@awak-app/simy-cli 0.6.28 → 0.6.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.28";
+export const CLI_VERSION = "0.6.30";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/completion-binding.mjs

@@ -0,0 +1,14 @@
+import { createHash } from 'node:crypto';
+const digest = run => createHash('sha256').update(JSON.stringify([run.id, run.objective, run.revision, run.checkpoint,
+ run.managed?.taskId, run.managed?.acceptanceCriteria, run.managed?.verified, run.managed?.grants, run.managed?.purpose?.ruleDigest])).digest('hex');
+// A compatibility fence, not a semantic proof or a cryptographic attestation.
+// An older writer retaining an unknown receipt cannot certify its later revision.
+export function bindControllerCompletion(run, now) {
+ run.managed.completionBinding = { version:1, digest:digest(run), at:now, source:'canonical_acceptance_controller' };
+}
+export function completionBindingCurrent(run) {
+ return run.managed?.completionBinding?.version===1 && run.managed.completionBinding.source==='canonical_acceptance_controller' && run.managed.completionBinding.digest===digest(run);
+}
+export function completionClaimUnbound(record) {
+ return ['completed','reported_done'].includes(record?.run?.state) && record.run.managed?.purpose?.enabled === true && !completionBindingCurrent(record.run);
+}

package/src/codex-plugins/simy/hooks/consistency-handoff.mjs

@@ -0,0 +1,38 @@
+// Durable handoff deadlines concern unowned work, never a live effect lease.
+// Expiry queues diagnosis; it does not replay a write or grant permission.
+export const HANDOFF_RECEIPT_MS = 2 * 60_000;
+export const HANDOFF_PROGRESS_MS = 5 * 60_000;
+export function recordHandoffStage(item, stage, now, details = {}) {
+  const previous = item.stage;
+  item.stage = stage;
+  Object.assign(item, details);
+  if (previous !== stage) {
+    item.history ||= [];
+    item.history.push({ from: previous || null, to: stage, at: now });
+    item.history = item.history.slice(-16);
+    item.stageStartedAt = now;
+  }
+  item.owner = stage === 'pending' ? 'independent_auditor' : ['received', 'executing'].includes(stage) ? 'task_controller' : item.owner || 'independent_auditor';
+  item.dueAt = ['resolved', 'superseded'].includes(stage) ? null : (item.stageStartedAt || item.createdAt || now) + (stage === 'pending' ? HANDOFF_RECEIPT_MS : HANDOFF_PROGRESS_MS);
+}
+export function handoffHealth(managed, now) {
+  const requests = managed?.consistencyOutbox || [];
+  const busy = Boolean(managed?.resumeLease || managed?.liveWorkspaceLease || managed?.outcomeAudit?.lease);
+  return requests.filter(item => !['resolved', 'superseded'].includes(item.stage)).map(item => ({
+    id: item.id, owner: item.owner || 'task_controller', stage: item.stage,
+    overdue: !busy && now >= (item.dueAt || (item.observedAt || item.receivedAt || item.createdAt || now) + HANDOFF_PROGRESS_MS),
+    ageMs: Math.max(0, now - (item.createdAt || now)), effectDecisionId: item.decisionId || null,
+  }));
+}
+export function handoffMetrics(records, now) {
+  const requests = records.flatMap(r => r.run?.managed?.consistencyOutbox || []);
+  const resolved = requests.filter(r => r.stage === 'resolved' && Number.isFinite(r.verifiedAt) && Number.isFinite(r.createdAt));
+  const audits = records.map(r => r.run?.managed?.outcomeAudit).filter(Boolean);
+  return { pendingHandoffs: requests.filter(r => !['resolved', 'superseded'].includes(r.stage)).length,
+    overdueHandoffs: records.flatMap(r => handoffHealth(r.run?.managed, now)).filter(r => r.overdue).length,
+    resolvedHandoffs: resolved.length, recoveryLatencyMs: resolved.length ? resolved.reduce((n,r) => n + Math.max(0,r.verifiedAt-r.createdAt),0) / resolved.length : null,
+    auditTokens: audits.reduce((n,a) => n + (a.tokensUsed || 0),0),
+    unknownAuditConsumption: audits.filter(a => a.unknownConsumption).length,
+    falseCompletionCount: null, unnecessaryConfirmationCount: null, duplicateEffectCount: null, costAmount: null,
+    measurementScope: 'retained_controller_receipts', };
+}

