@cassiomc1/forgeloop 1.5.0 → 1.6.1

package/src/core/command-executors.js

@@ -25,9 +25,25 @@ import { runBundle } from "../commands/bundle.js";
 import { runPrepareCompletion } from "../commands/prepare-completion.js";
 import { runRecordCheck } from "../commands/record-check.js";
 import { runCheck } from "../commands/run-check.js";
+import { runAction } from "../commands/run-action.js";
+import { runActionPropose } from "../commands/action-propose.js";
+import { runActionRecord } from "../commands/action-record.js";
+import { runActionShow } from "../commands/action-show.js";
+import { runActionAuthorize } from "../commands/action-authorize.js";
+import { runActionVerify } from "../commands/action-verify.js";
+import { runActionReconcile } from "../commands/action-reconcile.js";
+import { runMetrics } from "../commands/metrics.js";
+import { runEval } from "../commands/eval.js";
+import { runApprovalRequest } from "../commands/approval-request.js";
+import { runApprovalResolve } from "../commands/approval-resolve.js";
 import { reconcileClosure } from "../commands/reconcile-closure.js";
 import { runRecordTerminalResult } from "../commands/record-terminal-result.js";
 import { runRecordDiagnosis } from "../commands/record-diagnosis.js";
+import { runRecordIntervention } from "../commands/record-intervention.js";
+import { runRecordHypothesisDisposition } from "../commands/record-hypothesis-disposition.js";
+import { runHistory } from "../commands/history.js";
+import { runTrace } from "../commands/trace.js";
+import { runReflect } from "../commands/reflect.js";
 import { runProgress } from "../commands/progress.js";
 import { runRecordDecisionCriterion } from "../commands/record-decision-criterion.js";
 import { runNext } from "../commands/next.js";
@@ -100,12 +116,19 @@ export const COMMAND_EXECUTORS = {
     const result = await runPreflight({ target, packageRoot, strict: options.strict, taskId: options.taskId });
     return { result, exitCode: result.status === "READY" ? 0 : 1 };
   },
-  advance: async ({ target, packageRoot, options }) => ({
-    result: await runAdvance({ target, packageRoot, to: options.to, taskId: options.taskId }),
+  advance: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => ({
+    result: await runAdvance({
+      target,
+      packageRoot,
+      to: options.to,
+      taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
+    }),
     exitCode: 0,
   }),
-  next: async ({ target, packageRoot, options }) => ({
-    result: await runNext({ target, packageRoot, taskId: options.taskId }),
+  next: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => ({
+    result: await runNext({ target, packageRoot, taskId: options.taskId, authorityContext, runtimeContext }),
     exitCode: 0,
   }),
   continuity: async ({ target, packageRoot, options }) => ({
@@ -135,11 +158,11 @@ export const COMMAND_EXECUTORS = {
     result: await runClearContinuity({ target, taskId: options.taskId }),
     exitCode: 0,
   }),
-  "prepare-completion": async ({ target, packageRoot, options }) => ({
-    result: await runPrepareCompletion({ target, packageRoot, taskId: options.taskId }),
+  "prepare-completion": async ({ target, packageRoot, options, authorityContext, runtimeContext }) => ({
+    result: await runPrepareCompletion({ target, packageRoot, taskId: options.taskId, authorityContext, runtimeContext }),
     exitCode: 0,
   }),
-  "run-check": async ({ target, packageRoot, options }) => {
+  "run-check": async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
     const result = await runCheck({
       target,
       packageRoot,
@@ -149,9 +172,67 @@ export const COMMAND_EXECUTORS = {
       details: options.checkDetails ?? undefined,
       timeoutMs: options.timeoutMs ?? undefined,
       taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
     });
     return { result, exitCode: result.check.status === "passed" ? 0 : 1 };
   },
+  "run-action": async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
+    const result = await runAction({ target, packageRoot, taskId: options.taskId,
+      actionId: options.actionId, capability: options.actionCapability,
+      effectClass: options.actionEffectClass, actionTarget: options.actionTarget,
