@awak-app/simy-cli 0.6.17 → 0.6.19

package/src/native-development-report-completion.js

@@ -0,0 +1,143 @@
+import { createHash } from "node:crypto";
+
+import {
+  NATIVE_DEVELOPMENT_REPORT_COMPLETIONS_PATH,
+  normalizeNativeDevelopmentReportCompletionReceipt,
+} from "./native-development-reports.js";
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SHA256 = /^[0-9a-f]{64}$/;
+const SOURCES = new Set(["user", "file_exists", "file_contains", "file_equals"]);
+const MAX_CRITERIA = 50;
+
+// This creates a device-authenticated local attestation. It is deliberately a
+// projection of the enrolled record and never asserts server-side verification.
+export function projectNativeDevelopmentReportCompletion({ enrollment, record } = {}) {
+  if (!isEnabledEnrollment(enrollment) || !isExactCompletedRecord(record, enrollment)) return null;
+
+  const run = record.run;
+  const managed = run.managed;
+  const criteria = managed.acceptanceCriteria;
+  const frozenAt = currentFrozenEnrollmentAt(run, criteria);
+  if (frozenAt === null || !Array.isArray(criteria) || criteria.length === 0 || criteria.length > MAX_CRITERIA) return null;
+
+  const projectedCriteria = [];
+  for (const criterion of criteria) {
+    const projected = projectCriterion(criterion, managed.verified, managed.criterionObservations, frozenAt);
+    if (!projected) return null;
+    projectedCriteria.push(projected);
+  }
+  projectedCriteria.sort((left, right) => left.id_hash.localeCompare(right.id_hash));
+  if (new Set(projectedCriteria.map((criterion) => criterion.id_hash)).size !== projectedCriteria.length) {
+    return null;
+  }
+
+  const verifiedAtMs = Math.max(...projectedCriteria.map((criterion) => Date.parse(criterion.checked_at)));
+  if (!Number.isFinite(verifiedAtMs)) return null;
+  const checkpoint = run.checkpoint;
+  return Object.freeze({
+    provider: enrollment.provider,
+    provider_session_id: enrollment.provider_session_id.toLowerCase(),
+    enrollment_revision: enrollment.revision,
+    task_id: managed.taskId.toLowerCase(),
+    managed_revision: run.revision,
+    checkpoint_digest: digest(checkpoint),
+    acceptance_digest: digest(projectedCriteria),
+    verified_at: new Date(verifiedAtMs).toISOString(),
+    criteria: projectedCriteria,
+  });
+}
+
+export async function sendNativeDevelopmentReportCompletion({ api, enrollment, record } = {}) {
+  if (!api || typeof api.submitCompletion !== "function") {
+    throw new TypeError("A native development reports API with submitCompletion is required");
+  }
+  const completion = projectNativeDevelopmentReportCompletion({ enrollment, record });
+  if (!completion) return null;
+  const receipt = await api.submitCompletion(completion);
+  return normalizeNativeDevelopmentReportCompletionReceipt(receipt, completion);
+}
+
+function isEnabledEnrollment(enrollment) {
+  return Boolean(
+    enrollment &&
+      enrollment.enabled === true &&
+      enrollment.provider === "codex" &&
+      UUID.test(enrollment.provider_session_id || "") &&
+      Number.isSafeInteger(enrollment.revision) &&
+      enrollment.revision > 0,
+  );
+}
+
+function isExactCompletedRecord(record, enrollment) {
+  const run = record?.run;
+  const managed = run?.managed;
+  return Boolean(
+    record &&
+      record.provider === enrollment.provider &&
+      typeof record.session === "string" &&
+      record.session.toLowerCase() === enrollment.provider_session_id.toLowerCase() &&
+      run?.state === "completed" &&
+      run.checkpoint?.status === "completed" &&
+      run.recoveryCause !== "process_exit" &&
+      managed &&
+      managed.thread?.provider === record.provider &&
+      managed.thread?.id === record.session &&
+      UUID.test(managed.taskId || "") &&
+      Number.isSafeInteger(run.revision) &&
+      run.revision >= 0,
+  );
+}
+
+function currentFrozenEnrollmentAt(run, criteria) {
+  const enrollment = run.managed?.enrollment;
+  const frozenAt = typeof enrollment?.frozenAt === "number" ? enrollment.frozenAt : NaN;
+  if (!enrollment || !Number.isFinite(frozenAt) || frozenAt < 0 ||
+      enrollment.objective !== run.objective ||
+      enrollment.acceptanceDigest !== loopDigest(criteria) ||
+      canonicalJson(enrollment.deliveryLevel ?? null) !== canonicalJson(run.managed.deliveryLevel ?? null)) return null;
+  return frozenAt;
+}
+
+function projectCriterion(criterion, verified, observations, frozenAt) {
+  if (!criterion || typeof criterion !== "object" || typeof criterion.id !== "string" || !criterion.id) {
+    return null;
+  }
+  const expectedSource = sourceForCheck(criterion.check?.type);
+  const evidence = verified?.[criterion.id];
+  const checkedAt = normalizeIso(evidence?.checkedAt);
+  if (!expectedSource || !checkedAt || Date.parse(checkedAt) < frozenAt || evidence?.source !== expectedSource) return null;
+
+  const observation = observations?.[criterion.id];
+  if (observation && (observation.passed !== true || observation.criterion_id !== criterion.id)) return null;
+  if (expectedSource !== "user" && !SHA256.test(evidence?.sha256 || "")) return null;
+  return Object.freeze({
+    id_hash: digest(criterion.id),
+    source: expectedSource,
+    checked_at: checkedAt,
+    evidence_digest: digest({ evidence, observation: observation || null }),
+  });
+}
+
+function sourceForCheck(type) {
+  return type === "manual" ? "user" : SOURCES.has(type) ? type : null;
+}
+
+function normalizeIso(value) {
+  const parsed = typeof value === "number" ? value : typeof value === "string" ? Date.parse(value) : NaN;
+  return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+
+function digest(value) {
+  return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+
+function loopDigest(value) {
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}

