@awak-app/simy-cli 0.5.72 → 0.5.74

package/src/codex-plugins/simy/hooks/continuation-policy.mjs

@@ -0,0 +1,27 @@
+// Missing policy means the persisted legacy budget contract, never implicit consent.
+export const CONTINUATION_POLICIES = Object.freeze(["bounded", "progress"]);
+export const MAX_COMPLETION_TOKENS = 15_000_000;
+export const DEFAULT_COMPLETION_ATTEMPT_CEILING = 50;
+
+export function continuationMode(value) {
+  if (value === undefined || value === null) return "bounded";
+  if (!CONTINUATION_POLICIES.includes(value)) throw new Error("Invalid continuation policy.");
+  return value;
+}
+
+export function progressLimits(input = {}) {
+  return {
+    continuation_policy: continuationMode(input.continuation_policy),
+    provider_token_ceiling: finiteLimit(input.provider_token_ceiling, MAX_COMPLETION_TOKENS, MAX_COMPLETION_TOKENS),
+    attempt_ceiling: finiteLimit(input.attempt_ceiling, DEFAULT_COMPLETION_ATTEMPT_CEILING, 100),
+    max_no_progress_attempts: finiteLimit(input.max_no_progress_attempts, 3, 20),
+  };
+}
+
+function finiteLimit(value, fallback, maximum) {
+  if (value === undefined || value === null) return fallback;
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new Error(`Continuation ceiling must be an integer between 1 and ${maximum}.`);
+  }
+  return value;
+}

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -8,6 +8,8 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
 import { associationContract, validateAssociationResult } from './action-association.mjs';
+import { continuationMode, MAX_COMPLETION_TOKENS } from './continuation-policy.mjs';
+import { evaluateOutcomeProgress } from './outcome-progress.mjs';
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
@@ -386,7 +388,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   const criteria = config.acceptanceCriteria.map((item, index) => {
     if (typeof item !== 'object' || !item || !text(item.description, 500)) throw new Error('Each acceptance criterion needs a description.');
     const id = text(item.id, 80) || `criterion-${index + 1}`;
-    if (!/^[A-Za-z0-9_-]+$/.test(id) || ['__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
+    if (!/^[A-Za-z0-9_-]+$/.test(id) || ['USER-GOAL', '__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
     const check = item.check || { type: 'manual' };
     if (!['manual', 'file_exists', 'file_contains', 'file_equals'].includes(check.type)) throw new Error('Unsupported acceptance check.');
     if (check.type !== 'manual' && (!text(check.path, 500) || isAbsolute(check.path) || check.path.split(/[\\/]/).includes('..'))) throw new Error('Acceptance file must be relative to the task directory.');
@@ -414,6 +416,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   const autoRecovery = config.autoRecovery === true && exactCodexSession && Boolean(resumeModel) &&
     (appServerChannel || config.resumeChannel === 'codex_exec' && Boolean(observedProcess?.identity));
   if (config.maxTokens !== undefined && !(provider === 'codex' && appServerChannel)) throw new Error('Provider token budgets require the host-observed Codex app-server channel.');
+  if (config.providerTokenCeiling !== undefined && !(provider === 'codex' && appServerChannel)) throw new Error('Provider token ceilings require the host-observed Codex app-server channel.');
   const managed = { taskId: randomUUID(), thread: { provider, id: session },
     actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
@@ -421,6 +424,9 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     maxNoProgressMinutes: positive(config.maxNoProgressMinutes, 30, 1440), lastVerifiedProgressAt: now,
     maxTokens: config.maxTokens === undefined ? null : positive(config.maxTokens, null, Number.MAX_SAFE_INTEGER), tokensUsed: 0, usageAvailable: null,
     noProgress: 0, verifiedRevision: 0, consumedVerifiedRevision: 0, notification: null, notificationKey: null,
+    continuationPolicy: continuationMode(config.continuationPolicy),
+    providerTokenCeiling: appServerChannel ? positive(config.providerTokenCeiling, MAX_COMPLETION_TOKENS, MAX_COMPLETION_TOKENS) : null,
+    budgetCapability: { time: true, continuations: true, providerTokens: appServerChannel },
     autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
     autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
     capability: appServerChannel && autoRecovery ? 'codex_app_server' : autoRecovery ? 'codex_exec_resume' : 'live_hook',
@@ -430,7 +436,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (initialPlan) recordDecision(managed, initialPlan, Date.now());
   return managed;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, managed, admission,
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, managed, admission,
   liveHookAdmission, autoContinueEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   cwd = await realpath(cwd);
