@kylecheng3146/agent-ops 0.9.0 → 0.10.2

package/dist/packages/cli/src/commands/task.js

@@ -30,6 +30,35 @@ async function jsonFile(path) {
         throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Invalid JSON payload.");
     }
 }
+async function escapeOrigin(args, service) {
+    return args.escapeOf === undefined ? undefined : await service.resolveOrigin({ kind: "escape-of", commit: args.escapeOf,
+        label: args.escapeLabel, ...(args.escapeReceipt === undefined ? {} : { receipt: args.escapeReceipt }),
+        ...(args.escapeFix === undefined ? {} : { fix: args.escapeFix }), ...(args.escapePromote === undefined ? {} : { promote: args.escapePromote }) });
+}
+/** Link state, label and blame hints are printed; the ledger record is committed with the fix. */
+async function withEscape(envelope, escape, service) {
+    if (escape === undefined || envelope.data === null)
+        return envelope;
+    const { link, label, agentLabel, facts, proof } = escape.record;
+    const proposal = proof?.status === "check" && proof.check !== null ? await service.escapeConfigProposal(proof.check) : undefined;
+    const lines = [
+        `Escape of ${escape.record.escapeOf}: ${link.state}${link.state === "unresolved" ? ` (${link.reason})` : ""}` +
+            `${link.state === "gated" ? ` via receipt ${link.receipt} (${link.matchedBy})` : ""}; label ${label}${label === agentLabel ? "" : ` (agent proposed ${agentLabel})`}.`,
+        ...facts.map(fact => `- ${fact.path}: ${fact.surface}`),
+        ...(proof === undefined ? [] : [proof.status === "proven"
+                ? `Proof: rule ${proof.rule} replays at the escaped commit; backtest ${proof.backtest.fires}/${proof.backtest.commits} commits (${proof.backtest.rate}).`
+                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Finish refuses this until a tracked rule proves it.`
+                    : proof.status === "lesson" ? `Lesson (unproven, does not block): ${proof.reason}`
+                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN - name the red-to-green check with --escape-promote <runnerId:checkId>."
+                            : `Proof: promoted check ${proof.check} must be a proven redCheckId of this task. Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
+        `Ledger record: ${escape.path} (commit it with the fix).`,
+        escape.blame.length === 0 ? "Blame hints: none (the fix only adds lines; an omission has no author)."
+            : `Blame hints (a hint only): ${escape.blame.map(hint => `${hint.commit.slice(0, 12)} (${hint.lines} line${hint.lines === 1 ? "" : "s"})`).join(", ")}`
+    ];
+    return { ...envelope, data: { ...envelope.data, escape: { ...escape.record, blame: escape.blame, path: escape.path,
+                ...(proposal === undefined ? {} : { configProposal: proposal }) },
+            text: `${envelope.data.text ?? ""}${envelope.data.text?.endsWith("\n") === false ? "\n" : ""}${lines.join("\n")}\n` } };
+}
 /** An unreadable surface file is a missing surface, not a generic payload error. */
 async function surfaceFile(path) {
     try {
@@ -105,6 +134,7 @@ export async function runTaskCommand(options) {
             const worktree = sessionId === undefined || options.sessionWorktree === undefined
                 ? undefined
                 : await options.sessionWorktree(sessionId);
+            const origin = await escapeOrigin(options.args, worktree?.service ?? options.service);
             const record = await (worktree?.service ?? options.service).create({
                 title: options.args.title,
                 ...(options.args.goal === undefined ? {} : { goal: options.args.goal }),
@@ -122,19 +152,21 @@ export async function runTaskCommand(options) {
