@amaster.ai/employee-runtime-connector 0.1.0-beta.0 → 0.1.0-beta.10

package/dist/amaster-runtime-daemon.mjs

@@ -264,7 +264,7 @@ function buildConfig(env = process.env, flags = {}) {
       0,
     ),
     artifactVerifierCommands: splitList(
-      flags.artifactVerifierCommands ?? env.AMASTER_ARTIFACT_VERIFIER_COMMANDS ?? "node,python3",
+      flags.artifactVerifierCommands ?? env.AMASTER_ARTIFACT_VERIFIER_COMMANDS ?? "",
     ),
     orphanReaperIntervalSeconds: parseNonNegativeInteger(
       flags.orphanReaperIntervalSeconds ?? env.AMASTER_RUNTIME_ORPHAN_REAPER_INTERVAL_SECONDS,
@@ -585,6 +585,23 @@ function piRuntimeActionText(message) {
   return text.includes("AMASTER_RUNTIME_ACTIONS") ? text : "";
 }
 
+function piEventHasRuntimeActionMarkerInToolOutput(event) {
+  const directMessage = asRecord(event.message);
+  if (directMessage.role === "toolResult" && piRuntimeActionText(directMessage)) return true;
+
+  const eventMessages = Array.isArray(event.messages) ? event.messages : [];
+  if (eventMessages.some((message) => {
+    const record = asRecord(message);
+    return record.role === "toolResult" && Boolean(piRuntimeActionText(record));
+  })) return true;
+
+  const toolResults = Array.isArray(event.toolResults) ? event.toolResults : [];
+  if (toolResults.some((result) => Boolean(piRuntimeActionText(result)))) return true;
+
+  if (event.type === "tool_execution_end" && piRuntimeActionText(event.result)) return true;
+  return false;
+}
+
 function appendUniqueText(values, text) {
   const normalized = typeof text === "string" ? text.trim() : "";
   if (!normalized) return false;
@@ -710,6 +727,7 @@ function parsePiJsonl(stdout) {
   let terminalEventType = null;
   let stopReason = null;
   let hasAssistantOutput = false;
+  let runtimeActionMarkerInToolOutput = false;
   const messages = [];
   const runtimeActionTexts = [];
   const usage = { inputTokens: 0, cachedInputTokens: 0, outputTokens: 0 };
@@ -717,6 +735,8 @@ function parsePiJsonl(stdout) {
   for (const rawLine of String(stdout ?? "").split(/\r?\n/)) {
     const event = parseJsonLine(rawLine.trim());
     if (!event) continue;
+    runtimeActionMarkerInToolOutput = piEventHasRuntimeActionMarkerInToolOutput(event)
+      || runtimeActionMarkerInToolOutput;
     if (event.type === "session") {
       sessionId = readString(event.id) ?? sessionId;
       continue;
@@ -755,6 +775,7 @@ function parsePiJsonl(stdout) {
     sessionId,
     summary: messages.at(-1) ?? "",
     runtimeActionText: runtimeActionTexts.join("\n\n"),
+    runtimeActionMarkerInToolOutput,
     usage,
     sawTurnEnd,
     terminalEventType,
@@ -2310,11 +2331,11 @@ function readWorkspaceStatus(cwd, opts = {}) {
 // ---- bundled entrypoint: src/amaster-runtime-daemon.mjs ----
 
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
-const CONNECTOR_VERSION = "0.1.0-beta.0";
+const CONNECTOR_VERSION = "0.1.0-beta.10";
 const MAX_INFERRED_ARTIFACT_UPLOADS = 20;
 const MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
 const CHECKPOINT_TTL_MS = 24 * 60 * 60 * 1000;
@@ -3371,6 +3392,73 @@ function renderTaskMarkdown(context) {
   return readString(context.paperclipTaskMarkdown);
 }
 
+const LEGACY_DECOMPOSITION_NEGATION_PATTERNS = [
+  /(?:不要|不得|无需|不需要|不用|禁止|避免)(?:再|去)?[^。！？；;.!?\n]{0,120}(?:子任务|子项任务)/i,
+  /\b(?:do\s+not|don't|must\s+not|should\s+not|need\s+not|no\s+need\s+to|avoid)\b[^.!?;\n]{0,120}\b(?:child\s+tasks?|subtasks?)\b/i,
+];
+
+const LEGACY_DECOMPOSITION_REQUIREMENT_PATTERNS = [
+  {
+    id: "zh_split_child_tasks",
+    language: "zh",
+    pattern: /(?:拆出|拆分(?:为|成)?|拆解(?:为|成)?)[^。！？；;.!?\n]{0,80}(?:子任务|子项任务)/i,
+  },
+  {
+    id: "zh_create_child_tasks",
+    language: "zh",
+    pattern: /(?:创建|建立|生成|新增)\s*(?:(?:以下|这些|新的|具体|独立|可执行|对应|若干|多个|[一二三四五六七八九十两]+|\d+)\s*){0,5}(?:个|条|项)?\s*(?:子任务|子项任务)(?!\s*(?:报告|清单|对比|列表|状态|概览))/i,
+  },
+  {
+    id: "en_create_child_tasks",
+    language: "en",
+    pattern: /\bcreate\s+(?:(?:the|these|those|following|new|concrete|independent|executable|one|two|three|four|five|six|seven|eight|nine|ten|several|multiple|\d+)\s+){0,5}(?:child\s+tasks?|subtasks?)\b(?!\s+(?:summar(?:y|ies)|reports?|lists?|overviews?)\b)/i,
+  },
+  {
+    id: "en_split_child_tasks",
+    language: "en",
+    pattern: /\b(?:split|decompose|break\s+down)\b[^.!?;\n]{0,80}\b(?:child\s+tasks?|subtasks?)\b/i,
+  },
+];
+
+function legacyTaskDecompositionRequirement(context) {
+  const issue = asRecord(context.paperclipIssue);
+  if (readString(issue.workMode) === "planning") return { required: false, source: "planning" };
+  const fields = [
+    { field: "title", text: readString(issue.title) },
+    { field: "description", text: readString(issue.description) },
+  ];
+  for (const { field, text } of fields) {
+    if (!text) continue;
+    const clauses = text
+      .split(/[。！？；.!?;\n]+/)
+      .map((clause) => clause.trim())
+      .filter(Boolean);
+    for (const [clauseIndex, clause] of clauses.entries()) {
+      if (LEGACY_DECOMPOSITION_NEGATION_PATTERNS.some((pattern) => pattern.test(clause))) continue;
+      const matched = LEGACY_DECOMPOSITION_REQUIREMENT_PATTERNS.find(({ pattern }) => pattern.test(clause));
+      if (!matched) continue;
+      return {
+        required: true,
+        source: "legacy_text_hard_gate",
+        match: {
+          field,
+          clauseIndex,
+          pattern: matched.id,
+          language: matched.language,
+          charCount: clause.length,
+          sha256Prefix: createHash("sha256").update(clause).digest("hex").slice(0, 12),
+        },
+      };
+    }
+  }
+  return { required: false, source: "none" };
+}
+
+function commandLegacyTaskDecompositionRequirement(command) {
+  const payload = asRecord(command.payload);
+  return legacyTaskDecompositionRequirement(asRecord(payload.contextSnapshot));
+}
+
 function normalizeAgentInstructionsFiles(bundle) {
   const files = asRecord(bundle.files);
   const selected = [];
@@ -3427,25 +3515,69 @@ function canRuntimeAgentOrchestrateOrganization(context) {
 }
 
