@awak-app/simy-cli 0.7.11 → 0.7.13

package/src/session-supervision/codex-app-server.js

@@ -1,3 +1,5 @@
+import { captureDispatchProvenance } from '../update-detachment/provenance.js';
+import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, queueDispatchReceipt, rootFromDelivery } from '../update-detachment/dispatch-gate.js';
 import { normalizePullRequests } from './pull-requests.js';
 import { delegatedNativeSandbox, canWriteWorkspace, authorizedWorktreeGitRoots } from './native-delegation.js';
 import { flexibleReasoning } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
@@ -18,7 +20,7 @@ import { createInterface } from 'node:readline';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, relative, sep } from 'node:path';
 import { CODEX_WRITER_LOCK_MINIMUM_VERSION, compareVersions, inspectBackendExecutable } from '../backend-executable.js';
-import { canExecuteAutonomousExternal, assessedCheckpointContract, deliveryProgressContext, taskDirectory, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { hasPendingUserStop, recordPath, rootDirectory, canExecuteAutonomousExternal, assessedCheckpointContract, deliveryProgressContext, taskDirectory, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { boundConversation, boundProviderGoal, textContent } from './conversation-context.js';
 import { JsonDataUrlFilter } from './json-data-url-filter.js';
 import { RECENT_SESSION_LIMIT } from './discovery-window.js';
@@ -625,6 +627,10 @@ async function frozenNativeSandbox(record, root, signal) {
 }
 
 export async function executeCodexAppServer(record, { webOrigin, openClient = openCodexAppServer, signal, authorizePreparation = async () => {}, beforeDispatch = async () => {}, onStarted = async () => {}, onActivity = () => {}, onUsage = () => {}, onEvidence = async () => {}, observeExternal = collectPurposeObservations, root, auditOnly = false, opinionOnly = false, peerAction, runPeerReview = runStructuredProviderReview } = {}) {
+  const dispatchOwner = captureDispatchOwner(root ? rootFromDelivery(root) : undefined);
+  let dispatchAttemptId;
+  const provenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: record.provider, providerSession: record.session, worktree: taskDirectory(record), taskId: record.run.managed.taskId, recordRef: recordPath(root || rootDirectory(), record.provider, record.session) });
+  assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance });
   const run = record.run, decision = run.managed?.decision;
   if(run.managed?.enrollment?.nativeAuthorityDigest && run.managed.enrollment.nativeAuthorityDigest!==createHash('sha256').update(JSON.stringify([run.managed.providerSandbox,run.managed.providerSandboxSource])).digest('hex'))throw new CodexAppServerError('permission_narrowed','Frozen native enrollment authority changed; do not dispatch with the altered ceiling.');
   if (!decision || !run.managed.autonomyPolicy) throw new CodexAppServerError('decision', 'An assessed action is required before Codex dispatch.');
@@ -660,11 +666,16 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
       prompt: peerOpinionPrompt(record, sourceContext, peerAction),
       output_schema: { type: 'object', properties: { opinion: { type: 'string' } }, required: ['opinion'], additionalProperties: false },
     }, { signal, readOnlyAnalysis: true, allowAutomaticRetry: false,
+      dispatchTransport: initiate => dispatchWithFence(dispatchOwner, { taskId: run.managed.taskId || record.session, attemptId: run.managed.resumeLease?.id, provenance }, attemptId => {
+        if (root && hasPendingUserStop(root, record)) throw new CodexAppServerError('cancelled', 'User stopped this provider task.');
+        dispatchAttemptId = attemptId;
+        return initiate();
+      }),
       beforeDispatch: async () => { await authorizePreparation(); await beforeDispatch({ type: 'readOnly', networkAccess: false }); },
       onContext: session => { if (peerSession && peerSession !== session) ambiguousContext = true; peerSession = session; },
       onUsage: observed => { usage = observed; onUsage(observed); } });
     if (!peerSession || peerSession === record.session || ambiguousContext || typeof reply.output?.opinion !== 'string' || !reply.output.opinion.trim()) throw new CodexAppServerError('identity', 'Independent peer context or opinion unavailable.');
-    return { code: 0, opinion: { text: evidenceExcerpt(reply.output.opinion, 2000).text, source: 'independent_codex_session', session: peerSession, model: reply.model }, usage, toolEvidence: [] };
+    return { code: 0, dispatchAttemptId, opinion: { text: evidenceExcerpt(reply.output.opinion, 2000).text, source: 'independent_codex_session', session: peerSession, model: reply.model }, usage, toolEvidence: [] };
   }
   // Connector schemas can exceed ordinary checkpoint limits; keep review pages
   // bounded to one server and a separate finite transport ceiling.
@@ -851,9 +862,10 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
       });
       signal?.addEventListener('abort', cancelled, { once: true });
       client.child.once('close', closed);
-      turnStart = client.request('turn/start', { threadId: targetSession, input: [{ type: 'text', text: `${prompt}\n${purposeInstruction}` }], cwd: isolated ? executionCwd : record.cwd,
-        model: run.managed.resumeModel, ...(isolated ? {sandboxPolicy} : {}) })
-        .then(async response => { turnId = response?.turn?.id; activeTurnId = turnId; if (!turnId) finish(new CodexAppServerError('turn_failed', 'Codex did not start a turn.')); else {
+      const targetProvenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: record.provider, providerSession: targetSession, worktree: isolated ? executionCwd : record.cwd, taskId: run.managed.taskId || record.session, recordRef: recordPath(root || rootDirectory(), record.provider, record.session) });
+      turnStart = dispatchWithFence(dispatchOwner, { taskId: run.managed.taskId || record.session, attemptId: run.managed.resumeLease?.id, provenance: targetProvenance }, attemptId => { assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance }); if (root && hasPendingUserStop(root, record)) throw new CodexAppServerError('cancelled', 'User stopped this provider task.'); dispatchAttemptId = attemptId; return client.request('turn/start', { threadId: targetSession, input: [{ type: 'text', text: `${prompt}\n${purposeInstruction}` }], cwd: isolated ? executionCwd : record.cwd,
+        model: run.managed.resumeModel, ...(isolated ? {sandboxPolicy} : {}) }); })
+        .then(async response => { turnId = response?.turn?.id; activeTurnId = turnId; if (turnId) queueDispatchReceipt({ root: dispatchOwner.root, attemptId: dispatchAttemptId, receiptId: `provider:${dispatchAttemptId}:${turnId}`, providerExecutionId: turnId }); if (!turnId) finish(new CodexAppServerError('turn_failed', 'Codex did not start a turn.')); else {
           startReceipt = Promise.resolve().then(() => onStarted({ turnId, session: targetSession }));
           await startReceipt;
           startRecorded = true;
@@ -908,14 +920,14 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
         review.findings.push(criterion ? { id: 'workspace-audit-binding', requirementId: `criterion:${criterion.id}`, source: 'controller_workspace_inventory', owner: 'controller', gap, verification: 'Establish the correct authorized workspace scope and independently bind its actual artifacts before acceptance.', reopenReason: 'The current workspace identity is unavailable or its scope changed.' } : gap);
       }
       review = assessIndependentInspection(review, { toolEvidence, observations: reviewObservations, criteria: effectiveAcceptanceCriteria(run.managed), flexible: flexibleReasoning(run.managed) });
-      return { code: 0, verification: { ...review, source: 'independent_codex_session', session: targetSession, workspaceDigest: boundAfter }, usage, toolEvidence };
+      return { code: 0, dispatchAttemptId, verification: { ...review, source: 'independent_codex_session', session: targetSession, workspaceDigest: boundAfter }, usage, toolEvidence };
     }
     const currentEvidence = beforeEvidence ? await captureWorkspace() : null;
     const controllerEvidence = beforeEvidence ? { source: 'adapter_capture', actionId: decision.id,
       baseline: run.managed.purpose.evidence?.baseline ? undefined : { ...beforeEvidence, kind: 'first_managed_observation', continuation: run.continuations },
       current: currentEvidence, before: beforeEvidence.digest, after: currentEvidence?.digest, receipts: toolEvidence } : undefined;
-    if (!run.managed.purpose?.enabled) return { code: 0, checkpoint };
-    return { code: 0, checkpoint, usage, providerTurnId: activeTurnId, providerSessionId:targetSession, toolEvidence, sourceContext, controllerEvidence };
+    if (!run.managed.purpose?.enabled) return { code: 0, dispatchAttemptId, checkpoint };
+    return { code: 0, dispatchAttemptId, checkpoint, usage, providerTurnId: activeTurnId, providerSessionId:targetSession, toolEvidence, sourceContext, controllerEvidence };
   } catch (error) {
     if (activeTurnId) error.providerTurnId ||= activeTurnId;
     if(targetSession!==record.session)error.providerSessionId ||=targetSession;

