@dsh-enhanced/assistant-goals 0.1.67 → 0.1.70

package/lib/service.js

@@ -17,11 +17,17 @@ import { buildGoalStrategyHistory } from './strategy-feedback.js';
 import { failureSummaryEvidenceDigest, OwnerVerifiedWorkflowSourceError, ownerGoalRunProof, verifiedWorkflowSource, verifiedWorkflowSourceChain } from './verified-workflow.js';
 import { buildOwnerAcceptedStepArtifacts, buildOwnerVerifiedArtifacts, validateOwnerVerifiedArtifactsInput } from './verified-artifact.js';
 import { assertGoalDependenciesAchieved, goalDependencies } from './dependency.js';
+import { buildGoalOwnerIntent, ownerIntentObjectiveSpan } from './owner-intent.js';
+import { GoalOwnerIntentStore, goalOwnerIntentSupplier } from './owner-intent-store.js';
+import { validateOwnerAcceptanceSeal, validateOwnerPreparedAcceptanceInput, resolveOwnerPreparedAcceptanceInput, preparedRegistration } from './owner-acceptance.js';
+import { GoalOwnerAcceptanceStore } from './owner-acceptance-store.js';
 export const Config = Schema.object({
     databasePath: Schema.string().default(join(homedir(), '.dsh', 'assistant-goals.sqlite')),
     preauthorizedCreateMaxRounds: Schema.number().step(1).min(0).max(32).default(0),
     preauthorizedSchedule: Schema.boolean().default(false),
     eventWaits: Schema.boolean().default(false),
+    ownerIntent: Schema.boolean().default(false),
+    ownerPreparedAcceptance: Schema.boolean().default(false),
     maxContextChars: Schema.number().step(1).min(1024).max(65536).default(12000),
     verifyNativeRounds: Schema.boolean().default(false),
     verifyGoalOutcome: Schema.boolean().default(false),
@@ -280,6 +286,7 @@ export class AssistantGoalsService extends Service {
     #active = true;
     #maxChars;
     #createMaxRounds;
+    #stepMaxDurationMs = 60_000;
     #preauthorizedSchedule = false;
     preauthorizedCreateEnabled;
     preauthorizedScheduleEnabled;
@@ -291,8 +298,17 @@ export class AssistantGoalsService extends Service {
     #wake;
     #outcome;
     #eventWait;
+    /** Set only when owner intent freezing is enabled; every Goal still needs its own frozen proof. */
+    #ownerIntent;
+    /** Set only when Host-prepared owner acceptance is enabled; every goal needs its own seal. */
+    #ownerAcceptance;
+    /** The current Host producer registration; seal requests are rejected without it. */
+    #acceptanceRegistration;
+    /** Native create emits goal/changed synchronously; this marker defers legacy binding. */
+    #preparingPreparedCreation = false;
     #ownerRepairBindings = new Map();
     eventWaitsEnabled;
+    ownerAcceptanceEnabled;
     #ownerGoalOutcomeFeedbackTargets = new WeakMap();
     constructor(ctx, input = {}) {
         super(ctx, 'assistantGoals');
@@ -308,6 +324,7 @@ export class AssistantGoalsService extends Service {
         const duration = input.stepMaxDurationMs ?? 60000;
         if (!Number.isSafeInteger(duration) || duration < 1 || duration > 300000 || (input.verifyNativeRounds !== undefined && typeof input.verifyNativeRounds !== 'boolean'))
             throw new Error('assistant-goals: invalid execution limits');
+        this.#stepMaxDurationMs = duration;
         const budget = input.executionBudget === undefined ? undefined : validateGoalBudgetConfig(input.executionBudget);
         if (budget !== undefined && input.verifyNativeRounds !== true)
             throw new Error('assistant-goals: execution budget requires verified native rounds');
@@ -334,9 +351,49 @@ export class AssistantGoalsService extends Service {
         Object.defineProperty(this, 'eventWaitsEnabled', { value: input.eventWaits === true, enumerable: true, writable: false, configurable: false });
         if (this.eventWaitsEnabled && (wake === undefined || budget === undefined || path === ':memory:' || input.verifyGoalOutcome !== true))
             throw new Error('assistant-goals: event waits require durable wake, budgets and verified outcomes');
+        if (input.ownerIntent !== undefined && typeof input.ownerIntent !== 'boolean')
+            throw new Error('assistant-goals: ownerIntent must be boolean');
+        const ownerIntent = input.ownerIntent === true;
+        // The side ledger must be a durable private file: an in-memory goal database
+        // cannot prove its intent ledger survived the exact owner request.
