@abelxiaoxing/cadence 1.3.0 → 1.4.0

package/src/index.ts

@@ -1,3 +1,19 @@
+import { compareCanonicalStrings } from "./canonical.ts";
+import { packageDeliverySource } from "./package-delivery.ts";
+import {
+  changeVerificationResult,
+  executePackageVerification,
+  phaseVerificationResult,
+} from "./package-verification.ts";
+import { captureVerificationEnvironmentIdentity } from "./verification-environment.ts";
+
+export {
+  type PackageDeliverySourceOptions,
+  type PackageWorkflowDeliverySource,
+  packageDeliverySource,
+} from "./package-delivery.ts";
+export { executePackageVerification } from "./package-verification.ts";
+
 // Private workflow orchestration extension. Registers the abel_dispatch tool
 // on load, then keeps it inactive by default by removing only that name from
 // the active set at session start. Eligible-stage activation is wired by the
@@ -5,14 +21,6 @@
 // integration; abel-init and ordinary prompts never activate dispatch.
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
-import {
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  realpathSync,
-  rmSync,
-} from "node:fs";
 import { homedir } from "node:os";
 import path, { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -28,12 +36,9 @@ import { type Activation, activateTool, deactivateTool } from "./activation.ts";
 import { loadAgentDefinitions } from "./agent-registry.ts";
 import { runChildSession } from "./child-session.ts";
 import {
-  type AtomicVerificationContract,
   type DesignEvidenceResult,
-  isValidRelativePath,
   LIMITS,
   type StructuredVerificationContract,
-  verificationSteps,
 } from "./contracts.ts";
 import {
   CONTROL_COMMAND_PARAMETERS,
@@ -41,26 +46,16 @@ import {
   validateControlCommand,
 } from "./control-contracts.ts";
 import {
-  assessDeliveryTraceability,
-  compileImplementPlan,
   DeliveryValidationError,
   DesignPlanValidationError,
-  type GateApprovalProof,
-  parseGateAReceipt,
-  parseImplementPlan,
-  parseReadyReceipt,
 } from "./delivery-compiler.ts";
 import {
   DesignController,
   DesignFinalizationError,
   validateDesignControlRequest,
 } from "./design-control.ts";
-import { canonicalJson, hashCanonicalValue } from "./implement-graph.ts";
-import { BubblewrapIsolationBackend } from "./isolation-backend.ts";
-import {
-  inspectOpenSpecDelivery,
-  type OpenSpecDeliveryInspection,
-} from "./openspec-cli.ts";
+import { canonicalJson } from "./implement-graph.ts";
+import { inspectOpenSpecDelivery } from "./openspec-cli.ts";
 import { PACKET_ACTIONS, PacketRuntime } from "./packet-runtime.ts";
 import { ParentPayloadBridge } from "./parent-payload-bridge.ts";
 import { runtimeForWorkerRoute } from "./parent-provider.ts";
@@ -72,7 +67,7 @@ import {
   type WorkerRoutePolicy,
 } from "./route-policy.ts";
 import { RunStoreFormatError, RunStoreMigrationError } from "./run-store.ts";
-import { observeSafePath } from "./safe-path.ts";
+import { isSafeRegularFile } from "./safe-path.ts";
 import { resolveStateRoot, StateRootError } from "./state-root.ts";
 import {
   ACTIVITY_DETAILS_KEY,
@@ -81,17 +76,11 @@ import {
   renderActivityResult,
   type WorkflowActivityUpdate,
 } from "./subagent-activity.ts";
-import { classifyCandidateContextRequest } from "./submit-tool.ts";
 import {
-  bindCurrentVerificationCapability,
-  isVerificationCapabilityCurrent,
-  type VerificationRunnerBinding,
-} from "./verification-capability.ts";
-import {
-  openDurableWorkflowEngine,
-  type WorkflowAvailableDelivery,
-  type WorkflowDeliverySource,
-} from "./workflow-engine.ts";
+  classifyCandidateContextRequest,
+  permitsContextRead,
+} from "./submit-tool.ts";
+import { openDurableWorkflowEngine } from "./workflow-engine.ts";
 
 export {
   inspectOpenSpecDelivery,
@@ -293,9 +282,9 @@ const DESIGN_CONTROL_REQUEST_SCHEMA = {
         operationId: { type: "string" },
         gate: { type: "string", enum: ["gate-a"] },
         contract: {
-          type: "string",
+          anyOf: [{ type: "string" }, { type: "object" }],
           description:
-            "Complete approved WHAT contract; code hashes it and never persists the text.",
+            "Structured ChangeContract with goal, acceptance, constraints and policy. Legacy prose remains readable; code hashes authority.",
         },
       },
       required: ["operation", "runId", "operationId", "gate", "contract"],
@@ -363,11 +352,13 @@ function invokedPrompt(text: string): EligiblePrompt | undefined {
   return ELIGIBLE_PROMPTS.find((candidate) => candidate === name);
 }
 
-function promptMarker(name: EligiblePrompt): string {
+type WorkflowPrompt = EligiblePrompt | "abel-init";
+
+function promptMarker(name: WorkflowPrompt): string {
   return `<!-- ABEL:PROMPT:${name} -->`;
 }
 
-function hasPackageProvenance(pi: ExtensionAPI, name: EligiblePrompt): boolean {
+function hasPackageProvenance(pi: ExtensionAPI, name: WorkflowPrompt): boolean {
   const commands = pi
     .getCommands()
     .filter((candidate) => candidate.name === name);
@@ -382,7 +373,7 @@ function hasPackageProvenance(pi: ExtensionAPI, name: EligiblePrompt): boolean {
 
 function hasExpandedPromptMarker(
   prompt: string,
-  name: EligiblePrompt,
+  name: WorkflowPrompt,
 ): boolean {
   const requestEnd = prompt.lastIndexOf("</abel-request>");
   if (requestEnd < 0) return false;
@@ -650,12 +641,12 @@ function safeDesignFailure(
               SAFE_DESIGN_ERROR_CODE.test(entry[1])
             );
           })
-          .sort(([left], [right]) => left.localeCompare(right)),
+          .sort(([left], [right]) => compareCanonicalStrings(left, right)),
       );
       return typeof admitted.code === "string" ? [admitted] : [];
     })
     .sort((left, right) =>
-      canonicalJson(left).localeCompare(canonicalJson(right)),
+      compareCanonicalStrings(canonicalJson(left), canonicalJson(right)),
     )
     .filter(
       (candidate, index, values) =>
@@ -687,6 +678,11 @@ export interface WorkflowControlEngine {
     onActivity?: (event: WorkflowActivityUpdate) => void,
   ): Promise<Record<string, unknown>>;
   executeDesign?(request: unknown): Promise<Record<string, unknown>>;
+  executeAmendment?(
+    change: string,
+    batchId: string,
+    request: unknown,
+  ): Promise<Record<string, unknown>>;
   assertDesignRun?(runId: string): void;
   recordDesignEvidence?(input: {
     runId: string;
@@ -700,899 +696,10 @@ export type WorkflowControlEngineFactory = (
   parentPayloadBridge: ParentPayloadBridge,
 ) => WorkflowControlEngine | Promise<WorkflowControlEngine>;
 
-const PACKAGE_DELIVERY_MAX_BYTES = 16 * 1024 * 1024;
-
-export interface PackageDeliverySourceOptions {
-  inspectOpenSpec?: (
-    consumerRoot: string,
-    change: string,
-  ) => Promise<OpenSpecDeliveryInspection>;
-  verifyGateProof?: (input: {
-    change: string;
-    gate: "gate-a" | "gate-b";
-    proof: GateApprovalProof;
-  }) => boolean;
-  verifyFinalizedDelivery?: (input: {
-    change: string;
-    deliveryRevision: number;
-    receiptHash: string;
-    gateA: GateApprovalProof;
-    gateB: GateApprovalProof;
-    planCanonicalHash: string;
-  }) => boolean;
-}
-
-export interface PackageWorkflowDeliverySource extends WorkflowDeliverySource {
-  discoverLatest(input: {
