@awak-app/simy-cli 0.7.44 → 0.7.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.44",
+  "version": "0.7.46",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.44";
+export const CLI_VERSION = "0.7.46";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -34,6 +34,12 @@ import { associationContract, validateAssociationResult } from './action-associa
 import { minimalSufficientChangeInstruction } from './minimal-sufficient.mjs';
 import { continuationMode } from './continuation-policy.mjs';
 import { evaluateOutcomeProgress, restartOutcomeProgressWindow } from './outcome-progress.mjs';
+import { collectMeasurementTransition, retainMeasurementHookInstruction } from './measurement-collector.mjs';
+import { measurementBinding, appendMeasurement, enrollMeasurementFromPolicy, measurementCollectionEnabled, measurementPolicyEnabled } from './measurement-store.mjs';
+const measurementEnabled = async (...args) => {
+  try { const binding = await measurementBinding(...args); return Boolean(binding && measurementCollectionEnabled(...args)); }
+  catch { console.error('Adoption measurement configuration is unreadable; collection is incomplete.'); return false; }
+};
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification', 'ConfigChange', 'PostModelSwitch']);
@@ -279,11 +285,15 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
   // Recovery requires positive process-death evidence and a serialized second
   // observation. Unknown/legacy owners are never reclaimed by age.
   const lockToken = await waitForStateLock(lock, inspectProcess);
-  let temporary, observation, result;
+  let temporary, observation, result, measurementObservation;
   try {
     const stored = await read(file, MAX_STATE_BYTES);
     const previous = await applyArchiveFence(root, applyProviderConsent(stored, await providerLinkState(root, provider)));
     const previousBytes = stored === null ? null : JSON.stringify(stored);
+    const measurementPriorRunId = previous?.run?.id;
+    let priorMeasurement, savedMeasurement;
+    try { savedMeasurement = await measurementBinding(root, provider, session); priorMeasurement = savedMeasurement && measurementCollectionEnabled(root, provider, session) ? savedMeasurement : null; } catch { /* Collection never blocks task state. */ }
+    const measurementPrevious = priorMeasurement ? structuredClone(previous) : null;
     const next = await mutate(previous);
     if (next) {
       // Older file_equals drafts used `path`, which an older verifier could
@@ -295,6 +305,12 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
         }
       }
       let serialized = JSON.stringify(next);
+      if (Buffer.byteLength(serialized) > MAX_STATE_BYTES) {
+        // Optional raw capture cannot consume the executor's state budget.
+        if (next.measurementObservation) Object.assign(next.measurementObservation, { response: null, responseComplete: false, prompt: null, promptComplete: false });
+        if (next.run?.managed?.measurementProviderResult) Object.assign(next.run.managed.measurementProviderResult, { response: null, responseComplete: false });
+        serialized = JSON.stringify(next);
+      }
       if (Buffer.byteLength(serialized) > MAX_STATE_BYTES / 2 && await compactConsistencyOutbox(root, next))
         serialized = JSON.stringify(next);
       if (Buffer.byteLength(serialized) > MAX_STATE_BYTES) throw new Error('Delivery state exceeds 4 MiB; retain history before reducing task details.');
@@ -317,9 +333,31 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
       // Runtime identity is revalidated by the caller that has a fresh direct
       // observation. Persistence alone is never treated as execution evidence.
       observation = { ...next, runtime: null };
+      let enrollProspectively = false;
+      try { enrollProspectively = (next.run?.id !== measurementPriorRunId || !next.run && !savedMeasurement) && measurementPolicyEnabled(root, provider, next.cwd); } catch { /* Collection never blocks task state. */ }
+      if (priorMeasurement || enrollProspectively)
+        measurementObservation = { previous: measurementPrevious, priorRunId: measurementPriorRunId, current: next, trace: priorMeasurement?.trace };
     }
     result = next;
   } finally { if (temporary) await rm(temporary, { force: true }); await releaseStateLock(lock, lockToken); }
+  if (measurementObservation) {
+    const { previous, priorRunId, current } = measurementObservation;
+    // Artifact reads run outside the task lock. A concurrent stop or new turn
+    // invalidates the snapshot instead of delaying a control or inventing S1.
+    const stamp = value => JSON.stringify([value?.run?.id, value?.run?.revision, value?.run?.controlRevision,
+      value?.run?.continuations, value?.run?.managed?.executionAttempt, value?.measurementObservation?.id,
+      value?.run?.managed?.measurementProviderResult?.id, value?.autoContinue, value?.providerArchived]);
+    const expected = stamp(current);
+    const validateCapture = async () => stamp(await read(file, MAX_STATE_BYTES)) === expected;
+    let trace = measurementObservation.trace;
+    try {
+      if (await validateCapture()) trace = (await enrollMeasurementFromPolicy({ root, previous: { run: { id: priorRunId } }, current }))?.trace || trace;
+      if (trace) await collectMeasurementTransition({ root, previous, current, trace, validateCapture });
+    } catch {
+      try { await appendMeasurement({ root, provider, session, trace, type: 'gap', key: `capture:${createHash('sha256').update(expected).digest('hex')}`, data: { reason: 'capture_failed' } }); }
+      catch { console.error('Adoption measurement journal unavailable; collection is incomplete.'); }
+    }
+  }
   // Do not wait on process inspection or the collector while holding the
   // delivery state lock. A matching fresh identity is required for start.
   if (observation) void (async () => {
@@ -2786,6 +2824,18 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       return record;
     }
     record.observedAt = now; record.lastEvent = event;
+    if (await measurementEnabled(root, provider, input.session_id)) {
+      // Claude's hook has no stable turn identifier. Preserve it as unknown
+      // rather than deduplicating separate identical assistant messages.
+      if (['Stop', 'StopFailure', 'UserPromptSubmit', 'Interrupt', 'PermissionRequest'].includes(event))
+        record.measurementObservation = { id: input.turn_id || input.tool_use_id || randomUUID(), event, at: now,
+          stable: Boolean(input.turn_id || input.tool_use_id), hookActive: input.stop_hook_active === true,
+          response: typeof input.last_assistant_message === 'string' ? input.last_assistant_message.slice(0, 65536) : null,
+          responseComplete: typeof input.last_assistant_message === 'string' && input.last_assistant_message.length <= 65536,
+          prompt: event === 'UserPromptSubmit' && typeof input.prompt === 'string' ? input.prompt.slice(0, 65536) : null,
+          promptComplete: event === 'UserPromptSubmit' && typeof input.prompt === 'string' && input.prompt.length <= 65536,
+          origin: typeof input.origin?.kind === 'string' ? input.origin.kind.slice(0, 80) : null };
+    }
     if (provider === 'claude' && identity && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event)) {
       // Optional model/mode observations are not complete permission evidence.
       // Only an explicit empty task AND wakeup registry proves this boundary.
@@ -3043,6 +3093,10 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
         current.run.state !== observed.run.state) return {};
     output.reason += '\n' + perspectiveInstruction(memory);
   }
+  if (output.decision === 'block') {
+    try { await retainMeasurementHookInstruction({ root, record: observed, text: output.reason }); }
+    catch { console.error('Adoption measurement instruction context unavailable; collection is incomplete.'); }
+  }
   return output;
 }
 export function canReplanDelivery(run, provider, now = Date.now()) {

