@hecer/yoke 1.19.0 → 1.21.1

package/docs/CODEX-COMPARISON-2026-09-29.md

@@ -0,0 +1,27 @@
+# Direct Codex comparison — 2026-09-29
+
+AI-assisted authenticated evaluation of Yoke **1.19.0**, commit `05fac3db1a51412563005e07f80e6e5a9aab8e06`. A fresh origin fetch confirmed that revision remains the remote main head.
+
+All arms requested **gpt-6.1-sol / low**, disabled routing and native multi-agent delegation, and used disposable Git fixtures with the same source and acceptance tests within each comparison. User config was disabled; removal of every host skill/plugin was not certified. The direct Codex arm received all story requirements in one call. Yoke used its normal per-story implementation, verification and commit workflow. This compares complete user workflows, not just model-call latency. Permissions allowed changes in the disposable fixture projects. The protected seed tests were replayed after execution; they were visible to agents, not hidden tests.
+
+| Fixture | Arm | Accepted runs | Median elapsed seconds | Fresh input tokens | Output tokens |
+| --- | --- | --- | --- | --- | --- |
+| routing-queue | codex | 2/2 | 118.3 | 25,292 | 2,162 |
+| routing-queue | yoke-serial | 2/2 | 274.9 | 48,524 | 4,822 |
+| independent-utils | codex | 1/1 | 71.3 | 10,263 | 797 |
+| independent-utils | yoke-serial | 1/1 | 442.2 | 92,330 | 3,905 |
+| independent-utils | yoke-parallel | 0/1 | 117.1 | 81,497 | 3,487 |
+
+Queue: **two alternating pairs**, each evaluated against ten original tests. Both arms passed both times. Yoke's serial workflow took **2.32 times** the elapsed time, with **91.9% more fresh input tokens**. Input totals also include cached tokens; fresh input is aggregate input minus cached input. This is not a USD cost calculation.
+
+Independent utilities: **one run per arm**, with three disjoint source scopes and fifteen original tests. Direct Codex and Yoke serial passed. Parallel Yoke started three real workers but accepted no stories after its integration checks lost the `YOKE_STORY` context. It stopped at the explicit three-attempt cap. **Its shorter failure time is not a performance improvement.** The deterministic control probe reproduced the context loss independently of model quality.
+
+The initial independent fixture lacked runtime ignore rules; its serial run stopped after one story. Its parallel attempt also hit Git's Windows worktree path limit before model execution. The fixture was corrected and all three arms rerun under shorter paths. Those initial records are retained separately as setup diagnostics, not silently discarded or mixed into accepted performance statistics.
+
+These are small fixtures on one Windows machine with uncontrolled background load. CPU, memory and USD cost were not measured. Routing, cheap-worker selection, native Codex subagents, large repositories and prolonged exploration were not compared. There is no evidence here that Yoke generally outperforms direct Codex. The observed serial overhead and parallel failure warrant fixing workflow/context correctness before promoting universal efficiency claims.
+
+See the [Goals/resource audit](GOALS-RESOURCE-AUDIT-2026-09-29.md) for implementation priorities. Machine-readable records: [comparison results](../bench/results/codex-comparison-2026-09-29.json), [integration probes](../bench/results/goal-integration-probes-2026-09-29.json). Full raw logs remain in the local testground; they are not included in these summaries.
+
+Reproduce with `bench/compare-codex.mjs`, then `bench/analyze-codex-comparison.mjs`. Use fresh, short output roots on Windows. The new summary tests verify median arithmetic, cache subtraction, unknown usage, incompatible policies and invalid measurements.
+
+Provenance: this report is disclosed as AI-assisted. Read-only text scans cannot establish human authorship or verify proprietary keyed watermarks; cryptographic verification and signer trust remain unknown without the corresponding verifier and trust policy.

package/docs/CONTINUOUS-EXPLORATION.md

@@ -53,8 +53,12 @@ when quoted, for example `--explore-limit="2 days"`. When it expires, Yoke pause
 code `3`. It stops launching new workers, lets already active workers finish their acceptance,
 verification and integration gates, and preserves resumable work. Finite runs process bounded task
 batches so an unfinished large backlog does not run past the deadline by draining the whole PRD.
-Omitting `--explore-limit` keeps the supervisor unbounded; a later resume starts a new duration if
-one is supplied.
+Omitting `--explore-limit` on a fresh run keeps the supervisor unbounded. Dashboard
+resume restores the saved absolute deadline and consumed iteration budget, so pausing
+does not grant another duration. An already expired saved run remains paused. Starting
+an explicit new CLI invocation with a new duration creates a new run and deadline.
+The supervisor retains the project lock during idle waits, preventing a second runner
+from changing the same project between exploration batches.
 
