@evoclock/pi-agentic-driver 0.10.1 → 1.1.0

package/scripts/codebase_inventory.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""Deterministic, static inventory of staged repository code (without executing it)."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import hashlib
+import json
+import re
+import subprocess
+from pathlib import Path
+
+EXTENSIONS = {".py": "python", ".sh": "shell", ".js": "javascript", ".mjs": "javascript", ".cjs": "javascript", ".ts": "typescript", ".mts": "typescript", ".tsx": "typescript", ".jsx": "javascript"}
+JS_FUNCTION = re.compile(r"\b(?:async\s+)?function\s+([\w$]+)\s*\(|\b(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[\w$]+)\s*=>|\b(?:async\s+)?([\w$]+)\s*\([^\n()]*\)\s*\{", re.M)
+JS_CLASS = re.compile(r"\bclass\s+([\w$]+)")
+JS_DEP = re.compile(r"\b(?:import|export)\s+(?:[^;\n]*?\s+from\s+)?['\"]([^'\"]+)['\"]|\b(?:require|import)\s*\(\s*['\"]([^'\"]+)['\"]")
+JS_EXPORT = re.compile(r"\bexport\s+(?:default\s+)?(?:async\s+)?(?:function|class|const|let|var|interface|type|enum)\s+([\w$]+)|\bexports\.([\w$]+)")
+SHELL_FUNCTION = re.compile(r"^\s*(?:function\s+)?([A-Za-z_][\w]*)\s*\(\)\s*\{", re.M)
+SHELL_SOURCE = re.compile(r"^\s*(?:source|\.)\s+['\"]?([^'\"\s]+)", re.M)
+
+
+def git(repo: Path, *args: str) -> bytes:
+    return subprocess.check_output(["git", "-C", str(repo), *args])
+
+
+def names(pattern: re.Pattern, text: str) -> list[str]:
+    return sorted({part for hit in pattern.findall(text) for part in (hit if isinstance(hit, tuple) else (hit,)) if part})
+
+
+def record(repo: Path, relative: str) -> dict | None:
+    path = repo / relative
+    if path.is_symlink() or not path.is_file():
+        return None
+    language = EXTENSIONS.get(path.suffix)
+    data = path.read_bytes()
+    if language is None and not path.suffix:
+        first = data.split(b"\n", 1)[0].lower()
+        if first.startswith(b"#!"):
+            language = "python" if b"python" in first else "shell" if b"sh" in first else None
+    if language is None:
+        return None
+    text = data.decode("utf-8", errors="replace")
+    functions: list[str] = []
+    classes: list[str] = []
+    dependencies: list[str] = []
+    exports: list[str] = []
+    if language == "python":
+        try:
+            tree = ast.parse(text, filename=relative)
+        except SyntaxError:
+            tree = None  # A broken source file remains visible, never silently omitted.
+        if tree:
+            functions = sorted({node.name for node in ast.walk(tree) if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))})
+            classes = sorted({node.name for node in ast.walk(tree) if isinstance(node, ast.ClassDef)})
+            dependencies = sorted({node.module or "." * node.level for node in ast.walk(tree) if isinstance(node, ast.ImportFrom)} | {alias.name for node in ast.walk(tree) if isinstance(node, ast.Import) for alias in node.names})
+            exports = sorted(name for name in functions + classes if not name.startswith("_"))
+    elif language == "shell":
+        functions = names(SHELL_FUNCTION, text)
+        dependencies = names(SHELL_SOURCE, text)
+        exports = functions
+    else:
+        functions = [name for name in names(JS_FUNCTION, text) if name not in {"if", "for", "while", "switch", "catch", "function"}]
+        classes = names(JS_CLASS, text)
+        dependencies = names(JS_DEP, text)
+        exports = names(JS_EXPORT, text)
+    return {
+        "path": relative,
+        "subdir": str(Path(relative).parent),
+        "filename": path.name,
+        "blob_sha": hashlib.sha1(b"blob " + str(len(data)).encode() + b"\0" + data).hexdigest(),
+        "loc": len(text.splitlines()),
+        "size_bytes": len(data),
+        "language": language,
+        "functions": [{"name": name} for name in functions],
+        "classes": [{"name": name} for name in classes],
+        "dependencies": dependencies,
+        "exported_symbols": exports,
+    }
+
+
+def generate(repo: Path) -> bytes:
+    tracked = git(repo, "ls-files", "--cached", "--full-name", "-z").decode("utf-8", errors="surrogateescape").split("\0")
