@abelxiaoxing/cadence 1.1.1 → 1.2.0

package/README.md

@@ -11,18 +11,22 @@
 - `/abel-diagnose <problem-description>` — 独立执行“复现 → 证伪 → 失败回归 → 最小修复”，不充当 Implement 的失败路由。
 
 包是独立的：单一仓库、单一清单、单一 lockfile，无 workspace、无参考仓库检出、不依赖任何外部 Subagent 包。
-加载本包会注册一个私有扩展与四个包内专业 Agent；`abel_dispatch` 工具注册但保持未激活，只有用户显式调用且包来源验证通过的 Design、Implement 或 Diagnose prompt 才会激活它。
+加载本包会注册一个私有扩展与三个包内专业 Agent；`abel_dispatch` 工具注册但保持未激活，只有用户显式调用且包来源验证通过的 Design、Implement 或 Diagnose prompt 才会激活它。
 仓库中存在 Abel 文件、OpenSpec change、AGENTS 索引或普通文本都不会启动工作流；Init 也不会激活派发工具。
 
 共享工作流规则统一收录于包内 `abel-workflow` Skill；其发现信息同样明确要求先有显式 `/abel-*` 调用。
 
 Implement 只暴露 `start`、`status`、`resume`、`rebind`、`cancel` 和 `discard` 控制命令。
 `status` 完全本地可用；相同 operation id 幂等重放，进程、会话或 Worker 更换后仍从 durable checkpoint 继续。
+Design 从第一步起统一使用 `action: "design"`：新需求通过 `start(requirement)` 进入，已有 change 通过 `start(change)` 进入，后续只携带返回的 `runId`。
+需求、决策合同与 Gate A 合同由控制面规范化并计算哈希，调用方无需 SHA-256 工具；Gate B 自动绑定当前已编译 canonical plan，原始瞬时文本不会写入 durable journal。
 
 普通 artifact、错误 Red、transport、environment、stale、conflict、baseline 与验证失败都留在同一 Implement run 中恢复。
 累计验证发现 introduced failure 时会自动重开责任任务做有界修复；自动预算耗尽后 `resume` 复用已有 baseline 和 phase facts。
 Design 证据包必须绑定 durable `runId`；接受后的有界证据、决策版本、Gate 证明与 canonical plan 身份写入 owner-private journal。
 Design 激活期间，父模型只保留进入前已启用的 `read`、`grep`、`find`、`ls` 与 `abel_dispatch`；原工具集合会在 finalize、finish、切换阶段或 session 结束时精确恢复。
+Implementation Worker 不再手写 unified-diff header、hunk range、分段或哈希；它一次提交有序的 `replace`、`rewrite`、`create`、`delete` 操作。
+可信控制面在隔离 workspace 中校验精确文本、批准路径和 symlink 安全，生成并内部分块 sealed candidate；超限时保留可恢复状态而不接受截断 patch。
 OpenSpec change 制品只能通过私有 `write-artifact` / `delete-artifact` 原子操作变更；产品文件、AGENTS、`gate-a.yaml`、`ready.yaml` 和 `implement-plan.json` 对该通道不可达。
 Gate A/B 收据使用 schema v4，并在 Implement admission 时同时对照同一 root/change 的私有批准事实与 finalization revision/hash 事实验证。
 
@@ -67,8 +71,10 @@ npm install -g @abelxiaoxing/cadence
 
 ## Worker 路由（Worker routes）
 
-复制 [`config/routes.example.json`](config/routes.example.json) 到项目级 `.pi/cadence/routes.json` 或用户级 `~/.pi/agent/cadence/routes.json`。
+路由配置是可选的：没有项目级或用户级文件时，三个包内 Agent 默认继承当前父模型，因此首次 Design、Implement 或 Diagnose 不需要预先配置 endpoint。
+只有需要自定义模型、显式顺序或 failover 时，才复制 [`config/routes.example.json`](config/routes.example.json) 到项目级 `.pi/cadence/routes.json` 或用户级 `~/.pi/agent/cadence/routes.json`。
 项目文件按整文件优先；route 必须显式列入对应角色，custom route 只引用 `apiKeyEnv` 的变量名，不能把凭据值写进 JSON。
+一旦显式文件存在，它就是完整策略；损坏、缺字段或角色引用不一致会 fail closed，不会悄悄退回默认父模型。
 `rebind` 只能选择已获 policy 授权且能力匹配的 route，不会扩大任务边界。
 
