@agent-delivery-harness/cli 0.7.3 → 0.8.0

package/src/commands/gate.ts

@@ -2,6 +2,7 @@ import { ScopedChecks } from "../scoped-checks.ts";
 import { CheckSnapshotError } from "../check-snapshot.ts";
 import { commandBlocker } from "../boundary.ts";
 import { runDeclaredCheck } from "../declared-checks.ts";
+import { refuseOverBudget } from "../scoped-budget.ts";
 /**
  * `gate` — evaluate the delivery gate and, under a TTY, offer a scoped waiver.
  *
@@ -15,8 +16,11 @@ import { runDeclaredCheck } from "../declared-checks.ts";
  */
 import { computeDeliverableIdentity, runAdmission, type AdmissionResult, type Blocker, type LiveProviderResult } from "@agent-delivery-harness/kernel";
 import { CliInterruption, type CommandContext, type CommandDescriptor, type CommandResult } from "../boundary.ts";
+import { focusedOutcome } from "../delivery-posture.ts";
 import { oneLine } from "../run-surface.ts";
 
+const scopedCheckBlocker = (error: CheckSnapshotError): Blocker => commandBlocker({ code: error.code, sourceId: "delivery-harness.cli.gate", summary: error.message, remediations: [{ id: "repair-scoped-check", kind: "manual_action", summary: "Repair the declared scoped check or its execution profile and run the gate again." }] });
+
 /**
  * Runs the ordinary admission first, invokes only configured providers that can
  * answer the resulting missing-evidence/live-result blocks, then re-evaluates
@@ -28,7 +32,7 @@ async function providerAdmission(
   options: { readonly allowPrompt: boolean; readonly includeInjectedLiveResults: boolean },
   session?: ScopedChecks,
 ): Promise<AdmissionResult & { readonly observedLiveResults?: readonly LiveProviderResult[] }> {
-  const admit = async (input: Parameters<typeof runAdmission>[0], options: Parameters<typeof runAdmission>[1]) => runAdmission(input, { ...options, ...(session ? { scopedPlan: await session.plan(), readOutput: session.readOutput } : {}) });
+  const admit = async (input: Parameters<typeof runAdmission>[0], options: Parameters<typeof runAdmission>[1]) => runAdmission(input, { ...options, ...(session ? { scopedPlan: await session.plan(), readOutput: session.readOutput, resourceBindings: await session.resourceBindings() } : {}) });
   if (session) {
     await session.fenceNonReusable(context.config.providers.filter(p => p.check?.scope).map(p => p.id));
   }
@@ -58,8 +62,11 @@ async function providerAdmission(
   const attemptBlockers: Blocker[] = [];
   let admission = await admit(input, admissionOptions);
   await session?.explainReuse((admission.decision?.resolutions ?? []).flatMap(r => r.kind === "satisfied_evidence" ? [r.providerId] : []));
+  // Under `scopedExecution.failFast` the first failing scoped check ends the run of checks: nothing further starts.
+  const failFast = context.config.scopedExecution?.failFast === true;
+  let failedFast = false;
 
-  while (!admission.admitted && admission.decision !== undefined && admission.candidate !== undefined) {
+  while (!failedFast && !admission.admitted && admission.decision !== undefined && admission.candidate !== undefined) {
     const requested = new Map<string, { obligationIds: string[]; requiresEvidence: boolean; needsLiveResult: boolean }>();
     for (const resolution of admission.decision.resolutions) {
       if (resolution.kind !== "blocked") continue;
@@ -70,7 +77,7 @@ async function providerAdmission(
         if (finding.code !== missingCode || finding.providerId === undefined || attempted.has(finding.providerId)) continue;
         const registration = context.config.providers.find((provider) => provider.id === finding.providerId);
         if (registration === undefined || (registration.command === undefined && registration.check === undefined) || !obligation.providers.includes(registration.id)) continue;
-        if (registration.check !== undefined && (obligation.freshness !== "exact_candidate" || !obligation.acceptedPayloadSpecs.includes("checks.passed/1") || admission.decision.resolutions.some(resolution => resolution.kind !== "satisfied_evidence" && resolution.kind !== "not_applicable" && resolution.kind !== "waived" && context.config.obligations.find(entry => entry.id === resolution.obligationId)?.acceptedPayloadSpecs.includes("review.green/1")))) continue;
+        if (registration.check !== undefined && (obligation.freshness !== "exact_candidate" || !obligation.acceptedPayloadSpecs.includes("checks.passed/1") || admission.decision.resolutions.some(resolution => resolution.kind !== "satisfied_evidence" && resolution.kind !== "not_applicable" && resolution.kind !== "waived" && context.config.obligations.find(entry => entry.id === resolution.obligationId)?.acceptedPayloadSpecs.some(spec => spec === "review.green/1" || spec === "review.green/2")))) continue;
         const entry = requested.get(registration.id) ?? { obligationIds: [], requiresEvidence: false, needsLiveResult: false };
         entry.obligationIds.push(obligation.id);
         entry.requiresEvidence ||= obligation.freshness === "exact_candidate";
@@ -79,6 +86,16 @@ async function providerAdmission(
       }
     }
 