 function runtimeActionsInstruction(options = {}) {
+  const authorizationEnvelope = options.authorizationEnvelope ?? {
+    allowedActionClasses: new Set(["task_governance"]),
+    sourceKind: "implicit_default",
+    sourceId: "unknown",
+    sourceRevision: "missing_envelope",
+  };
+  const knownActionClasses = ["task_governance", "organization_mutation", "executable_child"];
+  const allowedActionClasses = knownActionClasses.filter((actionClass) =>
+    authorizationEnvelope.allowedActionClasses.has(actionClass));
+  const deniedActionClasses = knownActionClasses.filter((actionClass) =>
+    !authorizationEnvelope.allowedActionClasses.has(actionClass));
+  const authorizationOptionIdEntries = knownActionClasses
+    .map((actionClass) => [actionClass, authorizationEnvelope.authorizationOptionIds?.get(actionClass)])
+    .filter(([, optionId]) => optionId);
+  const authorizationOptionIdGuidance = authorizationOptionIdEntries.length === knownActionClasses.length
+    ? `Authorization checkbox option ids: ${authorizationOptionIdEntries
+      .map(([actionClass, optionId]) => `${actionClass}=${optionId}`)
+      .join(", ")}. Use these exact ids when requesting authorization; do not invent another prefix.`
+    : "Authorization checkbox option ids are unavailable for this wake. Do not invent option ids that grant organization_mutation or executable_child authorization.";
   const allowedActionTypes = [
     "add_comment",
     "update_parent",
     "create_child_task",
     "upload_artifact",
+    "upsert_document",
     ...(options.canOrchestrateOrganization ? ["agent_hire"] : []),
     "create_interaction",
   ].join(", ");
   const currentAgentAdapterType = readString(options.currentAgentAdapterType);
+  const artifactVerifierCommands = Array.isArray(options.artifactVerifierCommands)
+    ? options.artifactVerifierCommands.map(readString).filter(Boolean)
+    : [];
+  const actionValidatorCommand = readString(options.actionValidatorCommand);
   return [
     "Runtime action bridge:",
-    "If direct AMaster API requests are unavailable from the executor sandbox, do not stop at blocked. Instead finish with this exact marker and a JSON object:",
+    `Allowed runtime action classes for this wake: ${allowedActionClasses.join(", ") || "none"}.`,
+    `Denied runtime action classes for this wake: ${deniedActionClasses.join(", ") || "none"}.`,
+    `Wake authorization source: ${authorizationEnvelope.sourceKind}:${authorizationEnvelope.sourceId} revision ${authorizationEnvelope.sourceRevision}.`,
+    authorizationOptionIdGuidance,
+    "This capability guidance is rendered from the same authorization envelope enforced by runtime preflight. Preflight remains the final authority. task_governance covers comments, parent status, backlog children, artifacts, and interactions; organization_mutation covers agent_hire/create_agent; executable_child covers todo/in_progress child creation.",
+    "Choose exactly one mutation path for each requested action: direct AMaster API or the runtime action bridge. Never replay the same mutation through both paths.",
+    "If direct AMaster API requests succeed for all requested mutations, finish with a normal summary and do not emit or mention the AMASTER_RUNTIME_ACTIONS marker.",
+    "If direct AMaster API requests are unavailable from the executor sandbox, do not stop at blocked. Use the runtime action bridge for the unapplied mutations.",
     "Use runtime actions as a continuation patch, not as a full replay. If the wake reason or latest comments say a confirmation was accepted, rejected, or that no more child tasks/interactions should be created, do not recreate those earlier actions. Add the final result comment and update the parent task instead.",
+    "On an accepted request_confirmation or request_checkbox_confirmation continuation, any new confirmation must include payload.target.type and a non-empty payload.target.key. Missing decision identity fields fail before mutation with accepted_confirmation_decision_target_required. The server reuses identical content for the same target identity and rejects changed prompt, options, or labels until the action uses the genuinely new target revision.",
+    "Every request_confirmation and request_checkbox_confirmation should bind the concrete decision to payload.target using {type:\"custom\", key, label, revisionId} or the applicable issue_document target. Keep target.key stable for the same decision purpose and change target.revisionId only when the target content changes. Replace example target values with task-specific values; when no business revision exists, use the current run id as revisionId instead of omitting target.",
     "If the wake reason is issue_children_completed, treat the completed child tasks as already resolved blockers. Do not recreate blocker child tasks, do not repeat the first-run blocker plan, and do not create another review path unless new human input is truly required. Summarize the completed child work and use update_parent status done when no human review is needed.",
     "Use update_parent status done when no human review is needed. Prefer creating a pending review path such as request_confirmation, request_checkbox_confirmation, ask_user_questions, or suggest_tasks before status in_review; if a bare in_review update is emitted, AMaster will create a fallback request_confirmation before PATCH.",
     "For create_child_task, do not create ownerless executable todo tasks. Set assigneeAgentId only when the target agent id came from the current AMaster task context or an agent_hire action in this same batch. Do not invent agent ids, role ids, or ids from another company. If you are unsure, omit assigneeAgentId and assigneeUserId; AMaster will assign the current executing agent for todo/in_progress children. Use backlog only when a task is intentionally unassigned.",
-    "If child tasks must wait for a human confirmation, use one suggest_tasks interaction so AMaster creates and wakes the selected tasks only after acceptance. A batch that combines executable create_child_task actions with a pending interaction is rejected before mutation unless every such child is backlog or explicitly sets executeBeforeConfirmation true.",
+    "Create a child only for an independently executable residual work item. Do not create a nested child merely to prove that child creation works, and do not treat the current issue title as an instruction to recreate the issue itself. If the current child already embodies the requested test or work item, complete it directly.",
+    "Every root create_child_task with status todo or in_progress must establish the parent disposition in the same batch. Set blockParentUntilDone true when the parent depends on that child. Only omit the wait when the same batch also closes the parent's independent scope with update_parent status done or cancelled. parentId alone is structural and never proves that the parent is waiting; missing both paths fails with delegated_parent_wait_required.",
+    "Creating child tasks and delegating them to existing agents is task execution, not organization orchestration. Use assignee ids only from the current task context; server permissions still decide whether an assignment is allowed.",
+    "Runtime actions use a strict schema. Unknown fields, unsupported action types, duplicate clientKey values, unknown client-key references, and client-key dependency cycles reject the entire batch before any mutation. blockedByIssueIds is supported only on create_child_task for existing issue UUIDs supplied by the current task context; connector preflight checks UUID shape, while the server validates same-company existence and permissions. Do not place it on update_parent or invent fields that are not in the canonical action examples.",
+    "Use native JSON scalar types exactly: booleans such as create_child_task.blockParentUntilDone, top-level deliverables[].required, and create_interaction payload questions[].required must be true or false without quotes. Numbers such as minSelected/maxSelected/version must be numeric literals without quotes. String forms such as \"true\" or \"1\" reject the whole batch; AMaster does not silently coerce them.",
+    "For same-batch relationships, assign a unique clientKey to each agent_hire or create_child_task producer. Use reportsToAgentClientKey for a new agent's manager, assigneeAgentClientKey for a child owner, parentClientKey for a nested child, and blockedByClientKeys for first-class child blockers. Use blockedByIssueIds only when a new child depends on existing issue UUIDs supplied by the current task context; connector preflight checks UUID shape and the server validates same-company existence. References may point forward within the same batch; every referenced key must resolve to the correct resource kind in that batch.",
+    options.explicitDecompositionRequired
+      ? "This standard task explicitly requires child task decomposition. The runtime action batch must include create_child_task or one suggest_tasks interaction unless child tasks already exist. A checklist in a comment or artifact is not decomposition. Create independently executable internal preparation tasks now. Use backlog for recorded work that should not start now, and use suggest_tasks for work that must wait for human approval. When a pending interaction is created, keep the parent in_review rather than in_progress or done."
+      : "",
+    options.canOrchestrateOrganization
+      ? "Pending-interaction batch gate: before emitting JSON, scan every agent_hire and create_child_task. Every co-batched hire must independently set executeBeforeConfirmation true; every create_child_task must independently be backlog, set executeBeforeConfirmation true, or move into suggest_tasks. blockParentUntilDone=false and a flagged assignee hire do not exempt a child. Otherwise move the hires to a later continuation and use suggest_tasks for work that must wait for acceptance. This applies to every pending interaction, including budget or business approval."
+      : "Pending-interaction batch gate: before emitting JSON, scan every create_child_task. Every create_child_task must independently be backlog, set executeBeforeConfirmation true, or move into suggest_tasks. blockParentUntilDone=false does not exempt a child. Use suggest_tasks for work that must wait for acceptance.",
     options.canOrchestrateOrganization
-      ? "For AMaster organization-building requests, such as creating other roles, hiring digital employees, building the first team, or assigning work to roles, do not stop at a strategy document. Include agent_hire for each needed role and create_child_task for that role's first concrete assignment. If approval is required, create a request_confirmation or leave the hire approval pending. These organization batches must include add_comment or update_parent.comment explaining what was created, requested, assigned, or blocked."
+      ? "For AMaster organization-building requests, such as creating other roles, hiring digital employees, building the first team, or assigning work to roles, do not stop at a strategy document. Include agent_hire for each needed role and create_child_task for that role's first concrete assignment. agent_hire already creates the native pending hire approval; do not also ask whether to approve that hire in a create_interaction action in the same batch. If approval must happen before any hire record exists, create only a proposal interaction and hire in a later continuation. These organization batches must include add_comment or update_parent.comment explaining what was created, requested, assigned, or blocked."
       : "",
     options.canOrchestrateOrganization
       ? `For agent_hire, set adapterType explicitly. Default to the current executing agent adapterType${currentAgentAdapterType ? ` (${currentAgentAdapterType})` : ""} unless the task names a different approved adapter.`
@@ -3453,20 +3585,41 @@ function runtimeActionsInstruction(options = {}) {
     options.canOrchestrateOrganization
       ? `For agent_hire, role must be one of: ${AGENT_HIRE_SCHEMA_ROLES.join(", ")}. Put custom business role names in name/title/capabilities/instructionsBundle, not in role. Map product/customer insight to research or product, growth/revenue to marketing or sales, finance/budget to finance, engineering delivery to engineering, legal/compliance to legal, customer success/support to customer_support. capabilities must be a string, not an array. instructionsBundle must use {entryFile:"AGENTS.md", files: {"AGENTS.md": "..."}}, and instructionsBundle.files must contain at least one file.`
       : "",
+    options.canOrchestrateOrganization
+      ? "Every agent_hire must declare exactly one reporting disposition. For an existing manager from the current task context, set reportsTo to that manager UUID. For a manager hired in the same batch, set reportsToAgentClientKey to the manager's clientKey. Only a genuinely company-root role may set topLevel true. reportsToAgentId is unsupported; use reportsTo for an existing manager UUID."
+      : "",
     options.canOrchestrateOrganization
       ? "When assigning a newly hired agent's first task in the same action batch, set clientKey on the agent_hire action and set assigneeAgentClientKey or agentClientKey on the create_child_task action to that same key. Do not leave the first task assigned to the current CEO/executing agent unless the CEO should actually do the work."
       : "",
-    "Output format: write the marker AMASTER_RUNTIME_ACTIONS, then exactly one fenced json object. Use this literal shape with real action objects: {\"version\":1,\"actions\":[{\"type\":\"add_comment\",\"body\":\"Progress or result summary\"}]}.",
-    "The runtime action block must be strict JSON parseable by JSON.parse. Do not use ellipses, placeholders such as [...], comments, trailing commas, single quotes, markdown tables outside quoted strings, or raw double quotes inside string values. Escape quotes and newlines in string values, or generate the block with JSON.stringify / @amaster/runtime-sdk before printing it.",
-    "Before final output, validate the runtime action block with JSON.parse. If it would fail, fix the JSON and only then print AMASTER_RUNTIME_ACTIONS.",
+    "Fallback output format: put the marker AMASTER_RUNTIME_ACTIONS in the final assistant message, then exactly one fenced json object. Use this literal shape with real action objects: {\"version\":1,\"actions\":[{\"type\":\"add_comment\",\"body\":\"Progress or result summary\"}]}.",
+    "Never use write, bash, cat, printf, echo, or any other tool to emit the marker or JSON. You may prepare and validate the envelope in a temporary workspace file, but the final assistant message itself must contain the exact marker and JSON; tool output is ignored by the runtime action bridge.",
+    "The runtime action block must be strict JSON parseable by JSON.parse. Do not use ellipses, placeholders such as [...], comments, trailing commas, single quotes, markdown tables outside quoted strings, or raw double quotes inside string values. Escape quotes and newlines in string values, or generate the block with JSON.stringify / @amaster/runtime-sdk before including it in the final assistant message.",
+    "Before final output, validate the runtime action block with JSON.parse. If it would fail, fix the JSON and only then include AMASTER_RUNTIME_ACTIONS in the final assistant message.",
+    actionValidatorCommand
+      ? `Before final output, write only the JSON envelope to .amaster-runtime-actions.json and run this exact strict-schema validator: ${actionValidatorCommand}. Fix every reported error and rerun until it exits 0. JSON.parse alone is not sufficient. Do not include the marker in the temporary file.`
+      : "",
     `Allowed action types: ${allowedActionTypes}.`,
-    "For create_interaction ask_user_questions, use payload {\"version\":1,\"title\":\"...\",\"questions\":[{\"id\":\"question_key\",\"prompt\":\"Question text\",\"selectionMode\":\"single\",\"required\":true,\"options\":[{\"id\":\"option_key\",\"label\":\"Option label\"}]}]}. Do not use question/options.value at the top level.",
-    "For create_interaction request_confirmation, use payload {\"version\":1,\"prompt\":\"Confirm this result?\",\"acceptLabel\":\"确认\",\"rejectLabel\":\"调整\"}. Do not use options arrays for request_confirmation.",
-    "For create_interaction request_checkbox_confirmation, use payload {\"version\":1,\"prompt\":\"Select approved items\",\"options\":[{\"id\":\"option_key\",\"label\":\"Option label\"}],\"minSelected\":1,\"maxSelected\":2,\"acceptLabel\":\"确认\",\"rejectLabel\":\"调整\"}.",
+    "For upsert_document, write or replace a Markdown document on the current AMaster task. Use {\"type\":\"upsert_document\",\"key\":\"business-brief\",\"title\":\"2026-07-16 每日经营简报\",\"body\":\"# 每日经营简报\\n...\",\"format\":\"markdown\",\"changeSummary\":\"生成每日经营简报\"}. key, body, and format are required; format must be markdown. Never target a different issue.",
+    "For every create_interaction action, set top-level kind to the interaction kind and set payload to a JSON object. Use this complete canonical request_confirmation example: {\"type\":\"create_interaction\",\"kind\":\"request_confirmation\",\"continuationPolicy\":\"wake_assignee_on_accept\",\"payload\":{\"version\":1,\"prompt\":\"Confirm this result?\",\"acceptLabel\":\"确认\",\"rejectLabel\":\"调整\",\"target\":{\"type\":\"custom\",\"key\":\"delivery-review\",\"label\":\"交付结果\",\"revisionId\":\"v1\"}}}. Never use interactionType.",
+    "Interactions cannot be updated with PATCH after creation. For direct API calls, include continuationPolicy in the initial POST /api/issues/{issueId}/interactions request and use only the documented POST accept, reject, respond, or cancel resolution endpoint afterward.",
+    "For create_interaction ask_user_questions, use continuationPolicy wake_assignee, never wake_assignee_on_accept, because answering questions does not produce accepted status. Every question requires 1-10 options; do not emit an open-text question without options. The UI provides an Other text answer alongside the declared options. Use payload {\"version\":1,\"title\":\"...\",\"questions\":[{\"id\":\"question_key\",\"prompt\":\"Question text\",\"selectionMode\":\"single\",\"required\":true,\"options\":[{\"id\":\"option_key\",\"label\":\"Option label\"}]}]}. Do not use question/options.value at the top level.",
+    "For create_interaction request_confirmation, follow the complete example above and do not use options arrays.",
+    "For create_interaction request_checkbox_confirmation, use payload {\"version\":1,\"prompt\":\"Select approved items\",\"options\":[{\"id\":\"option_key\",\"label\":\"Option label\"}],\"minSelected\":1,\"maxSelected\":2,\"acceptLabel\":\"确认\",\"rejectLabel\":\"调整\",\"target\":{\"type\":\"custom\",\"key\":\"approved-items\",\"label\":\"待批准项目\",\"revisionId\":\"v1\"}}.",
     "For create_interaction suggest_tasks, use payload {\"version\":1,\"tasks\":[{\"clientKey\":\"task_key\",\"title\":\"Task title\",\"description\":\"Task description\",\"priority\":\"medium\"}]}.",
+    "When a suggested task should start automatically after acceptance, set assigneeAgentId to an agent id from the current task context. Set assigneeUserId only when a known user must own the task. Omit both assignee fields only when the accepted task should remain intentionally unassigned in backlog. Never substitute a role name for an assignee id.",
+    "An external input or human approval cannot exist only as free-text owner/next-step prose. Create a human-owned create_child_task with assigneeUserId and blockParentUntilDone=true (or another explicit interaction/dependency path), then keep the parent blocked or in_review until it resolves.",
     "Do not copy placeholder names, placeholder summaries, placeholder action arrays, or placeholder paths. Every title, body, role, idempotencyKey, artifact path, and task description must be specific to the current issue and company.",
     "Only include upload_artifact for a file that you actually created in the execution workspace and whose path exists relative to cwd. If no file was created, omit upload_artifact.",
-    "For required deliverables, add top-level deliverables entries. Use {\"path\":\"relative/file\",\"required\":true}; for runnable outputs add verification {\"command\":\"node\",\"args\":[\"script.js\"],\"timeoutSeconds\":30,\"expectedExitCode\":0,\"expectedOutputs\":[\"result.json\"]}. Commands are argv-only, run without a shell, and must be allowed by the runtime verifier policy.",
+    "upload_artifact actions do not accept required. Artifact required belongs only to top-level deliverables entries, not action objects.",
+    "When a child artifact is promoted as a replacement for a parent artifact, run upload_artifact on the parent issue and include both sourceWorkProductId (the child artifact) and supersedesWorkProductId (the current parent artifact). Never claim the parent artifact was corrected without this durable lineage.",
+    "For derived artifacts, set evidenceRole=derived, sourceWorkProductIds to every consumed input work product, and scenarioKeys to the unchanged source scenario set. For post-implementation review artifacts, set evidenceRole=review and sourceWorkProductIds to the exact current artifacts reviewed; stale or missing sources fail closed.",
+    "When a child must consume current parent artifacts, set create_child_task.inputWorkProductIds to the exact parent work product UUIDs from task context. AMaster persists their attachment/SHA revision manifest and materializes only those required inputs under input-artifacts/. Do not assume parent attachments are implicitly copied into every child workspace.",
+    "When creating a review child that must run after sibling implementation or governance tasks, express that ordering with blockedByClientKeys in the same create_child_task batch. Do not start a post-implementation review as an independent sibling without dependencies.",
+    "For required deliverables, add top-level deliverables entries using {\"path\":\"relative/file\",\"required\":true}.",
+    "update_parent accepts only status, comment, and force. Never put deliverables, artifacts, interactions, blockers, or child-task fields inside update_parent; keep top-level deliverables beside actions and use their dedicated action objects.",
+    artifactVerifierCommands.length > 0
+      ? `Executable deliverable verification is enabled. Allowed verifier commands: ${artifactVerifierCommands.join(", ")}. For runnable outputs, add verification {\"command\":\"${artifactVerifierCommands[0]}\",\"args\":[\"script.js\"],\"timeoutSeconds\":30,\"expectedExitCode\":0,\"expectedOutputs\":[\"result.json\"]}. Commands are argv-only and run without a shell.`
+      : "Executable deliverable verification is disabled by runtime policy. Do not include verification blocks. Required deliverables are still checked for presence and upload completeness.",
     "Only include actions for the current PAPERCLIP_TASK_ID. Never include PAPERCLIP_API_KEY or any token in the JSON.",
   ].filter(Boolean).join("\n");
 }
@@ -3751,14 +3904,25 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
   const agentInstructions = renderAgentInstructionsBundle(asRecord(payload.agentInstructionsBundle));
   const runtimeAuth = commandRuntimeAuth(command);
   const hasRuntimeApi = Boolean(readString(runtimeAuth.apiUrl) && readString(runtimeAuth.apiKey));
-  const canOrchestrateOrganization = canRuntimeAgentOrchestrateOrganization(context);
+  const authorizationEnvelope = runtimeActionAuthorizationEnvelope(command);
+  const canOrchestrateOrganization = canRuntimeAgentOrchestrateOrganization(context)
+    && authorizationEnvelope.allowedActionClasses.has("organization_mutation");
+  const decompositionRequirement = commandLegacyTaskDecompositionRequirement(command);
+  const explicitDecompositionRequired = decompositionRequirement.required
+    && runtimeActionChildIssueSummaryEntries(command).length === 0;
   const executingAgent = asRecord(context.paperclipExecutingAgent);
   const currentAgentAdapterType = readString(executingAgent.adapterType);
+  const validatorContentTypes = runtimeAttachmentContentTypes(command);
+  // Built-in executors run on the connector host, so the prompt may reference these host paths.
+  // A custom wrapper may isolate model tools; until isolation is an explicit capability, this
+  // validator is same-host only and must fail visibly rather than fall back to a weaker check.
+  const actionValidatorCommand = `${quoteShell(process.execPath)} ${quoteShell(resolve(process.argv[1]))} validate-actions --file .amaster-runtime-actions.json --cwd . --allowed-content-types ${quoteShell(validatorContentTypes.join(","))}`;
   return [
     "## AMaster Runtime Connector Task",
     "",
     "You are executing a task dispatched by AMaster Employee from the central control plane.",
     "Work only inside the declared workspace. Make concrete progress and finish with a concise result summary.",
+    "Do not install operating-system or user-global packages, and do not use host package managers such as brew, apt, yum, or global pip/npm installs. Use tools already available or workspace-local dependencies or virtual environments. If a required renderer or evaluator is unavailable, keep the source artifact, record the exact verification gap, and do not mutate the host.",
     "",
     `- command id: ${command.commandId}`,
     `- run id: ${commandRunId(command) ?? "unknown"}`,
@@ -3766,13 +3930,22 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
     issueLine ? `- issue: ${issueLine}` : "",
     `- workspace: ${cwd}`,
     workspaceContext.managed ? `- source workspace: ${workspaceContext.sourceWorkspacePath}` : "",
-    workspaceContext.managed ? "Use the execution workspace as cwd. Do not run broad scans in the source workspace; only inspect specific source paths when the task requires it." : "",
+    workspaceContext.managed
+      ? "Use the execution workspace as cwd. Never recursively scan the source workspace, the user's home directory, or any path outside the execution workspace. Only inspect a specific external source path when the task explicitly requires that exact path."
+      : "",
     readString(context.wakeReason) ? `- wake reason: ${readString(context.wakeReason)}` : "",
     hasRuntimeApi
       ? "- AMaster API env: PAPERCLIP_API_URL, PAPERCLIP_API_KEY, AMASTER_BOARD_API_KEY, PAPERCLIP_RUN_ID, PAPERCLIP_TASK_ID, PAPERCLIP_AGENT_ID, PAPERCLIP_COMPANY_ID are available to update the task, create child tasks, and report progress. Treat API keys as secrets; never print them or include them in runtime actions."
       : "",
     "",
-    hasRuntimeApi ? runtimeActionsInstruction({ canOrchestrateOrganization, currentAgentAdapterType }) : "",
+    hasRuntimeApi ? runtimeActionsInstruction({
+      canOrchestrateOrganization,
+      currentAgentAdapterType,
+      explicitDecompositionRequired,
+      artifactVerifierCommands: options.artifactVerifierCommands,
+      actionValidatorCommand,
+      authorizationEnvelope,
+    }) : "",
     "",
     agentInstructions,
     "",
@@ -5183,9 +5356,10 @@ function extractRuntimeActionEnvelope(text) {
   const structuredEnvelope = tryExtractStructuredRuntimeActionEnvelope(text);
   if (structuredEnvelope) return structuredEnvelope;
 