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { bindControllerCompletion } from './completion-binding.mjs';
+import { recordHandoffStage } from './consistency-handoff.mjs';
 import { retainApplicableRules } from './purpose-rule-policy.mjs';
 import { reconcileRequirements, retainControllerEvidence, reconcileFindings, findingText, evidenceLedger, currentPurposeObservation } from './purpose-evidence.mjs';
 import { workspaceIdentity } from './purpose-workspace.mjs';
@@ -7,7 +9,7 @@ import { searchEnabled, failureLimitReached, searchState, recordSearchExperiment
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
@@ -63,9 +65,40 @@ function applyProviderConsent(record, link) {
       revision: (record.run.revision || 0) + 1,
       ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
 }
+async function applyArchiveFence(root, record) {
+  if (!record) return record;
+  const file = `${recordPath(root, record.provider, record.session)}.archive-fence`;
+  let archived;
+  try { archived = JSON.parse(await readFile(file, 'utf8')).archived !== false; }
+  catch (error) { if (error.code === 'ENOENT') return record; archived = true; }
+  if (!archived) return record;
+  return { ...record, providerArchived: true, autoContinue: false, tracked: false, monitor: false,
+    ...(record.run && !TERMINAL.has(record.run.state) ? { run: { ...record.run, state: 'paused',
+      reason: 'The original provider conversation was archived.',
+      ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
+}
+export async function recordProviderArchive(root, provider, session, archived, observedAt) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const file = `${recordPath(root, provider, session)}.archive-fence`;
+  const lock = `${file}.lock`, token = await acquireStateLock(lock, processIdentity);
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    let previous; try { previous = JSON.parse(await readFile(file, 'utf8')); } catch {}
+    if (previous?.observedAt > observedAt) return;
+    await writeFile(temporary, JSON.stringify({ provider, session, archived, observedAt }), { mode: 0o600 });
+    await rename(temporary, file);
+  } finally { await rm(temporary, { force: true }); await releaseStateLock(lock, token); }
+}
 async function currentProviderConsent(root, records) {
   const links = Object.fromEntries(await Promise.all(['codex', 'claude'].map(async provider => [provider, await providerLinkState(root, provider)])));
-  return records.map(record => applyProviderConsent(record, links[record.provider] || {}));
+  let archiveNames;
+  try { archiveNames = new Set((await readdir(root)).filter(name => name.endsWith('.archive-fence'))); }
+  catch { /* A failed index read falls back to fresh per-record fencing. */ }
+  return Promise.all(records.map(record => {
+    const current = applyProviderConsent(record, links[record.provider] || {});
+    if (archiveNames && !archiveNames.has(`${basename(recordPath(root, record.provider, record.session))}.archive-fence`)) return current;
+    return applyArchiveFence(root, current);
+  }));
 }
 export async function linkedProvider(root, provider) {
   return (await providerLinkState(root, provider)).connected === true;
@@ -175,6 +208,34 @@ async function acquireStateLock(lock, inspectProcess, depth = 0) {
     await releaseStateLock(reclaim, token);
   }
 }
+export async function withSessionParentLock(root, operation, inspectProcess = processIdentity) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const lock = join(root, 'session-lineage.lock');
+  // Distinct SessionStart hooks share this lock. Wait within the hook timeout
+  // for short writers, without reclaiming unknown owners or replaying work.
+  const deadline = Date.now() + 500;
+  let token;
+  for (;;) {
+    try { token = await acquireStateLock(lock, inspectProcess); break; }
+    catch (error) {
+      if (Date.now() >= deadline || !/^(?:Delivery state is busy; retry the command\.|Delivery state lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message)) throw error;
+      await new Promise(resolve => setTimeout(resolve, 10));
+    }
+  }
+  try { return await operation(); } finally { await releaseStateLock(lock, token); }
+}
+export async function validateSessionParent(root, child, parent) {
+  const key = item => `${item.provider}:${item.session}`;
+  const seen = new Set([key(child)]);
+  let cursor = parent;
+  for (let depth = 0; cursor; depth++) {
+    if (depth >= 256 || seen.has(key(cursor))) throw new Error('Parent relationship would create a cycle or exceed the ancestry limit.');
+    seen.add(key(cursor));
+    const ancestor = await readRecord(root, cursor.provider, cursor.session);
+    if (!ancestor?.observedAt && !ancestor?.admission?.validatedAt) throw new Error('The parent ancestry must contain observed provider conversations.');
+    cursor = ancestor.parentSession;
+  }
+}
 export async function updateRecord(root, provider, session, mutate, { inspectProcess = processIdentity } = {}) {
   await mkdir(root, { recursive: true, mode: 0o700 });
   const file = recordPath(root, provider, session), lock = `${file}.lock`;
@@ -184,7 +245,7 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
   let temporary;
   try {
     const stored = await read(file);
-    const previous = applyProviderConsent(stored, await providerLinkState(root, provider));
+    const previous = await applyArchiveFence(root, applyProviderConsent(stored, await providerLinkState(root, provider)));
     const previousBytes = stored === null ? null : JSON.stringify(stored);
     const next = await mutate(previous);
     if (next) {
@@ -210,7 +271,7 @@ export async function readRecord(root = rootDirectory(), provider, session) {
   const path = recordPath(root, provider, session);
   try {
     const record = await read(path);
-    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? applyProviderConsent(record, await providerLinkState(root, provider)) : null;
+    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? applyArchiveFence(root, applyProviderConsent(record, await providerLinkState(root, provider))) : null;
   } catch { return null; } // Match listRecords' treatment of unreadable records.
 }
 const RECORD_NAME = /^[a-f0-9]{64}\.json$/;
@@ -608,6 +669,9 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     continuationPolicy: continuationMode(config.continuationPolicy),
     autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
     autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
+    ...(appServerChannel && admission.nativeSandbox && admission.nativeSandboxSource ? {
+      providerSandbox: structuredClone(admission.nativeSandbox), providerSandboxSource: structuredClone(admission.nativeSandboxSource) } :
+      appServerChannel ? { providerSandbox: null, providerSandboxSource: { type: 'unavailable_at_enrollment' } } : {}),
     capability: appServerChannel && autoRecovery ? 'codex_app_server' : autoRecovery ? 'codex_exec_resume' : 'live_hook',
     awaitingInitialHook: provider === 'claude' && Boolean(observedProcess?.identity) && Boolean(autonomyPolicy),
     autonomyPolicy, plan: null, decision: null, decisionHistory: [], workHistory: [], escalation: null,
@@ -623,6 +687,7 @@ function freezeEnrollment(run, now) {
     ledger.charter ||= { objective: run.objective, criteria: structuredClone(run.managed.acceptanceCriteria), approvalScopes: [...run.managed.approvalScopes], frozenAt: now };
   }
   run.managed.enrollment = { objective: run.objective, acceptanceDigest: digest(JSON.stringify(run.managed.acceptanceCriteria)),
+    ...(run.managed.providerSandboxSource ? {nativeAuthorityDigest:digest(JSON.stringify([run.managed.providerSandbox,run.managed.providerSandboxSource]))} : {}),
     deliveryLevel: structuredClone(run.managed.deliveryLevel || null), frozenAt: now };
 }
 export function pendingAcceptance(run) {
@@ -943,7 +1008,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       delete run.managed.recoveryDiagnosisDecisionId;
     }
     for (const request of run.managed?.consistencyOutbox || []) if (request.decisionId && request.decisionId === checkpoint.actionResult?.decisionId) {
