@brainervirus/workit-codex 1.1.1 → 1.2.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14551,6 +14551,7 @@ var workerSchema = object({
   assignment: assignmentSchema,
   state: _enum(["assigned", "dispatching", "running", "cancelling", "stopped", "unknown"]),
   session: refSchema.nullable(),
+  coordinator: refSchema.optional(),
   report: workerReportSchema.nullable()
 }).strict();
 var ownerSchema = object({
@@ -14662,6 +14663,7 @@ var taskSummarySchema = object({
   requirements: array(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
 var exportBundleSchema = object({
   schemaVersion: literal(1),
   exportedAt: utc,
@@ -14683,11 +14685,15 @@ var taskOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     intent: intentSchema
   }),
-  list: operation({ action: literal("list") }),
+  list: operation({
+    action: literal("list"),
+    status: _enum(["open", "closed", "all"]).optional(),
+    limit: number2().int().min(1).max(50).optional()
+  }),
   inspect: operation({
     action: literal("inspect"),
     ...taskId,
-    view: _enum(["summary", "full"])
+    view: _enum(["summary", "full"]).optional()
   }),
   revise: operation({
     action: literal("revise"),
@@ -14715,7 +14721,7 @@ var taskOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    authorityRefs: array(refSchema)
+    authorityRefs: array(refSchema).optional()
   }),
   close: operation({
     action: literal("close"),
@@ -16548,6 +16554,10 @@ var validPath = (value) => typeof value === "string" && value.length > 0 && ![..
 }) && !value.split(/[\\/]/).includes("..");
 var callerValue = (value) => ({ host: value.host, actor: value.actor });
 var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
     return failure("invalid_input", "invalid product write path");
@@ -17264,9 +17274,11 @@ var standingReceiptFor = (root, workspace, cls, dir) => {
 var verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
-  const session = task.intent?.provenance?.session;
-  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
-    return failure("permission_denied", "standing approval requires the lead session");
+  const workspace = new TaskStore(root).readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
+    return failure("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
     return failure("invalid_input", "standing approval needs a workspace and class");
@@ -17503,6 +17515,20 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
 };
 var verifyContentRefs = (store, binding) => verifyDecisionContentAtRoot(store.root, binding);
 var storedDecisionApplicable = (store, task, purpose, binding) => task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && verifyDecisionContentAtRoot(store.root, entry.data.binding).ok);
+var approvalAuthorityMatches = (store, task, approval, current) => {
+  if (approval.kind !== "host_observed" || approval.receipts.length === 0)
+    return false;
+  if (provenanceMatches(approval, current))
+    return true;
+  const session = current.kind === "host_observed" ? current.session : null;
+  if (!session || session.kind !== "host")
+    return false;
+  const workspace = store.readWorkspace();
+  return workspace.ok && workspace.data !== null && currentWriterOwnsTask(task, workspace.data, {
+    host: session.host,
+    actor: session.handle
+  });
+};
 var validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
@@ -17528,7 +17554,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
     return failure("permission_denied", "decision was rejected");
-  if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
+  if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
@@ -17695,7 +17721,7 @@ function settleAction(input) {
       return failure("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
       return failure("permission_denied", "native settlement authority does not match decision");
-    if (!provenanceMatches(entry.provenance, authority.provenance))
+    if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
       return failure("permission_denied", "decision binding is invalid");
@@ -17794,7 +17820,7 @@ function reconcileAction(input) {
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
       return failure("not_found", "decision not found");
-    if (!authorityDecisionMatches(authority, entry.data) || !provenanceMatches(entry.provenance, authority.provenance))
+    if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
       return failure("permission_denied", "reconciliation decision binding is invalid");
@@ -18131,7 +18157,7 @@ var resolveBinding = (evidence, pin, currentCandidateId) => {
     candidateId: evidence.candidateId ?? fallback
   };
 };
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
@@ -18366,6 +18392,11 @@ var exportDigest = (bundle) => sha256({
   task: bundle.task
 });
 // packages/workit-core/src/core/external-action.ts
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
