@awak-app/simy-cli 0.7.4 → 0.7.6

package/src/session-supervision/consistency-auditor.js

@@ -2,13 +2,14 @@ import { completionClaimUnbound } from '../codex-plugins/simy/hooks/completion-b
 import { createHash, randomUUID } from 'node:crypto';
 import { automaticContinuationAllowed, queuePurposeVerification, processIdentity, readRecord, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { purposeDiagnosisPlan } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
-import { reconcileFindings } from '../codex-plugins/simy/hooks/purpose-evidence.mjs';
+import { reconcileFindings, evidenceExcerpt } from '../codex-plugins/simy/hooks/purpose-evidence.mjs';
 import { requireProviderLink } from '../provider-links.js';
 import { executeCodexAppServer, openCodexAppServer, readCodexSession } from './codex-app-server.js';
 import { pauseOrigin } from './autonomous-upgrade.js';
 import { realpath } from 'node:fs/promises';
 import { leaseOwnerDead } from './workspace-lease.js';
 
+const isOpinionOnly = findings => findings.length > 0 && findings.every(row => row.code === 'outcome_alignment');
 const contract = record => createHash('sha256').update(JSON.stringify([record.run.id, record.run.revision,
   record.run.objective, record.run.managed.acceptanceCriteria, record.autoContinueEpoch])).digest('hex');
 export const canAuditOutcome = record => record?.provider === 'codex' && record.autoContinue === true &&
@@ -22,6 +23,33 @@ export const canAuditOutcome = record => record?.provider === 'codex' && record.
   !(Number.isFinite(record.run.maxContinuations) && record.run.continuations >= record.run.maxContinuations) &&
   !(record.run.managed.outcomeAudit?.usageReceipts?.filter(row => !row.settled).length >= 128) && !record.run.managed.usageBlocked && !(record.run.managed.maxTokens && record.run.managed.tokensUsed >= record.run.managed.maxTokens);
 
+// Lease accounting is recovery bookkeeping, not permission to start an audit.
+// Reach it even when a legacy worker lease coexists with the audit lease.
+export async function recoverOutcomeAuditLease(record, { root, writeRecord = updateRecord, inspectProcess = processIdentity } = {}) {
+  const oldLease = record?.run?.managed?.outcomeAudit?.lease;
+  if (!oldLease) return record;
+  const oldOwnerDead = await leaseOwnerDead(oldLease.owner, inspectProcess);
+  if (!(Date.now() >= oldLease.expiresAt || oldOwnerDead)) return record;
+  const boundWrite = (root, provider, session, mutate) => writeRecord(root, provider, session, live => {
+    if (live?.run?.id !== record.run.id || live.run.managed?.taskId !== record.run.managed.taskId ||
+        live.run.managed.outcomeAudit?.lease?.id !== oldLease.id) return live;
+    return mutate(live);
+  });
+  // Keep unknown consumption and hard-budget blocks before releasing the lease.
+  await accountAuditUsage(root, record, oldLease.id, null, boundWrite);
+  return boundWrite(root, record.provider, record.session, live => {
+    const audit = live.run.managed.outcomeAudit;
+    delete audit.lease;
+    // Expiry fences late results; only confirmed death settles late-usage slots.
+    if (oldOwnerDead) {
+      const receipt = audit.usageReceipts?.find(row => row.id === oldLease.id);
+      if (receipt) receipt.settled = true;
+    }
+    audit.lastFailure = { at: Date.now(), code: 'audit_owner_exited', requestId: oldLease.requestId, attemptId: oldLease.id };
+    return live;
+  });
+}
+
 // A distinct provider context reads original instructions and primary evidence.
 // It has its own read-only lease; original turns are never resumed or edited.
 async function auditConsistencyAttempt(record, findings, request, { root, signal,
@@ -36,34 +64,18 @@ async function auditConsistencyAttempt(record, findings, request, { root, signal
   signal?.throwIfAborted();
   const key = contract(record), id = request.attemptId;
   const owner = { pid: process.pid, identity: await processIdentity(process.pid) };
-  const oldLease = record.run.managed.outcomeAudit?.lease;
-  const oldOwnerDead = oldLease && await leaseOwnerDead(oldLease.owner, processIdentity);
-  if (oldLease && (Date.now() >= oldLease.expiresAt || oldOwnerDead)) {
-    // The final provider total cannot be recovered from a dead owner's memory.
-    await accountAuditUsage(root, record, oldLease.id, null, writeRecord);
-    await writeRecord(root, record.provider, record.session, live => {
-    if (live?.run?.managed?.outcomeAudit?.lease?.id === oldLease.id) {
-      delete live.run.managed.outcomeAudit.lease;
-      // A confirmed dead process cannot deliver late usage. Settle its dedupe
-      // slot, while retaining unknown consumption and every hard-budget block.
-      // Expiry alone does not prove death, so live-owner receipts stay pending.
