@awak-app/simy-cli 0.7.37 → 0.7.39

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -12,6 +12,8 @@ import { recordHandoffStage, compactConsistencyOutbox } from './consistency-hand
 import { retainApplicableRules } from './purpose-rule-policy.mjs';
 import { reconcileRequirements, retainControllerEvidence, reconcileFindings, findingText, evidenceLedger, currentPurposeObservation } from './purpose-evidence.mjs';
 import { workspaceIdentity } from './purpose-workspace.mjs';
+import { normalizeRequirementContract, pendingRequirements } from './requirement-acceptance.mjs';
+import { bindRequirementChecker, registeredCheckerCurrent, registeredRequirementObserver, isRegisteredRequirementObserver } from './registered-requirement-checker.mjs';
 import { actionReversibilityInstruction, searchEnabled, failureLimitReached, searchState, recordSearchExperiment, rememberSearchWait, searchNeedsPivot, markSearchPivot, repeatedSearchAction } from './purpose-search.mjs';
 // Standalone by design: this exact module is shipped to both provider plugins.
 import { createHash, randomUUID } from 'node:crypto';
@@ -40,7 +42,7 @@ const RETRYABLE = new Set(['overloaded', 'server_error', 'rate_limit']);
 const APPROVAL_DECISIONS = new Set(['automatic', 'proceed_and_report', 'wait']);
 const LOCAL_ACTIONS = new Set(['read', 'local_edit', 'local_test']);
 const ACTIONS = new Set([...LOCAL_ACTIONS, 'external', 'destructive', 'scope_change', 'unknown']);
-const AUTONOMY_POLICIES = new Set(['strict', 'balanced', 'autonomous']);
+const AUTONOMY_POLICIES = new Set(['strict', 'balanced', 'autonomous', 'local_single_file']);
 const ASSESSMENT_FIELDS = { risk: ['low', 'medium', 'high', 'unknown'], reversibility: ['reversible', 'irreversible', 'unknown'], externalEffect: ['none', 'local', 'external', 'unknown'], blastRadius: ['single_file', 'repository', 'multi_system', 'unknown'], uncertainty: ['low', 'medium', 'high', 'unknown'] };
 export const rootDirectory = (env = process.env) => join(env.SIMY_HOME?.trim() || join(homedir(), '.simy'), 'delivery-hooks');
 // Provider identity remains bound to record.cwd. File acceptance and writer
@@ -449,7 +451,9 @@ export function missingAcceptanceDiagnosis(managed, missing) {
   const names = missing.map(item => item.id).join(', ');
   const scope = managed.decision.action.scope;
   const action = { kind: 'read', scope, summary: `Inspect missing acceptance checks: ${names}` };
-  return assessedPlan({ diagnosis: `Worker claimed completion, but independent acceptance checks still fail: ${names}. Diagnose the discrepancy before any repair.`,
+  return assessedPlan({ diagnosis: missing.some(item => item.check === 'behavior')
+    ? `Behavior acceptance is incomplete or unresolved: ${names}. Read the observations and distinguish a failed behavior from unavailable verification before any repair.`
+    : `Worker claimed completion, but independent acceptance checks still fail: ${names}. Diagnose the discrepancy before any repair.`,
     alternatives: [{ id: 'inspect_missing_acceptance', action,
       assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
       expectedVerification: `Report actual outcome and unmet conditions for ${names}`, rollback: 'No changes to undo' }],
@@ -535,7 +539,7 @@ export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now(), { a
   const localWrite = action.kind === 'local_edit' || allowLocalTestWrites && action.kind === 'local_test' && facts.externalEffect === 'local';
   const autonomous = policy === 'autonomous' && llmDelegated;
   const external = autonomous && allowReversibleExternal && action.kind === 'external' && facts.externalEffect === 'external';
-  let reason = null, waitKind = autonomous ? 'research' : 'human';
+  let reason = null, assessmentError = null, waitKind = autonomous ? 'research' : 'human';
   if (!scopes.includes(action.scope)) { reason = 'Action scope is outside the task enrollment.'; waitKind = 'authority'; }
   else if (facts.inObjective !== true) reason = 'Establish objective fit or choose work within the original task.';
   else if (facts.reversibility === 'irreversible') { reason = 'Irreversible consequences require an exact user decision.'; waitKind = 'human'; }
@@ -545,13 +549,16 @@ export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now(), { a
   else if (autonomous && allowReversibleExternal && action.kind === 'external' && facts.externalEffect !== 'external') reason = 'External action and declared effects disagree. Inspect the target and correct the assessment without executing it; API/service mutations have external effects even for a loopback service, while local filesystem work uses a local action.';
   else if ((!LOCAL_ACTIONS.has(action.kind) || facts.externalEffect === 'external') && !external) { reason = 'This action needs existing external authority or a reversible supported alternative.'; waitKind = 'authority'; }
   else if ((localWrite || external) && (!option.rollback || external && /^(?:no changes|none|n\/a)/i.test(option.rollback.trim()))) reason = 'Effectful work needs a concrete restoration plan.';
-  else if (localWrite && facts.externalEffect !== 'local') reason = 'Local write has inconsistent effect boundaries.';
+  else if (localWrite && facts.externalEffect !== 'local') { reason = 'Local write has inconsistent effect boundaries.'; assessmentError = 'local_write_effect_mismatch'; }
   else if (!localWrite && !external && facts.externalEffect !== 'none') reason = 'Read or test action has unexpected side effects.';
   else if (!autonomous && (facts.blastRadius === 'multi_system' || facts.risk === 'high' || facts.uncertainty === 'high')) reason = 'Selected policy requires a narrower or lower-risk action.';
   else if (policy === 'strict' && (localWrite || facts.risk !== 'low' || facts.uncertainty !== 'low')) reason = 'Strict policy requires low-risk read or local test.';
   else if (policy === 'balanced' && (facts.risk !== 'low' || facts.uncertainty !== 'low' || localWrite && facts.blastRadius !== 'single_file')) reason = 'Balanced policy requires a low-risk, narrow action.';
-  const report = external || autonomous && (facts.risk !== 'low' || facts.uncertainty !== 'low' || facts.userChoice !== false || facts.blastRadius === 'multi_system') || policy === 'autonomous' && facts.risk === 'medium';
-  return { id: digest(JSON.stringify({ plan, policy, llmDelegated, allowReversibleExternal })), outcome: reason ? 'wait' : report ? 'report' : 'proceed', ...(reason ? { waitKind } : {}), ...(external && !reason ? { autonomousExternal: true } : {}), reason: reason || 'AI selected reversible work within the enrolled objective and provider authority.', selectedOptionId: option.id, action, assessment: facts, expectedVerification: option.expectedVerification, rollback: option.rollback, policy, at: now };
+  else if (policy === 'local_single_file' && (action.scope !== 'task' || facts.uncertainty !== 'low' ||
+      (action.kind === 'local_edit' ? !['low','medium'].includes(facts.risk) || facts.blastRadius !== 'single_file' || /^(?:no changes|none|n\/a)\b/i.test(option.rollback.trim()) :
+        localWrite || facts.risk !== 'low'))) reason = 'Local single-file policy requires known low uncertainty, reversible task-local single-file edits at low or medium risk, or low-risk read-only work.';
+  const report = external || autonomous && (facts.risk !== 'low' || facts.uncertainty !== 'low' || facts.userChoice !== false || facts.blastRadius === 'multi_system') || ['autonomous','local_single_file'].includes(policy) && facts.risk === 'medium';
+  return { id: digest(JSON.stringify({ plan, policy, llmDelegated, allowReversibleExternal })), outcome: reason ? 'wait' : report ? 'report' : 'proceed', ...(reason ? { waitKind } : {}), ...(assessmentError ? { assessmentError } : {}), ...(external && !reason ? { autonomousExternal: true } : {}), reason: reason || 'AI selected reversible work within the enrolled objective and provider authority.', selectedOptionId: option.id, action, assessment: facts, expectedVerification: option.expectedVerification, rollback: option.rollback, policy, at: now };
 }
 // Recompute from the frozen plan, not an arbitrary checkpoint flag. Provider
 // permissions are checked independently by the adapter at actual dispatch.
