@awak-app/simy-cli 0.5.72 → 0.5.73

package/src/local-task.js

@@ -1,3 +1,4 @@
+import { normalizePurposeVerification } from "./purpose-local-proof.js";
 import { buildWorkflowReportingInstruction } from "./workflow-reporting.js";
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -20,6 +21,7 @@ import { promisify } from "node:util";
 
 import { resolveDesktopExecutorCommand } from "./desktop-executor.js";
 import { providerBudgetTokens } from "./orchestrator/budget.js";
+import { continuationMode } from "./continuation-policy.js";
 import {
   buildLocalTaskArtifactRefs,
   MAX_LOCAL_TASK_ARTIFACT_REFS,
@@ -257,15 +259,21 @@ export function createLocalTask({
   expectedOutputs = [],
   scenarioPack = null,
   providerTokenBudget = DEFAULT_LOCAL_TASK_TOKEN_BUDGET,
+  continuationPolicy = "bounded",
+  providerTokenCeiling = MAX_LOCAL_TASK_TOKEN_BUDGET,
   timeoutMs = DEFAULT_LOCAL_TASK_TIMEOUT_MS,
   idempotencyKeyHash = null,
   requestFingerprint = null,
   workflowObservationBinding = null,
   workflowStartIntent = null,
+  purposeVerification = null,
 }) {
   validateTaskId(id);
   const now = new Date().toISOString();
   const tokenBudget = normalizeTokenBudget(providerTokenBudget);
+  const policy = continuationMode(continuationPolicy);
+  const tokenCeiling = normalizeTokenBudget(providerTokenCeiling);
+  if (policy === "progress" && tokenCeiling < tokenBudget) throw new Error("The hard Provider token ceiling cannot be below the notification threshold.");
   const normalizedTimeout = normalizeTimeoutMs(timeoutMs);
   const normalizedScenarioPack = normalizeLocalTaskScenarioPack(scenarioPack);
   const scenarioExpectedOutputs =
@@ -284,6 +292,7 @@ export function createLocalTask({
   return {
     id,
     kind: "local_task",
+    ...(purposeVerification ? { purpose_verification: normalizePurposeVerification(purposeVerification) } : {}),
     idempotency_key_hash: idempotencyKeyHash,
     request_fingerprint: requestFingerprint,
     status: "queued",
@@ -316,6 +325,8 @@ export function createLocalTask({
     error: null,
     reason_code: null,
     provider_token_budget: tokenBudget,
+    continuation_policy: policy,
+    provider_token_ceiling: policy === "progress" ? tokenCeiling : tokenBudget,
     provider_tokens_used: 0,
     token_usage: { records: [] },
     ...(normalizedWorkflowObservationBinding
@@ -368,11 +379,14 @@ export function createLocalTaskRequestFingerprint({
   repository,
   expectedOutputs,
   providerTokenBudget,
+  continuationPolicy = "bounded",
+  providerTokenCeiling = MAX_LOCAL_TASK_TOKEN_BUDGET,
   timeoutMs,
   attachmentManifest,
   scenarioPack,
   workflowObservationBinding = null,
   workflowStartIntent = null,
+  purposeVerification = null,
 }) {
   const normalizedModel = normalizeLocalTaskModel(model);
   const manifest = Array.isArray(attachmentManifest)
@@ -398,6 +412,7 @@ export function createLocalTaskRequestFingerprint({
   }
   const payload = {
     instruction: String(instruction || "").trim(),
+    ...(purposeVerification ? { purpose_verification: normalizePurposeVerification(purposeVerification) } : {}),
     backend: String(backend || ""),
     ...(normalizedModel ? { model: normalizedModel } : {}),
     operation: String(operation || ""),
@@ -406,6 +421,10 @@ export function createLocalTaskRequestFingerprint({
     repository: String(repository || "").trim() || null,
     expected_outputs: normalizeExpectedOutputs(expectedOutputs),
     provider_token_budget: normalizeTokenBudget(providerTokenBudget),
+    ...(continuationMode(continuationPolicy) === "progress" ? {
+      continuation_policy: "progress",
+      provider_token_ceiling: normalizeTokenBudget(providerTokenCeiling),
+    } : {}),
     timeout_ms: normalizeTimeoutMs(timeoutMs),
     attachment_manifest: manifest,
     scenario_pack: normalizeLocalTaskScenarioPack(scenarioPack),
@@ -426,6 +445,7 @@ export async function startLocalTask(
     environment = process.env,
     persist = persistLocalTask,
     beforeProviderInvocation = null,
+    beforeSpawn = null,
     session = null,
     apiOrigin = null,
     observationFetch = globalThis.fetch,
@@ -509,6 +529,7 @@ export async function startLocalTask(
   // synchronous spawn boundary so a stopped task can never start Provider work.
   if (task.stop_requested || task.status !== "running") return task;
 
