@awak-app/simy-cli 0.6.26 → 0.6.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.26";
+export const CLI_VERSION = "0.6.27";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/acceptance-policy.mjs

@@ -1,5 +1,22 @@
-// Frozen manual acceptance is an explicit enrollment boundary. Its description
-// or an old auto-continue switch cannot authorize a different verifier.
+import { createHash } from 'node:crypto';
+
+export const acceptanceIdentity = criterion => createHash('sha256').update(JSON.stringify(criterion)).digest('hex');
+// A description cannot establish consent to replace a frozen verifier in any
+// language. Only a user's delegation naming this exact criterion can do so.
+export function legacyIndependentCriterion(criterion, delegatedIds = []) {
+  return criterion.check?.type === 'manual' && delegatedIds.includes(criterion.id) && Boolean(criterion.description?.trim());
+}
+
+export const policyContractIdentity = managed => createHash('sha256').update(JSON.stringify([managed.taskId, managed.enrollment || null, managed.acceptanceCriteria, managed.approvalScopes, managed.grants || null, managed.autoContinueEpoch || null])).digest('hex');
+export const autonomousPolicyAuthorized = managed => managed?.policyAuthorization?.source === 'explicit_user_runtime_policy' && managed.policyAuthorization.revokedAt === undefined &&
+  managed.policyAuthorization.taskId === managed.taskId && managed.policyAuthorization.contractDigest === policyContractIdentity(managed);
+
 export function effectiveAcceptanceCriteria(managed) {
-  return managed?.acceptanceCriteria || [];
+  return (managed?.acceptanceCriteria || []).map(criterion => {
+    const route = managed.acceptanceRoutes?.[criterion.id];
+    const eligible = autonomousPolicyAuthorized(managed) && managed.autonomyPolicy === 'autonomous' && managed.purpose?.version === 2 &&
+      managed.purpose.decisionPolicy === 'llm-first-hc102' && route?.source === 'explicit_user_runtime_policy' &&
+      route.authorizationId === managed.policyAuthorization.id && route.criterionDigest === acceptanceIdentity(criterion) && legacyIndependentCriterion(criterion, managed.policyAuthorization.independentCriterionIds);
+    return eligible ? { ...criterion, check: { type: 'semantic' }, originalCheck: criterion.check } : criterion;
+  });
 }

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1183,7 +1183,7 @@ export async function verifyAutomaticCriteria(record, now) {
       evidence_refs: [`host-check:${managed.taskId}:${criterion.id}:${sha256 || 'failed'}`] };
   };
   const failed = (criterion, detail) => { delete managed.verified[criterion.id]; observe(criterion, false, detail); };
-  for (const criterion of managed.acceptanceCriteria) {
+  for (const criterion of effectiveAcceptanceCriteria(managed)) {
     if (criterion.check.type === 'manual') {
       if (managed.verified[criterion.id]?.source !== 'user') delete managed.verified[criterion.id];
       continue;
@@ -1780,6 +1780,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     }
     else if (action === 'set_policy') {
       if (!run.managed?.autonomyPolicy || !run.managed.plan || TERMINAL.has(run.state) || !AUTONOMY_POLICIES.has(autonomyPolicy)) throw new Error('Only a nonterminal assessed managed task can change autonomy policy.');
+      if (run.managed.policyAuthorization) run.managed.policyAuthorization = { ...run.managed.policyAuthorization, revokedAt: now, revokedBy: 'user_set_policy' };
       run.managed.autonomyPolicy = autonomyPolicy;
       const decision = recordDecision(run.managed, run.managed.plan, now);
       if (decision.outcome === 'wait') { run.state = 'blocked'; run.reason = decision.reason; escalate(run, decision.reason); }

package/src/delivery-hooks/command.js

@@ -1,3 +1,4 @@
+import { adoptAutonomousPolicy } from '../session-supervision/autonomous-upgrade.js';
 import { deliveryEvidence } from './evidence.js';
 import { readFile } from 'node:fs/promises';
 import { startDelivery, checkpointDelivery, controlDelivery, listRecords, rootDirectory, verifyDelivery, readRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
@@ -25,10 +26,24 @@ async function readCheckpointInput(input) {
   return Buffer.concat(chunks).toString('utf8');
 }
 