-      if (oldOwnerDead) {
-        const receipt = live.run.managed.outcomeAudit.usageReceipts?.find(row => row.id === oldLease.id);
-        if (receipt) receipt.settled = true;
-      }
-      live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: 'audit_owner_exited' };
-    }
-    return live;
-  });
-  }
   const claimed = await writeRecord(root, record.provider, record.session, live => {
     if (signal?.aborted || !canAuditOutcome(live) || contract(live) !== key || live.run.managed.outcomeAudit?.lease) return live;
     live.run.managed.outcomeAudit = { ...live.run.managed.outcomeAudit,
+      lastAttempt: { requestId: request.id, attemptId: id, stage: 'preparing', session: null },
       lease: { id, owner, requestId: request.id, contract: key, startedAt: Date.now(), expiresAt: request.deadlineAt } };
     return live;
   });
   if (claimed?.run?.managed?.outcomeAudit?.lease?.id !== id) return { received: false, reason: 'audit_lease_busy' };
   const view = structuredClone(claimed), m = view.run.managed;
+  // Routine purpose alignment asks for a colleague's opinion. Existing outcome
+  // gaps and completion verification retain the canonical acceptance path.
+  const opinionOnly = isOpinionOnly(findings);
   const plan = purposeDiagnosisPlan(m, 'Independently compare the original user request and later corrections with actual outcomes. Inspect omitted targets, runtime adoption, existing state, evidence and remaining work; do not accept an implementer plan as the original goal.');
   m.autonomyPolicy = 'autonomous'; m.resumeModel = metadata.model;
   m.purpose = { ...m.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102' };
@@ -82,38 +94,72 @@ async function auditConsistencyAttempt(record, findings, request, { root, signal
   signal?.addEventListener('abort', abort, { once: true });
   if (signal?.aborted) abort();
   let result;
+  let diagnosticClosed = false, activityObserved = false, diagnosticWrites = Promise.resolve();
+  const retainDiagnostic = (stage, sessionId) => {
+    if (diagnosticClosed || controller.signal.aborted) return Promise.resolve();
+    diagnosticWrites = diagnosticWrites.then(() => writeRecord(root, record.provider, record.session, live => {
+      const audit = live?.run?.managed?.outcomeAudit;
+      if (diagnosticClosed || controller.signal.aborted || Date.now() >= request.deadlineAt ||
+          !canAuditOutcome(live) || contract(live) !== key || audit?.lease?.id !== id ||
+          audit.lease.requestId !== request.id || audit.lastAttempt?.attemptId !== id ||
+          audit.lastAttempt.requestId !== request.id) return live;
+      if (sessionId && audit.lastAttempt.session && audit.lastAttempt.session !== sessionId) return live;
+      audit.lastAttempt.stage = stage;
+      if (sessionId) audit.lastAttempt.session = sessionId;
+      return live;
+    }));
+    diagnosticWrites.catch(() => controller.abort());
+    return diagnosticWrites;
+  };
   let usage = null, usageWrites = Promise.resolve();
   try {
-    result = await execute(view, { root, signal: controller.signal, openClient, auditOnly: true, authorizePreparation:beforeDispatch, beforeDispatch,
+    result = await execute(view, { root, signal: controller.signal, openClient, auditOnly: true, opinionOnly, peerAction: record.run.managed.decision?.action, authorizePreparation:beforeDispatch,
+      beforeDispatch: async () => { await beforeDispatch(); await retainDiagnostic('dispatching'); },
+      onEvidence: evidence => {
+        const context = evidence?.workerContext;
+        if (evidence?.source !== 'adapter_capture' || evidence.actionId !== id || context?.originalSession !== record.session ||
+            typeof context.session !== 'string' || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(context.session) || context.session === record.session) return;
+        return retainDiagnostic('session_bound', context.session);
+      },
+      onActivity: () => { if (!activityObserved) { activityObserved = true; retainDiagnostic('provider_active'); } },
       onUsage: value => { usage = value; usageWrites = usageWrites.then(() => accountAuditUsage(root, record, id, value, writeRecord)); usageWrites.catch(() => controller.abort()); if (m.maxTokens && Number.isFinite(value?.tokens) && (m.tokensUsed || 0) + value.tokens >= m.maxTokens) controller.abort(); } });
+    await retainDiagnostic('result_received');
     await beforeDispatch();
-    const review = result.verification;
+    const review = opinionOnly ? result.opinion : result.verification;
     if (!review || review.source !== 'independent_codex_session' || !review.session || review.session === record.session) throw new Error('Independent audit provenance unavailable.');
+    if (opinionOnly && (typeof review.text !== 'string' || !review.text.trim())) throw new Error('Independent opinion was empty.');
     let persisted = false;
     await writeRecord(root, record.provider, record.session, live => {
       if (signal?.aborted || Date.now() >= request.deadlineAt || !live?.run?.managed || contract(live) !== key || live.run.managed.outcomeAudit?.lease?.id !== id || !canAuditOutcome(live)) return live;
       const audit = live.run.managed.outcomeAudit;
-      audit.lastReport = review; audit.lastSuccessAt = Date.now(); audit.requestId = request.id;
+      if (opinionOnly) audit.lastOpinion = { source: review.source, session: review.session, ...(review.model ? { model: review.model } : {}), text: evidenceExcerpt(review.text, 2000).text, at: Date.now() };
+      else audit.lastReport = review;
+      audit.lastSuccessAt = Date.now(); audit.requestId = request.id;
       audit.targetContract = key; audit.lastFailure = null;
       // Existing finding reconciliation enforces stable IDs, counterevidence
       // and reopen reasons. A delivered audit never certifies task completion.