 The supervisor can retry failures while its process remains alive. Run it in a background process
 for long sessions. An operating-system shutdown, forced process termination, exhausted credentials

package/docs/GOALS-RESOURCE-AUDIT-2026-09-29.md

@@ -0,0 +1,92 @@
+# Goals and resource audit — 2026-09-29
+
+AI-assisted inspection and authenticated tests of Yoke **1.19.0**, commit `05fac3db1a51412563005e07f80e6e5a9aab8e06`. Test tooling and this report were added in a separate worktree and branch. The original checkout and its local changes were preserved. Recommendations below are proposals, not shipped changes.
+
+## What is already reliable
+
+This report preserves the **1.19.0** findings. The implementation following this
+audit is documented in [verified goals](GOALS.md) and the **1.20.0** changelog;
+its release validation is recorded separately. Historical benchmark timings are
+not measurements of the corrected version.
+
+Yoke persists a provider-neutral objective, attempt history, independent check IDs, and interrupted-attempt evidence in `.yoke/goal.json`. Goals and story loops share an exclusive project lock. Goals require executable acceptance and protected test infrastructure. Each attempt is independently checked, and an earlier completion is checked again when resumed. Failed work is retained; a goal run does not automatically commit or publish it. These protections are useful even when a provider confidently claims completion.
+
+The latest release's complete prepublication validation previously passed: TypeScript lint/build, **148 test files; 1,337 passed and 2 skipped**, docs checks and package dry run. In this audit, the final focused goal, shared worker-pool, dashboard and comparison-summary suites passed: **40 tests**, including 11 goal tests and five new summary tests. A passing suite does not establish coverage for the gaps below.
+
+## Reproduced gaps
+
+| Gap | Evidence | Consequence | Proposed fix |
+| --- | --- | --- | --- |
+| Objective is not bound to relevant acceptance | A disposable project had passing protected checks for an old feature. A new objective requested `new-feature.txt`, but its criteria still only checked the old feature. Yoke marked the new goal `complete` with **zero attempts**, without calling the fake executor or creating the requested artifact. | Checks prove the supplied contract, which can be unrelated to the newly requested work. Existing green tests alone do not prove a new objective. | Persist an explicit goal-to-criterion mapping and contract revision. Require criteria that cover the new objective, generated or selected before autonomous execution and then protected. Keep regression-suite success separate from objective-specific acceptance; do not infer relevance from a free-text objective. |
+| Goals bypass the shared resource pool | With an isolated pool limited to one worker and its permit occupied, a goal's fake executor still started and completed. Default execution and capability-planner calls also directly start providers without requesting a permit. | Concurrent projects can exceed the intended Yoke worker limit; goal routing can introduce additional unaccounted calls. | Route all goal implementation and planner calls through the shared admission service. Disable unmanaged native delegation or account for its children explicitly. Release permits in `finally`, including abort, provider failure and routing escalation. |
+| No native Codex goal binding | The persisted goal schema contains no native thread reference. `goalHandoff` supplies text, and execution launches a fresh CLI invocation. There are no native goal protocol calls. | Native and Yoke goal statuses, pause controls, budgets and continuation can disagree. Context is restarted between attempts. | Add a capability-negotiated Codex adapter with persisted thread binding, native goal set/get/update notifications, pause synchronization and session recovery. Keep provider-neutral fallback for CLIs without this capability. |
+| Token budget is checked between attempts | A disposable goal with a budget of **1 token**, a fake executor reporting **100 tokens**, and passing acceptance finished as `complete`. This is a mechanical control-flow test, not an actual 100-token model call. | A single attempt can exceed the budget. The option is an admission guard for subsequent attempts, not a strict live token cap. | Pass supported live limits into the native runtime, consume streamed usage, reserve a bounded allowance for controller and verification calls, and report overshoot explicitly. Do not equate native budget accounting with provider aggregate tokens until their units are verified. |
+| Time budget excludes verification | With a **60 ms agent-time budget**, intentionally delayed protected checks and a fake fast executor, the final recorded probe completed after **652 ms** while recording **3 ms** agent work. | Users cannot use `--minutes` as a total elapsed-time or CPU-resource limit. The current handoff explicitly says total agent work; this is a limitation rather than proof the documented budget is incorrect. | Preserve the existing meaning for compatibility and add an explicit elapsed-time deadline. Record admission wait, model work, verification and integration separately. Allow safe-boundary overrun only when documented. |
+| Goal CLI does not inherit the configured runner selection | `src/cli.ts` defaults the goal provider to Codex and passes only `--model`; `runProjectGoal` loads config for routing but does not merge `runner.reasoningEffort`, `bare`, or native delegation policy into the direct selection. | Goal execution can use different startup context, effort and resource policy than the same project's story loop. | Resolve one common execution policy: explicit CLI overrides, then project runner config, then provider defaults. Test parity across goal, loop and dashboard resume. |