+        if (ownerIntent && path === ':memory:')
+            throw new Error('assistant-goals: owner intent requires a durable private database file');
+        if (input.ownerPreparedAcceptance !== undefined && typeof input.ownerPreparedAcceptance !== 'boolean')
+            throw new Error('assistant-goals: ownerPreparedAcceptance must be boolean');
+        const ownerPreparedAcceptance = input.ownerPreparedAcceptance === true;
+        if (ownerPreparedAcceptance && path === ':memory:')
+            throw new Error('assistant-goals: owner prepared acceptance requires a durable private database file');
+        Object.defineProperty(this, 'ownerAcceptanceEnabled', { value: ownerPreparedAcceptance, enumerable: true, writable: false, configurable: false });
         this.#store = new GoalStore(path);
-        ctx.effect(() => () => { this.#active = false; for (const binding of this.#ownerRepairBindings.values())
-            binding.dispose(); this.#ownerRepairBindings.clear(); this.#store.close(); }, 'assistant-goals.store');
+        if (ownerIntent) {
+            try {
+                this.#ownerIntent = { store: new GoalOwnerIntentStore(`${path}.owner-intents`) };
+            }
+            catch (error) {
+                this.#store.close();
+                throw error;
+            }
+        }
+        if (ownerPreparedAcceptance) {
+            try {
+                this.#ownerAcceptance = { store: new GoalOwnerAcceptanceStore(`${path}.owner-acceptance`) };
+            }
+            catch (error) {
+                this.#ownerIntent?.store.close();
+                this.#store.close();
+                throw error;
+            }
+        }
+        ctx.effect(() => () => {
+            this.#active = false;
+            this.#acceptanceRegistration = undefined;
+            for (const binding of this.#ownerRepairBindings.values())
+                binding.dispose();
+            this.#ownerRepairBindings.clear();
+            this.#store.close();
+            this.#ownerIntent?.store.close();
+            this.#ownerAcceptance?.store.close();
+        }, 'assistant-goals.store');
         this.#execution = new GoalExecutionRuntime(ctx, input.verifyNativeRounds === true ? (path === ':memory:' ? path : `${path}.executions`) : undefined, duration, (agent, consume = true) => {
             const scope = this.#scope(agent, 'execute', consume);
             const record = this.#observe(agent, false, consume);
@@ -346,7 +403,7 @@ export class AssistantGoalsService extends Service {
         }, input.verifyGoalOutcome === true ? {
             prepare: (agent, run) => this.#outcome.prepare(agent, run),
             settled: (agent, run, assertCurrent) => this.#outcome.settled(agent, run, assertCurrent),
-        } : undefined, record => this.#assertDependencies(record));
+        } : undefined, record => this.#assertDependencies(record), () => this.#ownerAcceptance !== undefined, record => this.#ownerAcceptance === undefined ? undefined : this.#sealFor(record));
         if (input.verifyGoalOutcome === true)
             this.#outcome = new GoalOutcomeRuntime(ctx, `${path}.outcomes`, agent => {
                 this.#scope(agent, 'execute');
@@ -355,7 +412,7 @@ export class AssistantGoalsService extends Service {
                     throw new Error('assistant-goals: current whole-goal definition required');
                 return record;
             }, this.#execution.list, duration, record => this.#assertDependencies(record), (record, run, agent) => this.#eventWait?.acceptsPausedOutcomeSettlement(record, run) === true
-                && this.#execution.acceptsPausedEventWaitSettlement(record, run, agent), (record, wake, run) => this.#eventWait?.acceptsHistoricalPausedOutcomeCompletion(record, wake, run) === true);