+
   const observationSender = createWorkflowObservationSender({
     binding: task.workflow_observation_binding,
     startIntent: task.workflow_start_intent,
@@ -523,6 +544,27 @@ export async function startLocalTask(
     path.join(runtimeTempBase, `simy-local-task-${task.id}-`),
   );
   allowCodexRuntimeTemp(command, runtimeTempRoot);
+  // Temp preparation is asynchronous too: the final authority check belongs
+  // after it, immediately adjacent to the synchronous process spawn boundary.
+  if (task.stop_requested || task.status !== "running") {
+    await rm(runtimeTempRoot, { recursive: true, force: true }); return task;
+  }
+  if (beforeSpawn) {
+    try { await beforeSpawn(task); }
+    catch (error) {
+      try {
+        if (!task.stop_requested && task.status === "running") {
+          updateTask(task, { status: "failed", control_state: "complete", error: errorMessage(error),
+            reason_code: error.code || "local_task_invocation_authorization_failed", completed_at: new Date().toISOString() });
+          await persist(task);
+        }
+      } finally { await rm(runtimeTempRoot, { recursive: true, force: true }); }
+      return task;
+    }
+  }
+  if (task.stop_requested || task.status !== "running") {
+    await rm(runtimeTempRoot, { recursive: true, force: true }); return task;
+  }
 
   return new Promise((resolve, reject) => {
     let settled = false;
@@ -572,13 +614,20 @@ export async function startLocalTask(
       emitTaskEvent(task, "usage", {
         provider_tokens_used: task.provider_tokens_used,
         provider_token_budget: task.provider_token_budget,
+        continuation_policy: task.continuation_policy || "bounded",
+        provider_token_ceiling: localTaskTokenCeiling(task),
       });
+      if (task.continuation_policy === "progress" && task.provider_tokens_used >= task.provider_token_budget && !task.token_warning_emitted) {
+        task.token_warning_emitted = true;
+        task.warnings.push("Provider token notification threshold reached. Work continues within the approved task and hard safety ceiling.");
+        emitTaskEvent(task, "budget_warning", { provider_tokens_used: task.provider_tokens_used, provider_token_budget: task.provider_token_budget, provider_token_ceiling: localTaskTokenCeiling(task) });
+      }
       if (
-        task.provider_tokens_used > task.provider_token_budget &&
+        localTaskTokensExhausted(task) &&
         !task.stop_requested
       ) {
         task.reason_code = "provider_token_budget_exhausted";
-        task.error = `Provider token budget exceeded (${task.provider_tokens_used} / ${task.provider_token_budget}).`;
+        task.error = `Provider token ${task.continuation_policy === "progress" ? "hard ceiling" : "budget"} exceeded (${task.provider_tokens_used} / ${localTaskTokenCeiling(task)}).`;
         task.stop_requested = true;
         task.control_state = "stopping";
         signalExecutorProcess(child, "SIGINT");
@@ -692,7 +741,7 @@ export async function startLocalTask(
         Boolean(error) ||
         exitCode !== 0 ||
         Boolean(task.error) ||
-        task.provider_tokens_used > task.provider_token_budget;
+        localTaskTokensExhausted(task);
       task.status = manuallyStopped ? "stopped" : failed ? "failed" : "succeeded";
       task.control_state = task.status === "stopped" ? "stopped" : "complete";
       task.error ||= error || (exitCode !== 0 ? `Provider exited with code ${exitCode}.` : null);
@@ -823,6 +872,7 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
     output: [...task.output],
     ...(includeEvents ? { events: structuredClone(task.events) } : {}),
     result: structuredClone(task.result),
+    ...(task.host_verification ? { host_verification: structuredClone(task.host_verification) } : {}),
     artifacts: task.artifacts.map(publicArtifact),
     attachments: task.attachments.map(publicAttachment),
     expected_outputs: structuredClone(task.expected_outputs),
@@ -836,6 +886,9 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
     error: task.error,
     reason_code: task.reason_code,
     provider_token_budget: task.provider_token_budget,
+    continuation_policy: task.continuation_policy || "bounded",
+    provider_token_ceiling: localTaskTokenCeiling(task),
+    token_warning_emitted: task.token_warning_emitted === true,
     provider_tokens_used: task.provider_tokens_used,
     token_usage: structuredClone(task.token_usage),
     ...(task.workflow_observation
@@ -849,6 +902,8 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
     completed_at: task.completed_at,
     ...(includeLocalPaths
       ? {
+          ...(task.purpose_verification ? { purpose_verification: structuredClone(task.purpose_verification),
+            purpose_verification_state: structuredClone(task.purpose_verification_state || null) } : {}),
           workspace_path: task.workspace_path,
           task_root: task.task_root,
           inputs_root: task.inputs_root,
@@ -1057,6 +1112,7 @@ function restoreLocalTask(snapshot) {
   );
   return {
     ...snapshot,
+    ...(snapshot.purpose_verification ? { purpose_verification: normalizePurposeVerification(snapshot.purpose_verification) } : {}),
     outputs_root_expected:
       snapshot.outputs_root_expected || null,
     output: Array.isArray(snapshot.output) ? snapshot.output : [],
@@ -1243,6 +1299,15 @@ function normalizeExpectedOutputs(value) {
     }));
 }
 
