@axiom-lattice/core 4.2.4 → 4.2.6

package/dist/index.mjs

@@ -1982,6 +1982,7 @@ function cloneWebApp(webApp) {
     },
     features: { ...webApp.features },
     appearance: { ...webApp.appearance },
+    identity: webApp.identity ? { policy: webApp.identity.policy, issuers: webApp.identity.issuers.map((issuer) => ({ ...issuer })) } : void 0,
     createdAt: new Date(webApp.createdAt),
     updatedAt: new Date(webApp.updatedAt)
   };
@@ -2027,6 +2028,7 @@ var InMemoryAgentWebAppStore = class {
       },
       features: { ...input.features },
       appearance: { ...input.appearance },
+      identity: input.identity ? { policy: input.identity.policy, issuers: input.identity.issuers.map((issuer) => ({ ...issuer })) } : void 0,
       createdAt: now,
       updatedAt: now
     };
@@ -2043,7 +2045,7 @@ var InMemoryAgentWebAppStore = class {
     const existing = tenantWebApps?.get(webAppId);
     if (!tenantWebApps || !existing) return null;
     if (options?.expectedUpdatedAt && existing.updatedAt.getTime() !== options.expectedUpdatedAt.getTime()) return null;
-    const hasUpdate = patch.name !== void 0 || Object.prototype.hasOwnProperty.call(patch, "description") || patch.scope !== void 0 || patch.features !== void 0 || patch.appearance !== void 0 || patch.status !== void 0;
+    const hasUpdate = patch.name !== void 0 || Object.prototype.hasOwnProperty.call(patch, "description") || patch.scope !== void 0 || patch.features !== void 0 || patch.appearance !== void 0 || patch.identity !== void 0 || patch.status !== void 0;
     if (!hasUpdate) return cloneWebApp(existing);
     const updated = {
       ...existing,
@@ -2058,6 +2060,7 @@ var InMemoryAgentWebAppStore = class {
       } : {},
       ...patch.features ? { features: { ...patch.features } } : {},
       ...patch.appearance ? { appearance: { ...patch.appearance } } : {},
+      ...patch.identity !== void 0 ? { identity: { policy: patch.identity.policy, issuers: patch.identity.issuers.map((issuer) => ({ ...issuer })) } } : {},
       ...patch.status !== void 0 ? { status: patch.status } : {},
       updatedAt: new Date(Math.max(Date.now(), existing.updatedAt.getTime() + 1))
     };
@@ -7246,7 +7249,8 @@ var VolumeFilesystem = class {
       path: entry.path.startsWith("/") ? entry.path : prefix + entry.path,
       is_dir: entry.kind === "directory",
       size: entry.size,
-      modified_at: entry.modified ? new Date(entry.modified).toISOString() : void 0
+      modified_at: entry.modified ? new Date(entry.modified).toISOString() : void 0,
+      created_at: entry.created ? new Date(entry.created).toISOString() : void 0
     }));
   }
   async read(filePath, offset = 0, limit = 2e3) {
@@ -12261,6 +12265,18 @@ async function createCommonMiddlewares(middlewareConfigs, filesystemBackend, fsI
 
 // src/deep_agent_new/backends/sandboxFiles.ts
 import * as path3 from "path";
+import micromatch2 from "micromatch";
+function matchesGlobFilter(matchPath, searchPath, glob) {
+  if (!glob || glob === "**/*") {
+    return true;
+  }
+  if (!glob.includes("/")) {
+    return micromatch2.isMatch(path3.basename(matchPath), glob, { dot: true });
+  }
+  const base = searchPath.endsWith("/") ? searchPath : `${searchPath}/`;
+  const relative4 = matchPath.startsWith(base) ? matchPath.slice(base.length) : matchPath;
+  return micromatch2.isMatch(relative4, glob, { dot: true });
+}
 var SandboxFilesystem = class {
   constructor(options = {}) {
     const { maxFileSizeMb = 10, sandboxInstance } = options;
@@ -12387,6 +12403,16 @@ var SandboxFilesystem = class {
   }
   async grepRaw(pattern, searchPath = "/", glob = null) {
     try {
+      if (this.sandbox.file.grepRecursive) {
+        const result2 = await this.sandbox.file.grepRecursive(
+          pattern,
+          searchPath || "/"
+        );
+        const globFilter = glob || "**/*";
+        return result2.matches.filter(
+          (match) => matchesGlobFilter(match.path, searchPath || "/", globFilter)
+        );
+      }
       const result = await this.sandbox.file.findFiles(searchPath || "/", glob || "**/*");
       const filePaths = result.files;
       const matches = [];
@@ -18542,7 +18568,7 @@ import * as fsSync from "fs";
 import * as path4 from "path";
 import { spawn } from "child_process";
 import fg from "fast-glob";
-import micromatch2 from "micromatch";
+import micromatch3 from "micromatch";
 var SUPPORTS_NOFOLLOW = fsSync.constants.O_NOFOLLOW !== void 0;
 var FilesystemBackend = class {
   constructor(options = {}) {
@@ -19043,7 +19069,7 @@ var FilesystemBackend = class {
     });
     for (const fp of files) {
       try {
-        if (includeGlob && !micromatch2.isMatch(path4.basename(fp), includeGlob)) {
+        if (includeGlob && !micromatch3.isMatch(path4.basename(fp), includeGlob)) {
           continue;
         }
         const stat5 = await fs2.stat(fp);
@@ -22542,8 +22568,12 @@ Otherwise, the owning caller interprets the returned observation.
 An execution result is an observation, not automatic proof of business
 completion. \`task\` returns its exact \`executionResultId\`. After \`task\`
 returns, inspect the observation, then pass that \`executionResultId\` to the
-meaningful \`manage_task update\` or \`manage_task add_activity\` that interprets
-it and reconciles status, belief, plan, and next action. Omitting
+meaningful \`manage_task set_status\` (status transition), \`manage_task
+update\` (content fields), or \`manage_task add_activity\` that interprets
+it and reconciles status, belief, plan, and next action. Action split:
+\`set_status\` owns status transitions (with result/failureReason/summary and
+beliefImpact on completion); \`update\` owns content fields (title,
+description, priority, dependencies, ...); the two never mix in one call. Omitting
 \`executionResultId\` leaves the result pending so forgotten handling remains
 detectable. Reconciliation does not require the task to become \`completed\`;
 choose the truthful status. \`manage_task get\` exposes pending execution-result
@@ -22563,13 +22593,14 @@ independently.
 6. **Reconcile** - revise Belief, Task, plan, and next action on Prediction Error,
    then repeat only while a decision-relevant action remains and stop at honest convergence.
 
-Converge using existing statuses:
+Converge through \`set_status\` using existing statuses:
 
-- \`completed\`: acceptance is satisfied by evidence; include a \`result\`.
+- \`completed\`: acceptance is satisfied by evidence; \`set_status\` with a
+  \`result\` and structured \`beliefImpact\`.
 - \`in_progress\`: a feasible, decision-relevant action remains.
 - \`pending\`: work is future or dependency-blocked.
 - \`interrupted\`: an external condition is missing; record the condition needed to resume.
-- \`failed\`: no reasonable path remains; include a \`failureReason\`.
+- \`failed\`: no reasonable path remains; \`set_status\` with a \`failureReason\`.
 - \`cancelled\`: the goal or subgoal is no longer needed.
 
 For human judgment, use the actual HITL payload \`status: "interrupted"\` plus
@@ -23859,6 +23890,35 @@ Renew HITL approval when a foundational assumption or authority boundary changes
 
 **Full reference**: [[eval-verify]] implements the same loop for the eval fix loop, with the full six-heading format (## Observed Failure / ## Implicated Design Assumption / ## Candidate Change / ## Expected Improvement / ## Possible Regression / ## Cases That Can Falsify the Change). [[task-tracking]] implements the same loop for persistent task operations.
 
+## Skill Loading Policy
+
+Visible in <available_skills> does not mean loaded. Follow these three tiers.
+
+### Tier 1 \u2014 Session start (mandatory, unconditional)
+Load before any other work; the bootstrap prompt enforces this:
+- [[agent-architecture]] (this skill) \u2014 shared policy and routing.
+- [[task-tracking]] \u2014 before your first \`manage_task\` call; Task management is
+  the planning surface and is gated again under Architect Task Policy.
+
+### Tier 2 \u2014 Scenario gates (mandatory before entering the scenario)
+Load the owning skill with the \`skill\` tool BEFORE the first action of that
+scenario. Never execute a scenario without its owning skill loaded:
+- Creating or modifying a Capability (\`react\`) or Orchestra (\`deep_agent\`)
+  Agent \u2192 [[agent-build]]
+- Creating or modifying a Workflow (stable enumerable pipelines) \u2192 [[design-workflow]]
+- Learning a capability from source material \u2192 [[document-learning-learn-capability]]
+- Designing evals, running evals, or fixing eval failures \u2192 [[eval-verify]]
+- Claiming work is complete or delivered \u2192 [[completion-gate]]
+- Final configuration pre-check before delivery \u2192 [[review-agent]]
+
+If a Tier 2 load fails, retry once, then stop and tell the user which
+capability is unavailable. Do not improvise the scenario from partial knowledge.
+
+### Tier 3 \u2014 Reference (load on demand, never preload)
+Deep details reachable through [[links]] inside loaded skills, and plugin
+skills outside this chain (for example task-definition for non-architect
+agents). Load one only when the current step actually needs it.
+
 ## Agent Forms and Routing
 - **Capability** (\`react\`) for bounded direct work: [[agent-build]]
 - **Orchestra** (\`deep_agent\`) for open-ended delegated work: [[agent-build]]
@@ -23871,8 +23931,11 @@ Renew HITL approval when a foundational assumption or authority boundary changes
 ## Architect Task Policy
 The Agent Architect uses persistent TaskItems as its planning surface. Architect must not use
 \`write_todos\`. Create a persistent child only for an independently verifiable
-outcome; tool calls and file reads are actions inside the active Task. Load
-[[task-tracking]] for operation and status details.
+outcome; tool calls and file reads are actions inside the active Task.
+**MANDATORY: before your first \`manage_task\` call in this session, load
+[[task-tracking]] with the \`skill\` tool.** Do not create, update, or transition
+any Task until it is loaded. If the load fails, retry once, then tell the user
+task management is unavailable.
 Learning authority is **normal** or **bounded**: normal for fresh work without a
 bound round; bounded for learning rounds that bind an existing target and
 tracking Task with a confirmed goal. Identity remains fixed; materialization uses
@@ -24101,6 +24164,9 @@ ${TASK_BELIEF_REFERENCE_EXAMPLE}
 
