@awak-app/simy-cli 0.5.29 → 0.5.31

package/src/codex-plugins/simy/hooks/hooks.json

@@ -10,6 +10,15 @@
             "timeout": 3
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'delivery-loop.mjs')).href); await hook.main('codex');\"",
+            "timeout": 3
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [
@@ -22,6 +31,50 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'delivery-loop.mjs')).href); await hook.main('codex');\"",
+            "timeout": 3
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'delivery-loop.mjs')).href); await hook.main('codex');\"",
+            "timeout": 3
+          }
+        ]
+      }
+    ],
+    "Interrupt": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'delivery-loop.mjs')).href); await hook.main('codex');\"",
+            "timeout": 3
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'delivery-loop.mjs')).href); await hook.main('codex');\"",
+            "timeout": 3
+          }
+        ]
+      }
     ]
   }
 }

package/src/codex-plugins/simy/skills/delivery-loop/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: delivery-loop
+description: Continue an explicitly requested SIMY Delivery Loop in the current provider conversation using user-reviewed hooks, bounded checkpoints, and human blocker handling.
+---
+
+# SIMY Delivery Loop
+
+Use only when the user explicitly requests this skill or SIMY Delivery Loop for the current task. Installing this plugin does not opt a task in. Do not run SQM unless separately requested.
+
+1. Require the SIMY SessionStart hook context with the exact provider and session ID. If absent, explain how to install the SIMY plugin, review and enable its hooks with `/hooks`, and start a new conversation. Codex settings can be opened at `codex://settings`; a hooks subpage deep link is not guaranteed. Never change hook trust or bypass permissions yourself.
+2. Use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. Default limits: 6 automatic continuations, 3 consecutive failures/missing checkpoints, 30 minutes. Set different finite limits only if the user requests them. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
+3. Work in the current conversation with its normal permissions. Before ending each turn, write a JSON checkpoint and run `simy delivery checkpoint --provider <provider> --session <id> --file <file>` from the same directory. Keep checkpoints outside the tracked source diff.
+
+Checkpoint shapes:
+
+```json
+{"status":"in_progress","summary":"Tests identified one remaining failure","nextStep":"Fix the failing validation test and rerun the targeted suite"}
+```
+```json
+{"status":"blocked","blocker":"authorization","summary":"Deployment requires the user's approval"}
+```
+
+For missing information use `blocker: "missing_information"`. For a failed attempt use `status: "error"` and a concrete `nextStep`; repeated errors stop the loop. Do not reclassify blocked work as in_progress to force continuation. Never assume a provider error means permission to switch accounts, credentials, or bypass approvals.
+
+For completed work use `{"status":"completed","summary":"Actual result","acceptanceMet":true,"evidence":["Exact checks and observed results"]}` only after checking the user's acceptance criteria. Evidence is a report, not independent certification: preserve failed checks and deployment gaps. The hook must not infer success from optimistic closing text.
+
+4. The Stop hook evaluates checkpoints and supplies the next instruction within the original budgets. Missing checkpoints consume the failure budget. A human interrupt stops the loop. Approval/input events block it. Provider errors/exits may require reopening the existing conversation; these hooks cannot restart a dead provider process.
+5. After the user explicitly resolves the blocker and requests continuation, `simy delivery resume --provider <provider> --session <id>` retains all budgets. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.

package/src/codex-plugins/simy/skills/sqm-loop/SKILL.md

@@ -14,7 +14,9 @@ Treat the current Codex thread, its attachments, and the active repository as th
 3. Run `simy sqm min-check` from the repository root.
 4. Run `simy sqm check --proof proof.json --signed-evidence proof.json.signed.json`.
 5. Read `proof.json` and require `outcome.status` to be `passed` before reporting success or proposing a pull request.
-6. Report the checked repository/revision, proof paths, outcome, blockers, and any evidence gap.
+6. Verify the proof's repository, base, HEAD and working-tree/diff identity against the candidate, and verify its bound signature with SQM tooling. Use separate artifact paths outside the diff; do not edit between min-check and check or reuse stale proof after a candidate change.
+7. Report outcome reasons, matched modules, evaluated rules and scenario statuses from `executions`, separating blocking and advisory results. `passed` with `no_applicable_rules`, zero scenario evaluations, or advisory-only checks is not feature or incident coverage. Scenario statuses are deterministic evaluations, not evidence that a browser, provider or deployed journey ran. Record relevant uncovered review findings and their concrete regression evidence or remaining gap.
+8. Report the checked repository/revision, proof paths, outcome, blockers, and any evidence gap. Keep delivery acceptance pending for unverified applicable paths even when SQM passes.
 