-      if (completionClaimUnbound(live)) {
+      if (!opinionOnly && completionClaimUnbound(live)) {
         audit.completionRecovery = { at: Date.now(), priorState: live.run.state, priorRevision: live.run.revision };
         live.run.revision++;
         queuePurposeVerification(live.run, 'Prior terminal claim has no current controller completion receipt. Independently recheck the original frozen acceptance and remaining defects; an audit report alone cannot certify completion.', Date.now());
-      } else if (live.run.managed.purpose?.enabled) reconcileFindings(live.run.managed, review, Date.now());
+      } else if (!opinionOnly && live.run.managed.purpose?.enabled) reconcileFindings(live.run.managed, review, Date.now());
       persisted = true;
       return live;
     });
-    return { received: true, audited: persisted, ...(persisted ? { passed: review.passed } : { reason: 'target_changed' }) };
+    return opinionOnly && persisted ? { received: true, advised: true } : { received: true, audited: persisted, ...(persisted ? { passed: review.passed } : { reason: 'target_changed' }) };
   } catch (error) {
-    const safeCode = ['cancelled', 'closed', 'identity', 'unsupported', 'approval', 'permission_restore', 'manual_provider_action', 'timeout'].includes(error?.code) ? error.code : 'independent_audit_failed';
+    // Persist only fixed classifications, never provider exception text or metadata.
+    const safeCode = ['cancelled', 'closed', 'identity', 'unsupported', 'approval', 'permission_restore', 'manual_provider_action', 'timeout',
+      'unavailable', 'authentication_required', 'permission_narrowed', 'provider_approval', 'archived', 'context_unavailable',
+      'checkpoint', 'decision', 'response_too_large', 'revision_changed', 'turn_failed', 'turn_settling'].includes(error?.code) ? error.code : 'independent_audit_failed';
     await writeRecord(root, record.provider, record.session, live => {
-      if (live?.run?.managed?.outcomeAudit?.lease?.id === id) live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: safeCode };
+      if (live?.run?.managed?.outcomeAudit?.lease?.id === id) live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: safeCode, requestId: request.id, attemptId: id };
       return live;
     });
     return { received: true, audited: false, reason: 'independent_audit_failed' };
   } finally {
+    diagnosticClosed = true;
+    try { await diagnosticWrites; } catch { /* The attempt already failed closed. */ }
     signal?.removeEventListener('abort', abort);
     let usageWriteFailed = false;
     try { await usageWrites; } catch { usageWriteFailed = true; }
@@ -132,7 +178,7 @@ async function accountAuditUsage(root, record, id, observed, writeRecord = updat
   await writeRecord(root, record.provider, record.session, live => {
     if (!live?.run?.managed || live.run.id !== record.run.id || live.run.managed.taskId !== record.run.managed.taskId) return live;
     const audit = live.run.managed.outcomeAudit ||= {};
-    const measured = observed?.source === 'codex_app_server' && Number.isSafeInteger(observed.tokens) && observed.tokens >= 0;
+    const measured = ['codex_app_server', 'codex_exec'].includes(observed?.source) && Number.isSafeInteger(observed.tokens) && observed.tokens >= 0;
     audit.usageReceipts ||= [];
     let receipt = audit.usageReceipts.find(row => row.id === id);
     if (!receipt) { receipt = { id, tokens: 0, source: measured ? 'measured' : 'unknown' }; audit.usageReceipts.push(receipt); }
@@ -155,17 +201,25 @@ async function accountAuditUsage(root, record, id, observed, writeRecord = updat
 // An inspection deadline bounds one read-only audit, not the user's task.
 // Abort fences all late report adoption. Original effect leases are untouched.
 export async function auditConsistencyTask(record, findings, request, options = {}) {
+  record = await recoverOutcomeAuditLease(record, options);
   if (!canAuditOutcome(record)) return { received: false, reason: 'audit_boundary' };
   const controller = new AbortController();
   const abort = () => controller.abort();
   options.signal?.addEventListener('abort', abort, { once: true });
   if (options.signal?.aborted) abort();
   const attemptId = randomUUID();
-  const timeoutMs = options.auditTimeoutMs ?? 120_000;
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('Invalid audit inspection deadline.');
+  // Full outcome inspection reads artifacts and checks the original contract.
+  // Keep it finite, but do not give it the tools-disabled opinion's deadline.
+  const requestedTimeout = options.auditTimeoutMs ?? (isOpinionOnly(findings) ? 120_000 : 300_000);
+  if (!Number.isFinite(requestedTimeout) || requestedTimeout <= 0) throw new Error('Invalid audit inspection deadline.');
+  const deadlineAt = Math.min(Date.now() + requestedTimeout,
+    Number.isFinite(record.run.deadline) ? record.run.deadline : Infinity);
+  const timeoutMs = Math.max(1, deadlineAt - Date.now());
   let timer, writes = Promise.resolve();
   const writeRecord = (...args) => {
     const pending = writes.catch(() => {}).then(async () => {
+      // The standard writer already bounds acquisition retries before mutation.
