@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-subagents-risk-artifacts.mjs

@@ -0,0 +1,853 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRuntimeSubagentAdapterDispatchCommand } from './runtime-subagent-adapter-dispatch-command.mjs';
+import { createSubagentBoundaryContracts } from './runtime-subagent-boundary-contracts.mjs';
+import { buildControlledSubagentOrchestrationContract } from './runtime-controlled-subagent-orchestration-contract.mjs';
+import { createSubagentEligibilityModel } from './runtime-subagents-eligibility-model.mjs';
+import { createRuntimeSubagentsStageArtifactModel } from './runtime-subagents-stage-artifact-model.mjs';
+import { createRuntimeSubagentsTailRouting } from './runtime-subagents-tail-routing-model.mjs';
+import { createSubagentPlatformSessionProxies } from './runtime-subagents-platform-session-proxies.mjs';
+import { createRuntimeSubagentsPresentation } from './runtime-subagents-presentation.mjs';
+
+export const runtimeSubagentsCommandContractSync = {
+  runtime_check_owner: 'tools/vibe-runtime-check/index.mjs',
+  release_check_owner: 'tools/vibe-release-check',
+};
+
+export const createRuntimeSubagentsRiskArtifacts = function (deps) {
+  const {
+    jsonSchemaVersion,
+    stateDirectoryName,
+    subagentEligibilityDirectoryName,
+    subagentDispatchesDirectoryName,
+    subagentAdapterDispatchesDirectoryName,
+    schedulerRunsDirectoryName,
+    subagentRunLeasesDirectoryName,
+    subagentRunResultsDirectoryName,
+    subagentResultsDirectoryName,
+    subagentReviewsDirectoryName,
+  } = deps;
+  const {
+    ensureRoot,
+    workflowPath,
+    readWorkflow,
+    validateState,
+    tasksFromState,
+    asList,
+    validateTaskId,
+    fileDigest,
+    digestObject,
+    validateCommonArtifactSafety,
+    readJsonArtifact,
+    writeStateArtifact,
+    writeJsonEnvelope,
+    listStateFiles,
+    printList,
+    subagentEligibilityDirectory,
+    subagentDispatchesDirectory,
+    subagentAdapterDispatchesDirectory,
+    schedulerRunsDirectory,
+    subagentRunLeasesDirectory,
+    subagentRunResultsDirectory,
+    subagentResultsDirectory,
+    subagentReviewsDirectory,
+    subagentEligibilityFilePath,
+    subagentDispatchFilePath,
+    subagentAdapterDispatchFilePath,
+    subagentRunLeaseFilePath,
+    subagentRunResultFilePath,
+    subagentResultFilePath,
+    subagentReviewFilePath,
+    schedulerHookPlanFilePath,
+    validateSchedulerHookPlanArtifact,
+    safeStateArtifactFilePath,
+    orchestratorDispatchPlanFilePath,
+    validateOrchestratorArtifact,
+    platformCapabilityFilePath,
+    validatePlatformCapabilityArtifact,
+    getPlatformCommand,
+  } = deps;
+
+  const {
+    listPlatformSessionApprovalFiles, listPlatformSessionFiles, listPlatformSessionLeaseFiles, listPlatformSessionResultFiles, listPlatformSessionCancellationFiles, listPlatformSessionIntakeFiles, listPlatformSessionReviewFiles,
+    platformSessionApprovalSnapshotPath, platformSessionIntakeSnapshotPath, platformSessionReviewSnapshotPath, platformSessionApprovalsDirectory, platformSessionsDirectory, platformSessionLeasesDirectory, platformSessionResultsDirectory, platformSessionCancellationsDirectory, platformSessionIntakeDirectory, platformSessionReviewsDirectory,
+    platformSessionApprovalFilePath, platformSessionFilePath, platformSessionLeaseFilePath, platformSessionResultFilePath, platformSessionCancellationFilePath, platformSessionIntakeFilePath, platformSessionReviewFilePath,
+    platformSessionApprovalEnvelope, platformSessionEnvelope, platformSessionCancelEnvelope, platformSessionResultIntakeEnvelope, platformSessionReviewEnvelope,
+    validatePlatformSessionApprovalArtifact, validatePlatformSessionArtifact, validatePlatformSessionCancelArtifact, validatePlatformSessionIntakeArtifact, validatePlatformSessionReviewArtifact,
+    writePlatformSessionApproval, writePlatformSession, writePlatformSessionCancel, writePlatformSessionIntake, writePlatformSessionReview,
+    printPlatformSessionApproval, printPlatformSession, printPlatformSessionCancel, printPlatformSessionResultReview,
+  } = createSubagentPlatformSessionProxies(getPlatformCommand);
+
+  const {
+    printSubagentEligibility,
+    printSubagentEligibilityAudit,
+    printSubagentSingleShotRun,
+    printSubagentResultOrReview,
+    printSubagentDispatch,
+  } = createRuntimeSubagentsPresentation({ printList });
+
+  const {
+    subagentEligibilityGateIds,
+    subagentEligibilityRequiredEvidence,
+    subagentEligibilityForbiddenEvidence,
+    subagentEligibilityPlannedWrites,
+    subagentDispatchPlannedWrites,
+    stage35SubagentEligibilitySafety,
+    stage36SubagentDispatchSafety,
+    validateStage35SubagentEligibilitySafety,
+  } = createSubagentBoundaryContracts({
+    stateDirectoryName,
+    subagentEligibilityDirectoryName,
+    subagentDispatchesDirectoryName,
+    validateCommonArtifactSafety,
+  });
+
+  function controlledSubagentOrchestrationForEnvelope(envelope, phase) {
+    const detail = envelope.subagent_eligibility
+      || envelope.subagent_dispatch
+      || envelope.subagent_adapter_dispatch
+      || envelope.platform_session_approval
+      || envelope.subagent_scheduler_run
+      || envelope.subagent_run_result
+      || envelope.subagent_result
+      || envelope.subagent_review
+      || envelope.platform_session_review
+      || envelope.platform_session_intake
+      || {};
+    return buildControlledSubagentOrchestrationContract({
+      phase,
+      writeMode: envelope.safety?.writes === true ? 'explicit-confirm-sidecar-only' : 'none',
+      eligibilityGateBound: Boolean(envelope.subagent_eligibility),
+      dispatchArtifactBound: Boolean(envelope.subagent_dispatch),
+      adapterHandoffBound: Boolean(envelope.subagent_adapter_dispatch),
+      platformSessionApprovalBound: Boolean(envelope.platform_session_approval),
+      singleShotResultBound: Boolean(envelope.subagent_scheduler_run || envelope.subagent_run_result),
+      resultReviewGateBound: Boolean(envelope.subagent_result || envelope.subagent_review || envelope.platform_session_review || envelope.platform_session_intake),
+      artifactSummary: envelope.summary || {
+        mode: envelope.mode || '',
+        task_id: detail.task_id || '',
+        status: detail.dispatch_status || detail.approval_status || detail.run_status || detail.result_status || detail.ingest_status || detail.review_status || '',
+        writes: envelope.safety?.writes === true,
+      },
+      blockedReasons: envelope.quality || detail.blocked_reasons || [],
+    });
+  }
+
+  function withControlledSubagentOrchestration(envelope, phase) {
+    return {
+      ...envelope,