+                && this.#execution.acceptsPausedEventWaitSettlement(record, run, agent), (record, wake, run) => this.#eventWait?.acceptsHistoricalPausedOutcomeCompletion(record, wake, run) === true, () => this.#ownerAcceptance !== undefined, record => this.#ownerAcceptance === undefined ? undefined : this.#sealFor(record));
         if (this.#outcome !== undefined)
             ctx.on('agent/pre-step', async ({ agent, signal }, next) => {
                 signal.throwIfAborted();
@@ -366,7 +423,7 @@ export class AssistantGoalsService extends Service {
                 return await next();
             });
         if (budget !== undefined)
-            this.#budget = new GoalBudgetRuntime(ctx, path === ':memory:' ? path : `${path}.budgets`, budget, this.#execution.budgetState);
+            this.#budget = new GoalBudgetRuntime(ctx, path === ':memory:' ? path : `${path}.budgets`, budget, this.#execution.budgetState, record => goalOwnerIntentSupplier(this.#ownerIntent?.store, record));
         if (strategy)
             ctx.inject(['subagents'], runtime => {
                 const instance = new GoalStrategyRuntime(runtime, `${path}.strategies`, strategy, {
@@ -438,7 +495,8 @@ export class AssistantGoalsService extends Service {
                         this.#clear(agent, change.ref.id, change.ref.revision);
                     else {
                         const record = this.#observe(agent, change.operation === 'create');
-                        if (record !== undefined && (change.operation === 'create' || change.operation === 'edit'))
+                        if (record !== undefined && !this.#preparingPreparedCreation
+                            && (change.operation === 'create' || change.operation === 'edit'))
                             this.#bindOutcome(agent, record);
                     }
                     this.#eventWait?.reconcile();
@@ -515,6 +573,15 @@ export class AssistantGoalsService extends Service {
     #bindOutcome(agent, record) {
         if (this.#outcome === undefined)
             return;
+        if (this.#ownerAcceptance !== undefined) {
+            // Prepared acceptance is sealed by the Host after the business goal
+            // exists; never silently fall back to the legacy profile binding here.
+            const seal = this.#sealFor(record);
+            if (seal === undefined)
+                return;
+            this.#outcome.bindPrepared(record, seal);
+            return;
+        }
         this.#requireOwnerTurn(agent, record.scope);
         this.#outcome.bind(record);
     }
@@ -694,6 +761,10 @@ export class AssistantGoalsService extends Service {
             const scope = this.#scope(execution.agent, 'create', false);
             this.#scope(execution.agent, 'observe', false);
             this.#requireOwnerTurn(execution.agent, scope);
+            // Preauthorization is a read-only prediction of the same frozen proof the
+            // real execution will require; it never writes or consumes a budget.
+            if (this.#ownerIntent !== undefined)
+                this.#freezeOwnerIntent(execution.agent, execution, objective, scope);
             this.#outcome.preflight(scope, objective);
             const verifier = this.ctx.get('assistantVerifier', false);
             return ['goal-step', 'goal-outcome'].every(taskKind => {
@@ -728,7 +799,15 @@ export class AssistantGoalsService extends Service {
         this.#outcome?.preflight(scope, objective.trim());
         // Delivery retains its real source kind. Its current owner-turn proof is the
         // Host authority for this bridge; never forge a native direct-user event.