+      if (!options.writeRecord) return updateRecord(...args);
       for (let retry = 0; ; retry++) {
         try { return await (options.writeRecord || updateRecord)(...args); }
         catch (error) {
@@ -176,7 +230,6 @@ export async function auditConsistencyTask(record, findings, request, options =
     });
     writes = pending; return pending;
   };
-  const deadlineAt = Date.now() + timeoutMs;
   let attemptFinished = false, outerFinished = false;
   const settleReceipt = async () => {
     await writeRecord(options.root, record.provider, record.session, live => {
@@ -201,7 +254,7 @@ export async function auditConsistencyTask(record, findings, request, options =
       await writeRecord(options.root, record.provider, record.session, live => {
         if (live?.run?.managed?.outcomeAudit?.lease?.id === attemptId) {
           delete live.run.managed.outcomeAudit.lease;
-          live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: 'audit_timeout' };
+          live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: 'audit_timeout', requestId: request.id, attemptId };
         }
         return live;
       });

package/src/session-supervision/index.js

@@ -4,7 +4,7 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
@@ -554,3 +554,24 @@ export async function continueSession(options) {
 export async function answerSession({ root, provider, session, taskId, expectedRunId, expectedRevision, questionId, answer, now = Date.now() }) {
   return controlDelivery({ root, provider, session, taskId, expectedRunId, expectedRevision, questionId, answer, action: 'session_answer', now });
 }
+
+// Explicit user resume observes the existing native conversation. A model
+// selection changed in Codex is configuration, not a different task or authority.
+export async function resumeSession({ openClient = openCodexAppServer, ...options }) {
+  const record = await readRecord(options.root, options.provider, options.session);
+  if (options.provider !== 'codex' || record?.run?.managed?.resumeChannel !== 'codex_app_server')
+    return controlDelivery({ ...options, action: 'resume' });
+  if (record.run.managed.taskId !== options.taskId) throw new Error('Managed task identity changed; refresh its status.');
+  const link = await requireProviderLink(options);
+  const client = await openClient({ isolateConnectors: true });
+  let metadata;
+  try { metadata = await readCodexSession(client, options.session); }
+  finally { await client.close(); }
+  const cwd = await realpath(metadata.cwd);
+  if (cwd !== record.cwd || !metadata.model) throw new Error('Original Codex workspace or model is unavailable; inspect before resuming.');
+  await requireProviderLink({ ...options, expectedEpoch: link.epoch });
+  return controlDelivery({ ...options, action: 'resume',
+    expectedRunId: options.expectedRunId ?? record.run.id,
+    expectedRevision: options.expectedRevision ?? deliveryDecisionRevision(record.run),
+    resumeObservation: { session: metadata.session, cwd, model: metadata.model, source: 'codex_app_server', providerEpoch: link.epoch } });
+}

package/src/session-supervision/native-delegation.js

@@ -0,0 +1,86 @@
+import { isAbsolute, relative, join } from 'node:path';
+import { requireProviderLink } from '../provider-links.js';
+import { createHash } from 'node:crypto';
+import { realpath, open } from 'node:fs/promises';
+import { taskDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+
+export const authorityDigest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+
+// New explicit delegation is separate from historical enrollment. It never
+// authorizes connectors or overrides a subsequently narrowed native policy.
+export async function delegatedNativeSandbox(record, kind, root, { signal } = {}) {
+  if (!['read', 'local_edit', 'local_test'].includes(kind)) return null;
+  const grant = record.run?.managed?.nativeDelegation;
+  if (!grant) return null;
+  const { digest, ...body } = grant;
+  if (digest !== authorityDigest(body) || body.schema !== 1 || body.source !== 'explicit_native_redelegation' ||
+      body.taskId !== record.run.managed.taskId || body.runId !== record.run.id || body.session !== record.session ||
+      body.cwd !== record.cwd || body.executionCwd !== taskDirectory(record) ||
+      body.consentEpoch !== (record.providerConsentEpoch ?? null) || !body.consentRef ||
+      body.observation?.type !== 'sdk_rollout_turn_context' || body.observation.session !== record.session ||
+      body.observation.policyDigest !== authorityDigest(body.policy)) return null;
+  try { if (await realpath(body.observation.cwd) !== record.cwd) return null; } catch { return null; }
+  try { await requireProviderLink({ root, provider: record.provider, expectedEpoch: body.providerEpoch }); } catch { return null; }
+  // A local-only renewal is narrower than the observed native ceiling.
+  // Network/connector use needs separate existing authority.
+  const gitRoots = await authorizedWorktreeGitRoots(body.executionCwd, body.cwd, [body.policy], { signal });
+  return { type: 'workspaceWrite', writableRoots: [body.executionCwd, ...gitRoots], networkAccess: false,
+    excludeTmpdirEnvVar: true, excludeSlashTmp: true };
+}
+
+export function canWriteWorkspace(sandbox, cwd, sessionCwd) {
+  if (sandbox?.type === 'dangerFullAccess') return true;
+  if (sandbox?.type !== 'workspaceWrite' || !Array.isArray(sandbox.writableRoots)) return false;
+  // Codex workspaceWrite always includes its verified thread cwd. The roots
+  // array lists *additional* writable directories and is usually empty.
