@dsh-enhanced/plugin-control-plane 0.1.67 → 0.1.70

package/lib/source-jobs.js

@@ -2,18 +2,36 @@ import { normalizeSourceCreationGrant } from './source-creation.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { isAbsolute, join, resolve } from 'node:path';
 import { realpath } from 'node:fs/promises';
-import { SourceGrowthRunUnavailableError, isSourceOwnerContinuation, validateAnySourceGrowthRunBinding as validateSourceGrowthRunBinding } from '@dsh-enhanced/assistant-growth-contract';
+import { SourceGrowthRunUnavailableError, isSourceOwnerContinuation, validateAnySourceGrowthRunBinding as validateSourceGrowthRunBinding, revisionBenefitContractDigest, validateRevisionBenefitContract } from '@dsh-enhanced/assistant-growth-contract';
 import { automationDefinitionDigest } from '@dsh-enhanced/assistant-automations';
 import { controlPlaneDigest, expectedSourceRelease } from './store.js';
 import { awaitSourceSignal, inspectSourceContext } from './source-context.js';
 import { assertPluginModificationAllowed, removeSourceJobWorktree, validateScopedPluginFiles } from './source-workspace.js';
 import { assertManagedVersionPaths } from './source-versioning.js';
 import { resolveSourceBaseline, validateSourceBaselineConfig } from './source-baseline.js';
-import { removeSourceJobContainer, validateSourceBuildConfig } from './source-build.js';
-import { inspectSourceRevisionContext, validateSourceRevisionGrant } from './source-revision.js';
+import { validateSourceBuildConfig } from './source-build.js';
+import { inspectSourceRevisionContext, normalizeSourceRevisionGrant, validateSourceRevisionGrant } from './source-revision.js';
 import { inspectSourceCreationContext, validateSourceCreationFiles, validateSourceCreationGrant } from './source-creation.js';
 import { inheritedEnvironment } from './trust.js';
 import { SOURCE_BUILD_CHECK_FAILED } from './source-build-diagnostics.js';
+const ZERO_REVIEW_WINDOW = Object.freeze({ verificationMs: 0, regressionMs: 0, adoptionMs: 0 });
+const LINUX_REVIEW_WINDOW_MS = 1_800_000;
+const ADOPTION_WINDOW_MS = 180_000;
+/**
+ * The exact Host-side review/adoption windows a source job may allocate. It is
+ * computed from live capability presence only when an owner instruction is first
+ * enqueued; afterwards the frozen copy is authoritative and any difference
+ * fails closed instead of silently resizing the review budget.
+ */
+export function instructionReviewWindowFor(input) {
+    if (!input.linuxBackend)
+        return ZERO_REVIEW_WINDOW;
+    return Object.freeze({
+        verificationMs: input.verification ? LINUX_REVIEW_WINDOW_MS : 0,
+        regressionMs: input.regression ? LINUX_REVIEW_WINDOW_MS : 0,
+        adoptionMs: input.adoption ? ADOPTION_WINDOW_MS : 0,
+    });
+}
 export const SOURCE_JOB_OWNER = 'plugin-control-plane-source';
 const EXECUTOR = 'plugin-control-plane-source-check';
 const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1, operation: 'isolated-check-pending-plan' });
@@ -24,7 +42,7 @@ export { SourceGrowthRunUnavailableError } from '@dsh-enhanced/assistant-growth-
 class SourceGrowthNativeMismatchError extends Error {
 }
 export function validateSourceJobsConfig(value, build) {
-    const allowed = new Set(['authorityId', 'expiresAt', 'maxSubmissions', 'allowedModes', 'repository', 'baseline', 'creation', 'revision', 'ownerRouteId', 'principalId', 'workspace', 'preset', 'budgetId', 'budgetAmount']);
+    const allowed = new Set(['authorityId', 'expiresAt', 'maxSubmissions', 'allowedModes', 'repository', 'baseline', 'creation', 'revision', 'revisionBenefit', 'allowReviewOnlyFirstAdoption', 'ownerRouteId', 'principalId', 'workspace', 'preset', 'budgetId', 'budgetAmount']);
     if (value === null || typeof value !== 'object' || Array.isArray(value) || build === undefined
         || Object.keys(value).some(key => !allowed.has(key))
         || ![value.authorityId, value.ownerRouteId, value.principalId, value.repository, value.workspace, value.preset].every(text => typeof text === 'string' && text !== '' && text.normalize('NFC').trim() === text && text.length <= 4096 && !/[\p{Cc}]/u.test(text))
@@ -48,6 +66,14 @@ export function validateSourceJobsConfig(value, build) {
         validateSourceCreationGrant(value.creation);
     if (value.revision !== undefined)
         validateSourceRevisionGrant(value.revision);
+    if (value.revisionBenefit !== undefined)
+        validateRevisionBenefitContract(value.revisionBenefit);
+    if (value.allowReviewOnlyFirstAdoption !== undefined && typeof value.allowReviewOnlyFirstAdoption !== 'boolean') {
+        throw new Error('plugin-control-plane: invalid review-only adoption flag');
+    }
+    if (value.revisionBenefit !== undefined && value.revision?.benefit?.contractDigest !== revisionBenefitContractDigest(value.revisionBenefit)) {
+        throw new Error('plugin-control-plane: revisionBenefit contract does not match the revision grant benefit pin');
+    }
     if ('backend' in build && build.backend === 'macos-seatbelt'
         && (!value.allowedModes || value.allowedModes.some(mode => mode === 'modify')