+function localTaskTokenCeiling(task) {
+  return task.continuation_policy === "progress" ? normalizeTokenBudget(task.provider_token_ceiling ?? MAX_LOCAL_TASK_TOKEN_BUDGET) : task.provider_token_budget;
+}
+
+function localTaskTokensExhausted(task) {
+  const ceiling = localTaskTokenCeiling(task);
+  return task.continuation_policy === "progress" ? task.provider_tokens_used >= ceiling : task.provider_tokens_used > ceiling;
+}
+
 function normalizeTokenBudget(value) {
   const budget = Number(value ?? DEFAULT_LOCAL_TASK_TOKEN_BUDGET);
   if (!Number.isInteger(budget) || budget < 1 || budget > MAX_LOCAL_TASK_TOKEN_BUDGET) {

package/src/orchestrator/budget.js

@@ -1,4 +1,5 @@
 import { clampAttempts } from "./shared.js";
+import { progressLimits } from "../continuation-policy.js";
 
 export const DEFAULT_TOKEN_BUDGET = 250_000;
 export const DEFAULT_RETRY_BUDGET = 2;
@@ -54,6 +55,31 @@ export function increaseProviderTokenBudget(snapshot, value) {
   return refreshBudgetState(snapshot);
 }
 
+export function extendProgressCeilings(snapshot, changes = {}) {
+  const current = budgetState(snapshot);
+  if (current.continuation_policy !== "progress") {
+    throw new Error("Hard ceilings can be extended only for an explicitly approved progress policy.");
+  }
+  if (!changes || typeof changes !== "object" || Array.isArray(changes) ||
+      Object.keys(changes).some(key => !["provider_token_ceiling", "attempt_ceiling"].includes(key))) {
+    throw new Error("Specify only the Provider token ceiling or attempt ceiling.");
+  }
+  const provided = Object.entries(changes).filter(([, value]) => value !== undefined);
+  if (!provided.length) throw new Error("Explicitly increase at least one hard ceiling.");
+  for (const [field, value] of provided) {
+    const previous = field === "provider_token_ceiling" ? current.hard_token_ceiling : current.hard_attempt_ceiling;
+    const used = field === "provider_token_ceiling" ? current.tokens_used : (snapshot.attempts || []).length;
+    if (!Number.isSafeInteger(value) || value <= previous || value <= used) {
+      throw new Error("Each requested hard ceiling must be an integer higher than its current limit and recorded usage.");
+    }
+  }
+  // Validate every field before changing either ceiling; partial rejection must
+  // never leave a larger authorization behind.
+  const limits = progressLimits({ ...snapshot.charter, ...Object.fromEntries(provided) });
+  for (const [field] of provided) snapshot.charter[field] = limits[field];
+  return refreshBudgetState(snapshot);
+}
+
 export function budgetState(snapshot, pendingAttempt = null) {
   const attempts = [
     ...(Array.isArray(snapshot?.attempts) ? snapshot.attempts : []),
@@ -67,11 +93,15 @@ export function budgetState(snapshot, pendingAttempt = null) {
   const tokensUsed = attempts.reduce(
     (sum, attempt) => sum + tokenUsageTotal(attempt?.token_usage),
     0,
-  );
+  ) + unaccountedProviderUsage(snapshot, attempts);
   const attemptsUsed = attempts.length;
   const retriesUsed = Math.max(attemptsUsed - 1, 0);
-  const tokenExhausted = tokensUsed >= tokenBudget;
-  const retryExhausted = attemptsUsed > 0 && retriesUsed >= retryBudget;
+  const policy = progressLimits(snapshot?.charter);
+  const progress = policy.continuation_policy === "progress";
+  const hardTokenCeiling = progress ? policy.provider_token_ceiling : tokenBudget;
+  const hardAttemptCeiling = progress ? policy.attempt_ceiling : retryBudget + 1;
+  const tokenExhausted = tokensUsed >= hardTokenCeiling;
+  const retryExhausted = attemptsUsed >= hardAttemptCeiling;
   return {
     schema_version: 1,
     token_budget: tokenBudget,
@@ -88,9 +118,26 @@ export function budgetState(snapshot, pendingAttempt = null) {
       : retryExhausted
         ? "retry_budget_exhausted"
         : null,
+    continuation_policy: policy.continuation_policy,
+    token_warning: progress && tokensUsed >= tokenBudget,
+    retry_warning: progress && attemptsUsed >= retryBudget + 1,
+    hard_token_ceiling: hardTokenCeiling,
+    hard_attempt_ceiling: hardAttemptCeiling,
+    hard_tokens_remaining: Math.max(hardTokenCeiling - tokensUsed, 0),
   };
 }
 