 If implementation is required before the check can pass, obtain or confirm the user's change authorization and make the smallest relevant repair. A request to run SQM alone does not authorize unrelated edits, a PR, merge, deployment, or external messages.
 

package/src/coding-run-store.js

@@ -0,0 +1,69 @@
+import { createHash, randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { redactExecutionValue } from "./orchestrator/execution-io.js";
+
+const RUN_ID = /^[A-Za-z0-9_-]{1,160}$/;
+const writes = new Map();
+
+export function codingRunsRoot(sessionRoot) {
+  return path.resolve(sessionRoot || path.join(homedir(), ".simy"), "coding-runs");
+}
+
+export async function saveCodingRunSnapshot(root, snapshot) {
+  const id = String(snapshot?.id || "");
+  if (!RUN_ID.test(id)) throw new Error("Invalid coding run ID for durable storage.");
+  // Capture at enqueue time: later mutations must not rewrite a queued version.
+  snapshot = redactExecutionValue(snapshot);
+  const directory = path.resolve(root);
+  const key = path.join(directory, id);
+  const previous = writes.get(key) || Promise.resolve();
+  const current = previous.catch(() => undefined).then(async () => {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const body = JSON.stringify(snapshot);
+    const document = JSON.stringify({
+      version: 1,
+      sha256: createHash("sha256").update(body).digest("hex"),
+      snapshot,
+    });
+    const target = `${key}.json`;
+    const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`;
+    await writeFile(temporary, `${document}\n`, { mode: 0o600 });
+    await rename(temporary, target);
+  });
+  writes.set(key, current);
+  try { await current; } finally {
+    if (writes.get(key) === current) writes.delete(key);
+  }
+}
+
+export async function loadCodingRunSnapshots(root) {
+  let files;
+  try {
+    files = await readdir(root, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return { snapshots: [], errors: [] };
+    throw error;
+  }
+  const snapshots = [];
+  const errors = [];
+  for (const file of files) {
+    if (!file.isFile() || !file.name.endsWith(".json")) continue;
+    const id = file.name.slice(0, -5);
+    if (!RUN_ID.test(id)) continue;
+    try {
+      const document = JSON.parse(await readFile(path.join(root, file.name), "utf8"));
+      const body = JSON.stringify(document.snapshot);
+      const hash = createHash("sha256").update(body).digest("hex");
+      if (document.version !== 1 || document.sha256 !== hash || document.snapshot?.id !== id) {
+        throw new Error("Coding run record failed integrity check.");
+      }
+      snapshots.push(document.snapshot);
+    } catch (error) {
+      errors.push({ id, message: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { snapshots, errors };
+}

package/src/delivery-hooks/command.js

@@ -0,0 +1,31 @@
+import { readFile } from 'node:fs/promises';
+import { startDelivery, checkpointDelivery, controlDelivery, listRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), output = console.log } = {}) {
+  const [action, ...args] = argv;
+  if (!action || action === '--help') {
+    output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--max-continuations 6] [--max-failures 3] [--max-minutes 30]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json\nsimy delivery status\nsimy delivery stop|resume --provider codex|claude --session ID\nEnable and review SIMY hooks in your provider first. Starting a loop opts in only this session. Resume requires the user to resolve the blocker; original budgets are retained.');
+    return 0;
+  }
+  const options = {};
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'file']);
+  for (let i = 0; i < args.length; i += 2) {
+    const key = args[i]?.replace(/^--/, '');
+    if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
+    options[key] = args[i + 1];
+  }
+  const base = { root, cwd, provider: options.provider, session: options.session };
+  let result;
+  if (action === 'status') result = (await listRecords(root)).filter(r => (!options.provider || r.provider === options.provider) && (!options.session || r.session === options.session));
+  else if (action === 'start') result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'],
+    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
+  else if (action === 'checkpoint') {
+    if (!options.file) throw new Error('--file is required.');
+    const data = await readFile(options.file, 'utf8');
+    if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Checkpoint exceeds 64 KiB.');
+    result = await checkpointDelivery({ ...base, checkpoint: JSON.parse(data) });
+  } else if (['stop', 'resume'].includes(action)) result = await controlDelivery({ ...base, action });
+  else throw new Error('Unknown delivery command.');
+  output(JSON.stringify(result, null, 2));
+  return 0;
+}

