@awak-app/simy-cli 0.6.23 → 0.6.26

package/src/codex-plugins/simy/skills/delivery-loop/SKILL.md

@@ -5,10 +5,24 @@ description: Continue an explicitly requested SIMY Delivery Loop in the current
 
 # SIMY Delivery Loop
 
+## Select the matching local runtime
+
+When `$HOME/.simy/bin/simy` exists, prefer that fixed local candidate for the
+`simy delivery ...` commands below. Read its `--version` and `delivery runtime status`
+first, and require version 0.6.24 or newer with `purposeVersion:2` and
+`decisionPolicy:"llm-first-hc102"`. Use the selected absolute CLI path consistently
+for start, checkpoint, status, controls and supervision; do not mix a new hook
+bundle with an older global CLI or desktop supervisor. With a custom `SIMY_HOME`,
+look in its `bin` directory instead. If no candidate exists, inspect the global
+CLI and use a compatible current release. An unavailable matching runtime is
+installation/research work, not a request for a human to certify compatibility.
+Runtime selection, installation and cache refresh do not start, enable, trust,
+resume or reset a task. A task still needs the user's explicit start request.
+
 Use only when the user explicitly requests this skill or SIMY Delivery Loop for the current task. Installing this plugin does not opt a task in. Do not run SQM unless separately requested.
 
 1. Require the SIMY SessionStart hook context with the exact provider and session ID. If absent, explain how to install the SIMY plugin, review and enable its hooks with `/hooks`, and start a new conversation. Codex settings can be opened at `codex://settings`; a hooks subpage deep link is not guaranteed. Never change hook trust or bypass permissions yourself.
-2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. For a Loop that must track acceptance, use the existing managed specification with `--managed-file <task.json>` as described below: freeze the original user outcome, the selected delivery level when one exists, and the necessary applicable acceptance criteria before work. A regular start without this specification is standard checkpoint tracking and can only end as `reported_done`; do not present it as a fully verified Agentic Loop. Do not fabricate a level selection or add engineering/SQM checks the user did not select or the task does not require. The loop stops after 3 failures/missing checkpoints and pauses for review when no progress is verified; it does not limit elapsed time or turns. Set a different failure limit only if the user requests it. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
+2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. For a Loop that must track acceptance, use the existing managed specification with `--managed-file <task.json>` as described below: freeze the original user outcome, the selected delivery level when one exists, and the necessary applicable acceptance criteria before work. A regular start without this specification is standard checkpoint tracking and can only end as `reported_done`; do not present it as a fully verified Agentic Loop. Do not fabricate a level selection or add engineering/SQM checks the user did not select or the task does not require. The loop stops after 3 failures/missing checkpoints and pauses for review when no progress is verified; it does not limit elapsed time or turns. Set a different failure limit only if the user requests it. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume user-stopped work without a user request. Authorized automatic recovery from ordinary blockers is distinct from resuming user-stopped work.
 3. Work in the current conversation with its normal permissions. Before ending each turn, submit a JSON checkpoint through standard input with `simy delivery checkpoint --provider <provider> --session <id> --file -` (for example, a shell heredoc). This updates SIMY state; it does not require writing a checkpoint file to the user's workspace. A file path remains supported when authorized.
 
 Checkpoint shapes:
@@ -25,7 +39,7 @@ For missing information use `blocker: "missing_information"`. For a failed attem
 For completed work use `{"status":"completed","summary":"Actual result","acceptanceMet":true,"evidence":["Exact checks and observed results"]}` only after checking the user's acceptance criteria. For standard tracking this ends as `reported_done`, never verified `completed`. In managed tracking SIMY independently checks frozen file predicates or waits for explicit user verification of manual criteria. Evidence is a report, not independent certification: preserve failed checks and deployment gaps. The hook must not infer success from optimistic closing text.
 
 4. The Stop hook evaluates checkpoints and supplies the next instruction within the original scope while progress is verified. Missing checkpoints count toward the repeated-failure circuit. A human interrupt stops the loop. Approval/input events block it. Provider errors/exits may require reopening the existing conversation; these hooks cannot restart a dead provider process.
-5. After the user explicitly resolves the blocker and requests continuation, `simy delivery resume --provider <provider> --session <id>` retains usage, failure and progress history; local time, turn and token counters do not stop work. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.
+5. Once a blocker is resolved with current evidence, continue already-authorized work without an additional continuation request. AI handles reversible decisions by investigating, selecting and verifying a suitable option; use LLM judgment first and HC-01–HC-102 as critique lenses. A matching irreversible-operation approval or necessary answer is sufficient to continue that operation. User-directed pause/stop requires an explicit resume; actual provider permissions, rejected actions and budgets remain authoritative. For manual recovery, `simy delivery resume --provider <provider> --session <id>` retains usage, failure and progress history; local time, turn and token counters do not stop work. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.
 
 If the user selected **Continue this conversation** in SIMY desktop, the exact session already has a managed task. Do not run `delivery start` or ask the user to restate its goal. Follow the Stop hook's distinct `session_understanding` contract first: inspect only the original conversation context, report the original user goal and grounded progress, and submit the JSON checkpoint via `--file -`. Do not execute the next assessed work action during understanding. If context is materially unclear, report one focused question and wait for a matching `session_answer`; generic Resume is insufficient. A model-reported finished goal without an independent check is shown as `reported_done`, not verified `completed`.
 
@@ -39,10 +53,10 @@ The managed file must include `initialAction` and nonempty `acceptanceCriteria`.
 {"actionId":"ACTION-123","actionDueAt":"2026-10-05T09:00:00+09:00","initialAction":{"kind":"local_edit","scope":"repository","summary":"Implement the requested parser"},"approvalPolicy":"wait","approvalScopes":[],"acceptanceCriteria":[{"id":"output","description":"Expected output is exactly READY","check":{"type":"file_equals","path":"output.txt","text":"READY"}},{"id":"review","description":"User accepts behavior","check":{"type":"manual"}}]}
 ```
 
-File checks prove only the stated file predicate: `file_equals` compares complete UTF-8 bytes including whitespace, `file_contains` proves a substring, and `file_exists` proves existence. Tests, deployment, and subjective acceptance need explicit user verification. The user can verify each manual criterion from SIMY desktop or `simy delivery verify --provider ... --session ... --task-id ... --criterion-id ...`. `approvalPolicy` is `wait`, `automatic`, or `proceed_and_report`; the last two apply only to enrolled scopes for `read`, `local_edit`, and `local_test`. External, destructive, changed-scope, and unknown actions always wait for an exact proposal decision. SIMY approval does not change provider permissions. Rejected proposals remain blocked until the user revises or stops the task.