+function unaccountedProviderUsage(snapshot, attempts) {
+  const checkpoints = snapshot?.metadata?.provider_usage_checkpoints || {};
+  return Object.entries(checkpoints).reduce((sum, [id, checkpoint]) => {
+    const reported = tokenUsageTotal(checkpoint?.token_usage);
+    const accounted = attempts.reduce((total, attempt) => total + tokenUsageTotal({
+      records: (Array.isArray(attempt?.token_usage?.records) ? attempt.token_usage.records : []).filter(record => record?.invocation_id === id),
+    }), 0);
+    return sum + Math.max(0, reported - accounted);
+  }, 0);
+}
+
 export function refreshBudgetState(snapshot, pendingAttempt = null) {
   const state = budgetState(snapshot, pendingAttempt);
   snapshot.budget = state;
@@ -102,12 +149,16 @@ export function canStartProvider(snapshot, { attemptNumber, phase }) {
   if (state.token_exhausted) {
     return { allowed: false, reason: "token_budget_exhausted", budget: state };
   }
-  if (phase === "executor" && attemptNumber > state.retry_budget + 1) {
+  if (phase === "executor" && attemptNumber > state.hard_attempt_ceiling) {
     return { allowed: false, reason: "retry_budget_exhausted", budget: state };
   }
   return { allowed: true, reason: null, budget: state };
 }
 
+export function codingAttemptCeiling(snapshot) {
+  return snapshot?.charter?.continuation_policy === "progress" ? budgetState(snapshot).hard_attempt_ceiling : snapshot?.charter?.max_attempts;
+}
+
 export function tokenUsageTotal(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return 0;
   if (Array.isArray(value.records)) {

package/src/orchestrator/charter-validation.js

@@ -0,0 +1,33 @@
+export function validateCharter(charter) {
+  const findings = [];
+  if (charter.risk.requires_design_review && charter.acceptance_criteria_source !== "explicit") {
+    findings.push({
+      code: "EXPLICIT_ACCEPTANCE_CRITERIA_REQUIRED",
+      severity: "blocker",
+      target: "acceptance_criteria",
+      explanation: "High-risk work requires explicit acceptance criteria.",
+      repairability: "manual",
+    });
+  }
+  if (charter.design_review.required && charter.design_review.status !== "approved") {
+    findings.push({
+      code: "DESIGN_REVIEW_REQUIRED",
+      severity: "blocker",
+      target: "design_review",
+      explanation:
+        "High-risk work requires a design summary, approval owner, and review evidence before implementation.",
+      repairability: "manual",
+    });
+  }
+  if (charter.risk.requires_design_review && charter.required_checks.length === 0) {
+    findings.push({
+      code: "REQUIRED_CI_CHECKS_MISSING",
+      severity: "blocker",
+      target: "required_checks",
+      explanation: "High-risk work requires explicit CI and security check names.",
+      repairability: "manual",
+    });
+  }
+  return findings;
+}
+

