@axiom-lattice/core 4.2.5 → 4.2.6

package/dist/index.mjs

@@ -1982,6 +1982,7 @@ function cloneWebApp(webApp) {
     },
     features: { ...webApp.features },
     appearance: { ...webApp.appearance },
+    identity: webApp.identity ? { policy: webApp.identity.policy, issuers: webApp.identity.issuers.map((issuer) => ({ ...issuer })) } : void 0,
     createdAt: new Date(webApp.createdAt),
     updatedAt: new Date(webApp.updatedAt)
   };
@@ -2027,6 +2028,7 @@ var InMemoryAgentWebAppStore = class {
       },
       features: { ...input.features },
       appearance: { ...input.appearance },
+      identity: input.identity ? { policy: input.identity.policy, issuers: input.identity.issuers.map((issuer) => ({ ...issuer })) } : void 0,
       createdAt: now,
       updatedAt: now
     };
@@ -2043,7 +2045,7 @@ var InMemoryAgentWebAppStore = class {
     const existing = tenantWebApps?.get(webAppId);
     if (!tenantWebApps || !existing) return null;
     if (options?.expectedUpdatedAt && existing.updatedAt.getTime() !== options.expectedUpdatedAt.getTime()) return null;
-    const hasUpdate = patch.name !== void 0 || Object.prototype.hasOwnProperty.call(patch, "description") || patch.scope !== void 0 || patch.features !== void 0 || patch.appearance !== void 0 || patch.status !== void 0;
+    const hasUpdate = patch.name !== void 0 || Object.prototype.hasOwnProperty.call(patch, "description") || patch.scope !== void 0 || patch.features !== void 0 || patch.appearance !== void 0 || patch.identity !== void 0 || patch.status !== void 0;
     if (!hasUpdate) return cloneWebApp(existing);
     const updated = {
       ...existing,
@@ -2058,6 +2060,7 @@ var InMemoryAgentWebAppStore = class {
       } : {},
       ...patch.features ? { features: { ...patch.features } } : {},
       ...patch.appearance ? { appearance: { ...patch.appearance } } : {},
+      ...patch.identity !== void 0 ? { identity: { policy: patch.identity.policy, issuers: patch.identity.issuers.map((issuer) => ({ ...issuer })) } } : {},
       ...patch.status !== void 0 ? { status: patch.status } : {},
       updatedAt: new Date(Math.max(Date.now(), existing.updatedAt.getTime() + 1))
     };
@@ -7246,7 +7249,8 @@ var VolumeFilesystem = class {
       path: entry.path.startsWith("/") ? entry.path : prefix + entry.path,
       is_dir: entry.kind === "directory",
       size: entry.size,
-      modified_at: entry.modified ? new Date(entry.modified).toISOString() : void 0
+      modified_at: entry.modified ? new Date(entry.modified).toISOString() : void 0,
+      created_at: entry.created ? new Date(entry.created).toISOString() : void 0
     }));
   }
   async read(filePath, offset = 0, limit = 2e3) {
@@ -22564,8 +22568,12 @@ Otherwise, the owning caller interprets the returned observation.
 An execution result is an observation, not automatic proof of business
 completion. \`task\` returns its exact \`executionResultId\`. After \`task\`
 returns, inspect the observation, then pass that \`executionResultId\` to the
-meaningful \`manage_task update\` or \`manage_task add_activity\` that interprets
-it and reconciles status, belief, plan, and next action. Omitting
+meaningful \`manage_task set_status\` (status transition), \`manage_task
+update\` (content fields), or \`manage_task add_activity\` that interprets
+it and reconciles status, belief, plan, and next action. Action split:
+\`set_status\` owns status transitions (with result/failureReason/summary and
+beliefImpact on completion); \`update\` owns content fields (title,
+description, priority, dependencies, ...); the two never mix in one call. Omitting
 \`executionResultId\` leaves the result pending so forgotten handling remains
 detectable. Reconciliation does not require the task to become \`completed\`;
 choose the truthful status. \`manage_task get\` exposes pending execution-result
@@ -22585,13 +22593,14 @@ independently.
 6. **Reconcile** - revise Belief, Task, plan, and next action on Prediction Error,
    then repeat only while a decision-relevant action remains and stop at honest convergence.
 
-Converge using existing statuses:
+Converge through \`set_status\` using existing statuses:
 
-- \`completed\`: acceptance is satisfied by evidence; include a \`result\`.
+- \`completed\`: acceptance is satisfied by evidence; \`set_status\` with a
+  \`result\` and structured \`beliefImpact\`.
 - \`in_progress\`: a feasible, decision-relevant action remains.
 - \`pending\`: work is future or dependency-blocked.
 - \`interrupted\`: an external condition is missing; record the condition needed to resume.
-- \`failed\`: no reasonable path remains; include a \`failureReason\`.
+- \`failed\`: no reasonable path remains; \`set_status\` with a \`failureReason\`.
 - \`cancelled\`: the goal or subgoal is no longer needed.
 
 For human judgment, use the actual HITL payload \`status: "interrupted"\` plus
@@ -23881,6 +23890,35 @@ Renew HITL approval when a foundational assumption or authority boundary changes
 
 **Full reference**: [[eval-verify]] implements the same loop for the eval fix loop, with the full six-heading format (## Observed Failure / ## Implicated Design Assumption / ## Candidate Change / ## Expected Improvement / ## Possible Regression / ## Cases That Can Falsify the Change). [[task-tracking]] implements the same loop for persistent task operations.
 
+## Skill Loading Policy
+
+Visible in <available_skills> does not mean loaded. Follow these three tiers.
+
+### Tier 1 \u2014 Session start (mandatory, unconditional)
+Load before any other work; the bootstrap prompt enforces this:
+- [[agent-architecture]] (this skill) \u2014 shared policy and routing.
+- [[task-tracking]] \u2014 before your first \`manage_task\` call; Task management is
+  the planning surface and is gated again under Architect Task Policy.
+
+### Tier 2 \u2014 Scenario gates (mandatory before entering the scenario)
+Load the owning skill with the \`skill\` tool BEFORE the first action of that
+scenario. Never execute a scenario without its owning skill loaded:
+- Creating or modifying a Capability (\`react\`) or Orchestra (\`deep_agent\`)
+  Agent \u2192 [[agent-build]]
+- Creating or modifying a Workflow (stable enumerable pipelines) \u2192 [[design-workflow]]
+- Learning a capability from source material \u2192 [[document-learning-learn-capability]]
+- Designing evals, running evals, or fixing eval failures \u2192 [[eval-verify]]
+- Claiming work is complete or delivered \u2192 [[completion-gate]]
+- Final configuration pre-check before delivery \u2192 [[review-agent]]
+
+If a Tier 2 load fails, retry once, then stop and tell the user which
+capability is unavailable. Do not improvise the scenario from partial knowledge.
+
+### Tier 3 \u2014 Reference (load on demand, never preload)
+Deep details reachable through [[links]] inside loaded skills, and plugin
+skills outside this chain (for example task-definition for non-architect
+agents). Load one only when the current step actually needs it.
+
 ## Agent Forms and Routing
 - **Capability** (\`react\`) for bounded direct work: [[agent-build]]
 - **Orchestra** (\`deep_agent\`) for open-ended delegated work: [[agent-build]]
@@ -23893,8 +23931,11 @@ Renew HITL approval when a foundational assumption or authority boundary changes
 ## Architect Task Policy
 The Agent Architect uses persistent TaskItems as its planning surface. Architect must not use
 \`write_todos\`. Create a persistent child only for an independently verifiable
-outcome; tool calls and file reads are actions inside the active Task. Load
-[[task-tracking]] for operation and status details.
+outcome; tool calls and file reads are actions inside the active Task.