package/src/codex-plugins/simy/hooks/measurement-collector.mjs

@@ -0,0 +1,130 @@
+import { appendMeasurement, measurementBinding, measurementDirectory, measurementEventForSource, measurementCollectionEnabled, retainMeasurementArtifact } from './measurement-store.mjs';
+import { measurementDigest } from './measurement-contract.mjs';
+import { captureMeasurementSnapshot } from './measurement-snapshot.mjs';
+import { judgeMeasurementStop, readFrozenMeasurementJudge } from './measurement-judge.mjs';
+import { join } from 'node:path';
+
+const terminal = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
+// Called after state persistence, outside the task lock. The caller rechecks
+// the exact task/turn before and after artifact capture. It cannot authorize work.
+export async function collectMeasurementTransition({ root, previous, current, trace, capture = captureMeasurementSnapshot, validateCapture = async () => true }) {
+  if (!current) return;
+  const binding = await measurementBinding(root, current.provider, current.session, trace);
+  if (!binding) return;
+  if (!measurementCollectionEnabled(root, current.provider, current.session, binding.trace)) return;
+  const directory = measurementDirectory(root, current.provider, current.session, binding.trace);
+  if (!current.run && binding.loop === 'off' && binding.task === measurementDigest(`passive:${current.session}`))
+    current = { ...current, run: { id: `passive:${current.session}`, state: 'observing', continuations: 0 } };
+  if (!current.run) return;
+  const run = current.run, prior = previous?.run?.id === run.id ? previous.run : null;
+  const append = (type, key, data, at) => appendMeasurement({ root, provider: current.provider, session: current.session, trace: binding.trace, type, key, data, at });
+  if (binding.task !== measurementDigest(run.managed?.taskId || run.id)) {
+    await append('gap', `foreign_run:${run.id}`, { reason: 'history_incomplete' }); return;
+  }
+  const priorResults = new Set(prior?.resultCycle?.events?.map(row => row.id) || []);
+  const hook = current.measurementObservation;
+  const newHook = hook && JSON.stringify(hook) !== JSON.stringify(previous?.measurementObservation);
+  const results = (run.resultCycle?.events || []).filter(row => !(newHook && ['Stop', 'StopFailure'].includes(hook.event) && row.kind === 'stop'));
+  if (newHook && ['Stop', 'StopFailure'].includes(hook.event)) {
+    results.push({ id: `turn:${hook.id}`, kind: hook.event === 'StopFailure' ? 'failure' : 'stop', at: hook.at, stable: hook.stable });
+    if (!hook.stable) await append('gap', `hook_identity:${hook.id}`, { reason: 'unknown_stop_identity' }, hook.at);
+  }
+  if (newHook && hook.event === 'UserPromptSubmit') {
+    const event = await append('user_input', hook.id, { input: measurementDigest(hook.id) }, hook.at);
+    await retainMeasurementArtifact(join(directory, 'inputs', `${event.id}.json`), { schemaVersion: 1,
+      source: 'provider_user_role_hook', origin: hook.origin || null, prompt: hook.prompt || null, complete: hook.promptComplete === true });
+  }
+  if (newHook && ['Interrupt', 'PermissionRequest'].includes(hook.event)) await append('boundary', hook.id, { boundary: hook.event === 'Interrupt' ? 'user_stop' : 'permission' }, hook.at);
+  if (current.providerArchived && !previous?.providerArchived) await append('boundary', `archive:${run.id}`, { boundary: 'archive' });
+  if (current.autoContinue === false && previous?.autoContinue === true) await append('boundary', `disconnect:${run.controlRevision}`, { boundary: 'disconnect' });
+  if (run.managed?.nativeWait && JSON.stringify(run.managed.nativeWait) !== JSON.stringify(prior?.managed?.nativeWait))
+    await append('boundary', `native:${measurementDigest(run.managed.nativeWait)}`, { boundary: 'permission' });
+  if (run.managed?.userQuestion && run.managed.userQuestion !== prior?.managed?.userQuestion)
+    await append('boundary', `question:${measurementDigest(run.managed.userQuestion)}`, { boundary: 'question' });
+  if (prior?.managed && JSON.stringify(run.managed?.approvalScopes) !== JSON.stringify(prior.managed.approvalScopes))
+    await append('boundary', `scope:${run.controlRevision}:${run.revision}`, { boundary: 'scope_change' });
+  const providerResult = run.managed?.measurementProviderResult;
+  if (providerResult && providerResult.id !== prior?.managed?.measurementProviderResult?.id)
+    results.push({ id: `turn:${providerResult.turnId || providerResult.id}`, kind: providerResult.success ? 'stop' : 'failure', at: providerResult.at, stable: Boolean(providerResult.turnId) });
+  for (const result of results) {
+    if (priorResults.has(result.id) || !['stop', 'final_response', 'failure', 'checkpoint'].includes(result.kind)) continue;
+    if (await measurementEventForSource({ root, provider: current.provider, session: current.session, trace: binding.trace, type: 'stop', key: result.id })) continue;
+    // A structured checkpoint is not a natural provider turn end. The
+    // distinction is retained so it cannot become an S1 counterfactual.
+    const spec = await readFrozenMeasurementJudge(directory);
+    let snapshot = null;
+    try {
+      if (!await validateCapture()) throw new Error('Task changed before snapshot.');
+      snapshot = await capture({ directory, cwd: run.executionCwd || current.cwd, requiredPaths: spec?.checks.map(check => check.path) || [],
+      context: { objective: run.objective || null, originalContext: run.managed?.purpose?.originalContext || null, checkpoint: run.checkpoint || null,
+        providerResponse: newHook ? hook.response || null : providerResult?.response || run.managed?.finalResponseWithoutCheckpoint || null,
+        responseComplete: newHook ? hook.responseComplete === true : providerResult?.responseComplete === true } });
+      if (!await validateCapture()) throw new Error('Task changed during snapshot.');
+    }
+    catch { snapshot = null; await append('gap', `snapshot:${result.id}`, { reason: 'snapshot_unavailable' }, result.at); }
+    const stop = await append('stop', result.id, { snapshot: snapshot?.id || null, candidate: snapshot?.candidate || null,
+      natural: result.kind === 'stop' ? result.stable === false ? null : true : result.kind === 'checkpoint' ? false : null,
+      stop_kind: result.kind === 'failure' ? 'error' : 'unknown', influenced: (prior?.continuations || 0) > 0 ? true : null }, result.at);
+    if (snapshot && spec) await judgeMeasurementStop({ root, provider: current.provider, session: current.session, trace: binding.trace, stop, spec });
+  }
+  if (run.continuations > (prior?.continuations || 0)) {
+    await append('instruction', `continuation:${run.continuations}`, { decision: measurementDigest(run.managed?.decision?.id || `continuation:${run.continuations}`), instruction_type: 'unknown', dispatched: null }, run.updatedAt);
+    if (run.continuations - (prior?.continuations || 0) > 1) await append('gap', `continuations:${run.continuations}`, { reason: 'history_incomplete' }, run.updatedAt);
+  }
+  const attempt = run.managed?.executionAttempt, oldAttempt = prior?.managed?.executionAttempt;
+  if (attempt?.id && (!oldAttempt || oldAttempt.id !== attempt.id || oldAttempt.phase !== attempt.phase) && ['claimed', 'dispatching'].includes(attempt.phase)) {
+    await append('execution', `${attempt.id}:${attempt.phase}`, { attempt: measurementDigest(attempt.id), phase: attempt.phase, decision: attempt.decisionId ? measurementDigest(attempt.decisionId) : null, provider_turn: attempt.providerTurnId ? measurementDigest(attempt.providerTurnId) : null }, attempt.dispatchedAt || attempt.claimedAt);
+  }
+  if (attempt?.id && attempt.startedAt && (oldAttempt?.id !== attempt.id || !oldAttempt.startedAt)) {
+    await append('execution', `${attempt.id}:started`, { attempt: measurementDigest(attempt.id), phase: 'started', decision: attempt.decisionId ? measurementDigest(attempt.decisionId) : null, provider_turn: attempt.providerTurnId ? measurementDigest(attempt.providerTurnId) : null }, attempt.startedAt);
+    const instruction = await append('instruction', `attempt:${attempt.id}`, { decision: measurementDigest(attempt.decisionId || attempt.id), instruction_type: 'unknown', dispatched: true }, attempt.startedAt);
+    await retainMeasurementArtifact(join(directory, 'instructions', `${instruction.id}.json`), { schemaVersion: 1, source: 'controller_dispatch_context',
+      objective: run.objective || null, nextStep: run.nextStep || null, action: attempt.action || null, decision: run.managed?.decision || null });
+  }
+  for (const receipt of run.managed?.attempts || []) {
+    if ((prior?.managed?.attempts || []).some(row => row.id === receipt.id && row.outcome === receipt.outcome)) continue;
+    if (!['failed', 'cancelled', 'busy', 'checkpoint'].includes(receipt.outcome)) continue;
+    await append('execution', `${receipt.id}:${receipt.outcome}`, { attempt: measurementDigest(receipt.id), phase: receipt.outcome, decision: receipt.decisionId ? measurementDigest(receipt.decisionId) : null, provider_turn: attempt?.id === receipt.id && attempt.providerTurnId ? measurementDigest(attempt.providerTurnId) : null }, receipt.endedAt || receipt.finishedAt || receipt.at);
+    if (!['busy', 'cancelled'].includes(receipt.outcome) && run.managed?.lastUsage?.attemptId !== receipt.id)
+      await append('cost', `unavailable:${receipt.id}`, { attempt: measurementDigest(receipt.id), tokens: null, turns: null, amount_micros: null, currency: 'unknown', basis: 'unavailable' }, receipt.finishedAt || receipt.at);
+  }
+  const usage = run.managed?.lastUsage;
+  if (usage?.attemptId && JSON.stringify(usage) !== JSON.stringify(prior?.managed?.lastUsage)) {
+    await append('cost', `usage:${usage.attemptId}`, { attempt: measurementDigest(usage.attemptId), tokens: Number.isSafeInteger(usage.tokens) ? usage.tokens : null,
+      turns: null, amount_micros: null, currency: 'unknown', basis: 'provider_usage' });
+  }
+  if (run.stopReason?.actor === 'user' && JSON.stringify(run.stopReason) !== JSON.stringify(prior?.stopReason)) {
+    await append('boundary', `control:${run.controlRevision}:${run.stopReason.at}`, { boundary: run.state === 'paused' ? 'user_pause' : 'user_stop' }, run.stopReason.at);
+  }
+  if (terminal.has(run.state) && prior?.state !== run.state) await append('run_finished', `terminal:${run.state}:${run.controlRevision || 0}:${run.revision}`, { state: run.state }, run.updatedAt);
+}
+
+export async function retainMeasurementHookInstruction({ root, record, text }) {
+  if (!record?.run || typeof text !== 'string') return;
+  const binding = await measurementBinding(root, record.provider, record.session);
+  if (!binding || binding.task !== measurementDigest(record.run.managed?.taskId || record.run.id) ||
+      !measurementCollectionEnabled(root, record.provider, record.session, binding.trace)) return;
+  const event = await measurementEventForSource({ root, provider: record.provider, session: record.session, trace: binding.trace,
+    type: 'instruction', key: `continuation:${record.run.continuations}` });
+  if (!event) return;
+  await retainMeasurementArtifact(join(measurementDirectory(root, record.provider, record.session, binding.trace), 'instructions', `${event.id}.json`), {
+    schemaVersion: 1, source: 'generated_hook_instruction', emitted: null, text: text.slice(0, 65536), complete: text.length <= 65536,
+  });
+}
+
+export async function recordMeasurementSqm({ root, provider, session, trace, result }) {
+  if (!provider || !session || !result?.proof) return;
+  const binding = await measurementBinding(root, provider, session, trace);
+  if (!binding || !measurementCollectionEnabled(root, provider, session, binding.trace)) return;
+  const proof = result.proof, findings = proof.findings || result.findings || [];
+  await retainMeasurementArtifact(join(measurementDirectory(root, provider, session, binding.trace), 'sqm-proofs', `${measurementDigest(proof.proof_id)}.json`), {
+    schemaVersion: 1, proof, signedEvidence: result.signed_evidence || null,
+  });
+  const id = finding => measurementDigest(finding.finding_id || finding.id || finding);
+  await appendMeasurement({ root, provider, session, trace: binding.trace, type: 'sqm', key: proof.proof_id,
+    data: { proof: measurementDigest(proof.proof_id), candidate: measurementDigest(proof.repository_identity),
+      outcome: ['passed', 'failed', 'requires_human', 'requires_post_deploy', 'skipped'].includes(proof.outcome?.status) ? proof.outcome.status : 'unavailable',
+      findings: [...new Set(findings.map(id))], blocking: [...new Set(findings.filter(f => f.enforcement === 'blocking').map(id))],
+      advisory: [...new Set(findings.filter(f => f.enforcement !== 'blocking').map(id))],
+      scenarios: (proof.executions || []).reduce((sum, row) => sum + (row.scenarios?.length || 0), 0) } });
+}