 ## Status discipline \u2014 MANDATORY
 
+- All status transitions go through \`manage_task set_status\` (with
+  \`result\` on completed, \`failureReason\` on failed). \`update\` is for
+  content fields only and rejects a status field.
 - A subtask is \`completed\` ONLY when its work is actually finished.
   While fixing eval failures, keep it \`in_progress\` \u2014 never mark
   \`completed\` as a workaround (the state machine rejects illegal
@@ -24345,12 +24411,18 @@ flows the decomposition is presented for user confirmation first.
 **3. Create each sub-agent.** After [[agent-architecture]] is loaded, per sub-agent:
 Call \`create_agent(type: "react", skillLoaded: true, skills: ["[[skill-name]]", ...)\`
 where skillLoaded: true is set only after [[agent-architecture]] is loaded.
-- Each sub-agent gets its OWN eval project: \`manage_eval create_project(name: "eval-{{sub-agent-id}}")\`
+- Each sub-agent gets its OWN eval project (eval-{sub-agent-id}); per [[eval-verify]]
+  Setup, first resolve the sub-agent's exact id and check whether its project already
+  exists \u2014 reuse it when it does; only create (and confirm) when it does not. Never
+  create a duplicate project for an agent that already has one.
 - Design eval cases per [[eval-design-tests]], run per [[eval-verify]]
 - Sub-agent eval passes before you proceed to the next sub-agent
 
 **4. Integration eval.** After ALL sub-agents pass their evals:
-- Create integration eval project: \`manage_eval create_project(name: "eval-{{parent-id}}")\`
+- The integration project for the parent (eval-{parent-id}) goes through the same
+  [[eval-verify]] Setup check: confirm the parent's project does not already exist,
+  present the proposed creation to the user, then
+  \`manage_eval create_project(name: "eval-{parent-id}", targetAgentId: "{parent-id}", evalVerifyLoaded: true)\`.
 - Integration eval tests the parent's delegation logic, not sub-agent correctness
 - [[eval-verify]] owns the run
 
@@ -24583,14 +24655,39 @@ its evidence projection, not an independent source of goals or expectations.
    before calling manage_eval") apply to every manage_eval call in this skill \u2014 not
    just during the case design phase. Do not call manage_eval without presenting the
    change first.
-1. **One eval project per agent**, named \`eval-{agent-id}\`:
-   \`read_eval list_projects\` \u2192 find "eval-{agent-id}"
-   Exists \u2192 reuse projectId. New \u2192 \`manage_eval create_project(name: "eval-{agent-id}")\`
-   - The agent-id is the eval project's subject. Observability: from an
-     agent's id you can find its eval project by naming convention.
+1. **Resolve the subject agent FIRST \u2014 one eval project per agent, never per task or per round.**
+   An eval project belongs to exactly one agent-under-test, named \`eval-{agent-id}\`.
+   The agent-id is the eval project's subject. Observability: from an agent's id you
+   can find its eval project by naming convention. Before ANY project creation you MUST:
+   - **Pin the exact subject agent-id.** The subject is the materialized target agent
+     being evaluated: the id returned by \`create_agent\` / \`update_agent\` /
+     \`create_workflow\` / \`update_workflow\`, or the exact bound target ID pinned by
+     the learning kickoff / round task. It is NEVER the Architect session id, the
+     round/task id, a skill name, or any invented label.
+   - **If the exact agent-id is unknown or unconfirmed \u2014 STOP and ask.** Do NOT guess a
+     name, do NOT create a project, and do NOT proceed to case design. Present which
+     agent is under test and confirm with the user (\`ask_user_to_clarify\`) before
+     touching any eval project. An eval project created without a real, confirmed
+     subject is a hard error. If the agent is only planned (not yet materialized),
+     evaluation must wait until materialization returns its id.
+   - **Check existence before creating; reuse is the rule, creation is the exception.**
+     1) \`read_eval list_projects\`
+     2) Find the project whose \`targetAgentId\` equals the subject agent-id; fall back
+        to the name \`eval-{agent-id}\` only when no pointer exists (legacy projects).
+     3) Exists \u2192 reuse its projectId. NEVER create a second project for the same agent \u2014
+        project names are unique per tenant and duplicate projects are forbidden.
+     4) Not exists \u2192 present the proposed project (name \`eval-{agent-id}\` +
+        \`targetAgentId\`) and confirm with the user, THEN
+        \`manage_eval create_project(name: "eval-{agent-id}", targetAgentId: "{agent-id}", evalVerifyLoaded: true, ...)\`.
+        The tool refuses create_project without \`evalVerifyLoaded: true\` \u2014 that flag
+        confirms you are following THIS skill's Setup (resolve \u2192 check \u2192 reuse/confirm).
+        Always pass \`targetAgentId\` so the agent\u2194project link is structural, not name-only.
+   - Re-resolve on every round and every fix pass of the same agent. A new round or task
+     is NOT a reason to create a new project \u2014 reuse the agent's canonical project.
    - Orchestrator + subAgents \u2192 one eval project per sub-agent
      (eval-{sub-agent-id}) PLUS one integration eval project for the
-     parent (eval-{parent-id}) \u2014 see Layered verification below.
+     parent (eval-{parent-id}) \u2014 see Layered verification below. Every project goes
+     through the same resolve-then-confirm-then-create check above.
 2. \`manage_eval create_case(suiteId, ...)\` per sample or scenario
    Required: inputMessage, steps=[{agent_id}], outputType, contentAssertion
    **contentAssertion MUST come from the confirmed goal, approved expected output,
@@ -25598,11 +25695,11 @@ function isUndecidedLearningPlaceholder(config) {
   const metadata = getStringMetadata(config);
   return config.type === AgentType3.REACT && metadata.learningPlaceholder === "true" && metadata.architectureStatus === "undecided";
 }
-function requireArchitectSkill(skillLoaded, exeConfig) {
-  if (exeConfig?.configurable?.runConfig?.assistant_id === "agent-architect" && skillLoaded !== true) {
+function requireSkillDeclaration(skillLoaded) {
+  if (skillLoaded !== true) {
     return JSON.stringify({
       success: false,
-      error: "Load the 'agent-architecture' skill before creating or updating an agent."
+      error: "Load the 'agent-architecture' skill via the skill tool (skill_name 'agent-architecture'), then retry this exact call with skillLoaded: true."
     });
   }
   return void 0;
@@ -25715,7 +25812,7 @@ var middlewareConfigSchema = z49.object({
   config: z49.record(z49.any()).optional()
 });
 var createAgentSchema = z49.object({
-  skillLoaded: z49.literal(true).optional().describe("For agent-architect, set true only after loading agent-architecture in the current conversation context."),
+  skillLoaded: z49.boolean().optional().describe("Required on every call: load the 'agent-architecture' skill first via the skill tool (skill_name 'agent-architecture'), then pass skillLoaded: true. Calls without skillLoaded: true fail. Never omit or pass false."),
   name: z49.string().describe("Human-friendly display name for the agent. The machine ID (used in other tools) is auto-generated as a slug from this name (e.g. 'My Cool Agent' \u2192 'my-cool-agent')."),
   description: z49.string().optional().describe("Short description"),
   type: z49.enum(["react", "deep_agent"]).describe("Agent type. Use 'react' for simple single-responsibility agents, 'deep_agent' for complex open-ended agents. For PROCESSING agents (workflow orchestration), use create_processing_agent instead."),
@@ -25736,9 +25833,9 @@ registerToolLattice(
   },
   async (input, exeConfig) => {
     try {
-      const tenantId2 = getTenantId2(exeConfig);
-      const skillError = requireArchitectSkill(input.skillLoaded, exeConfig);
+      const skillError = requireSkillDeclaration(input.skillLoaded);
       if (skillError) return skillError;
+      const tenantId2 = getTenantId2(exeConfig);
       const store = getAssistStore();
       const taskConfigIssue = validateTaskMiddlewareConfig(input.middleware);
       if (taskConfigIssue) return JSON.stringify(taskConfigIssue);
@@ -25773,7 +25870,7 @@ registerToolLattice(
 var createWorkflowSchema = z49.object({
   name: z49.string().describe("Display name for the workflow agent"),
   description: z49.string().optional().describe("Short description"),
-  skillLoaded: z49.literal(true).describe("MUST be true. Set after loading the 'create-workflow' skill."),
+  skillLoaded: z49.boolean().optional().describe("Required on every call: load the 'agent-architecture' skill first via the skill tool (skill_name 'agent-architecture'), then pass skillLoaded: true. Calls without skillLoaded: true fail. Never omit or pass false."),
   yaml: z49.string().describe("The YAML workflow definition in linear DSL format (steps execute top-to-bottom, use parallel: for concurrency)"),
   tools: z49.array(z49.string()).optional().describe("Tool keys for the workflow agent"),
   middleware: z49.array(middlewareConfigSchema).optional().describe("Middleware configs"),
@@ -25788,6 +25885,8 @@ registerToolLattice(
   },
   async (input, exeConfig) => {
     try {
+      const skillError = requireSkillDeclaration(input.skillLoaded);
+      if (skillError) return skillError;
       const tenantId2 = getTenantId2(exeConfig);
       const store = getAssistStore();
       const taskConfigIssue = validateTaskMiddlewareConfig(input.middleware);
@@ -25928,7 +26027,7 @@ registerToolLattice(
 );
 var updateWorkflowSchema = z49.object({
   id: z49.string().describe("The workflow agent ID to update"),
-  skillLoaded: z49.literal(true).optional().describe("For agent-architect, set true only after loading agent-architecture in the current conversation context."),
+  skillLoaded: z49.boolean().optional().describe("Required on every call: load the 'agent-architecture' skill first via the skill tool (skill_name 'agent-architecture'), then pass skillLoaded: true. Calls without skillLoaded: true fail. Never omit or pass false."),
   name: z49.string().optional().describe("New display name"),
   description: z49.string().optional().describe("New description"),
   yaml: z49.string().optional().describe("Replacement YAML workflow DSL. Omit to keep existing."),
@@ -25940,13 +26039,13 @@ registerToolLattice(
   "update_workflow",
   {
     name: "update_workflow",
-    description: "Update an existing workflow agent or materialize an eligible marked learning placeholder. For agent-architect, pass skillLoaded: true after loading agent-architecture. Placeholder eligibility is not proof that the user approved the architecture; approval remains a prompt/HITL contract.",
+    description: "Update an existing workflow agent or materialize an eligible marked learning placeholder. Pass skillLoaded: true on every call after loading agent-architecture (skill tool, skill_name 'agent-architecture'); calls without it fail. Placeholder eligibility is not proof that the user approved the architecture; approval remains a prompt/HITL contract.",
     schema: updateWorkflowSchema
   },
   async (input, exeConfig) => {
     console.log(`[update_workflow] CALLED id=${input.id} hasYaml=${input.yaml !== void 0}`);
     try {
-      const skillError = requireArchitectSkill(input.skillLoaded, exeConfig);
+      const skillError = requireSkillDeclaration(input.skillLoaded);
       if (skillError) return skillError;
       const tenantId2 = getTenantId2(exeConfig);
       const store = getAssistStore();
@@ -26024,7 +26123,7 @@ registerToolLattice(
         description: input.description !== void 0 ? input.description : existing.description,
         graphDefinition: mergedConfig
       });
-      if (isPlaceholder && updated === null) {
+      if (updated === null) {
         return JSON.stringify({
           success: false,
           code: "ASSISTANT_UPDATE_FAILED",
@@ -26042,7 +26141,7 @@ registerToolLattice(
 );
 var updateAgentSchema = z49.object({
   id: z49.string().describe("The agent ID to update"),
-  skillLoaded: z49.literal(true).optional().describe("For agent-architect, set true only after loading agent-architecture in the current conversation context."),
+  skillLoaded: z49.boolean().optional().describe("Required on every call: load the 'agent-architecture' skill first via the skill tool (skill_name 'agent-architecture'), then pass skillLoaded: true. Calls without skillLoaded: true fail. Never omit or pass false."),
   config: z49.object({
     name: z49.string().optional().describe("New display name for the agent"),
     description: z49.string().optional().describe("New short description"),
@@ -26060,14 +26159,14 @@ registerToolLattice(
   "update_agent",
   {
     name: "update_agent",
-    description: "Update an existing agent's configuration. Provide the agent ID and the fields to change. Returns the updated agent's ID and name. NOTE: For user approval/confirmation scenarios, add middleware with type: 'ask_user_to_clarify'. IMPORTANT: do NOT set 'modelKey' unless the user explicitly specified a model \u2014 leaving it unset makes the runtime use the 'default' model.",
+    description: "Update an existing agent's configuration. Provide the agent ID and the fields to change. Returns the updated agent's ID and name. Pass skillLoaded: true on every call after loading agent-architecture (skill tool, skill_name 'agent-architecture'); calls without it fail. NOTE: For user approval/confirmation scenarios, add middleware with type: 'ask_user_to_clarify'. IMPORTANT: do NOT set 'modelKey' unless the user explicitly specified a model \u2014 leaving it unset makes the runtime use the 'default' model.",
     schema: updateAgentSchema
   },
   async (input, exeConfig) => {
     try {
-      const tenantId2 = getTenantId2(exeConfig);
-      const skillError = requireArchitectSkill(input.skillLoaded, exeConfig);
+      const skillError = requireSkillDeclaration(input.skillLoaded);
       if (skillError) return skillError;
+      const tenantId2 = getTenantId2(exeConfig);
       const store = getAssistStore();
       const existing = await store.getAssistantById(tenantId2, input.id);
       if (!existing) {
@@ -26107,7 +26206,7 @@ registerToolLattice(
         description: input.config.description !== void 0 ? input.config.description : existing.description,
         graphDefinition: mergedConfig
       });
-      if (isMaterializingPlaceholder && updated === null) {
+      if (updated === null) {
         return JSON.stringify({
           success: false,
           code: "ASSISTANT_UPDATE_FAILED",
@@ -26336,8 +26435,11 @@ var AGENT_ARCHITECT_PROMPT = `You are the Agent Architect.
 
 CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
 tool with skill_name: "agent-architecture" to load agent-architecture and follow it.
-Never announce the skill load. If it fails, retry once, then stop and explicitly
-report that the required Agent Architect skill could not be loaded.`;
+Immediately after it loads, call the \`skill\` tool again with skill_name:
+"task-tracking" \u2014 persistent Task management is your core planning surface and
+you must have its operation reference before creating or updating any Task.
+Never announce skill loads. If a load fails, retry once, then stop and
+explicitly report that the required skill could not be loaded.`;
 
 // src/agent_lattice/agentReviewerConfig.ts
 import { AgentType as AgentType4 } from "@axiom-lattice/protocols";
@@ -28324,6 +28426,25 @@ var mcpManager = McpLatticeManager.getInstance();
 // src/sandbox_lattice/MicrosandboxRemoteInstance.ts
 import * as posix3 from "path/posix";
 
+// src/sandbox_lattice/grepUtils.ts
+function buildRecursiveGrepCommand(pattern, path8) {
+  return `grep -r -n -I -E -e ${quotePosixShellArg(pattern)} ${quotePosixShellArg(path8)}`;
+}
+function parseRecursiveGrepOutput(output) {
+  const matches = [];
+  for (const line of output.split("\n")) {
+    if (!line) continue;
+    const match = /^(.*):(\d+):(.*)$/.exec(line);
+    if (!match) continue;
+    matches.push({
+      path: match[1],
+      line: Number.parseInt(match[2], 10),
+      text: match[3]
+    });
+  }
+  return matches;
+}
+
 // src/sandbox_lattice/packDirectory.ts
 import { randomBytes } from "crypto";
 import * as posix2 from "path/posix";
@@ -28459,6 +28580,15 @@ var MicrosandboxRemoteInstance = class {
           line_numbers: result.matches.map((match) => match.line)
         };
       },
+      grepRecursive: async (pattern, searchPath) => {
+        const result = await this.shell.execCommand({
+          command: buildRecursiveGrepCommand(
+            pattern,
+            normalizeExternalSandboxPath(searchPath)
+          )
+        });
+        return { matches: parseRecursiveGrepOutput(result.output) };
+      },
       strReplaceEditor: async (params) => {
         await this.client.replaceInFile(this.name, {
           path: normalizeExternalSandboxPath(params.path),
@@ -28991,6 +29121,13 @@ var RemoteSandboxInstance = class {
           line_numbers: result.body.data?.line_numbers || []
         };
       },
+      grepRecursive: async (pattern, searchPath) => {
+        const resolved = this.resolvePath(searchPath);
+        const result = await this.shell.execCommand({
+          command: buildRecursiveGrepCommand(pattern, resolved)
+        });
+        return { matches: parseRecursiveGrepOutput(result.output) };
+      },
       strReplaceEditor: async (params) => {
         const resolved = this.resolvePath(params.path);
         const result = await this.client.file.strReplaceEditor({
@@ -29294,7 +29431,8 @@ var RemoteSandboxProvider = class {
           kind: f.is_dir === true || f.size === null ? "directory" : "file",
           size: f.size ?? 0,
           mode: 0,
-          modified: f.modified_at ?? null
+          modified: f.modified_at ?? null,
+          created: f.created_at ?? null
         }));
         return entries;
       },
@@ -29370,6 +29508,12 @@ var E2BInstance = class {
         }
         return { matches, line_numbers };
       },
+      grepRecursive: async (pattern, searchPath) => {
+        const result = await this.native.commands.run(
+          buildRecursiveGrepCommand(pattern, searchPath)
+        );
+        return { matches: parseRecursiveGrepOutput(result.stdout) };
+      },
       strReplaceEditor: async (params) => {
         const { path: path8, old_str, new_str, replace_mode } = params;
         const delim = "#";
@@ -29568,6 +29712,21 @@ var DaytonaInstance = class {
         }
         return { matches: matchTexts, line_numbers };
       },
+      grepRecursive: async (pattern, searchPath) => {
+        const matches = await this.native.fs.findFiles(
+          toRelativePath(searchPath),
+          pattern
+        );
+        const results = [];
+        for (const match of matches) {
+          results.push({
+            path: normalizeExternalSandboxPath(match.file ?? ""),
+            line: match.line ?? 0,
+            text: match.content ?? ""
+          });
+        }
+        return { matches: results };
+      },
       strReplaceEditor: async (params) => {
         const { path: path8, old_str, new_str, replace_mode } = params;
         const relPath = toRelativePath(path8);
@@ -29950,6 +30109,37 @@ var LocalSandboxInstance = class {
         }
         return { matches, line_numbers };
       },
+      grepRecursive: async (pattern, searchPath) => {
+        const hp = this.hostPath(searchPath);
+        let regex;
+        try {
+          regex = new RegExp(pattern);
+        } catch {
+          return { matches: [] };
+        }
+        const hostFiles = [];
+        await this.walkDirFilter(hp, /.+/, hostFiles);
+        const hpNorm = hp.endsWith(path5.sep) ? hp : hp + path5.sep;
+        const toSandboxPath = (hostFilePath) => posix5.join(searchPath, hostFilePath.slice(hpNorm.length).split(path5.sep).join("/"));
+        const matches = [];
+        for (const hostFile of hostFiles) {
+          const content = await fs3.readFile(hostFile, "utf-8").catch(() => null);
+          if (content === null || content.includes("\0")) {
+            continue;
+          }
+          const lines = content.split("\n");
+          for (let i = 0; i < lines.length; i++) {
+            if (regex.test(lines[i])) {
+              matches.push({
+                path: toSandboxPath(hostFile),
+                line: i + 1,
+                text: lines[i]
+              });
+            }
+          }
+        }
+        return { matches };
+      },
       strReplaceEditor: async (params) => {
         const content = await fs3.readFile(this.hostPath(params.path), "utf-8");
         let result;
@@ -30989,8 +31179,12 @@ Note: if final_score >= 80 and there are no fatal errors, pass should be true; o
         });
       }
     } else if (parsedResult.pass !== void 0) {
-      pass = parsedResult.pass;
-      this.log("Pass determined from parsedResult.pass", { case_id: evalCase.caseId, pass });
+      pass = false;
+      parsedResult.final_score = 0;
+      this.log("Pass without final_score \u2014 cannot verify threshold, defaulting to FAIL", {
+        case_id: evalCase.caseId,
+        pass_field: parsedResult.pass
+      });
     } else if (parsedResult.final_score !== void 0) {
       pass = parsedResult.final_score >= 80;
       this.log("Pass determined from parsedResult.final_score", {
@@ -32738,7 +32932,11 @@ var TaskLifecycleService = class {
           ...event2.warning ? { warnings: [event2.warning] } : {}
         };
       }
-      if (task.status !== "interrupted") return failure2("TASK_STATUS_CONFLICT", "Task is not interrupted.");
+      if (task.status !== "interrupted") return failure2(
+        "TASK_STATUS_CONFLICT",
+        `Task is in '${task.status}' status, not interrupted.`,
+        "Only interrupted tasks can resume to in_progress."
+      );
       if (interruption && typeof interruption === "object" && interruption.type === "review_required") {
         return failure2("REVIEW_APPROVAL_REQUIRED", "Review interruption requires explicit approval or rejection.");
       }
@@ -32835,7 +33033,11 @@ var TaskLifecycleService = class {
         task.updatedAt
       );
     } catch {
-      return { ...failure2("TASK_STORE_WRITE_FAILED", "Failed to update task lifecycle state."), transitioned: false };
+      return { ...failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to update task lifecycle state.",
+        "The store rejected the write; this may be transient. Retry the same set_status."
+      ), transitioned: false };
     }
     if (!updated) {
       let current;
@@ -32863,7 +33065,11 @@ var TaskLifecycleService = class {
           ...repaired.warning ? { warnings: [repaired.warning] } : {}
         };
       }
-      return { ...failure2("TASK_STATUS_CONFLICT", "Task changed concurrently."), transitioned: false };
+      return { ...failure2(
+        "TASK_STATUS_CONFLICT",
+        "Task changed concurrently.",
+        "Another writer modified the task between read and write. Use manage_task get to re-read its current state, then retry."
+      ), transitioned: false };
     }
     const event = await this.writeStatusEvent(
       updated,
@@ -33007,10 +33213,18 @@ var TaskLifecycleService = class {
       const storedExternal = parseExternalDependency(currentInterruption);
       if (input.type === "external_dependency") {
         if (!external || !storedExternal || storedExternal.summary !== external.summary || canonicalJson(storedExternal.dependencyTaskIds) !== canonicalJson(external.dependencyTaskIds)) {
-          return failure2("TASK_STATUS_CONFLICT", "Task is interrupted by a different or malformed external dependency.");
+          return failure2(
+            "TASK_STATUS_CONFLICT",
+            "Task is already interrupted by a different or malformed external dependency.",
+            "Use manage_task get to inspect the existing interruption in task context.interruption."
+          );
         }
       } else if (currentInterruption.type !== input.type || currentInterruption.summary !== summary) {
-        return failure2("TASK_STATUS_CONFLICT", "Task is interrupted by a different request.");
+        return failure2(
+          "TASK_STATUS_CONFLICT",
+          "Task is already interrupted by a different request.",
+          "Use manage_task get to inspect the existing interruption, or resume it first."
+        );
       }
       const detail = storedExternal ? { ...storedExternal } : currentInterruption;
       const eventKey2 = this.statusEventKey(task, "interrupted", detail);
@@ -33027,7 +33241,11 @@ var TaskLifecycleService = class {
         ...warnings2.length ? { warnings: warnings2 } : {}
       };
     }
-    if (task.status !== "in_progress") return failure2("TASK_STATUS_CONFLICT", "Task is not in progress.");
+    if (task.status !== "in_progress") return failure2(
+      "TASK_STATUS_CONFLICT",
+      `Task is in '${task.status}' status, not in progress.`,
+      "Only in_progress tasks can be interrupted. Use manage_task get to check the current status."
+    );
     if (external && isProjectLifecycleTask(task)) {
       const dependencyFailure = await this.validateExternalDependencies(task, external.dependencyTaskIds);
       if (dependencyFailure) return dependencyFailure;
@@ -33040,9 +33258,17 @@ var TaskLifecycleService = class {
         context: mergeInterruptionContext(task.context, interruption, input.threadId)
       }, ["in_progress"], task.updatedAt);
     } catch {
-      return failure2("TASK_STORE_WRITE_FAILED", "Failed to interrupt the task.");
+      return failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to interrupt the task.",
+        "The store rejected the write; this may be transient. Retry the same set_status."
+      );
     }
-    if (!updated) return failure2("TASK_STATUS_CONFLICT", "Task changed concurrently.");
+    if (!updated) return failure2(
+      "TASK_STATUS_CONFLICT",
+      "Task changed concurrently.",
+      "Another writer modified the task between read and write. Use manage_task get to re-read its current state, then retry."
+    );
     const eventKey = this.statusEventKey(updated, "interrupted", interruption);
     const event = await this.writeStatusEvent(updated, input.actor, input.threadId, "interrupted", summary, interruption, eventKey);
     const warnings = event.warning ? [event.warning] : await this.notifyWinningTransition(updated, "interrupted", event);
@@ -33080,7 +33306,11 @@ var TaskLifecycleService = class {
         context: withCompletionAudit(prepared.task.context, prepared.evidence.id, prepared.eventKey)
       }, ["in_progress"]);
     } catch {
-      return failure2("TASK_STORE_WRITE_FAILED", "Failed to complete the task.");
+      return failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to complete the task.",
+        "The store rejected the write; this may be transient. Retry the completion."
+      );
     }
     if (!updated) {
       if (await this.hasStaleAgentParent(prepared)) {
@@ -33643,7 +33873,11 @@ var TaskLifecycleService = class {
     } catch {
       return failure2("TASK_STORE_WRITE_FAILED", "Failed to reconcile task description.");
     }
-    if (!updated) return failure2("TASK_STATUS_CONFLICT", "Task changed concurrently.");
+    if (!updated) return failure2(
+      "TASK_STATUS_CONFLICT",
+      "Task changed concurrently.",
+      "Another writer modified the task between read and write. Use manage_task get to re-read it, then retry the description update."
+    );
     if (changedKeys.length === 0) {
       return {
         success: true,
@@ -36427,7 +36661,7 @@ import z56 from "zod";
 import { tool as tool51 } from "langchain";
 var DESCRIPTION3 = `RUNTIME QUERY SURFACE \u2014 read what is published and answer business questions with numbers. Business agents use ONLY this tool; Builder agents also use it to verify freshly published metrics.
 