+
+Source references: `src/goals/command.ts:21,69,83,115,128,134,136,147,152`; `src/cli.ts:202`; `src/loop/resource-pool.ts`; `src/agents/providers.ts`.
+
+## Native capability verified on this machine
+
+Installed Codex: **0.161.0-alpha.2**, authenticated with ChatGPT; its `goals` feature is enabled. The local CLI emitted experimental app-server schemas for `thread/goal/set`, `thread/goal/get`, and `thread/goal/clear`. In a disposable thread the actual app-server successfully performed:
+
+1. Set an active objective with a 1,000-token budget.
+2. Read the same objective and budget.
+3. Set status `paused` and read it back.
+4. Clear the goal and verify `goal: null`.
+
+The thread was archived. This protocol probe did **not** request a model development turn; it verifies the local lifecycle API, not autonomous completion quality. Protocol availability must be negotiated for other installed versions. Do not enable global features or silently create a native goal in the user's current conversation.
+
+OpenAI describes native goals as persistent, thread-scoped objectives with continuation subject to completion, interruption, budgets and blockers. This is not a guarantee of endless productive development. See the [official Goals cookbook](https://developers.openai.com/cookbook/examples/codex/using_goals_in_codex).
+
+## Unify continuation without competing controllers
+
+Keep Yoke authoritative for executable project acceptance, evidence and safe integration. Let the native goal manage work inside a provider thread. When the provider reports completion, run Yoke's independent check against the current tree. Only synchronize successful completion when that check passes. When it fails, supply bounded findings and continue the same objective within the remaining budget. Persist the native completion claim and the failed evidence separately rather than discarding either.
+
+Store a run identity, native thread reference, objective revision, acceptance digest, provider/model selection, budget units and stop reason. Recovery must reconcile native and Yoke state before resuming. An explicit user pause must remain paused across crashes and restarts. Temporary rate limits, exhausted budgets, unresolved decisions and infrastructure errors need distinguishable reasons and retry rules; they should not all become an indistinguishable `blocked` status.
+
+Checks currently use synchronous command execution with a default timeout of up to ten minutes **per command** (`src/loop/verify.ts:42`). The goal's agent-time timer has already been cleared before those checks. A total elapsed-time limit therefore needs an asynchronous, abortable verification path or an external supervisor; adding only another JavaScript timer around synchronous checks would not enforce it. Synchronous checks also block the dashboard process's event loop when a goal is resumed inside that process.
+
+Continuous exploration is already an optional story-loop supervisor; it does not consume or synchronize `.yoke/goal.json`. Keep discovery separate from a finite goal contract. Each accepted exploration batch should have a bounded objective and verified acceptance, then return to discovery if the user still wants exploration. A waiting or blocked provider must never cause two independent supervisors to issue overlapping work.
+
+Dashboard resume currently chooses a goal when an unfinished `.yoke/goal.json` exists; otherwise it starts `runLoopCommand(root, {})`. It does not persist and restore the original exploration flag, exploration deadline or full run selection. This is an observed source-level integration gap, not a crash-recovery test. Persist the actual execution mode and options, select the interrupted run by identity, and explicitly choose whether a resumed exploration limit preserves the original deadline. Test pause/resume both before and during model calls and integration.
+
+## Resource efficiency priorities
+
+**An actual parallel integration failure was reproduced.** The corrected independent-task fixture ran three authenticated Codex workers, but integrated **0/3** stories and ended at the explicit three-attempt cap. The worker gate sets `YOKE_STORY`; the dispatcher's integration gate directly invokes the verifier without setting it (`src/loop/worker.ts:60`, `src/loop/parallel-command.ts:113`, `src/loop/dispatcher.ts:133`). The fixture's scoped verifier therefore ran all three tests against each partial candidate at integration, rejecting it because the other independent modules were still unimplemented.
+
+A deterministic diagnostic exercised the real loop/dispatcher with fake agents and Git adapters: worker observations were `A,B,C`, integration observations were `null,null,null`. The always-green control accepted **3/3**; the story-context-dependent verifier accepted **0/3**. Preserve identical verification context across worker and integration phases, preferably with explicit subprocess environment rather than ambient global mutation. Record rejection reasons and retain recoverable candidate evidence: this run's final status only reported `cap-reached`, while worker directories were removed. Lost context and repeated implementation after rejected integration consume resources without accepted work. The failed authenticated parallel run remains in the result set and is not reported as a speedup.
+