+  return [sessionCwd, ...sandbox.writableRoots].some(root => {
+    if (typeof root !== 'string' || !isAbsolute(root)) return false;
+    const path = relative(root, cwd);
+    return !isAbsolute(path) && path !== '..' && !path.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`);
+  });
+}
+
+
+// Linked worktrees keep their index and object/ref store outside their checkout.
+// Only the original repository's registered link can supply additional roots,
+// and every native ceiling must already cover them. This is not a new grant.
+export async function authorizedWorktreeGitRoots(cwd, sessionCwd, policies, { signal } = {}) {
+  if (!policies?.length) return [];
+  try {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_')));
+    const git = async (where, args) => (await exec('git', ['-C', where, ...args], {
+      env, timeout: 5000, maxBuffer: 64 * 1024, windowsHide: true, signal,
+    })).stdout.trim();
+    const checkout = await realpath(cwd), original = await realpath(sessionCwd);
+    const top = await realpath(await git(checkout, ['rev-parse', '--show-toplevel']));
+    if (top !== checkout) return [];
+    const gitDir = await realpath(await git(checkout, ['rev-parse', '--absolute-git-dir']));
+    const common = await realpath(await git(checkout, ['rev-parse', '--path-format=absolute', '--git-common-dir']));
+    // Ordinary checkouts need no extra worktree administration outside cwd.
+    if (gitDir === common) return [];
+    const originalCommon = await realpath(await git(original, ['rev-parse', '--path-format=absolute', '--git-common-dir']));
+    if (common !== originalCommon || !canWriteWorkspace({ type: 'workspaceWrite', writableRoots: [] }, gitDir, join(common, 'worktrees'))) return [];
+    // A forged .git pointer must not expose another checkout's administration.
+    const file = await open(join(gitDir, 'gitdir'), constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    let backlink;
+    try {
+      const stat = await file.stat();
+      if (!stat.isFile() || stat.size > 8192 || signal?.aborted) return [];
+      const buffer = Buffer.alloc(8193);
+      const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+      if (bytesRead > 8192 || signal?.aborted) return [];
+      backlink = buffer.subarray(0, bytesRead).toString('utf8').trim();
+    } finally { await file.close(); }
+    if (await realpath(backlink) !== await realpath(join(checkout, '.git'))) return [];
+    const roots = [...new Set([gitDir, common])];
+    // workspace-write protects .git implicitly. An enclosing cwd/root does not
+    // authorize making Git metadata writable; require an exact explicit root.
+    if (!roots.every(path => policies.every(policy => policy?.type === 'dangerFullAccess' || policy?.type === 'workspaceWrite' && policy.writableRoots?.some(root => root === path)))) return [];
+    return roots;
+  } catch { return []; }
+}

package/src/session-supervision/purpose-instruction.js

@@ -1,3 +1,4 @@
+import { recallPerspectives, perspectiveInstruction } from '../codex-plugins/simy/hooks/perspective-memory.mjs';
 import { loadHypothesisKnowledge, hypothesisKnowledgeInstruction } from '../sqm/hypothesis-knowledge.js';
 import { selectiveRuleReview, applicableRuleIds } from '../codex-plugins/simy/hooks/purpose-rule-policy.mjs';
 import { searchInstruction } from '../codex-plugins/simy/hooks/purpose-search.mjs';
@@ -38,12 +39,13 @@ export async function loadPurposeRuleSet() {
   if (!rules.length || new Set(rules.map(rule => rule.id)).size !== rules.length) throw new Error('Purpose rule index is empty or ambiguous.');
   return { digest: createHash('sha256').update(JSON.stringify(sources)).digest('hex'), rules };
 }
-export async function buildPurposeInstruction(managed, { reviewer = false, cwd, webOrigin, allowNetwork = false, signal, knowledgeLoader = loadHypothesisKnowledge, authorizeKnowledgeNetwork } = {}) {
+export async function buildPurposeInstruction(managed, { reviewer = false, cwd, webOrigin, allowNetwork = false, signal, knowledgeLoader = loadHypothesisKnowledge, authorizeKnowledgeNetwork, root: memoryRoot, record, memoryLoader = recallPerspectives } = {}) {
   if (!managed?.purpose?.enabled) return '';
   const ruleSet = await loadPurposeRuleSet();
   if (ruleSet.digest !== managed.purpose.ruleDigest) throw Object.assign(new Error('Purpose workflow changed; refresh its rule inventory before dispatch.'), { code: 'purpose_rules_changed' });
   if (reviewer && selectiveRuleReview(managed)) return `${llmDecisionInstruction}\nIndependently verify the original acceptance criteria and applicable canonical obligations from actual evidence. Consult the inventory as needed after forming an LLM judgment; do not enumerate every ID or impose core controls as universal checklist gates. Report only rules actually evaluated; omitted inventory entries are not passed or not_applicable. Known applicable obligations ${JSON.stringify(applicableRuleIds(managed))} must be independently assessed and cannot be discarded by worker claims. Do not copy worker dispositions as proof. Failed, unavailable or missing evidence remains unverified with a concrete acquisition/repair finding. No unrelated rule coverage obligation is implied.\nruleSet: ${JSON.stringify(ruleSet.rules.map(rule => ({ ...rule, path: fileURLToPath(new URL(rule.file, root)) })))}`;