package/src/sqm/claude-plugin.js

@@ -45,11 +45,16 @@ export async function claudePluginFiles() {
   files.set("hooks/acceptance-policy.mjs", await readFile(path.join(SOURCE, "hooks/acceptance-policy.mjs"), "utf8"));
   files.set("hooks/purpose-rule-review.mjs", await readFile(path.join(SOURCE, "hooks/purpose-rule-review.mjs"), "utf8"));
   files.set("hooks/workspace-lease.mjs", await readFile(path.join(SOURCE, "hooks/workspace-lease.mjs"), "utf8"));
+  for (const name of ["update-state-store.mjs", "update-dispatch-gate.mjs", "update-dispatch-identity.mjs"]) files.set(`hooks/${name}`, await readFile(path.join(SOURCE, "hooks", name), "utf8"));
   files.set("hooks/connection-reminder.mjs", await readFile(path.join(SOURCE, "hooks/connection-reminder.mjs"), "utf8"));
   files.set("hooks/dev-work.mjs", await readFile(path.join(SOURCE, "hooks/dev-work.mjs"), "utf8"));
   const hooks = JSON.parse(await readFile(path.join(SOURCE, "hooks/hooks.json"), "utf8"));
   delete hooks.hooks.Interrupt; // Codex-only event; Claude interruptions cannot be vetoed.
   hooks.hooks.StopFailure = structuredClone(hooks.hooks.Stop);
+  // Observe policy/model invalidation without emitting continuation decisions.
+  // Supported by the pinned 2.1.201 CLI. PostModelSwitch is rejected by its
+  // manifest validator; Stop observations therefore cannot retain an old model.
+  hooks.hooks.ConfigChange = structuredClone(hooks.hooks.SessionStart);
   hooks.hooks.Notification = structuredClone(hooks.hooks.PermissionRequest);
   for (const [event, groups] of Object.entries(hooks.hooks)) {
     for (const group of groups) {

