@felixdotgo/aidlc-kit 0.0.1 → 0.1.0

package/dist/services/aidlc-coordination/test/fleet.test.mjs

@@ -0,0 +1,351 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { FleetConflict, PostgresFleetRepository, SqliteFleetRepository, applyFleetCommand, featureReady, validateCanonicalFeature, validateFeature } from "../src/fleet.mjs";
+import { PostgresStateRepository, SqliteStateRepository } from "../src/repository.mjs";
+import { callTool } from "../src/fleet-client.mjs";
+import { cpSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { PostgresCoordinationRepository } from "../src/coordination.mjs";
+
+const sha = "a".repeat(40);
+const task = { id: "T1", title: "First", type: "infra", phase: "clarify", gate: "G0_confirm", status: "blocked_on_user", language: "en", risk: "normal", areas: ["root"], branch: "—", artifacts: { intent: ".agents/data/tasks/T1/intent.md", design: ".agents/data/tasks/T1/design.md", workplan: ".agents/data/tasks/T1/workplan.md" }, decisions: [], tasks: [], evidence: [], createdAt: "2026-01-01T00:00:00.000Z", updatedAt: "2026-01-01T00:00:00.000Z" };
+
+test("feature graph rejects missing dependencies and cycles and derives ready work", () => {
+  const manifest = validateFeature({ id: "F1", integrationBranch: "feature/one", tasks: [{ id: "T1", dependsOn: [] }, { id: "T2", dependsOn: ["T1"] }] });
+  assert.deepEqual(featureReady(manifest, []).map((item) => item.ready), [true, false]);
+  assert.deepEqual(featureReady(manifest, ["T1"]).map((item) => item.ready), [false, true]);
+  assert.throws(() => validateFeature({ ...manifest, tasks: [{ id: "T1", dependsOn: ["T2"] }, { id: "T2", dependsOn: ["T1"] }] }), /cycle/);
+  assert.throws(() => validateFeature({ ...manifest, tasks: [{ id: "T1", dependsOn: ["missing"] }] }), /unknown feature dependency/);
+  assert.deepEqual(validateCanonicalFeature(manifest,{tasks:{T1:{featureId:"F1"},T2:{featureId:"F1"}}}),manifest);
+  assert.throws(() => validateCanonicalFeature(manifest,{tasks:{T1:{featureId:"F1"}}}),/does not exist in canonical state/);
+  assert.throws(() => validateCanonicalFeature(manifest,{tasks:{T1:{featureId:"F1"},T2:{featureId:"other"}}}),/another feature/);
+});
+
+test("fleet claims fence stale leads and workers, persist checkpoints, and replay idempotently", async () => {
+  const repo = new SqliteFleetRepository(":memory:");
+  try {
+    const feature = await repo.apply("w", 0, "feature", "lead", "lead", { type: "feature_apply", feature: { id: "F1", integrationBranch: "feature/one", tasks: [{ id: "T1", dependsOn: [] }] } });
+    assert.equal(feature.fleet.features.F1.revision, 1);
+    const claimed = await repo.apply("w", 1, "lead-1", "lead", "lead", { type: "run_claim", taskId: "T1", leaseMs: 60000 });
+    assert.equal(claimed.fleet.leads.T1.epoch, 1);
+    const retry = await repo.apply("w", 1, "lead-1", "lead", "lead", { type: "run_claim", taskId: "T1", leaseMs: 60000 });
+    assert.deepEqual(retry, claimed);
+    await assert.rejects(() => repo.apply("w", 2, "wrong-lead", "other", "lead", { type: "run_claim", taskId: "T1", leaseMs: 60000 }), FleetConflict);
+    const scheduled = await repo.apply("w", 2, "schedule", "lead", "lead", { type: "job_schedule", jobId: "J1", taskId: "T1", itemId: "I1", workerId: "worker1", agent: "codex", attempt: 1, leadEpoch: 1, ownedPaths: ["src/a.ts"], baseCommit: sha, branch: "worker/J1" });
+    await assert.rejects(() => repo.apply("w", 3, "wrong-worker", "worker2", "worker", { type: "job_claim", jobId: "J1", leaseMs: 60000 }), /not assigned/);
+    const worker = await repo.apply("w", 3, "worker-claim", "worker1", "worker", { type: "job_claim", jobId: "J1", leaseMs: 60000 });
+    assert.equal(worker.fleet.jobs.J1.epoch, 1);
+    const checkpoint = await repo.apply("w", 4, "checkpoint", "worker1", "worker", { type: "job_checkpoint", jobId: "J1", epoch: 1, sessionId: "session-1", checkpoint: "turn 2" });
+    assert.equal(checkpoint.fleet.jobs.J1.sessionId, "session-1");
+    await assert.rejects(() => repo.apply("w", 5, "changed-session", "worker1", "worker", { type: "job_checkpoint", jobId: "J1", epoch: 1, sessionId: "another-session", checkpoint: "turn 3" }), /session cannot change/);
+    await assert.rejects(() => repo.apply("w", 5, "stale-worker", "worker1", "worker", { type: "job_report", jobId: "J1", epoch: 0, commitSha: sha, changedPaths: [] }), FleetConflict);
+    const report = await repo.apply("w", 5, "report", "worker1", "worker", { type: "job_report", jobId: "J1", epoch: 1, commitSha: sha, changedPaths: ["src/a.ts"] });
+    assert.equal(report.fleet.jobs.J1.state, "reported");
+    await assert.rejects(() => repo.apply("w", 6, "duplicate-report", "worker1", "worker", { type: "job_report", jobId: "J1", epoch: 1, commitSha: sha, changedPaths: [] }), FleetConflict);
+    assert.equal(scheduled.revision, 3);
+  } finally { repo.close(); }
+});
+
+test("lead takeover makes every unfinished prior-epoch job uncertain and recovers a verified commit", () => {
+  const time=Date.parse("2026-01-01T01:00:00.000Z");
+  const base={schemaVersion:1,features:{},leads:{T1:{taskId:"T1",actor:"old",epoch:1,expiresAt:new Date(time-1).toISOString()}},jobs:{}};
+  for(const [name,state] of [["ready","ready"],["leased","leased"],["reported","reported"],["integrated","integrated"]]) base.jobs[name]={schemaVersion:1,id:name,taskId:"T1",itemId:name,workerId:"worker1",agent:"codex",attempt:1,leadEpoch:1,epoch:1,ownedPaths:[`src/${name}.ts`],baseCommit:sha,branch:`worker/${name}`,state,expiresAt:new Date(time+1000).toISOString(),sessionId:"old-session",checkpoint:"old",report:state==="reported"||state==="integrated"?{commitSha:sha,changedPaths:[`src/${name}.ts`]}:null};
+  const expiredWorker=structuredClone(base); expiredWorker.leads.T1.expiresAt=new Date(time+60000).toISOString(); expiredWorker.jobs.leased.expiresAt=new Date(time-1).toISOString();
+  assert.throws(()=>applyFleetCommand(expiredWorker,{type:"job_claim",jobId:"leased",leaseMs:60000},"worker1","worker",time),/requires lead reconciliation/);
+  const reconciled=applyFleetCommand(expiredWorker,{type:"job_reconcile",jobId:"leased",leadEpoch:1,state:"uncertain"},"old","lead",time);
+  assert.equal(reconciled.jobs.leased.uncertainAt,new Date(time).toISOString());
+  const taken=applyFleetCommand(base,{type:"run_claim",taskId:"T1",leaseMs:60000},"new","lead",time);
+  assert.equal(taken.leads.T1.epoch,2);
+  for(const name of ["ready","leased","reported"]) { assert.equal(taken.jobs[name].state,"uncertain"); assert.equal(taken.jobs[name].uncertainAt,new Date(time).toISOString()); }
+  assert.equal(taken.jobs.integrated.state,"integrated");
+  assert.throws(()=>applyFleetCommand(taken,{type:"job_report",jobId:"leased",epoch:1,commitSha:sha,changedPaths:["src/leased.ts"]},"worker1","worker",time+1),/stale or expired job claim/);