                     : { parentTaskId: options.args.parentTaskId }),
                 ...(sessionId === undefined ? {} : { sessionId }),
                 ...(options.args.surfaceFile === undefined ? {} : { surface: await surfaceFile(options.args.surfaceFile) }),
+                ...(origin === undefined ? {} : { origin }),
                 requireSurface: true
             });
+            const escape = origin === undefined ? undefined : await (worktree?.service ?? options.service).declareEscape(record.task.id);
             // An explicit CLI DEBUG intake may be the only start signal on hosts
             // without a prompt hook (notably agy). The native session owns the clock;
             // foregroundStart is idempotent for a repeated hook or command.
             if (options.args.debug && sessionId !== undefined) {
                 await (worktree?.service ?? options.service).debugService().foregroundStart(record.task.id, sessionId);
             }
-            const created = taskEnvelope(action, "TASK_CREATED", sessionId === undefined
+            const created = await withEscape(taskEnvelope(action, "TASK_CREATED", sessionId === undefined
                 ? `Created task ${record.task.id}.`
                 : record.task.parentTaskId === undefined
                     ? `Created and attached task ${record.task.id}.`
-                    : `Created subtask ${record.task.id}; the session stays on the top of its task tree.`, record);
+                    : `Created subtask ${record.task.id}; the session stays on the top of its task tree.`, record), escape, worktree?.service ?? options.service);
             if (worktree === undefined || created.data === null)
                 return created;
             return {
@@ -157,6 +189,10 @@ export async function runTaskCommand(options) {
         }
         if (action === "debug") {
             const id = requireTaskId(options.args), service = options.service.debugService();
+            if (options.args.debugAction === "origin") {
+                const declared = await service.origin(id, await jsonFile(options.args.payloadFile));
+                return await withEscape(taskEnvelope(action, "TASK_DEBUG_ORIGIN_DECLARED", "Origin bound into the contract; re-verify, re-record the confirmed hypothesis, then review.", declared.record), declared.escape, options.service);
+            }
             switch (options.args.debugAction) {
                 case "hypothesis":
                     await service.hypothesis(id, await jsonFile(options.args.payloadFile));
@@ -191,13 +227,15 @@ export async function runTaskCommand(options) {
             const payload = options.args.criteriaFile === undefined ? undefined : await jsonFile(options.args.criteriaFile);
             if (payload !== undefined && !Array.isArray(payload))
                 throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Criteria file must contain an array.");
+            const origin = await escapeOrigin(options.args, options.service);
             const record = await options.service.revise(requireTaskId(options.args), {
                 expectedContractHash: options.args.expectedContract,
                 ...(payload === undefined ? {} : { criteria: payload }),
                 ...(options.args.surfaceFile === undefined ? {} : { surface: await surfaceFile(options.args.surfaceFile) }),
+                ...(origin === undefined ? {} : { origin }),
                 reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
             });
-            return taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record);
+            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
         }
         if (action === "replan") {
             const payload = await jsonFile(options.args.planFile);