+**MANDATORY: before your first \`manage_task\` call in this session, load
+[[task-tracking]] with the \`skill\` tool.** Do not create, update, or transition
+any Task until it is loaded. If the load fails, retry once, then tell the user
+task management is unavailable.
 Learning authority is **normal** or **bounded**: normal for fresh work without a
 bound round; bounded for learning rounds that bind an existing target and
 tracking Task with a confirmed goal. Identity remains fixed; materialization uses
@@ -24123,6 +24164,9 @@ ${TASK_BELIEF_REFERENCE_EXAMPLE}
 
 ## Status discipline \u2014 MANDATORY
 
+- All status transitions go through \`manage_task set_status\` (with
+  \`result\` on completed, \`failureReason\` on failed). \`update\` is for
+  content fields only and rejects a status field.
 - A subtask is \`completed\` ONLY when its work is actually finished.
   While fixing eval failures, keep it \`in_progress\` \u2014 never mark
   \`completed\` as a workaround (the state machine rejects illegal
@@ -26391,8 +26435,11 @@ var AGENT_ARCHITECT_PROMPT = `You are the Agent Architect.
 
 CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
 tool with skill_name: "agent-architecture" to load agent-architecture and follow it.
-Never announce the skill load. If it fails, retry once, then stop and explicitly
-report that the required Agent Architect skill could not be loaded.`;
+Immediately after it loads, call the \`skill\` tool again with skill_name:
+"task-tracking" \u2014 persistent Task management is your core planning surface and
+you must have its operation reference before creating or updating any Task.
+Never announce skill loads. If a load fails, retry once, then stop and
+explicitly report that the required skill could not be loaded.`;
 
 // src/agent_lattice/agentReviewerConfig.ts
 import { AgentType as AgentType4 } from "@axiom-lattice/protocols";
@@ -29384,7 +29431,8 @@ var RemoteSandboxProvider = class {
           kind: f.is_dir === true || f.size === null ? "directory" : "file",
           size: f.size ?? 0,
           mode: 0,
-          modified: f.modified_at ?? null
+          modified: f.modified_at ?? null,
+          created: f.created_at ?? null
         }));
         return entries;
       },
@@ -31131,8 +31179,12 @@ Note: if final_score >= 80 and there are no fatal errors, pass should be true; o
         });
       }
     } else if (parsedResult.pass !== void 0) {
-      pass = parsedResult.pass;
-      this.log("Pass determined from parsedResult.pass", { case_id: evalCase.caseId, pass });
+      pass = false;
+      parsedResult.final_score = 0;
+      this.log("Pass without final_score \u2014 cannot verify threshold, defaulting to FAIL", {
+        case_id: evalCase.caseId,
+        pass_field: parsedResult.pass
+      });
     } else if (parsedResult.final_score !== void 0) {
       pass = parsedResult.final_score >= 80;
       this.log("Pass determined from parsedResult.final_score", {
@@ -32880,7 +32932,11 @@ var TaskLifecycleService = class {
           ...event2.warning ? { warnings: [event2.warning] } : {}
         };
       }
-      if (task.status !== "interrupted") return failure2("TASK_STATUS_CONFLICT", "Task is not interrupted.");
+      if (task.status !== "interrupted") return failure2(
+        "TASK_STATUS_CONFLICT",
+        `Task is in '${task.status}' status, not interrupted.`,
+        "Only interrupted tasks can resume to in_progress."
+      );
       if (interruption && typeof interruption === "object" && interruption.type === "review_required") {
         return failure2("REVIEW_APPROVAL_REQUIRED", "Review interruption requires explicit approval or rejection.");
       }
@@ -32977,7 +33033,11 @@ var TaskLifecycleService = class {
         task.updatedAt
       );
     } catch {
-      return { ...failure2("TASK_STORE_WRITE_FAILED", "Failed to update task lifecycle state."), transitioned: false };
+      return { ...failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to update task lifecycle state.",
+        "The store rejected the write; this may be transient. Retry the same set_status."
+      ), transitioned: false };
     }
     if (!updated) {
       let current;
@@ -33005,7 +33065,11 @@ var TaskLifecycleService = class {
           ...repaired.warning ? { warnings: [repaired.warning] } : {}
         };
       }
-      return { ...failure2("TASK_STATUS_CONFLICT", "Task changed concurrently."), transitioned: false };
+      return { ...failure2(
+        "TASK_STATUS_CONFLICT",
+        "Task changed concurrently.",
+        "Another writer modified the task between read and write. Use manage_task get to re-read its current state, then retry."
+      ), transitioned: false };
     }
     const event = await this.writeStatusEvent(
       updated,
@@ -33149,10 +33213,18 @@ var TaskLifecycleService = class {
       const storedExternal = parseExternalDependency(currentInterruption);
       if (input.type === "external_dependency") {
         if (!external || !storedExternal || storedExternal.summary !== external.summary || canonicalJson(storedExternal.dependencyTaskIds) !== canonicalJson(external.dependencyTaskIds)) {
-          return failure2("TASK_STATUS_CONFLICT", "Task is interrupted by a different or malformed external dependency.");
+          return failure2(
+            "TASK_STATUS_CONFLICT",
+            "Task is already interrupted by a different or malformed external dependency.",
+            "Use manage_task get to inspect the existing interruption in task context.interruption."
+          );
         }
       } else if (currentInterruption.type !== input.type || currentInterruption.summary !== summary) {
-        return failure2("TASK_STATUS_CONFLICT", "Task is interrupted by a different request.");
+        return failure2(
+          "TASK_STATUS_CONFLICT",
+          "Task is already interrupted by a different request.",
+          "Use manage_task get to inspect the existing interruption, or resume it first."
+        );
       }
       const detail = storedExternal ? { ...storedExternal } : currentInterruption;
       const eventKey2 = this.statusEventKey(task, "interrupted", detail);
@@ -33169,7 +33241,11 @@ var TaskLifecycleService = class {
         ...warnings2.length ? { warnings: warnings2 } : {}
       };
     }
-    if (task.status !== "in_progress") return failure2("TASK_STATUS_CONFLICT", "Task is not in progress.");
+    if (task.status !== "in_progress") return failure2(
+      "TASK_STATUS_CONFLICT",
+      `Task is in '${task.status}' status, not in progress.`,
+      "Only in_progress tasks can be interrupted. Use manage_task get to check the current status."
+    );
     if (external && isProjectLifecycleTask(task)) {
       const dependencyFailure = await this.validateExternalDependencies(task, external.dependencyTaskIds);
       if (dependencyFailure) return dependencyFailure;
@@ -33182,9 +33258,17 @@ var TaskLifecycleService = class {
         context: mergeInterruptionContext(task.context, interruption, input.threadId)
       }, ["in_progress"], task.updatedAt);
     } catch {
-      return failure2("TASK_STORE_WRITE_FAILED", "Failed to interrupt the task.");
+      return failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to interrupt the task.",
+        "The store rejected the write; this may be transient. Retry the same set_status."
+      );
     }
-    if (!updated) return failure2("TASK_STATUS_CONFLICT", "Task changed concurrently.");
+    if (!updated) return failure2(
+      "TASK_STATUS_CONFLICT",
+      "Task changed concurrently.",
+      "Another writer modified the task between read and write. Use manage_task get to re-read its current state, then retry."
+    );
     const eventKey = this.statusEventKey(updated, "interrupted", interruption);
     const event = await this.writeStatusEvent(updated, input.actor, input.threadId, "interrupted", summary, interruption, eventKey);
     const warnings = event.warning ? [event.warning] : await this.notifyWinningTransition(updated, "interrupted", event);
@@ -33222,7 +33306,11 @@ var TaskLifecycleService = class {
         context: withCompletionAudit(prepared.task.context, prepared.evidence.id, prepared.eventKey)
       }, ["in_progress"]);
     } catch {
-      return failure2("TASK_STORE_WRITE_FAILED", "Failed to complete the task.");
+      return failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to complete the task.",
+        "The store rejected the write; this may be transient. Retry the completion."