-        native.create(agent, { objective, ...(maxGoalRounds === undefined ? {} : { maxGoalRounds }) });
+        // Native create emits goal/changed synchronously; prepared mode must not
+        // attempt its legacy whole-goal binding before the Host seals acceptance.
+        this.#preparingPreparedCreation = this.#ownerAcceptance !== undefined;
+        try {
+            native.create(agent, { objective, ...(maxGoalRounds === undefined ? {} : { maxGoalRounds }) });
+        }
+        finally {
+            this.#preparingPreparedCreation = false;
+        }
         try {
             const record = this.#observe(agent, true);
             if (record !== undefined) {
@@ -741,6 +820,334 @@ export class AssistantGoalsService extends Service {
             ? 'assistant-goals: native goal created but context could not be indexed; inspect the current native goal before retrying'
             : 'assistant-goals: native goal created but context or whole-goal acceptance is unavailable; inspect the current native goal and exact acceptance profile before retrying');
     };
+    /**
+     * Create one goal from the live authenticated owner tool call after freezing
+     * the real owner text, supplier and call identity. Disabled (undefined
+     * ledger) keeps the historical create path; enabled means every native goal
+     * creation requires a fresh Delivery proof and fails closed otherwise.
+     */
+    createFromOwnerIntent = (execution, objective, maxGoalRounds, acceptance) => {
+        if (this.#ownerAcceptance !== undefined)
+            return this.#createFromOwnerIntentPrepared(execution, objective, maxGoalRounds, acceptance);
+        if (acceptance !== undefined)
+            throw new Error('assistant-goals: owner-prepared acceptance is not enabled; omit acceptance or enable ownerPreparedAcceptance');
+        if (this.#ownerIntent === undefined)
+            return this.create(execution.agent, objective, maxGoalRounds);
+        const agent = execution.agent;
+        if (agent === undefined)
+            throw new Error('assistant-goals: owner intent requires the live owner tool call');
+        if (this.#createMaxRounds > 0) {
+            maxGoalRounds ??= this.#createMaxRounds;
+            if (!Number.isSafeInteger(maxGoalRounds) || maxGoalRounds < 1 || maxGoalRounds > this.#createMaxRounds)
+                throw new Error('assistant-goals: configured creation round limit exceeded');
+        }
+        const scope = this.#scope(agent, 'create');
+        this.#scope(agent, 'observe');
+        this.#requireOwnerTurn(agent, scope);
+        if (typeof objective !== 'string' || objective.trim().length === 0 || objective.length > 16384)
+            throw new Error('assistant-goals: invalid objective');
+        if (maxGoalRounds !== undefined && (!Number.isSafeInteger(maxGoalRounds) || maxGoalRounds < 1))
+            throw new Error('assistant-goals: invalid round limit');
+        const intent = this.#freezeOwnerIntent(agent, execution, objective, scope);
+        const native = this.ctx.get('goals');
+        if (native === undefined)
+            throw new Error('assistant-goals: native goal service unavailable');
+        // Match the native domain's normalization before looking up exact profiles.
+        this.#outcome?.preflight(scope, objective.trim());
+        this.#preparingPreparedCreation = this.#ownerAcceptance !== undefined;
+        try {
+            native.create(agent, { objective, ...(maxGoalRounds === undefined ? {} : { maxGoalRounds }) });
+        }
+        finally {
+            this.#preparingPreparedCreation = false;
+        }
+        let record;
+        try {
+            record = this.#observe(agent, true);
+            if (record !== undefined)
+                this.#bindOutcome(agent, record);
+        }
+        catch {
+            record = undefined;
+        }
+        if (record === undefined) {
+            // Never attach the frozen intent to a goal we could not read back.
+            throw new Error(this.#outcome === undefined
+                ? 'assistant-goals: native goal created but context could not be indexed; inspect the current native goal before retrying'
+                : 'assistant-goals: native goal created but context or whole-goal acceptance is unavailable; inspect the current native goal and exact acceptance profile before retrying');
+        }
+        try {
+            this.#ownerIntent.store.record(intent, record.id, record.definition.digest);
+        }
+        catch (error) {
+            // The native goal must never survive without its frozen proof. Roll it
+            // back and report which outcome the caller must inspect.
