@kylecheng3146/agent-ops 0.5.3 → 0.7.0

package/dist/runtime/src/parallel/finish.js

@@ -1,4 +1,5 @@
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
@@ -6,7 +7,10 @@ import { currentGateFingerprint } from "../hooks/completion-gate.js";
 import { collectChangeSurface } from "../verify/change-surface.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "../verify/command-executor.js";
 import { prepareFinishReceipt } from "./receipt.js";
+import { readRunIntegrationProof, readRunIntegrationReceiptBinding, markRunIntegration } from "../run/integration.js";
+import { canonicalJson } from "../config/hash.js";
 import { listWorktrees } from "./manage.js";
+import { withPrivateFileLock } from "../security/permissions.js";
 import { assertWorktreeName, NOTES_REF, noteSessionLine, parseWorktreeListPorcelain, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
 const LOCK_NAME = "agent-ops-finish.lock";
 const LOCK_POLL_MS = 2_000;
@@ -97,30 +101,50 @@ export async function withFinishLock(deps, commonDir, action) {
     const path = join(commonDir, LOCK_NAME);
     const deadline = Date.now() + (deps.lockWaitMs ?? LOCK_WAIT_MS);
     const sleep = deps.sleep ?? (async (ms) => await new Promise((resolve) => setTimeout(resolve, ms)));
+    const token = randomUUID();
     for (;;) {
+        let claimed = false;
         try {
-            await mkdir(path);
-            await writeFile(join(path, "owner.json"), JSON.stringify({ pid: process.pid, at: Date.now() }));
-            break;
+            claimed = await withPrivateFileLock(path + ".state", commonDir, async () => {
+                for (;;) {
+                    try {
+                        await mkdir(path);
+                        await writeFile(join(path, "owner.json"), JSON.stringify({ pid: process.pid, at: Date.now(), token }));
+                        return true;
+                    }
+                    catch (error) {
+                        if (error.code !== "EEXIST")
+                            throw error;
+                        if (!await staleLock(path))
+                            return false;
+                        await rm(path, { recursive: true, force: true });
+                    }
+                }
+            });
         }
         catch (error) {
-            if (error.code !== "EEXIST")
+            if (!(error instanceof AgentOpsError) || error.code !== "PRIVATE_STATE_LOCK_TIMEOUT")
                 throw error;
-            if (await staleLock(path)) {
-                await rm(path, { recursive: true, force: true });
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                throw finishError("WORKTREE_FINISH_BUSY", "Another worktree finish is still running; try again later.");
-            }
-            await sleep(LOCK_POLL_MS);
         }
+        if (claimed)
+            break;
+        if (Date.now() >= deadline)
+            throw finishError("WORKTREE_FINISH_BUSY", "Another worktree finish is still running; try again later.");
+        await sleep(LOCK_POLL_MS);
     }
     try {
         return await action();
     }
     finally {
-        await rm(path, { recursive: true, force: true });
+        await withPrivateFileLock(path + ".state", commonDir, async () => {
+            const owner = await readFile(join(path, "owner.json"), "utf8").catch(error => {
+                if (error.code === "ENOENT")
+                    return null;
+                throw error;
+            });
+            if (owner !== null && JSON.parse(owner)?.token === token)
+                await rm(path, { recursive: true, force: true });
+        });
     }
 }
 /**
@@ -211,11 +235,12 @@ export async function finishWorktree(deps, options) {
     return await withFinishLock(deps, commonDir, async () => {
         const sessionChildren = (await listWorktrees(deps, mainRoot))
             .map(({ record: child }) => child)
-            .filter((child) => child.sessionId === record.sessionId && child.agentId !== undefined);
+            .filter((child) => child.path !== record.path && child.sessionId === record.sessionId &&
+            (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId)));
         if (options.finalProof === undefined && sessionChildren.length > 0) {
             throw finishError("WORKTREE_CHILDREN_REQUIRE_ADVANCE", "This session has child worktrees; run task advance for integrated final evidence before finish.");
         }
-        if (options.finalProof !== undefined &&
+        if (options.finalProof !== undefined && options.finalProof.recovery !== true &&
             (sessionChildren.length !== options.finalProof.children.length ||
                 sessionChildren.some((child) => !options.finalProof.children.some(({ name }) => name === child.name)))) {
             throw finishError("WORKTREE_CHILDREN_CHANGED", "The child worktree set changed after final review.");
@@ -257,12 +282,21 @@ export async function finishWorktree(deps, options) {
         if ((await collectChangeSurface(worktreeRunner)).paths.length > 0) {
             throw finishError("WORKTREE_DIRTY", `Commit or discard the uncommitted changes in ${record.path} first.`);
         }
-        const target = await git(deps, mainRoot, ["rev-parse", "--verify", `${record.targetBranch}^{commit}`], "WORKTREE_TARGET_MISSING", `${record.targetBranch} does not resolve to a commit.`);
-        if (options.finalProof !== undefined && target !== options.finalProof.target) {
+        const actualTarget = await git(deps, mainRoot, ["rev-parse", "--verify", `${record.targetBranch}^{commit}`], "WORKTREE_TARGET_MISSING", `${record.targetBranch} does not resolve to a commit.`);