-    stage: "abel-implement";
-    change: string;
-  }): Promise<WorkflowAvailableDelivery | undefined>;
-}
-
 function sha256(value: Uint8Array | string): string {
   return createHash("sha256").update(value).digest("hex");
 }
 
-function proofVerified(verify: () => boolean): boolean {
-  try {
-    return verify() === true;
-  } catch {
-    return false;
-  }
-}
-
-function normalizedTrackingArtifact(
-  bytes: Uint8Array,
-  taskIds: readonly string[],
-): Buffer | undefined {
-  let text: string;
-  try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  } catch {
-    return undefined;
-  }
-  const identities = taskIds.map((taskId) => ({
-    taskId,
-    pattern: new RegExp(
-      `(?:^|[^A-Za-z0-9._:-])${taskId.replace(
-        /[.*+?^${}()|[\]\\]/gu,
-        "\\$&",
-      )}(?![A-Za-z0-9._:-])`,
-      "u",
-    ),
-    matches: 0,
-  }));
-  const normalized = text
-    .split(/(?<=\n)/u)
-    .map((segment) => {
-      const line = segment.endsWith("\n") ? segment.slice(0, -1) : segment;
-      if (!/^\s*-\s+\[[ xX]\]/u.test(line)) return segment;
-      const matching = identities.filter(({ pattern }) => pattern.test(line));
-      if (matching.length !== 1) return segment;
-      matching[0].matches += 1;
-      return segment.replace(/^(\s*-\s+)\[[xX]\]/u, "$1[ ]");
-    })
-    .join("");
-  if (identities.some(({ matches }) => matches !== 1)) return undefined;
-  return Buffer.from(normalized, "utf8");
-}
-
-function readPackageDeliveryFile(
-  root: string,
-  relative: string,
-  maximumBytes = PACKAGE_DELIVERY_MAX_BYTES,
-): Buffer {
-  const observation = observeSafePath(root, relative);
-  if (observation.kind !== "file") {
-    throw new Error("delivery-file-unavailable");
-  }
-  const target = path.join(root, ...relative.split("/"));
-  const stat = lstatSync(target);
-  if (stat.size < 1 || stat.size > maximumBytes) {
-    throw new Error("delivery-file-size-invalid");
-  }
-  return readFileSync(target);
-}
-
-export function packageDeliverySource(
-  consumerRoot: string,
-  options: PackageDeliverySourceOptions = {},
-): PackageWorkflowDeliverySource {
-  const inspect = options.inspectOpenSpec ?? inspectOpenSpecDelivery;
-  const verifyGateProof = options.verifyGateProof;
-  const verifyFinalizedDelivery = options.verifyFinalizedDelivery;
-  return {
-    async discoverLatest(input) {
-      if (
-        input.stage !== "abel-implement" ||
-        !verifyGateProof ||
-        !verifyFinalizedDelivery
-      ) {
-        return undefined;
-      }
-      try {
-        const changeRoot = `openspec/changes/${input.change}`;
-        const receiptBytes = readPackageDeliveryFile(
-          consumerRoot,
-          `${changeRoot}/ready.yaml`,
-          4 * 1024 * 1024,
-        );
-        const receipt = parseReadyReceipt(receiptBytes);
-        if (receipt.change !== input.change) return undefined;
-        const gateABytes = readPackageDeliveryFile(
-          consumerRoot,
-          `${changeRoot}/${receipt.approvals.gateA.path}`,
-          4 * 1024 * 1024,
-        );
-        if (sha256(gateABytes) !== receipt.approvals.gateA.rawSha256) {
-          return undefined;
-        }
-        const gateA = parseGateAReceipt(gateABytes);
-        if (
-          gateA.change !== receipt.change ||
-          gateA.schema !== receipt.schema ||
-          !proofVerified(() =>
-            verifyGateProof({
-              change: input.change,
-              gate: "gate-a",
-              proof: gateA.approval,
-            }),
-          ) ||
-          !proofVerified(() =>
-            verifyGateProof({
-              change: input.change,
-              gate: "gate-b",
-              proof: receipt.approvals.gateB,
-            }),
-          )
-        ) {
-          return undefined;
-        }
-        const receiptHash = sha256(receiptBytes);
-        if (
-          !proofVerified(() =>
-            verifyFinalizedDelivery({
-              change: input.change,
-              deliveryRevision: receipt.deliveryRevision,
-              receiptHash,
-              gateA: gateA.approval,
-              gateB: receipt.approvals.gateB,
-              planCanonicalHash: receipt.plan.canonicalHash,
-            }),
-          )
-        ) {
-          return undefined;
-        }
-        return {
-          deliveryRevision: receipt.deliveryRevision,
-          receiptHash,
-        };
-      } catch {
-        return undefined;
-      }
-    },
-    async load(input) {
-      if (input.stage !== "abel-implement") {
-        throw new DeliveryValidationError(["delivery-stage-invalid"]);
-      }
-      const changeRoot = `openspec/changes/${input.change}`;
-      const receiptRelative = `${changeRoot}/ready.yaml`;
-      const planRelative = `${changeRoot}/implement-plan.json`;
-      let receiptBytes: Buffer;
-      try {
-        receiptBytes = readPackageDeliveryFile(
-          consumerRoot,
-          receiptRelative,
-          4 * 1024 * 1024,
-        );
-      } catch {
-        throw new DeliveryValidationError(["delivery-receipt-unavailable"]);
-      }
-      let receipt: ReturnType<typeof parseReadyReceipt>;
-      try {
-        receipt = parseReadyReceipt(receiptBytes);
-      } catch {
-        throw new DeliveryValidationError([
-          "delivery-receipt-invalid",
-          "delivery-recompile-required",
-        ]);
-      }
-      const diagnostics = new Set<string>();
-      if (receipt.change !== input.change) {
-        diagnostics.add("delivery-change-mismatch");
-      }
-      const receiptHash = sha256(receiptBytes);
-      if (
-        (input.deliveryRevision !== undefined &&
-          input.deliveryRevision !== receipt.deliveryRevision) ||
-        (input.receiptHash !== undefined && input.receiptHash !== receiptHash)
-      ) {
-        diagnostics.add("delivery-revision-mismatch");
-      }
-
-      let inspection: OpenSpecDeliveryInspection | undefined;
-      try {
-        inspection = await inspect(consumerRoot, input.change);
-      } catch {
-        diagnostics.add("delivery-openspec-unavailable");
-      }
-      if (inspection) {
-        if (!inspection.strictValid) {
-          diagnostics.add("delivery-openspec-strict-invalid");
-        }
-        if (!inspection.planningComplete) {
-          diagnostics.add("delivery-openspec-incomplete");
-        }
-        if (inspection.schema !== receipt.schema) {
-          diagnostics.add("delivery-schema-mismatch");
-        }
-      }
-
-      let gateABytes: Buffer | undefined;
-      let gateA: ReturnType<typeof parseGateAReceipt> | undefined;
-      try {
-        gateABytes = readPackageDeliveryFile(
-          consumerRoot,
-          `${changeRoot}/${receipt.approvals.gateA.path}`,
-          4 * 1024 * 1024,
-        );
-        if (sha256(gateABytes) !== receipt.approvals.gateA.rawSha256) {
-          diagnostics.add("delivery-gate-a-hash-mismatch");
-        }
-        gateA = parseGateAReceipt(gateABytes);
-        if (
-          gateA.change !== receipt.change ||
-          gateA.schema !== receipt.schema
-        ) {
-          diagnostics.add("delivery-gate-a-binding-mismatch");
-        }
-      } catch {
-        diagnostics.add("delivery-gate-a-invalid");
-      }
-
