@awak-app/simy-cli 0.6.10 → 0.6.12

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -21,9 +21,19 @@ const ACTIONS = new Set([...LOCAL_ACTIONS, 'external', 'destructive', 'scope_cha
 const AUTONOMY_POLICIES = new Set(['strict', 'balanced', 'autonomous']);
 const ASSESSMENT_FIELDS = { risk: ['low', 'medium', 'high', 'unknown'], reversibility: ['reversible', 'irreversible', 'unknown'], externalEffect: ['none', 'local', 'external', 'unknown'], blastRadius: ['single_file', 'repository', 'multi_system', 'unknown'], uncertainty: ['low', 'medium', 'high', 'unknown'] };
 export const rootDirectory = (env = process.env) => join(env.SIMY_HOME?.trim() || join(homedir(), '.simy'), 'delivery-hooks');
+// Provider identity remains bound to record.cwd. File acceptance and writer
+// coordination use the explicitly enrolled task directory instead.
+export const taskDirectory = record => record.run?.executionCwd || record.cwd;
+export const taskWorkspaceDirectories = record => [...new Set([record.cwd, taskDirectory(record)])];
+export const sharesTaskWorkspace = (left, right) => taskWorkspaceDirectories(left).some(cwd => taskWorkspaceDirectories(right).includes(cwd));
+const checkpointDirectoryMatches = (record, cwd) => record.cwd === cwd || taskDirectory(record) === cwd;
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
+export function canUpgradeDelivery(run) {
+  return Boolean(run && !run.managed && text(run.id) && text(run.objective) && Number.isFinite(run.startedAt) &&
+    Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 && ['active', 'paused', 'recovery_required'].includes(run.state));
+}
 const contextText = (value, max = 500) => text(value, max).replace(/\b(?:sk|key)-[A-Za-z0-9_-]{12,}\b|\bBearer\s+\S+|\b(?:password|token|api[_-]?key)\s*[:=]\s*\S+/gi, '[redacted]');
 export function recordPath(root, provider, session) {
   if (!['codex', 'claude'].includes(provider) || typeof session !== 'string' || !/^[A-Za-z0-9_-]{1,256}$/.test(session)) throw new Error('A provider and exact session ID are required.');
@@ -415,7 +425,15 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   const appServerChannel = config.resumeChannel === 'codex_app_server' && admission?.source === 'codex_app_server' && admission.session === session;
   const autoRecovery = config.autoRecovery === true && exactCodexSession && Boolean(resumeModel) &&
     (appServerChannel || config.resumeChannel === 'codex_exec' && Boolean(observedProcess?.identity));
-  const managed = { taskId: randomUUID(), thread: { provider, id: session },
+  let deliveryLevel = null;
+  if (config.deliveryLevel !== undefined) {
+    const value = config.deliveryLevel;
+    if (!Number.isInteger(value?.requested) || value.requested < 1 || value.requested > 5 ||
+        !Number.isInteger(value.effective) || value.effective < value.requested || value.effective > 5 ||
+        value.numberingVersion !== 'assurance-ascending-v2' || !text(value.selectionRef, 200)) throw new Error('Delivery level needs the user selection reference, requested/effective levels 1-5, and assurance-ascending-v2 numbering.');
+    deliveryLevel = { requested: value.requested, effective: value.effective, numberingVersion: value.numberingVersion, selectionRef: text(value.selectionRef, 200) };
+  }
+  const managed = { taskId: randomUUID(), deliveryLevel, thread: { provider, id: session },
     actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
     grants: Object.fromEntries(scopes.map(scope => [scope, { decision: approvalPolicy }])), maxNoProgress: positive(config.maxNoProgress, 3, 20),
@@ -431,25 +449,57 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (initialPlan) recordDecision(managed, initialPlan, Date.now());
   return managed;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxFailures, continuationPolicy, managed, admission,
+function freezeEnrollment(run, now) {
+  if (!run.managed || run.managed.enrollment) return;
+  run.managed.enrollment = { objective: run.objective, acceptanceDigest: digest(JSON.stringify(run.managed.acceptanceCriteria)),
+    deliveryLevel: structuredClone(run.managed.deliveryLevel || null), frozenAt: now };
+}
+export function pendingAcceptance(run) {
+  const enrollment = run.managed?.enrollment;
+  if (enrollment && (enrollment.objective !== run.objective || enrollment.acceptanceDigest !== digest(JSON.stringify(run.managed.acceptanceCriteria)) ||
+      JSON.stringify(enrollment.deliveryLevel) !== JSON.stringify(run.managed.deliveryLevel || null))) return [{ id: 'enrollment', description: 'Original objective, level and acceptance contract',
+    check: 'manual', detail: 'Enrollment changed unexpectedly; stop and inspect before enrolling a revised task' }];
+  return (run.managed?.acceptanceCriteria || []).filter(item => !Object.hasOwn(run.managed.verified, item.id))
+    .map(item => ({ id: item.id, description: item.description, check: item.check.type,
+      detail: run.managed.criterionObservations?.[item.id]?.observed_result || (item.check.type === 'manual' ? 'Explicit user verification required' : 'Independent check not yet passed') }));
+}
+function acceptancePendingReason(run) {
+  return `Acceptance verification pending: ${pendingAcceptance(run).map(item => `${item.id} (${item.description}): ${item.detail}`).join('; ')}`;
+}
+export function deliveryAcceptanceContext(run) {
+  return `Original objective: ${run.managed?.enrollment?.objective || run.objective}. Mode: ${run.managed ? 'managed acceptance tracking' : 'standard checkpoint tracking; completion reports are not verified acceptance'}.` +