package/src/sqm/review-worker.js

@@ -431,6 +431,7 @@ async function runSingleProviderReview(
   request,
   {
     spawnImpl = spawn,
+    dispatchTransport = initiate => initiate(),
     inspectExecutor = inspectDesktopExecutor,
     executionTimeoutMs = DEFAULT_EXECUTION_TIMEOUT_MS,
     environment = process.env,
@@ -463,6 +464,10 @@ async function runSingleProviderReview(
   const workDir = await mkdtemp(join(tmpdir(), "simy-sqm-review-"));
   const schemaPath = join(workDir, "output-schema.json");
   const outputPath = join(workDir, "output.json");
+  let transportFailure;
+  const fencedTransport = initiate => {
+    try { return dispatchTransport(initiate); } catch (error) { transportFailure = error; throw error; }
+  };
   try {
     await writeFile(schemaPath, JSON.stringify(request.output_schema), { mode: 0o600 });
     const prompt = [
@@ -512,7 +517,7 @@ async function runSingleProviderReview(
             "-",
           ],
           prompt,
-          { spawnImpl, executionTimeoutMs: remaining, stallTimeoutMs: provider === "codex" && readOnlyAnalysis && allowAutomaticRetry && !stallRetried && remaining > codexAttemptTimeoutMs ? codexAttemptTimeoutMs : null, label, cwd: workDir, environment, provider, signal, readOnlyAnalysis, model, retryAttempt,
+          { spawnImpl, dispatchTransport: fencedTransport, executionTimeoutMs: remaining, stallTimeoutMs: provider === "codex" && readOnlyAnalysis && allowAutomaticRetry && !stallRetried && remaining > codexAttemptTimeoutMs ? codexAttemptTimeoutMs : null, label, cwd: workDir, environment, provider, signal, readOnlyAnalysis, model, retryAttempt,
             terminationGraceMs: Number.isInteger(terminationGraceMs) ? Math.max(1, Math.min(terminationGraceMs, 5_000)) : 1_000, onUsage, onContext },
         );
         selectedModel = model;
@@ -563,7 +568,7 @@ async function runSingleProviderReview(
       ...(processResult.diagnostic.retryAttempt === 1 ? { retryAttempt: 1 } : {}),
     };
   } catch (error) {
-    if (error instanceof SqmLocalReviewError || error?.code === 'desktop_access_required' || ['subscription_auth_required', 'subscription_auth_unknown'].includes(error?.code)) throw error;
+    if (error === transportFailure || error instanceof SqmLocalReviewError || error?.code === 'desktop_access_required' || ['subscription_auth_required', 'subscription_auth_unknown'].includes(error?.code)) throw error;
     throw new SqmLocalReviewError(`Local ${label} review failed before producing a structured result.`, {
       code: `${provider}_local_review_failed`,
     });
@@ -585,15 +590,19 @@ function codexAnalysisArguments(system) {
     '-c', `developer_instructions=${JSON.stringify(system)}`];
 }
 
-function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, stallTimeoutMs, cwd, environment, provider, signal, readOnlyAnalysis, terminationGraceMs, model, retryAttempt, onUsage, onContext }) {
+function spawnReview(command, args, prompt, { spawnImpl, dispatchTransport, executionTimeoutMs, stallTimeoutMs, cwd, environment, provider, signal, readOnlyAnalysis, terminationGraceMs, model, retryAttempt, onUsage, onContext }) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) return reject(providerFailure("analysis_cancelled"));
     let child;
     try {
-      child = spawnImpl(command, args, {
-        env: safeReviewEnvironment(environment, provider), cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
+      child = dispatchTransport(() => {
+        try {
+          return spawnImpl(command, args, {
+            env: safeReviewEnvironment(environment, provider), cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
+          });
+        } catch { throw providerFailure("provider_spawn_failed", { model }); }
       });
-    } catch { reject(providerFailure("provider_spawn_failed", { model })); return; }
+    } catch (error) { reject(error); return; }
     let stdout = "", stderrPending = "", outputBytes = 0, phase = "before_turn";
     let settled = false, terminalError = null, killTimer = null;
     let reportedTokens = -1, reportedContext = null;

package/src/update-detachment/claude-observation.js

@@ -0,0 +1,33 @@
+import { realpath } from 'node:fs/promises';
+import { readClaudeSession, readClaudeBoundary } from '../session-supervision/claude-sessions.js';
+import { processIdentity } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { digest } from './state-store.js';
+
+const fail = code => { throw Object.assign(new Error(`Update connection: ${code}`), { code }); };
+
+// This permits observation only. Unknown policy stays unknown, and callers must
+// install a durable session/task dispatch fence before releasing the root gate.
+export async function observeClaudeReadOnly(record, { inspectProcess = processIdentity,
+  readMetadata = readClaudeSession, readConversation = null, readBoundary = readClaudeBoundary } = {}) {
+  const owner = record.run?.managed?.liveHookOwner || record.process;
+  const hook = record.hookSessionProcess, runtime = record.runtime, boundary = record.updateObservation;
+  if (!owner?.identity || !record.hookStartedAt || record.hookEndedAt ||
+      hook?.pid !== owner.pid || hook.identity !== owner.identity || await inspectProcess(owner.pid) !== owner.identity)
+    fail('original_claude_owner_unavailable');
+  if (runtime?.process?.pid !== owner.pid || runtime.process.identity !== owner.identity || typeof runtime.isRunning !== 'boolean')
+    fail('claude_turn_boundary_unobserved');
+  if (runtime.isRunning) fail('claude_turn_running');
+  if (boundary?.process?.pid !== owner.pid || boundary.process.identity !== owner.identity || boundary.source !== 'Stop' ||
+      boundary.observedAt !== runtime.observedAt || boundary.observedAt < record.hookStartedAt || boundary.backgroundIdle !== true)
+    fail('claude_background_boundary_unobserved');
+  const metadata = await readMetadata(record.session);
+  if (metadata?.session !== record.session || await realpath(metadata.cwd) !== await realpath(record.cwd)) fail('provider_identity_changed');
+  const context = readConversation ? await readConversation(metadata) : await readBoundary(metadata);
+  if (readConversation ? !context || context.incomplete !== false || context.truncated !== false || !Array.isArray(context.messages) : !context || context.complete !== true || !/^[a-f0-9]{64}$/.test(context.digest)) fail('claude_history_coverage_unknown');
+  if (await inspectProcess(owner.pid) !== owner.identity) fail('original_claude_owner_unavailable');
+  return { identity: { session: metadata.session, worktree: await realpath(metadata.cwd) }, model: boundary.model || null,
+    permissions: null, permissionMode: boundary.permissionMode || null, canResume: false, readOnlyReconnect: true,
+    cursor: digest([context, metadata.lastActivityAt, boundary]), historyCoverage: true, running: false,
+    writer: { id: owner.identity, verified: false, state: 'idle', source: 'read_only_live_hook', acquisitionRequired: true },
+    liveHook: { pid: owner.pid, identity: owner.identity, startedAt: record.hookStartedAt, verified: true, source: 'original_live_hook' } };
+}

