@brainervirus/workit-opencode 1.2.0 → 1.2.1

package/dist/plugin.js

@@ -7965,6 +7965,7 @@ var workerSchema = object({
   assignment: assignmentSchema,
   state: _enum(["assigned", "dispatching", "running", "cancelling", "stopped", "unknown"]),
   session: refSchema.nullable(),
+  coordinator: refSchema.optional(),
   report: workerReportSchema.nullable()
 }).strict();
 var ownerSchema = object({
@@ -8076,6 +8077,7 @@ var taskSummarySchema = object({
   requirements: array(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
 var exportBundleSchema = object({
   schemaVersion: literal(1),
   exportedAt: utc,
@@ -8097,11 +8099,15 @@ var taskOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     intent: intentSchema
   }),
-  list: operation({ action: literal("list") }),
+  list: operation({
+    action: literal("list"),
+    status: _enum(["open", "closed", "all"]).optional(),
+    limit: number2().int().min(1).max(50).optional()
+  }),
   inspect: operation({
     action: literal("inspect"),
     ...taskId,
-    view: _enum(["summary", "full"])
+    view: _enum(["summary", "full"]).optional()
   }),
   revise: operation({
     action: literal("revise"),
@@ -8129,7 +8135,7 @@ var taskOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    authorityRefs: array(refSchema)
+    authorityRefs: array(refSchema).optional()
   }),
   close: operation({
     action: literal("close"),
@@ -9962,6 +9968,10 @@ var validPath = (value) => typeof value === "string" && value.length > 0 && ![..
 }) && !value.split(/[\\/]/).includes("..");
 var callerValue = (value) => ({ host: value.host, actor: value.actor });
 var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
     return failure("invalid_input", "invalid product write path");
@@ -11144,9 +11154,11 @@ var standingReceiptFor = (root, workspace, cls, dir) => {
 var verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
-  const session = task.intent?.provenance?.session;
-  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
-    return failure("permission_denied", "standing approval requires the lead session");
+  const workspace = new TaskStore(root).readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
+    return failure("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
     return failure("invalid_input", "standing approval needs a workspace and class");
@@ -11194,14 +11206,14 @@ var standingAutoApplies = (store, host, actor, operation) => {
   const workspace = store.readWorkspace();
   if (!listed.ok || !workspace.ok || !workspace.data)
     return null;
-  const matches = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data.id && task.intent?.provenance?.session?.kind === "host" && task.intent.provenance.session.host === host && task.intent.provenance.session.handle === actor);
-  if (matches.length !== 1)
+  const task = listed.data.find((task) => currentWriterOwnsTask(task, workspace.data, { host, actor }));
+  if (!task)
     return null;
   const resolved = resolveAutoApproval(store.root);
   if (resolved.status !== "on")
     return null;
   return {
-    task: matches[0],
+    task,
     workspaceId: workspace.data.id,
     workspaceRevision: workspace.data.revision,
     cls,
@@ -11460,6 +11472,20 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
 };
 var verifyContentRefs = (store, binding) => verifyDecisionContentAtRoot(store.root, binding);
 var storedDecisionApplicable = (store, task, purpose, binding) => task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && verifyDecisionContentAtRoot(store.root, entry.data.binding).ok);
+var approvalAuthorityMatches = (store, task, approval, current) => {
+  if (approval.kind !== "host_observed" || approval.receipts.length === 0)
+    return false;
+  if (provenanceMatches(approval, current))
+    return true;
+  const session = current.kind === "host_observed" ? current.session : null;
+  if (!session || session.kind !== "host")
+    return false;
+  const workspace = store.readWorkspace();
+  return workspace.ok && workspace.data !== null && currentWriterOwnsTask(task, workspace.data, {
+    host: session.host,
+    actor: session.handle
+  });
+};
 var validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
@@ -11485,7 +11511,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
     return failure("permission_denied", "decision was rejected");
-  if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
+  if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
@@ -11652,7 +11678,7 @@ function settleAction(input) {
       return failure("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
       return failure("permission_denied", "native settlement authority does not match decision");
-    if (!provenanceMatches(entry.provenance, authority.provenance))
+    if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
       return failure("permission_denied", "decision binding is invalid");
@@ -11751,7 +11777,7 @@ function reconcileAction(input) {
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
       return failure("not_found", "decision not found");
-    if (!authorityDecisionMatches(authority, entry.data) || !provenanceMatches(entry.provenance, authority.provenance))
+    if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
       return failure("permission_denied", "reconciliation decision binding is invalid");
@@ -12088,7 +12114,7 @@ var resolveBinding = (evidence, pin, currentCandidateId) => {
     candidateId: evidence.candidateId ?? fallback
   };
 };
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
@@ -12558,6 +12584,11 @@ function shouldDenyShellRoute(dir, command) {
 }
 // packages/workit-core/src/core/external-action.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
 var externalActionSchema = discriminatedUnion("operation", [
   object({
     operation: literal("git.branch_setup"),
@@ -12572,7 +12603,7 @@ var externalActionSchema = discriminatedUnion("operation", [
     operation: literal("git.commit"),
     payload: object({
       message: string2().min(1).optional(),
-      plan_steps: array(string2().min(1)).optional(),
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
       plan_branch: string2().min(1).optional()
     }).strict()
   }).strict(),
@@ -12676,7 +12707,7 @@ var planReservationLength = (operation, descriptorPayload) => {
   const payload = descriptorPayload ?? {};
   return Array.isArray(payload.plan_steps) ? payload.plan_steps.length : null;
 };
-var externalActionHelp = "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
+var externalActionHelp = "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message?; plan_steps?: (string | {branch:string} | {pr:true})[]; plan_branch?}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind: git|pr|youtrack|github_issue|gitlab_issue|changelog|release|affected,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
 var externalActionRef = (host, actor, descriptor) => ({
   kind: "host",
   host,
@@ -12690,12 +12721,12 @@ var externalActionState = (store, host, actor, operation) => {
   if (!workspace.data)
     return failure("not_found", "workspace not found");
   const candidates = listed.data.flatMap((task) => {
-    if (task.status !== "active" || task.workspaceId !== workspace.data.id || task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
+    if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
     return task.decisions.filter((entry) => entry.data.purpose === "action" && entry.data.response === "approved" && entry.data.revoked === null && entry.data.binding.approvedContent === operation).map((entry) => ({ task, entry }));
   });
   if (candidates.length !== 1)
-    return failure("permission_denied", candidates.length === 0 ? "no approved action is bound to this session" : "multiple approved actions match this session");
+    return failure("permission_denied", candidates.length === 0 ? "no approved action is bound to the active task" : "multiple approved actions match the active task");
   return success(workspace.data.revision, null, { ...candidates[0], workspace: workspace.data });
 };
 var priorExternalAction = (store, host, actor, operation, payload) => {
@@ -12775,8 +12806,6 @@ var approvedPlanCommit = (store, host, actor, message) => {
   const matches = listed.data.flatMap((task) => {
     if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
-    if (task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