-  const markerIndex = text.indexOf("AMASTER_RUNTIME_ACTIONS");
-  if (markerIndex === -1) return null;
-  const jsonStart = text.indexOf("{", markerIndex);
+  const markerMatch = /^[ \t]*AMASTER_RUNTIME_ACTIONS[ \t]*$/m.exec(text);
+  if (!markerMatch) return null;
+  const markerEnd = markerMatch.index + markerMatch[0].length;
+  const jsonStart = text.indexOf("{", markerEnd);
   if (jsonStart === -1) {
     const err = new Error("AMASTER_RUNTIME_ACTIONS JSON could not be parsed: missing JSON object");
     err.runtimeActionType = "parse";
@@ -5204,7 +5378,9 @@ function extractRuntimeActionEnvelope(text) {
 
 function tryExtractStructuredRuntimeActionEnvelope(text) {
   const source = String(text ?? "");
-  const markerRe = /(^|\r?\n)[ \t]*AMASTER_RUNTIME_ACTIONS\b/g;
+  // Completion detection is permissive about fenced JSON, but the protocol
+  // marker itself must still be the only content on its line.
+  const markerRe = /(^|\r?\n)[ \t]*AMASTER_RUNTIME_ACTIONS[ \t]*(?:\r?\n|$)/g;
   let match;
   while ((match = markerRe.exec(source)) !== null) {
     let cursor = markerRe.lastIndex;
@@ -5244,6 +5420,15 @@ function parseRuntimeActionEnvelopeJson(jsonText) {
   }
 }
 
+function hasMalformedRuntimeActionMarkerIntent(text) {
+  const value = String(text ?? "");
+  if (!value.includes("AMASTER_RUNTIME_ACTIONS")) return false;
+  const hasNonCanonicalMarkerLine = value
+    .split(/\r?\n/)
+    .some((line) => line.includes("AMASTER_RUNTIME_ACTIONS") && line.trim() !== "AMASTER_RUNTIME_ACTIONS");
+  return hasNonCanonicalMarkerLine && /["']actions["']\s*:/.test(value);
+}
+
 function readBoundedActionString(record, key, maxChars) {
   const value = readString(record[key]);
   return value ? truncateText(value, maxChars) : null;
@@ -5607,6 +5792,97 @@ async function materializeIssueAttachments(config, command, workspace) {
   return materialized;
 }
 
+function safeArtifactInputSourceDir(entry, index) {
+  const raw = readString(entry.sourceIssueIdentifier) ?? readString(entry.sourceIssueId) ?? `source-${index + 1}`;
+  const safe = raw.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^\.+|\.+$/g, "").slice(0, 120);
+  return safe && safe !== "." && safe !== ".." ? safe : `source-${index + 1}`;
+}
+
+async function materializeRequiredArtifactInputs(config, command, workspace) {
+  const runtimeAuth = commandRuntimeAuth(command);
+  if (!readString(runtimeAuth.apiUrl) || !readString(runtimeAuth.apiKey)) return [];
+  const context = asRecord(asRecord(command.payload).contextSnapshot);
+  const issue = asRecord(context.paperclipIssue);
+  const manifest = asRecord(issue.artifactInputManifest);
+  if (Object.keys(manifest).length === 0) return [];
+  if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
+    throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
+  }
+
+  const targetRoot = join(workspace.cwd, "input-artifacts");
+  rmSync(targetRoot, { recursive: true, force: true });
+  mkdirSync(targetRoot, { recursive: true });
+  const usedPaths = new Set();
+  const materialized = [];
+  for (const [index, rawEntry] of manifest.entries.entries()) {
+    const entry = asRecord(rawEntry);
+    const workProductId = readString(entry.workProductId);
+    const attachmentId = readString(entry.attachmentId);
+    const sha256 = readString(entry.sha256);
+    const contentPath = readString(entry.contentPath);
+    const byteSize = readNumber(entry.byteSize, null);
+    if (!workProductId || !attachmentId || !/^[a-f0-9]{64}$/i.test(sha256 ?? "") || !contentPath || byteSize === null) {
+      throw new Error(`artifact_input_manifest_invalid: entry ${index} is incomplete`);
+    }
+    const expectedContentPath = `/api/attachments/${attachmentId}/content`;
+    if (contentPath !== expectedContentPath) {
+      throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
+    }
+    const body = await runtimeApiBuffer(runtimeAuth, contentPath);
+    const actualSha256 = createHash("sha256").update(body).digest("hex");
+    if (body.byteLength !== byteSize || actualSha256 !== sha256) {
+      throw new Error(
+        `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha256} actualSha256=${actualSha256}`,
+      );
+    }
+
+    const sourceDir = safeArtifactInputSourceDir(entry, index);
+    let filename = safeMaterializedAttachmentFilename({
+      id: attachmentId,
+      originalFilename: readString(entry.originalFilename),
+    }, index);
+    let relativePath = join("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    if (usedPaths.has(relativePath)) {
+      const ext = extname(filename);
+      const stem = ext ? filename.slice(0, -ext.length) : filename;
+      filename = `${stem}-${index + 1}${ext}`;
+      relativePath = join("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    }
+    usedPaths.add(relativePath);
+    const targetPath = join(workspace.cwd, relativePath);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    writeFileSync(targetPath, body);
+    chmodSync(targetPath, 0o444);
+    materialized.push({
+      id: attachmentId,
+      workProductId,
+      sourceIssueId: readString(entry.sourceIssueId),
+      sourceIssueIdentifier: readString(entry.sourceIssueIdentifier),
+      name: readString(entry.originalFilename) ?? filename,
+      path: targetPath,
+      relativePath,
+      contentType: readString(entry.contentType),
+      byteSize: body.byteLength,
+      sha256,
+      contentPath,
+    });
+  }
+
+  const localManifest = {
+    version: 1,
+    entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath })),
+  };
+  const manifestPath = join(targetRoot, "artifact-input-manifest.json");
+  writeFileSync(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  chmodSync(manifestPath, 0o444);
+  updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
+  await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
+    artifactInputCount: materialized.length,
+    artifactInputs: localManifest.entries,
+  });
+  return materialized;
+}
+
 function issueCheckpointDir(workspace) {
   return join(dirname(workspace.runDir), "checkpoint");
 }
@@ -5906,7 +6182,14 @@ function runtimeChildActionFingerprint(action, issueId, parentIssueId) {
     title,
     status: readActionStatus(action.status) ?? null,
     priority: readActionPriority(action.priority) ?? null,
+    blockParentUntilDone: action.blockParentUntilDone === true || readActionStatus(action.status) === "blocked",
     parentClientKey: readString(action.parentClientKey) ?? null,
+    inputWorkProductIds: Array.isArray(action.inputWorkProductIds)
+      ? action.inputWorkProductIds.map(readString).filter(Boolean).sort()
+      : [],
+    blockedByClientKeys: Array.isArray(action.blockedByClientKeys)
+      ? action.blockedByClientKeys.map(readString).filter(Boolean).sort()
+      : [],
   })}`;
 }
 
@@ -5924,6 +6207,9 @@ function runtimeAgentHireActionFingerprint(action, companyId, issueId, body) {
     adapterType: readString(body.adapterType) ?? null,
     sourceIssueId: readString(body.sourceIssueId) ?? null,
     sourceIssueIds: runtimeActionIssueIdList(body.sourceIssueIds).sort(),
+    reportsTo: readString(body.reportsTo) ?? null,
+    reportsToAgentClientKey: readString(action.reportsToAgentClientKey) ?? null,
+    topLevel: action.topLevel === true,
   })}`;
 }
 
@@ -5971,21 +6257,6 @@ function runtimeActionDoneNeedsExternalHuman(action, actionContext) {
   ].some((pattern) => pattern.test(normalized));
 }
 
-function runtimeActionExternalHumanPatch(comment) {
-  const owner = "人工负责人";
-  const action = "补充或授权外部输入后再继续；涉及个人信息、付款、报名提交或审批时由人工处理";
-  const guard = [
-    "AMaster 已检测到本次运行仍依赖人工授权或外部输入，任务已转为 blocked / external_owner_action。本次运行不会自动发送飞书消息；请通过人工协作或已配置的飞书 CLI 通知对应负责人处理，收到明确授权后再继续。",
-    "",
-    `external owner: ${owner}`,
-    `external action: ${action}`,
-  ].join("\n");
-  return {
-    status: "blocked",
-    comment: comment ? `${comment}\n\n${guard}` : guard,
-  };
-}
-
 function runtimeActionReviewConfirmation(action, runtimeAuth, command, actionContext, opts = {}) {
   const runId = runtimeActionRunId(runtimeAuth) ?? commandRunId(command) ?? "unknown-run";
   const comment = readBoundedActionString(action, "comment", 20_000)
@@ -6030,8 +6301,13 @@ function runtimeActionReviewConfirmation(action, runtimeAuth, command, actionCon
     payload: {
       version: 1,
       prompt: copy.prompt,
-      acceptLabel: "确认，继续推进",
-      rejectLabel: "需要修订",
+      resolutionMode: "review",
+      acceptLabel: "接受并继续",
+      requestChangesLabel: "退回修改",
+      requestChangesReasonLabel: "说明需要补充或修改的内容",
+      rejectLabel: "拒绝并停止",
+      rejectRequiresReason: true,
+      rejectReasonLabel: "说明停止该任务的原因",
       detailsMarkdown,
       target: {
         type: "custom",
@@ -6091,7 +6367,7 @@ function runtimeActionAcceptedConfirmationContinuation(command) {
   if (context.acceptedConfirmationContinuation === true) return true;
   if (readString(context.wakeReason) === "request_confirmation_accepted") return true;
   if (
-    readString(context.interactionKind) === "request_confirmation" &&
+    ["request_confirmation", "request_checkbox_confirmation"].includes(readString(context.interactionKind) ?? "") &&
     readString(context.interactionStatus) === "accepted"
   ) {
     return true;
@@ -6100,7 +6376,7 @@ function runtimeActionAcceptedConfirmationContinuation(command) {
   const interactions = Array.isArray(wake.interactions) ? wake.interactions : [];
   return interactions.some((entry) => {
     const interaction = asRecord(entry);
-    return readString(interaction.kind) === "request_confirmation" &&
+    return ["request_confirmation", "request_checkbox_confirmation"].includes(readString(interaction.kind) ?? "") &&
       readString(interaction.status) === "accepted";
   });
 }
@@ -6130,6 +6406,31 @@ function runtimeActionContinuationScope(command) {
   return ["revision_only", "interaction_accepted", "message_only"].includes(scope ?? "") ? scope : null;
 }
 
+function runtimeActionAuthorizationEnvelope(command) {
+  const payload = asRecord(command.payload);
+  const context = asRecord(payload.contextSnapshot);
+  const rawEnvelope = asRecord(context.authorizationEnvelope);
+  const allowedActionClasses = Array.isArray(rawEnvelope.allowedActionClasses)
+    ? rawEnvelope.allowedActionClasses.map(readString).filter(Boolean)
+    : [];
+  const effectiveAllowedActionClasses = allowedActionClasses.length > 0
+    ? allowedActionClasses
+    : ["task_governance"];
+  const rawAuthorizationOptionIds = asRecord(rawEnvelope.authorizationOptionIds);
+  const authorizationOptionIds = new Map(
+    ["task_governance", "organization_mutation", "executable_child"]
+      .map((actionClass) => [actionClass, readString(rawAuthorizationOptionIds[actionClass])])
+      .filter(([, optionId]) => optionId),
+  );
+  return {
+    allowedActionClasses: new Set(effectiveAllowedActionClasses),
+    authorizationOptionIds,
+    sourceKind: readString(rawEnvelope.sourceKind) ?? "implicit_default",
+    sourceId: readString(rawEnvelope.sourceId) ?? commandRunId(command),
+    sourceRevision: readString(rawEnvelope.sourceRevision) ?? "missing_envelope",
+  };
+}
+
 function runtimeActionInReviewNeedsFollowUpText(text) {
   const normalized = String(text ?? "")
     .replace(/\s+/g, "")
@@ -6292,6 +6593,35 @@ function runtimeActionParentIssueId(action, actionContext, fallbackIssueId) {
   return parentIssueId;
 }
 