+      );
     }
     if (!updated) {
       if (await this.hasStaleAgentParent(prepared)) {
@@ -33785,7 +33873,11 @@ var TaskLifecycleService = class {
     } catch {
       return failure2("TASK_STORE_WRITE_FAILED", "Failed to reconcile task description.");
     }
-    if (!updated) return failure2("TASK_STATUS_CONFLICT", "Task changed concurrently.");
+    if (!updated) return failure2(
+      "TASK_STATUS_CONFLICT",
+      "Task changed concurrently.",
+      "Another writer modified the task between read and write. Use manage_task get to re-read it, then retry the description update."
+    );
     if (changedKeys.length === 0) {
       return {
         success: true,
@@ -38773,6 +38865,7 @@ import { z as z70 } from "zod";
 import { GraphInterrupt as GraphInterrupt2, interrupt as interrupt4 } from "@langchain/langgraph";
 import {
   isExecutionResultEventKey as isExecutionResultEventKey3,
+  parseTaskBeliefState as parseTaskBeliefState3,
   parseTrustedRunContext as parseTrustedRunContext2,
   requireProjectTaskWorkItemStore
 } from "@axiom-lattice/protocols";
@@ -39083,6 +39176,16 @@ function getRunConfig2(config) {
   const c = config;
   return c?.configurable?.runConfig ?? {};
 }
+function taskUpdateDebug(message, data) {
+  try {
+    console.log(JSON.stringify({ __taskUpdateDebug: true, message, ...data }));
+  } catch {
+    console.log(`[taskUpdateDebug] ${message}`);
+  }
+}
+function taskUpdateBlocked(taskId, code, detail) {
+  taskUpdateDebug("update:blocked", { taskId, code, ...detail });
+}
 function getRuntimeActor2(runConfig) {
   if (runConfig.assistant_id) return `agent:${String(runConfig.assistant_id)}`;
   if (runConfig.user_id) return `user:${String(runConfig.user_id)}`;
@@ -39309,6 +39412,7 @@ async function validateEffectiveDependencies(store, tenantId2, targetScope, depe
   if (blockedBy.length === 0) return void 0;
   return JSON.stringify({
     success: false,
+    code: "DEPENDENCY_BLOCKED",
     error: `Cannot start task: ${blockedBy.length} dependencies not completed`,
     blockedBy,
     invalidScope,
@@ -39459,13 +39563,27 @@ function missingBeliefImpactError() {
     hint: "Provide beliefImpact: [{ key: '<belief-key>', after: <0-100>, basis: '<evidence>' }]"
   });
 }
+function reviewInterruption(task) {
+  const value = task.context?.interruption;
+  if (!value || typeof value !== "object") return void 0;
+  const interruption = value;
+  return interruption.type === "review_required" ? interruption : void 0;
+}
+function buildReviewMarkdown(task) {
+  return genUIMarkdown("task_review", {
+    taskId: task.id,
+    title: task.title,
+    description: task.description,
+    result: task.result
+  });
+}
 var manageTaskSchema = z70.object({
-  action: z70.enum(["create", "get", "list", "update", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, add_activity, delete. To mark a task complete, use update with status='completed'"),
+  action: z70.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
   id: z70.string().optional().describe("Task ID (required for get, update, add_activity, and delete)"),
   title: z70.string().optional().describe("Task title (required for create)"),
   description: z70.string().optional().describe("Task description in Markdown"),
   priority: z70.enum(["low", "medium", "high"]).optional().describe("Priority level"),
-  status: z70.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. Agent summary-only interrupted updates default to missing_input"),
+  status: z70.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Agent summary-only interrupted updates default to missing_input"),
   dueDate: z70.string().optional().describe("Due date (ISO 8601 format)"),
   metadata: z70.record(z70.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
   parentId: z70.string().optional().describe("Parent task ID for grouping subtasks"),
@@ -39476,8 +39594,8 @@ var manageTaskSchema = z70.object({
   requireReview: z70.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
   dependencies: z70.array(z70.string()).optional().describe("List of task IDs that must be completed before this task can start"),
   dependencyTaskIds: z70.array(z70.string().trim().min(1)).optional().describe("Exact blocking task IDs required for an external_dependency interruption"),
-  result: z70.string().optional().describe("Nonblank result summary required when creating or updating a task with status='completed'"),
-  failureReason: z70.string().optional().describe("Nonblank failure reason required when creating or updating a task with status='failed'"),
+  result: z70.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
+  failureReason: z70.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
   files: z70.array(z70.object({
     uri: z70.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
     name: z70.string().optional().describe("Display name"),
@@ -39496,11 +39614,11 @@ var manageTaskSchema = z70.object({
     "Canonical ASCII `execution-result:<suffix>` event key returned by task(); the nonempty suffix allows only A-Z, a-z, 0-9, period, underscore, colon, and hyphen, and is not a database row ID"
   )
 }).superRefine((input, context) => {
-  if (input.executionResultId && input.action !== "update" && input.action !== "add_activity") {
+  if (input.executionResultId && input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity") {
     context.addIssue({
       code: z70.ZodIssueCode.custom,
       path: ["executionResultId"],
-      message: "executionResultId is valid only for update or add_activity"
+      message: "executionResultId is valid only for update, set_status, or add_activity"
     });
   }
 });
@@ -39614,12 +39732,6 @@ function updateValuesEqual(field, requested, persisted) {
   }
   return valuesEqual(requested, persisted);
 }
-function reviewInterruption(task) {
-  const value = task.context?.interruption;
-  if (!value || typeof value !== "object") return void 0;
-  const interruption = value;
-  return interruption.type === "review_required" ? interruption : void 0;
-}
 function reviewModeDisabledResponse() {
   return JSON.stringify({
     success: false,
@@ -39628,14 +39740,6 @@ function reviewModeDisabledResponse() {
     hint: "Configure task middleware with reviewMode 'hitl' before enabling requireReview."
