@kendoo.agentdesk/agentdesk 0.32.0 → 0.33.0

package/CHANGELOG.md

@@ -8,6 +8,30 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [Unreleased]
+
+### Changed
+- `[Both]` Jane now leads delivery explicitly: she sets priorities, assigns an owner and required evidence for each step, resolves disagreements, follows up on incomplete work, and carries decisions into the next phase. Her reports distinguish verified outcomes from blockers and unconfirmed tracker writes; unmet requirements cannot be silently deferred or described as ready.
+
+### Fixed
+- `[CLI]` Team and solo agents can now submit their structured handoffs. The required submission tool was missing from their allowed tool lists, so intake could finish its research and Jira startup comment but stop before implementation or a final tracker report. Handoff repair also has access to the submission tool without execution tools.
+
+## [0.33.0] — 2026-09-21
+
+### Added
+- `[Both]` New dashboard sessions support pausing, saving task corrections, and resuming the same conversation and workspace after workers stop. Saved instructions and recovery status survive server restarts; the daemon retains the task checkpoint and checks access again before continuing.
+- `[UI]` A recovery panel explains access failures, shows when intervention is needed, and offers instructions for reconnecting the model provider.
+
+### Changed
+- `[CLI]` Missing phase handoffs get one repair attempt from saved findings with execution tools disabled. Failed recovery preserves the work for intervention. Recognized external writes are recorded before dispatch, and exact repeats are blocked during continuation.
+
+## [0.32.1] — 2026-09-21
+
+### Fixed
+- `[CLI]` The publish and history gates now understand the command they are looking at. `git -C . push`, `env git push`, a `git push` on a second line, `sh -c 'git push'`, `/usr/bin/git push` and similar spellings used to slip past both Sam's audit gate and the verification; the engine now parses the shell command and classifies what it actually runs, and refuses anything it cannot model when the text hints at publishing.
+- `[CLI]` A cached verification pass is only reused for the exact tree it ran on — same commit *and* a clean working tree, then and now. Uncommitted edits left `HEAD` unchanged, so later publish attempts and the review could reuse stale evidence; they now run the checks again. An approval is also invalidated by uncommitted changes appearing after it in a session worktree.
+- `[CLI]` Sam finishing his audit no longer counts as approving it. Sam ends his report with `AUDIT: APPROVED` or `AUDIT: REJECTED — <why>`; the engine reads that line, ties an approval to the commit he audited, and refuses to publish after a rejection, without the line, or once a newer commit exists — until he audits again. The verdict shows in the feed and in the handoff ledger.
+
 ## [0.32.0] — 2026-09-21
 
 ### Changed

package/README.md

@@ -46,7 +46,7 @@ AgentDesk spawns a team of AI agents inside Claude Code that collaborate on your
 
 | Agent | Role |
 |-------|------|
-| Jane | Product Lead — facilitates, clarifies requirements, coordinates the team |
+| Jane | Team Lead — owns priorities and delivery, assigns work, challenges evidence, and resolves disagreements |
 | Dennis | Senior Developer — implements the solution |
 | Sam | Architecture Auditor — code structure, separation of concerns |
 | Bart | QA Engineer — edge cases, risks, acceptance criteria, screenshots |
@@ -265,7 +265,7 @@ Valid values: `"default"`, `"opus"`, `"sonnet"`, `"haiku"`. `"default"` resolves
 
 The `REVIEW` phase is a read-only completeness check (no code changes) — it verifies the implementation meets requirements, flags missed documentation updates or silently-deferred scope. If gaps are found, the orchestrator loops back to `EXECUTION` once before moving on. The `SUMMARY` phase writes the final tracker comments and session protocol.
 
-Before the reviewers are asked, the engine runs the project's own checks itself — `commands.test`, `commands.build` and `commands.lint` from project settings, or the `test`/`build`/`lint` scripts in `package.json` when those are unset — inside the session sandbox, at the current commit. A failing check goes straight back to `EXECUTION` with the real output as findings; the reviewers are only asked once the checks pass. An approval is pinned to that commit: if the code changes afterwards, the approval no longer counts and the session ends for human review instead of reporting success. In a session worktree, uncommitted changes block review too — an approval refers to a committed revision. Publishing is verified the same way, on the spot: when the team runs `git push` or `gh pr create`, the engine runs the checks at the revision being published and refuses with the failing output until a new commit passes (a passing run is reused by the review that follows). `REVIEW` and `SUMMARY` cannot commit, move `HEAD`, or push; they read and write messages only.
+Before the reviewers are asked, the engine runs the project's own checks itself — `commands.test`, `commands.build` and `commands.lint` from project settings, or the `test`/`build`/`lint` scripts in `package.json` when those are unset — inside the session sandbox, at the current commit. A failing check goes straight back to `EXECUTION` with the real output as findings; the reviewers are only asked once the checks pass. An approval is pinned to that commit: if the code changes afterwards, the approval no longer counts and the session ends for human review instead of reporting success. In a session worktree, uncommitted changes block review too — an approval refers to a committed revision. Publishing is verified the same way, on the spot: when the team runs `git push` or `gh pr create` — however the command is spelled (`git -C . push`, `env git push`, on a later line, inside `sh -c`) — the engine runs the checks at the revision being published and refuses with the failing output until a new commit passes. A passing run is evidence for one tree only: the same commit with a clean working tree, then and now. It is reused by the review that follows only while that still holds; uncommitted changes force a fresh run. Publishing also needs Sam's explicit verdict: he ends his audit with `AUDIT: APPROVED` or `AUDIT: REJECTED`, the engine reads that line and ties an approval to the commit he read — a rejection, a report without the line, or a commit made after his approval keeps publishing closed until he audits again. `REVIEW` and `SUMMARY` cannot commit, move `HEAD`, or push; they read and write messages only.
 
