@awak-app/simy-cli 0.5.71 → 0.5.73

package/src/backend-executable.js

@@ -1,5 +1,7 @@
 import spawn from "cross-spawn";
 import os from "node:os";
+import { readdir } from "node:fs/promises";
+import { readdirSync, statSync } from "node:fs";
 import path from "node:path";
 
 const MACOS_CODEX_BINARY = "/Applications/ChatGPT.app/Contents/Resources/codex";
@@ -25,11 +27,12 @@ export async function resolveBackendExecutable(backend, options = {}) {
 
 export async function inspectBackendExecutable(
   backend,
-  { spawnImpl = spawn, candidates = backendCandidates(backend), timeoutMs = 5_000, signal } = {},
+  { spawnImpl = spawn, candidates, timeoutMs = 5_000, signal, discoveryOptions = {} } = {},
 ) {
   const assertActive = () => { if (signal?.aborted) throw Object.assign(new Error('Backend inspection was cancelled.'), { code: 'cancelled' }); };
   assertActive();
   const policy = versionPolicy(backend);
+  candidates ??= [...backendCandidates(backend, discoveryOptions), ...await bundledClaudeCandidates(backend, discoveryOptions)];
   for (const candidate of [...new Set(candidates.filter(Boolean))]) {
     assertActive();
     const probe = await probeExecutable(candidate, { spawnImpl, timeoutMs, signal });
@@ -85,7 +88,7 @@ export function backendCandidates(backend, {
       "claude",
       // Desktop launch environments may predate the installer's PATH update.
       paths.join(userHome, ".local", "bin", platform === "win32" ? "claude.exe" : "claude"),
-      ...(platform === "darwin" ? ["/opt/homebrew/bin/claude", "/usr/local/bin/claude"] : []),
+      ...(platform === "darwin" ? ["/opt/homebrew/bin/claude", "/usr/local/bin/claude", ...claudeDesktopCandidates(userHome)] : []),
     ];
   }
   return [
@@ -95,6 +98,46 @@ export function backendCandidates(backend, {
   ];
 }
 
+// Claude Desktop can install below <version>/<content hash>/claude.app while
+// an older PATH wrapper still points at <version>/claude.app. Discover only the
+// known app layout; never recursively execute arbitrary files from user folders.
+export async function bundledClaudeCandidates(backend, { platform = process.platform, home = os.homedir(), readDirectory = readdir } = {}) {
+  if (backend !== "claude" || platform !== "darwin") return [];
+  const root = path.posix.join(home, "Library", "Application Support", "Claude", "claude-code");
+  const entries = async target => { try { return await readDirectory(target, { withFileTypes: true }); } catch { return []; } };
+  const versions = (await entries(root)).filter(item => item.isDirectory() && /^\d+\.\d+\.\d+$/.test(item.name))
+    .sort((a, b) => compareVersions(b.name, a.name)).slice(0, 8);
+  const result = [];
+  for (const version of versions) {
+    const base = path.posix.join(root, version.name);
+    const hashes = (await entries(base)).filter(item => item.isDirectory() && /^[a-f0-9]{8,128}$/i.test(item.name)).slice(0, 8);
+    for (const hash of hashes) result.push(path.posix.join(base, hash.name, "claude.app", "Contents", "MacOS", "claude"));
+    result.push(path.posix.join(base, "claude.app", "Contents", "MacOS", "claude"));
+  }
+  return result;
+}
+// Desktop installs use either <version>/claude.app or <version>/<hash>/claude.app.
+// Only inspect these two known levels; never recurse through arbitrary home paths
+// or descend through version/hash directory symlinks. Existing explicit/PATH installs retain priority.