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
@@ -446,7 +452,11 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     }
     if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
-    const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null, now);
+    const managedConfig = managed && { ...(managed === true ? {} : managed),
+      ...(continuationPolicy === undefined ? {} : { continuationPolicy }),
+      ...(providerTokenCeiling === undefined ? {} : { providerTokenCeiling }) };
+    const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
+    if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
     if (managedState && previous.associationTaskId) {
       managedState.taskId = previous.associationTaskId;
@@ -458,6 +468,11 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     const queued = managedState?.capability === 'codex_app_server';
     const run = { id: randomUUID(), objective: text(objective), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
       deadline: now + positive(maxMinutes, 30, 1440) * 60_000, maxContinuations: positive(maxContinuations, 6, 50), maxFailures: positive(maxFailures, 3, 10),
+      ...(managedState?.continuationPolicy === 'progress' ? {
+        hardDeadline: now + positive(hardMaxMinutes ?? managedConfig.hardMaxMinutes, 1440, 1440) * 60_000,
+        hardMaxContinuations: positive(hardMaxContinuations ?? managedConfig.hardMaxContinuations, 50, 50),
+        budgetWarnings: [], budgetExtensionHistory: [],
+      } : {}),
       continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
       ...(queued ? { recoveryCause: 'session_supervision' } : {}), managed: managedState };
     if (waiting) escalate(run, run.reason);
@@ -552,6 +567,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     }
     run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep, blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
     run.revision += 1; run.updatedAt = now;
+    recordManagedOutcomeProgress(run, now);
     if (run.managed && effectiveStatus === 'completed') {
       const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
       if (pending.length) { run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`; }
@@ -582,7 +598,7 @@ export async function checkpointActionAssociation({ root, provider, session, cwd
     let result;
     try { result = validateAssociationResult(job, checkpoint); }
     catch { result = { result: 'no_match', actionId: null, reason: 'Invalid association evidence; original work continues.', invalid: true }; }
-    if (now >= run.deadline) result = { result: 'no_match', actionId: null, reason: 'Association budget expired.', invalid: true };
+    if (managedBudgetReason(run, now)) result = { result: 'no_match', actionId: null, reason: 'Association budget expired.', invalid: true };
     managed.phase = job.saved.phase; managed.plan = job.saved.plan; managed.decision = job.saved.decision;
     run.nextStep = job.saved.nextStep;
     if (association.invalidated || association.namespace !== job.namespace) result = { result: 'no_match', actionId: null, reason: 'Association account context changed.', invalid: true };
@@ -608,7 +624,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     if (!run || record.cwd !== cwd || run.managed?.phase !== 'understanding' ||
         TERMINAL.has(run.state) || ['blocked', 'paused', 'recovery_required', 'verification_pending'].includes(run.state)) throw new Error('No active session understanding turn.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Session understanding lease changed; checkpoint discarded.');
-    if (now >= run.deadline) throw new Error('Session understanding deadline expired.');
+    if (managedBudgetReason(run, now)) throw new Error('Session understanding deadline expired.');
     const decision = run.managed.decision;
     const result = checkpoint.actionResult;
     if (decision?.action.kind !== 'read' || result?.decisionId !== decision.id || !['observed', 'failed', 'not_run'].includes(result.status) || !text(result.summary, 300)) throw new Error('Understanding result must match the selected read decision.');
@@ -663,30 +679,49 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     return record;
   });
 }
+function newVerifiedCriterion(run, id, now) {
+  const managed = run.managed;
+  if (managed.continuationPolicy === 'progress') {
+    const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria }));
+    if (managed.progressObjectiveDigest !== objectiveDigest) {
+      managed.progressObjectiveDigest = objectiveDigest;
+      managed.verifiedCriterionHistory = [];
+    }
+    if (managed.verifiedCriterionHistory.includes(id)) return;
+    managed.verifiedCriterionHistory.push(id);
+  } else if (Object.hasOwn(managed.verified, id)) return;
+  managed.verifiedRevision += 1;