-OWNS: read_semantic_catalog (the published semantic model for a datasource: tables, metrics, dimensions, filters) and query_metrics (the semantic metric query: metrics / groupBy / filters / orderBy / limit \u2014 the server generates the SQL, so there is no free-form SQL here).
+OWNS: list_datasources (self-contained datasource discovery \u2014 redacted output, the first step before anything else), read_semantic_catalog (the published semantic model for a datasource: tables, metrics, dimensions, filters) and query_metrics (the semantic metric query: metrics / groupBy / filters / orderBy / limit \u2014 the server generates the SQL, so there is no free-form SQL here).
 
 DOES NOT OWN:
 - Publishing or correcting semantic tables/metrics \u2192 metrics_meta_tool (create_table/update_table/create_metric/update_metric/list_tables/read_table_meta/list_metrics/read_metric_meta).
@@ -36448,6 +36682,18 @@ function createMetricsRuntimeTool(params) {
         const client = await resolveClientFromConnections(input.connectionKey, resolvedConnections, readToolRunConfig(exeConfig));
         const selected = effectiveDatasourceScope(client.getSelectedDataSources(), selectedDataSources);
         switch (input.action) {
+          case "list_datasources": {
+            const result = await client.listDatasources();
+            const filtered = selected.length > 0 ? result.filter((d) => selected.includes(Number(d.id))) : result;
+            const safe = filtered.map((d) => ({
+              id: d.id,
+              name: d.name,
+              sourceType: d.sourceType,
+              description: d.description,
+              statusLabel: d.statusLabel
+            }));
+            return JSON.stringify(safe, null, 2);
+          }
           case "read_semantic_catalog": {
             const ds = resolveDatasourceId(input, exeConfig);
             assertDatasourceSelected(selected, ds);
@@ -36470,11 +36716,11 @@ function createMetricsRuntimeTool(params) {
       name: "metrics_runtime_tool",
       description: DESCRIPTION3,
       schema: z56.object({
-        action: z56.enum(["read_semantic_catalog", "query_metrics"]).describe(
-          "Actions ONLY in this runtime tool: read_semantic_catalog (read the published semantic model: tables, metrics, dimensions \u2014 obtain the datasourceId from metrics_datasource_tool list_datasources first), query_metrics (run a semantic metric query \u2014 the only way to get business numbers). Do NOT put meta-tool actions (list_tables/read_table_meta/create_table/update_table/list_metrics/read_metric_meta/create_metric/update_metric) here"
+        action: z56.enum(["list_datasources", "read_semantic_catalog", "query_metrics"]).describe(
+          "Actions ONLY in this runtime tool: list_datasources (list available datasources \u2014 ALWAYS call this first to obtain the datasourceId; output is redacted to non-sensitive fields), read_semantic_catalog (read the published semantic model: tables, metrics, dimensions), query_metrics (run a semantic metric query \u2014 the only way to get business numbers). Do NOT put meta-tool actions (list_tables/read_table_meta/create_table/update_table/list_metrics/read_metric_meta/create_metric/update_metric) here"
         ),
         connectionKey: z56.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: z56.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (optional if set in runConfig.metricsDataSource)"),
+        datasourceId: z56.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (required for read_semantic_catalog; optional if set in runConfig.metricsDataSource)"),
         query: z56.record(z56.unknown()).optional().describe('Semantic metric query request. Required for the query_metrics action, e.g. { datasourceId: 15, metrics: ["sell_in_nes"], groupBy: ["sales_team"], filters: [{ dimension: "posting_year", operator: "GTE", values: [2024] }], limit: 10 }')
       })
     }
@@ -36939,7 +37185,7 @@ var semanticMetricsPlugin = {
     configSchema: {
       type: "object",
       title: "Semantic Metrics Configuration",
-      description: "First select connections (connections or connectAll). Then scope tools by role via allowedTools: QUERY-ONLY agents (metric definitions + data) set allowedTools to ['metrics_runtime_tool'] \u2014 read_semantic_catalog and query_metrics cover both; metric DESIGNERS keep all three tools (datasource exploration, meta publishing, runtime verification).",
+      description: "First select connections (connections or connectAll). Then scope tools by role via allowedTools: QUERY-ONLY agents (metric definitions + data) set allowedTools to ['metrics_runtime_tool'] \u2014 it is self-contained (list_datasources, read_semantic_catalog, query_metrics); metric DESIGNERS keep all three tools (datasource exploration, meta publishing, runtime verification).",
       properties: {
         connections: {
           type: "array",
@@ -38619,6 +38865,7 @@ import { z as z70 } from "zod";
 import { GraphInterrupt as GraphInterrupt2, interrupt as interrupt4 } from "@langchain/langgraph";
 import {
   isExecutionResultEventKey as isExecutionResultEventKey3,
+  parseTaskBeliefState as parseTaskBeliefState3,
   parseTrustedRunContext as parseTrustedRunContext2,
   requireProjectTaskWorkItemStore
 } from "@axiom-lattice/protocols";
@@ -38929,6 +39176,16 @@ function getRunConfig2(config) {
   const c = config;
   return c?.configurable?.runConfig ?? {};
 }
+function taskUpdateDebug(message, data) {
+  try {
+    console.log(JSON.stringify({ __taskUpdateDebug: true, message, ...data }));
+  } catch {
+    console.log(`[taskUpdateDebug] ${message}`);
+  }
+}
+function taskUpdateBlocked(taskId, code, detail) {
+  taskUpdateDebug("update:blocked", { taskId, code, ...detail });
+}
 function getRuntimeActor2(runConfig) {
   if (runConfig.assistant_id) return `agent:${String(runConfig.assistant_id)}`;
   if (runConfig.user_id) return `user:${String(runConfig.user_id)}`;
@@ -39155,6 +39412,7 @@ async function validateEffectiveDependencies(store, tenantId2, targetScope, depe
   if (blockedBy.length === 0) return void 0;
   return JSON.stringify({
     success: false,
+    code: "DEPENDENCY_BLOCKED",
     error: `Cannot start task: ${blockedBy.length} dependencies not completed`,
     blockedBy,
     invalidScope,
@@ -39305,13 +39563,27 @@ function missingBeliefImpactError() {
     hint: "Provide beliefImpact: [{ key: '<belief-key>', after: <0-100>, basis: '<evidence>' }]"
   });
 }
+function reviewInterruption(task) {
+  const value = task.context?.interruption;
+  if (!value || typeof value !== "object") return void 0;
+  const interruption = value;
+  return interruption.type === "review_required" ? interruption : void 0;
+}
+function buildReviewMarkdown(task) {
+  return genUIMarkdown("task_review", {
+    taskId: task.id,
+    title: task.title,
+    description: task.description,
+    result: task.result
+  });
+}
 var manageTaskSchema = z70.object({
-  action: z70.enum(["create", "get", "list", "update", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, add_activity, delete. To mark a task complete, use update with status='completed'"),
+  action: z70.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
   id: z70.string().optional().describe("Task ID (required for get, update, add_activity, and delete)"),
   title: z70.string().optional().describe("Task title (required for create)"),
   description: z70.string().optional().describe("Task description in Markdown"),
   priority: z70.enum(["low", "medium", "high"]).optional().describe("Priority level"),
-  status: z70.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. Agent summary-only interrupted updates default to missing_input"),
+  status: z70.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Agent summary-only interrupted updates default to missing_input"),
   dueDate: z70.string().optional().describe("Due date (ISO 8601 format)"),
   metadata: z70.record(z70.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
   parentId: z70.string().optional().describe("Parent task ID for grouping subtasks"),
@@ -39322,8 +39594,8 @@ var manageTaskSchema = z70.object({
   requireReview: z70.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
   dependencies: z70.array(z70.string()).optional().describe("List of task IDs that must be completed before this task can start"),
   dependencyTaskIds: z70.array(z70.string().trim().min(1)).optional().describe("Exact blocking task IDs required for an external_dependency interruption"),
-  result: z70.string().optional().describe("Nonblank result summary required when creating or updating a task with status='completed'"),
-  failureReason: z70.string().optional().describe("Nonblank failure reason required when creating or updating a task with status='failed'"),
+  result: z70.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
+  failureReason: z70.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
   files: z70.array(z70.object({
     uri: z70.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
     name: z70.string().optional().describe("Display name"),
@@ -39342,11 +39614,11 @@ var manageTaskSchema = z70.object({
     "Canonical ASCII `execution-result:<suffix>` event key returned by task(); the nonempty suffix allows only A-Z, a-z, 0-9, period, underscore, colon, and hyphen, and is not a database row ID"
   )
 }).superRefine((input, context) => {
-  if (input.executionResultId && input.action !== "update" && input.action !== "add_activity") {
+  if (input.executionResultId && input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity") {
     context.addIssue({
       code: z70.ZodIssueCode.custom,
       path: ["executionResultId"],
-      message: "executionResultId is valid only for update or add_activity"
+      message: "executionResultId is valid only for update, set_status, or add_activity"
     });
   }
 });
@@ -39460,12 +39732,6 @@ function updateValuesEqual(field, requested, persisted) {
   }
   return valuesEqual(requested, persisted);
 }
-function reviewInterruption(task) {
-  const value = task.context?.interruption;
-  if (!value || typeof value !== "object") return void 0;
-  const interruption = value;
-  return interruption.type === "review_required" ? interruption : void 0;
-}
 function reviewModeDisabledResponse() {
   return JSON.stringify({
     success: false,
@@ -39474,14 +39740,6 @@ function reviewModeDisabledResponse() {
     hint: "Configure task middleware with reviewMode 'hitl' before enabling requireReview."
   });
 }
-function buildReviewMarkdown(task) {
-  return genUIMarkdown("task_review", {
-    taskId: task.id,
-    title: task.title,
-    description: task.description,
-    result: task.result
-  });
-}
 function createTaskMiddleware(options = {}) {
   const handleManageTaskAction = async (input, config, validateExecutionResult, markMutation) => {
     const rc = getRunConfig2(config);
@@ -39869,35 +40127,75 @@ function createTaskMiddleware(options = {}) {
         return JSON.stringify({ success: true, data: activity });
       }
       case "update": {
+        taskUpdateDebug("update:enter", {
+          id: input.id,
+          action: input.action,
+          status: input.status,
+          hasResult: input.result !== void 0,
+          hasDescription: input.description !== void 0,
+          tenantId: tenantId2,
+          workspaceId,
+          projectId,
+          authorityKind: delegatedTaskId ? "delegated" : trustedProject ? "trusted" : "ordinary",
+          trustedKind: trustedProject ? trustedProject.projectTask ? "projectTask" : "projectRoom" : void 0
+        });
         if (!input.id) {
+          taskUpdateBlocked(input.id, "MISSING_TASK_ID", {});
           return JSON.stringify({
             success: false,
+            code: "MISSING_TASK_ID",
             error: "id is required for update action",
             hint: "Pass the task ID you want to update"
           });
         }
         if (delegatedTaskId && input.id !== delegatedTaskId) {
+          taskUpdateBlocked(input.id, "DELEGATED_TASK_SCOPE_VIOLATION", { delegatedTaskId });
           return delegatedTaskScopeError(delegatedTaskId);
         }
-        let existing = await store.getById(tenantId2, input.id);
+        const existing = await store.getById(tenantId2, input.id);
+        taskUpdateDebug("update:loaded", existing ? {
+          status: existing.status,
+          updatedAt: existing.updatedAt?.toISOString(),
+          ownerType: existing.ownerType,
+          ownerId: existing.ownerId,
+          workspaceId: existing.workspaceId,
+          projectId: existing.projectId
+        } : { found: false });
         if (!existing) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND", {});
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found`,
-            hint: "Use list to see available tasks and their IDs"
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
           });
         }
         if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND_OR_INACCESSIBLE", {
+            taskWorkspaceId: existing.workspaceId,
+            taskProjectId: existing.projectId,
+            runtimeWorkspaceId: workspaceId,
+            runtimeProjectId: projectId
+          });
           return taskScopeAccessError(input.id);
         }
         if (trustedProject?.projectTask) {
           const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
-          if (trustedFailure) return trustedFailure;
+          if (trustedFailure) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", {
+              taskOwnerId: existing.ownerId,
+              trustedAssistantId: trustedProject.projectTask.assistantId,
+              taskThreadId: existing.context?.thread_id,
+              trustedThreadId: trustedProject.projectTask.threadId
+            });
+            return trustedFailure;
+          }
         }
         if (trustedProject && input.dependencyTaskIds !== void 0) {
           const interruption = input.context?.interruption;
           const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
           if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
+            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
             return JSON.stringify({
               success: false,
               code: "INVALID_EXTERNAL_DEPENDENCY",
@@ -39906,24 +40204,26 @@ function createTaskMiddleware(options = {}) {
           }
         }
         if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
+          taskUpdateBlocked(input.id, "TASK_REASSIGN_ENDPOINT_REQUIRED", {
+            inputOwnerType: input.ownerType,
+            existingOwnerType: existing.ownerType,
+            inputOwnerId: input.ownerId,
+            existingOwnerId: existing.ownerId
+          });
           return JSON.stringify({
             success: false,
             code: "TASK_REASSIGN_ENDPOINT_REQUIRED",
             error: "Project task ownership changes require the reassignment endpoint."
           });
         }
-        if (existing.status === "review" || input.status === "review") {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_STATUS_UNSUPPORTED",
-            error: "Task status is not supported by the task lifecycle."
-          });
-        }
         const isAgentTask = existing.ownerType === "agent";
-        const candidateReviewInterruption = input.status === "interrupted" && input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required" && !!input.result?.trim() && !!input.beliefImpact?.length;
         const changesOwnerType = input.ownerType !== void 0 && input.ownerType !== existing.ownerType;
         const changesAgentIdentity = isAgentTask && (input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId);
         if (changesOwnerType || changesAgentIdentity) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_IMMUTABLE", {
+            changesOwnerType,
+            changesAgentIdentity
+          });
           return JSON.stringify({
             success: false,
             code: "TASK_OWNERSHIP_IMMUTABLE",
@@ -39931,18 +40231,10 @@ function createTaskMiddleware(options = {}) {
             hint: "Create a separate task for different ownership or parentage."
           });
         }
-        const hasMismatchedAgentOutput = isAgentTask && (input.result !== void 0 && input.status !== "completed" && !candidateReviewInterruption || input.failureReason !== void 0 && input.status !== "failed");
-        if (hasMismatchedAgentOutput) {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_LIFECYCLE_TRANSITION_REQUIRED",
-            error: "Agent task result and failureReason require a matching governed lifecycle transition.",
-            hint: "Provide result only with completion, or failureReason only with failure."
-          });
-        }
         const changesOwnership = input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId;
         const changesGovernedState = input.status !== void 0 || input.description !== void 0 || input.result !== void 0 || input.failureReason !== void 0 || input.requireReview !== void 0 || input.context !== void 0;
         if (changesOwnership && changesGovernedState) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_MUTATION_CONFLICT", {});
           return JSON.stringify({
             success: false,
             code: "TASK_OWNERSHIP_MUTATION_CONFLICT",
@@ -39950,17 +40242,389 @@ function createTaskMiddleware(options = {}) {
             hint: "Persist ownership or parent changes separately before changing lifecycle or task content."
           });
         }
+        if (existing.status === "review") {
+          taskUpdateBlocked(input.id, "TASK_STATUS_UNSUPPORTED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_STATUS_UNSUPPORTED",
+            error: "Task status is not supported by the task lifecycle."
+          });
+        }
+        if (input.status !== void 0) {
+          taskUpdateBlocked(input.id, "STATUS_USES_SET_STATUS", { status: input.status });
+          return JSON.stringify({
+            success: false,
+            code: "STATUS_USES_SET_STATUS",
+            error: `Status changes must use the set_status action. Received status='${input.status}'.`,
+            hint: "Call manage_task with action='set_status', id, and status to change the task status. Use action='update' for content fields only."
+          });
+        }
+        if (isAgentTask && input.requireReview === true && options.reviewMode !== "hitl") {
+          return reviewModeDisabledResponse();
+        }
+        if (["completed", "failed", "cancelled"].includes(existing.status) && input.requireReview !== void 0 && input.requireReview !== existing.requireReview) {