             || value.creation === undefined && value.revision === undefined)) {
@@ -56,7 +82,9 @@ export function validateSourceJobsConfig(value, build) {
 }
 export function normalizeSourceJobsConfig(value, build) {
     validateSourceJobsConfig(value, build);
-    return { ...structuredClone(value), ...(value.creation ? { creation: normalizeSourceCreationGrant(value.creation) } : {}) };
+    return { ...structuredClone(value),
+        ...(value.creation ? { creation: normalizeSourceCreationGrant(value.creation) } : {}),
+        ...(value.revision ? { revision: normalizeSourceRevisionGrant(value.revision) } : {}) };
 }
 function projection(job, diagnostics) {
     return { id: job.id, name: job.intent.name, gapId: job.intent.gapId, baseCommit: job.intent.baseCommit,
@@ -76,12 +104,14 @@ export class SourceJobRuntime {
     authorityDigest;
     unregister;
     unregisterContinuation;
+    unsubscribeWake;
     closing;
     active = false;
     generation = randomUUID();
     continuationNonce;
     continuing = new Set();
     continuationCursor = 0;
+    preferRequestDrain = true;
     continuationStatus;
     continuationTransition = 0;
     /** Process-local, bounded build diagnostics; the failure code itself is durable. */
@@ -121,6 +151,12 @@ export class SourceJobRuntime {
                     execute: input => this.track(this.executeContinuations(input)),
                 });
             this.active = true;
+            if (this.options.drainOwnerInstructionRequests !== undefined) {
+                const automations = this.options.ports.automations;
+                if (!automations.onSchedulerWake)
+                    throw new Error('owner instruction drain requires native scheduler wake');
+                this.unsubscribeWake = automations.onSchedulerWake(() => this.reconcileContinuations());
+            }
             // Recovery is admitted exclusively through a production cron occurrence.
             // Reading this local durable query intentionally performs no authority call.
             this.reconcileContinuations();
@@ -130,6 +166,10 @@ export class SourceJobRuntime {
             // Registration is transactional from this runtime's point of view: an
             // unregistration fault cannot leave the other executor registered or
             // obscure the original registration failure.
+            try {
+                this.unsubscribeWake?.();
+            }
+            catch { /* original error wins */ }
             try {
                 this.unregisterContinuation?.();
             }
@@ -192,17 +232,40 @@ export class SourceJobRuntime {
         }
         return Promise.allSettled(this.growthFlights).then(() => undefined);
     }
-    /** A revision is adoptable only when its independent review, and any configured regression, verified. */
+    /** A revision is adoptable only when its independent review, any configured regression, and any configured benefit outcome verified. */
     revisionAdoptionReady(job, planId) {
         if (this.options.store.getRevisionVerificationStatus(planId) !== 'verified')
             return false;
-        if (job.intent.revision?.growthRun.revisionRegressionAcceptance === undefined)
-            return true;
-        return this.options.verifyPreparedRevisionRegression !== undefined
-            && this.options.store.getRevisionRegressionStatus(planId) === 'verified';
+        if (job.intent.revision?.growthRun?.revisionRegressionAcceptance !== undefined
+            && (!(this.options.verifyPreparedRevisionRegression !== undefined)
+                || this.options.store.getRevisionRegressionStatus(planId) !== 'verified')) {
+            return false;
+        }
+        const benefit = job.intent.revision?.grant.benefit;
+        if (benefit !== undefined) {
+            // Default contract semantics: a pinned benefit requires a recorded
+            // non-inferior outcome before adoption. Removing the benefit contract
+            // while the grant keeps its pin fails closed instead of silently
+            // degrading to review-only adoption.
+            if (this.options.reconcileRevisionBenefits === undefined)
+                return false;
+            const outcome = this.options.store.inspectRevisionBenefitOutcome(planId);
+            if (outcome === undefined) {
+                // Only an explicit owner opt-in may adopt once before candidate
+                // evidence can exist; the reconcile pass then proves non-inferior or
+                // rolls the revision back at its bounded observation deadline.
+                return this.options.allowReviewOnlyFirstAdoption === true;
+            }
+            if (outcome.contractDigest !== benefit.contractDigest || outcome.status !== 'non-inferior')
+                return false;
+        }
+        return true;
     }
     async continuePrepared(job, signal) {
-        if (!job.planId || !this.options.store.getOwnerTaskFailureReference(job.intent.gapId))
+        // Owner-instruction revisions continue on their frozen instruction; task
+        // revisions on their durable task-failure source. Both re-authorize below.