+  managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? run.startedAt, now);
+}
 export async function verifyAutomaticCriteria(record, now) {
   const managed = record.run.managed;
+  managed.criterionObservations = {};
+  const observe = (criterion, passed, detail, sha256 = null) => {
+    managed.criterionObservations[criterion.id] = { criterion_id: criterion.id, passed,
+      verification_method: `host_${criterion.check.type}`, observed_result: detail,
+      evidence_refs: [`host-check:${managed.taskId}:${criterion.id}:${sha256 || 'failed'}`] };
+  };
+  const failed = (criterion, detail) => { delete managed.verified[criterion.id]; observe(criterion, false, detail); };
   for (const criterion of managed.acceptanceCriteria) {
     if (criterion.check.type === 'manual') continue;
     const path = criterion.check.type === 'file_equals' ? criterion.check.exactPath || criterion.check.path : criterion.check.path;
-    if (!path) { delete managed.verified[criterion.id]; continue; }
+    if (!path) { failed(criterion, 'Frozen acceptance file path is absent'); continue; }
     const file = resolve(record.cwd, path);
     const rel = relative(record.cwd, file);
-    if (rel.startsWith('..') || isAbsolute(rel)) { delete managed.verified[criterion.id]; continue; }
+    if (rel.startsWith('..') || isAbsolute(rel)) { failed(criterion, 'Acceptance path is outside the enrolled workspace'); continue; }
     try {
       const actual = await realpath(file);
       const actualRel = relative(record.cwd, actual);
-      if (actualRel.startsWith('..') || isAbsolute(actualRel)) { delete managed.verified[criterion.id]; continue; }
+      if (actualRel.startsWith('..') || isAbsolute(actualRel)) { failed(criterion, 'Resolved acceptance path is outside the enrolled workspace'); continue; }
       const info = await stat(actual);
-      if (!info.isFile() || info.size > 1024 * 1024) { delete managed.verified[criterion.id]; continue; }
+      if (!info.isFile() || info.size > 1024 * 1024) { failed(criterion, 'Acceptance file is not a bounded regular file'); continue; }
       const content = await readFile(actual);
-      if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { delete managed.verified[criterion.id]; continue; }
-      if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { delete managed.verified[criterion.id]; continue; }
-      if (!Object.hasOwn(managed.verified, criterion.id)) {
-        managed.verifiedRevision += 1;
-        managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? record.run.startedAt, now);
-      }
+      if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { failed(criterion, 'Observed file lacks the required frozen content'); continue; }
+      if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { failed(criterion, 'Observed file differs from the frozen exact contents'); continue; }
+      newVerifiedCriterion(record.run, criterion.id, now);
       managed.verified[criterion.id] = { source: criterion.check.type, checkedAt: now, path, sha256: digest(content) };
-    } catch { delete managed.verified[criterion.id]; }
+      observe(criterion, true, 'Frozen file acceptance check passed', digest(content));
+    } catch { failed(criterion, 'Acceptance file could not be independently read'); }
   }
 }
 export async function verifyDelivery({ root = rootDirectory(), provider, session, taskId, criterionId, now = Date.now() }) {
@@ -696,10 +731,7 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     if (taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
     if (!criterion || criterion.check.type !== 'manual') throw new Error('Only manual criteria can be verified by the user.');
-    if (!Object.hasOwn(run.managed.verified, criterionId)) {
-      run.managed.verifiedRevision += 1;
-      run.managed.lastVerifiedProgressAt = Math.max(run.managed.lastVerifiedProgressAt ?? run.startedAt, now);
-    }
+    newVerifiedCriterion(run, criterionId, now);
     run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
     if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
       await verifyAutomaticCriteria(record, now);
@@ -742,17 +774,70 @@ export function prepareRecoveryDiagnosis(run, now = Date.now()) {
   run.nextStep = decision.action.summary;
   return decision;
 }
-export function managedBudgetReason(run, now = Date.now()) {
+export function deliveryBudgetState(run, now = Date.now(), { checkProgress = true } = {}) {
+  const managed = run.managed;
+  const progress = managed?.continuationPolicy === 'progress';
+  const deadline = progress ? run.hardDeadline ?? run.startedAt + 1440 * 60_000 : run.deadline;
+  const maxContinuations = progress ? run.hardMaxContinuations ?? 50 : run.maxContinuations;
+  const tokenCeiling = progress ? managed.providerTokenCeiling : managed?.maxTokens;
+  const warnings = [];
   const checkpointDetail = run.checkpoint ? '' : ' No progress checkpoint was recorded.';