+File checks prove only the stated file predicate: `file_equals` compares complete UTF-8 bytes including whitespace, `file_contains` proves a substring, and `file_exists` proves existence. Tests, deployment, and subjective acceptance need explicit user verification. The user can verify each manual criterion from SIMY desktop or `simy delivery verify --provider ... --session ... --task-id ... --criterion-id ...`. `approvalPolicy` is `wait`, `automatic`, or `proceed_and_report`; the last two apply only to enrolled scopes for `read`, `local_edit`, and `local_test`. Irreversible effects require an exact proposal decision. In purpose-driven Codex autonomous mode, reversible external work in enrolled scope can proceed with actual provider permissions, concrete restoration and independent result readback. Unknown effects require research; changed objectives and absent authority are not automatically granted. SIMY approval does not change provider permissions. Rejected proposals remain blocked until the user revises or stops the task.
 
 Cold recovery is **off by default**. Only when the user explicitly authorizes exact-session Codex CLI recovery, add `"autoRecovery":true,"resumeChannel":"codex_exec","resumeModel":"<exact model>","autoRecoverySandbox":"read-only"` (or an explicitly authorized `workspace-write`). An exact Codex UUID and observed process identity are also required; otherwise recovery stays manual. The recovered process returns a structured final checkpoint that SIMY validates and persists. It must not edit SIMY state directly. Claude and ordinary SessionEnd remain manual paths. Token usage is not measured by these hooks.
 
-For an explicitly requested autonomous managed task, also enroll `"autonomyPolicy":"strict"|"balanced"|"autonomous"` and an `initialPlan` before work begins. Example initialPlan: `{"diagnosis":"Inspect input before repair","alternatives":[{"id":"inspect","action":{"kind":"read","scope":"repository","summary":"Inspect input.json"},"assessment":{"risk":"low","reversibility":"reversible","externalEffect":"none","blastRadius":"single_file","uncertainty":"low","inObjective":true,"userChoice":false},"expectedVerification":"Observe ready field","rollback":"No changes"}],"selectedOptionId":"inspect","recommendation":{"optionId":"inspect","reason":"Need evidence before editing"}}`. `initialAction` must exactly match the selected option and its scope must be enrolled in `approvalScopes`. For each subsequent action, report `actionResult:{decisionId,status:"observed"|"failed"|"not_run",summary,evidence}` for the current decision and a `plan` with diagnosis, one to five assessed alternatives, selectedOptionId, and recommendation for the **next** action. Never execute the next alternative in the current turn. Use only action kinds `read`, `local_edit`, `local_test`, `external`, `destructive`, `scope_change`, `unknown`; use `local_edit` for writing local files. Missing assessment facts, external/destructive effects, user choice, or unapproved scope wait. A recommendation is advisory, not an authorization. Worker reports are not independent acceptance verification. If an automatic file criterion is missing after claimed completion, SIMY schedules bounded read-only diagnosis; manual criteria still require the user. Task policy can be changed with `simy delivery set_policy --provider ... --session ... --task-id ... --autonomy-policy strict|balanced|autonomous`, which preserves usage history, approvals and scopes. Provider permissions remain authoritative.
+For an explicitly requested autonomous managed task, also enroll `"autonomyPolicy":"strict"|"balanced"|"autonomous"` and an `initialPlan` before work begins. Example initialPlan: `{"diagnosis":"Inspect input before repair","alternatives":[{"id":"inspect","action":{"kind":"read","scope":"repository","summary":"Inspect input.json"},"assessment":{"risk":"low","reversibility":"reversible","externalEffect":"none","blastRadius":"single_file","uncertainty":"low","inObjective":true,"userChoice":false},"expectedVerification":"Observe ready field","rollback":"No changes"}],"selectedOptionId":"inspect","recommendation":{"optionId":"inspect","reason":"Need evidence before editing"}}`. `initialAction` must exactly match the selected option and its scope must be enrolled in `approvalScopes`. For each subsequent action, report `actionResult:{decisionId,status:"observed"|"failed"|"not_run",summary,evidence}` for the current decision and a `plan` with diagnosis, one to five assessed alternatives, selectedOptionId, and recommendation for the **next** action. Never execute the next alternative in the current turn. Use only action kinds `read`, `local_edit`, `local_test`, `external`, `destructive`, `scope_change`, `unknown`; use `local_edit` for writing local files. Unknown effect boundaries call for read-only research. In autonomous purpose mode, reversible preferences, high risk or broad impact alone do not require human selection; use a smaller step, rollback and verification. Irreversible effects, absent authority and explicit stops/rejections remain boundaries. A recommendation is advisory, not an authorization. Worker reports are not independent acceptance verification. If an automatic file criterion is missing after claimed completion, SIMY schedules bounded read-only diagnosis; manual criteria still require the user. Task policy can be changed with `simy delivery set_policy --provider ... --session ... --task-id ... --autonomy-policy strict|balanced|autonomous`, which preserves usage history, approvals and scopes. Provider permissions remain authoritative.
 
-In assessed mode, a blocked authorization checkpoint must also include an assessed `plan` whose selected action exactly matches `approval:{kind,scope,summary}` and a concrete `nextStep`. A missing-information blocker must include a specific `question` for the user. Do not turn a provider approval prompt into an automatic scheduling grant, even for a normally low-risk action. Resume only after the exact user decision; low-risk enrolled actions already allowed by the policy do not need an additional SIMY approval.
+In assessed mode, a blocked authorization checkpoint must also include an assessed `plan` whose selected action exactly matches `approval:{kind,scope,summary}` and a concrete `nextStep`. A missing-information blocker must include a specific `question` for the user. Do not turn a provider approval prompt into an automatic scheduling grant, even for a normally low-risk action. Provider-denied or irreversible operations resume only after their exact decision; already-authorized reversible work continues without another resume request; low-risk enrolled actions already allowed by the policy do not need an additional SIMY approval.

package/src/codex-plugins/simy/skills/sqm-loop/SKILL.md

@@ -7,17 +7,32 @@ description: Run the SIMY Software Quality Monitor against the repository and ch
 
 Treat the current Codex thread, its attachments, and the active repository as the request context. Convert that context into explicit quality expectations, then verify the actual repository state; do not merely summarize the conversation.