   });
 }
-function buildReviewMarkdown(task) {
-  return genUIMarkdown("task_review", {
-    taskId: task.id,
-    title: task.title,
-    description: task.description,
-    result: task.result
-  });
-}
 function createTaskMiddleware(options = {}) {
   const handleManageTaskAction = async (input, config, validateExecutionResult, markMutation) => {
     const rc = getRunConfig2(config);
@@ -40023,35 +40127,75 @@ function createTaskMiddleware(options = {}) {
         return JSON.stringify({ success: true, data: activity });
       }
       case "update": {
+        taskUpdateDebug("update:enter", {
+          id: input.id,
+          action: input.action,
+          status: input.status,
+          hasResult: input.result !== void 0,
+          hasDescription: input.description !== void 0,
+          tenantId: tenantId2,
+          workspaceId,
+          projectId,
+          authorityKind: delegatedTaskId ? "delegated" : trustedProject ? "trusted" : "ordinary",
+          trustedKind: trustedProject ? trustedProject.projectTask ? "projectTask" : "projectRoom" : void 0
+        });
         if (!input.id) {
+          taskUpdateBlocked(input.id, "MISSING_TASK_ID", {});
           return JSON.stringify({
             success: false,
+            code: "MISSING_TASK_ID",
             error: "id is required for update action",
             hint: "Pass the task ID you want to update"
           });
         }
         if (delegatedTaskId && input.id !== delegatedTaskId) {
+          taskUpdateBlocked(input.id, "DELEGATED_TASK_SCOPE_VIOLATION", { delegatedTaskId });
           return delegatedTaskScopeError(delegatedTaskId);
         }
-        let existing = await store.getById(tenantId2, input.id);
+        const existing = await store.getById(tenantId2, input.id);
+        taskUpdateDebug("update:loaded", existing ? {
+          status: existing.status,
+          updatedAt: existing.updatedAt?.toISOString(),
+          ownerType: existing.ownerType,
+          ownerId: existing.ownerId,
+          workspaceId: existing.workspaceId,
+          projectId: existing.projectId
+        } : { found: false });
         if (!existing) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND", {});
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found`,
-            hint: "Use list to see available tasks and their IDs"
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
           });
         }
         if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND_OR_INACCESSIBLE", {
+            taskWorkspaceId: existing.workspaceId,
+            taskProjectId: existing.projectId,
+            runtimeWorkspaceId: workspaceId,
+            runtimeProjectId: projectId
+          });
           return taskScopeAccessError(input.id);
         }
         if (trustedProject?.projectTask) {
           const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
-          if (trustedFailure) return trustedFailure;
+          if (trustedFailure) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", {
+              taskOwnerId: existing.ownerId,
+              trustedAssistantId: trustedProject.projectTask.assistantId,
+              taskThreadId: existing.context?.thread_id,
+              trustedThreadId: trustedProject.projectTask.threadId
+            });
+            return trustedFailure;
+          }
         }
         if (trustedProject && input.dependencyTaskIds !== void 0) {
           const interruption = input.context?.interruption;
           const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
           if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
+            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
             return JSON.stringify({
               success: false,
               code: "INVALID_EXTERNAL_DEPENDENCY",
@@ -40060,24 +40204,26 @@ function createTaskMiddleware(options = {}) {
           }
         }
         if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
+          taskUpdateBlocked(input.id, "TASK_REASSIGN_ENDPOINT_REQUIRED", {
+            inputOwnerType: input.ownerType,
+            existingOwnerType: existing.ownerType,
+            inputOwnerId: input.ownerId,
+            existingOwnerId: existing.ownerId
+          });
           return JSON.stringify({
             success: false,
             code: "TASK_REASSIGN_ENDPOINT_REQUIRED",
             error: "Project task ownership changes require the reassignment endpoint."
           });
         }
-        if (existing.status === "review" || input.status === "review") {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_STATUS_UNSUPPORTED",
-            error: "Task status is not supported by the task lifecycle."
-          });
-        }
         const isAgentTask = existing.ownerType === "agent";
-        const candidateReviewInterruption = input.status === "interrupted" && input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required" && !!input.result?.trim() && !!input.beliefImpact?.length;
         const changesOwnerType = input.ownerType !== void 0 && input.ownerType !== existing.ownerType;
         const changesAgentIdentity = isAgentTask && (input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId);
         if (changesOwnerType || changesAgentIdentity) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_IMMUTABLE", {
+            changesOwnerType,
+            changesAgentIdentity
+          });
           return JSON.stringify({
             success: false,
             code: "TASK_OWNERSHIP_IMMUTABLE",
@@ -40085,18 +40231,10 @@ function createTaskMiddleware(options = {}) {
             hint: "Create a separate task for different ownership or parentage."
           });
         }
-        const hasMismatchedAgentOutput = isAgentTask && (input.result !== void 0 && input.status !== "completed" && !candidateReviewInterruption || input.failureReason !== void 0 && input.status !== "failed");
-        if (hasMismatchedAgentOutput) {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_LIFECYCLE_TRANSITION_REQUIRED",
-            error: "Agent task result and failureReason require a matching governed lifecycle transition.",
-            hint: "Provide result only with completion, or failureReason only with failure."
-          });
-        }
         const changesOwnership = input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId;
         const changesGovernedState = input.status !== void 0 || input.description !== void 0 || input.result !== void 0 || input.failureReason !== void 0 || input.requireReview !== void 0 || input.context !== void 0;
         if (changesOwnership && changesGovernedState) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_MUTATION_CONFLICT", {});
           return JSON.stringify({
             success: false,
             code: "TASK_OWNERSHIP_MUTATION_CONFLICT",
@@ -40104,17 +40242,389 @@ function createTaskMiddleware(options = {}) {
             hint: "Persist ownership or parent changes separately before changing lifecycle or task content."
           });
         }
+        if (existing.status === "review") {
+          taskUpdateBlocked(input.id, "TASK_STATUS_UNSUPPORTED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_STATUS_UNSUPPORTED",
+            error: "Task status is not supported by the task lifecycle."
+          });
+        }
+        if (input.status !== void 0) {
+          taskUpdateBlocked(input.id, "STATUS_USES_SET_STATUS", { status: input.status });
+          return JSON.stringify({
+            success: false,
+            code: "STATUS_USES_SET_STATUS",
+            error: `Status changes must use the set_status action. Received status='${input.status}'.`,
+            hint: "Call manage_task with action='set_status', id, and status to change the task status. Use action='update' for content fields only."
+          });
+        }
+        if (isAgentTask && input.requireReview === true && options.reviewMode !== "hitl") {
+          return reviewModeDisabledResponse();
+        }
+        if (["completed", "failed", "cancelled"].includes(existing.status) && input.requireReview !== void 0 && input.requireReview !== existing.requireReview) {
+          taskUpdateBlocked(input.id, "TERMINAL_REVIEW_CONFIGURATION_LOCKED", { requireReview: input.requireReview });
+          return JSON.stringify({
+            success: false,
+            code: "TERMINAL_REVIEW_CONFIGURATION_LOCKED",
+            error: "requireReview cannot be changed on a terminal task",
+            hint: "Configure requireReview before the task reaches a terminal status"
+          });
+        }
+        if (existing.status !== "pending" && existing.requireReview === true && input.requireReview === false) {
+          taskUpdateBlocked(input.id, "REVIEW_REQUIREMENT_LOCKED", {});
+          return JSON.stringify({
+            success: false,
+            code: "REVIEW_REQUIREMENT_LOCKED",
+            error: "requireReview cannot be disabled after a task leaves pending",
+            hint: "Configure requireReview while the task is pending"
+          });
+        }
+        if (existing.status === "completed" && input.result !== void 0) {
+          const error = missingTerminalDetail("result", input.result ?? existing.result);
+          if (error) return error;
+        }
+        if (existing.status === "failed" && input.failureReason !== void 0) {
+          const error = missingTerminalDetail(
+            "failureReason",
+            input.failureReason ?? existing.failureReason
+          );
+          if (error) return error;
+        }
         const actor = trustedActor(trustedProject, rc) ?? (existing.ownerType === "agent" ? `agent:${existing.ownerId}` : `user:${existing.ownerId ?? ownerId}`);
-        const threadId = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
+        const workItemStore = getTaskWorkItemStore();
         const lifecycle = isAgentTask ? createTaskLifecycleService({
           taskStore: store,
           workItemStore: trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore()
         }) : void 0;
+        let trustedReferenceSnapshots;
+        if (input.parentId !== void 0 || input.dependencies !== void 0) {
+          if (delegatedTaskId) {
+            const delegatedDependencyError = await validateDelegatedDependencies(
+              store,
+              tenantId2,
+              delegatedTaskId,
+              { workspaceId: existing.workspaceId, projectId: existing.projectId },
+              input.parentId,
+              input.dependencies,
+              input.id
+            );
+            if (delegatedDependencyError) {
+              taskUpdateBlocked(input.id, "DELEGATED_TASK_SCOPE_VIOLATION", { delegatedDependencyError });