@@ -566,15 +573,19 @@ export function canExecuteAutonomousExternal(managed) {
 }
 // Shared by live Stop hooks and cold exact-session recovery. Keep the result
 // contract identical across transports; the host still verifies acceptance.
-export function assessedCheckpointContract(decision, managed = null) {
+function actionAssessmentInstruction(decision, managed = null) {
   const scopes = managed?.approvalScopes ?? (decision.action?.scope ? [decision.action.scope] : []);
-  const actionFields = `Enrolled action.scope labels: ${JSON.stringify(scopes)}. scope is an exact enrollment label, not a filename or target description. Reuse an enrolled label for work within that scope; do not invent labels. Put concrete file names and affected targets in action.summary. These labels do not expand the original objective or provider permissions. Describe actual effects consistently: read uses externalEffect:"none"; local_edit uses externalEffect:"local". Do not relabel an outside-scope action to bypass approval.`;
+  const policy=managed?.autonomyPolicy || decision.policy;
+  return `${policy==='local_single_file' ? 'The host-enrolled local_single_file policy permits only reversible task-local edits to one file at low or medium risk with known low uncertainty. Read-only work stays low risk; external/high/unknown/user-choice effects remain held. Declare exactly one task-relative writeResources target, retain a concrete rollback, and checkpoint the actual result before the next effect. ' : ''}Enrolled action.scope labels: ${JSON.stringify(scopes)}. scope is an exact enrollment label, not a filename or target description. Reuse an enrolled label for work within that scope; do not invent labels. Put concrete file names and affected targets in action.summary. These labels do not expand the original objective or provider permissions. externalEffect classifies all effects, not just network effects: read-only work uses "none"; local file writes use "local"; outside-service effects use "external"; retain "unknown" when facts are missing. local_edit therefore requires externalEffect:"local", even when it makes no network call. Never relabel an external or unknown effect to bypass a hold. ${policy==='balanced' ? 'Balanced policy requires known low risk and uncertainty; a local write must be single_file, reversible and have a concrete rollback. Keep the entire original goal in remaining work, but choose one bounded original-task action rather than collapsing a multi-file goal into one write.' : policy==='strict' ? 'Strict policy permits low-risk read or local test; it does not authorize local edits.' : 'The enrolled policy and actual permission boundaries remain authoritative.'}`;
+}
+export function assessedCheckpointContract(decision, managed = null) {
+  const actionFields=actionAssessmentInstruction(decision,managed);
   const observationField = flexibleReasoning(managed) ? 'Plan diagnosis, recommendation and its reason are optional when the selected action is clear. Optional observations may be omitted; do not create evidence files, citations or extra reports. Actual tool results are captured by the controller.' : 'Return the observed result; evidence attachments and extra reports are optional.';
   return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. When the requested outcome is a conversational answer or correction, put the actual answer text in summary. Saying it was prepared or delivered is insufficient; do not place the answer only in an undeclared JSON field. For an answer-only request, returning that text here is the conversational result: do not invent a separate message-delivery action unless the original user requested a separate destination. This does not verify implementation or external effects. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. ${actionFields} Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Report completed only when the original requested outcome is achieved; keep unfinished checks as remaining work. Do not add audit reports, certification, or evidence-submission tasks. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
 
 }
-export function understandingCheckpointContract(decision) {
-  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use semantic; do not create human verification requirements."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic and obtain the needed observation automatically. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. If and only if the original user requests ONLY a conversational answer or design (no implementation, files, tests, deployment or external effects), no independent review/audit or human acceptance is requested anywhere in the user context, and the existing answer already satisfies every requested point, you may include sessionUnderstanding.conversationOutcome:{kind:"answer_only",independentReviewRequested:false,requestTurnRefs:["exact user turn refs"],answerTurnRefs:["exact assistant answer turn refs"]}. Include the latest user and latest answer references, and exact user excerpts in the criteria basis. Read and judge the actual answer, including factual errors and unsupported claims; its mere existence or a worker saying done is insufficient. If the answer is wrong or incomplete, use clear with the next read action to formulate the missing/corrected answer, not already_done. Omit conversationOutcome for uncertain scope, missing context or requested effects; a design that describes unimplemented work is complete only when the user asked for design alone. This optional classification ends only an initially uncontracted conversational task as reported_done; it does not waive a frozen acceptance contract or assert independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
+export function understandingCheckpointContract(decision, managed = null) {
+  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\n${actionAssessmentInstruction(decision,managed)}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use semantic; do not create human verification requirements."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic and obtain the needed observation automatically. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. If and only if the original user requests ONLY a conversational answer or design (no implementation, files, tests, deployment or external effects), no independent review/audit or human acceptance is requested anywhere in the user context, and the existing answer already satisfies every requested point, you may include sessionUnderstanding.conversationOutcome:{kind:"answer_only",independentReviewRequested:false,requestTurnRefs:["exact user turn refs"],answerTurnRefs:["exact assistant answer turn refs"]}. Include the latest user and latest answer references, and exact user excerpts in the criteria basis. Read and judge the actual answer, including factual errors and unsupported claims; its mere existence or a worker saying done is insufficient. If the answer is wrong or incomplete, use clear with the next read action to formulate the missing/corrected answer, not already_done. Omit conversationOutcome for uncertain scope, missing context or requested effects; a design that describes unimplemented work is complete only when the user asked for design alone. This optional classification ends only an initially uncontracted conversational task as reported_done; it does not waive a frozen acceptance contract or assert independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
 }
 function boundedContextList(value, maxItems = 8, maxLength = 300) {
   if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
@@ -690,11 +701,14 @@ function recordPurposeProgress(run, now, countAttempt = true) {
     if (fresh.length) purpose.progressCapacityReached = true;
   }
 }
+function managedAssessmentOptions(managed) {
+  return {allowLocalTestWrites:true,llmDelegated:searchEnabled(managed),
+    allowReversibleExternal:searchEnabled(managed) && managed.resumeChannel==='codex_app_server'};
+}
 function recordDecision(managed, plan, now) {
   // Classify effectful local tests as writes, with the same scope, policy and
   // rollback checks as local_edit. Native write permissions remain independent.