-  if (now >= run.deadline) return `Delivery time limit exhausted.${checkpointDetail}`;
-  if (run.continuations >= run.maxContinuations) return `Delivery continuation limit exhausted (${run.continuations}/${run.maxContinuations}).${checkpointDetail}`;
-  if (run.failures >= run.maxFailures) return `Delivery failure limit exhausted (${run.failures}/${run.maxFailures}).${checkpointDetail}`;
+  if (progress) {
+    if (now >= run.deadline) warnings.push('soft_time_limit');
+    if (run.continuations >= run.maxContinuations) warnings.push('soft_continuation_limit');
+    if (managed.maxTokens && managed.tokensUsed >= managed.maxTokens) warnings.push('soft_token_limit');
+  }
+  let reason = null;
+  if (now >= deadline) {
+    reason = progress ? 'Delivery hard time ceiling reached.' : `Delivery time limit exhausted.${checkpointDetail}`;
+  } else if (run.continuations >= maxContinuations) {
+    reason = progress ? 'Delivery hard continuation ceiling reached.' : `Delivery continuation limit exhausted (${run.continuations}/${maxContinuations}).${checkpointDetail}`;
+  } else if (run.failures >= run.maxFailures) {
+    reason = `Delivery failure limit exhausted (${run.failures}/${run.maxFailures}).${checkpointDetail}`;
+  } else if (managed?.usageBlocked) {
+    reason = `Reliable provider token usage is unavailable; budgeted continuation is blocked.${checkpointDetail}`;
+  } else if (tokenCeiling && managed.tokensUsed >= tokenCeiling) {
+    reason = progress ? 'Provider hard token ceiling reached.' : `Provider token budget exhausted (${managed.tokensUsed}/${tokenCeiling}).${checkpointDetail}`;
+  } else if (checkProgress && managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) {
+    reason = 'No verified acceptance progress within the configured time limit.';
+  } else if (checkProgress && managed && managed.noProgress >= managed.maxNoProgress) {
+    reason = 'No verified acceptance progress within the configured continuation limit.';
+  }
+  return { continuationPolicy: progress ? 'progress' : 'bounded', deadline, maxContinuations, tokenCeiling, warnings, reason };
+}
+export function managedBudgetReason(run, now = Date.now(), options) {
+  return deliveryBudgetState(run, now, options).reason;
+}
+export function managedDispatchDeadline(run) {
+  return deliveryBudgetState(run).deadline;
+}
+
+function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
   const managed = run.managed;
-  if (managed?.usageBlocked) return `Reliable provider token usage is unavailable; budgeted continuation is blocked.${checkpointDetail}`;
-  if (managed?.maxTokens && managed.tokensUsed >= managed.maxTokens) return `Provider token budget exhausted (${managed.tokensUsed}/${managed.maxTokens}).${checkpointDetail}`;
-  if (managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) return 'No verified acceptance progress within the configured time limit.';
-  if (managed && managed.noProgress >= managed.maxNoProgress) return 'No verified acceptance progress within the configured continuation limit.';
-  return null;
+  if (managed?.continuationPolicy !== 'progress') return;
+  const current = managed.acceptanceCriteria.map(criterion => ({ id: criterion.id, statement: criterion.description }));
+  const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria }));
+  const results = current.flatMap(criterion => {
+    const observation = managed.verified[criterion.id];
+    return observation ? [{ criterion_id: criterion.id, passed: true,
+      verification_method: observation.source === 'user' ? 'explicit_user_verification' : `host_${observation.source}`,
+      observed_result: `Frozen ${criterion.id} acceptance check verified`,
+      evidence_refs: [observation.source === 'user' ? `user:${managed.taskId}:${criterion.id}:${observation.checkedAt}`
+        : `host:${criterion.id}:${observation.sha256}`] }]
+      : managed.criterionObservations?.[criterion.id] ? [managed.criterionObservations[criterion.id]] : [];
+  });
+  managed.outcomeProgress = evaluateOutcomeProgress({
+    criteria: current, objectiveDigest, objectiveVersion: managed.understandingRevision || 1,
+    criterionResults: results, assessmentAvailable,
+    previous: managed.outcomeProgress, maxNoProgressAttempts: managed.maxNoProgress,
+    findings: run.checkpoint?.status === 'blocked' ? [{
+      code: run.checkpoint.blocker, blocker_kind: run.checkpoint.blocker === 'external_dependency' ? 'external' : 'human',
+      explanation: run.checkpoint.summary,
+    }] : [],
+  });
+  managed.noProgress = managed.outcomeProgress.no_progress_attempts;
+  if (managed.outcomeProgress.has_progress) managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? run.startedAt, now);
+  managed.progressCheckpointRevision = run.revision;
 }
 // Manual/legacy runs have no marker and retain their existing controls.