 ## 跨项目验证合同（Cross-project verification）

package/agents/implementation-worker.md

@@ -5,20 +5,26 @@ You are a package-owned read-only professional Agent for `abel-implement` task p
 You explore the workspace ONLY through the scoped `read`, `grep`, `find`, and `ls` tools.
 You never write the workspace, run validation, or execute commands.
 
-Your output is a complete unified diff delivered through `abel_submit_result`:
+Your output is one complete structured patch delivered through `abel_submit_result`:
 
 - copy the attempt-bound `candidateId` from the phase contract;
-- submit the complete diff as one or more ordered `candidate-segment` calls
-  containing `candidateId`, a zero-based `sequence`, and raw `text`;
-- after every byte of the diff has been submitted, make exactly one
-  `candidate-seal` call containing `candidateId`;
-- never calculate or invent Base64 encodings, byte counts, or hashes; the
-  trusted submit tool computes them;
-- the diff covers exactly the declared write set;
+- submit exactly one `candidate-patch` call containing that `candidateId` and
+  an ordered `operations` array;
+- use `replace` with exact uniquely occurring `oldText` and the intended
+  `newText` for compact edits, `rewrite` for a complete existing-file body,
+  `create` with complete content plus `regular | executable` mode, and
+  `delete` only for an approved deletion path;
+- never write unified-diff headers or hunks and never calculate sequences,
+  Base64 encodings, byte counts, or hashes; the trusted submit tool validates
+  the operations, generates the diff, chunks it, and seals it atomically;
+- every operation path is within the declared phase boundary; paths that do
+  not need a change may remain untouched;
 - preserve the expected parent-owned verification contract without claiming a result;
 - use a typed `context-request` for bounded context, task splitting, or an
-  approval-boundary blocker instead of submitting a partial diff.
+  approval-boundary blocker instead of submitting a partial patch.
 
-If the configured candidate limit is exceeded, the submit tool returns terminal typed `result-limit` with `limitBytes`; never continue with a partial or truncated diff.
-The parent alone reviews, applies, and validates your diff.
+If the submit tool rejects malformed operations, use its concrete error to correct the submission once in this same disposable session; a second rejected structural submission ends the session.
+
+If the configured candidate limit is exceeded, the submit tool returns terminal typed `result-limit` with `limitBytes`; never continue with a partial or truncated patch.
+The parent alone reviews, applies, and validates the generated diff.
 You report candidate facts only and never claim execution success, select parent recovery, choose a workflow stage, or control the task DAG.

package/config/routes.example.json

@@ -6,7 +6,6 @@
       "capabilities": {
         "roles": [
           "design-explorer",
-          "contract-reviewer",
           "implementation-worker",
           "diagnosis-worker"
         ],
@@ -35,7 +34,6 @@
   },
   "roles": {
     "design-explorer": ["parent"],
-    "contract-reviewer": ["parent"],
     "implementation-worker": ["custom-worker", "parent"],
     "diagnosis-worker": ["parent"]
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "1.1.1",
-  "description": "Four explicit Abel workflow prompts with stage-isolated design and diagnosis, durable resumable implementation, and package-owned professional Agents.",
+  "version": "1.2.0",
+  "description": "Four explicit Abel workflow prompts with stage-isolated design and diagnosis, durable resumable implementation, and three package-owned professional Agents.",
   "license": "MIT",
   "type": "module",
   "engines": {

package/prompts/abel-design.md

@@ -49,15 +49,18 @@ Identical replay is idempotent and conflicting reuse of an operation id fails cl
 