+    `${run.managed?.deliveryLevel ? ` Frozen delivery level: ${JSON.stringify(run.managed.deliveryLevel)}.` : ''}` +
+    ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}. Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
+}
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, objective, nextStep, maxFailures, continuationPolicy, managed, admission,
   liveHookAdmission, autoContinueEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   cwd = await realpath(cwd);
+  if (executionCwd !== undefined) {
+    executionCwd = await realpath(executionCwd);
+    if (!(await stat(executionCwd)).isDirectory()) throw new Error('Task execution directory must be a directory.');
+  }
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
   return updateRecord(root, provider, session, async previous => {
+    if (previous?.providerArchived === true) throw new Error('Restore the original provider conversation before starting Delivery Loop.');
     if (autoContinueEpoch && (previous?.autoContinue !== true || previous.autoContinueEpoch !== autoContinueEpoch)) throw new Error('Automatic continuation was disabled before enrollment.');
-    const admitted = admission?.source === 'codex_app_server' && admission.provider === provider && admission.session === session && admission.cwd === cwd && previous?.admission?.source === admission.source && previous.admission.session === session && previous.cwd === cwd;
+    const sessionCwd = previous?.cwd;
+    const admitted = admission?.source === 'codex_app_server' && admission.provider === provider && admission.session === session && admission.cwd === sessionCwd && previous?.admission?.source === admission.source && previous.admission.session === session && previous.admission.cwd === sessionCwd;
     if (liveHookAdmission) {
       const process = previous?.process;
       if (provider !== 'claude' || previous?.hookStartedAt !== liveHookAdmission.hookStartedAt ||
-          !(await claudeHookChannel(previous, { session, cwd, inspectProcess })).ready || process?.pid !== liveHookAdmission.pid ||
+          !(await claudeHookChannel(previous, { session, cwd: sessionCwd, inspectProcess })).ready || process?.pid !== liveHookAdmission.pid ||
           process?.identity !== liveHookAdmission.identity || !process.identity ||
           await inspectProcess(process.pid) !== process.identity) throw new Error('Claude live hook changed before enrollment; refresh the session.');
     }
-    if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
-    if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
+    if ((!previous?.observedAt && !admitted) || sessionCwd !== cwd && executionCwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or explicitly bind its task execution directory.');
+    const upgrading = upgradeRunId !== undefined;
+    if (upgrading && (!canUpgradeDelivery(previous.run) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
+    if (previous.run && !upgrading) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
+    if (upgrading && (text(objective) !== previous.run.objective || executionCwd && previous.run.executionCwd && executionCwd !== previous.run.executionCwd)) throw new Error('Upgrade must preserve the original objective and task directory.');
     const managedConfig = managed && { ...(managed === true ? {} : managed),
       ...(continuationPolicy === undefined ? {} : { continuationPolicy }) };
     const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
+    if (upgrading && (!managedState?.autonomyPolicy || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Upgrade requires read-only reconciliation and frozen acceptance of the original objective.');
     if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
     if (managedState && previous.associationTaskId) {
@@ -464,6 +514,25 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       maxFailures: positive(maxFailures, 3, 10),
       continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
       ...(queued ? { recoveryCause: 'session_supervision' } : {}), managed: managedState };
+    if (executionCwd || previous.run?.executionCwd) run.executionCwd = executionCwd || previous.run.executionCwd;
+    if (upgrading) {
+      const prior = previous.run;
+      // Adopt the same run, including all failure/progress budgets and history.
+      // Consume the legacy checkpoint so its completion claim cannot replay.
+      Object.assign(run, structuredClone(prior), { managed: managedState, executionCwd: run.executionCwd,
+        updatedAt: now, nextStep: text(nextStep), consumedRevision: prior.revision });
+      managedState.taskId = previous.associationTaskId || prior.id;
+      managedState.lastVerifiedProgressAt = prior.startedAt;
+      managedState.upgradedFrom = { runId: prior.id, state: prior.state, nextStep: prior.nextStep,
+        checkpoint: structuredClone(prior.checkpoint), at: now };
+      if (prior.state !== 'paused') {
+        run.state = waiting ? 'blocked' : queued ? 'recovery_required' : 'active';
+        run.reason = waiting ? managedState.decision.reason : 'Existing loop adopted; reconcile prior work before selecting another action.';
+        if (queued) run.recoveryCause = 'session_supervision';
+      }
+      if (managedState.capability === 'live_hook') managedState.awaitingReplanHook = true;
+    }
+    if (managedState && !managedState.contextBootstrap) freezeEnrollment(run, now);
     if (waiting) escalate(run, run.reason);
     return { ...previous, run };
   });
@@ -483,7 +552,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     let effectiveStatus = checkpoint.status;
