@frankzhang2026/opencode-android-orchestrator 0.10.0 → 1.0.0

package/templates/automation/config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "urn:frankzhang2026:opencode-android-orchestrator:automation-config:v5",
+  "$id": "urn:frankzhang2026:opencode-android-orchestrator:automation-config:v6",
   "title": "OpenCode task orchestration configuration",
   "type": "object",
   "additionalProperties": false,
@@ -11,7 +11,10 @@
       "pattern": "^(?!/)(?!\\.\\.(?:/|$))(?![A-Za-z]:[\\\\/]).+"
     },
     "nullableIdentifier": {
-      "type": ["string", "null"],
+      "type": [
+        "string",
+        "null"
+      ],
       "minLength": 1
     },
     "gradleTask": {
@@ -23,7 +26,9 @@
       "type": "array",
       "minItems": 1,
       "uniqueItems": true,
-      "items": { "$ref": "#/$defs/gradleTask" }
+      "items": {
+        "$ref": "#/$defs/gradleTask"
+      }
     }
   },
   "required": [
@@ -46,24 +51,63 @@
     "requiredSkills",
     "gradleVerification",
     "androidProject",
-    "protectedPaths"
+    "protectedPaths",
+    "commitPolicy",
+    "queue"
   ],
   "properties": {
-    "schemaVersion": { "const": 5 },
-    "enabled": { "type": "boolean" },
-    "mode": { "enum": ["shadow", "orchestrated"] },
+    "schemaVersion": {
+      "const": 6
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "mode": {
+      "enum": [
+        "shadow",
+        "orchestrated"
+      ]
+    },
     "workspaceStrategy": {
-      "enum": ["inPlaceExclusive", "isolatedWorktree"]
-    },
-    "originalBranchDriftPolicy": { "const": "block" },
-    "worktreeBase": { "type": "string" },
-    "maxFixLoops": { "type": "integer", "minimum": 0, "maximum": 1 },
-    "maxReviewCycles": { "type": "integer", "minimum": 0, "maximum": 2 },
-    "maxReviewerRestarts": { "type": "integer", "minimum": 0, "maximum": 3 },
-    "unitTestsEnabled": { "type": "boolean", "default": true },
-    "lintEnabled": { "type": "boolean", "default": false },
+      "enum": [
+        "inPlaceExclusive",
+        "isolatedWorktree"
+      ]
+    },
+    "originalBranchDriftPolicy": {
+      "const": "block"
+    },
+    "worktreeBase": {
+      "type": "string"
+    },
+    "maxFixLoops": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 1
+    },
+    "maxReviewCycles": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 2
+    },
+    "maxReviewerRestarts": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 3
+    },
+    "unitTestsEnabled": {
+      "type": "boolean",
+      "default": true
+    },
+    "lintEnabled": {
+      "type": "boolean",
+      "default": false
+    },
     "commitMessagePrefixMode": {
-      "enum": ["required", "disabled"],
+      "enum": [
+        "required",
+        "disabled"
+      ],
       "default": "required"
     },
     "longCommandTimeoutMs": {
@@ -71,25 +115,53 @@
       "minimum": 120000,
       "maximum": 7200000
     },
-    "autoCleanupWorktrees": { "type": "boolean" },
-    "pushAfterAcceptance": { "const": false },
+    "autoCleanupWorktrees": {
+      "type": "boolean"
+    },
+    "pushAfterAcceptance": {
+      "const": false
+    },
     "approvalPhrases": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["proposal", "contract", "acceptance", "abort", "resume"],
+      "required": [
+        "proposal",
+        "contract",
+        "acceptance",
+        "abort",
+        "resume"
+      ],
       "properties": {
-        "proposal": { "type": "string", "minLength": 4 },
-        "contract": { "type": "string", "minLength": 4 },
-        "acceptance": { "type": "string", "minLength": 4 },
-        "abort": { "type": "string", "minLength": 4 },
-        "resume": { "type": "string", "minLength": 4 }
+        "proposal": {
+          "type": "string",
+          "minLength": 4
+        },
+        "contract": {
+          "type": "string",
+          "minLength": 4
+        },
+        "acceptance": {
+          "type": "string",
+          "minLength": 4
+        },
+        "abort": {
+          "type": "string",
+          "minLength": 4
+        },
+        "resume": {
+          "type": "string",
+          "minLength": 4
+        }
       }
     },
     "requiredSkills": {
       "type": "array",
       "minItems": 6,
       "uniqueItems": true,
-      "items": { "type": "string", "minLength": 1 }
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
     },
     "gradleVerification": {
       "type": "object",
@@ -102,11 +174,21 @@
         "deviceTestTasks"
       ],
       "properties": {
-        "fullUnitTestTasks": { "$ref": "#/$defs/gradleTaskList" },
-        "focusedTestTasks": { "$ref": "#/$defs/gradleTaskList" },