package/src/orchestrator/completion-contract.js

@@ -65,7 +65,7 @@ function criterionIds(value, count) {
   if (
     ids.length !== count ||
     new Set(ids).size !== ids.length ||
-    ids.some((id) => !criterionIdPattern.test(id))
+    ids.some((id) => id === "USER-GOAL" || !criterionIdPattern.test(id))
   ) {
     throw new Error("Invalid acceptance criterion IDs");
   }

package/src/orchestrator/contract.js

@@ -8,6 +8,7 @@ import {
   visualEvidenceSurface,
 } from "./shared.js";
 import { budgetState, resolveRunBudgets } from "./budget.js";
+import { progressLimits } from "../continuation-policy.js";
 import { classifyRisk } from "./risk.js";
 import { buildCompletionContract } from "./completion-contract.js";
 import { freezeObjective } from "./outcome-monitor.js";
@@ -117,6 +118,7 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
       max_attempts: budgets.max_attempts,
       retry_budget: budgets.retry_budget,
       token_budget: budgets.token_budget,
+      ...progressLimits(request),
       ui_evidence_root: cleanString(request.ui_evidence_root),
       acceptance_criteria: finalAcceptanceCriteria,
       acceptance_criteria_source: acceptanceCriteriaSource,

package/src/orchestrator/delivery/references/state-and-receipts.md

@@ -99,9 +99,27 @@ recommendation, silence, or an implementation pattern.
 The controller persists `thread_state.objective_contract` with the baseline,
 current version, digest and explicit human revision lineage. Each attempt stores
 `outcome_progress` with its objective digest, independently supported criterion
-IDs, unproven IDs and assessment availability. A repeated unproven set without
-new independently supported IDs opens `OUTCOME_PROGRESS_STALLED`; this prevents
-automatic retries across changing commits. An old review cannot settle a newer
+IDs, unproven IDs and assessment availability. `evaluateOutcomeProgress` separates
+current `verified_ids`, `failed_ids`, and `unassessed_ids`; executor test counts,
+commits, evidence hashes and reference paths cannot create progress. A new
+independently verified criterion resets `no_progress_attempts`. A prior proof
+missing from the current review remains unassessed, rather than silently passing.
+The historical verified-ID set is used only for comparison, so repeating an old
+proof after a regression cannot manufacture new progress.
+
+Progress continuation uses `{ policy: "progress", maxNoProgressAttempts: 3 }`
+with `assessOutcomeProgress`. Three attempts without new verified outcomes,
+including attempts that never reach independent review, mark `stalled` with a
+specific `stall_reason`. The pure evaluator accepts the same threshold for
+Delivery. Legacy runs retain their original stopping policy until the controller
+selects progress continuation. Partial independent proof can show progress even
+when the overall audit fails; a complete passing audit is still required for
+completion. Human and external blockers remain visible alongside machine repairs
+in `blockers` and `next_actions`; they do not imply every criterion is blocked.
+
+Audits bound to a different objective or current candidate evidence identity
+cannot supply progress. Revisions reset the comparison baseline and require a
+fresh independent review. An old review cannot settle a newer
 objective version. Legacy snapshots without an objective contract remain
 readable but lose completion status on restore; their original baseline cannot
 be reconstructed retrospectively. `USER-GOAL` is tracked separately from

