@caupulican/pi-adaptative 0.81.41 → 0.81.43

package/dist/core/delegation/worker-runner.d.ts

@@ -1,6 +1,7 @@
 import type { GateOutcome, WorkerClaim, WorkerRequest } from "../autonomy/contracts.ts";
+import { type EvidenceFindingDraft } from "../autonomy/evidence-finding-projection.ts";
 import type { LaneTerminalStatus } from "../autonomy/lane-tracker.ts";
-import { type AppliedActionsReport, type WorkerAction } from "./worker-actions.ts";
+import { type AppliedActionsReport, type RejectedWorkerActions, type WorkerAction } from "./worker-actions.ts";
 /**
  * Pure execution for one bounded specialist delegation: bounded isolated completion ->
  * parse -> untrusted `WorkerClaim` -> parent validation via {@link validateWorkerClaim}.
@@ -74,11 +75,10 @@ export interface ParsedWorkerOutput {
     summary: string;
     status: "completed" | "blocked";
     blockers: string[];
-    findings: Array<{
-        summary: string;
-        confidence?: number;
-    }>;
+    findings: EvidenceFindingDraft[];
     actions: WorkerAction[];
+    /** Present when the model emitted an action list that cannot safely reach execution. */
+    actionRejection?: RejectedWorkerActions;
     verdict?: "accepted" | "rejected";
     reasonCodes: string[];
 }

package/dist/core/delegation/worker-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-runner.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAwB,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,KAAK,oBAAoB,EAAsB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGvG;;;;;;;GAOG;AAEH,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,YAAY,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CA2BlG;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAA4D,CAAC;AACnG,eAAO,MAAM,+BAA+B,QAA2D,CAAC;AACxG,eAAO,MAAM,kCAAkC,QAA2D,CAAC;AAE3G,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,aAAa,CAAC;IACvB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClH,oGAAoG;IACpG,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;2DAEuD;IACvD,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,oBAAoB,CAAC;IAC1E,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;gDAC4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,6FAA6F;IAC7F,UAAU,EAAE,WAAW,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAUpE;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AA8BD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAsD9E;AAiDD,wBAAsB,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0LvF","sourcesContent":["import { runBoundedCompletion } from \"../autonomy/bounded-completion.ts\";\nimport type { EvidenceRef, Finding, GateOutcome, WorkerClaim, WorkerRequest } from \"../autonomy/contracts.ts\";\nimport type { LaneTerminalStatus } from \"../autonomy/lane-tracker.ts\";\nimport { createEvidenceBundle } from \"../research/evidence-bundle.ts\";\nimport { type AppliedActionsReport, parseWorkerActions, type WorkerAction } from \"./worker-actions.ts\";\nimport { validateWorkerClaim } from \"./worker-claim.ts\";\n\n/**\n * Pure execution for one bounded specialist delegation: bounded isolated completion ->\n * parse -> untrusted `WorkerClaim` -> parent validation via {@link validateWorkerClaim}.\n *\n * The injected completion may be a bounded child tool loop. Its tool surface is built and gated by\n * the host; this module keeps the structured-output contract and treats every claim as untrusted\n * until parent validation succeeds.\n */\n\n/** Builds one capability-exact prompt; no role text may deny a tool already granted by policy. */\nexport function buildWorkerSystemPrompt(capabilities: { write: boolean; process: boolean }): string {\n\tconst resultShape = capabilities.write\n\t\t? '{\"summary\":\"<what you did>\",\"status\":\"completed\"|\"blocked\",\"blockers\":[],\"findings\":[{\"summary\":\"<finding>\",\"confidence\":<0..1>}],\"actions\":[{\"op\":\"write\",\"path\":\"<relative path>\",\"content\":\"<full file content>\"},{\"op\":\"edit\",\"path\":\"<relative path>\",\"old\":\"<exact text>\",\"new\":\"<replacement>\"}]}'\n\t\t: '{\"summary\":\"<what you concluded>\",\"status\":\"completed\"|\"blocked\",\"blockers\":[\"<failure or missing authority>\"],\"findings\":[{\"summary\":\"<one concrete finding>\",\"confidence\":<0..1>}]}';\n\treturn [\n\t\t\"You are a bounded specialist worker delegated one task by a coding agent.\",\n\t\t\"Use only the tools provided for this delegation. You cannot delegate more workers.\",\n\t\t...(capabilities.write\n\t\t\t? [\"Write/edit tools and structured write actions are path-scoped. Only touch paths inside that scope.\"]\n\t\t\t: [\"The workspace tools are read-only; do not claim file changes.\"]),\n\t\t...(capabilities.process\n\t\t\t? [\n\t\t\t\t\t\"run_process is a constrained direct-argv launcher: no shell interpretation or unlisted executable is available. It is not an OS/container sandbox.