-        "assembleTasks": { "$ref": "#/$defs/gradleTaskList" },
-        "lintTasks": { "$ref": "#/$defs/gradleTaskList" },
-        "deviceTestTasks": { "$ref": "#/$defs/gradleTaskList" }
+        "fullUnitTestTasks": {
+          "$ref": "#/$defs/gradleTaskList"
+        },
+        "focusedTestTasks": {
+          "$ref": "#/$defs/gradleTaskList"
+        },
+        "assembleTasks": {
+          "$ref": "#/$defs/gradleTaskList"
+        },
+        "lintTasks": {
+          "$ref": "#/$defs/gradleTaskList"
+        },
+        "deviceTestTasks": {
+          "$ref": "#/$defs/gradleTaskList"
+        }
       }
     },
     "androidProject": {
@@ -122,10 +204,26 @@
         "testPaths"
       ],
       "properties": {
-        "name": { "type": "string", "minLength": 1 },
-        "gradleDsl": { "enum": ["kotlin", "groovy", "mixed"] },
-        "settingsFile": { "$ref": "#/$defs/repositoryPath" },
-        "moduleScope": { "enum": ["all", "primary"] },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "gradleDsl": {
+          "enum": [
+            "kotlin",
+            "groovy",
+            "mixed"
+          ]
+        },
+        "settingsFile": {
+          "$ref": "#/$defs/repositoryPath"
+        },
+        "moduleScope": {
+          "enum": [
+            "all",
+            "primary"
+          ]
+        },
         "primaryModule": {
           "type": "string",
           "pattern": "^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$"
@@ -150,9 +248,18 @@
                 "type": "string",
                 "pattern": "^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$"
               },
-              "directory": { "$ref": "#/$defs/repositoryPath" },
-              "buildFile": { "$ref": "#/$defs/repositoryPath" },
-              "dsl": { "enum": ["kotlin", "groovy"] },
+              "directory": {
+                "$ref": "#/$defs/repositoryPath"
+              },
+              "buildFile": {
+                "$ref": "#/$defs/repositoryPath"
+              },
+              "dsl": {
+                "enum": [
+                  "kotlin",
+                  "groovy"
+                ]
+              },
               "type": {
                 "enum": [
                   "application",
@@ -162,8 +269,12 @@
                   "asset-pack"
                 ]
               },
-              "namespace": { "$ref": "#/$defs/nullableIdentifier" },
-              "applicationId": { "$ref": "#/$defs/nullableIdentifier" }
+              "namespace": {
+                "$ref": "#/$defs/nullableIdentifier"
+              },
+              "applicationId": {
+                "$ref": "#/$defs/nullableIdentifier"
+              }
             }
           }
         },
@@ -173,8 +284,12 @@
           "uniqueItems": true,
           "items": {
             "allOf": [
-              { "$ref": "#/$defs/repositoryPath" },
-              { "pattern": "(^|/)src/main/\\*\\*$" }
+              {
+                "$ref": "#/$defs/repositoryPath"
+              },
+              {
+                "pattern": "(^|/)src/main/\\*\\*$"
+              }
             ]
           }
         },
@@ -184,8 +299,12 @@
           "uniqueItems": true,
           "items": {
             "allOf": [
-              { "$ref": "#/$defs/repositoryPath" },
-              { "pattern": "(^|/)src/(?:test|androidTest)/\\*\\*$" }
+              {
+                "$ref": "#/$defs/repositoryPath"
+              },
+              {
+                "pattern": "(^|/)src/(?:test|androidTest)/\\*\\*$"
+              }
             ]
           }
         }
@@ -195,7 +314,60 @@
       "type": "array",
       "minItems": 1,
       "uniqueItems": true,
-      "items": { "$ref": "#/$defs/repositoryPath" }
+      "items": {
+        "$ref": "#/$defs/repositoryPath"
+      }
+    },
+    "commitPolicy": {
+      "enum": [
+        "humanApproval",
+        "autoCommit"
+      ],
+      "default": "humanApproval"
+    },
+    "queue": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "scanIntervalMs",
+        "maxWorkspaces",
+        "maxWorkspaceBytes"
+      ],
+      "properties": {
+        "scanIntervalMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 60000
+        },
+        "maxWorkspaces": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 32
+        },
+        "maxWorkspaceBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 21474836480
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "workspaceStrategy": {
+            "const": "isolatedWorktree"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "commitPolicy": {
+            "const": "humanApproval"
+          }
+        }
+      }
     }
-  }
+  ]
 }