+  const recovered=applyFleetCommand(taken,{type:"job_recover",jobId:"reported",leadEpoch:2,commitSha:sha,changedPaths:["src/reported.ts"]},"new","lead",time+1);
+  assert.equal(recovered.jobs.reported.state,"reported"); assert.equal(recovered.jobs.reported.leadEpoch,2); assert.equal(recovered.jobs.reported.uncertainAt,null);
+  const requeued=applyFleetCommand(taken,{type:"job_reconcile",jobId:"ready",leadEpoch:2,state:"ready"},"new","lead",time+1);
+  assert.equal(requeued.jobs.ready.uncertainAt,null); assert.equal(requeued.jobs.ready.sessionId,null);
+  const integrated=applyFleetCommand(recovered,{type:"job_reconcile",jobId:"reported",leadEpoch:2,state:"integrated"},"new","lead",time+2);
+  assert.equal(integrated.jobs.reported.state,"integrated");
+  assert.throws(()=>applyFleetCommand(taken,{type:"job_recover",jobId:"ready",leadEpoch:2,commitSha:sha,changedPaths:["other.ts"]},"new","lead",time+1),/out-of-scope/);
+});
+
+test("review snapshots require a ready wait and approval is atomic against its revision", async () => {
+  const repo = new SqliteStateRepository(":memory:");
+  try {
+    const first = await repo.apply("w", 0, "create", { type: "upsertTask", taskId: "T1", task }, "/workspace/project");
+    assert.equal(first.nextActions.T1.classification, "await_user");
+    const snapshot = await repo.putGateSnapshot("w", 1, "snapshot", "T1", "G0_confirm", "Review this intent");
+    assert.equal((await repo.gateInbox("w")).length, 1);
+    const sibling={...task,id:"T2",title:"Sibling",status:"active",artifacts:{intent:".agents/data/tasks/T2/intent.md",design:".agents/data/tasks/T2/design.md",workplan:".agents/data/tasks/T2/workplan.md"}};
+    await repo.apply("w",1,"sibling",{type:"upsertTask",taskId:"T2",task:sibling},"/workspace/project");
+    assert.equal((await repo.gateInbox("w"))[0].currentRevision,2);
+    await assert.rejects(() => repo.approveGate("w", 0, "stale", "T1", snapshot.id, "human approval", "/workspace/project"), /revision conflict/);
+    const approval = await repo.approveGate("w", 2, "approve", "T1", snapshot.id, "human approval", "/workspace/project");
+    assert.equal(approval.state.tasks.T1.phase, "plan");
+    assert.equal(approval.state.tasks.T1.evidence.at(-1).kind, "approval");
+    assert.deepEqual(await repo.gateInbox("w"), []);
+    assert.deepEqual(await repo.approveGate("w", 2, "approve", "T1", snapshot.id, "human approval", "/workspace/project"), approval);
+    await assert.rejects(() => repo.approveGate("w", 3, "again", "T1", snapshot.id, "human approval", "/workspace/project"), /stale gate snapshot/);
+  } finally { repo.close(); }
+});
+
+test("G2 snapshot binds the reviewed integration commit through approval", async () => {
+  const repo=new SqliteStateRepository(":memory:");
+  try {
+    const g2={...task,phase:"build",gate:"G2_codereview",evidence:[
+      {kind:"approval",gate:"G1_review",result:"pass",source:"human",recordedAt:"2026-01-01T00:00:01.000Z"},
+      {kind:"test",area:"root",result:"pass",source:"test",recordedAt:"2026-01-01T00:00:02.000Z"},
+      {kind:"review",result:"pass",source:"review",recordedAt:"2026-01-01T00:00:03.000Z"}
+    ]};
+    const created=await repo.apply("g2",0,"create",{type:"upsertTask",taskId:"T1",task:g2},"/workspace/project");
+    assert.equal(created.nextActions.T1.classification,"await_user");
+    await assert.rejects(() => repo.putGateSnapshot("g2",1,"missing","T1","G2_codereview","Review build"),/integration commit SHA/);
+    const snapshot=await repo.putGateSnapshot("g2",1,"snapshot","T1","G2_codereview","Review build",undefined,sha);
+    assert.deepEqual(await repo.putGateSnapshot("g2",0,"snapshot","T1","G2_codereview","Changed retry",undefined,sha),snapshot);
+    assert.equal((await repo.gateInbox("g2"))[0].integrationCommit,sha);
+    assert.match(snapshot.reviewText,new RegExp(`Integration commit: ${sha}`));
+    await assert.rejects(() => repo.approveGate("g2",1,"wrong","T1",snapshot.id,"human","/workspace/project","b".repeat(40)),/does not match/);
+    const approved=await repo.approveGate("g2",1,"approved","T1",snapshot.id,"human","/workspace/project",sha);
+    assert.equal(approved.state.tasks.T1.phase,"wrap");
+  } finally {repo.close();}
+});
+
+test("a fleet lifecycle mutation is fenced by the current lead epoch", async () => {
+  const dir=mkdtempSync(join(tmpdir(),"aidlc-fleet-fence-")); const file=join(dir,"state.db");
+  const fleet=new SqliteFleetRepository(file); const state=new SqliteStateRepository(file);
+  try {
+    const lead=await fleet.apply("w",0,"claim","lead","lead",{type:"run_claim",taskId:"T1",leaseMs:60000});
+    assert.equal(lead.fleet.leads.T1.epoch,1);
+    await assert.rejects(() => state.apply("w",0,"wrong",{type:"upsertTask",taskId:"T1",task},"/workspace/project",0),/stale or expired lead epoch/);
+    const activeT1={...task,status:"active"};
+    const created=await state.apply("w",0,"create",{type:"upsertTask",taskId:"T1",task:activeT1},"/workspace/project",1);
+    assert.equal(created.revision,1);
+    assert.equal(created.nextActions.T1.classification,"run_phase");
+    const forged={...activeT1,evidence:[{kind:"approval",gate:"G0_confirm",result:"pass",source:"forged by lead",recordedAt:"2026-01-01T00:00:01.000Z"}]};
+    await assert.rejects(() => state.apply("w",1,"forged",{type:"upsertTask",taskId:"T1",task:forged},"/workspace/project",1),/lead credential cannot record human gate approval/);
+    await fleet.apply("w",1,"claim-T2","lead","lead",{type:"run_claim",taskId:"T2",leaseMs:60000});
+    const active={...task,id:"T2",title:"Active sibling",status:"active",artifacts:{intent:".agents/data/tasks/T2/intent.md",design:".agents/data/tasks/T2/design.md",workplan:".agents/data/tasks/T2/workplan.md"}};
+    await state.apply("w",1,"create-T2",{type:"upsertTask",taskId:"T2",task:active},"/workspace/project",1);
+    for(const [phase,gate,status] of [["plan","G1_review","active"],["build","G2_codereview","active"],["wrap","none","active"],["done","none","done"]]) {
+      const skipped={...active,phase,gate,status,...(phase==="done"?{lessonDisposition:{status:"none",reason:"none",source:"lead",recordedAt:"2026-01-01T00:00:02.000Z"}}:{})};
+      await assert.rejects(() => state.apply("w",2,`skip-${phase}`,{type:"upsertTask",taskId:"T2",task:skipped},"/workspace/project",1),/human gate approval is required/);
+    }
+    await assert.rejects(() => state.apply("w",2,"remove-active",{type:"removeTask",taskId:"T2"},"/workspace/project",1),/active fleet task cannot be removed/);
+    await fleet.apply("w",2,"release","lead","lead",{type:"run_release",taskId:"T1",epoch:1});