package/src/codex-plugins/simy/hooks/measurement-contract.mjs

@@ -0,0 +1,51 @@
+import { createHash } from 'node:crypto';
+
+export const measurementDigest = value => createHash('sha256').update(typeof value === 'string' || value instanceof Uint8Array ? value : JSON.stringify(value)).digest('hex');
+export const MEASUREMENT_VERSION = 'adoption_measurement.v1';
+// Cloud transport is deliberately content-free. Artifacts and judge specifications
+// remain local; every reference below is a digest, never a path or conversation.
+export const MEASUREMENT_FIELDS = Object.freeze({
+  run_started: { loop: ['on', 'off'], cohort: 'hash', repository: 'nullable_repository', runtime: 'nullable_hash', collector: 'hash' },
+  stop: { snapshot: 'nullable_hash', candidate: 'nullable_hash', natural: 'nullable_boolean', stop_kind: ['unknown', 'claimed_done', 'plan_only', 'question', 'error', 'limit'], influenced: 'nullable_boolean' },
+  instruction: { decision: 'hash', instruction_type: ['unknown', 'boilerplate', 'informative', 'owner_wait'], dispatched: 'nullable_boolean' },
+  execution: { attempt: 'hash', phase: ['claimed', 'dispatching', 'started', 'finished', 'failed', 'cancelled', 'busy', 'checkpoint'], decision: 'nullable_hash', provider_turn: 'nullable_hash' },
+  sqm: { proof: 'hash', candidate: 'hash', outcome: ['passed', 'failed', 'requires_human', 'requires_post_deploy', 'skipped', 'unavailable'], findings: 'hashes', blocking: 'hashes', advisory: 'hashes', scenarios: 'integer' },
+  sqm_attempt: { attempt: 'hash', phase: ['min', 'full'], outcome: ['passed', 'failed', 'unavailable', 'unknown'], candidate: 'nullable_hash', diagnostic: 'nullable_hash' },
+  judge: { stop: 'hash', snapshot: 'hash', judge: 'hash', scope: ['artifact_predicates', 'task_acceptance'], satisfied: 'boolean', passed: 'integer', total: 'integer', violations: 'hashes' },
+  stop_label: { stop: 'hash', reviewer: 'hash', stop_kind: ['claimed_done', 'plan_only', 'question', 'error', 'limit'], influenced: 'boolean' },
+  instruction_label: { instruction: 'hash', reviewer: 'hash', instruction_type: ['boilerplate', 'informative', 'owner_wait'] },
+  resolution: { finding: 'hash', first_proof: 'hash', final_proof: 'nullable_hash', actor: ['controller', 'human', 'unresolved', 'unknown'], evidence: 'hash', reviewer: 'hash' },
+  gate: { gate: ['premature_finish', 'after_stop', 'permission', 'scope', 'resume_stopped', 'candidate_identity', 'execution_evidence', 'gap_disclosure', 'correct_recheck', 'pass_handling', 'handoff'], outcome: ['passed', 'failed', 'unknown'], evidence: 'hash', reviewer: 'hash' },
+  user_input: { input: 'hash' },
+  boundary: { boundary: ['user_stop', 'user_pause', 'permission', 'question', 'scope_change', 'archive', 'disconnect'] },
+  cost: { attempt: 'hash', tokens: 'nullable_integer', turns: 'nullable_integer', amount_micros: 'nullable_integer', currency: ['unknown', 'USD', 'JPY'], basis: ['provider_usage', 'billing', 'unavailable'] },
+  run_finished: { state: ['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'] },
+  gap: { reason: ['capture_failed', 'snapshot_unavailable', 'late_enrollment', 'unknown_stop_identity', 'usage_unavailable', 'journal_error', 'history_incomplete'] },
+});
+const hashPattern = /^[a-f0-9]{64}$/;
+function fieldValid(value, type) {
+  if (Array.isArray(type)) return type.includes(value);
+  if (type.startsWith('nullable_')) return value === null || fieldValid(value, type.slice(9));
+  if (type === 'hash') return typeof value === 'string' && hashPattern.test(value);
+  if (type === 'repository') return typeof value === 'string' && /^[a-zA-Z0-9_.-]{1,100}\/[a-zA-Z0-9_.-]{1,100}$/.test(value);
+  if (type === 'hashes') return Array.isArray(value) && value.length <= 512 && new Set(value).size === value.length && value.every(item => fieldValid(item, 'hash'));
+  if (type === 'boolean') return typeof value === 'boolean';
+  return type === 'integer' && Number.isSafeInteger(value) && value >= 0;
+}
+export function validateMeasurementEvent(event) {
+  const keys = ['version', 'trace', 'provider', 'session', 'task', 'sequence', 'source', 'layer', 'type', 'at', 'data', 'id'];
+  const fields = Object.hasOwn(MEASUREMENT_FIELDS, event?.type) ? MEASUREMENT_FIELDS[event.type] : null;
+  if (!event || Object.keys(event).length !== keys.length || keys.some(key => !Object.hasOwn(event, key)) || !fields ||
+      event.version !== MEASUREMENT_VERSION || !['codex', 'claude'].includes(event.provider) ||
+      !['field', 'fixture'].includes(event.source) || ![null, 'N', 'S', 'F', 'W', 'X', 'B'].includes(event.layer) ||
+      !['trace', 'session', 'task', 'id'].every(key => fieldValid(event[key], 'hash')) ||
+      !Number.isSafeInteger(event.sequence) || event.sequence < 1 ||
+      typeof event.at !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(event.at) || !Number.isFinite(Date.parse(event.at)) || new Date(event.at).toISOString() !== event.at ||
+      !event.data || typeof event.data !== 'object' || Array.isArray(event.data) ||
+      Object.keys(event.data).length !== Object.keys(fields).length ||
+      Object.entries(fields).some(([key, type]) => !fieldValid(event.data[key], type))) throw new Error('Invalid adoption measurement event.');
+  const { id, ...unsigned } = event;
+  if (id !== measurementDigest(unsigned) || Buffer.byteLength(JSON.stringify(event)) > 65536) throw new Error('Adoption measurement identity mismatch.');
+  if (event.type === 'judge' && (event.data.total < 1 || event.data.passed > event.data.total || event.data.satisfied !== (event.data.passed === event.data.total && event.data.violations.length === 0))) throw new Error('Invalid independent judgement.');
+  return event;
+}

package/src/codex-plugins/simy/hooks/measurement-judge.mjs

@@ -0,0 +1,46 @@
+import { readFile } from 'node:fs/promises';
+import { join, isAbsolute } from 'node:path';
+import { measurementDigest } from './measurement-contract.mjs';
+import { appendMeasurement, measurementDirectory } from './measurement-store.mjs';
+import { readMeasurementSnapshot } from './measurement-snapshot.mjs';
+
+// Declarative, held-out predicates only. Never execute a command supplied by a
+// provider or let a judge create the very output it is supposed to evaluate.
+export function validateMeasurementJudge(spec) {
+  if (spec?.version !== 'artifact_judge.v1' || Object.keys(spec).some(key => !['version', 'checks', 'scope'].includes(key)) ||
+      ![undefined, 'artifact_predicates', 'task_acceptance'].includes(spec.scope) ||
+      !Array.isArray(spec.checks) || !spec.checks.length || spec.checks.length > 256) throw new Error('Invalid held-out judge.');
+  const ids = new Set();
+  for (const check of spec.checks) {
+    if (!check || typeof check.id !== 'string' || !check.id || ids.has(check.id) ||
+        typeof check.path !== 'string' || isAbsolute(check.path) || check.path.split(/[\\/]/).some(part => ['..', '.', ''].includes(part)) ||
+        !['equals', 'contains', 'absent', 'sha256'].includes(check.type) ||
+        Object.keys(check).some(key => !['id', 'path', 'type', 'expected', 'gate'].includes(key)) ||
+        typeof check.gate !== 'boolean' || check.type !== 'absent' && typeof check.expected !== 'string' ||
+        check.type === 'sha256' && !/^[a-f0-9]{64}$/.test(check.expected) ||
+        check.type === 'contains' && !check.expected) throw new Error('Invalid held-out predicate.');
+    ids.add(check.id);
+  }
+  return spec;
+}
+export async function judgeMeasurementStop({ root, provider, session, trace, stop, spec }) {
+  validateMeasurementJudge(spec);
+  if (stop.type !== 'stop' || !stop.data.snapshot) throw new Error('No complete snapshot to judge.');
+  const snapshot = await readMeasurementSnapshot(measurementDirectory(root, provider, session, trace), stop.data.snapshot, { paths: spec.checks.map(check => check.path) });
+  if (spec.checks.some(check => !snapshot.manifest.files.some(file => file.path === check.path))) throw new Error('Judge artifact was not included in this snapshot.');
+  const verdicts = spec.checks.map(check => {
+    const content = snapshot.files.get(check.path);
+    const passed = check.type === 'absent' ? !content : content !== undefined &&
+      (check.type === 'sha256' ? measurementDigest(content) === check.expected :
+        check.type === 'equals' ? content.equals(Buffer.from(check.expected)) : content.toString('utf8').includes(check.expected));
+    return { id: measurementDigest(check.id), passed, gate: check.gate };
+  });
+  const violations = verdicts.filter(v => v.gate && !v.passed).map(v => v.id), passed = verdicts.filter(v => v.passed).length;
+  return appendMeasurement({ root, provider, session, trace, type: 'judge', key: `${stop.id}:${measurementDigest(spec)}`,
+    data: { stop: stop.id, snapshot: stop.data.snapshot, judge: measurementDigest(spec), scope: spec.scope || 'artifact_predicates', satisfied: passed === verdicts.length && !violations.length,
+      passed, total: verdicts.length, violations } });
+}
+export async function readFrozenMeasurementJudge(directory) {
+  try { return validateMeasurementJudge(JSON.parse(await readFile(join(directory, 'judge.json'), 'utf8'))); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}

