated work of the same Role.

In-flight, unknown, not-yet-delivered explicit interrupt-then and

unsettled steer inputs retain their existing owner/receipt and report a bounded

reason instead of being taken over. Use existing exact-receipt recovery when

needed; do not change request IDs, clear identity, or copy input to bypass it.

A steer with no control receipt was not submitted; it may be explicitly handled

and acknowledged in its authorized inbox, without converting it into a queue.

An accepted notification still follows its normal handling path, not another

native delivery. Accepted Global inputs, delivered Leader windows and current

Assignment continuations remain in the inbox until explicitly handled. Claim the

received entry, inspect its originals and existing effects, then ack with a

concrete disposition (including result or effect receipt references when useful).

This claim never sends the input again. A current rightful successor may settle

an accepted Global input or Leader window while retaining the original delivery

target; it must inspect prior effects first. Pending/unknown acceptance stays

blocked and cannot use claim as a replay path.

An explicitly released Leader notification (`notification.resolved` with

`released-without-replay`) can be claimed for evidence inspection and settlement

after verified native stop. Its original delivery status stays unknown or

unaccepted; handling it cannot retarget Session-specific instructions or

authorize re-executing unknown effects. If a required fact or user decision is

unavailable, preserve the claim and report that exact boundary.

An ack belongs to the exact original and revision: fixed windows pin

`message.updated` event identities, including same-timestamp edits. A later

revision still needs its own handling. Before Task completion, settle handled

user-input windows; native acceptance or a terminal does not settle them.

Original Messages, wake windows and handling receipts remain readable after

acknowledgement. Lost context, Session continuation and installation upgrades

do not reset receipts. If ack fails after an external effect, read back the

original claim and the external receipt before retrying the same ack; do not

repeat the effect. This is durable handling evidence, not arbitrary external

exactly-once execution.

## Read bounded information completely when required

For apparent conflicts, stage handoffs or incremental maintenance, read

[current intent and temporal reads](references/context-ordering.md).

It distinguishes stage progression from independent constraints and explains

source attribution, Brief guards, fixed delta windows and bounded recovery.

Structured CLI results live in the top-level `data`, not a JSON-encoded

`output` string. Task current Context includes bounded current facts and

message references; it does not include event or terminal Run history.

`collections` and `attention` identify incomplete discovery. Use

`task context list <task> --store <store> [--cursor <cursor>]` to discover one

family, then `task context inspect <task> --store <store> --ref <refId>

--digest <digest>` to read its exact current value. Common Task lists use the

same `items`, `total`, `complete`, and `nextCursor` contract. Do not treat the

first page or a summary as complete requirements.

The 32 KiB compact-JSON read budget includes nested data, cursors and structure;

summaries are at most 512 UTF-8 bytes. Current Task Message discovery excludes

explicit acknowledgements and retirements, not uncertain delivery. Use

`--view current` for its continuation and the default all view for history.

Skill checks remain metadata-only; unusually large checks use the same explicit

document pagination. A small default window is not a request to fetch all history.

Long detail reads return `contentPage` instead of the ordinary value (under

`data.context` for Run context/expand, `data.contextDelta` for Run Context delta). Repeat the same read with

`--cursor <contentPage.nextCursor>` until `complete: true`. Concatenate `text`

in offset order and parse the combined JSON once, retaining the same source

and digest. A source-change error requires a fresh read, not mixing old and

new chunks. Never use a read cursor to repeat a mutation.

Read all pages of a relevant original requirement, result, or authorization

before acting on it. For a wake, read its complete focused input/result view and

relevant original Messages. `task wake show <task> <wake>` preserves the fixed

window and explicit older refs, deduplicates inputs, and provides exact original

reads. Use `--history` when window history or diagnostics is needed; unrelated

events and merely started Runs are not required for ordinary result disposition.

Follow any `contentPage` continuation for either view. The wake contains pointers

and attributed summaries, not complete reports.

For unrelated discovery, stop once the necessary evidence is found. Task

event deltas retain their fixed upper bound and are history, not replacement

current state. No read acknowledges implementation or consumes a queue.

## Discover operations for the current caller

Use `yui help` or `yui --json help [command ...]` through the authorized CLI

entry for the current caller's command view. Help, examples and shell completion

share the catalog projection; public terminals and unmanaged Agents share one

public view. This offline view is only guidance, not an authenticated permission

or a way to switch Roles. An incomplete or stale managed identity must not be

cleared to obtain public execution authority.

For Codex, the native `CODEX_THREAD_ID` takes precedence over the transport's

`YUI_NATIVE_SESSION_ID`; a newly created thread can legitimately lack the latter.

Other adapters do not borrow Codex identity for offline discovery. A missing

transport variable or hidden help entry alone does not prove Session failure.