 The team follows the task. `INTAKE` assesses the scope — `small` or `standard`, and which areas the change touches (`ui`, `copy`, `docs`, `api`, `data`). A small task skips `PLAN` (Dennis states the approach at the start of `EXECUTION`) and is reviewed by Bart and Vera; Sam's architecture audit still gates the PR inside `EXECUTION`. Luna, Mark and Nora join only when the task touches UI, user-facing copy or docs respectively. Set `"teamProfile": "small"` or `"standard"` in `.agentdesk.json` to force it (`"auto"`, the default, lets `INTAKE` decide).
 
@@ -288,12 +288,24 @@ When working on Jira or Linear tasks, agents automatically download and review a
 
 ### Handoff & Resume
 
-If a session hits Claude's rate or context limit, AgentDesk saves a resume snapshot (`.agentdesk-resume.md`) and marks the session as **Handoff** in the dashboard. When you run the same task again, agents pick up where the previous session left off — skipping completed work and continuing from the last phase.
+The phase lead submits each handoff through the SDK's `StructuredOutput` tool. It must be included in both the selected agent's tool list and the unattended tool permissions; chat text alone cannot advance the phase. To check this against the real SDK after changes to tool configuration, run `npm run test:sdk-handoff`. This opt-in diagnostic requires a Claude login and uses model tokens. It checks every phase, solo mode, and handoff repair with fixed fixtures and execution tools blocked.
+
+Run `npm run test:sdk-leadership` to check Jane's decisions against supplied reports: a superseded scope deferral, a completion claim missing visual evidence, and a failed Jira comment. This opt-in behavioral check also requires a Claude login and uses model tokens; delegation and external actions are blocked. It checks decisions and named follow-up owners using the production prompts.
+
+Sessions started from the dashboard with an updated daemon can be paused and resumed in the same conversation and workspace. Use **Pause / check workers**, or enter a correction and choose **Pause & save**. Instructions are saved immediately; **Verify & resume** becomes available after the previous workers have stopped and released the workspace. A quarantined workspace remains blocked until its workers exit.
+
+Resume restores the original task, discovered tracker task ID, pending phase, saved findings, user corrections, token totals, and recorded external actions. Corrections trigger replanning against the existing work. Access is checked again before continuing; a failed login check preserves both the checkpoint and the pending correction. For a revoked model login, reconnect Claude on the daemon computer using the same account profile, then choose **Verify & resume**. Session controls require the session owner and a connected daemon that supports recovery; older sessions need a separate continuation.
+
+A missing phase handoff gets one repair attempt using the preserved findings with execution tools disabled. If repair fails, or required tracker access is denied during intake or planning, work pauses for intervention. Recognized external write commands are fingerprinted before dispatch and exact repeats are blocked. An uncertain result must be reconciled with the provider before continuing. This is a conservative replay guard, not general deduplication of equivalent commands or arbitrary scripts.
+
+The recovery checkpoint lives on the daemon computer. The dashboard retains instructions and recovery status across server restarts, but cannot resume without the local checkpoint and workspace. It never silently creates a new task when a required checkpoint is missing.
+
+Terminal sessions also save a resume snapshot (`.agentdesk-resume.md`) when interrupted. To start a continuation from the terminal, use the command printed in that snapshot, including `--resume-worktree` when present:
 
 ```bash
 # Session hits limit → "HANDOFF" shown in terminal
-# Resume when ready:
-agentdesk team KEN-517
+# Continue in the retained workspace:
+agentdesk team KEN-517 --resume-worktree SESSION-ID
 ```
 
