@lyupro/codex-bridge 0.6.10 → 0.6.11

package/src/home/lib/runner/continuation.mjs

@@ -1,192 +1,174 @@
-/**
- * Owns the zero-quota decision about whether a requested continuation was ordered.
- *
- * The 2026-08-05 incident showed why the runner must not infer a second pass from a verdict:
- * only the orchestrator read that verdict and can name the run and reason it is willing to fund.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { CONTINUATION_INPUT, parseContinuationGrant } from '../required-inputs.mjs';
-import { readJson } from '../write-meta.mjs';
-import { workerMayBeAlive } from '../meta/run-liveness.mjs';
-
-// One comparison of run names for the grant gate and for attach, so a repeat and a grant can never
-// disagree about whether two spellings name the same folder.
-export const sameRun = (runsRootPath, left, right) => {
-  const a = path.resolve(runsRootPath, left);
-  const b = path.resolve(runsRootPath, right);
-  return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
-};
-
-function namedRunDirectory(runsRootPath, run) {
-  if (!run || run === '.' || run === '..' || path.basename(run) !== run) return null;
-  const directory = path.join(runsRootPath, run);
-  try {
-    return fs.statSync(directory).isDirectory() ? directory : null;
-  } catch {
-    return null;
-  }
-}
-
-function normalizeGrant(grant) {
-  if (typeof grant === 'string') return parseContinuationGrant(grant);
-  if (!grant || typeof grant !== 'object') return null;
-  const run = String(grant.run ?? '').trim();
-  const reason = String(grant.reason ?? '').trim();
-  return run && reason ? { run, reason } : null;
-}
-
-const grantExample = `Example: \`continue: ${CONTINUATION_INPUT.example}\`.`;
-const grantAction =
-  'Action: ask the orchestrator for an explicit grant naming the run and reason; do not invent or reuse a continuation.';
-
-// The 2026-08-10_220535_plan25-2-install-table-two-roots incident showed that a refusal must
-// carry the repair line; otherwise a typo forces an unnecessary directory listing and retry.
-function lastRunOutcome(runsRootPath, chain) {
-  const run = chain[chain.length - 1];
-  if (!run) return null;
-  const status = readJson(path.join(runsRootPath, run, 'status.json')) || {};
-  const meta = readJson(path.join(runsRootPath, run, 'meta.json')) || {};
-  const outcomeStatus = String(meta.status ?? status.status ?? status.state ?? 'unknown').trim() || 'unknown';
-  const outcomeReason = String(meta.reason ?? status.reason ?? 'reason not recorded').trim() || 'reason not recorded';
-  return { run, status: outcomeStatus, reason: outcomeReason, verdict: meta.status, orderId: status.order_id };
-}
-
-export function readyGrantLines(runsRootPath, chain, grantReason) {
-  const last = lastRunOutcome(runsRootPath, chain);
-  if (!last) return 'Ready grant line: none (there is no run to continue).';
-  const reason = String(grantReason ?? last.reason).trim() || last.reason;
-  const continuation = `Ready grant line: continue: ${last.run} — ${reason}.`;
-  // Plan_75 D1: the TradeForge failed advise spent its continuation, so show the same-pass repair.
-  // A run without order_id cannot be retried (retryRefusal step d), so it gets no retry line.
-  const orderId = String(last.orderId ?? '').trim();
-  if (!last.verdict || last.verdict === 'OK' || !orderId) return continuation;
-  return continuation +
-    ` Ready retry line: retry: ${last.run} — ${last.reason} (repeats that pass under order ${orderId}).`;
-}
-
-function lastRunHints(runsRootPath, chain, grantReason) {
-  const last = lastRunOutcome(runsRootPath, chain);
-  if (!last) {
-    return 'Last run: none. Outcome: none. Ready grant line: none (there is no run to continue).';
-  }
-  return `Last run: ${last.run}. Outcome: ${last.status} — ${last.reason}. ` +
-    readyGrantLines(runsRootPath, chain, grantReason);
-}
-
-/**
- * Applies the one-continuation limit and all continuation safety gates before a folder is created.