+    rows = [row for rel in sorted(set(tracked)) if rel and (row := record(repo, rel)) is not None]
+    return ("".join(json.dumps(row, sort_keys=True, ensure_ascii=True, separators=(",", ":")) + "\n" for row in rows)).encode()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source-root", type=Path, default=Path.cwd())
+    parser.add_argument("--check", action="store_true", help="compare without writing")
+    args = parser.parse_args()
+    repo = Path(git(args.source_root.resolve(), "rev-parse", "--show-toplevel").decode().strip())
+    output = repo / "pipeline_output/codebase_inventory.jsonl"
+    content = generate(repo)
+    if args.check:
+        return 0 if output.is_file() and output.read_bytes() == content else 1
+    output.parent.mkdir(parents=True, exist_ok=True)
+    if not output.is_file() or output.read_bytes() != content:
+        output.write_bytes(content)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/codebase_inventory_gate.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Pre-commit inventory gate: refresh, then require the exact refreshed bytes staged."""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+from pathlib import Path
+
+from codebase_inventory import EXTENSIONS, generate, git
+
+INVENTORY = "pipeline_output/codebase_inventory.jsonl"
+
+
+def check(repo: Path) -> tuple[bool, str]:
+    repo = Path(git(repo.resolve(), "rev-parse", "--show-toplevel").decode().strip())
+    output = repo / INVENTORY
+    content = generate(repo)
+    output.parent.mkdir(parents=True, exist_ok=True)
+    if not output.is_file() or output.read_bytes() != content:
+        output.write_bytes(content)
+    # A worktree inventory cannot describe a different staged version of the source.
+    unstaged = git(repo, "diff", "--name-only", "-z", "--diff-filter=ACMRT")
+    changed = unstaged.decode("utf-8", errors="surrogateescape").split("\0")
+    if any(Path(name).suffix in EXTENSIONS for name in changed if name):
+        return False, "source has unstaged changes; stage the intended code before refreshing the inventory"
+    staged = subprocess.run(["git", "-C", str(repo), "show", f":{INVENTORY}"], capture_output=True)
+    if staged.returncode != 0 or staged.stdout != content:
+        return False, "review and stage pipeline_output/codebase_inventory.jsonl, then retry the commit"
+    return True, "inventory matches the staged source"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--repo", type=Path, default=Path.cwd())
+    args = parser.parse_args()
+    try:
+        allowed, reason = check(args.repo)
+    except (OSError, subprocess.CalledProcessError) as error:
+        allowed, reason = False, str(error)
+    if not allowed:
+        print(f"codebase-inventory: BLOCKED -- {reason}", file=sys.stderr)
+    return 0 if allowed else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/enforcement/board_claim_bridge_pi.js

@@ -0,0 +1,204 @@
+// SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
+// SPDX-License-Identifier: AGPL-3.0-only
+
+// Board-claim bridge for Vogelkop (vogelkop phase #47, step 3).
+//
+// Vogelkop reads its TASKS.md, selects the next eligible governed card, and
+// emits a versioned claim request (vogelkop.board-claim-request.v1). This
+// module services that request by DELEGATING to the existing board authority
+// implementation — claimCard in task_board_core_pi.js — which already owns
+// the writer-lock CAS, the claims-file HMAC, expiry/single-attempt, and
+// card-hash verification. Nothing here reimplements claims, lanes, HMACs, or
+// writer state.
+//
+// The one thing this module adds is the pre-claim card-hash binding: the
+// request carries the card's own on-disk [hash::] value, and it is verified
+// against the board bytes BEFORE the claim is attempted, so a stale or
+// tampered card is refused with a precise reason instead of surfacing as a
+// generic no-dispatchable-card failure. The authoritative hash verification
+// still happens inside claimCard's own dispatchability predicate.