 ### Session protocol

package/cli/agents.mjs

@@ -3,16 +3,16 @@
 export const BUILT_IN_AGENTS = {
   Jane: {
     badge: "●● JANE ●●",
-    role: "Product Analyst / Team Lead",
-    description: "leads the session, clarifies requirements, coordinates the team, dictates tracker comments (Dennis executes), decomposes large tasks into subtasks",
-    groundRules: "Jane is strictly non-technical and NEVER calls tools. She MUST NEVER: call Read, Write, Edit, Bash, Grep, Glob, or any other tool; read or reference code; mention file names, paths, function names, variable names, class names, imports, code snippets, terminal commands, error messages, or stack traces; write or modify code; execute tracker API calls herself. Her language is product-only: user stories, acceptance criteria, scope, priorities, stakeholder impact. During INTAKE she evaluates task complexity and decomposes large features into subtasks (basic vs deferred). When she needs technical information she asks Dennis or Sam (\"Dennis, can you check...\"). When tracker comments or status transitions are needed, Jane DICTATES the exact text and Dennis runs the command. If you are about to call a tool while the current speaker is Jane, STOP and switch to Dennis instead.",
-    planning: "Requirements: what we're building, acceptance criteria, scope. Flags UI tasks for Luna. (No code, no files, no tool calls.)",
+    role: "Team Lead",
+    description: "owns delivery against the user's requirements, sets priorities, makes decisions, assigns work, challenges unsupported reports, resolves disagreements, and decomposes large tasks into accountable steps",
+    groundRules: "Jane owns the outcome: she sets acceptance criteria, decomposes work, assigns an owner and expected evidence, and follows up until each requirement is verified or explicitly blocked. The latest user correction takes precedence over earlier plans and agent-proposed deferrals. She makes routine decisions within the authorized scope and asks the user only for a consequential choice or missing information the team cannot resolve. In team mode she delegates implementation and tracker operations; she does not edit code or run commands herself. She can discuss technical evidence, file references and tradeoffs when needed to judge a report. She never overrides a failed check or required review gate, invents evidence, or treats an agent's unsupported claim as completion. She keeps unrelated improvements out of scope and reports unresolved blockers honestly.",
+    planning: "Set the delivery target and acceptance criteria; choose the approach from the team's evidence; resolve tradeoffs; assign owners, dependencies and verification for each step.",
     execution: {
-      step: "Jane wraps up (dictates, Dennis executes)",
+      step: "Jane leads delivery and closes the loop",
       tasks: [
-        "Jane dictates the final summary text (product outcome, what was delivered, any scope decisions).",
-        "Dennis transitions the task to 'In Review' and posts the final summary comment on the tracker.",
-        "Jane verifies the PR description reflects the product outcome (reads Dennis's report, does not open files).",
+        "Track each acceptance criterion, its owner, and the evidence still owed; send incomplete work back with a specific next action.",
+        "Resolve disagreements using requirements, project conventions and observations; preserve all required audit and verification gates.",
+        "Dictate an accurate final tracker summary and verify the posting receipt; distinguish delivered, unverified, blocked and user-approved deferred work.",
       ],
       order: 99,
     },

package/cli/daemon.mjs

@@ -17,6 +17,7 @@ import { fileURLToPath } from "url";
 import { dirname } from "path";
 import { repositoryInfo, listWorkspaces, findWorkspacesByTask, inspectWorkspace, cleanupWorkspace, recoverWorkspaceLocks } from "./worktrees.mjs";
 import { createSessionQueue, sessionLimit, confirmWithAbort } from "./session-queue.mjs";
+import { classifyFailure } from "../shared/recovery.mjs";
 
 const __dirname_daemon = dirname(fileURLToPath(import.meta.url));
 const DAEMON_VERSION = JSON.parse(readFileSync(join(__dirname_daemon, "../package.json"), "utf-8")).version;
@@ -280,17 +281,20 @@ export async function runDaemon() {
   let confirmationQueue = Promise.resolve();
   const maxSessions = sessionLimit();
   const sessionQueue = createSessionQueue({ limit: maxSessions, run: handleStartSession,
-    onQueued: job => sendBuffered(job.sessionId, { type: "session:update", status: "queued" }),
-    onError: job => send({ type: "daemon:error", sessionId: job.sessionId, error: "Unable to start queued session" }),
+    onQueued: job => sendBuffered(job.sessionId, { type: "session:update", status: "queued", runId: job.runId }),
+    onSettled: job => {
+      if (job.recoveryCompletion) sendBuffered(job.sessionId, { type: "session:recovery", runId: job.runId, recovery: job.recoveryCompletion });
+    },
+    onError: job => send({ type: "daemon:error", sessionId: job.sessionId, runId: job.runId, error: "Unable to start queued session" }),
   });
   function enqueueSession(job) {
     const project = projects.find(p => p.id === job.projectId);
-    if (!project) { send({ type: "daemon:error", sessionId: job.sessionId, error: "Unknown project" }); return; }
+    if (!project) { send({ type: "daemon:error", sessionId: job.sessionId, runId: job.runId, error: "Unknown project" }); return; }
     try {
       let key = job.workspace?.resumeId ? `workspace:${job.workspace.resumeId}` : null;
       if (job.workspace?.enabled === false) key = `repo:${repositoryInfo(project.path).repo}`;
       sessionQueue.enqueue({ ...job, key });
-    } catch (error) { send({ type: "daemon:error", sessionId: job.sessionId, error: error.message }); }
+    } catch (error) { send({ type: "daemon:error", sessionId: job.sessionId, runId: job.runId, error: error.message }); }
   }
 