+function parseDeliveryOptions(args, allowed) {
+  const options = {};
+  for (let i = 0; i < args.length; i += 2) {
+    const key = args[i]?.slice(2);
+    if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
+    options[key] = args[i + 1];
+  }
+  return options;
+}
+
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
   if (action === 'runtime') {
-    if (args.length !== 1 || !['install', 'status', 'workflows', 'desktop-install', 'desktop-activate', 'watch', 'watchdog-install', 'legacy-hooks', 'doctor'].includes(args[0])) throw new Error('Use simy delivery runtime install|status|workflows|desktop-install|doctor.');
+    if (args[0] === 'policy-adopt') {
+      const options = parseDeliveryOptions(args.slice(1), new Set(['task-id', 'criterion-id']));
+      output(JSON.stringify(await adoptAutonomousPolicy({ root, taskId: options['task-id'], criterionId: options['criterion-id'] }), null, 2)); return 0;
+    }
+    if (args.length !== 1 || !['install', 'status', 'workflows', 'desktop-install', 'desktop-activate', 'watch', 'watchdog-install', 'legacy-hooks', 'policy-adopt', 'doctor'].includes(args[0])) throw new Error('Use simy delivery runtime install|status|workflows|desktop-install|doctor.');
     if (args[0] === 'legacy-hooks') { output(JSON.stringify(await routeLegacyHooks({ root: dirname(root) }), null, 2)); return 0; }
     if (args[0] === 'watchdog-install') { output(JSON.stringify(await installRuntimeWatchdog({ root: dirname(root) }), null, 2)); return 0; }
     if (args[0] === 'desktop-activate') { output(JSON.stringify(await activateLocalDesktop({ root: dirname(root) }), null, 2)); return 0; }
@@ -63,6 +78,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   if (!action || action === '--help') {
     output('simy delivery runtime install|status|workflows — install an immutable local candidate, inspect its version/digest, or refresh existing plugin sources/cache while preserving enabled state and hook trust. Never enables a task.');
     output('simy delivery runtime doctor|desktop-install|desktop-activate|watch — audit live host/state/monitor alignment, or prepare a separate local desktop using the verified fixed runtime. Does not start or resume tasks.');
+    output('simy delivery runtime policy-adopt [--task-id ID [--criterion-id ID]] — explicitly delegate decisions within existing permissions. Manual acceptance stays manual unless the user names the exact task and criterion to delegate its verifier.');
     output('simy delivery supervise [--once] — service already opted-in tasks with this runtime; refuses an active desktop host.');
     output('simy delivery evidence --provider codex|claude --session ID — read-only execution and acceptance receipts.');
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
@@ -72,13 +88,8 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--execution-cwd PATH] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Standard start tracks checkpoints and reports done without certifying acceptance. Managed start freezes the original objective, optional user-selected deliveryLevel, and acceptance specification. Desktop Continue infers the original conversation goal first. Continue adopts an eligible ordinary loop with the same goal and failure budget; its first managed action reconciles prior work read-only. --execution-cwd explicitly binds the task directory while provider identity retains its original folder. Resume preserves original task identity, history and approvals.');
     return 0;
   }
-  const options = {};
   const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
-  for (let i = 0; i < args.length; i += 2) {
-    const key = args[i]?.replace(/^--/, '');
-    if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
-    options[key] = args[i + 1];
-  }
+  const options = parseDeliveryOptions(args, allowed);
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
   if (action === 'evidence') {

package/src/delivery-hooks/consistency-monitor.js

@@ -122,5 +122,5 @@ export async function runConsistencyMonitor({ root, now = Date.now(), records, r
 