+function claudeDesktopCandidates(home) {
+  const root = path.join(home, "Library", "Application Support", "Claude", "claude-code");
+  const directories = directory => {
+    try { return readdirSync(directory, { withFileTypes: true }).filter(entry => entry.isDirectory()).map(entry => entry.name); }
+    catch { return []; }
+  };
+  return directories(root).filter(name => /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(name))
+    .sort((left, right) => compareVersions(right, left)).slice(0, 32)
+    .flatMap(version => {
+      const versionRoot = path.join(root, version);
+      const bundle = directory => path.join(directory, "claude.app", "Contents", "MacOS", "claude");
+      return [bundle(versionRoot), ...directories(versionRoot)
+        .filter(name => /^[a-zA-Z0-9_-]{8,128}$/.test(name)).sort().slice(0, 8)
+        .map(hash => bundle(path.join(versionRoot, hash)))];
+    }).filter(candidate => {
+      try { return statSync(candidate).isFile(); } catch { return false; }
+    });
+}
+
 export function parseBackendVersion(output) {
   const match = String(output || "").match(/(?:^|\s|v)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?=\s|$|\))/);
   return match?.[1] ?? null;

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.71";
+export const CLI_VERSION = "0.5.73";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/README.md

@@ -31,6 +31,28 @@ keyed by provider and session ID and bound to the canonical working directory.
 Historical hook observations do not prove hooks are still enabled. See the
 bundled delivery-loop skill for checkpoint commands and explicit recovery.
 
+Managed tasks may explicitly select `--continuation-policy progress`. Existing
+tasks without that choice keep their bounded contract. Progress mode treats the
+ordinary time, continuation and token thresholds as warnings, with independent
+hard ceilings of 24 hours from the original start, 50 continuations and, on the
+host-observed Codex channel, 15 million provider tokens. Claude live hooks expose
+no trustworthy usage stream; their status explicitly reports that token limits
+are unsupported. Required approvals, missing observed usage, manual stops and
+unreconciled effects continue to block dispatch.
+
+The host records passing, failed and unevaluated frozen acceptance checks.
+Provider summaries, test counts, renamed evidence and restored old criteria
+cannot manufacture progress. Three attempts without new verified criteria, or
+30 minutes without verified progress at a dispatch/checkpoint boundary, pause
+the original run. Active tools are allowed to reach their checkpoint within the
+hard ceiling; activity alone does not prove progress.
+
+`delivery extend` raises explicitly selected ceilings within those global caps.
+It records the old and new bounds, preserves run identity, usage, checkpoints,
+criteria and approvals, and does not start a new provider turn. A separate resume
+is required after an exhausted run becomes paused. `delivery continuation_policy`
+requires an explicit choice and never infers progress consent from an extension.
+
 ## Project 実装状況 (dev-work) hook
 
 `dev-work.mjs` runs on Stop in both distributions. In a Git work tree with a

package/src/codex-plugins/simy/hooks/continuation-policy.mjs

@@ -0,0 +1,27 @@
+// Missing policy means the persisted legacy budget contract, never implicit consent.
+export const CONTINUATION_POLICIES = Object.freeze(["bounded", "progress"]);
+export const MAX_COMPLETION_TOKENS = 15_000_000;
+export const DEFAULT_COMPLETION_ATTEMPT_CEILING = 50;
+
+export function continuationMode(value) {
+  if (value === undefined || value === null) return "bounded";
+  if (!CONTINUATION_POLICIES.includes(value)) throw new Error("Invalid continuation policy.");
+  return value;
+}
+
+export function progressLimits(input = {}) {
+  return {
+    continuation_policy: continuationMode(input.continuation_policy),
+    provider_token_ceiling: finiteLimit(input.provider_token_ceiling, MAX_COMPLETION_TOKENS, MAX_COMPLETION_TOKENS),
+    attempt_ceiling: finiteLimit(input.attempt_ceiling, DEFAULT_COMPLETION_ATTEMPT_CEILING, 100),
+    max_no_progress_attempts: finiteLimit(input.max_no_progress_attempts, 3, 20),
+  };
+}
+
+function finiteLimit(value, fallback, maximum) {
+  if (value === undefined || value === null) return fallback;
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new Error(`Continuation ceiling must be an integer between 1 and ${maximum}.`);