   if (reviewer) return `${llmDecisionInstruction}\nCanonical rule inventory. Review applicability and evidence for EVERY ID, including HC-01 through HC-102; these controls are requirements, not proof that their mechanisms exist. Read the referenced sections and acceptance details as needed. User instructions retain priority. Do not impose unrelated development/release controls on other task types. Core controls ${CORE_CONTROL_IDS.join(', ')} apply to every autonomous task; inspect their actual bounded behavior, including conditional duties whose trigger did not occur, rather than marking the entire control not_applicable. Return rules:[{id,evidenceRefs:[{ref,target,observation}],status:"satisfied|failed|unverified|not_applicable",basis:"inspected evidence or specific applicability reason"}]. Keep basis concise with source locators; stored receipts are limited to 160 UTF-8 bytes and basisTruncated means re-read the original evidence. Never copy worker dispositions as independent proof. Missing capability is unverified and requires an acquisition/repair finding, not a human certification request.\nruleSet: ${JSON.stringify(ruleSet.rules.map(rule => ({ ...rule, path: fileURLToPath(new URL(rule.file, root)) })))}`;
   const knowledge = await knowledgeLoader({ cwd, webOrigin, allowNetwork, signal, ...(authorizeKnowledgeNetwork ? { authorizeNetwork: authorizeKnowledgeNetwork } : {}) });
-  return `${purposeContract(managed)}\n${hypothesisKnowledgeInstruction(knowledge)}\n${searchInstruction(managed)}\nForm a grounded candidate judgment with LLM reasoning first; consult the applicable canonical rule sections using read tools to challenge that judgment before its effects. This ruleSet is authoritative workflow material; user instructions retain priority. ${selectiveRuleReview(managed) ? "Review applicable rules and known obligations only; do not require full inventory coverage." : "Use the purpose contract for full initial rule coverage and changed dispositions on subsequent search turns."} Missing sources or unavailable tools remain unverified; do not fabricate coverage. Repository AGENTS.md and explicit user constraints also apply.\nruleSet: ${JSON.stringify(ruleSet.rules.map(rule => ({ ...rule, path: fileURLToPath(new URL(rule.file, root)) })))}\nPrior rule dispositions (provider reported, re-evaluate applicability): ${JSON.stringify(managed.purpose.version === 2 ? managed.purpose.lastReview?.rules || [] : [])}\nLast purpose review (provider reported): ${JSON.stringify(managed.purpose.lastReview ? { gap: managed.purpose.lastReview.gap, hypothesis: managed.purpose.lastReview.hypothesis, noChangeAssessment: managed.purpose.lastReview.noChangeAssessment, observations: managed.purpose.lastReview.observations, unresolvedRules: managed.purpose.lastReview.rules.filter(rule => ['failed', 'unverified'].includes(rule.status)) } : null)}\nRecovery context: ${JSON.stringify(managed.purpose.lastRecovery || null)}`;
+  const memory = await memoryLoader({ root: memoryRoot, record, signal });
+  return `${purposeContract(managed)}\n${perspectiveInstruction(memory)}\n${hypothesisKnowledgeInstruction(knowledge, { flexible: selectiveRuleReview(managed) })}\n${searchInstruction(managed)}\nForm a grounded candidate judgment with LLM reasoning first; consult the applicable canonical rule sections using read tools to challenge that judgment before its effects. This ruleSet is authoritative workflow material; user instructions retain priority. ${selectiveRuleReview(managed) ? "Review applicable rules and known obligations only; do not require full inventory coverage." : "Use the purpose contract for full initial rule coverage and changed dispositions on subsequent search turns."} Missing sources or unavailable tools remain unverified; do not fabricate coverage. Repository AGENTS.md and explicit user constraints also apply.\nruleSet: ${JSON.stringify(ruleSet.rules.map(rule => ({ ...rule, path: fileURLToPath(new URL(rule.file, root)) })))}\nPrior rule dispositions (provider reported, re-evaluate applicability): ${JSON.stringify(managed.purpose.version === 2 ? managed.purpose.lastReview?.rules || [] : [])}\nLast purpose review (provider reported): ${JSON.stringify(managed.purpose.lastReview ? { gap: managed.purpose.lastReview.gap, hypothesis: managed.purpose.lastReview.hypothesis, noChangeAssessment: managed.purpose.lastReview.noChangeAssessment, observations: managed.purpose.lastReview.observations, unresolvedRules: managed.purpose.lastReview.rules.filter(rule => ['failed', 'unverified'].includes(rule.status)) } : null)}\nRecovery context: ${JSON.stringify(managed.purpose.lastRecovery || null)}`;
 }

package/src/session-supervision/purpose-recovery.js

@@ -23,15 +23,17 @@ function auditReinspectionEligible(run, now) {
 export async function observePurposeTurn(record, { openClient = openCodexAppServer } = {}) {
   const client = await openClient();
   try {
-    const session=record.run.managed.nativeWait?.session || record.session;
-    const cwd=session===record.session?record.cwd:record.run.managed.nativeWait?.cwd;
+    const wait=record.run.managed.nativeWait || record.run.managed.purpose?.nativeBoundary;
+    if (wait && !wait.session) return {state:'unknown'};
+    const session=wait?.session || record.session;
+    const cwd=session===record.session?record.cwd:wait?.cwd;
     if(!cwd)return {state:'unknown'};