package/templates/scripts/automation/abort-task.sh

@@ -13,12 +13,13 @@ if [[ "$#" -ne 2 ]]; then
 fi
 
 automation_validate_task_id "$task_id"
+automation_require_queue_execution "$task_id"
 automation_require_orchestrated
 automation_require_approval abort "$approval"
 
 current_state="$(automation_read_state "$task_id")"
 case "$current_state" in
-    PREPARING|PENDING|CODING|READY_FOR_REVIEW|REVIEWING|CHANGES_REQUESTED|AWAITING_HUMAN|BLOCKED|TEST_FAILED|NEEDS_HUMAN|INTEGRATION_BLOCKED) ;;
+    PREPARING|PENDING|CODING|READY_FOR_REVIEW|REVIEWING|CHANGES_REQUESTED|AWAITING_HUMAN|READY_TO_COMMIT|BLOCKED|TEST_FAILED|NEEDS_HUMAN|INTEGRATION_BLOCKED) ;;
     *) automation_die "cannot abort $task_id from state $current_state" ;;
 esac
 

package/templates/scripts/automation/accept-and-integrate.sh

@@ -14,6 +14,11 @@ fi
 
 automation_validate_task_id "$task_id"
 automation_require_orchestrated
+queued_workspace="$(automation_workspace_path "$task_id")"
+if [[ -f "$queued_workspace" && -n "$(jq -r '.queueKey // empty' "$queued_workspace")" ]]; then
+    automation_die "queued acceptance must request integration through the repository queue"
+    exit 1
+fi
 automation_require_approval acceptance "$approval"
 [[ "$(automation_read_state "$task_id")" == "AWAITING_HUMAN" ]] || automation_die "$task_id is not awaiting human acceptance"
 [[ "$(automation_config_value '.pushAfterAcceptance')" == "false" ]] || automation_die "automatic push is forbidden"

package/templates/scripts/automation/acceptance-report.sh

@@ -8,7 +8,8 @@ source "$SCRIPT_DIR/lib.sh"
 task_id="${1:-}"
 [[ "$#" -eq 1 ]] || { printf 'Usage: %s TASK-ID\n' "$0" >&2; exit 2; }
 automation_validate_task_id "$task_id"
-[[ "$(automation_read_state "$task_id")" == "AWAITING_HUMAN" ]] || automation_die "$task_id is not AWAITING_HUMAN"
+report_state="$(automation_read_state "$task_id")"
+[[ "$report_state" == "AWAITING_HUMAN" || ( "$report_state" == "READY_TO_COMMIT" && -n "${AUTOMATION_QUEUE_RUN_ID:-}" ) ]] || automation_die "$task_id is not ready for acceptance or authorized local commit"
 