     let nextStep = text(checkpoint.nextStep);
     let repairPlan = null;
-    if (!run || record.cwd !== cwd) throw new Error('No matching active Delivery Loop.');
+    if (!run || !checkpointDirectoryMatches(record, cwd)) throw new Error('No matching active Delivery Loop.');
     if (run.managed?.phase === 'understanding' || run.managed?.phase === 'needs_clarification') throw new Error('Session understanding needs its separate structured checkpoint.');
     if (checkpoint.status === 'completed' && !run.managed && (!evidence.length || checkpoint.acceptanceMet !== true)) throw new Error('Completion requires acceptanceMet and concrete verification evidence.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed?.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Managed recovery lease changed; checkpoint discarded.');
@@ -558,8 +627,8 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     run.revision += 1; run.updatedAt = now;
     recordManagedOutcomeProgress(run, now);
     if (run.managed && effectiveStatus === 'completed') {
-      const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
-      if (pending.length) { run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`; }
+      const pending = pendingAcceptance(run);
+      if (pending.length) { run.state = 'verification_pending'; run.reason = acceptancePendingReason(run); }
       else if (run.managed.contextBootstrap && !run.managed.acceptanceCriteria.length) {
         run.state = 'reported_done'; run.reason = 'Original session reported the goal done; no independent acceptance check was available.';
       }
@@ -582,7 +651,7 @@ export async function checkpointActionAssociation({ root, provider, session, cwd
   cwd = await realpath(cwd);
   return updateRecord(root, provider, session, record => {
     const run = record?.run, managed = run?.managed, association = managed?.actionAssociation, job = association?.job;
-    if (!job || managed.phase !== 'action_association' || record.cwd !== cwd || job.taskId !== managed.taskId || job.provider !== provider || job.session !== session || managed.handoff && managed.handoff.status !== 'received' || TERMINAL.has(run.state) || managed.understandingRevision !== job.understandingRevision || managed.decision?.id !== job.id || run.revision !== job.runRevision || ['paused','blocked'].includes(run.state)) throw new Error('Association job changed; checkpoint discarded.');
+    if (!job || managed.phase !== 'action_association' || !checkpointDirectoryMatches(record, cwd) || job.taskId !== managed.taskId || job.provider !== provider || job.session !== session || managed.handoff && managed.handoff.status !== 'received' || TERMINAL.has(run.state) || managed.understandingRevision !== job.understandingRevision || managed.decision?.id !== job.id || run.revision !== job.runRevision || ['paused','blocked'].includes(run.state)) throw new Error('Association job changed; checkpoint discarded.');
     if (expectedLease && (run.state !== 'auto_resuming' || managed.resumeLease?.id !== expectedLease || run.revision !== managed.resumeLease.checkpointRevision)) throw new Error('Association lease changed; checkpoint discarded.');
     let result;
     try { result = validateAssociationResult(job, checkpoint); }
@@ -610,7 +679,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
   if (!text(checkpoint.summary, 1000)) throw new Error('Understanding checkpoint needs a summary.');
   return updateRecord(root, provider, session, async record => {
     const run = record?.run;
-    if (!run || record.cwd !== cwd || run.managed?.phase !== 'understanding' ||
+    if (!run || !checkpointDirectoryMatches(record, cwd) || run.managed?.phase !== 'understanding' ||
         TERMINAL.has(run.state) || ['blocked', 'paused', 'recovery_required', 'verification_pending'].includes(run.state)) throw new Error('No active session understanding turn.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Session understanding lease changed; checkpoint discarded.');
     if (managedBudgetReason(run, now)) throw new Error('Session understanding deadline expired.');
@@ -647,6 +716,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
           ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
       run.managed.verified = {};
       run.managed.phase = 'active';
+      freezeEnrollment(run, now);
       run.nextStep = understanding.nextAction.summary;
       recordDecision(run.managed, plan, now);
       run.reason = run.managed.decision.outcome === 'wait' ? run.managed.decision.reason : 'Session goal understood; selected next action awaits the normal dispatch gate.';
@@ -697,12 +767,13 @@ export async function verifyAutomaticCriteria(record, now) {
     if (criterion.check.type === 'manual') continue;
     const path = criterion.check.type === 'file_equals' ? criterion.check.exactPath || criterion.check.path : criterion.check.path;
     if (!path) { failed(criterion, 'Frozen acceptance file path is absent'); continue; }
-    const file = resolve(record.cwd, path);
-    const rel = relative(record.cwd, file);
+    const directory = taskDirectory(record);
+    const file = resolve(directory, path);
+    const rel = relative(directory, file);
     if (rel.startsWith('..') || isAbsolute(rel)) { failed(criterion, 'Acceptance path is outside the enrolled workspace'); continue; }
     try {
       const actual = await realpath(file);
-      const actualRel = relative(record.cwd, actual);
+      const actualRel = relative(directory, actual);