 export async function consistencyMonitorStatus(root, now = Date.now()) {
   const status = await read(join(root, 'consistency', 'monitor.json'));
-  return status ? { ...status, health: status.lastFailure ? 'failed' : status.lastAttemptAt > (status.lastSuccessAt || 0) ? 'interrupted' : now - status.lastSuccessAt > 3 * 60_000 ? 'stale' : 'healthy' } : { health: 'not_started' };
+  return status ? { ...status, health: status.lastFailure ? 'failed' : status.lastAttemptAt > (status.lastSuccessAt || 0) ? now - (status.lastHeartbeatAt || status.lastAttemptAt) < 90_000 ? 'auditing' : 'interrupted' : now - (status.lastHeartbeatAt || status.lastSuccessAt) > 3 * 60_000 ? 'stale' : 'healthy' } : { health: 'not_started' };
 }

package/src/delivery-hooks/runtime-watchdog.js

@@ -53,7 +53,8 @@ export async function tickRuntimeWatchdog({ root, now = Date.now(), run = exec,
     host: null, monitor: null, error: null, action: 'observe' };
   try {
     state.host = await observeHost({ root });
-    state.monitor = await observeMonitor(join(root, 'delivery-hooks'), now);
+    const monitor = await observeMonitor(join(root, 'delivery-hooks'), now);
+    state.monitor = Object.fromEntries(['health', 'ownerPid', 'lastAttemptAt', 'lastSuccessAt', 'lastHeartbeatAt', 'lastFailure', 'metrics'].map(key => [key, monitor[key] ?? null]));
     const active = await read(join(root, 'desktop-runtime/active.json'));
     if (active?.suspendedBy === 'user_quit') state.action = 'user_quit_preserved';
     if (active && !active.suspendedBy && state.host.state !== 'matched' && now - (previous.lastLaunchAt || 0) >= 60_000) {
@@ -96,6 +97,9 @@ export async function installRuntimeWatchdog({ root, home = homedir(), run = exe
   await run('/usr/bin/plutil', ['-lint', plist]);
   const domain = `gui/${process.getuid()}`;
   try { await run('/bin/launchctl', ['bootout', `${domain}/${label}`]); } catch { /* First install has no job. */ }
-  await run('/bin/launchctl', ['bootstrap', domain, plist]);
+  for (let attempt = 0; ; attempt++) {
+    try { await run('/bin/launchctl', ['bootstrap', domain, plist]); break; }
+    catch (error) { if (attempt >= 2) throw error; await delay(250 * (attempt + 1)); }
+  }
   return { label, plist, scope: 'activated_local_desktop_only' };
 }

package/src/desktop-process-lock.js

@@ -172,7 +172,7 @@ export function parseLegacyAgentArguments(args) {
     const previous = agentArgs[index - 1];
     return previous !== "--host" && previous !== "--port";
   });
-  if (subcommand === "sqm" || subcommand === "update") return null;
+  if (subcommand === "sqm" || subcommand === "update" || subcommand === "delivery" && agentArgs[agentArgs.indexOf("delivery") + 1] !== "supervise" || agentArgs.includes("--version") || agentArgs.includes("-v")) return null;
   let webOrigin = null;
   const hostIndex = argv.indexOf("--host", entryIndex + 1);
   const inlineHost = argv.slice(entryIndex + 1).find((value) => value.startsWith("--host="));

package/src/session-supervision/autonomous-upgrade.js

@@ -1,5 +1,6 @@
-import { createHash } from 'node:crypto';
-import { automaticContinuationAllowed, queuePurposeDiagnosis, queuePurposeVerification } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { createHash, randomUUID } from 'node:crypto';
+import { automaticContinuationAllowed, listRecords, updateRecord, queuePurposeDiagnosis, queuePurposeVerification } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { autonomousPolicyAuthorized, policyContractIdentity, acceptanceIdentity, legacyIndependentCriterion, effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 
 export const AUTONOMOUS_STATE_CONTRACT = 2;
@@ -21,6 +22,12 @@ export function upgradeEligible(record) {
     !(record.run.state === 'paused' && pauseOrigin(record.run) === 'user');
 }
 