+function runtimeActionReportsToAgentId(action, actionContext) {
+  const reportsToAgentClientKey = readString(action.reportsToAgentClientKey);
+  if (!reportsToAgentClientKey) return readString(action.reportsTo);
+  const reportsTo = actionContext.agentIdByClientKey.get(reportsToAgentClientKey);
+  if (!reportsTo) {
+    throw new Error(`agent_hire action references unknown reportsToAgentClientKey: ${reportsToAgentClientKey}`);
+  }
+  return reportsTo;
+}
+
+function runtimeActionBlockedByIssueIds(action, actionContext) {
+  const explicitIssueIds = Array.isArray(action.blockedByIssueIds)
+    ? action.blockedByIssueIds.map((rawIssueId) => readString(rawIssueId)).filter(Boolean)
+    : [];
+  if (action.blockedByClientKeys === undefined) return [...new Set(explicitIssueIds)];
+  const clientKeyIssueIds = action.blockedByClientKeys.map((rawClientKey, index) => {
+    const clientKey = readString(rawClientKey);
+    if (!clientKey) {
+      throw runtimeActionValidationError(`create_child_task blockedByClientKeys[${index}] must be a non-empty string`);
+    }
+    const blockerIssueId = actionContext.issueIdByClientKey.get(clientKey);
+    if (!blockerIssueId) {
+      throw new Error(`create_child_task action references unknown blockedByClientKeys entry: ${clientKey}`);
+    }
+    return blockerIssueId;
+  });
+  return [...new Set([...explicitIssueIds, ...clientKeyIssueIds])];
+}
+
 const RUNTIME_EXECUTOR_ADAPTER_TYPE_ALIASES = new Map([
   ["pi", "pi_local"],
   ["pi_local", "pi_local"],
@@ -6513,9 +6843,14 @@ function normalizeRequestConfirmationPayload(payload, action) {
   return {
     version: normalized.version === 1 ? normalized.version : 1,
     prompt,
+    ...(readString(normalized.resolutionMode) === "review" ? { resolutionMode: "review" } : {}),
     ...(readString(normalized.acceptLabel) ?? readString(action.acceptLabel)
       ? { acceptLabel: readString(normalized.acceptLabel) ?? readString(action.acceptLabel) }
       : {}),
+    ...(readString(normalized.requestChangesLabel) ? { requestChangesLabel: readString(normalized.requestChangesLabel) } : {}),
+    ...(readString(normalized.requestChangesReasonLabel)
+      ? { requestChangesReasonLabel: readString(normalized.requestChangesReasonLabel) }
+      : {}),
     ...(readString(normalized.rejectLabel) ?? readString(action.rejectLabel)
       ? { rejectLabel: readString(normalized.rejectLabel) ?? readString(action.rejectLabel) }
       : {}),
@@ -6734,6 +7069,245 @@ function assertRuntimeActionValid(condition, message) {
   if (!condition) throw runtimeActionValidationError(message);
 }
 
+const RUNTIME_ACTION_COMMON_FIELDS = new Set(["type", "action", "name", "payload"]);
+const RUNTIME_ACTION_ALLOWED_FIELDS = new Map([
+  ["create_child_task", new Set([
+    "title", "description", "status", "priority", "assigneeAgentId", "assigneeUserId",
+    "assigneeAgentClientKey", "agentClientKey", "blockParentUntilDone", "executeBeforeConfirmation",
+    "clientKey", "idempotencyKey", "parentClientKey", "blockedByIssueIds", "blockedByClientKeys", "create_child_task",
+    "inputWorkProductIds",
+  ])],
+  ["agent_hire", new Set([
+    "clientKey", "idempotencyKey", "key", "companyId", "role", "title", "icon", "reportsTo",
+    "reportsToAgentClientKey", "topLevel", "capabilities", "desiredSkills", "adapterType", "adapterConfig",
+    "instructionsBundle", "runtimeConfig", "defaultEnvironmentId", "budgetMonthlyCents", "permissions",
+    "metadata", "sourceIssueId", "sourceIssueIds", "executeBeforeConfirmation", "agent_hire", "agent_hire/create_agent",
+  ])],
+  ["create_agent", new Set([
+    "clientKey", "idempotencyKey", "key", "companyId", "role", "title", "icon", "reportsTo",
+    "reportsToAgentClientKey", "topLevel", "capabilities", "desiredSkills", "adapterType", "adapterConfig",
+    "instructionsBundle", "runtimeConfig", "defaultEnvironmentId", "budgetMonthlyCents", "permissions",
+    "metadata", "sourceIssueId", "sourceIssueIds", "executeBeforeConfirmation", "create_agent",
+  ])],
+  ["add_comment", new Set(["body", "content", "text", "message", "add_comment"])],
+  ["upload_artifact", new Set([
+    "path", "filePath", "artifactPath", "artifact_path", "title", "summary", "contentType",
+    "createWorkProduct", "provider", "status", "reviewState", "isPrimary", "healthStatus",
+    "sourceWorkProductId", "sourceWorkProductIds", "supersedesWorkProductId", "evidenceRole", "scenarioKeys",
+    "idempotencyKey", "upload_artifact",
+  ])],
+  ["upsert_document", new Set([
+    "key", "title", "body", "format", "changeSummary", "baseRevisionId", "upsert_document",
+  ])],
+  ["create_interaction", new Set([
+    "kind", "continuationPolicy", "title", "summary", "idempotencyKey", "interaction", "version",
+    "prompt", "question", "body", "content", "text", "message", "description", "acceptLabel",
+    "requestChangesLabel", "requestChangesReasonLabel", "rejectLabel", "rejectRequiresReason",
+    "rejectReasonLabel", "allowDeclineReason", "declineReasonPlaceholder", "detailsMarkdown",
+    "supersedeOnUserComment", "target", "artifactRefs", "tasks", "options", "defaultSelectedOptionIds",
+    "minSelected", "maxSelected", "questions", "submitLabel", "selectionMode", "required", "helpText",
+    "create_interaction",
+  ])],
+  ["update_parent", new Set(["status", "comment", "force", "update_parent"])],
+  ["update_company_profile", new Set([
+    "companyId", "tagline", "stage", "targetCustomers", "products", "currentPriority", "businessModel",
+    "regions", "brandTone", "markAutoDerived", "idempotencyKey", "update_company_profile",
+  ])],
+  ["create_routine", new Set([
+    "companyId", "title", "description", "cronExpression", "priority", "concurrencyPolicy", "catchUpPolicy",
+    "assigneeAgentId", "timezone", "idempotencyKey", "create_routine",
+  ])],
+]);
+
+function runtimeActionReceivedType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+
+function assertNoUnsupportedRuntimeActionFields(action, actionIndex) {
+  const type = readRuntimeActionType(action);
+  const allowed = RUNTIME_ACTION_ALLOWED_FIELDS.get(type);
+  assertRuntimeActionValid(allowed, `unsupported AMaster runtime action type: ${type ?? "missing"}`);
+  const fields = runtimeActionBusinessFields(action);
+  for (const [field, value] of Object.entries(fields)) {
+    if (type === "create_interaction" && field === "interactionType") continue;
+    if (RUNTIME_ACTION_COMMON_FIELDS.has(field) || allowed.has(field)) continue;
+    const fieldPath = `actions[${actionIndex}].${field}`;
+    const receivedType = runtimeActionReceivedType(value);
+    const managerFieldHint = ["agent_hire", "create_agent"].includes(type ?? "") && field === "reportsToAgentId"
+      ? "; reportsToAgentId is unsupported; use reportsTo for an existing manager UUID or reportsToAgentClientKey for a manager hired in the same batch"
+      : "";
+    const err = runtimeActionValidationError(
+      `${type} action has unsupported field ${field} at ${fieldPath}; received ${receivedType}${managerFieldHint}`,
+    );
+    err.runtimeActionFieldPath = fieldPath;
+    err.runtimeActionReceivedType = receivedType;
+    throw err;
+  }
+}
+
+const RUNTIME_ACTION_BOOLEAN_FIELDS = new Set([
+  "blockParentUntilDone", "executeBeforeConfirmation", "createWorkProduct", "isPrimary",
+  "force", "markAutoDerived", "rejectRequiresReason", "allowDeclineReason", "supersedeOnUserComment",
+  "required", "topLevel",
+]);
+const RUNTIME_ACTION_NUMBER_FIELDS = new Set(["budgetMonthlyCents", "minSelected", "maxSelected", "version"]);
+const RUNTIME_ACTION_ARRAY_FIELDS = new Set([
+  "blockedByIssueIds", "blockedByClientKeys", "desiredSkills", "sourceIssueIds", "artifactRefs", "tasks",
+  "options", "defaultSelectedOptionIds", "questions", "sourceWorkProductIds", "scenarioKeys",
+  "inputWorkProductIds",
+]);
+const RUNTIME_ACTION_OBJECT_FIELDS = new Set([
+  "adapterConfig", "instructionsBundle", "runtimeConfig", "permissions", "metadata", "target",
+  "interaction",
+]);
+
+function assertRuntimeActionFieldTypes(action, actionIndex) {
+  const fields = runtimeActionBusinessFields(action);
+  const type = readRuntimeActionType(fields) ?? "unknown";
+  for (const [field, value] of Object.entries(fields)) {
+    if (value === undefined) continue;
+    if (SINGLE_KEY_RUNTIME_ACTION_TYPES.has(field)) continue;
+    if (type === "create_interaction" && field === "payload") continue;
+    let expectedType = null;
+    let valid = true;
+    if (RUNTIME_ACTION_BOOLEAN_FIELDS.has(field)) {
+      expectedType = "boolean";
+      valid = typeof value === "boolean";
+    } else if (RUNTIME_ACTION_NUMBER_FIELDS.has(field)) {
+      expectedType = "number";
+      valid = typeof value === "number" && Number.isFinite(value);
+    } else if (RUNTIME_ACTION_ARRAY_FIELDS.has(field)) {
+      expectedType = "array";
+      valid = Array.isArray(value);
+    } else if (field === "capabilities") {
+      expectedType = "string or array";
+      valid = typeof value === "string" || Array.isArray(value);
+    } else if (RUNTIME_ACTION_OBJECT_FIELDS.has(field) || field === "payload") {
+      expectedType = "object";
+      valid = value !== null && typeof value === "object" && !Array.isArray(value);
+    } else if (!RUNTIME_ACTION_COMMON_FIELDS.has(field) && value !== null) {
+      expectedType = "string";
+      valid = typeof value === "string";
+    }
+    if (valid || !expectedType) continue;
+    const fieldPath = `actions[${actionIndex}].${field}`;
+    const err = runtimeActionValidationError(
+      `${type} action field ${fieldPath} must be ${expectedType}; received ${runtimeActionReceivedType(value)}`,
+    );
+    err.runtimeActionFieldPath = fieldPath;
+    err.runtimeActionReceivedType = runtimeActionReceivedType(value);
+    throw err;
+  }
+}
+
+function runtimeActionClientKeyProducerKind(type) {
+  if (["agent_hire", "create_agent"].includes(type ?? "")) return "agent";
+  if (type === "create_child_task") return "issue";
+  return null;
+}
+
+function runtimeActionClientKeyReferences(fields) {
+  const type = readRuntimeActionType(fields);
+  const references = [];
+  if (["agent_hire", "create_agent"].includes(type ?? "")) {
+    const clientKey = readString(fields.reportsToAgentClientKey);
+    if (clientKey) references.push({ clientKey, expectedKind: "agent", field: "reportsToAgentClientKey" });
+  }
+  if (type === "create_child_task") {
+    const assigneeClientKey = readString(fields.assigneeAgentClientKey) ?? readString(fields.agentClientKey);
+    if (assigneeClientKey) references.push({ clientKey: assigneeClientKey, expectedKind: "agent", field: "assigneeAgentClientKey" });
+    const parentClientKey = readString(fields.parentClientKey);
+    if (parentClientKey) references.push({ clientKey: parentClientKey, expectedKind: "issue", field: "parentClientKey" });
+    if (fields.blockedByClientKeys !== undefined) {
+      assertRuntimeActionValid(Array.isArray(fields.blockedByClientKeys), "create_child_task blockedByClientKeys must be an array");
+      for (const [index, value] of fields.blockedByClientKeys.entries()) {
+        const clientKey = readString(value);
+        assertRuntimeActionValid(clientKey, `create_child_task blockedByClientKeys[${index}] must be a non-empty string`);
+        references.push({ clientKey, expectedKind: "issue", field: `blockedByClientKeys[${index}]` });
+      }
+    }
+  }
+  return references;
+}
+
+function throwRuntimeActionGraphValidation(message, action, actionIndex, fieldPath) {
+  const err = runtimeActionValidationError(message);
+  err.runtimeActionType = readRuntimeActionType(action) ?? "unknown";
+  err.runtimeActionOriginalType = readRuntimeActionOriginalType(action);
+  err.runtimeActionFieldPath = fieldPath ?? `actions[${actionIndex}]`;
+  throw err;
+}
+
+function orderRuntimeActionsByClientKeyDependencies(actions) {
+  const producers = new Map();
+  for (const [index, action] of actions.entries()) {
+    const fields = runtimeActionBusinessFields(action);
+    const type = readRuntimeActionType(fields);
+    const kind = runtimeActionClientKeyProducerKind(type);
+    const clientKey = readString(fields.clientKey);
+    if (!clientKey || !kind) continue;
+    if (producers.has(clientKey)) {
+      throwRuntimeActionGraphValidation(
+        `runtime action clientKey must be unique: ${clientKey}`,
+        action,
+        index,
+        `actions[${index}].clientKey`,
+      );
+    }
+    producers.set(clientKey, { index, kind, type });
+  }
+
+  const dependenciesByIndex = actions.map(() => new Set());
+  const dependentsByIndex = actions.map(() => new Set());
+  for (const [index, action] of actions.entries()) {
+    const fields = runtimeActionBusinessFields(action);
+    for (const reference of runtimeActionClientKeyReferences(fields)) {
+      const producer = producers.get(reference.clientKey);
+      if (!producer) {
+        throwRuntimeActionGraphValidation(
+          `${readRuntimeActionType(fields)} action references unknown ${reference.field}: ${reference.clientKey}`,
+          action,
+          index,
+          `actions[${index}].${reference.field}`,
+        );
+      }
+      if (producer.kind !== reference.expectedKind) {
+        throwRuntimeActionGraphValidation(
+          `${readRuntimeActionType(fields)} action ${reference.field} must reference a ${reference.expectedKind} clientKey: ${reference.clientKey}`,
+          action,
+          index,
+          `actions[${index}].${reference.field}`,
+        );
+      }
+      dependenciesByIndex[index].add(producer.index);
+      dependentsByIndex[producer.index].add(index);
+    }
+  }
+
+  const ready = actions.map((_, index) => index).filter((index) => dependenciesByIndex[index].size === 0);
+  const orderedIndexes = [];
+  while (ready.length > 0) {
+    ready.sort((left, right) => left - right);
+    const index = ready.shift();
+    orderedIndexes.push(index);
+    for (const dependentIndex of dependentsByIndex[index]) {
+      dependenciesByIndex[dependentIndex].delete(index);
+      if (dependenciesByIndex[dependentIndex].size === 0) ready.push(dependentIndex);
+    }
+  }
+  if (orderedIndexes.length !== actions.length) {
+    const cycleIndex = dependenciesByIndex.findIndex((dependencies) => dependencies.size > 0);
+    throwRuntimeActionGraphValidation(
+      "runtime action clientKey dependency graph contains a cycle",
+      actions[cycleIndex],
+      cycleIndex,
+    );
+  }
+  return orderedIndexes.map((index) => actions[index]);
+}
+
 function assertRuntimeInteractionOptions(options, path) {
   assertRuntimeActionValid(Array.isArray(options) && options.length > 0 && options.length <= 10, `${path} requires 1-10 options`);
   const ids = new Set();
@@ -6811,6 +7385,16 @@ function willRuntimeActionCreateRootBlockingChild(action) {
   return fields.blockParentUntilDone === true || childStatus === "blocked";
 }
 