+      controlled_subagent_orchestration: controlledSubagentOrchestrationForEnvelope(envelope, phase),
+    };
+  }
+
+  const {
+    subagentEligibilityGateResults,
+    orchestratorDispatchTargetForTask,
+    subagentEligibilityBridgeGateResults,
+    subagentEligibilityBridgeEnvelope,
+    subagentEligibilityEnvelope,
+    validateSubagentEligibilityArtifact,
+  } = createSubagentEligibilityModel({
+    jsonSchemaVersion,
+    stateDirectoryName,
+    subagentEligibilityDirectoryName,
+    ensureRoot,
+    workflowPath,
+    readWorkflow,
+    validateState,
+    tasksFromState,
+    asList,
+    validateTaskId,
+    fileDigest,
+    digestObject,
+    readJsonArtifact,
+    orchestratorDispatchPlanFilePath,
+    validateOrchestratorArtifact,
+    subagentEligibilityGateIds,
+    subagentEligibilityRequiredEvidence,
+    subagentEligibilityForbiddenEvidence,
+    subagentEligibilityPlannedWrites,
+    stage35SubagentEligibilitySafety,
+    validateStage35SubagentEligibilitySafety,
+  });
+  
+  function subagentEligibilitySnapshotPath(root) {
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    return path.join(subagentEligibilityDirectory(root), `${timestamp}.subagent-eligibility.json`);
+  }
+  
+  function listSubagentEligibilityFiles(root) {
+    return listStateFiles(root, subagentEligibilityDirectory, '.subagent-eligibility.json');
+  }
+  
+  function writeSubagentEligibility(root, envelope) {
+    const file = subagentEligibilitySnapshotPath(root);
+    const payload = { schema_version: jsonSchemaVersion, command: 'subagents', ...envelope, safety: { ...envelope.safety, subagent_eligibility_artifact: true } };
+    const verification = validateSubagentEligibilityArtifact(root, payload);
+    if (!verification.ok) throw new Error(`subagent eligibility verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+  
+  function subagentEligibilityAuditEnvelope(root, mode, eligibilityFile = '') {
+    if (mode === 'list') {
+      const eligibilities = listSubagentEligibilityFiles(root).map((fileName) => {
+        try {
+          const artifact = readJsonArtifact(path.join(subagentEligibilityDirectory(root), fileName), 'Subagent eligibility');
+          const verification = validateSubagentEligibilityArtifact(root, artifact);
+          return { file: fileName, task_id: artifact.subagent_eligibility?.task_id || '', eligible: artifact.subagent_eligibility?.eligible === true, verification_ok: verification.ok, verification_failures: verification.failures };
+        } catch (error) {
+          return { file: fileName, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message] };
+        }
+      });
+      return { mode: 'subagent-eligibility-list', ok: true, eligibilities, summary: { count: eligibilities.length, eligible_count: eligibilities.filter((item) => item.eligible).length, failed_count: eligibilities.filter((item) => !item.verification_ok).length }, quality: [], action: 'read-only subagent eligibility audit listed local gate artifacts. No subagent dispatch occurred.' };
+    }
+    const file = subagentEligibilityFilePath(root, eligibilityFile);
+    const artifact = readJsonArtifact(file, 'Subagent eligibility');
+    const verification = validateSubagentEligibilityArtifact(root, artifact);
+    if (mode === 'verify' && !verification.ok) throw new Error(`subagent eligibility verification failed: ${verification.failures.join('; ')}`);
+    return { mode: mode === 'verify' ? 'subagent-eligibility-verify' : 'subagent-eligibility-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_eligibility?.task_id || '', eligible: artifact.subagent_eligibility?.eligible === true }, verification, eligibility: artifact, quality: verification.failures, action: 'read-only subagent eligibility audit inspected one local gate artifact. No subagent dispatch occurred.' };
+  }
+  
+  function subagentDispatchSnapshotPath(root) {
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    return path.join(subagentDispatchesDirectory(root), `${timestamp}.subagent-dispatch.json`);
+  }
+  
+  function listSubagentDispatchFiles(root) {
+    return listStateFiles(root, subagentDispatchesDirectory, '.subagent-dispatch.json');
+  }
+  
+  const {
+    subagentSchedulerRunSnapshotPath,
+    subagentRunLeaseSnapshotPath,
+    subagentRunResultSnapshotPath,
+    listSubagentSchedulerRunFiles,
+    listSubagentRunLeaseFiles,
+    listSubagentRunResultFiles,
+    subagentSingleShotRunEnvelope,
+    validateSubagentSingleShotRunArtifact,
+    subagentResultSnapshotPath,
+    subagentReviewSnapshotPath,
+    listSubagentResultFiles,
+    listSubagentReviewFiles,
+    subagentResultIngestionEnvelope,
+    validateSubagentResultArtifact,
+    subagentReviewGateEnvelope,
+    validateSubagentReviewArtifact,
+  } = createRuntimeSubagentsStageArtifactModel({
+    ...deps,
+    fs,
+    path,
+    validateSubagentDispatchArtifact,
+  });
+  
+  function writeSubagentSingleShotRun(root, envelope) {
+    const runFile = subagentSchedulerRunSnapshotPath(root, envelope.files.scheduler_run.replace('.subagent-scheduler-run.json', ''));
+    const leaseFile = subagentRunLeaseSnapshotPath(root, envelope.files.lease.replace('.subagent-lease.json', ''));
+    const resultFile = subagentRunResultSnapshotPath(root, envelope.files.result.replace('.subagent-run-result.json', ''));
+    const payload = { schema_version: jsonSchemaVersion, command: 'subagents', ...envelope, safety: { ...envelope.safety, scheduler_run_artifact: true, subagent_lease_artifact: true, subagent_run_result_artifact: true } };
+    const verification = validateSubagentSingleShotRunArtifact(root, payload, path.basename(runFile));
+    if (!verification.ok) throw new Error(`subagent single-shot run verification failed: ${verification.failures.join('; ')}`);
+    writeStateArtifact(path.dirname(runFile), path.basename(runFile), payload);
+    writeStateArtifact(path.dirname(leaseFile), path.basename(leaseFile), payload);
+    writeStateArtifact(path.dirname(resultFile), path.basename(resultFile), payload);
+    return { runFile, leaseFile, resultFile };
+  }
+  
+  function writeSubagentResult(root, envelope) {
+    const fileName = envelope.files?.subagent_result || path.basename(subagentResultSnapshotPath(root));
+    const file = subagentResultFilePath(root, fileName);
+    const payload = { schema_version: jsonSchemaVersion, command: 'subagents', ...envelope, safety: { ...envelope.safety, subagent_result_artifact: true } };
+    const verification = validateSubagentResultArtifact(root, payload, path.basename(file));
+    if (!verification.ok) throw new Error(`subagent result verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+  
+  function writeSubagentReview(root, envelope) {