-      request.stage = checkpoint.actionResult.status === 'observed' ? 'inspected' : 'inspection_failed';
+      recordHandoffStage(request, checkpoint.actionResult.status === 'observed' ? 'inspected' : 'inspection_failed', now);
       request.observedAt = now; request.result = checkpoint.actionResult.status;
     }
     notifyState(run, now);
@@ -991,6 +1056,29 @@ export async function settlePurposeVerification({ root, provider, session, expec
         'Required operation, effect reconciliation or original-purpose contract remains unresolved. Preserve the waiting unit and continue independent authorized work.'] };
     }
     if(!externalReviewIsCurrent(managed,review,now)) review={...review,passed:false,needsHuman:false,findings:[...review.findings,'Controller external evidence expired before settlement; reacquire the same authorized observations and independently re-evaluate without replaying writes.']};
+    // Validate counterevidence against a disposable ledger before mutations.
+    // Verifier contract failures are verifier work, never worker checkpoint errors.
+    if (!review.controllerEvidenceFailure) {
+      try { reconcileFindings(structuredClone(managed), review, now); }
+      catch (error) {
+        if (!/^(Reopening a closed finding|Finding resolution needs|Independent review left unresolved findings|A finding cannot be open and resolved\.)/.test(error.message)) throw error;
+        review = { ...review, passed: false, needsHuman: false, controllerEvidenceFailure: {
+          code: 'independent_finding_evidence_invalid', targets: [...(review.resolutions || []).map(row => `resolution:${row.id}`), ...(review.findings || []).filter(row => row.reopenReason).map(row => `reopen:${row.id}`)],
+          instruction: error.message + ' Repeat isolated verification and reconcile existing findings with primary reads. For reopening use the exact prior closure read scope.',
+          requiredReads: (managed.purpose.evidence?.findings || []).filter(row => row.status !== 'open').map(row => ({ id: row.id, closedReads: row.closedReads || [] }))
+        } };
+      }
+    }
+    if (review.controllerEvidenceFailure) {
+      const prior = state.verifierFailures;
+      const key = digest(JSON.stringify([currentDigest, review.controllerEvidenceFailure.code, review.controllerEvidenceFailure.targets]));
+      state.verifierFailures = { key, attempts: prior?.key === key ? prior.attempts + 1 : 1, at: now, failure: review.controllerEvidenceFailure };
+      state.review = review;
+      run.revision += 1; run.updatedAt = now;
+      queuePurposeVerification(run, `${review.controllerEvidenceFailure.instruction} Invalid targets: ${(review.controllerEvidenceFailure.targets || []).join(', ')}. Use a narrow direct read containing the cited excerpt within 2000 characters.`, now);
+      managed.nextAttemptAt = now + Math.min(60_000, 1000 * 2 ** Math.min(state.verifierFailures.attempts - 1, 6));
+      notifyState(run, now); return record;
+    }
     const openFindings = reconcileFindings(managed, review, now);
     const units=evidenceLedger(managed).units;
     for (const result of (review.passed || review.needsHuman) ? review.workUnits || [] : []) {
@@ -1018,11 +1106,9 @@ export async function settlePurposeVerification({ root, provider, session, expec
         for (const unit of evidenceLedger(managed).units || []) if (unit.status === 'observed' && unit.criterionIds.every(id => managed.verified[id])) unit.status = 'verified';
         run.state = 'completed'; run.reason = review.summary; state.phase = 'completed';
         run.checkpoint = { status: 'completed', summary: review.summary, evidence: review.criteria.map(c => c.evidence) };
+        bindControllerCompletion(run, now);
         managed.autoRecovery = false;
-        for (const request of managed.consistencyOutbox || []) {
-          request.stage = 'resolved'; request.verifiedAt = now; request.reviewerSession = review.session;
-          request.workspaceDigest = review.workspaceDigest;
-        }
+        settleCompletionHandoffs(run, now, review);
       } else if (pending.length && pending.every(c => c.check.type === 'manual')) {
         run.state = 'verification_pending'; run.reason = 'Only explicitly human acceptance remains.'; state.phase = 'waiting';
         run.checkpoint = { status: 'completed', summary: review.summary }; managed.autoRecovery = false;
@@ -1219,6 +1305,17 @@ function purposeCompletionBarrier(run) {
   const pending=ledger.units.filter(unit=>unit.required && unit.purposeRevision===ledger.purposeRevision && !['verified','superseded'].includes(unit.status));
   return pending.length ? 'Required work units still waiting: '+pending.map(unit=>unit.id).join(', ') : null;
 }
+function settleCompletionHandoffs(run, now, review) {
+  const managed = run.managed;
+  for (const request of managed.consistencyOutbox || []) {
+    if (request.targetTask !== managed.taskId || request.objectiveDigest !== digest(JSON.stringify([run.objective, managed.acceptanceCriteria])) || request.version !== managed.controllerContractVersion) {
+      recordHandoffStage(request, 'superseded', now, { reason: 'contract_changed' });
+      continue;
+    }
+    recordHandoffStage(request, 'resolved', now, { verifiedAt: now, reviewerSession: review.session });
+    request.workspaceDigest = review.workspaceDigest;
+  }
+}
 export async function verifyDelivery({ root = rootDirectory(), provider, session, taskId, criterionId, now = Date.now() }) {
   const started=Date.now(), initialNow=now;
   return updateRecord(root, provider, session, async record => {
@@ -1244,7 +1341,7 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
       if (!pendingAcceptance(run).length) {
         const barrier=purposeCompletionBarrier(run);
         if(barrier) queuePurposeVerification(run, 'Human decision recorded; '+barrier+' Independently reconcile the required operation before completing.', now);
-        else {run.state = 'completed'; run.reason = run.checkpoint.summary;}
+        else {run.state = 'completed'; run.reason = run.checkpoint.summary; bindControllerCompletion(run, now); settleCompletionHandoffs(run, now, run.managed.purpose?.search?.review || {});}
       }
     }
     notifyState(run, now);
@@ -1519,7 +1616,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
   const event = input.hook_event_name;
   const identity = observedProcess === undefined && (['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) ? await providerProcess(provider) : observedProcess;
   let output = {}, boundaryLease = null, claimedWorkspace = null;
-  try { await updateRecord(root, provider, input.session_id, async old => {
+  const applyObservation = () => updateRecord(root, provider, input.session_id, async old => {
     const currentLink = await providerLinkState(root, provider);
     if (!currentLink.connected || currentLink.epoch !== link.epoch) return old;
     if (old && old.cwd !== cwd) return old;
@@ -1531,7 +1628,11 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       const parentId = env.SIMY_PARENT_SESSION || (parentProvider === 'codex' ? env.CODEX_THREAD_ID : null);
       if (['codex', 'claude'].includes(parentProvider) && /^[0-9a-f-]{36}$/i.test(parentId || '') &&
           !(parentProvider === provider && parentId === input.session_id)) {
-        record.parentSession = { provider: parentProvider, session: parentId };
+        const parent = { provider: parentProvider, session: parentId };
+        try {
+          await validateSessionParent(root, { provider, session: input.session_id }, parent);
+          record.parentSession = parent;
+        } catch { /* Unverified or cyclic ancestry never changes navigation. */ }
       }
     }
     const owner = record.run?.managed?.liveHookOwner;
@@ -1673,7 +1774,11 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     record.run.updatedAt = now;
     notifyState(record.run, now);
     return record;
-  }); } catch (error) {
+  });
+  try {
+    if (event === 'SessionStart') await withSessionParentLock(root, applyObservation, inspectProcess);
+    else await applyObservation();
+  } catch (error) {
     if (claimedWorkspace?.release) await claimedWorkspace.release();
     throw error;
   }