package/src/orchestrator/independent-audit.js

@@ -108,6 +108,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
         "Required keys: passed, summary, findings, criterion_results, visual_review, coverage_review.",
         "coverage_review must contain requirements_complete (boolean), unmapped_requirements (array), observation, and user_outcome with passed, verification_method, evidence_refs, and observed_result. Independently exercise or inspect proof of the original user goal even when supplied acceptance criteria mention only tests, code, or a PR. Use passed=false if the goal is not demonstrated. Explain the comparison of the original request, frozen experience, stable criterion-ID list, implementation and raw user/system proof.",
         "Each finding candidate must contain passed, code, severity, target, explanation, and repairability.",
+        "For a failed finding, optionally identify blocker_kind as machine, human, or external. Use human when a specific user decision or credential interaction is required, external for an unavailable outside dependency, and machine when local repair or verification can proceed. One blocked criterion does not imply all remaining work is blocked.",
         "criterion_results must contain one entry per stable criterion ID with criterion_id, passed, verification_method, evidence_refs, and observed_result.",
         "visual_review must contain inspected, artifacts, and acceptance_observations.",
         "Only passed=false entries are findings. Omit passing checks, and never report passed=true evidence as a finding.",
@@ -121,6 +122,10 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
   const result = execution?.result && typeof execution.result === "object" ? execution.result : {};
   const completionContractV2 =
     charter?.completion_contract?.version === COMPLETION_CONTRACT_VERSION;
+  const objectiveBinding = {
+    objective_digest: charter?.thread_state?.objective_contract?.current_digest || null,
+    objective_version: charter?.thread_state?.objective_contract?.version || null,
+  };
   const valid =
     execution?.exitCode === 0 &&
     !execution?.error &&
@@ -132,6 +137,7 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
         typeof result.visual_review === "object"));
   if (!valid) {
     return {
+      ...objectiveBinding,
       passed: false,
       summary: cleanString(execution?.error || result.summary) || "Independent audit did not return valid evidence.",
       findings: [
@@ -159,6 +165,8 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
       target: cleanString(item.target) || "pull_request",
       explanation: cleanString(item.explanation) || "Independent audit finding.",
       repairability: item.repairability === "manual" ? "manual" : "auto",
+      blocker_kind: ["machine", "human", "external"].includes(item.blocker_kind)
+        ? item.blocker_kind : item.repairability === "manual" ? "human" : "machine",
       auto_fix_hint: cleanString(item.auto_fix_hint) || null,
     }));
   const findings = evaluations.filter((item) => item.passed === false);
@@ -243,6 +251,7 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
   }
   const requiresHuman = findings.some((item) => item.repairability === "manual");
   return {
+    ...objectiveBinding,
     passed: result.passed === true && findings.length === 0,
     summary: cleanString(result.summary) || "Independent audit completed.",
     findings,

package/src/orchestrator/instruction.js

@@ -39,9 +39,14 @@ export function buildCodingInstruction(
         `Risk level: ${charter.risk.level}`,
         `Design summary: ${charter.design_review.summary || "not required"}`,
         `Design approved by: ${charter.design_review.approved_by || "not required"}`,
-        `Attempt: ${attemptNumber}/${charter.max_attempts}`,
+        `Attempt: ${attemptNumber}/${budget?.hard_attempt_ceiling ?? charter.max_attempts}`,
         `Retry budget: ${Math.max(attemptNumber - 1, 0)}/${charter.retry_budget}`,
         `Token budget remaining: ${budget?.tokens_remaining ?? charter.token_budget}/${charter.token_budget}`,
+        ...(charter.continuation_policy === "progress" ? [
+          "Continuation policy: verified acceptance progress. Token/retry thresholds notify; they do not relax acceptance or authorize new work.",
+          `Hard Provider token ceiling: ${budget?.hard_token_ceiling}; remaining: ${budget?.hard_tokens_remaining}. Hard attempt ceiling: ${budget?.hard_attempt_ceiling}.`,
+          "Report human/external blockers as soon as observed; continue independent work within the approved objective. Changed metadata alone is not progress.",
+        ] : []),
         `Local evidence root: ${charter.ui_evidence_root || "not required"}`,
       ].join("\n"),
     ),

package/src/orchestrator/loop.js

@@ -1,3 +1,4 @@
+import { validateCharter } from "./charter-validation.js";
 import { redactExecutionText } from "./execution-io.js";
 import { minimumCharter } from "./delivery/scripts/check-minimum-completion.mjs";
 import { auditAttempt, evaluatePrReadiness } from "./audit.js";
@@ -6,7 +7,7 @@ import {
   buildIndependentAuditInstruction,
 } from "./independent-audit.js";
 import { buildCodingInstruction, buildPromptInterventions } from "./instruction.js";
-import { canStartProvider, refreshBudgetState } from "./budget.js";
+import { canStartProvider, codingAttemptCeiling, refreshBudgetState } from "./budget.js";
 import { buildAttempt, mergeTokenUsage } from "./result.js";
 import { evaluateRetryCircuit } from "./retry.js";
 import { assessOutcomeProgress, verifyObjective } from "./outcome-monitor.js";
@@ -76,7 +77,8 @@ async function runCodingLoopOwned({
 