package/src/update-detachment/codex-context.js

@@ -0,0 +1,27 @@
+import { open, realpath } from 'node:fs/promises';
+import { resolve, relative, join } from 'node:path';
+import { homedir } from 'node:os';
+import { digest } from './state-store.js';
+
+// Read only session metadata and the newest turn_context. Never read auth.json,
+// copy prompts/tool output, write provider configuration or acquire a writer.
+export async function readCodexPolicyContext(file, session, worktree, { codexHome = process.env.CODEX_HOME || join(homedir(),'.codex') } = {}) {
+  if(typeof file!=='string')throw new Error('Codex rollout reference unavailable.');
+  const [base,target]=await Promise.all([realpath(codexHome),realpath(file)]);
+  const rel=relative(base,target); if(rel.startsWith('..') || resolve(base,rel)!==target || !/^(sessions|archived_sessions)[/\\]/.test(rel))throw new Error('Codex rollout outside existing account.');
+  const handle=await open(target,'r');
+  try {
+    const before=await handle.stat(); const head=Buffer.alloc(Math.min(32768,before.size));
+    await handle.read(head,0,head.length,0);
+    const size=Math.min(2*1024*1024,before.size), tail=Buffer.alloc(size);
+    await handle.read(tail,0,size,before.size-size);
+    const parse=line=>{try{return JSON.parse(line);}catch{return null;}};
+    const meta=head.toString().split('\n').map(parse).find(item=>item?.type==='session_meta');
+    const contexts=tail.toString().split('\n').map(parse).filter(item=>item?.type==='turn_context');
+    const context=contexts.at(-1)?.payload;
+    const after=await handle.stat();
+    if(before.size!==after.size || before.mtimeMs!==after.mtimeMs || meta?.payload?.id!==session || !context?.model ||
+      !context.sandbox_policy || context.approval_policy===undefined || await realpath(context.cwd)!==await realpath(worktree))throw new Error('Codex turn context is incomplete or changed.');
+    return {model:context.model,permissions:digest([context.sandbox_policy,context.approval_policy]),revision:digest(context)};
+  } finally {await handle.close();}
+}