+    const fileName = envelope.files?.subagent_review || path.basename(subagentReviewSnapshotPath(root));
+    const file = subagentReviewFilePath(root, fileName);
+    const payload = { schema_version: jsonSchemaVersion, command: 'subagents', ...envelope, safety: { ...envelope.safety, subagent_review_artifact: true } };
+    const verification = validateSubagentReviewArtifact(root, payload, path.basename(file));
+    if (!verification.ok) throw new Error(`subagent review verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+  
+  function subagentDispatchEnvelope(root, schedulerPlanFile, eligibilityFile, { persist = false, orchestratorDispatchPlanFile = '' } = {}) {
+    ensureRoot(root);
+    if (!eligibilityFile) throw new Error('subagents --dispatch requires --eligibility <eligibility-file>');
+    const hasOrchestratorBridge = Boolean(orchestratorDispatchPlanFile);
+    if (!schedulerPlanFile && !hasOrchestratorBridge) throw new Error('subagents --dispatch requires --from-plan <scheduler-hook-plan-file> or --from-orchestrator <orchestrator-dispatch-plan-file>');
+    let schedulerPlanPath = '';
+    let schedulerPlan = null;
+    let schedulerVerification = { ok: true, failures: [] };
+    let schedulerPlanDigest = '';
+    if (schedulerPlanFile) {
+      schedulerPlanPath = schedulerHookPlanFilePath(root, schedulerPlanFile);
+      schedulerPlan = readJsonArtifact(schedulerPlanPath, 'Scheduler hook plan');
+      schedulerVerification = validateSchedulerHookPlanArtifact(root, schedulerPlan);
+      if (!schedulerVerification.ok) throw new Error(`scheduler hook plan verification failed: ${schedulerVerification.failures.join('; ')}`);
+      schedulerPlanDigest = fileDigest(schedulerPlanPath);
+    }
+    let orchestratorDispatchPlanPath = '';
+    let orchestratorDispatchPlan = null;
+    let orchestratorVerification = { ok: true, failures: [] };
+    let orchestratorDispatchPlanDigest = '';
+    if (hasOrchestratorBridge) {
+      orchestratorDispatchPlanPath = orchestratorDispatchPlanFilePath(root, orchestratorDispatchPlanFile);
+      orchestratorDispatchPlan = readJsonArtifact(orchestratorDispatchPlanPath, 'Orchestrator dispatch plan');
+      orchestratorVerification = validateOrchestratorArtifact(root, orchestratorDispatchPlan, path.basename(orchestratorDispatchPlanPath));
+      if (!orchestratorVerification.ok) throw new Error(`orchestrator dispatch plan verification failed: ${orchestratorVerification.failures.join('; ')}`);
+      orchestratorDispatchPlanDigest = fileDigest(orchestratorDispatchPlanPath);
+    }
+    const eligibilityPath = subagentEligibilityFilePath(root, eligibilityFile);
+    const eligibility = readJsonArtifact(eligibilityPath, 'Subagent eligibility');
+    const eligibilityVerification = validateSubagentEligibilityArtifact(root, eligibility);
+    if (!eligibilityVerification.ok) throw new Error(`subagent eligibility verification failed: ${eligibilityVerification.failures.join('; ')}`);
+    if (eligibility.subagent_eligibility?.eligible !== true) throw new Error('subagent eligibility is not approved');
+    const eligibilityDigest = fileDigest(eligibilityPath);
+    const taskId = eligibility.subagent_eligibility.task_id;
+    if (hasOrchestratorBridge) {
+      const source = eligibility.subagent_eligibility?.source || {};
+      if (source.kind !== 'orchestrator-dispatch-plan') throw new Error('subagents --dispatch --from-orchestrator requires Stage 50 bridge eligibility');
+      if (source.file !== path.basename(orchestratorDispatchPlanPath)) throw new Error('subagent eligibility source does not match orchestrator dispatch plan');
+      const target = orchestratorDispatchTargetForTask(orchestratorDispatchPlan.orchestrator_dispatch_plan || {}, taskId);
+      if (!target) throw new Error('orchestrator dispatch plan does not contain eligibility task');
+    }
+    const dispatchCore = {
+      version: 1,
+      stage: 'Stage 36',
+      created_at: new Date().toISOString(),
+      writes: Boolean(persist),
+      dispatch_status: 'approved-dispatch-artifact-only',
+      task_id: taskId,
+      scheduler_hook_plan_file: schedulerPlanPath ? path.basename(schedulerPlanPath) : '',
+      scheduler_hook_plan_digest: schedulerPlanDigest,
+      scheduler_plan_id: schedulerPlan?.scheduler_hook_plan?.scheduler_plan_id || '',
+      orchestrator_dispatch_plan_file: orchestratorDispatchPlanPath ? path.basename(orchestratorDispatchPlanPath) : '',
+      orchestrator_dispatch_plan_digest: orchestratorDispatchPlanDigest,
+      orchestrator_dispatch_plan_artifact_digest: orchestratorDispatchPlan?.orchestrator_dispatch_plan?.dispatch_plan_digest || '',
+      eligibility_file: path.basename(eligibilityPath),
+      eligibility_digest: eligibilityDigest,
+      task_brief_digest: eligibility.subagent_eligibility?.task_digest || '',
+      workflow_digest: eligibility.subagent_eligibility?.workflow_sha256 || '',
+      methodology_gate_digest: digestObject(eligibility.subagent_eligibility?.gates || []),
+      scheduler_plan_digest: schedulerPlan?.scheduler_hook_plan?.plan_digest || '',
+      approval_policy_digest: digestObject({ required: ['scheduler-hook-plan-review', 'subagent-eligibility-review'], allowed_followup: ['dispatch-artifact-only'], approval_required: true }),
+      capability_matrix_digest: digestObject(eligibility.subagent_eligibility?.platform_capability || {}),
+      allowed_followup: ['claim-artifact-only'],
+      lease_required: true,
+      review_required: true,
+      no_session_create: true,
+      no_platform_api: true,
+      no_subagent_run: true,
+      no_scheduler_run: true,
+      no_git: true,
+      no_worktree: true,
+      planned_writes: subagentDispatchPlannedWrites(persist),
+    };
+    return {
+      mode: 'subagent-dispatch',
+      ok: true,
+      state_present: fs.existsSync(workflowPath(root)),
+      subagent_dispatch: { ...dispatchCore, dispatch_digest: digestObject(dispatchCore) },
+      scheduler_hook_plan: schedulerPlanPath ? { file: path.basename(schedulerPlanPath), digest: schedulerPlanDigest, verification: schedulerVerification } : null,
+      orchestrator_dispatch_plan: orchestratorDispatchPlanPath ? { file: path.basename(orchestratorDispatchPlanPath), digest: orchestratorDispatchPlanDigest, verification: orchestratorVerification } : null,
+      subagent_eligibility: { file: path.basename(eligibilityPath), digest: eligibilityDigest, verification: eligibilityVerification },
+      safety: stage36SubagentDispatchSafety(persist),
+      quality: [],
+      action: persist
+        ? 'approved subagent dispatch artifact was written. No subagent session, platform API, scheduler run, git, worktree, or business source write occurred.'