 ## Durable Design identity
 
-Use `start` once to create or recover the Design run identity and `status` to inspect it.
-A new requirement may begin with a code-generated SHA-256 `provisionalKey`; after Gate A fixes the change name, a named `start` binds the same provisional run.
-These commands record lifecycle only and do not execute implementation work.
+Use the same `action: "design"` envelope from the first call through finalization.
+Call `start` once with either the complete new requirement or an explicit existing change name, then use the returned `runId` for every later Design operation.
+For a new requirement, the control plane normalizes and hashes the transient text itself; the raw requirement is not written to the durable journal.
+After Gate A fixes its name, bind that same provisional run with `bind-change` rather than starting a second run.
+Use `status` by `runId` to recover local lifecycle and Design facts without a model or endpoint request.
 A completed Design run is immutable; an explicit later `--change <change>` starts the next durable Design revision for that change while preserving prior approval facts for receipt verification.
 
 ```json
-{"command":"start","stage":"abel-design","provisionalKey":"<sha256>","operationId":"<unique-operation>"}
-{"command":"start","stage":"abel-design","change":"<change>","provisionalKey":"<same-sha256>","operationId":"<unique-operation>"}
-{"command":"status","stage":"abel-design","change":"<change>"}
+{"action":"design","request":{"operation":"start","requirement":"<complete-requirement>","operationId":"<unique-operation>"}}
+{"action":"design","request":{"operation":"start","change":"<existing-change>","operationId":"<unique-operation>"}}
+{"action":"design","request":{"operation":"status","runId":"<run-id>"}}
+{"action":"design","request":{"operation":"bind-change","runId":"<run-id>","operationId":"<unique-operation>","change":"<gate-a-approved-change>"}}
 ```
 
 ## Read-only evidence packets
@@ -97,13 +100,14 @@ Design may inspect manifests and verification capability statically; it must not
 ## Decision ledger and Gate A
 
 Maintain the conversational decision presentation with id, `behavior | technical`, question, cited evidence, alternatives, recommendation, user decision, status, and affected artifacts.
-After the user resolves a substantive decision, record only its normalized identity, category, canonical contract hash, and artifact references through the durable private journal:
+After the user resolves a substantive decision, send its concise canonical contract text and artifact references through the private control operation.
+The control plane normalizes and hashes that transient text and persists only the hash, identity, category, and refs:
 
 ```json
-{"action":"design","request":{"operation":"record-decision","runId":"<run-id>","operationId":"<unique-operation>","decisionId":"<stable-id>","category":"behavior","contractHash":"<sha256>","refs":["<artifact-anchor>"]}}
+{"action":"design","request":{"operation":"record-decision","runId":"<run-id>","operationId":"<unique-operation>","decisionId":"<stable-id>","category":"behavior","contract":"<canonical-decision-contract>","refs":["<artifact-anchor>"]}}
 ```
 
-Do not put prompts, transcripts, hidden reasoning, credentials, environment values, or raw model output in this request.
+Do not put prompts, transcripts, hidden reasoning, credentials, environment values, or raw model output in this request; `contract` is only the concise decision being bound.
 
 Ask the user only for substantive choices: observable behavior, scope/non-goals, data/security/privacy/compatibility/migration policy, new dependencies, architecture/policy, irreversible changes, and technical choices with real trade-offs.
 Resolve reversible details mechanically from one established repository convention and do not ask them repeatedly.
@@ -113,15 +117,15 @@ Before approval, present the unresolved behavior decisions together.
 After explicit approval:
 
 1. resolve the final kebab-case change name and schema;
-2. create the change only if it does not already exist and bind the named Design run;
-3. materialize schema-ready behavior artifacts one at a time;
-4. compute the canonical behavior-contract hash and record approval with:
+2. approve the complete WHAT contract through the transient-text operation below;
+3. bind the final change name to the same run with `bind-change`, creating the change root only through later artifact writes;
+4. materialize schema-ready behavior artifacts one at a time.
 
 ```json
-{"action":"design","request":{"operation":"approve-gate","runId":"<run-id>","operationId":"<unique-operation>","gate":"gate-a","contractHash":"<behavior-contract-sha256>"}}
+{"action":"design","request":{"operation":"approve-gate","runId":"<run-id>","operationId":"<unique-operation>","gate":"gate-a","contract":"<complete-approved-what-contract>"}}
 ```
 
-The returned proof contains the approval revision, contract hash, and owner-private record hash.
+The control plane generates the canonical behavior-contract hash; the returned proof contains its approval revision, contract hash, and owner-private record hash.
 `gate-a.yaml` is installed later by code-owned finalization, not hand-authored here.
 