package/src/codex-plugins/simy/hooks/purpose-cycle.mjs

@@ -42,9 +42,13 @@ export function validatePurposeReview(value, plan, ruleIds = [], previousRules =
       result.priorities.some(item => !Number.isInteger(item.rank) || item.rank < 1 || item.rank > options.length) ||
       new Set(result.priorities.map(item => item.rank)).size !== options.length ||
       options.length && result.priorities.find(item => item.rank === 1)?.optionId !== plan.selectedOptionId) throw new Error('Purpose priorities must rank every option and select the highest priority.');
-  if (!Array.isArray(value.rules) || value.rules.length > ruleIds.length || new Set(value.rules.map(item => item?.id)).size !== value.rules.length) throw new Error('Every purpose rule needs one disposition.');
+  if (!Array.isArray(value.rules) || value.rules.length > ruleIds.length) throw new Error('Every purpose rule needs one disposition.');
+  // Requirement references use rule:<id>; both spellings identify the same
+  // frozen clause. Normalize the label, never the status or evidence.
+  const suppliedRules=value.rules.map(item=>({...item,id:typeof item?.id==='string' && item.id.startsWith('rule:')?item.id.slice(5):item?.id}));
+  if(new Set(suppliedRules.map(item=>item.id)).size!==suppliedRules.length)throw new Error('Every purpose rule needs one disposition.');
   const merged = new Map(previousRules.filter(item => ruleIds.includes(item.id)).map(item => [item.id, item]));
-  for (const item of value.rules) { if (!ruleIds.includes(item?.id)) throw new Error('Invalid purpose rule receipt.'); merged.set(item.id, item); }
+  for (const item of suppliedRules) { if (!ruleIds.includes(item?.id)) throw new Error('Invalid purpose rule receipt.'); merged.set(item.id, item); }
   if (!selectiveRuleReview(managed) && merged.size !== ruleIds.length) throw new Error('Every purpose rule needs one disposition.');
   result.rules = (selectiveRuleReview(managed) ? [...merged.values()] : ruleIds.map(id => merged.get(id))).map(item => {
     if (!ruleIds.includes(item?.id) || !['satisfied', 'failed', 'unverified', 'not_applicable'].includes(item.status) || !clean(item.basis, 160)) throw new Error('Invalid purpose rule receipt.');