+    // A pool runs every requested scoped check at once; a single worker keeps the one-at-a-time loop below.
+    const scoped = session !== undefined && session.concurrency > 1 ? [...requested].filter(([id]) => context.config.providers.find(p => p.id === id)!.check?.scope) : [];
+    if (session !== undefined && scoped.length > 0) {
+      for (const [id] of scoped) attempted.add(id);
+      const failures = await session.executeAll(scoped.map(([id, request]) => ({ provider: context.config.providers.find(p => p.id === id)!, obligationIds: request.obligationIds })));
+      attemptBlockers.push(...failures.map(scopedCheckBlocker));
+      failedFast = failFast && failures.length > 0;
+      admission = await admit({ ...input, ...(liveResults.length === 0 ? {} : { liveResults }) }, admissionOptions);
+      continue;
+    }
     const next = requested.entries().next().value as
       | [string, { obligationIds: string[]; requiresEvidence: boolean; needsLiveResult: boolean }]
       | undefined;
@@ -91,9 +108,13 @@ async function providerAdmission(
         try { await session.execute(registration, request.obligationIds); }
         catch (error) {
           if (!(error instanceof CheckSnapshotError)) throw error;
-          attemptBlockers.push(commandBlocker({ code: error.code, sourceId: "delivery-harness.cli.gate", summary: error.message, remediations: [{ id: "repair-scoped-check", kind: "manual_action", summary: "Repair the declared scoped check or its execution profile and run the gate again." }] }));
+          attemptBlockers.push(scopedCheckBlocker(error));
+          if (failFast) {
+            failedFast = true;
+            await session.cancelUnstarted([...requested.keys()].filter(id => !attempted.has(id) && context.config.providers.find(p => p.id === id)!.check?.scope), providerId);
+          }
         }
-      } else attemptBlockers.push(...await runDeclaredCheck(context, registration, request.obligationIds, admission.candidate));
+      } else attemptBlockers.push(...await runDeclaredCheck(context, registration, request.obligationIds, admission.candidate, session ? { scopedPlan: await session.plan(), readOutput: session.readOutput, resourceBindings: await session.resourceBindings() } : {}));
       admission = await admit({ ...input, ...(liveResults.length === 0 ? {} : { liveResults }) }, admissionOptions);
       continue;
     }
@@ -135,6 +156,8 @@ async function providerAdmission(
 }
 
 export async function runProviderBackedAdmission(context: CommandContext, options: { readonly allowPrompt: boolean; readonly includeInjectedLiveResults: boolean }): Promise<AdmissionResult & { readonly observedLiveResults?: readonly LiveProviderResult[] }> {
+  // Before any capture or check: a selection over its declared budget runs nothing.
+  refuseOverBudget(context.config);
   let session: ScopedChecks | undefined;
   try {
     if (context.config.providers.some(p => p.check?.scope)) {
@@ -145,7 +168,35 @@ export async function runProviderBackedAdmission(context: CommandContext, option
   } finally { await session?.cleanup(); }
 }
 
+/**
+ * The gate itself, with no posture. `admit` runs this directly, because it keeps
+ * its behaviour under either posture: only the `gate` command honours `focused`.
+ */
+export async function runGate(context: CommandContext): Promise<CommandResult> {
+  const result = await runProviderBackedAdmission(context, { allowPrompt: true, includeInjectedLiveResults: true });
+
+  if (result.admitted) {
+    const waiverNote =
+      result.waiver === "accepted"
+        ? ` (waived: ${result.waivedObligationIds.join(", ")})`
+        : "";
+    const kinds = (result.decision?.resolutions ?? []).map((resolution) => `${resolution.obligationId}=${resolution.kind}`);
+    // This observation describes the admitted immutable tree. Failure to
+    // observe it cannot change admission; the run journal is not evidence.
+    let digest: string | undefined;
+    if (result.candidate !== undefined) {
+      try {
+        digest = await computeDeliverableIdentity({ rootDir: context.rootDir, treeSha: result.candidate.treeSha,
+          config: { ...context.config, computingIdentityVersion: "validation-tree/v1", reviewNeutral: context.config.recordNeutral } });
+      } catch { /* Best-effort observability, like the completion append. */ }
+    }
+    return { kind: "ok", summary: `admitted${waiverNote}: ${kinds.join(", ")}`, ...(digest === undefined ? {} : { digest }) };
+  }
+  return { kind: "blocked", blockers: [...result.blockers] };
+}
+
 export const gateCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "gate",
   sourceId: "delivery-harness.cli.gate",
   summary: "Evaluate the delivery gate for the current candidate.",
@@ -157,25 +208,9 @@ export const gateCommand: CommandDescriptor = {
     if (unexpected !== undefined) {
       return { kind: "usage", message: `gate takes no arguments, and ${oneLine(unexpected, 64)} is one.\n${gateCommand.usage}` };
     }
-    const result = await runProviderBackedAdmission(context, { allowPrompt: true, includeInjectedLiveResults: true });
+    const focused = await focusedOutcome(context);
+    if (focused !== undefined) return focused;
 