   function send(data) {
@@ -332,6 +336,7 @@ export async function runDaemon() {
             type: "daemon:connect",
             version: DAEMON_VERSION,
             worktrees: true,
+            recovery: true,
             maxSessions,
             projects: projects.map(p => ({ id: p.id, name: p.name })),
           });
@@ -366,6 +371,13 @@ export async function runDaemon() {
         if (msg.type === "daemon:cancel-session") {
           handleCancelSession(msg);
         }
+        if (msg.type === "daemon:pause-session") {
+          try { handlePauseSession(msg); }
+          catch {
+            sendBuffered(msg.sessionId, { type: "session:recovery", runId: msg.runId,
+              recovery: { state: "paused", kind: "restart", ready: false, message: "Could not verify workspace ownership. Check the daemon and try checking workers again." } });
+          }
+        }
         if (msg.type === "daemon:workspace-request") handleWorkspaceRequest(msg);
       });
 
@@ -453,12 +465,13 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
     }
   }
 
-  async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, screenshots: screenshotsOverride, workspace }) {
+  async function handleStartSession(job) {
+    const { sessionId, projectId, taskId: remoteTaskId, prompt, screenshots: screenshotsOverride, workspace, runId, resumeSession, instructions = [] } = job;
     // Validate project against local allowlist
     const project = projects.find(p => p.id === projectId);
     if (!project) {
       console.log(`  ${red}Rejected:${reset} unknown project ${dim}${projectId}${reset}`);
-      send({ type: "daemon:error", sessionId, error: `Project "${projectId}" not registered with this daemon` });
+      send({ type: "daemon:error", sessionId, runId, error: `Project "${projectId}" not registered with this daemon` });
       return;
     }
 
@@ -471,6 +484,7 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
     if (activeSessions.has(sessionId)) return;
     const activeSession = {
       sessionId, projectId,
+      runId,
       child: null,
       // Cancelling must stop the whole phase pipeline, not just the child that
       // happens to be running: killing one phase's child would otherwise let
@@ -531,6 +545,8 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
         sessionId,
         cwd: project.path,
         workspace,
+        resumeSession, instructions,
+        onWorkspace: record => { activeSession.workspaceId = record?.id; },
         apiKey,
         serverUrl: agentdeskServer,
         abortSignal: sessionAbort.signal,
@@ -564,6 +580,10 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
           }
 
           return (event) => {
+            event = { ...event, runId };
+            if (event.type === "session:start") activeSession.startedExecution = true;
+            if (event.type === "session:recovery") activeSession.recovery = event.recovery;
+            if (event.type === "session:workspace" && event.quarantined) activeSession.quarantined = true;
             // Confirmed accomplishments may arrive during cancellation teardown.
             // They do not revive the session or emit a second terminal event.
             if (["session:outcome", "session:workspace", "session:usage"].includes(event.type)) { sendBuffered(sessionId, event); return; }
@@ -594,6 +614,7 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
           };
         })(),
       });
+      activeSession.quarantined ||= result.quarantined;
 
       const outcome = result.status || (result.handoff ? "handoff" : "complete");
       const clean = outcome === "complete";
@@ -616,10 +637,42 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
     } catch (err) {
       console.log(`  ${red}Failed to start session:${reset} ${err.message}`);
       if (activeSession.cancelled) return;
+      activeSession.recovery = classifyFailure(err.message);
       // Send generic error to server — don't leak internal details (paths, config, etc.)
-      send({ type: "daemon:error", sessionId, error: "Failed to start session on daemon" });
+      send({ type: "daemon:error", sessionId, runId, error: "Failed to start session on daemon" });
     } finally {
       if (activeSessions.get(sessionId) === activeSession) activeSessions.delete(sessionId);
+      if (activeSession.paused || activeSession.recovery?.state !== "running" && activeSession.recovery) {
+        job.recoveryCompletion = activeSession.paused
+          ? { state: "paused", kind: activeSession.startedExecution || resumeSession ? "user" : "queued", message: "Work preserved. Your saved instructions will be applied when you resume." }
+          : activeSession.recovery;
+        job.recoveryCompletion = { ...job.recoveryCompletion, ready: !activeSession.quarantined };
+        if (activeSession.quarantined) job.recoveryCompletion.message = "Waiting for previous workers to exit. The workspace is quarantined; it cannot be resumed yet.";
+      }
+    }
+  }
+
+  function handlePauseSession({ sessionId, runId, workspaceId }) {
+    const job = sessionQueue.get(sessionId);
+    if (job && job.runId !== runId) return;
+    const session = activeSessions.get(sessionId);
+    if (session && session.runId !== runId) return;
+    if (session) {
+      session.paused = true;
+      session.cancelled = true;
+      stopSessionWork(session);
+    } else if (sessionQueue.cancel(sessionId)) {
+      sendBuffered(sessionId, { type: "session:recovery", runId, recovery: { state: "paused", kind: job?.resumeSession ? "user" : "queued", ready: true,
+        message: "Paused before starting. Resume to begin with your saved instructions." } });
+    } else {
+      // After a daemon restart, no local worker owns the session. Workspace
+      // acquisition on resume still checks surviving child PIDs and leases.
+      recoverWorkspaceLocks();
+      const record = workspaceId ? listWorkspaces({ projectPaths: projects.map(p => p.path) }).find(r => r.id === workspaceId) : null;
+      const busy = sessionQueue.activeIds.includes(sessionId) || (record ? inspectWorkspace(record).active : !!workspaceId);
+      if (record && !busy) sendBuffered(sessionId, { type: "session:workspace", runId, quarantined: false });
+      sendBuffered(sessionId, { type: "session:recovery", runId, recovery: { state: "paused", kind: "restart", ready: !busy,
+        message: busy ? "The workspace is still busy or unavailable. Check workers again after they exit." : "No worker is running on this daemon. Resume will check the saved workspace lease and checkpoint." } });
     }
   }
 