+      idempotencyKey: options.actionIdempotencyKey, requirement: options.actionRequirement,
+      requiredForCompletion: options.actionRequiredForCompletion, argv: options.commandArgv,
+      approvalId: options.approvalId, timeoutMs: options.timeoutMs,
+      authorityContext, runtimeContext });
+    return { result, exitCode: result.action.state === "COMMITTED" ? 0 : 1 };
+  },
+  "action-propose": async ({ target, packageRoot, options }) => ({ result: await runActionPropose({
+    target, packageRoot, taskId: options.taskId, input: { actionId: options.actionId,
+      capability: options.actionCapability, effectClass: options.actionEffectClass,
+      target: options.actionTarget, operation: options.actionOperation,
+      idempotencyKey: options.actionIdempotencyKey, requirement: options.actionRequirement,
+      requiredForCompletion: options.actionRequiredForCompletion },
+  }), exitCode: 0 }),
+  "action-record": async ({ target, packageRoot, options }) => ({ result: await runActionRecord({
+    target, packageRoot, taskId: options.taskId, actionId: options.actionId,
+    state: options.actionState, provenance: options.actionProvenance,
+    evidenceRef: options.actionEvidenceRef,
+  }), exitCode: 0 }),
+  "action-show": async ({ target, packageRoot, options }) => ({ result: await runActionShow({
+    target, packageRoot, taskId: options.taskId, actionId: options.actionId,
+  }), exitCode: 0 }),
+  "action-authorize": async ({ target, packageRoot, options, authorityContext }) => ({
+    result: await runActionAuthorize({
+      target,
+      packageRoot,
+      taskId: options.taskId,
+      actionId: options.actionId,
+      approvalId: options.approvalId,
+      // Trusted authority arrives out-of-band only; never from actor input.
+      authorityContext,
+    }),
+    exitCode: 0,
+  }),
+  "action-verify": async ({ target, packageRoot, options }) => ({ result: await runActionVerify({
+    target, packageRoot, taskId: options.taskId, actionId: options.actionId,
+    evidenceRef: options.actionEvidenceRef,
+  }), exitCode: 0 }),
+  "action-reconcile": async ({ target, packageRoot, options, authorityContext }) => ({ result: await runActionReconcile({
+    target, packageRoot, taskId: options.taskId, actionId: options.actionId,
+    outcome: options.reconciliationOutcome, evidenceRefs: options.evidenceRefs ?? [],
+    observedAt: options.observedAt,
+    // Trusted settlement authority travels only through the out-of-band
+    // executor parameter; actor input can never supply it.
+    authorityContext,
+  }), exitCode: 0 }),
+  metrics: async ({ target, packageRoot, options }) => ({ result: await runMetrics({ target, packageRoot, taskId: options.taskId }), exitCode: 0 }),
+  eval: async ({ target, packageRoot, options }) => {
+    const result = await runEval({ target, packageRoot, taskId: options.taskId, scenarioPath: options.scenarioPath });
+    return { result, exitCode: result.result === "PASS" ? 0 : 1 };
+  },
+  "approval-request": async ({ target, packageRoot, options }) => ({ result: await runApprovalRequest({ target, packageRoot, taskId: options.taskId, approvalId: options.approvalId, actionId: options.actionId, reason: options.reason }), exitCode: 0 }),
+  "approval-resolve": async ({ target, packageRoot, options, authorityContext }) => ({ result: await runApprovalResolve({ target, packageRoot, taskId: options.taskId, approvalId: options.approvalId, decision: options.approvalDecision, authorityKind: options.approvalAuthorityKind, hostGrantRef: options.hostGrantRef, reason: options.reason, authorityContext }), exitCode: 0 }),
   "record-check": async ({ target, packageRoot, options }) => ({
     result: await runRecordCheck({
       target,
@@ -189,6 +270,7 @@ export const COMMAND_EXECUTORS = {
     result: await runRecordDiagnosis({
       target,
       packageRoot,
+      file: options.file ?? null,
       hypothesis: options.hypothesis,
       failureClass: options.failureClass,
       evidenceRefs: options.evidenceRefs,
@@ -198,6 +280,52 @@ export const COMMAND_EXECUTORS = {
     }),
     exitCode: 0,
   }),
+  "record-intervention": async ({ target, packageRoot, options }) => ({
+    result: await runRecordIntervention({