+export function policyAdoptionPending(record) {
+  const m = record?.run?.managed;
+  return autonomousPolicyAuthorized(m) && (m.autonomyPolicy !== 'autonomous' || m.acceptanceCriteria.some(c => !m.verified[c.id] && legacyIndependentCriterion(c, m.policyAuthorization.independentCriterionIds) &&
+    (m.acceptanceRoutes?.[c.id]?.source !== 'explicit_user_runtime_policy' || m.acceptanceRoutes[c.id].authorizationId !== m.policyAuthorization.id || m.acceptanceRoutes[c.id].criterionDigest !== acceptanceIdentity(c))));
+}
+
 // Controller-only, idempotent migration. Frozen criteria and grants remain
 // byte-identical, including each criterion's original verifier.
 export function upgradeAutonomousRecord(record, { rules, now, metadata } = {}) {
@@ -28,28 +35,79 @@ export function upgradeAutonomousRecord(record, { rules, now, metadata } = {}) {
   const run = record.run, m = run.managed, previousState = run.state;
   if (metadata?.session !== record.session || metadata.cwd !== record.cwd || !metadata.model ||
       metadata.model !== (m.resumeModel || record.admission.model)) return { changed: false, reason: 'original_channel_unverified' };
+  if (metadata.isRunning !== false) return { changed: false, reason: 'original_not_idle' };
   if (!m.approvalScopes?.length) return { changed: false, reason: 'authorized_read_scope_missing' };
   const before = digest({ purpose: m.purpose, autonomyPolicy: m.autonomyPolicy, routes: m.acceptanceRoutes, channel: m.resumeChannel, contractVersion: m.controllerContractVersion });
   const original = digest({ objective: run.objective, criteria: m.acceptanceCriteria, level: m.deliveryLevel, grants: m.grants });
   m.purpose = { ...m.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102',
     failureBudgetMode: purposeFailureMode(record), ruleDigest: rules.digest, ruleIds: rules.rules.map(rule => rule.id),
     recoveries: m.purpose?.recoveries || [] };
+  if (autonomousPolicyAuthorized(m)) {
+    m.autonomyPolicy = 'autonomous'; m.acceptanceRoutes ||= {};
+    for (const criterion of m.acceptanceCriteria) if (!m.verified[criterion.id] && legacyIndependentCriterion(criterion, m.policyAuthorization.independentCriterionIds)) {
+      const expected = acceptanceIdentity(criterion), route = m.acceptanceRoutes[criterion.id];
+      if (route?.criterionDigest !== expected || route.authorizationId !== m.policyAuthorization.id || route.source !== 'explicit_user_runtime_policy') m.acceptanceRoutes[criterion.id] = {
+        source: 'explicit_user_runtime_policy', authorizationId: m.policyAuthorization.id, mode: 'independent', criterionDigest: expected, at: now };
+    }
+  }
   m.controllerContractVersion = AUTONOMOUS_STATE_CONTRACT;
   m.resumeChannel = 'codex_app_server'; m.resumeModel = metadata.model; m.capability = 'codex_app_server';
   const after = digest({ purpose: m.purpose, autonomyPolicy: m.autonomyPolicy, routes: m.acceptanceRoutes, channel: m.resumeChannel, contractVersion: m.controllerContractVersion });
   if (before !== after) {
     m.policyMigrations = [...(m.policyMigrations || []), { version: AUTONOMOUS_STATE_CONTRACT, at: now, originalContract: original,
-      previous: before, applied: after, source: 'existing_auto_continue_consent' }].slice(-20);
+      previous: before, applied: after, source: autonomousPolicyAuthorized(m) ? 'explicit_user_runtime_policy' : 'existing_auto_continue_consent' }].slice(-20);
     m.controllerContractVersion = AUTONOMOUS_STATE_CONTRACT;
   }
+  if (autonomousPolicyAuthorized(m) && run.state === 'paused' && pauseOrigin(run) === 'system' && m.dependencyWait &&
+    !m.pendingApproval && !m.userQuestion && !m.understandingQuestion && !m.nativeWait && !m.providerWarning && !m.executionUncertain) {
+    run.stopReason = { actor: 'system', code: 'legacy_no_progress', at: now, evidence: run.reason };
+    run.state = 'blocked'; run.blocker = 'external_dependency';
+    run.reason = 'Monitoring the original dependency and permitted independent work; no authority or prior effect is assumed.';
+    m.purpose.nextDependencyCheckAt = now;
+  }
   const canRecover = metadata.isRunning === false && !m.pendingApproval && !m.userQuestion &&