package/src/codex-plugins/simy/hooks/purpose-evidence.mjs

@@ -117,7 +117,7 @@ export function normalizeFindings(value, managed) {
     if (typeof item === 'string') return { id: `legacy:${digest(item).slice(0, 16)}`, requirementId: null, source: 'legacy_review', owner: 'worker', gap: text(item, 1000), verification: 'Inspect the reported gap', status: 'open' };
     const row = ledger.requirements.find(row => row.id === item?.requirementId);
     if (!row || !/^[\w:.-]{1,100}$/.test(item?.id) || !owners.includes(item.owner) || !text(item.gap) || !text(item.verification) || !text(item.source)) throw new Error('Review finding must identify a known requirement, source, owner, observation and verification.');
-    return { id: item.id, requirementId: row.id, source: text(item.source), owner: item.owner, gap: text(item.gap, 1000), verification: text(item.verification), reopenReason: text(item.reopenReason), ...(item.observation && ['observer', 'capability'].includes(item.owner) ? { observation: { type: text(item.observation.type, 40), ...(item.observation.url ? { url: text(item.observation.url, 2000) } : {}), ...(item.observation.path ? { path: text(item.observation.path, 500) } : {}), ...(Array.isArray(item.observation.fields) ? { fields: item.observation.fields.slice(0, 5).map(field => text(field, 201)) } : {}) } } : {}), status: 'open' };
+    return { id: item.id, requirementId: row.id, source: text(item.source), owner: item.owner, gap: text(item.gap, 1000), verification: text(item.verification), reopenReason: text(item.reopenReason), reopenEvidenceRefs: Array.isArray(item.reopenEvidenceRefs) ? item.reopenEvidenceRefs.slice(0, 8).map(row => ({ target: text(row.target, 2000), digest: text(row.digest, 64), scope: row.scope })) : [], ...(item.observation && ['observer', 'capability'].includes(item.owner) ? { observation: { type: text(item.observation.type, 40), ...(item.observation.url ? { url: text(item.observation.url, 2000) } : {}), ...(item.observation.path ? { path: text(item.observation.path, 500) } : {}), ...(Array.isArray(item.observation.fields) ? { fields: item.observation.fields.slice(0, 5).map(field => text(field, 201)) } : {}) } } : {}), status: 'open' };
   });
 }
 
@@ -129,11 +129,19 @@ export function reconcileFindings(managed, review, now) {
     const prior = ledger.findings.find(row => row.id === resolution.id);
     if (!prior || !['resolved', 'refuted'].includes(resolution.status) || !text(resolution.evidence)) throw new Error('Finding resolution needs a known ID and independent evidence.');
     if (findings.some(row => row.id === resolution.id)) throw new Error('A finding cannot be open and resolved.');
-    Object.assign(prior, { status: resolution.status, evidence: text(resolution.evidence, 1000), checkedAt: now, workspaceDigest: review.workspaceDigest });
+    const boundReads = (resolution.evidenceRefs || []).filter(link => /^[a-f0-9]{64}$/.test(link.digest) && (review.capturedReads || []).some(row => row.target === link.target && row.digest === link.digest && row.scope === link.scope));
+    if (!boundReads.length) throw new Error('Finding resolution needs current captured finding-specific evidence references.');
+    Object.assign(prior, { status: resolution.status, evidence: text(resolution.evidence, 1000), checkedAt: now, workspaceDigest: review.workspaceDigest, closedReads: boundReads.map(row => ({ target: row.target, digest: row.digest, scope: row.scope })) });
   }
   for (const finding of findings) {
     const prior = ledger.findings.find(row => row.id === finding.id);
-    if (prior && prior.status !== 'open' && !finding.reopenReason) throw new Error('Reopening a closed finding needs new counterevidence or a changed dependency.');
+    if (prior && prior.status !== 'open') {
+      const currentReads = review.capturedReads || [];
+      const newBoundEvidence = finding.reopenEvidenceRefs.some(link => /^[a-f0-9]{64}$/.test(link.digest) &&
+        currentReads.some(row => row.target === link.target && row.digest === link.digest && row.scope === link.scope) &&
+        (prior.closedReads || []).some(row => row.target === link.target && row.scope === link.scope && row.digest !== link.digest));
+      if (!finding.reopenReason || !newBoundEvidence) throw new Error('Reopening a closed finding needs new independently observed counterevidence linked to the finding, not a paraphrased reason or missing observation.');
+    }
     if (prior) Object.assign(prior, finding, { checkedAt: now, workspaceDigest: review.workspaceDigest });
     else ledger.findings.push({ ...finding, checkedAt: now, workspaceDigest: review.workspaceDigest });
   }