+        : 'approved subagent dispatch was previewed read-only. No files were written and no subagent session was created.',
+    };
+  }
+  
+  function validateSubagentDispatchArtifact(root, artifact) {
+    const failures = [];
+    if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+    if (artifact.command !== 'subagents') failures.push('command must be subagents');
+    if (artifact.mode !== 'subagent-dispatch') failures.push('mode must be subagent-dispatch');
+    if (artifact.ok !== true) failures.push('subagent dispatch artifact ok must be true');
+    const dispatch = artifact.subagent_dispatch || {};
+    if (dispatch.version !== 1) failures.push('subagent_dispatch.version must be 1');
+    if (dispatch.stage !== 'Stage 36') failures.push('subagent_dispatch.stage must be Stage 36');
+    if (dispatch.writes !== true) failures.push('subagent_dispatch.writes must be true');
+    if (dispatch.dispatch_status !== 'approved-dispatch-artifact-only') failures.push('subagent_dispatch.dispatch_status must be approved-dispatch-artifact-only');
+    const usesSchedulerPlan = Boolean(dispatch.scheduler_hook_plan_file);
+    const usesOrchestratorBridge = Boolean(dispatch.orchestrator_dispatch_plan_file);
+    if (!dispatch.task_id) failures.push('subagent_dispatch.task_id is required');
+    if (!usesSchedulerPlan && !usesOrchestratorBridge) failures.push('subagent_dispatch requires scheduler hook plan or orchestrator dispatch plan source');
+    if (usesSchedulerPlan && !String(dispatch.scheduler_hook_plan_file).endsWith('.scheduler-hook-plan.json')) failures.push('subagent_dispatch.scheduler_hook_plan_file must be a scheduler hook plan artifact');
+    if (usesOrchestratorBridge && !String(dispatch.orchestrator_dispatch_plan_file).endsWith('.orchestrator-dispatch-plan.json')) failures.push('subagent_dispatch.orchestrator_dispatch_plan_file must be an orchestrator dispatch plan artifact');
+    if (!dispatch.eligibility_file || !String(dispatch.eligibility_file).endsWith('.subagent-eligibility.json')) failures.push('subagent_dispatch.eligibility_file must be a subagent eligibility artifact');
+    if (!Array.isArray(dispatch.allowed_followup) || digestObject(dispatch.allowed_followup) !== digestObject(['claim-artifact-only'])) failures.push('subagent_dispatch.allowed_followup must equal claim-artifact-only');
+    for (const key of ['lease_required', 'review_required', 'no_session_create', 'no_platform_api', 'no_subagent_run', 'no_scheduler_run', 'no_git', 'no_worktree']) {
+      if (dispatch[key] !== true) failures.push(`subagent_dispatch.${key} must be true`);
+    }
+    if (!Array.isArray(dispatch.planned_writes)) failures.push('subagent_dispatch.planned_writes must be an array');
+    else if (dispatch.writes === true && digestObject(dispatch.planned_writes) !== digestObject([path.join(stateDirectoryName, subagentDispatchesDirectoryName, '<timestamp>.subagent-dispatch.json').replace(/\\/g, '/')])) failures.push('subagent_dispatch.planned_writes must only contain subagent dispatch artifact');
+    const digestPayload = { ...dispatch };
+    delete digestPayload.dispatch_digest;
+    if (dispatch.dispatch_digest !== digestObject(digestPayload)) failures.push('subagent_dispatch digest mismatch');
+    if (root && usesSchedulerPlan) {
+      try {
+        const planPath = schedulerHookPlanFilePath(root, dispatch.scheduler_hook_plan_file);
+        if (fileDigest(planPath) !== dispatch.scheduler_hook_plan_digest) failures.push('subagent_dispatch scheduler hook plan digest mismatch');
+        const plan = readJsonArtifact(planPath, 'Scheduler hook plan');
+        const verification = validateSchedulerHookPlanArtifact(root, plan);
+        failures.push(...verification.failures.map((failure) => `scheduler hook plan: ${failure}`));
+        if ((plan.scheduler_hook_plan?.scheduler_plan_id || '') !== dispatch.scheduler_plan_id) failures.push('subagent_dispatch scheduler_plan_id mismatch');
+        if ((plan.scheduler_hook_plan?.plan_digest || '') !== dispatch.scheduler_plan_digest) failures.push('subagent_dispatch scheduler plan digest mismatch');
+      } catch (error) {
+        failures.push(error.message);
+      }
+    }
+    if (root && usesOrchestratorBridge) {
+      try {
+        const planPath = orchestratorDispatchPlanFilePath(root, dispatch.orchestrator_dispatch_plan_file);
+        if (fileDigest(planPath) !== dispatch.orchestrator_dispatch_plan_digest) failures.push('subagent_dispatch orchestrator dispatch plan digest mismatch');
+        const plan = readJsonArtifact(planPath, 'Orchestrator dispatch plan');
+        const verification = validateOrchestratorArtifact(root, plan, path.basename(planPath));
+        failures.push(...verification.failures.map((failure) => `orchestrator dispatch plan: ${failure}`));
+        if ((plan.orchestrator_dispatch_plan?.dispatch_plan_digest || '') !== dispatch.orchestrator_dispatch_plan_artifact_digest) failures.push('subagent_dispatch orchestrator dispatch plan artifact digest mismatch');
+        const target = orchestratorDispatchTargetForTask(plan.orchestrator_dispatch_plan || {}, dispatch.task_id);
+        if (!target) failures.push('subagent_dispatch task not found in orchestrator dispatch plan');
+      } catch (error) {
+        failures.push(error.message);
+      }
+    }
+    if (root && dispatch.eligibility_file) {
+      try {
+        const eligibilityPath = subagentEligibilityFilePath(root, dispatch.eligibility_file);
+        if (fileDigest(eligibilityPath) !== dispatch.eligibility_digest) failures.push('subagent_dispatch eligibility digest mismatch');
+        const eligibility = readJsonArtifact(eligibilityPath, 'Subagent eligibility');
+        const verification = validateSubagentEligibilityArtifact(root, eligibility);
+        failures.push(...verification.failures.map((failure) => `subagent eligibility: ${failure}`));
+        if (eligibility.subagent_eligibility?.eligible !== true) failures.push('subagent_dispatch eligibility must be approved');
+        const eligibilitySourceKind = eligibility.subagent_eligibility?.source?.kind || 'workflow-task';
+        if (usesOrchestratorBridge && eligibilitySourceKind !== 'orchestrator-dispatch-plan') failures.push('subagent_dispatch orchestrator bridge requires Stage 50 bridge eligibility');
+        if (!usesOrchestratorBridge && eligibilitySourceKind === 'orchestrator-dispatch-plan') failures.push('subagent_dispatch Stage 50 bridge eligibility requires orchestrator dispatch plan source');
+        if (usesOrchestratorBridge && eligibility.subagent_eligibility?.source?.file !== dispatch.orchestrator_dispatch_plan_file) failures.push('subagent_dispatch eligibility source file mismatch');
+        if ((eligibility.subagent_eligibility?.task_id || '') !== dispatch.task_id) failures.push('subagent_dispatch task_id mismatch');
+        if ((eligibility.subagent_eligibility?.task_digest || '') !== dispatch.task_brief_digest) failures.push('subagent_dispatch task brief digest mismatch');
+        if ((eligibility.subagent_eligibility?.workflow_sha256 || '') !== dispatch.workflow_digest) failures.push('subagent_dispatch workflow digest mismatch');
+        if (digestObject(eligibility.subagent_eligibility?.gates || []) !== dispatch.methodology_gate_digest) failures.push('subagent_dispatch methodology gate digest mismatch');
+        if (digestObject(eligibility.subagent_eligibility?.platform_capability || {}) !== dispatch.capability_matrix_digest) failures.push('subagent_dispatch capability matrix digest mismatch');
+      } catch (error) {
+        failures.push(error.message);
+      }
+    }