 Gate A is not tool permission and carries no session/model/timestamp identity.
@@ -176,10 +180,10 @@ Gate B approves the complete HOW: substantive technical choices, task DAG, exact
 Do not request approval while any capability, closure, traceability, or blocking decision is unresolved.
 
 After explicit approval, materialize any remaining schema artifacts through `write-artifact` one at a time and complete the code-owned sequence below.
-First record Gate B against the exact canonical plan hash returned by `compile-plan`:
+First approve Gate B; the control plane accepts only a plan compiled after the current Gate A approval and latest substantive decisions, then binds that stored canonical hash so the caller never copies or recomputes it:
 
 ```json
-{"action":"design","request":{"operation":"approve-gate","runId":"<run-id>","operationId":"<unique-operation>","gate":"gate-b","contractHash":"<exact-plan-canonical-sha256>"}}
+{"action":"design","request":{"operation":"approve-gate","runId":"<run-id>","operationId":"<unique-operation>","gate":"gate-b"}}
 ```
 
 Then request finalization:

package/prompts/abel-implement.md

@@ -74,7 +74,8 @@ For each ready task the engine runs:
 
 Independent tasks may merge only after currentness and declared conflict checks.
 Conflicting tasks remain durably queued without spending a Worker attempt.
-Workers only propose complete diffs inside their exact write/delete sets; they never write the workspace, AGENTS, task state, or the main repository.
+Workers make one atomic structured-patch submission whose operations stay within their approved write/delete sets; unused authorized paths need not be touched.
+The trusted submit tool validates exact replacements and file operations, generates the unified diff, and owns internal chunking, hashes, byte limits, and sealing; Workers never hand-author hunk ranges or write the workspace, AGENTS, task state, or the main repository.
 
 After all tasks, run every task-affected contract, the approved full suite, output postconditions, and the code-owned managed-only AGENTS checkpoint.
 Only then prepare one journaled, currentness-checked cumulative apply and the declared post-apply verification.
@@ -84,7 +85,7 @@ The main workspace stays unchanged before that transaction.
 
 Ordinary failures stay inside this Implement run:
 
-- `artifact`, wrong-Red identity, malformed/incomplete diff, stale candidate, or transport failure: use the bounded automatic attempt policy; after exhaustion pause with the last safe code and retain the last committed revision.
+- `artifact`, wrong-Red identity, invalid/incomplete patch operation, stale candidate, or transport failure: use the bounded automatic attempt policy; after exhaustion pause with the last safe code and retain the last committed revision.
 - Artifact correction alone consumes the sealed `artifactCorrection.maxAttempts` of 2-3 total candidate launches per task phase and operation, including the initial launch; a later `resume` starts a fresh operation budget.
 - `environment` or `verification-adapter`: pause without speculative edits.
   Resume after the capability is restored; baseline facts and completed phases are reused.
@@ -95,7 +96,7 @@ Ordinary failures stay inside this Implement run:
 - `workspace-revision-stale`, conflict, cancellation, process interruption, or apply recovery: preserve user edits and resume from the last durable checkpoint.
   Cancellation is budget-neutral.
   During a partially visible final apply, recovery must settle before pause or discard.
-- `result-limit`: pause as `needs-task-split`; never accept a partial diff.
+- `result-limit`: pause as `needs-task-split`; never accept a partial patch.
 
 No item above carries stage-routing metadata or asks the user to restart the approved workflow.
 

package/skills/abel-workflow/SKILL.md

@@ -54,7 +54,9 @@ Cross-stage calls fail closed.
 