@@ -633,8 +686,9 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
   }
 
   function handleCancelSession({ sessionId }) {
+    const job = sessionQueue.get(sessionId);
     if (sessionQueue.cancel(sessionId)) {
-      sendBuffered(sessionId, { type: "session:end", status: "stopped", duration: "0s" });
+      sendBuffered(sessionId, { type: "session:end", runId: job?.runId, status: "stopped", duration: "0s" });
       return;
     }
     const activeSession = activeSessions.get(sessionId);
@@ -649,7 +703,7 @@ async function confirmIncomingSession({ project, taskId, prompt, signal }) {
 
       // The `cancelled` flag also suppresses the orchestrator's own
       // session:end, so this stays the single terminal event for the session.
-      sendBuffered(sessionId, { type: "session:end", duration, steps: 0, inputTokens: 0, outputTokens: 0, status: "stopped" });
+      sendBuffered(sessionId, { type: "session:end", runId: activeSession.runId, duration, steps: 0, inputTokens: 0, outputTokens: 0, status: "stopped" });
     }
   }
 

package/cli/engine/agents/index.mjs

@@ -3,8 +3,8 @@
 // The team (cli/agents.mjs BUILT_IN_AGENTS + project customisations via
 // resolveTeam) becomes, per phase:
 //   - one lead definition — Jane — that the main thread runs *as* (Options.agent),
-//     with the Agent tool and nothing else. She cannot touch code because the
-//     tools do not exist in her session.
+//     with Agent for delegation and StructuredOutput for the phase handoff.
+//     She cannot touch code because those tools do not exist in her session.
 //   - one AgentDefinition per engineering role, with the tool list that role
 //     needs in that phase and nothing more.
 //
@@ -12,6 +12,7 @@
 // belt to these braces.
 
 import { BUILT_IN_AGENTS } from "../../agents.mjs";
+import { AUDITOR, AUDIT_INSTRUCTION } from "../hooks.mjs";
 