package/src/codex-plugins/simy/hooks/purpose-rule-review.mjs

@@ -49,15 +49,22 @@ export function assessRuleReview(review, managed) {
     source: 'Independent canonical rule assessment', owner, gap: `Resolve applicable failed/unverified controls: ${values.slice(0, 25).join(', ')}`,
     verification: owner === 'worker' ? 'Repair the observed result and independently recheck.' : 'Acquire missing independent evidence or repair the owning observation/controller capability; do not require worker-authored proof.', status: 'open' });
   const complete = !missing.length && !unknown && !unresolved.length;
-  const resolutions = [...(review.resolutions || [])].filter(row => !/^independent-rule-(?:coverage|obligations(?:-[a-z]+)?)$/.test(row.id));
+  const resolutions = [...(review.resolutions || [])];
   const generatedIds = new Set(['independent-rule-coverage', 'independent-rule-obligations',
     ...(managed.purpose.evidence?.findings || []).filter(row => /^independent-rule-obligations-[a-z]+$/.test(row.id)).map(row => row.id),
     ...findings.filter(row => /^independent-rule-obligations-[a-z]+$/.test(row.id)).map(row => row.id)]);
   for (const id of generatedIds) {
     const current = findings.find(item => item.id === id);
     const prior = managed.purpose.evidence?.findings?.find(item => item.id === id);
-    if (!current && !missing.length && prior?.status === 'open') resolutions.push({ id, status: 'resolved', evidence: 'Current independent assessment covers this obligation with no remaining gap.' });
-    if (current && prior && prior.status !== 'open') current.reopenReason = 'Current independent rule assessment no longer supports the prior resolution.';
+    if (!current && !missing.length && prior?.status === 'open' && !resolutions.some(row => row.id === id)) {
+      const resolution = { id, status: 'resolved', evidence: 'Current independent assessment covers this obligation with no remaining gap.', evidenceRefs: (review.capturedReads || []).filter(read => rules.filter(rule => rule.id === prior.requirementId?.replace(/^rule:/, '')).some(rule => rule.evidenceRefs.some(link => link.target === read.target && (link.ref === read.ref || link.ref === `read:${read.target}` && (review.capturedReads || []).filter(row => row.target === read.target).length === 1)))) };
+      if (resolution.evidenceRefs.length) resolutions.push(resolution);
+      else review = { ...review, passed: false, needsHuman: false, controllerEvidenceFailure: { code: 'generated_resolution_evidence_missing', targets: [`resolution:${id}`], instruction: 'Independently acquire finding-specific primary evidence for the prior rule applicability gap before resolving it. A not_applicable label alone cannot close an existing finding.' } };
+    }
+    if (current && prior && prior.status !== 'open') {
+      current.reopenReason = 'Current independent rule assessment no longer supports the prior resolution.';
+      current.reopenEvidenceRefs = (review.findings || []).find(row => row.id === id)?.reopenEvidenceRefs || [];
+    }
   }
   return { ...review, rules, findings, resolutions, passed: review.passed && complete, needsHuman: review.needsHuman && complete,
     ruleCoverage: { total: inventory.length, mode: selective ? 'applicable' : 'full', unevaluated: inventory.length - rules.length, assessed: ids.length - missing.length, missing: missing.length, unresolved: unresolved.length, unknownIds: unknown,

package/src/codex-plugins/simy/skills/delivery-loop/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: delivery-loop
-description: Continue an explicitly requested SIMY Delivery Loop in the current provider conversation using user-reviewed hooks, bounded checkpoints, and human blocker handling.
+description: Continue an explicitly requested SIMY Delivery Loop with bounded checkpoints, evidence-based autonomous recovery, and preserved native permissions and user stops.
 ---
 
 # SIMY Delivery Loop
@@ -39,7 +39,7 @@ For missing information use `blocker: "missing_information"`. For a failed attem
 For completed work use `{"status":"completed","summary":"Actual result","acceptanceMet":true,"evidence":["Exact checks and observed results"]}` only after checking the user's acceptance criteria. For standard tracking this ends as `reported_done`, never verified `completed`. In managed tracking SIMY independently checks frozen file predicates or waits for explicit user verification of manual criteria. Evidence is a report, not independent certification: preserve failed checks and deployment gaps. The hook must not infer success from optimistic closing text.
 
 4. The Stop hook evaluates checkpoints and supplies the next instruction within the original scope while progress is verified. Missing checkpoints count toward the repeated-failure circuit. A human interrupt stops the loop. Approval/input events block it. Provider errors/exits may require reopening the existing conversation; these hooks cannot restart a dead provider process.
-5. Once a blocker is resolved with current evidence, continue already-authorized work without an additional continuation request. AI handles reversible decisions by investigating, selecting and verifying a suitable option; use LLM judgment first and HC-01–HC-102 as critique lenses. A matching irreversible-operation approval or necessary answer is sufficient to continue that operation. User-directed pause/stop requires an explicit resume; actual provider permissions, rejected actions and budgets remain authoritative. For manual recovery, `simy delivery resume --provider <provider> --session <id>` retains usage, failure and progress history; local time, turn and token counters do not stop work. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.
+5. Once a blocker is resolved with current evidence, continue already-authorized work without an additional continuation request. AI handles reversible decisions by investigating, selecting and verifying a suitable option; use LLM judgment first and HC-01–HC-102 as critique lenses. A matching irreversible-operation approval or necessary answer is sufficient to continue that operation. User-directed pause/stop requires an explicit resume; actual provider permissions, rejected actions and budgets remain authoritative. `simy delivery resume --provider <provider> --session <id>` retains task identity, usage, failure and progress history and does not reset existing hard time, turn or token budgets. A budget boundary is not a request for human judgment about an ordinary implementation choice. `simy delivery stop` permanently ends this loop. `simy delivery status` shows observed hook activity and loop states; old observations do not prove hooks remain enabled today.
 