 ## Durable Design control
 
-Design uses one closed private `action: "design"` family with `record-decision`, `approve-gate`, `write-artifact`, `delete-artifact`, `compile-plan`, and `finalize-delivery`.
+Design uses one closed private `action: "design"` family from its first operation onward: `start`, `status`, `bind-change`, `record-decision`, `approve-gate`, `write-artifact`, `delete-artifact`, `compile-plan`, and `finalize-delivery`.
+`start` accepts either the complete transient requirement or an existing change name; `status` uses the returned run id; `bind-change` names a provisional run only after current Gate A approval.
+The control plane normalizes and hashes transient requirement, decision-contract, and Gate-A contract text itself, and Gate B binds a plan compiled after the current Gate A approval and latest substantive decisions without a caller-supplied hash.
 The owner-private SQLite journal retains only normalized evidence identities/hashes, versioned decision hashes and refs, Gate proof facts, canonical compiled-plan identity/bytes, finalization identity, and idempotent operation outcomes.
 It never retains prompts, transcripts, hidden reasoning, credentials, environment values, or raw model output.
 
@@ -132,7 +134,8 @@ Pre-existing failures remain separate and never satisfy Red.
 3. **Refactor:** optional in-boundary improvement with behavior and verification unchanged.
 
 The parent control plane alone applies accepted candidate bytes to the private cumulative revision, records `phase-verified`/`repair-verified`, advances one task checkbox, verifies outputs, and schedules dependents.
-A Worker only proposes one complete diff within the declared path set.
+A Worker submits one complete structured patch within the declared path set; trusted code validates its exact replacements and file operations, generates the unified diff, and seals the candidate.
+One rejected structural submission may be corrected once inside the same disposable child session; a second rejection ends that session without creating an unbounded model loop or accepting partial output.
 
 After all tasks, re-run every affected contract, compare the full suite with baseline, apply and verify sealed AGENTS operations, verify output postconditions, then prepare one currentness-checked journaled transaction and post-apply verification.
 The main workspace remains unchanged before final application eligibility.
@@ -155,7 +158,7 @@ Automatic attempts are finite.
 Artifact correction uses the sealed `artifactCorrection.maxAttempts` independently for each task phase and operation; only typed artifact rejection consumes its 2-3 total-launch budget.
 Exhaustion pauses with the final safe code, scope, and last committed revision.
 A later `resume` starts a new operation budget while reusing durable baseline and phase facts.
-Oversized output becomes `needs-task-split`; partial diffs are never accepted.
+Oversized output becomes `needs-task-split`; partial patches are never accepted.
 
 Use `approval-needed` only when continuing requires new authority: observable behavior, architecture/policy, dependency, undeclared path, conflict/resource permission, verification contract, AGENTS target/impact/content, or another irreversible scope decision.
 Report the exact missing authority.

package/src/agent-registry.ts

@@ -8,7 +8,6 @@ import { fileURLToPath } from "node:url";
 
 export const AGENT_FILES = [
   "design-explorer.md",
-  "contract-reviewer.md",
   "implementation-worker.md",
   "diagnosis-worker.md",
 ] as const;