package/dist/packages/cli/src/commands/update.js

@@ -8,6 +8,11 @@ import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
 import { toPublicUpdatePlan } from "../public-plan.js";
 import { formatTrustChange, planTrustGrant } from "./trust.js";
+/** One plan line, so the user approves the worktrees together with the commands. */
+export function worktreeSyncLine(worktrees) {
+    return worktrees.length === 0 ? "" :
+        `Session worktrees that receive this config and its trust: ${worktrees.join(", ")}\n`;
+}
 function repairedLines(plan) {
     return plan.installation.repaired.map(({ path, reason }) => `repaired: ${path} (${reason.replace("-", " ")})`);
 }
@@ -146,19 +151,21 @@ export async function runUpdateCommand(options) {
         ...(worktree === undefined ? {} : { worktree })
     });
     const trust = await trustChange(options, plan);
+    const worktrees = await options.sessionWorktrees?.list().catch(() => []) ?? [];
     if (options.args.dryRun) {
         return okEnvelope("UPDATE_PLAN_READY", {
             applied: false,
             plan: toPublicUpdatePlan(plan, trust),
             message: "Update plan calculated; no files were changed.",
-            text: formatUpdatePlan(plan, trust)
+            text: formatUpdatePlan(plan, trust) + worktreeSyncLine(worktrees),
+            ...(worktrees.length === 0 ? {} : { worktrees })
         });
     }
     if (!options.args.yes && !options.isTTY) {
         return updateError("UPDATE_CONFIRMATION_REQUIRED", "Non-interactive update requires --yes.", plan, trust);
     }
     if (!options.args.yes &&
-        !(await options.confirm(plan, trust))) {
+        !(await options.confirm(plan, trust, worktrees))) {
         return updateError("UPDATE_CANCELLED", "Update was cancelled; no files were changed.", plan, trust);
     }
     await applyUpdatePlan(options.root, plan);
@@ -173,16 +180,21 @@ export async function runUpdateCommand(options) {
             return updateError("UPDATE_TRUST_FAILED", "Update was applied, but repository trust was not granted. Run `agent-ops trust grant --yes`.", plan, trust, true);
         }
     }
+    // Fail-open: a worktree that cannot be synced keeps its old trust and says so via trust status.
+    const synced = worktrees.length === 0 ? [] : await options.sessionWorktrees?.sync().catch(() => []) ?? [];
+    const syncedLines = synced.length === 0 ? [] : [`Synced config and trust into session worktrees: ${synced.join(", ")}.`];
     return okEnvelope("UPDATE_APPLIED", {
         applied: true,
         plan: toPublicUpdatePlan(plan, trust),
         message: `Managed installation updated to ${plan.targetVersion}.`,
-        ...(plan.installation.repaired.length === 0
+        ...(synced.length === 0 ? {} : { worktrees: synced }),
+        ...(plan.installation.repaired.length === 0 && synced.length === 0
             ? {}
             : {
                 text: [
                     `Managed installation updated to ${plan.targetVersion}.`,
-                    ...repairedLines(plan)
+                    ...repairedLines(plan),
+                    ...syncedLines
                 ].join("\n")
             })
     });

package/dist/packages/cli/src/commands/verify.js

@@ -72,7 +72,10 @@ function formatReport(report) {
     const lines = [
         `Verification task ${safe(report.taskId)}: ${report.status}`,
         `Scope: ${report.selection.reason} (${report.selection.fallback ? "fallback" : "bounded"})`,
-        ...report.results.flatMap(formatResult)
+        ...report.results.flatMap(formatResult),
+        // A timed-out runner step says which step and which limit; plain UNKNOWN left people guessing.
+        ...(report.acceptance ?? []).flatMap(row => row.detail === undefined ? [] :
+            [`- ${row.status} ${safe(row.runnerId)} (${row.criterionId}, ${row.phase}): ${safe(row.detail)}`])
     ];
     if (report.signal !== null) {
         lines.push(`Signal: ${report.signal}`);