 var externalActionSchema = discriminatedUnion("operation", [
   object({
     operation: literal("git.branch_setup"),
@@ -18380,7 +18411,7 @@ var externalActionSchema = discriminatedUnion("operation", [
     operation: literal("git.commit"),
     payload: object({
       message: string2().min(1).optional(),
-      plan_steps: array(string2().min(1)).optional(),
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
       plan_branch: string2().min(1).optional()
     }).strict()
   }).strict(),
@@ -18866,6 +18897,7 @@ var verifyNativeWorker = (verifier, input, binding) => {
     expectedWorkspaceRevision: expected.expectedWorkspaceRevision,
     state: expected.state,
     session: expected.session,
+    report: expected.report ?? null,
     provenance: result.data,
     ...binding
   });
@@ -18876,7 +18908,7 @@ var takeWorker = (token, binding, expected) => {
   verifiedWorkers.delete(token);
   if (!value)
     return null;
-  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session))
+  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session) || !sameValue(value.report, expected.report ?? null))
     return null;
   return value;
 };
@@ -18917,6 +18949,8 @@ var applyWorkerLifecycle = (input) => {
     return failure("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
     return failure("invalid_transition", "worker launch was not claimed");
+  if (input.report && input.state !== "stopped")
+    return failure("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
     return failure("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
@@ -18933,12 +18967,13 @@ var applyWorkerLifecycle = (input) => {
     data: {
       ...entry.data,
       state: terminalCancel ? "cancelling" : input.state,
-      session: input.session
+      session: input.session,
+      report: entry.data.report ?? input.report ?? null
     }
   };
   const shouldClear = input.state === "stopped" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
   const shouldUncertain = input.state === "unknown" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
-  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && !shouldClear && !shouldUncertain)
+  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && sameValue(entry.data.report, nextEntry.data.report) && !shouldClear && !shouldUncertain)
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
@@ -19356,14 +19391,30 @@ class WorkitCore {
         const listed = this.store.listTasks();
         if (!listed.ok)
           return listed;
-        const summaries = [];
-        for (const task of listed.data) {
-          const summary = this.summary(task);
-          if (!summary.ok)
-            return summary;
-          summaries.push(summary.data);
-        }
-        return success(null, null, summaries);
+        const status = input.status ?? "open";
+        const limit = input.limit ?? 20;
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        if (selected.length === 0)
+          return success(null, null, []);
+        const workspace = this.store.readWorkspace();
+        if (!workspace.ok)
+          return workspace;
+        if (!workspace.data)
+          return failure("not_found", "workspace not found");
+        const tasks = selected.map((task) => ({
+          id: task.id,
+          revision: task.revision,
+          workspaceRevision: workspace.data.revision,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          runtime: task.runtime ?? null,
+          objective: task.intent.data.objective,
+          status: task.status,
+          closure: task.closure,
+          progress: task.progress,
+          writer: task.status === "closed" ? null : workspace.data.writer
+        }));
+        return success(null, null, tasks);
       }
       case "inspect": {
         const task = this.store.readTask(input.taskId);
@@ -19372,7 +19423,7 @@ class WorkitCore {
         const helper = this.helperTaskGuard(task.data, true);
         if (!helper.ok)
           return helper;
-        if (input.view === "summary")
+        if ((input.view ?? "summary") === "summary")
           return this.summary(task.data);
         return this.view(task.data);
       }
@@ -19716,7 +19767,7 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return findingVerificationPasses(finding.data.candidateId, {
+        return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
           kind: entry.data.kind,
           candidateId: entry.data.candidateId,
           status: evaluation?.status ?? "missing"
@@ -19796,7 +19847,18 @@ class WorkitCore {
       if (task.data.status !== "active")
         return failure("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope");
+        return failure("permission_denied", "worker assignment is outside task scope", {
+          fields: [
+            {
+              path: "assignment.scope",