+        if (!job.planId || (job.intent.ownerInstruction === undefined
+            && !this.options.store.getOwnerTaskFailureReference(job.intent.gapId)))
             return;
         if (this.continuing.has(job.id))
             return;
@@ -216,7 +279,8 @@ export class SourceJobRuntime {
     }
     async continuePreparedLocked(job, signal) {
         this.assertMode(job.intent.mode);
-        if (!job.planId || !this.options.store.getOwnerTaskFailureReference(job.intent.gapId))
+        if (!job.planId || (job.intent.ownerInstruction === undefined
+            && !this.options.store.getOwnerTaskFailureReference(job.intent.gapId)))
             return;
         const planId = job.planId;
         const current = this.options.store.getSourceJob(job.id);
@@ -239,20 +303,26 @@ export class SourceJobRuntime {
             this.assertOwner(job);
         };
         if (initial.mode === 'prepared-revise') {
-            if (job.intent.mode !== 'revise-created' || !job.intent.revision?.growthRun.revisionAcceptance || !initial.sourceRevision?.growthRun.revisionAcceptance)
+            // Task-failure revisions continue only while their frozen acceptance pins
+            // are fresh; owner-instruction revisions carry no growth run and are
+            // re-authorized by assertOwner (instruction, parent and owner checks).
+            const revisionPins = job.intent.revision?.growthRun?.revisionAcceptance !== undefined
+                && initial.sourceRevision?.growthRun?.revisionAcceptance !== undefined;
+            if (job.intent.mode !== 'revise-created'
+                || (job.intent.ownerInstruction === undefined && !revisionPins))
                 return;
             await assertCurrent();
             if (this.options.store.getRevisionVerificationStatus(planId) === undefined && this.options.verifyPreparedRevision)
                 await this.options.verifyPreparedRevision(job, signal);
             if (this.options.store.getRevisionVerificationStatus(planId) === 'verified'
                 && this.options.store.getRevisionRegressionStatus(planId) === undefined
-                && job.intent.revision.growthRun.revisionRegressionAcceptance && this.options.verifyPreparedRevisionRegression) {
+                && job.intent.revision?.growthRun?.revisionRegressionAcceptance && this.options.verifyPreparedRevisionRegression) {
                 await assertCurrent();
                 await this.options.verifyPreparedRevisionRegression(job, signal);
             }
             // Verified acceptance and the optional independent parent regression end the review lane.
             // Replacing the stable adopted entry is a separately authorized continuation.
-            if (this.revisionAdoptionReady(job, planId)
+            if (job.intent.ownerInstruction === undefined && this.revisionAdoptionReady(job, planId)
                 && this.options.revisionAdoptionEligible?.(planId) && this.options.adoptVerifiedRevision) {
                 await assertCurrent();
                 await this.options.adoptVerifiedRevision(job, signal);
@@ -260,8 +330,13 @@ export class SourceJobRuntime {
             return;
         }
         if (initial.mode === 'prepared-create') {
+            const initialRun = initial.creation?.growthRun;
             if (job.intent.mode !== 'create'
-                || !job.intent.creation?.growthRun?.creationAcceptance || !initial.creation?.growthRun?.creationAcceptance)
+                || !job.intent.creation?.growthRun
+                || job.intent.creation.growthRun.protocol === 'assistant-growth/source-run/v3'
+                || !job.intent.creation.growthRun.creationAcceptance
+                || !initialRun || initialRun.protocol === 'assistant-growth/source-run/v3'
+                || !initialRun.creationAcceptance)
                 return;
             await assertCurrent();
             if (this.options.store.getCreationVerificationStatus(planId) === undefined && this.options.verifyPreparedCreation) {
@@ -306,11 +381,22 @@ export class SourceJobRuntime {
         const authority = { id: config.authorityId, digest: this.authorityDigest, expiresAt: config.expiresAt };
         return { authority, creation: structuredClone(config.creation), remaining: this.options.store.inspectSourceJobQuota({ authority: { ...authority, maxSubmissions: config.maxSubmissions }, creation: config.creation }) };
     }
+    inspectWorkItemRevisionReadiness(owner) {
+        if (!this.available() || !this.modeAllowed('revise-created') || ('expiresAt' in this.options.build && Date.now() >= this.options.build.expiresAt) || this.options.config.revision?.workItemFailures !== true || Date.now() >= this.options.config.revision.expiresAt)
+            return undefined;
+        const current = this.receipt();
+        if (!isSourceOwnerContinuation(current, owner))
+            return undefined;
+        const config = this.options.config;
+        const authority = { id: config.authorityId, digest: this.authorityDigest, expiresAt: config.expiresAt };
+        return { authority, revision: structuredClone(config.revision), remaining: this.options.store.inspectSourceJobRevisionQuota({ authority: { ...authority, maxSubmissions: config.maxSubmissions }, revision: config.revision }) };
+    }
     available() { return this.active && !this.abort.signal.aborted && Date.now() < this.options.config.expiresAt; }
     close() {
         return this.closing ??= (async () => {
             this.active = false;
             try {
+                this.unsubscribeWake?.();
                 const current = this.options.ports.automations.inspectSystemOwnedActivation({ owner: SOURCE_JOB_OWNER, automationId: CONTINUATION_AUTOMATION });
                 if (current?.activationNonce === this.continuationNonce)
                     this.options.ports.automations.reconcileSystem({ owner: SOURCE_JOB_OWNER,
@@ -358,7 +444,7 @@ export class SourceJobRuntime {
     withGapSource(gapId, owner, callback, growthRun) {
         const reference = this.options.store.getOwnerTaskFailureReference(gapId);
         if (reference?.schemaVersion === 2) {
-            if (growthRun?.protocol !== 'assistant-growth/source-run/v2' || !this.options.withWorkItemGrowthRunFence)
+            if ((growthRun?.protocol !== 'assistant-growth/source-run/v2' && growthRun?.protocol !== 'assistant-growth/source-run/v3') || !this.options.withWorkItemGrowthRunFence)
                 throw new SourceGrowthRunUnavailableError('work item growth source fence unavailable');
             return this.options.withWorkItemGrowthRunFence(growthRun, gapId, owner, false, callback);
         }
@@ -375,6 +461,67 @@ export class SourceJobRuntime {
         if (!this.modeAllowed(mode))
             throw new Error('source job mode is not authorized');
     }
+    /**
+     * Fail-closed re-validation of a Host-recorded owner instruction at enqueue
+     * and at every continuation. The instruction, not the caller, freezes the
+     * target, files and owner; the gap must be the synthetic instruction gap.