     const metadata = await readCodexSession(client, session);
     if (await realpath(metadata.cwd) !== cwd || metadata.model !== record.run.managed.resumeModel) return { state: 'unknown' };
     const result = await client.request('thread/turns/list', { threadId: session, limit: 1, sortDirection: 'desc', itemsView: 'summary' });
     const turn = result?.data?.[0];
     if (!turn?.id || !['completed', 'failed', 'interrupted', 'inProgress'].includes(turn.status)) return { state: 'unknown' };
-    return { state: turn.status === 'inProgress' ? 'running' : 'idle', turnId: turn.id, status: turn.status };
+    return { state: turn.status === 'inProgress' ? 'running' : 'idle', turnId: turn.id, status: turn.status, session, cwd };
   } finally { await client.close(); }
 }
 
@@ -50,7 +52,7 @@ export async function observeUpgradeMetadata(record, { openClient = openCodexApp
   finally { await client.close(); }
 }
 
-export async function reconcilePurposeTasks({ root, signal, prepareCandidate = preparePurposeCandidate, now = Date.now(), observeTurn = observePurposeTurn, observeAuthentication = observeCodexAuthentication, readRecords = () => listRecords(root), observeMetadata = observeUpgradeMetadata }) {
+export async function reconcilePurposeTasks({ root, signal, prepareCandidate = preparePurposeCandidate, now = Date.now(), observeTurn = observePurposeTurn, observeAuthentication = observeCodexAuthentication, readRecords = () => listRecords(root), observeMetadata = observeUpgradeMetadata, writeRecord = updateRecord }) {
   const started = Date.now();
   let rules;
   const deferred = [];
@@ -101,11 +103,30 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
       if (!latest || !automaticContinuationAllowed(latest) || latest.run?.id !== run.id || latest.autoContinueEpoch !== record.autoContinueEpoch || ['paused', 'stopped'].includes(latest.run.state)) throw new Error('Purpose observation authorization changed.');
     };
     const observe = async read => { await authorized(); const result = await read(); await authorized(); return result; };
-    const persist = mutate => updateRecord(root, record.provider, record.session, async current => {
+    const persist = mutate => writeRecord(root, record.provider, record.session, async current => {
       try { await requireProviderLink({ root, provider: record.provider, expectedEpoch: link.epoch }); } catch { return current; }
       if (!current || !automaticContinuationAllowed(current) || current.autoContinueEpoch !== record.autoContinueEpoch) return current;
       return mutate(current);
     });
+    // Recheck the current budget and boundaries under the existing record lock.
+    // Audit usage can change without changing the run revision or updatedAt.
+    const nativeCurrent = current => {
+      const latest = current?.run, managed = latest?.managed;
+      return latest?.id === run.id && latest.revision === run.revision && latest.state === run.state && latest.updatedAt === run.updatedAt &&
+        !['paused', 'stopped', 'completed', 'budget_exhausted'].includes(latest.state) && !managed.resumeLease &&
+        !managed.pendingApproval && !managed.liveWorkspaceLease && !managed.outcomeAudit?.lease &&
+        !['pending', 'transferred', 'pending_received'].includes(managed.handoff?.status) && !managed.rejectedActionOverflow &&
+        !managed.rejectedActionDigests?.includes(createHash('sha256').update(JSON.stringify(managed.decision?.action ?? null)).digest('hex')) &&
+        !managedBudgetReason(latest, Date.now()) &&
+        JSON.stringify(managed.nativeWait) === JSON.stringify(run.managed.nativeWait) &&
+        JSON.stringify(managed.purpose.nativeBoundary) === JSON.stringify(run.managed.purpose.nativeBoundary);
+    };
+    const nativeSessionMatches = observed => {
+      const wait = run.managed.nativeWait || run.managed.purpose.nativeBoundary;
+      const boundary = run.managed.purpose.nativeBoundary;
+      return Boolean(observed.session && observed.session === (wait ? wait.session : record.session) &&
+        (!boundary || boundary.session === observed.session));
+    };
     rules ||= await loadPurposeRuleSet();
     if (run.managed.purpose.ruleDigest !== rules.digest && run.state !== 'auto_resuming') {
       record = await persist(current => {
@@ -122,15 +143,19 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
     }
     if (run.managed.purpose.nativeBoundary && !run.managed.resumeLease && now >= (run.managed.purpose.nativeObservedAt || 0) + 60_000) {
       let native;try {native=await observe(()=>observeTurn(record));} catch {native={state:'unknown'};}
+      if (!nativeSessionMatches(native)) continue;
+      let persisted = false;
       await persist(current=>{
-        if(current?.run?.id !== run.id || current.run.revision !== run.revision) return current;
+        if(!nativeCurrent(current)) return current;
+        persisted = true;
         const purpose=current.run.managed.purpose;purpose.nativeObservedAt=now;purpose.nativeObservation=native;
         if(native.status==='completed' && native.turnId===purpose.nativeBoundary?.turnId && purpose.nativeBoundary.state!=='writer_completed_requires_verification') {
           purpose.nativeBoundary={...purpose.nativeBoundary,state:'writer_completed_requires_verification',writer:'completed',completedTurnId:native.turnId,observedAt:now};