package/src/delivery-hooks/desktop.js

@@ -0,0 +1,40 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+export const HOOK_SETUP = Object.freeze({
+  codex: { settingsUrl: 'codex://settings', docsUrl: 'https://learn.chatgpt.com/docs/hooks', command: '/hooks' },
+  claude: { settingsUrl: null, docsUrl: 'https://code.claude.com/docs/en/hooks-guide', command: '/hooks' },
+});
+
+export async function deliveryHookStatus({ root = rootDirectory(), now = Date.now() } = {}) {
+  const records = await reconcileRecords({ root, now });
+  return {
+    providers: Object.fromEntries(['codex', 'claude'].map(provider => {
+      const latest = records.filter(r => r.provider === provider).sort((a, b) => b.observedAt - a.observedAt)[0];
+      return [provider, { ...HOOK_SETUP[provider], state: latest ? 'observed' : 'not_observed', lastObservedAt: latest?.observedAt || null }];
+    })),
+    runs: records.filter(r => r.run).sort((a, b) => b.run.updatedAt - a.run.updatedAt).slice(0, 30).map(r => ({
+      provider: r.provider, session: r.session, objective: r.run.objective, state: r.run.state, reason: r.run.reason,
+      continuations: r.run.continuations, maxContinuations: r.run.maxContinuations, deadline: r.run.deadline,
+      needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted'].includes(r.run.state), updatedAt: r.run.updatedAt,
+    })),
+  };
+}
+
+// Wait for the OS opener to exit. A successful spawn alone does not prove that
+// a custom URL scheme has a registered handler.
+export async function openHookSetup(provider, { platform = process.platform, run = promisify(execFile) } = {}) {
+  const setup = HOOK_SETUP[provider];
+  if (!setup) throw new Error("Unsupported provider.");
+  const targets = platform === "darwin" && setup.settingsUrl ? [setup.settingsUrl, setup.docsUrl] : [setup.docsUrl];
+  for (const url of targets) {
+    try {
+      const command = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+      const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+      await run(command, args, { timeout: 5000, maxBuffer: 4096 });
+      return { opened: true, url };
+    } catch {}
+  }
+  throw new Error("Could not open hook setup. Use /hooks inside your provider.");
+}

package/src/desktop-host.js

@@ -1,3 +1,5 @@
+import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
+import { controlDelivery } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createWindowsDesktopUpdater } from "./windows-desktop-updater.js";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -42,7 +44,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const publish = () => {
     if (closed || relay || !agent) return Promise.resolve();
     if (publishing) return publishing;
-    publishing = Promise.resolve(agent.getDesktopStatus()).then((status) => {
+    publishing = Promise.resolve(agent.getDesktopStatus()).then(async (status) => {
+      status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: join(root, "delivery-hooks") }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
       if (!closed && !relay) emit({ type: "status", status });
     }).finally(() => { publishing = null; });
     return publishing;
@@ -178,6 +181,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
           if (login) await login(root);
           else await openProviderLogin(provider, root);
         }
+        else if (action === "codex_hooks" || action === "claude_hooks") {
+          const provider = action === "codex_hooks" ? "codex" : "claude";
+          await (dependencies.openHookSettings || openHookSetup)(provider);
+        } else if (action === "delivery_stop" || action === "delivery_resume") {
+          await controlDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
+            action: action === "delivery_stop" ? "stop" : "resume" });
+        }
         else if (action === "quit") {
           const status = await agent.getDesktopStatus();
           if (status.tasks.activeCount > 0 && command.force !== true) throw new Error("Tasks are still running. Confirm before quitting.");