+function willRuntimeActionCreateHumanOwnedInputPath(action) {
+  const fields = runtimeActionBusinessFields(action);
+  if (readRuntimeActionType(fields) !== "create_child_task") return false;
+  const childStatus = readActionStatus(fields.status) ?? "todo";
+  return Boolean(
+    readString(fields.assigneeUserId) &&
+    (fields.blockParentUntilDone === true || childStatus === "blocked"),
+  );
+}
+
 function willRuntimeActionCreatePendingInteraction(action) {
   const fields = runtimeActionBusinessFields(action);
   if (readRuntimeActionType(fields) !== "create_interaction") return false;
@@ -6826,8 +7410,22 @@ function runtimeActionIsAmbiguousApprovalGatedChild(action) {
   return childStatus !== "backlog";
 }
 
-function assertNoAmbiguousApprovalGatedChildren(actions) {
+function assertNoAmbiguousApprovalGatedSideEffects(actions) {
   if (!actions.some(willRuntimeActionCreatePendingInteraction)) return;
+  const ambiguousHire = actions.find((action) => {
+    const fields = runtimeActionBusinessFields(action);
+    return ["agent_hire", "create_agent"].includes(readRuntimeActionType(fields) ?? "") &&
+      fields.executeBeforeConfirmation !== true;
+  });
+  if (ambiguousHire) {
+    const error = runtimeActionValidationError(
+      "approval-gated agent hire actions require the native hire approval only, a separate proposal interaction, or executeBeforeConfirmation true",
+    );
+    error.runtimeActionType = readRuntimeActionType(ambiguousHire) ?? "agent_hire";
+    error.runtimeActionOriginalType = readRuntimeActionOriginalType(ambiguousHire);
+    error.runtimeActionReason = error.message;
+    throw error;
+  }
   const ambiguousChild = actions.find(runtimeActionIsAmbiguousApprovalGatedChild);
   if (!ambiguousChild) return;
   const error = new Error(
@@ -6839,6 +7437,50 @@ function assertNoAmbiguousApprovalGatedChildren(actions) {
   throw error;
 }
 
+function assertDelegatedParentWaitDisposition(actions) {
+  const closesIndependentParentScope = actions.some((action) => {
+    const fields = runtimeActionBusinessFields(action);
+    if (readRuntimeActionType(fields) !== "update_parent") return false;
+    return ["done", "cancelled"].includes(readActionStatus(fields.status) ?? "");
+  });
+  for (const [actionIndex, action] of actions.entries()) {
+    const fields = runtimeActionBusinessFields(action);
+    if (readRuntimeActionType(fields) !== "create_child_task") continue;
+    if (readString(fields.parentClientKey)) continue;
+    const status = readActionStatus(fields.status) ?? "todo";
+    if (!["todo", "in_progress"].includes(status)) continue;
+    if (fields.blockParentUntilDone === true || closesIndependentParentScope) continue;
+    const err = runtimeActionValidationError(
+      "delegated_parent_wait_required: root executable child tasks require blockParentUntilDone true, or the same batch must close the parent's independent scope with update_parent done/cancelled",
+    );
+    err.runtimeActionType = "create_child_task";
+    err.runtimeActionFieldPath = `actions[${actionIndex}].blockParentUntilDone`;
+    err.runtimeActionReason = err.message;
+    throw err;
+  }
+}
+
+function assertExplicitTaskDecomposition(command, actions) {
+  const requirement = commandLegacyTaskDecompositionRequirement(command);
+  if (!requirement.required) return;
+  if (runtimeActionChildIssueSummaryEntries(command).length > 0) return;
+  const hasDecompositionAction = actions.some((action) => {
+    const fields = runtimeActionBusinessFields(action);
+    const type = readRuntimeActionType(fields);
+    return type === "create_child_task"
+      || (type === "create_interaction" && inferCreateInteractionKind(fields) === "suggest_tasks");
+  });
+  if (hasDecompositionAction) return;
+  const error = new Error(
+    "task explicitly requires child task decomposition under the legacy text hard gate; emit create_child_task or suggest_tasks instead of only describing a checklist",
+  );
+  error.runtimeActionType = "decomposition";
+  error.runtimeActionReason = error.message;
+  error.runtimeActionDecompositionRequirementSource = requirement.source;
+  error.runtimeActionDecompositionMatch = requirement.match;
+  throw error;
+}
+
 function assertRuntimeActionsAllowedByContinuationScope(actions, scope) {
   if (scope === "message_only" && actions.length > 0) {
     const err = new Error("message_only continuation forbids runtime action mutations");
@@ -6861,9 +7503,64 @@ function assertRuntimeActionsAllowedByContinuationScope(actions, scope) {
   }
 }
 
-function preflightRuntimeAction(action, preflightContext) {
+function preflightRuntimeAction(action, preflightContext, actionIndex) {
   const type = readRuntimeActionType(action);
   const fields = runtimeActionBusinessFields(action);
+  assertNoUnsupportedRuntimeActionFields(action, actionIndex);
+  assertRuntimeActionFieldTypes(action, actionIndex);
+  if (type === "create_child_task") {
+    assertNoPlaceholderRuntimeActionText(fields, ["title", "description"]);
+    assertRuntimeActionValid(readBoundedActionString(fields, "title", 240), "create_child_task action requires title");
+    if (fields.status !== undefined) {
+      assertRuntimeActionValid(readActionStatus(fields.status), `create_child_task status is unsupported: ${String(fields.status)}`);
+    }
+    if (fields.priority !== undefined) {
+      assertRuntimeActionValid(readActionPriority(fields.priority), `create_child_task priority is unsupported: ${String(fields.priority)}`);
+    }
+    assertRuntimeActionValid(
+      !readString(fields.assigneeAgentId) || (!readString(fields.assigneeAgentClientKey) && !readString(fields.agentClientKey)),
+      "create_child_task action cannot combine assigneeAgentId with assigneeAgentClientKey/agentClientKey",
+    );
+    if (fields.blockedByIssueIds !== undefined) {
+      for (const [index, rawIssueId] of fields.blockedByIssueIds.entries()) {
+        const issueId = readString(rawIssueId);
+        assertRuntimeActionValid(
+          issueId && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(issueId),
+          `create_child_task blockedByIssueIds[${index}] must be a UUID`,
+        );
+      }
+    }
+    if (fields.inputWorkProductIds !== undefined) {
+      const seen = new Set();
+      for (const [index, rawWorkProductId] of fields.inputWorkProductIds.entries()) {
+        const workProductId = readString(rawWorkProductId);
+        assertRuntimeActionValid(
+          workProductId && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(workProductId),
+          `create_child_task inputWorkProductIds[${index}] must be a UUID`,
+        );
+        assertRuntimeActionValid(
+          !seen.has(workProductId),
+          `create_child_task inputWorkProductIds[${index}] duplicates ${workProductId}`,
+        );
+        seen.add(workProductId);
+      }
+    }
+    return;
+  }
+  if (["agent_hire", "create_agent"].includes(type ?? "")) {
+    assertNoPlaceholderRuntimeActionText(fields, ["name", "role", "title", "instructionsBundle"]);
+    assertRuntimeActionValid(readBoundedActionString(fields, "name", 240), `${type} action requires name`);
+    const reportingDispositionCount = [
+      Boolean(readString(fields.reportsTo)),
+      Boolean(readString(fields.reportsToAgentClientKey)),
+      fields.topLevel === true,
+    ].filter(Boolean).length;
+    assertRuntimeActionValid(
+      reportingDispositionCount === 1,
+      `${type} action requires exactly one of reportsTo, reportsToAgentClientKey, or topLevel true`,
+    );
+    return;
+  }
   if (type === "add_comment") {
     assertNoPlaceholderRuntimeActionText(fields, ["body", "content", "text", "message"]);
     const body = readBoundedActionString(fields, "body", 20_000)
@@ -6874,7 +7571,52 @@ function preflightRuntimeAction(action, preflightContext) {
     return;
   }
   if (type === "upload_artifact") {
+    assertNoPlaceholderRuntimeActionText(fields, ["path", "filePath", "artifactPath", "artifact_path", "title", "summary"]);
+    assertRuntimeActionValid(readRuntimeArtifactPath(fields), "upload_artifact action requires path");
+    const pathFields = ["path", "filePath", "artifactPath", "artifact_path"].filter((field) => readString(fields[field]));
+    assertRuntimeActionValid(pathFields.length === 1, "upload_artifact action requires exactly one path field");
+    const sourceWorkProductId = readString(fields.sourceWorkProductId);
+    const sourceWorkProductIds = Array.isArray(fields.sourceWorkProductIds)
+      ? fields.sourceWorkProductIds.map(readString).filter(Boolean)
+      : [];
+    const supersedesWorkProductId = readString(fields.supersedesWorkProductId);
+    assertRuntimeActionValid(
+      Boolean(sourceWorkProductId) === Boolean(supersedesWorkProductId),
+      "upload_artifact parent replacement requires both sourceWorkProductId and supersedesWorkProductId",
+    );
+    const evidenceRole = readString(fields.evidenceRole);
+    assertRuntimeActionValid(
+      !evidenceRole || ["source", "derived", "review"].includes(evidenceRole),
+      `upload_artifact evidenceRole is unsupported: ${String(fields.evidenceRole)}`,
+    );
+    assertRuntimeActionValid(
+      !["derived", "review"].includes(evidenceRole ?? "") || sourceWorkProductIds.length > 0 || Boolean(sourceWorkProductId),
+      `upload_artifact evidenceRole=${evidenceRole} requires sourceWorkProductIds`,
+    );
+    if (fields.sourceWorkProductIds !== undefined) {
+      assertRuntimeActionValid(Array.isArray(fields.sourceWorkProductIds), "upload_artifact sourceWorkProductIds must be an array");
+      assertRuntimeActionValid(sourceWorkProductIds.length === fields.sourceWorkProductIds.length, "upload_artifact sourceWorkProductIds must contain non-empty strings");
+    }
+    if (fields.scenarioKeys !== undefined) {
+      assertRuntimeActionValid(Array.isArray(fields.scenarioKeys), "upload_artifact scenarioKeys must be an array");
+      assertRuntimeActionValid(fields.scenarioKeys.map(readString).filter(Boolean).length === fields.scenarioKeys.length, "upload_artifact scenarioKeys must contain non-empty strings");
+    }
     assertRuntimeArtifactContentType(fields, preflightContext.allowedContentTypes);
+    resolveWorkspaceArtifactPath(fields, { cwd: preflightContext.cwd });
+    return;
+  }
+  if (type === "upsert_document") {
+    assertNoPlaceholderRuntimeActionText(fields, ["key", "title", "body", "changeSummary"]);
+    const key = readBoundedActionString(fields, "key", 64);
+    const body = readBoundedActionString(fields, "body", 524_288);
+    assertRuntimeActionValid(key && /^[a-z0-9][a-z0-9_-]*$/.test(key), "upsert_document key must use lowercase letters, numbers, _ or -");
+    assertRuntimeActionValid(body, "upsert_document action requires body");
+    assertRuntimeActionValid(fields.format === "markdown", "upsert_document format must be markdown");
+    const baseRevisionId = readString(fields.baseRevisionId);
+    assertRuntimeActionValid(
+      !baseRevisionId || /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(baseRevisionId),
+      "upsert_document baseRevisionId must be a UUID",
+    );
     return;
   }
   if (type === "create_interaction") {
@@ -6885,12 +7627,27 @@ function preflightRuntimeAction(action, preflightContext) {
       ["request_confirmation", "request_checkbox_confirmation", "ask_user_questions", "suggest_tasks"].includes(kind),
       `create_interaction action does not support kind: ${kind}`,
     );
+    assertRuntimeActionValid(
+      kind !== "ask_user_questions" || readString(fields.continuationPolicy) !== "wake_assignee_on_accept",
+      "ask_user_questions continuationPolicy cannot be wake_assignee_on_accept; use wake_assignee so answering the questions resumes the assignee",
+    );
     const payload = normalizeCreateInteractionPayload(fields, kind);
     assertRuntimeActionValid(
       Object.keys(payload).length > 0,
       `create_interaction.${kind} action requires payload; expected shape is available in runtimeActionDiagnostics.expectedShape`,
     );
     assertRuntimeCreateInteractionPayload(kind, payload);
+    const confirmationTarget = asRecord(payload.target);
+    if (
+      preflightContext.acceptedConfirmationContinuation &&
+      ["request_confirmation", "request_checkbox_confirmation"].includes(kind) &&
+      (!readString(confirmationTarget.type) || !readString(confirmationTarget.key))
+    ) {
+      assertRuntimeActionValid(
+        false,
+        "accepted_confirmation_decision_target_required: an accepted confirmation continuation requires payload.target.type and a non-empty payload.target.key so the server can identify the decision; use a new target revision for genuinely changed content or finish the accepted work",
+      );
+    }
     preflightContext.createdReviewPathForInReview = true;
     return;
   }
@@ -6899,6 +7656,20 @@ function preflightRuntimeAction(action, preflightContext) {
     const status = readActionStatus(fields.status);
     const comment = readBoundedActionString(fields, "comment", 20_000);
     assertRuntimeActionValid(status || comment, "update_parent action requires status or comment");
+    if (fields.status !== undefined) {
+      assertRuntimeActionValid(status, `update_parent status is unsupported: ${String(fields.status)}`);
+    }
+    if (
+      status === "done" &&
+      runtimeActionDoneNeedsExternalHuman(fields, preflightContext) &&
+      !preflightContext.createdHumanOwnedInputPath &&
+      fields.force !== true
+    ) {
+      assertRuntimeActionValid(
+        false,
+        "external_input_disposition_required: external input cannot be represented only by a free-text owner; create a human-owned blocking child task or another first-class external dependency path",
+      );
+    }
     if (
       status === "in_review" &&
       !preflightContext.createdReviewPathForInReview &&
@@ -6911,22 +7682,45 @@ function preflightRuntimeAction(action, preflightContext) {
     ) {
       preflightContext.createdReviewPathForInReview = true;
     }
+    return;
+  }
+  if (type === "update_company_profile") {
+    const profileFields = ["tagline", "stage", "targetCustomers", "products", "currentPriority", "businessModel", "regions", "brandTone"];
+    assertRuntimeActionValid(
+      profileFields.some((field) => fields[field] === null || readBoundedActionString(fields, field, 2000)),
+      "update_company_profile action requires at least one profile field",
+    );
+    return;
+  }
+  if (type === "create_routine") {
+    assertRuntimeActionValid(readBoundedActionString(fields, "title", 240), "create_routine action requires title");
+    assertRuntimeActionValid(readBoundedActionString(fields, "cronExpression", 120), "create_routine action requires cronExpression");
+    if (fields.priority !== undefined) {
+      assertRuntimeActionValid(readActionPriority(fields.priority), `create_routine priority is unsupported: ${String(fields.priority)}`);
+    }
   }
 }
 
