@lazyingart/agintiflow 0.20.266 → 0.20.268

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.266",
+  "version": "0.20.268",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-dynamic-step-budget.js

@@ -5306,6 +5306,159 @@ try {
       postMutationVerificationRuntime.testVerificationCommand === postMutationVerifier,
     "a material failed-test repair did not advance directly to its exact retained verifier"
   );
+  const generatedDeckValidator =
+    "python3 /tmp/presentation_deck_contract.py --root .";
+  const staleGeneratedDeckState = {
+    goal: [
+      "Rebuild the canonical presentation output after repairing build_deck.py.",
+      "Do not modify source_brief.md, measurements.csv,",
+      "prompt.txt, or TASK.md.",
+      `Run ${generatedDeckValidator} only after the generated deck is fresh.`,
+    ].join("\n"),
+    meta: {
+      taskProfile: "slides",
+      goalContract: {
+        revision: 13,
+        currentRequest: "Rebuild the canonical presentation output from build_deck.py.",
+      },
+      activeExecutionContract: {
+        revision: 13,
+        startedMutationRevision: 8,
+        materialMutationRevision: 9,
+        requiresFileMutation: true,
+        requiresSourceGrounding: true,
+      },
+      projectVerification: {
+        mutationRevision: 9,
+        mutationHistory: [
+          { revision: 8, toolName: "run_command", paths: [] },
+          { revision: 9, toolName: "apply_patch", paths: ["build_deck.py"] },
+        ],
+        commandRuns: [{
+          command:
+            'rm -rf dist && echo "removed dist" && python3 build_deck.py && ls -la output',
+          at: "2026-08-27T18:18:14.726Z",
+          ok: true,
+          mutationRevision: 8,
+          privateMutationRevision: 0,
+        }],
+        testRuns: [{
+          command: generatedDeckValidator,
+          at: "2026-08-27T18:24:28.347Z",
+          mutationRevision: 9,
+          privateMutationRevision: 0,
+          passed: false,
+          failureEvidenceVersion: 2,
+          failureSignature: "stale-generated-deck",
+          failureSummary: "acceptance failed: deck omits source-grounded phrase: single reader",
+        }],
+      },
+    },
+  };
+  const staleGeneratedDeckRuntime = nextStepRuntimeConfig(
+    {
+      provider: "deepseek",
+      taskProfile: "slides",
+      commandCwd: workspace,
+      goal: staleGeneratedDeckState.goal,
+    },
+    staleGeneratedDeckState
+  );
+  const staleGeneratedDeckPhase = buildKnownConstrainedPhasePlan(
+    {
+      provider: "deepseek",
+      taskProfile: "slides",
+      commandCwd: workspace,
+      goal: staleGeneratedDeckState.goal,
+    },
+    staleGeneratedDeckState,
+    staleGeneratedDeckRuntime
+  );
+  assert(
+    staleGeneratedDeckRuntime.generatedArtifactProducerPending === true &&
+      staleGeneratedDeckRuntime.generatedArtifactProducerCommand === "python3 build_deck.py" &&
+      staleGeneratedDeckPhase?.mode === "generated-artifact-producer" &&
+      staleGeneratedDeckPhase?.command === "python3 build_deck.py",
+    `a stale generated artifact did not recover its exact safe producer before validation: ${JSON.stringify(
+      staleGeneratedDeckRuntime
+    )}`
+  );
+  recordProjectVerificationOutcome(
+    staleGeneratedDeckState,
+    {
+      toolName: "run_command",
+      ok: true,
+      exitCode: 0,
+      args: { command: "python3 build_deck.py" },
+      stdout: "Wrote output/deck.pptx\n",
+      stderr: "",
+      commandPolicy: {
+        category: "toolchain",
+        writesWorkspace: true,
+        mayMutateProject: false,
+        substantiveTest: false,
+      },
+    },
+    {
+      provider: "deepseek",
+      taskProfile: "slides",
+      commandCwd: workspace,
+      goal: staleGeneratedDeckState.goal,
+      allowShellTool: true,
+      sandboxMode: "host",
+    }
+  );
+  const postProducerRuntime = nextStepRuntimeConfig(
+    {
+      provider: "deepseek",
+      taskProfile: "slides",
+      commandCwd: workspace,
+      goal: staleGeneratedDeckState.goal,
+    },
+    staleGeneratedDeckState
+  );
+  assert(
+    staleGeneratedDeckState.meta.projectVerification.mutationRevision === 10 &&
+      postProducerRuntime.generatedArtifactProducerPending !== true &&
+      postProducerRuntime.testVerificationPending === true &&
+      postProducerRuntime.testVerificationCommand === generatedDeckValidator,
+    `a successful producer replay did not advance exactly once to fresh validation: ${JSON.stringify({
+      verification: staleGeneratedDeckState.meta.projectVerification,
+      activeExecutionContract: staleGeneratedDeckState.meta.activeExecutionContract,
+      runtime: postProducerRuntime,
+    })}`
+  );
+  const immutableOnlyRepairState = {
+    goal: "Treat service_ctl.py as immutable read-only source evidence and finish from existing results.",
+    meta: {
+      taskProfile: "devops",
+      projectVerification: {
+        mutationRevision: 0,
+        mutationHistory: [],
+        commandRuns: [],
+        testRuns: [],
+      },
+      completionEvidenceRepair: {
+        key: "protected-source-only",
+        at: "2026-08-27T19:00:00.000Z",
+        requiresFreshFileMutation: true,
+        requiredFreshMutationRevision: 1,
+      },
+      toolLoop: { recent: [] },
+    },
+  };
+  assert(
+    nextStepRuntimeConfig(
+      {
+        provider: "deepseek",
+        taskProfile: "devops",
+        commandCwd: workspace,
+        goal: immutableOnlyRepairState.goal,
+      },
+      immutableOnlyRepairState
+    ).completionFreshMutationRequired !== true,
+    "completion recovery forced a mutation when every concrete candidate was immutable"
+  );
   const concreteGoalUpdate = applyContinuationContractTransition(
     concreteContinuationState,
     concreteContinuation,

