@dsh-enhanced/assistant-delivery 0.1.32 → 0.1.34

package/lib/service.js

@@ -3,21 +3,23 @@ import { isAbsolute } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { Context, Service } from '@deepseek-ai/cordis';
 import Schema from '@deepseek-ai/schemastery';
-import { acceptanceCanonicalJson } from '@dsh-enhanced/task-acceptance-contract';
+import { acceptanceCanonicalJson, goalDefinitionSituation } from '@dsh-enhanced/task-acceptance-contract';
 import { approvalReviewerOf, isAutoReviewEscalation, } from '@dsh-enhanced/assistant-policy';
 import { TRUSTED_EVALUATION_PRODUCER_PROTOCOL, } from '@dsh-enhanced/assistant-evaluation';
 import { ASSISTANT_GROWTH_CONTRACT_VERSION, growthObjectDigest, validateResolvedWorkflowAutomationTemplate, validateWorkflowAutomationTemplate, validateWorkflowScope, validateWorkflowTraceProjectionReceipt, workflowArgumentShapeDigest, } from '@dsh-enhanced/assistant-growth-contract';
 import { DeliveryAdapterRegistry, DeliveryCoordinator, InboundCoordinator, } from './coordinator.js';
-import { DeliveryStore, DeliveryStoreError } from './store.js';
+import { DeliveryStore, DeliveryStoreError, } from './store.js';
 import { DshDeliveryRuntime } from './agent-runtime.js';
 import { DeliverySessionLeases } from './session-lease-runtime.js';
 import { NativeWebOwner } from './native-web-owner.js';
 import { validateOwnerGoalOutcomeFeedbackLocator, validateOwnerGoalOutcomeFeedbackProof, } from './goal-wake-types.js';
+import { isSynchronousForegroundObservationHandle, validForegroundObservationRegistration } from './foreground-observation.js';
 import { InboundImageMaterializer } from './inbound-images.js';
 import { registerDeliveryTools } from './tools.js';
 import { bindingMatchesOwnerRoute, canonicalBackgroundSourceId as canonicalHostBackgroundSourceId, canonicalConversation, canonicalLocalOperatorId, canonicalOwnerRouteAuthority, externalPrincipalId, ownerRouteAuthorityHash, ownerRouteBindingSnapshot, } from './canonical.js';
 import { isExactDeliveryCommand, parseDeliveryCommand } from './session-commands.js';
 import { deliveryT1PreferenceKeys, deliveryT1PreferenceValues } from './learning-command.js';
+import { assertReplyReplayAllowed, blockAgentRepliesForReplay as createReplyReplayBlock, } from './reply-replay.js';
 import { feedbackSignalInput, parseFeedbackCommand, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
 import { DELIVERY_PREFERENCE_PROJECTION_PROTOCOL, TRUSTED_DELIVERY_PRESENTATION_PRODUCER_PROTOCOL, } from './types.js';
 const trustedDeliveryPreferenceProducers = new WeakSet();
@@ -242,6 +244,23 @@ export class AssistantDeliveryError extends Error {
         this.name = 'AssistantDeliveryError';
     }
 }
+function isOwnerAnchoredGoalsCapability(value) {
+    return typeof value === 'object' && value !== null
+        && typeof value.inspectOwnerVerifiedWorkflowSource === 'function'
+        && typeof value.inspectOwnerGoalRunProof === 'function';
+}
+function isOwnerGoalSnapshotLocator(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const locator = value;
+    return Object.keys(locator).sort().join(',') === 'goalId,ownerRouteId,preset,principalId,sessionId,workspace'
+        && typeof locator['ownerRouteId'] === 'string' && locator['ownerRouteId'] !== ''
+        && typeof locator['principalId'] === 'string' && locator['principalId'] !== ''
+        && typeof locator['workspace'] === 'string' && locator['workspace'] !== ''
+        && typeof locator['preset'] === 'string' && locator['preset'] !== ''
+        && typeof locator['sessionId'] === 'string' && locator['sessionId'] !== ''
+        && typeof locator['goalId'] === 'string' && locator['goalId'] !== '';
+}
 const configSchema = Schema.object({
     databasePath: Schema.string().required(),
     spoolPath: Schema.string().required(),
@@ -524,6 +543,7 @@ export class AssistantDeliveryService extends Service {
     preferenceProducerGeneration = `assistant-delivery-preference:${randomUUID()}`;
     acceptanceProducerGeneration = `assistant-delivery-acceptance:${randomUUID()}`;
     acceptanceSink;
+    foregroundObserver;
     /** Once a live verifier required acceptance, loss of that verifier must not silently bypass it. */
     acceptanceRequired = false;
     preferenceTurns = new WeakMap();
@@ -651,6 +671,10 @@ export class AssistantDeliveryService extends Service {
                 maxTextBytes: config.maxTextBytes,