package/src/codex-plugins/simy/hooks/measurement-snapshot.mjs

@@ -0,0 +1,89 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { lstat, readFile, mkdir, writeFile, realpath } from 'node:fs/promises';
+import { join, relative, resolve, sep } from 'node:path';
+import { measurementDigest } from './measurement-contract.mjs';
+
+const exec = promisify(execFile);
+const MAX_BYTES = 64 * 1024 * 1024;
+export async function measurementRepository(cwd) {
+  try {
+    const { stdout } = await exec('git', ['remote', 'get-url', 'origin'], { cwd, timeout: 2000, maxBuffer: 4096 });
+    const match = /(?:github\.com[:/])([a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+?)(?:\.git)?\s*$/.exec(stdout);
+    return match?.[1] || null;
+  } catch { return null; }
+}
+// Opt-in capture, local only. A bounded capture is either complete or unknown;
+// a partial directory must never be presented to a judge as the whole artifact.
+export async function captureMeasurementSnapshot({ directory, cwd, context = null, requiredPaths = [], maxBytes = MAX_BYTES }) {
+  cwd = await realpath(cwd);
+  const git = async args => (await exec('git', args, { cwd, maxBuffer: 16 * 1024 * 1024, timeout: 5000 })).stdout;
+  const head = (await git(['rev-parse', 'HEAD'])).trim();
+  const tree = (await git(['rev-parse', 'HEAD^{tree}'])).trim();
+  const patchArgs = ['diff', '--no-ext-diff', '--no-textconv', '--binary', 'HEAD'];
+  const patch = await git(patchArgs);
+  const listedPaths = async () => [...new Set([
+    ...(await git(['diff', '--no-ext-diff', '--no-textconv', '--name-only', '-z', 'HEAD'])).split('\0'),
+    ...(await git(['ls-files', '-z', '--others', '--exclude-standard'])).split('\0'),
+    ...requiredPaths,
+  ].filter(Boolean))].sort();
+  const paths = await listedPaths();
+  if (paths.length > 20000) throw new Error('Snapshot file limit exceeded.');
+  const files = []; let bytes = Buffer.byteLength(JSON.stringify(context)) + Buffer.byteLength(patch);
+  if (bytes > maxBytes) throw new Error('Snapshot byte limit exceeded.');
+  await mkdir(join(directory, 'blobs'), { recursive: true, mode: 0o700 });
+  await mkdir(join(directory, 'snapshots'), { recursive: true, mode: 0o700 });
+  for (const path of paths) {
+    const full = resolve(cwd, path), within = relative(cwd, full);
+    if (within.startsWith(`..${sep}`) || within === '..' || within === '' || full === cwd) throw new Error('Snapshot path escaped workspace.');
+    let parent = cwd;
+    for (const component of within.split(sep).slice(0, -1)) {
+      parent = join(parent, component);
+      let info; try { info = await lstat(parent); } catch (error) { if (error.code === 'ENOENT') break; throw error; }
+      if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('Snapshot path traverses an unsupported directory.');
+    }
+    let before;
+    try { before = await lstat(full); } catch (error) { if (error.code === 'ENOENT') { files.push({ path, deleted: true }); continue; } throw error; }
+    if (!before.isFile()) throw new Error('Snapshot contains unsupported file type.');
+    if (await realpath(full) !== full) throw new Error('Snapshot path traverses a symbolic link.');
+    bytes += before.size;
+    if (bytes > maxBytes) throw new Error('Snapshot byte limit exceeded.');
+    const content = await readFile(full), after = await lstat(full);
+    if (!after.isFile() || after.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || content.length !== before.size) throw new Error('Workspace changed during snapshot.');
+    const blob = measurementDigest(content);
+    files.push({ path, blob, mode: before.mode & 0o777 });
+    // Content-addressed blobs are retained once, not accumulated in RAM for a
+    // repository-sized snapshot. Unchanged baseline assets are named by Git.
+    await writeOnce(join(directory, 'blobs', blob), content);
+  }
+  if ((await git(['rev-parse', 'HEAD'])).trim() !== head || await git(patchArgs) !== patch ||
+      JSON.stringify(await listedPaths()) !== JSON.stringify(paths)) throw new Error('Workspace identity changed during snapshot.');
+  for (const file of files) {
+    if (file.deleted) { try { await lstat(join(cwd, file.path)); throw new Error('Deleted artifact reappeared.'); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+    else if (measurementDigest(await readFile(join(cwd, file.path))) !== file.blob) throw new Error('Artifact changed during snapshot.');
+  }
+  const manifest = { schemaVersion: 1, head, tree, patch, files, context,
+    coverage: 'changed_files_and_declared_artifacts', requiredPaths: [...new Set(requiredPaths)].sort(),
+    baselineBytesIncluded: false };
+  const id = measurementDigest(manifest);
+  await writeOnce(join(directory, 'snapshots', `${id}.json`), JSON.stringify(manifest));
+  return { id, candidate: measurementDigest({ head, tree, patch, files }) };
+}
+async function writeOnce(path, content) {
+  try { await writeFile(path, content, { flag: 'wx', mode: 0o600 }); }
+  catch (error) { if (error.code !== 'EEXIST') throw error; const saved = await readFile(path); if (!saved.equals(Buffer.from(content))) throw new Error('Snapshot content conflict.'); }
+}
+export async function readMeasurementSnapshot(directory, id, { paths = null } = {}) {
+  if (!/^[a-f0-9]{64}$/.test(id)) throw new Error('Invalid snapshot reference.');
+  const manifest = JSON.parse(await readFile(join(directory, 'snapshots', `${id}.json`), 'utf8'));
+  if (measurementDigest(manifest) !== id) throw new Error('Snapshot manifest was modified.');
+  const files = new Map();
+  for (const file of manifest.files) {
+    if (file.deleted || paths && !paths.includes(file.path)) continue;
+    if (!/^[a-f0-9]{64}$/.test(file.blob)) throw new Error('Invalid snapshot blob.');
+    const content = await readFile(join(directory, 'blobs', file.blob));
+    if (measurementDigest(content) !== file.blob) throw new Error('Snapshot blob was modified.');
+    files.set(file.path, content);
+  }
+  return { manifest, files };
+}

package/src/codex-plugins/simy/hooks/measurement-store.mjs

@@ -0,0 +1,132 @@
+import { mkdir, readFile, readdir, link, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { acquireLock, atomicSave, readState } from './update-state-store.mjs';
+import { MEASUREMENT_VERSION, measurementDigest, validateMeasurementEvent } from './measurement-contract.mjs';
+import { measurementRepository } from './measurement-snapshot.mjs';
+
+const sessionDirectory = (root, provider, session) => join(root, 'measurement', measurementDigest([provider, session]));
+async function measurementLock(file) {
+  for (let attempt = 0; ; attempt++) {
+    try { return acquireLock(file); }
+    catch (error) { if (error.code !== 'state_busy' || attempt >= 30) throw error; await new Promise(resolve => setTimeout(resolve, 10)); }
+  }
+}
+export const measurementDirectory = (root, provider, session, trace) => {
+  const directory = sessionDirectory(root, provider, session);
+  const id = trace || readState(join(directory, 'active.json'))?.trace;
+  if (id && !/^[a-f0-9]{64}$/.test(id)) throw new Error('Invalid measurement trace.');
+  return id ? join(directory, id) : directory;
+};
+export const measurementPolicyPath = (root, provider, cwd) => join(root, 'measurement-policies', `${measurementDigest([provider, cwd])}.json`);
+export const measurementPolicyEnabled = (root, provider, cwd) => readState(measurementPolicyPath(root, provider, cwd))?.enabled === true;
+export const measurementRuntime = record => record.admission?.model ? measurementDigest({ provider: record.provider,
+  model: record.admission.model, source: record.admission.source || null,
+  permissionMode: record.updateObservation?.permissionMode || null }) : null;
+export async function enrollMeasurementFromPolicy({ root, previous, current }) {
+  if (!current) return;
+  const policy = readState(measurementPolicyPath(root, current.provider, current.cwd));
+  if (!policy?.enabled) return;
+  const task = current.run?.managed?.taskId || current.run?.id || `passive:${current.session}`;
+  if (!current.run && (policy.loop !== 'off' || await measurementBinding(root, current.provider, current.session))) return;
+  if (current.run && previous?.run?.id === current.run.id) return;
+  if (policy.loop === 'off' && current.autoContinue !== false || policy.loop === 'on' && current.autoContinue !== true) return;
+  const binding = await enrollMeasurement({ root, provider: current.provider, session: current.session, task,
+    source: policy.source, layer: policy.layer, loop: policy.loop, cohort: policy.cohort, scope: policy.scope,
+    late: !(['SessionStart', 'UserPromptSubmit'].includes(current.lastEvent) && (!current.run || current.observedAt === current.run.startedAt)),
+    repository: await measurementRepository(current.run?.executionCwd || current.cwd), runtime: measurementRuntime(current) });
+  if (policy.judge) await writeFile(join(measurementDirectory(root, current.provider, current.session, binding.trace), 'judge.json'), JSON.stringify(policy.judge), { flag: 'wx', mode: 0o600 });
+  return binding;
+}
+export async function measurementBinding(root, provider, session, trace) {
+  return readState(join(measurementDirectory(root, provider, session, trace), 'binding.json'));
+}
+export function measurementCollectionEnabled(root, provider, session, trace) {
+  return readState(join(measurementDirectory(root, provider, session, trace), 'collection.json'))?.enabled !== false;
+}
+export async function enrollMeasurement({ root, provider, session, task, source = 'field', layer = null, loop = 'on', cohort, late = true, scope = null, repository = null, runtime = null }) {
+  if (!['codex', 'claude'].includes(provider) || !session || !task || !['field', 'fixture'].includes(source) ||
+      ![null, 'N', 'S', 'F', 'W', 'X', 'B'].includes(layer) || !['on', 'off'].includes(loop) || !cohort) throw new Error('Explicit measurement identity and cohort required.');
+  // Enrollment and the active pointer form one session-scoped publication.
+  // Concurrent task updates cannot steal another trace's initial event.
+  const release = await measurementLock(join(sessionDirectory(root, provider, session), 'active.json'));
+  try {
+    const existing = await measurementBinding(root, provider, session);
+    if (existing?.task === measurementDigest(task)) throw new Error('Task measurement binding already exists.');
+    const trace = measurementDigest(randomUUID());
+    const directory = measurementDirectory(root, provider, session, trace);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const binding = { schemaVersion: 1, trace, provider, session: measurementDigest(session),
+      task: measurementDigest(task), source, layer, loop, cohort: measurementDigest(cohort), scope };
+    // Each task owns an immutable trace. Moving the active pointer retains every
+    // prior task and its complete journal in the same provider conversation.
+    const temporary = join(directory, `${randomUUID()}.tmp`);
+    await writeFile(temporary, JSON.stringify(binding), { flag: 'wx', mode: 0o600 });
+    try { await link(temporary, join(directory, 'binding.json')); }
+    finally { await rm(temporary, { force: true }); }
+    const collectorSources = await Promise.all(['contract', 'store', 'snapshot', 'judge', 'collector'].map(name => readFile(new URL(`./measurement-${name}.mjs`, import.meta.url), 'utf8')));
+    const collector = measurementDigest(collectorSources);
+    await appendMeasurement({ root, provider, session, trace, type: 'run_started', key: 'enrollment', data: { loop, cohort: binding.cohort, repository, runtime, collector } });
+    if (late) await appendMeasurement({ root, provider, session, trace, type: 'gap', key: 'late_enrollment', data: { reason: 'late_enrollment' } });
+    atomicSave(join(sessionDirectory(root, provider, session), 'active.json'), { schemaVersion: 1, trace });
+    return binding;
+  } finally { release(); }
+}
+export async function appendMeasurement({ root, provider, session, trace, type, key, data, at = Date.now() }) {
+  const binding = await measurementBinding(root, provider, session, trace);
+  if (!binding) return null;
+  if (typeof key !== 'string' || !key || key.length > 2000) throw new Error('Measurement source identity required.');
+  const directory = measurementDirectory(root, provider, session, binding.trace), manifest = join(directory, 'journal.json');
+  const release = await measurementLock(manifest);
+  try {
+    const journal = readState(manifest) || { schemaVersion: 1, sequence: 0 };
+    const source = measurementDigest([type, key]), eventFile = join(directory, `${source}.event.json`);
+    let saved;
+    try { saved = await readFile(eventFile, 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (saved) {
+      const event = validateMeasurementEvent(JSON.parse(saved));
+      if (JSON.stringify(event.data) !== JSON.stringify(data)) throw new Error('Measurement source changed; preserve the original event.');
+      return event;
+    }
+    const unsigned = { version: MEASUREMENT_VERSION, trace: binding.trace, provider, session: binding.session, task: binding.task,
+      sequence: journal.sequence + 1, source: binding.source, layer: binding.layer, type, at: new Date(at).toISOString(), data };
+    const event = validateMeasurementEvent({ ...unsigned, id: measurementDigest(unsigned) });
+    // Reserve the sequence durably BEFORE publishing: a crash is a visible gap,
+    // never two different observations occupying one sequence number.
+    atomicSave(manifest, { schemaVersion: 1, sequence: event.sequence });
+    atomicSave(eventFile, event);
+    return event;
+  } finally { release(); }
+}
+export async function readMeasurements({ root, provider, session, trace }) {
+  const directory = measurementDirectory(root, provider, session, trace);
+  const binding = await measurementBinding(root, provider, session, trace);
+  let names; try { names = await readdir(directory); } catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+  const events = [];
+  for (const name of names.filter(name => /^[a-f0-9]{64}\.event\.json$/.test(name))) {
+    const event = validateMeasurementEvent(JSON.parse(await readFile(join(directory, name), 'utf8')));
+    if (!binding || event.trace !== binding.trace || event.task !== binding.task || event.session !== binding.session || event.provider !== binding.provider || event.source !== binding.source || event.layer !== binding.layer) throw new Error('Measurement event belongs to another trace.');
+    events.push(event);
+  }
+  return events.sort((left, right) => left.sequence - right.sequence);
+}
+export async function measurementEventForSource({ root, provider, session, trace, type, key }) {
+  const file = join(measurementDirectory(root, provider, session, trace), `${measurementDigest([type, key])}.event.json`);
+  try { return validateMeasurementEvent(JSON.parse(await readFile(file, 'utf8'))); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+export async function listMeasurementTraces({ root, provider, session }) {
+  let names; try { names = await readdir(sessionDirectory(root, provider, session)); } catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+  return names.filter(name => /^[a-f0-9]{64}$/.test(name));
+}
+export async function retainMeasurementArtifact(file, value) {
+  const temporary = `${file}.${randomUUID()}.publish`;
+  atomicSave(temporary, value);
+  try {
+    try { await link(temporary, file); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      if (JSON.stringify(JSON.parse(await readFile(file, 'utf8'))) !== JSON.stringify(value)) throw new Error('Measurement artifact content conflict.');
+    }
+  } finally { await rm(temporary, { force: true }); }
+}