package/scripts/smoke-progressive-tool-selection.js

@@ -1747,6 +1747,28 @@ sameNames(
   "failed-test repair did not receive the bounded diagnose-patch-retest tool surface"
 );
 
+const generatedArtifactProducerTools = selectProgressiveTools(allTools, {
+  config: {
+    provider: "localllm",
+    testFailureRepairActive: true,
+    testFailureRepairMutationRequired: true,
+    generatedArtifactProducerPending: true,
+    generatedArtifactProducerCommand: "python3 build_deck.py",
+  },
+  goal: "Rebuild the generated presentation before rerunning its validator.",
+  profile: "slides",
+});
+sameNames(
+  generatedArtifactProducerTools,
+  ["run_command", "finish"],
+  "a stale generated artifact did not expose only its retained producer command"
+);
+assertStrict.deepEqual(
+  generatedArtifactProducerTools[0].function.parameters.properties.command.enum,
+  ["python3 build_deck.py"],
+  "the generated-artifact producer command was not schema-constrained"
+);
+
 const mutationOnlyFailedTestRepairTools = selectProgressiveTools(allTools, {
   config: {
     provider: "localllm",

package/scripts/smoke-scs-evidence-visibility.js

@@ -60,6 +60,16 @@ const coordinatedForbiddenOutputContract = deriveScsTaskContract({
   taskProfile: "devops",
 });
 