                 prepareForegroundTaskAcceptance: (binding, envelope) => this.prepareForegroundTaskAcceptance(binding, envelope),
                 completeForegroundTaskAcceptance: (handle, input) => this.completeForegroundTaskAcceptance(handle, input),
+                recordForegroundTaskModelSelection: (handle, input) => this.deliveryStore.recordForegroundTaskModelSelection({ contractId: handle.contractId, ...input }),
+                beginForegroundTaskExecution: (binding, envelope) => this.beginForegroundTaskExecution(binding, envelope),
+                recordForegroundExecutionModelSelection: (inboxId, input) => this.deliveryStore.recordForegroundExecutionModelSelection({ inboxId, ...input }),
+                completeForegroundTaskExecution: (inboxId, input) => this.completeForegroundTaskExecution(inboxId, input),
                 modelPickerTtlMs: config.modelPickerTtlMs,
                 permissionPickerTtlMs: config.permissionPickerTtlMs,
                 getModelSelection: conversation => this.deliveryStore.getModelSelection(conversation),
@@ -731,6 +755,7 @@ export class AssistantDeliveryService extends Service {
             trustedDeliveryPreferenceProducers.delete(this);
             this.preferenceFeedbackSink = undefined;
             this.acceptanceSink = undefined;
+            this.foregroundObserver = undefined;
             this.evaluationSink = undefined;
             this.workflowTraceSink = undefined;
             this.automationPresentationBinding?.dispose();
@@ -1344,7 +1369,7 @@ export class AssistantDeliveryService extends Service {
         if (Buffer.byteLength(rendered, 'utf8') > this.config.maxTextBytes) {
             throw new AssistantDeliveryError('runtime-conflict', 'scheduled goal result exceeds the delivery text limit');
         }
-        const situation = `goal:${locator.goalId}:definition:${proof.goal.definitionVersion}`;
+        const situation = goalDefinitionSituation(proof.goal.definitionDigest);
         return this.deliveryStore.enqueueGoalOutcomeTarget({
             locator, proof,
             intent: {
@@ -1353,7 +1378,7 @@ export class AssistantDeliveryService extends Service {
                 target: { conversation: finalBinding.conversation, principal: finalBinding.principal },
                 text: rendered, format: 'markdown',
                 metadata: Object.freeze({
-                    'dsh.learning.schemaVersion': '3', 'dsh.learning.kind': 'goal-outcome',
+                    'dsh.learning.schemaVersion': '4', 'dsh.learning.kind': 'goal-outcome',
                     'dsh.learning.goalId': locator.goalId, 'dsh.learning.assessmentId': locator.assessmentId,
                     'dsh.learning.runId': proof.runId, 'dsh.learning.situation': situation,
                     'dsh.learning.occurredAt': String(proof.receipt.completedAt),
@@ -1475,6 +1500,91 @@ export class AssistantDeliveryService extends Service {
                 this.acceptanceSink = undefined;
         };
     }
+    beginForegroundTaskExecution(binding, envelope) {
+        const owner = this.ownerLineageForBinding(binding);
+        if (owner === undefined)
+            return undefined;
+        const inbox = this.deliveryStore.getInboxByProviderEvent(envelope.channel, envelope.account, envelope.eventId);
+        if (!inbox || inbox.status !== 'claimed' || inbox.bindingId !== binding.id
+            || JSON.stringify(inbox.envelope) !== JSON.stringify(envelope)) {
+            throw new AssistantDeliveryError('missing-binding', 'foreground execution lacks an authenticated owner inbox');
+        }
+        const dispatchedAt = Date.now();
+        this.deliveryStore.bindForegroundTaskExecution({ inboxId: inbox.id,
+            scope: { workspace: binding.workspace, preset: binding.agentPreset }, owner, binding, dispatchedAt });
+        this.observeForegroundBegin(Object.freeze({ protocol: 'assistant-delivery/foreground-task/v1', inboxId: inbox.id,
+            sessionId: binding.sessionId, scope: Object.freeze({ workspace: binding.workspace, preset: binding.agentPreset }),
+            owner: Object.freeze({ principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion }),
+            binding: Object.freeze({ id: binding.id, version: binding.version, generation: binding.generation }), dispatchedAt }));
+        return inbox.id;
+    }
+    registerForegroundTaskObserver(registration) {
+        this.assertActive();
+        const control = this.context.get('pluginControlPlane', false);