package/src/update-detachment/coordinator.js

@@ -0,0 +1,117 @@
+// PR3 owns sequencing only. Persistence/fencing and provider identity checks are
+// supplied by PR1/PR2; absence of either must never become permission to update.
+export function createUpdateCoordinator({ store, gate, boundary, reconcile, now = Date.now,
+  preserveConnectedOnStartup = false, initialState = 'connected', onChange = () => {}, pollMs = 50, timeoutMs = 30_000, sleep = ms => new Promise(resolve => setTimeout(resolve, ms)) } = {}) {
+  let state = initialState, phase = 'unavailable', operation = null, cancelled = false;
+  const available = Boolean(store?.read && store?.write && gate?.close && gate?.open && boundary && reconcile);
+  const snapshot = () => ({ state, phase, available, busy: Boolean(operation),
+    canCancel: state === 'detaching', canReconnect: !operation && ['detached', 'recovery_required'].includes(state) });
+  const save = async (next, nextPhase, extra = {}) => {
+    // Await the durable commit before advertising or acting on a transition.
+    await store.write({ connectionState: next, phase: nextPhase, ...extra });
+    state = next; phase = nextPhase; onChange();
+  };
+  const requireAvailable = () => {
+    if (!available) throw Object.assign(new Error('Update detachment dependencies are unavailable.'), { code: 'detachment_unavailable' });
+  };
+  const exclusive = fn => {
+    if (operation) return Promise.reject(new Error('An update connection operation is already in progress.'));
+    operation = Promise.resolve().then(fn).finally(() => { operation = null; });
+    return operation;
+  };
+  const recover = async reason => {
+    state = 'recovery_required'; phase = reason;
+    await gate.close();
+    await save(state, phase);
+  };
+  const reconcileConnection = async () => {
+    await save('reconciling', 'identity_check');
+    const result = await reconcile(await store.read());
+    if (result?.verified !== true || result?.unresolvedAttempts !== 0) {
+      await recover('reconciliation_required');
+      return snapshot();
+    }
+    await save('ready', 'reconciled');
+    // Gate owns per-task eligibility: ready is not permission to resume a
+    // paused/blocked/waiting-human task, reset budgets, or replay an attempt.
+    await gate.open({ resumeTasks: false });
+    await save('connected', 'complete');
+    return snapshot();
+  };
+  return {
+    snapshot,
+    acceptsNewWork: () => state === 'connected',
+    async initialize() {
+      if (!available) return snapshot();
+      if (operation) throw new Error('An update connection operation is already in progress.');
+      // Fence admission synchronously and reserve the operation before reading
+      // disk: startup participates in the same exclusion as detach/reconnect.
+      state = 'reconciling'; phase = 'startup';
+      return exclusive(async () => {
+        try {
+          const record = await store.read();
+          if (preserveConnectedOnStartup && record?.connectionState === 'connected') { state = 'connected'; phase = 'complete'; return snapshot(); }
+          await gate.close();
+          // Missing state may mean a process died before its first checkpoint.
+          state = record?.connectionState || 'recovery_required';
+          phase = record?.phase || 'startup';
+          if (state !== 'connected') { await recover('interrupted_update'); return snapshot(); }
+          return await reconcileConnection();
+        } catch (error) { await recover('startup_failed'); throw error; }
+      });
+    },
+    async detachUpdate(update) {
+      requireAvailable();
+      if (state !== 'connected') return Promise.reject(new Error('Reconnect the original conversation before updating.'));
+      if (operation) throw new Error('An update connection operation is already in progress.');
+      // Synchronous local admission closure precedes the first asynchronous IO.
+      state = 'detaching'; phase = 'closing_admission'; cancelled = false;
+      return exclusive(async () => {
+        try {
+          await gate.close();
+          await save('detaching', 'draining');
+          const deadline = now() + timeoutMs;
+          while (true) {
+            const remaining = deadline - now();
+            if (remaining <= 0) throw new Error('Safe update boundary timed out.');
+            let timeout;
+            const proof = await Promise.race([
+              Promise.resolve().then(boundary),
+              new Promise((_, reject) => { timeout = setTimeout(() => reject(new Error('Safe update boundary timed out.')), remaining); }),
+            ]).finally(() => clearTimeout(timeout));
+            if (cancelled) { await recover('cancelled'); return snapshot(); }
+            if (now() >= deadline) throw new Error('Safe update boundary timed out.');
+            if (proof?.safe === true && proof.pendingWrites === 0 && proof.unsettledPermissions === 0 &&
+                (proof.liveExecutions === 0 || proof.workerHandoffVerified === true)) break;
+            await sleep(pollMs);
+          }
+          await save('detached', 'checkpoint_committed');
+          if (cancelled) { await recover('cancelled'); return snapshot(); }
+          // The updater returns only after installation and candidate health
+          // verification; it owns rollback. An ambiguous outcome stays fenced.
+          await save('detached', 'updating');
+          const result = await update();
+          if (result?.connectionTransferred === true && result?.healthy === true) { state = 'connected'; phase = 'complete'; return snapshot(); }
+          if (result?.healthy !== true) throw new Error('Updated runtime health was not verified.');
+          return await reconcileConnection();
+        } catch (error) {
+          try { await recover('update_failed'); } catch { error.recoveryFailed = true; }
+          throw error;
+        }
+      });
+    },
+    async reconnect() {
+      requireAvailable();
+      if (operation) throw new Error('An update connection operation is already in progress.');
+      state = 'reconciling'; phase = 'closing_admission';
+      return exclusive(async () => {
+      try { await gate.close(); return await reconcileConnection(); }
+      catch (error) { await recover('reconnect_failed'); throw error; }
+    }); },
+    cancel() {
+      if (state !== 'detaching') throw new Error('Cancellation is only available before detachment.');
+      cancelled = true;
+      return snapshot();
+    },
+  };
+}

package/src/update-detachment/dispatch-gate.js

@@ -0,0 +1 @@
+export * from '../codex-plugins/simy/hooks/update-dispatch-gate.mjs';

package/src/update-detachment/ledger-adapter.js

@@ -0,0 +1,62 @@
+import { join } from 'node:path';
+import { acquireLock } from './state-store.js';
+import { detachmentRoot, readDispatchGate, transitionConnection, prepareUpgradeFence, DISPATCH_PROTOCOL, readTaskAdmission, setTaskAdmissionFence } from './dispatch-gate.js';
+
+// Adapt the published PR1 root barrier without creating a competing ledger.
+// Identity/result verification and safe-boundary proof are mandatory PR2/host
+// dependencies; this module never fabricates either from a task status label.
+export function createLedgerCoordinatorAdapters({ root = detachmentRoot(), boundary, reconcile, readWriters } = {}) {
+  let releaseOwner = null;
+  const release = () => { releaseOwner?.(); releaseOwner = null; };
+  const transition = connection => {
+    const current = readDispatchGate(root);
+    if (current.connection !== connection) transitionConnection({ root, expectedRevision: current.revision, connection });
+  };
+  const recovery = () => {
+    const current = readDispatchGate(root).connection;
+    if (current === 'recovery_required') return;
+    if (['connected', 'ready'].includes(current)) transition('detaching');
+    if (readDispatchGate(root).connection === 'detached') transition('reconciling');
+    transition('recovery_required');
+  };
+  return {
+    store: {
+      read: async () => { const ledger = readDispatchGate(root); return { ...ledger, connectionState: ledger.connection }; },
+      write: async patch => {
+        const next = patch.connectionState;
+        // Reconnect is a verification path, not an assertion that an active
+        // owner drained. Move through recovery instead of claiming detached.
+        if (next === 'reconciling' && readDispatchGate(root).connection === 'detaching') recovery();
+        if (next === 'recovery_required') recovery();
+        else transition(next);
+        if (['connected', 'recovery_required'].includes(next)) release();
+      },
+    },
+    gate: {
+      close: async () => {
+        // Hold ownership across async drain, update and identity verification.
+        // A second process cannot replace a newer barrier using stale proof.
+        releaseOwner ||= acquireLock(join(root, 'update-detachment', 'coordinator')); 
+        if (['connected', 'ready'].includes(readDispatchGate(root).connection)) {
+          if(readWriters) { const writers=await readWriters(),current=readDispatchGate(root);prepareUpgradeFence({root,expectedRevision:current.revision,writers}); }
+          else transition('detaching');
+        }
+      },
+      open: async ({ resumeTasks }) => {
+        if (resumeTasks !== false || readDispatchGate(root).connection !== 'ready') throw new Error('Verified ready ledger required.');
+        transition('connected');
+      },
+      fenceTask: async ({identity,taskId,reason}) => {
+        if(!releaseOwner || !['detaching','reconciling'].includes(readDispatchGate(root).connection)) throw new Error('Coordinator ownership and closed admission required.');
+        const writers=await readWriters(),current=readTaskAdmission({root,identity,taskId});
+        // This is the explicit coordinator authority while its exclusive
+        // lease is held, never a refresh of an old execution dispatch owner.
+        return setTaskAdmissionFence({owner:{root,generation:current.generation,protocol:DISPATCH_PROTOCOL},identity,taskId,
+          expectedRevision:current.revision,expectedFenceRevision:current.record?.revision ?? null,reason,writers});
+      },
+    },
+    handoff: release,
+    boundary,
+    reconcile,
+  };
+}