+const wrappedImmutableSourceContract = deriveScsTaskContract({
+  goal: [
+    "Continue the exact task. Do not modify source_brief.md, measurements.csv,",
+    "prompt.txt, or TASK.md.",
+    "Treat source_brief.md, measurements.csv, prompt.txt, and TASK.md as immutable read-only source evidence.",
+    "Repair build_deck.py and rebuild output/deck.pptx.",
+  ].join("\n"),
+  taskProfile: "slides",
+});
+
 const recoveryInstructionContract = deriveScsTaskContract({
   goal: [
     "Use the retained source and these two failures: the tests invoke ../service_ctl.py, while `python3 service_ctl.py start --state-dir .runtime` fails. Preserve the lifecycle assertions rather than replacing them, repair service_ctl.py, and remove the accidental untracked resume-after-git-baseline-recovery-dev-prompt.txt.",
@@ -152,6 +162,17 @@ assert.deepEqual(
   ["scratch.py", "temporary.py"],
   "a coordinated list did not retain each path governed by one exclusion"
 );
+assert.deepEqual(
+  wrappedImmutableSourceContract.excludedOutputPaths.sort(),
+  ["TASK.md", "measurements.csv", "prompt.txt", "source_brief.md"].sort(),
+  "a wrapped immutable source list lost one or more protected paths"
+);
+assert(
+  !wrappedImmutableSourceContract.exactOutputPaths.some((item) =>
+    ["TASK.md", "measurements.csv", "prompt.txt", "source_brief.md"].includes(item)
+  ),
+  "an immutable source path leaked into exact output requirements"
+);
 assert(
   recoveryInstructionContract.excludedOutputPaths.includes("resume-after-git-baseline-recovery-dev-prompt.txt") &&
     !recoveryInstructionContract.exactOutputPaths.includes("resume-after-git-baseline-recovery-dev-prompt.txt"),

package/src/agent-runner.js

@@ -2157,7 +2157,13 @@ export function buildKnownConstrainedPhasePlan(
   runtimeConfig = nextStepRuntimeConfig(config, state)
 ) {
   const repositoryStateRepair = runtimeConfig.testFailureRepositoryStateRepair === true;
-  if (runtimeConfig.testFailureRepairActive === true && !repositoryStateRepair) return null;
+  const generatedArtifactProducer =
+    runtimeConfig.generatedArtifactProducerPending === true;
+  if (
+    runtimeConfig.testFailureRepairActive === true &&
+    !repositoryStateRepair &&
+    !generatedArtifactProducer
+  ) return null;
 
   const freshSourceMutation = runtimeConfig.completionFreshMutationRequired === true;
   const verificationPending = runtimeConfig.testVerificationPending === true;
@@ -2181,6 +2187,7 @@ export function buildKnownConstrainedPhasePlan(
   if (
     !repositoryStateRepair &&
     !freshSourceMutation &&
+    !generatedArtifactProducer &&
     !verificationPending &&
     !requiredProjectCommandPending &&
     !verifiedCompletion &&
@@ -2191,19 +2198,22 @@ export function buildKnownConstrainedPhasePlan(
   }
 
   const command = String(
-    requiredProjectCommandPending
-      ? runtimeConfig.requiredProjectCommand || ""
-      : verificationPending
-        ? runtimeConfig.testVerificationCommand || ""
-        : repositoryStateRepair
-          ? runtimeConfig.testFailureCommand || ""
-          : runtimeConfig.verifiedCompletionCommand || ""
+    generatedArtifactProducer
+      ? runtimeConfig.generatedArtifactProducerCommand || ""
+      : requiredProjectCommandPending
+        ? runtimeConfig.requiredProjectCommand || ""
+        : verificationPending
+          ? runtimeConfig.testVerificationCommand || ""
+          : repositoryStateRepair
+            ? runtimeConfig.testFailureCommand || ""
+            : runtimeConfig.verifiedCompletionCommand || ""
   ).trim();
   if (
     !verifiedCompletion &&
     !artifactCommitPending &&
     !taskOwnedCommitPending &&
     !freshSourceMutation &&
+    !generatedArtifactProducer &&
     !command
   ) return null;
 