+        if (!validForegroundObservationRegistration(registration) || control === undefined
+            || control.ownsForegroundTaskObservationRegistration?.(registration) !== true) {
+            throw new AssistantDeliveryError('runtime-conflict', 'foreground observation registration is invalid');
+        }
+        if (this.foregroundObserver !== undefined)
+            throw new AssistantDeliveryError('runtime-conflict', 'foreground observer is already registered');
+        const token = Symbol('assistant-delivery.foreground-observer');
+        const sink = Object.freeze({ token, generation: registration.generation, registration,
+            handles: new Map() });
+        this.foregroundObserver = sink;
+        let live = true;
+        return () => { if (live) {
+            live = false;
+            if (this.foregroundObserver?.token === token)
+                this.foregroundObserver = undefined;
+        } };
+    }
+    observerCurrent(sink) {
+        const control = this.context.get('pluginControlPlane', false);
+        return this.active && this.foregroundObserver?.token === sink.token
+            && control?.ownsForegroundTaskObservationRegistration?.(sink.registration) === true
+            && sink.generation === sink.registration.generation;
+    }
+    observeForegroundBegin(task) {
+        const sink = this.foregroundObserver;
+        if (sink === undefined || !this.observerCurrent(sink) || sink.handles.size >= Math.max(16, this.config.maxConcurrency * 4))
+            return;
+        try {
+            const handle = sink.registration.begin(task);
+            if (!isSynchronousForegroundObservationHandle(handle)) {
+                void Promise.resolve(handle).catch(error => this.context.logger.warn(`assistant-delivery: foreground observer begin must be synchronous: ${String(error)}`));
+                return;
+            }
+            if (!this.observerCurrent(sink))
+                return;
+            sink.handles.set(task.inboxId, { task, handle });
+        }
+        catch (error) {
+            this.context.logger.warn(`assistant-delivery: foreground observer begin failed: ${String(error)}`);
+        }
+    }
+    completeForegroundTaskExecution(inboxId, input) {
+        this.deliveryStore.finishForegroundTaskExecution({ inboxId, ...input, completedAt: Date.now() });
+        const sink = this.foregroundObserver;
+        const observed = sink?.handles.get(inboxId);
+        if (sink === undefined || observed === undefined)
+            return;
+        sink.handles.delete(inboxId);
+        if (!this.observerCurrent(sink))
+            return;
+        const actual = this.deliveryStore.inspectForegroundExecutionForOwner({ inboxId, scope: observed.task.scope, owner: observed.task.owner,
+            bindingId: observed.task.binding.id, bindingVersion: observed.task.binding.version, bindingGeneration: observed.task.binding.generation });
+        if (actual === null)
+            return;
+        try {
+            const result = sink.registration.completed(observed.handle, observed.task, actual);
+            if (!isSynchronousForegroundObservationHandle(result)) {
+                void Promise.resolve(result).catch(error => this.context.logger.warn(`assistant-delivery: foreground observer completion must be synchronous: ${String(error)}`));
+            }
+        }
+        catch (error) {
+            this.context.logger.warn(`assistant-delivery: foreground observer completion failed: ${String(error)}`);
+        }
+    }
     prepareForegroundTaskAcceptance(binding, envelope) {
         const sink = this.acceptanceSink;
         if (sink === undefined) {
@@ -1979,6 +2089,106 @@ export class AssistantDeliveryService extends Service {
         }
         return route;
     }
+    /**
+     * Host-only owner-anchored workflow learning bridge. This method is not
+     * registered as an Agent tool (same Host seam as prepareWorkflowApproval):
+     * only the opt-in growth driver invokes it, and only with a locator plus one
+     * bounded-wake authority. Delivery itself re-fetches both the verified Goals
+     * source and the owner-run-trace proof, so the caller can never supply the
+     * objective, steps, acceptance verdict or proof digest — a spoofed driver
+     * learns nothing. A goal that does not honestly reduce to the single
+     * no-tool `assistant.agent-turn` step is returned as `abstained` with zero
+     * writes; the trace is projected through the existing outbox/drain chain.