 export function automaticContinuationAllowed(record) {
@@ -763,6 +848,7 @@ export function automaticContinuationAllowed(record) {
 export function decideStop(run, now = Date.now()) {
   if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
+  next.budgetWarnings = deliveryBudgetState(next, now).warnings;
   const finish = (state, reason) => { next.state = state; next.reason = reason; next.updatedAt = now; return { run: next, output: {} }; };
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
@@ -780,7 +866,7 @@ export function decideStop(run, now = Date.now()) {
     } else { escalate(next, cp.summary); return finish('blocked', cp.summary); }
   }
   const budgetReason = managedBudgetReason(next, now);
-  if (budgetReason) return finish('budget_exhausted', budgetReason);
+  if (budgetReason) return finish(next.managed?.continuationPolicy === 'progress' && budgetReason.startsWith('No verified') ? 'paused' : 'budget_exhausted', budgetReason);
   const initialHook = next.managed?.awaitingInitialHook && next.revision === 0 && !next.checkpoint;
   const replanHook = next.managed?.capability === 'live_hook' && next.managed.awaitingReplanHook === true;
   const understandingHook = next.managed?.capability === 'live_hook' && (next.managed.awaitingUnderstandingHook === true || next.managed.awaitingAssociationHook === true);
@@ -815,11 +901,13 @@ export function decideStop(run, now = Date.now()) {
     const reportedStep = next.managed.associationCheckpointRevision !== next.revision && next.managed.contextBootstrap && next.managed.phase === 'active' && !next.managed.acceptanceCriteria.length &&
       !['session_understanding', 'action_association'].includes(cp?.kind) && cp?.status === 'in_progress' &&
       next.managed.workHistory?.at(-1)?.result?.status === 'observed' && next.managed.workHistory.at(-1).result.evidence?.length;
-    if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
+    if (next.managed.continuationPolicy === 'progress') {
+      if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind) && (!fresh || next.managed.progressCheckpointRevision !== next.revision)) recordManagedOutcomeProgress(next, now, Boolean(fresh));
+    } else if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
     else if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind)) next.managed.noProgress += 1;
     if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
     next.managed.consumedVerifiedRevision = next.managed.verifiedRevision;
-    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish('failed', 'No verified acceptance progress within the configured continuation limit.'); }
+    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish(next.managed.continuationPolicy === 'progress' ? 'paused' : 'failed', 'No verified acceptance progress within the configured continuation limit.'); }
   }
   next.consumedRevision = next.revision;
   if (initialHook) next.managed.awaitingInitialHook = false;
@@ -1009,7 +1097,11 @@ export function canReplanDelivery(run, provider, now = Date.now()) {
     run.state === 'blocked' && managed.pendingApproval?.denied === true &&
     !managedBudgetReason(run, now));
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, questionId, waitId, answer, action, now = Date.now() }) {
+export function canChangeDeliveryContinuation(run) {
+  return Boolean(run?.managed && ['paused', 'blocked', 'failed', 'budget_exhausted', 'verification_pending', 'recovery_required'].includes(run.state) &&
+    !['pending', 'pending_received', 'transferred'].includes(run.managed.handoff?.status));
+}
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, continuationPolicy, limits, questionId, waitId, answer, action, now = Date.now() }) {
   for (let retry = 0; ; retry += 1) {
     try { return await updateRecord(root, provider, session, record => {
     const run = record?.run;
@@ -1017,6 +1109,52 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
+    if (action === 'extend' || action === 'continuation_policy') {
+      if (!canChangeDeliveryContinuation(run)) throw new Error('Pause a managed task before changing its continuation bounds.');
+      if (action === 'continuation_policy') {
+        if (!['bounded', 'progress'].includes(continuationPolicy)) throw new Error('Select an explicit continuation policy.');
+        run.managed.continuationPolicy = continuationMode(continuationPolicy);
+        if (continuationPolicy === 'progress') {
+          run.hardDeadline ??= run.startedAt + 1440 * 60_000;
+          run.hardMaxContinuations ??= 50;
+          if (run.managed.resumeChannel === 'codex_app_server') run.managed.providerTokenCeiling ??= MAX_COMPLETION_TOKENS;
+        }
+        run.continuationPolicyHistory ||= [];
+        run.continuationPolicyHistory.push({ policy: continuationPolicy, at: now, source: 'explicit_controller_selection' });
+      } else {
+        if (!limits || typeof limits !== 'object' || Array.isArray(limits) || !Object.keys(limits).length ||
+            Object.keys(limits).some(key => !['hardMaxMinutes', 'hardMaxContinuations', 'providerTokenCeiling'].includes(key))) throw new Error('Supply explicit continuation ceiling increases.');
+        const progress = run.managed.continuationPolicy === 'progress';
+        const before = { deadline: progress ? run.hardDeadline : run.deadline,