package/src/delivery-hooks/command.js

@@ -47,6 +47,10 @@ function parseDeliveryOptions(args, allowed) {
 
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), webOrigin, input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
+  if (action === 'measurement') {
+    const { runMeasurementCommand } = await import('./measurement.js');
+    return runMeasurementCommand(args, { root, cwd, webOrigin, output });
+  }
   if (action === 'auto-continue') {
     const controller = new AbortController(), abort = () => controller.abort();
     process.once('SIGINT', abort); process.once('SIGTERM', abort);
@@ -238,6 +242,8 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery consult [--scope diagnose|repair_continue] [--request-id USER_TURN_ID] [--context-file context.json] [--provider codex|claude --session ID | --task-id ID] — diagnose scope: check why it stopped, using the observed current conversation or selected original work; repair_continue scope never implies completion.');
     output('simy delivery diagnose --provider codex|claude --session ID [--task-id ID] [--mode analyze|evidence] [--issues-file issues.json] [--detail brief|full] — advisory check of why it stopped, in a separate process; never resumes the target. Exact --task-id alone is also supported.');
     output('simy delivery evidence --provider codex|claude --session ID — read-only execution and acceptance receipts.');
+    output('simy delivery measurement enable|disable --provider codex|claude --cohort ID [--source field|fixture --layer N|S|F|W|X|B --loop on|off --judge-file FILE] — opt in future tasks in this workspace to local snapshot collection.');
+    output('simy delivery measurement start|stop|list|status|export|record|flush --provider codex|claude --session ID [--trace SHA256] — audit or explicitly upload content-free observations. See docs/adoption-measurement.md.');
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
     output('A task stops after repeated failures, and pauses for review when no progress is confirmed. Resume starts a new progress window.');
     output('simy delivery continuation_policy --provider PROVIDER --session ID --task-id ID --continuation-policy bounded|progress');

package/src/delivery-hooks/measurement.js

@@ -0,0 +1,149 @@
+import { readFile, writeFile, realpath } from 'node:fs/promises';
+import { dirname, join, relative, isAbsolute, sep } from 'node:path';
+import { readRecord, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { enrollMeasurement, measurementBinding, measurementDirectory, measurementPolicyPath, readMeasurements, appendMeasurement, listMeasurementTraces, measurementRuntime } from '../codex-plugins/simy/hooks/measurement-store.mjs';
+import { measurementDigest } from '../codex-plugins/simy/hooks/measurement-contract.mjs';
+import { validateMeasurementJudge } from '../codex-plugins/simy/hooks/measurement-judge.mjs';
+import { readSession, isSessionValid } from '../session-store.js';
+import { webApiUrl } from '../web-api.js';
+import { atomicSave, readState } from '../codex-plugins/simy/hooks/update-state-store.mjs';
+import { measurementRepository } from '../codex-plugins/simy/hooks/measurement-snapshot.mjs';
+
+function measurementCloudScope(webOrigin, auth) {
+  if (!webOrigin || !isSessionValid(auth, Date.now(), webOrigin) || !auth.organization_id ||
+      !(auth.account_id || auth.auth_user_id) || !auth.device_id) return null;
+  return { origin: new URL(webOrigin).origin, organization: auth.organization_id,
+    account: auth.account_id || auth.auth_user_id, device: auth.device_id };
+}
+
+async function loadMeasurementJudge(file, cwd) {
+  const root = await realpath(cwd), target = await realpath(file), path = relative(root, target);
+  if (!(path === '..' || path.startsWith(`..${sep}`) || isAbsolute(path))) throw new Error('Held-out judge must remain outside the solver workspace.');
+  const content = await readFile(target);
+  if (content.length > 65536) throw new Error('Held-out judge exceeds 64 KiB.');
+  return validateMeasurementJudge(JSON.parse(content.toString('utf8')));
+}
+
+export function measurementReadiness(events, { reservedSequence = events.at(-1)?.sequence || 0 } = {}) {
+  const gaps = []; let expected = 1;
+  for (const event of events) { if (event.sequence !== expected) gaps.push({ expected, received: event.sequence }); expected = event.sequence + 1; }
+  if (reservedSequence >= expected) gaps.push({ expected, received: null, reserved: reservedSequence });
+  const stops = events.filter(event => event.type === 'stop');
+  const judges = events.filter(event => event.type === 'judge');
+  return {
+    eventCount: events.length, stopCount: stops.length, sequenceGaps: gaps,
+    missingRunStart: !events.some(event => event.type === 'run_started' && event.sequence === 1),
+    terminalObserved: events.some(event => event.type === 'run_finished'),
+    declaredGaps: events.filter(event => event.type === 'gap').map(event => event.data.reason),
+    missingSnapshots: stops.filter(event => !event.data.snapshot).length,
+    unjudgedStops: stops.filter(stop => !judges.some(judge => judge.data.stop === stop.id && judge.data.snapshot === stop.data.snapshot && judge.data.scope === 'task_acceptance')).length,
+    artifactJudgedStops: stops.filter(stop => judges.some(judge => judge.data.stop === stop.id && judge.data.snapshot === stop.data.snapshot)).length,
+    unknownNaturalStops: stops.filter(event => event.data.natural === null).length,
+    unclassifiedStops: stops.filter(stop => stop.data.stop_kind === 'unknown' && !events.some(event => event.type === 'stop_label' && event.data.stop === stop.id)).length,
+    unclassifiedInstructions: events.filter(instruction => instruction.type === 'instruction' && instruction.data.instruction_type === 'unknown' && !events.some(event => event.type === 'instruction_label' && event.data.instruction === instruction.id)).length,
+    hasBillingReceipt: events.some(event => event.type === 'cost' && event.data.basis === 'billing' && event.data.amount_micros !== null),
+    // This is a collection audit. It cannot certify causal calibration, sample
+    // sufficiency, real-user acceptance or turn a fixture into field evidence.
+    effectReadiness: 'requires_cohort_evaluation',
+    remainingEvaluation: [
+      ...(stops.some(stop => !judges.some(judge => judge.data.stop === stop.id && judge.data.scope === 'task_acceptance')) ? ['independent_task_judgement'] : []),
+      'cohort_calibration', 'sample_sufficiency',
+    ],
+  };
+}
+
+export async function flushMeasurements({ root, provider, session, trace, webOrigin, fetchImpl = globalThis.fetch }) {
+  const binding = await measurementBinding(root, provider, session, trace);
+  if (!binding?.scope) throw new Error('Measurement was not enrolled with a Cloud scope.');
+  const auth = await readSession(webOrigin, dirname(root));
+  const scope = measurementCloudScope(webOrigin, auth);
+  if (!scope || !binding.scope.device || JSON.stringify(scope) !== JSON.stringify(binding.scope)) throw new Error('Measurement Cloud account or organization changed; original scope required.');
+  const events = await readMeasurements({ root, provider, session, trace: binding.trace });
+  const directory = measurementDirectory(root, provider, session, binding.trace); let uploaded = 0;
+  for (const event of events) {
+    let saved;
+    try { saved = await readFile(join(directory, `${event.id}.ack`), 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (saved === event.id) continue;
+    const response = await fetchImpl(webApiUrl('sqm/measurement-events', { webOrigin, apiBaseUrl: auth.api_base_url }), {
+      method: 'POST', headers: { authorization: `Bearer ${auth.token}`, 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify(event), signal: AbortSignal.timeout(10000),
+    });
+    const ack = await response.json().catch(() => null);
+    if (!response.ok || ack?.accepted !== true || ack?.event_id !== event.id || ack?.sequence !== event.sequence || ack?.trace !== event.trace)
+      throw new Error('Measurement upload was not acknowledged; local events retained.');
+    await writeFile(join(directory, `${event.id}.ack`), event.id, { mode: 0o600 }); uploaded++;
+  }
+  return { uploaded, retained: events.length };
+}
+
+export async function runMeasurementCommand(args, { root, cwd, webOrigin, output }) {
+  const [operation, ...flags] = args, options = {};
+  const allowed = new Set(['provider', 'session', 'trace', 'source', 'layer', 'loop', 'cohort', 'judge-file', 'event-file']);
+  for (let index = 0; index < flags.length; index += 2) {
+    const key = flags[index]?.slice(2);
+    if (!flags[index]?.startsWith('--') || !allowed.has(key) || !flags[index + 1] || Object.hasOwn(options, key)) throw new Error('Invalid measurement option.');
+    options[key] = flags[index + 1];
+  }
+  const { provider, session } = options;
+  if (!['codex', 'claude'].includes(provider) || !session && !['enable', 'disable'].includes(operation)) throw new Error('Use measurement enable|disable|start|status|export|record|flush --provider codex|claude [--session ID].');
+  const context = { root, provider, session, trace: options.trace };
+  if (['enable', 'disable'].includes(operation)) {
+    if (operation === 'disable') atomicSave(measurementPolicyPath(root, provider, cwd), { schemaVersion: 1, enabled: false });
+    else {
+      if (!options.cohort || !['field', 'fixture'].includes(options.source || 'field') || !['on', 'off'].includes(options.loop || 'on') || ![undefined, 'N','S','F','W','X','B'].includes(options.layer)) throw new Error('Explicit cohort and valid measurement policy required.');
+      const auth = webOrigin ? await readSession(webOrigin, dirname(root)) : null;
+      const scope = measurementCloudScope(webOrigin, auth);
+      const judge = options['judge-file'] ? await loadMeasurementJudge(options['judge-file'], cwd) : null;
+      atomicSave(measurementPolicyPath(root, provider, cwd), { schemaVersion: 1, enabled: true, cohort: options.cohort, source: options.source || 'field', layer: options.layer || null, loop: options.loop || 'on', scope, judge });
+    }
+    output(JSON.stringify({ enabled: operation === 'enable', appliesTo: 'future_tasks_in_this_workspace', historicalStopsAvailable: false }, null, 2));
+  } else if (operation === 'start') {
+    const record = await readRecord(root, provider, session);
+    if (!record?.run) throw new Error('Enroll an existing exact task; no task is started by measurement.');
+    if (options.loop === 'off' && record.autoContinue !== false) throw new Error('Turn off Auto Continue before enrolling a Loop-off control.');
+    if (options.loop !== 'off' && record.autoContinue !== true) throw new Error('A Loop-on cohort requires enabled Auto Continue.');
+    const auth = webOrigin ? await readSession(webOrigin, dirname(root)) : null;
+    const scope = measurementCloudScope(webOrigin, auth);
+    let spec;
+    if (options['judge-file']) spec = await loadMeasurementJudge(options['judge-file'], cwd);
+    let binding;
+    await updateRecord(root, provider, session, async fresh => {
+      if (fresh?.run?.id !== record.run.id || fresh.autoContinue !== record.autoContinue) throw new Error('Task changed before measurement enrollment.');
+      binding = await enrollMeasurement({ ...context, task: record.run.managed?.taskId || record.run.id,
+        source: options.source || 'field', layer: options.layer || null, loop: options.loop || 'on', cohort: options.cohort, late: true, scope,
+        repository: await measurementRepository(record.run.executionCwd || record.cwd), runtime: measurementRuntime(record) });
+      if (spec) await writeFile(join(measurementDirectory(root, provider, session, binding.trace), 'judge.json'), JSON.stringify(spec), { flag: 'wx', mode: 0o600 });
+      return fresh;
+    });
+    output(JSON.stringify({ enrolled: true, trace: binding.trace, cloudScopeBound: Boolean(scope), historicalStopsAvailable: false }, null, 2));
+  } else if (operation === 'stop') {
+    if (!await measurementBinding(root, provider, session, context.trace)) throw new Error('Measurement trace not found.');
+    atomicSave(join(measurementDirectory(root, provider, session, context.trace), 'collection.json'), { schemaVersion: 1, enabled: false });
+    output(JSON.stringify({ collectionEnabled: false, eventsRetained: true, taskChanged: false }, null, 2));
+  } else if (operation === 'list') output(JSON.stringify({ traces: await listMeasurementTraces(context) }, null, 2));
+  else if (operation === 'record') {
+    if (!options['event-file']) throw new Error('--event-file is required.');
+    const entry = JSON.parse(await readFile(options['event-file'], 'utf8'));
+    if (!['stop_label', 'instruction_label', 'resolution', 'gate', 'cost'].includes(entry.type)) throw new Error('Only externally reviewed annotations or usage receipts may be imported.');
+    const events = await readMeasurements(context);
+    const referenced = entry.data?.stop || entry.data?.instruction;
+    if (referenced && !events.some(event => event.id === referenced && event.type === (entry.type === 'stop_label' ? 'stop' : 'instruction'))) throw new Error('Annotation target is absent from this trace.');
+    if (entry.type === 'resolution') {
+      const first = events.find(event => event.type === 'sqm' && event.data.proof === entry.data?.first_proof);
+      if (!first?.data.findings.includes(entry.data?.finding) || entry.data.final_proof !== null &&
+          !events.some(event => event.type === 'sqm' && event.data.proof === entry.data.final_proof))
+        throw new Error('Resolution finding or proof is absent from this trace.');
+    }
+    if (entry.type === 'cost' && !events.some(event => ['execution', 'cost'].includes(event.type) && event.data.attempt === entry.data?.attempt))
+      throw new Error('Cost attempt is absent from this trace.');
+    const event = await appendMeasurement({ ...context, type: entry.type, key: entry.key, data: entry.data });
+    output(JSON.stringify({ recorded: true, event_id: event.id }, null, 2));
+  } else if (operation === 'flush') output(JSON.stringify(await flushMeasurements({ ...context, webOrigin }), null, 2));
+  else if (operation === 'status' || operation === 'export') {
+    const events = await readMeasurements(context);
+    const reservedSequence = readState(join(measurementDirectory(root, provider, session, context.trace), 'journal.json'))?.sequence || 0;
+    output(JSON.stringify(operation === 'export' ? { version: 'adoption_measurement_export.v1', events, readiness: measurementReadiness(events, { reservedSequence }) }
+      : { enrolled: Boolean(await measurementBinding(root, provider, session, context.trace)), ...measurementReadiness(events, { reservedSequence }) }, null, 2));
+  } else throw new Error('Use measurement start|status|export|flush.');
+  return 0;
+}