     !m.understandingQuestion && !m.dependencyWait && !m.providerWarning && !m.nativeWait && !m.executionUncertain;
   if (canRecover && run.state === 'paused' && pauseOrigin(run) === 'system') {
     run.stopReason = { actor: 'system', code: 'legacy_no_progress', at: now, evidence: run.reason };
     run.state = 'recovery_required'; run.recoveryCause = 'session_supervision';
     queuePurposeDiagnosis(run, 'Independently diagnose the original outcome after a system no-progress pause. Preserve prior effects, failure history and budgets.', `upgrade:${original}`, now);
-  } else if (canRecover && run.state === 'verification_pending' && m.acceptanceCriteria.some(c => c.check.type === 'semantic' && !m.verified[c.id])) {
+  } else if (canRecover && run.state === 'verification_pending' && effectiveAcceptanceCriteria(m).some(c => c.check.type === 'semantic' && !m.verified[c.id])) {
     queuePurposeVerification(run, 'Existing outcome awaits independent evidence inspection; inspect original instructions and actual artifacts, not a worker completion claim.', now);
   }
   return { changed: before !== after || run.state !== previousState, reason: 'applied', originalContract: original };
 }
+
+// Explicit CLI user control; never inferred from installation, ON, descriptions
+// or a worker checkpoint. It records intent; migration waits for verified idle
+// authority, and retains all original grants and budgets.
+export async function adoptAutonomousPolicy({ root, taskId, criterionId, now = Date.now() } = {}) {
+  if (criterionId && !taskId) throw new Error('Delegating an acceptance verifier requires an exact task ID.');
+  const snapshots = await listRecords(root);
+  if (taskId && snapshots.filter(record => record.run?.managed?.taskId === taskId).length !== 1) throw new Error('Exact managed task not found or ambiguous.');
+  const receipts = [];
+  for (const snapshot of snapshots) {
+    const m = snapshot.run?.managed;
+    if (taskId && m?.taskId !== taskId) continue;
+    if (criterionId && !m?.acceptanceCriteria?.some(c => c.id === criterionId && c.check.type === 'manual')) throw new Error('Exact manual acceptance criterion not found.');
+    if (snapshot.provider !== 'codex' || !m || !snapshot.autoContinue || !automaticContinuationAllowed(snapshot) || snapshot.providerArchived ||
+      ['stopped', 'completed', 'reported_done', 'budget_exhausted', 'failed'].includes(snapshot.run.state) ||
+      snapshot.run.state === 'paused' && pauseOrigin(snapshot.run) === 'user') continue;
+    const expected = policyContractIdentity(m);
+    const saved = await updateRecord(root, snapshot.provider, snapshot.session, current => {
+      if (!current?.autoContinue || !automaticContinuationAllowed(current) || current.autoContinueEpoch !== snapshot.autoContinueEpoch ||
+        current.run?.id !== snapshot.run.id || policyContractIdentity(current.run.managed) !== expected ||
+        ['stopped', 'completed', 'reported_done', 'budget_exhausted', 'failed'].includes(current.run.state) ||
+        current.run.state === 'paused' && pauseOrigin(current.run) === 'user') return current;
+      const authorized = autonomousPolicyAuthorized(current.run.managed);
+      const independentCriterionIds = authorized ? current.run.managed.policyAuthorization.independentCriterionIds || [] : [];
+      if (!authorized || criterionId && !independentCriterionIds.includes(criterionId)) current.run.managed.policyAuthorization = {
+        id: randomUUID(), source: 'explicit_user_runtime_policy', taskId: m.taskId, contractDigest: expected,
+        independentCriterionIds: [...new Set([...independentCriterionIds, ...(criterionId ? [criterionId] : [])])],
+        decisionPolicy: 'llm-first-hc102', at: now, effects: 'existing_scopes_and_permissions_only' };
+      return current;
+    });
+    if (autonomousPolicyAuthorized(saved?.run?.managed)) receipts.push({ provider: snapshot.provider, session: snapshot.session, taskId: m.taskId,
+      authorizationId: saved.run.managed.policyAuthorization.id, stateUnchanged: true });
+  }
+  return { policy: 'llm-first-hc102', scope: 'existing_opted_in_codex_tasks', receipts };
+}