 
+## Use the matching local runtime and scope
+
+When `$HOME/.simy/bin/simy` exists, prefer its absolute path consistently for
+SQM and Delivery Loop. Check `--version` and `delivery runtime status`: the local
+candidate requires 0.6.24 or newer, `purposeVersion:2` and
+`decisionPolicy:"llm-first-hc102"`. With a custom `SIMY_HOME`, use its `bin`.
+Inspect `sqm scope --json` when diagnosing a connection. It reads the current
+authorization and verifies the repository's signed knowledge bundle without
+switching organization or signing in. HTTP 409 `repository_scope_unresolved`
+does not by itself prove missing registration: compare the selected organization
+and `SIMY_SQM_ORGANIZATION_ID` with the intended repository's SQM System first.
+Investigate and repair authorized reversible setup; preserve real account,
+organization, device and provider authority. Do not guess credentials or invent a
+successful scope. A connected scope is not quality acceptance.
+
 ## Run the quality loop
 
 1. Identify the repository root and the user-visible behavior or incident discussed in the current thread.
 2. Preserve unrelated user changes and follow repository instructions.
-3. Run `simy sqm min-check` from the repository root.
-4. Run `simy sqm check --proof proof.json --signed-evidence proof.json.signed.json`.
-5. Read `proof.json` and require `outcome.status` to be `passed` before reporting success or proposing a pull request.
+3. Run `simy sqm run --json` from the repository root. It runs min-check then check with a private min result and new proof/signature paths outside the candidate. Alternatively, run `simy sqm min-check` then `simy sqm check`; their defaults are separated by worktree and authorization scope. Keep explicit artifact paths outside the repository.
+4. Read the returned artifacts and actual proof; require `outcome.status` to be `passed` and `candidate_verification.current`, `signature_valid`, and `artifacts_current` to be true before reporting success or proposing a pull request. A `stale` result or nonzero exit requires diagnosis and recheck; retain the historical evidence.
+5. A pending human or post-deploy proof is not a passed command. Obtain missing evidence through authorized AI/tool verification where possible; preserve explicit human requirements.
 6. Verify the proof's repository, base, HEAD and working-tree/diff identity against the candidate, and verify its bound signature with SQM tooling. Use separate artifact paths outside the diff; do not edit between min-check and check or reuse stale proof after a candidate change.
 7. Report outcome reasons, matched modules, evaluated rules and scenario statuses from `executions`, separating blocking and advisory results. `passed` with `no_applicable_rules`, zero scenario evaluations, or advisory-only checks is not feature or incident coverage. Scenario statuses are deterministic evaluations, not evidence that a browser, provider or deployed journey ran. Record relevant uncovered review findings and their concrete regression evidence or remaining gap.
 8. Report the checked repository/revision, proof paths, outcome, blockers, and any evidence gap. Keep delivery acceptance pending for unverified applicable paths even when SQM passes.
 
-If implementation is required before the check can pass, obtain or confirm the user's change authorization and make the smallest relevant repair. A request to run SQM alone does not authorize unrelated edits, a PR, merge, deployment, or external messages.
+If implementation is required before the check can pass, use existing change authorization to make the smallest relevant repair and rerun without asking for another continuation. Apply LLM understanding, reasoning, alternatives and self-critique first, then relevant HC-01–HC-102 lenses; the full inventory is not a per-turn gate. A request to run SQM alone does not authorize unrelated edits, a PR, merge, deployment, or external messages. User-directed pause/stop, explicit rejection, irreversible operations and actual provider permissions remain authoritative.
 
 Do not substitute an informal LLM review for SQM. If the CLI is unavailable, authentication is missing, or the proof is not passed, stop at the highest verified state and report the exact blocker.

package/src/delivery-hooks/command.js

@@ -4,6 +4,14 @@ import { startDelivery, checkpointDelivery, controlDelivery, listRecords, rootDi
 import { continueSession } from '../session-supervision/index.js';
 import { cancelHandoffSession, handoffSession } from '../session-supervision/handoff.js';
 import { runActivityCommand } from './activity.js';
+import { installLocalRuntime, localRuntimeStatus } from './local-runtime.js';
+import { superviseLocalDelivery } from './local-supervisor.js';
+import { dirname } from 'node:path';
+import { syncInstalledWorkflows } from '../sqm/workflow-update.js';
+import { routeLegacyHooks } from './legacy-hook-routing.js';
+import { activateLocalDesktop, watchLocalRuntime, installRuntimeWatchdog } from './runtime-watchdog.js';
+import { desktopRuntimeStatus, installLocalDesktop } from './desktop-runtime.js';
+import { consistencyMonitorStatus, consistencyFindings } from './consistency-monitor.js';
 
 async function readCheckpointInput(input) {
   const chunks = [];
@@ -19,8 +27,43 @@ async function readCheckpointInput(input) {
 
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
+  if (action === 'runtime') {
+    if (args.length !== 1 || !['install', 'status', 'workflows', 'desktop-install', 'desktop-activate', 'watch', 'watchdog-install', 'legacy-hooks', 'doctor'].includes(args[0])) throw new Error('Use simy delivery runtime install|status|workflows|desktop-install|doctor.');
+    if (args[0] === 'legacy-hooks') { output(JSON.stringify(await routeLegacyHooks({ root: dirname(root) }), null, 2)); return 0; }
+    if (args[0] === 'watchdog-install') { output(JSON.stringify(await installRuntimeWatchdog({ root: dirname(root) }), null, 2)); return 0; }
+    if (args[0] === 'desktop-activate') { output(JSON.stringify(await activateLocalDesktop({ root: dirname(root) }), null, 2)); return 0; }
+    if (args[0] === 'watch') {
+      const controller = new AbortController(), abort = () => controller.abort();
+      process.once('SIGINT', abort); process.once('SIGTERM', abort);
+      try { await watchLocalRuntime({ root: dirname(root), signal: controller.signal }); }
+      finally { process.removeListener('SIGINT', abort); process.removeListener('SIGTERM', abort); }
+      return 0;
+    }
+    if (args[0] === 'desktop-install') { output(JSON.stringify(await installLocalDesktop({ root: dirname(root) }), null, 2)); return 0; }
+    if (args[0] === 'doctor') {
+      const [runtime, host, monitor, records] = await Promise.all([localRuntimeStatus({ root: dirname(root), allowMissingLock: true }),