-      return [];
     return task.decisions.flatMap((entry) => {
       const decision = entry.data;
       if (decision.purpose !== "action" || decision.response !== "approved" || decision.revoked !== null)
@@ -12818,8 +12847,6 @@ var approvedChainStep = (store, host, actor, query) => {
   const matches = listed.data.flatMap((task) => {
     if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
-    if (task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
-      return [];
     return task.decisions.flatMap((entry) => {
       const decision = entry.data;
       if (decision.purpose !== "action" || decision.response !== "approved" || decision.revoked !== null)
@@ -12976,7 +13003,7 @@ var branchSetupIntent = (descriptor) => {
 var approvedBranchSetupIntent = (store, host, actor, operation) => {
   const current = branchSetupIntent(operation);
   if (!current)
-    return failure("permission_denied", "no approved action is bound to this session");
+    return failure("permission_denied", "no approved action is bound to the active task");
   const listed = store.listTasks();
   const workspace = store.readWorkspace();
   if (!listed.ok || !workspace.ok)
@@ -12984,7 +13011,7 @@ var approvedBranchSetupIntent = (store, host, actor, operation) => {
   if (!workspace.data)
     return failure("not_found", "workspace not found");
   const candidates = listed.data.flatMap((task) => {
-    if (task.status !== "active" || task.workspaceId !== workspace.data.id || task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
+    if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
     return task.decisions.filter((entry) => entry.data.purpose === "action" && entry.data.response === "approved" && entry.data.revoked === null).map((entry) => ({ task, entry }));
   });
@@ -12993,7 +13020,7 @@ var approvedBranchSetupIntent = (store, host, actor, operation) => {
     return intent !== null && intent.target === current.target && intent.base === current.base && intent.remoteBase === current.remoteBase && intent.targetExists === current.targetExists;
   });
   if (matches.length !== 1)
-    return failure("permission_denied", matches.length === 0 ? "no approved action is bound to this session" : "multiple approved actions match this session");
+    return failure("permission_denied", matches.length === 0 ? "no approved action is bound to the active task" : "multiple approved actions match the active task");
   return success(workspace.data.revision, null, { ...matches[0], workspace: workspace.data });
 };
 var priorResolvedDrift = (store, host, actor, operation, payload, currentResolved) => {
@@ -13550,6 +13577,7 @@ var verifyNativeWorker = (verifier, input, binding) => {
     expectedWorkspaceRevision: expected.expectedWorkspaceRevision,
     state: expected.state,
     session: expected.session,
+    report: expected.report ?? null,
     provenance: result.data,
     ...binding
   });
@@ -13560,7 +13588,7 @@ var takeWorker = (token, binding, expected) => {
   verifiedWorkers.delete(token);
   if (!value)
     return null;
-  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session))
+  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session) || !sameValue(value.report, expected.report ?? null))
     return null;
   return value;
 };
@@ -13601,6 +13629,8 @@ var applyWorkerLifecycle = (input) => {
     return failure("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
     return failure("invalid_transition", "worker launch was not claimed");
+  if (input.report && input.state !== "stopped")
+    return failure("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
     return failure("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
@@ -13617,12 +13647,13 @@ var applyWorkerLifecycle = (input) => {
     data: {
       ...entry.data,
       state: terminalCancel ? "cancelling" : input.state,
-      session: input.session
+      session: input.session,
+      report: entry.data.report ?? input.report ?? null
     }
   };
   const shouldClear = input.state === "stopped" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
   const shouldUncertain = input.state === "unknown" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
-  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && !shouldClear && !shouldUncertain)
+  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && sameValue(entry.data.report, nextEntry.data.report) && !shouldClear && !shouldUncertain)
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
@@ -14040,14 +14071,30 @@ class WorkitCore {
         const listed = this.store.listTasks();
         if (!listed.ok)
           return listed;
-        const summaries = [];
-        for (const task of listed.data) {
-          const summary = this.summary(task);
-          if (!summary.ok)
-            return summary;
-          summaries.push(summary.data);
-        }
-        return success(null, null, summaries);
+        const status = input.status ?? "open";
+        const limit = input.limit ?? 20;
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        if (selected.length === 0)
+          return success(null, null, []);
+        const workspace = this.store.readWorkspace();
+        if (!workspace.ok)
+          return workspace;
+        if (!workspace.data)
+          return failure("not_found", "workspace not found");
+        const tasks = selected.map((task) => ({
+          id: task.id,
+          revision: task.revision,
+          workspaceRevision: workspace.data.revision,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          runtime: task.runtime ?? null,
+          objective: task.intent.data.objective,
+          status: task.status,
+          closure: task.closure,
+          progress: task.progress,
+          writer: task.status === "closed" ? null : workspace.data.writer
+        }));
+        return success(null, null, tasks);
       }
       case "inspect": {
         const task = this.store.readTask(input.taskId);
@@ -14056,7 +14103,7 @@ class WorkitCore {
         const helper = this.helperTaskGuard(task.data, true);
         if (!helper.ok)
           return helper;
-        if (input.view === "summary")
+        if ((input.view ?? "summary") === "summary")
           return this.summary(task.data);
         return this.view(task.data);
       }
@@ -14400,7 +14447,7 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return findingVerificationPasses(finding.data.candidateId, {
+        return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
           kind: entry.data.kind,
           candidateId: entry.data.candidateId,
           status: evaluation?.status ?? "missing"
@@ -14480,7 +14527,18 @@ class WorkitCore {
       if (task.data.status !== "active")
         return failure("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope");
+        return failure("permission_denied", "worker assignment is outside task scope", {
+          fields: [
+            {
+              path: "assignment.scope",
+              reason: `paths ${JSON.stringify(input.assignment.scope.paths)} must be contained by lead paths ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            },
+            {
+              path: "task.intent.scope",
+              reason: `lead paths are ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            }
+          ]
+        });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
         return failure("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
@@ -14687,7 +14745,15 @@ class WorkitCore {
             ...item,
             recordedAt: mutation.now,
             provenance: attested.data,
-            data: { ...item.data, state: "dispatching" }
+            data: {
+              ...item.data,
+              state: "dispatching",
+              coordinator: {
+                kind: "host",
+                host: this.context.caller.host,
+                handle: this.context.caller.actor
+              }
+            }
           } : item)
         });
       }
@@ -14763,6 +14829,7 @@ class WorkitCore {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         state: "stopped",
         session: null,
+        report: null,
         provenance: attested.data,
         owner: this.authorityOwner,
         store: this.store,
@@ -15070,10 +15137,12 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -15087,7 +15156,7 @@ class WorkitCore {