+        const recovering = options.finalProof?.recovery === true;
+        if (recovering) {
+            const sealed = await readRunIntegrationProof(commonDir, record);
+            const { recovery: _recovery, ...requested } = options.finalProof;
+            if (sealed === null || canonicalJson(sealed) !== canonicalJson(requested) || actualTarget !== sealed.head)
+                throw finishError("RUN_INTEGRATION_PROOF_CHANGED", "Recovery requires the exact sealed candidate already at the target.");
+        }
+        const target = recovering ? options.finalProof.target : actualTarget;
+        if (options.finalProof !== undefined && actualTarget !== options.finalProof.target && !recovering) {
             throw finishError("WORKTREE_TARGET_MOVED", "The target branch moved after final review; rerun the final evidence gate.");
         }
         const ahead = Number(await git(deps, record.path, ["rev-list", "--count", `${target}..HEAD`], "WORKTREE_LOG_FAILED", "Git could not compare the branch with its target."));
-        if (ahead === 0) {
+        const noChangeProof = options.finalProof?.noChange;
+        if (ahead === 0 && noChangeProof === undefined && !recovering) {
             throw finishError("WORKTREE_NOTHING_TO_MERGE", `${record.branch} has no commits beyond ${record.targetBranch}; remove the worktree instead.`);
         }
         const worktreeConfig = await deps.loadConfig(record.path);
@@ -274,6 +308,9 @@ export async function finishWorktree(deps, options) {
             if ((await deps.git(record.path, ["merge-base", "--is-ancestor", target, "HEAD"])).exitCode !== 0) {
                 throw finishError("WORKTREE_TARGET_MOVED", "The final candidate is not based on the target; rerun the final evidence gate.");
             }
+            if (noChangeProof !== undefined && noChangeProof.sourceCommit !== headBeforeCompletion) {
+                throw finishError("WORKTREE_NO_CHANGE_SOURCE_MISMATCH", "The verified-no-change proof does not match the candidate commit.");
+            }
         }
         // Direct finish completes before merge. A final-proof finish checks all
         // evidence first, then completes only after the target's fast-forward:
@@ -283,12 +320,13 @@ export async function finishWorktree(deps, options) {
             throw finishError("WORKTREE_TASK_INCOMPLETE", "The worktree has no task; create one, verify and review it before finishing.");
         }
         const completeTasks = async () => {
+            const noChangePaths = noChangeProof?.reviewScope.changedFiles;
             for (const { task } of [...tree].sort((left, right) => right.depth - left.depth)) {
                 if (task.status === "complete")
                     continue;
                 const base = options.finalProof === undefined ? task.reviewBase ?? record.base : target;
                 try {
-                    await deps.tasks(record.path, base).complete(task.task.id, {});
+                    await deps.tasks(record.path, base, noChangePaths).complete(task.task.id, {});
                 }
                 catch (error) {
                     throw finishError("WORKTREE_TASK_INCOMPLETE", `Task ${task.task.id} (${task.task.title}) could not be completed against ${base}: ${error instanceof Error ? error.message : String(error)} ` +
@@ -337,6 +375,15 @@ export async function finishWorktree(deps, options) {
                 throw finishError("WORKTREE_REVERIFY_FAILED", `After rebasing onto ${target}, verification failed: ${failed.join(", ")}. The branch was reset; fix it as a new task and finish again.`);
             }
         }
+        const sealedIntegration = options.finalProof === undefined || record.runId === undefined
+            ? null
+            : await readRunIntegrationReceiptBinding(commonDir, record, { target, candidate: head });
+        const requestedIntegration = options.finalProof?.integrationJournal;
+        if (requestedIntegration !== undefined && sealedIntegration !== null &&
+            canonicalJson(requestedIntegration) !== canonicalJson(sealedIntegration)) {
+            throw finishError("RUN_INTEGRATION_PROOF_CHANGED", "The requested receipt binding differs from the sealed integration transaction.");
+        }
+        const integrationJournal = sealedIntegration ?? requestedIntegration;
         const receiptOptions = options.finalProof === undefined ? undefined : {
             commonDir,
             record,
@@ -345,7 +392,9 @@ export async function finishWorktree(deps, options) {
             expectedFingerprint: options.finalProof.sourceFingerprint,
             children: options.finalProof.children,
             config: worktreeConfig,
-            gitRunner: worktreeRunner
+            gitRunner: worktreeRunner,
+            ...(noChangeProof === undefined ? {} : { noChange: noChangeProof }),
+            ...(integrationJournal === undefined ? {} : { integrationJournal })
         };
         let receipt = receiptOptions === undefined ? undefined : await prepareFinishReceipt({
             ...receiptOptions,
@@ -355,7 +404,13 @@ export async function finishWorktree(deps, options) {
         const gateEnabled = mainConfig.features.completionGate.enabled;
         const before = gateEnabled ? await currentGateFingerprint(mainRoot, mainRunner) : "";
         let mergedHead;
-        if (onTarget) {
+        if (noChangeProof !== undefined || recovering) {
+            // A verified-no-change finish records proof and task state while leaving
+            // the target ref untouched. The ordinary finish path still rejects an
+            // empty branch, preserving its public behavior.