+     */
+    #assertOwnerInstruction(binding, input) {
+        if (!binding)
+            throw new Error('revision requires an authenticated owner task failure or owner instruction');
+        const stored = this.options.store.getOwnerInstruction(binding.instructionId);
+        if (!stored || controlPlaneDigest(stored) !== binding.digest)
+            throw new Error('owner instruction changed');
+        if (stored.expiresAt <= Date.now())
+            throw new Error('owner instruction expired');
+        if (stored.planId !== input.parentPlanId || stored.pluginName !== input.name)
+            throw new Error('owner instruction target changed');
+        if (stored.filesDigest !== controlPlaneDigest(input.files))
+            throw new Error('owner instruction files changed');
+        let gapKey;
+        try {
+            gapKey = this.options.store.getGap(input.gapId).idempotencyKey;
+        }
+        catch {
+            throw new Error('owner instruction gap changed');
+        }
+        if (gapKey !== `owner-instruction:${stored.instructionId}`) {
+            throw new Error('owner instruction gap changed');
+        }
+        const freeze = this.options.store.getOwnerInstructionReviewFreeze(stored.instructionId);
+        if (freeze === undefined)
+            throw new Error('owner instruction review freeze is unavailable');
+        this.#assertInstructionReviewFreeze(freeze, undefined);
+        return Object.freeze({ stored, freeze });
+    }
+    /** Live capability identity; only used to validate an already frozen budget. */
+    instructionReviewWindow() {
+        return instructionReviewWindowFor({
+            linuxBackend: 'backend' in this.options.build && this.options.build.backend === 'linux-native',
+            verification: this.options.verifyPreparedRevision !== undefined,
+            regression: this.options.verifyPreparedRevisionRegression !== undefined,
+            adoption: this.options.adoptVerifiedRevision !== undefined,
+        });
+    }
+    /**
+     * A frozen review budget may only be consumed while the current reviewer
+     * capability is exactly the one frozen at enqueue. Any absence or difference
+     * fails closed: this guard never substitutes live config for the freeze.
+     */
+    #assertInstructionReviewFreeze(freeze, expected) {
+        if (this.options.verifyPreparedRevision === undefined)
+            throw new Error('owner instruction revision requires an available independent review');
+        if (freeze.budget.authority.expiresAt <= Date.now())
+            throw new Error('owner instruction review authority expired');
+        if (controlPlaneDigest(this.instructionReviewWindow()) !== controlPlaneDigest(freeze.budget.window)) {
+            throw new Error('owner instruction review budget changed');
+        }
+        if (expected !== undefined && (expected.reviewFreezeDigest === undefined || expected.reviewWindow === undefined
+            || expected.reviewFreezeDigest !== freeze.digest
+            || controlPlaneDigest(expected.reviewWindow) !== controlPlaneDigest(freeze.budget.window))) {
+            throw new Error('owner instruction review freeze changed');
+        }
+    }
     assertOwner(job) {
         this.assertMode(job.intent.mode);
         const current = this.receipt();
@@ -387,8 +534,27 @@ export class SourceJobRuntime {
             || job.intent.authority.id !== this.options.config.authorityId
             || controlPlaneDigest(job.intent.owner) !== job.intent.ownerDigest
             || (taskBacked ? !isSourceOwnerContinuation(current, job.intent.owner)
-                : controlPlaneDigest(current) !== job.intent.ownerDigest))
+                : (job.intent.ownerInstruction !== undefined
+                    ? !isSourceOwnerContinuation(current, job.intent.owner)
+                    : controlPlaneDigest(current) !== job.intent.ownerDigest)))
             throw new Error('source job authority changed or expired');
+        // Re-validate the frozen instruction on every continuation exactly like
+        // enqueue; a revoked, changed or expired instruction cannot proceed.
+        if (job.intent.ownerInstruction !== undefined) {
+            const stored = this.options.store.getOwnerInstruction(job.intent.ownerInstruction.instructionId);
+            if (taskBacked || stored === undefined || controlPlaneDigest(stored) !== job.intent.ownerInstruction.digest
+                || stored.expiresAt <= Date.now() || stored.planId !== job.intent.revision?.parent.planId
+                || stored.pluginName !== job.intent.name || stored.filesDigest !== controlPlaneDigest(job.intent.files)
+                || stored.ownerDigest !== job.intent.ownerDigest
+                || this.options.store.getGap(job.intent.gapId).idempotencyKey !== `owner-instruction:${stored.instructionId}`) {
+                throw new Error('owner instruction changed or expired');
+            }
+            // Recovery consumes only the review supplier/budget frozen at enqueue.