       if (actualRel.startsWith('..') || isAbsolute(actualRel)) { failed(criterion, 'Resolved acceptance path is outside the enrolled workspace'); continue; }
       const info = await stat(actual);
       if (!info.isFile() || info.size > 1024 * 1024) { failed(criterion, 'Acceptance file is not a bounded regular file'); continue; }
@@ -726,7 +797,7 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
     if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
       await verifyAutomaticCriteria(record, now);
-      if (run.managed.acceptanceCriteria.every(item => Object.hasOwn(run.managed.verified, item.id))) {
+      if (!pendingAcceptance(run).length) {
         run.state = 'completed'; run.reason = run.checkpoint.summary;
       }
     }
@@ -843,6 +914,7 @@ function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
 }
 // Manual/legacy runs have no marker and retain their existing controls.
 export function automaticContinuationAllowed(record) {
+  if (record?.providerArchived === true) return false;
   const epoch = record?.run?.managed?.autoContinueEpoch;
   return !epoch || record.autoContinue === true && record.autoContinueEpoch === epoch;
 }
@@ -854,8 +926,13 @@ export function decideStop(run, now = Date.now()) {
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
   const cp = fresh ? next.checkpoint : null;
-  if (cp?.status === 'completed') return finish(next.managed?.contextBootstrap && !next.managed.acceptanceCriteria.length ? 'reported_done' : 'completed',
-    next.managed?.contextBootstrap && !next.managed.acceptanceCriteria.length ? 'Original session reported the goal done; no independent acceptance check was available.' : cp.summary);
+  if (cp?.status === 'completed') {
+    const pending = pendingAcceptance(next);
+    if (pending.length) return finish('verification_pending', acceptancePendingReason(next));
+    if (!next.managed || !next.managed.acceptanceCriteria.length) return finish('reported_done',
+      'Original session reported the goal done; no independent acceptance check was available.');
+    return finish('completed', cp.summary);
+  }
   if (cp?.status === 'blocked') {
     next.blocker = cp.blocker;
     const approval = next.managed?.pendingApproval;
@@ -932,7 +1009,7 @@ export function decideStop(run, now = Date.now()) {
   next.reason = fresh ? 'continue_pending_work' : 'checkpoint_missing';
   const selected = next.managed?.autonomyPolicy ? next.managed.decision : null;
   const instruction = selected && next.managed.phase === 'action_association' ? `${associationContract(next.managed.actionAssociation.job)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping.` : selected && next.managed.phase === 'understanding' ? `Understand the current user request in this ORIGINAL conversation. ${next.managed.understandingAnswer ? `The user answered question ${next.managed.understandingAnswer.questionId}: ${next.managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? next.nextStep : `Check the actual delivery status first. Record an honest checkpoint with simy delivery checkpoint before stopping; do not claim completion without verification. Pending step: ${next.nextStep}`;
-  return { run: next, output: { decision: 'block', reason: `SIMY Delivery Loop (${next.continuations} continuations). ${instruction}\nStay within the original request and permissions. If authorization or information is missing, record a blocked checkpoint and stop. Resume this same task; do not start a replacement loop.` } };
+  return { run: next, output: { decision: 'block', reason: `SIMY Delivery Loop (${next.continuations} continuations). ${next.executionCwd ? `Use task execution directory ${JSON.stringify(next.executionCwd)} for task work and acceptance. ` : ''}${deliveryAcceptanceContext(next)} ${instruction}\nStay within the original request and permissions. If authorization or information is missing, record a blocked checkpoint and stop. Resume this same task; do not start a replacement loop.` } };
 }
 // A process signature protects against PID reuse. Never treat a stale timer alone
 // as a crash; an idle provider may be waiting for its user.
@@ -1024,12 +1101,12 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       const lease = run.managed.liveWorkspaceLease;
       const settled = run.managed.executionAttempt?.id === lease.attemptId && run.managed.executionAttempt?.phase === 'checkpointed' && lease.checkpointRevision === run.managed.executionAttempt.checkpointRevision;
       if (!settled) run.managed.executionUncertain = { attemptId: lease.attemptId, decisionId: lease.decisionId, cause: `live_${event}`, at: now };
-      boundaryLease = { ownerId: lease.ownerId, cwd: record.cwd };
+      boundaryLease = { ownerId: lease.ownerId, cwd: taskDirectory(record), cwds: lease.cwds || taskWorkspaceDirectories(record) };
       if (settled && event === 'Stop') {
         // The matching checkpoint was durably committed before this verified
         // provider boundary. Releasing now permits the next write/test claim;
         // a crash cannot reinterpret the settled action as a new dispatch.
-        await releaseWorkspaceLease({ root, cwd: record.cwd, ownerId: lease.ownerId });
+        await releaseWorkspaceLease({ root, cwd: taskDirectory(record), cwds: lease.cwds || taskWorkspaceDirectories(record), ownerId: lease.ownerId });
         boundaryLease = null;
       }
       delete run.managed.liveWorkspaceLease;
@@ -1040,6 +1117,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       }
     }
     if (!run || TERMINAL.has(run.state)) return record;