package/src/session-supervision/codex-app-server.js

@@ -494,7 +494,7 @@ async function reviewConnectorInventory(client, threadId) {
   const servers = [], seen = new Set();
   let cursor = null;
   do {
-    const page = await client.request('mcpServerStatus/list', { threadId, cursor, limit: 1 });
+    const page = await client.request('mcpServerStatus/list', { ...(threadId ? { threadId } : {}), cursor, limit: 1 });
     if (!Array.isArray(page?.data) || servers.length + page.data.length > 1000) throw new CodexAppServerError('unsupported', 'Review connector inventory is unavailable.');
     servers.push(...page.data); cursor = page.nextCursor || null;
     if (cursor && seen.has(cursor)) throw new CodexAppServerError('unsupported', 'Review connector pagination is inconsistent.');
@@ -536,7 +536,7 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
   // Connector schemas can exceed ordinary checkpoint limits; keep review pages
   // bounded to one server and a separate finite transport ceiling.
   const client = await openClient({ signal, ...(isolated ? { maxLineBytes: 8 * 1024 * 1024 } : {}) });
-  let targetSession = record.session, reviewBaseline = null, reviewObservations = [], reviewInventory = [];
+  let targetSession = record.session, reviewBaseline = null, reviewObservations = [], reviewInventory = [], auditBindingUnavailable = false;
   const toolEvidence = [];
   const captureWorkspace = async () => {
     const files = [];
@@ -580,8 +580,9 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
     const purposeInstruction = await buildPurposeInstruction(run.managed, { reviewer: reviewing });
     let prompt = run.managed.phase === 'action_association' ? associationContract(run.managed.actionAssociation.job) : run.managed.phase === 'understanding' ? `Understand the ORIGINAL user request in this exact Codex conversation. This first/clarifying turn is read-only and must not perform task work. Context: ${JSON.stringify({ ...context, priorUnderstanding: run.managed.sessionUnderstanding, userAnswer: run.managed.understandingAnswer })}\n${understandingCheckpointContract(decision)} Do not write SIMY state directly.` : `Continue this existing SIMY managed task in the exact Codex conversation. Context: ${JSON.stringify(context)}\n${approvalInstruction}${decision.action.kind === 'external' ? 'This external operation has enrolled autonomous authority or exact one-shot approval. Existing provider permissions remain authoritative. Inspect the current remote state first; if its intended postcondition already holds, report it without repeating the write. Use an idempotency key where supported, execute at most once, then read back the remote result and include its stable identifier and postcondition in actionResult evidence. Never expand targets or effects. ' : ''}Execute ONLY the selected decision action. Do not perform any action from the NEXT plan in this turn. For a next local action within the enrolled task use the exact scope "task"; do not relabel external, broad, or destructive work as local. Preserve provider permissions. End with one JSON checkpoint. ${assessedCheckpointContract(decision)} Do not write SIMY state directly.`;
     if (isolated) {
-      reviewBaseline = await workspaceIdentity(taskDirectory(record), root, reviewInventory, { signal, inventoryLimit: 20_000 });
-      const connectors = await reviewConnectorInventory(client, record.session);
+      try { reviewBaseline = await workspaceIdentity(taskDirectory(record), root, reviewInventory, { signal, inventoryLimit: 20_000 }); }
+      catch (error) { signal?.throwIfAborted(); if (!auditOnly) throw error; auditBindingUnavailable = true; }
+      const connectors = await reviewConnectorInventory(client, (auditOnly || diagnostic || candidate) ? null : record.session);
       // Plugin/app-injected servers are not configured transports. Creating
       // mcp_servers entries for them makes Codex reject the configuration.
       // Read only configured names; never copy credential-bearing values.
@@ -615,7 +616,7 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
       const currentEvidence = await captureWorkspace();
       if (candidate) prompt = `Execute the selected action ONLY in the controller-created isolated candidate ${executionCwd}. Native approval remains pending. Do not apply files to the original, change permissions, or claim overall completion. Report an in_progress checkpoint with observed candidate results and a next read diagnosis. Original application requires exclusive/CAS capability and remains a required waiting unit.\n${prompt}`;