+  }
+  return value;
+}

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -8,6 +8,8 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
 import { associationContract, validateAssociationResult } from './action-association.mjs';
+import { continuationMode, MAX_COMPLETION_TOKENS } from './continuation-policy.mjs';
+import { evaluateOutcomeProgress } from './outcome-progress.mjs';
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
@@ -386,7 +388,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   const criteria = config.acceptanceCriteria.map((item, index) => {
     if (typeof item !== 'object' || !item || !text(item.description, 500)) throw new Error('Each acceptance criterion needs a description.');
     const id = text(item.id, 80) || `criterion-${index + 1}`;
-    if (!/^[A-Za-z0-9_-]+$/.test(id) || ['__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
+    if (!/^[A-Za-z0-9_-]+$/.test(id) || ['USER-GOAL', '__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
     const check = item.check || { type: 'manual' };
     if (!['manual', 'file_exists', 'file_contains', 'file_equals'].includes(check.type)) throw new Error('Unsupported acceptance check.');
     if (check.type !== 'manual' && (!text(check.path, 500) || isAbsolute(check.path) || check.path.split(/[\\/]/).includes('..'))) throw new Error('Acceptance file must be relative to the task directory.');
@@ -414,6 +416,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   const autoRecovery = config.autoRecovery === true && exactCodexSession && Boolean(resumeModel) &&
     (appServerChannel || config.resumeChannel === 'codex_exec' && Boolean(observedProcess?.identity));
   if (config.maxTokens !== undefined && !(provider === 'codex' && appServerChannel)) throw new Error('Provider token budgets require the host-observed Codex app-server channel.');
+  if (config.providerTokenCeiling !== undefined && !(provider === 'codex' && appServerChannel)) throw new Error('Provider token ceilings require the host-observed Codex app-server channel.');
   const managed = { taskId: randomUUID(), thread: { provider, id: session },
     actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
@@ -421,6 +424,9 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     maxNoProgressMinutes: positive(config.maxNoProgressMinutes, 30, 1440), lastVerifiedProgressAt: now,
     maxTokens: config.maxTokens === undefined ? null : positive(config.maxTokens, null, Number.MAX_SAFE_INTEGER), tokensUsed: 0, usageAvailable: null,
     noProgress: 0, verifiedRevision: 0, consumedVerifiedRevision: 0, notification: null, notificationKey: null,
+    continuationPolicy: continuationMode(config.continuationPolicy),
+    providerTokenCeiling: appServerChannel ? positive(config.providerTokenCeiling, MAX_COMPLETION_TOKENS, MAX_COMPLETION_TOKENS) : null,
+    budgetCapability: { time: true, continuations: true, providerTokens: appServerChannel },
     autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
     autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
     capability: appServerChannel && autoRecovery ? 'codex_app_server' : autoRecovery ? 'codex_exec_resume' : 'live_hook',
@@ -430,7 +436,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (initialPlan) recordDecision(managed, initialPlan, Date.now());
   return managed;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, managed, admission,
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, managed, admission,
   liveHookAdmission, autoContinueEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   cwd = await realpath(cwd);
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
@@ -446,7 +452,11 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     }
     if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
-    const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null, now);
+    const managedConfig = managed && { ...(managed === true ? {} : managed),
+      ...(continuationPolicy === undefined ? {} : { continuationPolicy }),
+      ...(providerTokenCeiling === undefined ? {} : { providerTokenCeiling }) };
+    const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
+    if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
     if (managedState && previous.associationTaskId) {
       managedState.taskId = previous.associationTaskId;
@@ -458,6 +468,11 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     const queued = managedState?.capability === 'codex_app_server';