+              return delegatedDependencyError;
+            }
+          }
+          const referenceError = await validateReferencedTasks(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            input.parentId,
+            input.dependencies
+          );
+          if (referenceError) {
+            taskUpdateBlocked(input.id, "INVALID_TASK_REFERENCES", { referenceError });
+            return referenceError;
+          }
+          if (trustedProject) {
+            trustedReferenceSnapshots = await captureReferencedTaskSnapshots(
+              store,
+              tenantId2,
+              { workspaceId: existing.workspaceId, projectId: existing.projectId },
+              input.parentId,
+              input.dependencies
+            );
+            if (!trustedReferenceSnapshots) {
+              taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", { reason: "reference snapshots unavailable" });
+              return trustedContextError();
+            }
+          }
+        }
+        const effectiveDependencies = input.dependencies ?? existing.dependencies ?? [];
+        const effectiveStatus = input.status ?? existing.status;
+        if (effectiveStatus === "in_progress" && effectiveDependencies.length > 0) {
+          const dependencyError = await validateEffectiveDependencies(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            effectiveDependencies
+          );
+          if (dependencyError) {
+            const trustedException = trustedProject?.projectTask && input.dependencies !== void 0 ? await validateTrustedChildDependencyWait(
+              store,
+              tenantId2,
+              existing,
+              effectiveDependencies,
+              trustedProject
+            ) : void 0;
+            if (trustedException === void 0) {
+              taskUpdateBlocked(input.id, "DEPENDENCY_BLOCKED", { dependencyError });
+              return dependencyError;
+            }
+            if (trustedException) return trustedException;
+          }
+        }
+        let reconciledTask;
+        let reconciliationMetadata = {};
+        let descriptionMutated = false;
+        if (isAgentTask && input.description !== void 0 && !valuesEqual(input.description, existing.description)) {
+          const oldBelief = parseTaskBeliefState3(existing.description ?? "");
+          const newBelief = parseTaskBeliefState3(input.description);
+          const hasBeliefState = oldBelief.success || newBelief.success;
+          if (hasBeliefState) {
+            await validateExecutionResult();
+            const reconciliation = await lifecycle.updateTaskDescriptionWithReconciliation({
+              tenantId: tenantId2,
+              taskId: input.id,
+              description: input.description,
+              actor,
+              threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id)
+            });
+            if (!reconciliation.success) return JSON.stringify(reconciliation);
+            reconciledTask = reconciliation.task;
+            reconciliationMetadata = { ...reconciliation };
+            delete reconciliationMetadata.task;
+            descriptionMutated = reconciliation.mutated;
+            if (descriptionMutated) markMutation();
+          }
+        }
+        const updates = {};
+        const settableFields = [
+          "title",
+          "description",
+          "priority",
+          "dueDate",
+          "metadata",
+          "parentId",
+          "sourceId",
+          "context",
+          "ownerId",
+          "result",
+          "failureReason",
+          "requireReview",
+          "dependencies",
+          "files"
+        ];
+        for (const field of settableFields) {
+          if (trustedProject && (field === "sourceId" || field === "context" || field === "ownerId")) continue;
+          if (field === "description" && reconciledTask) continue;
+          const requested = input[field];
+          const persisted = reconciledTask ?? existing;
+          if (requested !== void 0 && !updateValuesEqual(field, requested, persisted[field])) {
+            updates[field] = requested;
+          }
+        }
+        if (!reconciledTask && Object.keys(updates).length > 0) {
+          await validateExecutionResult();
+        }
+        if (trustedProject && (input.parentId !== void 0 || input.dependencies !== void 0)) {
+          if (!await referencedTaskSnapshotsStillMatch(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            trustedReferenceSnapshots
+          )) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", { reason: "referenced task changed" });
+            return trustedContextError("Parent or dependency task changed before update.");
+          }
+        }
+        if (trustedProject) {
+          try {
+            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+          } catch (error) {
+            taskUpdateBlocked(input.id, "PROJECT_POLICY_ERROR", { policyError: String(error) });
+            return projectPolicyError(error);
+          }
+        }
+        const snapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
+        taskUpdateDebug("update:write", {
+          updateKeys: Object.keys(updates),
+          useCas: !!snapshot,
+          storeMethod: snapshot ? "updateIfSnapshot" : "update"
+        });
+        const updated = Object.keys(updates).length > 0 ? snapshot ? await store.updateIfSnapshot(tenantId2, input.id, updates, snapshot) : await store.update(tenantId2, input.id, updates) : reconciledTask ?? existing;
+        taskUpdateDebug("update:result", {
+          updated: !!updated,
+          resultStatus: updated?.status,
+          resultUpdatedAt: updated?.updatedAt?.toISOString?.()
+        });
+        if (!updated) {
+          taskUpdateBlocked(input.id, "TASK_UPDATE_FAILED", { storeMethod: snapshot ? "updateIfSnapshot" : "update" });
+          return JSON.stringify({
+            success: false,
+            code: "TASK_UPDATE_FAILED",
+            error: `Failed to update task '${input.id}'.`,
+            hint: "The task may have been deleted, the ID may be incorrect, or the store rejected the write. Use manage_task get to verify the task still exists, then retry the update."
+          });
+        }
+        if (Object.keys(updates).length > 0) markMutation();
+        if (reconciledTask && Object.keys(updates).length === 0) {
+          return successfulTaskResponse(input.id, updated, descriptionMutated, reconciliationMetadata);
+        }
+        if (Object.keys(updates).length === 0) {
+          return successfulTaskResponse(input.id, updated, false);
+        }
+        const workItemAction = "updated";
+        const workItemSummary = input.summary;
+        let activityWarnings;
+        try {
+          if (trustedProject) {
+            try {
+              await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+            } catch (error) {
+              return projectPolicyError(error);
+            }
+          }
+          await workItemStore.create({
+            taskId: input.id,
+            tenantId: tenantId2,
+            action: workItemAction,
+            actor,
+            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId),
+            summary: workItemSummary,
+            detail: {
+              ...input.result !== void 0 && { result: input.result },
+              ...input.failureReason !== void 0 && { failureReason: input.failureReason }
+            },
+            workspaceId: updated.workspaceId,
+            projectId: updated.projectId
+          });
+        } catch (error) {
+          activityWarnings = [{
+            code: "TASK_UPDATE_ACTIVITY_WRITE_FAILED",
+            taskId: input.id,
+            error: error instanceof Error ? error.message : String(error)
+          }];
+        }
+        const lifecycleWarnings = Array.isArray(reconciliationMetadata.warnings) ? reconciliationMetadata.warnings : void 0;
+        return successfulTaskResponse(input.id, updated, true, {
+          ...reconciliationMetadata,
+          warnings: mergeTaskUpdateWarnings(lifecycleWarnings, activityWarnings)
+        });
+      }
+      case "set_status": {
+        if (!input.id) {
+          taskUpdateBlocked(input.id, "MISSING_TASK_ID", {});
+          return JSON.stringify({
+            success: false,
+            code: "MISSING_TASK_ID",
+            error: "id is required for set_status action",
+            hint: "Pass the task ID you want to update"
+          });
+        }
+        if (!input.status) {
+          return JSON.stringify({
+            success: false,
+            code: "MISSING_STATUS",
+            error: "status is required for set_status action",
+            hint: "Pass the target status: pending, in_progress, completed, failed, interrupted, cancelled"
+          });
+        }
+        if (delegatedTaskId && input.id !== delegatedTaskId) {
+          return delegatedTaskScopeError(delegatedTaskId);
+        }
+        const existing = await store.getById(tenantId2, input.id);
+        taskUpdateDebug("set_status:loaded", existing ? {
+          status: existing.status,
+          updatedAt: existing.updatedAt?.toISOString()
+        } : { found: false });
+        if (!existing) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
+          });
+        }
+        if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
+          taskUpdateBlocked(input.id, "TASK_NOT_FOUND_OR_INACCESSIBLE", {});
+          return taskScopeAccessError(input.id);
+        }
+        if (trustedProject?.projectTask) {
+          const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
+          if (trustedFailure) {
+            taskUpdateBlocked(input.id, "PROJECT_TASK_CONTEXT_INVALID", {
+              taskOwnerId: existing.ownerId,
+              trustedAssistantId: trustedProject.projectTask.assistantId,
+              taskThreadId: existing.context?.thread_id,
+              trustedThreadId: trustedProject.projectTask.threadId
+            });
+            return trustedFailure;
+          }
+        }
+        if (trustedProject && input.dependencyTaskIds !== void 0) {
+          const interruption = input.context?.interruption;
+          const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
+          if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
+            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
+            return JSON.stringify({
+              success: false,
+              code: "INVALID_EXTERNAL_DEPENDENCY",
+              error: "dependencyTaskIds are only valid for external dependency interruptions."