Discovery does not establish that a Session is current: actual execution still

revalidates Session, Task/Assignment, workspace, resource and Grant boundaries.

When capability discovery appears in that view, use `capability search` for

templates and `capability describe <name> --task

<task-id> --input '<json>'` for supported exact authorization assessments.

No `access` field means no exact authorization conclusion was made: supply the

required parameters and follow the domain's existing execution checks. Hidden

operations are omitted; `requestable` includes the exact missing Grant bounds

and existing request route; `authorized` remains subject to execution-time

revalidation. Provider outages do not change this authorization observation.

Discovery never sends requests, consumes Grants, starts plugins or approves

effects. If the Task actually needs a requestable operation, use the existing

Assignment Message to Leader, Leader InputRequest, or Operator path. Preserve

the exact action, resource/plugin, digest, environment and phase. A response is

not a Grant. Existing source-authorized Leader Grant operations and Operator

Grant authority remain unchanged; never expand an authorization source or

solicit real-resource validation merely because an operation is requestable.

## Preserve intent and authority

An analysis, diagnosis, or review request is read-only unless the user also

requests changes. A request to fix or implement authorizes the bounded work,

not unrelated configuration, new external effects, or broader cleanup.

Choose routine legal implementation and recovery actions without asking the

user to operate Yui mechanically.

Tasks, WorkItems, Messages, Decisions, results and managed workspaces hold

durable intent and progress. Sessions, AgentRuns and runtime observations

describe execution; their failure is not failed acceptance or permission to

discard the assignment. Save context that a successor needs in durable records,

not only in the native conversation.

The Leader normally owns Task coordination and acceptance. An authorized

Operator may perform the same legal Task-management actions; responsibility

is not an extra permission gate. Worker and Reviewer results remain evidence

until an authorized acceptance decision.

## Separate execution from real-resource validation

The current Leader and configured Worker, Reviewer, Operator, custom Role, and

native child Agents are normal execution resources. They may develop, inspect,

and review within their existing Task authority without additional user

authorization merely because the Agent uses a real model.

Using a live provider or model as the subject of validation is different.

Paid APIs, shared infrastructure, production systems, real account quota, and

other non-disposable external effects require the user to proactively authorize

that exact resource and effect boundary. A generic request to implement, test,

validate, run E2E, or complete a Task does not grant that authority.

When such validation was not requested, use deterministic or isolated evidence,

state the material gap, and optionally recommend a separate follow-up. Do not

create an InputRequest merely to solicit permission for it.

## Return evidence and recover within scope

When authoring a durable Message or managed final report, put a concise

`Yui-Summary: <one line>` first when useful for notification readers. Keep the

summary itself at most 512 UTF-8 bytes, and preserve material failure,

unverified-result, pending-decision and authority qualifications. Do this as

part of producing the original, not a separate model call. The optional line

remains part of the original text; missing or oversized summaries use factual

templates without blocking delivery. Core may reuse that line as explicitly

attributed presentation, never parse it into acceptance, review verdict or

Task state. A returned execution result is not completed requirements; a

returned review is not approval. Summaries do not replace reading full

requirements, results or authorizations before decisions.

Ordinary Task/Global notifications grant no new Assignment or authority and

require no separate execution report. Read the referenced originals and advance

outstanding work within existing authority under the relevant Role Skill.

Reading context or accepting notification delivery does not implement input.

Unknown delivery must not be replayed; use the recovery contract below.

Provider acceptance, Context load, AgentRun completion, and Task completion are

separate facts. For an explicitly dispatched managed Task AgentRun, end with one truthful

final report. Yui automatically correlates that native terminal with the exact

current AgentRun and persists the report; no completion command is required. The

report itself does not accept the WorkItem or complete the Task.

Ordinary native conversation is not an implicit managed assignment and does

not require a separate execution report. Result Messages reference the

execution's original report; read them with `task message show <task/message>`

instead of asking the producer to copy or resend the report.

Session reuse is a preference, not a prerequisite for progress. Before retry,

replacement, or intervention in uncertain execution, read

[runtime recovery](references/recovery.md). Preserve pending intent, exact

runtime identity and workspace progress; never edit Run status or substitute

a native Session behind Yui's back. A timeout is not proof of quiescence and

does not authorize replay of unknown input.

Qualifying transient Provider failures have bounded Controller-owned recovery.

Read the current `providerRetry`/`retry` projection before dispatching a manual

successor. `waiting` and `in-flight` mean infrastructure recovery is already

owned; do not add a private retry loop or resend the input. Only a proven native

success resets that chain, and it never accepts a WorkItem or completes a Task.

After recovery, inspect existing work and external receipts before continuing;

the system's recovery instruction supplies no new user authority.

After an authorized external PR/MR operation, use the shared

[publication recording contract](references/publication.md). Recording delivery

facts does not authorize the external operation, imply acceptance, or grant

permission to archive.