+      target,
+      packageRoot,
+      file: options.file ?? null,
+      taskId: options.taskId,
+    }),
+    exitCode: 0,
+  }),
+  "record-hypothesis-disposition": async ({ target, packageRoot, options }) => ({
+    result: await runRecordHypothesisDisposition({
+      target,
+      packageRoot,
+      hypothesis: options.hypothesis,
+      status: options.dispositionStatus,
+      evidenceRefs: options.evidenceRefs,
+      reason: options.reason,
+      taskId: options.taskId,
+    }),
+    exitCode: 0,
+  }),
+  history: async ({ target, packageRoot, options }) => {
+    const result = await runHistory({
+      target,
+      packageRoot,
+      taskId: options.taskId,
+      filters: {
+        type: options.historyType ?? null,
+        phase: options.historyPhase ?? null,
+        failures: Boolean(options.historyFailures),
+        checks: Boolean(options.historyChecks),
+        since: options.historySince ?? null,
+        until: options.historyUntil ?? null,
+        limit: Number.isInteger(options.historyLimit) ? options.historyLimit : null,
+      },
+    });
+    return { result, exitCode: result.integrity.valid ? 0 : 1 };
+  },
+  trace: async ({ target, packageRoot, options }) => {
+    const result = await runTrace({ target, packageRoot, taskId: options.taskId });
+    return { result, exitCode: result.integrity.valid ? 0 : 1 };
+  },
+  reflect: async ({ target, packageRoot, options }) => {
+    const result = await runReflect({ target, packageRoot, taskId: options.taskId });
+    return { result, exitCode: result.status === "STALLED" ? 1 : 0 };
+  },
   progress: async ({ target, packageRoot, options }) => {
     const result = await runProgress({ target, packageRoot, taskId: options.taskId });
     return { result, exitCode: result.status === "STALLED" ? 1 : 0 };
@@ -212,16 +340,37 @@ export const COMMAND_EXECUTORS = {
     }),
     exitCode: 0,
   }),
-  complete: async ({ target, packageRoot, options }) => {
-    const result = await runComplete({ target, packageRoot, strict: options.strict, taskId: options.taskId });
+  complete: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
+    const result = await runComplete({
+      target,
+      packageRoot,
+      strict: options.strict,
+      taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     return { result, exitCode: result.status === "VALID" ? 0 : 1 };
   },
-  audit: async ({ target, packageRoot, options }) => {
-    const result = await runAudit({ target, packageRoot, strict: options.strict, taskId: options.taskId });
+  audit: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
+    const result = await runAudit({
+      target,
+      packageRoot,
+      strict: options.strict,
+      taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     return { result, exitCode: result.status === "VALID" ? 0 : 1 };
   },
-  report: async ({ target, packageRoot, options }) => {
-    const result = await runReport({ target, packageRoot, strict: options.strict, taskId: options.taskId });
+  report: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
+    const result = await runReport({
+      target,
+      packageRoot,
+      strict: options.strict,
+      taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     return { result, exitCode: result.verdict === "VALID" ? 0 : 1 };
   },
   policy: async ({ target, packageRoot, options }) => ({
@@ -262,8 +411,15 @@ export const COMMAND_EXECUTORS = {
     result: await runBundle({ target, packageRoot, taskId: options.taskId }),
     exitCode: 0,
   }),
-  inspect: async ({ target, packageRoot, options }) => {
-    const result = await inspectTarget({ target, packageRoot, contractFile: options.contractFile, taskId: options.taskId });
+  inspect: async ({ target, packageRoot, options, authorityContext, runtimeContext }) => {
+    const result = await inspectTarget({
+      target,
+      packageRoot,
+      contractFile: options.contractFile,
+      taskId: options.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     return { result, exitCode: result.ok ? 0 : 1 };
   },
   "validate-receipt": async ({ target, packageRoot, options }) => ({

package/src/core/command-runtime.js

@@ -31,6 +31,8 @@ export async function executeForgeLoopCommand({