+    await assert.rejects(() => state.apply("w",2,"stale",{type:"upsertTask",taskId:"T1",task},"/workspace/project",1),/stale or expired lead epoch/);
+  } finally {state.close();fleet.close();rmSync(dir,{recursive:true,force:true});}
+});
+
+test("fenced lead may complete the gateless wrap phase after lesson disposition", async () => {
+  const dir=mkdtempSync(join(tmpdir(),"aidlc-fleet-wrap-")); const file=join(dir,"state.db");
+  const fleet=new SqliteFleetRepository(file); const state=new SqliteStateRepository(file);
+  try {
+    const wrapped={...task,phase:"wrap",gate:"none",status:"active",evidence:[
+      {kind:"approval",gate:"G1_review",result:"pass",source:"human",recordedAt:"2026-01-01T00:00:00.000Z"},
+      {kind:"approval",gate:"G2_codereview",result:"pass",source:"human",recordedAt:"2026-01-01T00:00:01.000Z"}
+    ],lessonDisposition:{status:"none",reason:"none",source:"human",recordedAt:"2026-01-01T00:00:02.000Z"}};
+    await state.apply("w",0,"seed",{type:"upsertTask",taskId:"T1",task:wrapped},"/workspace/project");
+    await fleet.apply("w",0,"claim","lead","lead",{type:"run_claim",taskId:"T1",leaseMs:60000});
+    const done=await state.apply("w",1,"complete",{type:"transition",taskId:"T1",target:"done"},"/workspace/project",1);
+    assert.equal(done.state.tasks.T1.phase,"done");
+    assert.equal(done.nextActions.T1.classification,"complete");
+  } finally {state.close();fleet.close();rmSync(dir,{recursive:true,force:true});}
+});
+
+test("MCP client parses a stateless SSE tool response and rejects tool errors", async () => {
+  const ok=await callTool({url:"http://localhost/mcp",token:"test",name:"fleet_get",args:{workspace:"w"},fetchImpl:async (_,options)=>{const body=JSON.parse(options.body);return new Response(`data: ${JSON.stringify({jsonrpc:"2.0",id:body.id,result:{content:[{type:"text",text:JSON.stringify({revision:1})}]}})}\n\n`,{status:200,headers:{"content-type":"text/event-stream"}});}});
+  assert.equal(ok.revision,1);
+  await assert.rejects(() => callTool({url:"http://localhost/mcp",token:"test",name:"x",fetchImpl:async (_,options)=>{const body=JSON.parse(options.body);return new Response(JSON.stringify({jsonrpc:"2.0",id:body.id,result:{isError:true,content:[{type:"text",text:JSON.stringify({code:"DENIED",message:"role denied"})}]}}),{status:200,headers:{"content-type":"application/json"}});}}),/role denied/);
+});
+
+test("installed project fleet wrapper resolves its runner assets", () => {
+  const dir=mkdtempSync(join(tmpdir(),"aidlc-fleet-installed-"));
+  try {
+    const serviceSrc=join(dir,".agents","aidlc-coordination","src");
+    mkdirSync(serviceSrc,{recursive:true});
+    for(const file of ["fleet-run.mjs","fleet-client.mjs"]) cpSync(new URL(`../src/${file}`,import.meta.url),join(serviceSrc,file));
+    cpSync(new URL("../../../assets/aidlc/scripts",import.meta.url),join(dir,".agents","aidlc","scripts"),{recursive:true});
+    const run=spawnSync(process.execPath,[join(serviceSrc,"fleet-run.mjs")],{encoding:"utf8"});
+    assert.equal(run.status,1);
+    assert.match(`${run.stdout}\n${run.stderr}`,/Usage: aidlc-fleet coordinator/,JSON.stringify({stdout:run.stdout,stderr:run.stderr,error:run.error?.message}));
+    assert.doesNotMatch(run.stderr,/Fleet runner assets are missing|ERR_MODULE_NOT_FOUND/);
+  } finally { rmSync(dir,{recursive:true,force:true}); }
+});
+
+test("PostgreSQL board preserves the full task/comment projection across writes", { skip: !process.env.TEST_POSTGRES_URL }, async () => {
+  const repo=new PostgresCoordinationRepository(process.env.TEST_POSTGRES_URL); const workspace=`test-${randomUUID()}`;
+  try {
+    await repo.apply(workspace,0,"create","human","writer",{type:"upsert_task",task:{id:"K1",title:"Work",status:"ready"}});
+    await repo.apply(workspace,1,"comment","human","commenter",{type:"add_comment",taskId:"K1",authorType:"human",intent:"status",body:"Progress"});
+    const board=await repo.get(workspace); const thread=await repo.thread(workspace,"K1");
+    assert.deepEqual(board.board.tasks.map((item)=>item.id),["K1"]);
+    assert.deepEqual(thread.comments.map((item)=>item.body),["Progress"]);
+    const row=(await repo.pool.query("SELECT board FROM coordination_workspaces WHERE workspace=$1",[workspace])).rows[0];
+    assert.equal(Array.isArray(row.board.tasks),false);
+    assert.equal(row.board.comments.K1.length,1);
+  } finally { await repo.pool.query("DELETE FROM coordination_events WHERE workspace=$1",[workspace]); await repo.pool.query("DELETE FROM coordination_idempotency WHERE workspace=$1",[workspace]); await repo.pool.query("DELETE FROM coordination_workspaces WHERE workspace=$1",[workspace]); await repo.close(); }
+});
+
+test("PostgreSQL fleet and canonical state enforce fencing and atomic reviewer approval", { skip: !process.env.TEST_POSTGRES_URL }, async () => {
+  const fleet=new PostgresFleetRepository(process.env.TEST_POSTGRES_URL); const state=new PostgresStateRepository(process.env.TEST_POSTGRES_URL); const workspace=`test-${randomUUID()}`;
+  try {
+    const claim=await fleet.apply(workspace,0,"claim","lead","lead",{type:"run_claim",taskId:"T1",leaseMs:60000});
+    assert.equal(claim.fleet.leads.T1.epoch,1);
+    await assert.rejects(() => state.apply(workspace,0,"stale",{type:"upsertTask",taskId:"T1",task},"/workspace/project",0),/stale or expired lead epoch/);
+    const activeTask={...task,status:"active"};
+    const created=await state.apply(workspace,0,"create",{type:"upsertTask",taskId:"T1",task:activeTask},"/workspace/project",1);
+    assert.equal(created.nextActions.T1.classification,"run_phase");
+    for(const [phase,gate,status] of [["plan","G1_review","active"],["build","G2_codereview","active"],["wrap","none","active"],["done","none","done"]]) {
+      const skipped={...activeTask,phase,gate,status,...(phase==="done"?{lessonDisposition:{status:"none",reason:"none",source:"lead",recordedAt:"2026-01-01T00:00:02.000Z"}}:{})};
+      await assert.rejects(() => state.apply(workspace,1,`skip-${phase}`,{type:"upsertTask",taskId:"T1",task:skipped},"/workspace/project",1),/human gate approval is required/);
+    }
+    await state.apply(workspace,1,"wait",{type:"upsertTask",taskId:"T1",task},"/workspace/project",1);
+    const snapshot=await state.putGateSnapshot(workspace,2,"snapshot","T1","G0_confirm","Review this intent",1);
+    assert.deepEqual(await state.putGateSnapshot(workspace,0,"snapshot","T1","G0_confirm","Changed retry",1),snapshot);
+    const forged={...task,status:"active",evidence:[{kind:"approval",gate:"G0_confirm",result:"pass",source:"forged by lead",recordedAt:"2026-01-01T00:00:01.000Z"}]};
+    await assert.rejects(() => state.apply(workspace,2,"forged",{type:"upsertTask",taskId:"T1",task:forged},"/workspace/project",1),/lead credential cannot record human gate approval/);