+            mergedHead = actualTarget;
+        }
+        else if (onTarget) {
             if (options.finalProof !== undefined &&
                 await git(deps, mainRoot, ["rev-parse", "HEAD"], "WORKTREE_LOG_FAILED", "Git could not read HEAD.") !== target) {
                 throw finishError("WORKTREE_TARGET_MOVED", "The target changed after the final proof was prepared.");
@@ -384,13 +439,16 @@ export async function finishWorktree(deps, options) {
             }
         }
         if (receiptOptions !== undefined) {
+            await markRunIntegration(commonDir, record, "target-moved", "target");
             try {
                 await completeTasks();
                 await validateGate();
+                await markRunIntegration(commonDir, record, "tasks-completed", "tasks");
                 receipt = await prepareFinishReceipt({
                     ...receiptOptions,
                     tasks: await deps.tasks(record.path).list().then((tasks) => tasks.filter(({ status }) => status !== "archived"))
                 });
+                await markRunIntegration(commonDir, record, "receipt-written", "receipt", receipt);
             }
             catch (error) {
                 throw finishError("WORKTREE_FINISH_PARTIAL", `Code merged at ${mergedHead}; final task state or receipt failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -410,8 +468,10 @@ export async function finishWorktree(deps, options) {
                 warnings.push(message);
             }
         };
-        const finishNote = `${noteText(record, tree)}${receipt === undefined ? "" : `\nreceipt: ${receipt.path}\nreceipt-sha256: ${receipt.digest}`}`;
+        const finishNote = `${noteText(record, tree)}${noChangeProof === undefined ? "" : "\nverified-no-change: true"}${receipt === undefined ? "" : `\nreceipt: ${receipt.path}\nreceipt-sha256: ${receipt.digest}`}`;
         await attempt("note", async () => await git(deps, mainRoot, ["notes", `--ref=${NOTES_REF}`, "add", "-f", "-m", finishNote, mergedHead], "WORKTREE_NOTE_FAILED", "Git could not write the agent-ops note."));
+        if (receiptOptions !== undefined)
+            await markRunIntegration(commonDir, record, "receipt-written", "note");
         if (gateEnabled) {
             await attempt("gate", async () => {
                 const mainGate = await deps.gate(mainRoot, mainConfig);
@@ -435,10 +495,13 @@ export async function finishWorktree(deps, options) {
                     const pinnedHead = await assertPinnedChild(child);
                     await deps.trust.revoke(child.path, await deps.loadConfig(child.path));
                     await removeCheckout(deps, child, false, pinnedHead);
+                    await markRunIntegration(commonDir, record, "receipt-written", "child:" + child.name);
                 });
             }
         }
         await attempt("remove", async () => await removeCheckout(deps, record, options.finalProof === undefined, options.finalProof?.head));
+        if (receiptOptions !== undefined)
+            await markRunIntegration(commonDir, record, "cleaned", "coordinator");
         return { record, mergedHead, rebased: !fastForward, taskIds: tree.map(({ task }) => task.task.id), warnings,
             ...(receipt === undefined ? {} : { receipt: receipt.path }) };
     });

package/dist/runtime/src/parallel/guard.js

@@ -1,3 +1,4 @@
+import { registeredRunWriter } from "../run/ownership.js";
 import { realpath } from "node:fs/promises";
 import { basename, dirname, join, relative, sep } from "node:path";
 import { insideWorktreeDirectory, mayUseWorktree, readWorktreeRecord, WORKTREE_DIRECTORY } from "./service.js";
@@ -35,6 +36,8 @@ export async function canonicalPath(path) {
         }
     }
 }
+/** The gitignored goal file the `run` profile writes in the main checkout. */
+export const RUN_GOAL_FILE = join(".agent-ops", "state", "run-goal.md");
 /**
  * In worktree auto mode the main checkout is shared by every session, so no
  * session writes it directly: each edit belongs in that session's own
@@ -45,16 +48,23 @@ export async function evaluateWorktreeWrite(mainRoot, paths, sessionId,
 /** Creates or reuses this writer's worktree and returns its path. */
 ensureWorktree, 
 /** The subagent making the write, when there is one: it has a worktree of its own. */
-agentId) {
+agentId, 
+/** The `auto-run` capability: `agent-ops run` starts from the main checkout. */
+autoRun = false) {
     for (const path of paths) {
         const target = await canonicalPath(path);
+        if (autoRun && target === join(mainRoot, RUN_GOAL_FILE))
+            continue;
         const inMain = target === mainRoot || target.startsWith(`${mainRoot}${sep}`);
         if (inMain && insideWorktreeDirectory(mainRoot, target) && sessionId !== undefined) {
             // A worktree belongs to the session that made it: writing into another
             // session's mixes two tasks' changes into one review and one merge.