+            const rolledBack = this.#rollbackCreatedGoal(agent, record);
+            throw new Error(rolledBack
+                ? 'assistant-goals: native goal created but the owner intent could not be recorded; the native goal was rolled back'
+                : 'assistant-goals: native goal created without a frozen owner intent; inspect and clear it before use', { cause: error });
+        }
+        return record;
+    };
+    /** Owner-turn creation that also seals the protected acceptance before returning. */
+    #createFromOwnerIntentPrepared(execution, objective, maxGoalRounds, acceptance) {
+        const agent = execution.agent;
+        if (agent === undefined)
+            throw new Error('assistant-goals: owner intent requires the live owner tool call');
+        if (acceptance === undefined)
+            throw new Error('assistant-goals: owner-prepared acceptance requires explicit criteria');
+        const input = resolveOwnerPreparedAcceptanceInput(acceptance, this.#stepMaxDurationMs);
+        // Fail before native creation when the verifier side cannot seal at all.
+        this.#sealCapability();
+        if (this.#createMaxRounds > 0) {
+            maxGoalRounds ??= this.#createMaxRounds;
+            if (!Number.isSafeInteger(maxGoalRounds) || maxGoalRounds < 1 || maxGoalRounds > this.#createMaxRounds)
+                throw new Error('assistant-goals: configured creation round limit exceeded');
+        }
+        const scope = this.#scope(agent, 'create');
+        this.#scope(agent, 'observe');
+        this.#requireOwnerTurn(agent, scope);
+        if (typeof objective !== 'string' || objective.trim().length === 0 || objective.length > 16384)
+            throw new Error('assistant-goals: invalid objective');
+        if (maxGoalRounds !== undefined && (!Number.isSafeInteger(maxGoalRounds) || maxGoalRounds < 1))
+            throw new Error('assistant-goals: invalid round limit');
+        const intent = this.#ownerIntent === undefined ? undefined : this.#freezeOwnerIntent(agent, execution, objective, scope);
+        const native = this.ctx.get('goals');
+        if (native === undefined)
+            throw new Error('assistant-goals: native goal service unavailable');
+        // Match the native domain's normalization before looking up exact profiles.
+        this.#outcome?.preflight(scope, objective.trim());
+        this.#preparingPreparedCreation = true;
+        try {
+            native.create(agent, { objective, ...(maxGoalRounds === undefined ? {} : { maxGoalRounds }) });
+        }
+        finally {
+            this.#preparingPreparedCreation = false;
+        }
+        let record;
+        try {
+            record = this.#observe(agent, true);
+        }
+        catch {
+            record = undefined;
+        }
+        if (record === undefined) {
+            const rolledBack = this.#rollbackCurrentGoal(agent);
+            throw new Error(rolledBack
+                ? 'assistant-goals: native goal created but context could not be indexed; the native goal was rolled back'
+                : 'assistant-goals: native goal created but context could not be indexed; inspect and clear the current native goal before retrying');
+        }
+        try {
+            this.#sealOwnerAcceptanceRecord(record, input);
+        }
+        catch (error) {
+            const rolledBack = this.#rollbackCreatedGoal(agent, record);
+            throw new Error(rolledBack
+                ? 'assistant-goals: native goal created but the owner acceptance could not be sealed; the native goal was rolled back'
+                : 'assistant-goals: native goal created without a sealed owner acceptance; inspect and clear it before use', { cause: error });
+        }
+        if (intent !== undefined) {
+            try {
+                this.#ownerIntent.store.record(intent, record.id, record.definition.digest);
+            }
+            catch (error) {
+                const rolledBack = this.#rollbackCreatedGoal(agent, record);
+                throw new Error(rolledBack
+                    ? 'assistant-goals: native goal created but the owner intent could not be recorded; the native goal was rolled back'
+                    : 'assistant-goals: native goal created without a frozen owner intent; inspect and clear it before use', { cause: error });
+            }
+        }
+        return record;
+    }
+    /** Clear a just-created native goal when the business record could not be observed. */
+    #rollbackCurrentGoal(agent) {
+        try {
+            const native = this.ctx.get('goals');
+            if (native === undefined)