-  const assessmentOptions = { allowLocalTestWrites: true, llmDelegated: searchEnabled(managed),
-    allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' };
+  const assessmentOptions = managedAssessmentOptions(managed);
   let decision = evaluateAssessedPlan(plan, managed.autonomyPolicy, managed.approvalScopes, now, assessmentOptions);
   const dependencyPending = option => (option?.dependsOn || []).some(id =>
     !managed.purpose?.evidence?.units?.some(unit => unit.id === id && unit.status === 'verified' && unit.purposeRevision === managed.purpose.evidence.purposeRevision));
@@ -773,6 +787,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (!spec) return null;
   if (spec !== true && (typeof spec !== 'object' || Array.isArray(spec))) throw new Error('Invalid managed task specification.');
   const config = spec === true ? {} : spec;
+  if (Object.hasOwn(config, 'requirementChecker') || Object.hasOwn(config, 'hostRequirementChecker')) throw new Error('Checker registration must come from the owning host, not a managed specification.');
   if (!Array.isArray(config.acceptanceCriteria) || (!config.acceptanceCriteria.length && config.contextBootstrap !== true) || config.acceptanceCriteria.length > 20) throw new Error('Managed tasks require acceptanceCriteria.');
   const criteria = config.acceptanceCriteria.map((item, index) => {
     if (typeof item !== 'object' || !item || !text(item.description, 500)) throw new Error('Each acceptance criterion needs a description.');
@@ -814,6 +829,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     deliveryLevel = { requested: value.requested, effective: value.effective, numberingVersion: value.numberingVersion, selectionRef: text(value.selectionRef, 200) };
   }
   const managed = { ...(config.purpose ? { purpose: structuredClone(config.purpose) } : {}), taskId: randomUUID(), deliveryLevel, thread: { provider, id: session },
+    ...(config.requirementContract ? { requirementContract: normalizeRequirementContract(config.requirementContract) } : {}),
     independentReviewRequired: config.independentReviewRequired === true,
     actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
@@ -842,12 +858,16 @@ function freezeEnrollment(run, now) {
     ledger.charter ||= { objective: run.objective, criteria: structuredClone(run.managed.acceptanceCriteria), approvalScopes: [...run.managed.approvalScopes], frozenAt: now };
   }
   run.managed.enrollment = { objective: run.objective, acceptanceDigest: digest(JSON.stringify(run.managed.acceptanceCriteria)),
+    ...(run.managed.requirementContract ? { requirementContractHash: run.managed.requirementContract.contractHash } : {}),
+    ...(run.managed.requirementChecker ? { requirementCheckerDigest: run.managed.requirementChecker.digest } : {}),
     ...(run.managed.providerSandboxSource ? {nativeAuthorityDigest:digest(JSON.stringify([run.managed.providerSandbox,run.managed.providerSandboxSource]))} : {}),
     deliveryLevel: structuredClone(run.managed.deliveryLevel || null), frozenAt: now };
 }
 export function pendingAcceptance(run) {
   const enrollment = run.managed?.enrollment;
   if (enrollment && (enrollment.objective !== run.objective || enrollment.acceptanceDigest !== digest(JSON.stringify(run.managed.acceptanceCriteria)) ||
+      enrollment.requirementContractHash !== run.managed.requirementContract?.contractHash ||
+      enrollment.requirementCheckerDigest !== run.managed.requirementChecker?.digest ||
       JSON.stringify(enrollment.deliveryLevel) !== JSON.stringify(run.managed.deliveryLevel || null))) return [{ id: 'enrollment', description: 'Original objective, level and acceptance contract',
     check: 'manual', detail: 'Enrollment changed unexpectedly; stop and inspect before enrolling a revised task' }];
   const feedback = new Map(pendingAcceptanceFeedback(run).map(item => [item.criterionId, item]));
@@ -860,7 +880,7 @@ export function pendingAcceptance(run) {
   if (run.managed?.independentReviewRequired && !searchEnabled(run.managed) && run.managed.liveOutcomeReview?.passed !== true) pending.push({
     id: 'independent-review', description: 'Required independent outcome review', check: 'semantic',
     detail: 'Independent outcome review has not passed; file checks alone cannot complete this task' });
-  return pending;
+  return [...pending, ...pendingRequirements(run.managed)];
 }
 function acceptancePendingReason(run) {
   return `Acceptance verification pending: ${pendingAcceptance(run).map(item => `${item.id} (${item.description}): ${item.detail}`).join('; ')}`;
@@ -929,7 +949,7 @@ export function liveOutcomeReviewEligible(record) {
 }
 // Checkpoints are rejected while only manual acceptance is pending, so the
 // review instruction applies only where an independent review can follow.