+          taskUpdateBlocked(input.id, "TERMINAL_REVIEW_CONFIGURATION_LOCKED", { requireReview: input.requireReview });
+          return JSON.stringify({
+            success: false,
+            code: "TERMINAL_REVIEW_CONFIGURATION_LOCKED",
+            error: "requireReview cannot be changed on a terminal task",
+            hint: "Configure requireReview before the task reaches a terminal status"
+          });
+        }
+        if (existing.status !== "pending" && existing.requireReview === true && input.requireReview === false) {
+          taskUpdateBlocked(input.id, "REVIEW_REQUIREMENT_LOCKED", {});
+          return JSON.stringify({
+            success: false,
+            code: "REVIEW_REQUIREMENT_LOCKED",
+            error: "requireReview cannot be disabled after a task leaves pending",
+            hint: "Configure requireReview while the task is pending"
+          });
+        }
+        if (existing.status === "completed" && input.result !== void 0) {
+          const error = missingTerminalDetail("result", input.result ?? existing.result);
+          if (error) return error;
+        }
+        if (existing.status === "failed" && input.failureReason !== void 0) {
+          const error = missingTerminalDetail(
+            "failureReason",
+            input.failureReason ?? existing.failureReason
+          );
+          if (error) return error;
+        }
         const actor = trustedActor(trustedProject, rc) ?? (existing.ownerType === "agent" ? `agent:${existing.ownerId}` : `user:${existing.ownerId ?? ownerId}`);
-        const threadId = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
+        const workItemStore = getTaskWorkItemStore();
         const lifecycle = isAgentTask ? createTaskLifecycleService({
           taskStore: store,
           workItemStore: trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore()
         }) : void 0;
+        let trustedReferenceSnapshots;
+        if (input.parentId !== void 0 || input.dependencies !== void 0) {
+          if (delegatedTaskId) {
+            const delegatedDependencyError = await validateDelegatedDependencies(
+              store,
+              tenantId2,
+              delegatedTaskId,
+              { workspaceId: existing.workspaceId, projectId: existing.projectId },
+              input.parentId,
+              input.dependencies,
+              input.id
+            );
+            if (delegatedDependencyError) {
+              taskUpdateBlocked(input.id, "DELEGATED_TASK_SCOPE_VIOLATION", { delegatedDependencyError });
+              return delegatedDependencyError;
+            }
+          }
+          const referenceError = await validateReferencedTasks(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            input.parentId,
+            input.dependencies
+          );
+          if (referenceError) {
+            taskUpdateBlocked(input.id, "INVALID_TASK_REFERENCES", { referenceError });
+            return referenceError;
+          }
+          if (trustedProject) {
+            trustedReferenceSnapshots = await captureReferencedTaskSnapshots(
+              store,
+              tenantId2,
+              { workspaceId: existing.workspaceId, projectId: existing.projectId },
+              input.parentId,
+              input.dependencies
+            );
+            if (!trustedReferenceSnapshots) {
+              taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", { reason: "reference snapshots unavailable" });
+              return trustedContextError();
+            }
+          }
+        }
+        const effectiveDependencies = input.dependencies ?? existing.dependencies ?? [];
+        const effectiveStatus = input.status ?? existing.status;
+        if (effectiveStatus === "in_progress" && effectiveDependencies.length > 0) {
+          const dependencyError = await validateEffectiveDependencies(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            effectiveDependencies
+          );
+          if (dependencyError) {
+            const trustedException = trustedProject?.projectTask && input.dependencies !== void 0 ? await validateTrustedChildDependencyWait(
+              store,
+              tenantId2,
+              existing,
+              effectiveDependencies,
+              trustedProject
+            ) : void 0;
+            if (trustedException === void 0) {
+              taskUpdateBlocked(input.id, "DEPENDENCY_BLOCKED", { dependencyError });
+              return dependencyError;
+            }
+            if (trustedException) return trustedException;
+          }
+        }
+        let reconciledTask;
+        let reconciliationMetadata = {};
+        let descriptionMutated = false;
+        if (isAgentTask && input.description !== void 0 && !valuesEqual(input.description, existing.description)) {
+          const oldBelief = parseTaskBeliefState3(existing.description ?? "");
+          const newBelief = parseTaskBeliefState3(input.description);
+          const hasBeliefState = oldBelief.success || newBelief.success;
+          if (hasBeliefState) {
+            await validateExecutionResult();
+            const reconciliation = await lifecycle.updateTaskDescriptionWithReconciliation({
+              tenantId: tenantId2,
+              taskId: input.id,
+              description: input.description,
+              actor,
+              threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id)
+            });
+            if (!reconciliation.success) return JSON.stringify(reconciliation);
+            reconciledTask = reconciliation.task;
+            reconciliationMetadata = { ...reconciliation };
+            delete reconciliationMetadata.task;
+            descriptionMutated = reconciliation.mutated;
+            if (descriptionMutated) markMutation();
+          }
+        }
+        const updates = {};
+        const settableFields = [
+          "title",
+          "description",
+          "priority",
+          "dueDate",
+          "metadata",
+          "parentId",
+          "sourceId",
+          "context",
+          "ownerId",
+          "result",
+          "failureReason",
+          "requireReview",
+          "dependencies",
+          "files"
+        ];
+        for (const field of settableFields) {
+          if (trustedProject && (field === "sourceId" || field === "context" || field === "ownerId")) continue;
+          if (field === "description" && reconciledTask) continue;
+          const requested = input[field];
+          const persisted = reconciledTask ?? existing;
+          if (requested !== void 0 && !updateValuesEqual(field, requested, persisted[field])) {
+            updates[field] = requested;
+          }
+        }
+        if (!reconciledTask && Object.keys(updates).length > 0) {
+          await validateExecutionResult();
+        }
+        if (trustedProject && (input.parentId !== void 0 || input.dependencies !== void 0)) {
+          if (!await referencedTaskSnapshotsStillMatch(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            trustedReferenceSnapshots
+          )) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", { reason: "referenced task changed" });
+            return trustedContextError("Parent or dependency task changed before update.");
+          }
+        }
+        if (trustedProject) {
+          try {
+            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+          } catch (error) {
+            taskUpdateBlocked(input.id, "PROJECT_POLICY_ERROR", { policyError: String(error) });
+            return projectPolicyError(error);
+          }
+        }
+        const snapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
+        taskUpdateDebug("update:write", {
+          updateKeys: Object.keys(updates),
+          useCas: !!snapshot,
+          storeMethod: snapshot ? "updateIfSnapshot" : "update"
+        });
+        const updated = Object.keys(updates).length > 0 ? snapshot ? await store.updateIfSnapshot(tenantId2, input.id, updates, snapshot) : await store.update(tenantId2, input.id, updates) : reconciledTask ?? existing;
+        taskUpdateDebug("update:result", {
+          updated: !!updated,
+          resultStatus: updated?.status,
+          resultUpdatedAt: updated?.updatedAt?.toISOString?.()
+        });
+        if (!updated) {
+          taskUpdateBlocked(input.id, "TASK_UPDATE_FAILED", { storeMethod: snapshot ? "updateIfSnapshot" : "update" });
+          return JSON.stringify({
+            success: false,
+            code: "TASK_UPDATE_FAILED",
+            error: `Failed to update task '${input.id}'.`,
+            hint: "The task may have been deleted, the ID may be incorrect, or the store rejected the write. Use manage_task get to verify the task still exists, then retry the update."
+          });
+        }
+        if (Object.keys(updates).length > 0) markMutation();
+        if (reconciledTask && Object.keys(updates).length === 0) {
+          return successfulTaskResponse(input.id, updated, descriptionMutated, reconciliationMetadata);
+        }
+        if (Object.keys(updates).length === 0) {
+          return successfulTaskResponse(input.id, updated, false);
+        }
+        const workItemAction = "updated";
+        const workItemSummary = input.summary;
+        let activityWarnings;
+        try {
+          if (trustedProject) {
+            try {
+              await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+            } catch (error) {
+              return projectPolicyError(error);
+            }
+          }
+          await workItemStore.create({
+            taskId: input.id,
+            tenantId: tenantId2,
+            action: workItemAction,
+            actor,
+            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId),
+            summary: workItemSummary,
+            detail: {
+              ...input.result !== void 0 && { result: input.result },
+              ...input.failureReason !== void 0 && { failureReason: input.failureReason }
+            },
+            workspaceId: updated.workspaceId,
+            projectId: updated.projectId
+          });
+        } catch (error) {
+          activityWarnings = [{
+            code: "TASK_UPDATE_ACTIVITY_WRITE_FAILED",
+            taskId: input.id,
+            error: error instanceof Error ? error.message : String(error)
+          }];
+        }
+        const lifecycleWarnings = Array.isArray(reconciliationMetadata.warnings) ? reconciliationMetadata.warnings : void 0;
+        return successfulTaskResponse(input.id, updated, true, {
+          ...reconciliationMetadata,
+          warnings: mergeTaskUpdateWarnings(lifecycleWarnings, activityWarnings)
+        });
+      }
+      case "set_status": {
+        if (!input.id) {
+          taskUpdateBlocked(input.id, "MISSING_TASK_ID", {});
+          return JSON.stringify({
+            success: false,
+            code: "MISSING_TASK_ID",
+            error: "id is required for set_status action",
+            hint: "Pass the task ID you want to update"
+          });
+        }
+        if (!input.status) {
+          return JSON.stringify({
+            success: false,
+            code: "MISSING_STATUS",
+            error: "status is required for set_status action",
+            hint: "Pass the target status: pending, in_progress, completed, failed, interrupted, cancelled"
+          });
+        }
+        if (delegatedTaskId && input.id !== delegatedTaskId) {
+          return delegatedTaskScopeError(delegatedTaskId);
+        }
+        const existing = await store.getById(tenantId2, input.id);
+        taskUpdateDebug("set_status:loaded", existing ? {
+          status: existing.status,
+          updatedAt: existing.updatedAt?.toISOString()
+        } : { found: false });
+        if (!existing) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
+          });
+        }
+        if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND_OR_INACCESSIBLE", {});
+          return taskScopeAccessError(input.id);
+        }
+        if (trustedProject?.projectTask) {
+          const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
+          if (trustedFailure) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", {
+              taskOwnerId: existing.ownerId,
+              trustedAssistantId: trustedProject.projectTask.assistantId,
+              taskThreadId: existing.context?.thread_id,
+              trustedThreadId: trustedProject.projectTask.threadId
+            });
+            return trustedFailure;
+          }
+        }
+        if (trustedProject && input.dependencyTaskIds !== void 0) {
+          const interruption = input.context?.interruption;
+          const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
+          if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
+            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
+            return JSON.stringify({
+              success: false,
+              code: "INVALID_EXTERNAL_DEPENDENCY",
+              error: "dependencyTaskIds are only valid for external dependency interruptions."
+            });
+          }
+        }
+        if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
+          taskUpdateBlocked(input.id, "TASK_REASSIGN_ENDPOINT_REQUIRED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_REASSIGN_ENDPOINT_REQUIRED",
+            error: "Project task ownership changes require the reassignment endpoint."
+          });
+        }
+        if (existing.status === "review" || input.status === "review") {
+          taskUpdateBlocked(input.id, "TASK_STATUS_UNSUPPORTED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_STATUS_UNSUPPORTED",
+            error: "Task status is not supported by the task lifecycle."
+          });
+        }
+        const isAgentTask = existing.ownerType === "agent";
+        const changesOwnerType = input.ownerType !== void 0 && input.ownerType !== existing.ownerType;
+        const changesAgentIdentity = isAgentTask && (input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId);
+        if (changesOwnerType || changesAgentIdentity) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_IMMUTABLE", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_OWNERSHIP_IMMUTABLE",
+            error: "Agent task ownerType, ownerId, and parentId cannot be changed after task creation.",
+            hint: "Create a separate task for different ownership or parentage."
+          });
+        }
+        const actor = trustedActor(trustedProject, rc) ?? (existing.ownerType === "agent" ? `agent:${existing.ownerId}` : `user:${existing.ownerId ?? ownerId}`);
+        const statusWorkItemStore = trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore();
+        const lifecycle = isAgentTask ? createTaskLifecycleService({
+          taskStore: store,
+          workItemStore: statusWorkItemStore
+        }) : void 0;
         const lifecycleMutationResponse = (result, extra = {}) => {
           if (result.success && result.mutated) markMutation();
           return lifecycleResponse(input.id, result, extra);
         };
-        const hasCarriedContentFields = () => ["title", "description", "priority", "dueDate", "metadata", "files"].some((key4) => input[key4] !== void 0);
+        if (input.status === "in_progress" && (existing.dependencies ?? []).length > 0) {
+          const dependencyError = await validateEffectiveDependencies(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            existing.dependencies ?? []
+          );
+          if (dependencyError) {
+            const trustedException = trustedProject?.projectTask ? await validateTrustedChildDependencyWait(
+              store,
+              tenantId2,
+              existing,
+              existing.dependencies ?? [],
+              trustedProject
+            ) : void 0;
+            if (trustedException === void 0) {
+              taskUpdateBlocked(input.id, "DEPENDENCY_BLOCKED", { dependencyError });
+              return dependencyError;
+            }
+            if (trustedException) return trustedException;
+          }
+        }
+        const statusThreadId = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
         if (lifecycle && input.status === "failed") {
           await validateExecutionResult();
           const callerError = await revalidateCaller();
@@ -39970,11 +40634,9 @@ function createTaskMiddleware(options = {}) {
             taskId: input.id,
             failureReason: input.failureReason ?? existing.failureReason ?? "",
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!failed.success) return lifecycleMutationResponse(failed);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(failed);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(failed);
         }
         if (lifecycle && input.status === "cancelled") {
           await validateExecutionResult();
@@ -39984,12 +40646,10 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId,
+            threadId: statusThreadId,
             summary: input.summary
           });
-          if (!cancelled.success) return lifecycleMutationResponse(cancelled);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(cancelled);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(cancelled);
         }
         if (lifecycle && input.status === "interrupted" && !(input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required")) {
           const interruption = input.context?.interruption;
@@ -40011,12 +40671,10 @@ function createTaskMiddleware(options = {}) {
             type,
             summary: input.summary ?? "",
             actor,
-            threadId,
+            threadId: statusThreadId,
             dependencyTaskIds: input.dependencyTaskIds
           });
-          if (!interrupted.success) return lifecycleMutationResponse(interrupted);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(interrupted);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(interrupted);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "interrupted") {
           await validateExecutionResult();
@@ -40026,11 +40684,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!resumed.success) return lifecycleMutationResponse(resumed);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(resumed);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(resumed);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "pending") {
           await validateExecutionResult();
@@ -40040,11 +40696,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!started.success) return lifecycleMutationResponse(started);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(started);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(started);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "failed") {