+            const freeze = this.options.store.getOwnerInstructionReviewFreeze(stored.instructionId);
+            if (freeze === undefined)
+                throw new Error('owner instruction review freeze is unavailable');
+            this.#assertInstructionReviewFreeze(freeze, job.intent.ownerInstruction);
+        }
         if (job.intent.revision) {
             const parent = this.options.inspectRevisionParent?.(job.intent.revision.parent.planId);
             if (!parent || parent.name !== job.intent.name || controlPlaneDigest(parent.parent) !== controlPlaneDigest(job.intent.revision.parent))
@@ -408,6 +574,8 @@ export class SourceJobRuntime {
         validateSourceGrowthRunBinding(growthRun);
         if (growthRun.protocol === 'assistant-growth/source-run/v2' && (mode !== 'create' || this.options.config.creation?.workItemFailures !== true || this.options.store.getOwnerTaskFailureReference(gapId)?.schemaVersion !== 2))
             throw new Error('work item growth requires explicit create authority');
+        if (growthRun.protocol === 'assistant-growth/source-run/v3' && (mode !== 'revise-created' || this.options.config.revision?.workItemFailures !== true || this.options.store.getOwnerTaskFailureReference(gapId)?.schemaVersion !== 2 || Date.now() >= this.options.config.revision.expiresAt))
+            throw new Error('work item revision growth requires explicit current revision authority');
         if (!this.options.assertGrowthRun)
             throw new SourceGrowthRunUnavailableError('source growth run producer unavailable');
         this.options.assertGrowthRun(growthRun, gapId, owner, generation);
@@ -416,8 +584,14 @@ export class SourceJobRuntime {
         this.assertMode(input.mode);
         if (input.growthRun?.protocol === 'assistant-growth/source-run/v2' && input.mode !== 'create')
             throw new Error('work item growth only permits create');
+        if (input.growthRun?.protocol === 'assistant-growth/source-run/v3' && input.mode !== 'revise-created')
+            throw new Error('work item revision growth only permits revise-created');
         if (input.mode !== 'create' && input.mode !== 'revise-created' && input.growthRun !== undefined)
             throw new Error('modify source job cannot carry a growth run');
+        if (input.ownerInstruction !== undefined && input.mode !== 'revise-created')
+            throw new Error('owner instructions only authorize revise-created jobs');
+        if (input.growthRun !== undefined && input.ownerInstruction !== undefined)
+            throw new Error('an owner instruction is not a growth run');
         if (input.mode === 'create' || input.mode === 'revise-created')
             validateSourceCreationFiles(input.files);
         else {
@@ -429,7 +603,8 @@ export class SourceJobRuntime {
         }
         if ((input.mode === 'revise-created') !== (typeof input.parentPlanId === 'string' && input.parentPlanId.length > 0))
             throw new Error('source revision parent is missing or outside revision mode');
-        return this.track(this.enqueueOwned({ ...input, files: structuredClone(input.files), owner: structuredClone(input.owner) }));
+        return this.track(this.enqueueOwned({ ...input, files: structuredClone(input.files), owner: structuredClone(input.owner),
+            ...(input.ownerInstruction === undefined ? {} : { ownerInstruction: structuredClone(input.ownerInstruction) }) }));
     }
     async enqueueOwned(input) {
         this.assertMode(input.mode);
@@ -457,11 +632,19 @@ export class SourceJobRuntime {
             throw new Error('source job repository mismatch');
         const currentOwner = this.assertCaller(input.owner);
         const reference = this.options.store.getOwnerTaskFailureReference(input.gapId);
-        if (input.mode === 'revise-created' && !reference)
-            throw new Error('revision requires an authenticated owner task failure');
-        const owner = reference?.owner ?? currentOwner;
+        if (input.mode === 'revise-created' && reference !== undefined && input.ownerInstruction !== undefined) {
+            throw new Error('owner instruction cannot replace an authenticated owner task failure');
+        }
+        // A revise-created job without a task failure is legal only through a
+        // Host-recorded owner instruction; every frozen field must match it.