+    const expectedApprovalPolicyDigest = digestObject({ required: ['scheduler-hook-plan-review', 'subagent-eligibility-review'], allowed_followup: ['dispatch-artifact-only'], approval_required: true });
+    if (dispatch.approval_policy_digest !== expectedApprovalPolicyDigest) failures.push('subagent_dispatch approval policy digest mismatch');
+    failures.push(...validateCommonArtifactSafety(artifact.safety, 'Stage 36'));
+    if (artifact.safety?.writes !== true) failures.push('safety.writes must be true');
+    if (artifact.safety?.subagent_dispatch_artifact !== true) failures.push('safety.subagent_dispatch_artifact must be true');
+    for (const key of ['scheduler_plan', 'scheduler_run', 'session_create', 'subagent_dispatch', 'external_api', 'external_delivery', 'model_invocation', 'runtime_action', 'auto_execution', 'platform_api', 'skill_execution', 'business_source_write', 'subagent', 'mcp', 'daemon', 'git', 'worktree']) {
+      if (artifact.safety?.[key] !== false) failures.push(`safety.${key} must be false`);
+    }
+    return { ok: failures.length === 0, failures };
+  }
+  
+  function writeSubagentDispatch(root, envelope) {
+    const file = subagentDispatchSnapshotPath(root);
+    const payload = { schema_version: jsonSchemaVersion, command: 'subagents', ...envelope, safety: { ...envelope.safety, subagent_dispatch_artifact: true } };
+    const verification = validateSubagentDispatchArtifact(root, payload);
+    if (!verification.ok) throw new Error(`subagent dispatch verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+  
+  const {
+    subagentAdapterDispatchSnapshotPath,
+    listSubagentAdapterDispatchFiles,
+    subagentAdapterDispatchEnvelope,
+    validateSubagentAdapterDispatchArtifact,
+    writeSubagentAdapterDispatch,
+    printSubagentAdapterDispatch,
+  } = createRuntimeSubagentAdapterDispatchCommand({
+    jsonSchemaVersion,
+    stateDirectoryName,
+    subagentAdapterDispatchesDirectoryName,
+    ensureRoot,
+    workflowPath,
+    fileDigest,
+    digestObject,
+    readJsonArtifact,
+    writeStateArtifact,
+    listStateFiles,
+    subagentAdapterDispatchesDirectory,
+    subagentAdapterDispatchFilePath,
+    subagentDispatchFilePath,
+    subagentEligibilityFilePath,
+    platformCapabilityFilePath,
+    validateSubagentDispatchArtifact,
+    validateSubagentEligibilityArtifact,
+    validatePlatformCapabilityArtifact,
+  });
+
+  function subagentAuditListEnvelope(root, mode, fileName) {
+    const eligibilityEnvelope = subagentEligibilityAuditEnvelope(root, mode, fileName);
+    const dispatches = listSubagentDispatchFiles(root).map((name) => {
+      try {
+        const artifact = readJsonArtifact(path.join(subagentDispatchesDirectory(root), name), 'Subagent dispatch');
+        const verification = validateSubagentDispatchArtifact(root, artifact);
+        return { file: name, task_id: artifact.subagent_dispatch?.task_id || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind: 'subagent-dispatch' };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind: 'subagent-dispatch' };
+      }
+    });
+    const adapterDispatches = listSubagentAdapterDispatchFiles(root).map((name) => {
+      try {
+        const artifact = readJsonArtifact(path.join(subagentAdapterDispatchesDirectory(root), name), 'Subagent adapter dispatch');
+        const verification = validateSubagentAdapterDispatchArtifact(root, artifact, name);
+        return { file: name, task_id: artifact.subagent_adapter_dispatch?.task_id || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind: 'subagent-adapter-dispatch' };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind: 'subagent-adapter-dispatch' };
+      }
+    });
+    const singleShotFiles = [
+      ...listSubagentSchedulerRunFiles(root).map((name) => ['subagent-scheduler-run', name, schedulerRunsDirectory(root)]),
+      ...listSubagentRunLeaseFiles(root).map((name) => ['subagent-run-lease', name, subagentRunLeasesDirectory(root)]),
+      ...listSubagentRunResultFiles(root).map((name) => ['subagent-run-result', name, subagentRunResultsDirectory(root)]),
+    ].map(([kind, name, directory]) => {
+      try {
+        const artifact = readJsonArtifact(path.join(directory, name), kind);
+        const verification = validateSubagentSingleShotRunArtifact(root, artifact, name);
+        return { file: name, task_id: artifact.subagent_scheduler_run?.task_id || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind };
+      }
+    });
+    const stage38Files = [
+      ...listSubagentResultFiles(root).map((name) => ['subagent-result', name, subagentResultsDirectory(root), validateSubagentResultArtifact]),
+      ...listSubagentReviewFiles(root).map((name) => ['subagent-review', name, subagentReviewsDirectory(root), validateSubagentReviewArtifact]),
+    ].map(([kind, name, directory, verifier]) => {
+      try {
+        const artifact = readJsonArtifact(path.join(directory, name), kind);
+        const verification = verifier(root, artifact, name);
+        const detail = artifact.subagent_result || artifact.subagent_review || {};
+        return { file: name, task_id: detail.task_id || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind };
+      }
+    });
+    const sessionApprovals = listPlatformSessionApprovalFiles(root).map((name) => {
+      try {
+        const artifact = readJsonArtifact(path.join(platformSessionApprovalsDirectory(root), name), 'Platform session approval');
+        const verification = validatePlatformSessionApprovalArtifact(root, artifact, name);
+        return { file: name, task_id: artifact.platform_session_approval?.task_id || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind: 'platform-session-approval' };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind: 'platform-session-approval' };
+      }
+    });
+    const sessionRuntimeFiles = [
+      ...listPlatformSessionFiles(root).map((name) => ['platform-session', name, platformSessionsDirectory(root)]),
+      ...listPlatformSessionLeaseFiles(root).map((name) => ['platform-session-lease', name, platformSessionLeasesDirectory(root)]),
+      ...listPlatformSessionResultFiles(root).map((name) => ['platform-session-result', name, platformSessionResultsDirectory(root)]),
+    ].map(([kind, name, directory]) => {
+      try {
+        const artifact = readJsonArtifact(path.join(directory, name), kind);
+        const verification = validatePlatformSessionArtifact(root, artifact, name);
+        return { file: name, task_id: artifact.platform_session?.approval_file || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind };
+      }
+    });
+    const sessionCancelFiles = listPlatformSessionCancellationFiles(root).map((name) => {
+      try {
+        const artifact = readJsonArtifact(path.join(platformSessionCancellationsDirectory(root), name), 'Platform session cancellation');
+        const verification = validatePlatformSessionCancelArtifact(root, artifact, name);
+        return { file: name, task_id: artifact.platform_session_cancel?.session_file || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind: 'platform-session-cancel' };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind: 'platform-session-cancel' };
+      }
+    });
+    const sessionReviewFiles = [
+      ...listPlatformSessionIntakeFiles(root).map((name) => ['platform-session-intake', name, platformSessionIntakeDirectory(root), validatePlatformSessionIntakeArtifact]),
+      ...listPlatformSessionReviewFiles(root).map((name) => ['platform-session-review', name, platformSessionReviewsDirectory(root), validatePlatformSessionReviewArtifact]),
+    ].map(([kind, name, directory, verifier]) => {
+      try {
+        const artifact = readJsonArtifact(path.join(directory, name), kind);
+        const verification = verifier(root, artifact, name);