   let previousFindings = resume ? snapshot.final_audit?.findings || [] : [];
   const firstAttempt = resume ? snapshot.attempts.length + 1 : 1;
-  const lastAttempt = resume ? firstAttempt : snapshot.charter.max_attempts;
+  const progressPolicy = snapshot.charter.continuation_policy === "progress";
+  const lastAttempt = progressPolicy ? codingAttemptCeiling(snapshot) : resume ? firstAttempt : snapshot.charter.max_attempts;
   for (
     let attemptNumber = firstAttempt;
     attemptNumber <= lastAttempt;
@@ -183,8 +185,9 @@ async function runCodingLoopOwned({
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
     snapshot.attempts.push(attempt);
-    assessOutcomeProgress(snapshot.charter, attempt, previousAttempt, { resetUnavailableCount: resume && attemptNumber === firstAttempt });
+    assessOutcomeProgress(snapshot.charter, attempt, previousAttempt, { ...outcomeOptions(snapshot), resetUnavailableCount: resume && attemptNumber === firstAttempt });
     attempt.budget = refreshBudgetState(snapshot);
+    recordBudgetWarnings(snapshot, attempt);
 
     if (snapshot.budget.token_exhausted) {
       await stopForBudget({
@@ -234,6 +237,8 @@ async function runCodingLoopOwned({
     const auditInstruction = buildIndependentAuditInstruction(snapshot.charter, attempt);
     const reviewedMatrix = attempt.observed_evidence?.minimum_completion?.matrix_sha256;
     const reviewedEvidenceIdentity = independentAuditEvidenceIdentity(attempt);
+    const reviewedObjectiveDigest = snapshot.charter.thread_state?.objective_contract?.current_digest;
+    const reviewedObjectiveVersion = snapshot.charter.thread_state?.objective_contract?.version;
     const auditExecution = await safeExecution(() =>
       executeIndependentAudit({
         attemptNumber,
@@ -251,9 +256,16 @@ async function runCodingLoopOwned({
     );
     attempt.token_usage = mergeTokenUsage(attempt.token_usage, auditExecution.tokenUsage);
     attempt.budget = refreshBudgetState(snapshot);
+    recordBudgetWarnings(snapshot, attempt);
+    if (attempt.budget.token_exhausted) {
+      await stopForBudget({ snapshot, attempt, reason: "token_budget_exhausted", onUpdate });
+      return snapshot;
+    }
 
     attempt.independent_audit.minimum_matrix_sha256 = reviewedMatrix;
     attempt.independent_audit.evidence_identity_sha256 = reviewedEvidenceIdentity;
+    attempt.independent_audit.objective_digest = reviewedObjectiveDigest;
+    attempt.independent_audit.objective_version = reviewedObjectiveVersion;
 
     // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
@@ -265,7 +277,7 @@ async function runCodingLoopOwned({
     });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
-    assessOutcomeProgress(snapshot.charter, attempt, previousAttempt, { resetUnavailableCount: resume && attemptNumber === firstAttempt });
+    assessOutcomeProgress(snapshot.charter, attempt, previousAttempt, { ...outcomeOptions(snapshot), resetUnavailableCount: resume && attemptNumber === firstAttempt });
 
     const independentFindings = attempt.independent_audit.findings || [];
     if (!attempt.audit.passed || !attempt.independent_audit.passed) {
@@ -308,6 +320,10 @@ async function runCodingLoopOwned({
   return snapshot;
 }
 
+function outcomeOptions(snapshot) {
+  return { policy: snapshot.charter.continuation_policy || "bounded", maxNoProgressAttempts: snapshot.charter.max_no_progress_attempts || 3 };
+}
+
 async function stopCodingLoop(snapshot, onUpdate) {
   if (snapshot.state === "stopped") return snapshot;
   appendEvent(snapshot, "stopped", "Agentic loop stopped by the local human operator.", {
@@ -354,6 +370,7 @@ async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = n
   });
   attempt.outcome_progress = assessOutcomeProgress(
     snapshot.charter, attempt, snapshot.attempts.at(-2) ?? null,
+    outcomeOptions(snapshot),
   );
   snapshot.implementation_gate_passed = attempt.audit.passed;
   attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
@@ -372,38 +389,6 @@ async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = n
   return snapshot;
 }
 