 contract="$(automation_contract_path "$task_id")"
 workspace_file="$(automation_workspace_path "$task_id")"
@@ -60,6 +61,7 @@ automation_worktree_patch_at "$AUTOMATION_ROOT" > "$sealed_diff"
 report_file="$evidence_dir/acceptance-report.json"
 jq -n \
     --arg taskId "$task_id" \
+    --arg state "$report_state" \
     --arg title "$(jq -er '.title' "$contract")" \
     --arg generatedAt "$(automation_now)" \
     --arg originalBranch "$original_branch" \
@@ -88,7 +90,7 @@ jq -n \
     --argjson acceptanceCriteria "$(jq -c '.acceptanceCriteria' "$contract")" \
     --argjson nonGoals "$(jq -c '.nonGoals' "$contract")" \
     --argjson targetTests "$(jq -c '.targetTests' "$contract")" \
-    '{taskId: $taskId, title: $title, state: "AWAITING_HUMAN",
+    '{taskId: $taskId, title: $title, state: $state,
       generatedAt: $generatedAt, originalBranch: $originalBranch,
       originalHeadBeforeContract: $originalHeadBeforeContract,
       baselineHead: $baselineHead, originalHeadCurrent: $originalHeadCurrent,

package/templates/scripts/automation/approve-and-run.sh

@@ -14,6 +14,10 @@ fi
 
 automation_validate_task_id "$task_id"
 automation_require_orchestrated
+[[ "$(automation_config_value '.schemaVersion')" != "6" ]] || {
+    automation_die "contract approval now enqueues through android_orchestrator_intake or the queue enqueue CLI"
+    exit 1
+}
 automation_require_approval contract "$approval"
 "$SCRIPT_DIR/validate-contract.sh" "$task_id" >/dev/null
 [[ "$(automation_read_state "$task_id")" == "CONTRACT_REVIEW" ]] || automation_die "$task_id is not awaiting contract review"

package/templates/scripts/automation/begin-review.sh

@@ -8,6 +8,7 @@ source "$SCRIPT_DIR/lib.sh"
 task_id="${1:-}"
 [[ "$#" -eq 1 ]] || { printf 'Usage: %s TASK-ID\n' "$0" >&2; exit 2; }
 automation_validate_task_id "$task_id"
+automation_require_queue_execution "$task_id"
 [[ "$(automation_read_state "$task_id")" == "READY_FOR_REVIEW" ]] || automation_die "$task_id is not READY_FOR_REVIEW"
 
 ready_file="$(automation_evidence_path "$task_id")/ready.json"

package/templates/scripts/automation/block-task.sh

@@ -15,6 +15,7 @@ if [[ -z "$task_id" || ${#reason} -lt 12 ]]; then
 fi
 
 automation_validate_task_id "$task_id"
+automation_require_queue_execution "$task_id"
 current="$(automation_read_state "$task_id")"
 case "$current" in
     PENDING|CODING)

package/templates/scripts/automation/claim-task.sh

@@ -8,6 +8,7 @@ source "$SCRIPT_DIR/lib.sh"
 task_id="${1:-}"
 [[ -n "$task_id" ]] || { printf 'Usage: %s TASK-ID\n' "$0" >&2; exit 2; }
 automation_validate_task_id "$task_id"
+automation_require_queue_execution "$task_id"
 automation_require_layout
 