+    if (event === 'UserPromptSubmit') output = { hookSpecificOutput: { hookEventName: event, additionalContext: deliveryAcceptanceContext(run) } };
     if (event === 'Interrupt') { run.state = 'stopped'; run.reason = 'User interrupted the provider.'; }
     else if (run.state === 'auto_resuming' && ['Stop', 'SessionEnd', 'StopFailure'].includes(event)) {
       // The supervisor owns this exact attempt and consumes its structured
@@ -1066,11 +1144,11 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       // stable event ID; never dedupe on text (identical text can be a new turn).
       const key = input.turn_id ? `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}` : null;
       if (key && run.lastStopKey === key) return record;
-      if (run.managed && run.checkpoint?.status === 'completed') {
+      if (run.managed && run.checkpoint?.status === 'completed' && run.revision > run.consumedRevision) {
         await verifyAutomaticCriteria(record, now);
-        const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
+        const pending = pendingAcceptance(run);
         if (pending.length) {
-          run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`;
+          run.state = 'verification_pending'; run.reason = acceptancePendingReason(run);
           run.lastStopKey = key; notifyState(run, now); return record;
         }
       }
@@ -1082,7 +1160,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       const decision = decideStop(run, now);
       const selected = decision.run.managed?.decision;
       if (decision.output.decision === 'block' && provider === 'claude' && owner && run.managed.capability === 'live_hook' && ['local_edit', 'local_test'].includes(selected?.action.kind)) {
-        const unresolved = (await listRecords(root)).find(item => item.cwd === record.cwd && item.run?.managed?.executionUncertain);
+        const unresolved = (await listRecords(root)).find(item => sharesTaskWorkspace(item, record) && item.run?.managed?.executionUncertain);
         if (unresolved) {
           run.reason = 'Workspace has an unresolved prior execution; the original task must reconcile its effects using read-only evidence before another write.';
           run.updatedAt = now; output = {}; return record;
@@ -1104,13 +1182,13 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
           run.reason = claimedWorkspace.reason || 'Workspace is in use by another provider session; wait for its safe boundary.';
           run.updatedAt = now; output = {}; return record;
         }
-        const unresolvedAfterClaim = (await listRecords(root)).find(item => item.cwd === record.cwd && item.run?.managed?.executionUncertain);
+        const unresolvedAfterClaim = (await listRecords(root)).find(item => sharesTaskWorkspace(item, record) && item.run?.managed?.executionUncertain);
         if (claimedWorkspace.recoveredOwner || unresolvedAfterClaim) {
-          boundaryLease = { ownerId: claimedWorkspace.owner.id, cwd: record.cwd };
+          boundaryLease = { ownerId: claimedWorkspace.owner.id, cwd: taskDirectory(record), cwds: claimedWorkspace.owner.cwds };
           run.reason = 'Recovered workspace owner had unconfirmed effects; the original task must reconcile them before another write.';
           run.updatedAt = now; output = {}; return record;
         }
-        decision.run.managed.liveWorkspaceLease = { ownerId: claimedWorkspace.owner.id, decisionId: selected.id, attemptId };
+        decision.run.managed.liveWorkspaceLease = { ownerId: claimedWorkspace.owner.id, cwds: claimedWorkspace.owner.cwds, decisionId: selected.id, attemptId };
         decision.run.managed.executionAttempt = { id: attemptId, decisionId: selected.id, phase: 'dispatching', dispatchedAt: now, lastActivityAt: now };
       }
       record.run = decision.run; output = decision.output;
@@ -1124,7 +1202,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     if (claimedWorkspace?.release) await claimedWorkspace.release();
     throw error;
   }
-  if (boundaryLease) await releaseWorkspaceLease({ root, cwd: boundaryLease.cwd, ownerId: boundaryLease.ownerId });
+  if (boundaryLease) await releaseWorkspaceLease({ root, ...boundaryLease });
   return output;
 }
 export function canReplanDelivery(run, provider, now = Date.now()) {
@@ -1157,6 +1235,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     try { return await updateRecord(root, provider, session, record => {
     const run = record?.run;
     if (!run) throw new Error('Delivery Loop not found.');
+    if (record.providerArchived === true && !['stop', 'pause'].includes(action)) throw new Error('Restore the original provider conversation before changing Delivery Loop.');
     if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
@@ -1321,8 +1400,9 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
       const run = current.run;
       if (run.state === 'verification_pending' && run.managed) {
         await verifyAutomaticCriteria(current, now);
-        if (run.managed.acceptanceCriteria.every(item => Object.hasOwn(run.managed.verified, item.id))) {
-          run.state = 'completed'; run.reason = run.checkpoint.summary; run.updatedAt = now;
+        if (!pendingAcceptance(run).length) {
+          run.state = run.managed.acceptanceCriteria.length ? 'completed' : 'reported_done';
+          run.reason = run.managed.acceptanceCriteria.length ? run.checkpoint.summary : 'Original session reported the goal done; no independent acceptance check was available.'; run.updatedAt = now;
         }
       }
       const activeTurn = run.managed &&