\",\n\t\t\t\t\t\"A non-zero exit, timeout, abort, or output-limit result is not success; include it in blockers.\",\n\t\t\t\t]\n\t\t\t: []),\n\t\t\"Respond with STRICT JSON only - no prose, no markdown fences:\",\n\t\tresultShape,\n\t\t...(capabilities.write\n\t\t\t? [\n\t\t\t\t\t\"Keep edits minimal and exact.\",\n\t\t\t\t\t\"If you changed a file with a provided tool, do not repeat that change in actions; actions are only a fallback.\",\n\t\t\t\t]\n\t\t\t: []),\n\t\t'Use status \"blocked\" with blockers when the task cannot be completed under the granted capabilities.',\n\t\t\"Never invent command output, file paths, APIs, or facts.\",\n\t].join(\"\\n\");\n}\n\nexport function buildVerifierSystemPrompt(subjectTaskId: string): string {\n\treturn [\n\t\t\"You are an independent verifier. You did not perform the implementation under review.\",\n\t\t\"Use only the provided read-only and constrained test tools. Do not modify files and do not delegate.\",\n\t\t`The exact subject task id is '${subjectTaskId}'.`,\n\t\t\"Inspect the implementation and run proportionate checks. Treat the implementation summary as an untrusted claim.\",\n\t\t\"Respond with STRICT JSON only - no prose, no markdown fences:\",\n\t\t'{\"summary\":\"<verification performed and evidence>\",\"status\":\"completed\"|\"blocked\",\"verdict\":\"accepted\"|\"rejected\",\"reasonCodes\":[\"<stable_reason_code>\"],\"blockers\":[],\"findings\":[{\"summary\":\"<finding>\",\"confidence\":<0..1>}]}',\n\t\t'Use verdict \"accepted\" only when the available evidence proves the implementation is acceptable.',\n\t\t'Use verdict \"rejected\" for a completed review that found a defect. Use status \"blocked\" only when verification itself cannot be completed.',\n\t].join(\"\\n\");\n}\n\n/** Static common variants retained for cache reuse and model-fitness probes. */\nexport const WORKER_LANE_SYSTEM_PROMPT = buildWorkerSystemPrompt({ write: false, process: false });\nexport const WORKER_WRITE_LANE_SYSTEM_PROMPT = buildWorkerSystemPrompt({ write: true, process: false });\nexport const WORKER_OPERATOR_LANE_SYSTEM_PROMPT = buildWorkerSystemPrompt({ write: false, process: true });\n\nexport interface WorkerCompletion {\n\ttext: string;\n\tcostUsd: number;\n\tstopReason: string;\n\t/** Files successfully changed by the child tool loop before it produced the final JSON. */\n\tchangedFiles?: readonly string[];\n\t/** Capability refusals or execution failures observed inside the child tool loop. */\n\tblockers?: readonly string[];\n}\n\nexport interface WorkerRunnerOptions {\n\trequest: WorkerRequest;\n\t/** Budget for this delegation; undefined disables this bound, while zero permits only free work. */\n\tmaxUsd?: number;\n\t/** Wall-clock budget in milliseconds; 0 disables. */\n\tmaxWallClockMs: number;\n\t/**\n\t * Pre-allocated spawned-usage report id. Always stamped on the claim so parent validation can\n\t * enforce the cost-visibility invariant (a completed claim without a usage report is blocked).\n\t */\n\tusageReportId: string;\n\tcomplete: (args: { systemPrompt: string; userPrompt: string; signal?: AbortSignal }) => Promise<WorkerCompletion>;\n\t/** Live successful child-tool mutations, including writes completed before timeout/cancellation. */\n\tgetChangedFiles?: () => readonly string[];\n\tsignal?: AbortSignal;\n\tnow?: () => string;\n\t/** Enables the WRITE lane: only honored when the request envelope grants \"filesystem.write\". The\n\t * runner applies the worker's structured actions through the envelope path scope; refusals\n\t * and failures become blockers, never silent drops. */\n\tapplyActions?: (actions: readonly WorkerAction[]) => AppliedActionsReport;\n\t/** Enables the constrained direct-argv operator role prompt. */\n\tprocessCapable?: boolean;\n\t/** Session cwd — the baseline for relative changed-file and envelope paths in parent\n\t * validation. Defaults to process.cwd(). */\n\tcwd?: string;\n\t/** Turns the child into a read-only semantic verifier for this exact durable task. */\n\tverificationSubjectTaskId?: string;\n}\n\nexport interface WorkerRunOutcome {\n\tclaim: WorkerClaim;\n\t/** Parent-review verdict from {@link validateWorkerClaim}; worker output stays untrusted. */\n\tacceptance: GateOutcome;\n\taccepted: boolean;\n\tlaneStatus: LaneTerminalStatus;\n\treasonCode: string;\n\tcostUsd: number;\n}\n\nexport function buildWorkerUserPrompt(request: WorkerRequest): string {\n\treturn [\n\t\t\"Delegated task:\",\n\t\t\"<task>\",\n\t\trequest.instructions,\n\t\t\"</task>\",\n\t\t\"\",\n\t\t\"The task may request a custom output format. Do not replace the worker claim envelope.