package/src/index.js

@@ -70,6 +70,13 @@ if (!configuredWebOrigin) {
 }
 
 async function runCommand(installMode) {
+  if (dispatchArgv[0] === "delivery") {
+    try {
+      const { runDeliveryCommand } = await import("./delivery-hooks/command.js");
+      process.exitCode = await runDeliveryCommand(dispatchArgv.slice(1));
+    } catch (error) { console.error(error.message); process.exitCode = 2; }
+    return;
+  }
   if (dispatchArgv[0] === "sqm") {
     try {
       const { runSqmCommand } = await import("./sqm/command.js");

package/src/local-task.js

@@ -1,3 +1,4 @@
+import { buildWorkflowReportingInstruction } from "./workflow-reporting.js";
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { EventEmitter, once } from "node:events";
@@ -37,6 +38,10 @@ import {
 } from "./local-task-scenario-packs.js";
 import { createProviderStreamDecoder } from "./provider-stream.js";
 import { signalExecutorProcess } from "./runner.js";
+import {
+  createWorkflowObservationSender,
+  normalizeWorkflowObservationBinding,
+} from "./workflow-observation-sender.js";
 
 export const DEFAULT_LOCAL_TASK_TOKEN_BUDGET = 100_000;
 export const DEFAULT_LOCAL_TASK_TIMEOUT_MS = 10 * 60_000;
@@ -250,6 +255,7 @@ export function createLocalTask({
   timeoutMs = DEFAULT_LOCAL_TASK_TIMEOUT_MS,
   idempotencyKeyHash = null,
   requestFingerprint = null,
+  workflowObservationBinding = null,
 }) {
   validateTaskId(id);
   const now = new Date().toISOString();
@@ -258,6 +264,10 @@ export function createLocalTask({
   const normalizedScenarioPack = normalizeLocalTaskScenarioPack(scenarioPack);
   const scenarioExpectedOutputs =
     localTaskScenarioExpectedOutputs(normalizedScenarioPack);
+  const normalizedWorkflowObservationBinding = normalizeWorkflowObservationBinding(
+    workflowObservationBinding,
+    { provider: backend },
+  );
   return {
     id,
     kind: "local_task",
@@ -295,6 +305,17 @@ export function createLocalTask({
     provider_token_budget: tokenBudget,
     provider_tokens_used: 0,
     token_usage: { records: [] },
+    ...(normalizedWorkflowObservationBinding
+      ? {
+          workflow_observation_binding: normalizedWorkflowObservationBinding,
+          workflow_observation: {
+            status: "pending",
+            workflow_id: normalizedWorkflowObservationBinding.workflow_id,
+            workflow_run_id: normalizedWorkflowObservationBinding.workflow_run_id,
+            development_outcome: "unverified",
+          },
+        }
+      : {}),
     timeout_ms: normalizedTimeout,
     created_at: now,
     updated_at: now,
@@ -326,6 +347,7 @@ export function createLocalTaskRequestFingerprint({
   timeoutMs,
   attachmentManifest,
   scenarioPack,
+  workflowObservationBinding = null,
 }) {
   const normalizedModel = normalizeLocalTaskModel(model);
   const manifest = Array.isArray(attachmentManifest)
@@ -338,6 +360,10 @@ export function createLocalTaskRequestFingerprint({
           sha256: String(item.sha256 || "").toLowerCase(),
         }))
     : [];
+  const normalizedWorkflowObservationBinding = normalizeWorkflowObservationBinding(
+    workflowObservationBinding,
+    { provider: backend },
+  );
   const payload = {
     instruction: String(instruction || "").trim(),
     backend: String(backend || ""),
@@ -351,6 +377,9 @@ export function createLocalTaskRequestFingerprint({
     timeout_ms: normalizeTimeoutMs(timeoutMs),
     attachment_manifest: manifest,
     scenario_pack: normalizeLocalTaskScenarioPack(scenarioPack),
+    ...(normalizedWorkflowObservationBinding
+      ? { workflow_observation_binding: normalizedWorkflowObservationBinding }
+      : {}),
   };
   return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
 }
@@ -362,6 +391,9 @@ export async function startLocalTask(
     environment = process.env,
     persist = persistLocalTask,
     beforeProviderInvocation = null,
+    session = null,
+    apiOrigin = null,
+    observationFetch = globalThis.fetch,
   } = {},
 ) {
   if (!task || task.status !== "queued") throw new Error("Local Task must be queued.");
@@ -441,6 +473,14 @@ export async function startLocalTask(
   // synchronous spawn boundary so a stopped task can never start Provider work.
   if (task.stop_requested || task.status !== "running") return task;
 