+//
+// Route authority: the request's route is explicit user-authored board
+// metadata (a #route-<seat-alias> tag) or an injected Jev fallback. The
+// bridge NEVER re-routes: it records the route source on the receipt and
+// binds the route into the envelope through claimCard's `route` parameter
+// (the route decision identity the envelope carries). The model-moat gate
+// result travels on the request and is recorded, not re-judged.
+//
+// The receipt is a versioned, non-authorizing observation. It contains no
+// secrets and no endpoints.
+
+import {
+  claimCard,
+  validateBoard,
+  readClaimsState,
+  computeCardHash,
+  canonicalJsonString,
+  sha256Hex,
+  createEnvelope as createEnvelopeBase,
+  workspaceRegistriesFor,
+} from "./task_board_core_pi.js";
+import { readFileSync, existsSync } from "node:fs";
+
+export const BOARD_CLAIM_BRIDGE_SCHEMA = "agentic-driver.board-claim-bridge.v1";
+export const BOARD_CLAIM_RECEIPT_SCHEMA = "vogelkop.board-claim-receipt.v1";
+export const REQUEST_SCHEMA = "vogelkop.board-claim-request.v1";
+
+const ROLE_NAME_RE = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/;
+const ROUTE_SOURCE_KINDS = new Set(["explicit-board-route", "jev-fallback"]);
+
+function verifiedMoat({ request, backendBaseUrlFor, moatPolicy }) {
+  if (typeof backendBaseUrlFor !== "function") {
+    return fail("moat-evidence-required", "the authority boundary requires a trusted backend registry lookup (fails closed)");
+  }
+  const baseUrl = backendBaseUrlFor(request.route.seatAlias);
+  let host;
+  try { host = new URL(baseUrl).hostname; } catch {
+    return fail("moat-evidence-invalid", "the trusted backend registry did not provide a valid URL (fails closed)");
+  }
+  const local = host === "127.0.0.1" || host === "localhost" || host === "::1";
+  if (!local && moatPolicy?.allowHostedEgress !== true) {
+    return fail("moat-denied", `backend host "${host}" is not loopback — hosted egress is denied (fails closed)`);
+  }
+  return { ok: true, evidence: { ok: true, locality: local ? "local" : "hosted", basis: "trusted-backend-registry" } };
+}
+
+function fail(code, reason, extra = {}) {
+  return { ok: false, schema: BOARD_CLAIM_BRIDGE_SCHEMA, code, reason, ...extra };
+}
+
+/**
+ * Verify the request's cardHash against the CURRENT board bytes. This is the
+ * stale/tampered-card gate: a card edited after the request was minted is
+ * refused here, before any claim machinery runs.
+ */
+export function verifyRequestedCard({ boardPath, request }) {
+  if (!existsSync(boardPath)) return fail("board-unavailable", "board file is not present");
+  let registries;
+  try { registries = workspaceRegistriesFor(boardPath); }
+  catch (error) { return fail(error?.code ?? "capability-registry-invalid", error?.message ?? String(error)); }
+  const validated = validateBoard(readFileSync(boardPath, "utf8"), registries);
+  if (!validated.ok) return fail("board-invalid", validated.errors.join("; "), { errors: validated.errors });
+  const card = validated.cards.find((entry) => entry.cardId === request.cardId);
+  if (!card) return fail("card-not-found", `card ${request.cardId} is not on the board`);
+  const onDiskHash = card.hash ?? computeCardHash(card);
+  if (onDiskHash !== request.cardHash) {
+    return fail("card-hash-mismatch",
+      `request cardHash does not match the on-disk card hash (stale or tampered request — fails closed)`);
+  }
+  return { ok: true, card, validated };
+}
+
+/**
+ * Mint the route-decision identity the envelope carries. The bridge does not
+ * re-route: the seat/model identity comes from the request's resolved route
+ * (explicit board route or injected Jev fallback), and the digest binds it
+ * deterministically so the envelope's routeDecisionDigest is reproducible
+ * from the receipt. No router config, no capacity snapshot, no janus call.