package/src/update-detachment/ledger-reader.js

@@ -0,0 +1,42 @@
+import { createStateStore, digest } from './state-store.js';
+import { readDispatchGate } from './dispatch-gate.js';
+import { normalizeDispatchIdentity, listDispatchRegistrations } from './provenance.js';
+
+// PR1 stores references, not copied task authority. Read the original record
+// and include all three revisions in the sample; never synthesize missing state.
+export function ledgerSnapshotReader({ identity, taskId, readTaskSnapshot, readGate = readDispatchGate }) {
+  identity = Object.freeze(structuredClone(identity));
+  const exactIdentity = normalizeDispatchIdentity(identity);
+  const exactHashes = new Set([digest(identity), digest(exactIdentity)]);
+  const store = createStateStore(identity);
+  return async () => {
+    const scope = store.read();
+    const registration = scope.tasks[digest(taskId)];
+    if (!registration?.recordRef) throw new Error('Task not registered in exact scope');
+    const task = await readTaskSnapshot(registration.recordRef);
+    if (!task || !Number.isSafeInteger(task.revision) || task.revision < 0 ||
+        !Object.keys(identity).every(key => task.identity?.[key] === identity[key])) throw new Error('Task identity unavailable');
+    const gate = readGate(identity.root);
+    const knownScopes = new Set(listDispatchRegistrations(identity.root, { taskId, retained: true }).map(item=>digest(item.identity)));
+    const attempts = Object.values(gate.attempts).filter(attempt => {
+      if(attempt.taskHash!==digest(taskId))return false;
+      if(exactHashes.has(attempt.identityHash))return true;
+      if(attempt.identityHash && knownScopes.has(attempt.identityHash))return false;
+      // Unbound and unregistered evidence is still ambiguous, never silently
+      // attributed to another provider or discarded as someone else's work.
+      throw new Error('Attempt identity mismatch');
+    }).map(attempt => {
+      if (!exactHashes.has(attempt.identityHash)) throw new Error('Attempt identity mismatch');
+      const receipts = Object.values(gate.receipts).filter(receipt => receipt.attemptId === attempt.id);
+      if (receipts.some(receipt => receipt.generation !== attempt.generation)) throw new Error('Receipt generation mismatch');
+      const ids = [...new Set(receipts.map(receipt => receipt.providerExecutionId).filter(value => value != null))];
+      const refs = [...new Set(receipts.map(receipt => receipt.resultRef).filter(value => value != null))];
+      if (ids.length > 1 || refs.length > 1) throw new Error('Conflicting attempt receipts');
+      const state = attempt.phase === 'provider_identified' ? 'sent' : attempt.phase;
+      return { id: attempt.id, state, generation: attempt.generation,
+        ...(ids.length ? { providerExecutionId: ids[0] } : {}), ...(refs.length ? { resultRef: refs[0] } : {}) };
+    });
+    return { ...structuredClone(task), revision: digest([scope.revision, gate.revision, task]),
+      generation: gate.generation, identity: structuredClone(identity), attempts };
+  };
+}

package/src/update-detachment/provenance.js

@@ -0,0 +1 @@
+export * from '../codex-plugins/simy/hooks/update-dispatch-identity.mjs';

package/src/update-detachment/provider-adapters.js

@@ -0,0 +1,33 @@
+import { readCodexSession } from '../session-supervision/codex-app-server.js';
+import { readClaudeSession } from '../session-supervision/claude-sessions.js';
+import { processIdentity } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+// The existing owner supplies account/origin, policy, history, artifact and
+// execution evidence as one revisioned observation. No new process is opened.
+// Codex thread/read alone does not establish account, permissions or writer.
+export function codexReconciliationAdapter({ client, readObservation, readSession = readCodexSession }) {
+  return { async observe(snapshot) {
+    if (snapshot.identity.provider !== 'codex') throw new Error('Wrong adapter');
+    const metadata = await readSession(client, snapshot.identity.session);
+    const observed = await readObservation(snapshot);
+    if (metadata?.session !== snapshot.identity.session || metadata.cwd !== snapshot.identity.worktree ||
+        metadata.model !== observed?.policy?.model || observed?.writer?.source !== 'existing_owner') throw new Error('Unverified Codex owner');
+    return observed;
+  } };
+}
+
+export function claudeReconciliationAdapter({ readObservation, readSession = readClaudeSession, inspectProcess = processIdentity }) {
+  return { async observe(snapshot) {
+    if (snapshot.identity.provider !== 'claude') throw new Error('Wrong adapter');
+    const metadata = await readSession({ session: snapshot.identity.session, cwd: snapshot.identity.worktree });
+    const observed = await readObservation(snapshot);
+    const hook = snapshot.liveHook;
+    if (metadata?.session !== snapshot.identity.session || metadata.cwd !== snapshot.identity.worktree ||
+        metadata.observation?.source !== 'claude_local_index' || !hook?.identity ||
+        !Number.isSafeInteger(hook.pid) || hook.pid < 2 ||
+        observed?.liveHook?.source !== 'original_live_hook' ||
+        observed.liveHook.startedAt !== hook.startedAt || observed.liveHook.pid !== hook.pid || observed.liveHook.identity !== hook.identity ||
+        await inspectProcess(hook.pid) !== hook.identity) throw new Error('Original Claude process unavailable');
+    return { ...observed, liveHook: { ...observed.liveHook, verified: true } };
+  } };
+}