-    if (result.admitted) {
-      const waiverNote =
-        result.waiver === "accepted"
-          ? ` (waived: ${result.waivedObligationIds.join(", ")})`
-          : "";
-      const kinds = (result.decision?.resolutions ?? []).map((resolution) => `${resolution.obligationId}=${resolution.kind}`);
-      // This observation describes the admitted immutable tree. Failure to
-      // observe it cannot change admission; the run journal is not evidence.
-      let digest: string | undefined;
-      if (result.candidate !== undefined) {
-        try {
-          digest = await computeDeliverableIdentity({ rootDir: context.rootDir, treeSha: result.candidate.treeSha,
-            config: { ...context.config, computingIdentityVersion: "validation-tree/v1", reviewNeutral: context.config.recordNeutral } });
-        } catch { /* Best-effort observability, like the completion append. */ }
-      }
-      return { kind: "ok", summary: `admitted${waiverNote}: ${kinds.join(", ")}`, ...(digest === undefined ? {} : { digest }) };
-    }
-    return { kind: "blocked", blockers: [...result.blockers] };
+    return runGate(context);
   },
 };

package/src/commands/prepare.ts

@@ -1,5 +1,6 @@
 import { ScopedChecks } from "../scoped-checks.ts";
 import { CheckSnapshotError } from "../check-snapshot.ts";
+import { refuseOverBudget } from "../scoped-budget.ts";
 /**
  * `prepare` — capture the candidate and publish its preparation receipt.
  *
@@ -24,17 +25,19 @@ import { CliInterruption, type CommandContext, type CommandDescriptor, type Comm
 const USAGE = "Usage: delivery-harness prepare [--refresh-record-neutral]";
 