\",\n\t\t'Always return the JSON object required by the system prompt; put requested details inside \"summary\" and \"findings\".',\n\t].join(\"\\n\");\n}\n\nexport interface ParsedWorkerOutput {\n\tsummary: string;\n\tstatus: \"completed\" | \"blocked\";\n\tblockers: string[];\n\tfindings: Array<{ summary: string; confidence?: number }>;\n\tactions: WorkerAction[];\n\tverdict?: \"accepted\" | \"rejected\";\n\treasonCodes: string[];\n}\n\nfunction balancedObjectCandidates(text: string): string[] {\n\tconst candidates: string[] = [];\n\tfor (let start = 0; start < text.length; start++) {\n\t\tif (text[start] !== \"{\") continue;\n\t\tlet depth = 0;\n\t\tlet inString = false;\n\t\tlet escaped = false;\n\t\tfor (let index = start; index < text.length; index++) {\n\t\t\tconst character = text[index];\n\t\t\tif (inString) {\n\t\t\t\tif (escaped) escaped = false;\n\t\t\t\telse if (character === \"\\\\\") escaped = true;\n\t\t\t\telse if (character === '\"') inString = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === '\"') {\n\t\t\t\tinString = true;\n\t\t\t} else if (character === \"{\") {\n\t\t\t\tdepth++;\n\t\t\t} else if (character === \"}\" && --depth === 0) {\n\t\t\t\tcandidates.push(text.slice(start, index + 1));\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\treturn candidates;\n}\n\nexport function parseWorkerOutput(text: string): ParsedWorkerOutput | undefined {\n\tconst trimmed = text.trim();\n\tconst candidates: string[] = [trimmed];\n\tconst fenced = /```(?:json)?\\s*([\\s\\S]*?)```/.exec(trimmed);\n\tif (fenced?.[1]) candidates.push(fenced[1].trim());\n\tcandidates.push(...balancedObjectCandidates(trimmed));\n\n\tfor (const candidate of candidates) {\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(candidate);\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) continue;\n\t\tconst record = parsed as Record<string, unknown>;\n\t\tconst summary = record.summary;\n\t\tif (typeof summary !== \"string\" || summary.trim().length === 0) continue;\n\n\t\tconst status = record.status === \"blocked\" ? \"blocked\" : \"completed\";\n\t\tconst blockers = Array.isArray(record.blockers)\n\t\t\t? record.blockers.filter((blocker): blocker is string => typeof blocker === \"string\" && blocker.length > 0)\n\t\t\t: [];\n\t\tconst findings: Array<{ summary: string; confidence?: number }> = [];\n\t\tif (Array.isArray(record.findings)) {\n\t\t\tfor (const item of record.findings) {\n\t\t\t\tif (!item || typeof item !== \"object\" || Array.isArray(item)) continue;\n\t\t\t\tconst findingSummary = (item as { summary?: unknown }).summary;\n\t\t\t\tif (typeof findingSummary !== \"string\" || findingSummary.trim().length === 0) continue;\n\t\t\t\tconst confidenceRaw = (item as { confidence?: unknown }).confidence;\n\t\t\t\tconst confidence =\n\t\t\t\t\ttypeof confidenceRaw === \"number\" && Number.isFinite(confidenceRaw)\n\t\t\t\t\t\t? Math.min(Math.max(confidenceRaw, 0), 1)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tfindings.push({ summary: findingSummary.trim(), confidence });\n\t\t\t}\n\t\t}\n\t\tconst verdict = record.verdict === \"accepted\" || record.verdict === \"rejected\" ? record.verdict : undefined;\n\t\tconst reasonCodes = Array.isArray(record.reasonCodes)\n\t\t\t? record.reasonCodes.filter(\n\t\t\t\t\t(reasonCode): reasonCode is string => typeof reasonCode === \"string\" && reasonCode.length > 0,\n\t\t\t\t)\n\t\t\t: [];\n\t\treturn {\n\t\t\tsummary: summary.trim(),\n\t\t\tstatus,\n\t\t\tblockers,\n\t\t\tfindings,\n\t\t\tactions: parseWorkerActions(record.actions),\n\t\t\t...(verdict ? { verdict } : {}),\n\t\t\treasonCodes,\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction buildWorkerEvidence(request: WorkerRequest, findings: ParsedWorkerOutput[\"findings\"]) {\n\tif (findings.length === 0) return undefined;\n\tconst instructionsRef: EvidenceRef = {\n\t\tid: \"src-instructions\",\n\t\tkind: \"user\",\n\t\ttitle: \"Delegated task instructions\",\n\t\ttrusted: true,\n\t\texcerpt: request.instructions.slice(0, 2000),\n\t};\n\tconst synthesisRef: EvidenceRef = {\n\t\tid: \"src-worker\",\n\t\tkind: \"tool\",\n\t\ttitle: \"Delegated worker synthesis\",\n\t\ttrusted: false,\n\t};\n\tconst bundleFindings: Finding[] = findings.map((finding, index) => ({\n\t\tid: `finding-${index + 1}`,\n\t\tsummary: finding.summary,\n\t\tevidenceIds: [synthesisRef.id],\n\t\t...(finding.confidence !== undefined ? { confidence: finding.confidence } : {}),\n\t}));\n\treturn createEvidenceBundle({\n\t\tquery: `worker:${request.id}`,\n\t\tsources: [instructionsRef, synthesisRef],\n\t\tfindings: bundleFindings,\n\t});\n}\n\nfunction finishOutcome(args: {\n\trequest: WorkerRequest;\n\tclaim: WorkerClaim;\n\tlaneStatus: LaneTerminalStatus;\n\treasonCode: string;\n\tcostUsd: number;\n\tcwd?: string;\n}): WorkerRunOutcome {\n\tconst acceptance = validateWorkerClaim({ request: args.request, claim: args.claim, cwd: args.cwd });\n\treturn {\n\t\tclaim: args.claim,\n\t\tacceptance,\n\t\taccepted: acceptance.outcome === \"allow\",\n\t\tlaneStatus: args.laneStatus,\n\t\treasonCode: args.reasonCode,\n\t\tcostUsd: args.costUsd,\n\t};\n}\n\nexport async function runWorker(options: WorkerRunnerOptions): Promise<WorkerRunOutcome> {\n\tconst now = options.now ?? (() => new Date().toISOString());\n\tconst baseClaim = {\n\t\trequestId: options.request.id,\n\t\tchangedFiles: [] as string[],\n\t\tusageReportId: options.usageReportId,\n\t\tcreatedAt: now(),\n\t};\n\n\t// The write prompt requires BOTH the envelope grant and a caller-supplied applier.