     const run = { id: randomUUID(), objective: text(objective), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
       deadline: now + positive(maxMinutes, 30, 1440) * 60_000, maxContinuations: positive(maxContinuations, 6, 50), maxFailures: positive(maxFailures, 3, 10),
+      ...(managedState?.continuationPolicy === 'progress' ? {
+        hardDeadline: now + positive(hardMaxMinutes ?? managedConfig.hardMaxMinutes, 1440, 1440) * 60_000,
+        hardMaxContinuations: positive(hardMaxContinuations ?? managedConfig.hardMaxContinuations, 50, 50),
+        budgetWarnings: [], budgetExtensionHistory: [],
+      } : {}),
       continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
       ...(queued ? { recoveryCause: 'session_supervision' } : {}), managed: managedState };
     if (waiting) escalate(run, run.reason);
@@ -552,6 +567,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     }
     run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep, blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
     run.revision += 1; run.updatedAt = now;
+    recordManagedOutcomeProgress(run, now);
     if (run.managed && effectiveStatus === 'completed') {
       const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
       if (pending.length) { run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`; }
@@ -582,7 +598,7 @@ export async function checkpointActionAssociation({ root, provider, session, cwd
     let result;
     try { result = validateAssociationResult(job, checkpoint); }
     catch { result = { result: 'no_match', actionId: null, reason: 'Invalid association evidence; original work continues.', invalid: true }; }
-    if (now >= run.deadline) result = { result: 'no_match', actionId: null, reason: 'Association budget expired.', invalid: true };
+    if (managedBudgetReason(run, now)) result = { result: 'no_match', actionId: null, reason: 'Association budget expired.', invalid: true };
     managed.phase = job.saved.phase; managed.plan = job.saved.plan; managed.decision = job.saved.decision;
     run.nextStep = job.saved.nextStep;
     if (association.invalidated || association.namespace !== job.namespace) result = { result: 'no_match', actionId: null, reason: 'Association account context changed.', invalid: true };
@@ -608,7 +624,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     if (!run || record.cwd !== cwd || run.managed?.phase !== 'understanding' ||
         TERMINAL.has(run.state) || ['blocked', 'paused', 'recovery_required', 'verification_pending'].includes(run.state)) throw new Error('No active session understanding turn.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Session understanding lease changed; checkpoint discarded.');
-    if (now >= run.deadline) throw new Error('Session understanding deadline expired.');
+    if (managedBudgetReason(run, now)) throw new Error('Session understanding deadline expired.');
     const decision = run.managed.decision;
     const result = checkpoint.actionResult;
     if (decision?.action.kind !== 'read' || result?.decisionId !== decision.id || !['observed', 'failed', 'not_run'].includes(result.status) || !text(result.summary, 300)) throw new Error('Understanding result must match the selected read decision.');
@@ -663,30 +679,49 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     return record;
   });
 }
+function newVerifiedCriterion(run, id, now) {
+  const managed = run.managed;
+  if (managed.continuationPolicy === 'progress') {
+    const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria }));
+    if (managed.progressObjectiveDigest !== objectiveDigest) {
+      managed.progressObjectiveDigest = objectiveDigest;
+      managed.verifiedCriterionHistory = [];
+    }
+    if (managed.verifiedCriterionHistory.includes(id)) return;
+    managed.verifiedCriterionHistory.push(id);
+  } else if (Object.hasOwn(managed.verified, id)) return;
+  managed.verifiedRevision += 1;
+  managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? run.startedAt, now);
+}
 export async function verifyAutomaticCriteria(record, now) {
   const managed = record.run.managed;
+  managed.criterionObservations = {};
+  const observe = (criterion, passed, detail, sha256 = null) => {
+    managed.criterionObservations[criterion.id] = { criterion_id: criterion.id, passed,
+      verification_method: `host_${criterion.check.type}`, observed_result: detail,