             const name = relative(join(mainRoot, WORKTREE_DIRECTORY), target).split(sep)[0] ?? "";
             const record = await readWorktreeRecord(join(mainRoot, WORKTREE_DIRECTORY, name));
-            if (record !== null && !mayUseWorktree(record, sessionId, agentId)) {
+            const permitted = record === null || (record.runId === undefined
+                ? mayUseWorktree(record, sessionId, agentId)
+                : await registeredRunWriter(record, sessionId, agentId));
+            if (record !== null && !permitted) {
                 const owner = record.sessionId;
                 const sameSession = owner === sessionId;
                 let own = "";

package/dist/runtime/src/parallel/integrate.js

@@ -1,10 +1,15 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { calculateConfigHash } from "../config/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
+import { sha256 } from "../fs/hash.js";
 import { resolveReviewScope } from "../review/scope.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
 import { checkTaskVerificationEvidence } from "../task/completion.js";
+import { validateEvidence } from "../schema/validate.js";
 import { FileEvidenceStore } from "../verify/evidence.js";
+import { REVIEW_ATTESTATION_DIRECTORY } from "../review/attestation.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
 import { collectChangeSurface } from "../verify/change-surface.js";
 import { listWorktrees } from "./manage.js";
@@ -26,6 +31,111 @@ function runner(deps, cwd) {
 function markerPath(record) {
     return join(record.path, ".agent-ops", "tasks", "integrated-children.json");
 }
+function journalPath(record) {
+    return join(record.path, ".agent-ops", "tasks", "integration-journal.json");
+}
+function deliveryPath(record) {
+    return join(record.path, ".agent-ops", "tasks", "delivery.json");
+}
+function deliveryArchivePath(record, child) {
+    return join(record.path, ".agent-ops", "tasks", "deliveries", `${child.name}.json`);
+}
+async function readJournal(record) {
+    const source = await readPrivateFile(journalPath(record), record.path);
+    if (source === null)
+        return null;
+    try {
+        const value = JSON.parse(source);
+        if (value.schemaVersion !== 1 || typeof value.transactionId !== "string" || value.transactionId.length === 0 || value.transactionId.length > 256 ||
+            !/^[a-f0-9]{40,64}$/u.test(value.expectedTarget ?? "") ||
+            !/^[a-f0-9]{40,64}$/u.test(value.coordinatorBefore ?? "") ||
+            !["prepared", "merging", "importing", "recorded", "rolled-back"].includes(String(value.status)) ||
+            !Array.isArray(value.steps) || value.steps.some((step) => typeof step !== "object" || step === null ||
+            typeof step.name !== "string" ||
+            !/^[a-f0-9]{40,64}$/u.test(step.commit ?? "") ||
+            !["changed", "no-change"].includes(String(step.kind)) ||
+            !["prepared", "merged", "imported", "recorded"].includes(String(step.status)) ||
+            !Array.isArray(step.taskIds) ||
+            !Array.isArray(step.sourceArtifacts))) {
+            throw new Error("invalid integration journal");
+        }
+        return value;
+    }
+    catch (cause) {
+        throw error("WORKTREE_INTEGRATION_JOURNAL_INVALID", "Integration journal is invalid; preserve the worktree for recovery.");
+    }
+}
+/** Read the coordinator's durable integration transaction for finish/recovery. */
+export async function readIntegrationJournal(record) {
+    return await readJournal(record);
+}
+async function writeJournal(record, journal) {
+    await mkdir(join(record.path, ".agent-ops", "tasks"), { recursive: true });
+    await writePrivateFile(journalPath(record), `${JSON.stringify(journal, null, 2)}\n`, record.path);
+}
+/** Stable digest used by finish receipts to bind journal bookkeeping. */
+export function integrationJournalDigest(journal) {
+    return sha256(JSON.stringify(journal));
+}
+/** Persist a coordinator journal update so recovery can resume the same transaction. */
+export async function writeIntegrationJournal(record, journal) {
+    await writeJournal(record, journal);
+}
+async function readNoChangeDelivery(record) {
+    const source = await readPrivateFile(deliveryPath(record), record.path);
+    if (source === null)
+        return null;
+    try {
+        const value = JSON.parse(source);
+        if (value.schemaVersion !== 1 || value.deliveryKind !== "no-change" ||
+            typeof value.sourceCommit !== "string" || !/^[a-f0-9]{40,64}$/u.test(value.sourceCommit) ||
+            typeof value.deliveryDigest !== "string" || !/^[a-f0-9]{40,64}$/u.test(value.deliveryDigest) ||