\n\tconst writeCapable =\n\t\toptions.request.envelope.capabilities.includes(\"filesystem.write\") && options.applyActions !== undefined;\n\n\tconst bounded = await runBoundedCompletion({\n\t\tmaxWallClockMs: options.maxWallClockMs,\n\t\tsignal: options.signal,\n\t\texecute: (signal) =>\n\t\t\toptions.complete({\n\t\t\t\tsystemPrompt: options.verificationSubjectTaskId\n\t\t\t\t\t? buildVerifierSystemPrompt(options.verificationSubjectTaskId)\n\t\t\t\t\t: buildWorkerSystemPrompt({ write: writeCapable, process: options.processCapable === true }),\n\t\t\t\tuserPrompt: buildWorkerUserPrompt(options.request),\n\t\t\t\tsignal,\n\t\t\t}),\n\t});\n\tconst costUsd = bounded.completion?.costUsd ?? 0;\n\tconst liveChangedFiles = [...new Set(options.getChangedFiles?.() ?? [])];\n\n\tif (bounded.failure) {\n\t\tconst cancelled = bounded.failure.status === \"canceled\" || bounded.failure.status === \"timeout\";\n\t\treturn finishOutcome({\n\t\t\trequest: options.request,\n\t\t\tcwd: options.cwd,\n\t\t\tclaim: {\n\t\t\t\t...baseClaim,\n\t\t\t\tchangedFiles: liveChangedFiles,\n\t\t\t\tstatus: cancelled ? \"cancelled\" : \"failed\",\n\t\t\t\tsummary: `Worker did not complete: ${bounded.failure.reasonCode}`,\n\t\t\t},\n\t\t\tlaneStatus: bounded.failure.status,\n\t\t\treasonCode: bounded.failure.reasonCode,\n\t\t\tcostUsd,\n\t\t});\n\t}\n\n\tconst completion = bounded.completion as WorkerCompletion | undefined;\n\tconst completionChangedFiles = [...new Set([...liveChangedFiles, ...(completion?.changedFiles ?? [])])];\n\tconst completionBaseClaim = { ...baseClaim, changedFiles: completionChangedFiles };\n\tif (!completion || completion.stopReason === \"error\" || completion.stopReason === \"aborted\") {\n\t\treturn finishOutcome({\n\t\t\trequest: options.request,\n\t\t\tcwd: options.cwd,\n\t\t\tclaim: { ...completionBaseClaim, status: \"failed\", summary: \"Worker model call failed.\" },\n\t\t\tlaneStatus: \"failed\",\n\t\t\treasonCode: \"model_error\",\n\t\t\tcostUsd,\n\t\t});\n\t}\n\n\tconst parsed = parseWorkerOutput(completion.text);\n\tif (!parsed) {\n\t\tconst readOnlyPlainText =\n\t\t\t!options.verificationSubjectTaskId &&\n\t\t\t!writeCapable &&\n\t\t\tcompletion.text.trim().length > 0 &&\n\t\t\tcompletionChangedFiles.length === 0;\n\t\tif (readOnlyPlainText) {\n\t\t\tconst completionBlockers = [...(completion.blockers ?? [])];\n\t\t\tconst incompleteNote =\n\t\t\t\tcompletion.stopReason === \"stop\"\n\t\t\t\t\t? \"\"\n\t\t\t\t\t: `\\n\\n[Worker output ended with stop reason '${completion.stopReason}'; verify completeness.]`;\n\t\t\tconst summary = `${completion.text.trim().slice(0, Math.max(0, 8000 - incompleteNote.length))}${incompleteNote}`;\n\t\t\tconst blocked = completionBlockers.length > 0;\n\t\t\treturn finishOutcome({\n\t\t\t\trequest: options.request,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tclaim: {\n\t\t\t\t\t...completionBaseClaim,\n\t\t\t\t\tstatus: blocked ? \"blocked\" : \"completed\",\n\t\t\t\t\toutputFormat: \"plain_text\",\n\t\t\t\t\tsummary,\n\t\t\t\t\t...(blocked ? { blockers: completionBlockers } : {}),\n\t\t\t\t},\n\t\t\t\tlaneStatus: blocked ? \"failed\" : \"succeeded\",\n\t\t\t\treasonCode: blocked\n\t\t\t\t\t? \"worker_blocked\"\n\t\t\t\t\t: completion.stopReason === \"stop\"\n\t\t\t\t\t\t? \"worker_completed_plain_text\"\n\t\t\t\t\t\t: \"worker_completed_plain_text_incomplete\",\n\t\t\t\tcostUsd,\n\t\t\t});\n\t\t}\n\t\treturn finishOutcome({\n\t\t\trequest: options.request,\n\t\t\tcwd: options.cwd,\n\t\t\tclaim: {\n\t\t\t\t...completionBaseClaim,\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tsummary: \"Worker output was not valid structured JSON.\",\n\t\t\t},\n\t\t\tlaneStatus: \"failed\",\n\t\t\treasonCode: \"unparseable_output\",\n\t\t\tcostUsd,\n\t\t});\n\t}\n\n\tconst evidence = buildWorkerEvidence(options.request, parsed.findings);\n\tif (options.verificationSubjectTaskId && (!parsed.verdict || parsed.reasonCodes.length === 0)) {\n\t\treturn finishOutcome({\n\t\t\trequest: options.request,\n\t\t\tcwd: options.cwd,\n\t\t\tclaim: {\n\t\t\t\t...completionBaseClaim,\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tsummary: \"Verifier output omitted its typed verdict or reasonCodes.