 [[ "$(automation_read_state "$task_id")" == "PENDING" ]] || automation_die "$task_id is not PENDING"

package/templates/scripts/automation/lib.sh

@@ -114,7 +114,9 @@ automation_validate_config() {
             length > 0 and
             length == (unique | length) and
             all(.[]; gradle_task);
-        .schemaVersion == 5 and
+        (.schemaVersion == 5 or .schemaVersion == 6) and
+        ((.commitPolicy // "humanApproval") == "humanApproval" or .commitPolicy == "autoCommit") and
+        (.workspaceStrategy != "isolatedWorktree" or (.commitPolicy // "humanApproval") == "humanApproval") and
         (.enabled | type == "boolean") and
         (.mode == "shadow" or .mode == "orchestrated") and
         (.workspaceStrategy == "inPlaceExclusive" or .workspaceStrategy == "isolatedWorktree") and
@@ -217,6 +219,26 @@ automation_workspace_path() {
     printf '%s/%s.json\n' "$AUTOMATION_WORKSPACES_DIR" "$task_id"
 }
 
+automation_require_queue_execution() {
+    local task_id="$1"
+    local workspace_file queue_key group
+    workspace_file="$(automation_workspace_path "$task_id")"
+    [[ -f "$workspace_file" ]] || return 0
+    queue_key="$(jq -r '.queueKey // empty' "$workspace_file")"
+    [[ -n "$queue_key" ]] || return 0
+    [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]] || {
+        automation_die "queued tasks must use the repository queue for execution, integration and recovery"
+        return 1
+    }
+    group="$(ps -o pgid= -p "$$" | tr -d ' ')"
+    jq -e --arg key "$queue_key" --arg run "$AUTOMATION_QUEUE_RUN_ID" --argjson group "$group" \
+        '.active.key == $key and .active.id == $run and .active.worker.pid == $group' \
+        "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json" >/dev/null || {
+            automation_die "current process does not own this task queue execution"
+            return 1
+        }
+}
+
 automation_workspace_strategy() {
     local workspace_file="$1"
     jq -er '.workspaceStrategy // "isolatedWorktree"' "$workspace_file"
@@ -386,12 +408,75 @@ automation_run_gradle_group() {
         return 1
     }
 
+    if [[ "$group" == "fullUnitTestTasks" && -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]]; then
+        automation_run_fresh_unit_tests "$root" "${tasks[@]}"
+        return $?
+    fi
     (
         cd "$root"
         ./gradlew "${tasks[@]}"
     )
 }
 
+# Queue execution reruns Test tasks while preserving compilation/build caches.
+# The init script disables only Test output reuse, including FROM-CACHE, and
+# emits actual test counts. No clean task or model polling is involved.
+automation_run_fresh_unit_tests() {
+    local root="$1"
+    shift
+    local init_file log_file result elapsed start
+    mkdir -p "$AUTOMATION_RUNTIME_ROOT/gradle"
+    init_file="$(mktemp "$AUTOMATION_RUNTIME_ROOT/gradle/fresh-tests.XXXXXX")"
+    log_file="${init_file}.log"
+    cat > "$init_file" <<'GRADLE'
+gradle.allprojects { project ->
+    project.tasks.withType(org.gradle.api.tasks.testing.Test).configureEach { testTask ->
+        outputs.upToDateWhen { false }
+        outputs.doNotCacheIf('Orchestrator requires fresh unit-test execution') { true }
+        if (testTask.hasProperty('dryRun')) testTask.dryRun = false
+        afterSuite { descriptor, result ->
+            if (descriptor.parent == null) {
+                logger.lifecycle("ORCHESTRATOR_TEST_RESULT|${testTask.path}|${result.testCount}|${result.failedTestCount}|${result.skippedTestCount}")
+            }
+        }
+    }
+}
+gradle.taskGraph.whenReady { graph ->
+    graph.allTasks.findAll { it instanceof org.gradle.api.tasks.testing.Test }.each { task ->
+        task.logger.lifecycle("ORCHESTRATOR_TEST_EXPECTED|${task.path}")
+    }
+}
+gradle.taskGraph.afterTask { task, state ->
+    if (task instanceof org.gradle.api.tasks.testing.Test && state.noSource) {
+        task.logger.lifecycle("ORCHESTRATOR_TEST_NO_SOURCE|${task.path}")
+    }
+}
+GRADLE
+    start="$(date +%s)"
+    set +e
+    (cd "$root" && ./gradlew "$@" --no-configuration-cache --console=plain --init-script "$init_file") 2>&1 | tee "$log_file"
+    result=${PIPESTATUS[0]}
+    set -e
+    elapsed=$(( $(date +%s) - start ))
+    [[ "$result" -eq 0 ]] || return "$result"
+    # A successful build with only cached, skipped or empty suites is not proof
+    # that the required regression tests actually executed.
+    awk -F '|' '
+      /^ORCHESTRATOR_TEST_EXPECTED\|/ { expected[$2] = 1; count++ }
+      /^ORCHESTRATOR_TEST_RESULT\|/ { verified[$2] = 1; total += $3 - $5; failed += $4 }
+      /^ORCHESTRATOR_TEST_NO_SOURCE\|/ { verified[$2] = 1 }
+      END {
+        for (task in expected) if (!verified[task]) missing++
+        exit !(count > 0 && total > 0 && failed == 0 && missing == 0)
+      }' "$log_file" || {
+        automation_die "full unit tests produced no fresh successful test results"
+        return 1
+    }
+    AUTOMATION_FULL_TEST_LOG="$log_file"
+    AUTOMATION_FULL_TEST_ELAPSED="$elapsed"
+    automation_info "fresh full unit tests executed in ${elapsed}s; log: $log_file"
+}
+
 automation_run_configured_unit_tests() {
     local contract="${1:-}"
     local root="${2:-$AUTOMATION_ROOT}"
@@ -399,6 +484,12 @@ automation_run_configured_unit_tests() {
 