   command,
   projectPath = ".",
   input = {},
+  authorityContext,
+  runtimeContext,
 } = {}) {
   const metadata = Object.freeze({
     protocolVersion: PROTOCOL_VERSION,
@@ -81,7 +83,16 @@ export async function executeForgeLoopCommand({
     const packageRoot = getPackageRoot();
     const packageVersion = await readPackageVersion(packageRoot);
 
-    const { result, exitCode } = await executor({ target, packageRoot, packageVersion, options });
+    // Trusted host authority and runtime context travel out-of-band, never
+    // inside actor-controlled command input (INV-AUTH-03).
+    const { result, exitCode } = await executor({
+      target,
+      packageRoot,
+      packageVersion,
+      options,
+      authorityContext,
+      runtimeContext,
+    });
     return {
       ok: true,
       command,

package/src/core/completion-artifacts.js

@@ -24,6 +24,20 @@ import { readExecutionArtifact, validateExecutionBinding } from "./execution.js"
 import { taskArtifactPath, taskExecutionPath } from "./task-paths.js";
 import { assertClaimsCoverChangedPaths } from "./task-scope.js";
 import { discoverTasks } from "./task-discovery.js";
+import { listActions } from "./actions.js";
+
+async function actionReceiptSummary(target, packageRoot, taskId) {
+  const actions = await listActions(target, { packageRoot, taskId });
+  return {
+    count: actions.length,
+    required: actions.filter((action) => action.requiredForCompletion).length,
+    verified: actions.filter((action) => action.state === "VERIFIED").length,
+    failed: actions.filter((action) => action.state === "FAILED").length,
+    ambiguous: actions.filter((action) => action.state === "COMMIT_UNKNOWN").length,
+    pending: actions.filter((action) => !["VERIFIED", "FAILED", "CANCELLED"].includes(action.state)).length,
+    actionRefs: actions.map((action) => action.actionId),
+  };
+}
 
 /**
  * Canonical terminal-result types shared by runtime validation, tests, and
@@ -138,10 +152,42 @@ export async function validateCheckExecutionProvenance(check, {
     requirement: check.requirement,
     verificationCycle: check.details?.verificationCycle ?? 1,
   });
-  if (!allowForeignCwd && path.resolve(execution.cwd) !== path.resolve(target)) {
+  const protocolProjectRoot = execution.protocolProjectRoot ?? execution.cwd;
+  if (
+    execution.executionKind !== undefined
+    && execution.executionKind !== "VERIFICATION"
+  ) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "A command check must reference a verification execution artifact",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (
+    execution.executionIsolation !== undefined
+    && execution.isolation?.mode !== execution.executionIsolation
+  ) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution artifact isolation mode does not match its isolation metadata",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (
+    execution.isolation?.mode !== undefined
+    && execution.isolation.mode !== "NATIVE_PROJECT"
+    && path.resolve(execution.cwd) === path.resolve(protocolProjectRoot)
+  ) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Isolated execution artifact cwd must be separate from the protocol project root",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (!allowForeignCwd && path.resolve(protocolProjectRoot) !== path.resolve(target)) {
     throw artifactError(
       "E_EXECUTION_REF_INVALID",
-      "Execution artifact cwd does not match the current target",
+      "Execution artifact protocol project root does not match the current target",
       [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
     );
   }
@@ -249,6 +295,16 @@ export async function prepareCompletion({
   if (existing && existingValue.stateFingerprint === undefined) {
     throw artifactError("E_RECEIPT_STATE_MISMATCH", "Execution receipt requires the current work-state fingerprint", [receiptRel]);
   }
+  // A checkpoint recreated after clear-state/loss starts with empty checks; a
+  // receipt still bound to the previous checkpoint fingerprint belongs to a
+  // superseded epoch and must not be adopted into the fresh one. The prior
+  // epoch remains auditable through the executions/ artifacts and the
+  // append-only ledger.