-function reviewInstruction(run) {
+export function reviewInstruction(run) {
   const m = run.managed;
   if (m?.capability !== 'live_hook' || m?.thread?.provider !== 'claude') return '';
   if (run.state === 'verification_pending' && !m.independentReviewRequired && !effectiveAcceptanceCriteria(m).some(c => c.check.type === 'semantic'))
@@ -937,7 +957,7 @@ function reviewInstruction(run) {
       ? 'Manual acceptance is pending. The completion report records remaining work, but no additional executable next plan has been accepted. '
       : 'Only manual acceptance remains and the user verifies it. ') +
       'Checkpoints are not accepted until the user verifies or resumes this task; do not resubmit one. ';
-  return 'When the requested artifact is ready or repaired, submit a completed work checkpoint to request independent review. This does not grant acceptance. If nativeOutcomeReview.prompt is absent, submit that checkpoint first to obtain a fresh review prompt; never reuse a pre-repair prompt. ';
+  return 'When the requested artifact is ready or repaired, submit a completed work checkpoint to request independent review. Use status=completed with the actual actionResult even while acceptance is pending; this is not acceptance. If nativeOutcomeReview.prompt is absent, submit that checkpoint first to obtain a fresh review prompt; never reuse a pre-repair prompt. ';
 }
 export function deliveryAcceptanceContext(run) {
   const feedback = manualAcceptanceFeedback(run);
@@ -991,6 +1011,9 @@ function initialDeliveryRun(objective, nextStep, now, maxFailures) {
     maxFailuresSource: maxFailures === undefined ? 'default' : 'explicit', continuations: 0, failures: 0,
     revision: 0, consumedRevision: -1, checkpoint: null, reason: 'started', managed: null };
 }
+function understandingTurnInstruction(managed, decision) {
+  return `Understand the current user request in this ORIGINAL conversation. ${managed.understandingAnswer ? `The user answered question ${managed.understandingAnswer.questionId}: ${managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(decision,managed)}`;
+}
 function hookDeliveryContext(record, automatic = false) {
   const { provider, session, run } = record;
   const identity = `SIMY connected to this ${provider} conversation: ${session}.`;
@@ -1000,9 +1023,14 @@ function hookDeliveryContext(record, automatic = false) {
     (['active', 'reported_done', 'completed'].includes(run.state) ? `${correctiveFollowupInstruction} ` : '') +
     (provider === 'codex' && ['completed', 'reported_done'].includes(run.state) ? `Finished run ID: ${run.id}. Its completion does not supervise later user requests. If the user explicitly requests supervision of the current goal, use simy delivery followup --provider codex --session ${session} --previous-run-id ${run.id} --objective CURRENT_GOAL. A different goal archives the old run; the same ordinary reported_done goal retains identity and budgets for read-only reconciliation. A new prompt alone is not consent to run this command. ` : '') +
     (run.state === 'active' && !run.managed ? `Before ending the turn, submit an honest JSON checkpoint with simy delivery checkpoint --provider ${provider} --session ${session} --file -. Use status in_progress with summary, remainingWork and nextStep for remaining work; completed with summary, acceptanceMet:true and evidence for finished work; or blocked with summary and blocker missing_information or authorization. The first completed checkpoint requests an outcome check in this conversation; inspect the actual result and submit a fresh checkpoint. If requested work remains, perform the first authorized step instead of ending with self-evaluation or a plan. Completion is provider-reported, not independently verified. ${informationWaitInstruction} ` : '') +
+    // Publish the current read/understanding contract at the real user boundary,
+    // before any work or Stop. Rendering it neither dispatches nor consumes a
+    // decision, and terminal/paused runs never receive an execution instruction.
+    (run.state === 'active' && run.managed?.phase === 'understanding' && run.managed.decision ?
+      `${understandingTurnInstruction(run.managed, run.managed.decision)} Submit this checkpoint through standard input using simy delivery checkpoint --provider ${provider} --session ${session} --file -. A chat JSON answer does not submit a checkpoint. ` : '') +
     `Preserve the current task and its permissions, pauses and stops; never restart or reset it automatically.`;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, previousRunId, reconcileRunId, objective, nextStep, maxMinutes, maxContinuations, maxFailures, continuationPolicy, managed, admission,
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, hostRequirementChecker, upgradeRunId, previousRunId, reconcileRunId, objective, nextStep, maxMinutes, maxContinuations, maxFailures, continuationPolicy, managed, admission,
   liveHookAdmission, autoContinueEpoch, followupAutoContinue = false, providerLinkEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   const link = await providerLinkState(root, provider);
   if (providerLinkEpoch !== undefined && providerLinkEpoch !== link.epoch) throw Object.assign(new Error("SIMY provider connection changed before enrollment."), { code: "provider_link_changed" });
@@ -1013,6 +1041,11 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if (!(await stat(executionCwd)).isDirectory()) throw new Error('Task execution directory must be a directory.');
   }
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
+  const hostRequirements = hostRequirementChecker === undefined ? null : await bindRequirementChecker(hostRequirementChecker,
+    { root, provider, session, cwd: executionCwd || cwd, objective: text(objective) });
+  if (hostRequirements && (!managed || managed.resumeChannel && managed.resumeChannel !== 'live_hook')) throw new Error('Registered checker requires managed Claude live-hook enrollment.');
+  if (hostRequirements && managed.requirementContract && normalizeRequirementContract(managed.requirementContract).contractHash !== hostRequirements.requirementContract.contractHash)
+    throw new Error('Managed contract differs from the host registration.');
   return updateRecord(root, provider, session, async previous => {
     if (previous?.providerArchived === true) throw new Error('Restore the original provider conversation before starting Delivery Loop.');
     if (autoContinueEpoch && (previous?.autoContinue !== true || previous.autoContinueEpoch !== autoContinueEpoch)) throw new Error('Automatic continuation was disabled before enrollment.');
@@ -1048,6 +1081,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     const managedConfig = managed && { ...(managed === true ? {} : managed),
       ...(continuationPolicy === undefined ? {} : { continuationPolicy }) };
     const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
+    if (hostRequirements) Object.assign(managedState, structuredClone(hostRequirements));
     if ((following || reconciling) && (provider !== 'codex' || !admitted || !managedState?.autoRecovery || managedState.capability !== 'codex_app_server' || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Follow-up requires exact-session managed supervision, a concrete goal and read-only reconciliation.');
     if (upgrading && (!managedState?.autonomyPolicy || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Upgrade requires read-only reconciliation and frozen acceptance of the original objective.');
     if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
@@ -1242,7 +1276,8 @@ export function diagnoseControllerApproval(record, now) {
   return queued;
 }
 
-export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, expectedNativeHandoff, toolEvidence = [], sourceContext, controllerEvidence, now = Date.now() }) {
+export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, expectedNativeHandoff, toolEvidence = [], sourceContext, controllerEvidence, signal, now = Date.now() }) {
+  signal?.throwIfAborted();
   if (expectedNativeHandoff && checkpoint?.kind) throw new Error('Native handoff requires an ordinary action checkpoint.');
   if (checkpoint?.kind === 'action_association') return checkpointActionAssociation({ root, provider, session, cwd, checkpoint, expectedLease, now });
   if (checkpoint?.kind === 'session_understanding') return checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, sourceContext, controllerEvidence, now });
@@ -1253,7 +1288,23 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
   if (checkpoint.status === 'error' && !text(checkpoint.nextStep)) throw new Error('A concrete nextStep is required.');
   if (checkpoint.status === 'blocked' && !['authorization', 'missing_information', 'external_dependency'].includes(checkpoint.blocker)) throw new Error('Specify authorization, missing_information, or external_dependency.');
   const evidence = Array.isArray(checkpoint.evidence) ? checkpoint.evidence.map(v => text(v, 1000)).filter(Boolean).slice(0, 20) : [];
+  // Registered read-only verification runs outside updateRecord's lock. The
+  // ordinary checkpoint still applies the existing stop/authority/action rules.