     [[ -n "$contract" && -f "$contract" ]] || automation_die "unit-test contract does not exist: $contract"
     automation_validate_config || return 1
+    if [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]]; then
+        [[ "$(automation_config_value '.unitTestsEnabled')" == "true" ]] || {
+            automation_die "queued execution requires full unit tests"
+            return 1
+        }
+    fi
     if [[ "$(automation_config_value '.unitTestsEnabled')" != "true" ]]; then
         automation_info "skipping ${context}unit tests (unitTestsEnabled=false)"
         return 0
@@ -1062,6 +1153,7 @@ automation_transition_allowed() {
         READY_FOR_REVIEW:REVIEWING:orchestrator) return 0 ;;
         READY_FOR_REVIEW:BLOCKED:orchestrator) return 0 ;;
         REVIEWING:AWAITING_HUMAN:reviewer) return 0 ;;
+        REVIEWING:READY_TO_COMMIT:reviewer) return 0 ;;
         REVIEWING:CHANGES_REQUESTED:reviewer) return 0 ;;
         REVIEWING:BLOCKED:orchestrator) return 0 ;;
         BLOCKED:REVIEWING:human) return 0 ;;
@@ -1070,6 +1162,7 @@ automation_transition_allowed() {
         AWAITING_HUMAN:INTEGRATING:integrator) return 0 ;;
         INTEGRATING:COMPLETED:integrator) return 0 ;;
         INTEGRATING:INTEGRATION_BLOCKED:integrator) return 0 ;;
+        READY_TO_COMMIT:ABORTED:human) return 0 ;;
         PREPARING:ABORTED:human|PENDING:ABORTED:human|CODING:ABORTED:human|READY_FOR_REVIEW:ABORTED:human|REVIEWING:ABORTED:human|CHANGES_REQUESTED:ABORTED:human|AWAITING_HUMAN:ABORTED:human|BLOCKED:ABORTED:human|TEST_FAILED:ABORTED:human|NEEDS_HUMAN:ABORTED:human|INTEGRATION_BLOCKED:ABORTED:human) return 0 ;;
         *) return 1 ;;
     esac

package/templates/scripts/automation/orchestrate-task.sh

@@ -8,6 +8,7 @@ source "$SCRIPT_DIR/lib.sh"
 task_id="${1:-}"
 [[ "$#" -eq 1 ]] || { printf 'Usage: %s TASK-ID\n' "$0" >&2; exit 2; }
 automation_validate_task_id "$task_id"
+automation_require_queue_execution "$task_id"
 automation_require_orchestrated
 