+The first independent-task comparison exposed a Windows path limit before any parallel provider call: `git worktree add` failed with `fatal: '$GIT_DIR' too big`. Yoke's generated candidate path included a 64-character story digest and a UUID below the project path. The fixture was rerun under a shorter root. A production improvement is to preflight the complete Git worktree path, use shorter collision-safe candidate names or an explicit short worktree root, and report recoverable setup failures without a raw stack trace. Separately, the new fixture initially lacked runtime-file ignore rules and its serial run stopped on a dirty worktree after one story; this was corrected in the fixture. Those initial failed attempts are retained as setup diagnostics, not counted as successful performance samples.
+
+The existing pool limits worker units, not measured CPU, memory or test subprocesses. Model request concurrency and local compilation/testing are different constraints. A useful next step is separate admission for model calls and expensive local checks, with per-project fairness and a shared cross-project ceiling. Include goal planners, repair attempts, exploration and native children in the accounting. Do not hold an implementation permit while merely waiting for integration if the integration lane can acquire its own permit safely.
+
+For small coherent tasks, repeated context loading, separate sessions, worktree creation and repeated gates can cost more than they save. Introduce an explicit lightweight path or batching of tightly related criteria where the final independent acceptance remains protected. Parallelism is useful when write scopes are independent and model work dominates; it does not remove serial integration and can increase total tokens. Preserve mandatory final acceptance, but reuse test results only when the relevant code, toolchain, environment and test contract digests match. Missing telemetry is unknown, not zero cost.
+
+## Concrete implementation order and acceptance
+
+1. **Correct verification context, objective acceptance and shared execution policy.** Assert worker and integration gates receive the same story context and that rejection reasons survive in status/events. Test a new objective against an old green contract; it must not be accepted without an explicit relevant criterion binding. Preserve legitimate already-satisfied objective handling. Saturate a one-worker pool; assert goals and their planner wait. Exercise abort while queued, failure after acquisition and escalation. Assert no leaked permit and consistent selection in CLI/dashboard paths.
+2. **Optional Codex native-goal adapter.** Test supported and unsupported schemas, persistent thread binding, independent-completion reconciliation, provider switches, objective revision mismatch and stale native state. Never require native Codex goals for Hermes or other providers.
+3. **Budgets, pauses and recovery.** Test live token accounting, unknown usage, single-attempt overshoot reporting, elapsed-time limits during checks, user pause while active, restart after interruption and resumption without resetting measured consumption.
+4. **Exploration and dashboard identity.** Persist mode/options and connect each bounded batch to its own verified goal. Test that a requested pause survives restart and dashboard resume preserves the chosen mode and documented deadline policy.
+5. **Measured efficiency.** Run repeated real comparisons at equal accepted quality, model and effort. Include dependent tasks, independent tasks and a larger build/test workload. Report elapsed time, fresh/cached tokens, acceptance, retries and actual process-tree CPU/memory when measured. Decide lightweight/default policies from that evidence.
+
+## Reproduce
+
+Run from the validation branch after building Yoke:
+
+```powershell
+rtk npx vitest run tests/goals/command.test.ts tests/loop/resource-pool.test.ts
+rtk proxy node bench/probe-goal-integration.mjs G:/NN-Developed/Yoke-Testground/goal-probe-NEW
+rtk proxy node bench/probe-parallel-gate-context.mjs G:/NN-Developed/Yoke-Testground/parallel-probe-NEW
+rtk proxy node bench/compare-codex.mjs --fixture=routing-queue --repeats=2 --root=G:/NN-Developed/Yoke-Testground/comparison-NEW
+rtk proxy node bench/compare-codex.mjs --fixture=independent-utils --repeats=1 --root=G:/NN-Developed/Yoke-Testground/independent-NEW
+```
+
+Use a fresh output directory. The comparisons make authenticated model calls and permit changes inside disposable fixture projects. Routing is disabled and native multi-agent delegation is disabled in both arms. The Yoke parallel arm uses three Yoke workers. The original fixture tests are replayed after execution, so agent-modified tests do not define success. They remain visible to the agents; this is not hidden-test evaluation. User config is disabled, but the harness does not certify removal of every installed plugin or host-discovered skill. CPU and memory are not measured. Full logs remain in the local testground; summarized results accompany this report.
+
+These runs share one Windows machine with other activity; background resource load was not controlled or measured. Small-sample elapsed times should not be generalized to all projects or treated as isolated CPU benchmarks.
+
+The [authenticated comparison report](CODEX-COMPARISON-2026-09-29.md) contains timings, tokens, the failed parallel outcome and explicit sample limits. [Machine-readable probes](../bench/results/goal-integration-probes-2026-09-29.json) retain the mechanical findings and protocol results without private thread identifiers.
+
+Provenance: AI assistance is disclosed above. Read-only scans found no supported provenance carrier or observable text-watermark signal and inspected the full text. Cryptographic verification, signer trust, and metadata privacy remain unknown for this text without supported verifier/trust inputs. Proprietary keyed watermark detectors were unavailable; absence of a signal is not evidence of human authorship. No authorship classification is made.