@@ -2211,6 +2221,8 @@ export function buildKnownConstrainedPhasePlan(
     ? "repository-state-repair"
     : freshSourceMutation
       ? "fresh-source-mutation"
+      : generatedArtifactProducer
+        ? "generated-artifact-producer"
       : requiredProjectCommandPending
       ? "required-project-command"
       : verificationPending
@@ -2250,6 +2262,12 @@ export function buildKnownConstrainedPhasePlan(
             "2. Preserve unrelated current behavior and do not edit private verification evidence.",
             "3. After the mutation succeeds, rerun the retained validation and complete required Git actions.",
           ].join("\n")
+      : generatedArtifactProducer
+        ? [
+            `1. Run the exact retained local producer command now: ${command}`,
+            "2. Rebuild generated artifacts from the latest canonical source mutation; do not rerun the stale validator first or substitute another command.",
+            "3. After the producer succeeds, run the exact retained validator and repair only from any fresh concrete failure.",
+          ].join("\n")
       : artifactCommitPending || taskOwnedCommitPending
       ? [
           "1. Use the offered commit_project_changes tool once; its path scope comes from recorded task-owned mutations.",
@@ -2281,6 +2299,8 @@ export function buildKnownConstrainedPhasePlan(
       ? runtimeConfig.completionFreshMutationNeedsSourceRead === true
         ? "Completion was rejected because a fresh canonical source correction is still missing. Read one exact offered project file now; command, test, Git, and finish actions remain intentionally unavailable until the source is grounded and materially patched."
         : "Completion was rejected because a fresh canonical source correction is still missing. Use the offered path-bounded apply_patch tool now. Do not substitute another read-only inspection, test rerun, Git command, private verifier edit, or finish claim."
+      : generatedArtifactProducer
+        ? "A canonical producer source changed after the last successful build. Run only the exact retained local producer command now so validation observes fresh artifacts; do not rerun the stale validator or invent another source edit."
       : artifactCommitPending
       ? "The exact artifact and current source changes already passed deterministic checks. Only the required local commit is missing. Call commit_project_changes with a concise factual subject, then finish; do not restart discovery or validation."
       : taskOwnedCommitPending
@@ -6025,10 +6045,14 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
     // verification regardless of its final exit status. Test identity and
     // mutation capability are independent: a generator or snapshot-updating
     // test still advances the revision, then records its evidence there.
+    const generatedArtifactProducer = safeProjectProducerSegment(command, config);
     const projectContentMutation = Boolean(
       command &&
         toolResult.blocked !== true &&
-        commandCanMutateProjectContent(mutationCommand, commandPolicy)
+        (
+          commandCanMutateProjectContent(mutationCommand, commandPolicy) ||
+          generatedArtifactProducer
+        )
     );
     let requiredBatch = currentRequiredCommandBatch(verification, requiredCommands);
     const activeExecutionContract = state.meta?.activeExecutionContract;
@@ -6086,6 +6110,21 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
         paths: [],
         commandCategory: String(commandPolicy.category || "general-shell"),
       }, config);
+      if (
+        generatedArtifactProducer &&
+        Number(activeExecutionContract?.revision || 0) ===
+          Number(state.meta?.goalContract?.revision || 0)
+      ) {
+        activeExecutionContract.materialMutationRevision = verification.mutationRevision;
+        activeExecutionContract.materialMutationCommands = [
+          ...new Set([
+            ...(Array.isArray(activeExecutionContract.materialMutationCommands)
+              ? activeExecutionContract.materialMutationCommands
+              : []),
+            generatedArtifactProducer,
+          ]),
+        ].slice(0, 12);
+      }
     }
     const run = {
       command,
@@ -6096,6 +6135,7 @@ export function recordProjectVerificationOutcome(state = {}, toolResult = {}, co
       ...(requiredBatch?.id ? { requiredCommandBatchId: requiredBatch.id } : {}),
       ...(requiredCommand ? { requiredProjectCommand: requiredCommand } : {}),
       ...(exitProbe.present ? { explicitExitStatus: exitProbe.status } : {}),
+      ...(generatedArtifactProducer ? { generatedArtifactProducer } : {}),
     };
     if (requiredCommand && commandSucceeded) {
       if (!requiredBatch && requiredMutatingCommands.length === 0) {
@@ -10415,6 +10455,139 @@ function completionFreshMutationCandidatePaths(state = {}, config = {}) {
   return selected.slice(0, 16);
 }
 