 function preflightRuntimeActionBatch(actions, options = {}) {
-  assertRuntimeActionsAllowedByContinuationScope(actions, options.continuationScope);
-  assertNoAmbiguousApprovalGatedChildren(actions);
+  const actionIndexByObject = new Map(actions.map((action, index) => [action, index]));
+  assertDelegatedParentWaitDisposition(actions);
+  const orderedActions = orderRuntimeActionsByClientKeyDependencies(actions);
+  assertRuntimeActionsAllowedByContinuationScope(orderedActions, options.continuationScope);
+  assertNoAmbiguousApprovalGatedSideEffects(orderedActions);
   const preflightContext = {
     createdReviewPathForInReview: false,
     createdRootBlockingChildForInReview: false,
+    createdHumanOwnedInputPath: false,
     answeredQuestionContinuation: options.answeredQuestionContinuation === true,
+    acceptedConfirmationContinuation: options.acceptedConfirmationContinuation === true,
     allowedContentTypes: Array.isArray(options.allowedContentTypes) ? options.allowedContentTypes : [],
+    cwd: readString(options.cwd),
     finalCommentBodies: [],
   };
-  for (const action of actions) {
+  for (const action of orderedActions) {
+    const actionIndex = actionIndexByObject.get(action);
     try {
-      preflightRuntimeAction(action, preflightContext);
+      preflightRuntimeAction(action, preflightContext, actionIndex);
       const fields = runtimeActionBusinessFields(action);
       if (readRuntimeActionType(fields) === "add_comment") {
         const body = readBoundedActionString(fields, "body", 20_000)
@@ -6938,6 +7732,9 @@ function preflightRuntimeActionBatch(actions, options = {}) {
       if (willRuntimeActionCreateRootBlockingChild(action)) {
         preflightContext.createdRootBlockingChildForInReview = true;
       }
+      if (willRuntimeActionCreateHumanOwnedInputPath(action)) {
+        preflightContext.createdHumanOwnedInputPath = true;
+      }
       if (willRuntimeActionCreateReviewPath(action)) {
         preflightContext.createdReviewPathForInReview = true;
       }
@@ -6954,6 +7751,40 @@ function preflightRuntimeActionBatch(actions, options = {}) {
       throw err;
     }
   }
+  return orderedActions;
+}
+
+function runtimeActionAuthorizationClass(action) {
+  // Keep these high-risk route mappings aligned with server-side checks in
+  // routes/agents.ts (organization_mutation) and routes/issues.ts
+  // (executable_child). Unknown action types intentionally remain governance.
+  const fields = runtimeActionBusinessFields(action);
+  const type = readRuntimeActionType(fields);
+  if (["agent_hire", "create_agent"].includes(type ?? "")) return "organization_mutation";
+  if (
+    type === "create_child_task" &&
+    ["todo", "in_progress"].includes(readActionStatus(fields.status) ?? "todo")
+  ) return "executable_child";
+  return "task_governance";
+}
+
+function assertRuntimeActionsAllowedByAuthorizationEnvelope(actions, envelope) {
+  for (const [actionIndex, action] of actions.entries()) {
+    const requiredAuthorization = runtimeActionAuthorizationClass(action);
+    if (envelope.allowedActionClasses.has(requiredAuthorization)) continue;
+    const type = readRuntimeActionType(runtimeActionBusinessFields(action)) ?? "unknown";
+    const err = runtimeActionValidationError(
+      `${type} action at index ${actionIndex} requires authorization class ${requiredAuthorization}; ` +
+      `source ${envelope.sourceKind ?? "unknown"}:${envelope.sourceId ?? "unknown"} revision ${envelope.sourceRevision ?? "unknown"}`,
+    );
+    err.runtimeActionType = type;
+    err.runtimeActionFieldPath = `actions[${actionIndex}]`;
+    err.runtimeActionRequiredAuthorization = requiredAuthorization;
+    err.runtimeActionAuthorizationSourceKind = envelope.sourceKind;
+    err.runtimeActionAuthorizationSourceId = envelope.sourceId;
+    err.runtimeActionAuthorizationSourceRevision = envelope.sourceRevision;
+    throw err;
+  }
 }
 
 function normalizeRuntimeActionPlaceholderText(value) {
@@ -6984,6 +7815,7 @@ const SINGLE_KEY_RUNTIME_ACTION_TYPES = new Set([
   "create_child_task",
   "create_interaction",
   "create_routine",
+  "upsert_document",
   "update_company_profile",
   "update_parent",
   "upload_artifact",
@@ -7056,6 +7888,10 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
       priority: readActionPriority(fields.priority) ?? "medium",
       assigneeAgentId: runtimeChildAssigneeAgentId(fields, runtimeAuth, command, actionContext),
       assigneeUserId: readString(fields.assigneeUserId),
+      blockedByIssueIds: runtimeActionBlockedByIssueIds(fields, actionContext),
+      ...(Array.isArray(fields.inputWorkProductIds)
+        ? { inputWorkProductIds: fields.inputWorkProductIds.map(readString).filter(Boolean) }
+        : {}),
       blockParentUntilDone,
       originKind: "amaster_runtime_child_task",
       originId: issueId,
@@ -7066,6 +7902,23 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
       idempotencyKey: originFingerprint,
     });
     const createdIssueId = readString(asRecord(created).id);
+    const persistedAssigneeAgentId = readString(asRecord(created).assigneeAgentId);
+    if (body.assigneeAgentId && persistedAssigneeAgentId !== body.assigneeAgentId) {
+      throw new Error(
+        `runtime_action_postcondition_failed: child assignee mismatch; expected ${body.assigneeAgentId}, received ${persistedAssigneeAgentId ?? "missing"}`,
+      );
+    }
+    if (body.blockedByIssueIds.length > 0) {
+      const persistedBlockerIds = Array.isArray(asRecord(created).blockedBy)
+        ? asRecord(created).blockedBy.map((entry) => readString(asRecord(entry).id)).filter(Boolean)
+        : [];
+      const missingBlockerIds = body.blockedByIssueIds.filter((blockerId) => !persistedBlockerIds.includes(blockerId));
+      if (missingBlockerIds.length > 0) {
+        throw new Error(
+          `runtime_action_postcondition_failed: child blockers were not persisted: ${missingBlockerIds.join(", ")}`,
+        );
+      }
+    }
     const clientKey = runtimeActionResultKey(fields);
     if (createdIssueId) actionContext.createdChildIssueIdByFingerprint.set(duplicateKey, createdIssueId);
     if (createdIssueId && clientKey) actionContext.issueIdByClientKey.set(clientKey, createdIssueId);
@@ -7105,6 +7958,8 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
       adapterType: runtimeActionCurrentAgentAdapterType(command),
       runtimeConfig: runtimeActionCurrentAgentRuntimeConnector(command),
     });
+    const reportsTo = runtimeActionReportsToAgentId(fields, actionContext);
+    if (reportsTo) body.reportsTo = reportsTo;
     const idempotencyKey = runtimeAgentHireActionFingerprint(fields, companyId, issueId, body);
     body.idempotencyKey = idempotencyKey;
     const created = asRecord(await runtimeApiJson(
@@ -7118,6 +7973,16 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
     const approval = asRecord(created.approval);
     const clientKey = runtimeActionResultKey(fields);
     const agentId = readString(agent.id);
+    if (reportsTo && readString(agent.reportsTo) !== reportsTo) {
+      throw new Error(
+        `runtime_action_postcondition_failed: agent reportsTo mismatch; expected ${reportsTo}, received ${readString(agent.reportsTo) ?? "missing"}`,
+      );
+    }
+    if (fields.topLevel === true && readString(agent.reportsTo)) {
+      throw new Error(
+        `runtime_action_postcondition_failed: top-level agent reportsTo mismatch; expected missing, received ${readString(agent.reportsTo)}`,
+      );
+    }
     if (agentId && clientKey) actionContext.agentIdByClientKey.set(clientKey, agentId);
     return {
       type,
@@ -7130,6 +7995,8 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
       approvalStatus: readString(approval.status),
       sourceIssueId: readString(body.sourceIssueId) ?? null,
       sourceIssueIds: runtimeActionIssueIdList(body.sourceIssueIds),
+      reportsTo: reportsTo ?? null,
+      topLevel: fields.topLevel === true,
       ...(clientKey ? { clientKey } : {}),
       reusedExisting: asRecord(created).reusedExisting === true,
     };
@@ -7163,25 +8030,6 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
       { key: "idempotencyKey", placeholders: ["artifact-key", "artifact key", "upload-artifact-key", "upload artifact key"] },
     ]);
     const rawPath = readRuntimeArtifactPath(fields);
-    if (!rawPath) {
-      const title = readBoundedActionString(fields, "title", 240) ?? "运行产物";
-      const summary = readBoundedActionString(fields, "summary", 20_000);
-      const body = [
-        `AMaster 未上传产物 \`${title}\`，因为 runtime action 没有提供工作区内文件路径。`,
-        summary ? `\n${summary}` : "",
-        "\n请在后续运行中先把文件写入执行工作区，再用 upload_artifact.path 引用该相对路径。",
-      ].join("");
-      const created = await runtimeApiJson(runtimeAuth, "POST", `/api/issues/${encodeURIComponent(issueId)}/comments`, { body });
-      actionContext.finalCommentBodies.push(body);
-      return {
-        type,
-        ...(originalType && originalType !== type ? { originalType } : {}),
-        status: "skipped",
-        reason: "missing_path",
-        title,
-        commentId: readString(asRecord(created).id),
-      };
-    }
     const payload = asRecord(command.payload);
     const companyId = readString(payload.companyId) ?? readString(runtimeAuth.companyId);
     if (!companyId) throw new Error("upload_artifact action requires companyId");
@@ -7203,15 +8051,25 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
     const title = readBoundedActionString(fields, "title", 240) ?? filename;
     if (fields.createWorkProduct !== false) {
       const existingWorkProducts = await listExistingIssueWorkProducts(runtimeAuth, issueId);
-      const existingWorkProduct = existingExplicitArtifactUploadMatch(filePath, title, existingWorkProducts);
+      const existingWorkProduct = existingExplicitArtifactUploadMatch(filePath, title, existingWorkProducts, fields);
       if (existingWorkProduct) {
         const metadata = asRecord(existingWorkProduct.metadata);
+        const existingWorkProductId = readString(existingWorkProduct.id);
+        const existingAttachmentId = readString(metadata.attachmentId);
+        if (!existingWorkProductId || !existingAttachmentId) {
+          throw new Error("runtime_action_postcondition_failed: reused artifact is missing work product or attachment identity");
+        }
+        await verifyUploadedArtifactPostcondition(runtimeAuth, issueId, {
+          attachmentId: existingAttachmentId,
+          workProductId: existingWorkProductId,
+          sha256,
+        }, fields);
         return {
           type,
           ...(originalType && originalType !== type ? { originalType } : {}),
           path: filePath,
-          attachmentId: readString(metadata.attachmentId),
-          workProductId: readString(existingWorkProduct.id),
+          attachmentId: existingAttachmentId,
+          workProductId: existingWorkProductId,
           sha256: readString(metadata.sha256) ?? sha256,
           byteSize: readNumber(metadata.byteSize, fileBytes.byteLength),
           originalFilename: readString(metadata.originalFilename) ?? filename,
@@ -7233,11 +8091,12 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
     if (!attachmentId) throw new Error("upload_artifact attachment response did not include id");
 
     let workProduct = null;
-    if (fields.createWorkProduct !== false) {
-      const contentPath = readString(attachment.contentPath) ?? `/api/attachments/${attachmentId}/content`;
-      const openPath = readString(attachment.openPath) ?? contentPath;
-      const downloadPath = readString(attachment.downloadPath) ?? `${contentPath}?download=1`;
-      workProduct = asRecord(await runtimeApiJson(runtimeAuth, "POST", `/api/issues/${encodeURIComponent(issueId)}/work-products`, {
+    try {
+      if (fields.createWorkProduct !== false) {
+        const contentPath = readString(attachment.contentPath) ?? `/api/attachments/${attachmentId}/content`;
+        const openPath = readString(attachment.openPath) ?? contentPath;
+        const downloadPath = readString(attachment.downloadPath) ?? `${contentPath}?download=1`;
+        workProduct = asRecord(await runtimeApiJson(runtimeAuth, "POST", `/api/issues/${encodeURIComponent(issueId)}/work-products`, {
         type: "artifact",
         provider: readString(fields.provider) ?? "paperclip",
         title,
@@ -7256,8 +8115,26 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
           openPath,
           downloadPath,
           originalFilename: readString(attachment.originalFilename) ?? filename,
+          ...(readString(fields.sourceWorkProductId) ? { sourceWorkProductId: readString(fields.sourceWorkProductId) } : {}),
+          ...(Array.isArray(fields.sourceWorkProductIds) ? { sourceWorkProductIds: fields.sourceWorkProductIds.map(readString).filter(Boolean) } : {}),
+          ...(readString(fields.supersedesWorkProductId) ? { supersedesWorkProductId: readString(fields.supersedesWorkProductId) } : {}),
+          ...(readString(fields.evidenceRole) ? { evidenceRole: readString(fields.evidenceRole) } : {}),
+          ...(Array.isArray(fields.scenarioKeys) ? { scenarioKeys: fields.scenarioKeys.map(readString).filter(Boolean) } : {}),
         },
-      }));
+        }));
+        const workProductId = readString(workProduct.id);
+        if (!workProductId) {
+          throw new Error("runtime_action_postcondition_failed: artifact work product response did not include id");
+        }
+        await verifyUploadedArtifactPostcondition(runtimeAuth, issueId, {
+          attachmentId,
+          workProductId,
+          sha256: readString(attachment.sha256) ?? sha256,
+        }, fields);
+      }
+    } catch (err) {
+      await cleanupFailedArtifactUpload(config, command, runtimeAuth, attachmentId, readString(workProduct?.id), err);
+      throw err;
     }
 
     return {
@@ -7315,6 +8192,37 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
     };
   }
 