       progress: task.progress,
       policy: task.policy,
       requirements,
-      writer: workspace.data.writer
+      writer: evaluationWorkspace.writer
     });
   }
   view(task) {
@@ -15096,13 +15165,15 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       task,
-      workspace: workspace.data,
+      workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
       evidence: evaluateEvidence(task, current.data)
@@ -15193,8 +15264,6 @@ class WorkitCore {
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
       return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
-    if (status === "active" && input.authorityRefs.length === 0)
-      return failure("permission_denied", "resuming a task requires authority references");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -15224,7 +15293,7 @@ class WorkitCore {
         return failure("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
         return failure("recovery_required", "imported task requires resume reconciliation");
-      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs, this.context))
+      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
@@ -15354,7 +15423,7 @@ class WorkitCore {
       task: (value, context) => success(context.revision, null, {
         ...value,
         status: "closed",
-        candidates: value.candidates.some((item) => item.id === withCandidate.id) ? value.candidates : [...value.candidates, withCandidate],
+        candidates: taskForView.candidates,
         closure: {
           outcome: closure.data.outcome,
           at: context.now,
@@ -15731,31 +15800,25 @@ var packageRoot2 = () => {
 var assetsRoot = () => path13.join(packageRoot2(), "assets");
 
 // packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync5 } from "node:fs";
 import path14 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-var packageFiles = [
-  "src/index.ts",
-  "src/plugin.ts",
-  "src/v1/server.ts",
-  "src/v2/plugin.ts",
-  "src/shared/tools.ts",
-  "src/tools/workit.ts"
-].map((file) => path14.join(packageRoot2(), file));
-var coreDir = path14.join(packageRoot2(), "..", "workit-core", "src", "core");
+var typescriptFiles = (directory) => {
+  if (!existsSync8(directory))
+    return [];
+  return readdirSync5(directory, { withFileTypes: true }).flatMap((entry) => {
+    const file = path14.join(directory, entry.name);
+    return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
+  });
+};
 var pluginSourceFiles = [
-  fileURLToPath3(import.meta.url),
-  ...packageFiles,
-  ...[
-    "task-contract.ts",
-    "task-engine.ts",
-    "task-evaluation.ts",
-    "task-store.ts",
-    "workers.ts",
-    "authority.ts",
-    "methods.ts"
-  ].map((file) => path14.join(coreDir, file))
-].filter((file) => existsSync8(file));
+  ...new Set([
+    fileURLToPath3(import.meta.url),
+    ...typescriptFiles(path14.join(packageRoot2(), "src")),
+    path14.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path14.join(packageRoot2(), "..", "workit-core", "src", "core"))
+  ])
+].filter((file) => existsSync8(file)).sort();
 
 // packages/workit-opencode/src/tools/repo.ts
 import { realpathSync as realpathSync9 } from "node:fs";
@@ -28471,7 +28534,7 @@ function parseVerifyOutput(stdout) {
 
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync5 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync6 } from "node:fs";
 import path16 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
@@ -28586,7 +28649,7 @@ var printSection = (title) => `
 `;
 var probeCaseInsensitive = (dir, wanted) => {
   try {
-    for (const entry of readdirSync5(dir)) {
+    for (const entry of readdirSync6(dir)) {
       if (entry.toLowerCase() === wanted.toLowerCase())
         return entry;
     }
@@ -28655,7 +28718,7 @@ var documentationFiles = (cwd) => {
       return;
     let entries;
     try {
-      entries = readdirSync5(dir, { withFileTypes: true });
+      entries = readdirSync6(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -29488,7 +29551,7 @@ import {
   mkdirSync as mkdirSync5,
   mkdtempSync,
   readFileSync as readFileSync12,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync7,
   realpathSync as realpathSync8,
   renameSync as renameSync2,
   rmSync,
@@ -31754,7 +31817,7 @@ var readExternalContext = async (root, payload) => {
     }
   }
 };
-var localAction = (operation) => operation === "git.branch_setup" || operation === "git.commit" || operation === "git.push" || operation === "hosting.pull_request" || operation === "changelog.apply";
+var localAction = (operation) => operation === "git.branch_setup" || operation === "git.commit" || operation === "git.push" || operation === "hosting.pull_request" || operation === "hosting.merge" || operation === "changelog.apply";
 var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
   const store = new TaskStore(root);
   const listed = store.listTasks();
@@ -31765,7 +31828,7 @@ var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
     return workspace;
   if (!workspace.data)
     return failure("not_found", "workspace not found");
-  const candidates = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === caller.host && task.intent.provenance.session.handle === caller.actor);
+  const candidates = listed.data.filter((task) => currentWriterOwnsTask(task, workspace.data, caller));
   if (candidates.length !== 1)
     return failure("permission_denied", "local external action requires exactly one active task");
   const allowed = assertProductWriteAllowed({
@@ -31775,7 +31838,7 @@ var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
     paths,
     store
   });
-  return allowed.ok ? success(null, null, null) : allowed;
+  return allowed;
 };
 var safePath = (root, value) => {
   try {
@@ -31787,13 +31850,20 @@ var safePath = (root, value) => {
 var branchCreationBaseline = (root, target, base) => {
   const exists = gitValue(root, ["rev-parse", "--verify", "--quiet", `refs/heads/${target}`]) !== null;
   if (exists)
-    return { base_branch: base, target_exists: true, remote_base: null };
+    return {
+      base_branch: base,
+      target_exists: true,
+      remote_base: null,
+      target_head: gitValue(root, ["rev-parse", `refs/heads/${target}`])
+    };
   const remote = run4(root, ["ls-remote", "origin", `refs/heads/${base}`]);
   const sha = remote.exitCode === 0 ? remote.stdout.trim().split(/\s+/)[0] : "";
+  const remoteBase = /^[0-9a-f]{40}$/.test(sha ?? "") ? sha : null;
   return {
     base_branch: base,
     target_exists: false,
-    remote_base: /^[0-9a-f]{40}$/.test(sha ?? "") ? sha : null
+    remote_base: remoteBase,
+    target_head: remoteBase
   };
 };
 var shortSha = (value) => typeof value === "string" && value ? value.slice(0, 8) : "unknown";
@@ -31904,7 +31974,7 @@ var actionProposalQuestion = (request, descriptorPayload) => {
 var approvedResolvedExternalAction = (content) => {
   try {
     const value = JSON.parse(content);
-    if (value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && value.operation !== "youtrack.update" && value.operation !== "youtrack.time" && value.operation !== "youtrack.meeting")
+    if (value.operation !== "git.branch_setup" && value.operation !== "git.commit" && value.operation !== "git.push" && value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && value.operation !== "youtrack.update" && value.operation !== "youtrack.time" && value.operation !== "youtrack.meeting")
       return failure("invalid_input", "approved action is not a reconciliable external action");
     if (!value.payload || typeof value.payload !== "object")
       return failure("invalid_input", "approved action payload is incomplete");
@@ -31915,18 +31985,24 @@ var approvedResolvedExternalAction = (content) => {
     if (!request.ok || !resolved || typeof resolved !== "object")
       return failure("invalid_input", "approved hosting target is incomplete");
     const target = resolved;
+    if (value.operation === "git.commit" && (typeof target.head !== "string" || typeof target.staged !== "string" || typeof payload.message !== "string"))
+      return failure("invalid_input", "approved Git commit target is incomplete");
+    if (value.operation === "git.push" && (typeof target.branch !== "string" || typeof target.commit !== "string" || typeof target.remote !== "string"))