package/src/delivery-hooks/supervisor.js

@@ -5,6 +5,7 @@ import { recoveryWorkProposal, admitRecoveryWork } from '../session-supervision/
 import { safeCheckpointDiagnostic } from './checkpoint-diagnostic.js';
 import { continueResultCycle, resultEvent, executeResultCycle, acceptResultEvent } from '../codex-plugins/simy/hooks/result-cycle.mjs';
 import { finalResponseRecoveryInstruction } from '../session-supervision/final-response-recovery.js';
+import { measurementBinding, measurementCollectionEnabled } from '../codex-plugins/simy/hooks/measurement-store.mjs';
 import { recordHandoffStage } from '../codex-plugins/simy/hooks/consistency-handoff.mjs';
 import { retainControllerEvidence } from '../codex-plugins/simy/hooks/purpose-evidence.mjs';
 import { workspaceIdentity, reviewWorkspaceIdentity } from '../session-supervision/purpose-verification.js';
@@ -160,7 +161,7 @@ export async function executeCodexResume(record, { signal, root, leaseId, execut
   });
 }
 
-export async function tickManagedTasks({ root, webOrigin, now = Date.now(), execute, inspectProcess = processIdentity, signal, beforeClaim, authorizeDispatch, readRecords, observeTurn, observeAuthentication, inspectProvider = inspectCodexAppServer, shouldYield, nativeHandoff = reconcileNativeHandoff } = {}) {
+export async function tickManagedTasks({ root, webOrigin, now = Date.now(), execute, inspectProcess = processIdentity, signal, beforeClaim, authorizeDispatch, readRecords, readCancellationRecords, observeTurn, observeAuthentication, inspectProvider = inspectCodexAppServer, shouldYield, nativeHandoff = reconcileNativeHandoff } = {}) {
   const tickWallStart = Date.now();
   const currentTime = () => now + Math.max(0, Date.now() - tickWallStart);
   if (signal?.aborted) return;
@@ -170,7 +171,11 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
   // OFF changes the consent epoch and removes a task from a scoped activation.
   // Still reconcile its old native queue on reconnect, without admitting work
   // outside this supervisor's selected scope.
-  const cancellationOnly = readRecords ? (await listRecords(root)).filter(r => r.run?.managed?.nativeHandoff && !selectedIds.has(identity(r))) : [];
+  // Desktop callers can share their fresh metadata-validated global index.
+  // Keep it separate from the selected scope: a revoked native queue must still
+  // be cancelled, and the handoff reconciler re-reads authority before acting.
+  const cancellationOnly = readRecords ? (await (readCancellationRecords ? readCancellationRecords() : listRecords(root)))
+    .filter(r => r.run?.managed?.nativeHandoff && !selectedIds.has(identity(r))) : [];
   for (const record of [...selected, ...cancellationOnly]) {
     if (signal?.aborted || await shouldYield?.()) return;
     if ((!execute || record.run?.managed?.nativeHandoff) && await nativeHandoff({ root, record, signal, authorize: authorizeDispatch, cancelOnly: !selectedIds.has(identity(record)) })) nativeOwned.add(identity(record));
@@ -529,6 +534,15 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
     await updateRecordAfterControl(root, record.provider, record.session, async current => {
       const live = current?.run;
       if (live?.managed?.resumeLease?.id !== leaseId) return current;
+      try {
+        if (!result.busy && await measurementBinding(root, record.provider, record.session) && measurementCollectionEnabled(root, record.provider, record.session)) {
+          const response = typeof result.output === 'string' ? result.output : null;
+          live.managed.measurementProviderResult = { id: leaseId, at: currentTime(),
+            turnId: result.providerTurnId || live.managed.executionAttempt?.providerTurnId || null,
+            success: result.code === 0 && !result.cancelled, response: response?.slice(0, 65536) || null,
+            responseComplete: response !== null && response.length <= 65536 };
+        }
+      } catch { /* Collection does not change the executor's completion policy. */ }
       delete live.managed.resumeLease;
       if (searchEnabled(live.managed) && !result.busy && (dispatched || result.code === 0)) live.continuations += 1;
       if (live.managed.executionAttempt?.budgetReservation) live.managed.executionAttempt.budgetReservation.state = usage && result.code===0 ? 'settled' : dispatched ? 'unknown' : 'released';

package/src/desktop-catalog-frames.js

@@ -41,6 +41,38 @@ function updateRows(previous, incoming, full, { unchanged = false, immutableInpu
   return { rows: immutableInput ? incoming : rows, payload: { count: incoming.length, changes } };
 }
 