package/src/update-detachment/reconcile.js

@@ -0,0 +1,105 @@
+import { isDeepStrictEqual } from 'node:util';
+
+const IDENTITY = ['provider', 'session', 'account', 'origin', 'worktree', 'device', 'root'];
+const POLICY = ['model', 'permissions', 'approvals', 'budget', 'deadline'];
+const STOPPED = new Set(['stopped', 'paused', 'paused_by_user', 'cancelled']);
+const ATTEMPT_STATES = new Set(['intent', 'sending', 'sent', 'running', 'result_saved', 'confirmed']);
+const present = value => typeof value === 'string' && value.length > 0;
+const own = (object, key) => Object.hasOwn(object || {}, key);
+
+// Pure assessment: no persistence, writer acquisition, provider turn or replay.
+export function assessReconciliation(snapshot, observation, { now = Date.now(), maxAgeMs = 5_000, connectionOnly = false } = {}) {
+  const taskState = snapshot?.task?.state;
+  const stopped = STOPPED.has(taskState);
+  const result = (status, reasons, evidence = {}) => ({
+    status, reasons, connectionState: status === 'ready' ? 'ready' : 'recovery_required',
+    taskState, preserveStop: stopped, canReleaseGate: status === 'ready' && !stopped,
+    discardNextStep: status !== 'ready', replayAttempts: false,
+    nextAction: status === 'already_running' ? 'wait_original_provider' :
+      status === 'changed' ? 'review_current_state' : status === 'recovery_required' ? 'inspect_original_conversation' : 'none',
+    evidence,
+  });
+  const recovery = reason => result('recovery_required', [reason]);
+  if (!snapshot || !observation || !IDENTITY.every(key => present(snapshot.identity?.[key]))) return recovery('snapshot_identity_missing');
+  if (!IDENTITY.every(key => observation.identity?.[key] === snapshot.identity[key])) return recovery('provider_identity_mismatch');
+  if (!['codex', 'claude'].includes(snapshot.identity.provider)) return recovery('unsupported_provider');
+  if (!present(taskState) || !present(snapshot.revision) || !Number.isSafeInteger(snapshot.generation) || snapshot.generation < 0) return recovery('snapshot_invalid');
+  if (!POLICY.every(key => own(snapshot.policy, key) && snapshot.policy[key] !== undefined && own(observation.policy, key) && observation.policy[key] !== undefined) || !present(snapshot.policy.model) || !present(observation.policy.model)) return recovery('policy_unobserved');
+  if (observation.generation !== snapshot.generation) return recovery('owner_generation_mismatch');
+  if (!Number.isFinite(now) || !Number.isFinite(maxAgeMs) || maxAgeMs < 0 || !Number.isFinite(observation.observedAt) ||
+      observation.observedAt > now || now - observation.observedAt > maxAgeMs) return recovery('observation_stale');
+  if (observation.consistent !== true || !present(observation.revision)) return recovery('observation_unstable');
+  const history = observation.history;
+  if (!present(snapshot.historyCursor) || history?.incomplete !== false || history.truncated !== false ||
+      history.fromCursor !== snapshot.historyCursor || !present(history.cursor) || !Array.isArray(history.events) ||
+      history.events.some(event => !present(event?.id)) || new Set(history.events.map(event => event.id)).size !== history.events.length) return recovery('history_cursor_unverified');
+  if (!Array.isArray(snapshot.artifacts) || !Array.isArray(observation.artifacts) ||
+      !Array.isArray(snapshot.attempts) || !Array.isArray(observation.executions)) return recovery('evidence_unobserved');
+  const writer = observation.writer;
+  if (snapshot.identity.provider === 'codex') {
+    const readOnlyBoundary = connectionOnly === true && writer?.source === 'read_only_boundary' && writer.acquisitionRequired === true && writer.verified === false && writer.state === 'idle' && writer.id === snapshot.identity.session && snapshot.writer?.id === snapshot.identity.session;
+    if (!readOnlyBoundary && (!present(snapshot.writer?.id) || writer?.verified !== true || writer.id !== snapshot.writer.id ||
+        !['idle', 'running'].includes(writer.state))) return recovery('codex_writer_unverified');
+  } else if (observation.liveHook?.verified !== true ||
+      observation.liveHook.pid !== snapshot.liveHook?.pid || observation.liveHook.identity !== snapshot.liveHook?.identity ||
+      observation.liveHook.startedAt !== snapshot.liveHook?.startedAt || !present(observation.liveHook.identity) ||
+      !Number.isSafeInteger(observation.liveHook.pid) || observation.liveHook.pid < 2 || !present(observation.liveHook.startedAt) ||
+      !['idle', 'running'].includes(writer?.state)) return recovery('claude_live_hook_unverified');
+
+  const attempts = snapshot.attempts;
+  if (attempts.some(attempt => !present(attempt?.id) || !ATTEMPT_STATES.has(attempt.state)) ||
+      new Set(attempts.map(attempt => attempt.id)).size !== attempts.length) return recovery('attempt_ledger_invalid');
+  if (observation.executions.some(execution => !present(execution?.id) || !['running', 'completed', 'failed', 'cancelled'].includes(execution.state)) ||
+      new Set(observation.executions.map(execution => execution.id)).size !== observation.executions.length) return recovery('execution_evidence_invalid');
+  const executionIds = attempts.filter(attempt => attempt.state !== 'intent').map(attempt => attempt.providerExecutionId);
+  if (new Set(executionIds).size !== executionIds.length) return recovery('attempt_execution_ambiguous');