\",\n\t\t\t},\n\t\t\tlaneStatus: \"failed\",\n\t\t\treasonCode: \"invalid_verifier_result\",\n\t\t\tcostUsd,\n\t\t});\n\t}\n\tlet changedFiles: string[] = [...completionChangedFiles];\n\tconst actionBlockers: string[] = [...(completion.blockers ?? [])];\n\tif (!writeCapable && completionChangedFiles.length > 0) {\n\t\tactionBlockers.push(\"worker reported file changes without a filesystem.write envelope grant\");\n\t}\n\tif (writeCapable && parsed.status !== \"blocked\" && parsed.actions.length > 0 && options.applyActions) {\n\t\t// Runner-side application through the envelope path scope: refusals and failures are\n\t\t// surfaced as blockers so a partially-applied change can never look like clean success.\n\t\tconst applied = options.applyActions(parsed.actions);\n\t\tchangedFiles = [...new Set([...changedFiles, ...applied.changedFiles])];\n\t\tfor (const refusal of applied.refused) {\n\t\t\tactionBlockers.push(`action refused (${refusal.path}): ${refusal.reason}`);\n\t\t}\n\t\tfor (const failure of applied.failed) {\n\t\t\tactionBlockers.push(`action failed (${failure.path}): ${failure.reason}`);\n\t\t}\n\t} else if (!writeCapable && parsed.actions.length > 0) {\n\t\tactionBlockers.push(\"worker emitted file actions without a filesystem.write envelope grant; nothing was applied\");\n\t}\n\tconst allBlockers = [...parsed.blockers, ...actionBlockers];\n\tconst claim: WorkerClaim = {\n\t\t...baseClaim,\n\t\tchangedFiles,\n\t\tstatus: parsed.status === \"blocked\" || allBlockers.length > 0 ? \"blocked\" : \"completed\",\n\t\tsummary: parsed.summary,\n\t\t...(allBlockers.length > 0 ? { blockers: allBlockers } : {}),\n\t\t...(evidence ? { evidence } : {}),\n\t\t...(options.verificationSubjectTaskId && parsed.verdict\n\t\t\t? {\n\t\t\t\t\tverification: {\n\t\t\t\t\t\tsubjectTaskId: options.verificationSubjectTaskId,\n\t\t\t\t\t\tverdict: parsed.verdict,\n\t\t\t\t\t\treasonCodes: parsed.reasonCodes,\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t};\n\n\tif (claim.status === \"blocked\") {\n\t\treturn finishOutcome({\n\t\t\trequest: options.request,\n\t\t\tcwd: options.cwd,\n\t\t\tclaim,\n\t\t\tlaneStatus: \"failed\",\n\t\t\treasonCode: \"worker_blocked\",\n\t\t\tcostUsd,\n\t\t});\n\t}\n\n\tconst overBudget = options.maxUsd !== undefined && costUsd > options.maxUsd;\n\treturn finishOutcome({\n\t\trequest: options.request,\n\t\tcwd: options.cwd,\n\t\tclaim,\n\t\tlaneStatus: overBudget ? \"budget_exhausted\" : \"succeeded\",\n\t\treasonCode: overBudget\n\t\t\t? \"cost_budget_exceeded\"\n\t\t\t: claim.verification\n\t\t\t\t? claim.verification.verdict === \"accepted\"\n\t\t\t\t\t? \"verification_accepted\"\n\t\t\t\t\t: \"verification_rejected\"\n\t\t\t\t: \"worker_completed\",\n\t\tcostUsd,\n\t});\n}\n"]}
+{"version":3,"file":"worker-runner.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EACN,KAAK,oBAAoB,EAGzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EACN,KAAK,oBAAoB,EAEzB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAW7B;;;;;;;GAOG;AAEH,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,YAAY,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CA2BlG;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAA4D,CAAC;AACnG,eAAO,MAAM,+BAA+B,QAA2D,CAAC;AACxG,eAAO,MAAM,kCAAkC,QAA2D,CAAC;AAE3G,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,aAAa,CAAC;IACvB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClH,oGAAoG;IACpG,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;2DAEuD;IACvD,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,oBAAoB,CAAC;IAC1E,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;gDAC4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,6FAA6F;IAC7F,UAAU,EAAE,WAAW,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAUpE;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wFAAwF;IACxF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAkFD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAkD9E;AA4CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6QvF"}

package/dist/core/delegation/worker-runner.js

@@ -1,7 +1,8 @@
 import { runBoundedCompletion } from "../autonomy/bounded-completion.js";
+import { normalizeEvidenceFinding, projectEvidenceFindings, } from "../autonomy/evidence-finding-projection.js";
 import { createEvidenceBundle } from "../research/evidence-bundle.js";
-import { parseWorkerActions } from "./worker-actions.js";
-import { validateWorkerClaim } from "./worker-claim.js";
+import { parseWorkerActions, } from "./worker-actions.js";
+import { collectBoundedWorkerClaimBlockers, collectBoundedWorkerClaimChangedFiles, MAX_WORKER_CLAIM_BLOCKER_CHARS, MAX_WORKER_CLAIM_BLOCKERS, MAX_WORKER_CLAIM_SUMMARY_CHARS, normalizeWorkerClaimForHost, validateWorkerClaim, } from "./worker-claim.js";
 /**
  * Pure execution for one bounded specialist delegation: bounded isolated completion ->
  * parse -> untrusted `WorkerClaim` -> parent validation via {@link validateWorkerClaim}.