+      evidence_refs: [`host-check:${managed.taskId}:${criterion.id}:${sha256 || 'failed'}`] };
+  };
+  const failed = (criterion, detail) => { delete managed.verified[criterion.id]; observe(criterion, false, detail); };
   for (const criterion of managed.acceptanceCriteria) {
     if (criterion.check.type === 'manual') continue;
     const path = criterion.check.type === 'file_equals' ? criterion.check.exactPath || criterion.check.path : criterion.check.path;
-    if (!path) { delete managed.verified[criterion.id]; continue; }
+    if (!path) { failed(criterion, 'Frozen acceptance file path is absent'); continue; }
     const file = resolve(record.cwd, path);
     const rel = relative(record.cwd, file);
-    if (rel.startsWith('..') || isAbsolute(rel)) { delete managed.verified[criterion.id]; continue; }
+    if (rel.startsWith('..') || isAbsolute(rel)) { failed(criterion, 'Acceptance path is outside the enrolled workspace'); continue; }
     try {
       const actual = await realpath(file);
       const actualRel = relative(record.cwd, actual);
-      if (actualRel.startsWith('..') || isAbsolute(actualRel)) { delete managed.verified[criterion.id]; continue; }
+      if (actualRel.startsWith('..') || isAbsolute(actualRel)) { failed(criterion, 'Resolved acceptance path is outside the enrolled workspace'); continue; }
       const info = await stat(actual);
-      if (!info.isFile() || info.size > 1024 * 1024) { delete managed.verified[criterion.id]; continue; }
+      if (!info.isFile() || info.size > 1024 * 1024) { failed(criterion, 'Acceptance file is not a bounded regular file'); continue; }
       const content = await readFile(actual);
-      if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { delete managed.verified[criterion.id]; continue; }
-      if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { delete managed.verified[criterion.id]; continue; }
-      if (!Object.hasOwn(managed.verified, criterion.id)) {
-        managed.verifiedRevision += 1;
-        managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? record.run.startedAt, now);
-      }
+      if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { failed(criterion, 'Observed file lacks the required frozen content'); continue; }
+      if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { failed(criterion, 'Observed file differs from the frozen exact contents'); continue; }
+      newVerifiedCriterion(record.run, criterion.id, now);
       managed.verified[criterion.id] = { source: criterion.check.type, checkedAt: now, path, sha256: digest(content) };
-    } catch { delete managed.verified[criterion.id]; }
+      observe(criterion, true, 'Frozen file acceptance check passed', digest(content));
+    } catch { failed(criterion, 'Acceptance file could not be independently read'); }
   }
 }
 export async function verifyDelivery({ root = rootDirectory(), provider, session, taskId, criterionId, now = Date.now() }) {
@@ -696,10 +731,7 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     if (taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
     if (!criterion || criterion.check.type !== 'manual') throw new Error('Only manual criteria can be verified by the user.');
-    if (!Object.hasOwn(run.managed.verified, criterionId)) {
-      run.managed.verifiedRevision += 1;
-      run.managed.lastVerifiedProgressAt = Math.max(run.managed.lastVerifiedProgressAt ?? run.startedAt, now);
-    }
+    newVerifiedCriterion(run, criterionId, now);
     run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
     if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
       await verifyAutomaticCriteria(record, now);
@@ -742,13 +774,70 @@ export function prepareRecoveryDiagnosis(run, now = Date.now()) {
   run.nextStep = decision.action.summary;
   return decision;
 }
-export function managedBudgetReason(run, now = Date.now()) {
-  if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) return 'Original delivery time, continuation, or failure budget exhausted.';
+export function deliveryBudgetState(run, now = Date.now(), { checkProgress = true } = {}) {
   const managed = run.managed;
-  if (managed?.usageBlocked || managed?.maxTokens && managed.tokensUsed >= managed.maxTokens) return 'Provider token budget exhausted or reliable usage unavailable.';
-  if (managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) return 'No verified acceptance progress within the configured time limit.';