+ */
+export function bridgeRouteFor({ request, repository }) {
+  return {
+    seatId: `vogelkop-${request.route.seatAlias}`,
+    accountId: null,
+    provider: "vogelkop-router",
+    model: request.route.seatAlias,
+    role: request.route.seat,
+    effort: "default",
+    containmentTier: "testudo",
+    phase: "implement",
+    routeDecisionDigest: sha256Hex(canonicalJsonString({
+      schema: "vogelkop.board-claim-route.v1",
+      cardId: request.cardId,
+      seatAlias: request.route.seatAlias,
+      seat: request.route.seat,
+      routeSource: request.route.source,
+      moat: request.moat,
+      repository,
+    })),
+    reservationId: null,
+  };
+}
+
+/**
+ * Service one claim request. Single attempt, no retry: whatever claimCard
+ * returns is the outcome. The receipt is a versioned, non-authorizing
+ * observation carrying the card binding, the claim/envelope identity, the
+ * route source and model, the moat result, and the branch/base/scope.
+ */
+export function claimFromVogelkopRequest({ boardPath, request, policy = null, now = null, backendBaseUrlFor = null, moatPolicy = null }) {
+  if (request?.schema !== REQUEST_SCHEMA) {
+    return fail("request-schema-invalid", `unknown request schema "${String(request?.schema)}"`);
+  }
+  if (request.boardPathBasename !== "TASKS.md") {
+    return fail("request-board-invalid", "the request must name the canonical TASKS.md board");
+  }
+  if (typeof request.cardId !== "string" || request.cardId === "") {
+    return fail("request-card-invalid", "the request carries no cardId");
+  }
+  if (!/^[0-9a-f]{64}$/.test(request.cardHash ?? "")) {
+    return fail("request-hash-invalid", "the request cardHash is not a sha256 hex digest");
+  }
+  if (request.authorityCreated !== false) {
+    return fail("request-authority-invalid", "a claim request never carries authority (fails closed)");
+  }
+  if (typeof request.route?.seatAlias !== "string" || request.route.seatAlias === ""
+      || typeof request.route?.seat !== "string" || !ROLE_NAME_RE.test(request.route.seat)) {
+    return fail("request-route-invalid", "the request carries no valid resolved route seat and alias");
+  }
+  if (!ROUTE_SOURCE_KINDS.has(request.route?.source?.kind)) {
+    return fail("request-route-source-invalid", "the route source is not in the closed source vocabulary");
+  }
+  const moat = verifiedMoat({ request, backendBaseUrlFor, moatPolicy });
+  if (!moat.ok) return moat;
+
+  const verify = verifyRequestedCard({ boardPath, request });
+  if (!verify.ok) return verify;
+
+  // Delegation: the existing claim machinery owns exclusivity, HMAC,
+  // expiry, and authoritative hash verification. The route is bound as the
+  // envelope's route identity; the policy is the caller's (the automation
+  // policy file beside the board is used when none is supplied).
+  const route = bridgeRouteFor({ request, repository: boardPath.replace(/\/[^/]*$/, "") });
+  const result = claimCard({ boardPath, cardId: request.cardId, role: request.route.seat, policy, now, route });
+  if (!result.ok && result.code !== "claim-recoverable") {
+    return fail(result.code ?? "claim-refused", result.reason ?? (result.errors ?? []).join("; "), {
+      errors: result.errors ?? [],
+    });
+  }
+
+  const envelope = result.envelope;
+  const claims = readClaimsState(boardPath);
+  const claimRecord = claims.ok
+    ? claims.state.claims.find((entry) => entry.envelopeId === envelope.envelopeId) ?? null
+    : null;
+  return {
+    ok: result.ok,
+    schema: BOARD_CLAIM_RECEIPT_SCHEMA,
+    code: result.code ?? null,
+    recoverable: result.recoverable === true,
+    claimed: true,
+    nonAuthorizing: true,
+    authorityCreated: false,
+    persisted: true,
+    cardId: envelope.cardId,
+    cardHash: envelope.cardHash,
+    claimId: claimRecord ? `${claimRecord.cardId}@${claimRecord.claimedAt}` : null,
+    envelopeId: envelope.envelopeId,
+    route: {
+      source: request.route.source,
+      seat: request.route.seat,
+      seatAlias: request.route.seatAlias,
+      model: envelope.model,
+      provider: envelope.provider,
+    },
+    moat: moat.evidence,
+    branch: envelope.branch,
+    baseRevision: envelope.baseRevision,