package/dist/packages/cli/src/context.js

@@ -9,7 +9,8 @@ import { mergeConfigLayers } from "../../../runtime/src/config/merge.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { localStatePaths, readPrivateFile } from "../../../runtime/src/security/permissions.js";
 import { FileRunRepository } from "../../../runtime/src/run/service.js";
-import { readRunPolicy, runRuntimeHash } from "../../../runtime/src/run/policy.js";
+import { readRunPolicy, renewRunPolicy, runRuntimeHash } from "../../../runtime/src/run/policy.js";
+import { CLI_VERSION } from "./version.js";
 import { calculateTrustBinding, FileTrustStore } from "../../../runtime/src/security/trust.js";
 export const DEFAULT_CONFIG = {
     schemaVersion: 3,
@@ -83,6 +84,10 @@ export async function loadEffectiveConfig(root, scope, projectOverride) {
                     config: run.policy.config
                 }]);
     }
+    return await loadRepositoryConfig(root, scope, projectOverride);
+}
+/** Read the real config layers when checking renewal, without consulting the run overlay. */
+async function loadRepositoryConfig(root, scope, projectOverride) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
     const projectPath = join(scope === "user" ? root : projectConfigRoot(root), ".agent-ops", "config.json");
@@ -212,7 +217,7 @@ export async function repositoryTrust(root, config, cliVersion) {
     }
 }
 /** A run-private capability is usable only by its registered checkout or proof group. */
-export async function runPolicyContext(root) {
+export async function runPolicyContext(root, renew = false) {
     let common;
     try {
         common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim();
@@ -250,10 +255,23 @@ export async function runPolicyContext(root) {
         throw new AgentOpsError("RUN_WORKER_STALE", "Run policy requires the current registered worker generation or proof process.");
     if (saved.status !== "active" || saved.disableRestart || saved.awaitingResume)
         throw new AgentOpsError("RUN_POLICY_DISABLED", "Run execution policy is inactive; explicit resume is required.");
-    const policy = await readRunPolicy(saved, await runRuntimeHash());
+    const state = renew ? await ensureRunPolicy(repository, saved) : saved;
+    const policy = await readRunPolicy(state, await runRuntimeHash());
     if (policy === null)
         return null;
-    return { repository, state: saved, policy, worker };
+    return { repository, state, policy, worker };
+}
+/** Only active execution paths call this; status, installation and recovery reads never renew. */
+export async function ensureRunPolicy(repository, state) {
+    if (state.policyBinding === undefined || Date.parse(state.policyBinding.expiresAt) > Date.now())
+        return state;
+    return await renewRunPolicy(repository, state.runId, { authority: async () => {
+            const config = (await loadRepositoryConfig(state.root, "project")).config;
+            const baseTrustBinding = await repositoryTrustBinding(state.root, config, CLI_VERSION);
+            const paths = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+            const trusted = (await new FileTrustStore(paths.trustStore, paths.anchorDirectory).status(baseTrustBinding)).status === "TRUSTED";
+            return { config, baseTrustBinding, trusted, runtimeHash: await runRuntimeHash() };
+        } });
 }
 export async function repositoryTrustBinding(root, config, cliVersion) {
     return await calculateTrustBinding({

package/dist/packages/cli/src/debug-intake.js

@@ -171,7 +171,7 @@ export async function routeDebugPrompt(root, input, host = "claude") {
     }
     else
         clockNote = " Native foreground timing is unsupported on this host; controlled operations remain evidence-timed and do not claim a complete active-time budget.";
-    return `DEBUG issue ${created.task.id} created in ${path}. Preserve the original goal. Investigate, record falsifiable hypotheses, revise provisional criteria to relevant behavioral regression, add the surface audit (task revise --surface-file) before the first repair, repair, verify, obtain two fresh independent reviews, then finish. A clean HEAD baseline is fixed automatically; do not ask permission for it or offer diagnosis-only as a fallback. Failure to reproduce alone is not a stop condition: continue discriminating checks within the budget. Defaults: 60 active minutes / 5 material repair candidates. No user-authored debug plan is required.${clockNote}`;
+    return `DEBUG issue ${created.task.id} created in ${path}. Preserve the original goal. Investigate, record falsifiable hypotheses, revise provisional criteria to relevant behavioral regression, add the surface audit (task revise --surface-file) before the first repair, repair, declare the origin (task debug --debug-action origin) once a hypothesis is confirmed, verify, obtain two fresh independent reviews, then finish. A clean HEAD baseline is fixed automatically; do not ask permission for it or offer diagnosis-only as a fallback. Failure to reproduce alone is not a stop condition: continue discriminating checks within the budget. Defaults: 60 active minutes / 5 material repair candidates. No user-authored debug plan is required.${clockNote}`;
 }
 export async function interruptDebugSession(root, sessionId, nativeInput) {
     const saved = await readWorktreeRecord(join(root, ".worktrees", sessionWorktreeName(sessionId)));