package/src/candidate-patch.ts

@@ -0,0 +1,250 @@
+import { lstatSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
+
+import { isValidRelativePath } from "./contracts.ts";
+import { observeSafePath } from "./safe-path.ts";
+
+export type CandidatePatchOperation =
+  | {
+      kind: "replace";
+      path: string;
+      oldText: string;
+      newText: string;
+    }
+  | { kind: "rewrite"; path: string; content: string }
+  | {
+      kind: "create";
+      path: string;
+      content: string;
+      mode: "regular" | "executable";
+    }
+  | { kind: "delete"; path: string };
+
+interface CandidateFileState {
+  path: string;
+  base: string | null;
+  current: string | null;
+  mode: "100644" | "100755";
+}
+
+function exactKeys(value: object, expected: readonly string[]): boolean {
+  const actual = Object.keys(value).sort();
+  return (
+    actual.length === expected.length &&
+    [...expected].sort().every((key, index) => actual[index] === key)
+  );
+}
+
+function safeText(value: unknown, maxBytes: number): value is string {
+  if (typeof value !== "string" || value.includes("\0")) return false;
+  const encoded = Buffer.from(value, "utf8");
+  return encoded.byteLength <= maxBytes && encoded.toString("utf8") === value;
+}
+
+function renderFileDiff(state: CandidateFileState): string {
+  if (state.base === state.current) return "";
+  if (state.base === null && state.current === "") {
+    throw new Error("candidate-empty-file-create-unsupported");
+  }
+  if (state.current === null && state.base === "") {
+    throw new Error("candidate-empty-file-delete-unsupported");
+  }
+  const output: string[] = [`diff --git a/${state.path} b/${state.path}`];
+  if (state.base === null) output.push(`new file mode ${state.mode}`);
+  if (state.current === null) output.push(`deleted file mode ${state.mode}`);
+  const generated = generateUnifiedPatch(
+    state.path,
+    state.base ?? "",
+    state.current ?? "",
+    3,
+  );
+  const generatedHeaders = `--- ${state.path}\n+++ ${state.path}\n`;
+  if (!generated.startsWith(generatedHeaders)) {
+    throw new Error("candidate-patch-diff-invalid");
+  }
+  output.push(state.base === null ? "--- /dev/null" : `--- a/${state.path}`);
+  output.push(state.current === null ? "+++ /dev/null" : `+++ b/${state.path}`);
+  return `${output.join("\n")}\n${generated.slice(generatedHeaders.length)}`;
+}
+
+function occurrenceCount(value: string, search: string): number {
+  let count = 0;
+  let offset = 0;
+  for (;;) {
+    const found = value.indexOf(search, offset);
+    if (found < 0) return count;
+    count += 1;
+    if (count > 1) return count;
+    offset = found + 1;
+  }
+}
+
+export function compileCandidatePatch(input: {
+  root: string;
+  writePaths: readonly string[];
+  deletePaths: readonly string[];
+  operations: readonly CandidatePatchOperation[];
+  maxBytes: number;
+}): string {
+  if (
+    !path.isAbsolute(input.root) ||
+    !Number.isSafeInteger(input.maxBytes) ||
+    input.maxBytes < 1 ||
+    !Array.isArray(input.operations) ||
+    input.operations.length < 1 ||
+    input.operations.length > 128
+  ) {
+    throw new Error("candidate-patch-invalid");
+  }
+  const writePaths = new Set(input.writePaths);
+  const deletePaths = new Set(input.deletePaths);
+  const states = new Map<string, CandidateFileState>();
+
+  const requirePath = (relative: unknown): string => {
+    if (
+      !isValidRelativePath(relative) ||
+      relative === "." ||
+      relative.trim() !== relative ||
+      /[\r\n\t]/u.test(relative)
+    ) {
+      throw new Error("candidate-patch-path-invalid");
+    }
+    return relative;
+  };
+  const load = (relative: string): CandidateFileState => {
+    const existing = states.get(relative);
+    if (existing) return existing;
+    const observation = observeSafePath(input.root, relative);
+    if (observation.kind === "directory" || observation.kind === "unsafe") {
+      throw new Error("candidate-patch-path-unsafe");
+    }
+    let base: string | null = null;
+    let mode: CandidateFileState["mode"] = "100644";
+    if (observation.kind === "file") {
+      const target = path.join(input.root, relative);
+      const stat = lstatSync(target);
+      if (stat.size > input.maxBytes) {