@@ -66,89 +67,136 @@ export function buildWorkerUserPrompt(request) {
         'Always return the JSON object required by the system prompt; put requested details inside "summary" and "findings".',
     ].join("\n");
 }
+const MAX_WORKER_OUTPUT_CHARS = 512 * 1024;
+const MAX_WORKER_JSON_CANDIDATES = 64;
+const MAX_WORKER_JSON_DEPTH = 256;
+const MAX_WORKER_FINDINGS = 64;
+const MAX_WORKER_FINDING_CHARS = 2_000;
+const MAX_WORKER_REASON_CODES = 32;
+const MAX_WORKER_REASON_CODE_CHARS = 128;
 function balancedObjectCandidates(text) {
-    const candidates = [];
-    for (let start = 0; start < text.length; start++) {
-        if (text[start] !== "{")
+    const ranges = [];
+    const starts = [];
+    let inString = false;
+    let escaped = false;
+    for (let index = 0; index < text.length; index++) {
+        const character = text[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (character === "\\")
+                escaped = true;
+            else if (character === '"')
+                inString = false;
             continue;
-        let depth = 0;
-        let inString = false;
-        let escaped = false;
-        for (let index = start; index < text.length; index++) {
-            const character = text[index];
-            if (inString) {
-                if (escaped)
-                    escaped = false;
-                else if (character === "\\")
-                    escaped = true;
-                else if (character === '"')
-                    inString = false;
-                continue;
-            }
-            if (character === '"') {
-                inString = true;
-            }
-            else if (character === "{") {
-                depth++;
-            }
-            else if (character === "}" && --depth === 0) {
-                candidates.push(text.slice(start, index + 1));
-                break;
-            }
         }
+        if (character === '"') {
+            inString = true;
+            continue;
+        }
+        if (character === "{") {
+            if (starts.length >= MAX_WORKER_JSON_DEPTH)
+                return ranges.map(({ start, end }) => text.slice(start, end));
+            starts.push(index);
+            continue;
+        }
+        if (character !== "}")
+            continue;
+        const start = starts.pop();
+        if (start === undefined || ranges.length >= MAX_WORKER_JSON_CANDIDATES)
+            continue;
+        const end = index + 1;
+        if (end - start <= MAX_WORKER_OUTPUT_CHARS)
+            ranges.push({ start, end });
     }
-    return candidates;
+    return ranges.map(({ start, end }) => text.slice(start, end));
 }
-export function parseWorkerOutput(text) {
+function workerOutputRecords(text) {
     const trimmed = text.trim();
+    if (trimmed.length === 0 || trimmed.length > MAX_WORKER_OUTPUT_CHARS)
+        return [];
     const candidates = [trimmed];
     const fenced = /```(?:json)?\s*([\s\S]*?)```/.exec(trimmed);
     if (fenced?.[1])
         candidates.push(fenced[1].trim());
     candidates.push(...balancedObjectCandidates(trimmed));
+    const records = [];
     for (const candidate of candidates) {
-        let parsed;
         try {
-            parsed = JSON.parse(candidate);
+            const parsed = JSON.parse(candidate);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                records.push(parsed);
         }
         catch {
-            continue;
+            // Candidate extraction is deliberately best-effort; a later balanced candidate may still be valid.
         }
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            continue;
-        const record = parsed;
+    }
+    return records;
+}
+function isWorkerStatus(value) {
+    return value === "completed" || value === "blocked";
+}
+/**
+ * Plain-text fallback is for output that never attempted the worker claim envelope. A JSON object
+ * with a claim summary but malformed typed fields is a contract failure, never an implicit success.
+ */
+function hasMalformedWorkerClaimEnvelope(text) {
+    return workerOutputRecords(text).some((record) => {
+        if (typeof record.summary !== "string" || record.summary.trim().length === 0)
+            return false;
+        if (!isWorkerStatus(record.status))
+            return true;
+        if (record.verdict !== undefined && record.verdict !== "accepted" && record.verdict !== "rejected")
+            return true;
+        return (record.reasonCodes !== undefined &&
+            (!Array.isArray(record.reasonCodes) ||
+                record.reasonCodes.some((reasonCode) => typeof reasonCode !== "string" || reasonCode.trim().length === 0)));
+    });
+}
+export function parseWorkerOutput(text) {
+    for (const record of workerOutputRecords(text)) {
         const summary = record.summary;
         if (typeof summary !== "string" || summary.trim().length === 0)
             continue;
-        const status = record.status === "blocked" ? "blocked" : "completed";
+        if (!isWorkerStatus(record.status))
+            continue;
+        if (record.verdict !== undefined && record.verdict !== "accepted" && record.verdict !== "rejected")
+            continue;
+        if (record.reasonCodes !== undefined &&
+            (!Array.isArray(record.reasonCodes) ||
+                record.reasonCodes.some((reasonCode) => typeof reasonCode !== "string" || reasonCode.trim().length === 0))) {
+            continue;
+        }
+        const status = record.status;
         const blockers = Array.isArray(record.blockers)
-            ? record.blockers.filter((blocker) => typeof blocker === "string" && blocker.length > 0)
+            ? record.blockers
+                .filter((blocker) => typeof blocker === "string" && blocker.trim().length > 0)
+                .slice(0, MAX_WORKER_CLAIM_BLOCKERS)
+                .map((blocker) => blocker.trim().slice(0, MAX_WORKER_CLAIM_BLOCKER_CHARS))
             : [];
         const findings = [];
         if (Array.isArray(record.findings)) {
-            for (const item of record.findings) {
-                if (!item || typeof item !== "object" || Array.isArray(item))