-  if (managed && managed.noProgress >= managed.maxNoProgress) return 'No verified acceptance progress within the configured continuation limit.';
-  return null;
+  const progress = managed?.continuationPolicy === 'progress';
+  const deadline = progress ? run.hardDeadline ?? run.startedAt + 1440 * 60_000 : run.deadline;
+  const maxContinuations = progress ? run.hardMaxContinuations ?? 50 : run.maxContinuations;
+  const tokenCeiling = progress ? managed.providerTokenCeiling : managed?.maxTokens;
+  const warnings = [];
+  const checkpointDetail = run.checkpoint ? '' : ' No progress checkpoint was recorded.';
+  if (progress) {
+    if (now >= run.deadline) warnings.push('soft_time_limit');
+    if (run.continuations >= run.maxContinuations) warnings.push('soft_continuation_limit');
+    if (managed.maxTokens && managed.tokensUsed >= managed.maxTokens) warnings.push('soft_token_limit');
+  }
+  let reason = null;
+  if (now >= deadline) {
+    reason = progress ? 'Delivery hard time ceiling reached.' : `Delivery time limit exhausted.${checkpointDetail}`;
+  } else if (run.continuations >= maxContinuations) {
+    reason = progress ? 'Delivery hard continuation ceiling reached.' : `Delivery continuation limit exhausted (${run.continuations}/${maxContinuations}).${checkpointDetail}`;
+  } else if (run.failures >= run.maxFailures) {
+    reason = `Delivery failure limit exhausted (${run.failures}/${run.maxFailures}).${checkpointDetail}`;
+  } else if (managed?.usageBlocked) {
+    reason = `Reliable provider token usage is unavailable; budgeted continuation is blocked.${checkpointDetail}`;
+  } else if (tokenCeiling && managed.tokensUsed >= tokenCeiling) {
+    reason = progress ? 'Provider hard token ceiling reached.' : `Provider token budget exhausted (${managed.tokensUsed}/${tokenCeiling}).${checkpointDetail}`;
+  } else if (checkProgress && managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) {
+    reason = 'No verified acceptance progress within the configured time limit.';
+  } else if (checkProgress && managed && managed.noProgress >= managed.maxNoProgress) {
+    reason = 'No verified acceptance progress within the configured continuation limit.';
+  }
+  return { continuationPolicy: progress ? 'progress' : 'bounded', deadline, maxContinuations, tokenCeiling, warnings, reason };
+}
+export function managedBudgetReason(run, now = Date.now(), options) {
+  return deliveryBudgetState(run, now, options).reason;
+}
+export function managedDispatchDeadline(run) {
+  return deliveryBudgetState(run).deadline;
+}
+
+function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
+  const managed = run.managed;
+  if (managed?.continuationPolicy !== 'progress') return;
+  const current = managed.acceptanceCriteria.map(criterion => ({ id: criterion.id, statement: criterion.description }));
+  const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria }));
+  const results = current.flatMap(criterion => {
+    const observation = managed.verified[criterion.id];
+    return observation ? [{ criterion_id: criterion.id, passed: true,
+      verification_method: observation.source === 'user' ? 'explicit_user_verification' : `host_${observation.source}`,
+      observed_result: `Frozen ${criterion.id} acceptance check verified`,
+      evidence_refs: [observation.source === 'user' ? `user:${managed.taskId}:${criterion.id}:${observation.checkedAt}`
+        : `host:${criterion.id}:${observation.sha256}`] }]
+      : managed.criterionObservations?.[criterion.id] ? [managed.criterionObservations[criterion.id]] : [];
+  });
+  managed.outcomeProgress = evaluateOutcomeProgress({
+    criteria: current, objectiveDigest, objectiveVersion: managed.understandingRevision || 1,
+    criterionResults: results, assessmentAvailable,
+    previous: managed.outcomeProgress, maxNoProgressAttempts: managed.maxNoProgress,
+    findings: run.checkpoint?.status === 'blocked' ? [{
+      code: run.checkpoint.blocker, blocker_kind: run.checkpoint.blocker === 'external_dependency' ? 'external' : 'human',
+      explanation: run.checkpoint.summary,
+    }] : [],
+  });
+  managed.noProgress = managed.outcomeProgress.no_progress_attempts;
+  if (managed.outcomeProgress.has_progress) managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? run.startedAt, now);
+  managed.progressCheckpointRevision = run.revision;
 }
 // Manual/legacy runs have no marker and retain their existing controls.