package/src/native-development-reports.js

@@ -0,0 +1,137 @@
+import { webApiErrorMessage, webApiHeaders, webApiUrl } from "./web-api.js";
+
+export const NATIVE_DEVELOPMENT_REPORTS_PATH = "native-development-reports";
+export const NATIVE_DEVELOPMENT_REPORT_COMPLETIONS_PATH = "native-development-report-completions";
+
+const PROVIDERS = new Set(["codex", "claude"]);
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const CONTROL = /[\x00-\x1f\x7f]/;
+
+export class NativeDevelopmentReportsError extends Error {
+  constructor(message, { code = "native_development_reports_unavailable", status = null } = {}) {
+    super(message);
+    this.name = "NativeDevelopmentReportsError";
+    this.code = code;
+    this.status = status;
+  }
+}
+
+export function normalizeNativeDevelopmentReportEnrollment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalidResponse();
+  const keys = Object.keys(value).sort();
+  const expected = ["enabled", "provider", "provider_session_id", "request_title", "revision"];
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw invalidResponse();
+  if (!PROVIDERS.has(value.provider) || !UUID.test(value.provider_session_id) ||
+      typeof value.request_title !== "string" || value.request_title.length > 160 || CONTROL.test(value.request_title) ||
+      typeof value.enabled !== "boolean" || !Number.isSafeInteger(value.revision) || value.revision < 0 ||
+      (value.enabled && value.revision === 0)) throw invalidResponse();
+  return Object.freeze({
+    provider: value.provider,
+    provider_session_id: value.provider_session_id.toLowerCase(),
+    request_title: value.request_title,
+    enabled: value.enabled,
+    revision: value.revision,
+  });
+}
+
+export function normalizeNativeDevelopmentReportSave(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new NativeDevelopmentReportsError("Invalid development report request.", { code: "invalid_native_development_report_request" });
+  const keys = Object.keys(value).sort();
+  const expected = ["enabled", "expected_revision", "provider", "provider_session_id", "request_title"];
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new NativeDevelopmentReportsError("Invalid development report request.", { code: "invalid_native_development_report_request" });
+  if (!PROVIDERS.has(value.provider) || !UUID.test(value.provider_session_id) || typeof value.enabled !== "boolean" ||
+      !Number.isSafeInteger(value.expected_revision) || value.expected_revision < 0 ||
+      typeof value.request_title !== "string") throw new NativeDevelopmentReportsError("Invalid development report request.", { code: "invalid_native_development_report_request" });
+  const requestTitle = value.request_title.trim();
+  if (requestTitle.length > 160 || CONTROL.test(requestTitle) || (value.enabled && requestTitle.length === 0)) {
+    throw new NativeDevelopmentReportsError("Invalid development report title.", { code: "invalid_native_development_report_request" });
+  }
+  return Object.freeze({
+    provider: value.provider,
+    provider_session_id: value.provider_session_id.toLowerCase(),
+    request_title: requestTitle,
+    enabled: value.enabled,
+    expected_revision: value.expected_revision,
+  });
+}
+
+export function normalizeNativeDevelopmentReportCompletionReceipt(value, completion) {
+  if (!value || typeof value !== "object" || Array.isArray(value) ||
+      Object.keys(value).sort().join(",") !== "enrollment_revision,receipt_id,status,task_id") {