+                return false;
+            const current = native.get(agent);
+            if (current === undefined)
+                return true;
+            native.clear(agent, { id: current.id, revision: current.revision });
+            return native.get(agent) === undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    #freezeOwnerIntent(agent, execution, objective, scope) {
+        const delivery = this.ctx.get('assistantDelivery');
+        if (delivery === undefined || typeof delivery.inspectOwnerForegroundToolCallForAgent !== 'function'
+            || typeof delivery.readOwnerForegroundToolInputForAgent !== 'function')
+            throw new Error('assistant-goals: owner intent proof is unavailable');
+        const intent = buildGoalOwnerIntent({ delivery, agent, execution, scope });
+        // The model selects only words already present verbatim in the owner input;
+        // the frozen span must be exactly the span of the live objective argument.
+        const span = ownerIntentObjectiveSpan(intent.text, objective);
+        if (objective !== intent.objective.text || span.start !== intent.objective.start || span.end !== intent.objective.end) {
+            throw new Error("assistant-goals: objective must quote the owner's original words verbatim");
+        }
+        return intent;
+    }
+    /**
+     * Read-only catalog of installed acceptance authorities for the caller's
+     * owner scope. The verifier keeps the authority list; Goals only proxies it
+     * inside a model tool that is registered in owner-prepared mode.
+     */
+    inspectAcceptanceAuthorities = (agent) => {
+        const scope = this.#scope(agent, 'inspect');
+        const verifier = this.ctx.get('assistantVerifier', false);
+        if (verifier === undefined || typeof verifier.inspectAcceptanceAuthorities !== 'function') {
+            throw new Error('assistant-goals: acceptance authority catalog is unavailable; the verifier peer does not expose it');
+        }
+        return verifier.inspectAcceptanceAuthorities({ scope: { workspace: scope.workspace, preset: scope.preset },
+            owner: { principalRecordId: scope.principalRecordId, principalVersion: scope.principalVersion } });
+    };
+    /**
+     * Host-only read of the frozen owner intent for one owner-scoped business
+     * goal. A stored row whose definition digest no longer matches the current
+     * goal definition is a stale binding and returns undefined instead of
+     * silently authorizing a different objective.
+     */
+    ownerIntent = (agent, goalId) => {
+        const store = this.#ownerIntent?.store;
+        if (store === undefined)
+            return undefined;
+        const scope = this.#scope(agent, 'inspect');
+        const record = this.#store.get(scope, goalId);
+        if (record === undefined)
+            return undefined;
+        const stored = store.inspect(goalId);
+        if (stored === undefined || stored.definitionDigest !== record.definition.digest)
+            return undefined;
+        return stored.intent;
+    };
+    /** Best-effort clear of a just-created native goal whose proof could not be frozen. */
+    #rollbackCreatedGoal(agent, record) {
+        try {
+            const native = this.ctx.get('goals');
+            if (native === undefined)
+                return false;
+            const current = native.get(agent);
+            if (current === undefined)
+                return true;
+            if (String(current.id) !== record.native.goalId)
+                return false;
+            native.clear(agent, { id: current.id, revision: current.revision });
+            return native.get(agent) === undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Current seal for one business goal; a stale definition digest fails closed. */
+    #sealFor(record) {
+        const store = this.#ownerAcceptance?.store;
+        if (store === undefined)
+            return undefined;
+        const seal = store.get(record.id);
+        if (seal === undefined)
+            return undefined;
+        if (seal.definition.version !== record.definition.version || seal.definition.digest !== record.definition.digest) {
+            throw new Error('assistant-goals: sealed owner acceptance is stale for the current goal definition; create a new goal');
+        }
+        return seal;
+    }
+    /**
+     * Host-only: seal the protected acceptance for one owner-scoped business goal
+     * before its first native round. Criteria are Host-prepared and never reachable
+     * from model tool arguments; a goal in prepared mode cannot run unsealed.