+  if (observation.executions.some(execution => !attempts.some(attempt => attempt.state !== 'intent' &&
+      attempt.providerExecutionId === execution.id && attempt.id === execution.attemptId))) return recovery('untracked_execution');
+  const matches = [];
+  for (const attempt of attempts) {
+    if (attempt.state === 'intent') return recovery('attempt_intent_unresolved');
+    if (!present(attempt.providerExecutionId)) return recovery('attempt_send_outcome_unknown');
+    const execution = observation.executions.find(item => item.id === attempt.providerExecutionId);
+    if (!execution || execution.attemptId !== attempt.id) return recovery('attempt_execution_unmatched');
+    if (['completed', 'failed', 'cancelled'].includes(execution.state) && !present(execution.resultRef)) return recovery('execution_result_missing');
+    if (['result_saved', 'confirmed'].includes(attempt.state) &&
+        (execution.state !== 'completed' || !present(attempt.resultRef) || attempt.resultRef !== execution.resultRef)) return recovery('saved_result_mismatch');
+    matches.push({ attemptId: attempt.id, providerExecutionId: execution.id, state: execution.state,
+      ...(execution.resultRef ? { resultRef: execution.resultRef } : {}) });
+  }
+  const evidence = { writerAcquisitionRequired: connectionOnly === true && writer.acquisitionRequired === true, historyCursor: history.cursor, attempts: matches,
+    artifacts: structuredClone(observation.artifacts), currentPolicy: Object.fromEntries(POLICY.map(key => [key, structuredClone(observation.policy[key])])) };
+  // These observations update the plan; they never authorize the old plan.
+  const changed = POLICY.filter(key => !isDeepStrictEqual(snapshot.policy[key], observation.policy[key]));
+  if (changed.length || history.events.length || history.cursor !== snapshot.historyCursor ||
+      !isDeepStrictEqual(snapshot.artifacts, observation.artifacts)) return result('changed', ['manual_or_provider_progress', ...changed.map(key => `${key}_changed`)], evidence);
+  if (writer.state === 'running' || matches.some(item => item.state === 'running')) return result('already_running', ['original_provider_running'], evidence);
+  if (matches.some(item => ['failed', 'cancelled'].includes(item.state))) return result('recovery_required', ['execution_did_not_complete'], evidence);
+  if (attempts.length && attempts.every(attempt => attempt.state !== 'intent') && matches.every(item => item.state === 'completed')) return result('completed', ['execution_results_observed'], evidence);
+  if (stopped) return result('changed', ['user_stop_preserved'], evidence);
+  if (taskState !== 'active') return result('changed', ['task_not_runnable'], evidence);
+  return result('ready', ['identity_history_writer_and_policy_verified'], evidence);
+}
+
+// readSnapshot is PR1's read-only normalized view, not a state-store implementation.
+// Two ledger/observation samples fence concurrent manual edits and owner changes.
+export async function reconcileSession({ readSnapshot, adapter, now = Date.now, maxAgeMs, connectionOnly = false }) {
+  try {
+    if (typeof readSnapshot !== 'function' || typeof adapter?.observe !== 'function') throw new Error('Missing reader');
+    const snapshot = structuredClone(await readSnapshot());
+    const first = structuredClone(await adapter.observe(structuredClone(snapshot)));
+    const observation = structuredClone(await adapter.observe(structuredClone(snapshot)));
+    const current = await readSnapshot();
+    if (!isDeepStrictEqual(snapshot, current) || !isDeepStrictEqual({ ...first, observedAt: undefined }, { ...observation, observedAt: undefined })) return {
+      status: 'recovery_required', reasons: ['concurrent_change'], connectionState: 'recovery_required',
+      taskState: current?.task?.state, preserveStop: STOPPED.has(current?.task?.state), canReleaseGate: false,
+      discardNextStep: true, replayAttempts: false, nextAction: 'inspect_original_conversation', evidence: {},
+    };
+    return assessReconciliation(snapshot, observation, { now: now(), maxAgeMs, connectionOnly });
+  } catch {
+    // Provider errors can contain private transcript/authentication data.
+    return { status: 'recovery_required', reasons: ['observation_unavailable'], connectionState: 'recovery_required',
+      canReleaseGate: false, preserveStop: true, discardNextStep: true, replayAttempts: false,
+      nextAction: 'inspect_original_conversation', evidence: {} };
+  }
+}

package/src/update-detachment/reconciliation-adapter.js

@@ -0,0 +1,13 @@
+import { reconcileSession } from './reconcile.js';
+
+// Use PR2's assessment without interpreting a changed/stopped/unknown task as
+// permission to release the root barrier. The caller supplies the registered
+// scope reader and original-provider observation adapter, never a new session.
+export function createCoordinatorReconciler({ readSnapshot, adapter, now, maxAgeMs } = {}) {
+  if (typeof readSnapshot !== 'function' || typeof adapter?.observe !== 'function') return undefined;
+  return async () => {
+    const result = await reconcileSession({ readSnapshot, adapter, now, maxAgeMs });
+    return { verified: result.status === 'ready' && result.canReleaseGate === true,
+      unresolvedAttempts: result.status === 'ready' ? 0 : null, assessment: result };
+  };
+}