+    throw invalidResponse();
+  }
+  if (!UUID.test(value.receipt_id) || !UUID.test(value.task_id) ||
+      !Number.isSafeInteger(value.enrollment_revision) || value.enrollment_revision < 1 ||
+      !["pending", "sent", "suppressed"].includes(value.status) ||
+      !completion || value.task_id.toLowerCase() !== completion.task_id.toLowerCase() ||
+      value.enrollment_revision !== completion.enrollment_revision) {
+    throw invalidResponse();
+  }
+  return Object.freeze({
+    receipt_id: value.receipt_id.toLowerCase(),
+    task_id: value.task_id.toLowerCase(),
+    enrollment_revision: value.enrollment_revision,
+    status: value.status,
+  });
+}
+
+export function createNativeDevelopmentReportsApi({ webOrigin, readSession, fetchImpl = globalThis.fetch } = {}) {
+  if (typeof readSession !== "function") throw new TypeError("readSession is required");
+  if (typeof fetchImpl !== "function") throw new TypeError("fetchImpl is required");
+
+  const sessionForRequest = async () => {
+    const session = await readSession();
+    if (!session?.token || !session?.api_base_url) {
+      throw new NativeDevelopmentReportsError("SIMY desktop sign-in is required.", { code: "device_session_unavailable" });
+    }
+    return session;
+  };
+  const request = async (method, body = undefined, path = NATIVE_DEVELOPMENT_REPORTS_PATH) => {
+    const session = await sessionForRequest();
+    let response;
+    try {
+      response = await fetchImpl(webApiUrl(path, {
+        webOrigin, apiBaseUrl: session.api_base_url,
+      }), {
+        method,
+        headers: webApiHeaders({ token: session.token }, body === undefined ? {} : { "Content-Type": "application/json" }),
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        signal: AbortSignal.timeout(10_000),
+        cache: "no-store",
+      });
+    } catch {
+      throw new NativeDevelopmentReportsError("Development report settings could not be reached.");
+    }
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new NativeDevelopmentReportsError(webApiErrorMessage(payload, response.status), {
+        code: response.status === 409 ? "conflict" : "native_development_reports_unavailable",
+        status: response.status,
+      });
+    }
+    return payload;
+  };
+  return {
+    async list() {
+      const payload = await request("GET");
+      if (!payload || typeof payload !== "object" || Array.isArray(payload) ||
+          Object.keys(payload).length !== 1 || !Array.isArray(payload.enrollments)) throw invalidResponse();
+      return payload.enrollments.map(normalizeNativeDevelopmentReportEnrollment);
+    },
+    async save(value) {
+      const requestValue = normalizeNativeDevelopmentReportSave(value);
+      const payload = await request("PUT", requestValue);
+      if (!payload || typeof payload !== "object" || Array.isArray(payload) ||
+          Object.keys(payload).length !== 1) throw invalidResponse();
+      return normalizeNativeDevelopmentReportEnrollment(payload.enrollment);
+    },
+    async submitCompletion(value) {
+      const payload = await request("POST", value, NATIVE_DEVELOPMENT_REPORT_COMPLETIONS_PATH);
+      return normalizeNativeDevelopmentReportCompletionReceipt(payload, value);
+    },
+  };
+}
+
+function invalidResponse() {
+  return new NativeDevelopmentReportsError("Development report settings returned an invalid response.", { code: "invalid_native_development_reports_response" });
+}