+              reason: `paths ${JSON.stringify(input.assignment.scope.paths)} must be contained by lead paths ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            },
+            {
+              path: "task.intent.scope",
+              reason: `lead paths are ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            }
+          ]
+        });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
         return failure("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
@@ -20003,7 +20065,15 @@ class WorkitCore {
             ...item,
             recordedAt: mutation.now,
             provenance: attested.data,
-            data: { ...item.data, state: "dispatching" }
+            data: {
+              ...item.data,
+              state: "dispatching",
+              coordinator: {
+                kind: "host",
+                host: this.context.caller.host,
+                handle: this.context.caller.actor
+              }
+            }
           } : item)
         });
       }
@@ -20079,6 +20149,7 @@ class WorkitCore {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         state: "stopped",
         session: null,
+        report: null,
         provenance: attested.data,
         owner: this.authorityOwner,
         store: this.store,
@@ -20386,10 +20457,12 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -20403,7 +20476,7 @@ class WorkitCore {
       progress: task.progress,
       policy: task.policy,
       requirements,
-      writer: workspace.data.writer
+      writer: evaluationWorkspace.writer
     });
   }
   view(task) {
@@ -20412,13 +20485,15 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       task,
-      workspace: workspace.data,
+      workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
       evidence: evaluateEvidence(task, current.data)
@@ -20509,8 +20584,6 @@ class WorkitCore {
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
       return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
-    if (status === "active" && input.authorityRefs.length === 0)
-      return failure("permission_denied", "resuming a task requires authority references");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -20540,7 +20613,7 @@ class WorkitCore {
         return failure("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
         return failure("recovery_required", "imported task requires resume reconciliation");
-      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs, this.context))
+      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
@@ -20670,7 +20743,7 @@ class WorkitCore {
       task: (value, context) => success(context.revision, null, {
         ...value,
         status: "closed",
-        candidates: value.candidates.some((item) => item.id === withCandidate.id) ? value.candidates : [...value.candidates, withCandidate],
+        candidates: taskForView.candidates,
         closure: {
           outcome: closure.data.outcome,
           at: context.now,
@@ -20745,7 +20818,7 @@ function run2(root, executable, args, env = {}) {
 var SUPPORT_MATRIX = {
   bun: "1.4.1",
   node: { minimum: "24", current: "24.20.0" },
-  opencode: { minimum: "1.15.0", current: "1.18.30" },
+  opencode: { minimum: "1.18.30", current: "1.18.30" },
   codex: { cli: "0.153.4", desktopPackage: "26.901.20858", bundledCodexCli: "0.153.0-alpha.5" },
   os: ["ubuntu-latest", "macos-latest", "windows-latest"]
 };

package/dist/workit-hook.js

@@ -7705,6 +7705,7 @@ var workerSchema = object({
   assignment: assignmentSchema,
   state: _enum(["assigned", "dispatching", "running", "cancelling", "stopped", "unknown"]),
   session: refSchema.nullable(),
+  coordinator: refSchema.optional(),
   report: workerReportSchema.nullable()
 }).strict();
 var ownerSchema = object({
@@ -7816,6 +7817,7 @@ var taskSummarySchema = object({
   requirements: array(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
 var exportBundleSchema = object({
   schemaVersion: literal(1),
   exportedAt: utc,
@@ -7837,11 +7839,15 @@ var taskOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     intent: intentSchema
   }),
-  list: operation({ action: literal("list") }),
+  list: operation({
+    action: literal("list"),
+    status: _enum(["open", "closed", "all"]).optional(),
+    limit: number2().int().min(1).max(50).optional()
+  }),
   inspect: operation({
     action: literal("inspect"),
     ...taskId,
-    view: _enum(["summary", "full"])
+    view: _enum(["summary", "full"]).optional()
   }),
   revise: operation({
     action: literal("revise"),
@@ -7869,7 +7875,7 @@ var taskOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    authorityRefs: array(refSchema)
+    authorityRefs: array(refSchema).optional()
   }),
   close: operation({
     action: literal("close"),
@@ -9641,6 +9647,10 @@ var validPath = (value) => typeof value === "string" && value.length > 0 && ![..