package/dist/packages/cli/src/office-entry.js

@@ -5,7 +5,7 @@ import { rm } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 import { collectOfficeBuilding } from "../../../runtime/src/office/collect.js";
-import { claimOffice, createOfficeServer, ensureOffice, legacyOfficeHome, officeRecordPath, readLiveOffice, officeUrl, releaseOffice, userOfficeHome } from "../../../runtime/src/office/server.js";
+import { claimOffice, createOfficeServer, ensureOffice, legacyOfficeHome, officeRecordPath, readLiveOffice, readOfficeRecord, officeUrl, userOfficeHome } from "../../../runtime/src/office/server.js";
 import { registerOfficeRepo } from "../../../runtime/src/office/repos.js";
 import { recordOfficeSession, recordOfficeSessionPhase } from "../../../runtime/src/office/sessions.js";
 import { resolveCheckouts } from "../../../runtime/src/parallel/service.js";
@@ -254,7 +254,6 @@ export async function serveOffice(cwd, onUrl = () => { }, openBrowser) {
     }, 15_000);
     await idle;
     clearInterval(timer);
-    await releaseOffice(home, record);
     await office.close();
 }
 /** Reuse the user's live server or start one under launchd; null where launchd is unavailable. */
@@ -267,10 +266,13 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
     const live = await readLiveOffice(home);
     if (live !== null)
         return officeUrl(live);
+    let previousUrl = null;
     let started = false;
     const args = [entry, mainRoot];
     if (!launchd.supported) {
         const url = await ensureOffice(home, async () => {
+            const previous = await readOfficeRecord(home);
+            previousUrl = previous === null ? null : officeUrl(previous);
             started = true;
             await new Promise((resolve, reject) => {
                 const child = spawn(process.execPath, args, { cwd: mainRoot, detached: true, stdio: "ignore", windowsHide: true });
@@ -278,7 +280,7 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
                 child.once("spawn", () => { child.unref(); resolve(); });
             });
         });
-        if (started && openBrowser !== undefined)
+        if (started && url !== previousUrl && openBrowser !== undefined)
             void openBrowser(url).catch(() => undefined);
         return url;
     }
@@ -289,6 +291,8 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
         cwd: mainRoot, pathEnvironment: process.env.PATH
     });
     const url = await ensureOffice(home, async () => {
+        const previous = await readOfficeRecord(home);
+        previousUrl = previous === null ? null : officeUrl(previous);
         started = true;
         // The descriptor write anchors on this directory, so it must exist first.
         await ensurePrivateDirectory(privateDirectory, home.anchor);
@@ -297,7 +301,7 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
         await launchd.bootout(descriptor).catch(() => { });
         await launchd.bootstrap(descriptor);
     });
-    if (started && openBrowser !== undefined)
+    if (started && url !== previousUrl && openBrowser !== undefined)
         void openBrowser(url).catch(() => undefined);
     return url;
 }

package/dist/packages/cli/src/owned-run-step.js

@@ -4,13 +4,13 @@ import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { nativeProcessIdentity, NativeRunTransport } from "../../../runtime/src/run/transport.js";
 import { ClaudeGoalHost } from "../../../runtime/src/run/hosts/claude.js";
 import { CodexGoalHost } from "../../../runtime/src/run/hosts/codex.js";
-import { activeWallTimeMs } from "../../../runtime/src/run/scheduler.js";
+import { remainingRunTimeMs } from "../../../runtime/src/run/scheduler.js";
 import { runPolicyContext } from "./context.js";
 /** Native-issued proof commands use the same dormant group as final evidence. */
 export async function runOwnedLocalProof(argv) {
     if (!["verify", "review", "batch"].includes(argv[0] ?? "") || argv.includes("--help") || process.env.AGENT_OPS_RUN_PROOF_PID !== undefined)
         return null;
-    const context = await runPolicyContext(process.cwd());
+    const context = await runPolicyContext(process.cwd(), true);
     if (context === null)
         return null;
     const { repository, state, worker } = context;
@@ -22,7 +22,7 @@ export async function runOwnedLocalProof(argv) {
         if (existing.processAlive)
             throw new AgentOpsError("RUN_WORKER_PROOF_ACTIVE", "A registered proof command is already running for this worker.");
     }
-    const remaining = state.budget.limitMs - activeWallTimeMs(state.budget.activeIntervals, Date.now());
+    const remaining = remainingRunTimeMs(state);
     if (remaining <= 0)
         throw new AgentOpsError("RUN_BUDGET_EXHAUSTED", "No active run time remains for local proof.");
     const cli = fileURLToPath(new URL("./bin.js", import.meta.url));
@@ -34,7 +34,7 @@ export async function runOwnedLocalProof(argv) {
             process.kill(process.platform === "win32" ? child.pid : -child.pid, "SIGKILL");
         }
         catch { } };
-    const deadline = setTimeout(kill, remaining);
+    const deadline = Number.isFinite(remaining) ? setTimeout(kill, remaining) : undefined;
     try {
         const identity = child.pid === undefined ? null : await nativeProcessIdentity(child.pid);
         if (identity === null)