- *
- * The limit is counted over the runs carrying THIS order id, not over the whole chain. The chain
- * also ties runs together by slug and by the fingerprint of the task text, which is what catches a
- * repeat that renamed itself — but counting continuations that way makes the escape hatch
- * unreachable: the operator's rule is "more passes than one need a new order id", and a new order
- * id lands in the same chain through the task hash. A task would then be refused with --continue
- * for having spent its continuation and refused without it for already having runs — permanently
- * unrunnable, which is a worse failure than the retry storm this limit exists to stop.
- */
-export function continuationRefusal(runsRootPath, chain, isContinue, orderId, grant) {
-  const continuation = normalizeGrant(grant);
-  if (!isContinue) {
-    if (!continuation) return null;
-    return (
-      '--continue is required when the task text contains a `continue:` grant. ' +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      'The submitted grant was not rewritten. The run folder was not created; quota was not spent.'
-    );
-  }
-
-  if (!continuation) {
-    return (
-      '--continue is refused: the orchestrator did not provide a `continue:` grant in the task text. ' +
-      `${lastRunHints(runsRootPath, chain)} ` +
-      `${grantExample} ${grantAction} The run folder was not created; quota was not spent.`
-    );
-  }
-
-  const namedDirectory = namedRunDirectory(runsRootPath, continuation.run);
-  if (!namedDirectory) {
-    return (
-      `--continue is refused: the orchestrator named run “${continuation.run}”, but it does not ` +
-      `exist as a run folder in this project's runs directory ${runsRootPath}. ` +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      `${grantExample} ${grantAction} The submitted grant was not rewritten. ` +
-      'The run folder was not created; quota was not spent.'
-    );
-  }
-
-  const last = chain[chain.length - 1];
-  // Continuing the last run appends a later run, so the old grant stops matching by itself; this
-  // incident needs no counter or new state to make an orchestrator grant single-use.
-  if (!last || !sameRun(runsRootPath, continuation.run, last)) {
-    return (
-      `--continue is refused: grant ${continuation.run} is not the LAST run of this task's chain; ` +
-      `the current last run is ${last || 'none'}. A continuation is single-use: continuing the ` +
-      'last run appends a later run, so the old grant stops matching by itself — no counter or new ' +
-      `state is used. ${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      `${grantExample} ${grantAction} The run folder was not created; quota was not spent.`
-    );
-  }
-
-  const wanted = String(orderId ?? '').trim();
-  // Plan_75 D1, TradeForge capacity incident: a retry spends no new pass, even after an OK verdict.
-  const ofThisOrder = chain.filter((run) => {
-    const status = readJson(path.join(runsRootPath, run, 'status.json'));
-    return String(status?.order_id ?? '').trim() === wanted && !String(status?.retry_of ?? '').trim();
-  });
-  if (ofThisOrder.length === 0) return null;
-  if (ofThisOrder.length > 1) {
-    const spent = ofThisOrder.map((run) => path.join(runsRootPath, run)).join(', ');
-    return (
-      `--continue is refused: order “${wanted}” already spent its allowed continuation on ${spent}. ` +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      'A further pass needs a new order id from the orchestrator. The run folder was not ' +
-      'created; quota was not spent.'
-    );
-  }
-  const previous = path.join(runsRootPath, ofThisOrder[0]);
-  const status = readJson(path.join(previous, 'status.json'));
-  const meta = readJson(path.join(previous, 'meta.json'));
-  if (!meta?.status || status?.state === 'running') {
-    return (
-      `--continue is refused: previous run ${previous} has no finished verdict and may still ` +
-      'be editing the worktree. Repeat without --continue to attach to it. ' +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} The run folder was ` +
-      'not created; quota was not spent.'
-    );
-  }
-  return null;
-}
-
-export function retryRefusal(runsRootPath, chain, isContinue, orderId, grant, liveness = workerMayBeAlive) {
-  const refuse = (message) => `${message} The run folder was not created; quota was not spent.`;
-  if (!isContinue) {
-    return refuse('--continue is required for a `retry:` grant: the orchestrator deliberately repeats the same pass.');
-  }
-  const runDir = namedRunDirectory(runsRootPath, grant?.run);
-  if (!runDir) {
-    return refuse(`Retry is refused: ${grant?.run || 'none'} is not a bare existing run folder in ${runsRootPath}.`);
-  }
-  const last = chain[chain.length - 1];
-  // Plan_75 D1: appending the TradeForge retry makes this grant single-use without a new counter.