 export const LEAD = "Jane";
 export const READ_ONLY = Object.freeze(["Read", "Grep", "Glob"]);
@@ -85,6 +86,9 @@ export function agentSystemPrompt(a, phase) {
     "",
     PHASE_GUIDANCE[phase] || "",
     phase === "EXECUTION" ? executionTasks(a) : "",
+    // The audit verdict is read by the engine, so the instruction lives here,
+    // not in a customisable task list.
+    phase === "EXECUTION" && a.name === AUDITOR ? `\n${AUDIT_INSTRUCTION}\n` : "",
     "",
     "No announcement without observation: never claim something is done, passes, or works unless you ran the check and read its output. If the observation is out of reach, say so plainly.",
     `Report back to ${LEAD} concisely. You may prefix a message with [THINK], [ACT], [ARGUE] or [AGREE] to make your stance clear.`,
@@ -100,16 +104,23 @@ export function leadSystemPrompt(roster, phase) {
   const lines = Object.entries(roster).map(([n, d]) => rosterLine(n, d));
   return [
     `You are ${LEAD}, ${jane.role}. ${jane.description}.`,
+    `Leadership responsibilities: ${jane.groundRules}`,
     "",
-    "You coordinate; you do not build. You have exactly one tool — Agent — and you use it to delegate to the team. You never read files, run commands, or edit anything yourself; when you need technical information, ask an agent for it.",
+    "You coordinate; you do not build. Use Agent to delegate to the team and StructuredOutput to submit the phase handoff when the work is done. You never read files, run commands, or edit anything yourself; when you need technical information, ask an agent for it.",
+    "Finish by calling StructuredOutput with the required schema. A closing chat message alone does not submit the handoff. Do not repeat the JSON in chat.",
     "Always delegate with run_in_background: false. A backgrounded agent's own tool calls cannot be approved, so it will be unable to do anything.",
-    "Your language is product-only: user stories, acceptance criteria, scope, priorities, stakeholder impact.",
+    "Explain decisions in plain language tied to the user's outcome. Use technical details when they help assign work, challenge a claim, or explain a tradeoff.",
     "",
     `Team available in phase ${phase}:`,
     ...lines,
     "",
-    "When you delegate, give the agent everything it needs in the prompt: the task, the relevant decisions so far, and exactly what to report back. Agents start with no memory of this conversation.",
-    "When an agent reports, relay the substance in one to three lines and move on. Never claim a result you did not receive from an agent.",
+    "Start each phase by stating its objective, the outstanding acceptance criteria, and who owns the next action. On a resumed task, work from the existing implementation and latest user feedback; reopen only what that feedback or current evidence requires.",
+    "When you delegate, name one owner and provide the objective, relevant context and user corrections, scope boundaries, dependencies, and the exact evidence needed to accept the result. Agents start with no memory of this conversation. Use only agents available in this phase.",
+    "When an agent reports, assess it against the assignment. Accept with evidence, return a specific gap to its owner, or identify a real blocker. Follow each assessment with your decision and the next action; do not merely relay the report. Never claim a result you did not receive or treat a proposed action as an executed one.",
+    "Resolve disagreements by comparing observations with the user's requirements and project conventions. Request a focused check when facts conflict, then make the call and explain why. An unsupported rejection needs evidence; a valid blocking finding must be fixed and rechecked, never voted away. Do not re-run broad discovery when a targeted check will settle the issue.",
+    "Keep a concise account of requirements, owners, accepted evidence and unresolved blockers in the phase's existing handoff fields. Carry your decisions and next actions forward. A prior agent's deferral does not authorize skipping a current user requirement; do not silently expand scope either.",
+    "If blocked, assign a bounded diagnostic or recovery step to an available agent. If it requires user access or a consequential scope decision, state what is blocked, what was tried, and the smallest input needed; never weaken acceptance criteria to call the task done. Continue independent authorized work only where the phase's gates permit it.",
+    "Report meaningful decisions, resolved blockers, and the next owner/action concisely. Avoid repeating long agent reports, narrating every delegation, or requesting permission for routine work already authorized.",
     "Announce a new task id, if you create one, on its own line as `TASK_ID: <id>`, and a short session title as `SESSION_TITLE: <title>`.",
   ].join("\n");
 }
@@ -120,10 +131,10 @@ export function leadSystemPrompt(roster, phase) {
 export function soloDefinition(agent) {
   const def = {
     description: `${agent.role}: ${agent.description}`,
-    prompt: `You are ${agent.name}, ${agent.role}. You work alone on the task given to you, end to end.`,
-    tools: [...FULL],
+    prompt: `You are ${agent.name}, ${agent.role}. You work alone on the task given to you, end to end. Finish by calling StructuredOutput with the required schema; a chat message alone does not submit the handoff.`,
+    tools: [...FULL, "StructuredOutput"],
   };
-  return { agents: { [agent.name]: def }, allowedTools: [...FULL], lead: agent.name };
+  return { agents: { [agent.name]: def }, allowedTools: [...def.tools], lead: agent.name };
 }
 
 // team        — resolveTeam(config) output (array of { name, role, description, ... })
@@ -164,7 +175,9 @@ export function agentsForPhase({ phase, team, phaseModels = {}, profile = null }
   sdkAgents[LEAD] = {
     description: `${BUILT_IN_AGENTS.Jane.role}: ${BUILT_IN_AGENTS.Jane.description}`,
     prompt: leadSystemPrompt(agents, phase),
-    tools: ["Agent"],
+    // The SDK filters even its schema tool against the selected agent's tools.
+    // Without this, outputFormat yields success with no structured_output.
+    tools: ["Agent", "StructuredOutput"],
   };
 
   const allowed = new Set(["Agent"]);