+     */
+    async commitOwnerAnchoredWorkflowTrace(input) {
+        this.assertActive();
+        if (typeof input !== 'object' || input === null
+            || !isOwnerGoalSnapshotLocator(input.locator)
+            || typeof input.authority !== 'object' || input.authority === null
+            || typeof input.authority.assertCurrent !== 'function') {
+            throw new AssistantDeliveryError('runtime-conflict', 'owner-anchored workflow commit request is invalid');
+        }
+        const { locator, authority } = input;
+        authority.assertCurrent();
+        if (authority.ownerRouteId !== locator.ownerRouteId
+            || authority.scope.principalId !== locator.principalId
+            || authority.scope.workspace !== locator.workspace
+            || authority.scope.preset !== locator.preset) {
+            throw new AssistantDeliveryError('policy-denied', 'owner-anchored workflow authority scope does not match its locator');
+        }
+        const goals = this.ctx.get('assistantGoals', false);
+        if (!isOwnerAnchoredGoalsCapability(goals)) {
+            throw new AssistantDeliveryError('runtime-unavailable', 'owner-anchored workflow goals evidence is unavailable');
+        }
+        let source;
+        try {
+            source = await goals.inspectOwnerVerifiedWorkflowSource(locator);
+        }
+        catch (error) {
+            if (error?.code === 'unavailable') {
+                throw new AssistantDeliveryError('runtime-unavailable', 'owner-anchored workflow goals observation is unavailable');
+            }
+            throw new AssistantDeliveryError('missing-binding', 'owner-anchored workflow verified source is not available');
+        }
+        let proof;
+        try {
+            proof = await goals.inspectOwnerGoalRunProof({ ...locator, runId: source.runId });
+        }
+        catch (error) {
+            if (/unavailable/u.test(error instanceof Error ? error.message : '')) {
+                throw new AssistantDeliveryError('runtime-unavailable', 'owner-anchored workflow run proof is unavailable');
+            }
+            throw new AssistantDeliveryError('missing-binding', 'owner-anchored workflow run proof is not available');
+        }
+        // Re-anchor after every await: the bounded-wake authority and the live
+        // owner route must still be the same generation the driver was minted for.
+        authority.assertCurrent();
+        const route = this.resolveOwnerRoute(locator.ownerRouteId);
+        if (externalPrincipalId(route.binding.principal) !== locator.principalId
+            || route.binding.workspace !== locator.workspace
+            || route.binding.agentPreset !== locator.preset) {
+            throw new AssistantDeliveryError('missing-binding', 'owner-anchored workflow locator does not match the live owner route');
+        }
+        const failedObservations = source.failedObservations ?? [];
+        const proofSucceeded = proof.steps.filter(step => step.outcome === 'succeeded');
+        const proofFailed = proof.steps.filter(step => step.outcome === 'failed');
+        // The reduction decision below must cover exactly the settled calls the
+        // trusted run-proof digest covers; a mismatch fails closed.
+        if (source.scope.principalId !== locator.principalId
+            || source.scope.workspace !== locator.workspace || source.scope.preset !== locator.preset
+            || source.goal.id !== locator.goalId || source.goal.sessionId !== locator.sessionId
+            || proof.runId !== source.runId || proof.turn !== source.turn
+            || proof.definitionDigest !== source.goal.definition.digest
+            || !/^[a-f0-9]{64}$/u.test(proof.traceDigest)
+            || proofSucceeded.length !== source.steps.length
+            || proofFailed.length !== failedObservations.length
+            || JSON.stringify(proofSucceeded.map(step => `${step.id}:${step.name}`).sort())
+                !== JSON.stringify(source.steps.map(step => `${step.id}:${step.toolName}`).sort())
+            || JSON.stringify(proofFailed.map(step => step.id).sort())
+                !== JSON.stringify(failedObservations.map(step => step.id).sort())) {
+            throw new AssistantDeliveryError('missing-binding', 'owner-anchored workflow evidence does not match its locator');
+        }
+        const committed = this.deliveryStore.commitOwnerAnchoredWorkflowTrace({
+            binding: route.binding,
+            ownerRouteId: route.authorityId,
+            scope: { workspace: locator.workspace, preset: locator.preset },
+            goal: source.goal,
+            runId: source.runId,
+            turn: source.turn,
+            acceptance: {
+                contractId: source.acceptance.contractId,
+                receiptDigest: source.acceptance.receiptDigest,
+                verifiedAt: source.acceptance.verifiedAt,
+                validUntil: source.acceptance.validUntil,
+            },
+            steps: source.steps.map(step => Object.freeze({ id: step.id, toolName: step.toolName })),
+            ...(failedObservations.length === 0 ? {} : { failedObservations }),
+            ownerRunTraceDigest: proof.traceDigest,
+        });
+        if (committed.outcome === 'trace-recorded')
+            await this.drainWorkflowTraces();
+        return committed;
+    }
     /**
      * Host-only, content-free route minting seam for Preference promotion.