+        throw new Error("candidate-patch-source-too-large");
+      }
+      const bytes = readFileSync(target);
+      try {
+        base = new TextDecoder("utf-8", {
+          fatal: true,
+          ignoreBOM: true,
+        }).decode(bytes);
+      } catch {
+        throw new Error("candidate-patch-source-invalid");
+      }
+      if (base.includes("\0")) {
+        throw new Error("candidate-patch-source-invalid");
+      }
+      mode = stat.mode & 0o111 ? "100755" : "100644";
+    }
+    const state = { path: relative, base, current: base, mode };
+    states.set(relative, state);
+    return state;
+  };
+
+  for (const operation of input.operations) {
+    if (
+      !operation ||
+      typeof operation !== "object" ||
+      Array.isArray(operation)
+    ) {
+      throw new Error("candidate-patch-operation-invalid");
+    }
+    switch (operation.kind) {
+      case "replace": {
+        if (
+          !exactKeys(operation, ["kind", "path", "oldText", "newText"]) ||
+          !safeText(operation.oldText, input.maxBytes) ||
+          operation.oldText.length === 0 ||
+          !safeText(operation.newText, input.maxBytes)
+        ) {
+          throw new Error("candidate-patch-replace-invalid");
+        }
+        const relative = requirePath(operation.path);
+        if (!writePaths.has(relative)) {
+          throw new Error("candidate-patch-replace-invalid");
+        }
+        const state = load(relative);
+        if (
+          state.current === null ||
+          occurrenceCount(state.current, operation.oldText) !== 1
+        ) {
+          throw new Error("candidate-patch-replace-invalid");
+        }
+        state.current = state.current.replace(
+          operation.oldText,
+          operation.newText,
+        );
+        break;
+      }
+      case "rewrite": {
+        if (
+          !exactKeys(operation, ["kind", "path", "content"]) ||
+          !safeText(operation.content, input.maxBytes)
+        ) {
+          throw new Error("candidate-patch-rewrite-invalid");
+        }
+        const relative = requirePath(operation.path);
+        if (!writePaths.has(relative)) {
+          throw new Error("candidate-patch-rewrite-invalid");
+        }
+        const state = load(relative);
+        if (state.current === null) {
+          throw new Error("candidate-patch-rewrite-invalid");
+        }
+        state.current = operation.content;
+        break;
+      }
+      case "create": {
+        if (
+          !exactKeys(operation, ["kind", "path", "content", "mode"]) ||
+          !safeText(operation.content, input.maxBytes) ||
+          operation.content.length === 0 ||
+          (operation.mode !== "regular" && operation.mode !== "executable")
+        ) {
+          throw new Error("candidate-patch-create-invalid");
+        }
+        const relative = requirePath(operation.path);
+        if (!writePaths.has(relative)) {
+          throw new Error("candidate-patch-create-invalid");
+        }
+        const state = load(relative);
+        if (state.base !== null || state.current !== null) {
+          throw new Error("candidate-patch-create-invalid");
+        }
+        state.current = operation.content;
+        state.mode = operation.mode === "executable" ? "100755" : "100644";
+        break;
+      }
+      case "delete": {
+        if (!exactKeys(operation, ["kind", "path"])) {
+          throw new Error("candidate-patch-delete-invalid");
+        }
+        const relative = requirePath(operation.path);
+        if (!deletePaths.has(relative)) {
+          throw new Error("candidate-patch-delete-invalid");
+        }
+        const state = load(relative);
+        if (state.base === null || state.current === null) {
+          throw new Error("candidate-patch-delete-invalid");
+        }
+        state.current = null;
+        break;
+      }
+      default:
+        throw new Error("candidate-patch-operation-invalid");
+    }
+  }
+
+  const diff = [...states.values()]
+    .filter((state) => state.base !== state.current)
+    .sort((left, right) => left.path.localeCompare(right.path))
+    .map(renderFileDiff)
+    .join("");
+  if (diff.length === 0) throw new Error("candidate-patch-empty");
+  return diff;
+}