-          queuePurposeVerification(current.run,'Original pending turn completed; independently inspect its actual result and reconcile effects without replaying the operation.',now);
-        } else if (native.status==='completed' && native.turnId && native.turnId!==purpose.nativeBoundary?.turnId && native.turnId!==purpose.lastOwnedTurnId) {delete purpose.nativeBoundary;current.run.managed.nativeWait=null;purpose.nextSearchAt=0;}
+          queuePurposeVerification(current.run,'Original pending turn completed; independently inspect its actual result and reconcile effects without replaying the operation.',Date.now());
+        } else if (native.session===record.session && native.status==='completed' && native.turnId && native.turnId!==purpose.nativeBoundary?.turnId && native.turnId!==purpose.lastOwnedTurnId) {delete purpose.nativeBoundary;current.run.managed.nativeWait=null;purpose.nextSearchAt=0;}
         return current;
       });
+      if (!persisted) continue;
       record=await readRecord(root,record.provider,record.session);run=record.run;
     }
     if (searchEnabled(run.managed) && run.managed.purpose.nativeBoundary && run.state==='blocked' && !run.managed.resumeLease &&
@@ -200,25 +225,31 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
         if (now < (run.managed.purpose.lastObservedAt || 0) + 60_000) continue;
         let observed;
         try { observed = await observe(() => observeTurn(record)); } catch { observed = { state: 'unavailable' }; }
+        if (!nativeSessionMatches(observed)) continue;
+        let persisted = false;
         await persist(current => {
-          if (current?.run?.id !== run.id || current.run.state !== 'blocked' || current.run.revision !== run.revision) return current;
+          if (!nativeCurrent(current)) return current;
+          persisted = true;
           current.run.managed.purpose.lastObservedAt = now;
           current.run.managed.purpose.observationState = observed.state;
-          if (!current.run.managed.nativeWait?.turnId && observed.turnId) current.run.managed.nativeWait = { turnId: observed.turnId, observedAt: now };
+          if (!current.run.managed.nativeWait?.turnId && observed.turnId) current.run.managed.nativeWait = { turnId: observed.turnId, session: observed.session, cwd: observed.cwd, observedAt: now };
           return current;
         });
+        if (!persisted) continue;
         // A failed/interrupted owned turn or merely elapsed time is not a user
         // answer. A subsequent completed original turn permits diagnosis only.
-        if (run.managed.nativeWait?.turnId && observed.status === 'completed' && observed.turnId !== run.managed.nativeWait.turnId) {
-          await persist(current => {
-            if (current?.run?.id === run.id && current.run.revision === run.revision) {
+        if (observed.session === record.session && run.managed.nativeWait?.turnId && observed.status === 'completed' && observed.turnId !== run.managed.nativeWait.turnId && observed.turnId !== run.managed.purpose.lastOwnedTurnId) {
+          let cleared = false;
+          const saved = await persist(current => {
+            if (nativeCurrent(current)) {
               current.run.managed.nativeWait = null;
               delete current.run.managed.purpose.nativeBoundary;
+              cleared = true;
             }
             return current;
           });
-          run.managed.nativeWait = null;
-          delete run.managed.purpose.nativeBoundary;
+          if (!cleared) continue;
+          record = saved; run = saved.run;
           obstacle = { type: 'native_wait_updated', detail: observed.turnId };
         } else if (searchEnabled(run.managed)) {
           obstacle = { type: 'native_wait_diagnosis', detail: run.managed.nativeWait?.turnId || 'writer_unknown' };
@@ -275,9 +306,10 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
     const key = createHash('sha256').update(JSON.stringify([run.managed.verifiedRevision, obstacle, obstacle.type === 'external_dependency' ? run.managed.purpose.dependencyChecks || 0 : null])).digest('hex');
     await persist(current => {
       if (current?.run?.id !== run.id || current.run.revision !== run.revision || current.run.state !== run.state || current.run.updatedAt !== run.updatedAt) return current;
+      if (['native_wait_updated', 'native_wait_diagnosis'].includes(obstacle.type) && !nativeCurrent(current)) return current;
       if (searchEnabled(current.run.managed) && ['original_context_updated', 'native_wait_updated'].includes(obstacle.type)) current.run.managed.purpose.nextSearchAt = 0;
       const queued = queuePurposeDiagnosis(current.run,
-        `Reassess the original purpose after ${obstacle.type}: ${obstacle.detail}. Gather evidence before deciding that a person is needed. Preserve unresolved approvals/dependencies; choose independent work or a safe alternative where possible.`, key, now);
+        `Reassess the original purpose after ${obstacle.type}: ${obstacle.detail}. Gather evidence before deciding that a person is needed. Preserve unresolved approvals/dependencies; choose independent work or a safe alternative where possible.`, key, Date.now());
       if (queued && obstacle.type === 'external_dependency') {
         const purpose = current.run.managed.purpose;
         purpose.dependencyChecks = (purpose.dependencyChecks || 0) + 1;