+    const sibling={...task,id:"T2",title:"Sibling",status:"active",artifacts:{intent:".agents/data/tasks/T2/intent.md",design:".agents/data/tasks/T2/design.md",workplan:".agents/data/tasks/T2/workplan.md"}};
+    await state.apply(workspace,2,"sibling",{type:"upsertTask",taskId:"T2",task:sibling},"/workspace/project");
+    assert.equal((await state.gateInbox(workspace))[0].currentRevision,3);
+    const approval=await state.approveGate(workspace,3,"approve","T1",snapshot.id,"human approval","/workspace/project");
+    assert.equal(approval.state.tasks.T1.phase,"plan");
+    await assert.rejects(() => state.approveGate(workspace,4,"stale-snapshot","T1",snapshot.id,"human approval","/workspace/project"),/stale gate snapshot/);
+    const g2={...task,id:"T3",title:"G2 task",phase:"build",gate:"G2_codereview",artifacts:{intent:".agents/data/tasks/T3/intent.md",design:".agents/data/tasks/T3/design.md",workplan:".agents/data/tasks/T3/workplan.md"},evidence:[
+      {kind:"approval",gate:"G1_review",result:"pass",source:"human",recordedAt:"2026-01-01T00:00:01.000Z"},
+      {kind:"test",area:"root",result:"pass",source:"test",recordedAt:"2026-01-01T00:00:02.000Z"},
+      {kind:"review",result:"pass",source:"review",recordedAt:"2026-01-01T00:00:03.000Z"}
+    ]};
+    await state.apply(workspace,4,"seed-g2",{type:"upsertTask",taskId:"T3",task:g2},"/workspace/project");
+    const g2Snapshot=await state.putGateSnapshot(workspace,5,"g2-snapshot","T3","G2_codereview","Review integrated build",undefined,sha);
+    assert.equal((await state.gateInbox(workspace))[0].integrationCommit,sha);
+    assert.match(g2Snapshot.reviewText,new RegExp(`Integration commit: ${sha}`));
+    await assert.rejects(() => state.approveGate(workspace,5,"g2-wrong","T3",g2Snapshot.id,"human approval","/workspace/project","b".repeat(40)),/does not match/);
+    const g2Approval=await state.approveGate(workspace,5,"g2-approved","T3",g2Snapshot.id,"human approval","/workspace/project",sha);
+    assert.equal(g2Approval.state.tasks.T3.phase,"wrap");
+    await fleet.apply(workspace,1,"schedule","lead","lead",{type:"job_schedule",jobId:"J1",taskId:"T1",itemId:"I1",workerId:"worker1",agent:"codex",attempt:1,leadEpoch:1,ownedPaths:["src/a.ts"],baseCommit:sha,branch:"worker/J1"});
+    await fleet.apply(workspace,2,"worker-claim","worker1","worker",{type:"job_claim",jobId:"J1",leaseMs:60000});
+    await fleet.apply(workspace,3,"worker-report","worker1","worker",{type:"job_report",jobId:"J1",epoch:1,commitSha:sha,changedPaths:["src/a.ts"]});
+    await fleet.apply(workspace,4,"release","lead","lead",{type:"run_release",taskId:"T1",epoch:1});
+    const takeover=await fleet.apply(workspace,5,"takeover","lead","lead",{type:"run_claim",taskId:"T1",leaseMs:60000});
+    assert.equal(takeover.fleet.jobs.J1.state,"uncertain");
+    assert.match(takeover.fleet.jobs.J1.uncertainAt,/^\d{4}-\d{2}-\d{2}T/);
+    await assert.rejects(() => fleet.apply(workspace,6,"late-worker","worker1","worker",{type:"job_report",jobId:"J1",epoch:1,commitSha:sha,changedPaths:["src/a.ts"]}),/stale or expired job claim/);
+    const recovered=await fleet.apply(workspace,6,"recover","lead","lead",{type:"job_recover",jobId:"J1",leadEpoch:2,commitSha:sha,changedPaths:["src/a.ts"]});
+    assert.equal(recovered.fleet.jobs.J1.state,"reported"); assert.equal(recovered.fleet.jobs.J1.leadEpoch,2);
+  } finally {
+    for(const table of ["state_gate_snapshots","state_events","state_idempotency","state_workspaces","fleet_idempotency","fleet_workspaces"]) await state.pool.query(`DELETE FROM ${table} WHERE workspace=$1`,[workspace]);
+    await state.close();await fleet.close();
+  }
+});
+
+test("tokenized supervisor claim fences same-identity contenders and atomically checkpoints approval", async () => {
+  const dir=mkdtempSync(join(tmpdir(),"aidlc-checkpoint-")); const file=join(dir,"state.db");
+  const fleet=new SqliteFleetRepository(file); let state=new SqliteStateRepository(file);
+  const ownerToken="a".repeat(64);
+  try {
+    await state.apply("w",0,"seed",{type:"upsertTask",taskId:"T1",task},"/workspace/project");
+    const claim=await fleet.apply("w",0,"claim-token","lead","lead",{type:"run_claim",taskId:"T1",leaseMs:60000,ownerToken});
+    assert.equal(JSON.stringify(claim).includes(ownerToken),false);
+    await assert.rejects(() => fleet.apply("w",1,"bad-heartbeat","lead","lead",{type:"run_heartbeat",taskId:"T1",epoch:1,leaseMs:60000,ownerToken:"b".repeat(64)}),/stale or expired/);
+    await assert.rejects(() => state.putGateSnapshot("w",1,"bad-snapshot","T1","G0_confirm","Review",1,undefined,"b".repeat(64),true),/stale or expired/);
+    const snap=await state.putGateSnapshot("w",1,"snapshot-token","T1","G0_confirm","Review",1,undefined,ownerToken,true);
+    assert.equal((await state.gateCheckpoint("w","T1")).status,"pending");
+    await assert.rejects(() => state.approveGate("w",0,"bad-approval","T1",snap.id,"human","/workspace/project"),/revision conflict/);
+    assert.equal((await state.gateCheckpoint("w","T1")).status,"pending");
+    const approved=await state.approveGate("w",1,"approve-token","T1",snap.id,"human","/workspace/project");
+    state.close(); state=new SqliteStateRepository(file);
+    const checkpoint=await state.gateCheckpoint("w","T1");
+    assert.equal(checkpoint.status,"approved"); assert.equal(checkpoint.approvalRevision,approved.revision); assert.equal(checkpoint.snapshotId,snap.id);
+    assert.deepEqual(await state.approveGate("w",1,"approve-token","T1",snap.id,"human","/workspace/project"),approved);
+    await fleet.apply("w",1,"release-token","lead","lead",{type:"run_release",taskId:"T1",epoch:1,ownerToken});
+    await assert.rejects(() => state.apply("w",approved.revision,"stale-token",{type:"upsertTask",taskId:"T1",task:approved.state.tasks.T1},"/workspace/project",1,ownerToken),/stale or expired/);
+  } finally {state.close();fleet.close();rmSync(dir,{recursive:true,force:true});}
+});
+
+test("PostgreSQL tokenized checkpoint survives approval and rejects stale owners", { skip: !process.env.TEST_POSTGRES_URL }, async () => {
+  const workspace = `test-${randomUUID()}`;
+  const fleet = new PostgresFleetRepository(process.env.TEST_POSTGRES_URL);
+  const state = new PostgresStateRepository(process.env.TEST_POSTGRES_URL);
+  const ownerToken = "c".repeat(64);
+  try {
+    await state.apply(workspace, 0, "seed", { type: "upsertTask", taskId: "T1", task }, "/workspace/project");
+    await fleet.apply(workspace, 0, "claim", "lead", "lead", { type: "run_claim", taskId: "T1", leaseMs: 60000, ownerToken });
+    await assert.rejects(() => state.putGateSnapshot(workspace, 1, "bad", "T1", "G0_confirm", "Review", 1, undefined, "d".repeat(64), true), /stale or expired/);