+    startingRevision: envelope.startingRevision,
+    scope: [...envelope.allowedPaths],
+    stoppingPoint: envelope.stoppingPoint,
+    repository: envelope.repository,
+    claimedAt: claimRecord?.claimedAt ?? null,
+    expiresAt: envelope.expiry,
+  };
+}

package/scripts/enforcement/herdr_async_dispatch_pi.js

@@ -11,6 +11,7 @@
 
 import {
   executeHerdrCommunication,
+  executeHerdrPromptExchange,
   HERDR_REPORT_MARKERS,
   HERDR_COMMUNICATION_SCHEMA,
   HERDR_COMMUNICATION_ACTIONS,
@@ -18,6 +19,7 @@ import {
 import { isNativeTuiContext } from "./native_tui_context.js";
 import { prepareEnvelopeForExecution, validateEnvelopeForExecution, consumeEnvelope, gitHead } from "./task_board_core_pi.js";
 import { sha256Hex } from "./task_board_core_pi.js";
+import { sessionTaskDisplayId, PROVENANCE_CAPTURE_STATUSES } from "./session_tasks_core_pi.js";
 import { execFileSync } from "node:child_process";
 
 export const WORKER_DISPATCH_TOOL = "agentic_worker_dispatch";
@@ -225,7 +227,7 @@ function journeyReceipt(journey) {
     `status: ${journey.status}`,
     ...(journey.handoff ? [`handoff: attempted=${journey.handoff.attempted} ok=${journey.handoff.ok ?? false} role=${journey.handoff.role ?? journey.role} reason=${journey.handoff.reason ?? "none"}`] : []),
     ...journey.steps.map((step, index) =>
-      `step ${index + 1}: task=${step.taskId ?? "none"} status=${step.status} report=${step.report ?? "(none)"}`),
+      `step ${index + 1}: taskDisplayId=${step.taskDisplayId ?? "none"} status=${step.status} report=${step.report ?? "(none)"}`),
     "[WORKER_JOURNEY_REPORT_END]",
   ].join("\n");
   if (Buffer.byteLength(body, "utf8") > MAX_REPORT_BYTES) {
@@ -238,10 +240,10 @@ function journeyReceipt(journey) {
 // step/terminal evidence it belongs to. Not authority, not persisted
 // separately, and not written on every timer tick — only at assignment start
 // and meaningful checkpoints. Repository observations are read-only.
-function progressSnapshot({ taskId = null, envelope = null, repository = null, workerStatus = null, lastReportAt = null }) {
+function progressSnapshot({ taskDisplayId = null, envelope = null, repository = null, workerStatus = null, lastReportAt = null }) {
   const snapshot = {
     schema: "agentic-driver.progress-snapshot.v1",
-    taskId,
+    taskDisplayId,
     at: new Date().toISOString(),
   };
   if (envelope) {
@@ -289,9 +291,42 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
   }
   const role = params.role;
   const stepPrompt = params.stepPrompt;
-  const taskStore = options.taskStore;
+  // A factory scopes observational advancement to this journey. Direct callers
+  // may still inject the original read-only taskStore contract unchanged.
+  const taskStore = typeof options.taskStoreFactory === "function"
+    ? options.taskStoreFactory(context) : options.taskStore;
   const spawnReplacement = typeof options.spawnReplacement === "function" ? options.spawnReplacement : null;
   const journey = { mode, autonomy, role, steps: [], status: "failed", code: null, handoff: null };
+  // Snapshot once at journey start; observational evidence never gates or
+  // authorizes existing dispatch, replacement, or board execution.
+  // Full immutable capture stays local for drift revalidation. The tool
+  // result only ever carries the sanitized projection: task id, digest, and
+  // source identity — never raw title/description planning text.
+  let taskProvenance = { status: "source-unavailable", tasks: [] };
+  try {
+    if (typeof taskStore?.captureProvenance === "function") taskProvenance = taskStore.captureProvenance();
+  } catch {
+    taskProvenance = { status: "source-unavailable", tasks: [] };
+  }
+  let projectedTaskProvenance;
+  try {
+    projectedTaskProvenance = typeof taskStore?.projectProvenance === "function"
+      ? taskStore.projectProvenance(taskProvenance)
+      : null;
+  } catch {
+    projectedTaskProvenance = null;
+  }
+  if (!projectedTaskProvenance || typeof projectedTaskProvenance !== "object") {
+    // Closed fallback: a throwing or absent projector never alters dispatch,
+    // never surfaces raw task material, and never passes a status through.