           await validateExecutionResult();
@@ -40054,11 +40708,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!retried.success) return lifecycleMutationResponse(retried);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(retried);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(retried);
         }
         if (isAgentTask && input.requireReview === true && options.reviewMode !== "hitl") {
           return reviewModeDisabledResponse();
@@ -40080,54 +40732,39 @@ function createTaskMiddleware(options = {}) {
           });
         }
         const effectiveRequireReview = existing.requireReview === true || input.requireReview === true;
-        const workItemStore = getTaskWorkItemStore();
-        const governedAgentCompletion = isAgentTask && (input.status === "completed" || candidateReviewInterruption && !!input.result?.trim() && !!input.beliefImpact?.length);
+        const candidateReviewInterruption = input.status === "interrupted" && input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required" && !!input.result?.trim() && !!input.beliefImpact?.length;
+        const governedAgentCompletion = isAgentTask && (input.status === "completed" || candidateReviewInterruption);
         if (governedAgentCompletion) {
-          const guardedFields = [
-            "parentId",
-            "ownerType",
-            "ownerId",
-            "description"
-          ];
-          for (const field of guardedFields) {
-            const requestValue = input[field];
-            const existingValue = existing[field];
-            if (requestValue !== void 0 && requestValue !== existingValue) {
-              return JSON.stringify({
-                success: false,
-                code: "COMPLETION_CONTEXT_MUTATION",
-                error: `Cannot change ${field} while completing an agent task`,
-                hint: "Persist the context change in a separate update before completing the task"
-              });
-            }
-          }
           if (!input.beliefImpact?.length) return missingBeliefImpactError();
           const finalResult = input.result ?? existing.result ?? "";
-          const threadId2 = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
-          const lifecycle2 = createTaskLifecycleService({
-            taskStore: store,
-            workItemStore: trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore()
-          });
+          if (!finalResult.trim()) {
+            return JSON.stringify({
+              success: false,
+              code: "MISSING_RESULT",
+              error: "result is required for completing a task",
+              hint: "Provide a nonblank result"
+            });
+          }
           const completionInput = {
             tenantId: tenantId2,
             taskId: input.id,
             result: finalResult,
             beliefImpact: input.beliefImpact,
             actor,
-            threadId: threadId2,
+            threadId: statusThreadId,
             sourceId: trustedProject ? void 0 : input.sourceId
           };
           await validateExecutionResult();
-          const needsReview = effectiveRequireReview || candidateReviewInterruption || !!reviewInterruption(existing);
+          const needsReview = effectiveRequireReview || !!reviewInterruption(existing);
           if (!needsReview) {
             const callerError2 = await revalidateCaller();
             if (callerError2) return callerError2;
-            const result = existing.status === "completed" ? await lifecycle2.repairCompletion(completionInput) : await lifecycle2.completeAgentTask(completionInput);
+            const result = existing.status === "completed" ? await lifecycle.repairCompletion(completionInput) : await lifecycle.completeAgentTask(completionInput);
             return lifecycleMutationResponse(result);
           }
           const callerError = await revalidateCaller();
           if (callerError) return callerError;
-          const submitted = await lifecycle2.submitReview({
+          const submitted = await lifecycle.submitReview({
             ...completionInput,
             reviewMode: options.reviewMode ?? "disabled",
             configureRequireReview: input.requireReview === true && existing.requireReview !== true
@@ -40152,30 +40789,34 @@ function createTaskMiddleware(options = {}) {
           if (response?.action === "approve") {
             const approvalCallerError = await revalidateCaller();
             if (approvalCallerError) return approvalCallerError;
-            return lifecycleMutationResponse(await lifecycle2.approveInterrupted({
+            return lifecycleMutationResponse(await lifecycle.approveInterrupted({
               tenantId: tenantId2,
               taskId: input.id,
               evidenceId,
               actor,
-              threadId: threadId2
+              threadId: statusThreadId
             }), { reviewerAction: "approved" });
           }
           if (response?.action === "reject") {
             const note = response.data?.note?.trim() || "Changes requested.";
             const rejectionCallerError = await revalidateCaller();
             if (rejectionCallerError) return rejectionCallerError;
-            return lifecycleMutationResponse(await lifecycle2.rejectInterrupted({
+            return lifecycleMutationResponse(await lifecycle.rejectInterrupted({
               tenantId: tenantId2,
               taskId: input.id,
               evidenceId,
               actor,
-              threadId: threadId2,
+              threadId: statusThreadId,
               note
             }), { reviewerAction: "rejected", reviewerNote: note });
           }
           return lifecycleMutationResponse(submitted, { code: "REVIEW_REQUIRED" });
         }
-        if (isAgentTask && input.status !== void 0 && input.status !== existing.status) {
+        if (isAgentTask && input.status !== existing.status) {
+          taskUpdateBlocked(input.id, "AGENT_TASK_LIFECYCLE_REQUIRED", {
+            currentStatus: existing.status,
+            requestedStatus: input.status
+          });
           return JSON.stringify({
             success: false,
             code: "AGENT_TASK_LIFECYCLE_REQUIRED",
@@ -40183,45 +40824,17 @@ function createTaskMiddleware(options = {}) {
             hint: "Valid transitions: pending\u2192in_progress, in_progress\u2192completed (requires result + beliefImpact), in_progress\u2192failed (requires failureReason), in_progress\u2192cancelled, in_progress\u2192interrupted. Check the current status with manage_task get first."
           });
         }
-        const persistedStatus = input.status;
-        let trustedReferenceSnapshots;
-        if (input.parentId !== void 0 || input.dependencies !== void 0) {
-          if (delegatedTaskId) {
-            const delegatedDependencyError = await validateDelegatedDependencies(
-              store,
-              tenantId2,
-              delegatedTaskId,
-              { workspaceId: existing.workspaceId, projectId: existing.projectId },
-              input.parentId,
-              input.dependencies,
-              input.id
-            );
-            if (delegatedDependencyError) return delegatedDependencyError;
-          }
-          const referenceError = await validateReferencedTasks(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            input.parentId,
-            input.dependencies
-          );
-          if (referenceError) return referenceError;
-          if (trustedProject) {
-            trustedReferenceSnapshots = await captureReferencedTaskSnapshots(
-              store,
-              tenantId2,
-              { workspaceId: existing.workspaceId, projectId: existing.projectId },
-              input.parentId,
-              input.dependencies
-            );
-            if (!trustedReferenceSnapshots) return trustedContextError();
-          }
-        }
         if (input.status) {
           if (!isAgentTask && !isValidUserTransition(existing.status, input.status)) {
             const allowed = USER_VALID_TRANSITIONS[existing.status] || [];
+            taskUpdateBlocked(input.id, "INVALID_USER_TRANSITION", {
+              currentStatus: existing.status,
+              requestedStatus: input.status,
+              allowedTransitions: allowed
+            });
             return JSON.stringify({
               success: false,
+              code: "INVALID_USER_TRANSITION",
               error: `Cannot transition task from '${existing.status}' to '${input.status}'`,
               allowedTransitions: allowed,
               hint: `From '${existing.status}', valid transitions are: ${allowed.join(", ")}`
@@ -40239,154 +40852,47 @@ function createTaskMiddleware(options = {}) {
           );
           if (error) return error;
         }
-        const effectiveDependencies = input.dependencies ?? existing.dependencies ?? [];
-        const effectiveStatus = input.status ?? existing.status;
-        if (effectiveStatus === "in_progress" && effectiveDependencies.length > 0) {
-          const dependencyError = await validateEffectiveDependencies(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            effectiveDependencies
-          );
-          if (dependencyError) {
-            const trustedException = trustedProject?.projectTask && input.dependencies !== void 0 ? await validateTrustedChildDependencyWait(
-              store,
-              tenantId2,
-              existing,
-              effectiveDependencies,
-              trustedProject
-            ) : void 0;
-            if (trustedException === void 0) return dependencyError;
-            if (trustedException) return trustedException;
-          }
+        if (input.status === existing.status) {
+          return successfulTaskResponse(input.id, existing, false);
         }
-        let reconciledTask;
-        let reconciliationMetadata = {};
-        let descriptionMutated = false;
-        if (isAgentTask && input.description !== void 0 && !valuesEqual(input.description, existing.description)) {
-          await validateExecutionResult();
-          const reconciliation = await lifecycle.updateTaskDescriptionWithReconciliation({
-            tenantId: tenantId2,
-            taskId: input.id,
-            description: input.description,
-            actor,
-            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id)
-          });
-          if (!reconciliation.success) return JSON.stringify(reconciliation);
-          reconciledTask = reconciliation.task;
-          reconciliationMetadata = { ...reconciliation };
-          delete reconciliationMetadata.task;
-          descriptionMutated = reconciliation.mutated;
-          if (descriptionMutated) markMutation();
-        }
-        const updates = {};
-        const settableFields = [
-          "title",
-          "description",
-          "priority",
-          "dueDate",
-          "metadata",
-          "parentId",
-          "sourceId",
-          "context",
-          "ownerId",
-          "result",
-          "failureReason",
-          "requireReview",
-          "dependencies",
-          "files"
-        ];
-        for (const field of settableFields) {
-          if (trustedProject && (field === "sourceId" || field === "context" || field === "ownerId")) continue;
-          if (field === "description" && reconciledTask) continue;
-          const requested = input[field];
-          const persisted = reconciledTask ?? existing;
-          if (requested !== void 0 && !updateValuesEqual(field, requested, persisted[field])) {
-            updates[field] = requested;
-          }
-        }
-        if (persistedStatus !== void 0 && existing.status !== persistedStatus) {
-          updates.status = persistedStatus;
-        }
-        if (!reconciledTask && Object.keys(updates).length > 0) {
-          await validateExecutionResult();
-        }
-        if (trustedProject && (input.parentId !== void 0 || input.dependencies !== void 0)) {
-          if (!await referencedTaskSnapshotsStillMatch(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            trustedReferenceSnapshots
-          )) return trustedContextError("Parent or dependency task changed before update.");
-        }
-        if (trustedProject) {
-          try {
-            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
-          } catch (error) {
-            return projectPolicyError(error);
-          }
-        }
-        const snapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
-        const updated = Object.keys(updates).length > 0 ? snapshot ? await store.updateIfSnapshot(tenantId2, input.id, updates, snapshot) : await store.update(tenantId2, input.id, updates) : reconciledTask ?? existing;
-        if (!updated) {
+        const statusUpdates = { status: input.status };
+        if (input.status === "completed" && input.result !== void 0) statusUpdates.result = input.result;
+        if (input.status === "failed" && input.failureReason !== void 0) statusUpdates.failureReason = input.failureReason;
+        if (input.summary !== void 0) statusUpdates.summary = input.summary;
+        const statusSnapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
+        taskUpdateDebug("set_status:write", {
+          status: input.status,
+          useCas: !!statusSnapshot
+        });
+        const updatedStatus = await (statusSnapshot ? store.updateIfSnapshot(tenantId2, input.id, statusUpdates, statusSnapshot) : store.update(tenantId2, input.id, statusUpdates));
+        taskUpdateDebug("set_status:result", {
+          updated: !!updatedStatus,
+          resultStatus: updatedStatus?.status
+        });
+        if (!updatedStatus) {
+          taskUpdateBlocked(input.id, "TASK_UPDATE_FAILED", {});
           return JSON.stringify({
             success: false,
-            error: `Failed to update task '${input.id}'`,
-            hint: "The task may have been deleted or the ID is incorrect"
+            code: "TASK_UPDATE_FAILED",
+            error: `Failed to update status of task '${input.id}'.`,
+            hint: "Use manage_task get to verify the task exists, then retry."
           });
         }
-        if (Object.keys(updates).length > 0) markMutation();
-        if (reconciledTask && Object.keys(updates).length === 0) {
-          return successfulTaskResponse(input.id, updated, descriptionMutated, reconciliationMetadata);
-        }
-        if (Object.keys(updates).length === 0) {
-          return successfulTaskResponse(input.id, updated, false);
-        }
-        const actionMap = {
-          pending: "pending",
-          in_progress: "started",
-          failed: "failed",
-          interrupted: "interrupted",
-          completed: "completed",
-          cancelled: "cancelled"
-        };
-        const workItemAction = persistedStatus ? actionMap[persistedStatus] || "updated" : "updated";
-        const workItemSummary = input.summary || (persistedStatus ? `Status changed to ${persistedStatus}` : void 0);
-        let activityWarnings;
+        markMutation();
         try {
-          if (trustedProject) {
-            try {
-              await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
-            } catch (error) {
-              return projectPolicyError(error);
-            }
-          }
-          await workItemStore.create({
+          await statusWorkItemStore.create({
             taskId: input.id,
             tenantId: tenantId2,
-            action: workItemAction,
+            action: input.status,
             actor,
-            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId),
-            summary: workItemSummary,
-            detail: {
-              ...input.result !== void 0 && { result: input.result },
-              ...input.failureReason !== void 0 && { failureReason: input.failureReason }
-            },
-            workspaceId: updated.workspaceId,
-            projectId: updated.projectId
+            threadId: statusThreadId ?? input.sourceId,
+            summary: input.summary || `Status changed to ${input.status}`,
+            workspaceId: updatedStatus.workspaceId,
+            projectId: updatedStatus.projectId
           });
-        } catch (error) {
-          activityWarnings = [{
-            code: "TASK_UPDATE_ACTIVITY_WRITE_FAILED",
-            taskId: input.id,
-            error: error instanceof Error ? error.message : String(error)
-          }];
+        } catch {
         }
-        const lifecycleWarnings = Array.isArray(reconciliationMetadata.warnings) ? reconciliationMetadata.warnings : void 0;
-        return successfulTaskResponse(input.id, updated, true, {
-          ...reconciliationMetadata,
-          warnings: mergeTaskUpdateWarnings(lifecycleWarnings, activityWarnings)
-        });
+        return successfulTaskResponse(input.id, updatedStatus, true);
       }
       case "delete": {
         if (!input.id) {
@@ -40403,8 +40909,9 @@ function createTaskMiddleware(options = {}) {
         if (!existing) {
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found`,
-            hint: "Use list to see available tasks and their IDs"
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
           });
         }
         if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
@@ -40430,8 +40937,9 @@ function createTaskMiddleware(options = {}) {
         if (!deleted) {
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found or could not be deleted`,
-            hint: "Use list to verify the task exists"
+            code: "TASK_DELETE_FAILED",
+            error: `Task '${input.id}' was not found or could not be deleted.`,
+            hint: "Use manage_task list to verify the task exists and you have access to it."
           });
         }
         return JSON.stringify({ success: true, message: `Task '${input.id}' deleted` });
@@ -40446,7 +40954,7 @@ function createTaskMiddleware(options = {}) {
     }
   };
   const reconcileExplicitExecutionResult = async (input, config, response, validationError, didMutate) => {
-    if (input.action !== "update" && input.action !== "add_activity" || !input.id) return response;
+    if (input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity" || !input.id) return response;
     const authority = classifyTaskAuthority(getRunConfig2(config));
     if (authority.kind === "projectRoom" || authority.kind === "projectTask" || authority.kind === "invalid") {
       return response;
@@ -40640,14 +41148,18 @@ ${TASK_CONVERGENCE_GUIDANCE}
 - Explicit ownerId: assign to a specific agent (cross-agent delegation)
 