+    const snapshot = await state.putGateSnapshot(workspace, 1, "snapshot", "T1", "G0_confirm", "Review", 1, undefined, ownerToken, true);
+    assert.equal((await state.gateCheckpoint(workspace, "T1")).status, "pending");
+    const approved = await state.approveGate(workspace, 1, "approve", "T1", snapshot.id, "human", "/workspace/project");
+    const checkpoint = await state.gateCheckpoint(workspace, "T1");
+    assert.equal(checkpoint.status, "approved");
+    assert.equal(Number(checkpoint.approvalRevision), approved.revision);
+    assert.equal(checkpoint.snapshotId, snapshot.id);
+    await fleet.apply(workspace, 1, "release", "lead", "lead", { type: "run_release", taskId: "T1", epoch: 1, ownerToken });
+    await assert.rejects(() => state.apply(workspace, approved.revision, "stale", { type: "upsertTask", taskId: "T1", task: approved.state.tasks.T1 }, "/workspace/project", 1, ownerToken), /stale or expired/);
+  } finally {
+    for (const table of ["state_gate_checkpoints", "state_gate_snapshots", "state_events", "state_idempotency", "state_workspaces", "fleet_idempotency", "fleet_workspaces"]) await state.pool.query(`DELETE FROM ${table} WHERE workspace=$1`, [workspace]);
+    await state.close(); await fleet.close();
+  }
+});
+
+test('supervised restart atomically validates approval checkpoint before claiming and consumes on fenced write', async () => {
+  const dir=mkdtempSync(join(tmpdir(),'fleet-restart-')), file=join(dir,'state.db');
+  const fleet=new SqliteFleetRepository(file), state=new SqliteStateRepository(file), supervisor='s'.repeat(64), run='r'.repeat(64);
+  try {
+    const active={...task,status:'active'};
+    await state.apply('w',0,'seed',{type:'upsertTask',taskId:'T1',task:active},'/workspace/project');
+    await fleet.apply('w',0,'super','lead','lead',{type:'supervisor_claim',taskId:'T1',leaseMs:60000,ownerToken:supervisor});
+    const digest=(value)=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+    const initial={type:'run_claim',taskId:'T1',leaseMs:60000,ownerToken:run,supervisorEpoch:1,supervisorOwnerToken:supervisor,expectedStateRevision:1,expectedTaskDigest:digest((await state.get('w')).state.tasks.T1)};
+    await assert.rejects(fleet.apply('w',1,'bad-digest','lead','lead',{...initial,expectedTaskDigest:'0'.repeat(64)}),/changed or is not runnable/);
+    await fleet.apply('w',1,'run','lead','lead',initial);
+    await state.apply('w',1,'wait',{type:'upsertTask',taskId:'T1',task},'/workspace/project',1,run,'lead');
+    const snapshot=await state.putGateSnapshot('w',2,'snap','T1','G0_confirm','Review',1,undefined,run,true,'lead');
+    await assert.rejects(state.putGateSnapshot('w',2,'snap','T1','G0_confirm','Changed review',1,undefined,run,true,'lead'),/idempotency payload/);
+    await fleet.apply('w',2,'release-run','lead','lead',{type:'run_release',taskId:'T1',epoch:1,ownerToken:run});
+    const approved=await state.approveGate('w',2,'approval','T1',snapshot.id,'human','/workspace/project',undefined,'reviewer');
+    await assert.rejects(state.approveGate('w',2,'approval','T1',snapshot.id,'changed','/workspace/project',undefined,'reviewer'),/idempotency payload/);
+    const restart={...initial,expectedStateRevision:approved.revision,expectedTaskDigest:digest(approved.state.tasks.T1),checkpointSnapshotId:snapshot.id,checkpointApprovalRevision:approved.revision};
+    await assert.rejects(fleet.apply('w',3,'bad-restart','lead','lead',{...restart,checkpointSnapshotId:'wrong'}),/checkpoint/);
+    await fleet.apply('w',3,'restart','lead','lead',restart);
+    assert.equal((await state.gateCheckpoint('w','T1')).status,'approved');
+    await state.apply('w',approved.revision,'progress',{type:'upsertTask',taskId:'T1',task:approved.state.tasks.T1},'/workspace/project',2,run,'lead');
+    assert.equal((await state.gateCheckpoint('w','T1')).status,'consumed');
+    await fleet.apply('w',4,'release-super','lead','lead',{type:'supervisor_release',taskId:'T1',epoch:1,ownerToken:supervisor});
+    await assert.rejects(state.apply('w',approved.revision,'progress',{type:'upsertTask',taskId:'T1',task:approved.state.tasks.T1},'/workspace/project',2,run,'lead'),/supervisor/);
+  } finally {state.close();fleet.close();rmSync(dir,{recursive:true,force:true});}
+});
+
+test('PostgreSQL supervised restart validates and consumes checkpoint', { skip: !process.env.TEST_POSTGRES_URL }, async () => {
+  const fleet=new PostgresFleetRepository(process.env.TEST_POSTGRES_URL), state=new PostgresStateRepository(process.env.TEST_POSTGRES_URL), supervisor='s'.repeat(64), run='r'.repeat(64);
+  const workspace=`restart-${randomUUID()}`;
+  try {
+    const active={...task,status:'active'};
+    await state.apply(workspace,0,'seed',{type:'upsertTask',taskId:'T1',task:active},'/workspace/project');
+    await fleet.apply(workspace,0,'super','lead','lead',{type:'supervisor_claim',taskId:'T1',leaseMs:60000,ownerToken:supervisor});
+    const digest=(value)=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+    const initial={type:'run_claim',taskId:'T1',leaseMs:60000,ownerToken:run,supervisorEpoch:1,supervisorOwnerToken:supervisor,expectedStateRevision:1,expectedTaskDigest:digest((await state.get(workspace)).state.tasks.T1)};
+    await assert.rejects(fleet.apply(workspace,1,'bad-digest','lead','lead',{...initial,expectedTaskDigest:'0'.repeat(64)}),/changed or is not runnable/);
+    await fleet.apply(workspace,1,'run','lead','lead',initial);
+    await state.apply(workspace,1,'wait',{type:'upsertTask',taskId:'T1',task},'/workspace/project',1,run,'lead');
+    const snapshot=await state.putGateSnapshot(workspace,2,'snap','T1','G0_confirm','Review',1,undefined,run,true,'lead');
+    await assert.rejects(state.putGateSnapshot(workspace,2,'snap','T1','G0_confirm','Changed review',1,undefined,run,true,'lead'),/idempotency payload/);
+    await fleet.apply(workspace,2,'release-run','lead','lead',{type:'run_release',taskId:'T1',epoch:1,ownerToken:run});
+    const approved=await state.approveGate(workspace,2,'approval','T1',snapshot.id,'human','/workspace/project',undefined,'reviewer');
+    await assert.rejects(state.approveGate(workspace,2,'approval','T1',snapshot.id,'changed','/workspace/project',undefined,'reviewer'),/idempotency payload/);
+    const restart={...initial,expectedStateRevision:approved.revision,expectedTaskDigest:digest((await state.get(workspace)).state.tasks.T1),checkpointSnapshotId:snapshot.id,checkpointApprovalRevision:approved.revision};
+    await assert.rejects(fleet.apply(workspace,3,'bad-restart','lead','lead',{...restart,checkpointSnapshotId:'wrong'}),/checkpoint/);
+    await fleet.apply(workspace,3,'restart','lead','lead',restart);