+  if (checkpoint.status === 'completed') {
+    const snapshot = await readRecord(root, provider, session);
+    const binding = snapshot?.run?.managed?.requirementChecker;
+    const decision = snapshot?.run?.managed?.decision;
+    const result = checkpoint.actionResult;
+    const actionBound = !snapshot?.run?.managed?.autonomyPolicy || result?.decisionId === decision?.id &&
+      ['observed', 'failed', 'not_run'].includes(result?.status) && Boolean(text(result.summary, 500));
+    if (binding && actionBound && checkpointDirectoryMatches(snapshot, cwd) && requirementObservationEligible(root, snapshot)) {
+      const observer = registeredRequirementObserver({ root, binding, provider, session, runId: snapshot.run.id });
+      observer.checkVersion = snapshot.run.managed.requirementContract.checkVersion;
+      await observeRequirementAcceptance({ root, provider, session, observer, signal, now });
+    }
+  }
   const settled = await updateRecord(root, provider, session, async record => {
+    signal?.throwIfAborted();
     const run = record?.run;
     let effectiveStatus = checkpoint.status;
     let nextStep = text(checkpoint.nextStep);
@@ -1363,7 +1414,8 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         rememberPerspectives(run, run.managed.purpose.lastReview, actionResult, now, perspectiveScope(record));
       }
       if (run.managed.autonomyPolicy && checkpoint.status === 'completed') {
-        const missing = run.managed.acceptanceCriteria.filter(item => !['manual', 'semantic'].includes(item.check.type) && !Object.hasOwn(run.managed.verified, item.id));
+        const missing = [...run.managed.acceptanceCriteria.filter(item => !['manual', 'semantic'].includes(item.check.type) && !Object.hasOwn(run.managed.verified, item.id)),
+          ...pendingRequirements(run.managed)];
         if (missing.length) {
           effectiveStatus = 'in_progress';
           repairPlan = checkpoint.plan && nextStep ? assessedPlan(checkpoint.plan, run.managed) : missingAcceptanceDiagnosis(run.managed, missing);
@@ -1467,9 +1519,10 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     run.blockerSource = effectiveStatus === 'blocked' ? 'checkpoint' : null;
     run.providerRequest = null;
     run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep,
+      ...(effectiveStatus !== checkpoint.status || incompleteResult ? { reportedStatus: checkpoint.status } : {}),
       blocker: unsupportedWait ? undefined : checkpoint.blocker,
       ...(unsupportedWait ? { reportedBlocker: checkpoint.blocker } : checkpoint.blocker === 'missing_information' ? { question: text(checkpoint.question, 1000) } : {}),
-      ...(remainingWork ? { remainingWork } : {}), ...(incompleteResult ? { reportedStatus: checkpoint.status } : {}),
+      ...(remainingWork ? { remainingWork } : {}),
       evidence, acceptanceMet: !unsupportedWait && !incompleteResult && checkpoint.acceptanceMet === true };
     if (!run.managed && effectiveStatus !== 'completed') delete run.completionCheck;
     if (run.managed?.liveOutcomeReview) {
@@ -1483,6 +1536,9 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     const semanticReviewRequired = effectiveAcceptanceCriteria(run.managed).some(c => c.check.type === 'semantic');
     if (searchEnabled(run.managed) && effectiveStatus === 'completed' && (run.managed.independentReviewRequired || semanticReviewRequired || pendingAcceptance(run).length || purposeCompletionBarrier(run))) {
       queuePurposeVerification(run, checkpoint.summary, now);
+    } else if (searchEnabled(run.managed) && effectiveStatus === 'in_progress' && semanticReviewStalled(run) &&
+        !(await reviewedCurrentWorkspace(record, root, searchState(run.managed).review))) {
+      queuePurposeVerification(run, `Repeated read-only checks report no remaining change; independently review the semantic acceptance. Latest result: ${text(checkpoint.summary, 600)}`, now);
     } else if (run.managed && effectiveStatus === 'completed') {
       const pending = pendingAcceptance(run);
       if (pending.length) { run.state = 'verification_pending'; run.reason = acceptancePendingReason(run); }
@@ -1730,6 +1786,16 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     if (['clear', 'already_done'].includes(understanding.state) && result.status !== 'observed') throw new Error('Clear understanding requires an observed read result.');
     const plan = understanding.state === 'clear' ? assessedPlan(checkpoint.plan, run.managed) : null;
     if (plan && JSON.stringify(plan.alternatives.find(item => item.id === plan.selectedOptionId).action) !== JSON.stringify(understanding.nextAction)) throw new Error('Understood next action differs from selected assessed option.');
+    // A deterministic contradictory declaration is invalid input, not evidence
+    // that the human needs to authorize an effect. Reject before committing
+    // understanding; never rewrite none to local or dispatch the write.