+    projectedTaskProvenance = Object.freeze({
+      status: typeof taskProvenance?.status === "string" && PROVENANCE_CAPTURE_STATUSES.includes(taskProvenance.status)
+        ? taskProvenance.status
+        : "source-unavailable",
+      source: null,
+      tasks: [],
+    });
+  }
   const dispatched = new Set();
   const communicationOptions = options.communication ?? options;
   const replacementRole = options.replacementRole ?? role;
@@ -318,7 +353,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
         status = "failed";
         journey.status = "failed";
         journey.code = consumed?.code || "envelope-consume-failed";
-        journey.steps.push({ step: journey.steps.length + 1, taskId: null, status: "failed", error: consumed?.reason || "envelope consumption failed closed" });
+        journey.steps.push({ step: journey.steps.length + 1, taskDisplayId: null, status: "failed", error: consumed?.reason || "envelope consumption failed closed" });
       } else {
         envelopeConsumed = true;
       }
@@ -339,6 +374,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       report: journeyReceipt(journey),
       reportMarkers: { open: "[WORKER_JOURNEY_REPORT_BEGIN]", close: "[WORKER_JOURNEY_REPORT_END]" },
       handoff: journey.handoff,
+      taskProvenance: projectedTaskProvenance,
       nonAuthorizing: true,
       persisted: false,
     };
@@ -348,10 +384,10 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
   // worker for the same trusted repository/role through the existing
   // herdr-lifecycle spawn boundary (fixed argv, shell:false) and resume the
   // pending task sequence. Reuses the same task cards; never duplicates them.
-  const handoffToReplacement = async (reason, taskId = null) => {
+  const handoffToReplacement = async (reason, taskDisplayId = null) => {
     journey.status = "worker-unresponsive";
     journey.code = "worker-unresponsive";
-    journey.steps.push({ step: journey.steps.length + 1, taskId, status: "worker-unresponsive", error: reason });
+    journey.steps.push({ step: journey.steps.length + 1, taskDisplayId, status: "worker-unresponsive", error: reason });
     if (!spawnReplacement) {
       journey.handoff = { attempted: false, reason: "replacement spawn is not available in this context" };
       return finish("worker-unresponsive");
@@ -472,13 +508,13 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
     } catch (error) {
       journey.status = "failed";
       journey.code = error?.code || "envelope-invalid";
-      journey.steps.push({ step: 0, taskId: null, status: "failed", error: String(error?.message || error).slice(0, 256) });
+      journey.steps.push({ step: 0, taskDisplayId: null, status: "failed", error: String(error?.message || error).slice(0, 256) });
       return finish("failed");
     }
     if (!guard.ok) {
       journey.status = "failed";
       journey.code = guard.code || "envelope-invalid";
-      journey.steps.push({ step: 0, taskId: null, status: "failed", error: guard.reason });
+      journey.steps.push({ step: 0, taskDisplayId: null, status: "failed", error: guard.reason });
       return finish("failed");
     }
   }
@@ -493,9 +529,18 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
     } catch (error) {
       journey.status = error?.code === "role_blocked" ? "role-blocked" : "failed";
       journey.code = error?.code || "pulse-failed";
-      journey.steps.push({ step: stepIndex, taskId: null, status: journey.status, error: String(error?.message || error).slice(0, 256) });
+      journey.steps.push({ step: stepIndex, taskDisplayId: null, status: journey.status, error: String(error?.message || error).slice(0, 256) });
       return finish(journey.status);
     }
+    // The pre-task pulse has not selected a task. Confirmed replacement here
+    // cannot be tied to a task identity, so it must not offer a spawn.