package/dist/packages/cli/src/parallel-deps.js

@@ -9,7 +9,6 @@ import { FileTrustStore } from "../../../runtime/src/security/trust.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
-import { registeredRunProofRunner } from "../../../runtime/src/verify/spawn.js";
 import { loadEffectiveConfig, repositoryTrust, runPolicyContext, repositoryTrustBinding } from "./context.js";
 import { CLI_VERSION } from "./version.js";
 // Shared by the CLI and the hook entry point: Claude Code runs hooks through
@@ -84,7 +83,6 @@ export function worktreeDependencies() {
                 ...(noChangePaths === undefined ? {} : { noChangePaths }),
                 loadConfig: async () => (await loadEffectiveConfig(root, "project")).config
             } }),
-        processRunner: registeredRunProofRunner(),
         runSetup: async (cwd, step) => await new Promise((resolve) => {
             execFile(step.command, [...step.args], {
                 cwd,

package/dist/packages/cli/src/run-deps.js

@@ -18,9 +18,9 @@ import { NativeRunTransport } from "../../../runtime/src/run/transport.js";
 import { ClaudeGoalHost } from "../../../runtime/src/run/hosts/claude.js";
 import { CodexGoalHost } from "../../../runtime/src/run/hosts/codex.js";
 import { RunSupervisor } from "../../../runtime/src/run/supervisor.js";
-import { activeWallTimeMs } from "../../../runtime/src/run/scheduler.js";
+import { activeWallTimeMs, remainingRunTimeMs } from "../../../runtime/src/run/scheduler.js";
 import { bindRunPolicy, readRunPolicy, runRuntimeHash, runPolicyAssessment } from "../../../runtime/src/run/policy.js";
-import { repositoryTrustBinding } from "./context.js";
+import { repositoryTrustBinding, ensureRunPolicy } from "./context.js";
 import { CLI_VERSION } from "./version.js";
 import { calculateConfigHash, canonicalJson } from "../../../runtime/src/config/hash.js";
 import { discoverPendingPolicyTransition, renewBoundPolicyTransition, currentPolicyArtifact } from "../../../runtime/src/run/policy-transition.js";
@@ -30,6 +30,7 @@ import { RunControlService } from "../../../runtime/src/run/controls.js";
 import { recordRunPhase } from "../../../runtime/src/run/phase.js";
 /** Worktree construction happens before a native lease exists; it must never write global trust. */
 export async function runWorktreeDependencies(deps, state) {
+    state = await ensureRunPolicy(new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir), state);
     const policy = await readRunPolicy(state, await runRuntimeHash());
     if (policy === null || (await trustStore().status(policy.baseTrustBinding)).status !== "TRUSTED")
         throw new AgentOpsError("RUN_REPO_UNTRUSTED", "Run worktree setup requires the original trusted repository and current scoped policy.");
@@ -40,7 +41,9 @@ export async function runWorktreeDependencies(deps, state) {
             if (index < 0)
                 throw new AgentOpsError("RUN_SETUP_UNAUTHORIZED", "Setup must select an exact fixed policy capability.");
             const repository = new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir);
-            const current = (await repository.read(state.runId));
+            const current = await ensureRunPolicy(repository, (await repository.read(state.runId)));
+            if (current.policyBinding?.configHash !== state.policyBinding.configHash)
+                throw new AgentOpsError("RUN_SETUP_STALE", "Policy capability changed after setup was selected.");
             const coordinator = current.workers.find(w => w.workerId === current.coordinatorId);
             const command = canonicalJson(step), resource = canonicalJson({ checkout: root, capabilityId: "setup:" + index });
             const approved = await runPolicyAssessment(current, policy, "setup:" + index);
@@ -49,11 +52,11 @@ export async function runWorktreeDependencies(deps, state) {
                 command, resource, commandDigest: sha256(command), resourceDigest: sha256(resource), reason: approved?.reason ?? "The original user trust authorizes this fixed repository setup capability in an isolated checkout.",