-      const artifactBytes = new Map<string, Buffer>();
-      const artifactHashes = new Map(
-        receipt.artifacts.map((artifact) => [
-          artifact.path,
-          artifact.rawSha256,
-        ]),
-      );
-      for (const artifact of receipt.artifacts) {
-        try {
-          const bytes = readPackageDeliveryFile(
-            consumerRoot,
-            `${changeRoot}/${artifact.path}`,
-          );
-          artifactBytes.set(artifact.path, bytes);
-          if (
-            artifact.path !== receipt.traceability.taskPath &&
-            sha256(bytes) !== artifact.rawSha256
-          ) {
-            diagnostics.add(`delivery-artifact-hash-mismatch:${artifact.path}`);
-          }
-        } catch {
-          diagnostics.add(`delivery-artifact-unavailable:${artifact.path}`);
-        }
-      }
-      if (inspection) {
-        const covered = new Set(receipt.artifacts.map((entry) => entry.path));
-        const expected = new Set(inspection.artifactPaths);
-        for (const relative of expected) {
-          if (!isValidRelativePath(relative) || !covered.has(relative)) {
-            diagnostics.add(`delivery-artifact-unbound:${relative}`);
-          }
-        }
-        for (const relative of covered) {
-          if (!expected.has(relative)) {
-            diagnostics.add(`delivery-artifact-not-in-openspec:${relative}`);
-          }
-        }
-      }
-      if (gateA) {
-        if (!verifyGateProof) {
-          diagnostics.add("delivery-gate-proof-verifier-unavailable");
-        } else if (
-          !proofVerified(() =>
-            verifyGateProof({
-              change: input.change,
-              gate: "gate-a",
-              proof: gateA.approval,
-            }),
-          )
-        ) {
-          diagnostics.add("delivery-gate-a-proof-invalid");
-        }
-        for (const artifact of gateA.artifacts) {
-          if (artifactHashes.get(artifact.path) !== artifact.rawSha256) {
-            diagnostics.add(
-              `delivery-gate-a-artifact-mismatch:${artifact.path}`,
-            );
-          }
-        }
-      }
-      if (
-        verifyGateProof &&
-        !proofVerified(() =>
-          verifyGateProof({
-            change: input.change,
-            gate: "gate-b",
-            proof: receipt.approvals.gateB,
-          }),
-        )
-      ) {
-        diagnostics.add("delivery-gate-b-proof-invalid");
-      }
-      if (gateA) {
-        if (!verifyFinalizedDelivery) {
-          diagnostics.add("delivery-finalization-verifier-unavailable");
-        } else if (
-          !proofVerified(() =>
-            verifyFinalizedDelivery({
-              change: input.change,
-              deliveryRevision: receipt.deliveryRevision,
-              receiptHash,
-              gateA: gateA.approval,
-              gateB: receipt.approvals.gateB,
-              planCanonicalHash: receipt.plan.canonicalHash,
-            }),
-          )
-        ) {
-          diagnostics.add("delivery-finalization-proof-invalid");
-        }
-      }
-
-      let plan: ReturnType<typeof parseImplementPlan> | undefined;
-      let planBytes: Buffer | undefined;
-      try {
-        planBytes = readPackageDeliveryFile(consumerRoot, planRelative);
-        plan = parseImplementPlan(planBytes);
-      } catch {
-        diagnostics.add("delivery-plan-invalid");
-      }
-      if (plan && planBytes) {
-        if (plan.changeId !== input.change) {
-          diagnostics.add("delivery-plan-change-mismatch");
-        }
-        let compiled: ReturnType<typeof compileImplementPlan> | undefined;
-        try {
-          compiled = compileImplementPlan(plan, { consumerRoot });
-        } catch {
-          diagnostics.add("delivery-verification-closure-invalid");
-        }
-        if (
-          receipt.plan.path !== "implement-plan.json" ||
-          receipt.plan.rawSha256 !== sha256(planBytes) ||
-          receipt.plan.canonicalHash !== hashCanonicalValue(plan)
-        ) {
-          diagnostics.add("delivery-plan-binding-invalid");
-        }
-        if (
-          compiled &&
-          canonicalJson(compiled.closure) !==
-            canonicalJson(receipt.verificationClosure)
-        ) {
-          diagnostics.add("delivery-verification-closure-mismatch");
-        }
-      }
-
-      if (plan) {
-        const tasksBytes = artifactBytes.get(receipt.traceability.taskPath);
-        const expectedTasksHash = artifactHashes.get(
-          receipt.traceability.taskPath,
-        );
-        if (
-          tasksBytes &&
-          expectedTasksHash &&
-          sha256(tasksBytes) !== expectedTasksHash
-        ) {
-          const normalized = normalizedTrackingArtifact(
-            tasksBytes,
-            plan.tracking.taskIds,
-          );
-          if (!normalized || sha256(normalized) !== expectedTasksHash) {
-            diagnostics.add(
-              `delivery-artifact-hash-mismatch:${receipt.traceability.taskPath}`,
-            );
-          }
-        }
-        const specs = [...artifactBytes]
-          .filter(
-            ([relative]) =>
-              relative.startsWith("specs/") && relative.endsWith("/spec.md"),
-          )
-          .flatMap(([relative, bytes]) => {
-            try {
-              return [
-                {
-                  path: relative,
-                  text: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
-                },
-              ];
-            } catch {
-              diagnostics.add(`delivery-artifact-encoding-invalid:${relative}`);
-              return [];
-            }
-          });
-        if (!tasksBytes || specs.length === 0) {
-          diagnostics.add("delivery-traceability-input-unavailable");
-        } else {
-          try {
-            const traceability = assessDeliveryTraceability({
-              tasksMarkdown: new TextDecoder("utf-8", { fatal: true }).decode(
-                tasksBytes,
-              ),
-              specs,
-              plan,
-            });
-            if (!traceability.ok) {
-              for (const diagnostic of traceability.diagnostics) {
-                diagnostics.add(diagnostic);
-              }
-            } else if (
-              canonicalJson(traceability.value) !==
-              canonicalJson(receipt.traceability)
-            ) {
-              diagnostics.add("delivery-traceability-binding-mismatch");
-            }
-          } catch {
-            diagnostics.add("delivery-traceability-invalid");
-          }
-        }
-      }
-      if (!plan || !gateA || diagnostics.size > 0) {
-        throw new DeliveryValidationError([...diagnostics]);
-      }
-      return {
-        gate: "gate-b",
-        revision: receipt.deliveryRevision,
-        receiptHash,
-        plan,
-        approvalProofs: {
-          gateA: structuredClone(gateA.approval),
-          gateB: structuredClone(receipt.approvals.gateB),
-        },
-      };
-    },
-  };
-}
-
-function packageScriptInvocation(
-  packageManager: string,
-  script: string,
-  args: string[],
-): string[] {
-  return packageManager === "npm" || packageManager === "pnpm"
-    ? ["run", script, "--", ...args]
-    : ["run", script, ...args];
-}
-
-function bindingFor(
-  bindings: readonly VerificationRunnerBinding[],