+    if (autonomy !== "autonomous" && (!pulse.alive || (!pulse.dispatchEligible && pulse.status !== "blocked"))) {
+      journey.status = "worker-unresponsive";
+      journey.code = "worker-unresponsive";
+      journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "worker-unresponsive", error: "worker unavailable before task selection" });
+      journey.handoff = { attempted: false, reason: "no task selected for confirmed replacement" };
+      return finish("worker-unresponsive");
+    }
     if (!pulse.alive) {
       return handoffToReplacement("worker role is not alive");
     }
@@ -503,7 +548,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       if (pulse.status === "blocked") {
         journey.status = "role-blocked";
         journey.code = "role_blocked";
-        journey.steps.push({ step: stepIndex, taskId: null, status: "role-blocked", workerStatus: pulse.status });
+        journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "role-blocked", workerStatus: pulse.status });
         return finish("role-blocked");
       }
       // Not idle within an observed exchange cycle: unresponsive for dispatch.
@@ -516,19 +561,23 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       task = selectNextTask(taskStore, dispatched);
     } catch (error) {
       journey.status = "failed";
-      journey.steps.push({ step: stepIndex, taskId: null, status: "failed", error: String(error?.message || error).slice(0, 256) });
+      journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "failed", error: String(error?.message || error).slice(0, 256) });
       return finish("failed");
     }
     if (!task) {
       journey.status = "exhausted";
-      journey.steps.push({ step: stepIndex, taskId: null, status: "exhausted" });
+      journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "exhausted" });
       return finish("exhausted");
     }
+    // Model-visible evidence carries only the opaque display token; the raw
+    // unbounded session ID stays internal to the store, dispatched set, and
+    // provenance revalidation lookups.
+    const displayTaskId = sessionTaskDisplayId(task.id);
 
     // Interactive opt-in: stop after each step for explicit approval.
     if (mode === "turn-by-turn" && stepIndex > 1) {
       journey.status = "waiting-approval";
-      journey.steps.push({ step: stepIndex, taskId: task.id, status: "waiting-approval" });
+      journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "waiting-approval" });
       return finish("waiting-approval");
     }
 
@@ -537,7 +586,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
     if (autonomy !== "autonomous") {
       if (!isNativeTuiContext(context) || typeof context?.ui?.confirm !== "function") {
         journey.status = "failed";
-        journey.steps.push({ step: stepIndex, taskId: task.id, status: "failed", error: "native TUI confirmation unavailable" });
+        journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "failed", error: "native TUI confirmation unavailable" });
         return finish("failed");
       }
       let confirmed;
@@ -550,12 +599,12 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
         ].join("\n"));
       } catch (error) {
         journey.status = "failed";
-        journey.steps.push({ step: stepIndex, taskId: task.id, status: "failed", error: `confirmation failed: ${error.message}` });
+        journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "failed", error: `confirmation failed: ${error.message}` });
         return finish("failed");
       }
       if (confirmed !== true) {
         journey.status = "cancelled";
-        journey.steps.push({ step: stepIndex, taskId: task.id, status: "cancelled", error: "native confirmation was not granted" });
+        journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "cancelled", error: "native confirmation was not granted" });
         return finish("cancelled");
       }
     }
@@ -568,14 +617,16 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       if (!guard.ok) {
         journey.status = "failed";
         journey.code = guard.code || "envelope-invalid";
-        journey.steps.push({ step: stepIndex, taskId: task.id, status: "failed", error: guard.reason });
+        journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "failed", error: guard.reason });
         return finish("failed");
       }
     }
 
     // One prompt exchange. Any failure is terminal for the journey; there is
-    // no invisible retry or resend.
-    const exchange = await executeHerdrCommunication(
+    // no invisible retry or resend. The legacy blocking exchange is used
+    // deliberately: a journey step is a single prompt→report round-trip, and
+    // the tool-facing prompt action is now async delivery-only.