 export const prepareCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "prepare",
   sourceId: "delivery-harness.cli.prepare",
   summary: "Run preparation checks; --refresh-record-neutral permits proven artifact-only receipt refresh.",
   // The text prepare has always answered `--help` with, unchanged; the
   // boundary is what prints it now, for every command rather than this one.
-  usage: `${USAGE}\nOrdinary prepare always runs mechanical checks. The refresh flag reuses prior success only when strict validation, policy, wiring and base are unchanged; otherwise it runs the checks.`,
+  usage: `${USAGE}\nOrdinary prepare always runs mechanical checks. The refresh flag reuses prior success only when strict validation, policy, wiring and base are unchanged; otherwise it runs the checks.\nScoped mechanical checks run the first declared check first and the rest cheapest first by recorded duration, one dependency setup at a time, stopping at the first failure.`,
   async run(context: CommandContext): Promise<CommandResult> {
     if (context.args.length > 1 || (context.args.length === 1 && context.args[0] !== "--refresh-record-neutral")) {
       return { kind: "usage", message: USAGE };
     }
     if (context.config.providers.some(p => p.check?.scope) && !context.config.scopedExecution) throw new CheckSnapshotError("scoped_executor_required", "Scoped execution profiles are required before preparation commands may run.");
+    refuseOverBudget(context.config);
     let scoped: ScopedChecks | undefined;
     const refreshRecordNeutral = context.args[0] === "--refresh-record-neutral";
     const wiring = await context.wire();
@@ -48,7 +51,16 @@ export const prepareCommand: CommandDescriptor = {
       let reusableFingerprint: string | undefined;
       let attemptId: string;
       try {
-        if (context.config.scopedExecution?.repairCommands?.length) {
+        capture = await wiring.captureCandidate();
+        if (capture.ok && refreshRecordNeutral) {
+          const previous = await evaluatePreparationReceipt(context.rootDir,
+            { config: context.config, candidate: capture.candidate }, { ...wiring.storageOptions, allowValidationEquivalent: true });
+          if (previous.prepared && previous.receipt.attemptId !== undefined) {
+            reusableFingerprint = previous.receipt.preparationFingerprint;
+            retainedAttemptId = previous.receipt.attemptId;
+          }
+        }
+        if (retainedAttemptId === undefined && context.config.scopedExecution?.repairCommands?.length) {
           ownedAttemptId = await invalidatePreparationReceipt(context.rootDir, context.config, wiring.storageOptions);
           const beforeRepair = await computePreparationFingerprint(context.rootDir, context.config, wiring.storageOptions);
           for (const repair of context.config.scopedExecution.repairCommands) {
@@ -59,15 +71,7 @@ export const prepareCommand: CommandDescriptor = {
             if (result.code !== 0) throw new CheckSnapshotError("preparation_repair_failed", `Source repair ${repair.id} failed; fix it and prepare again.`);
           }
           if (beforeRepair !== await computePreparationFingerprint(context.rootDir, context.config, wiring.storageOptions)) throw new CheckSnapshotError("preparation_candidate_changed", "Repair changed preparation wiring; reload the configuration and prepare again.");
-        }
-        capture = await wiring.captureCandidate();
-        if (capture.ok && refreshRecordNeutral) {
-          const previous = await evaluatePreparationReceipt(context.rootDir,
-            { config: context.config, candidate: capture.candidate }, { ...wiring.storageOptions, allowValidationEquivalent: true });
-          if (previous.prepared && previous.receipt.attemptId !== undefined) {
-            reusableFingerprint = previous.receipt.preparationFingerprint;
-            retainedAttemptId = previous.receipt.attemptId;
-          }
+          capture = await wiring.captureCandidate();
         }
       } finally {
         attemptId = retainedAttemptId ?? ownedAttemptId ?? await invalidatePreparationReceipt(context.rootDir, context.config, wiring.storageOptions);
@@ -86,6 +90,7 @@ export const prepareCommand: CommandDescriptor = {
         attemptId = await invalidatePreparationReceipt(context.rootDir, context.config, wiring.storageOptions);
         ownedAttemptId = attemptId;
         retainedAttemptId = undefined;
+        if (context.config.scopedExecution?.repairCommands?.length) throw new CheckSnapshotError("preparation_candidate_changed", "Preparation wiring changed after repairs were skipped; reload the configuration and prepare again.");
       }
       let validationDigest = await computeDeliverableIdentity({ rootDir: context.rootDir, treeSha: capture.candidate.treeSha,
         config: { ...context.config, computingIdentityVersion: "validation-tree/v1", reviewNeutral: context.config.recordNeutral } });
@@ -130,8 +135,12 @@ export const prepareCommand: CommandDescriptor = {
       if (context.config.scopedExecution) {
         capture = finalCapture;
         validationDigest = await computeDeliverableIdentity({ rootDir: context.rootDir, treeSha: capture.candidate.treeSha, config: { ...context.config, computingIdentityVersion: "validation-tree/v1", reviewNeutral: context.config.recordNeutral } });
-        scoped = await ScopedChecks.create(context, capture.candidate);
-        await scoped?.satisfyMechanical();
+        if (context.config.scopedExecution.mechanicalProviders.length === 0) {
+          await ScopedChecks.validatePreparation(context, capture.candidate);
+        } else {
+          scoped = await ScopedChecks.create(context, capture.candidate);
+          await scoped?.satisfyMechanical();
+        }
       }
       const published = await publishPreparationReceipt(
         context.rootDir,

package/src/commands/record.ts

@@ -23,6 +23,7 @@ import {
 } from "@agent-delivery-harness/kernel";
 import path from "node:path";
 import { commandBlocker } from "../boundary.ts";
+import { focusedOutcome } from "../delivery-posture.ts";
 import type { CommandContext, CommandDescriptor, CommandResult } from "../boundary.ts";
 import { oneLine, resolveRunSpan } from "../run-surface.ts";
 import { applyDeliveryRecordRetention } from "../record-retention.ts";
@@ -59,139 +60,152 @@ function parseRetentionOptions(args: readonly string[]): RetentionOptions | unde
   return { scope, keepSuperseded };
 }
 