+        desktopRuntimeStatus({ root: dirname(root) }), consistencyMonitorStatus(root), listRecords(root)]);
+      output(JSON.stringify({ runtime, host, monitor, tasks: records.flatMap(record => consistencyFindings(record)) }, null, 2)); return 0;
+    }
+    const result = args[0] === 'workflows' ? await syncInstalledWorkflows({ installMissing: false })
+      : await (args[0] === 'install' ? installLocalRuntime : localRuntimeStatus)({ root: dirname(root), ...(args[0] === 'status' ? { allowMissingLock: true } : {}) });
+    output(JSON.stringify(result, null, 2));
+    return 0;
+  }
+  if (action === 'supervise') {
+    if (args.length > 1 || args.length === 1 && args[0] !== '--once') throw new Error('Use simy delivery supervise [--once].');
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    process.once('SIGINT', stop); process.once('SIGTERM', stop);
+    try { await superviseLocalDelivery({ root, once: args[0] === '--once', signal: controller.signal }); }
+    finally { process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop); }
+    return 0;
+  }
   if (action === 'activity') return runActivityCommand(args, { root, output });
   if (!action || action === '--help') {
+    output('simy delivery runtime install|status|workflows — install an immutable local candidate, inspect its version/digest, or refresh existing plugin sources/cache while preserving enabled state and hook trust. Never enables a task.');
+    output('simy delivery runtime doctor|desktop-install|desktop-activate|watch — audit live host/state/monitor alignment, or prepare a separate local desktop using the verified fixed runtime. Does not start or resume tasks.');
+    output('simy delivery supervise [--once] — service already opted-in tasks with this runtime; refuses an active desktop host.');
     output('simy delivery evidence --provider codex|claude --session ID — read-only execution and acceptance receipts.');
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
     output('A task stops after repeated failures, and pauses for review when no progress is confirmed. Resume starts a new progress window.');
@@ -68,6 +111,11 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     const data = options.file === '-' ? await readCheckpointInput(input) : await readFile(options.file, 'utf8');
     if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Checkpoint exceeds 64 KiB.');
     result = await checkpointDelivery({ ...base, checkpoint: JSON.parse(data) });
+  } else if (action === 'revise-purpose') {
+    if (!options.file) throw new Error('An explicit user revision file is required.');
+    const data=options.file==='-' ? await readCheckpointInput(input) : await readFile(options.file,'utf8');
+    if (Buffer.byteLength(data)>64*1024) throw new Error('Purpose revision exceeds 64 KiB.');
+    result=await controlDelivery({...base,taskId:options['task-id'],action:'revise_purpose',purposeUpdate:JSON.parse(data)});
   } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready', 'continuation_policy'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
     waitId: options['wait-id'], answer: options.answer, action });
   else if (action === 'verify') result = await verifyDelivery({ ...base, taskId: options['task-id'], criterionId: options['criterion-id'] });

package/src/delivery-hooks/consistency-monitor.js

@@ -0,0 +1,126 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { pauseOrigin } from '../session-supervision/autonomous-upgrade.js';
+import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
+import { listRecords, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+const hash = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+async function read(path) { try { return JSON.parse(await readFile(path, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } }
+async function save(path, value) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try { await writeFile(temp, JSON.stringify(value), { mode: 0o600 }); await rename(temp, path); }
+  finally { await rm(temp, { force: true }); }
+}
+
+export function consistencyFindings(record) {
+  const run = record.run, m = run?.managed;
+  if (!m) return [];
+  const findings = [];
+  const add = (code, next, suppressed = false) => findings.push({ id: hash([record.provider, record.session, m.taskId, code]),
+    code, taskId: m.taskId, provider: record.provider, session: record.session, runRevision: run.revision,
+    contractVersion: m.controllerContractVersion || null, objectiveDigest: hash([run.objective, m.acceptanceCriteria]),
+    next, suppressed });
+  if (!record.autoContinue || record.providerArchived || run.state === 'stopped' || run.state === 'paused' && pauseOrigin(run) === 'user') {
+    add('user_boundary', 'Preserve OFF, archive, explicit pause/stop and rejection.', true); return findings;
+  }
+  if (m.pendingApproval?.denied || m.rejectedActionOverflow) add('rejection_boundary', 'Preserve the rejected action; investigate a different authorized alternative.', true);
+  if (!['completed', 'reported_done'].includes(run.state) && (m.purpose?.version !== 2 || m.purpose?.decisionPolicy !== 'llm-first-hc102' || m.controllerContractVersion !== 2)) add('contract_drift', 'Inspect the original provider identity and idempotently migrate existing consent without resetting history.');
+  if (run.state === 'paused') add(pauseOrigin(run) === 'system' ? 'system_pause' : 'unclassified_pause', 'Read the original stop evidence before recovery; never infer a user resume.');
+  if (run.state === 'verification_pending' && effectiveAcceptanceCriteria(m).some(c => !m.verified?.[c.id] && c.check.type === 'semantic')) add('independent_verification_pending', 'Run an independent read-only outcome inspection using original instructions and current primary evidence.');
+  if (record.provider === 'codex' && !['completed', 'reported_done', 'budget_exhausted'].includes(run.state)) add('outcome_alignment', 'Periodically compare original user instructions and corrections with actual primary evidence, including omitted scope and runtime adoption.');
+  for (const finding of m.purpose?.evidence?.findings || []) if (finding.status === 'open' && finding.owner !== 'human') add(`outcome:${finding.id}`, 'Independently inspect the original requirement and primary evidence; repair or refute this stable finding through its existing ledger.');
+  if (record.provider !== 'codex' && !['completed', 'reported_done'].includes(run.state)) add('provider_recovery_capability', 'Use the original live provider hook; cold recovery/independent verification needs a verified provider-specific adapter.', true);
+  return findings;
+}
+
+// Deterministic all-state watchdog, independent of execution eligibility. It
+// hands inspection to the existing independent verifier; it never edits a
+// workspace, authorizes effects, fabricates a pass, or resets a task.