package/src/orchestrator/checklist-continuation.js

@@ -5,8 +5,13 @@ export const ACCEPTANCE_EVIDENCE_PATH = fileURLToPath(
   new URL("./delivery/references/acceptance-evidence.md", import.meta.url),
 );
 
+export const DELIVERY_STATE_MODEL_PATH = fileURLToPath(
+  new URL("./delivery/references/state-model.md", import.meta.url),
+);
+
 export function buildChecklistContinuationInstruction({ auditor = false } = {}) {
   return section("checklist_continuation_contract", [
+    `Read the integrated delivery state model: ${DELIVERY_STATE_MODEL_PATH}. Keep proven delivery milestones, controller execution states, and final dispositions distinct. Follow the repair/reverify and evidence-invalidation branches; a PR readiness state never proves deployment or overall completion. The model documents the existing controller and executor duties, not an automatic scheduler or new transition validator.`,
     `The table is a progress checkpoint, not the deliverable or a stopping condition. Read: ${ACCEPTANCE_EVIDENCE_PATH}`,
     "Maintain the complete 依頼チェックリスト with columns #, ご依頼, 現状, 判定 in the evidence record after chartering, each evaluated attempt, and in the final receipt. User-facing reporting follows workflow_reporting_contract; show the full table only when requested or when it is the most useful requested answer, never as mandatory commentary. Preserve stable criterion IDs, all rows and both applicable evidence layers. ✅ requires current valid passing evidence for every applicable layer; ❌ means an observed failure; 🟡 means pending, missing, stale, blocked or unverifiable evidence. Retain counts and highest proven state in that record.",
     "After observing any non-green row, classify its cause and immediately take the next safe authorized action: implement missing behavior, repair a failure, exercise an untested path, collect missing evidence, or rerun stale verification. Re-observe the same criterion against the current candidate, run the validator, update the table, and repeat until every applicable requested outcome and gate for the authorized endpoint is verified. A next-action list without performing feasible actions is not completion. Never require another continue request merely because a table was shown.",

package/src/orchestrator/delivery/WORKFLOW.md

@@ -406,6 +406,10 @@ decision when the trade-off materially changes.
 
 ## Keep delivery states distinct
 
+Use the [integrated state model](references/state-model.md) for repair, wait,
+resume, evidence invalidation and endpoint boundaries. It distinguishes these
+delivery milestones from actual CLI controller states and final dispositions.
+
 Track and report the highest state actually proven:
 
 `chartered -> reproduction_verified -> implemented -> locally_verified -> pr_ci_green -> integration_verified -> user_like_local_verified -> merged -> deployed_exact_revision -> health_verified -> live_verified -> cleanup_verified -> done`
@@ -517,6 +521,14 @@ boundary from a simplified unit fixture.
 
 ### 2. Isolate and implement
 
+Choose the smallest change sufficient for the original purpose and acceptance.
+Tie substantive behavior, abstractions, configuration, compatibility, docs and
+tests to a criterion or observed failure. Independent review must identify
+unnecessary scope or complexity with file/line, burden, a smaller alternative,
+preserved criteria and required verification. Do not optimize line counts or
+remove required behavior, authorization, data integrity, concurrency, recovery,
+regression coverage or evidence to shorten the diff.
+
 Start from the latest required base in a dedicated worktree. Preserve user
 changes. Build the smallest behaviorally correct patch and add a regression
 that fails against the pre-fix behavior at the escaped boundary. Derive its