package/src/codex-plugins/simy/hooks/workspace-lease.mjs

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { processIdentity } from './delivery-loop.mjs';
+import { processIdentity, taskDirectory, taskWorkspaceDirectories } from './delivery-loop.mjs';
 
 export async function leaseOwnerDead(owner, inspectProcess = processIdentity) {
   if (!owner?.identity || !Number.isSafeInteger(owner.pid) || owner.pid < 2) return false;
@@ -17,14 +17,38 @@ export async function leaseOwnerDead(owner, inspectProcess = processIdentity) {
 
 // Provider writer locks protect a conversation. This lock protects the files
 // shared by different conversations. Tests may write fixtures/build outputs.
-export async function acquireWorkspaceLease({ root, record, leaseId, inspectProcess = processIdentity, onRecover = async () => {}, processOwner }) {
+export async function acquireWorkspaceLease(options) {
+  const { record } = options;
   if (!['local_edit', 'local_test'].includes(record.run.managed.decision?.action.kind)) return { release: async () => {} };
-  const cwd = await realpath(record.cwd);
+  // A Codex workspaceWrite turn also includes its original thread cwd. Lock
+  // both roots in canonical order even when task work targets another folder.
+  const cwds = [...new Set(await Promise.all(taskWorkspaceDirectories(record).map(cwd => realpath(cwd))))].sort();
+  const resources = [], ownerId = randomUUID();
+  let recoveredOwner = null;
+  try {
+    for (const cwd of cwds) {
+      const resource = await acquireDirectoryLease({ ...options, cwd, ownerId });
+      recoveredOwner ||= resource.recoveredOwner;
+      if (resource.busy) {
+        await Promise.all(resources.map(item => item.release()));
+        return { ...resource, recoveredOwner };
+      }
+      resources.push(resource);
+    }
+    const task = await realpath(taskDirectory(record));
+    return { recoveredOwner, owner: { ...resources.find(item => item.owner.cwd === task).owner, cwds },
+      async release(options) { await Promise.all(resources.map(item => item.release(options))); } };
+  } catch (error) {
+    await Promise.all(resources.map(item => item.release()));
+    throw error;
+  }
+}
+async function acquireDirectoryLease({ root, record, leaseId, cwd, ownerId, inspectProcess = processIdentity, onRecover = async () => {}, processOwner }) {
   const directory = join(root, 'workspace-leases');
   await mkdir(directory, { recursive: true, mode: 0o700 });
   const lock = join(directory, createHash('sha256').update(cwd).digest('hex'));
   const ownerPid = processOwner?.pid || process.pid;
-  const owner = { id: randomUUID(), pid: ownerPid, identity: processOwner?.identity || await inspectProcess(ownerPid),
+  const owner = { id: ownerId, pid: ownerPid, identity: processOwner?.identity || await inspectProcess(ownerPid),
     taskId: record.run.managed.taskId, session: record.session, provider: record.provider,
     decisionId: record.run.managed.decision.id, leaseId, cwd, acquiredAt: Date.now() };
   // On Windows no POSIX process signature is available. Never reclaim a live
@@ -63,7 +87,10 @@ export async function acquireWorkspaceLease({ root, record, leaseId, inspectProc
   } };
 }
 
-export async function releaseWorkspaceLease({ root, cwd, ownerId }) {
+export async function releaseWorkspaceLease({ root, cwd, cwds = [cwd], ownerId }) {
+  await Promise.all([...new Set(cwds)].map(cwd => releaseDirectoryLease({ root, cwd, ownerId })));
+}
+async function releaseDirectoryLease({ root, cwd, ownerId }) {
   const lock = join(root, 'workspace-leases', createHash('sha256').update(await realpath(cwd)).digest('hex'));
   let owner;
   try { owner = JSON.parse(await readFile(join(lock, 'owner.json'), 'utf8')); } catch { return; }

package/src/codex-plugins/simy/skills/delivery-loop/SKILL.md

@@ -8,7 +8,7 @@ description: Continue an explicitly requested SIMY Delivery Loop in the current
 Use only when the user explicitly requests this skill or SIMY Delivery Loop for the current task. Installing this plugin does not opt a task in. Do not run SQM unless separately requested.
 
 1. Require the SIMY SessionStart hook context with the exact provider and session ID. If absent, explain how to install the SIMY plugin, review and enable its hooks with `/hooks`, and start a new conversation. Codex settings can be opened at `codex://settings`; a hooks subpage deep link is not guaranteed. Never change hook trust or bypass permissions yourself.
-2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. When the user explicitly asks for a managed task with durable acceptance tracking, add `--managed-file <task.json>` as described below. The loop stops after 3 failures/missing checkpoints and pauses for review when no progress is verified; it does not limit elapsed time or turns. Set a different failure limit only if the user requests it. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
+2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. For a Loop that must track acceptance, use the existing managed specification with `--managed-file <task.json>` as described below: freeze the original user outcome, the selected delivery level when one exists, and the necessary applicable acceptance criteria before work. A regular start without this specification is standard checkpoint tracking and can only end as `reported_done`; do not present it as a fully verified Agentic Loop. Do not fabricate a level selection or add engineering/SQM checks the user did not select or the task does not require. The loop stops after 3 failures/missing checkpoints and pauses for review when no progress is verified; it does not limit elapsed time or turns. Set a different failure limit only if the user requests it. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
 3. Work in the current conversation with its normal permissions. Before ending each turn, submit a JSON checkpoint through standard input with `simy delivery checkpoint --provider <provider> --session <id> --file -` (for example, a shell heredoc). This updates SIMY state; it does not require writing a checkpoint file to the user's workspace. A file path remains supported when authorized.
 
 Checkpoint shapes:
@@ -22,7 +22,7 @@ Checkpoint shapes:
 
 For missing information use `blocker: "missing_information"`. For a failed attempt use `status: "error"` and a concrete `nextStep`; repeated errors stop the loop. Do not reclassify blocked work as in_progress to force continuation. Never assume a provider error means permission to switch accounts, credentials, or bypass approvals.
 
-For completed work use `{"status":"completed","summary":"Actual result","acceptanceMet":true,"evidence":["Exact checks and observed results"]}` only after checking the user's acceptance criteria. Evidence is a report, not independent certification: preserve failed checks and deployment gaps. The hook must not infer success from optimistic closing text.
+For completed work use `{"status":"completed","summary":"Actual result","acceptanceMet":true,"evidence":["Exact checks and observed results"]}` only after checking the user's acceptance criteria. For standard tracking this ends as `reported_done`, never verified `completed`. In managed tracking SIMY independently checks frozen file predicates or waits for explicit user verification of manual criteria. Evidence is a report, not independent certification: preserve failed checks and deployment gaps. The hook must not infer success from optimistic closing text.
 