package/docs/GOALS.md

@@ -0,0 +1,109 @@
+# Verified project goals
+
+A goal is a durable objective with explicit executable acceptance. Yoke owns the
+completion decision; a model's claim or an unrelated green suite cannot complete it.
+
+## Define and bind acceptance
+
+Create `.yoke/acceptance.yaml` and protect the tests it runs:
+
+```yaml
+version: 1
+protected: [tests/checkout.test.mjs]
+criteria:
+  - id: checkout
+    text: Checkout saves an order and rejects invalid input
+    commands: [node --test tests/checkout.test.mjs]
+```
+
+```sh
+yoke goal set . --objective="Implement checkout" --criteria=checkout
+yoke goal run . --runner=codex --model=gpt-6.1-sol --effort=low
+yoke goal status .
+yoke goal pause .
+yoke goal resume .
+```
+
+`--criteria` asserts that the named checks actually prove this objective. Yoke validates
+IDs and executable commands and binds the objective to a digest of the acceptance
+manifest. It cannot determine whether your tests fully express a free-text request.
+All project acceptance and configured regression checks must still pass.
+
+Existing goals without a binding now stop before any model call. Review their tests,
+then explicitly bind them with `yoke goal bind . --criteria=checkout`. Attempts and
+measured consumption remain intact. Changed acceptance infrastructure still requires
+an explicit protection refresh after review; binding never refreshes protected tests.
+
+## Resource and budget controls
+
+Goals and story loops share the project lock and the user-level worker pool. Routing
+planner and implementation calls each acquire a permit; native model delegation is
+disabled. Explicit runner/model/effort/bare options override project runner defaults.
+Execution uses Yoke's safe permission profile.
+
+| Setting | Meaning |
+| --- | --- |
+| `--attempts=N` on `set` or `budget` | Maximum cumulative attempts, default 3 |
+| `--minutes=N` | Cumulative admitted provider work, default 30 minutes; excludes capacity waits and independent checks |
+| `--wall-minutes=N` | Optional cumulative run time including admission, checks and state synchronization |
+| `--tokens=N` | Cumulative measured input + output tokens; unknown consumption stops further budgeted work |
+| `YOKE_MAX_PARALLEL_WORKERS=1..8` | Shared model/integration permit ceiling, default 3 |
+| `YOKE_MAX_PARALLEL_CHECKS=1..8` | Separate shared asynchronous goal verification ceiling, default 1 |
+
+After a measured token overrun, Yoke retains evidence and work and reports `blocked`
+even if acceptance passed. Update the budget explicitly with `yoke goal budget .
+--tokens=50000`; `--clear-token-budget` explicitly removes that ceiling. Providers
+reporting usage only after a call cannot provide a hard mid-call token cap. Native
+Codex usage units and Yoke's token accounting are recorded separately. Native
+stream updates use cumulative turn deltas and request cancellation when measured
+consumption exceeds the goal ceiling. Notifications arrive after model requests,
+so this can still overshoot within a request; progress updates are never added
+twice to persisted final usage.
+
+The asynchronous goal checker can interrupt its own command tree at a deadline or
+pause. Synchronous `yoke check` and story gates retain their existing execution
+contracts; this check pool is not an operating-system CPU, RAM, or per-test scheduler.
+After an interrupted process, unknown consumption is charged conservatively rather
+than silently granting a fresh budget.
+
+## Optional native Codex goals
+
+```sh
+yoke goal run . --native-goal
+```
+
+Or set `goals.nativeCodex: true` in `.yoke/config.yaml`. The default is off;
+`--no-native-goal` overrides the project setting. Other providers remain supported.
+
+Yoke negotiates the local Codex app-server goal capability, stores the thread binding,
+pauses native automatic continuation, and explicitly starts one bounded development
+turn. The same thread resumes on later attempts. Only Yoke's independent acceptance
+can synchronize it to `complete`. Provider/model changes create a new binding.
+An unsupported native goal method falls back to ordinary Codex execution; authentication,
+transport and execution failures remain visible. No global Codex configuration changes
+are needed. Support depends on the installed CLI, not on the model name alone.
+
+Codex app-server does not currently support exec's bare startup option. Combining
+native goals with `runner.bare: true` or `--bare` stops before dispatch rather than
+silently loading user configuration. Use `--no-native-goal` to retain bare execution,
+or explicitly disable bare startup when opting into native goals.
+
+## Dashboard resume
+
+The dashboard restores the recorded mode, goal identity and safe execution settings
+from `.yoke/run-state.json`. It rejects a mismatched goal identity. A saved story or
+exploration run takes precedence over an unrelated legacy unfinished goal. See
+[continuous exploration](CONTINUOUS-EXPLORATION.md) for absolute deadline behavior.
+
+Resume restores validated safe options, not every original authorization override.
+It uses safe permissions and defaults for self-review overrides and unbounded quality
+repair. Reviewer, quality and routing policy still follow the current project config;
+implementation and exploration-planner provider/model selections are saved separately.
+
+If process-tree termination cannot be confirmed, Yoke blocks subsequent execution and
+retains its process record and concurrency permit. A late confirmed termination can
+release the retained permit; otherwise inspect the recorded ownership before restarting
+the holder. Uncertainty is not treated as successful cleanup.
+
+Documentation and regression tooling were prepared with AI assistance; test evidence
+and release validation are recorded separately from product guarantees.