-  command: string,
-): VerificationRunnerBinding | undefined {
-  return bindings.find((binding) => binding.command === command);
-}
-
-function prepareRunnerBindings(
-  root: string,
-  bindings: readonly VerificationRunnerBinding[],
-): {
-  bindings: VerificationRunnerBinding[];
-  mounts: Array<{ source: string; target: string }>;
-  cleanupRoot?: string;
-} {
-  if (!bindings.some((binding) => binding.mountSource)) {
-    return {
-      bindings: bindings.map((binding) => ({
-        ...binding,
-        ...(binding.fixedArgs ? { fixedArgs: [...binding.fixedArgs] } : {}),
-      })),
-      mounts: [],
-    };
-  }
-  const cleanupRoot = mkdtempSync(path.join(root, ".cadence-runners-"));
-  try {
-    const mounted = new Map<
-      string,
-      { source: string; target: string; sandboxTarget: string }
-    >();
-    const prepared = bindings.map((binding) => {
-      if (!binding.mountSource) return { ...binding };
-      const source = path.resolve(binding.mountSource);
-      const sourceStat = lstatSync(source);
-      if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
-        throw new Error("runner-mount-unavailable");
-      }
-      let mount = mounted.get(source);
-      if (!mount) {
-        const target = path.join(cleanupRoot, String(mounted.size));
-        mkdirSync(target, { mode: 0o700 });
-        const sandboxRelative = path
-          .relative(root, target)
-          .split(path.sep)
-          .join("/");
-        mount = {
-          source,
-          target,
-          sandboxTarget: `/workspace/${sandboxRelative}`,
-        };
-        mounted.set(source, mount);
-      }
-      const executable = realpathSync(binding.executablePath);
-      const relative = path.relative(source, executable);
-      if (
-        relative === "" ||
-        relative.startsWith("..") ||
-        path.isAbsolute(relative)
-      ) {
-        throw new Error("runner-mount-unavailable");
-      }
-      return {
-        command: binding.command,
-        executablePath: path.posix.join(
-          mount.sandboxTarget,
-          ...relative.split(path.sep),
-        ),
-        ...(binding.fixedArgs ? { fixedArgs: [...binding.fixedArgs] } : {}),
-      };
-    });
-    return {
-      bindings: prepared,
-      mounts: [...mounted.values()].map(({ source, sandboxTarget }) => ({
-        source,
-        target: sandboxTarget,
-      })),
-      cleanupRoot,
-    };
-  } catch (error) {
-    rmSync(cleanupRoot, { recursive: true, force: true });
-    throw error;
-  }
-}
-
-function verificationInvocation(
-  step: AtomicVerificationContract,
-  bindings: readonly VerificationRunnerBinding[],
-): { executable: string; args: string[] } | undefined {
-  const reporter = step.kind === "vitest" ? ["--reporter=json"] : [];
-  if (step.kind === "package-script") {
-    const binding = bindingFor(bindings, step.packageManager);
-    return binding
-      ? {
-          executable: binding.executablePath,
-          args: [
-            ...(binding.fixedArgs ?? []),
-            ...packageScriptInvocation(
-              step.packageManager,
-              step.script,
-              step.args,
-            ),
-          ],
-        }
-      : undefined;
-  }
-  const runner = step.runner;
-  if (runner.kind === "package-script") {
-    const binding = bindingFor(bindings, runner.packageManager);
-    const args =
-      step.kind === "vitest"
-        ? [...step.testFiles, ...step.args, ...reporter]
-        : step.args;
-    return binding
-      ? {
-          executable: binding.executablePath,
-          args: [
-            ...(binding.fixedArgs ?? []),
-            ...packageScriptInvocation(
-              runner.packageManager,
-              runner.script,
-              args,
-            ),
-          ],
-        }
-      : undefined;
-  }
-  if (runner.kind === "local-binary") {
-    const binding = bindingFor(bindings, runner.executable);
-    return {
-      executable:
-        binding?.executablePath ??
-        `/workspace/node_modules/.bin/${runner.executable}`,
-      args: [
-        ...(binding?.fixedArgs ?? []),
-        ...(step.kind === "vitest"
-          ? [...step.testFiles, ...step.args, ...reporter]
-          : step.args),
-      ],
-    };
-  }
-  const command = runner.kind === "node" ? "node" : "npx";
-  const binding = bindingFor(bindings, command);
-  if (!binding) return undefined;
-  return {
-    executable: binding.executablePath,
-    args:
-      runner.kind === "node"
-        ? [...(binding.fixedArgs ?? []), runner.script, ...step.args]
-        : [
-            ...(binding.fixedArgs ?? []),
-            "--no-install",
-            runner.executable,
-            ...(step.kind === "vitest" ? step.testFiles : []),
-            ...step.args,
-            ...reporter,
-          ],
-  };
-}
-
-function vitestReport(stdout: string):
-  | {
-      total: number;
-      failed: number;
-      success: boolean;
-      failures: string[];
-      failedText: string[];
-    }
-  | undefined {
-  let value: unknown;
-  try {
-    value = JSON.parse(stdout);
-  } catch {
-    return undefined;
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return undefined;
-  }
-  const report = value as Record<string, unknown>;
-  if (
-    !Number.isSafeInteger(report.numTotalTests) ||
-    !Number.isSafeInteger(report.numFailedTests) ||
-    typeof report.success !== "boolean"
-  ) {
-    return undefined;
-  }
-  const failedAssertions = (
-    Array.isArray(report.testResults) ? report.testResults : []
-  ).flatMap((suite): Array<{ identity: string; text: string[] }> => {
-    if (!suite || typeof suite !== "object" || Array.isArray(suite)) return [];
-    const record = suite as Record<string, unknown>;
-    const suiteName =
-      typeof record.name === "string"
-        ? record.name.replace(/^\/workspace\//u, "")
-        : "unknown-suite";
-    if (!Array.isArray(record.assertionResults)) return [];
-    return record.assertionResults.flatMap(
-      (assertion): Array<{ identity: string; text: string[] }> => {
-        if (
-          !assertion ||
-          typeof assertion !== "object" ||
-          Array.isArray(assertion)
-        ) {
-          return [];
-        }
-        const entry = assertion as Record<string, unknown>;
-        if (entry.status !== "failed") return [];
-        const title =
-          typeof entry.fullName === "string"
-            ? entry.fullName
-            : typeof entry.title === "string"
-              ? entry.title
-              : "unknown-assertion";
-        const diagnostics = Array.isArray(entry.failureMessages)
-          ? entry.failureMessages.filter(
-              (message): message is string => typeof message === "string",
-            )
-          : [];
-        return [
-          {
-            identity: `${suiteName}\0${title}`,
-            text: [title, ...diagnostics],
-          },
-        ];
-      },
-    );
-  });
-  return {
-    total: report.numTotalTests as number,
-    failed: report.numFailedTests as number,
-    success: report.success,
-    failures: failedAssertions.map((failure) => failure.identity),
-    failedText: failedAssertions.flatMap((failure) => failure.text),
-  };
-}
-