package/src/orchestrator/delivery/references/state-model.md

@@ -0,0 +1,187 @@
+# Delivery Loop の統合状態モデル
+
+現行CLIの正本。対象は CLI Agentic Loop (`src/orchestrator/loop.js`) と、
+そのexecutorが従うDelivery workflow。ローカルhook型Loopとは区別する。
+図は新しいruntime enumや自動スケジューラを追加しない。
+
+## 1. 利用者が判断する全体図
+
+目的は、元の依頼を満たした証拠が揃うまで、安全に実装・検証を続けること。
+「今どこまで証明できたか」「次に何をするか」「今回の終了理由」を分けて保持する。
+以下はexecutor/auditorの行動契約であり、各矢印がCLIに自動実装済みという意味ではない。
+
+```mermaid
+flowchart TD
+  Contract[目的・体験・成功条件・権限・終了地点を固定] --> Baseline[現状と再現を確認・リスク相応のレビュー計画]
+  Baseline --> Work[実装・修正・不足証拠の取得]
+  Work --> Verify[現在の版で検証・チェックリスト更新]
+  Verify --> Review[独立レビュー・元の依頼と証拠を照合]
+  Review --> Decision{未達の原因と次の行動}
+  Decision -->|安全に修正・再検証できる| Work
+  Decision -->|CI等が進行中| Wait[上限のある待機・再確認]
+  Wait --> Verify
+  Decision -->|本当の権限・入力不足／進捗停止| Hold[未完了を記録・独立して進められる作業は続行]
+  Hold -->|不足解消・必要な承認・再開| Verify
+  Decision -->|全行と適用ゲートが合格| Endpoint{固定した終了地点}
+  Endpoint -->|PRまで| PR[PRの検証結果・残る非対象作業を記録]
+  Endpoint -->|配備までの権限あり| Release[マージ・exact revision配備・段階的な公開]
+  Release --> Live[health・実利用経路・成果とguardrailを観測]
+  Live -->|未達・回帰| Recovery[公開保留／権限内のrollback・修正]
+  Recovery --> Work
+  Live -->|合格| Cleanup[cleanupと最終証拠を確認・As-Is更新]
+  PR --> Final[元の依頼・全行・終了地点を最終照合]
+  Cleanup --> Final
+  Final -->|現在の証拠で全条件合格| Complete[依頼範囲の完了を報告]
+  Final -->|不足・失効| Decision
+```
+
+- チェックリストの◎相当は現行表記の **✅**。適用する体験・技術の両層に、
+  現在の候補と条件に束縛された合格証拠が必要。🟡・❌は完了ではない。
+- 目的・体験ID・受入条件は保持する。全行を消さずに修正→検証→更新を繰り返す。
+  個別の軽微な指摘の扱いは実際の監査判定に従い、未達の受入条件を軽微扱いして免除しない。
+- PRのみの依頼はmerge/deployを許可しない。一方、配備までの依頼をPR作成で終えない。
+- 自動待機を装わない。利用できるbounded wait/recheckまたは承認済みmonitorを使い、
+  継続不能なら具体的な制約と再開条件を残す。停止指示は尊重する。
+- 修正によってhead/base/設定/依存版/環境/成功条件が変われば、影響する証拠を失効させて
+  再検証する。過去の合格履歴は消さず、現在も合格とは扱わない。
+
+## 2. 証明済みの到達段階と品質ゲート
+
+次の13段階は成果のmilestoneであり、下節のcontroller stateとは別。
+順番だけで昇格せず、適用証拠を確認する。非該当は理由を明示する。
+
+```mermaid
+flowchart LR
+  chartered --> reproduction_verified --> implemented --> locally_verified
+  locally_verified --> pr_ci_green --> integration_verified --> user_like_local_verified
+  user_like_local_verified --> merged --> deployed_exact_revision
+  deployed_exact_revision --> health_verified --> live_verified --> cleanup_verified --> done
+```
+
+| 昇格箇所 | 保持すべき品質ゲート |
+|---|---|
+| chartered / reproduction_verified | 元の依頼・完全な利用体験・As-Is差分・成功契約・権限・レビュー計画 |
+| implemented / locally_verified | 修正、体験全体と技術的不変条件、必要な独立レビュー、現行証拠 |
+| PR準備と検証 | PR preparationの8行と4条件付きsafeguard、最新remote base/current head、CI・E2E・skip開示・差分・cleanup。明示opt-in時のSQM |
+| integration_verified / user_like_local_verified | 統合候補と実利用同等の経路。CI greenだけでは代替しない |
+| merged / deployed_exact_revision | 各操作の権限、正確な配備版、rolloutのpromote/hold/rollback条件 |
+| health_verified / live_verified | 稼働確認と利用者の成果を区別し、必要な観測windowとguardrailを検証 |
+| cleanup_verified / done | 適用する後片付け・最終受入条件・receipt。検証済みAs-Isを更新 |
+
+この表はworkflow上の要求。各条件の機械検証範囲は既存validatorとcollectorに従い、