+/**
+ * The write itself, with no posture. `admit` runs this directly, because it
+ * keeps its behaviour under either posture: only the `record` command honours
+ * `focused`.
+ */
+export async function writeRecord(context: CommandContext, retention?: RetentionOptions): Promise<CommandResult> {
+  const observedAt = `${new Date().toISOString().slice(0, 19)}Z`;
+  const wiring = await context.wire();
+
+  // The gate is run without a prompt: `record` is not the waiver surface. If a
+  // waiver is needed, the operator runs `gate` first; here a non-admitting gate
+  // is simply a refusal.
+  const admission = await runProviderBackedAdmission(context, { allowPrompt: false, includeInjectedLiveResults: false });
+  if (!admission.admitted || admission.decision === undefined) {
+    return { kind: "blocked", blockers: [...admission.blockers] };
+  }
+  const decision = admission.decision;
+
+  // Refuse when the gate result no longer describes the current deliverable
+  // identity: a re-capture adjacent to the write.
+  const recheck = await wiring.captureCandidate();
+  if (!recheck.ok) {
+    return { kind: "blocked", blockers: [...recheck.blockers] };
+  }
+  if (recheck.candidate.deliverable.digest !== decision.candidate.deliverable.digest) {
+    return {
+      kind: "blocked",
+      blockers: [
+        commandBlocker({
+          code: "record_identity_changed",
+          sourceId: "delivery-harness.cli.record",
+          summary: "The deliverable identity changed after the gate; nothing was recorded.",
+          details: `gate ${decision.candidate.deliverable.digest} but current ${recheck.candidate.deliverable.digest}`,
+          remediations: [
+            {
+              id: "reprepare-and-record",
+              kind: "command",
+              command: ["delivery-harness", "prepare"],
+              summary: "Re-prepare the candidate and re-run the gate before recording.",
+            },
+          ],
+        }),
+      ],
+    };
+  }
+
+  // Gather the evidence records backing the decision so each evidence claim can
+  // be stamped with its manifest digest.
+  const evidenceRecords: EvidenceRecord[] = [];
+  for (const obligation of context.config.obligations) {
+    const discovery = await discoverRecords(context.rootDir, {
+      gateId: context.config.gateId,
+      obligationId: obligation.id,
+      ...wiring.storageOptions,
+    });
+    evidenceRecords.push(...discovery.records);
+  }
+
+  const evidenceReader = repositoryEvidenceReader(context.rootDir, context.artifacts);
+  const evidenceContext = await capturePortableEvidenceContext(context.config, evidenceReader,
+    await computePreparationFingerprint(context.rootDir, context.config), recheck.candidate.deliverable.digest);
+  const compiledPolicy = context.policyBinding?.compiledPolicy ??
+    await readCompiledRepositoryPolicy(await candidateTreeEvidenceReader(context.rootDir, recheck.candidate.treeSha));
+  // The delivery's own span, read off the run journal rather than off a
+  // clock: `startedAt` is the journal's first instant and `endedAt` the last
+  // it had reached by this write, which is the time this delivery had spent
+  // when it recorded. A delivery with no journal records exactly as it always
+  // did — the member is simply absent — because the record is evidence about
+  // a candidate and this is a cycle-time reading beside it, never a condition
+  // on writing one.
+  const runSpan = await resolveRunSpan({ cwd: context.rootDir, treeSha: recheck.candidate.treeSha, allowCurrentRun: true });
+  const built = buildDeliveryRecord({ config: context.config, decision, evidenceRecords, context: evidenceContext,
+    ...(runSpan === undefined ? {} : { runSpan: { startedAt: runSpan.startedAt, endedAt: runSpan.endedAt } }),
+    ...(compiledPolicy === null ? {} : { compiledPolicy, observedAt }) });
+  if (!built.ok) {
+    return { kind: "blocked", blockers: [...built.blockers] };
+  }
+
+  const verificationInputs = await capturePortableVerificationInputs(context.rootDir, context.config, recheck.candidate, built.record);
+  const checked = verifyDeliveryRecord(context.config, built.record,
+    { deliverableDigest: recheck.candidate.deliverable.digest, identityToken: recheck.candidate.deliverable.identity }, recheck.candidate.base,
+    { ...verificationInputs, observedAt, liveResults: admission.observedLiveResults ?? [], executionContext: context.classifyContext() });
+  if (!checked.ok) return { kind: "blocked", blockers: [...checked.blockers] };
+  const relativePath = deliveryRecordPathFor(context.config, decision.candidate.deliverable.digest);
+  const absolutePath = path.join(context.rootDir, relativePath);
+  const bytes = deliveryRecordBytes(built.record);
+  if (retention === undefined) {
+    await context.artifacts.writeTextFile(absolutePath, bytes);
+    return { kind: "ok", summary: `recorded ${relativePath}` };
+  }
+
+  const retained = await applyDeliveryRecordRetention({
+    rootDir: context.rootDir,
+    storageNamespace: context.config.storageNamespace,
+    scope: retention.scope,
+    keepSuperseded: retention.keepSuperseded,
+    recordBasePath: context.config.deliveryRecordPath,
+    current: {
+      relativePath,
+      deliverableDigest: decision.candidate.deliverable.digest,
+      bytes,
+    },
+    writeCurrent: () => context.artifacts.writeTextFile(absolutePath, bytes),
+  });
+  if (!retained.ok) {
+    return {
+      kind: "blocked",
+      blockers: [
+        commandBlocker({
+          code: retained.code,
+          sourceId: "delivery-harness.cli.record",
+          summary: "Tracked delivery-record retention did not complete.",
+          details: retained.detail,
+          remediations: [
+            {
+              id: "repair-record-retention",
+              kind: "manual_action",
+              summary: "Preserve the exact owned record bytes in Git, repair the named ownership conflict, then retry record with the same scope and bound.",
+            },
+          ],
+        }),
+      ],
+    };
+  }
+
+  return {
+    kind: "ok",
+    summary: `recorded ${relativePath}${retained.pruned.length === 0 ? "" : `; pruned Git-preserved ${retained.pruned.join(", ")}`}`,
+  };
+}
+
 export const recordCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "record",
   sourceId: "delivery-harness.cli.record",
   summary: "Write the tracked delivery record for an admitted gate.",
   usage: "Usage: delivery-harness record [--retention-scope <delivery-key> --keep-superseded <0-100>]\nRetention is opt-in; run gate first if a waiver is needed.",
   async run(context: CommandContext): Promise<CommandResult> {
-    const observedAt = `${new Date().toISOString().slice(0, 19)}Z`;
     // Arguments before anything is wired, admitted, or written.
     const retention = parseRetentionOptions(context.args);
     if (typeof retention === "string") {
       return { kind: "usage", message: `${retention}.\n${recordCommand.usage}` };
     }
-    const wiring = await context.wire();
-
-    // The gate is run without a prompt: `record` is not the waiver surface. If a
-    // waiver is needed, the operator runs `gate` first; here a non-admitting gate
-    // is simply a refusal.
-    const admission = await runProviderBackedAdmission(context, { allowPrompt: false, includeInjectedLiveResults: false });
-    if (!admission.admitted || admission.decision === undefined) {
-      return { kind: "blocked", blockers: [...admission.blockers] };
-    }
-    const decision = admission.decision;
-
-    // Refuse when the gate result no longer describes the current deliverable
-    // identity: a re-capture adjacent to the write.
-    const recheck = await wiring.captureCandidate();
-    if (!recheck.ok) {
-      return { kind: "blocked", blockers: [...recheck.blockers] };
-    }
-    if (recheck.candidate.deliverable.digest !== decision.candidate.deliverable.digest) {
-      return {
-        kind: "blocked",
-        blockers: [
-          commandBlocker({
-            code: "record_identity_changed",
-            sourceId: "delivery-harness.cli.record",
-            summary: "The deliverable identity changed after the gate; nothing was recorded.",
-            details: `gate ${decision.candidate.deliverable.digest} but current ${recheck.candidate.deliverable.digest}`,
-            remediations: [
-              {
-                id: "reprepare-and-record",
-                kind: "command",
-                command: ["delivery-harness", "prepare"],
-                summary: "Re-prepare the candidate and re-run the gate before recording.",
-              },
-            ],
-          }),
-        ],
-      };
-    }
-
-    // Gather the evidence records backing the decision so each evidence claim can
-    // be stamped with its manifest digest.
-    const evidenceRecords: EvidenceRecord[] = [];
-    for (const obligation of context.config.obligations) {
-      const discovery = await discoverRecords(context.rootDir, {
-        gateId: context.config.gateId,
-        obligationId: obligation.id,
-        ...wiring.storageOptions,
-      });
-      evidenceRecords.push(...discovery.records);
-    }
+    const focused = await focusedOutcome(context);
+    if (focused !== undefined) return focused;
 