 ## Actions
-- create: Create a task (title required; result required for completed; failureReason required for failed)
+- create: Create a task (title required)
 - get: Get one task and its newest 100 activities (id required)
 - list: List tasks, filterable by ownerType/status/priority/parentId
-- update: Update a task (id required; pass only the fields to change)
-  To mark complete: update with status='completed', result='...' (a nonblank input or existing result is required)
-  To mark failed: update with status='failed', failureReason='...' (a nonblank input or existing failureReason is required)
-  To pause for missing input: update with status='interrupted', summary='what is needed' (defaults to interruption type missing_input)
-  Status transitions are validated \u2014 only allowed transitions will succeed.
+- update: Update a task's content fields (title/description/priority/dueDate/metadata/parentId/sourceId/context/ownerId/result/failureReason/requireReview/dependencies/files)
+  Status changes can also be done here, but use set_status for a simpler dedicated status update.
+- set_status: Change a task's status (id and status required). Use this when you only need to change the status.
+  Valid status values: pending, in_progress, review, failed, interrupted, completed, cancelled
+  Companion fields: result (for completed), failureReason (for failed), summary (for any status)
+  To mark complete: set_status with status='completed', result='...'
+  To mark failed: set_status with status='failed', failureReason='...'
+  To pause for input: set_status with status='interrupted', summary='what is needed'
+  Status can be freely changed to any valid value \u2014 no restrictions on transitions.
 - add_activity: Add a Markdown activity without changing task fields or status (id and content required)
 - delete: Delete a task (id required)
 