+function commandSegmentHasProducerIntent(command = "") {
+  const normalized = normalizeProjectCommand(command);
+  const tokens = tokenizeShellWords(normalized);
+  if (!tokens.length) return false;
+  let index = 0;
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(String(tokens[index] || ""))) {
+    index += 1;
+  }
+  const executable = path.posix.basename(
+    String(tokens[index] || "").replace(/\\/g, "/")
+  ).toLocaleLowerCase("en-US");
+  const args = tokens.slice(index + 1);
+  const rejectedProducerName =
+    /(?:^|[_-])(?:acceptance|audit|check|lint|smoke|spec|test|validat(?:e|or|ion)?|verif(?:y|ier|ication)?)(?:[_-]|$)/i;
+  const producerName =
+    /(?:^|[_-])(?:build|bundle|compile|deck|export|generat(?:e|or)|package|presentation|regen(?:erate)?|render|report|slides?)(?:[_-]|$)/i;
+
+  if (["python", "python3", "node", "ruby", "bash", "sh"].some((name) =>
+    executable === name || executable.startsWith(`${name}.`)
+  )) {
+    const scriptIndex = args[0] === "-m" ? 1 : 0;
+    const scriptName = path.posix.basename(
+      String(args[scriptIndex] || "").replace(/\\/g, "/")
+    ).replace(/\.[A-Za-z0-9]{1,8}$/u, "");
+    return Boolean(
+      scriptName &&
+        producerName.test(scriptName) &&
+        !rejectedProducerName.test(scriptName)
+    );
+  }
+
+  if (["npm", "pnpm", "yarn", "bun"].includes(executable)) {
+    const script = String(
+      args[0] === "run" ? args[1] : args[0]
+    ).toLocaleLowerCase("en-US");
+    return Boolean(
+      script && producerName.test(script) && !rejectedProducerName.test(script)
+    );
+  }
+  if (["make", "ninja", "latexmk", "pdflatex", "xelatex", "lualatex", "openscad"].includes(executable)) {
+    return true;
+  }
+  if (executable === "pandoc") return args.some((arg) => ["-o", "--output"].includes(arg));
+  if (executable === "typst") return args[0] === "compile";
+  if (executable === "cmake") return args.includes("--build");
+  if (executable === "meson") return ["compile", "install"].includes(args[0]);
+  if (["cargo", "go", "dotnet"].includes(executable)) return args[0] === "build";
+  return Boolean(
+    executable &&
+      producerName.test(executable.replace(/\.[A-Za-z0-9]{1,8}$/u, "")) &&
+      !rejectedProducerName.test(executable)
+  );
+}
+
+function safeProjectProducerSegment(command = "", config = {}) {
+  const normalized = normalizeProjectCommand(
+    normalizeCommandForPolicy(command, config)
+  );
+  const unwrapped = parseNonMutatingExitStatusWrapper(normalized)?.command || normalized;
+  const sequence = parseTopLevelShellSequence(unwrapped);
+  if (
+    !sequence.commands.length ||
+    sequence.openQuote ||
+    sequence.trailingEscape ||
+    sequence.trailingSeparator
+  ) {
+    return "";
+  }
+  for (const rawSegment of sequence.commands) {
+    const segment = normalizeProjectCommand(rawSegment);
+    if (!segment || !commandSegmentHasProducerIntent(segment)) continue;
+    const policy = classifyCommand(segment);
+    if (
+      policy.hardBlocked === true ||
+      policy.needsNetwork === true ||
+      ["blocked", "destructive", "external-write", "git-remote", "git-workflow", "package-install"].includes(
+        String(policy.category || "")
+      ) ||
+      isSubstantiveTestCommand(segment, config) ||
+      !commandCanMutateProjectContent(segment, policy)
+    ) {
+      continue;
+    }
+    return segment;
+  }
+  return "";
+}
+
+function pendingGeneratedArtifactProducerCommand(
+  state = {},
+  config = {},
+  verification = {},
+  currentFailedTest = null
+) {
+  if (!currentFailedTest || currentFailedTest.passed === true) return "";
+  if (failedTestRequiresCleanRepositoryState(currentFailedTest)) return "";
+  const context = [
+    completionContractGoal(config, state),
+    state.meta?.taskProfile || config.taskProfile || "",
+    currentFailedTest.failureSummary || "",
+  ].join("\n");
+  if (
+    !/(?:\b(?:artifact|build|bundle|compile|deck|export|generat(?:e|ed|or)|output|package|presentation|rebuild|regenerate|render|report|slides?)\b|\.(?:pdf|pptx|docx|html|svg|png|jpe?g|webp|mp4|mov)\b)/i.test(
+      context
+    )
+  ) {
+    return "";
+  }