 4. The Stop hook evaluates checkpoints and supplies the next instruction within the original scope while progress is verified. Missing checkpoints count toward the repeated-failure circuit. A human interrupt stops the loop. Approval/input events block it. Provider errors/exits may require reopening the existing conversation; these hooks cannot restart a dead provider process.
 5. After the user explicitly resolves the blocker and requests continuation, `simy delivery resume --provider <provider> --session <id>` retains usage, failure and progress history; local time, turn and token counters do not stop work. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.
@@ -31,6 +31,8 @@ If the user selected **Continue this conversation** in SIMY desktop, the exact s
 
 For an explicitly enrolled managed task (`--managed-file`), keep its task ID and frozen acceptance criteria. Every `in_progress` or `error` checkpoint must include a concrete `proposedAction` with `kind`, `scope`, and `summary`, plus `remainingWork` when known. Allowed kinds are `read`, `local_edit`, `local_test`, `external`, `destructive`, `scope_change`, and `unknown`. Record an authorization blocker with the proposed next step and a scoped `approval` object; do not assert that a provider permission has been granted by a SIMY policy. A `completed` checkpoint with worker evidence may remain `verification_pending` until the local verifier or user confirms every criterion. Do not mark a manual criterion verified on the user's behalf.
 
+The optional `deliveryLevel` records an existing user selection as `{"requested":3,"effective":4,"numberingVersion":"assurance-ascending-v2","selectionRef":"user-turn:7"}`. Effective assurance cannot silently be lower than requested. A level is a recorded selection, not proof that checks at that level ran. Express selected, applicable tests, review, actual runtime/user outcome and SQM requirements as named acceptance criteria; semantic engineering checks remain `manual`, never a `file_exists` proxy. SQM `passed` with 0 applicable checks cannot establish quality acceptance. Do not weaken a failed requirement to make the Loop finish. Enrollment keeps the original objective, level and criteria across checkpoints and resume; changing a checkpoint cannot replace them.
+
 The managed file must include `initialAction` and nonempty `acceptanceCriteria`. Use only criteria the user actually agreed to, such as:
 
 ```json

package/src/coding-run-recovery.js

@@ -6,6 +6,11 @@ import { objectiveValueDigest, verifyObjective } from "./orchestrator/outcome-mo
 export function recoverySnapshot(snapshot) {
   const verified = snapshot?.charter && verifyObjective(snapshot.charter);
   const sanitized = redactExecutionValue(snapshot);
+  const receipt = snapshot?.metadata?.completed_worker_result;
+  if (receipt && JSON.stringify(receipt.attempt?.raw_output) !==
+      JSON.stringify(sanitized.metadata?.completed_worker_result?.attempt?.raw_output)) {
+    sanitized.metadata.completed_worker_result.result_redacted = true;
+  }
   const contract = sanitized?.charter?.thread_state?.objective_contract;
   const objectiveDigest = value => objectiveValueDigest(value, contract?.digest_algorithm);
   if (!contract || verified.legacy || !verified.valid) return sanitized;
@@ -28,6 +33,45 @@ export function recoverySnapshot(snapshot) {
   return sanitized;
 }
 
+// A terminal provider result is a receipt, not acceptance evidence. It only
+// authorizes re-collecting and auditing this same attempt without replaying it.
+export function completedWorkerResult(snapshot) {
+  const receipt = snapshot?.metadata?.completed_worker_result;
+  if (!receipt) return null;
+  const objective = verifyObjective(snapshot.charter);
+  const attempt = receipt.attempt;
+  const previous = snapshot.attempts?.filter(item => item.attempt_number !== attempt?.attempt_number) || [];
+  if (receipt.version !== 1 || receipt.run_id !== snapshot.id || !receipt.invocation_id ||
+      !objective.valid || objective.legacy || receipt.objective_digest !== objective.digest ||
+      receipt.result_redacted || receipt.persistence_failed || !Number.isInteger(attempt?.attempt_number) ||
+      attempt.attempt_number !== previous.length + 1 || attempt.status !== "completed" ||
+      !attempt.raw_output || typeof attempt.raw_output !== "object" || Array.isArray(attempt.raw_output) ||
+      !Object.keys(attempt.raw_output).length) return null;
+  return receipt;
+}
+
+// Remote ledgers deliberately omit the private result. A later echo must not
+// erase that receipt, while a revised objective or a later attempt supersedes it.
+export function preserveCompletedWorkerResult(local, remote) {
+  const receipt = completedWorkerResult(local);
+  if (!receipt) return remote;
+  const remoteState = remote.metadata?.pr_lifecycle_state || remote.state;
+  const unconsumedStates = ["dispatching", "coding", "collecting_evidence", "auditing", "independent_auditing"];
+  if (!unconsumedStates.includes(remoteState) &&
+      !(remoteState === "failed" && remote.metadata?.controller_result_recovery)) return remote;
+  const remoteAttempt = remote.attempts?.find(item => item.attempt_number === receipt.attempt.attempt_number);
+  if (remoteAttempt?.audit?.passed === false || remoteAttempt?.independent_audit || remoteAttempt?.pr_readiness ||
+      (remoteAttempt?.commit_sha && remoteAttempt.commit_sha !== receipt.attempt.commit_sha)) return remote;
+  const merged = structuredClone(remote);
+  merged.metadata ??= {};
+  merged.metadata.completed_worker_result = structuredClone(receipt);
+  merged.metadata.recovery_actor = structuredClone(local.metadata.recovery_actor);
+  if (local.metadata.execution_device_id) merged.metadata.execution_device_id = local.metadata.execution_device_id;
+  if (!completedWorkerResult(merged)) delete merged.metadata.completed_worker_result;
+  if (local.metadata.local_stop_requested) merged.metadata.local_stop_requested = true;