+        const ownerInstruction = input.mode === 'revise-created' && !reference
+            ? this.#assertOwnerInstruction(input.ownerInstruction, input) : undefined;
+        const owner = ownerInstruction?.stored.ownerReceipt ?? reference?.owner ?? currentOwner;
         if (reference && !isSourceOwnerContinuation(currentOwner, owner))
             throw new Error('source job task owner changed');
+        if (ownerInstruction !== undefined && !isSourceOwnerContinuation(currentOwner, ownerInstruction.stored.ownerReceipt)) {
+            throw new Error('owner instruction owner changed');
+        }
         this.withGapSource(input.gapId, currentOwner, () => this.assertGrowthRun(input.growthRun, input.mode, input.gapId, owner, true), input.growthRun);
         const parent = input.mode === 'revise-created' ? this.options.inspectRevisionParent?.(input.parentPlanId) : undefined;
         if (input.mode === 'revise-created' && (!parent || parent.name !== input.name))
@@ -474,13 +657,19 @@ export class SourceJobRuntime {
         const prior = this.options.store.getSourceJob(id);
         if (prior !== undefined) {
             const frozen = prior.intent;
+            const instructionReviewMatches = ownerInstruction === undefined || (frozen.ownerInstruction?.digest === controlPlaneDigest(ownerInstruction.stored)
+                && frozen.ownerInstruction.reviewFreezeDigest === ownerInstruction.freeze.digest
+                && frozen.ownerInstruction.reviewWindow !== undefined
+                && controlPlaneDigest(frozen.ownerInstruction.reviewWindow) === controlPlaneDigest(ownerInstruction.freeze.budget.window));
             if (frozen.authority.digest !== this.authorityDigest || frozen.ownerDigest !== controlPlaneDigest(owner) || frozen.trustDigest !== controlPlaneDigest(trust)
                 || frozen.mode !== input.mode || (input.mode === 'create' && (controlPlaneDigest(frozen.creation?.grant) !== controlPlaneDigest(config.creation)
                 || (frozen.creation?.growthRun === undefined) !== (input.growthRun === undefined)
                 || (input.growthRun !== undefined && controlPlaneDigest(frozen.creation?.growthRun) !== controlPlaneDigest(input.growthRun))))
                 || (input.mode === 'revise-created' && (controlPlaneDigest(frozen.revision?.grant) !== controlPlaneDigest(config.revision)
                     || controlPlaneDigest(frozen.revision?.parent) !== controlPlaneDigest(parent.parent)
-                    || controlPlaneDigest(frozen.revision?.growthRun) !== controlPlaneDigest(input.growthRun)))
+                    || (frozen.revision?.growthRun === undefined) !== (input.growthRun === undefined)
+                    || (input.growthRun !== undefined && controlPlaneDigest(frozen.revision?.growthRun) !== controlPlaneDigest(input.growthRun))
+                    || !instructionReviewMatches))
                 || frozen.repository !== input.repository || frozen.name !== input.name || frozen.gapId !== input.gapId || frozen.baseCommit !== input.expectedBaseCommit
                 || frozen.ttlMs !== input.ttlMs || controlPlaneDigest(frozen.files) !== controlPlaneDigest(input.files))
                 throw new Error('source job idempotency conflict');
@@ -511,13 +700,18 @@ export class SourceJobRuntime {
             ...(input.mode === 'create' ? { mode: 'create', creation: { grant: structuredClone(config.creation), generatorDigest: source.generatorDigest,
                     ...(input.growthRun === undefined ? {} : { growthRun: structuredClone(input.growthRun) }) } } : {}),
             ...(input.mode === 'revise-created' ? { mode: 'revise-created', revision: { grant: structuredClone(config.revision),
-                    generatorDigest: source.generatorDigest, parent: structuredClone(parent.parent), growthRun: structuredClone(input.growthRun) } } : {}),
+                    generatorDigest: source.generatorDigest, parent: structuredClone(parent.parent),
+                    // Task-failure revisions pin a growth run; owner-instruction revisions have none.
+                    ...(input.growthRun === undefined ? {}
+                        : { growthRun: structuredClone(input.growthRun) }) } } : {}),
             gapId: gap.id, gapRevision: gap.revision, gapDigest: controlPlaneDigest(gap), baseCommit: source.baseCommit,
             files: structuredClone(input.files), ttlMs: input.ttlMs, build: structuredClone(this.options.build),
             worktree: join(this.options.statePath, 'source-worktrees', `worktree-job-${token}`),
-            ...('backend' in this.options.build
-                ? { nativeResource: { backend: this.options.build.backend, key: id } }
-                : { containerName: `dsh-source-job-${token}` }),
+            ...(ownerInstruction === undefined ? {} : {
+                ownerInstruction: { instructionId: ownerInstruction.stored.instructionId, digest: controlPlaneDigest(ownerInstruction.stored),
+                    reviewFreezeDigest: ownerInstruction.freeze.digest, reviewWindow: structuredClone(ownerInstruction.freeze.budget.window) }
+            }),
+            nativeResource: { backend: this.options.build.backend, key: id },
         };
         await assertCurrent();
         // Synchronous acceptance and registration: no Agent signal is persisted.
@@ -589,7 +783,24 @@ export class SourceJobRuntime {
             throw error;
         }
     }
-    linuxRevisionReviewTimeoutMs() {
+    /**
+     * Per-job review/adoption window. A supplied `job` whose revision is authorized
+     * by an owner instruction uses ONLY the window frozen in its intent. The
+     * job-less overload remains live because continuationTimeoutMs() sizes the
+     * shared continuation occurrence: that outer wall-clock cap may shrink with
+     * live config but can never enlarge the frozen inner verifier authority/budget.
+     * A smaller live window only truncates the continuation earlier (settled
+     * unknown); the per-job definition and the verifier budget stay frozen.
+     */
+    linuxRevisionReviewTimeoutMs(job) {
+        // An owner-instruction revision uses only the review window frozen in its
+        // intent: a live-config change must fail closed, never resize the budget.