 }) && !value.split(/[\\/]/).includes("..");
 var callerValue = (value) => ({ host: value.host, actor: value.actor });
 var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
     return failure("invalid_input", "invalid product write path");
@@ -9998,9 +10008,11 @@ var standingReceiptFor = (root, workspace, cls, dir) => {
 var verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
-  const session = task.intent?.provenance?.session;
-  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
-    return failure("permission_denied", "standing approval requires the lead session");
+  const workspace = new TaskStore(root).readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
+    return failure("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
     return failure("invalid_input", "standing approval needs a workspace and class");
@@ -10237,6 +10249,20 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
 };
 var verifyContentRefs = (store, binding) => verifyDecisionContentAtRoot(store.root, binding);
 var storedDecisionApplicable = (store, task, purpose, binding) => task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && verifyDecisionContentAtRoot(store.root, entry.data.binding).ok);
+var approvalAuthorityMatches = (store, task, approval, current) => {
+  if (approval.kind !== "host_observed" || approval.receipts.length === 0)
+    return false;
+  if (provenanceMatches(approval, current))
+    return true;
+  const session = current.kind === "host_observed" ? current.session : null;
+  if (!session || session.kind !== "host")
+    return false;
+  const workspace = store.readWorkspace();
+  return workspace.ok && workspace.data !== null && currentWriterOwnsTask(task, workspace.data, {
+    host: session.host,
+    actor: session.handle
+  });
+};
 var validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
@@ -10262,7 +10288,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
     return failure("permission_denied", "decision was rejected");
-  if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
+  if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
@@ -10429,7 +10455,7 @@ function settleAction(input) {
       return failure("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
       return failure("permission_denied", "native settlement authority does not match decision");
-    if (!provenanceMatches(entry.provenance, authority.provenance))
+    if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
       return failure("permission_denied", "decision binding is invalid");
@@ -10528,7 +10554,7 @@ function reconcileAction(input) {
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
       return failure("not_found", "decision not found");
-    if (!authorityDecisionMatches(authority, entry.data) || !provenanceMatches(entry.provenance, authority.provenance))
+    if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
       return failure("permission_denied", "reconciliation decision binding is invalid");
@@ -10865,7 +10891,7 @@ var resolveBinding = (evidence, pin, currentCandidateId) => {
     candidateId: evidence.candidateId ?? fallback
   };
 };
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
@@ -11334,6 +11360,11 @@ function shouldDenyShellRoute(dir, command) {
   return shellRouteIntent(command);
 }
 // packages/workit-core/src/core/external-action.ts
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
 var externalActionSchema = discriminatedUnion("operation", [
   object({
     operation: literal("git.branch_setup"),
@@ -11348,7 +11379,7 @@ var externalActionSchema = discriminatedUnion("operation", [
     operation: literal("git.commit"),
     payload: object({
       message: string2().min(1).optional(),
-      plan_steps: array(string2().min(1)).optional(),
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
       plan_branch: string2().min(1).optional()
     }).strict()
   }).strict(),
@@ -11834,6 +11865,7 @@ var verifyNativeWorker = (verifier, input, binding) => {
     expectedWorkspaceRevision: expected.expectedWorkspaceRevision,
     state: expected.state,
     session: expected.session,
+    report: expected.report ?? null,
     provenance: result.data,
     ...binding
   });
@@ -11844,7 +11876,7 @@ var takeWorker = (token, binding, expected) => {
   verifiedWorkers.delete(token);
   if (!value)
     return null;
-  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session))
+  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session) || !sameValue(value.report, expected.report ?? null))
     return null;
   return value;
 };
@@ -11885,6 +11917,8 @@ var applyWorkerLifecycle = (input) => {
     return failure("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
     return failure("invalid_transition", "worker launch was not claimed");
+  if (input.report && input.state !== "stopped")
+    return failure("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
     return failure("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
@@ -11901,12 +11935,13 @@ var applyWorkerLifecycle = (input) => {
     data: {
       ...entry.data,
       state: terminalCancel ? "cancelling" : input.state,
-      session: input.session
+      session: input.session,
+      report: entry.data.report ?? input.report ?? null
     }
   };
   const shouldClear = input.state === "stopped" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
   const shouldUncertain = input.state === "unknown" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
-  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && !shouldClear && !shouldUncertain)
+  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && sameValue(entry.data.report, nextEntry.data.report) && !shouldClear && !shouldUncertain)
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
@@ -12324,14 +12359,30 @@ class WorkitCore {