+            typeof value.contractDigest !== "string" || !/^[a-f0-9]{40,64}$/u.test(value.contractDigest) ||
+            typeof value.reviewScope !== "string" || value.reviewScope.length === 0 ||
+            typeof value.runId !== "string" || typeof value.workerId !== "string" ||
+            !Number.isSafeInteger(value.generation) || value.generation < 1 ||
+            !Array.isArray(value.artifactRefs) || value.artifactRefs.some((ref) => typeof ref !== "string" || ref.length === 0 || ref.length > 4096 || ref.includes("\0"))) {
+            throw new Error("invalid no-change delivery");
+        }
+        return value;
+    }
+    catch {
+        throw error("WORKTREE_NO_CHANGE_DELIVERY_INVALID", `Child ${record.name} has an invalid no-change delivery manifest.`);
+    }
+}
+function parseNoChangeReviewScope(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw error("WORKTREE_NO_CHANGE_SCOPE_INVALID", "No-change review scope is not valid JSON.");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        throw error("WORKTREE_NO_CHANGE_SCOPE_INVALID", "No-change review scope is invalid.");
+    const scope = parsed;
+    const safePaths = (paths) => Array.isArray(paths) && paths.length > 0 && paths.every((path) => {
+        if (typeof path !== "string" || path.length === 0 || path.includes("\\") || path.startsWith("/") || path.includes("\0"))
+            return false;
+        return path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+    });
+    const noChange = scope.noChange === true;
+    if (scope.mode === "worktree" && safePaths(scope.changedFiles)) {
+        return { mode: "worktree", changedFiles: scope.changedFiles, ...(noChange ? { noChange: true } : {}) };
+    }
+    if (scope.mode === "base" && typeof scope.baseRef === "string" && typeof scope.resolvedBase === "string" &&
+        /^[a-f0-9]{40,64}$/u.test(scope.resolvedBase) && safePaths(scope.changedFiles)) {
+        return { mode: "base", baseRef: scope.baseRef, resolvedBase: scope.resolvedBase, changedFiles: scope.changedFiles, ...(noChange ? { noChange: true } : {}) };
+    }
+    throw error("WORKTREE_NO_CHANGE_SCOPE_INVALID", "No-change review scope must list at least one safe supporting path.");
+}
+/** Persist a coordinator-issued no-change handoff before the worker is fenced. */
+export async function writeNoChangeDelivery(record, delivery) {
+    if (delivery.runId !== record.runId || delivery.workerId !== record.workerId || delivery.generation !== record.workerGeneration) {
+        throw error("WORKTREE_NO_CHANGE_OWNERSHIP", `No-change delivery does not match worktree ${record.name}.`);
+    }
+    await writePrivateFile(deliveryPath(record), `${JSON.stringify(delivery, null, 2)}\n`, record.path);
+}
 async function previous(record) {
     const source = await readPrivateFile(markerPath(record), record.path);
     if (source === null)
@@ -46,10 +156,12 @@ async function previous(record) {
     return value;
 }
 /** Integrate only this session's agent-owned branches; local proof is never promoted as final proof. */
-export async function integrateSessionChildren(deps, coordinator, parentTaskId) {
+export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds) {
     const statuses = await listWorktrees(deps, coordinator.mainRoot);
     const children = statuses.map(({ record }) => record)
-        .filter((record) => record.sessionId === coordinator.sessionId && record.agentId !== undefined)
+        .filter((record) => record.name !== coordinator.name && record.sessionId === coordinator.sessionId &&
+        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId)))
+        .filter(record => eligibleRunWorkerIds === undefined || (record.workerId !== undefined && eligibleRunWorkerIds.includes(record.workerId)))
         .sort((a, b) => a.name.localeCompare(b.name));
     const integrated = await previous(coordinator);
     if (children.length === 0)
@@ -74,9 +186,18 @@ export async function integrateSessionChildren(deps, coordinator, parentTaskId)
                 throw error("WORKTREE_CHILD_MOVED", `Child ${record.name} changed after delivery; keep its worktree and replan integration.`);
             continue;
         }
-        if ((await deps.git(record.path, ["merge-base", "--is-ancestor", record.base, head])).exitCode !== 0 ||
-            Number(await git(deps, record.path, ["rev-list", "--count", `${record.base}..${head}`])) === 0) {
+        const ahead = Number(await git(deps, record.path, ["rev-list", "--count", `${record.base}..${head}`]));
+        const noChange = ahead === 0;
+        const manifest = noChange ? await readNoChangeDelivery(record) : null;