+      return failure("invalid_input", "approved Git push target is incomplete");
+    if (value.operation === "git.branch_setup" && (typeof target.head !== "string" || (payload.action === "reapply_stash" ? typeof target.stash_commit !== "string" : typeof payload.target_branch !== "string" || typeof target.target_head !== "string")))
+      return failure("invalid_input", "approved Git branch target is incomplete");
     if (value.operation === "hosting.pull_request" && (typeof target.marker !== "string" || typeof target.source_branch !== "string" || typeof target.source_commit !== "string" || typeof target.remote !== "string" || typeof payload.target_branch !== "string"))
       return failure("invalid_input", "approved hosting target is incomplete");
     if (value.operation === "hosting.merge" && (typeof target.marker !== "string" || typeof target.source_branch !== "string" || typeof target.source_commit !== "string" || typeof target.remote !== "string" || typeof payload.target_branch !== "string"))
       return failure("invalid_input", "approved hosting target is incomplete");
     if (value.operation === "changelog.apply" && (typeof target.target !== "string" || typeof target.beforeDigest !== "string" || typeof target.beforeExists !== "boolean" || typeof target.afterDigest !== "string"))
       return failure("invalid_input", "approved changelog target is incomplete");
-    if (value.operation !== "hosting.pull_request" && value.operation !== "changelog.apply" && (typeof target.marker !== "string" || typeof target.baseUrl !== "string" || typeof target.issueId !== "string" || !Array.isArray(target.steps)))
+    if (value.operation !== "git.branch_setup" && value.operation !== "git.commit" && value.operation !== "git.push" && value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && (typeof target.marker !== "string" || typeof target.baseUrl !== "string" || typeof target.issueId !== "string" || !Array.isArray(target.steps)))
       return failure("invalid_input", "approved YouTrack target is incomplete");
     return success(null, null, {
       request: request.data,
       descriptorPayload: value.payload,
-      marker: String(target.marker)
+      ...typeof target.marker === "string" ? { marker: target.marker } : {}
     });
   } catch {
     return failure("invalid_input", "approved action descriptor is invalid");
@@ -31952,12 +32028,13 @@ var unknownHostingEvidence = (operation) => failure("external_outcome_unknown",
   outcome: "unknown"
 });
 var readHostingAction = async (root, resolved, actionRef) => {
-  if (resolved.request.operation !== "hosting.pull_request" || !resolved.marker)
-    return unknownHostingEvidence("hosting.pull_request");
+  const operation = resolved.request.operation;
+  if (operation !== "hosting.pull_request" && operation !== "hosting.merge" || !resolved.marker)
+    return unknownHostingEvidence(operation);
   try {
     const cfg = vcsConfig("load", root);
     if (!cfg.ok || !cfg.tokenPath || !cfg.provider || cfg.provider !== "github" && cfg.provider !== "gitlab")
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const remote = pushRemote(root);
     const repo = remote ? remoteRepo(remote) : null;
     const approved = resolved.descriptorPayload;
@@ -31976,7 +32053,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       }
     })();
     if (!repo || typeof branch !== "string" || typeof target !== "string" || typeof sourceCommit !== "string" || typeof approvedRemote !== "string" || !currentIdentity || currentIdentity !== approvedIdentity || repo !== remoteRepo(approvedRemote) || remoteProvider2(approvedRemote) !== null && remoteProvider2(approvedRemote) !== cfg.provider || remoteParts(approvedRemote)?.host !== apiHost)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const token = fs13.readFileSync(cfg.tokenPath, "utf8").trim();
     const headers = { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json" };
     const url = cfg.provider === "github" ? `https://api.github.com/repos/${repo}/pulls?state=all&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&base=${encodeURIComponent(target)}&per_page=100&page=1` : `${cfg.gitlab?.apiUrl ?? "https://gitlab.com/api/v4"}/projects/${encodeURIComponent(repo)}/merge_requests?state=all&source_branch=${encodeURIComponent(branch)}&target_branch=${encodeURIComponent(target)}&per_page=100&page=1`;
@@ -31984,14 +32061,14 @@ var readHostingAction = async (root, resolved, actionRef) => {
       headers: cfg.provider === "gitlab" ? { "PRIVATE-TOKEN": token } : headers
     });
     if (!response.ok)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const values = await response.json();
     if (!Array.isArray(values) || values.length >= 100)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const records = [];
     for (const item of values) {
       if (!item || typeof item !== "object" || Array.isArray(item))
-        return unknownHostingEvidence("hosting.pull_request");
+        return unknownHostingEvidence(operation);
       const record = item;
       const body = record.body ?? record.description;
       const base = record.base;
@@ -32003,7 +32080,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       const shaValue = cfg.provider === "github" && githubShape ? head.sha : record.sha;
       const idValue = record.number ?? record.iid ?? record.id;
       if (body !== undefined && body !== null && typeof body !== "string" || (cfg.provider === "github" ? !githubShape : !gitlabShape) || typeof targetValue !== "string" || typeof sourceValue !== "string" || typeof shaValue !== "string" || typeof idValue !== "string" && typeof idValue !== "number")
-        return unknownHostingEvidence("hosting.pull_request");
+        return unknownHostingEvidence(operation);
       records.push(record);
     }
     const matches = records.filter((item) => {
@@ -32013,15 +32090,23 @@ var readHostingAction = async (root, resolved, actionRef) => {
       const itemTarget = cfg.provider === "github" ? base?.ref : item.target_branch;
       const itemSource = cfg.provider === "github" ? head?.ref : item.source_branch;
       const itemSha = cfg.provider === "github" ? head?.sha : item.sha;
-      return body.includes(resolved.marker) && itemTarget === target && itemSource === branch && itemSha === sourceCommit;
+      const merged = cfg.provider === "github" ? typeof item.merged_at === "string" : item.state === "merged" || typeof item.merged_at === "string";
+      return (operation === "hosting.merge" ? merged : body.includes(resolved.marker)) && itemTarget === target && itemSource === branch && itemSha === sourceCommit;
     });
+    if (operation === "hosting.merge" && records.some((item) => {
+      const base = item.base;
+      const head = item.head;
+      return (cfg.provider === "github" ? base?.ref : item.target_branch) === target && (cfg.provider === "github" ? head?.ref : item.source_branch) === branch && (cfg.provider === "github" ? typeof item.merged_at !== "string" : item.state !== "merged" && typeof item.merged_at !== "string");
+    }))
+      return unknownHostingEvidence(operation);
     if (matches.length !== 1)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const item = matches[0];
     const id = item.number ?? item.iid ?? item.id;
     if (typeof id !== "string" && typeof id !== "number")
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const evidenceDigest = sha256({
+      operation,
       provider: cfg.provider,
       id,
       marker: resolved.marker,
@@ -32042,7 +32127,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       data: { provider: cfg.provider, id }
     });
   } catch {
-    return unknownHostingEvidence("hosting.pull_request");
+    return unknownHostingEvidence(operation);
   }
 };
 var appendMarker = (text, marker) => `${text}${text ? `
@@ -32132,7 +32217,70 @@ var readYouTrackAction = async (root, resolved, actionRef) => {
     return unknownHostingEvidence(operation);
   }
 };
-var readExternalAction = async (root, resolved, actionRef) => resolved.request.operation === "hosting.pull_request" ? readHostingAction(root, resolved, actionRef) : readYouTrackAction(root, resolved, actionRef);
+var readLocalAction = async (root, resolved, actionRef) => {
+  const operation = resolved.request.operation;
+  const target = resolved.descriptorPayload.resolved;
+  if (!target)
+    return unknownHostingEvidence(operation);
+  let observed = null;