+    const exchange = await executeHerdrPromptExchange(
       { action: "prompt", role, prompt: `${stepPrompt}\nTask: ${task.id}${task.subject ? ` — ${task.subject}` : ""}`, timeoutMs: 120000 },
       context,
       communicationOptions,
@@ -589,7 +640,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
           // automatically through the guarded seam. The replacement's first
           // prompt includes the mandatory gap-analysis instruction.
           const replacementPrompt = `${stepPrompt}\n\nMANDATORY GAP-ANALYSIS PHASE: you are a replacement agent. Before resuming implementation work: (1) read the task spec; (2) inspect the repository state (code, tests, working tree) — not what prior reports claim; (3) consult the journey history for prior step reports, handoffs, and progress judgments; (4) produce a gap analysis: remaining work and the next concrete sub-step you will execute. You may not resume implementation until this phase is complete.`;
-          const replacement = await executeHerdrCommunication(
+          const replacement = await executeHerdrPromptExchange(
             { action: "prompt", role, prompt: replacementPrompt, timeoutMs: 120000 },
             context,
             communicationOptions,
@@ -602,7 +653,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
           const progressCredited = replacement.ok === true && (!previousScope || gapAnalysis !== previousScope);
           journey.steps.push({
             step: journey.steps.length + 1,
-            taskId: task.id,
+            taskDisplayId: displayTaskId,
             status: replacement.ok === true ? "replaced" : "worker-unresponsive",
             error: replacement.ok === true ? undefined : String(replacement.code),
             gapAnalysis,
@@ -626,22 +677,22 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
             return finish("worker-unresponsive");
           }
         }
-        return handoffToReplacement(`exchange ended with ${exchange.code}`, task.id);
+        return handoffToReplacement(`exchange ended with ${exchange.code}`, displayTaskId);
       }
       journey.status = exchange.code === "role_blocked" ? "role-blocked" : "failed";
       journey.code = exchange.code || "exchange-failed";
-      journey.steps.push({ step: stepIndex, taskId: task.id, status: journey.status, error: exchange.reason || exchange.error || exchange.code });
+      journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: journey.status, error: exchange.reason || exchange.error || exchange.code });
       return finish(journey.status);
     }
     journey.steps.push({
       step: stepIndex,
-      taskId: task.id,
+      taskDisplayId: displayTaskId,
       status: "done",
       workerStatus: exchange.agentStatus,
       report: exchange.report,
       // §10.2 progress snapshot at the meaningful checkpoint (step completion).
       progress: progressSnapshot({
-        taskId: task.id,
+        taskDisplayId: displayTaskId,
         envelope: board?.envelope ?? null,
         repository: options.repository ?? null,
         workerStatus: exchange.agentStatus ?? null,
@@ -670,11 +721,13 @@ export function registerWorkerDispatchInterface(pi, options = {}) {
   pi.registerTool({
     name: WORKER_DISPATCH_TOOL,
     label: "Worker Dispatch And Pulse",
-    description: "Observe worker liveness (pulse) or run one bounded continuous worker journey over the existing task sequence. Continuous mode is the default; turn-by-turn is explicit opt-in. Journeys emit one collated marked report, never create task cards, never retry, and are bounded by step count, not wall-clock.",
-    promptSnippet: "Use agentic_worker_dispatch to pulse a worker or run one bounded continuous journey over the existing task sequence; it observes dispatchable tasks without creating cards and grants no authority.",
+    description: "Observe worker liveness (pulse) or run a bounded journey over coordinator session tasks. Interactive dispatch requires native confirmation; autonomous journeys follow their existing session confirmation semantics. Canonical TASKS.md board cards are dispatched through Board Pulse or agentic_kanban_board_dispatch, not this journey.",
+    promptSnippet: "Use agentic_worker_dispatch for coordinator session tasks only; board cards belong to Board Pulse or agentic_kanban_board_dispatch.",
     promptGuidelines: [
-      "agentic_worker_dispatch pulse observes liveness, state, and dispatch eligibility without granting authority.",
-      "agentic_worker_dispatch dispatch runs at most maxSteps single-exchange steps; any exchange failure ends the journey explicitly with no retry or resend.",
+      "agentic_worker_dispatch pulse observes liveness and eligibility without granting authority.",
+      "agentic_worker_dispatch dispatch observes session tasks without claiming board cards; interactive steps require native confirmation, while autonomous steps follow the session's existing autonomy semantics.",
+      "Board Pulse and agentic_kanban_board_dispatch own TASKS.md claims and the full route evidence required for envelopes. A journey never claims board cards.",
+      "Dispatch runs at most maxSteps single-exchange steps; exchange failure ends the journey without retry or resend.",
     ],
     parameters: WORKER_DISPATCH_PARAMETERS,
     async execute(_id, params, signal, _update, context) {