+        if (noChange && manifest === null)
             throw error("WORKTREE_CHILD_EMPTY", `Child ${record.name} has no committed delivery.`);
+        if (coordinator.runId !== undefined &&
+            (record.runId !== coordinator.runId || record.workerId === undefined || record.ownerSessionId === undefined || record.workerGeneration === undefined ||
+                (coordinator.coordinatorId !== undefined && record.coordinatorId !== coordinator.coordinatorId))) {
+            throw error("WORKTREE_CHILD_RUN_OWNERSHIP", `Child ${record.name} is not explicitly registered to run ${coordinator.runId}.`);
+        }
+        if (manifest !== null && (manifest.runId !== coordinator.runId || manifest.workerId !== record.workerId || manifest.generation !== record.workerGeneration || manifest.sourceCommit !== head)) {
+            throw error("WORKTREE_NO_CHANGE_OWNERSHIP", `Child ${record.name} no-change manifest does not match its registered worker and source.`);
         }
         const childConfig = await deps.loadConfig(record.path);
         if (calculateConfigHash(childConfig) !== configHash) {
@@ -84,12 +205,18 @@ export async function integrateSessionChildren(deps, coordinator, parentTaskId)
         }
         const tasks = await deps.tasks(record.path).list();
         const roots = tasks.filter(({ task }) => task.parentTaskId === undefined);
-        if (roots.length !== 1 || tasks.some(({ status }) => status === "archived")) {
+        if (roots.length !== 1 || tasks.some(record => record.status === "archived" && record.supersededBy === undefined)) {
             throw error("WORKTREE_CHILD_TASK_INVALID", `Child ${record.name} must deliver one active task tree.`);
         }
-        const scope = await resolveReviewScope({ root: record.path, runner: runner(deps, record.path), base: record.base });
+        const suppliedScope = manifest === null ? undefined : parseNoChangeReviewScope(manifest.reviewScope);
+        const scope = manifest === null
+            ? await resolveReviewScope({ root: record.path, runner: runner(deps, record.path), base: record.base })
+            : await resolveReviewScope({ root: record.path, runner: runner(deps, record.path), base: head,
+                noChangePaths: suppliedScope.changedFiles });
         const fingerprint = await calculateSourceFingerprint(record.path, scope, runner(deps, record.path));
         for (const task of tasks) {
+            if (task.supersededBy !== undefined)
+                continue;
             if (task.task.intent === undefined || task.task.intent.trim() === "") {
                 throw error("WORKTREE_CHILD_INTENT_MISSING", `Child task ${task.task.id} needs its pre-work modification intent.`);
             }
@@ -101,17 +228,65 @@ export async function integrateSessionChildren(deps, coordinator, parentTaskId)
                 throw error("WORKTREE_CHILD_UNVERIFIED", `Child task ${task.task.id}: ${problem.remedy}`);
             }
         }
-        deliveries.push({ record, head, tasks });
+        deliveries.push({
+            record,
+            head,
+            tasks,
+            kind: noChange ? "no-change" : "changed",
+            sourceArtifacts: manifest?.artifactRefs ?? [],
+            reviewScope: manifest?.reviewScope ?? null,
+            deliveryDigest: manifest?.deliveryDigest ?? null,
+            contractDigest: manifest?.contractDigest ?? null,
+            runId: manifest?.runId ?? record.runId ?? null,
+            workerId: manifest?.workerId ?? record.workerId ?? null,
+            workerGeneration: manifest?.generation ?? record.workerGeneration ?? null
+        });
     }
     if (deliveries.length === 0)
         return integrated;
     const before = await git(deps, coordinator.path, ["rev-parse", "HEAD"]);
+    const expectedTarget = await git(deps, coordinator.mainRoot, ["rev-parse", "--verify", `${coordinator.targetBranch}^{commit}`]);
+    const priorJournal = await readJournal(coordinator);
+    if (priorJournal !== null && priorJournal.status !== "rolled-back" &&
+        priorJournal.expectedTarget !== expectedTarget && priorJournal.status !== "recorded") {
+        throw error("WORKTREE_INTEGRATION_TARGET_MOVED", "The integration target moved while a journal is pending; re-run final proof.");
+    }
+    let journal = priorJournal !== null && priorJournal.status !== "rolled-back"
+        ? priorJournal
+        : {
+            schemaVersion: 1,
+            transactionId: `integration-${randomUUID()}`,
+            expectedTarget,
+            coordinatorBefore: before,
+            status: "prepared",