-function normalizedFailureIdentities(input: {
-  step: AtomicVerificationContract;
-  report?: ReturnType<typeof vitestReport>;
-  output: string;
-  exitCode: number;
-}): string[] {
-  const vitestFailures = input.report?.failures ?? [];
-  if (vitestFailures.length > 0) {
-    return [...new Set(vitestFailures)]
-      .sort()
-      .map((failure) => sha256(`vitest-failure\0${failure}`));
-  }
-  const normalizedOutput = input.output
-    .replace(new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "gu"), "")
-    .replace(/\r\n?/gu, "\n")
-    .replace(/\b\d+(?:\.\d+)?(?:ms|s)\b/gu, "<duration>")
-    .slice(0, 64 * 1024);
-  return [
-    sha256(
-      canonicalJson({
-        verificationId: input.step.id,
-        exitCode: input.exitCode,
-        output: normalizedOutput,
-      }),
-    ),
-  ];
-}
-
-export async function executePackageVerification(input: {
-  root: string;
-  dependencyOwner: string;
-  verification: StructuredVerificationContract;
-  signal: AbortSignal;
-}) {
-  const capability = bindCurrentVerificationCapability(
-    input.root,
-    input.verification,
-    { dependencyOwner: input.dependencyOwner },
-  );
-  if (!capability.ok) {
-    return {
-      ok: false as const,
-      kind: "paused" as const,
-      code: capability.diagnostic.code,
-    };
-  }
-  let runners: ReturnType<typeof prepareRunnerBindings>;
-  try {
-    runners = prepareRunnerBindings(
-      input.root,
-      capability.value.runnerBindings,
-    );
-  } catch {
-    return {
-      ok: false as const,
-      kind: "paused" as const,
-      code: "runner-mount-unavailable",
-    };
-  }
-  try {
-    const nodeModules = path.join(input.dependencyOwner, "node_modules");
-    const dependency = lstatSync(nodeModules, { throwIfNoEntry: false });
-    const mounts = [] as Array<{
-      source: string;
-      target: string;
-      writable?: boolean;
-    }>;
-    if (dependency) {
-      if (!dependency.isDirectory() || dependency.isSymbolicLink()) {
-        return {
-          ok: false as const,
-          kind: "paused" as const,
-          code: "dependency-path-unsafe",
-        };
-      }
-      const target = path.join(input.root, "node_modules");
-      const targetStat = lstatSync(target, { throwIfNoEntry: false });
-      if (
-        targetStat &&
-        (!targetStat.isDirectory() || targetStat.isSymbolicLink())
-      ) {
-        return {
-          ok: false as const,
-          kind: "paused" as const,
-          code: "dependency-path-unsafe",
-        };
-      }
-      if (!targetStat) mkdirSync(target, { mode: 0o700 });
-      mounts.push({ source: nodeModules, target: "/workspace/node_modules" });
-    }
-    mounts.push(...runners.mounts);
-    const isolation = new BubblewrapIsolationBackend();
-    const steps = verificationSteps(input.verification);
-    let final:
-      | {
-          exitCode: number;
-          classification: AtomicVerificationContract["classification"];
-          diagnostic: { kind: "assertion" | "compiler"; id: string };
-        }
-      | undefined;
-    for (const step of steps) {
-      const invocation = verificationInvocation(step, runners.bindings);
-      if (!invocation) {
-        return {
-          ok: false as const,
-          kind: "paused" as const,
-          code: "runner-missing",
-        };
-      }
-      const executed = await isolation.run({
-        root: input.root,
-        executable: invocation.executable,
-        args: invocation.args,
-        mounts,
-        environment: { CI: "1" },
-        signal: input.signal,
-      });
-      if (!executed.ok) {
-        if (executed.state === "cancelled") throw input.signal.reason;
-        return {
-          ok: false as const,
-          kind: "paused" as const,
-          code: executed.code,
-        };
-      }
-      const report =
-        step.kind === "vitest" ? vitestReport(executed.stdout) : undefined;
-      const output = `${executed.stdout}\n${executed.stderr}`;
-      const identity =
-        step.classification !== "expected-red" ||
-        (step.kind === "vitest"
-          ? report?.failedText.some((text) =>
-              text.includes(step.expectedFailure ?? ""),
-            ) === true
-          : output.includes(step.expectedFailure ?? ""));
-      const accepted =
-        step.classification === "expected-red"
-          ? executed.exitCode !== 0 &&
-            identity &&
-            (step.kind !== "vitest" ||
-              (report !== undefined &&
-                report.failed > 0 &&
-                report.total >= step.minTests))
-          : executed.exitCode === 0 &&
-            (step.kind !== "vitest" ||
-              (report?.success === true && report.total >= step.minTests));
-      if (!accepted) {
-        return {
-          ok: false as const,
-          kind: "retryable" as const,
-          code:
-            step.classification === "expected-red" && executed.exitCode === 0
-              ? "red-not-witnessed"
-              : "verification-rejected",
-          failureIdentities: normalizedFailureIdentities({
-            step,
-            report,
-            output,
-            exitCode: executed.exitCode,
-          }),
-        };
-      }
-      if (!isVerificationCapabilityCurrent(input.root, capability.value)) {
-        return {
-          ok: false as const,
-          kind: "retryable" as const,
-          code: "verification-input-unavailable",
-        };
-      }
-      final = {
-        exitCode: executed.exitCode,
-        classification: step.classification,
-        diagnostic: {
-          kind: step.kind === "vitest" ? "assertion" : "compiler",
-          id: step.id,
-        },
-      };
-    }
-    return final
-      ? { ok: true as const, ...final }
-      : {
-          ok: false as const,
-          kind: "paused" as const,
-          code: "verification-contract-unsupported",
-        };
-  } finally {
-    if (runners.cleanupRoot) {
-      rmSync(runners.cleanupRoot, { recursive: true, force: true });
-    }
-  }
-}
-
 function affectedVerification(
   task: Parameters<
     Parameters<typeof openDurableWorkflowEngine>[0]["proposeCandidate"]
@@ -1653,7 +760,39 @@ export function openPackageWorkflowControlEngine(
   if (!implementationAgent) {
     throw new Error("implementation-worker-agent-unavailable");
   }
+  const hostLimit = (name: string, fallback: number): number => {
+    const value =
+      process.env[name] === undefined ? fallback : Number(process.env[name]);
+    if (!Number.isSafeInteger(value) || value < 1)
+      throw new Error("verification-host-limit-invalid");
+    return value;
+  };
+  const maxReportBytes = hostLimit(
+    "ABEL_VERIFICATION_MAX_REPORT_BYTES",
+    64 * 1024 * 1024,
+  );
+  const workHardLimit = hostLimit("ABEL_WORK_MAX_UNITS", 512);
   const engine = openDurableWorkflowEngine({
+    workHardLimit,
+    verificationPolicy: "report-file-v4",
+    verificationEnvironment: (plan, signal) =>
+      captureVerificationEnvironmentIdentity(
+        consumerRoot,
+        [
+          ...plan.tasks.flatMap((task) => [
+            ...Object.values(task.phases).map((phase) => phase.verification),
+            task.affectedVerification,
+            task.repairVerification,