+        if (job?.intent.ownerInstruction !== undefined) {
+            const window = job.intent.ownerInstruction.reviewWindow;
+            if (window === undefined)
+                throw new Error('owner instruction review window is unavailable');
+            return window.verificationMs + window.regressionMs + window.adoptionMs;
+        }
         // A Linux revision can run two independently bounded reviews after its
         // repository build. This outer window never changes their own budgets or
         // the frozen source expiry; legacy backend definitions retain their identity.
@@ -603,7 +814,7 @@ export class SourceJobRuntime {
         const config = this.options.config;
         return { name: `Source check: ${job.intent.name}`, schedule: { kind: 'at', at: new Date(job.dispatchAt ?? job.createdAt + 1000).toISOString() },
             workspace: config.workspace, agentPreset: config.preset, timeoutMs: job.intent.build.timeoutMs + 120_000
-                + (job.intent.mode === 'revise-created' ? this.linuxRevisionReviewTimeoutMs() : 0)
+                + (job.intent.mode === 'revise-created' ? this.linuxRevisionReviewTimeoutMs(job) : 0)
                 + (job.intent.mode === 'create' && job.intent.creation?.growthRun?.protocol === 'assistant-growth/source-run/v2'
                     && 'backend' in this.options.build
                     && this.options.build.backend === 'linux-native' && this.options.verifyPreparedCreation ? 1_800_000 : 0)
@@ -693,7 +904,8 @@ export class SourceJobRuntime {
     hasContinuations() {
         return !!(this.options.approvePrepared || this.options.verifyPreparedRevisionRegression || this.options.verifyPreparedRevision
             || this.options.verifyPreparedCreation || this.options.adoptVerifiedCreation || this.options.adoptVerifiedRevision
-            || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased);
+            || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased
+            || this.options.drainOwnerInstructionRequests);
     }
     continuationJobs() {
         if (!this.hasContinuations())
@@ -713,11 +925,15 @@ export class SourceJobRuntime {
             return false;
         }
         if (plan.mode === 'prepared-revise') {
-            if (job.intent.mode !== 'revise-created' || plan.status !== 'pending-approval' || !plan.sourceRevision?.growthRun.revisionAcceptance)
+            // Task-failure revisions require fresh acceptance pins; owner-instruction
+            // revisions are re-authorized through their frozen instruction row.
+            if (job.intent.mode !== 'revise-created' || plan.status !== 'pending-approval')
+                return false;
+            if (job.intent.ownerInstruction === undefined && !plan.sourceRevision?.growthRun?.revisionAcceptance)
                 return false;
             const status = this.options.store.getRevisionVerificationStatus(plan.id);
             const verify = status === undefined && this.options.verifyPreparedRevision !== undefined;
-            const regression = status === 'verified' && plan.sourceRevision.growthRun.revisionRegressionAcceptance !== undefined
+            const regression = status === 'verified' && plan.sourceRevision?.growthRun?.revisionRegressionAcceptance !== undefined
                 && this.options.store.getRevisionRegressionStatus(plan.id) === undefined && this.options.verifyPreparedRevisionRegression !== undefined;
             const adoption = this.options.revisionAdoptionEligible !== undefined && this.options.adoptVerifiedRevision !== undefined
                 && this.revisionAdoptionReady(job, plan.id) && this.options.revisionAdoptionEligible(plan.id) === true;
@@ -732,8 +948,13 @@ export class SourceJobRuntime {
             return plan.expiresAt > Date.now();
         }
         if (plan.mode === 'prepared-create') {
+            const planRun = plan.creation?.growthRun;
             if (job.intent.mode !== 'create' || plan.status !== 'pending-approval'
-                || !job.intent.creation?.growthRun?.creationAcceptance || !plan.creation?.growthRun?.creationAcceptance)
+                || !job.intent.creation?.growthRun
+                || job.intent.creation.growthRun.protocol === 'assistant-growth/source-run/v3'
+                || !job.intent.creation.growthRun.creationAcceptance
+                || !planRun || planRun.protocol === 'assistant-growth/source-run/v3'
+                || !planRun.creationAcceptance)
                 return false;
             const verification = this.options.store.getCreationVerificationStatus(plan.id);
             const verify = verification === undefined && this.options.verifyPreparedCreation !== undefined;
@@ -778,6 +999,16 @@ export class SourceJobRuntime {
             return this.options.advanceReleased !== undefined;
         return plan.status === 'release-complete' && this.options.adoptReleased !== undefined;
     }
+    /**
+     * Outer wall-clock cap for the shared continuation automation definition, the
+     * owner-instruction request drain and the non-adoption continuation signal.
+     * This is NOT the frozen review budget: an owner-instruction job's inner
+     * verifier authority/budget and its own definition timeout are pinned by the
+     * intent plus the write-once instruction freeze. A live config change here can
+     * only truncate the continuation earlier (settled unknown); it can never
+     * enlarge the frozen inner budget. Narrowing the review budget for one request
+     * would require a verifier request/response protocol v2.