+        const detail = artifact.platform_session_intake || artifact.platform_session_review || {};
+        return { file: name, task_id: detail.session_file || '', eligible: true, verification_ok: verification.ok, verification_failures: verification.failures, kind };
+      } catch (error) {
+        return { file: name, task_id: '', eligible: false, verification_ok: false, verification_failures: [error.message], kind };
+      }
+    });
+    const eligibilities = eligibilityEnvelope.eligibilities.map((item) => ({ ...item, kind: 'subagent-eligibility' }));
+    const all = [...eligibilities, ...dispatches, ...adapterDispatches, ...singleShotFiles, ...stage38Files, ...sessionApprovals, ...sessionRuntimeFiles, ...sessionCancelFiles, ...sessionReviewFiles];
+    return { mode: 'subagent-artifact-list', ok: true, eligibilities: all, summary: { count: all.length, eligible_count: eligibilities.filter((item) => item.eligible).length, dispatch_count: dispatches.length, adapter_dispatch_count: adapterDispatches.length, run_artifact_count: singleShotFiles.length, result_artifact_count: stage38Files.length, session_approval_count: sessionApprovals.length, platform_session_count: sessionRuntimeFiles.length, platform_session_cancel_count: sessionCancelFiles.length, platform_session_review_count: sessionReviewFiles.length, failed_count: all.filter((item) => !item.verification_ok).length }, quality: [], action: 'read-only subagent audit listed eligibility, dispatch, adapter dispatch, single-shot run, result, review, session approval, platform session, session cancellation, and session review artifacts. No subagent dispatch occurred.' };
+  }
+
+  function subagentAuditEnvelope(root, mode, fileName = '') {
+    if (mode === 'list') {
+      return subagentAuditListEnvelope(root, mode, fileName);
+    }
+    if (fileName.endsWith('.platform-session-intake.json') || fileName.endsWith('.platform-session-review.json')) {
+      const isIntake = fileName.endsWith('.platform-session-intake.json');
+      const file = isIntake ? platformSessionIntakeFilePath(root, fileName) : platformSessionReviewFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Platform session review');
+      const verification = isIntake ? validatePlatformSessionIntakeArtifact(root, artifact, path.basename(file)) : validatePlatformSessionReviewArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`platform session review verification failed: ${verification.failures.join('; ')}`);
+      const verifyMode = isIntake ? 'platform-session-intake-verify' : 'platform-session-review-verify';
+      const showMode = isIntake ? 'platform-session-intake-show' : 'platform-session-review-show';
+      return { mode: mode === 'verify' ? verifyMode : showMode, ok: verification.ok, summary: { file: path.basename(file), status: artifact.platform_session_intake?.intake_status || artifact.platform_session_review?.review_status || '' }, verification, review: artifact, quality: verification.failures, action: 'read-only platform session review audit inspected one local review artifact. No source was written.' };
+    }
+    if (fileName.endsWith('.platform-session-cancel.json')) {
+      const file = platformSessionCancellationFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Platform session cancellation');
+      const verification = validatePlatformSessionCancelArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`platform session cancel verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'platform-session-cancel-verify' : 'platform-session-cancel-show', ok: verification.ok, summary: { file: path.basename(file), session_id: artifact.platform_session_cancel?.session_id || '', cancel_status: artifact.platform_session_cancel?.cancel_status || '' }, verification, cancellation: artifact, quality: verification.failures, action: 'read-only platform session cancellation audit inspected one local cancellation artifact. No source was written.' };
+    }
+    if (fileName.endsWith('.platform-session.json') || fileName.endsWith('.platform-session-lease.json') || fileName.endsWith('.platform-session-result.json')) {
+      const file = fileName.endsWith('.platform-session.json') ? platformSessionFilePath(root, fileName)
+        : fileName.endsWith('.platform-session-lease.json') ? platformSessionLeaseFilePath(root, fileName)
+          : platformSessionResultFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Platform session');
+      const verification = validatePlatformSessionArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`platform session verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'platform-session-verify' : 'platform-session-show', ok: verification.ok, summary: { file: path.basename(file), session_id: artifact.platform_session?.session_id || '', session_status: artifact.platform_session?.session_status || '' }, verification, session: artifact, quality: verification.failures, action: 'read-only platform session audit inspected one local session artifact. No source was written.' };
+    }
+    if (fileName.endsWith('.platform-session-approval.json')) {
+      const file = platformSessionApprovalFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Platform session approval');
+      const verification = validatePlatformSessionApprovalArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`platform session approval verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'platform-session-approval-verify' : 'platform-session-approval-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.platform_session_approval?.task_id || '', platform: artifact.platform_session_approval?.platform || '', approval_status: artifact.platform_session_approval?.approval_status || '' }, verification, approval: artifact, quality: verification.failures, action: 'read-only platform session approval audit inspected one local approval artifact. No session was created.' };
+    }
+    if (fileName.endsWith('.subagent-result.json')) {
+      const file = subagentResultFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Subagent result');
+      const verification = validateSubagentResultArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`subagent result verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'subagent-result-verify' : 'subagent-result-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_result?.task_id || '', ingest_status: artifact.subagent_result?.ingest_status || '' }, verification, result: artifact, quality: verification.failures, action: 'read-only subagent result audit inspected one local result artifact. No result was merged.' };
+    }
+    if (fileName.endsWith('.subagent-review.json')) {
+      const file = subagentReviewFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Subagent review');
+      const verification = validateSubagentReviewArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`subagent review verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'subagent-review-verify' : 'subagent-review-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_review?.task_id || '', review_status: artifact.subagent_review?.review_status || '' }, verification, review: artifact, quality: verification.failures, action: 'read-only subagent review audit inspected one local review gate artifact. No result was merged.' };
+    }
+    if (fileName.endsWith('.subagent-scheduler-run.json') || fileName.endsWith('.subagent-lease.json') || fileName.endsWith('.subagent-run-result.json')) {
+      const file = fileName.endsWith('.subagent-scheduler-run.json') ? safeStateArtifactFilePath(root, schedulerRunsDirectory, fileName, '.subagent-scheduler-run.json', 'Subagent scheduler run')
+        : fileName.endsWith('.subagent-lease.json') ? subagentRunLeaseFilePath(root, fileName)