+  const observationSender = createWorkflowObservationSender({
+    binding: task.workflow_observation_binding,
+    backend: task.backend,
+    session,
+    apiOrigin,
+    fetchImpl: observationFetch,
+  });
+
   const runtimeTempBase = process.platform === "darwin" ? "/tmp" : tmpdir();
   const runtimeTempRoot = await mkdtemp(
     path.join(runtimeTempBase, `simy-local-task-${task.id}-`),
@@ -512,6 +552,7 @@ export async function startLocalTask(
       stream: "stdout",
       onLine,
       onUsage,
+      onEvent: (event) => observationSender?.observe(event),
       onTerminalError: (message) => {
         task.error ||= message;
         task.reason_code ||= "provider_execution_failed";
@@ -559,6 +600,9 @@ export async function startLocalTask(
         (total, item) => total + providerTokenCount(item),
         0,
       );
+      if (observationSender) {
+        task.workflow_observation = await observationSender.flush();
+      }
 
       let artifacts = [];
       let scenarioAcceptance = null;
@@ -708,6 +752,9 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
     provider_token_budget: task.provider_token_budget,
     provider_tokens_used: task.provider_tokens_used,
     token_usage: structuredClone(task.token_usage),
+    ...(task.workflow_observation
+      ? { workflow_observation: structuredClone(task.workflow_observation) }
+      : {}),
     timeout_ms: task.timeout_ms,
     created_at: task.created_at,
     updated_at: task.updated_at,
@@ -723,6 +770,7 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
           outputs_root_expected: task.outputs_root_expected,
           idempotency_key_hash: task.idempotency_key_hash || null,
           request_fingerprint: task.request_fingerprint || null,
+          workflow_observation_binding: task.workflow_observation_binding || null,
         }
       : {}),
   };
@@ -912,6 +960,10 @@ export async function localTaskArtifact(task, artifactId) {
 }
 
 function restoreLocalTask(snapshot) {
+  const workflowObservationBinding = normalizeWorkflowObservationBinding(
+    snapshot.workflow_observation_binding,
+    { provider: snapshot.backend },
+  );
   return {
     ...snapshot,
     outputs_root_expected:
@@ -925,6 +977,8 @@ function restoreLocalTask(snapshot) {
     scenario_acceptance: snapshot.scenario_acceptance || null,
     warnings: Array.isArray(snapshot.warnings) ? snapshot.warnings : [],
     token_usage: snapshot.token_usage || { records: [] },
+    workflow_observation_binding: workflowObservationBinding,
+    workflow_observation: snapshot.workflow_observation || null,
     child: null,
     operation_promise: null,
     stop_requested: false,
@@ -957,6 +1011,7 @@ function localTaskProviderInstruction(task) {
     : null;
   return [
     "You are the local executor for a SIMY Local Task, not an Agentic Loop.",
+    buildWorkflowReportingInstruction(),
     "Complete this bounded task once. Do not create Git branches, commits, pull requests, audits, or automatic retries.",
     `Permission mode: ${task.permission_mode}.`,
     `Task workspace: ${task.workspace_path}`,

package/src/orchestrator/audit.js

@@ -16,6 +16,7 @@ import {
 } from "./pr-preparation.js";
 import {
   completionEvidenceChecks,
+  hasUserOutcomeProof,
   normalizeVisualReview,
 } from "./completion-contract.js";
 