+  if (operation === "git.commit") {
+    const commit = gitValue(root, ["rev-parse", "HEAD"]);
+    const parent = commit ? gitValue(root, ["rev-parse", `${commit}^`]) : null;
+    const message = commit ? gitValue(root, ["show", "-s", "--format=%B", commit]) : null;
+    const diff = commit && parent ? gitRaw(root, ["diff", "--raw", "-z", "--no-ext-diff", "--no-textconv", parent, commit]) : null;
+    if (commit && parent === target.head && message === resolved.request.payload.message && diff !== null && sha256(diff) === target.staged)
+      observed = { commit, parent, message, staged: target.staged };
+  } else if (operation === "git.push") {
+    const branch = target.branch;
+    const commit = target.commit;
+    const approvedRemote = target.remote;
+    const currentRemote = pushRemote(root);
+    const currentIdentity = currentRemote ? credentialFreeRemote(currentRemote) : null;
+    if (typeof branch === "string" && typeof commit === "string" && typeof approvedRemote === "string" && currentIdentity === approvedRemote) {
+      const remote = run4(root, ["ls-remote", currentRemote, `refs/heads/${branch}`]);
+      const remoteCommit = remote.exitCode === 0 ? remote.stdout.trim().split(/\s+/)[0] : null;
+      if (remoteCommit === commit)
+        observed = { branch, commit, remote: approvedRemote };
+    }
+  } else if (operation === "git.branch_setup") {
+    const targetBranch = resolved.request.payload.target_branch;
+    const sdd = resolved.request.payload.sdd_dir;
+    if (resolved.request.payload.action === "reapply_stash" && typeof sdd === "string") {
+      try {
+        const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd, "manifest.json"), "utf8"));
+        const stashes = gitRaw(root, ["stash", "list", "--format=%H"]);
+        if (typeof target.stash_commit === "string" && manifest.stash_ref === undefined && stashes !== null && !stashes.split(`
+`).includes(target.stash_commit))
+          observed = { stash_commit: target.stash_commit };
+      } catch {}
+    } else if (typeof targetBranch === "string" && typeof sdd === "string" && gitValue(root, ["branch", "--show-current"]) === targetBranch && typeof target.target_head === "string" && gitValue(root, ["rev-parse", "HEAD"]) === target.target_head) {
+      try {
+        const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd, "manifest.json"), "utf8"));
+        if (manifest.branch === targetBranch)
+          observed = { branch: targetBranch };
+      } catch {}
+    }
+  } else if (operation === "changelog.apply") {
+    const afterDigest = target.afterDigest;
+    const preview = changelogApplyPreview({ ...resolved.request.payload, workspace_root: root });
+    if (!preview.error && typeof afterDigest === "string" && preview.beforeDigest === afterDigest)
+      observed = { target: target.target, afterDigest };
+  }
+  if (!observed)
+    return unknownHostingEvidence(operation);
+  const evidenceDigest = sha256({ operation, observed });
+  return success(null, null, {
+    outcome: "succeeded",
+    evidenceDigest,
+    observation: {
+      kind: "provider_read",
+      actionRef,
+      outcome: "succeeded",
+      evidenceDigest
+    }
+  });
+};
+var readExternalAction = async (root, resolved, actionRef) => resolved.request.operation === "git.branch_setup" || resolved.request.operation === "git.commit" || resolved.request.operation === "git.push" || resolved.request.operation === "changelog.apply" ? readLocalAction(root, resolved, actionRef) : resolved.request.operation === "hosting.pull_request" || resolved.request.operation === "hosting.merge" ? readHostingAction(root, resolved, actionRef) : readYouTrackAction(root, resolved, actionRef);
 var youTrackBase = () => {
   try {
     const config = JSON.parse(fs13.readFileSync(youTrackConfigPath(), "utf8"));
@@ -32190,6 +32338,16 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
           return failure("storage_error", "current Git commit could not be resolved");
         const dirty = Boolean((gitRaw(root, ["status", "--short"]) ?? "").trim());
         const creation = action === "reapply_stash" || !target_branch ? { base_branch: policy.defaultTargetBranch } : branchCreationBaseline(root, target_branch, policy.defaultTargetBranch);
+        let stashTarget;
+        if (action === "reapply_stash") {
+          try {
+            const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd_dir, "manifest.json"), "utf8"));
+            const stash_ref = typeof manifest.stash_ref === "string" ? manifest.stash_ref : "";
+            const stash_commit = stash_ref ? gitValue(root, ["rev-parse", stash_ref]) : null;
+            if (stash_ref && stash_commit)
+              stashTarget = { stash_ref, stash_commit };
+          } catch {}
+        }
         const normalized = {
           operation: request.operation,
           payload: {
@@ -32204,7 +32362,7 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
           request: normalized,
           descriptorPayload: {
             ...normalized.payload,
-            resolved: { head, dirty, ...creation }
+            resolved: { head, dirty, ...creation, ...stashTarget }
           }
         });
       }
@@ -32356,7 +32514,7 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
             outcome: "not_started",
             fields: [{ path: "source_branch", reason: "protected branch" }]
           });
-        const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
+        const source_commit = source_branch ? gitValue(root, ["rev-parse", "--verify", `refs/heads/${source_branch}`]) : null;
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
         if (!source_branch || !source_commit || !identity || remoteProvider2(identity) !== null && remoteProvider2(identity) !== String(vcsConfig("load", root).provider).toLowerCase())
@@ -32644,7 +32802,17 @@ var executeResolvedExternalAction = async (resolved, root, step, caller) => {
   const workText = fresh.data.descriptorPayload.resolved?.workText;
   const beforeDigest = typeof resolvedDetails.resolved?.beforeDigest === "string" ? resolvedDetails.resolved.beforeDigest : undefined;
   const beforeExists = typeof resolvedDetails.resolved?.beforeExists === "boolean" ? resolvedDetails.resolved.beforeExists : undefined;
-  return executeConcreteExternalAction(fresh.data.request, root, fresh.data.marker, resolvedDate, step, typeof workText === "string" ? workText : undefined, caller, beforeDigest, beforeExists);
+  const result = await executeConcreteExternalAction(fresh.data.request, root, fresh.data.marker, resolvedDate, step, typeof workText === "string" ? workText : undefined, caller, beforeDigest, beforeExists);
+  if (!result.ok && result.code === "external_outcome_unknown" && caller) {
+    const observed = await readLocalAction(root, fresh.data, {
+      kind: "host",
+      host: caller.host,
+      handle: `local-recovery:${fresh.data.request.operation}`
+    });
+    if (observed.ok)
+      return success(null, null, { recovered: true });
+  }
+  return result;
 };
 
 // packages/workit-opencode/src/shared/session.ts
@@ -32702,6 +32870,7 @@ var purposeForQuestion = (question) => {
 class NativeReceiptStore {
   #receipts = new Map;
   #observations = new WeakSet;
+  #reservations = new WeakMap;
   #pending = new Map;
   #now;
   constructor(options = {}) {
@@ -32774,7 +32943,7 @@ class NativeReceiptStore {
     const args = input.args;
     this.mint(input.sessionID, input.callID, args?.questions, answers);
   }
-  consume(sessionID, purpose, expected = {}) {
+  reserve(sessionID, purpose, expected = {}) {
     const queue = this.#receipts.get(sessionID) ?? [];
     for (let i = queue.length - 1;i >= 0; i -= 1) {
       const receipt = queue[i];
@@ -32782,11 +32951,9 @@ class NativeReceiptStore {
         continue;
       if (expected.callID !== undefined && receipt.callID !== expected.callID || expected.selectedLabel !== undefined && normalizeReceiptLabel(receipt.selectedLabel) !== normalizeReceiptLabel(expected.selectedLabel) || expected.selectedDescription !== undefined && receipt.selectedDescription !== expected.selectedDescription || expected.decisionPurpose !== undefined && receipt.decisionPurpose !== expected.decisionPurpose || expected.contentDigest !== undefined && receipt.contentDigest !== expected.contentDigest || expected.question !== undefined && receipt.question !== expected.question)