 export function automaticContinuationAllowed(record) {
@@ -759,6 +848,7 @@ export function automaticContinuationAllowed(record) {
 export function decideStop(run, now = Date.now()) {
   if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
+  next.budgetWarnings = deliveryBudgetState(next, now).warnings;
   const finish = (state, reason) => { next.state = state; next.reason = reason; next.updatedAt = now; return { run: next, output: {} }; };
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
@@ -776,7 +866,7 @@ export function decideStop(run, now = Date.now()) {
     } else { escalate(next, cp.summary); return finish('blocked', cp.summary); }
   }
   const budgetReason = managedBudgetReason(next, now);
-  if (budgetReason) return finish('budget_exhausted', budgetReason);
+  if (budgetReason) return finish(next.managed?.continuationPolicy === 'progress' && budgetReason.startsWith('No verified') ? 'paused' : 'budget_exhausted', budgetReason);
   const initialHook = next.managed?.awaitingInitialHook && next.revision === 0 && !next.checkpoint;
   const replanHook = next.managed?.capability === 'live_hook' && next.managed.awaitingReplanHook === true;
   const understandingHook = next.managed?.capability === 'live_hook' && (next.managed.awaitingUnderstandingHook === true || next.managed.awaitingAssociationHook === true);
@@ -811,11 +901,13 @@ export function decideStop(run, now = Date.now()) {
     const reportedStep = next.managed.associationCheckpointRevision !== next.revision && next.managed.contextBootstrap && next.managed.phase === 'active' && !next.managed.acceptanceCriteria.length &&
       !['session_understanding', 'action_association'].includes(cp?.kind) && cp?.status === 'in_progress' &&
       next.managed.workHistory?.at(-1)?.result?.status === 'observed' && next.managed.workHistory.at(-1).result.evidence?.length;
-    if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
+    if (next.managed.continuationPolicy === 'progress') {
+      if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind) && (!fresh || next.managed.progressCheckpointRevision !== next.revision)) recordManagedOutcomeProgress(next, now, Boolean(fresh));
+    } else if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
     else if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind)) next.managed.noProgress += 1;
     if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
     next.managed.consumedVerifiedRevision = next.managed.verifiedRevision;
-    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish('failed', 'No verified acceptance progress within the configured continuation limit.'); }
+    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish(next.managed.continuationPolicy === 'progress' ? 'paused' : 'failed', 'No verified acceptance progress within the configured continuation limit.'); }
   }
   next.consumedRevision = next.revision;
   if (initialHook) next.managed.awaitingInitialHook = false;
@@ -1005,7 +1097,11 @@ export function canReplanDelivery(run, provider, now = Date.now()) {
     run.state === 'blocked' && managed.pendingApproval?.denied === true &&
     !managedBudgetReason(run, now));
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, questionId, waitId, answer, action, now = Date.now() }) {
+export function canChangeDeliveryContinuation(run) {
+  return Boolean(run?.managed && ['paused', 'blocked', 'failed', 'budget_exhausted', 'verification_pending', 'recovery_required'].includes(run.state) &&
+    !['pending', 'pending_received', 'transferred'].includes(run.managed.handoff?.status));
+}
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, continuationPolicy, limits, questionId, waitId, answer, action, now = Date.now() }) {
   for (let retry = 0; ; retry += 1) {
     try { return await updateRecord(root, provider, session, record => {
     const run = record?.run;
@@ -1013,6 +1109,52 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
+    if (action === 'extend' || action === 'continuation_policy') {
+      if (!canChangeDeliveryContinuation(run)) throw new Error('Pause a managed task before changing its continuation bounds.');
+      if (action === 'continuation_policy') {
+        if (!['bounded', 'progress'].includes(continuationPolicy)) throw new Error('Select an explicit continuation policy.');
+        run.managed.continuationPolicy = continuationMode(continuationPolicy);
+        if (continuationPolicy === 'progress') {
+          run.hardDeadline ??= run.startedAt + 1440 * 60_000;
+          run.hardMaxContinuations ??= 50;
+          if (run.managed.resumeChannel === 'codex_app_server') run.managed.providerTokenCeiling ??= MAX_COMPLETION_TOKENS;