-    const evidenceReader = repositoryEvidenceReader(context.rootDir, context.artifacts);
-    const evidenceContext = await capturePortableEvidenceContext(context.config, evidenceReader,
-      await computePreparationFingerprint(context.rootDir, context.config));
-    const compiledPolicy = context.policyBinding?.compiledPolicy ??
-      await readCompiledRepositoryPolicy(await candidateTreeEvidenceReader(context.rootDir, recheck.candidate.treeSha));
-    // The delivery's own span, read off the run journal rather than off a
-    // clock: `startedAt` is the journal's first instant and `endedAt` the last
-    // it had reached by this write, which is the time this delivery had spent
-    // when it recorded. A delivery with no journal records exactly as it always
-    // did — the member is simply absent — because the record is evidence about
-    // a candidate and this is a cycle-time reading beside it, never a condition
-    // on writing one.
-    const runSpan = await resolveRunSpan({ cwd: context.rootDir, treeSha: recheck.candidate.treeSha, allowCurrentRun: true });
-    const built = buildDeliveryRecord({ config: context.config, decision, evidenceRecords, context: evidenceContext,
-      ...(runSpan === undefined ? {} : { runSpan: { startedAt: runSpan.startedAt, endedAt: runSpan.endedAt } }),
-      ...(compiledPolicy === null ? {} : { compiledPolicy, observedAt }) });
-    if (!built.ok) {
-      return { kind: "blocked", blockers: [...built.blockers] };
-    }
-
-    const verificationInputs = await capturePortableVerificationInputs(context.rootDir, context.config, recheck.candidate, built.record);
-    const checked = verifyDeliveryRecord(context.config, built.record,
-      { deliverableDigest: recheck.candidate.deliverable.digest, identityToken: recheck.candidate.deliverable.identity }, recheck.candidate.base,
-      { ...verificationInputs, observedAt, liveResults: admission.observedLiveResults ?? [], executionContext: context.classifyContext() });
-    if (!checked.ok) return { kind: "blocked", blockers: [...checked.blockers] };
-    const relativePath = deliveryRecordPathFor(context.config, decision.candidate.deliverable.digest);
-    const absolutePath = path.join(context.rootDir, relativePath);
-    const bytes = deliveryRecordBytes(built.record);
-    if (retention === undefined) {
-      await context.artifacts.writeTextFile(absolutePath, bytes);
-      return { kind: "ok", summary: `recorded ${relativePath}` };
-    }
-
-    const retained = await applyDeliveryRecordRetention({
-      rootDir: context.rootDir,
-      storageNamespace: context.config.storageNamespace,
-      scope: retention.scope,
-      keepSuperseded: retention.keepSuperseded,
-      recordBasePath: context.config.deliveryRecordPath,
-      current: {
-        relativePath,
-        deliverableDigest: decision.candidate.deliverable.digest,
-        bytes,
-      },
-      writeCurrent: () => context.artifacts.writeTextFile(absolutePath, bytes),
-    });
-    if (!retained.ok) {
-      return {
-        kind: "blocked",
-        blockers: [
-          commandBlocker({
-            code: retained.code,
-            sourceId: "delivery-harness.cli.record",
-            summary: "Tracked delivery-record retention did not complete.",
-            details: retained.detail,
-            remediations: [
-              {
-                id: "repair-record-retention",
-                kind: "manual_action",
-                summary: "Preserve the exact owned record bytes in Git, repair the named ownership conflict, then retry record with the same scope and bound.",
-              },
-            ],
-          }),
-        ],
-      };
-    }
-
-    return {
-      kind: "ok",
-      summary: `recorded ${relativePath}${retained.pruned.length === 0 ? "" : `; pruned Git-preserved ${retained.pruned.join(", ")}`}`,
-    };
+    return writeRecord(context, retention);
   },
 };