+  if (type === "upsert_document") {
+    assertNoPlaceholderRuntimeActionText(fields, ["key", "title", "body", "changeSummary"]);
+    const key = readBoundedActionString(fields, "key", 64);
+    if (!key || !/^[a-z0-9][a-z0-9_-]*$/.test(key)) {
+      throw new Error("upsert_document key must use lowercase letters, numbers, _ or -");
+    }
+    const body = readBoundedActionString(fields, "body", 524_288);
+    if (!body) throw new Error("upsert_document action requires body");
+    if (fields.format !== "markdown") throw new Error("upsert_document format must be markdown");
+    const document = asRecord(await runtimeApiJson(
+      runtimeAuth,
+      "PUT",
+      `/api/issues/${encodeURIComponent(issueId)}/documents/${encodeURIComponent(key)}`,
+      {
+        title: readBoundedActionString(fields, "title", 200) ?? null,
+        format: "markdown",
+        body,
+        changeSummary: readBoundedActionString(fields, "changeSummary", 500) ?? null,
+        baseRevisionId: readString(fields.baseRevisionId) ?? null,
+      },
+    ));
+    return {
+      type,
+      ...(originalType && originalType !== type ? { originalType } : {}),
+      issueId,
+      key,
+      documentId: readString(document.id),
+      revisionNumber: typeof document.latestRevisionNumber === "number" ? document.latestRevisionNumber : undefined,
+    };
+  }
+
   if (type === "update_parent") {
     assertNoPlaceholderRuntimeActionText(fields, ["comment"]);
     const patch = {};
@@ -7330,30 +8238,33 @@ async function applyRuntimeAction(config, command, runtimeAuth, issueId, action,
     if (Object.keys(patch).length === 0) {
       throw new Error("update_parent action requires status or comment");
     }
-    if (status === "done" && runtimeActionDoneNeedsExternalHuman(fields, actionContext) && fields.force !== true) {
-      Object.assign(patch, runtimeActionExternalHumanPatch(comment));
+    if (status === "done" && actionContext.createdReviewPathForInReview && fields.force !== true) {
+      patch.status = "in_review";
+      patch.comment = comment
+        ? `${comment}\n\nAMaster 已检测到本次运行已创建待确认事项，因此任务保持待确认；请在确认后继续推进。`
+        : "AMaster 已检测到本次运行已创建待确认事项，因此任务保持待确认；请在确认后继续推进。";
       const updated = await runtimeApiJson(runtimeAuth, "PATCH", `/api/issues/${encodeURIComponent(issueId)}`, patch);
       return {
         type,
         ...(originalType && originalType !== type ? { originalType } : {}),
         issueId: readString(asRecord(updated).id),
-        status: readString(asRecord(updated).status) ?? "blocked",
+        status: readString(asRecord(updated).status) ?? "in_review",
         coercedFromStatus: "done",
-        externalOwnerAction: true,
+        existingReviewPath: true,
       };
     }
-    if (status === "done" && actionContext.createdReviewPathForInReview && fields.force !== true) {
+    if (status === "in_progress" && actionContext.createdReviewPathForInReview && fields.force !== true) {
       patch.status = "in_review";
       patch.comment = comment
-        ? `${comment}\n\nAMaster 已检测到本次运行已创建待确认事项，因此任务保持待确认；请在确认后继续推进。`
-        : "AMaster 已检测到本次运行已创建待确认事项，因此任务保持待确认；请在确认后继续推进。";
+        ? `${comment}\n\nAMaster detected a pending review interaction in this run, so the task remains in review until that interaction is resolved.`
+        : "AMaster detected a pending review interaction in this run, so the task remains in review until that interaction is resolved.";
       const updated = await runtimeApiJson(runtimeAuth, "PATCH", `/api/issues/${encodeURIComponent(issueId)}`, patch);
       return {
         type,
         ...(originalType && originalType !== type ? { originalType } : {}),
         issueId: readString(asRecord(updated).id),
         status: readString(asRecord(updated).status) ?? "in_review",
-        coercedFromStatus: "done",
+        coercedFromStatus: "in_progress",
         existingReviewPath: true,
       };
     }
@@ -7582,6 +8493,48 @@ function runtimeActionFailureSummary(action, err) {
   };
 }
 
+function runtimeActionLedgerResourceIds(result) {
+  const record = asRecord(result);
+  const resourceIds = {};
+  for (const key of ["issueId", "parentIssueId", "agentId", "approvalId", "commentId", "interactionId", "attachmentId", "workProductId", "routineId", "profileId"]) {
+    const value = readString(record[key]);
+    if (value) resourceIds[key] = value;
+  }
+  return resourceIds;
+}
+
+function runtimeActionLedgerPostconditionStatus(action, status, error) {
+  if (status === "failed") {
+    return /runtime_action_postcondition_failed/i.test(String(error instanceof Error ? error.message : error ?? ""))
+      ? "failed"
+      : "not_run";
+  }
+  if (status !== "applied" && status !== "reused") return "not_run";
+  return ["create_child_task", "agent_hire", "create_agent", "upload_artifact"].includes(
+    readRuntimeActionType(action) ?? "",
+  )
+    ? "passed"
+    : "not_applicable";
+}
+
+function runtimeActionLedgerEntry(action, actionIndex, status, result = null, error = null) {
+  const fields = runtimeActionBusinessFields(action);
+  const resultRecord = asRecord(result);
+  const clientKey = readString(fields.clientKey);
+  const resourceIds = runtimeActionLedgerResourceIds(resultRecord);
+  return {
+    actionIndex,
+    actionType: readRuntimeActionType(fields) ?? "unknown",
+    actionKey: clientKey ?? `index:${actionIndex}`,
+    ...(clientKey ? { clientKey } : {}),
+    status,
+    reusedExisting: resultRecord.reusedExisting === true,
+    postconditionStatus: runtimeActionLedgerPostconditionStatus(fields, status, error),
+    ...(Object.keys(resourceIds).length > 0 ? { resourceIds } : {}),
+    ...(error ? { error: truncateText(error instanceof Error ? error.message : String(error), 1000) } : {}),
+  };
+}
+
 function isSkippedRuntimeActionResult(result) {
   return readString(asRecord(result).status) === "skipped";
 }
@@ -7725,6 +8678,16 @@ function runtimeActionExpectedShape(actionType, actionKind) {
   if (actionType === "upload_artifact") {
     return { type: "upload_artifact", path: "relative/path.ext", title: "Artifact title", summary: "Artifact summary" };
   }
+  if (actionType === "upsert_document") {
+    return {
+      type: "upsert_document",
+      key: "business-brief",
+      title: "2026-07-16 每日经营简报",
+      body: "# 每日经营简报\n\n经营摘要。",
+      format: "markdown",
+      changeSummary: "生成每日经营简报",
+    };
+  }
   if (actionType === "agent_hire" || actionType === "create_agent") {
     return {
       type: actionType,
@@ -7755,7 +8718,19 @@ function runtimeActionDiagnostics(err, options = {}) {
     actionType,
     schema: runtimeActionSchemaName(actionType, actionKind),
     ...(reasonHint ? { reasonHint } : {}),
+    ...(readString(err?.runtimeActionDecompositionRequirementSource)
+      ? { decompositionRequirementSource: readString(err.runtimeActionDecompositionRequirementSource) }
+      : {}),
+    ...(err?.runtimeActionDecompositionMatch
+      ? { decompositionMatch: err.runtimeActionDecompositionMatch }
+      : {}),
     ...(err?.runtimeActionInferenceTrace ? { inferenceTrace: err.runtimeActionInferenceTrace } : {}),
+    ...(readString(err?.runtimeActionFieldPath) ? { fieldPath: readString(err.runtimeActionFieldPath) } : {}),
+    ...(readString(err?.runtimeActionReceivedType) ? { receivedType: readString(err.runtimeActionReceivedType) } : {}),
+    ...(readString(err?.runtimeActionRequiredAuthorization) ? { requiredAuthorization: readString(err.runtimeActionRequiredAuthorization) } : {}),
+    ...(readString(err?.runtimeActionAuthorizationSourceKind) ? { authorizationSourceKind: readString(err.runtimeActionAuthorizationSourceKind) } : {}),
+    ...(readString(err?.runtimeActionAuthorizationSourceId) ? { authorizationSourceId: readString(err.runtimeActionAuthorizationSourceId) } : {}),
+    ...(readString(err?.runtimeActionAuthorizationSourceRevision) ? { authorizationSourceRevision: readString(err.runtimeActionAuthorizationSourceRevision) } : {}),
     ...(Array.isArray(err?.runtimeActionAllowedContentTypes)
       ? { allowedContentTypes: err.runtimeActionAllowedContentTypes }
       : {}),
@@ -7765,6 +8740,7 @@ function runtimeActionDiagnostics(err, options = {}) {
     ...(err?.runtimeActionVerificationResult
       ? { verificationResult: err.runtimeActionVerificationResult }
       : {}),
+    ...(err?.runtimeActionLedger ? { actionLedger: err.runtimeActionLedger } : {}),
     ...(runtimeActionExpectedShape(actionType, actionKind) ? { expectedShape: runtimeActionExpectedShape(actionType, actionKind) } : {}),
     ...(typeof err?.httpStatus === "number" ? { backendStatus: err.httpStatus } : {}),
     ...(backendErrors.length > 0 ? { backendErrors } : {}),
@@ -7783,6 +8759,14 @@ function classifyRuntimeActionFailure(err) {
     ...(reason ? { actionFailureReason: reason } : {}),
   };
   const diagnostics = runtimeActionDiagnostics(err, { retryable: false });
+  if (actionType === "decomposition") {
+    return {
+      errorCode: "task_decomposition_required",
+      errorFamily: "validation",
+      ...details,
+      ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
+    };
+  }
   if (actionType === "deliverable_verification") {
     return {
       errorCode: "artifact_verification_failed",
@@ -7791,6 +8775,14 @@ function classifyRuntimeActionFailure(err) {
       ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
     };
   }
+  if (actionType === "output_channel") {
+    return {
+      errorCode: readString(err?.runtimeActionErrorCode) ?? "runtime_action_validation_failed",
+      errorFamily: "output_contract",
+      ...details,
+      ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
+    };
+  }
   if (
     actionType === "create_interaction" &&
     /create_interaction\.[a-z_]+ action requires payload|create_interaction action requires payload|non-canonical fields/i.test(haystack)
@@ -7802,7 +8794,10 @@ function classifyRuntimeActionFailure(err) {
       ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
     };
   }
-  if (actionType === "upload_artifact" && /unsupported artifact content type/i.test(haystack)) {
+  if (
+    actionType === "upload_artifact" &&
+    /unsupported artifact content type|requires path|file does not exist|path must be inside/i.test(haystack)
+  ) {
     return {
       errorCode: "runtime_action_validation_failed",
       errorFamily: "output_contract",
@@ -7826,6 +8821,31 @@ function classifyRuntimeActionFailure(err) {
       ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
     };
   }
+  if (/runtime_action_postcondition_failed/i.test(haystack)) {
+    return {
+      errorCode: "runtime_action_postcondition_failed",
+      errorFamily: "output_contract",
+      ...details,
+      ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
+    };
+  }
+  if (err?.httpStatus === 401) {
+    const authenticationDiagnostics = runtimeActionDiagnostics(err, { retryable: true });
+    return {
+      errorCode: "runtime_action_authentication_failed",
+      errorFamily: "authentication",
+      ...details,
+      ...(authenticationDiagnostics ? { runtimeActionDiagnostics: authenticationDiagnostics } : {}),
+    };
+  }
+  if (err?.httpStatus === 403) {
+    return {
+      errorCode: "runtime_action_permission_denied",
+      errorFamily: "permission",
+      ...details,
+      ...(diagnostics ? { runtimeActionDiagnostics: diagnostics } : {}),
+    };
+  }
   if (/approval-gated executable child tasks/i.test(haystack)) {
     return {
       errorCode: "runtime_action_validation_failed",
@@ -7885,6 +8905,27 @@ function piOutputUsageMetadataMissing(parsed) {
   return totalTokens <= 0;
 }
 
+function runtimeBusinessDisposition(runtimeActions, inferredArtifactUploads) {
+  const results = Array.isArray(runtimeActions?.results)
+    ? runtimeActions.results.map(asRecord).filter((result) => !isSkippedRuntimeActionResult(result))
+    : [];
+  const terminalUpdate = results.find((result) =>
+    readString(result.type) === "update_parent" &&
+    ["done", "cancelled", "blocked", "in_review"].includes(readString(result.status) ?? ""));
+  const terminalStatus = readString(terminalUpdate?.status);
+  if (["done", "cancelled"].includes(terminalStatus ?? "")) {
+    return { state: "completed", reason: `parent_${terminalStatus}` };
+  }
+  if (terminalStatus === "blocked") return { state: "blocked", reason: "parent_blocked" };
+  if (terminalStatus === "in_review" || results.some((result) => readString(result.type) === "create_interaction")) {
+    return { state: "waiting", reason: "review_or_interaction_path_recorded" };
+  }
+  if (results.length > 0 || readNumber(inferredArtifactUploads?.appliedCount, 0) > 0) {
+    return { state: "needs_followup", reason: "durable_progress_without_terminal_disposition" };
+  }
+  return { state: "missing", reason: "no_durable_action_or_live_path" };
+}
+
 function piCompletionOutputStopped(parsed, execution) {
   return execution?.timedOut !== true
     && execution?.signal === "SIGTERM"
@@ -8122,10 +9163,29 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
     ...executorActionSources,
   ].filter(Boolean).join("\n\n");
   const envelope = extractRuntimeActionEnvelope(actionText);
+  if (!envelope && executorKind === "pi" && parsed.runtimeActionMarkerInToolOutput === true) {
+    const err = runtimeActionValidationError(
+      "AMASTER_RUNTIME_ACTIONS must be emitted in a Pi assistant message; a marker was found only in tool output, and tool output is ignored by the runtime action bridge",
+    );
+    err.runtimeActionType = "output_channel";
+    err.runtimeActionReasonHint = "assistant_message_required";
+    throw err;
+  }
+  if (!envelope && hasMalformedRuntimeActionMarkerIntent(actionText)) {
+    const err = runtimeActionValidationError(
+      "AMASTER_RUNTIME_ACTIONS action intent used a non-canonical marker; the marker must be an unformatted bare line",
+    );
+    err.runtimeActionType = "output_channel";
+    err.runtimeActionReasonHint = "bare_marker_line_required";
+    err.runtimeActionErrorCode = "runtime_action_output_marker_invalid";
+    throw err;
+  }
   if (!envelope) return null;
   const rawActions = Array.isArray(envelope.actions) ? envelope.actions.map(asRecord) : [];
   const continuationScope = runtimeActionContinuationScope(command);
+  const authorizationEnvelope = runtimeActionAuthorizationEnvelope(command);
   assertRuntimeActionsAllowedByContinuationScope(rawActions, continuationScope);
+  assertExplicitTaskDecomposition(command, rawActions);
   if (
     continuationScope === "message_only"
     && Array.isArray(envelope.deliverables)
@@ -8136,6 +9196,10 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
   const runtimeAuth = runtimeActionAuthForCommand(command);
   const issueId = readString(runtimeAuth.issueId) ?? commandIssueId(command);
   if (!issueId) throw new Error("AMaster runtime action bridge requires a current issue id");
+  const batchFingerprint = `runtime-action-batch:${stableRuntimeActionHash({
+    runId: runtimeActionRunId(runtimeAuth) ?? commandRunId(command),
+    envelope,
+  })}`;
   const allowedContentTypes = runtimeAttachmentContentTypes(command);
   let deliverableManifest;
   try {
@@ -8167,20 +9231,41 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
     attachRuntimeCheckpointCandidates(err, envelope, cwd);
     throw err;
   }
-  const actions = orderRuntimeActionsForGovernance([...generatedUploadActions, ...rawActions]);
+  let actions = orderRuntimeActionsForGovernance([...generatedUploadActions, ...rawActions]);
   const answeredQuestionContinuation = runtimeActionAnsweredQuestionContinuation(command);
+  const acceptedConfirmationContinuation = runtimeActionAcceptedConfirmationContinuation(command);
   try {
-    preflightRuntimeActionBatch(actions, {
+    actions = preflightRuntimeActionBatch(actions, {
       answeredQuestionContinuation,
+      acceptedConfirmationContinuation,
       allowedContentTypes,
       continuationScope,
+      cwd,
     });
+    assertRuntimeActionsAllowedByAuthorizationEnvelope(actions, authorizationEnvelope);
   } catch (err) {
+    if (err && typeof err === "object" && !err.runtimeActionLedger) {
+      const fieldPath = readString(err.runtimeActionFieldPath);
+      const failedIndex = Number.parseInt(fieldPath?.match(/^actions\[(\d+)]/)?.[1] ?? "0", 10);
+      err.runtimeActionLedger = {
+        batchFingerprint,
+        traceId: batchFingerprint,
+        status: "validation_failed",
+        actions: actions.map((action, index) => runtimeActionLedgerEntry(
+          action,
+          index,
+          index === failedIndex ? "failed" : "pending",
+          null,
+          index === failedIndex ? err : null,
+        )),
+      };
+    }
     attachRuntimeCheckpointCandidates(err, envelope, cwd);
     throw err;
   }
   const results = [];
   const skipped = [];
+  const actionLedgerEntries = [];
   const actionContext = {
     rootIssueId: issueId,
     cwd,
@@ -8190,14 +9275,20 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
     createdChildIssueIdByFingerprint: new Map(),
     completedChildIssuesByTitle: runtimeActionCompletedChildIssueMap(command),
     createdReviewPathForInReview: false,
-    acceptedConfirmationContinuation: runtimeActionAcceptedConfirmationContinuation(command),
+    acceptedConfirmationContinuation,
     answeredQuestionContinuation,
     finalCommentBodies: [],
   };
-  for (const action of actions) {
+  for (const [actionIndex, action] of actions.entries()) {
     try {
       const result = await applyRuntimeAction(config, command, runtimeAuth, issueId, action, actionContext);
       results.push(result);
+      actionLedgerEntries.push(runtimeActionLedgerEntry(
+        action,
+        actionIndex,
+        asRecord(result).reusedExisting === true ? "reused" : "applied",
+        result,
+      ));
       if (isSkippedRuntimeActionResult(result)) {
         skipped.push(result);
       }
@@ -8226,6 +9317,17 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
           err.runtimeActionOriginalType = readRuntimeActionOriginalType(action);
           err.runtimeActionKind = readString(action.kind) ?? readString(asRecord(action.payload).kind);
           err.runtimeActionReason = truncateText(err instanceof Error ? err.message : String(err), 1000);
+          err.runtimeActionLedger = {
+            batchFingerprint,
+            traceId: batchFingerprint,
+            status: "partial_failed",
+            actions: [
+              ...actionLedgerEntries,
+              runtimeActionLedgerEntry(action, actionIndex, "failed", null, err),
+              ...actions.slice(actionIndex + 1).map((pendingAction, offset) =>
+                runtimeActionLedgerEntry(pendingAction, actionIndex + offset + 1, "pending")),
+            ],
+          };
         }
         attachRuntimeCheckpointCandidates(err, envelope, cwd);
         throw err;
@@ -8233,6 +9335,7 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
       const skippedResult = runtimeActionFailureSummary(action, err);
       skipped.push(skippedResult);
       results.push(skippedResult);
+      actionLedgerEntries.push(runtimeActionLedgerEntry(action, actionIndex, "skipped", skippedResult, err));
       await ingestLog(config, command, "system", "warn", `Skipped AMaster runtime action: ${skippedResult.reason}`, {
         runtimeAction: skippedResult,
       });
@@ -8240,8 +9343,19 @@ async function applyRuntimeActionBridge(config, command, parsed, execution, cwd)
   }
   return {
     version: readNumber(envelope.version, 1),
+    markerFound: true,
+    jsonParsed: true,
+    actionsValidated: true,
+    postconditionsPassed: true,
+    actionLedger: {
+      batchFingerprint,
+      traceId: batchFingerprint,
+      status: "completed",
+      actions: actionLedgerEntries,
+    },
     requestedCount: actions.length,
     appliedCount: results.length - skipped.length,
+    actionsApplied: results.length - skipped.length,
     skippedCount: skipped.length,
     results,
     deliverableManifest: {
@@ -8272,6 +9386,72 @@ async function listExistingIssueWorkProducts(runtimeAuth, issueId) {
   }
 }
 