         continue;
-      queue.splice(i, 1);
-      if (!queue.length)
-        this.#receipts.delete(sessionID);
       const observation = { receipt };
       this.#observations.add(observation);
+      this.#reservations.set(observation, receipt);
       return { ok: true, receipt, observation };
     }
     return {
@@ -32812,6 +32979,26 @@ class NativeReceiptStore {
       })()
     };
   }
+  commit(observation) {
+    const receipt = this.#reservations.get(observation);
+    this.#reservations.delete(observation);
+    if (!receipt)
+      return false;
+    const queue = this.#receipts.get(receipt.sessionID) ?? [];
+    const index = queue.indexOf(receipt);
+    if (index < 0)
+      return false;
+    queue.splice(index, 1);
+    if (!queue.length)
+      this.#receipts.delete(receipt.sessionID);
+    return true;
+  }
+  consume(sessionID, purpose, expected = {}) {
+    const reserved = this.reserve(sessionID, purpose, expected);
+    if (reserved.ok)
+      this.commit(reserved.observation);
+    return reserved;
+  }
   verify(observation, sessionID, purpose) {
     if (typeof observation !== "object" || observation === null || !this.#observations.has(observation))
       return null;
@@ -33054,6 +33241,10 @@ var nativeExternalActionRunner = (root, actor, core, step) => createAuthorizedEx
     settleObservation: (outcome, revisions) => nativeExternalActionObservation(actor, actionRef, outcome, actionRef.kind === "host" ? actionRef.handle : "external-action", revisions)
   };
 });
+var workerCoordinatorFor = (task, worker) => {
+  const coordinator = worker.data.coordinator ?? task.intent.provenance.session;
+  return coordinator?.kind === "host" && coordinator.host === "opencode" ? coordinator.handle : null;
+};
 var workerIdFor = (store, actor, current, directChildren) => {
   const parentID = sessionParent(current);
   if (!parentID)
@@ -33064,10 +33255,9 @@ var workerIdFor = (store, actor, current, directChildren) => {
   const matches = tasks.data.flatMap((task) => {
     if (task.status !== "active")
       return [];
-    const coordinator = task.intent.provenance.session;
-    if (coordinator?.kind !== "host" || coordinator.host !== "opencode" || coordinator.handle !== parentID || directChildren.get(actor) !== parentID)
+    if (directChildren.get(actor) !== parentID)
       return [];
-    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor);
+    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor && workerCoordinatorFor(task, worker) === parentID);
   });
   return matches.length === 1 ? matches[0].id : null;
 };
@@ -33127,10 +33317,11 @@ var createWorkitTools = ({
         };
         if (decision.response === "approved")
           expectation.selectedDescription = decision.binding.approvedContent;
-        const observed = receipts.consume(context.sessionID, "decision", expectation);
+        const observed = receipts.reserve(context.sessionID, "decision", expectation);
         if (!observed.ok)
           return output2(failure("permission_denied", observed.error));
         let recordInput = parsed.data;
+        let proposalToCommit;
         if (decision.purpose === "action" && decision.response === "approved") {
           const queue = actionProposals.get(context.sessionID) ?? [];
           const textMatches = queue.filter((pending) => pending.presented === decision.binding.presented && pending.approvedText === decision.binding.approvedContent);
@@ -33142,7 +33333,7 @@ var createWorkitTools = ({
             const fresh = resolveExternalActionRequest(context.directory, pending.request);
             const freshDescriptor = fresh.ok ? externalActionDescriptor(pending.request.operation, fresh.data.descriptorPayload) : null;
             if (freshDescriptor === pending.descriptor) {
-              actionProposals.set(context.sessionID, queue.filter((candidate) => candidate !== pending));
+              proposalToCommit = pending;
               recordInput = {
                 ...recordInput,
                 binding: {
@@ -33161,6 +33352,13 @@ var createWorkitTools = ({
           }
         }
         result = core.observeDecision(recordInput, observed.observation);
+        if (result.ok) {
+          receipts.commit(observed.observation);
+          if (proposalToCommit) {
+            const queue = actionProposals.get(context.sessionID) ?? [];
+            actionProposals.set(context.sessionID, queue.filter((candidate) => candidate !== proposalToCommit));
+          }
+        }
       } else {
         const run = core[family];
         result = run.call(core, parsed.data);
@@ -33216,7 +33414,7 @@ var createWorkitTools = ({
           return output2(failure("permission_denied", "child sessions cannot run external actions"));
         const store = new TaskStore(context.directory);
         const prior = priorExternalAction(store, "opencode", context.sessionID, resolved.data.request.operation, resolved.data.request.payload);
-        if (prior.ok && prior.data.entry.data.consumption !== null && prior.data.entry.data.consumption.state !== "uncertain")
+        if (prior.ok && prior.data.entry.data.consumption !== null && prior.data.entry.data.consumption.state !== "uncertain" && resolved.data.request.operation !== "git.commit" && resolved.data.request.operation !== "git.push")
           return output2(failure("permission_denied", "external action was already settled"));
         const reconciliationTokens = new WeakSet;
         const core = new WorkitCore(store, {
@@ -33519,10 +33717,10 @@ var plugin = async ({ client, directory }) => {
     const listed = store.listTasks();
     if (!workspace.ok || !workspace.data || !listed.ok)
       return "unmanaged";
-    const owned = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data?.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator);
-    if (owned.length === 0)
+    const managed = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data?.id && (task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator || task.workers.some((entry) => entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator) || workspace.data.writer?.owner.taskId === task.id && workspace.data.writer.owner.session.host === "opencode" && workspace.data.writer.owner.session.handle === coordinator));
+    if (managed.length === 0)
       return "unmanaged";
-    const eligible = owned.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
+    const eligible = managed.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
     const next = oldestOfSingleTask(eligible);
     if (!next)
       return "unbound";
@@ -33606,7 +33804,7 @@ var plugin = async ({ client, directory }) => {
       dispatches.delete(coordinator);
     return committed.ok;
   };
-  const observeLifecycle = async (sessionID, parentID, state, binding, initial = false, eventInfo) => {
+  const observeLifecycle = async (sessionID, parentID, state, binding, eventInfo, report) => {
     const store = new TaskStore(directory);
     const listed = store.listTasks();
     const workspace = store.readWorkspace();
@@ -33616,7 +33814,7 @@ var plugin = async ({ client, directory }) => {
     }
     const persisted = listed.data.flatMap((task) => task.status === "active" ? task.workers.filter((entry) => entry.id === binding?.workerId || entry.data.session?.kind === "host" && entry.data.session.handle === sessionID).map((entry) => ({ task, entry })) : []);
     const matches = persisted.filter(({ entry }) => entry.data.session?.kind === "host");
-    if (binding && !initial && matches.length !== 1) {
+    if (binding && matches.length !== 1) {
       droppedLifecycle(sessionID, "bound child worker handle is ambiguous");
       return;
     }
@@ -33625,7 +33823,7 @@ var plugin = async ({ client, directory }) => {
       droppedLifecycle(sessionID, binding ? "bound worker is missing from persisted state" : "worker session is ambiguous");
       return;
     }
-    if (!initial && selected.entry.data.session?.kind !== "host") {
+    if (selected.entry.data.session?.kind !== "host") {
       droppedLifecycle(sessionID, "selected worker has no bound host session");
       return;
     }
@@ -33633,25 +33831,26 @@ var plugin = async ({ client, directory }) => {
       droppedLifecycle(sessionID, "selected worker provenance is not host-observed");
       return;
     }
-    if (!binding) {