+  const mutationRevision = Math.max(0, Number(verification.mutationRevision || 0));
+  const latestSourceMutation = [...(verification.mutationHistory || [])]
+    .reverse()
+    .find(
+      (mutation) =>
+        Number(mutation?.revision || 0) === mutationRevision &&
+        ["apply_patch", "write_file"].includes(String(mutation?.toolName || "")) &&
+        (Array.isArray(mutation?.paths) ? mutation.paths : []).some(
+          (item) => !isPrivateVerificationEvidencePath(item)
+        )
+    );
+  if (!latestSourceMutation) return "";
+  for (const run of [...(verification.commandRuns || [])].reverse()) {
+    if (
+      run?.ok !== true ||
+      Number(run?.mutationRevision || 0) >= mutationRevision
+    ) {
+      continue;
+    }
+    const producer = safeProjectProducerSegment(run?.command || "", config);
+    if (producer) return producer;
+  }
+  return "";
+}
+
 function exactOutputPathsForState(state = {}) {
   const scsOutputPaths = Array.isArray(state.meta?.scs?.taskContract?.exactOutputPaths)
     ? state.meta.scs.taskContract.exactOutputPaths.filter(Boolean)
@@ -11082,7 +11255,7 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       const entryAt = Date.parse(String(entry?.at || ""));
       return !Number.isFinite(repairAt) || (Number.isFinite(entryAt) && entryAt > repairAt);
     });
-    if (candidatePaths.length > 0 || !currentTurnRequiresFreshMutation) {
+    if (candidatePaths.length > 0) {
       runtimeConfig.completionFreshMutationRequired = true;
       runtimeConfig.completionFreshMutationRevision = currentTurnRequiresFreshMutation
         ? groundingMutationBaseline + 1
@@ -11099,6 +11272,15 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
   const latestRecordedTest = [...testRuns]
     .reverse()
     .find((run) => String(run?.command || "").trim());
+  const freshGeneratedArtifactProducer = [...(verification.commandRuns || [])]
+    .reverse()
+    .some(
+      (run) =>
+        run?.ok === true &&
+        String(run?.generatedArtifactProducer || "").trim() &&
+        Number(run?.mutationRevision || 0) === mutationRevision &&
+        Number(run?.privateMutationRevision || 0) === privateMutationRevision
+    );
   const retainedRepairPacket = state.meta?.failedTestRecoveryPacket;
   const repairedRetainedFailure = Boolean(
     latestRecordedTest?.passed !== true &&
@@ -11112,6 +11294,16 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
   );
   const retainedFailedTest =
     latestCurrentTest && latestCurrentTest.passed !== true ? latestCurrentTest : null;
+  const pendingArtifactProducerCommand = pendingGeneratedArtifactProducerCommand(
+    state,
+    config,
+    verification,
+    retainedFailedTest
+  );
+  if (pendingArtifactProducerCommand) {
+    runtimeConfig.generatedArtifactProducerPending = true;
+    runtimeConfig.generatedArtifactProducerCommand = pendingArtifactProducerCommand;
+  }
   if (retainedFailedTest) {
     const repositoryStateRepairMarker = state.meta?.repositoryStateRepair;
     const retainedRepositoryStateRepair = Boolean(
@@ -11572,7 +11764,7 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
       runtimeConfig.testVerificationCommand = String(retainedFailedTest.command || "");
     }
   } else if (
-    (!implementationOpen || repairedRetainedFailure) &&
+    (!implementationOpen || repairedRetainedFailure || freshGeneratedArtifactProducer) &&
     !latestCurrentTest &&
     latestRecordedTest &&
     !testRunMatchesVerificationRevision(latestRecordedTest, verification)
@@ -14710,7 +14902,9 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
             packageInstallPolicy: policy.packageInstallPolicy,
             needsNetwork: Boolean(policy.needsNetwork),
             writesWorkspace: Boolean(policy.writesWorkspace),
-            mayMutateProject: Boolean(policy.mayMutateProject),
+            ...(typeof policy.mayMutateProject === "boolean"
+              ? { mayMutateProject: policy.mayMutateProject }
+              : {}),
             substantiveTest: Boolean(policy.substantiveTest),
             gitOnly: Boolean(policy.gitOnly),
             noMatchExitIsSuccess: Boolean(policy.noMatchExitIsSuccess),