+export async function runConsistencyMonitor({ root, now = Date.now(), records, readRecords = () => listRecords(root),
+  runtime = null, onAudit = async () => {}, intervalMs = 60_000 } = {}) {
+  const file = join(root, 'consistency', 'monitor.json');
+  const previous = await read(file) || { schema: 1, scans: 0, failures: 0, tasks: {} };
+  let rows;
+  try { rows = records || await readRecords(); } catch (error) {
+    await save(file, { ...previous, lastAttemptAt: now, failures: previous.failures + 1, lastFailure: { at: now, code: 'consistency_read_failed' } });
+    throw error;
+  }
+  const fingerprint = hash([runtime, rows.map(r => [r.provider, r.session, r.autoContinueEpoch, r.run?.revision, r.run?.state, r.run?.managed?.controllerContractVersion])]);
+  if (previous.fingerprint === fingerprint && now - (previous.lastSuccessAt || 0) < intervalMs) return previous;
+  const status = { ...previous, lastAttemptAt: now, ownerPid: process.pid, runtime, fingerprint,
+    scans: previous.scans + 1, tasks: {}, lastFailure: null, metrics: { tasksObserved: rows.length, actionableFindings: 0, requestsDelivered: 0, independentInspections: 0, productiveTimeFraction: null, recoveryLatencyMs: null } };
+  status.runtimeGap = runtime && runtime.state !== 'matched' ? { code: runtime.state, expected: runtime.expected, observed: runtime.observed } : null;
+  status.lastHeartbeatAt = now;
+  let writes = Promise.resolve();
+  const persist = () => { const snapshot = structuredClone(status); writes = writes.catch(() => {}).then(() => save(file, snapshot)); return writes; };
+  await persist(); // A crash here remains an observable unfinished scan.
+  const heartbeat = setInterval(() => { status.lastHeartbeatAt = Date.now(); void persist().catch(() => {}); }, 30_000);
+  heartbeat.unref?.();
+  try {
+    for (const record of rows) {
+      const findings = consistencyFindings(record);
+      const key = `${record.provider}:${record.session}`;
+      const old = previous.tasks[key];
+      const current = { taskId: record.run?.managed?.taskId || null, state: record.run?.state || 'not_started',
+        findings, observedAt: now, inspection: old?.inspection || null };
+      status.tasks[key] = current;
+      const actionable = findings.filter(f => !f.suppressed);
+      status.metrics.actionableFindings += actionable.length;
+      if (!actionable.length || record.run?.managed?.resumeLease || record.run?.managed?.liveWorkspaceLease) continue;
+      const deliveryKey = hash(actionable.map(f => [f.id, f.objectiveDigest, f.runRevision]));
+      if (old?.inspection?.key === deliveryKey && now < old.inspection.retryAt) continue;
+      const request = { id: deliveryKey, stage: 'pending', targetTask: current.taskId,
+        version: record.run?.managed?.controllerContractVersion || null, objectiveDigest: actionable[0].objectiveDigest, findings: actionable.map(f => f.id), createdAt: now };
+      current.inspection = { key: deliveryKey, request, attempts: (old?.inspection?.key === deliveryKey ? old.inspection.attempts || 0 : 0) + 1, retryAt: now + Math.min(15 * 60_000, intervalMs * 2 ** Math.min(old?.inspection?.key === deliveryKey ? old.inspection.attempts || 0 : 0, 4)) };
+      await persist();
+      await updateRecord(root, record.provider, record.session, live => {
+        if (live?.run?.managed?.taskId !== request.targetTask || live.run.revision !== record.run.revision || live.autoContinueEpoch !== record.autoContinueEpoch) return live;
+        const outbox = live.run.managed.consistencyOutbox ||= [];
+        if (!outbox.some(item => item.id === request.id)) {
+          // A newer observation supersedes only undisbursed read inspections of
+          // the same contract/findings. Never discard an executing repair.
+          for (const item of outbox) if (!item.decisionId && item.targetTask === request.targetTask && item.version === request.version &&
+            item.objectiveDigest === request.objectiveDigest && JSON.stringify(item.findings) === JSON.stringify(request.findings) &&
+            ['pending', 'received', 'inspected'].includes(item.stage)) { item.stage = 'superseded'; item.supersededBy = request.id; }
+          outbox.push(request);
+        }
+        const terminal = outbox.filter(item => ['resolved', 'superseded'].includes(item.stage));
+        if (terminal.length > 32) live.run.managed.consistencyOutbox = outbox.filter(item => !['resolved', 'superseded'].includes(item.stage) || terminal.slice(-32).includes(item));
+        return live;
+      });
+      let receipt;
+      try { receipt = await onAudit(record, actionable, request); }
+      catch {
+        current.inspection.lastFailure = { at: now, code: 'audit_dispatch_failed' };
+        status.failures++; status.lastFailure = { at: now, code: 'consistency_audit_failed' };
+        await persist();
+        continue;
+      }
+      // Receipt means delivered to the canonical controller, never resolved.
+      if (receipt?.received === true) {
+        request.stage = receipt.audited === true ? 'inspected' : 'received';
+        status.metrics.requestsDelivered++;
+        if (receipt.audited === true) status.metrics.independentInspections++;
+        request.receivedAt = now;
+        await updateRecord(root, record.provider, record.session, live => {
+          const item = live?.run?.managed?.consistencyOutbox?.find(item => item.id === request.id);
+          if (item && item.stage === 'pending') { item.stage = request.stage; item.receivedAt = now; }
+          return live;
+        });
+      }
+    }
+    status.lastSuccessAt = now;
+    await persist();
+    return status;
+  } catch (error) {
+    status.failures += 1; status.lastFailure = { at: now, code: 'consistency_audit_failed' };
+    await persist(); throw error;
+  } finally { clearInterval(heartbeat); await writes.catch(() => {}); }
+}
+
+export async function consistencyMonitorStatus(root, now = Date.now()) {
+  const status = await read(join(root, 'consistency', 'monitor.json'));
+  return status ? { ...status, health: status.lastFailure ? 'failed' : status.lastAttemptAt > (status.lastSuccessAt || 0) ? 'interrupted' : now - status.lastSuccessAt > 3 * 60_000 ? 'stale' : 'healthy' } : { health: 'not_started' };
+}

package/src/delivery-hooks/desktop-runtime.js

@@ -0,0 +1,70 @@
+import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { localRuntimeStatus, pinnedWorkflowSource } from './local-runtime.js';
+import { processIdentity } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+const exec = promisify(execFile);
+const hash = value => createHash('sha256').update(String(value || '')).digest('hex');
+async function json(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } }
+
+export async function attestDesktopRuntime({ root, source, identity = processIdentity } = {}) {
+  const state = await localRuntimeStatus({ root, allowMissingLock: true, ...(source ? { source } : {}) });
+  const owner = await json(join(root, 'desktop-app.lock/owner.json'));
+  const value = { version: state.version, digest: state.sourceDigest, source: state.source, pid: process.pid,
+    identity: await identity(process.pid), ownerPid: owner?.pid, ownerStartedAt: owner?.startedAt,
+    ownerTokenDigest: hash(owner?.nonce), observedAt: Date.now(), stateContractVersion: 2 };
+  await writeFile(join(root, 'desktop-runtime.json'), JSON.stringify(value), { mode: 0o600 });
+  return value;
+}
+
+export async function desktopRuntimeStatus({ root, identity = processIdentity } = {}) {
+  const [pin, observed, owner] = await Promise.all([json(join(root, 'delivery-runtime/current.json')),
+    json(join(root, 'desktop-runtime.json')), json(join(root, 'desktop-app.lock/owner.json'))]);
+  const live = observed?.identity && owner?.pid === observed.ownerPid &&
+    owner.startedAt === observed.ownerStartedAt && hash(owner.nonce) === observed.ownerTokenDigest && await identity(observed.pid) === observed.identity;
+  return { expected: pin ? { version: pin.version, digest: pin.digest } : null,
+    observed: live ? observed : null, state: !owner ? 'not_running' : !live ? 'unverified_host' :
+      pin && (pin.digest !== observed.digest || pin.version !== observed.version) ? 'runtime_mismatch' : 'matched' };
+}
+
+// A separate local app keeps the signed/public application untouched. Only a
+// verified, explicitly installed candidate replaces its host resources. No
+// sign-in, permission grant, task control or process termination is performed.