+  const receiptFromSupersededEpoch = Boolean(existing)
+    && existingValue.stateFingerprint !== undefined
+    && existingValue.stateFingerprint !== canonicalFingerprint(state)
+    && (state.checks ?? []).length === 0;
+  const adoptedValue = receiptFromSupersededEpoch ? {} : existingValue;
   assertStateIdentity({ contract, route, state });
 
   let writeClaims = [];
@@ -286,35 +342,36 @@ export async function prepareCompletion({
 
   const changedPaths = observedPaths !== null
     ? [...observedPaths]
-    : existing
+    : !receiptFromSupersededEpoch && existing
       ? [...(existingValue.changedPaths ?? [])]
       : [];
-  const checks = existing ? [...existingValue.checks] : [...state.checks];
-  const evidence = existing ? [...(existingValue.evidence ?? [])] : [...state.verificationEvidence];
+  const checks = !receiptFromSupersededEpoch && existing ? [...existingValue.checks] : [...state.checks];
+  const evidence = !receiptFromSupersededEpoch && existing ? [...(existingValue.evidence ?? [])] : [...state.verificationEvidence];
   const receipt = await createReceipt({
-    ...existingValue,
+    ...adoptedValue,
     taskId: contract.value.taskId,
     contractFingerprint: contract.fingerprint,
     routeFingerprint: route.fingerprint,
     stateFingerprint: canonicalFingerprint(state),
     verificationCycle: state.verificationCycle ?? 1,
-    status: existingValue.status ?? "in-progress",
-    taskStatus: existingValue.taskStatus ?? "in-progress",
-    verificationStatus: existingValue.verificationStatus ?? "not-verified",
-    publicationStatus: existingValue.publicationStatus ?? "local-only",
-    productionReadiness: existingValue.productionReadiness ?? "not-verified",
+    status: adoptedValue.status ?? "in-progress",
+    taskStatus: adoptedValue.taskStatus ?? "in-progress",
+    verificationStatus: adoptedValue.verificationStatus ?? "not-verified",
+    publicationStatus: adoptedValue.publicationStatus ?? "local-only",
+    productionReadiness: adoptedValue.productionReadiness ?? "not-verified",
     selectedGuides: [...route.value.guides],
     changedPaths,
     checks,
+    actions: await actionReceiptSummary(target, packageRoot, contract.value.taskId),
     evidence,
     evidenceCoverage: coverageForRequirements(requiredEvidence, checks, {
       target,
       taskId: contract.value.taskId,
       options: { authorityContext, runtimeContext },
     }),
-    review: existingValue.review ?? { status: "not-run", independent: false },
-    limitations: [...(existingValue.limitations ?? [])],
-    publication: existingValue.publication ?? {
+    review: adoptedValue.review ?? { status: "not-run", independent: false },
+    limitations: [...(adoptedValue.limitations ?? [])],
+    publication: adoptedValue.publication ?? {
       committed: false,
       pushed: false,
       pullRequest: null,

package/src/core/completion-recovery-rebind.js

@@ -0,0 +1,194 @@
+import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
+import { appendProtocolEvent, validateCompletionRecoveryAuthorization, validateEventLedger } from "./events.js";
+import { createReceipt } from "./receipt.js";
+import { taskArtifactPath } from "./task-paths.js";
+import { mutateWorkState, readWorkState } from "./work-state.js";
+
+function resolveArtifactPath(key, taskId, override) {
+  if (override) return override;
+  return taskId ? taskArtifactPath(taskId, key) : ARTIFACT_PATHS[key];
+}
+
+const FINGERPRINT_MISMATCH_CODES = new Set([