         const listed = this.store.listTasks();
         if (!listed.ok)
           return listed;
-        const summaries = [];
-        for (const task of listed.data) {
-          const summary = this.summary(task);
-          if (!summary.ok)
-            return summary;
-          summaries.push(summary.data);
-        }
-        return success(null, null, summaries);
+        const status = input.status ?? "open";
+        const limit = input.limit ?? 20;
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        if (selected.length === 0)
+          return success(null, null, []);
+        const workspace = this.store.readWorkspace();
+        if (!workspace.ok)
+          return workspace;
+        if (!workspace.data)
+          return failure("not_found", "workspace not found");
+        const tasks = selected.map((task) => ({
+          id: task.id,
+          revision: task.revision,
+          workspaceRevision: workspace.data.revision,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          runtime: task.runtime ?? null,
+          objective: task.intent.data.objective,
+          status: task.status,
+          closure: task.closure,
+          progress: task.progress,
+          writer: task.status === "closed" ? null : workspace.data.writer
+        }));
+        return success(null, null, tasks);
       }
       case "inspect": {
         const task = this.store.readTask(input.taskId);
@@ -12340,7 +12391,7 @@ class WorkitCore {
         const helper = this.helperTaskGuard(task.data, true);
         if (!helper.ok)
           return helper;
-        if (input.view === "summary")
+        if ((input.view ?? "summary") === "summary")
           return this.summary(task.data);
         return this.view(task.data);
       }
@@ -12684,7 +12735,7 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return findingVerificationPasses(finding.data.candidateId, {
+        return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
           kind: entry.data.kind,
           candidateId: entry.data.candidateId,
           status: evaluation?.status ?? "missing"
@@ -12764,7 +12815,18 @@ class WorkitCore {
       if (task.data.status !== "active")
         return failure("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope");
+        return failure("permission_denied", "worker assignment is outside task scope", {
+          fields: [
+            {
+              path: "assignment.scope",
+              reason: `paths ${JSON.stringify(input.assignment.scope.paths)} must be contained by lead paths ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            },
+            {
+              path: "task.intent.scope",
+              reason: `lead paths are ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            }
+          ]
+        });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
         return failure("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
@@ -12971,7 +13033,15 @@ class WorkitCore {
             ...item,
             recordedAt: mutation.now,
             provenance: attested.data,
-            data: { ...item.data, state: "dispatching" }
+            data: {
+              ...item.data,
+              state: "dispatching",
+              coordinator: {
+                kind: "host",
+                host: this.context.caller.host,
+                handle: this.context.caller.actor
+              }
+            }
           } : item)
         });
       }
@@ -13047,6 +13117,7 @@ class WorkitCore {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         state: "stopped",
         session: null,
+        report: null,
         provenance: attested.data,
         owner: this.authorityOwner,
         store: this.store,
@@ -13354,10 +13425,12 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -13371,7 +13444,7 @@ class WorkitCore {
       progress: task.progress,
       policy: task.policy,
       requirements,
-      writer: workspace.data.writer
+      writer: evaluationWorkspace.writer
     });
   }
   view(task) {
@@ -13380,13 +13453,15 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       task,
-      workspace: workspace.data,
+      workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
       evidence: evaluateEvidence(task, current.data)
@@ -13477,8 +13552,6 @@ class WorkitCore {
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
       return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
-    if (status === "active" && input.authorityRefs.length === 0)
-      return failure("permission_denied", "resuming a task requires authority references");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -13508,7 +13581,7 @@ class WorkitCore {
         return failure("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
         return failure("recovery_required", "imported task requires resume reconciliation");
-      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs, this.context))
+      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
@@ -13638,7 +13711,7 @@ class WorkitCore {
       task: (value, context) => success(context.revision, null, {
         ...value,
         status: "closed",
-        candidates: value.candidates.some((item) => item.id === withCandidate.id) ? value.candidates : [...value.candidates, withCandidate],
+        candidates: taskForView.candidates,
         closure: {
           outcome: closure.data.outcome,
           at: context.now,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, and fourteen method skills",
   "keywords": [
@@ -38,8 +38,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.1.1",
-    "@brainervirus/workit-mcp": "^1.1.1"
+    "@brainervirus/workit-core": "^1.2.1",
+    "@brainervirus/workit-mcp": "^1.2.1"
   },
   "engines": {
     "node": ">=24"