      * No binding id is accepted from the caller; Delivery resolves the unique
@@ -2635,12 +2845,11 @@ export class AssistantDeliveryService extends Service {
                 return 'invalid-target';
             return await this.dispatchGoalOutcomeFeedback(binding, inbox, target, parsed, goalOutcomeTarget);
         }
-        // Ordinary Agent replies have no learning metadata.  They are eligible
-        // only for Delivery's local, atomic verified-workflow receipt; the Store
-        // rebuilds the full Inbox/Outbox fence and abstains unless the source text
-        // selects a closed deterministic-deidentification template.  Do not route
-        // these judgements through Evaluation: they are task proof for workflow
-        // repetition, not a cross-plugin quality vote.
+        // Ordinary Agent replies have no learning metadata. A completed Host
+        // execution permits an authenticated owner revision in Evaluation. The
+        // separate local workflow path rebuilds its Inbox/Outbox fence and abstains
+        // unless the source selects a closed deterministic-deidentification template;
+        // legacy replies without an execution receipt retain that local path.
         if (metadata?.['dsh.learning.kind'] !== 'automation-run') {
             const sourceEventId = target.intent.replyToEventId;
             if (typeof sourceEventId !== 'string')
@@ -2655,7 +2864,17 @@ export class AssistantDeliveryService extends Service {
                 owner: lineage,
                 bindingId: binding.id,
             });
-            const canonicalForeground = accepted !== null;
+            const foreground = lineage === undefined ? null : this.deliveryStore.inspectForegroundExecutionForOwner({
+                inboxId: sourceInbox.id, scope: { workspace: binding.workspace, preset: binding.agentPreset },
+                owner: lineage, bindingId: binding.id, bindingVersion: binding.version, bindingGeneration: binding.generation,
+            });
+            // The owner labels the objective, not whether Host work has stopped.
+            // Do not let Evaluation's delivery producer turn an unknown execution
+            // into a succeeded one merely because its reply reached the user.
+            if ([foreground, accepted].some(execution => execution !== null
+                && (execution.status !== 'succeeded' || !execution.quiescent)))
+                return 'invalid-target';
+            const canonicalForeground = foreground !== null || accepted !== null;
             const projectForegroundOwner = async (inspectOnly) => {
                 const sink = this.evaluationSink;
                 if (sink === undefined || lineage === undefined)
@@ -2707,7 +2926,7 @@ export class AssistantDeliveryService extends Service {
             if (canonicalForeground && this.evaluationSink === undefined)
                 return 'unavailable';
             try {
-                // Evaluation commits first for accepted foreground tasks. If the sink
+                // Evaluation commits first for recorded foreground tasks. If the sink
                 // is unavailable, never acknowledge a Delivery-only success; a replay
                 // can safely repeat the opaque command and then repair local workflow
                 // evidence after the canonical owner revision is durable.
@@ -2855,8 +3074,8 @@ export class AssistantDeliveryService extends Service {
         const metadata = target.intent.metadata;
         const locator = durable.locator;
         const immutableProof = durable.proof;
-        const situation = `goal:${locator.goalId}:definition:${immutableProof.goal.definitionVersion}`;
-        if (metadata?.['dsh.learning.schemaVersion'] !== '3'
+        const situation = goalDefinitionSituation(immutableProof.goal.definitionDigest);
+        if (metadata?.['dsh.learning.schemaVersion'] !== '4'
             || metadata['dsh.learning.kind'] !== 'goal-outcome'
             || metadata['dsh.learning.goalId'] !== locator.goalId
             || metadata['dsh.learning.assessmentId'] !== locator.assessmentId
@@ -3143,38 +3362,14 @@ export class AssistantDeliveryService extends Service {
             return reviewer === 'auto-review' ? next() : 'unavailable';
         if (initialRoute.state !== 'bound')
             return 'unavailable';
-        if (signalAborted(request.signal))
-            return 'cancelled';
-        let authority;
-        try {
-            authority = this.resolveToolApprovalAuthority(ctx, request);
-        }
-        catch {
-            return 'unavailable';
-        }
-        if (authority === undefined || authority.binding.id !== initialRoute.binding.id)
-            return 'unavailable';
-        const sessions = ctx.get('sessions');
-        if (sessions === undefined)
-            return 'unavailable';
-        try {
-            if (!await sessions.flush(request.agent.session))
-                return 'unavailable';
-        }
-        catch {
-            return 'unavailable';
-        }
-        if (signalAborted(request.signal))
-            return 'cancelled';
-        let persisted;
-        try {
-            persisted = this.resolveToolApprovalAuthority(ctx, request);
-        }
-        catch {
-            return 'unavailable';
-        }
-        if (!sameToolApprovalAuthority(authority, persisted))
-            return 'unavailable';
+        // The TTL controller is installed BEFORE every pre-card wait, not just
+        // before the adapter call. resolveToolApprovalAuthority is synchronous, but
+        // the durability `sessions.flush()` between the two authority reads has no
+        // cancellation of its own: a stuck flush listener used to hang the whole
+        // approval waterfall for hours with no card dispatched and no expiry (real
+        // headless-Lark observation). Everything from here on is bounded by the
+        // same fail-closed deadline; abort races resolve 'cancelled' only when the
+        // owning request itself was aborted, otherwise 'unavailable'.