-      const coordinator = selected.task.intent.provenance.session;
-      if (coordinator?.kind !== "host" || coordinator.host !== "opencode") {
-        droppedLifecycle(sessionID, "coordinator session is not validated");
+    const observed = eventInfo ?? await sessionData2(client, sessionID);
+    if (binding && eventInfo) {
+      if (!deletedSessionEnd(directory, sessionID, parentID, observed)) {
+        droppedLifecycle(sessionID, "deleted session payload contradicts the binding");
         return;
       }
-      parentID = coordinator.handle;
+    } else if (!trustedSession(directory, sessionID, observed)) {
+      droppedLifecycle(sessionID, "live session observation is not trusted");
+      return;
     }
-    if (!initial) {
-      const observed = eventInfo ?? await sessionData2(client, sessionID);
-      if (binding && eventInfo) {
-        if (!deletedSessionEnd(directory, sessionID, parentID, observed)) {
-          droppedLifecycle(sessionID, "deleted session payload contradicts the binding");
-          return;
-        }
-      } else if (!trustedSession(directory, sessionID, observed) || observed.parentID !== parentID) {
-        droppedLifecycle(sessionID, "live session observation is not trusted");
+    if (!binding) {
+      const coordinator = workerCoordinatorFor(selected.task, selected.entry);
+      if (!coordinator || observed.parentID !== coordinator) {
+        droppedLifecycle(sessionID, "live session parent contradicts persisted coordinator");
         return;
       }
+      parentID = coordinator;
+    } else if (!eventInfo && observed.parentID !== parentID) {
+      droppedLifecycle(sessionID, "live session parent contradicts the binding");
+      return;
     }
     directChildren.set(sessionID, parentID);
     const core = new WorkitCore(store, {
@@ -33669,6 +33868,7 @@ var plugin = async ({ client, directory }) => {
       expectedWorkspaceRevision: workspace.data.revision,
       state,
       session: { kind: "host", host: "opencode", handle: sessionID },
+      ...report ? { report } : {},
       observation: { event: state, sessionID }
     });
     if (!result.ok) {
@@ -33684,25 +33884,9 @@ var plugin = async ({ client, directory }) => {
   const bindCreatedSession = async (info) => {
     if (typeof info.id !== "string" || typeof info.parentID !== "string" || !sameWorkspace(directory, info.directory))
       return;
-    const live = dispatches.get(info.parentID);
-    if (live)
-      live.generation.childCreated = true;
-    const store = new TaskStore(directory);
-    const workspace = store.readWorkspace();
-    const listed = store.listTasks();
-    if (!workspace.ok || !workspace.data || !listed.ok)
-      return;
-    const candidates = listed.data.flatMap((task) => task.status === "active" && task.workspaceId === workspace.data?.id ? task.workers.filter((entry) => (entry.data.state === "assigned" || entry.data.state === "dispatching") && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === info.parentID).map((entry) => ({ task, entry })) : []);
-    const next = oldestOfSingleTask(candidates);
-    if (!next)
-      return;
     directChildren.set(info.id, info.parentID);
-    if (live && live.taskId === next.task.id && live.workerId === next.entry.id && commitDispatchStart(info.parentID, info.id))
-      return;
-    await observeLifecycle(info.id, info.parentID, "running", {
-      taskId: next.task.id,
-      workerId: next.entry.id
-    }, true);
+    if (dispatches.has(info.parentID))
+      commitDispatchStart(info.parentID, info.id);
   };
   return {
     tool: tools,
@@ -33724,7 +33908,7 @@ var plugin = async ({ client, directory }) => {
         return;
       const binding = lifecycleBindings.get(sessionID);
       const state = event.type === "session.status" ? event.properties.status.type === "busy" ? "running" : event.properties.status.type === "idle" ? "stopped" : "unknown" : event.type === "session.idle" ? "stopped" : event.type === "session.deleted" ? "stopped" : "unknown";
-      await observeLifecycle(sessionID, binding?.parentID ?? "", state, binding, false, event.type === "session.deleted" ? properties.info : undefined);
+      await observeLifecycle(sessionID, binding?.parentID ?? "", state, binding, event.type === "session.deleted" ? properties.info : undefined);
     },
     "tool.execute.after": async (input, output) => {
       observeQuestion(receipts, input, output);
@@ -33750,7 +33934,12 @@ var plugin = async ({ client, directory }) => {
         if (completedChild) {
           const completionBinding = lifecycleBindings.get(completedChild);
           if (completionBinding)
-            await observeLifecycle(completedChild, input.sessionID, "stopped", completionBinding, false, undefined);
+            await observeLifecycle(completedChild, input.sessionID, "stopped", completionBinding, undefined, {
+              outcome: "completed",
+              summary: outputText.match(/<task_result>([\s\S]*?)<\/task_result>/)?.[1]?.trim() || outputText.trim() || "Native worker completed.",
+              evidenceIds: [],
+              findingIds: []
+            });
         } else if (!resolved && /(?:cancel|interrupt|unknown|uncertain)/.test(state))
           unresolvedTaskLaunches.add(input.sessionID);
       }
@@ -33992,6 +34181,7 @@ var createV2Lifecycle = (deps) => {
       return null;
     return session;
   };
+  const managedByCoordinator = (task, workspace, coordinator) => task.status === "active" && task.workspaceId === workspace.id && (task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator || task.workers.some((entry) => entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator) || workspace.writer?.owner.taskId === task.id && workspace.writer.owner.session.host === "opencode" && workspace.writer.owner.session.handle === coordinator);
   const ownsActiveTask = (coordinator) => {
     try {
       const store = new TaskStore(root);
@@ -33999,7 +34189,7 @@ var createV2Lifecycle = (deps) => {
       const listed = store.listTasks();
       if (!workspace.ok || !workspace.data || !listed.ok)
         return false;
-      return listed.data.some((task) => task.status === "active" && task.workspaceId === workspace.data?.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator);
+      return listed.data.some((task) => managedByCoordinator(task, workspace.data, coordinator));
     } catch {
       return false;
     }
@@ -34027,10 +34217,10 @@ var createV2Lifecycle = (deps) => {
     const listed = store.listTasks();
     if (!workspace.ok || !workspace.data || !listed.ok)
       return "unmanaged";
-    const owned = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data?.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator);
-    if (owned.length === 0)
+    const managed = listed.data.filter((task) => managedByCoordinator(task, workspace.data, coordinator));
+    if (managed.length === 0)
       return "unmanaged";
-    const eligible = owned.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
+    const eligible = managed.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
     const next = oldestOfSingleTask(eligible);
     if (!next)
       return "unbound";
@@ -34098,7 +34288,7 @@ var createV2Lifecycle = (deps) => {
     });
     return true;
   };
-  const observeLifecycle = async (sessionID, parentID, state, binding, initial = false, deleted = false) => {
+  const observeLifecycle = async (sessionID, parentID, state, binding, deleted = false, report) => {
     const store = new TaskStore(root);
     const listed = store.listTasks();
     const workspace = store.readWorkspace();
@@ -34106,24 +34296,28 @@ var createV2Lifecycle = (deps) => {
       return;
     const persisted = listed.data.flatMap((task) => task.status === "active" ? task.workers.filter((entry) => entry.id === binding?.workerId || entry.data.session?.kind === "host" && entry.data.session.handle === sessionID).map((entry) => ({ task, entry })) : []);
     const matches = persisted.filter(({ entry }) => entry.data.session?.kind === "host");
-    if (binding && !initial && matches.length !== 1)
+    if (binding && matches.length !== 1)
       return;
     const selected = binding ? persisted.find(({ task, entry }) => task.id === binding.taskId && entry.id === binding.workerId) : matches.length === 1 ? matches[0] : undefined;
     if (!selected)
       return;