-function validateCharter(charter) {
-  const findings = [];
-  if (charter.risk.requires_design_review && charter.acceptance_criteria_source !== "explicit") {
-    findings.push({
-      code: "EXPLICIT_ACCEPTANCE_CRITERIA_REQUIRED",
-      severity: "blocker",
-      target: "acceptance_criteria",
-      explanation: "High-risk work requires explicit acceptance criteria.",
-      repairability: "manual",
-    });
-  }
-  if (charter.design_review.required && charter.design_review.status !== "approved") {
-    findings.push({
-      code: "DESIGN_REVIEW_REQUIRED",
-      severity: "blocker",
-      target: "design_review",
-      explanation:
-        "High-risk work requires a design summary, approval owner, and review evidence before implementation.",
-      repairability: "manual",
-    });
-  }
-  if (charter.risk.requires_design_review && charter.required_checks.length === 0) {
-    findings.push({
-      code: "REQUIRED_CI_CHECKS_MISSING",
-      severity: "blocker",
-      target: "required_checks",
-      explanation: "High-risk work requires explicit CI and security check names.",
-      repairability: "manual",
-    });
-  }
-  return findings;
-}
 
 async function safeExecution(callback) {
   try {
@@ -515,7 +500,7 @@ async function handleFailedAudit({
     previousAttempt: snapshot.attempts.at(-2) ?? null,
     findings,
   });
-  if (retryCircuit.open) {
+  if (retryCircuit.open && !attempt.outcome_progress?.has_progress) {
     const avoidedAttempts = Math.max(snapshot.charter.max_attempts - attemptNumber, 0);
     const circuitState = {
       state: "open",
@@ -546,7 +531,7 @@ async function handleFailedAudit({
     await publish(snapshot, "blocked", onUpdate);
     return true;
   }
-  if (attemptNumber >= snapshot.charter.max_attempts) {
+  if (attemptNumber >= codingAttemptCeiling(snapshot)) {
     await stopForBudget({
       snapshot,
       attempt,
@@ -590,7 +575,7 @@ async function handleFailedAudit({
     await publish(snapshot, "waiting_human", onUpdate);
     return true;
   }
-  if (attemptNumber < snapshot.charter.max_attempts) {
+  if (attemptNumber < codingAttemptCeiling(snapshot)) {
     appendEvent(snapshot, "re_instructing", "PR audit produced a repair instruction.", {
       attempt_number: attemptNumber,
       finding_codes: findings.map((finding) => finding.code),
@@ -601,6 +586,18 @@ async function handleFailedAudit({
   return false;
 }
 
+function recordBudgetWarnings(snapshot, attempt) {
+  if (snapshot.charter.continuation_policy !== "progress") return;
+  snapshot.budget_notifications ??= {};
+  for (const kind of ["token", "retry"]) {
+    if (!snapshot.budget[`${kind}_warning`] || snapshot.budget_notifications[kind]) continue;
+    snapshot.budget_notifications[kind] = { attempt_number: attempt.attempt_number, at: new Date().toISOString() };
+    appendEvent(snapshot, "budget_warning", "The continuation notification threshold was reached; acceptance progress and hard ceilings still govern further work.", {
+      kind, attempt_number: attempt.attempt_number, budget: snapshot.budget,
+    });
+  }
+}
+
 async function stopForBudget({ snapshot, attempt, reason, onUpdate }) {
   const budget = refreshBudgetState(snapshot);
   const finding = budgetFinding(reason, budget);
@@ -639,7 +636,7 @@ function budgetFinding(reason, budget) {
       code: "TOKEN_BUDGET_EXHAUSTED",
       severity: "blocker",
       target: "provider_token_budget",
-      explanation: `The run used ${budget.tokens_used} of ${budget.token_budget} Provider tokens, so no additional executor or reviewer call can start until the Provider token budget is increased. Provider tokens are not billed as SIMY tokens.`,
+      explanation: `The run used ${budget.tokens_used} of ${budget.hard_token_ceiling} Provider tokens. The ${budget.continuation_policy === "progress" ? "hard safety ceiling" : "budget"} prevents another provider call. Preserve this run and review its remaining acceptance conditions before resuming. Provider tokens are not billed as SIMY tokens.`,
       repairability: "manual",
       auto_fix_hint: null,
     };
@@ -649,7 +646,7 @@ function budgetFinding(reason, budget) {
     code: "RETRY_BUDGET_EXHAUSTED",
     severity: "blocker",
     target: "retry_budget",
-    explanation: `The run used ${budget.retries_used} of ${budget.retry_budget} automatic retries.`,
+    explanation: budget.continuation_policy === "progress" ? `The run reached its hard ceiling of ${budget.hard_attempt_ceiling} attempts. Preserve the checkpoint and review remaining acceptance conditions before resuming.` : `The run used ${budget.retries_used} of ${budget.retry_budget} automatic retries.`,
     repairability: "manual",
     auto_fix_hint: null,
   };