+  return merged;
+}
+
 export function recoveryActorBinding(session, apiOrigin, request) {
   return {
     device_id: session?.device_id || request?.execution_device_id || null,
@@ -47,6 +91,11 @@ export function assertRecoveryActor(run) {
     if (saved[field] && saved[field] !== current[field]) {
       const error = new Error(`The saved run belongs to another ${field}; restore its original authorized session.`);
       error.code = "recovery_actor_mismatch";
+      error.field = field;
+      error.recovery = { action: "reconnect_cli", steps: [
+        "Select the original SIMY Web host, account and organization.",
+        "Reconnect the original device, refresh the saved run and retry recovery.",
+      ] };
       throw error;
     }
   }

package/src/coding-run-store.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
-import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rename } from "node:fs/promises";
 import path from "node:path";
 
 import { recoverySnapshot } from "./coding-run-recovery.js";
@@ -30,8 +30,15 @@ export async function saveCodingRunSnapshot(root, snapshot) {
     });
     const target = `${key}.json`;
     const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`;
-    await writeFile(temporary, `${document}\n`, { mode: 0o600 });
+    const handle = await open(temporary, "wx", 0o600);
+    try { await handle.writeFile(`${document}\n`); await handle.sync(); }
+    finally { await handle.close(); }
     await rename(temporary, target);
+    // Persist the directory entry too on platforms that support directory fsync.
+    if (process.platform !== "win32") {
+      const directoryHandle = await open(directory, "r");
+      try { await directoryHandle.sync(); } finally { await directoryHandle.close(); }
+    }
   });
   writes.set(key, current);
   try { await current; } finally {

package/src/connection-diagnostics.js

@@ -0,0 +1,77 @@
+export function connectionScope(session, webOrigin) {
+  return {
+    web_origin: webOrigin,
+    account_id: session?.account_id || session?.auth_user_id || null,
+    organization_id: session?.organization_id || session?.org_id || null,
+    device_id: session?.device_id || null,
+  };
+}
+
+export function connectionDiagnostic(code, field = null) {
+  const scopeChanged = code === "connection_scope_changed";
+  const error = scopeChanged
+    ? `SIMY ${field.replaceAll("_", " ")} changed. Restore the account, organization, device and Web host that authorized this run before reconnecting.`
+    : {
+        connection_service_mismatch:
+          "The discovered port belongs to a different service. Run simy doctor, then reconnect to the original SIMY Web host.",
+        connection_service_unavailable:
+          "A SIMY service is recorded but cannot be reached. Run simy doctor; reopen SIMY or restart the confirmed daemon before reconnecting.",
+        connection_service_not_background:
+          "The existing SIMY service runs in a foreground terminal. Keep that terminal open, or stop it when idle and start simy --daemon before reconnecting.",
+        connection_port_mismatch:
+          "The existing SIMY service uses a different port. Reconnect without --port to reuse it, or select its recorded port.",
+        connection_session_changed:
+          "SIMY sign-in changed while the launch was being authorized. Refresh this run on the original device before retrying.",
+        connection_service_incompatible:
+          "The existing SIMY service has an incompatible version or API. Run simy update --check; update or restart that service when its tasks are idle.",
+        connection_session_expired:
+          "SIMY sign-in expired. Open the verification link for the existing service and sign in to the original account and organization.",
+        launch_challenge_expired:
+          "The launch credential expired. Retry this same run to obtain a fresh credential.",
+        launch_challenge_consumed:
+          "This launch credential was already used. Refresh the run status on its original device before retrying; execution may already have started.",
+        launch_scope_mismatch:
+          "This run or credential is unavailable for the current account, organization or device. Reconnect to the service and identity that authorized the run.",
+        launch_challenge_invalid:
+          "The launch credential is invalid. Refresh this run in SIMY Web and reconnect to its original device.",
+        launch_service_incompatible:
+          "SIMY Web does not support launch-credential recovery yet. Update the Web service, refresh this run and retry on its original device.",
+        launch_service_unavailable:
+          "The SIMY launch service could not be reached. Check the connection and retry this same run.",
+        launch_run_not_queued:
+          "This run has already progressed or stopped. Refresh its status on the original device before starting anything again.",
+      }[code] ||
+      "SIMY could not authorize this launch. Refresh the run in SIMY Web and reconnect to its original device.";
+  return {
+    error,
+    code,
+    ...(field ? { field } : {}),
+    recovery: {
+      action: "reconnect_cli",
+      steps:
+        scopeChanged || code === "launch_scope_mismatch"
+          ? [
+              "Select the original SIMY Web host, account and organization.",
+              "Reconnect the original device, refresh the run and retry.",
+            ]
+          : [error],
+    },
+  };
+}
+
+export function assertConnectionScope(expected, current) {
+  for (const field of [
+    "web_origin",
+    "account_id",
+    "organization_id",
+    "device_id",
+  ]) {
+    if (expected?.[field] && expected[field] !== current?.[field]) {
+      const diagnostic = connectionDiagnostic(
+        "connection_scope_changed",
+        field,
+      );
+      throw Object.assign(new Error(diagnostic.error), diagnostic);
+    }
+  }
+}