+図だけを根拠に検証済みとはしない。詳細は [state and receipts](state-and-receipts.md)、
+[minimum completion](minimum-completion.md)、[acceptance evidence](acceptance-evidence.md)。
+PR範囲の完了を報告しても、未配備のmilestoneを `done` に進めない。
+
+## 3. 現行controllerの実際の制御
+
+以下は `loop.js` / `audit.js` と保存済みworker結果の復帰経路。`Gate`、`Receipt`、`RecheckGate`、`Failure` は説明用の判定節点。
+新規runの契約不備は `waiting_human`。resume時も目的・minimum契約を再検査する。
+
+```mermaid
+flowchart TD
+  queued --> Gate{目的・minimum契約の検査}
+  Gate -->|不備| waiting_human
+  Gate -->|新規| risk_classifying
+  risk_classifying -->|charter不備| waiting_human
+  risk_classifying -->|有効| chartering
+  chartering --> Receipt{保存済みworker結果の検査}
+  Gate -->|resume・既存attempt・契約有効| Receipt
+  Receipt -->|保存結果なし| dispatching
+  Receipt -->|保存結果が不正| waiting_human
+  Receipt -->|有効な完了結果・同じattemptを復帰| collecting_evidence
+  dispatching --> coding --> collecting_evidence --> auditing
+  coding -->|完了結果の保存失敗・復帰対象外で照合待ち| failed
+  collecting_evidence & auditing & independent_auditing -->|有効な保存結果あり・controller例外| failed
+  collecting_evidence -->|保存結果あり・収集の再試行も失敗| waiting_human
+  independent_auditing -->|保存結果あり・証拠再収集の再試行も失敗| waiting_human
+  auditing -->|合格| independent_auditing
+  auditing -->|不合格| Failure{失敗原因・進捗・再試行判定}
+  independent_auditing -->|証拠を再収集し監査・独立レビュー不合格| Failure
+  independent_auditing -->|両方合格・PR条件未達| pr_ready_for_review
+  independent_auditing -->|両方合格・PR条件全合格| merge_ready
+  Failure -->|修正可能| re_instructing
+  re_instructing --> dispatching
+  Failure -->|同一失敗／成果の進捗なし| blocked
+  Failure -->|人の入力が必要／連続して評価不能| waiting_human
+  pr_ready_for_review -->|callerまたはdaemonのrecheck| RecheckGate{目的契約とレビューの目的digest}
+  merge_ready -->|callerまたはdaemonのrecheck| RecheckGate
+  RecheckGate -->|不備| waiting_human
+  RecheckGate -->|有効| checking_pr
+  checking_pr -->|現在の証拠・レビュー束縛を含むPR条件未達| pr_ready_for_review
+  checking_pr -->|現在のPR条件全合格| merge_ready
+  blocked -->|原因解消・許可されたresume| Gate
+  waiting_human -->|入力・許可されたresume| Gate
+  failed -->|復旧対象の完了結果あり・runnerで復元| waiting_human
+  waiting_human -->|中断復元・有効な完了結果・daemonの認証と作業権限確認| Gate
+```
+
+- 実行中のstop確認点で `stopped` に戻る。図は割込みを全辺に描いていない。
+  停止を自動解除しない。`local_stop_requested` を保持し、手動停止をdaemonの復帰対象にしない。
+- `handleFailedAudit` は失敗原因を決定論的に分岐する。修正可能な失敗は
+  `re_instructing` から次のattemptへ。成果評価不能は成果の停滞と同一視しない。
+- `budget.js` は現在 `local_limits_removed: true`。token/回数は観測・通知の値で、
+  `canStartProvider` は消費量で止めず `codingAttemptCeiling` は無限。
+  旧版の「3回／予算切れ→終了」を現行の通常経路として復活させない。
+  残っているbudget停止用コードは現行の到達可能な通常経路として描いていない。
+  外部providerの制約や停止・承認・進捗保護を無視してよいという意味ではない。
+- `runCodingLoop` はPR readinessを返すと終了する。既存attemptがあり、保存済み
+  `completed_worker_result` がない非resume呼出しは `checking_pr` で再評価し、
+  再実装・新しい独立レビューは行わない。修正や新しいレビューが必要なら、
+  適切なresumeで新attemptを実行する。保存済み結果がある場合は下記の復帰経路になる。
+  既存の認証済みdaemonは稼働中、作業実行が許可され、他のoperation/childがない
+  PR-ready runを定期recheckする（`agent.js` / `runner.js`）。daemon不在・認証切れでは