@@ -40827,7 +41339,12 @@ manage_eval calls in this skill and in [[eval-verify]]'s Setup step 0 \u2014
 [[eval-verify]] loads this skill and inherits its confirmation requirement.
 
 ## Project Structure
-1. Project: one per agent-under-test. Create with manage_eval create_project.
+1. Project: one per agent-under-test. A NEW project is created through [[eval-verify]]
+   Setup, which owns project organization: it resolves the exact subject agent-id,
+   checks whether \`eval-{agent-id}\` already exists (read_eval list_projects), reuses it
+   when it does, and confirms with the user before \`manage_eval create_project\`
+   (which requires \`evalVerifyLoaded: true\`). Do NOT call create_project directly from
+   this skill \u2014 load [[eval-verify]] to create a project.
 2. Suite: one per capability/domain. Create with manage_eval create_suite.
 3. Case: user input \u2192 agent steps \u2192 expected output \u2192 rubrics. Create with manage_eval create_case.
 
@@ -41120,6 +41637,15 @@ ACTIONS:
     }
   );
 }
+function requireEvalVerifyDeclaration(evalVerifyLoaded) {
+  if (evalVerifyLoaded !== true) {
+    return JSON.stringify({
+      success: false,
+      error: "Load the 'eval-verify' skill via the skill tool (skill_name 'eval-verify'), then retry this exact call with evalVerifyLoaded: true. eval-verify owns eval project organization: it resolves the exact subject agent-id, checks whether eval-{agent-id} already exists, reuses it when it does, and confirms with the user before creating. Never create an eval project without following it."
+    });
+  }
+  return void 0;
+}
 function createManageEvalTool() {
   const schema6 = z71.object({
     action: z71.enum([
@@ -41138,6 +41664,7 @@ function createManageEvalTool() {
     description: z71.string().optional(),
     judgeModelKey: z71.string().optional(),
     concurrency: z71.number().optional(),
+    evalVerifyLoaded: z71.boolean().optional().describe("Required on create_project: load the 'eval-verify' skill first via the skill tool (skill_name 'eval-verify'), then pass evalVerifyLoaded: true. Calls without evalVerifyLoaded: true fail. Never omit or pass false."),
     targetAgentId: z71.string().optional().describe("Optional for create_project \u2014 the agent this eval project verifies. Recorded in targetServerConfig so the agent's detail page can find its eval data without relying on project naming."),
     suiteId: z71.string().optional(),
     caseId: z71.string().optional(),
@@ -41163,6 +41690,8 @@ function createManageEvalTool() {
         let data;
         switch (input.action) {
           case "create_project": {
+            const skillError = requireEvalVerifyDeclaration(input.evalVerifyLoaded);
+            if (skillError) return skillError;
             const ctx = workspaceContext(exeConfig);
             data = await store.createProject(tid, uuidv48(), {
               name: input.name,
@@ -41243,7 +41772,12 @@ function createManageEvalTool() {
       name: "manage_eval",
       description: `Create, update, delete evaluation projects, suites, and test cases.
  
-Project: create_project(name, description?, judgeModelKey?, concurrency?, targetAgentId?) | update_project | delete_project
+Project: create_project(name, description?, judgeModelKey?, concurrency?, targetAgentId?, evalVerifyLoaded?) | update_project | delete_project
+  create_project REQUIRES evalVerifyLoaded: true \u2014 load the 'eval-verify' skill first
+  (skill tool, skill_name 'eval-verify'). eval-verify owns project organization:
+  resolve the exact subject agent-id, check whether eval-{agent-id} already exists via
+  read_eval list_projects, reuse it when it does, confirm with the user when it does not,
+  and always pass targetAgentId. Calls without evalVerifyLoaded: true fail.
   judgeModelKey defaults to the "default" model. concurrency defaults to 3.
   delete_project rejected if active runs exist.
   **When creating a project from within a workspace, the workspace/project context is
@@ -41598,6 +42132,10 @@ Selected target eval subjects:
 - Orchestra: component evals first, then integration eval
 - Workflow: validate_workflow first, then workflow eval covering branch paths, intermediate contracts, ask points, recovery
 - In Bounded mode: subject is always the exact bound target ID
+The eval project belongs to the TARGET agent, not to this round. The subject identity is
+fixed per target; across rounds and fix passes of the same target, [[eval-verify]] Setup
+resolves the canonical eval-{target-id} project and REUSES it \u2014 never create a new eval
+project for a new round of the same agent.
 
 ### 7. Deliver