+export async function installLocalDesktop({ root, template = '/Applications/SIMY.app',
+  run = exec, platform = process.platform } = {}) {
+  if (platform !== 'darwin') throw new Error('Local desktop candidate installation currently requires macOS; other platforms use their installer.');
+  const pinSource = await pinnedWorkflowSource({ root });
+  const pin = await json(join(root, 'delivery-runtime/current.json'));
+  if (!pin) throw new Error('Install the fixed local runtime before installing its desktop.');
+  const status = await localRuntimeStatus({ root, source: pinSource || pin.release });
+  if (status.sourceDigest !== pin.digest) throw new Error('Desktop candidate source failed integrity verification.');
+  if (!(await lstat(template)).isDirectory()) throw new Error('Desktop template must be a regular application.');
+  const identity = (await run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIdentifier', join(template, 'Contents/Info.plist')])).stdout.trim();
+  if (identity !== 'com.awak.simy.cli') throw new Error('Desktop template is not the SIMY application.');
+  const storage = join(root, 'desktop-runtime'); await mkdir(storage, { recursive: true, mode: 0o700 });
+  const app = join(storage, `SIMY Local-${pin.digest}.app`), staged = join(storage, `.staged-${randomUUID()}.app`);
+  try {
+    await run('/usr/bin/ditto', [template, staged]);
+    const cli = join(staged, 'Contents/Resources/cli');
+    await rm(cli, { recursive: true, force: true });
+    await run('/usr/bin/ditto', [pin.release, cli]);
+    await run('/usr/libexec/PlistBuddy', ['-c', `Set :CFBundleShortVersionString ${pin.version}`, join(staged, 'Contents/Info.plist')]);
+    await run('/usr/libexec/PlistBuddy', ['-c', `Set :CFBundleVersion ${pin.version}`, join(staged, 'Contents/Info.plist')]);
+    await run('/usr/libexec/PlistBuddy', ['-c', 'Set :CFBundleDisplayName SIMY Local', join(staged, 'Contents/Info.plist')]);
+    // Candidate host stays on the pinned source, including after reconnection.
+    await run('/usr/bin/codesign', ['--force', '--deep', '--sign', '-', staged]);
+    await run('/usr/bin/codesign', ['--verify', '--deep', '--strict', staged]);
+    if (await json(join(app, 'Contents/Resources/cli/runtime-build.json'))) {
+      const existing = await localRuntimeStatus({ root, source: join(app, 'Contents/Resources/cli') });
+      if (existing.sourceDigest !== pin.digest || existing.version !== pin.version) throw new Error('Existing local app failed integrity verification.');
+      await run('/usr/bin/codesign', ['--verify', '--deep', '--strict', app]);
+      await rm(staged, { recursive: true, force: true });
+    }
+    else await rename(staged, app);
+    await writeFile(join(storage, 'candidate.json'), JSON.stringify({ app, version: pin.version, digest: pin.digest }), { mode: 0o600 });
+    return { app, version: pin.version, digest: pin.digest, activation: 'not_started', publicApplicationChanged: false };
+  } finally { await rm(staged, { recursive: true, force: true }); }
+}

package/src/delivery-hooks/desktop.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { canReplanDelivery, pendingAcceptance, deliveryStop, deliveryStopBlocksResume, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { canReplanDelivery, purposeProgressAt, pendingAcceptance, deliveryStop, deliveryStopBlocksResume, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { originalSessionTarget } from '../session-supervision/original-session-target.js';
 
 export const HOOK_SETUP = Object.freeze({
@@ -37,6 +37,10 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       stopCode: deliveryStop(r.run, now)?.code ?? null,
       outcomeProgress: r.run.managed?.outcomeProgress || null,
       needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted', 'verification_pending'].includes(r.run.state), updatedAt: r.run.updatedAt,
+      purposeContinuation: r.run.managed?.purpose ? { enabled: r.run.managed.purpose.enabled, version: r.run.managed.purpose.version, search: r.run.managed.purpose.search || null, ruleCount: r.run.managed.purpose.ruleIds.length,
+        lastReviewAt: r.run.managed.purpose.lastReview?.at || null, lastRecoveryAt: r.run.managed.purpose.lastRecovery?.at || null,
+        hypothesis: r.run.managed.purpose.lastReview?.hypothesis || null, gap: r.run.managed.purpose.lastReview?.gap || null,
+        ruleCounts: (r.run.managed.purpose.lastReview?.rules || []).reduce((counts, rule) => { counts[rule.status] = (counts[rule.status] || 0) + 1; return counts; }, {}) } : null,
       mode: r.run.managed ? 'managed' : 'standard_loop',
       deliveryLevel: r.run.managed?.deliveryLevel || null, enrollment: r.run.managed?.enrollment || null,
       pendingAcceptance: pendingAcceptance(r.run),
@@ -51,8 +55,14 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       dependencyWait: r.run.managed?.dependencyWait || null,
       executionAttempt: r.run.managed?.executionAttempt || null, executionUncertain: r.run.managed?.executionUncertain || null,
       handoff: r.run.managed?.handoff || null, threadHistory: r.run.managed?.threadHistory || [],
-      progressBudget: r.run.managed ? { minutes: r.run.managed.maxNoProgressMinutes, lastVerifiedProgressAt: r.run.managed.lastVerifiedProgressAt,
-        attempts: r.run.managed.noProgress, maxAttempts: r.run.managed.maxNoProgress } : null,
+      progressBudget: r.run.managed ? { minutes: r.run.managed.maxNoProgressMinutes,
+        lastVerifiedProgressAt: r.run.managed.purpose?.enabled
+          ? purposeProgressAt(r.run, now)
+          : r.run.managed.lastVerifiedProgressAt,
+        attempts: r.run.managed.purpose?.enabled ? r.run.managed.purpose.noLearning || 0 : r.run.managed.noProgress,
+        maxAttempts: r.run.managed.maxNoProgress } : null,
+      tokenBudget: r.run.managed?.maxTokens ? { limit: r.run.managed.maxTokens, used: r.run.managed.tokensUsed,
+        usageAvailable: r.run.managed.usageAvailable, source: 'provider_observed', dollarCost: null } : null,