+  この監視を期待できず、recheck自体は修正attemptを開始しない。
+  この資料は追加のmonitorや自動resumeを起動しない。
+- 有効な `completed_worker_result` があれば、同じattemptのworkerを再実行せず
+  `collecting_evidence` から監査・独立監査をやり直す（`completed_worker_result_recovered`）。
+  保存結果は受入証拠ではなく、run・目的digest・attempt等への束縛を再検査する。
+  不正な結果は `WORKER_RESULT_UNVERIFIED` で `waiting_human`。
+  保存結果がある証拠収集は最大2回再試行し、失敗が続けば結果を保持したまま
+  `EVIDENCE_COLLECTION_UNAVAILABLE` で `waiting_human`。再開時も同じattemptから再収集する。
+  完了結果の永続化失敗は `worker_result_persistence_failed` をrunnerへ伝え、
+  `failed` と照合待ちを記録する。保存に失敗した結果を安全な復帰用receiptと扱わない。
+- 既存daemonは、中断状態（または `controller_result_recovery` 付きの `failed`）を
+  復元すると、目的・結果・actor束縛・認証・作業権限を確認し、停止要求や他のoperation/childが
+  なければ `recoverCompletedLocalCodingRun` で検証を自動復帰する。
+  すべての `waiting_human` を自動解除する機能ではなく、通常のPR recheckとも別経路。
+  この既存の復帰制御を説明する資料であり、新しいdaemonやLoopの起動を許可するものではない。
+- recheck前の目的契約不正、または評価済み成果の `outcome_progress.objective_digest` 不一致は
+  `waiting_human`。head/base等に対する `evidence_identity_sha256` の失効・不足は
+  PR readinessの未達として `pr_ready_for_review` になり、同じ扱いではない。
+- `pr_ready_for_review` はpending状態で、名前だけでは実装の合格さえ保証しない。
+  recheckで古い証拠が失効した場合もこの状態になる。checksとpending reasonsを読む。
+- `merge_ready` と `done_gate_passed` は現在のPR readiness判定。
+  マージ実行、配備、元の依頼全体の完了を証明しない。
+
+## 4. 最終報告と証拠の失効
+
+`verified_complete / best_available / blocked / failed / cancelled` はworkflowの
+終了理由。controller enumと混ぜたり、すべてを `done` に変換したりしない。
+`verified_complete` は固定した依頼範囲の全条件が現在の証拠で満たされた場合のみ。
+
+| 変化・停止 | 必要な行動 |
+|---|---|
+| head/base/環境/依存版の変化 | 影響する証拠をpendingに戻し、同じ受入IDで再取得・独立照合 |
+| 承認された目的変更 | successor契約として履歴保持。旧目的のレビューを再利用しない |
+| CIや依存処理の実行中 | bounded wait/recheck。重複jobを起動せず、未変化だけでblockedにしない |
+| 人の権限・入力が本当に不足 | affected IDs、根拠、必要入力、owner、再開条件を記録。独立作業は継続 |
+| 同じ失敗・成果停滞 | 原因と別の安全な方針を検討し、controllerの保護を迂回せず再開 |
+| 中止 | チェックポイントと最高到達段階を保持し、未完了として報告 |
+
+これは既存制御の説明とexecutor/auditorへの契約であり、追加の遷移強制validatorではない。
+
+## 5. 過去版との比較と採用理由
+
+| 版 | 採用する点 | 単独では足りない点 |
+|---|---|---|
+| [9月8日 Slack仕様](https://specialist-doctors.slack.com/archives/C04URHQBJV7/p1788832579923809) | 13 milestones、単一controller、証拠・終了理由の分離 | 当時の回数・予算停止を現行に適用できない |
+| [9月14日 #79](https://github.com/SpecialistDoctors-Inc/simy-cli/pull/79) | 未達→修正→再検証、確認不能からの復帰、minimumと全体完了の区別 | 体験全体・PR準備・rolloutの詳細が足りない |
+| [9月16日 #97](https://github.com/SpecialistDoctors-Inc/simy-cli/pull/97) | 体験・レビュー計画・PR preparation・段階的配備・As-Is更新 | 主経路中心で、待機・修正・再開や実装との対応が読み取りづらい |
+| 現行CLI 0.6.11 / 基準commit `3b9b453` | 実際の修正ループ、完了済みworker結果からの検証復帰、証拠再取得、進捗保護、PR recheck | workflowの13 milestonesとcontroller stateを一つの状態として読むと誤解する |
+| 本統合版 | 全体判断図＋到達段階と品質ゲート＋実装制御図を相互参照 | 図や指示による保証範囲を超えた自動制御は追加しない |
+
+8月31日・9月2日のSlack ZIP添付は存在と名称のみ確認でき、本文を取得できなかったため、
+内容の優劣を断定していない。上表は読めた一次資料と現行ソースに基づく選定。
+未マージPRの機能は現行として含めない。更新時は `loop.js`、`audit.js`、`budget.js`、
+`outcome-monitor.js`、`checklist-continuation.js`、`coding-run-recovery.js`、`runner.js`、`agent.js` と突合し、3層を一緒に見直す。