+  "E_COMPLETION_REJECTION_STATE_FINGERPRINT_MISMATCH",
+  "E_COMPLETION_REJECTION_RECEIPT_FINGERPRINT_MISMATCH",
+]);
+
+export function isFingerprintOnlyRecoveryMismatch(errors = []) {
+  return Array.isArray(errors)
+    && errors.length > 0
+    && errors.every((error) => FINGERPRINT_MISMATCH_CODES.has(error?.code));
+}
+
+function sortedValues(values) {
+  return [...new Set(values ?? [])].sort();
+}
+
+function sameSortedValues(left, right) {
+  return JSON.stringify(sortedValues(left)) === JSON.stringify(sortedValues(right));
+}
+
+function findMatchingRejectionEvent(events, attempt, cycle) {
+  let latestReviewIndex = -1;
+  for (let index = 0; index < events.length; index += 1) {
+    const event = events[index];
+    if (event.event === "REVIEW_STARTED" && (event.details?.verificationCycle ?? 1) === cycle) {
+      latestReviewIndex = index;
+    }
+  }
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const event = events[index];
+    if (event.event !== "COMPLETION_REJECTED") continue;
+    if ((event.details?.verificationCycle ?? 1) !== cycle) continue;
+    if (index < latestReviewIndex) continue;
+    return { event, index };
+  }
+  return null;
+}
+
+/**
+ * Rebind a persisted REJECTED completion attempt to the current work-state
+ * checkpoint when the only authorization failures are fingerprint mismatches.
+ *
+ * Repository drift or a recovery/resume cycle can mutate work-state after a
+ * completion rejection was persisted, so the ledger snapshot no longer matches
+ * the live checkpoint. Without rebinding, every sanctioned closure path refuses
+ * (reconcile-closure and REVIEWING -> VERIFYING require authorized completion
+ * recovery; complete cannot persist a fresh evidence-only rejection while the
+ * checkpoint is stale), which deadlocks the task.
+ *
+ * The rebind is append-only and logically conservative:
+ *   - the rejection reasonCodes, missingRequirementIds, and verification cycle
+ *     must be logically identical between work-state and the latest matching
+ *     ledger rejection; any logical difference is refused,
+ *   - the original COMPLETION_REJECTED event is never modified; a rebound
+ *     rejection carrying the current fingerprints is appended,
+ *   - the execution receipt is re-bound to the current checkpoint when present.
+ */
+export async function rebindCompletionRejectionSnapshot({
+  target,
+  packageRoot,
+  taskId = null,
+  statePath = null,
+  receiptPath = null,
+  eventsPath = null,
+  authorityContext,
+  runtimeContext,
+} = {}) {
+  const statePathResolved = resolveArtifactPath("state", taskId, statePath);
+  const receiptPathResolved = resolveArtifactPath("receipt", taskId, receiptPath);
+  const state = await readWorkState(target, { packageRoot, taskId, statePath: statePathResolved });
+  if (!state || state.phase !== "REVIEWING") {
+    return { rebound: false };
+  }
+  const attempt = state.lastCompletionAttempt;
+  if (!attempt || attempt.status !== "REJECTED") {
+    return { rebound: false };
+  }
+
+  const ledger = await validateEventLedger(target, packageRoot, { taskId, eventsPath });
+  if (!ledger.valid) {
+    return { rebound: false };
+  }
+  const cycle = attempt.verificationCycle ?? state.verificationCycle ?? 1;
+  const matching = findMatchingRejectionEvent(ledger.events, attempt, cycle);
+  if (!matching) {
+    return { rebound: false };
+  }
+  const details = matching.event.details ?? {};
+  const logicalMatch = (details.verificationCycle ?? 1) === cycle