package/src/commands/resume.ts

@@ -1,5 +1,6 @@
 import { classifyCandidateDrift, digestCanonical, evaluatePreparationReceipt, runAdmission, type CandidateBinding } from "@agent-delivery-harness/kernel";
 import { installedRelease, policyDigest, reconciliationActions, recoveryBlocker, recoveryRun } from "../ordinary-context.ts";
+import { focusedOutcome } from "../delivery-posture.ts";
 import type { CommandDescriptor } from "../boundary.ts";
 
 const USAGE = "Usage: delivery-harness resume [--run <run-id>]";
@@ -10,6 +11,8 @@ export const resumeCommand: CommandDescriptor = {
   usage: USAGE,
   async run(context) {
     if (context.args.length !== 0 && (context.args.length !== 2 || context.args[0] !== "--run")) return { kind: "usage", message: USAGE };
+    const focused = await focusedOutcome(context);
+    if (focused !== undefined) return focused;
     const run = await recoveryRun(context.rootDir, context.args[1]);
     if (!run.ok) return { kind: "blocked", blockers: [run.blocker] };
     const saved = [...run.events].reverse().find(event => event.kind === "context.saved");

package/src/commands/review-context.ts

@@ -13,6 +13,7 @@ import { buildReviewContext, OutcomeError } from "../review-evidence.ts";
 const USAGE = "Usage: delivery-harness review-context [--json]";
 
 export const reviewContextCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "review-context",
   sourceId: "delivery-harness.cli.review-context",
   summary: "Show the reviewable-change context for the prepared candidate.",

package/src/commands/save-context.ts

@@ -1,13 +1,20 @@
+import { describeRunEventPayload, RUN_EVENT_SPEC, type RunEventPayloadMemberGrammar } from "@agent-delivery-harness/kernel";
 import { buildRunEvent } from "../run-surface.ts";
 import { installedRelease, ordinaryEventWriter, policyDigest, recoveryBlocker, recoveryRun, rejectionDetails } from "../ordinary-context.ts";
 import type { CommandDescriptor } from "../boundary.ts";
 
 const USAGE = "Usage: delivery-harness save-context --json '{\"contract\":{\"objective\":\"...\",\"acceptanceCriteria\":[\"...\"],\"finishLine\":\"merge-ready\"},\"stage\":\"work\"}'";
+// Read from the store's own grammar, so the stated limits are the enforced ones.
+const members = describeRunEventPayload("context.saved", RUN_EVENT_SPEC)!.members;
+const bound = (name: string, member: RunEventPayloadMemberGrammar) => `  ${name}: ${member.constraint}${member.items ? `, each ${member.items.constraint}` : ""}`;
+const BOUNDS = ["Bounds:",
+  ...members.find(m => m.name === "contract")!.members!.map(m => bound(`contract.${m.name}`, m)),
+  bound("stage", members.find(m => m.name === "stage")!)].join("\n");
 