+    if (plan && run.managed.contextBootstrap && !searchEnabled(run.managed) &&
+        !run.managed.pendingApproval && !run.managed.executionUncertain && !run.managed.rejectedActionOverflow &&
+        !run.managed.rejectedActionDigests?.includes(digest(JSON.stringify(understanding.nextAction)))) {
+      const assessed=evaluateAssessedPlan(plan,run.managed.autonomyPolicy,run.managed.approvalScopes,now,managedAssessmentOptions(run.managed));
+      if (assessed.assessmentError==='local_write_effect_mismatch')
+        throw new Error('Inconsistent understanding assessment: local_edit requires externalEffect:"local" for actual local writes, not "none". Correct the declaration honestly or choose authorized read investigation; do not execute or relabel external/unknown effects.');
+    }
     if (purposeEnabled(run)) recordPurposeReview(run.managed,
       validatePurposeReview(checkpoint.purposeReview, plan, run.managed.purpose.ruleIds, searchEnabled(run.managed) ? run.managed.purpose.lastReview?.rules || [] : [], run.managed), now);
     if (searchEnabled(run.managed) && expectedLease && sourceContext) run.managed.purpose.originalContext ||= sourceContext;
@@ -1779,7 +1845,25 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
       run.managed.phase = 'active';
       run.state = 'reported_done';
       run.reason = 'Original conversation reports no remaining work; independent completion was not verified.';
-      if (conversationalCompletion) {
+      if (run.managed.requirementContract) {
+        // An already-enrolled behavior contract is independent of a worker's
+        // interpretation that nothing remains. Acquire its observation through
+        // the existing read/checkpoint path; reported_done would end that path.
+        if (!run.managed.acceptanceCriteria.length) run.managed.acceptanceCriteria = understanding.criteria
+          .filter(item => item.source === 'user_grounded').map(item => ({ id: item.id, description: item.description,
+            check: item.check.type === 'file_equals' ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
+        freezeEnrollment(run, now);
+        await verifyAutomaticCriteria(record, now);
+        const missing = pendingRequirements(run.managed);
+        if (missing.length) {
+          const diagnosis = missingAcceptanceDiagnosis(run.managed, missing);
+          run.state = 'active'; recordDecision(run.managed, diagnosis, now);
+          run.nextStep = run.managed.decision.action.summary;
+          run.reason = 'Reported completion still needs the enrolled independent behavior observations.';
+        } else {
+          run.state = 'verification_pending'; run.reason = acceptancePendingReason(run);
+        }
+      } else if (conversationalCompletion) {
         // These are inferred expectations, not a user-enrolled verification
         // contract. Preserve them in sessionUnderstanding without promoting
         // them into new audit obligations or claiming independent acceptance.
@@ -1820,8 +1904,98 @@ function newVerifiedCriterion(run, id, now) {
   if (!Object.hasOwn(managed.verified, id)) managed.lastOutcomeAt = now;
   managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? run.startedAt, now);
 }
+// Host adapter API, deliberately absent from the worker checkpoint JSON/CLI.
+// The caller provides a registered read-only observer, not a worker verdict or
+// a command discovered from task files. This API grants no execution permission.
+function requirementObservationEligible(root, record) {
+  const managed = record?.run?.managed;
+  return managed?.requirementContract && ['active', 'verification_pending'].includes(record.run.state) &&
+    !record.run.stopReason && !hasPendingUserStop(root, record) && automaticContinuationAllowed(record) &&
+    !managed.pendingApproval && !managed.nativeWait && !managed.executionUncertain && !managed.purpose?.nativeBoundary &&
+    !acceptanceAuthorityHeld(record.run) && !managed.liveWorkspaceLease && !managed.resumeLease && !managed.outcomeAudit?.lease &&
+    !['pending', 'pending_received', 'transferred'].includes(managed.handoff?.status) &&
+    !['understanding', 'needs_clarification'].includes(managed.phase);
+}
+export async function observeRequirementAcceptance({ root, provider, session, observer, signal, now = Date.now() }) {
+  signal?.throwIfAborted();
+  if (typeof observer !== 'function') throw new Error('A host behavior observer is required.');
+  const snapshot = await readRecord(root, provider, session);
+  const eligible = record => requirementObservationEligible(root, record);
+  if (!eligible(snapshot)) throw new Error('Behavior observation cannot override a task hold.');
+  if (snapshot.run.managed.requirementChecker && !isRegisteredRequirementObserver(observer)) throw new Error('Enrolled checker requires its registered host execution path.');
+  const contract = normalizeRequirementContract(snapshot.run.managed.requirementContract);
+  if (observer.checkVersion !== contract.checkVersion) throw new Error('Host observer version does not match the enrolled contract.');
+  const link = await providerLinkState(root, provider);
+  if (!link.connected) throw new Error('Provider connection is unavailable.');
+  const controller = new AbortController();
+  const abort = () => controller.abort(signal.reason);
+  signal?.addEventListener('abort', abort, { once: true });
+  if (signal?.aborted) abort();
+  let checking = false;
+  const stillCurrent = async () => {
+    if (checking || controller.signal.aborted) return;
+    checking = true;
+    try {
+      const record = await readRecord(root, provider, session), currentLink = await providerLinkState(root, provider);
+      if (!eligible(record) || record.run.id !== snapshot.run.id || record.run.revision !== snapshot.run.revision ||
+          record.run.controlRevision !== snapshot.run.controlRevision || !currentLink.connected || currentLink.epoch !== link.epoch)
+        controller.abort(new Error('Task authority changed during behavior verification.'));
+    } catch { controller.abort(new Error('Task authority is unavailable.')); }
+    finally { checking = false; }
+  };
+  const monitor = setInterval(stillCurrent, 100);
+  let candidateHash, receipt;
+  try {
+    await stillCurrent();
+    controller.signal.throwIfAborted();
+    candidateHash = await workspaceIdentity(taskDirectory(snapshot), root, undefined, { signal: controller.signal });
+    await stillCurrent();
+    controller.signal.throwIfAborted();
+    receipt = await observer({ cwd: taskDirectory(snapshot), contract: structuredClone(contract), candidateHash, signal: controller.signal });
+  }
+  catch { receipt = { schemaVersion: 1, contractHash: contract.contractHash, checkVersion: contract.checkVersion,
+    candidateHash, execution: { status: 'infrastructure_error', assertionCount: 0 }, observations: [] }; }
+  finally { clearInterval(monitor); signal?.removeEventListener('abort', abort); }
+  // Bound storage before retaining output from a verifier transport.