-                    continue;
-                const findingSummary = item.summary;
-                if (typeof findingSummary !== "string" || findingSummary.trim().length === 0)
-                    continue;
-                const confidenceRaw = item.confidence;
-                const confidence = typeof confidenceRaw === "number" && Number.isFinite(confidenceRaw)
-                    ? Math.min(Math.max(confidenceRaw, 0), 1)
-                    : undefined;
-                findings.push({ summary: findingSummary.trim(), confidence });
+            for (let index = 0; index < record.findings.length && index < MAX_WORKER_FINDINGS; index++) {
+                const finding = normalizeEvidenceFinding(record.findings[index], MAX_WORKER_FINDING_CHARS);
+                if (finding)
+                    findings.push(finding);
             }
         }
         const verdict = record.verdict === "accepted" || record.verdict === "rejected" ? record.verdict : undefined;
         const reasonCodes = Array.isArray(record.reasonCodes)
-            ? record.reasonCodes.filter((reasonCode) => typeof reasonCode === "string" && reasonCode.length > 0)
+            ? record.reasonCodes
+                .filter((reasonCode) => typeof reasonCode === "string" && reasonCode.trim().length > 0)
+                .slice(0, MAX_WORKER_REASON_CODES)
+                .map((reasonCode) => reasonCode.trim().slice(0, MAX_WORKER_REASON_CODE_CHARS))
             : [];
+        const actionOutcome = parseWorkerActions(record.actions);
         return {
-            summary: summary.trim(),
+            summary: summary.trim().slice(0, MAX_WORKER_CLAIM_SUMMARY_CHARS),
             status,
             blockers,
             findings,
-            actions: parseWorkerActions(record.actions),
+            actions: actionOutcome.kind === "accepted" ? actionOutcome.actions : [],
+            ...(actionOutcome.kind === "rejected" ? { actionRejection: actionOutcome } : {}),
             ...(verdict ? { verdict } : {}),
             reasonCodes,
         };
@@ -171,22 +219,17 @@ function buildWorkerEvidence(request, findings) {
         title: "Delegated worker synthesis",
         trusted: false,
     };
-    const bundleFindings = findings.map((finding, index) => ({
-        id: `finding-${index + 1}`,
-        summary: finding.summary,
-        evidenceIds: [synthesisRef.id],
-        ...(finding.confidence !== undefined ? { confidence: finding.confidence } : {}),
-    }));
     return createEvidenceBundle({
         query: `worker:${request.id}`,
         sources: [instructionsRef, synthesisRef],
-        findings: bundleFindings,
+        findings: projectEvidenceFindings(findings, synthesisRef.id),
     });
 }
 function finishOutcome(args) {
-    const acceptance = validateWorkerClaim({ request: args.request, claim: args.claim, cwd: args.cwd });
+    const claim = normalizeWorkerClaimForHost(args.claim);
+    const acceptance = validateWorkerClaim({ request: args.request, claim, cwd: args.cwd });
     return {
-        claim: args.claim,
+        claim,
         acceptance,
         accepted: acceptance.outcome === "allow",
         laneStatus: args.laneStatus,
@@ -216,9 +259,13 @@ export async function runWorker(options) {
         }),
     });
     const costUsd = bounded.completion?.costUsd ?? 0;
-    const liveChangedFiles = [...new Set(options.getChangedFiles?.() ?? [])];
+    const liveChangedFilesReport = collectBoundedWorkerClaimChangedFiles(options.getChangedFiles?.() ?? []);
+    const liveChangedFiles = liveChangedFilesReport.values;
     if (bounded.failure) {
         const cancelled = bounded.failure.status === "canceled" || bounded.failure.status === "timeout";
+        const blockers = liveChangedFilesReport.overflowed
+            ? ["worker changed-file report exceeded the durable claim bound; parent review is required"]
+            : undefined;
         return finishOutcome({
             request: options.request,
             cwd: options.cwd,
@@ -227,6 +274,7 @@ export async function runWorker(options) {
                 changedFiles: liveChangedFiles,
                 status: cancelled ? "cancelled" : "failed",
                 summary: `Worker did not complete: ${bounded.failure.reasonCode}`,
+                ...(blockers ? { blockers } : {}),
             },
             laneStatus: bounded.failure.status,
             reasonCode: bounded.failure.reasonCode,
@@ -234,7 +282,15 @@ export async function runWorker(options) {
         });
     }
     const completion = bounded.completion;
-    const completionChangedFiles = [...new Set([...liveChangedFiles, ...(completion?.changedFiles ?? [])])];
+    const completionChangedFilesReport = collectBoundedWorkerClaimChangedFiles(completion?.changedFiles ?? []);
+    const mergedChangedFilesReport = collectBoundedWorkerClaimChangedFiles([
+        ...liveChangedFiles,
+        ...completionChangedFilesReport.values,
+    ]);
+    const changedFilesOverflowed = liveChangedFilesReport.overflowed ||
+        completionChangedFilesReport.overflowed ||
+        mergedChangedFilesReport.overflowed;
+    const completionChangedFiles = mergedChangedFilesReport.values;
     const completionBaseClaim = { ...baseClaim, changedFiles: completionChangedFiles };
     if (!completion || completion.stopReason === "error" || completion.stopReason === "aborted") {
         return finishOutcome({
@@ -248,16 +304,37 @@ export async function runWorker(options) {
     }
     const parsed = parseWorkerOutput(completion.text);
     if (!parsed) {
+        if (hasMalformedWorkerClaimEnvelope(completion.text)) {
+            return finishOutcome({
+                request: options.request,
+                cwd: options.cwd,
+                claim: {
+                    ...completionBaseClaim,
+                    status: "failed",
+                    summary: "Worker output used a malformed structured claim envelope.",
+                },
+                laneStatus: "failed",
+                reasonCode: "unparseable_output",
+                costUsd,
+            });