package/docs/RELEASE-VALIDATION-1.20.0.md

@@ -0,0 +1,100 @@
+# Yoke 1.20.0 release preparation — 2026-09-30
+
+AI-assisted implementation and validation in an isolated worktree based on
+`05fac3db1a51412563005e07f80e6e5a9aab8e06`. The original checkout and its local
+changes were preserved. This report records local release preparation, not a
+published GitHub or npm release.
+
+## Implemented and checked
+
+- Goal-to-criterion binding, contract digests and migration for unbound goals.
+- Shared model admission, separate asynchronous check admission, token overrun
+  reporting, cumulative provider/wall budgets, cancellation and retained ownership.
+- Optional Codex native goal threads with paused automatic continuation, independent
+  completion, durable usage baselines and cumulative turn accounting.
+- Story context through integration gates, retained parallel candidates, validated
+  recovery, bounded metadata and shorter Windows worktree paths.
+- Saved run mode, identity, implementation/planner selections, absolute exploration
+  deadline and durable attempt charging before scheduling work.
+- Runtime claims and nested worker checkouts excluded from cleanliness and staging.
+
+Regression tests reproduced the original failures before correction. Review also
+covered telemetry failures during retention, reporter failures after admission,
+interrupted counters, unsafe resume defaults and process-tree cleanup uncertainty.
+
+## Actual execution evidence
+
+The corrected authenticated parallel smoke used `gpt-6.1-sol`, low effort, three
+workers and routing disabled. It accepted **3/3 stories**, exited `0`, and passed
+**15/15 original tests** after replaying immutable verification files. All four
+protected verification files matched the seed. Duration: **112,949 ms**. Recorded
+input: **456,659**, including **372,096 cached**; output: **3,217**. The initial
+failed sample is preserved rather than excluded from the report.
+
+See [parallel validation data](../bench/results/parallel-validation-2026-09-30.json).
+This is a single corrected arm, not a fresh direct-Codex comparison. CPU, RAM and
+USD costs were not measured, and host load was not controlled. It establishes this
+fixture's acceptance, not general efficiency superiority.
+
+The integrated native goal fixture completed its protected acceptance in one model
+attempt and resumed the same goal/thread without another implementation attempt.
+The final accounting trial measured **153,736 input** and **606 output** tokens,
+with **134,528 cached input**. Its persisted baseline matched the cumulative
+provider total; native paused-goal accounting separately reported zero. Model and
+check permits and process records were empty after completion.
+
+See [native goal validation data](../bench/results/native-goal-validation-2026-09-30.json).
+
+Native accounting uses cumulative thread snapshots and a durable baseline. Missing,
+malformed or decreasing counters remain unknown; a decreasing counter marks the
+binding untrusted for subsequent accounting. No token usage is fabricated from the
+absence of telemetry. Paused native goals do not provide a hard token cap for a
+manual turn; Yoke's independent accounting guards further work and reports overruns.
+Native cumulative progress notifications also request cancellation when the ceiling
+is exceeded. Focused parent/adapter regressions cover streaming, buffered replies
+and foreign-turn rejection; the authenticated sample above used a generous budget
+and establishes completion/accounting, not a live small-budget cancellation trial.
+
+## Release checks
+
+Environment: Windows, Node.js **24.13.0**. Native protocol and model execution used
+installed Codex **0.161.0-alpha.2**. TypeScript lint and build passed. Dependency
+audit passed with **0 vulnerabilities**. The complete test run passed **1,418 tests**
+across **155 files**, with **2 skipped** (1,420 defined), in **342.26 seconds**.
+Canon, README metadata and package dry-run checks passed. The complete
+`prepublishOnly` pipeline exited **0**. The package contains **362 files**;
+temporary runtime state and raw model transcripts are excluded.
+
+The local build archive `hecer-yoke-1.20.0.tgz` was created and inspected directly.
+All four packaged version manifests match; the native adapter and durable run-state
+modules are included. Matching changelog-derived `RELEASE-NOTES.md`, `SHA256SUMS`
+and `PACKAGE-VALIDATION.json` accompany the archive in the local release output.
+
+Versions are synchronized to **1.20.0** in package/lockfile, Claude/Codex manifests,
+Gemini extension and README. The dated changelog entry is the source of release
+notes. No remote tag, GitHub release, CI run or npm publication is claimed here;
+the repository's GitHub matrix and npm verification remain publication gates.
+
+## Documentation provenance
+
+Read-only provenance inspection fully scanned README, CHANGELOG, this report, the
+goal guide and sanitized validation reports. No supported provenance carrier or
+observable text marker was found.
+Cryptographic verification, signer trust and text metadata privacy remain unknown:
+no conforming verifier/trust policy was supplied, and keyed provider watermarks
+are unavailable. Absence of a marker is not evidence of human authorship. Raw model
+transcripts and native thread identifiers are kept outside the published reports.
+
+## Operational limits
+
+- Native goals are opt-in. App-server lacks exec's bare startup control, so native
+  plus bare stops before dispatch. Ordinary Codex execution remains available.
+- Worker/check permits limit concurrency, not CPU/RAM consumption inside a process.
+- Synchronous check/story execution retains its existing contracts.
+- Process termination uncertainty blocks follow-up and retains ownership; a late
+  confirmed tree stop can release the retained permit.
+- Dashboard resume restores validated safe options. Reviewer/quality/routing policy
+  still follows current config; self-review/unbounded-quality overrides use defaults.
+- Retained parallel candidates require validated repository, contract and ownership
+  state. Stale target history requires reconciliation; serial recovery does not
+  automatically adopt a parallel checkout.

package/docs/VERIFIED-PROJECTS.md

@@ -33,7 +33,7 @@ After intentionally editing protected tests, use `yoke check . --protect --refre
 ## Durable goals across providers
 
 ```sh
-yoke goal set . --objective="Finish guest checkout" --attempts=3 --minutes=30
+yoke goal set . --objective="Finish guest checkout" --criteria=guest-checkout --attempts=3 --minutes=30
 yoke goal run . --runner=codex
 yoke goal resume . --runner=claude --model=<installed-model-id>
 yoke goal resume . --runner=gemini --model=<installed-model-id>
@@ -42,9 +42,9 @@ yoke goal handoff .
 yoke goal pause .
 ```
 
-Goals keep objective, attempts, failure context and check IDs in `.yoke/goal.json`. They share the story-loop lock. Each implementation attempt is followed by independent executable acceptance. A completed goal is checked again on a later run. Failed work stays in the project; goal execution itself does not commit or publish it. Goal handoff is readable context for native agent goal facilities; Yoke does not invent or call an undocumented native goal API.
+Goals keep objective, explicit acceptance binding, attempts, failure context and check IDs in `.yoke/goal.json`. They share the story-loop lock and worker capacity. A completed goal is checked again on a later run. Failed work stays in the project; goal execution itself does not commit or publish it. Native Codex goals are optional through `--native-goal`; see the [goal guide](GOALS.md) for capability negotiation and migration of unbound goals.
 