@@ -340,6 +341,8 @@ export function evaluatePrReadiness(charter, attempt) {
     readinessCheck("minimum_independent_binding",
       Boolean(independentAudit?.evidence_identity_sha256 && independentAudit.evidence_identity_sha256 === independentAuditEvidenceIdentity(attempt)),
       "Independent review must cover the current head, base, CI, skips, preparation rows, companion revisions, and minimum evidence."),
+    readinessCheck("user_outcome_proven", hasUserOutcomeProof(independentAudit?.coverage_review),
+      "Independent review must observe the original user outcome and cite its evidence."),
     readinessCheck("implementation_gate", attempt.audit?.passed === true, "Implementation gate must pass."),
     readinessCheck("pr_preparation_gate", preparation.passed, preparation.detail),
     readinessCheck(

package/src/orchestrator/checklist-continuation.js

@@ -8,12 +8,12 @@ export const ACCEPTANCE_EVIDENCE_PATH = fileURLToPath(
 export function buildChecklistContinuationInstruction({ auditor = false } = {}) {
   return section("checklist_continuation_contract", [
     `The table is a progress checkpoint, not the deliverable or a stopping condition. Read: ${ACCEPTANCE_EVIDENCE_PATH}`,
-    "Show the complete 依頼チェックリスト with columns #, ご依頼, 現状, 判定 after chartering, each evaluated attempt, and in the final receipt. Preserve stable criterion IDs, all rows and both applicable evidence layers. ✅ requires current valid passing evidence for every applicable layer; ❌ means an observed failure; 🟡 means pending, missing, stale, blocked or unverifiable evidence. Show counts and highest proven state.",
-    "After presenting any non-green row, classify its cause and immediately take the next safe authorized action: implement missing behavior, repair a failure, exercise an untested path, collect missing evidence, or rerun stale verification. Re-observe the same criterion against the current candidate, run the validator, update the table, and repeat until every applicable requested outcome and gate for the authorized endpoint is verified. A next-action list without performing feasible actions is not completion. Never require another continue request merely because a table was shown.",
+    "Maintain the complete 依頼チェックリスト with columns #, ご依頼, 現状, 判定 in the evidence record after chartering, each evaluated attempt, and in the final receipt. User-facing reporting follows workflow_reporting_contract; show the full table only when requested or when it is the most useful requested answer, never as mandatory commentary. Preserve stable criterion IDs, all rows and both applicable evidence layers. ✅ requires current valid passing evidence for every applicable layer; ❌ means an observed failure; 🟡 means pending, missing, stale, blocked or unverifiable evidence. Retain counts and highest proven state in that record.",
+    "After observing any non-green row, classify its cause and immediately take the next safe authorized action: implement missing behavior, repair a failure, exercise an untested path, collect missing evidence, or rerun stale verification. Re-observe the same criterion against the current candidate, run the validator, update the table, and repeat until every applicable requested outcome and gate for the authorized endpoint is verified. A next-action list without performing feasible actions is not completion. Never require another continue request merely because a table was shown.",
     "For CI or other in-progress dependencies, use the available bounded wait/recheck or approved monitoring mechanism and maintain progress communication. Unchanged external state is not itself a blocker. Do not start duplicate jobs or busy-poll. Recheck current revision/results, repair authorized failures, and keep waiting only within the existing time, attempt and cost limits. If waiting cannot continue, report the concrete limit and explicit resumption condition; do not silently abandon it or promise an unscheduled follow-up.",
     "If a row genuinely requires new authority, credentials, a user/product decision, an unavailable dependency or an exhausted safety budget, retain it as non-green and record affected IDs, evidence of the blocker, safe alternatives attempted, exact missing input, owner and resumption trigger. Continue independent in-scope work. Stop with blocked, best_available, failed or cancelled as appropriate, explicitly unfinished, not verified_complete. Never raise budgets, bypass a stop, or expand authority to force green.",
     "Do not end successfully while a safe authorized repair, verification or bounded wait remains. All-green applies to the frozen authorized endpoint: PR-only work does not authorize merge/deploy, but a PR URL, an improvement PR, an issue, a narrower test or a future plan does not satisfy an unmet outcome. Never drop/merge away rows, weaken criteria, relabel applicable checks as not_applicable, recolor unknowns, or copy new digests onto old evidence to force green. Do not change the requested endpoint to match the work already completed.",
-    "Before the final response, independently reconcile the original request with all criterion IDs and current evidence, check remaining endpoint gates, and display the full table and explicit disposition. Distinguish a partial artifact from verified completion and state both yellow/red counts and what remains. A pr_ready_for_review or blocked controller state is not proof of overall completion. These instructions strengthen continuation and reporting; they do not add a background scheduler or remove controller limits.",
+    "Before the final response, independently reconcile the original request with all criterion IDs and current evidence, check remaining endpoint gates, and preserve the full table and explicit disposition in the evidence record. Distinguish a partial artifact from verified completion and disclose material remaining outcomes in the requested response format; keep yellow/red counts in the record. A pr_ready_for_review or blocked controller state is not proof of overall completion. These instructions strengthen continuation and reporting; they do not add a background scheduler or remove controller limits.",
     auditor
       ? "Remain read-only. Check that the executor performed feasible follow-up actions after non-green tables. Report premature stopping, omitted rows, unsupported green claims, or a blocker without evidence as findings, alongside exact criterion IDs and the necessary next action. Do not approve from a table's colors or the executor's completion wording."
       : "Execute the continuation within this attempt instead of merely returning a yellow table or delegating feasible remaining work to the requester. Return control honestly at a genuine boundary; never fabricate completion evidence.",