         const operationId = `tool-approval:${randomUUID()}`;
         const expiresAt = Date.now() + this.config.toolApprovalTtlMs;
         const controller = new AbortController();
@@ -3184,7 +3379,11 @@ export class AssistantDeliveryService extends Service {
             controller.abort(request.signal?.reason);
         };
         request.signal?.addEventListener('abort', onRequestAbort, { once: true });
-        const aborted = new Promise(resolve => {
+        if (signalAborted(request.signal)) {
+            request.signal?.removeEventListener('abort', onRequestAbort);
+            return 'cancelled';
+        }
+        const deadlineAbort = new Promise(resolve => {
             controller.signal.addEventListener('abort', () => {
                 resolve(requestCancelled ? 'cancelled' : 'unavailable');
             }, { once: true });
@@ -3194,26 +3393,69 @@ export class AssistantDeliveryService extends Service {
         }, this.config.toolApprovalTtlMs);
         timeout.unref?.();
         this.toolApprovalControllers.add(controller);
-        const adapterRequest = Object.freeze({
-            operationId,
-            bindingId: authority.binding.id,
-            target: Object.freeze({
-                conversation: Object.freeze({ ...authority.binding.conversation }),
-                principal: Object.freeze({ ...authority.binding.principal }),
-            }),
-            expiresAt,
-            actionHash: authority.actionHash,
-            toolName: request.toolName,
-            callId: authority.callId,
-            ...(request.reason === undefined ? {} : { reason: request.reason }),
-            arguments: authority.arguments,
-        });
         let outcome;
+        // Declared outside the try block: the post-race authority re-check below
+        // must compare against the exact authority that dispatched the card.
+        let authority;
         try {
+            const preCard = await Promise.race([
+                (async () => {
+                    let authority;
+                    try {
+                        authority = this.resolveToolApprovalAuthority(ctx, request);
+                    }
+                    catch {
+                        return 'unavailable';
+                    }
+                    if (authority === undefined || authority.binding.id !== initialRoute.binding.id)
+                        return 'unavailable';
+                    const sessions = ctx.get('sessions');
+                    if (sessions === undefined)
+                        return 'unavailable';
+                    try {
+                        if (!await sessions.flush(request.agent.session))
+                            return 'unavailable';
+                    }
+                    catch {
+                        return 'unavailable';
+                    }
+                    if (signalAborted(request.signal))
+                        return 'cancelled';
+                    let persisted;
+                    try {
+                        persisted = this.resolveToolApprovalAuthority(ctx, request);
+                    }
+                    catch {
+                        return 'unavailable';
+                    }
+                    if (!sameToolApprovalAuthority(authority, persisted))
+                        return 'unavailable';
+                    return authority;
+                })(),
+                deadlineAbort,
+            ]);
+            if (typeof preCard === 'string')
+                return preCard;
+            const granted = preCard;
+            authority = granted;
+            const adapterRequest = Object.freeze({
+                operationId,
+                bindingId: granted.binding.id,
+                target: Object.freeze({
+                    conversation: Object.freeze({ ...granted.binding.conversation }),
+                    principal: Object.freeze({ ...granted.binding.principal }),
+                }),
+                expiresAt,
+                actionHash: granted.actionHash,
+                toolName: request.toolName,
+                callId: granted.callId,
+                ...(request.reason === undefined ? {} : { reason: request.reason }),
+                arguments: granted.arguments,
+            });
             const answer = Promise.resolve()
-                .then(() => authority.adapter.requestToolApproval(adapterRequest, controller.signal))
+                .then(() => granted.adapter.requestToolApproval(adapterRequest, controller.signal))
                 .then(value => value, () => 'unavailable');
-            outcome = await Promise.race([answer, aborted]);
+            outcome = await Promise.race([answer, deadlineAbort]);
         }
         finally {
             clearTimeout(timeout);
@@ -3231,7 +3473,7 @@ export class AssistantDeliveryService extends Service {
         catch {
             return 'unavailable';
         }
-        if (current === undefined || !sameToolApprovalAuthority(authority, current))
+        if (authority === undefined || current === undefined || !sameToolApprovalAuthority(authority, current))
             return 'unavailable';
         if (outcome === 'allowed-once') {
             try {
@@ -3655,6 +3897,123 @@ export class AssistantDeliveryService extends Service {
             generation: resolved.snapshot.generation,
         });
     }
+    /** Host-only snapshot of the model selected for this owner's external conversation. */
+    inspectOwnerModelSelection(input) {
+        this.validateOwnerRoute(input);
+        const { binding } = this.resolveOwnerRoute(input.authorityId);
+        if (input.sourceAgent !== undefined) {
+            const session = input.sourceAgent.session;
+            if (String(session.id) !== binding.sessionId || session.header.cwd !== binding.workspace
+                || session.header.agentPreset !== binding.agentPreset) {
+                throw new AssistantDeliveryError('missing-binding', 'growth source session does not match the owner route');
+            }
+            // Request headers reflect native model-selection hooks; agent.options
+            // can still contain the initial route after the user changes models.