+    && sameSortedValues(details.reasonCodes, attempt.reasonCodes)
+    && sameSortedValues(details.missingRequirementIds, attempt.missingRequirementIds);
+  if (!logicalMatch) {
+    return { rebound: false };
+  }
+
+  const next = await mutateWorkState(target, {
+    expectedRevision: state.revision ?? 0,
+    packageRoot,
+    taskId,
+    statePath: statePathResolved,
+  }, () => ({
+    ...state,
+    revision: (state.revision ?? 0) + 1,
+    lastUpdated: new Date().toISOString(),
+  }));
+
+  let reboundReceiptFingerprint;
+  try {
+    const receipt = await readJsonArtifact(target, receiptPathResolved, "execution-receipt", packageRoot);
+    const reboundReceipt = await createReceipt({
+      ...receipt.value,
+      stateFingerprint: canonicalFingerprint(next),
+      verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
+    }, packageRoot, { target, taskId, authorityContext, runtimeContext });
+    await writeJsonArtifact(target, receiptPathResolved, reboundReceipt, "execution-receipt", packageRoot);
+    reboundReceiptFingerprint = canonicalFingerprint(reboundReceipt);
+  } catch (error) {
+    if (error.code !== "ARTIFACT_MISSING") throw error;
+  }
+
+  await appendProtocolEvent(target, {
+    taskId: state.taskId,
+    event: "COMPLETION_REJECTED",
+    details: {
+      verificationCycle: cycle,
+      reasonCodes: sortedValues(details.reasonCodes),
+      missingRequirementIds: sortedValues(details.missingRequirementIds),
+      stateFingerprint: canonicalFingerprint(next),
+      ...(reboundReceiptFingerprint ? { receiptFingerprint: reboundReceiptFingerprint } : {}),
+      ...(details.stateFingerprint ? { reboundFromStateFingerprint: details.stateFingerprint } : {}),
+    },
+  }, packageRoot, { taskId, eventsPath });
+
+  return { rebound: true, state: next };
+}
+
+export async function authorizeCompletionRecoveryOrRebind({
+  target,
+  packageRoot,
+  taskId = null,
+  statePath = null,
+  receiptPath = null,
+  eventsPath = null,
+  authorityContext,
+  runtimeContext,
+} = {}) {
+  const statePathResolved = resolveArtifactPath("state", taskId, statePath);
+  const receiptPathResolved = resolveArtifactPath("receipt", taskId, receiptPath);
+  const resolveArtifacts = async () => {
+    const state = await readWorkState(target, { packageRoot, taskId, statePath: statePathResolved });
+    let receipt = null;
+    try {
+      receipt = (await readJsonArtifact(target, receiptPathResolved, "execution-receipt", packageRoot))?.value ?? null;
+    } catch {
+      receipt = null;
+    }
+    const events = (await validateEventLedger(target, packageRoot, { taskId, eventsPath })).events;
+    return { state, receipt, events };
+  };
+
+  const initial = await resolveArtifacts();
+  const recoveryAuth = validateCompletionRecoveryAuthorization(initial);
+  if (recoveryAuth.authorized || !isFingerprintOnlyRecoveryMismatch(recoveryAuth.errors)) {
+    return { ...initial, recoveryAuth, rebound: false };
+  }
+
+  const reboundResult = await rebindCompletionRejectionSnapshot({
+    target,
+    packageRoot,
+    taskId,
+    statePath,
+    receiptPath,
+    eventsPath,
+    authorityContext,
+    runtimeContext,
+  });
+  if (!reboundResult.rebound) {
+    return { ...initial, recoveryAuth, rebound: false };
+  }
+
+  const rebounded = await resolveArtifacts();
+  const reboundAuth = validateCompletionRecoveryAuthorization(rebounded);
+  return { ...rebounded, recoveryAuth: reboundAuth, rebound: reboundAuth.authorized };
+}