package/src/progressive-tool-selection.js

@@ -1937,6 +1937,16 @@ export function selectProgressiveTools(
     return artifactValidationToolNames(config).map((name) => available.get(name)).filter(Boolean);
   }
 
+  if (config.generatedArtifactProducerPending === true) {
+    const available = new Map(enabled.map(({ name, tool }) => [name, tool]));
+    const producerCommand = constrainRunCommand(
+      available.get("run_command"),
+      config.generatedArtifactProducerCommand,
+      "Run this exact previously successful local producer command once. Canonical source changed after its last run, so generated artifacts must be rebuilt before the retained validator can provide fresh evidence. Do not substitute another command or rerun the stale validator first."
+    );
+    return [producerCommand, finish].filter(Boolean);
+  }
+
   if (config.testFailureRepairActive === true) {
     const available = new Map(enabled.map(({ name, tool }) => [name, tool]));
     if (

package/src/scs-evidence.js

@@ -542,7 +542,10 @@ export function filterExplicitlyExcludedOutputPaths(paths = [], exclusions = [])
 }
 
 export function inferExplicitlyExcludedOutputPaths(goal = "") {
-  const source = String(goal || "");
+  // Preserve coordinated path lists that wrap after a comma. Prompt and task
+  // files commonly format "do not modify a, b,\nc, or d" across lines; splitting
+  // that text first drops the governing negative action from the continuation.
+  const source = String(goal || "").replace(/([,，、])\s*\r?\n\s*/gu, "$1 ");
   if (!source.trim()) return [];
   const extensionPattern = "md|txt|json|jsonl|ndjson|ya?ml|html|css|js|ts|tsx|jsx|py|sh|csv|tex|svg|png|jpe?g|webp|mp4|mov|pdf|docx";
   const pathPattern = new RegExp(
@@ -573,6 +576,11 @@ export function inferExplicitlyExcludedOutputPaths(goal = "") {
   for (const clause of source.split(/[;；\n]|(?<=[.!?。！？])\s+/u)) {
     pathPattern.lastIndex = 0;
     const matches = [...clause.matchAll(pathPattern)];
+    const immutablePathClause = Boolean(
+      /\b(?:treat|consider|regard)\b[^!?。！？;；\n]{0,260}\b(?:as\s+)?(?:immutable|read[ -]?only)\b/i.test(
+        clause
+      )
+    );
     let previousExcluded = false;
     for (let matchIndex = 0; matchIndex < matches.length; matchIndex += 1) {
       const match = matches[matchIndex];
@@ -595,6 +603,7 @@ export function inferExplicitlyExcludedOutputPaths(goal = "") {
           )
       );
       const directExclusion = Boolean(
+        immutablePathClause ||
         negativeActionBefore.test(before) ||
         negativeActionAfter.test(after) ||
         keepAbsent.test(`${before}${after}`) ||