                 result: "auto-approved", source: approved === null ? "repo-trust" : "coordinator-policy-review", policyArtifactDigest: current.policyBinding.artifactDigest,
                 policyConfigHash: current.policyBinding.configHash, runtimeHash: current.policyBinding.runtimeHash, expiresAt: current.policyBinding.expiresAt });
-            const remaining = current.budget.limitMs - activeWallTimeMs(current.budget.activeIntervals, Date.now());
+            const remaining = remainingRunTimeMs(current);
             if (remaining <= 0)
                 throw new AgentOpsError("RUN_BUDGET_EXHAUSTED", "No active time remains for setup.");
             const child = spawn(process.execPath, [fileURLToPath(new URL("./run-step-entry.js", import.meta.url)),
-                fileURLToPath(new URL("./run-setup-entry.js", import.meta.url)), state.commonDir, state.runId, root, String(index), state.policyBinding.artifactDigest], { cwd: root, env: process.env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] });
+                fileURLToPath(new URL("./run-setup-entry.js", import.meta.url)), state.commonDir, state.runId, root, String(index), current.policyBinding.artifactDigest], { cwd: root, env: process.env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] });
             let output = "";
             const completion = new Promise((resolve, reject) => { child.once("error", reject); child.once("close", resolve); });
             const kill = () => { if (child.pid !== undefined)
@@ -70,7 +73,7 @@ export async function runWorktreeDependencies(deps, state) {
                 if (identity === null)
                     throw new AgentOpsError("RUN_PROCESS_IDENTITY_REQUIRED", "Cannot register setup process identity.");
                 await repository.mutate(state.runId, saved => {
-                    if (saved.status !== "active" || saved.disableRestart || saved.proofProcess != null || saved.policyBinding?.artifactDigest !== state.policyBinding.artifactDigest)
+                    if (saved.status !== "active" || saved.disableRestart || saved.proofProcess != null || saved.policyBinding?.artifactDigest !== current.policyBinding.artifactDigest)
                         throw new AgentOpsError("RUN_SETUP_STALE", "Stop or another proof process raced setup registration.");
                     return { ...saved, proofProcess: { processId: child.pid, processIdentity: identity } };
                 });
@@ -206,7 +209,7 @@ export async function productionRunContext(cwd, options = {}) {
             throw cause;
         }
     };
-    const resume = async (runId) => {
+    const resume = async (runId, retryApprovalIds = [], upgradeBudget = true) => {
         const before = await service.status(runId);
         const runtimeHash = await runRuntimeHash();
         const policy = await readRunPolicy(before, before.policyBinding?.runtimeHash ?? runtimeHash, Date.now(), true);
@@ -233,7 +236,7 @@ export async function productionRunContext(cwd, options = {}) {
                 if (exists === null || (await collectChangeSurface(gitRunner(worker.worktree))).paths.length > 0)
                     throw new AgentOpsError("RUN_RECOVERY_DIRTY", "Commit or preserve every writer checkout before explicit resume.");
             }
-        const result = await service.resume(runId);
+        const result = await service.resume(runId, retryApprovalIds, upgradeBudget);
         try {
             if (pending !== null)
                 await renewPendingRunPolicy(repository, runId, pending);
@@ -308,7 +311,7 @@ export async function productionRunContext(cwd, options = {}) {
         await writePrivateFile(join(state.commonDir, "agent-ops", "runs", state.runId, "answers", sha256(questionId) + ".json"), JSON.stringify({ questionId, answer: answer.trim() }), state.commonDir);
         const result = await service.respond(runId, questionId, answer);
         try {
-            const resumed = await resume(runId);
+            const resumed = await resume(runId, [], false);
             return { ...result, state: resumed.state };
         }
         catch (cause) {