       pendingApproval: r.run.managed?.pendingApproval || null,
       autonomyPolicy: r.run.managed?.autonomyPolicy || null, plan: r.run.managed?.plan || null,
       decision: r.run.managed?.decision || null, decisionHistory: r.run.managed?.decisionHistory || [],

package/src/delivery-hooks/legacy-hook-routing.js

@@ -0,0 +1,61 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { lstat, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { pinnedWorkflowSource } from './local-runtime.js';
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+// Exact shipped 0.6.23 and 0.6.24 entrypoints only. Customized hooks are retained.
+const shipped = new Set(['8a454293d119eac7cdb46c2df70c6b54a431fcf575bbf4f48f3373ca14414f3b', '339dc64d7ac980f9bfdafd1b2feea47ef8e86b2895b9d6e040086b005a806a79']);
+export const legacyRoutingShim = `// SIMY managed immutable-runtime route v1. Original exports retained for compatibility.
+export * from './delivery-loop.pre-runtime-route.mjs';
+import { readFile, readdir, lstat } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+export async function main(provider) {
+  try {
+    const root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+    const pin = JSON.parse(await readFile(join(root, 'delivery-runtime/current.json'), 'utf8'));
+    const source = resolve(root, 'delivery-runtime/releases', pin.digest || 'invalid');
+    if (pin.schema !== 1 || !/^[a-f0-9]{64}$/.test(pin.digest || '') || resolve(pin.release || '') !== source) throw Error('Invalid runtime route');
+    const hash = createHash('sha256');
+    async function visit(relative) {
+      const file = join(source, relative), info = await lstat(file);
+      if (info.isSymbolicLink()) throw Error('Invalid runtime route');
+      if (info.isDirectory()) { for (const name of (await readdir(file)).sort()) await visit(relative + '/' + name); }
+      else if (info.isFile()) { const bytes = await readFile(file); hash.update(relative + '\\0' + bytes.length + '\\0'); hash.update(bytes); }
+      else throw Error('Invalid runtime route');
+    }
+    for (const input of ['package.json', 'package-lock.json', 'README.md', 'src']) await visit(input);
+    if (hash.digest('hex') !== pin.digest || JSON.parse(await readFile(join(source, 'package.json'), 'utf8')).version !== pin.version) throw Error('Runtime integrity mismatch');
+    const selected = await import(pathToFileURL(join(source, 'src/codex-plugins/simy/hooks/delivery-loop.mjs')).href);
+    await selected.main(provider);
+  } catch { process.stdout.write('{}\\n'); process.stderr.write('SIMY runtime route unavailable; original task state was preserved.\\n'); }
+}
+`;
+export async function routeLegacyHooks({ root, codexHome = process.env.CODEX_HOME || join(homedir(), '.codex') } = {}) {
+  await pinnedWorkflowSource({ root });
+  const folder = join(codexHome, 'plugins/cache/personal/simy');
+  let entries; try { entries = await readdir(folder); } catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+  const receipts = [];
+  for (const version of entries) {
+    if (!/^0\.1\.0\+codex\.[a-f0-9]{64}$/.test(version)) continue;
+    const cache = join(folder, version), file = join(cache, 'hooks/delivery-loop.mjs');
+    if ((await lstat(cache)).isSymbolicLink()) continue;
+    const manifest = JSON.parse(await readFile(join(cache, '.codex-plugin/plugin.json'), 'utf8'));
+    if (manifest.name !== 'simy' || manifest.version !== version || (await lstat(file)).isSymbolicLink()) continue;
+    const bytes = await readFile(file), before = digest(bytes), next = digest(legacyRoutingShim);
+    if (before === next) { receipts.push({ version, outcome: 'current', routeDigest: next }); continue; }
+    if (!shipped.has(before)) { receipts.push({ version, outcome: 'customized_retained', originalDigest: before }); continue; }
+    const backup = join(cache, 'hooks/delivery-loop.pre-runtime-route.mjs');
+    try { await writeFile(backup, bytes, { mode: 0o600, flag: 'wx' }); }
+    catch (error) { if (error.code !== 'EEXIST' || digest(await readFile(backup)) !== before) throw error; }
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    await writeFile(temporary, legacyRoutingShim, { mode: 0o600 }); await rename(temporary, file);
+    receipts.push({ version, outcome: 'routed', originalDigest: before, routeDigest: next, backup });
+  }
+  await mkdir(join(root, 'delivery-runtime'), { recursive: true, mode: 0o700 });
+  await writeFile(join(root, 'delivery-runtime/legacy-routes.json'), JSON.stringify({ at: Date.now(), receipts }), { mode: 0o600 });
+  return receipts;
+}

package/src/delivery-hooks/local-runtime.js

@@ -0,0 +1,123 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { cp, lstat, mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { stableHookRuntime } from '../hook-runtime.js';
+
+const exec = promisify(execFile);
+const packageRoot = fileURLToPath(new URL('../../', import.meta.url));
+const inputs = ['package.json', 'package-lock.json', 'README.md', 'src'];
+
+async function fingerprint(source, { allowMissingLock = false } = {}) {
+  const hash = createHash('sha256');
+  async function visit(relative) {
+    const target = join(source, relative);
+    const info = await lstat(target);
+    if (info.isSymbolicLink()) throw new Error('Runtime source must not contain symbolic links.');
+    if (info.isDirectory()) {
+      for (const entry of (await readdir(target)).sort()) await visit(`${relative}/${entry}`);
+    } else if (info.isFile()) {
+      const bytes = await readFile(target);
+      hash.update(`${relative}\0${bytes.length}\0`); hash.update(bytes);
+    } else throw new Error('Runtime source must contain only regular files and directories.');
+  }
+  for (const input of inputs) {
+    try { await visit(input); } catch (error) {
+      if (allowMissingLock && input === 'package-lock.json' && error.code === 'ENOENT') hash.update('packaged-without-lock\0');