+            steps: [],
+            updatedAt: new Date().toISOString()
+        };
+    await writeJournal(coordinator, journal);
     if ((await collectChangeSurface(runner(deps, coordinator.path))).paths.length > 0) {
         throw error("WORKTREE_DIRTY", "Commit the candidate worktree before integrating children.");
     }
     try {
         for (const delivery of deliveries) {
-            if ((await deps.git(coordinator.path, ["merge-base", "--is-ancestor", delivery.head, "HEAD"])).exitCode !== 0) {
+            const priorStep = journal.steps.find((step) => step.name === delivery.record.name);
+            if (priorStep !== undefined && priorStep.commit !== delivery.head)
+                throw error("WORKTREE_CHILD_MOVED", `Child ${delivery.record.name} changed after its journaled delivery.`);
+            if (priorStep?.status === "recorded")
+                continue;
+            const step = {
+                name: delivery.record.name,
+                commit: delivery.head,
+                kind: delivery.kind,
+                status: "prepared",
+                taskIds: delivery.tasks.map(({ task }) => task.id),
+                sourceArtifacts: delivery.sourceArtifacts,
+                reviewScope: delivery.reviewScope,
+                deliveryDigest: delivery.deliveryDigest,
+                contractDigest: delivery.contractDigest
+            };
+            journal = { ...journal, status: "merging", steps: [...journal.steps.filter((candidate) => candidate.name !== delivery.record.name), step], updatedAt: new Date().toISOString() };
+            await writeJournal(coordinator, journal);
+            if (delivery.kind === "changed" && (await deps.git(coordinator.path, ["merge-base", "--is-ancestor", delivery.head, "HEAD"])).exitCode !== 0) {
                 const merge = await deps.git(coordinator.path, ["merge", "--no-ff", "--no-edit", delivery.head]);
                 if (merge.exitCode !== 0) {
                     const files = (await deps.git(coordinator.path, ["diff", "--name-only", "--diff-filter=U"])).stdout.trim();
@@ -122,10 +297,48 @@ export async function integrateSessionChildren(deps, coordinator, parentTaskId)
             if (await git(deps, delivery.record.path, ["rev-parse", "HEAD"]) !== delivery.head) {
                 throw error("WORKTREE_CHILD_MOVED", `Child ${delivery.record.name} moved during integration.`);
             }
+            journal = {
+                ...journal,
+                status: "merging",
+                steps: journal.steps.map((candidate) => candidate.name === delivery.record.name ? { ...candidate, status: "merged" } : candidate),
+                updatedAt: new Date().toISOString()
+            };
+            await writeJournal(coordinator, journal);
         }
+        journal = { ...journal, status: "importing", updatedAt: new Date().toISOString() };
+        await writeJournal(coordinator, journal);
+        for (const delivery of deliveries)
+            await copyDeliveryHistory(delivery.record, coordinator, delivery.tasks);
         await deps.tasks(coordinator.path).importDelivery(parentTaskId, deliveries.flatMap(({ tasks }) => tasks));
-        const next = [...integrated, ...deliveries.map(({ record, head, tasks }) => ({
-                name: record.name, commit: head, taskIds: tasks.map(({ task }) => task.id)
+        for (const delivery of deliveries) {
+            if (delivery.sourceArtifacts.length > 0) {
+                const manifest = await readPrivateFile(deliveryPath(delivery.record), delivery.record.path);
+                if (manifest !== null) {
+                    await mkdir(join(coordinator.path, ".agent-ops", "tasks", "deliveries"), { recursive: true });
+                    await writePrivateFile(deliveryArchivePath(coordinator, delivery.record), manifest, coordinator.path);
+                }
+            }
+        }
+        journal = { ...journal, status: "recorded", steps: journal.steps.map((step) => ({ ...step, status: "recorded" })), updatedAt: new Date().toISOString() };
+        await writeJournal(coordinator, journal);
+        const next = [...integrated, ...deliveries.map(({ record, head, tasks, kind, sourceArtifacts, reviewScope, deliveryDigest, contractDigest, runId, workerId, workerGeneration }) => ({
+                name: record.name,
+                commit: head,
+                taskIds: tasks.map(({ task }) => task.id),
+                ...(kind === "no-change" ? {
+                    deliveryKind: kind,
+                    ...(sourceArtifacts.length === 0 ? {} : { sourceArtifacts }),
+                    ...(reviewScope === null ? {} : { reviewScope }),