+     */
     continuationTimeoutMs() {
         const release = this.options.releaseTimeoutMs ?? 40_000, adoption = this.options.adoptionTimeoutMs ?? 60_000;
         const needed = (this.options.adoptReleased ? adoption : 0) + (this.options.advanceReleased ? release + 40_000 : this.options.releasePrepared ? 40_000 : 10_000);
@@ -804,7 +1035,9 @@ export class SourceJobRuntime {
     reconcileContinuations(force = false) {
         if (!this.active || !this.hasContinuations())
             return;
-        const definition = this.continuationDefinition(), desiredStatus = this.continuationJobs().length ? 'active' : 'paused';
+        const definition = this.continuationDefinition();
+        const requests = this.available() && this.options.hasOwnerInstructionRequests?.() === true;
+        const desiredStatus = requests || this.continuationJobs().length ? 'active' : 'paused';
         if (!force && desiredStatus === this.continuationStatus)
             return;
         this.options.ports.automations.reconcileSystem({ owner: SOURCE_JOB_OWNER, automationId: CONTINUATION_AUTOMATION,
@@ -822,7 +1055,22 @@ export class SourceJobRuntime {
                 throw new Error('source continuation dispatch changed');
             const jobs = this.continuationJobs();
             let unsettled = false;
-            if (jobs.length) {
+            const drain = this.options.drainOwnerInstructionRequests;
+            const hasRequests = drain !== undefined && this.available() && this.options.hasOwnerInstructionRequests?.() === true;
+            if (hasRequests && (!jobs.length || this.preferRequestDrain)) {
+                const signal = AbortSignal.any([this.abort.signal, input.signal, AbortSignal.timeout(Math.max(1, Math.min(this.continuationTimeoutMs(), this.options.config.expiresAt - Date.now())))]);
+                signal.throwIfAborted();
+                try {
+                    await drain(signal);
+                    signal.throwIfAborted();
+                }
+                catch {
+                    unsettled = true;
+                }
+                this.preferRequestDrain = false;
+            }
+            else if (jobs.length) {
+                this.preferRequestDrain = true;
                 // One budget-admitted occurrence advances one durable row. The cursor
                 // is intentionally in-memory; a restart returning to the first row is
                 // safe because every release transition remains independently claimed.
@@ -840,6 +1088,12 @@ export class SourceJobRuntime {
                 }
             }
             this.reconcileContinuations();
+            // P1-4 benefit evaluation rides the same cron occurrence; a failure here
+            // never changes the continuation verdict.
+            try {
+                this.options.reconcileRevisionBenefits?.();
+            }
+            catch { /* owner-visible via benefit ledger absence */ }
             if (unsettled)
                 return { outcome: 'unknown', failureClass: 'infrastructure', failurePhase: 'host-execution', failureCode: 'source-continuation-unsettled', sideEffectState: 'unknown', retryability: 'unsafe' };
             return { outcome: 'succeeded', failureClass: 'none', failurePhase: 'none', failureCode: 'none', sideEffectState: 'possible', retryability: 'unsafe' };
@@ -906,8 +1160,8 @@ export class SourceJobRuntime {
         const signal = AbortSignal.any([input.signal, this.abort.signal,
             ...(growthController ? [growthController.signal] : []),
             AbortSignal.timeout(Math.max(1, Math.min(job.intent.build.timeoutMs + 120_000
-                + (job.intent.mode === 'revise-created' && this.linuxRevisionReviewTimeoutMs()
-                    ? this.linuxRevisionReviewTimeoutMs() : this.options.verifyPreparedCreation ? 1_800_000 : 0)
+                + (job.intent.mode === 'revise-created' && this.linuxRevisionReviewTimeoutMs(job)
+                    ? this.linuxRevisionReviewTimeoutMs(job) : this.options.verifyPreparedCreation ? 1_800_000 : 0)
                 + (this.options.advanceReleased ? this.options.releaseTimeoutMs ?? 40_000 : 0) + (this.options.adoptReleased ? this.options.adoptionTimeoutMs ?? 60_000 : 0), job.expiresAt - Date.now())))]);
         try {
             this.assertOwner(job);
@@ -1005,15 +1259,11 @@ export class SourceJobRuntime {
             const trust = await this.options.trust();
             if (controlPlaneDigest(trust) !== job.intent.trustDigest)
                 throw new Error('source job trust changed');
-            if ('backend' in job.intent.build) {
-                if (job.intent.nativeResource?.backend !== job.intent.build.backend || job.intent.nativeResource.key !== job.id
-                    || controlPlaneDigest(this.options.build) !== controlPlaneDigest(job.intent.build)
-                    || await this.options.inspectNativeQuiescence?.(job.id) !== 'quiescent') {
-                    throw new Error('native source job has no valid durable quiescence receipt');
-                }
-            }
-            else {
-                await removeSourceJobContainer(job.intent.build, { id: job.id, containerName: job.intent.containerName });
+            if (job.intent.nativeResource === undefined || !('backend' in job.intent.build)
+                || job.intent.nativeResource.backend !== job.intent.build.backend || job.intent.nativeResource.key !== job.id
+                || controlPlaneDigest(this.options.build) !== controlPlaneDigest(job.intent.build)
+                || await this.options.inspectNativeQuiescence?.(job.id) !== 'quiescent') {
+                throw new Error('native source job has no valid durable quiescence receipt');
             }
             await removeSourceJobWorktree({ stateRoot: join(this.options.statePath, 'source-worktrees'), repository: job.intent.repository, worktree: job.intent.worktree, baseCommit: job.intent.baseCommit, environment: inheritedEnvironment(trust) });
             this.inspect(input);