+          : subagentRunResultFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Subagent single-shot run');
+      const verification = validateSubagentSingleShotRunArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`subagent single-shot run verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'subagent-single-shot-run-verify' : 'subagent-single-shot-run-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_scheduler_run?.task_id || '', run_status: artifact.subagent_scheduler_run?.run_status || '' }, verification, run: artifact, quality: verification.failures, action: 'read-only subagent single-shot run audit inspected one local run artifact. No subagent session was created.' };
+    }
+    if (fileName.endsWith('.subagent-adapter-dispatch.json')) {
+      const file = subagentAdapterDispatchFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Subagent adapter dispatch');
+      const verification = validateSubagentAdapterDispatchArtifact(root, artifact, path.basename(file));
+      if (mode === 'verify' && !verification.ok) throw new Error(`subagent adapter dispatch verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'subagent-adapter-dispatch-verify' : 'subagent-adapter-dispatch-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_adapter_dispatch?.task_id || '', dispatch_status: artifact.subagent_adapter_dispatch?.dispatch_status || '' }, verification, adapter_dispatch: artifact, quality: verification.failures, action: 'read-only subagent adapter dispatch audit inspected one local adapter handoff artifact. No adapter or subagent session was created.' };
+    }
+    if (fileName.endsWith('.subagent-dispatch.json')) {
+      const file = subagentDispatchFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Subagent dispatch');
+      const verification = validateSubagentDispatchArtifact(root, artifact);
+      if (mode === 'verify' && !verification.ok) throw new Error(`subagent dispatch verification failed: ${verification.failures.join('; ')}`);
+      return { mode: mode === 'verify' ? 'subagent-dispatch-verify' : 'subagent-dispatch-show', ok: verification.ok, summary: { file: path.basename(file), task_id: artifact.subagent_dispatch?.task_id || '', dispatch_status: artifact.subagent_dispatch?.dispatch_status || '' }, verification, dispatch: artifact, quality: verification.failures, action: 'read-only subagent dispatch audit inspected one local dispatch artifact. No subagent session was created.' };
+    }
+    return subagentEligibilityAuditEnvelope(root, mode, fileName);
+  }
+  
+  function runPlatformSessionSubagentsMode(options) {
+    if (options.cancelSession) {
+      if (!options.confirm) throw new Error('subagents --cancel-session requires --confirm');
+      const envelope = withControlledSubagentOrchestration(platformSessionCancelEnvelope(options.root, options.subagentsFile, { persist: true }), 'platform-session-cancel-gate');
+      const file = writePlatformSessionCancel(options.root, envelope);
+      if (options.json) writeJsonEnvelope('subagents', { ...envelope, platform_session_cancel_file: path.basename(file) });
+      else printPlatformSessionCancel(envelope, file);
+      return true;
+    }
+    if (options.createSession) {
+      if (!options.confirm) throw new Error('subagents --create-session requires --confirm');
+      if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsIngestResult || options.subagentsReviewGate || options.sessionApproval) throw new Error('subagents --create-session cannot be combined with other subagent write modes');
+      const envelope = withControlledSubagentOrchestration(platformSessionEnvelope(options.root, options.fromApproval, { persist: true }), 'platform-session-sidecar-gate');
+      const files = writePlatformSession(options.root, envelope);
+      if (options.json) writeJsonEnvelope('subagents', { ...envelope, platform_session_file: path.basename(files.sessionFile), platform_session_lease_file: path.basename(files.leaseFile), platform_session_result_file: path.basename(files.resultFile) });
+      else printPlatformSession(envelope, files);
+      return true;
+    }
+    if (options.sessionResultIngest) {
+      if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsIngestResult || options.subagentsReviewGate || options.sessionResultReview || options.sessionApproval || options.createSession || options.cancelSession) throw new Error('subagents --ingest-session-result cannot be combined with other subagent write modes');
+      const intakeArtifactFile = options.confirm ? path.basename(platformSessionIntakeSnapshotPath(options.root)) : '';
+      const envelope = withControlledSubagentOrchestration(platformSessionResultIntakeEnvelope(options.root, options.subagentsResultFile, { persist: options.confirm, artifactFile: intakeArtifactFile }), 'platform-session-result-intake-gate');
+      if (options.confirm) {
+        const file = writePlatformSessionIntake(options.root, envelope);
+        if (options.json) writeJsonEnvelope('subagents', { ...envelope, platform_session_intake_file: path.basename(file) });
+        else printPlatformSessionResultReview(envelope, file);
+        return true;
+      }
+      if (options.json) writeJsonEnvelope('subagents', envelope);
+      else printPlatformSessionResultReview(envelope);
+      return true;
+    }
+    if (options.sessionResultReview) {
+      if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsIngestResult || options.subagentsReviewGate || options.sessionResultIngest || options.sessionApproval || options.createSession || options.cancelSession) throw new Error('subagents --review-session-result cannot be combined with other subagent write modes');
+      const reviewArtifactFile = options.confirm ? path.basename(platformSessionReviewSnapshotPath(options.root)) : '';
+      const envelope = withControlledSubagentOrchestration(platformSessionReviewEnvelope(options.root, options.subagentsResultFile, { persist: options.confirm, artifactFile: reviewArtifactFile }), 'platform-session-review-gate');
+      if (options.confirm) {
+        const file = writePlatformSessionReview(options.root, envelope);
+        if (options.json) writeJsonEnvelope('subagents', { ...envelope, platform_session_review_file: path.basename(file) });
+        else printPlatformSessionResultReview(envelope, file);
+        return true;
+      }
+      if (options.json) writeJsonEnvelope('subagents', envelope);
+      else printPlatformSessionResultReview(envelope);
+      return true;
+    }
+    if (options.sessionApproval) {
+      if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsIngestResult || options.subagentsReviewGate) throw new Error('subagents --session-approval cannot be combined with other subagent write modes');
+      const approvalArtifactFile = options.confirm ? path.basename(platformSessionApprovalSnapshotPath(options.root)) : '';
+      const envelope = withControlledSubagentOrchestration(platformSessionApprovalEnvelope(options.root, options.fromDispatch, options.capabilityFile, { persist: options.confirm, artifactFile: approvalArtifactFile }), 'platform-session-approval-gate');
+      if (options.confirm) {
+        const file = writePlatformSessionApproval(options.root, envelope);
+        if (options.json) writeJsonEnvelope('subagents', { ...envelope, platform_session_approval_file: path.basename(file) });
+        else printPlatformSessionApproval(envelope, file);
+        return true;
+      }
+      if (options.json) writeJsonEnvelope('subagents', envelope);
+      else printPlatformSessionApproval(envelope);
+      return true;
+    }
+    return false;
+  }
+
+  function emitSubagentArtifactEnvelope(options, envelope, writeConfirmed, printEnvelope, fileKey) {