+                    ...(deliveryDigest === null ? {} : { deliveryDigest }),
+                    ...(contractDigest === null ? {} : { contractDigest }),
+                    ...(runId === null ? {} : { runId }),
+                    ...(workerId === null ? {} : { workerId }),
+                    ...(workerGeneration === null ? {} : { workerGeneration })
+                } : {
+                    ...(runId === null ? {} : { runId }),
+                    ...(workerId === null ? {} : { workerId }),
+                    ...(workerGeneration === null ? {} : { workerGeneration })
+                })
             }))];
         await writePrivateFile(markerPath(coordinator), `${JSON.stringify(next, null, 2)}\n`, coordinator.path);
         return next;
@@ -133,6 +346,71 @@ export async function integrateSessionChildren(deps, coordinator, parentTaskId)
     catch (failure) {
         await deps.git(coordinator.path, ["merge", "--abort"]);
         await deps.git(coordinator.path, ["reset", "--hard", before]);
+        await writeJournal(coordinator, { ...journal, status: "rolled-back", updatedAt: new Date().toISOString() });
         throw failure;
     }
 }
+/** Preserve immutable local proof for historical review; import never promotes it to final proof. */
+async function copyDeliveryHistory(child, coordinator, tasks) {
+    const source = new FileEvidenceStore(child.path, child.path);
+    const target = new FileEvidenceStore(coordinator.path, coordinator.path);
+    const references = new Set(tasks.flatMap(record => [record.evidence,
+        ...(record.revisions ?? []).map(revision => revision.previousEvidence)].flatMap(evidence => Object.values(evidence).flat())));
+    for (const reference of references) {
+        if (reference.startsWith("review:"))
+            continue;
+        const checked = validateEvidence(await source.load(reference));
+        if (!checked.ok || !tasks.some(record => record.task.id === checked.value.taskId))
+            throw error("WORKTREE_CHILD_HISTORY_INVALID", "Historical evidence must resolve to the delivered task tree.");
+        const saved = await target.save(checked.value);
+        if (saved !== reference)
+            throw error("WORKTREE_CHILD_HISTORY_INVALID", "Historical evidence has a noncanonical identity.");
+        const artifact = checked.value.acceptance?.executionArtifact;
+        if (artifact === undefined)
+            continue;
+        const content = await readPrivateFile(join(child.path, artifact), child.path);
+        if (content === null || Buffer.byteLength(content) > 4 * 1024 * 1024 ||
+            artifact !== ".agent-ops/tasks/acceptance/" + sha256(content) + ".json")
+            throw error("WORKTREE_CHILD_HISTORY_INVALID", "Acceptance execution history is missing or changed.");
+        const destination = join(coordinator.path, artifact);
+        const existing = await readPrivateFile(destination, coordinator.path);
+        if (existing !== null && existing !== content)
+            throw error("WORKTREE_CHILD_HISTORY_INVALID", "Acceptance artifact collision.");
+        if (existing === null)
+            await writePrivateFile(destination, content, coordinator.path);
+    }
+    const directory = join(child.path, REVIEW_ATTESTATION_DIRECTORY);
+    let names;
+    try {
+        names = await readdir(directory);
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT")
+            throw cause;
+        names = [];
+    }
+    for (const name of names.filter(name => /^[a-f0-9]{64}\.[a-z][a-z0-9-]{0,127}\.reports\.json$/u.test(name))) {
+        const content = await readPrivateFile(join(directory, name), child.path);
+        if (content === null || Buffer.byteLength(content) > 512 * 1024)
+            continue;
+        let value;
+        try {
+            value = JSON.parse(content);
+        }
+        catch {
+            continue;
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            continue;
+        const artifact = value;
+        if (artifact.status !== "FAIL" || !tasks.some(task => task.task.id === artifact.taskId) ||
+            name !== artifact.sourceFingerprint + "." + artifact.taskId + ".reports.json")
+            continue;
+        const destination = join(coordinator.path, REVIEW_ATTESTATION_DIRECTORY, name);
+        const existing = await readPrivateFile(destination, coordinator.path);
+        if (existing !== null && existing !== content)
+            throw error("WORKTREE_CHILD_HISTORY_INVALID", "Failed review history collision.");
+        if (existing === null)
+            await writePrivateFile(destination, content, coordinator.path);
+    }
+}