+          maxContinuations: progress ? run.hardMaxContinuations : run.maxContinuations,
+          tokens: progress ? run.managed.providerTokenCeiling : run.managed.maxTokens };
+        const after = { ...before };
+        if (limits.hardMaxMinutes !== undefined) {
+          after.deadline = run.startedAt + positive(limits.hardMaxMinutes, null, 1440) * 60_000;
+          if (after.deadline <= before.deadline) throw new Error('Extension must increase the original deadline within 24 hours of its start.');
+        }
+        if (limits.hardMaxContinuations !== undefined) {
+          after.maxContinuations = positive(limits.hardMaxContinuations, null, 50);
+          if (after.maxContinuations <= before.maxContinuations) throw new Error('Extension must increase the continuation ceiling within 50 turns.');
+        }
+        if (limits.providerTokenCeiling !== undefined) {
+          if (run.managed.resumeChannel !== 'codex_app_server') throw new Error('Provider token ceilings require host-observed Codex usage.');
+          after.tokens = positive(limits.providerTokenCeiling, null, MAX_COMPLETION_TOKENS);
+          if (after.tokens <= (before.tokens || 0)) throw new Error('Extension must increase the provider token ceiling.');
+        }
+        if (after.deadline <= now || after.maxContinuations <= run.continuations || after.tokens && after.tokens <= run.managed.tokensUsed) throw new Error('Extended ceilings must exceed already consumed time, turns, and tokens.');
+        if (progress) { run.hardDeadline = after.deadline; run.hardMaxContinuations = after.maxContinuations; run.managed.providerTokenCeiling = after.tokens; }
+        else { run.deadline = after.deadline; run.maxContinuations = after.maxContinuations; run.managed.maxTokens = after.tokens; }
+        run.budgetExtensionHistory ||= [];
+        run.budgetExtensionHistory.push({ before, after, at: now, source: 'explicit_controller_extension' });
+      }
+      run.budgetWarnings = deliveryBudgetState(run, now).warnings;
+      if (run.state === 'budget_exhausted' && !managedBudgetReason(run, now)) {
+        run.state = 'paused'; run.reason = 'Continuation bounds changed; explicitly resume this same task.';
+      }
+      run.updatedAt = now;
+      return record;
+    }
     if (action === 'dependency_ready') {
       const wait = run.managed?.dependencyWait;
       if (run.state !== 'blocked' || run.blocker !== 'external_dependency' || !wait || wait.id !== waitId ||
@@ -1170,7 +1308,14 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
           run.state = 'completed'; run.reason = run.checkpoint.summary; run.updatedAt = now;
         }
       }
-      if (managedBudgetReason(run, now) && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) { run.state = 'budget_exhausted'; run.reason = managedBudgetReason(run, now); run.updatedAt = now; }
+      const activeTurn = run.managed?.continuationPolicy === 'progress' &&
+        (run.state === 'auto_resuming' || current.runtime?.isRunning === true || run.managed.executionAttempt?.phase === 'dispatching');
+      const budgetState = deliveryBudgetState(run, now, { checkProgress: !activeTurn });
+      run.budgetWarnings = budgetState.warnings;
+      if (budgetState.reason && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) {
+        run.state = run.managed?.continuationPolicy === 'progress' && budgetState.reason.startsWith('No verified') ? 'paused' : 'budget_exhausted';
+        run.reason = budgetState.reason; run.updatedAt = now;
+      }
       else if (run.state === 'active' && observed !== null && observed !== current.process?.identity && current.process?.identity === record.process?.identity) {
         run.state = 'recovery_required'; run.recoveryCause = 'process_exit'; run.reason = run.managed?.autoRecovery ? 'Observed provider process exited. Managed recovery is eligible for a bounded exact-session attempt.' : 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;
       }

package/src/codex-plugins/simy/hooks/outcome-progress.mjs

@@ -0,0 +1,129 @@
+import { createHash } from "node:crypto";
+
+function text(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function observed(row) {
+  return typeof row?.passed === "boolean" && Boolean(text(row.verification_method)) &&
+    Boolean(text(row.observed_result)) && Array.isArray(row.evidence_refs) &&
+    row.evidence_refs.some((ref) => Boolean(text(ref)));
+}
+
+function classifyBlockers(findings) {
+  const blockers = { machine: [], human: [], external: [] };
+  for (const finding of findings || []) {
+    if (!finding || finding.passed === true) continue;
+    const kind = ["machine", "human", "external"].includes(finding.blocker_kind)
+      ? finding.blocker_kind
+      : finding.repairability === "external" ? "external"
+      : finding.repairability === "manual" ? "human" : "machine";
+    blockers[kind].push({
+      code: text(finding.code) || "OUTCOME_UNPROVEN",
+      target: text(finding.target) || null,
+      explanation: text(finding.explanation) || text(finding.detail) || null,
+    });
+  }
+  return blockers;
+}
+
+/**
+ * Compare controller-owned independent observations against one frozen objective.
+ * Evidence references identify proof; changing their paths/hashes is not progress.
+ * This measures continuation only and never replaces the completion gates.