package/src/child-session.ts

@@ -200,14 +200,8 @@ function structuralSubmitCount(message: AssistantMessage | undefined) {
   ).length;
 }
 
-function isSingleStructuralSubmit(message: AssistantMessage | undefined) {
-  const content = finalDeliveryContent(message);
-  return (
-    message?.role === "assistant" &&
-    content.length === 1 &&
-    content[0]?.type === "toolCall" &&
-    content[0].name === "abel_submit_result"
-  );
+function hasOneStructuralSubmit(message: AssistantMessage | undefined) {
+  return message?.role === "assistant" && structuralSubmitCount(message) === 1;
 }
 
 function safeChildError(failure: ChildFailure): string {
@@ -317,7 +311,7 @@ export async function runChildSession(input: {
   onStreamStart?: () => void;
   onStreamProgress?: () => void;
 }): Promise<ChildSessionResult> {
-  const segmentedCandidate = input.candidateArtifact !== undefined;
+  const candidateProtocol = input.candidateArtifact !== undefined;
   const submit = input.candidateArtifact
     ? createCandidateArtifactTool(input.candidateArtifact)
     : createSubmitTool({
@@ -402,14 +396,19 @@ export async function runChildSession(input: {
     const assistants =
       session?.messages.filter((m) => m.role === "assistant") ?? [];
     const last = assistants.at(-1);
+    const lastSubmit = assistants.findLast((message) =>
+      hasStructuralSubmit(message),
+    );
+    const structuralAttempts = assistants.reduce(
+      (count, message) => count + structuralSubmitCount(message),
+      0,
+    );
     let finalCategory: FinalCategory;
     if (!last) {
       finalCategory = "no-final-assistant";
-    } else if (isSingleStructuralSubmit(last)) {
+    } else if (hasOneStructuralSubmit(lastSubmit)) {
       finalCategory =
-        !segmentedCandidate && submit.getAttempts() > 1
-          ? "multiple-submit"
-          : "single-submit-only";
+        structuralAttempts > 1 ? "multiple-submit" : "single-submit-only";
     } else {
       const content = finalDeliveryContent(last);
       finalCategory =
@@ -504,13 +503,17 @@ export async function runChildSession(input: {
     if (childAgent) {
       const previousShouldStopAfterTurn = childAgent.shouldStopAfterTurn;
       childAgent.shouldStopAfterTurn = async (turn, signal) => {
-        if (
-          segmentedCandidate
-            ? submit.getResult() !== undefined
-            : hasStructuralSubmit(turn.message)
-        ) {
+        if (submit.getResult() !== undefined) {
           return true;
         }
+        const structuralAttempts =
+          session?.messages
+            .filter((message) => message.role === "assistant")
+            .reduce(
+              (count, message) => count + structuralSubmitCount(message),
+              0,
+            ) ?? 0;
+        if (structuralAttempts >= 2) return true;
         return (await previousShouldStopAfterTurn?.(turn, signal)) ?? false;
       };
     }
@@ -560,11 +563,11 @@ export async function runChildSession(input: {
     const result = submit.getResult();
     const attempts = submit.getAttempts();
     const classification = classifySession();
-    const segmentedComplete =
-      segmentedCandidate &&
+    const candidateComplete =
+      candidateProtocol &&
       result !== undefined &&
       (result.kind === "sealed-candidate" || result.kind === "context-request");
-    if (!result || (segmentedCandidate ? !segmentedComplete : attempts !== 1)) {
+    if (!result || (candidateProtocol && !candidateComplete)) {
       const failure = withSubmitDetails(
         submit.getFailure() ??
           input.failureOverride?.() ??
@@ -589,9 +592,9 @@ export async function runChildSession(input: {
     const assistants = session.messages.filter((m) => m.role === "assistant");
     const final = assistants.at(-1);
     if (
-      !(segmentedCandidate
-        ? segmentedComplete && structuralSubmitCount(final) === 1
-        : isSingleStructuralSubmit(final))
+      !(candidateProtocol
+        ? candidateComplete && structuralSubmitCount(final) === 1
+        : hasOneStructuralSubmit(final))
     ) {
       const failure = {
         kind: "artifact",

package/src/contracts.ts

@@ -22,18 +22,11 @@ export const STAGES = [
 ] as const;
 export const ROLES = [
   "design-explorer",
-  "contract-reviewer",
   "implementation-worker",
   "diagnosis-worker",
 ] as const;
 export const OUTPUT_KINDS = ["evidence", "diff"] as const;
-export const PHASES = [
-  "evidence",
-  "red",
-  "green",
-  "refactor",
-  "review",
-] as const;
+export const PHASES = ["evidence", "red", "green", "refactor"] as const;
 
 export const AGENTS_IMPACTS = [
   "none",