package/src/orchestrator/independent-audit.js

@@ -1,3 +1,4 @@
+import { minimalSufficientChangeInstruction } from "../codex-plugins/simy/hooks/minimal-sufficient.mjs";
 import { buildAcceptedHumanGuidanceInstruction, buildWorkflowReportingInstruction } from "../workflow-reporting.js";
 import { bullets, cleanString, section } from "./shared.js";
 import { buildPrClosureInstruction } from "./pr-closure.js";
@@ -26,6 +27,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
 
   return [
     buildUxSpecificationInstruction({ auditor: true }),
+    section("minimal_sufficient_change", minimalSufficientChangeInstruction({ auditor: true })),
     buildDeliveryLevelInstruction({ auditor: true }),
     buildChecklistContinuationInstruction({ auditor: true }),
     buildWorkflowReportingInstruction({ auditor: true }),

package/src/orchestrator/instruction.js

@@ -1,3 +1,4 @@
+import { minimalSufficientChangeInstruction } from "../codex-plugins/simy/hooks/minimal-sufficient.mjs";
 import { buildAcceptedHumanGuidanceInstruction, buildWorkflowReportingInstruction } from "../workflow-reporting.js";
 import { minimumCharter } from "./delivery/scripts/check-minimum-completion.mjs";
 import { bullets, looksLikeUiTask, section } from "./shared.js";
@@ -23,6 +24,7 @@ export function buildCodingInstruction(
   const sections = [
     section("role", "You are the local coding executor for a SIMY agentic loop."),
     buildUxSpecificationInstruction(),
+    section("minimal_sufficient_change", minimalSufficientChangeInstruction()),
     buildDeliveryLevelInstruction(),
     buildChecklistContinuationInstruction(),
     buildWorkflowReportingInstruction(),