 export const saveContextCommand: CommandDescriptor = {
   name: "save-context", sourceId: "delivery-harness.cli.save-context",
   summary: "Save a bounded delivery contract and stage observation in the current run.",
-  usage: USAGE,
+  usage: `${USAGE}\n${BOUNDS}`,
   async run(context) {
     if (context.args.length !== 2 || context.args[0] !== "--json") return { kind: "usage", message: USAGE };
     let input: { contract?: unknown; stage?: unknown };
@@ -44,7 +51,7 @@ export const saveContextCommand: CommandDescriptor = {
       { reuseExistingTimestamp: true },
     );
     if (!appended.ok) return { kind: "blocked", blockers: [recoveryBlocker("resume_context_invalid",
-      "Context was refused by the bounded run-event contract; inspect contract, stage, and secret-free inputs.",
+      "Context was refused by the bounded run-event contract; inspect contract, stage, and secret-free inputs. `save-context --help` lists every bound.",
       `run ${run.runId}: ${rejectionDetails(appended.rejections)}`)] };
     return { kind: "ok", summary: `saved ordinary context for ${run.runId}; stage is an observation, not evidence` };
   },

package/src/commands/submit-evidence.ts

@@ -10,6 +10,7 @@
 import { submitManifest } from "@agent-delivery-harness/kernel";
 import type { CommandContext, CommandDescriptor, CommandResult } from "../boundary.ts";
 import { oneLine } from "../run-surface.ts";
+import { ScopedChecks } from "../scoped-checks.ts";
 
 function manifestPathsFrom(args: readonly string[]): string[] | undefined {
   const paths: string[] = [];
@@ -44,6 +45,7 @@ function unknownFlagIn(args: readonly string[]): string | undefined {
 }
 
 export const submitEvidenceCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "submit-evidence",
   sourceId: "delivery-harness.cli.submit-evidence",
   summary: "Validate a provider manifest and publish its evidence records.",
@@ -68,10 +70,22 @@ export const submitEvidenceCommand: CommandDescriptor = {
     }
 
     const wiring = await context.wire();
-    const outcome = await submitManifest(
-      { rootDir: context.rootDir, manifestPath, config: context.config },
-      { captureCandidate: wiring.captureCandidate, artifacts: context.artifacts, ...wiring.storageOptions },
-    );
+    // Scoped check bindings are captured for every manifest, so a scoped
+    // provider needs the plan rebuilt for the current candidate and base, as
+    // the gate builds it. The kernel still refuses a plan that is not current.
+    let session: ScopedChecks | undefined;
+    let outcome: Awaited<ReturnType<typeof submitManifest>>;
+    try {
+      if (context.config.providers.some(p => p.check?.scope)) {
+        const capture = await wiring.captureCandidate();
+        if (capture.ok) session = await ScopedChecks.create(context, capture.candidate);
+      }
+      outcome = await submitManifest(
+        { rootDir: context.rootDir, manifestPath, config: context.config },
+        { captureCandidate: wiring.captureCandidate, artifacts: context.artifacts, ...wiring.storageOptions,
+          ...(session ? { scopedPlan: await session.plan(), readOutput: session.readOutput } : {}) },
+      );
+    } finally { await session?.cleanup(); }
 
     if (outcome.status === "accepted") {
       const lines = outcome.records.map(

package/src/commands/verify.ts

@@ -43,6 +43,7 @@ import {
   type RunJournalRow,
 } from "@agent-delivery-harness/kernel";
 import { commandBlocker } from "../boundary.ts";
+import { focusedOutcome } from "../delivery-posture.ts";
 import type { CommandContext, CommandDescriptor, CommandResult } from "../boundary.ts";
 import { RUN_JOURNAL_ADMISSION_ROW, oneLine, resolveRunJournalRow, resolveRunSpan, runJournalRows } from "../run-surface.ts";
 import { durationLabel } from "../run-projection.ts";
@@ -233,6 +234,7 @@ async function runSpanRows(
 }
 
 export const verifyCommand: CommandDescriptor = {
+  capturesCandidate: true,
   name: "verify",
   sourceId: "delivery-harness.cli.verify",
   summary: "Verify the tracked delivery record against the current candidate.",
@@ -244,6 +246,9 @@ export const verifyCommand: CommandDescriptor = {
     const parsedArgs = parseArgs(context.args);
     if (!parsedArgs.ok) return { kind: "usage", message: parsedArgs.message };
 
+    const focused = await focusedOutcome(context);
+    if (focused !== undefined) return focused;
+
     const wiring = await context.wire();
     const capture = await wiring.captureCandidate();
     if (!capture.ok) {