+    assert.equal((await state.gateCheckpoint(workspace,'T1')).status,'approved');
+    await state.apply(workspace,approved.revision,'progress',{type:'upsertTask',taskId:'T1',task:approved.state.tasks.T1},'/workspace/project',2,run,'lead');
+    assert.equal((await state.gateCheckpoint(workspace,'T1')).status,'consumed');
+    const intent={workspace,taskId:'T1',epoch:2,ownerToken:run,operationId:'git-op',ref:'refs/heads/main',oldOid:'a'.repeat(40),newOid:'b'.repeat(40)};
+    assert.equal((await fleet.prepareGitOperation(intent)).status,'pending');
+    await assert.rejects(fleet.withGitFence(intent,async()=>{throw new Error('uncertain');}),/uncertain/);
+    assert.equal((await fleet.getGitOperation(intent)).status,'pending');
+    await fleet.withGitFence(intent,async ({assertValid,complete})=>{await assertValid();await complete();});
+    assert.equal((await fleet.getGitOperation(intent)).status,'complete');
+    await fleet.apply(workspace,4,'release-super','lead','lead',{type:'supervisor_release',taskId:'T1',epoch:1,ownerToken:supervisor});
+    await assert.rejects(state.apply(workspace,approved.revision,'progress',{type:'upsertTask',taskId:'T1',task:approved.state.tasks.T1},'/workspace/project',2,run,'lead'),/supervisor/);
+  } finally {for(const table of ['state_request_fingerprints','state_gate_checkpoints','state_gate_snapshots','state_events','state_idempotency','state_workspaces','fleet_git_operations','fleet_idempotency','fleet_workspaces']) await state.pool.query(`DELETE FROM ${table} WHERE workspace=$1`,[workspace]); await state.close();await fleet.close();}
+});

package/dist/services/aidlc-coordination/test/git-gateway.test.mjs

@@ -0,0 +1,75 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createGitGateway } from "../src/git-gateway.mjs";
+const git=(cwd,...args)=>execFileSync("git",args,{cwd,encoding:"utf8",stdio:["ignore","pipe","pipe"]}).trim();
+const token="x".repeat(64);
+function fixture(t) {
+  const dir=mkdtempSync(join(tmpdir(),"aidlc-gateway-")); t.after(()=>rmSync(dir,{recursive:true,force:true}));
+  const repo=join(dir,"bare"), work=join(dir,"work"); mkdirSync(repo); git(repo,"init","--bare"); git(dir,"clone",repo,work); git(work,"checkout","-b","main");
+  writeFileSync(join(work,"a"),"one"); git(work,"add","a"); git(work,"-c","user.name=Test","-c","user.email=test@test","commit","-m","one"); const oldCommit=git(work,"rev-parse","HEAD"); git(work,"push","origin","HEAD:refs/heads/main");
+  writeFileSync(join(work,"a"),"two"); git(work,"add","a"); git(work,"-c","user.name=Test","-c","user.email=test@test","commit","-m","two"); const newCommit=git(work,"rev-parse","HEAD"); git(work,"push","origin","HEAD:refs/heads/objects-staging");
+  return {repo,oldCommit,newCommit};
+}
+function fakeAuthority() {
+  const records=new Map(); let valid=true, active=false, failComplete=false;
+  return {
+    records, setValid:(value)=>{valid=value;}, failComplete:()=>{failComplete=true;},
+    async prepareGitOperation(input) { if(!valid || input.ownerToken!==token) throw new Error("stale fence"); const {ownerToken,...operation}=input; const old=records.get(operation.operationId); if(old && JSON.stringify(old.record)!==JSON.stringify(operation)) throw new Error("operation conflict"); if(!old) records.set(operation.operationId,{record:operation,status:"pending"}); return records.get(operation.operationId); },
+    async withGitFence(input, callback) { if(!valid || input.ownerToken!==token || active) throw new Error("stale fence"); active=true; try { const stored=records.get(input.operationId); return await callback({record:stored.record,assertValid:async ()=>{if(!valid) throw new Error("stale fence");},complete:async ()=>{if(failComplete) throw new Error("crash"); stored.status="complete";}}); } finally {active=false;} }
+  };
+}
+test("gateway fences, CAS updates, and idempotently returns a completed operation", async (t) => {
+  const {repo,oldCommit,newCommit}=fixture(t), authority=fakeAuthority();
+  const gateway=createGitGateway({repo,protectedRefs:["refs/heads/main"],authority});
+  const req={workspace:"w",taskId:"t",epoch:1,ownerToken:token,operationId:"one",ref:"refs/heads/main",oldCommit,newCommit};
+  await assert.rejects(()=>gateway.update({...req,ownerToken:"y".repeat(64)}),/stale fence/);
+  await assert.rejects(()=>gateway.update({...req,ref:"refs/heads/objects-staging"}),/Invalid protected/);
+  assert.equal((await gateway.update(req)).status,"complete"); assert.equal(git(repo,"rev-parse","refs/heads/main"),newCommit);
+  assert.equal((await gateway.update(req)).status,"complete");
+  await assert.rejects(()=>gateway.update({...req,epoch:2}),/operation conflict/);
+});
+test("pending intent after ref update and failed authority commit fails closed", async (t) => {
+  const {repo,oldCommit,newCommit}=fixture(t), authority=fakeAuthority(); const gateway=createGitGateway({repo,protectedRefs:["refs/heads/main"],authority});
+  const req={workspace:"w",taskId:"t",epoch:1,ownerToken:token,operationId:"one",ref:"refs/heads/main",oldCommit,newCommit};
+  authority.failComplete(); await assert.rejects(()=>gateway.update(req),/authority commit uncertain/);
+  assert.equal(git(repo,"rev-parse","refs/heads/main"),newCommit); assert.equal(authority.records.get("one").status,"pending");
+  await assert.rejects(()=>gateway.update(req),/outcome uncertain/);
+});
+test("ref moved before the lease-locked CAS is rejected", async (t) => {
+  const {repo,oldCommit,newCommit}=fixture(t), authority=fakeAuthority(); const gateway=createGitGateway({repo,protectedRefs:["refs/heads/main"],authority});
+  git(repo,"update-ref","refs/heads/main",newCommit,oldCommit);
+  await assert.rejects(()=>gateway.update({workspace:"w",taskId:"t",epoch:1,ownerToken:token,operationId:"race",ref:"refs/heads/main",oldCommit,newCommit}),/outcome uncertain/);
+  assert.equal(authority.records.get("race").status,"pending");
+});
+
+test("lease loss after durable intent prevents Git ref update", async (t) => {
+  const {repo,oldCommit,newCommit}=fixture(t), authority=fakeAuthority();
+  const prepare=authority.prepareGitOperation;
+  authority.prepareGitOperation=async (input)=>{const result=await prepare(input);authority.setValid(false);return result;};
+  const gateway=createGitGateway({repo,protectedRefs:["refs/heads/main"],authority});
+  await assert.rejects(()=>gateway.update({workspace:"w",taskId:"t",epoch:1,ownerToken:token,operationId:"expiry",ref:"refs/heads/main",oldCommit,newCommit}),/stale fence/);
+  assert.equal(git(repo,"rev-parse","refs/heads/main"),oldCommit);
+  assert.equal(authority.records.get("expiry").status,"pending");
+});
+
+test("SQLite authority holds its real lease while gateway updates the Git ref", async (t) => {
+  const {repo,oldCommit,newCommit}=fixture(t);