+        }
         const readOnlyPlainText = !options.verificationSubjectTaskId &&
             !writeCapable &&
             completion.text.trim().length > 0 &&
-            completionChangedFiles.length === 0;
+            completionChangedFiles.length === 0 &&
+            !changedFilesOverflowed;
         if (readOnlyPlainText) {
-            const completionBlockers = [...(completion.blockers ?? [])];
+            const completionBlockersReport = collectBoundedWorkerClaimBlockers(completion.blockers ?? []);
+            const completionBlockers = completionBlockersReport.overflowed
+                ? [
+                    ...completionBlockersReport.values.slice(0, Math.max(0, MAX_WORKER_CLAIM_BLOCKERS - 1)),
+                    "worker blocker report exceeded the durable claim bound; parent review is required",
+                ]
+                : completionBlockersReport.values;
             const incompleteNote = completion.stopReason === "stop"
                 ? ""
                 : `\n\n[Worker output ended with stop reason '${completion.stopReason}'; verify completeness.]`;
-            const summary = `${completion.text.trim().slice(0, Math.max(0, 8000 - incompleteNote.length))}${incompleteNote}`;
+            const summary = `${completion.text.trim().slice(0, Math.max(0, MAX_WORKER_CLAIM_SUMMARY_CHARS - incompleteNote.length))}${incompleteNote}`;
             const blocked = completionBlockers.length > 0;
             return finishOutcome({
                 request: options.request,
@@ -285,6 +362,13 @@ export async function runWorker(options) {
                 ...completionBaseClaim,
                 status: "failed",
                 summary: "Worker output was not valid structured JSON.",
+                ...(changedFilesOverflowed
+                    ? {
+                        blockers: [
+                            "worker changed-file report exceeded the durable claim bound; parent review is required",
+                        ],
+                    }
+                    : {}),
             },
             laneStatus: "failed",
             reasonCode: "unparseable_output",
@@ -292,6 +376,21 @@ export async function runWorker(options) {
         });
     }
     const evidence = buildWorkerEvidence(options.request, parsed.findings);
+    if (parsed.actionRejection) {
+        return finishOutcome({
+            request: options.request,
+            cwd: options.cwd,
+            claim: {
+                ...completionBaseClaim,
+                status: "failed",
+                summary: "Worker output contained invalid structured actions.",
+                blockers: [parsed.actionRejection.reasonCode],
+            },
+            laneStatus: "failed",
+            reasonCode: "unparseable_output",
+            costUsd,
+        });
+    }
     if (options.verificationSubjectTaskId && (!parsed.verdict || parsed.reasonCodes.length === 0)) {
         return finishOutcome({
             request: options.request,
@@ -307,7 +406,14 @@ export async function runWorker(options) {
         });
     }
     let changedFiles = [...completionChangedFiles];
-    const actionBlockers = [...(completion.blockers ?? [])];
+    const completionBlockersReport = collectBoundedWorkerClaimBlockers(completion.blockers ?? []);
+    const actionBlockers = [...completionBlockersReport.values];
+    if (changedFilesOverflowed) {
+        actionBlockers.push("worker changed-file report exceeded the durable claim bound; parent review is required");
+    }
+    if (completionBlockersReport.overflowed) {
+        actionBlockers.push("worker blocker report exceeded the durable claim bound; parent review is required");
+    }
     if (!writeCapable && completionChangedFiles.length > 0) {
         actionBlockers.push("worker reported file changes without a filesystem.write envelope grant");
     }
@@ -315,18 +421,35 @@ export async function runWorker(options) {
         // Runner-side application through the envelope path scope: refusals and failures are
         // surfaced as blockers so a partially-applied change can never look like clean success.
         const applied = options.applyActions(parsed.actions);
-        changedFiles = [...new Set([...changedFiles, ...applied.changedFiles])];
+        const appliedChangedFilesReport = collectBoundedWorkerClaimChangedFiles(applied.changedFiles);
+        const mergedAppliedChangedFilesReport = collectBoundedWorkerClaimChangedFiles([
+            ...changedFiles,
+            ...appliedChangedFilesReport.values,
+        ]);
+        changedFiles = mergedAppliedChangedFilesReport.values;
+        if (appliedChangedFilesReport.overflowed || mergedAppliedChangedFilesReport.overflowed) {
+            actionBlockers.push("applied changed-file report exceeded the durable claim bound; parent review is required");
+        }
         for (const refusal of applied.refused) {
             actionBlockers.push(`action refused (${refusal.path}): ${refusal.reason}`);
         }
         for (const failure of applied.failed) {
             actionBlockers.push(`action failed (${failure.path}): ${failure.reason}`);
         }
+        for (const inspection of applied.inspectionRequired) {
+            actionBlockers.push(`action requires workspace/evidence inspection (${inspection.path}, ${inspection.state}): ${inspection.reasonCode}`);
+        }
     }
     else if (!writeCapable && parsed.actions.length > 0) {
         actionBlockers.push("worker emitted file actions without a filesystem.write envelope grant; nothing was applied");
     }
-    const allBlockers = [...parsed.blockers, ...actionBlockers];
+    const allBlockersReport = collectBoundedWorkerClaimBlockers([...parsed.blockers, ...actionBlockers]);
+    const allBlockers = allBlockersReport.overflowed
+        ? [
+            ...allBlockersReport.values.slice(0, Math.max(0, MAX_WORKER_CLAIM_BLOCKERS - 1)),
+            "worker blocker report exceeded the durable claim bound; parent review is required",
+        ]
+        : allBlockersReport.values;
     const claim = {
         ...baseClaim,
         changedFiles,