+     */
+    sealOwnerAcceptance = (agent, goalId, value) => {
+        const scope = this.#scope(agent, 'create');
+        const record = this.#store.get(scope, goalId);
+        if (record === undefined)
+            throw new Error('assistant-goals: goal not found');
+        if (record.native.phase !== 'active' && record.native.phase !== 'paused')
+            throw new Error('assistant-goals: only an active or paused goal can seal owner acceptance');
+        const input = validateOwnerPreparedAcceptanceInput(value, this.#stepMaxDurationMs);
+        const capability = this.#sealCapability();
+        const stepCriteria = input.stepCriteria ?? input.criteria;
+        const existing = capability.store.get(record.id);
+        if (existing !== undefined) {
+            const same = existing.definition.version === record.definition.version && existing.definition.digest === record.definition.digest
+                && acceptanceDigest(existing.criteria) === acceptanceDigest(input.criteria)
+                && acceptanceDigest(existing.stepCriteria) === acceptanceDigest(stepCriteria)
+                && acceptanceDigest(existing.bounds) === acceptanceDigest(input.bounds)
+                && existing.validityMs === input.validityMs && acceptanceDigest(existing.preparer) === acceptanceDigest(input.preparer);
+            if (!same)
+                throw new Error('assistant-goals: owner acceptance is already sealed for this goal with different criteria; create a new goal to change it');
+            this.#outcome.bindPrepared(record, existing);
+            return this.#sealView(existing);
+        }
+        try {
+            return this.#sealView(this.#sealOwnerAcceptanceRecord(record, input));
+        }
+        catch (error) {
+            // An unsealed goal cannot run in prepared mode; never leave it silently usable.
+            const rolledBack = this.#rollbackCreatedGoal(agent, record);
+            throw new Error(rolledBack
+                ? 'assistant-goals: owner acceptance could not be sealed; the native goal was rolled back'
+                : 'assistant-goals: owner acceptance could not be sealed; the native goal remains without a sealed owner acceptance and must be inspected and cleared before use', { cause: error });
+        }
+    };
+    #sealView(seal) {
+        return Object.freeze({ goalId: seal.goalId, definitionDigest: seal.definition.digest,
+            outcome: Object.freeze({ contractId: seal.outcome.contractId, contractDigest: seal.outcome.contractDigest }),
+            expiresAt: seal.outcomeExpiresAt });
+    }
+    /** Resolve the live verifier capability required to seal prepared acceptance. */
+    #sealCapability() {
+        const store = this.#ownerAcceptance?.store;
+        if (store === undefined)
+            throw new Error('assistant-goals: owner prepared acceptance is not enabled');
+        const registration = this.#acceptanceRegistration;
+        if (registration === undefined)
+            throw new Error('assistant-goals: owner prepared acceptance requires the goal verifier registration');
+        if (this.#outcome === undefined)
+            throw new Error('assistant-goals: owner prepared acceptance requires whole-goal verification');
+        const verifier = this.ctx.get('assistantVerifier', false);
+        const prepared = preparedRegistration(registration);
+        if (prepared === undefined)
+            throw new Error('assistant-goals: the goal verifier does not support owner-prepared acceptance');
+        return { store, prepared, verifier };
+    }
+    /** Seal one prepared outcome contract and persist it before the first round. */
+    #sealOwnerAcceptanceRecord(record, input) {
+        const capability = this.#sealCapability();
+        const stepCriteria = input.stepCriteria ?? input.criteria;
+        const assessmentId = `goal-assessment-${acceptanceDigest([record.scope, record.id, record.definition, 'initial'])}`;
+        const task = { kind: 'goal-outcome', ref: assessmentId, goal: {