 If the user selected **Continue this conversation** in SIMY desktop, the exact session already has a managed task. Do not run `delivery start` or ask the user to restate its goal. Follow the Stop hook's distinct `session_understanding` contract first: inspect only the original conversation context, report the original user goal and grounded progress, and submit the JSON checkpoint via `--file -`. Do not execute the next assessed work action during understanding. If context is materially unclear, report one focused question and wait for a matching `session_answer`; generic Resume is insufficient. A model-reported finished goal without an independent check is shown as `reported_done`, not verified `completed`.
 

package/src/delivery-hooks/checkpoint-diagnostic.js

@@ -0,0 +1,157 @@
+// Only fixed controller schema messages may be sent back to an AI worker.
+// Provider bodies, user text and arbitrary exception messages remain private.
+const known = new Set([
+  "A concrete nextStep is required.",
+  "A finding cannot be open and resolved.",
+  "A provider and exact session ID are required.",
+  "A structured session understanding is required.",
+  "Acceptance file must be relative to the task directory.",
+  "Already-finished understanding must have no remaining action.",
+  "An assessed plan needs a diagnosis and one to five alternatives.",
+  "An outcome already satisfied without changes permits only read-only verification.",
+  "Answer the current session question before resuming.",
+  "Association job changed; checkpoint discarded.",
+  "Association lease changed; checkpoint discarded.",
+  "Authorization blocker requires a scoped approval request.",
+  "Authorization request must match the selected assessed option.",
+  "Authorization request requires the proposed nextStep.",
+  "Automatic continuation requires the original verified provider channel.",
+  "Automatic continuation was disabled before enrollment.",
+  "Checkpoint needs an actionResult bound to the selected decision.",
+  "Checkpoint status must be in_progress, completed, blocked, or error.",
+  "Checkpoint summary is required.",
+  "Claude live hook changed before enrollment; refresh the session.",
+  "Clear understanding needs an objective, remaining work, and an unambiguous next action.",
+  "Clear understanding requires an observed read result.",
+  "Completion requires acceptanceMet and concrete verification evidence.",
+  "Confirm the exact external dependency condition before resuming.",
+  "Delivery Loop not found.",
+  "Delivery level needs the user selection reference, requested/effective levels 1-5, and assurance-ascending-v2 numbering.",
+  "Delivery state exceeds 256 KiB; reduce task details.",
+  "Delivery state is busy; retry the command.",
+  "Delivery state lock owner is unavailable; inspect the lock before retrying.",
+  "Delivery state reclaim lock requires inspection.",
+  "Dependency wait changed or confirmation is empty; refresh its status.",
+  "Duplicate acceptance criterion ID.",
+  "Duplicate plan option ID.",
+  "Each acceptance criterion needs a description.",
+  "Empty purpose observation.",
+  "Every purpose rule needs one disposition.",
+  "Exact session changed before automatic continuation.",
+  "External dependency needs waitCondition {condition, owner, nextCheck} and a nextStep.",
+  "Finding ledger capacity reached; reconcile existing finding IDs.",
+  "Finding resolution needs a known ID and independent evidence.",
+  "Finding resolution needs current captured finding-specific evidence references.",
+  "Hook input too large.",
+  "Independent review lease changed.",
+  "Independent review left unresolved findings.",
+  "Independent review provenance is missing.",
+  "Inferred file check needs a relative task path.",
+  "Inferred file check needs expected text.",
+  "Inferred file_equals needs bounded exact UTF-8 text.",
+  "Inferred session goal needs a user-message basis.",
+  "Initial action must be the selected assessed option.",
+  "Invalid acceptance criterion ID.",
+  "Invalid actionDueAt timestamp.",
+  "Invalid approval policy.",
+  "Invalid autoRecoverySandbox.",
+  "Invalid autonomy policy.",
+  "Invalid delivery budget.",
+  "Invalid managed task specification.",
+  "Invalid plan option ID.",
+  "Invalid purpose rule receipt.",
+  "Invalid requirement updates.",
+  "Invalid resumeModel.",
+  "Invalid work unit metadata.",
+  "Loop is stopped or awaiting a human resume.",
+  "Managed continuation requires a concrete proposedAction with kind, scope, and summary.",
+  "Managed recovery lease changed; checkpoint discarded.",
+  "Managed task identity changed; refresh its status.",
+  "Managed task is not awaiting acceptance verification.",
+  "Managed task is paused or awaiting acceptance verification.",
+  "Managed tasks require acceptanceCriteria.",
+  "Missing information blocker needs a specific user question.",
+  "No active session understanding turn.",
+  "No matching active Delivery Loop.",
+  "No matching verified provider session observed here. Select an exact discovered session or explicitly bind its task execution directory.",
+  "Objective and concrete next step are required.",
+  "Observed action result needs concrete evidence.",
+  "Only a blocked, paused, or recoverable loop can resume.",
+  "Only a nonterminal assessed managed task can change autonomy policy.",
+  "Only a running or queued managed task can pause.",
+  "Only manual criteria can be verified by the user.",
+  "Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.",
+  "Original budget exhausted; automatic continuation cannot reset it.",
+  "Pause a managed task before changing its continuation policy.",
+  "Pause the task and supply an explicit user purpose revision with sourceRef, objective and acceptanceCriteria.",
+  "Pending approval changed; refresh its status.",
+  "Plan recommendation must identify an assessed option and reason.",
+  "Progress continuation requires frozen managed acceptance criteria.",
+  "Proposed action differs from selected assessed option.",
+  "Provider token budgets require the host-observed Codex app-server channel.",
+  "Purpose continuation is not enabled.",
+  "Purpose priorities are required.",
+  "Purpose priorities must rank every option and select the highest priority.",
+  "Purpose review is required.",
+  "Purpose review needs an explicit no-change assessment.",
+  "Purpose review needs bounded observations.",
+  "Purpose revision history requires archival before another revision.",
+  "Read-only recovery diagnosis needs human review.",
+  "Read-only understanding cannot be dispatched under current policy.",
+  "Recovery diagnosis needs an enrolled task scope.",
+  "Reopening a closed finding needs new independently observed counterevidence linked to the finding, not a paraphrased reason or missing observation.",
+  "Replanning needs a supported original-session channel, a rejected assessed approval or safe research wait, and available budget.",
+  "Replanning needs an enrolled task scope.",
+  "Required unit resolution needs independent criterion-linked evidence.",
+  "Requirement update must reference an enrolled criterion or canonical rule.",
+  "Requirement updates need source ID, observation, owner and reason.",
+  "Research replanning requires the original verified live hook owner.",
+  "Resolve the exact pending approval before resuming.",
+  "Restore the original provider conversation before changing Delivery Loop.",
+  "Restore the original provider conversation before starting Delivery Loop.",
+  "Retained candidates require explicit archival before another purpose revision.",
+  "Review finding must identify a known requirement, source, owner, observation and verification.",
+  "Safe read diagnosis is unavailable; keep the waiting action blocked.",
+  "Select an explicit continuation policy.",
+  "Selected action must match an assessed option.",
+  "Selected action requires a fresh scoped user decision.",
+  "Session question changed or answer is empty; refresh its status.",
+  "Session understanding deadline expired.",
+  "Session understanding has too many items.",
+  "Session understanding lease changed; checkpoint discarded.",
+  "Session understanding needs its separate structured checkpoint.",
+  "Session understanding requires an assessed read-only initial action.",
+  "Specify authorization, missing_information, or external_dependency.",
+  "State exceeds limit.",
+  "Task execution directory must be a directory.",
+  "Task handoff is locked; continue in the received target session.",
+  "Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.",
+  "This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.",
+  "This task cannot change supervision while completed, executing, or handed off.",
+  "Unclear understanding needs one focused question.",
+  "Understanding basis needs a reference or excerpt.",
+  "Understanding basis needs a source.",
+  "Understanding checkpoint needs a summary.",
+  "Understanding criterion needs a description and provenance.",
+  "Understanding needs bounded context evidence.",
+  "Understanding result must match the selected read decision.",
+  "Understood next action differs from selected assessed option.",
+  "Unit belongs to an old purpose revision.",
+  "Unsupported acceptance check.",
+  "Unsupported control.",
+  "Unsupported inferred acceptance check.",
+  "Upgrade must preserve the original objective and task directory.",
+  "Upgrade requires read-only reconciliation and frozen acceptance of the original objective.",
+  "User-grounded criterion needs a user-message basis.",
+  "Waiting recovery needs an enrolled scope.",
+  "Work frontier needs reconciliation before more dispatch.",
+  "Work unit references unknown criterion.",
+  "file_contains needs expected text.",
+  "file_equals needs bounded exact UTF-8 text."
+]);
+export function safeCheckpointDiagnostic(error) {
+  const message = error?.message;
+  if (known.has(message)) return message;
+  if (['gap','hypothesis','refutation','necessity'].some(key => message === `Purpose review needs ${key}.`)) return message;
+  return 'Checkpoint did not satisfy the controller schema; reread the supplied checkpoint contract and preserve the same task and action identity.';
+}