+  try {
+    const serialized = JSON.stringify(receipt);
+    if (!serialized || Buffer.byteLength(serialized) > 48 * 1024) throw new Error('Unusable observation.');
+    receipt = JSON.parse(serialized);
+  } catch { receipt = null; }
+  return updateRecord(root, provider, session, async record => {
+    signal?.throwIfAborted();
+    const currentLink = await providerLinkState(root, provider);
+    if (!eligible(record) || record.run.id !== snapshot.run.id || record.run.revision !== snapshot.run.revision ||
+        record.run.controlRevision !== snapshot.run.controlRevision || !currentLink.connected || currentLink.epoch !== link.epoch ||
+        JSON.stringify(record.run.managed.enrollment) !== JSON.stringify(snapshot.run.managed.enrollment) ||
+        record.run.managed.requirementContract.contractHash !== contract.contractHash) return record;
+    const owner = record.run.managed.liveHookOwner;
+    if (owner && await processIdentity(owner.pid) !== owner.identity) return record;
+    record.run.managed.requirementObservation = { id: randomUUID(), source: 'host_requirement_observer',
+      ...(snapshot.run.managed.requirementChecker ? { checkerDigest: snapshot.run.managed.requirementChecker.digest } : {}),
+      candidateHash, stateRoot: root, checkedAt: now, current: false, receipt };
+    await verifyAutomaticCriteria(record, now);
+    if (!pendingAcceptance(record.run).length && record.run.state === 'verification_pending') {
+      record.run.state = 'active'; record.run.reason = 'Current behavior observation passed; awaiting the original Stop boundary.';
+    }
+    return record;
+  });
+}
+
 export async function verifyAutomaticCriteria(record, now) {
   const managed = record.run.managed;
+  if (managed.requirementObservation) {
+    const observation = managed.requirementObservation;
+    // Refresh against the actual current workspace on every checkpoint/Stop.
+    // A cached worker PASS or a previously matching candidate cannot waive it.
+    observation.current = observation.source === 'host_requirement_observer' &&
+      (!managed.requirementChecker || observation.checkerDigest === managed.requirementChecker.digest &&
+        await registeredCheckerCurrent(observation.stateRoot, managed.requirementChecker)) &&
+      observation.receipt?.candidateHash === observation.candidateHash &&
+      observation.receipt?.contractHash === managed.requirementContract?.contractHash &&
+      observation.receipt?.checkVersion === managed.requirementContract?.checkVersion &&
+      observation.candidateHash === await workspaceIdentity(taskDirectory(record), observation.stateRoot).catch(() => null);
+  }
   if (managed.liveOutcomeReview?.passed && managed.liveOutcomeReview.workspaceDigest !== await workspaceIdentity(taskDirectory(record)).catch(() => null)) {
     managed.liveOutcomeReview = { ...managed.liveOutcomeReview, passed: false, summary: 'Workspace changed after independent review; inspect the current result.' };
     delete managed.nativeOutcomeReview;
@@ -1834,6 +2008,23 @@ export async function verifyAutomaticCriteria(record, now) {
       evidence_refs: [`host-check:${managed.taskId}:${criterion.id}:${sha256 || 'failed'}`] };
   };
   const failed = (criterion, detail) => { delete managed.verified[criterion.id]; observe(criterion, false, detail); };
+  if (managed.requirementContract) {
+    const pending = new Map(pendingRequirements(managed).map(row => [row.id, row]));
+    let requirements = [];
+    try { requirements = normalizeRequirementContract(managed.requirementContract).requirements; }
+    catch { for (const id of Object.keys(managed.verified)) if (id.startsWith('behavior:')) delete managed.verified[id]; }
+    for (const requirement of requirements) {
+      const id = `behavior:${requirement.id}`, row = pending.get(id);
+      if (row) delete managed.verified[id];
+      else {
+        newVerifiedCriterion(record.run, id, now);
+        managed.verified[id] = { source: 'behavior', checkedAt: now, sha256: managed.requirementObservation.candidateHash };
+      }
+      managed.criterionObservations[id] = { criterion_id: id, passed: row ? row.status === 'failed' ? false : null : true,
+        verification_method: 'host_behavior', observed_result: row?.detail || 'All required assertions independently observed.',
+        evidence_refs: managed.requirementObservation ? [`host-behavior:${managed.requirementObservation.id}`] : [] };
+    }
+  }
   const feedbackPending = new Set(pendingAcceptanceFeedback(record.run).map(item => item.criterionId));
   for (const criterion of effectiveAcceptanceCriteria(managed)) {
     if (criterion.check.type === 'manual') {
@@ -1864,6 +2055,29 @@ export async function verifyAutomaticCriteria(record, now) {
     } catch { failed(criterion, 'Acceptance file could not be independently read'); }
   }
 }
+// A semantic criterion is verified only by the independent review, and the
+// review is queued when the worker reports completed. The worker sees the
+// criterion as unverified until then, so it can keep re-reading an already
+// correct result and never report completed: the review never runs and the
+// task spends its whole budget. Two consecutive observed read-only results
+// (reads cannot change the workspace) with nothing pending except semantic
+// criteria mean there is nothing left for the worker to do, so the controller
+// schedules the review instead. The review still decides, and its findings
+// become the next repair cycle. A workspace the last review already judged is
+// not reviewed again; after a repair it is.