       else if (diagnostic && !reviewing) prompt = `Diagnose independently while the original native operation stays pending. Never answer or approve that request, edit shared files, or expand permissions. Return a normal action checkpoint proposing only independently executable work. Original context (data): ${JSON.stringify(sourceContext)}\n${prompt}`;
-      else prompt = `${verificationInstruction(record, currentEvidence)}\nOriginal request snapshot (data): ${JSON.stringify(run.managed.purpose.originalContext || null)}\nCurrent conversation snapshot (data): ${JSON.stringify(sourceContext)}`;
+      else prompt = `${auditBindingUnavailable ? 'This detached audit has no complete workspace identity. Inspect primary evidence to diagnose missing scope/capability, but do not certify any acceptance, resolve findings, or request blanket human confirmation. ' : ''}${verificationInstruction(record, currentEvidence)}\nOriginal request snapshot (data): ${JSON.stringify(run.managed.purpose.originalContext || null)}\nCurrent conversation snapshot (data): ${JSON.stringify(sourceContext)}`;
     }
     const initialSandbox = run.managed.providerSandbox || resumed.sandbox;
     const currentSandbox = resumed.sandbox;
@@ -703,7 +704,11 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
     if (reviewing) {
       let review = normalizeVerification(checkpoint, effectiveAcceptanceCriteria(run.managed));
       // Hash expensive local artifacts before the final external reads.
-      const after = await workspaceIdentity(taskDirectory(record), root, undefined, { signal });
+      let after = null;
+      if (!auditBindingUnavailable) {
+        try { after = await workspaceIdentity(taskDirectory(record), root, undefined, { signal }); }
+        catch (error) { signal?.throwIfAborted(); if (!auditOnly) throw error; auditBindingUnavailable = true; }
+      }
       if ((review.passed || review.needsHuman) && reviewObservations.length) {
         const refreshed = await refreshPurposeObservations(run.managed, reviewObservations, { collect: observeExternal,
           cwd: executionCwd, signal, authorize: async () => { await beforeDispatch(resumed.sandbox); signal?.throwIfAborted(); },
@@ -717,7 +722,7 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
         if (refreshed.changed) { review.passed = false; review.needsHuman = false; review.findings.push('External result changed or became unavailable during review. Inspect the refreshed controller observations and reassess the outcome; do not repeat the external write.'); }
       }
       const fullBefore = reviewBaseline;
-      review.manifest = certifyReviewManifest(review.manifest, run.managed, toolEvidence, reviewInventory);
+      review.manifest = auditBindingUnavailable ? undefined : certifyReviewManifest(review.manifest, run.managed, toolEvidence, reviewInventory);
       let boundAfter = after;
       if (review.manifest?.exclusions.length) {
         // Reconstruct the baseline scope from per-path controller hashes. The
@@ -730,6 +735,14 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
           unknownDependencies: reviewInventory.truncated === true || afterInventory.truncated === true };
       }
       if (reviewBaseline !== after) { review.passed = false; review.needsHuman = false; review.findings.push('Workspace changed while reviewing; inspect the new revision and repeat verification.'); }
+      if (auditBindingUnavailable) {
+        review.passed = false; review.needsHuman = false; review.resolutions = [];
+        review.criteria = review.criteria.map(row => ({ ...row, passed: false }));
+        review.workspaceBinding = 'unavailable';
+        const criterion = run.managed.acceptanceCriteria[0];
+        const gap = 'The complete workspace identity is unavailable; this read-only diagnosis cannot certify task acceptance.';
+        review.findings.push(criterion ? { id: 'workspace-audit-binding', requirementId: `criterion:${criterion.id}`, source: 'controller_workspace_inventory', owner: 'controller', gap, verification: 'Establish the correct authorized workspace scope and independently bind its actual artifacts before acceptance.', reopenReason: 'The current workspace identity is unavailable or its scope changed.' } : gap);
+      }
       review = assessIndependentInspection(review, { toolEvidence, observations: reviewObservations });
       return { code: 0, verification: { ...review, source: 'independent_codex_session', session: targetSession, workspaceDigest: boundAfter }, usage, toolEvidence };
     }