package/cli/engine/commands.mjs

@@ -0,0 +1,162 @@
+// Shell command classification for the publish and history gates.
+//
+// A regex over the raw text is not enforcement: `git -C . push`, `env git
+// push`, a newline before `git push`, `sh -c 'git push'`, `/usr/bin/git
+// push` all publish. This tokenizes the command the way a POSIX shell
+// would, splits it into simple commands, unwraps environment prefixes and
+// wrapper programs, and classifies each simple command by its effective
+// program and subcommand. Constructs it does not model (command
+// substitution, backticks, heredocs, process substitution) are marked
+// unparseable and fail closed whenever the text hints at publishing.
+
+const OPERATORS = ["&&", "||", ";;", "|&", ";", "|", "&", "\n", "(", ")", "{", "}"];
+const WRAPPERS_NO_ARGS = new Set(["command", "exec", "nohup", "time", "builtin", "caffeinate", "chronic", "nocorrect", "noglob"]);
+const PUBLISH_GIT = new Set(["push", "send-pack"]);
+const HISTORY_GIT = new Set(["commit", "merge", "rebase", "reset", "checkout", "switch", "cherry-pick", "revert", "am", "apply", "stash", "restore", "clean"]);
+const PUBLISH_GH_PR = new Set(["create", "merge", "ready", "reopen", "edit"]);
+const GIT_GLOBAL_WITH_ARG = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--super-prefix", "--config-env", "--list-cmds", "--attr-source"]);
+const PUBLISH_HINT = /\b(push|send-pack|pr\s+(create|merge|ready|reopen|edit)|release\s+create|repo\s+sync|gh\s+api)\b/i;
+
+// POSIX-ish tokenizer: words with quote/escape handling, operators, and a
+// flag for constructs we do not model.
+export function tokenize(command) {
+  const text = String(command || "");
+  const tokens = [];
+  let word = "", inWord = false, quote = null, unparseable = false;
+  const push = () => { if (inWord) { tokens.push({ word }); word = ""; inWord = false; } };
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote === "'") { if (ch === "'") quote = null; else word += ch; continue; }
+    if (quote === '"') {
+      if (ch === '"') { quote = null; continue; }
+      if (ch === "\\" && i + 1 < text.length && /["\\$`\n]/.test(text[i + 1])) { word += text[++i]; continue; }
+      if (ch === "`" || (ch === "$" && text[i + 1] === "(")) unparseable = true;
+      word += ch; continue;
+    }
+    if (ch === "\\") { if (i + 1 < text.length) { word += text[++i]; inWord = true; } continue; }
+    if (ch === "'" || ch === '"') { quote = ch; inWord = true; continue; }
+    if (ch === "`" || (ch === "$" && text[i + 1] === "(") || (ch === "<" && text[i + 1] === "(") || (ch === ">" && text[i + 1] === "(")) { unparseable = true; word += ch; inWord = true; continue; }
+    if (ch === "<" && text[i + 1] === "<") { unparseable = true; word += ch; inWord = true; continue; }
+    if (/\s/.test(ch) && ch !== "\n") { push(); continue; }
+    const op = OPERATORS.find(o => text.startsWith(o, i));
+    if (op) { push(); tokens.push({ op }); i += op.length - 1; continue; }
+    word += ch; inWord = true;
+  }
+  if (quote) unparseable = true;
+  push();
+  return { tokens, unparseable };
+}
+
+// Splits tokens into simple commands (lists of words); operators and
+// grouping punctuation only separate.
+export function splitCommands(tokens) {
+  const commands = [];
+  let current = [];
+  for (const t of tokens) {
+    if (t.op !== undefined) { if (current.length) commands.push(current); current = []; }
+    else current.push(t.word);
+  }
+  if (current.length) commands.push(current);
+  return commands;
+}
+
+const basename = word => String(word).split("/").pop();
+const isAssignment = word => /^[A-Za-z_][A-Za-z0-9_]*=/.test(word);
+
+// Returns the effective simple command with prefixes and wrappers removed,
+// or a list of nested commands when a wrapper carries a shell string.
+export function unwrap(words, depth = 0) {
+  const rest = [...words];
+  for (let guard = 0; guard < 16 && rest.length; guard++) {
+    while (rest.length && isAssignment(rest[0])) rest.shift();
+    if (!rest.length) return { words: [] };
+    const prog = basename(rest[0]);
+    if (WRAPPERS_NO_ARGS.has(prog)) { rest.shift(); continue; }
+    if (prog === "env") {
+      rest.shift();
+      while (rest.length) {
+        if (rest[0] === "-S" || rest[0] === "--split-string") return { unparseable: true, words: rest };
+        if (rest[0] === "-u" || rest[0] === "-C" || rest[0] === "--unset" || rest[0] === "--chdir") { rest.splice(0, 2); continue; }
+        if (rest[0].startsWith("-") && rest[0] !== "--") { rest.shift(); continue; }
+        if (rest[0] === "--") { rest.shift(); break; }
+        if (isAssignment(rest[0])) { rest.shift(); continue; }
+        break;
+      }
+      continue;
+    }
+    if (prog === "sudo" || prog === "doas") {
+      rest.shift();
+      while (rest.length && rest[0].startsWith("-")) { const flag = rest.shift(); if (["-u", "-g", "-p", "-C", "-D", "-h", "-r", "-t", "-U", "-T"].includes(flag)) rest.shift(); }
+      continue;
+    }
+    if (prog === "timeout") { rest.shift(); while (rest.length && rest[0].startsWith("-")) { const f = rest.shift(); if (["-k", "-s", "--kill-after", "--signal"].includes(f)) rest.shift(); } rest.shift(); continue; }