+            });
+          }
+        }
+        if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
+          taskUpdateBlocked(input.id, "TASK_REASSIGN_ENDPOINT_REQUIRED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_REASSIGN_ENDPOINT_REQUIRED",
+            error: "Project task ownership changes require the reassignment endpoint."
+          });
+        }
+        if (existing.status === "review" || input.status === "review") {
+          taskUpdateBlocked(input.id, "TASK_STATUS_UNSUPPORTED", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_STATUS_UNSUPPORTED",
+            error: "Task status is not supported by the task lifecycle."
+          });
+        }
+        const isAgentTask = existing.ownerType === "agent";
+        const changesOwnerType = input.ownerType !== void 0 && input.ownerType !== existing.ownerType;
+        const changesAgentIdentity = isAgentTask && (input.ownerId !== void 0 && input.ownerId !== existing.ownerId || input.parentId !== void 0 && input.parentId !== existing.parentId);
+        if (changesOwnerType || changesAgentIdentity) {
+          taskUpdateBlocked(input.id, "TASK_OWNERSHIP_IMMUTABLE", {});
+          return JSON.stringify({
+            success: false,
+            code: "TASK_OWNERSHIP_IMMUTABLE",
+            error: "Agent task ownerType, ownerId, and parentId cannot be changed after task creation.",
+            hint: "Create a separate task for different ownership or parentage."
+          });
+        }
+        const actor = trustedActor(trustedProject, rc) ?? (existing.ownerType === "agent" ? `agent:${existing.ownerId}` : `user:${existing.ownerId ?? ownerId}`);
+        const statusWorkItemStore = trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore();
+        const lifecycle = isAgentTask ? createTaskLifecycleService({
+          taskStore: store,
+          workItemStore: statusWorkItemStore
+        }) : void 0;
         const lifecycleMutationResponse = (result, extra = {}) => {
           if (result.success && result.mutated) markMutation();
           return lifecycleResponse(input.id, result, extra);
         };
-        const hasCarriedContentFields = () => ["title", "description", "priority", "dueDate", "metadata", "files"].some((key4) => input[key4] !== void 0);
+        if (input.status === "in_progress" && (existing.dependencies ?? []).length > 0) {
+          const dependencyError = await validateEffectiveDependencies(
+            store,
+            tenantId2,
+            { workspaceId: existing.workspaceId, projectId: existing.projectId },
+            existing.dependencies ?? []
+          );
+          if (dependencyError) {
+            const trustedException = trustedProject?.projectTask ? await validateTrustedChildDependencyWait(
+              store,
+              tenantId2,
+              existing,
+              existing.dependencies ?? [],
+              trustedProject
+            ) : void 0;
+            if (trustedException === void 0) {
+              taskUpdateBlocked(input.id, "DEPENDENCY_BLOCKED", { dependencyError });
+              return dependencyError;
+            }
+            if (trustedException) return trustedException;
+          }
+        }
+        const statusThreadId = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
         if (lifecycle && input.status === "failed") {
           await validateExecutionResult();
           const callerError = await revalidateCaller();
@@ -40124,11 +40634,9 @@ function createTaskMiddleware(options = {}) {
             taskId: input.id,
             failureReason: input.failureReason ?? existing.failureReason ?? "",
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!failed.success) return lifecycleMutationResponse(failed);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(failed);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(failed);
         }
         if (lifecycle && input.status === "cancelled") {
           await validateExecutionResult();
@@ -40138,12 +40646,10 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId,
+            threadId: statusThreadId,
             summary: input.summary
           });
-          if (!cancelled.success) return lifecycleMutationResponse(cancelled);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(cancelled);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(cancelled);
         }
         if (lifecycle && input.status === "interrupted" && !(input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required")) {
           const interruption = input.context?.interruption;
@@ -40165,12 +40671,10 @@ function createTaskMiddleware(options = {}) {
             type,
             summary: input.summary ?? "",
             actor,
-            threadId,
+            threadId: statusThreadId,
             dependencyTaskIds: input.dependencyTaskIds
           });
-          if (!interrupted.success) return lifecycleMutationResponse(interrupted);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(interrupted);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(interrupted);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "interrupted") {
           await validateExecutionResult();
@@ -40180,11 +40684,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!resumed.success) return lifecycleMutationResponse(resumed);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(resumed);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(resumed);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "pending") {
           await validateExecutionResult();
@@ -40194,11 +40696,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!started.success) return lifecycleMutationResponse(started);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(started);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(started);
         }
         if (lifecycle && input.status === "in_progress" && existing.status === "failed") {
           await validateExecutionResult();
@@ -40208,11 +40708,9 @@ function createTaskMiddleware(options = {}) {
             tenantId: tenantId2,
             taskId: input.id,
             actor,
-            threadId
+            threadId: statusThreadId
           });
-          if (!retried.success) return lifecycleMutationResponse(retried);
-          if (trustedProject || !hasCarriedContentFields()) return lifecycleMutationResponse(retried);
-          existing = { ...existing, status: input.status };
+          return lifecycleMutationResponse(retried);
         }
         if (isAgentTask && input.requireReview === true && options.reviewMode !== "hitl") {
           return reviewModeDisabledResponse();
@@ -40234,54 +40732,39 @@ function createTaskMiddleware(options = {}) {
           });
         }
         const effectiveRequireReview = existing.requireReview === true || input.requireReview === true;
-        const workItemStore = getTaskWorkItemStore();
-        const governedAgentCompletion = isAgentTask && (input.status === "completed" || candidateReviewInterruption && !!input.result?.trim() && !!input.beliefImpact?.length);
+        const candidateReviewInterruption = input.status === "interrupted" && input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required" && !!input.result?.trim() && !!input.beliefImpact?.length;
+        const governedAgentCompletion = isAgentTask && (input.status === "completed" || candidateReviewInterruption);
         if (governedAgentCompletion) {
-          const guardedFields = [
-            "parentId",
-            "ownerType",
-            "ownerId",
-            "description"
-          ];
-          for (const field of guardedFields) {
-            const requestValue = input[field];
-            const existingValue = existing[field];
-            if (requestValue !== void 0 && requestValue !== existingValue) {
-              return JSON.stringify({
-                success: false,
-                code: "COMPLETION_CONTEXT_MUTATION",
-                error: `Cannot change ${field} while completing an agent task`,
-                hint: "Persist the context change in a separate update before completing the task"
-              });
-            }
-          }
           if (!input.beliefImpact?.length) return missingBeliefImpactError();
           const finalResult = input.result ?? existing.result ?? "";
-          const threadId2 = trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id);
-          const lifecycle2 = createTaskLifecycleService({
-            taskStore: store,
-            workItemStore: trustedProject ? getProjectTaskWorkItemStore() : getTaskWorkItemStore()
-          });
+          if (!finalResult.trim()) {
+            return JSON.stringify({
+              success: false,
+              code: "MISSING_RESULT",
+              error: "result is required for completing a task",
+              hint: "Provide a nonblank result"
+            });
+          }
           const completionInput = {
             tenantId: tenantId2,
             taskId: input.id,
             result: finalResult,
             beliefImpact: input.beliefImpact,
             actor,
-            threadId: threadId2,
+            threadId: statusThreadId,
             sourceId: trustedProject ? void 0 : input.sourceId
           };
           await validateExecutionResult();
-          const needsReview = effectiveRequireReview || candidateReviewInterruption || !!reviewInterruption(existing);
+          const needsReview = effectiveRequireReview || !!reviewInterruption(existing);
           if (!needsReview) {
             const callerError2 = await revalidateCaller();
             if (callerError2) return callerError2;
-            const result = existing.status === "completed" ? await lifecycle2.repairCompletion(completionInput) : await lifecycle2.completeAgentTask(completionInput);
+            const result = existing.status === "completed" ? await lifecycle.repairCompletion(completionInput) : await lifecycle.completeAgentTask(completionInput);
             return lifecycleMutationResponse(result);
           }
           const callerError = await revalidateCaller();
           if (callerError) return callerError;
-          const submitted = await lifecycle2.submitReview({