+          ]),
+          plan.verification.baseline.fullSuite,
+          plan.verification.change.fullSuite,
+          plan.verification.change.postApply,
+          ...(plan.verification.agentsCheckpoint.verification
+            ? [plan.verification.agentsCheckpoint.verification]
+            : []),
+        ],
+        signal,
+      ),
     consumerRoot,
     stateRoot,
     deliverySource: packageDeliverySource(consumerRoot, {
@@ -1706,10 +845,28 @@ export function openPackageWorkflowControlEngine(
             ].sort(),
           }
         : {
-            read: [...phase.read],
+            read: [
+              ...new Set(
+                taskPhases.flatMap((boundary) => [
+                  ...boundary.read,
+                  ...boundary.write,
+                  ...boundary.delete,
+                ]),
+              ),
+            ].sort(),
             write: [...phase.write],
             delete: [...phase.delete],
           };
+      executionBoundary.read = [
+        ...new Set([
+          ...executionBoundary.read,
+          ...(input.contextReadPaths ?? []).filter(
+            (relative) =>
+              permitsContextRead(relative, input.task.roots) &&
+              isSafeRegularFile(input.workspaceRoot, relative),
+          ),
+        ]),
+      ].sort();
       const phaseContract = {
         candidateId: input.candidateArtifact.identity.candidateId,
         taskId: input.taskId,
@@ -1729,6 +886,9 @@ export function openPackageWorkflowControlEngine(
         ...(input.contextRequest
           ? { requestedContext: structuredClone(input.contextRequest) }
           : {}),
+        ...(input.recoveryFeedback
+          ? { recoveryFeedback: structuredClone(input.recoveryFeedback) }
+          : {}),
         ...(input.repair
           ? {
               repair: {
@@ -1750,6 +910,7 @@ export function openPackageWorkflowControlEngine(
           input.task.objective,
           input.task.context.agents,
           input.task.context.contract,
+          "Use recoveryFeedback to change the failing approach. For compact-patch, prefer exact replace operations and omit unchanged bodies; submit one complete atomic patch. Never repeat an unchanged failing submission or weaken verification to obtain a pass.",
           `<phase-contract>${JSON.stringify(phaseContract)}</phase-contract>`,
         ].join("\n\n"),
         requestId: childRequestId(input.operationId, input.taskId, input.phase),
@@ -1785,7 +946,7 @@ export function openPackageWorkflowControlEngine(
           return { kind: "approval-needed", code: child.failure.code };
         }
         if (child.failure.kind === "result-limit") {
-          return { kind: "paused", code: "needs-task-split" };
+          return { kind: "retryable", code: "needs-task-split" };
         }
         const attemptDiagnostic = {
           finalCategory: child.classification.finalCategory,
@@ -1804,6 +965,7 @@ export function openPackageWorkflowControlEngine(
       if (result.kind === "context-request") {
         return classifyCandidateContextRequest(result, {
           phase: input.phase,
+          contextReadRoots: input.task.roots,
           readPaths: phase.read,
           writePaths: phase.write,
           deletePaths: phase.delete,
@@ -1836,44 +998,37 @@ export function openPackageWorkflowControlEngine(
         paths: [...result.paths],
       };
     },
-    verifyPhase: (input) =>
-      executePackageVerification({
-        root: input.root,
-        dependencyOwner: consumerRoot,
-        verification: input.verification,
-        signal: input.signal,
-      }),
+    verifyPhase: async (input) =>
+      phaseVerificationResult(
+        await executePackageVerification({
+          maxReportBytes,
+          executionWritePaths: input.executionWritePaths,
+          root: input.root,
+          dependencyOwner: consumerRoot,
+          verification: input.verification,
+          signal: input.signal,
+        }),
+      ),
     verifyChange: async (input) => {
       const verifications = input.verification
         ? [input.verification]
         : input.plan.tasks.map((task) => affectedVerification(task));
       for (const verification of verifications) {
         const result = await executePackageVerification({
+          maxReportBytes,
+          executionWritePaths: input.plan.tasks.flatMap((task) =>
+            Object.values(task.phases).flatMap((phase) => [
+              ...phase.write,
+              ...phase.delete,
+            ]),
+          ),
           root: input.root,
           dependencyOwner: consumerRoot,
           verification,
           signal: input.signal,
         });
-        if (!result.ok) {
-          const adapter = new Set([
-            "runner-missing",
-            "script-missing",
-            "script-command-mismatch",
-            "local-executable-missing",
-          ]).has(result.code);
-          return {
-            ok: false,
-            kind: adapter
-              ? ("verification-adapter" as const)
-              : result.kind === "paused"
-                ? ("environment" as const)
-                : ("verification" as const),
-            code: result.code,
-            ...(result.failureIdentities
-              ? { failureIdentities: result.failureIdentities }
-              : {}),
-          };
-        }
+        const observed = changeVerificationResult(result);
+        if (!observed.ok) return observed;
       }
       return {
         ok: true,
@@ -1921,6 +1076,11 @@ export function openPackageWorkflowControlEngine(
     executeDesign(request: unknown) {
       return design.execute(request);
     },
+    executeAmendment(change: string, batchId: string, request: unknown) {
+      return engine.amend(change, batchId, request, (assertAuthority) =>
+        design.executeWithAuthority(request, assertAuthority),
+      );
+    },
     assertDesignRun(runId: string) {
       design.assertDesignRun(runId);
     },
@@ -1987,8 +1147,11 @@ export function registerWorkflowControl(
   const parentPayloadBridge = new ParentPayloadBridge();
   const activity = new ActivityController();
   const engines = new Map<string, Promise<WorkflowControlEngine>>();
+  const designOperations = new Set<Promise<void>>();
   const designFailures = new Map<string, SafeDesignFailure>();
   let pendingPrompt: EligiblePrompt | undefined;
+  let pendingInit = false;
+  let exitingStage = false;
   let activePrompt: EligiblePrompt | undefined;
   let designToolSnapshot: string[] | undefined;
   const activation = new (class implements Activation {
@@ -2030,16 +1193,19 @@ export function registerWorkflowControl(
     return opened;
   };
   const closeEngines = async () => {
-    const current = [...engines.values()];
-    engines.clear();
-    const opened = await Promise.allSettled(current);
-    await Promise.allSettled(
-      opened.flatMap((result) =>
-        result.status === "fulfilled"
-          ? [Promise.resolve(result.value.close())]
-          : [],
-      ),
+    // Design close() is synchronous and does not own an operation queue.
+    // Keep its journal open through finalization's commit/lease-cleanup path
+    // and the dispatch result handling before closing any engine storage.