package/src/session-supervision/index.js

@@ -59,6 +59,10 @@ function autoContinueState(record, isRunning, availability) {
     }[record.run.recoveryCause] || 'automatic recovery is unavailable. Review the task and explicitly resume through its existing controls.';
     return { autoContinueStatus: 'needs_user', autoContinueReason: `Existing supervision needs your attention: ${recoveryReason}` };
   }
+  if (record.provider === 'codex' && managed?.controllerContractVersion === 2 && managed.purpose?.decisionPolicy === 'llm-first-hc102' &&
+    managed.dependencyWait && !managed.userQuestion && (state === 'blocked' && record.run.blocker === 'external_dependency' || state === 'paused' && pauseOrigin(record.run) === 'system')) {
+    return { autoContinueStatus: 'watching', autoContinueReason: 'Monitoring dependency evidence and permitted independent work while preserving the original authority boundary.' };
+  }
   if (record.provider === 'codex' && managed?.controllerContractVersion === 2 && !managed.userQuestion && !managed.dependencyWait &&
       (state === 'paused' && pauseOrigin(record.run) === 'system' || state === 'verification_pending' && effectiveAcceptanceCriteria(managed).some(c => !managed.verified?.[c.id] && c.check.type === 'semantic'))) {
     return { autoContinueStatus: 'supervising', autoContinueReason: 'Inspecting the original outcome and evidence before the next authorized action.' };

package/src/session-supervision/purpose-recovery.js

@@ -7,7 +7,7 @@ import { openCodexAppServer, readCodexSession, observeCodexAuthentication } from
 import { realpath } from 'node:fs/promises';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { purposeEnabled } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
-import { upgradeAutonomousRecord, upgradeEligible } from './autonomous-upgrade.js';
+import { upgradeAutonomousRecord, upgradeEligible, policyAdoptionPending } from './autonomous-upgrade.js';
 import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
 
 export async function observePurposeTurn(record, { openClient = openCodexAppServer } = {}) {
@@ -44,7 +44,7 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
   for (let record of await readRecords()) {
     try {
     let run = record.run;
-    if (upgradeEligible(record) && (run.managed.controllerContractVersion !== 2 || run.state === 'paused' || run.state === 'verification_pending')) {
+    if (upgradeEligible(record) && (policyAdoptionPending(record) || run.managed.controllerContractVersion !== 2 || run.state === 'paused' || run.state === 'verification_pending')) {
       let metadata, migrationLink;
       try { migrationLink = await requireProviderLink({ root, provider: record.provider }); metadata = await observeMetadata(record); }
       catch { metadata = null; }