 workspace_file="$(automation_workspace_path "$task_id")"
@@ -63,6 +64,12 @@ run_agent() {
 }
 
 for _step in 1 2 3 4 5 6 7 8; do
+    if [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]] && jq -e --arg id "$task_id" \
+        'any(.items[]; .taskId == $id and .request.kind == "abort")' \
+        "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json" >/dev/null; then
+        automation_info "$task_id has an approved abort request; returning at a safe agent boundary"
+        exit 0
+    fi
     state="$(automation_read_state "$task_id")"
     case "$state" in
         PENDING|CODING)
@@ -99,6 +106,10 @@ for _step in 1 2 3 4 5 6 7 8; do
                 ./scripts/automation/resume-review-fix.sh "$task_id"
             ) || true
             ;;
+        READY_TO_COMMIT)
+            automation_info "$task_id reached READY_TO_COMMIT; queue executor will verify the sealed authorization"
+            exit 0
+            ;;
         AWAITING_HUMAN)
             automation_info "$task_id reached AWAITING_HUMAN"
             (

package/templates/scripts/automation/preflight.sh

@@ -66,11 +66,15 @@ if [[ "${AUTOMATION_TEST_MODE:-0}" != "1" ]]; then
     fi
 fi
 
-if [[ -z "$task_id" ]] && ! automation_worktree_is_clean; then
+intake_mode=0
+if [[ "$source_mode" == "1" && "$(automation_config_value '.schemaVersion')" == "6" ]]; then
+    intake_mode=1
+fi
+if [[ -z "$task_id" && "$intake_mode" != "1" ]] && ! automation_worktree_is_clean; then
     fail_or_warn "Git worktree is dirty"
 fi
 
-if [[ "$source_mode" == "1" ]]; then
+if [[ "$source_mode" == "1" && "$intake_mode" != "1" ]]; then
     repository_lease_file="$(automation_repository_lease_dir)/lease.json"
     if [[ -f "$repository_lease_file" ]]; then
         fail_or_warn "repository workspace is leased by $(jq -r '.taskId // "an unknown task"' "$repository_lease_file")"
@@ -158,7 +162,7 @@ else
         def last_rule($permission; $pattern):
             [.permission[] | select(.permission == $permission and .pattern == $pattern) | .action][-1];
         (last_rule("*"; "*") == "deny") and
-        (last_rule("edit"; "docs/plans/**") == "allow") and
+        (((last_rule("edit"; "docs/plans/**") == "allow") and
         (last_rule("edit"; "automation/tasks/**") == "allow") and
         (last_rule("edit"; "**/src/**") == "deny") and
         (last_rule("bash"; "./scripts/automation/prepare-contract-review.sh *") == "allow") and
@@ -166,7 +170,13 @@ else
         (last_rule("bash"; "./scripts/automation/resume-task.sh *") == "allow") and
         (last_rule("bash"; "./scripts/automation/resume-review.sh *") == "allow") and
         (last_rule("bash"; "./scripts/automation/accept-and-integrate.sh *") == "allow") and
-        (last_rule("bash"; "./scripts/automation/abort-task.sh *") == "allow") and
+        (last_rule("bash"; "./scripts/automation/abort-task.sh *") == "allow")) or
+         ((last_rule("read"; "*") == "deny") and
+          (last_rule("edit"; "*") == "deny") and
+          (last_rule("bash"; "*") == "deny") and
+          (last_rule("android_orchestrator_snapshot"; "*") == "allow") and
+          (last_rule("android_orchestrator_intake"; "*") == "allow") and
+          (last_rule("android_orchestrator_queue"; "*") == "allow"))) and
         (last_rule("android_orchestrator_status"; "*") == "allow") and
         (last_rule("android_orchestrator_doctor"; "*") == "allow") and
         (last_rule("schedule_job"; "*") == "deny") and