+          const submitted = await lifecycle.submitReview({
             ...completionInput,
             reviewMode: options.reviewMode ?? "disabled",
             configureRequireReview: input.requireReview === true && existing.requireReview !== true
@@ -40306,30 +40789,34 @@ function createTaskMiddleware(options = {}) {
           if (response?.action === "approve") {
             const approvalCallerError = await revalidateCaller();
             if (approvalCallerError) return approvalCallerError;
-            return lifecycleMutationResponse(await lifecycle2.approveInterrupted({
+            return lifecycleMutationResponse(await lifecycle.approveInterrupted({
               tenantId: tenantId2,
               taskId: input.id,
               evidenceId,
               actor,
-              threadId: threadId2
+              threadId: statusThreadId
             }), { reviewerAction: "approved" });
           }
           if (response?.action === "reject") {
             const note = response.data?.note?.trim() || "Changes requested.";
             const rejectionCallerError = await revalidateCaller();
             if (rejectionCallerError) return rejectionCallerError;
-            return lifecycleMutationResponse(await lifecycle2.rejectInterrupted({
+            return lifecycleMutationResponse(await lifecycle.rejectInterrupted({
               tenantId: tenantId2,
               taskId: input.id,
               evidenceId,
               actor,
-              threadId: threadId2,
+              threadId: statusThreadId,
               note
             }), { reviewerAction: "rejected", reviewerNote: note });
           }
           return lifecycleMutationResponse(submitted, { code: "REVIEW_REQUIRED" });
         }
-        if (isAgentTask && input.status !== void 0 && input.status !== existing.status) {
+        if (isAgentTask && input.status !== existing.status) {
+          taskUpdateBlocked(input.id, "AGENT_TASK_LIFECYCLE_REQUIRED", {
+            currentStatus: existing.status,
+            requestedStatus: input.status
+          });
           return JSON.stringify({
             success: false,
             code: "AGENT_TASK_LIFECYCLE_REQUIRED",
@@ -40337,45 +40824,17 @@ function createTaskMiddleware(options = {}) {
             hint: "Valid transitions: pending\u2192in_progress, in_progress\u2192completed (requires result + beliefImpact), in_progress\u2192failed (requires failureReason), in_progress\u2192cancelled, in_progress\u2192interrupted. Check the current status with manage_task get first."
           });
         }
-        const persistedStatus = input.status;
-        let trustedReferenceSnapshots;
-        if (input.parentId !== void 0 || input.dependencies !== void 0) {
-          if (delegatedTaskId) {
-            const delegatedDependencyError = await validateDelegatedDependencies(
-              store,
-              tenantId2,
-              delegatedTaskId,
-              { workspaceId: existing.workspaceId, projectId: existing.projectId },
-              input.parentId,
-              input.dependencies,
-              input.id
-            );
-            if (delegatedDependencyError) return delegatedDependencyError;
-          }
-          const referenceError = await validateReferencedTasks(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            input.parentId,
-            input.dependencies
-          );
-          if (referenceError) return referenceError;
-          if (trustedProject) {
-            trustedReferenceSnapshots = await captureReferencedTaskSnapshots(
-              store,
-              tenantId2,
-              { workspaceId: existing.workspaceId, projectId: existing.projectId },
-              input.parentId,
-              input.dependencies
-            );
-            if (!trustedReferenceSnapshots) return trustedContextError();
-          }
-        }
         if (input.status) {
           if (!isAgentTask && !isValidUserTransition(existing.status, input.status)) {
             const allowed = USER_VALID_TRANSITIONS[existing.status] || [];
+            taskUpdateBlocked(input.id, "INVALID_USER_TRANSITION", {
+              currentStatus: existing.status,
+              requestedStatus: input.status,
+              allowedTransitions: allowed
+            });
             return JSON.stringify({
               success: false,
+              code: "INVALID_USER_TRANSITION",
               error: `Cannot transition task from '${existing.status}' to '${input.status}'`,
               allowedTransitions: allowed,
               hint: `From '${existing.status}', valid transitions are: ${allowed.join(", ")}`
@@ -40393,154 +40852,47 @@ function createTaskMiddleware(options = {}) {
           );
           if (error) return error;
         }
-        const effectiveDependencies = input.dependencies ?? existing.dependencies ?? [];
-        const effectiveStatus = input.status ?? existing.status;
-        if (effectiveStatus === "in_progress" && effectiveDependencies.length > 0) {
-          const dependencyError = await validateEffectiveDependencies(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            effectiveDependencies
-          );
-          if (dependencyError) {
-            const trustedException = trustedProject?.projectTask && input.dependencies !== void 0 ? await validateTrustedChildDependencyWait(
-              store,
-              tenantId2,
-              existing,
-              effectiveDependencies,
-              trustedProject
-            ) : void 0;
-            if (trustedException === void 0) return dependencyError;
-            if (trustedException) return trustedException;
-          }
+        if (input.status === existing.status) {
+          return successfulTaskResponse(input.id, existing, false);
         }
-        let reconciledTask;
-        let reconciliationMetadata = {};
-        let descriptionMutated = false;
-        if (isAgentTask && input.description !== void 0 && !valuesEqual(input.description, existing.description)) {
-          await validateExecutionResult();
-          const reconciliation = await lifecycle.updateTaskDescriptionWithReconciliation({
-            tenantId: tenantId2,
-            taskId: input.id,
-            description: input.description,
-            actor,
-            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId ?? rc.thread_id)
-          });
-          if (!reconciliation.success) return JSON.stringify(reconciliation);
-          reconciledTask = reconciliation.task;
-          reconciliationMetadata = { ...reconciliation };
-          delete reconciliationMetadata.task;
-          descriptionMutated = reconciliation.mutated;
-          if (descriptionMutated) markMutation();
-        }
-        const updates = {};
-        const settableFields = [
-          "title",
-          "description",
-          "priority",
-          "dueDate",
-          "metadata",
-          "parentId",
-          "sourceId",
-          "context",
-          "ownerId",
-          "result",
-          "failureReason",
-          "requireReview",
-          "dependencies",
-          "files"
-        ];
-        for (const field of settableFields) {
-          if (trustedProject && (field === "sourceId" || field === "context" || field === "ownerId")) continue;
-          if (field === "description" && reconciledTask) continue;
-          const requested = input[field];
-          const persisted = reconciledTask ?? existing;
-          if (requested !== void 0 && !updateValuesEqual(field, requested, persisted[field])) {
-            updates[field] = requested;
-          }
-        }
-        if (persistedStatus !== void 0 && existing.status !== persistedStatus) {
-          updates.status = persistedStatus;
-        }
-        if (!reconciledTask && Object.keys(updates).length > 0) {
-          await validateExecutionResult();
-        }
-        if (trustedProject && (input.parentId !== void 0 || input.dependencies !== void 0)) {
-          if (!await referencedTaskSnapshotsStillMatch(
-            store,
-            tenantId2,
-            { workspaceId: existing.workspaceId, projectId: existing.projectId },
-            trustedReferenceSnapshots
-          )) return trustedContextError("Parent or dependency task changed before update.");
-        }
-        if (trustedProject) {
-          try {
-            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
-          } catch (error) {
-            return projectPolicyError(error);
-          }
-        }
-        const snapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
-        const updated = Object.keys(updates).length > 0 ? snapshot ? await store.updateIfSnapshot(tenantId2, input.id, updates, snapshot) : await store.update(tenantId2, input.id, updates) : reconciledTask ?? existing;
-        if (!updated) {
+        const statusUpdates = { status: input.status };
+        if (input.status === "completed" && input.result !== void 0) statusUpdates.result = input.result;
+        if (input.status === "failed" && input.failureReason !== void 0) statusUpdates.failureReason = input.failureReason;
+        if (input.summary !== void 0) statusUpdates.summary = input.summary;
+        const statusSnapshot = trustedProject ? taskMutationSnapshot(existing) : void 0;
+        taskUpdateDebug("set_status:write", {
+          status: input.status,
+          useCas: !!statusSnapshot
+        });
+        const updatedStatus = await (statusSnapshot ? store.updateIfSnapshot(tenantId2, input.id, statusUpdates, statusSnapshot) : store.update(tenantId2, input.id, statusUpdates));
+        taskUpdateDebug("set_status:result", {
+          updated: !!updatedStatus,
+          resultStatus: updatedStatus?.status
+        });
+        if (!updatedStatus) {
+          taskUpdateBlocked(input.id, "TASK_UPDATE_FAILED", {});
           return JSON.stringify({
             success: false,
-            error: `Failed to update task '${input.id}'`,
-            hint: "The task may have been deleted or the ID is incorrect"
+            code: "TASK_UPDATE_FAILED",
+            error: `Failed to update status of task '${input.id}'.`,
+            hint: "Use manage_task get to verify the task exists, then retry."