package/src/orchestrator/completion-contract.js

@@ -4,6 +4,13 @@ import { cleanString, stringArray } from "./shared.js";
 export const COMPLETION_CONTRACT_VERSION = 2;
 const criterionIdPattern = /^[A-Za-z][A-Za-z0-9]*(?:[-_.][A-Za-z0-9]+)*$/;
 
+export function hasUserOutcomeProof(coverage) {
+  const proof = coverage?.user_outcome;
+  return proof?.passed === true && Boolean(cleanString(proof.verification_method)) &&
+    Boolean(cleanString(proof.observed_result)) && Array.isArray(proof.evidence_refs) &&
+    proof.evidence_refs.some((ref) => Boolean(cleanString(ref)));
+}
+
 export function buildCompletionContract({
   inherited,
   requirement,

package/src/orchestrator/contract.js

@@ -10,6 +10,7 @@ import {
 import { budgetState, resolveRunBudgets } from "./budget.js";
 import { classifyRisk } from "./risk.js";
 import { buildCompletionContract } from "./completion-contract.js";
+import { freezeObjective } from "./outcome-monitor.js";
 import { defaultPrPreparationContract } from "./pr-preparation.js";
 import {
   DESKTOP_EXECUTION_TARGET,
@@ -56,11 +57,11 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
     cleanString(charterContext.acceptance_criteria_source) === "explicit"
       ? "explicit"
       : acceptanceCriteria.length > 0 &&
-          cleanString(charterContext.acceptance_criteria_source) === "default"
-        ? "default"
+          cleanString(charterContext.acceptance_criteria_source) === "request"
+        ? "request"
         : acceptanceCriteria.length > 0
           ? "explicit"
-          : "default";
+          : "request";
   const inheritedRequiredChecks = stringArray(charterContext.required_checks);
   const inheritedNonGoals = stringArray(charterContext.non_goals);
   const inheritedArtifacts = stringArray(charterContext.artifacts_required);
@@ -71,7 +72,7 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
     acceptanceCriteria.length > 0
       ? acceptanceCriteria
       : [
-          "The requested change is implemented without unrelated scope.",
+          cleanString(request.requirement),
           "Relevant tests pass and are recorded.",
           `A pull request targets ${baseBranch}.`,
         ];
@@ -216,6 +217,7 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
     updated_at: now,
   };
   snapshot.budget = budgetState(snapshot);
+  freezeObjective(snapshot.charter);
   return snapshot;
 }