+            const request = session.snapshotEvents().findLast(event => event.type === 'request/header');
+            const selected = request?.type === 'request/header' ? request.data.header.config : undefined;
+            if (!selected?.provider || !selected.model) {
+                throw new AssistantDeliveryError('missing-binding', 'growth source session has no resolved model request');
+            }
+            return Object.freeze({ provider: selected.provider, model: selected.model,
+                ...(selected.reasoningEffort === undefined ? {} : { reasoningEffort: selected.reasoningEffort }) });
+        }
+        // Native Web sessions own their model selection in DSH, not this external
+        // conversation ledger. Never substitute Delivery defaults for those sessions.
+        if (binding.conversation.channel === 'web') {
+            throw new AssistantDeliveryError('missing-binding', 'native Web model selection requires a source session');
+        }
+        const selected = this.deliveryStore.getModelSelection(binding.conversation)
+            ?? { provider: this.config.agentProvider, model: this.config.agentModel };
+        return Object.freeze({ provider: selected.provider, model: selected.model,
+            ...(selected.reasoningEffort === undefined ? {} : { reasoningEffort: selected.reasoningEffort }) });
+    }
+    /**
+     * Resolve one canonical foreground result against its actual owner lineage.
+     * Evaluation's workspace/preset scope alone does not establish ownership.
+     * Historical Sessions remain eligible after /new, but not after owner ABA.
+     */
+    inspectOwnerForegroundLearningTask(input) {
+        this.assertActive();
+        const routeInput = { authorityId: input.authorityId, principalId: input.principalId,
+            workspace: input.workspace, agentPreset: input.agentPreset };
+        const owner = this.validateOwnerRoute(routeInput);
+        const evaluation = this.context.get('assistantEvaluation', false);
+        if (!evaluation || typeof evaluation.inspectTrustedTaskOwnerRevision !== 'function')
+            return undefined;
+        const scope = evaluation.canonicalHostScope({ workspace: owner.workspace, preset: owner.agentPreset });
+        const canonical = evaluation.getTrustedTaskLearningProjection({ scope, outcomeId: input.outcomeId });
+        if (!canonical || canonical.projection.subjectKind !== 'foreground-turn')
+            return undefined;
+        const inbox = this.deliveryStore.getInbox(canonical.projection.subjectRef);
+        const binding = inbox?.bindingId === undefined ? undefined : this.deliveryStore.getBinding(inbox.bindingId);
+        if (!inbox || !binding || binding.workspace !== owner.workspace || binding.agentPreset !== owner.agentPreset
+            || externalPrincipalId(binding.principal) !== owner.principalId
+            || JSON.stringify(inbox.envelope.principal) !== JSON.stringify(binding.principal)
+            || JSON.stringify(inbox.envelope.conversation) !== JSON.stringify(binding.conversation))
+            return undefined;
+        const accepted = this.deliveryStore.inspectForegroundAcceptedExecutionForOwner({ inboxId: inbox.id,
+            scope: { workspace: owner.workspace, preset: owner.agentPreset }, bindingId: binding.id,
+            owner: { principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion } });
+        const execution = this.deliveryStore.inspectForegroundExecutionForOwner({ inboxId: inbox.id,
+            scope: { workspace: owner.workspace, preset: owner.agentPreset }, bindingId: binding.id,
+            bindingVersion: binding.version, bindingGeneration: binding.generation,
+            owner: { principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion } }) ?? accepted;
+        if (execution === null)
+            return undefined;
+        const verifierComponent = (component) => accepted !== null && component.source.kind === 'evaluator' && component.source.id === 'assistant-verifier'
+            && component.evaluator.id === 'assistant-verifier' && component.evaluator.version === '1'
+            && component.evidence.some(ref => ref.kind === 'foreground-turn' && ref.ref === inbox.id)
+            && component.evidence.some(ref => ref.kind === 'execution' && ref.ref === accepted.executionRef)
+            && component.evidence.some(ref => ref.kind === 'acceptance-contract'
+                && ref.ref === accepted.contractId && ref.digest === accepted.contractDigest);