-`--minutes` limits cumulative agent execution time. Verification is measured separately and commands retain their verification timeout. `--tokens=N` is a checkpoint budget: it prevents another attempt when measured consumption is exhausted or unknown, but cannot promise a hard token cap within a single provider call. An interrupted attempt is persisted before dispatch; recovery accounts for it conservatively and reconciles recorded provider processes before continuing. Unknown process ownership blocks execution. Pause takes effect at an attempt boundary; it does not instantly kill an in-flight agent.
+`--minutes` limits cumulative admitted provider execution time. Optional `--wall-minutes` also includes capacity waits and independent checks. `--tokens=N` blocks further execution when measured usage is exhausted or unknown, and reports post-call overruns even when checks pass; providers with end-of-call telemetry cannot promise a hard mid-call cap. Interrupted attempts are charged conservatively and recorded process ownership is reconciled before continuation. A pause requests cancellation of Yoke-owned asynchronous execution and retains unfinished work and evidence.
 
 Explicitly extend total budgets without deleting history:
 
@@ -65,7 +65,7 @@ Failed or paused isolated story worktrees are retained. Resume the same story wi
 yoke loop run . --isolate --resume-worktree --parallel=1 --candidates=1
 ```
 
-Yoke validates the registered worktree, repository, original target commit and PRD digest. Changed target/PRD state is refused; inspect retained edits and reconcile deliberately. This flag is for serial isolated recovery; parallel workers retain their existing coordinator lifecycle. `yoke loop cleanup` remains an explicit cleanup operation; inspect its removal flags before discarding unfinished work. Existing projects should rerun retrofit to add ignore entries for checks, events and goals.
+Yoke validates the registered worktree, repository, original target commit and PRD digest. Changed target/PRD state is refused; inspect retained edits and reconcile deliberately. This flag is for serial isolated recovery. Parallel retained candidates resume through the dispatcher without reimplementation when their recovery binding remains valid. `yoke loop cleanup` is an explicit discard operation. Existing projects should rerun retrofit to add runtime ignore entries for checks, events, goals, saved runs and recovery evidence.
 
 ## Spend fewer model calls
 

package/docs/parallel-execution.md

@@ -80,6 +80,21 @@ one serial integration lane when integration measurements exist. Older runs with
 remain visible as missing integration history; forecasts are empirical ranges, not deadlines, and do
 not predict future contention from other projects.
 
+### Rejected integration recovery
+
+Worker and integrated-tree gates receive the same `YOKE_STORY` context. A rejected
+candidate is retained with its reason and an `integration-recovery.json` proof record;
+it is not silently discarded and regenerated. The next parallel run can reuse it
+without a new implementation model call when canonical project/worktree ownership,
+Git registration, target base and PRD digest still match. Integration gates run again.
+Changed target or PRD state blocks recovery and requires explicit reconciliation.
+Generated worktree names are shorter and Windows path limits are checked before setup.
+
+Goals also use the worker pool. Their asynchronous checks use a separate default-one
+check pool; see [goal resources](GOALS.md). These are concurrency permits, not hard CPU
+or RAM quotas. Current controlled comparisons do not establish general efficiency gains
+over direct Codex; see the [measured comparison](CODEX-COMPARISON-2026-09-29.md).
+
 ## Safe task decomposition
 
 Make a preview with:

package/docs/superpowers/plans/2026-09-30-goals-resources-release.md

@@ -0,0 +1,78 @@
+# Goals, verification and recovery implementation plan
+
+> **For agentic workers:** Implement independent parallel and resume components with dispatching-parallel-agents; integrate goal policy centrally. Write each regression before changing production behavior.
+
+**Goal:** Correct the reproduced completion/resource/integration failures, provide optional persistent native Codex Goals, and prepare a validated 1.20.0 release.
+
+**Architecture:** Yoke owns objective-specific executable acceptance and project integration. A negotiated optional native adapter owns a Codex thread, paused at verification boundaries. All actual provider calls use the same admission pool; local goal checks have abortable execution and a separate shared check budget. Durable run identity restores the correct mode and limits.
+
+**Tech stack:** TypeScript, Node 20+, Zod, Vitest, native CLI/app-server stdio; no new dependency.
+
+**Spec:** docs/GOALS-RESOURCE-AUDIT-2026-09-29.md and docs/CODEX-COMPARISON-2026-09-29.md. Recommendations in those dated reports become implementation scope here; historic results remain historic.
+
+## Constraints and decisions
+
+- Preserve the original dirty checkout; use the existing codex/benchmark-goals-2026-09-29 worktree.
+- Native goals remain optional, capability negotiated, and never required for other providers. No global CLI configuration changes.
+- Bind each goal to explicitly selected criterion IDs and a stable objective/contract digest. Old unbound goals require explicit binding before accepting completion; provide CLI migration command.
+- Preserve --minutes as cumulative agent-time budget; add explicit cumulative wall-time budget. Report token overshoot and unknown consumption, never silently reset them.
+- Disable unmanaged native multi-agent delegation for managed provider calls; reserve one pool unit per actual call, not an outer unit plus nested units.
+- Keep protected acceptance, scope controls, commits and safe-boundary exploration semantics. No weaker test gates or fabricated CPU/USD savings.
+- Prepare the release locally; tagging, npm publication and GitHub release are not performed by a preparation request.