+    await Promise.all([...designOperations]);
+    const closed = await Promise.allSettled(
+      [...engines].map(async ([key, opened]) => {
+        const engine = await opened;
+        await engine.close();
+        if (engines.get(key) === opened) engines.delete(key);
+      }),
     );
+    const failed = closed.find((result) => result.status === "rejected");
+    if (failed?.status === "rejected") throw failed.reason;
   };
   const restoreDesignTools = () => {
     if (!designToolSnapshot) return;
@@ -2077,6 +1243,16 @@ export function registerWorkflowControl(
     deactivate();
     parentPayloadBridge.clear();
   };
+  const exitStage = async () => {
+    if (exitingStage) throw new Error("stage-control-mismatch");
+    exitingStage = true;
+    try {
+      await closeEngines();
+      await deactivateStage();
+    } finally {
+      exitingStage = false;
+    }
+  };
 
   // Pi validates tool arguments before execute(), so expose only the schema
   // legal for the active stage instead of one ambiguous command/packet union.
@@ -2102,6 +1278,61 @@ export function registerWorkflowControl(
   } as const;
   let registeredParameterKind: "command" | "packet" | undefined;
 
+  // Stage exit is session control, not a durable Implement command. Keep the
+  // six engine commands unchanged and admit only this exact extra envelope.
+  const FINISH_PARAMETERS = {
+    type: "object",
+    properties: { action: { type: "string", enum: ["finish"] } },
+    required: ["action"],
+    additionalProperties: false,
+  } as const;
+  const AMEND_PARAMETERS = {
+    type: "object",
+    properties: {
+      action: { type: "string", enum: ["amend"] },
+      change: { type: "string" },
+      batchId: { type: "string" },
+      request: DESIGN_CONTROL_REQUEST_SCHEMA,
+    },
+    required: ["action", "change", "batchId", "request"],
+    additionalProperties: false,
+  } as const;
+  const IMPLEMENT_PARAMETERS = {
+    ...CONTROL_COMMAND_PARAMETERS,
+    properties: {
+      ...CONTROL_COMMAND_PARAMETERS.properties,
+      ...AMEND_PARAMETERS.properties,
+      action: { type: "string", enum: ["finish", "amend"] },
+    },
+    required: [],
+    anyOf: [
+      ...CONTROL_COMMAND_PARAMETERS.anyOf,
+      FINISH_PARAMETERS,
+      AMEND_PARAMETERS,
+    ],
+  } as const;
+  const prepareImplementArguments = (args: unknown): unknown => {
+    if (!args || typeof args !== "object" || Array.isArray(args)) return args;
+    const record = { ...(args as Record<string, unknown>) };
+    // Strict providers can pad fields belonging to the other union branch.
+    if (record.action !== "amend") {
+      for (const key of ["batchId", "request"]) {
+        if (record[key] === null || record[key] === undefined)
+          delete record[key];
+      }
+    }
+    if (record.action === "finish" || record.action === "amend") {
+      for (const key of Object.keys(CONTROL_COMMAND_PARAMETERS.properties)) {
+        if (record[key] === null || record[key] === undefined)
+          delete record[key];
+      }
+      return record;
+    }
+    if (record.action === null || record.action === undefined)
+      delete record.action;
+    return canonicalizeControlCommandToolInput(record);
+  };
+
   const registerDispatchTool = (kind: "command" | "packet") => {
     if (registeredParameterKind === kind) return;
     registeredParameterKind = kind;
@@ -2110,17 +1341,16 @@ export function registerWorkflowControl(
       label: "Abel Control",
       description:
         kind === "command"
-          ? "Private stage-bound Abel workflow control. Accepts durable Implement change commands."
+          ? 'Private stage-bound Abel workflow control. Accepts durable Implement commands, batch-bound {"action":"amend"} artifact revisions, or {"action":"finish"} to leave and preserve resumable work.'
           : "Private stage-bound Abel packet control. Accepts bounded Design and Diagnose packet operations.",
       executionMode: "parallel",
       ...(kind === "command"
         ? {
             prepareArguments: (args: unknown) =>
-              canonicalizeControlCommandToolInput(args) as never,
+              prepareImplementArguments(args) as never,
           }
         : {}),
-      parameters:
-        kind === "command" ? CONTROL_COMMAND_PARAMETERS : PACKET_PARAMETERS,
+      parameters: kind === "command" ? IMPLEMENT_PARAMETERS : PACKET_PARAMETERS,
       async execute(
         toolCallId: string,
         params: unknown,
@@ -2128,10 +1358,120 @@ export function registerWorkflowControl(
         onUpdate: AgentToolUpdateCallback<unknown> | undefined,
         ctx: ExtensionContext,
       ) {
+        if (
+          exitingStage ||
+          !activation.isActive() ||
+          activePrompt === undefined
+        ) {
+          throw new Error("stage-control-mismatch");
+        }
+        if (kind === "command") params = prepareImplementArguments(params);
         const record =
           params && typeof params === "object" && !Array.isArray(params)
             ? (params as Record<string, unknown>)
             : undefined;
+        if (record?.action === "amend") {
+          if (
+            activePrompt !== "abel-implement" ||
+            Object.keys(record).some(
+              (key) =>
+                !["action", "change", "batchId", "request"].includes(key),
+            ) ||
+            typeof record.change !== "string" ||
+            typeof record.batchId !== "string"
+          ) {
+            throw new Error("stage-control-mismatch");
+          }
+          const parsed = validateDesignControlRequest(record.request);
+          if (!parsed.ok) throw new Error(parsed.code);
+          const request = parsed.value;
+          if (
+            request.operation === "bind-change" ||
+            (request.operation === "start" &&
+              (!("change" in request) || request.change !== record.change))
+          ) {
+            throw new Error("amendment-change-mismatch");
+          }
+          let settle!: () => void;
+          const pending = new Promise<void>((resolve) => {
+            settle = resolve;
+          });
+          designOperations.add(pending);
+          try {
+            const engine = await engineFor(ctx);
+            if (exitingStage || !activation.isActive() || !engine.executeDesign)
+              throw new Error("stage-control-mismatch");
+            const status = await engine.execute(
+              {
+                command: "status",
+                stage: "abel-implement",
+                change: record.change,
+              },
+              ctx,
+              signal,
+            );
+            const batch = status.decisionBatch as { id?: string } | undefined;
+            if (
+              !["approval-needed", "paused"].includes(String(status.state)) ||
+              batch?.id !== record.batchId
+            )
+              throw new Error("amendment-batch-stale");
+            if (request.operation !== "start") {
+              const designStatus = await engine.executeDesign({
+                operation: "status",
+                runId: request.runId,
+              });
+              if (designStatus.change !== record.change)
+                throw new Error("amendment-change-mismatch");
+            }
+            if (!engine.executeAmendment)
+              throw new Error("amendment-control-unavailable");
+            const revision = await engine.executeAmendment(
+              record.change,
+              record.batchId,
+              request,
+            );
+            const payload =
+              request.operation === "finalize-delivery" &&
+              revision.state === "completed"
+                ? {
+                    ...revision,
+                    scope: "amendment",
+                    state: "ready",
+                    completed: false,
+                    runId: status.runId,
+                    amendmentRunId: revision.runId,
+                    stage: "abel-implement",
+                  }
+                : { ...revision, scope: "amendment" };
+            // A compiled amendment stays in Implement; its private Design
+            // records do not activate the Design stage or broaden parent tools.