+      else throw error;
+    }
+  }
+  return hash.digest('hex');
+}
+
+async function atomicJson(file, value) {
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try { await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 }); await rename(temporary, file); }
+  finally { await rm(temporary, { force: true }); }
+}
+
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+
+export async function localRuntimeStatus({ root, source = packageRoot, allowMissingLock = false } = {}) {
+  const pkg = JSON.parse(await readFile(join(source, 'package.json'), 'utf8'));
+  let installation = null;
+  try { installation = JSON.parse(await readFile(join(root, 'delivery-runtime', 'current.json'), 'utf8')); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  return { version: pkg.version, source: resolve(source), sourceDigest: await fingerprint(source, { allowMissingLock }),
+    purposeVersion: 2, decisionPolicy: 'llm-first-hc102', stateContractVersion: 2, consistencyMonitorVersion: 1, installation };
+}
+
+export async function pinnedWorkflowSource({ root, source = packageRoot } = {}) {
+  let current;
+  try { current = JSON.parse(await readFile(join(root, 'delivery-runtime', 'current.json'), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  if (current.schema !== 1 || !/^[a-f0-9]{64}$/.test(current.digest || '')) throw new Error('Invalid local workflow runtime pin.');
+  const expected = resolve(root, 'delivery-runtime', 'releases', current.digest);
+  if (resolve(current.release || '') !== expected) throw new Error('Local workflow pin points outside its immutable releases.');
+  const info = await lstat(expected);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('Pinned workflow source must be a regular directory.');
+  const status = await localRuntimeStatus({ root, source: expected });
+  if (status.sourceDigest !== current.digest || status.version !== current.version) throw new Error('Pinned workflow runtime failed integrity verification.');
+  return resolve(source) === expected ? null : expected;
+}
+
+// Install a frozen candidate alongside the released app, without replacing a
+// signed application, changing provider trust, or starting any registered task.
+export async function installLocalRuntime({ root, source = packageRoot,
+  installDependencies = async target => exec(process.platform === 'win32' ? 'npm.cmd' : 'npm',
+    ['ci', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], { cwd: target, timeout: 120_000, maxBuffer: 1024 * 1024 }),
+} = {}) {
+  if (process.platform === 'win32') throw new Error('Local candidate launcher installation currently supports macOS/Linux; Windows uses the installer release.');
+  const storage = join(root, 'delivery-runtime');
+  await mkdir(storage, { recursive: true, mode: 0o700 });
+  const lock = join(storage, 'install.lock');
+  await mkdir(lock); // An existing install is not silently stolen.
+  const staged = join(storage, `.staged-${randomUUID()}`);
+  try {
+    const before = await localRuntimeStatus({ root, source });
+    const digest = before.sourceDigest;
+    const release = join(storage, 'releases', digest);
+    await mkdir(dirname(release), { recursive: true, mode: 0o700 });
+    let exists = false;
+    try {
+      const info = await lstat(release);
+      if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('Existing candidate must be a regular directory.');
+      exists = true;
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (!exists) {
+      await mkdir(staged, { mode: 0o700 });
+      for (const input of inputs) await cp(join(source, input), join(staged, input), { recursive: true, errorOnExist: true });
+      if (await fingerprint(staged) !== digest || await fingerprint(source) !== digest) throw new Error('Runtime source changed while copying; no candidate activated.');
+      await installDependencies(staged);
+      if (await fingerprint(staged) !== digest) throw new Error('Dependency installation changed the runtime source.');
+      await atomicJson(join(staged, 'runtime-build.json'), { schema: 1, version: before.version, digest });
+      await rename(staged, release);
+    } else {
+      const saved = JSON.parse(await readFile(join(release, 'runtime-build.json'), 'utf8'));
+      if (saved.schema !== 1 || saved.digest !== digest || await fingerprint(release) !== digest) throw new Error('Existing candidate failed integrity verification.');
+    }
+    const bin = join(root, 'bin');
+    await mkdir(bin, { recursive: true, mode: 0o700 });
+    const launcher = join(bin, 'simy-delivery');
+    const cli = join(bin, 'simy');
+    const temporary = `${launcher}.${randomUUID()}.tmp`;
+    // Pin this process to one immutable snapshot. Later installation cannot
+    // change modules under an active worker or implicitly resume old tasks.
+    try {
+      await writeFile(temporary, `#!/bin/sh\nexec ${quote(stableHookRuntime())} ${quote(join(release, 'src/index.js'))} --no-auto-update delivery "$@"\n`, { mode: 0o700 });
+      await rename(temporary, launcher);
+    } finally { await rm(temporary, { force: true }); }
+    const cliTemporary = `${cli}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(cliTemporary, `#!/bin/sh\nexec ${quote(stableHookRuntime())} ${quote(join(release, 'src/index.js'))} --no-auto-update "$@"\n`, { mode: 0o700 });
+      await rename(cliTemporary, cli);
+    } finally { await rm(cliTemporary, { force: true }); }
+    const current = { schema: 1, version: before.version, digest, release, launcher, cli,
+      previous: before.installation?.digest === digest ? before.installation.previous
+        : before.installation ? { version: before.installation.version, digest: before.installation.digest, release: before.installation.release } : null };
+    await atomicJson(join(storage, 'current.json'), current);
+    return current;
+  } finally { await rm(staged, { recursive: true, force: true }); await rm(lock, { recursive: true, force: true }); }
+}