+// A display ordering change is not a row-content change. Version 2 references
+// positions in the last delivered base; ambiguous identities are sent in full.
+const rowIdentity = row => row && typeof row.session === 'string' && row.session
+  ? JSON.stringify([row.hostId ?? 'local', row.provider ?? null, row.session]) : null;
+function updateOrderedRows(previous, incoming, full, { unchanged = false, immutableInput = false } = {}) {
+  if (full || previous === null) return updateRows(previous, incoming, true, { immutableInput });
+  if (unchanged) return { rows: previous, payload: { count: previous.length, changes: [] } };
+  const positions = new Map(), incomingCounts = new Map();
+  for (let index = 0; index < previous.length; index++) {
+    const key = rowIdentity(previous[index]);
+    if (key !== null) positions.set(key, positions.has(key) ? -1 : index);
+  }
+  for (const row of incoming) { const key = rowIdentity(row); if (key !== null) incomingCounts.set(key, (incomingCounts.get(key) || 0) + 1); }
+  const order = [], changes = [], rows = [], reused = new Set();
+  let reordered = previous.length !== incoming.length;
+  for (let index = 0; index < incoming.length; index++) {
+    const row = incoming[index], key = rowIdentity(row), source = positions.get(key);
+    const unique = key !== null && incomingCounts.get(key) === 1 && source >= 0;
+    const reuse = unique && !reused.has(source) && isDeepStrictEqual(previous[source], row) ? source
+      : !unique && index < previous.length && !reused.has(index) && isDeepStrictEqual(previous[index], row) ? index : null;
+    if (reuse !== null) {
+      rows.push(previous[reuse]); order.push(reuse); reused.add(reuse);
+      if (reuse !== index) reordered = true;
+    } else {
+      const detached = immutableInput ? row : structuredClone(row);
+      rows.push(detached); order.push(null); changes.push([index, detached]);
+    }
+  }
+  return { rows: immutableInput ? incoming : !reordered && changes.length === 0 ? previous : rows,
+    payload: { count: incoming.length, changes, ...(reordered ? { order } : {}) } };
+}
+
 // Detach mutable producer data once. Unchanged catalog rows may be shared only
 // between these owned read-only snapshots; changed rows get detached copies and
 // a new array. Older queued frames and durable writes must remain immutable.
@@ -69,7 +101,9 @@ export function createDesktopStatusSnapshot() {
 // One encoder per ordered output stream. Call only when a frame actually enters
 // that stream, after replaceable/backpressured snapshots have been coalesced.
 // This cache is transport state; it never authorizes work or provider dispatch.
-export function createDesktopCatalogEncoder({ immutableInput = false } = {}) {
+export function createDesktopCatalogEncoder({ immutableInput = false, version = 1 } = {}) {
+  if (![1, 2].includes(version)) throw new Error('Unsupported desktop catalog version.');
+  const projectRows = version === 2 ? updateOrderedRows : updateRows;
   let rows = null, candidates = null, sourceRows = null, sourceCandidates = null, scope = null, revision = 0;
   const reset = () => { rows = null; candidates = null; sourceRows = null; sourceCandidates = null; scope = null; };
   return { reset, encode(frame) {
@@ -81,16 +115,16 @@ export function createDesktopCatalogEncoder({ immutableInput = false } = {}) {
     const incoming = status.sessionSupervision.sessions;
     const identity = catalogScope(status);
     const previous = revision++;
-    const full = rows === null || scope !== identity || rows.length !== incoming.length;
-    const snapshot = updateRows(rows, incoming, full, { immutableInput, unchanged: immutableInput && sourceRows === incoming });
+    const full = rows === null || scope !== identity || version === 1 && rows.length !== incoming.length;
+    const snapshot = projectRows(rows, incoming, full, { immutableInput, unchanged: immutableInput && sourceRows === incoming });
     rows = snapshot.rows; sourceRows = incoming; scope = identity;
-    const catalog = { version: 1, revision, scope, ...(full ? {} : { baseRevision: previous }), ...snapshot.payload };
+    const catalog = { version, revision, scope, ...(full ? {} : { baseRevision: previous }), ...snapshot.payload };
     const { sessions, ...metadata } = status.sessionSupervision;
     let supervision = metadata;
     if (Array.isArray(metadata.selectionCandidates)) {
       // This is another complete directory, used by the conversation picker.
       // Do not silently retransmit it as supposedly small status metadata.
-      const snapshot = updateRows(candidates, metadata.selectionCandidates, full,
+      const snapshot = projectRows(candidates, metadata.selectionCandidates, full,
         { immutableInput, unchanged: immutableInput && sourceCandidates === metadata.selectionCandidates });
       candidates = snapshot.rows; sourceCandidates = metadata.selectionCandidates; catalog.selectionCandidates = snapshot.payload;
       const { selectionCandidates, ...small } = metadata;

package/src/desktop-host.js

@@ -160,8 +160,8 @@ export { createDesktopFrameWriter } from './desktop-frame-writer.js';
 
 export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
   updatePackageRoot, dependencies = {}, exit = (code) => process.exit(code) } = {}) {
-  let catalogEncoder = env.SIMY_REMOTE_CHILD !== '1' && env.SIMY_DESKTOP_CATALOG_DELTA === '1'
-    ? createDesktopCatalogEncoder({ immutableInput: true }) : null;
+  let catalogEncoder = env.SIMY_REMOTE_CHILD !== '1' && ['1', '2'].includes(env.SIMY_DESKTOP_CATALOG_DELTA)
+    ? createDesktopCatalogEncoder({ immutableInput: true, version: env.SIMY_DESKTOP_CATALOG_VERSION === '2' ? 2 : Number(env.SIMY_DESKTOP_CATALOG_DELTA) }) : null;
   // Object frames below own detached snapshots. Queue their references rather
   // than copying multi-MiB history again whenever a native reader is paused.
   const frames = createDesktopFrameWriter(output, { capture: frame => frame,
@@ -605,6 +605,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const link = await requireProviderLink({ root: deliveryRoot, provider: record.provider });
       return JSON.stringify([scope, link.epoch]);
     }, readRecords: () => recordReader.list(),
+    readCancellationRecords: () => recordReader.list(),
     readCurrentRecord: (provider, session) => readRecord(deliveryRoot, provider, session),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
@@ -781,7 +782,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const row = automaticContinuation?.project(analyzed) || analyzed;
       const projected = { ...row, actionDeadline: row.actionDeadline || { status: 'unavailable', online: false, reminder: null },
         workState: sessionWorkState(row, record?.run, { provider: sessionStatus.providers?.[candidate.provider] }) };
-      return { ...projected, conversationPresentation: conversationPresentation(projected, record?.run) };
+      return { ...projected, conversationPresentation: conversationPresentation(projected, record?.run, { rawRecord: record }) };
     }).sort(compareSessionWork);
     const providers = { ...sessionStatus.providers };
     for (const provider of PROVIDER_LINKS) {
@@ -2563,7 +2564,8 @@ if (isDesktopHostEntry()) {
   try {
     const root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
     if (process.env.SIMY_DESKTOP_ATTACH_OWNER === '1' && await relayToOwner({ root, webOrigin: resolveWebOrigin(null, process.env), desktopClient: true,
-      catalogDeltas: process.env.SIMY_DESKTOP_CATALOG_DELTA === '1' })) process.exit(0);
+      catalogDeltas: ['1', '2'].includes(process.env.SIMY_DESKTOP_CATALOG_DELTA)
+        ? process.env.SIMY_DESKTOP_CATALOG_VERSION === '2' ? 2 : Number(process.env.SIMY_DESKTOP_CATALOG_DELTA) : false })) process.exit(0);
     try { await adoptInstalledRuntime({ root }); }
     catch (error) {
       if (error.code === PROCESS_CONFLICT_CODE) throw error;

package/src/session-supervision/controller-store.js

@@ -1,11 +1,16 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 
 export const conversationKey = ({ hostId = 'local', provider, session }) => JSON.stringify([hostId, provider, session]);
 export const controllerScope = status => status?.auth?.userId && status?.access?.organizationId
   ? JSON.stringify([status.auth.userId, status.access.organizationId]) : null;
 const digest = value => createHash('sha256').update(value).digest('hex');
+const catalogDigest = catalog => {
+  const { observedAt, ...content } = catalog;
+  return digest(JSON.stringify(content));
+};
 
 // User preferences belong to the controlling device, never to an SSH target.
 // Each account/organization has a separate file. All mutations serialize and
@@ -13,7 +18,25 @@ const digest = value => createHash('sha256').update(value).digest('hex');
 export function createControllerStore(root) {
   let queue = Promise.resolve();
   const states = new Map();
+  const catalogDigests = new Map();
   const file = scope => join(root, 'controller', `${digest(scope)}.json`);
+  const observationFile = scope => join(root, 'controller', `${digest(scope)}.catalog-observation`);
+  async function readObservation(scope, state, contentDigest) {
+    if (!state.catalogObservationId || !state.catalog) return state;
+    let handle;
+    try {
+      handle = await open(observationFile(scope), 'r');
+      const bytes = Buffer.alloc(4097), { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+      if (bytesRead > 4096) return state;
+      const observation = JSON.parse(bytes.subarray(0, bytesRead).toString('utf8'));
+      if (observation.catalogId === state.catalogObservationId && observation.catalogDigest === contentDigest && Number.isFinite(observation.observedAt) &&
+          observation.observedAt >= state.catalog.observedAt) {
+        return { ...state, catalog: { ...state.catalog, observedAt: observation.observedAt } };
+      }
+    } catch { /* Missing, malformed or mismatched freshness never renews old history. */ }
+    finally { await handle?.close(); }
+    return state;
+  }
   async function load(scope) {
     if (!scope) throw new Error('Controller identity unavailable.');
     if (states.has(scope)) return states.get(scope);
@@ -21,24 +44,35 @@ export function createControllerStore(root) {
     try { state = JSON.parse(await readFile(file(scope), 'utf8')); }
     catch (error) { if (error.code !== 'ENOENT') throw error; state = { version: 1, conversations: {}, events: {} }; }
     if (state.version !== 1 || !state.conversations || !state.events) throw new Error('Invalid controller settings.');
+    const contentDigest = state.catalog ? catalogDigest(state.catalog) : null;
+    state = await readObservation(scope, state, contentDigest);
+    if (contentDigest) catalogDigests.set(scope, contentDigest);
     states.set(scope, state); return state;
   }
   function enqueue(work) {
     const pending = queue.catch(() => {}).then(work);
     queue = pending; return pending;
   }
-  async function persist(scope, next) {
+  async function atomicWrite(path, value) {
     await mkdir(join(root, 'controller'), { recursive: true, mode: 0o700 });
-    const path = file(scope), temp = `${path}.${randomUUID()}.tmp`;
-    try { await writeFile(temp, JSON.stringify(next) + '\n', { mode: 0o600 }); await rename(temp, path); }
+    const temp = `${path}.${randomUUID()}.tmp`;
+    try { await writeFile(temp, JSON.stringify(value) + '\n', { mode: 0o600 }); await rename(temp, path); }
     finally { await rm(temp, { force: true }); }
+  }
+  async function persist(scope, next) {
+    await atomicWrite(file(scope), next);
     states.set(scope, next);
   }
   function change(scope, mutate) {
     return enqueue(async () => {
-      const next = structuredClone(await load(scope));
+      const previous = await load(scope), next = structuredClone(previous);
       const result = await mutate(next);
-      await persist(scope, next); return result;
+      await persist(scope, next);
+      // Mutators (including older writers) may edit catalog contents while
+      // retaining unknown root fields. Its digest, not a copied ID, binds the
+      // next receipt; avoid another deep comparison on preference/event writes.
+      catalogDigests.delete(scope);
+      return result;
     });
   }
   function replaceCatalog(scope, catalog, { immutableInput = false } = {}) {
@@ -49,9 +83,25 @@ export function createControllerStore(root) {
     // callers retain immediate mutation isolation, including while queued.
     const snapshot = immutableInput ? catalog : structuredClone(catalog);
     return enqueue(async () => {
-      const settings = { ...await load(scope) };
+      const previous = await load(scope);
+      const { observedAt: previousTime, ...previousContent } = previous.catalog || {};
+      const { observedAt, ...content } = snapshot;
+      if (previous.catalogObservationId && Number.isFinite(observedAt) && observedAt >= previousTime &&
+          isDeepStrictEqual(previousContent, content)) {
+        // The owned row array is shared across unchanged desktop snapshots.
+        // Renew CLI freshness with a tiny receipt rather than serialize/write
+        // the entire history on every connection heartbeat. Bind it to this
+        // exact durable base so a crash or later base cannot renew old rows.
+        const contentDigest = catalogDigests.get(scope) || catalogDigest(previous.catalog);
+        await atomicWrite(observationFile(scope), { catalogId: previous.catalogObservationId, catalogDigest: contentDigest, observedAt });
+        catalogDigests.set(scope, contentDigest);
+        states.set(scope, { ...previous, catalog: snapshot });
+        return;
+      }
+      const settings = { ...previous };
       delete settings.catalog;
-      await persist(scope, { ...structuredClone(settings), catalog: snapshot });
+      await persist(scope, { ...structuredClone(settings), catalogObservationId: randomUUID(), catalog: snapshot });
+      catalogDigests.set(scope, catalogDigest(snapshot));
     });
   }
   return { load, change, replaceCatalog, peek: scope => states.get(scope),