+            return {
+              content: [
+                { type: "text" as const, text: JSON.stringify(payload) },
+              ],
+              details: payload,
+            };
+          } catch (error) {
+            if (
+              error instanceof DesignPlanValidationError ||
+              error instanceof DesignFinalizationError ||
+              error instanceof DeliveryValidationError
+            ) {
+              const failure = safeDesignFailure(
+                error,
+                request.operation,
+                "execution",
+              );
+              designFailures.set(toolCallId, failure);
+              throw new Error(failure.code);
+            }
+            throw error;
+          } finally {
+            settle();
+            designOperations.delete(pending);
+          }
+        }
         if (record && typeof record.action === "string") {
           if (
             Object.keys(record).some(
@@ -2143,6 +1483,18 @@ export function registerWorkflowControl(
           if (record.action === "finish" && Object.hasOwn(record, "request")) {
             throw new Error("control-envelope-ambiguous");
           }
+          if (record.action === "finish") {
+            // close() aborts and settles active operations before ordinary tools
+            // return; durable work is retained, never discarded or completed.
+            await exitStage();
+            const payload = { ok: true, state: "inactive" };
+            return {
+              content: [
+                { type: "text" as const, text: JSON.stringify(payload) },
+              ],
+              details: payload,
+            };
+          }
           if (
             activePrompt !== "abel-design" &&
             activePrompt !== "abel-diagnose"
@@ -2155,9 +1507,18 @@ export function registerWorkflowControl(
             }
             const designRequest = validateDesignControlRequest(record.request);
             if (!designRequest.ok) throw new Error(designRequest.code);
+            let settleDesign!: () => void;
+            const settled = new Promise<void>((resolve) => {
+              settleDesign = resolve;
+            });
+            // Register before the first await, including asynchronous engine
+            // opening. Teardown blocks admission before taking its snapshot.
+            designOperations.add(settled);
             let boundary: DesignFailureBoundary = "initialization";
             try {
               const engine = await engineFor(ctx);
+              if (exitingStage || !activation.isActive())
+                throw new Error("stage-control-mismatch");
               if (!engine.executeDesign)
                 throw new Error("design-control-unavailable");
               boundary = "execution";
@@ -2170,7 +1531,9 @@ export function registerWorkflowControl(
               boundary = "execution";
               if (
                 designRequest.value.operation === "finalize-delivery" &&
-                payload.state === "completed"
+                payload.state === "completed" &&
+                !exitingStage &&
+                activePrompt === "abel-design"
               ) {
                 await deactivateStage();
               }
@@ -2188,6 +1551,9 @@ export function registerWorkflowControl(
               const sanitized = new Error(failure.code);
               sanitized.name = "DesignControlError";
               throw sanitized;
+            } finally {
+              designOperations.delete(settled);
+              settleDesign();
             }
           }
           let designEngine: WorkflowControlEngine | undefined;
@@ -2201,6 +1567,8 @@ export function registerWorkflowControl(
             if (packet.value.stage === "abel-design") {
               try {
                 designEngine = await engineFor(ctx);
+                if (exitingStage || !activation.isActive())
+                  throw new Error("stage-control-mismatch");
               } catch (error) {
                 if (error instanceof RunStoreFormatError)
                   throw runStoreResetError(error);
@@ -2257,9 +1625,6 @@ export function registerWorkflowControl(
             });
             payload = { ...packetPayload, recordedEvidence };
           }
-          if (record.action === "finish" && packetPayload.ok) {
-            await deactivateStage();
-          }
           const display = tuiRun
             ? activity.finalize(toolCallId, payload)
             : undefined;
@@ -2287,15 +1652,16 @@ export function registerWorkflowControl(
           throw error;
         }
         if (
-          activePrompt !== undefined &&
-          (activePrompt === "abel-diagnose" ||
-            validation.value.stage !== activePrompt)
+          activePrompt !== "abel-implement" ||
+          validation.value.stage !== activePrompt
         ) {
           throw new Error("stage-control-mismatch");
         }
         let engine: WorkflowControlEngine;
         try {
           engine = await engineFor(ctx);
+          if (exitingStage || !activation.isActive())
+            throw new Error("stage-control-mismatch");
         } catch (error) {
           if (!(error instanceof RunStoreFormatError)) throw error;
           const payload = runStoreUnavailableStatus(error, validation.value);
@@ -2392,7 +1758,10 @@ export function registerWorkflowControl(
     if (
       event.toolName !== DISPATCH_TOOL ||
       !event.isError ||
-      event.input.action !== "design"
+      (event.input.action !== "design" &&
+        !(
+          event.input.action === "amend" && designFailures.has(event.toolCallId)
+        ))
     ) {
       return;
     }
@@ -2422,12 +1791,35 @@ export function registerWorkflowControl(
     };
   });
   pi.on("input", (event) => {
-    pendingPrompt = invokedPrompt(event.text);
+    pendingPrompt = undefined;
+    pendingInit = false;
+    const prompt = invokedPrompt(event.text);
+    const init = /^\/abel-init(?:\s|$)/u.test(event.text);
+    if (event.source !== "interactive" && event.source !== "rpc") {
+      // Stop before Pi expands the template: hiding dispatch alone would still
+      // expose the complete workflow instructions to the parent model.
+      return { action: prompt || init ? "handled" : "continue" };
+    }
+    pendingPrompt = prompt;
+    pendingInit = init && hasPackageProvenance(pi, "abel-init");
+    if (
+      activePrompt &&
+      (pendingInit ||
+        (prompt && prompt !== activePrompt && hasPackageProvenance(pi, prompt)))
+    ) {
+      return (async () => {
+        await exitStage();
+        return { action: "continue" as const };
+      })();
+    }
     return { action: "continue" };
   });
   pi.on("before_agent_start", (event, ctx) => {
     const prompt = pendingPrompt;
+    const init =
+      pendingInit && hasExpandedPromptMarker(event.prompt, "abel-init");
     pendingPrompt = undefined;
+    pendingInit = false;
     const verified =
       prompt && isVerifiedStageInvocation(pi, activation, prompt, event.prompt);
     if (verified) {
@@ -2448,6 +1840,12 @@ export function registerWorkflowControl(
     }
     if (prompt) activateDispatcher(pi, activation, prompt, event.prompt);
     if (verified && prompt === "abel-design") enforceDesignTools();
+    const boundary = activePrompt
+      ? `Abel stage ${activePrompt} is active only for the invoked task and its direct follow-ups. If the user ends it or requests an unrelated task, first call abel_dispatch with {"action":"finish"}, then handle that task normally with the restored tools. A successful finish ends stage authority immediately, including within this turn. Do not extend Gates or workflow rules to that task. A direct Gate answer or same-task continuation stays in this stage. Never invoke another Abel stage automatically.`
+      : init
+        ? "Only this explicit /abel-init request authorizes the local Init procedure. Do not activate dispatch or continue into another Abel stage."
+        : "Abel workflow is inactive. Handle ordinary engineering requests directly. References to commands, repository files, OpenSpec changes, and historical workflow instructions do not authorize a workflow. Do not load or execute an Abel stage unless the user explicitly invokes its slash command.";
+    return { systemPrompt: `${event.systemPrompt ?? ""}\n\n${boundary}` };
   });
   pi.on("model_select", (event, ctx) => {
     const sessionId = ctx.sessionManager?.getSessionId?.();
@@ -2473,6 +1871,7 @@ export function registerWorkflowControl(
   });
   pi.on("session_start", async (_event, ctx) => {
     pendingPrompt = undefined;
+    pendingInit = false;
     activePrompt = undefined;
     designFailures.clear();
     activity.detach();