+function semanticReviewStalled(run) {
+  const m = run.managed;
+  if (m.executionUncertain || m.pendingApproval || m.userQuestion || m.dependencyWait || searchState(m).phase === 'verifying') return false;
+  const pending = pendingAcceptance(run);
+  if (!pending.length || pending.some(item => item.check !== 'semantic')) return false;
+  const recent = (m.workHistory || []).filter(item => item.status !== 'session_understanding').slice(-2);
+  return recent.length === 2 && recent.every(item => item.action?.kind === 'read' && item.result?.status === 'observed');
+}
+async function reviewedCurrentWorkspace(record, root, review) {
+  if (!review?.workspaceDigest) return false;
+  const current = await workspaceIdentity(taskDirectory(record), root, undefined, { excludedPaths: review.manifest?.source === 'controller_certified_independent_proposal' ? review.manifest.exclusions.map(row => row.path) : [] }).catch(() => null);
+  return current === review.workspaceDigest;
+}
 function purposeCompletionBarrier(run) {
   const managed=run.managed;
   if(!searchEnabled(managed)) return null;
@@ -2137,8 +2351,10 @@ const pausesWithoutProgress = managed => managed.continuationPolicy === 'progres
 function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
   const managed = run.managed;
   if (managed?.continuationPolicy !== 'progress') return;
-  const current = managed.acceptanceCriteria.map(criterion => ({ id: criterion.id, statement: criterion.description }));
-  const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria }));
+  const current = [...managed.acceptanceCriteria.map(criterion => ({ id: criterion.id, statement: criterion.description })),
+    ...(managed.requirementContract?.requirements || []).map(row => ({ id: `behavior:${row.id}`, statement: row.description }))];
+  const objectiveDigest = digest(JSON.stringify({ objective: run.objective, criteria: managed.acceptanceCriteria,
+    ...(managed.requirementContract ? { requirementContract: managed.requirementContract } : {}) }));
   const results = current.flatMap(criterion => {
     const observation = managed.verified[criterion.id];
     return observation ? [{ criterion_id: criterion.id, passed: true,
@@ -2286,7 +2502,7 @@ export function decideStop(run, now = Date.now()) {
     next.reason = 'check_reported_outcome';
   }
   const selected = next.managed?.autonomyPolicy ? next.managed.decision : null;
-  const instruction = inspectCompletion ? resultFollowThroughInstruction({ completion: true }) : selected && next.managed.phase === 'action_association' ? `${associationContract(next.managed.actionAssociation.job)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping.` : selected && next.managed.phase === 'understanding' ? `Understand the current user request in this ORIGINAL conversation. ${next.managed.understandingAnswer ? `The user answered question ${next.managed.understandingAnswer.questionId}: ${next.managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected, next.managed)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${next.nextStep}` : `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${resultFollowThroughInstruction()}`;
+  const instruction = inspectCompletion ? resultFollowThroughInstruction({ completion: true }) : selected && next.managed.phase === 'action_association' ? `${associationContract(next.managed.actionAssociation.job)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping.` : selected && next.managed.phase === 'understanding' ? `${understandingTurnInstruction(next.managed, selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected, next.managed)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${next.nextStep}` : `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${resultFollowThroughInstruction()}`;
   return { run: next, output: { decision: 'block', reason: `SIMY Delivery Loop (${next.continuations} continuations). ${next.executionCwd ? `Use task execution directory ${JSON.stringify(next.executionCwd)} for task work and acceptance. ` : ''}${deliveryAcceptanceContext(next)} ${instruction}\n${purposeContract(next.managed)}\nStay within the original request and permissions. If one action lacks authorization or information, preserve that dependency and select independent authorized work. Resume this same task; do not start a replacement loop.` } };
 }
 // A process signature protects against PID reuse. Never treat a stale timer alone
@@ -2695,7 +2911,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       if (run.managed && run.checkpoint?.status === 'completed' && run.revision > run.consumedRevision) {
         await verifyAutomaticCriteria(record, now);
         const pending = pendingAcceptance(run);
-        const missingFiles = pending.filter(item => ['file_exists', 'file_contains', 'file_equals'].includes(item.check) || run.managed.liveOutcomeReview?.passed === false && item.check === 'semantic');
+        const missingFiles = pending.filter(item => ['file_exists', 'file_contains', 'file_equals', 'behavior'].includes(item.check) || run.managed.liveOutcomeReview?.passed === false && item.check === 'semantic');
         if (missingFiles.length && run.managed.autonomyPolicy && !run.managed.pendingApproval &&
             !run.managed.nativeWait && !run.managed.purpose?.nativeBoundary && !run.managed.executionUncertain) {
           // Completion reads at checkpoint time can become stale before Stop.

package/src/codex-plugins/simy/hooks/mention-router.mjs

@@ -0,0 +1,42 @@
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const MAX_INPUT_BYTES = 256 * 1024;
+
+// Detect the address only. Claude, not a keyword classifier, interprets intent.
+export function routeMention(input, pluginRoot) {
+  if (input?.hook_event_name !== 'UserPromptSubmit' || typeof input.prompt !== 'string' ||
+      !pluginRoot || !/(^|[^A-Za-z0-9_./:@-])(?:@simy(?![A-Za-z0-9_./:@-])|@(?:agent-)?simy:simy(?![A-Za-z0-9_./:@-]))/i.test(input.prompt)) return {};
+  const skill = name => JSON.stringify(join(pluginRoot, 'skills', name, 'SKILL.md'));
+  return { hookSpecificOutput: {
+    hookEventName: 'UserPromptSubmit',
+    additionalContext: `SIMY request routing for this submitted message. Parent conversation identity supplied by Claude: ${JSON.stringify(typeof input.session_id === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(input.session_id) ? input.session_id : null)}. If unavailable, obtain the original identity before any control:
+
+Interpret the latest user's complete message in its conversation context, including Japanese and English. The @simy address or SIMY agent selection is not itself authorization. A SIMY subagent returns advice only; the parent Claude conversation must perform authorized controls using its own verified identity, never a child session ID. Do not classify intent by isolated keywords.
+For an explicit request to continue or take over the original work, inspect/disable Auto Continue, or stop/wait, read and follow ${skill('continue')}.
+For diagnosis, why work stopped, or repair of a stopped task, read and follow ${skill('diagnose')}. Diagnosis alone does not authorize repair or continuation.
+For an explicit quality check or SQM request, read and follow ${skill('sqm-loop')}.
+For an explicit PR review, read and follow ${skill('pr-review')}. A review alone does not authorize implementing fixes.
+A task stop is distinct from turning Auto Continue off: use the original task's existing controls and clarify if the requested stop is ambiguous. For questions about SIMY, answer the question. Quoted text, examples, code blocks, reported speech, hypotheticals, negation, or a request to wait/stop are not authorization to start work. If a quoted example accompanies a separate genuine request, follow only that request.
+Handle explicitly requested combined intents within each skill's scope. Continuing work does not imply SQM. If the intended action is ambiguous, clarify it instead of enabling work by default.
+Preserve the exact original Claude conversation and its verified identity, permissions, stops, approval waits and opt-outs. Never create another task or provider session to bypass those boundaries. Do not treat a mention, chosen skill or accepted setting as proof that execution succeeded.`,
+  } };
+}
+
+export async function main({ stream = process.stdin, output = process.stdout, env = process.env } = {}) {
+  let result = {};
+  try {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of stream) {
+      const buffer = Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > MAX_INPUT_BYTES) { output.write('{}\n'); return; }
+      chunks.push(buffer);
+    }
+    result = routeMention(JSON.parse(Buffer.concat(chunks).toString('utf8')), env.CLAUDE_PLUGIN_ROOT);
+  } catch { /* A malformed hook input must not block the user's message. */ }
+  output.write(JSON.stringify(result) + '\n');
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) await main();