package/src/session-supervision/owner-transport.js

@@ -45,7 +45,8 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
         if (!authenticated) {
           if (command.nonce !== nonce) { peer.destroy(); return; }
           authenticated = true; desktopClient = allowDesktopClient && command.client === 'desktop'; controllerArchive = allowControllerArchive && command.client === 'archive-controller'; clearTimeout(timeout); peers.add(peer);
-          if (desktopClient && (command.desktopProtocol === 2 || command.catalogDeltas === 1)) catalogEncoders.set(peer, createDesktopCatalogEncoder());
+          if (desktopClient && (command.desktopProtocol === 2 || command.catalogDeltas === 1))
+            catalogEncoders.set(peer, createDesktopCatalogEncoder({ version: command.catalogVersion === 2 ? 2 : 1 }));
           if ([1, 2].includes(command.desktopProtocol) && desktopClient) send(peer, { type: 'desktop_owner_ready', version: catalogEncoders.has(peer) ? 2 : 1 });
           // One-shot controls need their result, not multi-megabyte broadcasts
           // that can fill the write queue before the result is sent.
@@ -119,7 +120,8 @@ export async function relayToOwner({ root, webOrigin, input = process.stdin, out
   } catch (error) { peer.destroy(); throw error; }
   // A protocol-1 owner replies with complete frames. New native windows accept
   // both versions, so attaching never requires replacing its execution owner.
-  peer.write(JSON.stringify({ nonce: owner.nonce, ...(desktopClient ? { client: 'desktop', desktopProtocol: 1, ...(catalogDeltas ? { catalogDeltas: 1 } : {}) } : {}) }) + '\n');
+  peer.write(JSON.stringify({ nonce: owner.nonce, ...(desktopClient ? { client: 'desktop', desktopProtocol: 1,
+    ...(catalogDeltas ? { catalogDeltas: 1, ...(catalogDeltas === 2 ? { catalogVersion: 2 } : {}) } : {}) } : {}) }) + '\n');
   // Old owners ignore unknown hello fields and expose only the restricted SSH
   // projection. Never attach a native window or forward its controls as though
   // that were a complete desktop endpoint. Keep the original owner untouched.

package/src/sqm/claude-plugin.js

@@ -61,6 +61,8 @@ export async function claudePluginFiles() {
   files.set("hooks/purpose-evidence.mjs", await readFile(path.join(SOURCE, "hooks/purpose-evidence.mjs"), "utf8"));
   files.set("hooks/user-experience.mjs", await readFile(path.join(SOURCE, "hooks/user-experience.mjs"), "utf8"));
   files.set("hooks/result-cycle.mjs", await readFile(path.join(SOURCE, "hooks/result-cycle.mjs"), "utf8"));
+  for (const name of ['measurement-contract', 'measurement-store', 'measurement-snapshot', 'measurement-judge', 'measurement-collector'])
+    files.set(`hooks/${name}.mjs`, await readFile(path.join(SOURCE, `hooks/${name}.mjs`), 'utf8'));
   files.set("hooks/scene-reasoning.mjs", await readFile(path.join(SOURCE, "hooks/scene-reasoning.mjs"), "utf8"));
   files.set("hooks/purpose-cycle.mjs", await readFile(path.join(SOURCE, "hooks/purpose-cycle.mjs"), "utf8"));
   files.set("hooks/purpose-rule-policy.mjs", await readFile(path.join(SOURCE, "hooks/purpose-rule-policy.mjs"), "utf8"));

package/src/sqm/history-store.js

@@ -6,6 +6,9 @@ import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promise
 import { basename, join } from "node:path";
 import { formatSqmCoverage, sqmCoverageWarnings } from "./report.js";
 import { defaultSessionRoot } from "../session-store.js";
+import { recordMeasurementSqm } from '../codex-plugins/simy/hooks/measurement-collector.mjs';
+import { measurementBinding, appendMeasurement, measurementCollectionEnabled } from '../codex-plugins/simy/hooks/measurement-store.mjs';
+import { measurementDigest } from '../codex-plugins/simy/hooks/measurement-contract.mjs';
 
 // Limit the desktop projection, never the durable history.
 const DISPLAY_LIMIT = 100;
@@ -132,11 +135,35 @@ export function projectSqmHistory(items, live = { activeCount: 0, items: [] }) {
 }
 
 export function createSqmCheckRecorder({ root, scope, phase, cwd, baseBranch, providerSession, conversationProvider, onError = () => console.warn("Could not save the local SQM check history.") }) {
-  if (!scope?.webOrigin || !scope?.accountId || !scope?.organizationId) return async () => {};
+  const historyEnabled = Boolean(scope?.webOrigin && scope?.accountId && scope?.organizationId);
   const history = createSqmHistoryStore({ root });
   const key = `sqm-check:${randomUUID()}`;
   const startedAt = new Date().toISOString();
+  const measurementRoot = join(root || defaultSessionRoot(), 'delivery-hooks');
+  // Pin the current trace before the check starts. A new task in the same
+  // provider conversation cannot inherit the old task's late SQM result.
+  const measurement = providerSession && conversationProvider ? measurementBinding(measurementRoot, conversationProvider, providerSession).catch(() => null) : Promise.resolve(null);
   return async (result, presentation = {}) => {
+    try {
+      const binding = await measurement;
+      if (binding && measurementCollectionEnabled(measurementRoot, conversationProvider, providerSession, binding.trace)) {
+        const context = { root: measurementRoot, provider: conversationProvider, session: providerSession, trace: binding.trace };
+        if (result.proof) await recordMeasurementSqm({ ...context, result });
+        else await appendMeasurement({ ...context, type: 'sqm_attempt', key,
+          data: { attempt: measurementDigest(key), phase: phase === 'min' ? 'min' : 'full',
+            outcome: result.status === 'unavailable' ? 'unavailable' : ['failed', 'preliminary_failed'].includes(result.status) ? 'failed' : ['passed', 'preliminary_passed'].includes(result.status) ? 'passed' : 'unknown',
+            candidate: result.repository_identity ? measurementDigest(result.repository_identity) : null,
+            diagnostic: result.diagnostic ? measurementDigest(result.diagnostic) : null } });
+      }
+    } catch {
+      console.warn('Adoption measurement could not retain this SQM observation.');
+      try {
+        const binding = await measurement;
+        if (binding) await appendMeasurement({ root: measurementRoot, provider: conversationProvider, session: providerSession, trace: binding.trace,
+          type: 'gap', key: `sqm:${key}`, data: { reason: 'capture_failed' } });
+      } catch { /* The collection audit must report the damaged journal. */ }
+    }
+    if (!historyEnabled) return;
     const proof = result.proof, identity = proof?.repository_identity || result.repository_identity || result.min_check?.repository_identity;
     const repository = identity?.repository || result.repository;
     const outcome = result.status === "stale" ? "stale" : proof?.outcome.status || result.min_check?.status || result.status;

package/src/web-api.js

@@ -17,6 +17,9 @@ export function publicImageUrl(value) {
 
 const APP_DEV_ORIGIN = "https://app-dev.simy.one";
 const APP_DEV_GATEWAY_BASE_URL = "https://app.simy.one/api/local-cli-gateway/";
+// An isolated dev build can explicitly select the dev gateway before a new
+// route reaches stable. Never infer this endpoint or redirect a saved session.
+const APP_DEV_LOCAL_GATEWAY_BASE_URL = "https://app-dev.simy.one/api/local-cli-gateway/";
 
 export function resolveWebApiBaseUrl(webOrigin, requestedBaseUrl = null) {
   const normalizedWebOrigin = new URL(webOrigin).origin;
@@ -36,9 +39,9 @@ export function resolveWebApiBaseUrl(webOrigin, requestedBaseUrl = null) {
   if (requested.href === directBase) return directBase;
   if (
     normalizedWebOrigin === APP_DEV_ORIGIN &&
-    requested.href === APP_DEV_GATEWAY_BASE_URL
+    [APP_DEV_GATEWAY_BASE_URL, APP_DEV_LOCAL_GATEWAY_BASE_URL].includes(requested.href)
   ) {
-    return APP_DEV_GATEWAY_BASE_URL;
+    return requested.href;
   }
   throw new Error("SIMY Web provided an untrusted CLI API endpoint.");
 }