+                id: record.id, definitionVersion: record.definition.version, definitionDigest: record.definition.digest,
+                assessmentId, sessionId: record.native.sessionId, nativeGoalId: record.native.goalId
+            } };
+        const request = Object.freeze({
+            scope: Object.freeze({ workspace: record.scope.workspace, preset: record.scope.preset }),
+            owner: Object.freeze({ principalRecordId: record.scope.principalRecordId, principalVersion: record.scope.principalVersion }),
+            task, objective: record.definition.objective, criteria: input.criteria, bounds: input.bounds,
+            validityMs: input.validityMs, preparer: input.preparer,
+        });
+        const handle = capability.prepared.prepareOwnerContract(request);
+        const contract = capability.verifier?.inspectAcceptedTask?.(handle.contractId)?.contract;
+        if (contract === undefined || contract.id !== handle.contractId || contract.digest !== handle.contractDigest
+            || contract.task.kind !== 'goal-outcome' || acceptanceDigest(contract.task) !== acceptanceDigest(task)
+            || contract.objective !== record.definition.objective
+            || acceptanceDigest(contract.criteria) !== acceptanceDigest(input.criteria)
+            || acceptanceDigest(contract.bounds) !== acceptanceDigest(input.bounds)
+            || contract.profile.id !== 'owner-prepared' || contract.profile.version !== 1
+            || contract.expiresAt <= Date.now())
+            throw new Error('assistant-goals: sealed owner acceptance readback failed');
+        const seal = validateOwnerAcceptanceSeal({
+            goalId: record.id, definition: record.definition, objective: record.definition.objective,
+            criteria: input.criteria, stepCriteria, bounds: input.bounds, validityMs: input.validityMs,
+            preparer: input.preparer, outcome: handle, preparedProfileDigest: contract.profile.digest,
+            outcomeExpiresAt: contract.expiresAt, at: Date.now(),
+        });
+        // Bind the frozen definition before persisting the seal: either both land or
+        // the caller rolls the native goal back, never a half-sealed goal.
+        this.#outcome.bindPrepared(record, seal);
+        return capability.store.record(seal);
+    }
     control = (agent, value) => {
         const input = this.#controlInput(value);
         const scope = this.#scope(agent, input.operation);
@@ -749,6 +1156,12 @@ export class AssistantGoalsService extends Service {
         const record = this.#store.get(scope, input.goalId);
         if (record === undefined)
             throw new Error('assistant-goals: goal not found');
+        // A frozen owner intent binds the objective to the authenticated owner's
+        // words. Editing it would silently break that proof and orphan the ledger
+        // row, so the caller must create a new goal instead.
+        if (input.operation === 'edit' && this.#ownerIntent?.store.inspect(input.goalId) !== undefined) {
+            throw new Error('assistant-goals: the objective is bound to the authenticated owner request; create a new goal to change it');
+        }
         const native = this.ctx.get('goals');
         if (native === undefined)
             throw new Error('assistant-goals: native goal service unavailable');
@@ -2024,7 +2437,13 @@ export class AssistantGoalsService extends Service {
             execution();
             throw error;
         }
-        return () => { outcome?.(); execution(); };
+        this.#acceptanceRegistration = registration;
+        return () => {
+            if (this.#acceptanceRegistration === registration)
+                this.#acceptanceRegistration = undefined;
+            outcome?.();
+            execution();
+        };
     };
     currentArtifactAdmission = (agent) => this.#execution.currentArtifactAdmission(agent);
     inspectAcceptedArtifactSource = (contract) => contract.task.kind === 'goal-outcome'