+async function verifyUploadedArtifactPostcondition(runtimeAuth, issueId, expected, fields) {
+  const [workProducts, attachments] = await Promise.all([
+    runtimeApiJson(runtimeAuth, "GET", `/api/issues/${encodeURIComponent(issueId)}/work-products`),
+    runtimeApiJson(runtimeAuth, "GET", `/api/issues/${encodeURIComponent(issueId)}/attachments`),
+  ]);
+  const workProduct = Array.isArray(workProducts)
+    ? workProducts.map(asRecord).find((entry) => readString(entry.id) === expected.workProductId)
+    : null;
+  const attachment = Array.isArray(attachments)
+    ? attachments.map(asRecord).find((entry) => readString(entry.id) === expected.attachmentId)
+    : null;
+  const metadata = asRecord(workProduct?.metadata);
+  const expectedSourceIds = Array.isArray(fields.sourceWorkProductIds)
+    ? fields.sourceWorkProductIds.map(readString).filter(Boolean).sort()
+    : [];
+  const persistedSourceIds = Array.isArray(metadata.sourceWorkProductIds)
+    ? metadata.sourceWorkProductIds.map(readString).filter(Boolean).sort()
+    : [];
+  const expectedScenarioKeys = Array.isArray(fields.scenarioKeys)
+    ? fields.scenarioKeys.map(readString).filter(Boolean).sort()
+    : [];
+  const persistedScenarioKeys = Array.isArray(metadata.scenarioKeys)
+    ? metadata.scenarioKeys.map(readString).filter(Boolean).sort()
+    : [];
+  const failures = [
+    !workProduct ? "work product missing" : null,
+    !attachment ? "attachment missing" : null,
+    readString(metadata.attachmentId) !== expected.attachmentId ? "work product attachmentId mismatch" : null,
+    readString(metadata.sha256) !== expected.sha256 ? "work product SHA mismatch" : null,
+    readString(attachment?.sha256) !== expected.sha256 ? "attachment SHA mismatch" : null,
+    readString(metadata.sourceWorkProductId) !== readString(fields.sourceWorkProductId) ? "sourceWorkProductId mismatch" : null,
+    readString(metadata.supersedesWorkProductId) !== readString(fields.supersedesWorkProductId) ? "supersedesWorkProductId mismatch" : null,
+    readString(metadata.evidenceRole) !== readString(fields.evidenceRole) ? "evidenceRole mismatch" : null,
+    JSON.stringify(persistedSourceIds) !== JSON.stringify(expectedSourceIds) ? "sourceWorkProductIds mismatch" : null,
+    JSON.stringify(persistedScenarioKeys) !== JSON.stringify(expectedScenarioKeys) ? "scenarioKeys mismatch" : null,
+  ].filter(Boolean);
+  if (failures.length > 0) {
+    throw new Error(`runtime_action_postcondition_failed: artifact upload readback failed: ${failures.join("; ")}`);
+  }
+}
+
+async function cleanupFailedArtifactUpload(config, command, runtimeAuth, attachmentId, workProductId, cause) {
+  const cleanupFailures = [];
+  if (workProductId) {
+    try {
+      await runtimeApiJson(runtimeAuth, "DELETE", `/api/work-products/${encodeURIComponent(workProductId)}`);
+    } catch (err) {
+      cleanupFailures.push(`workProduct=${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  try {
+    await runtimeApiJson(runtimeAuth, "DELETE", `/api/attachments/${encodeURIComponent(attachmentId)}`);
+  } catch (err) {
+    cleanupFailures.push(`attachment=${err instanceof Error ? err.message : String(err)}`);
+  }
+  await ingestLog(config, command, "system", "error", "Artifact upload postcondition failed", {
+    attachmentId,
+    workProductId: workProductId ?? null,
+    cause: cause instanceof Error ? cause.message : String(cause),
+    cleanupFailures,
+  });
+  if (cleanupFailures.length > 0) {
+    throw new Error(`${cause instanceof Error ? cause.message : String(cause)}; cleanup failed: ${cleanupFailures.join("; ")}`);
+  }
+}
+
 function existingArtifactUploadMatches(artifact, existingWorkProducts) {
   const filename = basename(artifact.path);
   const byteSize = statSync(artifact.path).size;
@@ -8297,7 +9477,7 @@ function existingArtifactUploadMatches(artifact, existingWorkProducts) {
   });
 }
 
-function existingExplicitArtifactUploadMatch(filePath, title, existingWorkProducts) {
+function existingExplicitArtifactUploadMatch(filePath, title, existingWorkProducts, fields = {}) {
   const filename = basename(filePath);
   const byteSize = statSync(filePath).size;
   const sha256 = hashFileSha256(filePath);
@@ -8308,6 +9488,22 @@ function existingExplicitArtifactUploadMatch(filePath, title, existingWorkProduc
     if (readString(workProduct.provider) !== "paperclip") return false;
     if (readString(workProduct.status) === "archived") return false;
     const metadata = asRecord(workProduct.metadata);
+    const sourceWorkProductId = readString(fields.sourceWorkProductId);
+    const sourceWorkProductIds = Array.isArray(fields.sourceWorkProductIds)
+      ? fields.sourceWorkProductIds.map(readString).filter(Boolean).sort()
+      : [];
+    const supersedesWorkProductId = readString(fields.supersedesWorkProductId);
+    const evidenceRole = readString(fields.evidenceRole);
+    const scenarioKeys = Array.isArray(fields.scenarioKeys) ? fields.scenarioKeys.map(readString).filter(Boolean).sort() : [];
+    if (sourceWorkProductId || supersedesWorkProductId || sourceWorkProductIds.length > 0 || evidenceRole || scenarioKeys.length > 0) {
+      if (readString(metadata.sourceWorkProductId) !== sourceWorkProductId) return false;
+      if (readString(metadata.supersedesWorkProductId) !== supersedesWorkProductId) return false;
+      const existingSourceIds = Array.isArray(metadata.sourceWorkProductIds) ? metadata.sourceWorkProductIds.map(readString).filter(Boolean).sort() : [];
+      const existingScenarioKeys = Array.isArray(metadata.scenarioKeys) ? metadata.scenarioKeys.map(readString).filter(Boolean).sort() : [];
+      if (JSON.stringify(existingSourceIds) !== JSON.stringify(sourceWorkProductIds)) return false;
+      if (readString(metadata.evidenceRole) !== evidenceRole) return false;
+      if (JSON.stringify(existingScenarioKeys) !== JSON.stringify(scenarioKeys)) return false;
+    }
     const existingSha = readString(metadata.sha256) ?? readString(workProduct.sha256);
     if (existingSha) return existingSha === sha256;
 
@@ -8430,15 +9626,19 @@ async function executeRunCommand(config, command) {
     });
   }
   await materializeIssueCheckpoint(config, command, workspace);
-  let materializedAttachments = [];
+  const requiredArtifactInputs = await materializeRequiredArtifactInputs(config, command, workspace);
+  let materializedAttachments = requiredArtifactInputs;
   try {
-    materializedAttachments = await materializeIssueAttachments(config, command, workspace);
+    materializedAttachments = [...requiredArtifactInputs, ...await materializeIssueAttachments(config, command, workspace)];
   } catch (err) {
     await ingestLog(config, command, "system", "warn", `Failed to materialize issue attachments: ${err instanceof Error ? err.message : String(err)}`, {
       error: err instanceof Error ? err.message : String(err),
     });
   }
-  const prompt = buildCommandPrompt(command, workspace, materializedAttachments, { executorKind: executor.kind });
+  const prompt = buildCommandPrompt(command, workspace, materializedAttachments, {
+    executorKind: executor.kind,
+    artifactVerifierCommands: config.artifactVerifierCommands,
+  });
   const invocation = buildExecutorInvocation(executor, command, workspace);
   const executorEnv = buildExecutorEnv(config, command, workspace);
   if (executor.kind === "pi") {
@@ -8654,6 +9854,7 @@ async function executeRunCommand(config, command) {
         ? "Executor cancelled by AMaster control plane"
       : execution.spawnError ?? parsedErrorMessage ?? runtimeActionError ?? inferredArtifactError ?? (succeeded ? null : `Executor exited with code ${execution.exitCode ?? "unknown"}`);
     const artifactUploadSummary = runtimeArtifactUploadSummary(runtimeActions, inferredArtifactUploads);
+    const businessDisposition = runtimeBusinessDisposition(runtimeActions, inferredArtifactUploads);
     const costUsage = parsedCostUsage(parsed.usage);
     const result = {
       executorKind: executor.kind,
@@ -8724,6 +9925,7 @@ async function executeRunCommand(config, command) {
       ...(runtimeActions ? { runtimeActions } : {}),
       ...(inferredArtifactUploads ? { inferredArtifactUploads } : {}),
       ...(artifactUploadSummary ? { artifactUploadSummary } : {}),
+      businessDisposition,
     };
     const completion = await completeCommand(config, command, cancelled ? "cancelled" : succeeded ? "succeeded" : "failed", result, error ?? undefined);
     if (!completion) {
@@ -8918,6 +10120,26 @@ function statusSummary(config) {
   }), null, 2)}\n`);
 }
 
+function validateRuntimeActionsFile(config, flags) {
+  const rawFile = readString(flags.file);
+  if (!rawFile) throw new Error("--file is required");
+  const cwd = resolve(readString(flags.cwd) ?? process.cwd());
+  const file = resolve(cwd, rawFile);
+  const allowedContentTypes = splitList(flags["allowed-content-types"]);
+  const envelope = JSON.parse(readFileSync(file, "utf8"));
+  if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+    throw runtimeActionValidationError("runtime action envelope must be a JSON object");
+  }
+  assertRuntimeActionValid(envelope.version === 1, "runtime action envelope version must be 1");
+  assertRuntimeActionValid(Array.isArray(envelope.actions), "runtime action envelope actions must be an array");
+  assertRuntimeActionValid(envelope.actions.length <= 20, "runtime action envelope actions exceed the limit of 20");
+
+  preflightRuntimeDeliverables(config, envelope, cwd, allowedContentTypes);
+  const actions = orderRuntimeActionsForGovernance(envelope.actions.map(asRecord));
+  preflightRuntimeActionBatch(actions, { cwd, allowedContentTypes });
+  process.stdout.write(`${JSON.stringify({ valid: true, actionCount: actions.length }, null, 2)}\n`);
+}
+
 async function runLoop(config) {
   config = await ensureRegistered(config);
   let startupOrphanCheckPending = true;
@@ -8951,6 +10173,7 @@ Commands:
   run-once                  Register if needed, heartbeat, poll once, execute leased commands, then exit.
   workspace-gc-dry-run      Print managed runtime workdir GC candidates without deleting anything.
   status-summary            Print safe local daemon storage/outbox summary JSON.
+  validate-actions          Validate a JSON action envelope with --file, --cwd, and --allowed-content-types.
   start | run               Register if needed, then heartbeat and poll in a foreground loop.
 
 Key env:
@@ -9002,6 +10225,9 @@ async function main() {
     case "status-summary":
       statusSummary(config);
       break;
+    case "validate-actions":
+      validateRuntimeActionsFile(config, flags);
+      break;
     case "start":
     case "run":
       await runLoop(config);