+  const {SqliteFleetRepository,applyFleetCommand}=await import("../src/fleet.mjs");
+  const authority=new SqliteFleetRepository(":memory:");
+  t.after(()=>authority.close());
+  await authority.get("w");
+  const supervisorToken="s".repeat(64);
+  let fleet={schemaVersion:1,features:{},leads:{},jobs:{}};
+  fleet=applyFleetCommand(fleet,{type:"supervisor_claim",taskId:"t",leaseMs:60000,ownerToken:supervisorToken},"lead","lead");
+  fleet=applyFleetCommand(fleet,{type:"run_claim",taskId:"t",leaseMs:60000,ownerToken:token,supervisorEpoch:1,supervisorOwnerToken:supervisorToken},"lead","lead");
+  authority.db.prepare("UPDATE fleet_workspaces SET fleet=? WHERE workspace=?").run(JSON.stringify(fleet),"w");
+  const gateway=createGitGateway({repo,protectedRefs:["refs/heads/main"],authority});
+  const request={workspace:"w",taskId:"t",epoch:1,ownerToken:token,operationId:"actual",ref:"refs/heads/main",oldCommit,newCommit};
+  assert.equal((await gateway.update(request)).status,"complete");
+  assert.equal((await authority.getGitOperation({workspace:"w",operationId:"actual"})).status,"complete");
+  assert.equal(git(repo,"rev-parse","refs/heads/main"),newCommit);
+});

package/dist/services/aidlc-coordination/test/supervisor-fencing.test.mjs

@@ -0,0 +1,59 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createHash } from 'node:crypto';
+import { applyFleetCommand, SqliteFleetRepository } from '../src/fleet.mjs';
+const owner = 's'.repeat(48), runOwner = 'r'.repeat(48), bad = 'x'.repeat(48), leaseMs = 60000, actor = 'lead', time = 1800000000000;
+const run = (state, command, timestamp = time) => applyFleetCommand(state, command, actor, 'lead', timestamp);
+test('supervisor binds run and fences stale and tokenless leads', () => {
+  let state = { schemaVersion: 1, features: {}, leads: {}, jobs: {} };
+  state = run(state, { type: 'supervisor_claim', taskId: 'T', leaseMs, ownerToken: owner });
+  assert.throws(() => run(state, { type: 'supervisor_claim', taskId: 'T', leaseMs, ownerToken: bad }), /held/);
+  assert.throws(() => run(state, { type: 'run_claim', taskId: 'T', leaseMs }), /supervisor claim/);
+  assert.throws(() => run(state, { type: 'run_claim', taskId: 'T', leaseMs, supervisorEpoch: 1, supervisorOwnerToken: bad, ownerToken: runOwner }), /supervisor claim/);
+  state = run(state, { type: 'run_claim', taskId: 'T', leaseMs, supervisorEpoch: 1, supervisorOwnerToken: owner, ownerToken: runOwner });
+  assert.throws(() => run(state, { type: 'run_heartbeat', taskId: 'T', epoch: 1, leaseMs, ownerToken: bad }), /lead claim/);
+  state = run(state, { type: 'supervisor_release', taskId: 'T', epoch: 1, ownerToken: owner });
+  assert.throws(() => run(state, { type: 'run_heartbeat', taskId: 'T', epoch: 1, leaseMs, ownerToken: runOwner }), /supervisor claim/);
+  state = run(state, { type: 'supervisor_claim', taskId: 'T', leaseMs, ownerToken: bad }, time + leaseMs + 1);
+  assert.equal(state.supervisors.T.epoch, 2);
+  assert.throws(() => run(state, { type: 'run_claim', taskId: 'T', leaseMs, supervisorEpoch: 1, supervisorOwnerToken: owner, ownerToken: runOwner }, time + leaseMs + 2), /supervisor claim/);
+});
+test('supervisor and lead secrets never appear in fleet output or idempotency cache', async () => {
+  const repo = new SqliteFleetRepository(':memory:');
+  try {
+    const command = { type: 'supervisor_claim', taskId: 'T', leaseMs, ownerToken: owner };
+    const first = await repo.apply('W', 0, 's1', actor, 'lead', command);
+    assert.equal(first.fleet.supervisors.T.epoch, 1);
+    const task = { id: 'T', phase: 'plan', gate: 'G1_review', status: 'active', decisions: [], tasks: [], evidence: [] };
+    repo.db.exec('CREATE TABLE state_workspaces (workspace TEXT, revision INTEGER, state TEXT); CREATE TABLE state_gate_checkpoints (workspace TEXT, task_id TEXT); CREATE TABLE state_gate_snapshots (workspace TEXT, id TEXT)');
+    repo.db.prepare('INSERT INTO state_workspaces VALUES (?, ?, ?)').run('W', 1, JSON.stringify({ tasks: { T: task } }));
+    const digest = createHash('sha256').update(JSON.stringify(task)).digest('hex');
+    const runClaim = { type: 'run_claim', taskId: 'T', leaseMs, ownerToken: runOwner, supervisorEpoch: 1, supervisorOwnerToken: owner, expectedStateRevision: 1, expectedTaskDigest: digest };
+    const next = await repo.apply('W', 1, 'r1', actor, 'lead', runClaim);
+    const serialized = JSON.stringify([first, next, await repo.get('W'), repo.db.prepare('SELECT response FROM fleet_idempotency').all()]);
+    assert.ok(!serialized.includes(owner) && !serialized.includes(runOwner) && !serialized.includes('ownerTokenHash') && !serialized.includes('supervisorOwnerTokenHash'));
+    assert.deepEqual(await repo.apply('W', 0, 's1', actor, 'lead', command), first);
+    await assert.rejects(repo.apply('W', 0, 's1', actor, 'lead', { ...command, leaseMs: 120000 }), /payload mismatch/);
+    await repo.apply('W', 2, 'release', actor, 'lead', { type: 'supervisor_release', taskId: 'T', epoch: 1, ownerToken: owner });
+    await assert.rejects(repo.apply('W', 1, 'r1', actor, 'lead', runClaim), /supervisor claim/);
+  } finally { repo.close(); }
+});
+test('Git gateway persists intent, fences lease and retains pending on uncertain callback', async () => {
+  const repo = new SqliteFleetRepository(':memory:');
+  try {
+    await repo.apply('W', 0, 's1', actor, 'lead', { type:'supervisor_claim',taskId:'T',leaseMs,ownerToken:owner });
+    const task={id:'T',phase:'plan',gate:'G1_review',status:'active',decisions:[],tasks:[],evidence:[]};
+    repo.db.exec('CREATE TABLE state_workspaces (workspace TEXT, revision INTEGER, state TEXT); CREATE TABLE state_gate_checkpoints (workspace TEXT, task_id TEXT); CREATE TABLE state_gate_snapshots (workspace TEXT, id TEXT)');
+    repo.db.prepare('INSERT INTO state_workspaces VALUES (?,?,?)').run('W',1,JSON.stringify({tasks:{T:task}}));
+    await repo.apply('W',1,'run',actor,'lead',{type:'run_claim',taskId:'T',leaseMs,ownerToken:runOwner,supervisorEpoch:1,supervisorOwnerToken:owner,expectedStateRevision:1,expectedTaskDigest:createHash('sha256').update(JSON.stringify(task)).digest('hex')});
+    const intent={workspace:'W',taskId:'T',epoch:1,ownerToken:runOwner,operationId:'op',ref:'refs/heads/main',oldOid:'a'.repeat(40),newOid:'b'.repeat(40)};
+    assert.deepEqual(await repo.prepareGitOperation(intent),{status:'pending'});
+    await assert.rejects(repo.prepareGitOperation({...intent,newOid:'c'.repeat(40)}),/mismatch/);
+    await assert.rejects(repo.withGitFence(intent,async ({assertValid})=>{assertValid();throw Error('ambiguous Git result');}),/ambiguous/);
+    assert.equal((await repo.getGitOperation(intent)).status,'pending');