           });
         }
-        if (Object.keys(updates).length > 0) markMutation();
-        if (reconciledTask && Object.keys(updates).length === 0) {
-          return successfulTaskResponse(input.id, updated, descriptionMutated, reconciliationMetadata);
-        }
-        if (Object.keys(updates).length === 0) {
-          return successfulTaskResponse(input.id, updated, false);
-        }
-        const actionMap = {
-          pending: "pending",
-          in_progress: "started",
-          failed: "failed",
-          interrupted: "interrupted",
-          completed: "completed",
-          cancelled: "cancelled"
-        };
-        const workItemAction = persistedStatus ? actionMap[persistedStatus] || "updated" : "updated";
-        const workItemSummary = input.summary || (persistedStatus ? `Status changed to ${persistedStatus}` : void 0);
-        let activityWarnings;
+        markMutation();
         try {
-          if (trustedProject) {
-            try {
-              await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
-            } catch (error) {
-              return projectPolicyError(error);
-            }
-          }
-          await workItemStore.create({
+          await statusWorkItemStore.create({
             taskId: input.id,
             tenantId: tenantId2,
-            action: workItemAction,
+            action: input.status,
             actor,
-            threadId: trustedProject?.projectTask?.threadId ?? (trustedProject?.projectRoom ? void 0 : input.sourceId),
-            summary: workItemSummary,
-            detail: {
-              ...input.result !== void 0 && { result: input.result },
-              ...input.failureReason !== void 0 && { failureReason: input.failureReason }
-            },
-            workspaceId: updated.workspaceId,
-            projectId: updated.projectId
+            threadId: statusThreadId ?? input.sourceId,
+            summary: input.summary || `Status changed to ${input.status}`,
+            workspaceId: updatedStatus.workspaceId,
+            projectId: updatedStatus.projectId
           });
-        } catch (error) {
-          activityWarnings = [{
-            code: "TASK_UPDATE_ACTIVITY_WRITE_FAILED",
-            taskId: input.id,
-            error: error instanceof Error ? error.message : String(error)
-          }];
+        } catch {
         }
-        const lifecycleWarnings = Array.isArray(reconciliationMetadata.warnings) ? reconciliationMetadata.warnings : void 0;
-        return successfulTaskResponse(input.id, updated, true, {
-          ...reconciliationMetadata,
-          warnings: mergeTaskUpdateWarnings(lifecycleWarnings, activityWarnings)
-        });
+        return successfulTaskResponse(input.id, updatedStatus, true);
       }
       case "delete": {
         if (!input.id) {
@@ -40557,8 +40909,9 @@ function createTaskMiddleware(options = {}) {
         if (!existing) {
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found`,
-            hint: "Use list to see available tasks and their IDs"
+            code: "TASK_NOT_FOUND",
+            error: `Task '${input.id}' was not found.`,
+            hint: "Use manage_task list to see available tasks and their correct IDs."
           });
         }
         if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
@@ -40584,8 +40937,9 @@ function createTaskMiddleware(options = {}) {
         if (!deleted) {
           return JSON.stringify({
             success: false,
-            error: `Task '${input.id}' not found or could not be deleted`,
-            hint: "Use list to verify the task exists"
+            code: "TASK_DELETE_FAILED",
+            error: `Task '${input.id}' was not found or could not be deleted.`,
+            hint: "Use manage_task list to verify the task exists and you have access to it."
           });
         }
         return JSON.stringify({ success: true, message: `Task '${input.id}' deleted` });
@@ -40600,7 +40954,7 @@ function createTaskMiddleware(options = {}) {
     }
   };
   const reconcileExplicitExecutionResult = async (input, config, response, validationError, didMutate) => {
-    if (input.action !== "update" && input.action !== "add_activity" || !input.id) return response;
+    if (input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity" || !input.id) return response;
     const authority = classifyTaskAuthority(getRunConfig2(config));
     if (authority.kind === "projectRoom" || authority.kind === "projectTask" || authority.kind === "invalid") {
       return response;
@@ -40794,14 +41148,18 @@ ${TASK_CONVERGENCE_GUIDANCE}
 - Explicit ownerId: assign to a specific agent (cross-agent delegation)
 
 ## Actions
-- create: Create a task (title required; result required for completed; failureReason required for failed)
+- create: Create a task (title required)
 - get: Get one task and its newest 100 activities (id required)
 - list: List tasks, filterable by ownerType/status/priority/parentId
-- update: Update a task (id required; pass only the fields to change)
-  To mark complete: update with status='completed', result='...' (a nonblank input or existing result is required)
-  To mark failed: update with status='failed', failureReason='...' (a nonblank input or existing failureReason is required)
-  To pause for missing input: update with status='interrupted', summary='what is needed' (defaults to interruption type missing_input)
-  Status transitions are validated \u2014 only allowed transitions will succeed.
+- update: Update a task's content fields (title/description/priority/dueDate/metadata/parentId/sourceId/context/ownerId/result/failureReason/requireReview/dependencies/files)
+  Status changes can also be done here, but use set_status for a simpler dedicated status update.
+- set_status: Change a task's status (id and status required). Use this when you only need to change the status.
+  Valid status values: pending, in_progress, review, failed, interrupted, completed, cancelled
+  Companion fields: result (for completed), failureReason (for failed), summary (for any status)
+  To mark complete: set_status with status='completed', result='...'
+  To mark failed: set_status with status='failed', failureReason='...'
+  To pause for input: set_status with status='interrupted', summary='what is needed'
+  Status can be freely changed to any valid value \u2014 no restrictions on transitions.
 - add_activity: Add a Markdown activity without changing task fields or status (id and content required)
 - delete: Delete a task (id required)