+        if (canonical.execution !== undefined && (!verifierComponent(canonical.execution)
+            || canonical.execution.status !== accepted?.status))
+            return undefined;
+        let judgement = 'unresolved';
+        let ownerRevision;
+        const objective = canonical.objective;
+        if (objective?.source.kind === 'user-feedback') {
+            if (objective.source.id !== 'assistant-delivery/typed-owner-feedback')
+                return undefined;
+            const revision = evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId: input.outcomeId,
+                principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+            if (!revision || revision.outcomeId !== objective.outcomeId || revision.objectiveStatus !== objective.status)
+                return undefined;
+            const outboxRefs = objective.evidence.filter(ref => ref.kind === 'delivery-outbox');
+            if (outboxRefs.length !== 1)
+                return undefined;
+            const outbox = this.deliveryStore.getOutbox(outboxRefs[0].ref);
+            if (!outbox || outbox.intent.bindingId !== binding.id
+                || outbox.intent.idempotencyKey !== `inbound:${inbox.id}:reply`
+                || outbox.intent.replyToEventId !== inbox.envelope.eventId
+                || JSON.stringify(outbox.intent.target.principal) !== JSON.stringify(binding.principal)
+                || JSON.stringify(outbox.intent.target.conversation) !== JSON.stringify(binding.conversation)
+                || !['accepted', 'delivered', 'read'].includes(outbox.status))
+                return undefined;
+            judgement = 'owner-feedback';
+            ownerRevision = Object.freeze({ version: revision.version, action: revision.action });
+        }
+        else if (objective !== undefined) {
+            if (!verifierComponent(objective))
+                return undefined;
+            judgement = 'independent-verifier';
+        }
+        // Generic execution receipts establish task provenance, never goal success.
+        // Without an acceptance contract, only authenticated typed owner feedback
+        // may turn a completed ordinary conversation into a learning source.
+        if (accepted === null && judgement !== 'owner-feedback')
+            return undefined;
+        // Fence cross-ledger reads before handing any task text to the consumer.
+        if (!evaluation.isTrustedTaskLearningProjectionReceipt(canonical)
+            || acceptanceCanonicalJson(owner) !== acceptanceCanonicalJson(this.validateOwnerRoute(routeInput)))
+            return undefined;
+        const objectiveText = inbox.envelope.text;
+        return Object.freeze({ protocol: 'assistant-delivery/owner-foreground-learning/v1', owner, canonical, judgement,
+            ...(ownerRevision === undefined ? {} : { ownerRevision }),
+            source: Object.freeze({ sessionId: binding.sessionId, inboxId: inbox.id,
+                objective: objectiveText.slice(0, 4096), truncated: objectiveText.length > 4096, quiescent: execution.quiescent,
+                modelSelectionState: execution.modelSelectionState, ...(execution.modelSelection === undefined ? {} : { modelSelection: execution.modelSelection }) }) });
+    }
     /**
      * Enqueue against a stable Host-owned route rather than a session binding.
      * Policy is evaluated against the exact `route:<authorityId>` resource. The
@@ -3794,6 +4153,11 @@ export class AssistantDeliveryService extends Service {
         const prepared = this.prepareAgentReply(agent, input);
         return this.deliveryStore.enqueue(prepared.intent);
     }
+    /** Host-only replay boundary. The returned tombstone fences this exact Agent object permanently. */
+    blockAgentRepliesForReplay(agent, config) {
+        this.assertActive();
+        return createReplyReplayBlock(agent, config);
+    }
     async replyCompletedPreferenceTurn(agent, expectedBinding, envelope, input) {
         const prepared = this.prepareAgentReply(agent, {
             idempotencyKey: `inbound:${envelope.eventId}:reply`,
@@ -3818,6 +4182,7 @@ export class AssistantDeliveryService extends Service {
         return projected ? 'recorded' : 'unavailable';
     }
     prepareAgentReply(agent, input) {
+        assertReplyReplayAllowed(agent, input);
         this.assertActive();
         const binding = agent === undefined ? undefined : this.deliveryStore.getBindingBySession(String(agent.session.id));
         if (agent === undefined || binding === undefined || binding.status !== 'active'