+        }
+        run.continuationPolicyHistory ||= [];
+        run.continuationPolicyHistory.push({ policy: continuationPolicy, at: now, source: 'explicit_controller_selection' });
+      } else {
+        if (!limits || typeof limits !== 'object' || Array.isArray(limits) || !Object.keys(limits).length ||
+            Object.keys(limits).some(key => !['hardMaxMinutes', 'hardMaxContinuations', 'providerTokenCeiling'].includes(key))) throw new Error('Supply explicit continuation ceiling increases.');
+        const progress = run.managed.continuationPolicy === 'progress';
+        const before = { deadline: progress ? run.hardDeadline : run.deadline,
+          maxContinuations: progress ? run.hardMaxContinuations : run.maxContinuations,
+          tokens: progress ? run.managed.providerTokenCeiling : run.managed.maxTokens };
+        const after = { ...before };
+        if (limits.hardMaxMinutes !== undefined) {
+          after.deadline = run.startedAt + positive(limits.hardMaxMinutes, null, 1440) * 60_000;
+          if (after.deadline <= before.deadline) throw new Error('Extension must increase the original deadline within 24 hours of its start.');
+        }
+        if (limits.hardMaxContinuations !== undefined) {
+          after.maxContinuations = positive(limits.hardMaxContinuations, null, 50);
+          if (after.maxContinuations <= before.maxContinuations) throw new Error('Extension must increase the continuation ceiling within 50 turns.');
+        }
+        if (limits.providerTokenCeiling !== undefined) {
+          if (run.managed.resumeChannel !== 'codex_app_server') throw new Error('Provider token ceilings require host-observed Codex usage.');
+          after.tokens = positive(limits.providerTokenCeiling, null, MAX_COMPLETION_TOKENS);
+          if (after.tokens <= (before.tokens || 0)) throw new Error('Extension must increase the provider token ceiling.');
+        }
+        if (after.deadline <= now || after.maxContinuations <= run.continuations || after.tokens && after.tokens <= run.managed.tokensUsed) throw new Error('Extended ceilings must exceed already consumed time, turns, and tokens.');
+        if (progress) { run.hardDeadline = after.deadline; run.hardMaxContinuations = after.maxContinuations; run.managed.providerTokenCeiling = after.tokens; }
+        else { run.deadline = after.deadline; run.maxContinuations = after.maxContinuations; run.managed.maxTokens = after.tokens; }
+        run.budgetExtensionHistory ||= [];
+        run.budgetExtensionHistory.push({ before, after, at: now, source: 'explicit_controller_extension' });
+      }
+      run.budgetWarnings = deliveryBudgetState(run, now).warnings;
+      if (run.state === 'budget_exhausted' && !managedBudgetReason(run, now)) {
+        run.state = 'paused'; run.reason = 'Continuation bounds changed; explicitly resume this same task.';
+      }
+      run.updatedAt = now;
+      return record;
+    }
     if (action === 'dependency_ready') {
       const wait = run.managed?.dependencyWait;
       if (run.state !== 'blocked' || run.blocker !== 'external_dependency' || !wait || wait.id !== waitId ||
@@ -1166,7 +1308,14 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
           run.state = 'completed'; run.reason = run.checkpoint.summary; run.updatedAt = now;
         }
       }
-      if (managedBudgetReason(run, now) && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) { run.state = 'budget_exhausted'; run.reason = managedBudgetReason(run, now); run.updatedAt = now; }
+      const activeTurn = run.managed?.continuationPolicy === 'progress' &&
+        (run.state === 'auto_resuming' || current.runtime?.isRunning === true || run.managed.executionAttempt?.phase === 'dispatching');
+      const budgetState = deliveryBudgetState(run, now, { checkProgress: !activeTurn });
+      run.budgetWarnings = budgetState.warnings;
+      if (budgetState.reason && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) {
+        run.state = run.managed?.continuationPolicy === 'progress' && budgetState.reason.startsWith('No verified') ? 'paused' : 'budget_exhausted';
+        run.reason = budgetState.reason; run.updatedAt = now;
+      }
       else if (run.state === 'active' && observed !== null && observed !== current.process?.identity && current.process?.identity === record.process?.identity) {
         run.state = 'recovery_required'; run.recoveryCause = 'process_exit'; run.reason = run.managed?.autoRecovery ? 'Observed provider process exited. Managed recovery is eligible for a bounded exact-session attempt.' : 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;
       }