+
+## Review focus
+
+Goal contract unrelated to new objective; stale/edited contracts; abort while admission is queued; planner/worker token accounting; dashboard resuming a stale goal instead of active explore run; expired exploration deadline; unavailable native protocol versus genuine authentication errors; native complete while Yoke check fails; retained worktree ownership; Windows full generated path length.
+
+## Task 1 — Parallel integration and recoverable candidates
+
+Files: src/loop/dispatcher.ts, parallel-command.ts, parallel-adapters.ts, merge-queue.ts; tests/loop parallel/dispatcher suites; reporter integration centrally.
+
+- [x] Add failing story-environment regression using independent scopes and an environment-dependent verifier.
+- [x] Preserve verification environment across worker and integration phases and restore previous environment on errors.
+- [x] Persist concrete rejection reasons and recoverable candidate ownership; retain implemented work safely and enable existing recovery paths.
+- [x] Shorten generated worktree names without weakening ownership validation; test Windows path failure handling.
+- [x] Run covering tests and deterministic control probe.
+
+## Task 2 — Durable run identity and resume
+
+Files: src/loop/run-state.ts, run-command.ts, src/dashboard/server.ts, run-state/dashboard tests.
+
+- [x] Add failing mode/provider/selection/deadline and unrelated-goal resume tests.
+- [x] Persist validated safe run options under owned project lock; restore the interrupted run's mode.
+- [x] Preserve absolute exploration deadline and user pauses; explicitly fresh CLI run gets a new deadline.
+- [x] Verify expired deadline starts no provider and unsafe permissions do not silently carry over.
+
+## Task 3 — Objective acceptance, policy and budgets
+
+Files: src/goals/command.ts, contracts.ts/admission.ts as needed, src/check/command.ts async counterpart, src/cli.ts, src/retrofit/config.ts, goals/check tests.
+
+- [x] Add failing unrelated-green-contract test, explicit binding/digest mutation tests, saturated pool and configured-selection tests.
+- [x] Bind goal objective to selected criteria and contract revision; add goal bind CLI and documented legacy migration.
+- [x] Resolve explicit provider/model/effort/bare overrides then project runner configuration; centrally disable unmanaged delegation.
+- [x] Admit actual implementation and planner calls through the pool and release in finally.
+- [x] Add abortable checks with shared local check admission; preserve fingerprints and protected contract evidence.
+- [x] Add cumulative wall-time option and post-attempt overshoot/unknown-usage accounting, streamed cancellation where supported; preserve safe pause and interrupted work.
+
+## Task 4 — Optional native Codex adapter
+
+Files: src/goals/codex-native.ts, tests/goals/codex-native.test.ts; central goal integration/config.
+
+- [x] Test initialized RPC transport, unsupported capability, malformed replies, thread start/resume, abort and bounded cleanup.
+- [x] Persist objective-bound thread identity; execute bounded turns with native goals paused between turns so independent checks arbitrate continuation.
+- [x] Synchronize completion/pause/budget/blocker states after Yoke checks; unavailable method can fall back, real execution/auth errors cannot silently downgrade.
+- [x] Test provider switches and existing-thread/model mismatch; prevent competing auto-continuation.
+
+## Task 5 — Review, measurements and release preparation
+
+- [x] Review merged components, fix covering regressions and rerun deterministic audit probes with updated expected outcomes.
+- [x] Run authenticated corrected parallel benchmark and report accepted quality/time/tokens with original sample limits.
+- [x] Run TypeScript/build, full tests, metadata checks and package dry run in isolated state.
+- [x] Add dated 1.20.0 CHANGELOG entry with implemented behavior, binding migration, default/native limits and actual validation limits.
+- [x] Synchronize package/lock/provider manifest/README versions; link compact guides for goals/resources/recovery.
+- [x] Read-only provenance audit for changed reports; prepare matching release notes and build archive.
+
+## Progress ledger
+
+- 2026-09-30: Plan created; three independent implementers assigned parallel correctness, durable resume, native adapter. Controller owns goal policy, check execution, integration, release preparation. Historic benchmark failures remain in reports.
+- 2026-09-30: Implementation and review complete. Final prepublish pipeline passed (1,418 tests, 2 skipped, 155 files), lint/build/Canon/metadata/package checks and zero-vulnerability audit passed. Authenticated parallel and native accounting fixtures succeeded with their stated limits. Local 1.20.0 archive and changelog-derived notes prepared; publication remains out of scope.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "yoke",
-  "version": "1.19.0",
+  "version": "1.21.1",
   "description": "Cross-agent coding harness for eight supported CLIs: curated skill canon, mechanical safety gates, autonomous loop with proof artifacts. CLI: npm i -g @hecer/yoke",
   "contextFileName": "GEMINI-EXTENSION.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hecer/yoke",
-  "version": "1.19.0",
+  "version": "1.21.1",
   "description": "One harness, eight agents, zero trust in \"done\" — cross-agent coding harness for Claude Code, Codex CLI, Gemini CLI, Qwen Code, OpenCode, Kilo, Pi and Hermes: one skill canon, mechanical safety gates, an autonomous loop with screenshot/video proofs.",
   "type": "module",
   "bin": {
@@ -23,6 +23,10 @@
     "bench/run-matrix.mjs",
     "bench/run-parallel-matrix.mjs",
     "bench/analyze-routing-study.mjs",
+    "bench/compare-codex.mjs",
+    "bench/analyze-codex-comparison.mjs",
+    "bench/probe-goal-integration.mjs",
+    "bench/probe-parallel-gate-context.mjs",
     "bench/fixtures",
     "bench/results",
     "docs",