+    await repo.withGitFence(intent,async ({record,assertValid,complete})=>{assert.equal(record.ref,intent.ref);assertValid();await complete();});
+    assert.equal((await repo.getGitOperation(intent)).status,'complete');
+    await repo.apply('W',2,'super-release',actor,'lead',{type:'supervisor_release',taskId:'T',epoch:1,ownerToken:owner});
+    await assert.rejects(repo.prepareGitOperation(intent),/supervisor/);
+  } finally { repo.close(); }
+});

package/dist/src/adapters.js

@@ -1,5 +1,17 @@
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+const hasManagedBlock = (root, path, owner) => {
+    const target = join(root, path);
+    if (!existsSync(target))
+        return false;
+    try {
+        const content = readFileSync(target, "utf8");
+        return content.includes(`<!-- aidlc-installer:${owner}:start -->`) || content.includes(`<!-- aidlc-installer:${owner} -->`);
+    }
+    catch {
+        return false;
+    }
+};
 const adapterFile = (owner, path, body) => ({
     path,
     owner,
@@ -12,11 +24,12 @@ const instruction = (agent, adapter) => [
     "",
     "Read `.agents/aidlc/orchestrator.md`. Use bounded `state.mjs task list` or `task find --query <text>`; never read or dump lifecycle files directly.",
     "",
-    "At each phase entry and dependency boundary, apply the orchestrator's delegation contract. When parallel work is independent and valuable, use your host's native collaboration/delegation tools to fan out at most the available collaboration slots minus the lead. The lead alone owns lifecycle mutations, gates, and task review artifacts; assign non-overlapping paths, require each worker to return its summary, changed paths, verification evidence, and concerns, then integrate and verify its result before advancing.",
+    "The current client conversation is the interactive lead. At each phase entry and dependency boundary, apply the orchestrator's delegation contract. When parallel work is independent and valuable, use your host's native collaboration/delegation tools to fan out at most the available collaboration slots minus the lead. The lead alone owns lifecycle mutations, gates, and task review artifacts; assign non-overlapping paths, require each worker to return its summary, changed paths, verification evidence, and concerns, then integrate and verify its result before advancing.",
     "",
     "For a NEW task, preserve an exact user-supplied canonical ID when present. Run `node .agents/aidlc/scripts/state.mjs task create <id> --title <title>`, then execute the clarify phase; do not call `task next` before the task exists.",
     "If `task create` reports another actionable task, stop and surface it. Pass the returned `--switch-from <task-id>` acknowledgement only when the user explicitly chooses to switch; the prior task keeps its state and remains the resume target — never pause, close, or forget it silently.",
-    "For an existing task, run `state.mjs task next <task-id>` and use the matching phase packet.",
+    "For an existing task or an explicit `resume <task-id>` request, run `state.mjs task next <task-id>` and use the matching phase packet. Keep advancing within this conversation until a human gate, structured blocker, terminal action, or completion.",
+    "Before native worker dispatch and after reopening a conversation, run `assignment.mjs reconcile <task-id>` and inspect uncertain/reported claims against canonical task state and worker output. Claim each independent item with `assignment.mjs claim <task-id> <item-id> --worker <id> --paths <owned-paths>`; pass the assignment ID and exclusive paths to the worker. Release or reconcile claims after integrating. Never redispatch an uncertain claim without inspection. These records are operational only; task status and `nextAction` remain canonical.",
     ...(adapter === "codex" ? ["Codex execpolicy prefix rules match one command invocation. Run every `node .agents/aidlc/scripts/...` lifecycle command in a separate exec call; never join lifecycle commands with shell operators such as `&`, `&&`, `;`, or `|`."] : []),
     "",
     "Before a human gate: run `gate-check.mjs`; set `task status <task-id> --status blocked_on_user`; render the task artifact when the phase requires it; then run `gate-view.mjs <task-id>` and relay its output verbatim.",
@@ -47,6 +60,7 @@ const claudeLocalSettings = JSON.stringify({
 const codexExecPolicy = [
     "# Permit only AI-DLC lifecycle scripts without an approval prompt.",
     "prefix_rule(pattern = [\"node\", \".agents/aidlc/scripts/context.mjs\"], decision = \"allow\")",
+    "prefix_rule(pattern = [\"node\", \".agents/aidlc/scripts/assignment.mjs\"], decision = \"allow\")",
     "prefix_rule(pattern = [\"node\", \".agents/aidlc/scripts/gate-check.mjs\"], decision = \"allow\")",
     "prefix_rule(pattern = [\"node\", \".agents/aidlc/scripts/gate-view.mjs\"], decision = \"allow\")",
     "prefix_rule(pattern = [\"node\", \".agents/aidlc/scripts/render.mjs\"], decision = \"allow\")",
@@ -62,7 +76,7 @@ export const adapters = [
         files: () => [
             { ...adapterFile("claude", "CLAUDE.md", instruction("Claude Code", "claude")), strategy: "managed-block" },
             { path: ".claude/settings.local.json", owner: "claude", content: claudeLocalSettings },
-            ...["clarify:G0", "plan:G1", "build:G2", "wrap:none", "index:none"].map((entry) => {
+            ...["clarify:Confirm requirements", "plan:Approve plan", "build:Review implementation", "wrap:none", "index:none"].map((entry) => {
                 const [phase, gate] = entry.split(":");
                 return adapterFile("claude", `.claude/skills/aidlc-${phase}/SKILL.md`, claudeSkill(phase, gate));
             })
@@ -71,12 +85,18 @@ export const adapters = [
     {
         id: "codex",
         displayName: "Codex",
-        detect: (root) => existsSync(join(root, "AGENTS.md")) || existsSync(join(root, ".codex")),
+        detect: (root) => existsSync(join(root, ".codex")) || hasManagedBlock(root, "AGENTS.md", "codex"),
         files: () => [
             { ...adapterFile("codex", "AGENTS.md", instruction("Codex", "codex")), strategy: "managed-block" },
             { path: ".codex/config.toml", owner: "codex", content: "approval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\n" },
             { path: ".codex/rules/aidlc.rules", owner: "codex", content: codexExecPolicy }
         ]
+    },
+    {
+        id: "opencode",
+        displayName: "OpenCode",
+        detect: (root) => existsSync(join(root, ".opencode")) || hasManagedBlock(root, "AGENTS.md", "opencode"),
+        files: () => [{ ...adapterFile("opencode", "AGENTS.md", instruction("OpenCode", "opencode")), strategy: "managed-block" }]
     }
 ];
 export const resolvedAdapters = () => adapters;