+    if (options.confirm) {
+      const file = writeConfirmed();
+      if (options.json) writeJsonEnvelope('subagents', { ...envelope, [fileKey]: path.basename(file) });
+      else printEnvelope(envelope, file);
+      return true;
+    }
+    if (options.json) writeJsonEnvelope('subagents', envelope);
+    else printEnvelope(envelope);
+    return true;
+  }
+  function runSubagentAdapterDispatchMode(options) {
+    if (!options.subagentsAdapterDispatch) return false;
+    if (options.run || options.subagentsDispatch || options.subagentsEligibility || options.subagentsIngestResult || options.subagentsReviewGate || options.sessionApproval || options.createSession || options.cancelSession) throw new Error('subagents --adapter-dispatch cannot be combined with other subagent write modes');
+    const adapterArtifactFile = options.confirm ? path.basename(subagentAdapterDispatchSnapshotPath(options.root)) : '';
+    const envelope = withControlledSubagentOrchestration(subagentAdapterDispatchEnvelope(options.root, options.fromDispatch, options.capabilityFile, { persist: options.confirm, artifactFile: adapterArtifactFile }), 'adapter-handoff-gate');
+    return emitSubagentArtifactEnvelope(options, envelope, () => writeSubagentAdapterDispatch(options.root, envelope), printSubagentAdapterDispatch, 'subagent_adapter_dispatch_file');
+  }
+  function runSubagentResultIngestMode(options) {
+    if (!options.subagentsIngestResult) return false;
+    if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsReviewGate) throw new Error('subagents --ingest-result cannot be combined with other subagent write modes');
+    const resultArtifactFile = options.confirm ? path.basename(subagentResultSnapshotPath(options.root)) : '';
+    const envelope = withControlledSubagentOrchestration(subagentResultIngestionEnvelope(options.root, options.subagentsResultFile, { persist: options.confirm, artifactFile: resultArtifactFile }), 'result-ingestion-gate');
+    return emitSubagentArtifactEnvelope(options, envelope, () => writeSubagentResult(options.root, envelope), printSubagentResultOrReview, 'subagent_result_file');
+  }
+  function runSubagentReviewGateMode(options) {
+    if (!options.subagentsReviewGate) return false;
+    if (options.run || options.subagentsDispatch || options.subagentsAdapterDispatch || options.subagentsEligibility || options.subagentsIngestResult) throw new Error('subagents --review-gate cannot be combined with other subagent write modes');
+    const reviewArtifactFile = options.confirm ? path.basename(subagentReviewSnapshotPath(options.root)) : '';
+    const envelope = withControlledSubagentOrchestration(subagentReviewGateEnvelope(options.root, options.subagentsResultFile, { persist: options.confirm, artifactFile: reviewArtifactFile }), 'result-review-gate');
+    return emitSubagentArtifactEnvelope(options, envelope, () => writeSubagentReview(options.root, envelope), printSubagentResultOrReview, 'subagent_review_file');
+  }
+  function runSubagentSingleShotMode(options) {
+    if (!options.run) return false;
+    if (!options.fromDispatch) throw new Error('subagents --run requires --from-dispatch <subagent-dispatch-file>');
+    if (!options.confirm) throw new Error('subagents --run requires --confirm');
+    const envelope = withControlledSubagentOrchestration(subagentSingleShotRunEnvelope(options.root, options.fromDispatch, { persist: true }), 'single-shot-result-recording');
+    const files = writeSubagentSingleShotRun(options.root, envelope);
+    if (options.json) writeJsonEnvelope('subagents', { ...envelope, subagent_scheduler_run_file: path.basename(files.runFile), subagent_lease_file: path.basename(files.leaseFile), subagent_run_result_file: path.basename(files.resultFile) });
+    else printSubagentSingleShotRun(envelope, files);
+    return true;
+  }
+  function runSubagentDispatchArtifactMode(options) {
+    if (!options.subagentsDispatch) return false;
+    if (!options.confirm) throw new Error('subagents --dispatch requires --confirm');
+    const envelope = withControlledSubagentOrchestration(subagentDispatchEnvelope(options.root, options.schedulerPlanFile, options.subagentsEligibilityFile, { persist: true, orchestratorDispatchPlanFile: options.subagentsFromOrchestrator ? options.orchestratorFile : '' }), 'dispatch-artifact-gate');
+    const file = writeSubagentDispatch(options.root, envelope);
+    if (options.json) writeJsonEnvelope('subagents', { ...envelope, subagent_dispatch_file: path.basename(file) });
+    else printSubagentDispatch(envelope, file);
+    return true;
+  }
+  function runSubagentArtifactMode(options) {
+    return runSubagentAdapterDispatchMode(options) || runSubagentResultIngestMode(options) || runSubagentReviewGateMode(options) || runSubagentSingleShotMode(options) || runSubagentDispatchArtifactMode(options);
+  }
+  const controlledSubagentEligibilityBridgeEnvelope = (...args) => withControlledSubagentOrchestration(
+    subagentEligibilityBridgeEnvelope(...args),
+    'orchestrator-eligibility-gate',
+  );
+  const controlledSubagentEligibilityEnvelope = (...args) => withControlledSubagentOrchestration(
+    subagentEligibilityEnvelope(...args),
+    'eligibility-gate',
+  );
+  const controlledSubagentAuditEnvelope = (...args) => withControlledSubagentOrchestration(
+    subagentAuditEnvelope(...args),
+    'artifact-audit',
+  );
+
+  const { runSubagents } = createRuntimeSubagentsTailRouting({
+    path,
+    writeJsonEnvelope,
+    subagentEligibilityBridgeEnvelope: controlledSubagentEligibilityBridgeEnvelope,
+    subagentEligibilityEnvelope: controlledSubagentEligibilityEnvelope,
+    writeSubagentEligibility,
+    printSubagentEligibility,
+    subagentAuditEnvelope: controlledSubagentAuditEnvelope,
+    printSubagentEligibilityAudit,
+    runPlatformSessionSubagentsMode,
+    runSubagentArtifactMode,
+  });
+
+  return {
+    subagentEligibilityGateIds,
+    subagentEligibilityRequiredEvidence,
+    subagentEligibilityForbiddenEvidence,
+    subagentEligibilitySnapshotPath,
+    listSubagentEligibilityFiles,
+    subagentEligibilityGateResults,
+    orchestratorDispatchTargetForTask,
+    subagentEligibilityBridgeGateResults,
+    subagentEligibilityBridgeEnvelope: controlledSubagentEligibilityBridgeEnvelope,
+    subagentEligibilityEnvelope: controlledSubagentEligibilityEnvelope,
+    validateSubagentEligibilityArtifact,
+    writeSubagentEligibility,
+    subagentEligibilityAuditEnvelope: controlledSubagentAuditEnvelope,
+    printSubagentEligibility,
+    printSubagentEligibilityAudit,
+    subagentDispatchSnapshotPath,
+    listSubagentDispatchFiles,
+    subagentSchedulerRunSnapshotPath,
+    subagentRunLeaseSnapshotPath,
+    subagentRunResultSnapshotPath,
+    listSubagentSchedulerRunFiles,
+    listSubagentRunLeaseFiles,
+    listSubagentRunResultFiles,
+    subagentSingleShotRunEnvelope,
+    validateSubagentSingleShotRunArtifact,
+    writeSubagentSingleShotRun,
+    printSubagentSingleShotRun,
+    subagentResultSnapshotPath,
+    subagentReviewSnapshotPath,
+    listSubagentResultFiles,
+    listSubagentReviewFiles,
+    subagentResultIngestionEnvelope,
+    validateSubagentResultArtifact,
+    writeSubagentResult,
+    subagentReviewGateEnvelope,
+    validateSubagentReviewArtifact,
+    writeSubagentReview,
+    printSubagentResultOrReview,
+    subagentDispatchEnvelope,
+    validateSubagentDispatchArtifact,
+    writeSubagentDispatch,
+    printSubagentDispatch,
+    subagentAdapterDispatchSnapshotPath,
+    listSubagentAdapterDispatchFiles,
+    subagentAdapterDispatchEnvelope,
+    validateSubagentAdapterDispatchArtifact,
+    writeSubagentAdapterDispatch,
+    printSubagentAdapterDispatch,
+    subagentAuditEnvelope,
+    runSubagents,
+  };
+};