+    if (prog === "nice" || prog === "ionice" || prog === "stdbuf") { rest.shift(); while (rest.length && rest[0].startsWith("-")) { const f = rest.shift(); if (/^-[nc]$|^-[oei]$/.test(f)) rest.shift(); } continue; }
+    if (prog === "xargs") { rest.shift(); while (rest.length && rest[0].startsWith("-")) { const f = rest.shift(); if (/^-[nILPsdEa]$|^--max-args$|^--replace$|^--max-procs$|^--delimiter$|^--arg-file$/.test(f)) rest.shift(); } continue; }
+    if (["sh", "bash", "zsh", "dash", "ksh", "fish"].includes(prog)) {
+      // `-c` may be combined with other single-letter flags (`bash -lc '…'`).
+      for (let i = 1; i < rest.length; i++) {
+        const w = rest[i];
+        if (/^-[A-Za-z]*c[A-Za-z]*$/.test(w) || w === "--command") { if (rest[i + 1] !== undefined) return { nested: classify(rest[i + 1], depth + 1) }; break; }
+        if (w === "-o" || w === "+o") { i++; continue; }
+        if (!w.startsWith("-") && !w.startsWith("+")) break; // a script file: its contents are not visible here
+      }
+      return { words: rest };
+    }
+    if (prog === "eval") return { nested: classify(rest.slice(1).join(" "), depth + 1) };
+    return { words: [prog, ...rest.slice(1)] };
+  }
+  return { words: rest };
+}
+
+function classifyGit(args) {
+  let i = 0, configOverride = false;
+  while (i < args.length) {
+    const a = args[i];
+    if (GIT_GLOBAL_WITH_ARG.has(a)) { if (a === "-c" && /hooksPath|receive\.|push\./i.test(args[i + 1] || "")) configOverride = true; i += 2; continue; }
+    if (a.startsWith("--") && a.includes("=")) { if (/^--config-env=|^-c=/.test(a)) configOverride = true; i++; continue; }
+    if (a.startsWith("-")) { i++; continue; }
+    break;
+  }
+  const sub = args[i];
+  return { publishes: PUBLISH_GIT.has(sub) || configOverride, history: HISTORY_GIT.has(sub), sub };
+}
+
+function classifyGh(args) {
+  const [a, b] = args;
+  if (a === "pr" && PUBLISH_GH_PR.has(b)) return { publishes: true };
+  if (a === "release" && b === "create") return { publishes: true };
+  if (a === "repo" && (b === "sync" || b === "create")) return { publishes: true };
+  if (a === "api") {
+    const mutating = args.some((w, i) => (["-X", "--method"].includes(w) && /^(POST|PUT|PATCH|DELETE)$/i.test(args[i + 1] || "")) ||
+      /^--method=(POST|PUT|PATCH|DELETE)$/i.test(w) || ["-f", "-F", "--field", "--raw-field", "--input"].includes(w) || /^--(raw-)?field=/.test(w));
+    return { publishes: mutating };
+  }
+  return { publishes: false };
+}
+
+// classify(command) → { publishes, history, unparseable }
+//   publishes  — pushes commits or creates/changes a PR (or cannot be
+//                ruled out because the syntax is not modelled and the text
+//                hints at it)
+//   history    — commits, moves HEAD, or rewrites the tree
+//   unparseable — contains constructs this parser does not model
+export function classify(command, depth = 0) {
+  const result = { publishes: false, history: false, unparseable: false };
+  if (depth > 4) return { ...result, publishes: true, unparseable: true };
+  const { tokens, unparseable } = tokenize(command);
+  if (unparseable) result.unparseable = true;
+  for (const words of splitCommands(tokens)) {
+    const u = unwrap(words, depth);
+    if (u.unparseable) { result.unparseable = true; continue; }
+    if (u.nested) {
+      result.publishes ||= u.nested.publishes; result.history ||= u.nested.history; result.unparseable ||= u.nested.unparseable;
+      continue;
+    }
+    const [prog, ...args] = u.words;
+    if (!prog) continue;
+    if (prog === "git") { const g = classifyGit(args); result.publishes ||= g.publishes; result.history ||= g.history; }
+    else if (prog === "gh") { result.publishes ||= classifyGh(args).publishes; }
+  }
+  if (result.unparseable && PUBLISH_HINT.test(String(command || ""))) result.publishes = true;
+  return result;
+}

package/cli/engine/evidence.mjs

@@ -132,13 +132,15 @@ export async function runChecks({ checks = [], cwd, env = {}, gitEnv: extraGitEn
 }
 
 // An approval stands only on: an explicit APPROVED, passing checks, and the
-// same revision the checks and reviewers saw.
-export function evaluateApproval({ verdict, evidence, headNow }) {
+// same tree the checks and reviewers saw — same revision, and (where a clean
+// tree is required) still clean.
+export function evaluateApproval({ verdict, evidence, headNow, cleanNow }) {
   if (!verdict || verdict.outcome !== "APPROVED") return { approved: false, reason: "review did not approve" };
   if (evidence && !evidence.passed) return { approved: false, reason: evidence.aborted ? "verification was cancelled" : "engine checks did not pass" };
   if (evidence?.revision && headNow && evidence.revision !== headNow) {
     return { approved: false, reason: `code changed after verification (${shortRev(evidence.revision)} → ${shortRev(headNow)})` };
   }
+  if (evidence?.requireClean && cleanNow === false) return { approved: false, reason: "uncommitted changes appeared during review" };
   return { approved: true, reason: null };
 }