-    if (!initial && selected.entry.data.session?.kind !== "host")
+    if (selected.entry.data.session?.kind !== "host")
       return;
     if (selected.entry.provenance.session?.kind !== "host")
       return;
-    if (!binding) {
-      const coordinator = selected.task.intent.provenance.session;
-      if (coordinator?.kind !== "host" || coordinator.host !== "opencode")
-        return;
-      parentID = coordinator.handle;
-    }
-    if (!initial && !deleted) {
+    if (!binding && deleted)
+      return;
+    if (!deleted) {
       const observed = await readSession(sessionID);
-      if (!observed || !sameWorkspace(root, observed.directory) || parentOf(observed) !== parentID)
+      const observedParent = parentOf(observed);
+      if (!observed || !sameWorkspace(root, observed.directory) || !observedParent)
+        return;
+      if (!binding) {
+        const coordinator = workerCoordinatorFor(selected.task, selected.entry);
+        if (!coordinator || observedParent !== coordinator)
+          return;
+        parentID = coordinator;
+      } else if (observedParent !== parentID)
         return;
     }
     directChildren.set(sessionID, parentID);
@@ -34142,6 +34336,7 @@ var createV2Lifecycle = (deps) => {
       expectedWorkspaceRevision: workspace.data.revision,
       state,
       session: { kind: "host", host: "opencode", handle: sessionID },
+      ...report ? { report } : {},
       observation: { event: state, sessionID }
     });
     if (!result.ok)
@@ -34188,6 +34383,10 @@ var createV2Lifecycle = (deps) => {
       const child = childID ? await readSession(childID) : null;
       if (!child || parentOf(child) !== coordinator)
         throw new Error("delegation_lineage_denied: a continuation sessionID must name an existing direct child of the coordinator");
+      const listed = new TaskStore(root).listTasks();
+      const bound = listed.ok ? listed.data.filter((task) => task.workers.some((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator)).length : 0;
+      if (bound !== 1 && ownsActiveTask(coordinator))
+        throw new Error("delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
       return;
     }
     if (!ownsActiveTask(coordinator)) {
@@ -34248,7 +34447,12 @@ var createV2Lifecycle = (deps) => {
       if (completedChild) {
         const binding = lifecycleBindings.get(completedChild);
         if (binding)
-          await observeLifecycle(completedChild, coordinator, "stopped", binding);
+          await observeLifecycle(completedChild, coordinator, "stopped", binding, false, {
+            outcome: "completed",
+            summary: output.trim() || "Native worker completed.",
+            evidenceIds: [],
+            findingIds: []
+          });
       }
     } else {
       const message = String(event.error?.message ?? event.error ?? "").toLowerCase();
@@ -34266,24 +34470,12 @@ var createV2Lifecycle = (deps) => {
   const bindCreatedSession = async (data) => {
     if (!sameWorkspace(root, data.directory))
       return;
+    directChildren.set(data.sessionID, data.parentID);
     const live = dispatches.get(data.parentID);
     if (live) {
-      live.generation.childCreated = true;
       live.childID = data.sessionID;
+      commitDispatchStart(data.parentID, data.sessionID);
     }
-    const store = new TaskStore(root);
-    const workspace = store.readWorkspace();
-    const listed = store.listTasks();
-    if (!workspace.ok || !workspace.data || !listed.ok)
-      return;
-    const candidates = listed.data.flatMap((task) => task.status === "active" && task.workspaceId === workspace.data?.id ? task.workers.filter((entry) => (entry.data.state === "assigned" || entry.data.state === "dispatching") && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === data.parentID).map((entry) => ({ task, entry })) : []);
-    const next = oldestOfSingleTask(candidates);
-    if (!next)
-      return;
-    directChildren.set(data.sessionID, data.parentID);
-    if (live && live.taskId === next.task.id && live.workerId === next.entry.id && commitDispatchStart(data.parentID, data.sessionID))
-      return;
-    await observeLifecycle(data.sessionID, data.parentID, "running", { taskId: next.task.id, workerId: next.entry.id }, true);
   };
   const handleEvent = async (event) => {
     const type = event.type;
@@ -34310,7 +34502,7 @@ var createV2Lifecycle = (deps) => {
       const directory = event.location?.directory;
       if (typeof directory === "string" && !sameWorkspace(root, directory))
         return;
-      await observeLifecycle(sessionID, binding?.parentID ?? "", "stopped", binding, false, true);
+      await observeLifecycle(sessionID, binding?.parentID ?? "", "stopped", binding, true);
       return;
     }
     const state = type === "session.execution.started" ? "running" : "stopped";
@@ -34391,13 +34583,13 @@ var normalizeQuestionAnswers = (answers) => {
     }
     if (first && typeof first === "object") {
       const values = Object.values(first);
-      if (values.length > 0 && values.every((entry) => singleValue(entry) !== null))
+      if (values.length === 1 && singleValue(values[0]) !== null)
         return [[singleValue(values[0])]];
     }
     return answers;
   }
   const values = Object.values(answers);
-  if (values.length > 0 && values.every((entry) => singleValue(entry) !== null))
+  if (values.length === 1 && singleValue(values[0]) !== null)
     return [[singleValue(values[0])]];
   return answers;
 };
@@ -34528,10 +34720,9 @@ var workerIdFor2 = (store, actor, parentID, directChildren) => {
   const matches = tasks.data.flatMap((task) => {
     if (task.status !== "active")
       return [];
-    const coordinator = task.intent.provenance.session;
-    if (coordinator?.kind !== "host" || coordinator.host !== "opencode" || coordinator.handle !== parentID || directChildren.get(actor) !== parentID)
+    if (directChildren.get(actor) !== parentID)
       return [];
-    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor);
+    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor && workerCoordinatorFor(task, worker) === parentID);
   });
   return matches.length === 1 ? matches[0].id : null;
 };
@@ -34543,7 +34734,7 @@ var recordDecision = (core, receipts, request, sessionID) => {
   const budgetIssue = workitBindingQuestionIssue([content]);
   if (budgetIssue)
     return failure("invalid_input", budgetIssue);
-  const observed = receipts.consume(sessionID, "decision", {
+  const observed = receipts.reserve(sessionID, "decision", {
     selectedLabel: decision.response,
     decisionPurpose: decision.purpose,
     contentDigest: sha256(canonicalJson(content)),
@@ -34554,10 +34745,15 @@ var recordDecision = (core, receipts, request, sessionID) => {
     return failure("permission_denied", observed.error);
   if (decision.purpose === "action" && decision.response === "approved" && !isSelfAuthorizingActionContent(decision.binding.approvedContent))
     return failure("invalid_input", "no matching action proposal; resolve the action through the action tool first");
-  return core.observeDecision(request, observed.observation);
+  const result = core.observeDecision(request, observed.observation);
+  if (result.ok)
+    receipts.commit(observed.observation);
+  return result;
 };
 var setup = async (ctx) => {
   const root = ctx.location.directory;
+  const sourceMarker = markSourcesLoaded(pluginSourceFiles);
+  let staleSourcesWarned = false;
   const receipts = new NativeReceiptStore;
   const lifecycle = createV2Lifecycle({
     root,
@@ -34664,6 +34860,16 @@ var setup = async (ctx) => {
   await ctx.session.hook("context", async (event) => {
     const session = await sessionFacts(ctx, String(event.sessionID));
     injectAgentContext(root, session, lifecycle.directChildren, event.system);
+    if (!staleSourcesWarned) {
+      const changed = changedSourcesSinceLoad(sourceMarker);
+      if (changed.length > 0) {
+        staleSourcesWarned = true;
+        event.system.push({
+          type: "text",
+          text: `<workit-warning>Workit sources changed after plugin load (${changed.map((file) => file.split(/[\\/]/).at(-1)).join(", ")}); restart the session for latest behavior.</workit-warning>`
+        });
+      }
+    }
   });
   await ctx.session.hook("compaction", (event) => {
     injectCompactionContext(root, String(event.sessionID), event.system);