+ */
+export function evaluateOutcomeProgress({
+  criteria,
+  objectiveDigest = null,
+  objectiveVersion = null,
+  criterionResults = [],
+  userOutcome = null,
+  assessmentAvailable = false,
+  assessmentReason = null,
+  findings = [],
+  previous = null,
+  maxNoProgressAttempts = 3,
+}) {
+  const rows = Array.isArray(criteria) ? criteria : [];
+  if (rows.some((row) => !text(row?.id) || row.id === "USER-GOAL") ||
+      new Set(rows.map((row) => row.id)).size !== rows.length) {
+    throw new Error("Outcome progress requires unique, non-reserved criterion IDs");
+  }
+  if (!Number.isInteger(maxNoProgressAttempts) || maxNoProgressAttempts < 1) {
+    throw new Error("maxNoProgressAttempts must be a positive integer");
+  }
+  const scopeDigest = createHash("sha256").update(JSON.stringify({
+    objectiveDigest, objectiveVersion, criteria: rows,
+  })).digest("hex");
+  const comparable = previous?.scope_digest === scopeDigest;
+  const requiredIds = [...rows.map((row) => row.id), "USER-GOAL"];
+  const results = Array.isArray(criterionResults) ? criterionResults : [];
+  const criterionStates = requiredIds.map((id) => {
+    const matches = id === "USER-GOAL" ? (userOutcome ? [userOutcome] : [])
+      : results.filter((row) => row?.criterion_id === id);
+    const row = matches[0];
+    const evaluated = assessmentAvailable && matches.length === 1 && observed(row);
+    return {
+      criterion_id: id,
+      state: evaluated ? row.passed ? "verified" : "unproven" : "unassessed",
+      reason: evaluated ? null : !assessmentAvailable ? assessmentReason || "independent_assessment_unavailable"
+        : matches.length > 1 ? "duplicate_independent_results" : "independent_observation_missing",
+    };
+  });
+  const idsWithState = (state) => criterionStates.filter((row) => row.state === state)
+    .map((row) => row.criterion_id).sort();
+  const verified = idsWithState("verified");
+  const unproven = idsWithState("unproven");
+  const unassessed = idsWithState("unassessed");
+  // History is only a comparison baseline, never carried into current proof.
+  const historicalRows = comparable ? previous.verified_history_ids || previous.verified_ids : [];
+  const historical = Array.isArray(historicalRows)
+    ? historicalRows.filter((id) => requiredIds.includes(id)) : [];
+  const newlyVerified = verified.filter((id) => !historical.includes(id));
+  const hasProgress = newlyVerified.length > 0;
+  const previousNoProgress = Number.isInteger(previous?.no_progress_attempts) && previous.no_progress_attempts >= 0
+    ? previous.no_progress_attempts : 0;
+  const noProgressAttempts = comparable
+    ? hasProgress ? 0 : previousNoProgress + 1
+    : verified.length > 0 ? 0 : 1;
+  const blockers = classifyBlockers(findings);
+  const complete = rows.length > 0 && unproven.length === 0 && unassessed.length === 0;
+  const stalled = !complete && noProgressAttempts >= maxNoProgressAttempts;
+  const evaluationStatus = unassessed.length === 0 ? "assessed"
+    : verified.length + unproven.length > 0 ? "partial" : "unavailable";
+  const nextActions = [];
+  if (blockers.machine.length || unproven.length || unassessed.length) nextActions.push("repair_or_verify");
+  if (blockers.human.length) nextActions.push("request_human_input");
+  if (blockers.external.length) nextActions.push("wait_for_external_dependency");
+  if (complete) nextActions.push("check_completion_gates");
+  if (stalled) nextActions.push("reassess_approach");
+  return {
+    version: 2,
+    objective_digest: objectiveDigest,
+    objective_version: objectiveVersion,
+    scope_digest: scopeDigest,
+    objective_changed: Boolean(previous && !comparable),
+    evaluation_status: evaluationStatus,
+    status: evaluationStatus === "assessed" ? "assessed" : "insufficient_evidence",
+    criterion_states: criterionStates,
+    verified_ids: verified,
+    assessed_ids: verified,
+    evaluated_ids: [...verified, ...unproven].sort(),
+    unproven_ids: [...unproven, ...unassessed].sort(),
+    failed_ids: unproven,
+    unassessed_ids: unassessed,
+    newly_verified_ids: newlyVerified,
+    verified_history_ids: [...new Set([...historical, ...verified])].sort(),
+    regressed_ids: comparable && Array.isArray(previous.verified_ids)
+      ? unproven.filter((id) => previous.verified_ids.includes(id)) : [],
+    has_progress: hasProgress,
+    no_progress_attempts: noProgressAttempts,
+    max_no_progress_attempts: maxNoProgressAttempts,
+    stalled,
+    stall_reason: stalled ? evaluationStatus === "unavailable"
+      ? "independent_assessment_repeatedly_unavailable" : "no_new_verified_outcome" : null,
+    blockers,
+    next_actions: nextActions,
+    next_action: stalled ? "reassess_approach" : nextActions[0] || "repair_or_verify",
+  };
+}

package/src/coding-run-recovery.js

@@ -0,0 +1,88 @@
+import { redactExecutionValue } from "./orchestrator/execution-io.js";
+import { objectiveValueDigest, verifyObjective } from "./orchestrator/outcome-monitor.js";
+
+// Redaction changes acceptance text, so its integrity chain must undergo the
+// same transformation. Never legitimize an already edited objective here.