package/src/delivery-hooks/command.js

@@ -1,3 +1,4 @@
+import { linkSessionParent } from '../session-supervision/session-lineage.js';
 import { adoptAutonomousPolicy } from '../session-supervision/autonomous-upgrade.js';
 import { deliveryEvidence } from './evidence.js';
 import { readFile } from 'node:fs/promises';
@@ -79,6 +80,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery runtime install|status|workflows — install an immutable local candidate, inspect its version/digest, or refresh existing plugin sources/cache while preserving enabled state and hook trust. Never enables a task.');
     output('simy delivery runtime doctor|desktop-install|desktop-activate|watch — audit live host/state/monitor alignment, or prepare a separate local desktop using the verified fixed runtime. Does not start or resume tasks.');
     output('simy delivery runtime policy-adopt [--task-id ID [--criterion-id ID]] — explicitly delegate decisions within existing permissions. Manual acceptance stays manual unless the user names the exact task and criterion to delegate its verifier.');
+    output('simy delivery link_parent --provider codex|claude --session CHILD --parent-provider codex|claude --parent-session PARENT — record an explicit observed navigation relationship without starting work.');
     output('simy delivery supervise [--once] — service already opted-in tasks with this runtime; refuses an active desktop host.');
     output('simy delivery evidence --provider codex|claude --session ID — read-only execution and acceptance receipts.');
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
@@ -88,11 +90,12 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--execution-cwd PATH] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Standard start tracks checkpoints and reports done without certifying acceptance. Managed start freezes the original objective, optional user-selected deliveryLevel, and acceptance specification. Desktop Continue infers the original conversation goal first. Continue adopts an eligible ordinary loop with the same goal and failure budget; its first managed action reconciles prior work read-only. --execution-cwd explicitly binds the task directory while provider identity retains its original folder. Resume preserves original task identity, history and approvals.');
     return 0;
   }
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session', 'parent-provider', 'parent-session']);
   const options = parseDeliveryOptions(args, allowed);
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
-  if (action === 'evidence') {
+  if (action === 'link_parent') result = await linkSessionParent({ ...base, parentProvider: options['parent-provider'], parentSession: options['parent-session'] });
+  else if (action === 'evidence') {
     const record = await readRecord(root, options.provider, options.session);
     if (!record) throw new Error('Exact provider session record not found.');
     result = deliveryEvidence(record, root);