+export function recoverySnapshot(snapshot) {
+  const verified = snapshot?.charter && verifyObjective(snapshot.charter);
+  const sanitized = redactExecutionValue(snapshot);
+  const contract = sanitized?.charter?.thread_state?.objective_contract;
+  const objectiveDigest = value => objectiveValueDigest(value, contract?.digest_algorithm);
+  if (!contract || verified.legacy || !verified.valid) return sanitized;
+  if (objectiveDigest(contract.current) === contract.current_digest) return sanitized;
+  for (const revision of contract.revisions) {
+    revision.previous_digest = objectiveDigest(revision.previous);
+    revision.next_digest = objectiveDigest(revision.next);
+  }
+  const previousDigest = contract.current_digest;
+  contract.current_digest = objectiveDigest(contract.current);
+  if (!verifyObjective(sanitized.charter).valid) {
+    throw new Error("The redacted objective cannot be preserved for recovery.");
+  }
+  sanitized.metadata ??= {};
+  sanitized.metadata.recovery_migrations ??= [];
+  sanitized.metadata.recovery_migrations.push({
+    kind: "objective_redaction", version: 1,
+    previous_digest: previousDigest, current_digest: contract.current_digest,
+  });
+  return sanitized;
+}
+
+export function recoveryActorBinding(session, apiOrigin, request) {
+  return {
+    device_id: session?.device_id || request?.execution_device_id || null,
+    account_id: session?.account_id || session?.auth_user_id || null,
+    organization_id: session?.organization_id || session?.org_id || null,
+    api_origin: apiOrigin || null,
+  };
+}
+
+export function assertRecoveryActor(run) {
+  const saved = run.snapshot.metadata?.recovery_actor || {
+    device_id: run.snapshot.metadata?.execution_device_id,
+  };
+  if (!saved) return;
+  const current = recoveryActorBinding(run.session, run.apiOrigin, run.request);
+  for (const field of ["device_id", "account_id", "organization_id", "api_origin"]) {
+    if (saved[field] && saved[field] !== current[field]) {
+      const error = new Error(`The saved run belongs to another ${field}; restore its original authorized session.`);
+      error.code = "recovery_actor_mismatch";
+      throw error;
+    }
+  }
+}
+
+// Current presentation can change; historical attempts and the corresponding
+// pause audit remain available for investigation.
+export function refreshRecoveryBudgetAudit(snapshot, budget) {
+  const stale = (finding) =>
+    (finding.code === "TOKEN_BUDGET_EXHAUSTED" && !budget.token_exhausted) ||
+    (finding.code === "RETRY_BUDGET_EXHAUSTED" && !budget.retry_exhausted);
+  const changed = refreshRecoveryAudit(snapshot, { reason: "budget_changed", stale,
+    summary: "The budget permits continuation; remaining verification or approval is still required." });
+  if (changed && snapshot.final_audit) snapshot.final_audit.budget = budget;
+  return changed;
+}
+
+export function refreshRecoveryAudit(snapshot, { reason, stale, summary }) {
+  const audit = snapshot.final_audit;
+  if (!audit) return false;
+  const findings = Array.isArray(audit.findings) ? audit.findings : [];
+  if (!findings.some(stale)) return false;
+  snapshot.metadata ??= {};
+  snapshot.metadata.recovery_audit_history ??= [];
+  snapshot.metadata.recovery_audit_history.push({
+    reason, recorded_at: new Date().toISOString(),
+    audit: structuredClone(audit),
+  });
+  const remaining = findings.filter((finding) => !stale(finding));
+  snapshot.final_audit = remaining.length ? {
+    ...audit, findings: remaining, passed: false,
+    auto_repairable: remaining.every(finding => finding.repairability === "auto"),
+    requires_human: remaining.some(finding => finding.repairability !== "auto"),
+    summary,
+  } : null;
+  snapshot.done_gate_passed = false;
+  snapshot.implementation_gate_passed = false;
+  return true;
+}

package/src/coding-run-store.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { redactExecutionValue } from "./orchestrator/execution-io.js";
+import { recoverySnapshot } from "./coding-run-recovery.js";
 
 const RUN_ID = /^[A-Za-z0-9_-]{1,160}$/;
 const writes = new Map();
@@ -16,7 +16,7 @@ export async function saveCodingRunSnapshot(root, snapshot) {
   const id = String(snapshot?.id || "");
   if (!RUN_ID.test(id)) throw new Error("Invalid coding run ID for durable storage.");
   // Capture at enqueue time: later mutations must not rewrite a queued version.
-  snapshot = redactExecutionValue(snapshot);
+  snapshot = recoverySnapshot(snapshot);
   const directory = path.resolve(root);
   const key = path.join(directory, id);
   const previous = writes.get(key) || Promise.resolve();

package/src/continuation-policy.js

@@ -0,0 +1,2 @@
+// The installed provider plugins use the same continuation policy validation.
+export * from "./codex-plugins/simy/hooks/continuation-policy.mjs";