-  if (!last || !sameRun(runsRootPath, grant.run, last)) {
-    return refuse(`Retry is refused: grant ${grant.run} is not the LAST run of this task's chain; a retry is single-use.`);
-  }
-  const status = readJson(path.join(runDir, 'status.json'));
-  const wanted = String(orderId ?? '').trim();
-  const previousOrder = String(status?.order_id ?? '').trim();
-  if (!previousOrder || previousOrder !== wanted) {
-    return refuse(`Retry is refused: run ${grant.run} order_id ${previousOrder || '(missing)'} differs from order ${wanted}. ` +
-      'A retry repeats its own order; a run without order_id predates orders — start a new order.');
-  }
-  const meta = readJson(path.join(runDir, 'meta.json'));
-  // Plan_75 D1: a verdict alone must not let a retry overlap the failed advise's live writer.
-  if (!meta?.status || liveness({ runDir, status })) {
-    return refuse(`Retry is refused: run ${grant.run} has no finished verdict or its worker may still be alive and writing. ` +
-      'Repeat without --continue to attach to it.');
-  }
-  if (meta.status === 'OK') {
-    return refuse(`Retry is refused: run ${grant.run} ended OK. A retry repeats a failed pass; use continue: for the next pass.`);
-  }
-  return null;
-}
+/**
+ * Owns the zero-quota decision about whether a requested continuation was ordered.
+ *
+ * The 2026-08-05 incident showed why the runner must not infer a second pass from a verdict:
+ * only the orchestrator read that verdict and can name the run and reason it is willing to fund.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { CONTINUATION_ORDER_INPUT, orderInputName } from '../order-schema.mjs';
+import { readJson } from '../write-meta.mjs';
+import { workerMayBeAlive } from '../meta/run-liveness.mjs';
+
+// One comparison of run names for the grant gate and for attach, so a repeat and a grant can never
+// disagree about whether two spellings name the same folder.
+export const sameRun = (runsRootPath, left, right) => {
+  const a = path.resolve(runsRootPath, left);
+  const b = path.resolve(runsRootPath, right);
+  return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+};
+
+function namedRunDirectory(runsRootPath, run) {
+  if (!run || run === '.' || run === '..' || path.basename(run) !== run) return null;
+  const directory = path.join(runsRootPath, run);
+  try {
+    return fs.statSync(directory).isDirectory() ? directory : null;
+  } catch {
+    return null;
+  }
+}
+
+function normalizeGrant(grant) {
+  if (!grant || typeof grant !== 'object') return null;
+  const run = String(grant.run ?? '').trim();
+  const reason = String(grant.reason ?? '').trim();
+  return run && reason ? { run, reason } : null;
+}
+
+const grantExample = `Example: \`continue: ${CONTINUATION_ORDER_INPUT.example}\`.`;
+const grantAction =
+  'Action: ask the orchestrator for an explicit grant naming the run and reason; do not invent or reuse a continuation.';
+
+// The 2026-08-10_220535_plan25-2-install-table-two-roots incident showed that a refusal must
+// carry the repair line; otherwise a typo forces an unnecessary directory listing and retry.
+function lastRunOutcome(runsRootPath, chain) {
+  const run = chain[chain.length - 1];
+  if (!run) return null;
+  const status = readJson(path.join(runsRootPath, run, 'status.json')) || {};
+  const meta = readJson(path.join(runsRootPath, run, 'meta.json')) || {};
+  const outcomeStatus = String(meta.status ?? status.status ?? status.state ?? 'unknown').trim() || 'unknown';
+  const outcomeReason = String(meta.reason ?? status.reason ?? 'reason not recorded').trim() || 'reason not recorded';
+  return { run, status: outcomeStatus, reason: outcomeReason, verdict: meta.status, orderId: status.order_id };
+}
+
+export function readyGrantLines(runsRootPath, chain, grantReason) {
+  const last = lastRunOutcome(runsRootPath, chain);
+  if (!last) return 'Ready grant line: none (there is no run to continue).';
+  const reason = String(grantReason ?? last.reason).trim() || last.reason;
+  const continuation = `Ready grant line: continue: ${last.run} — ${reason}.`;
+  // Plan_75 D1: the TradeForge failed advise spent its continuation, so show the same-pass repair.
+  // A run without order_id cannot be retried (retryRefusal step d), so it gets no retry line.
+  const orderId = String(last.orderId ?? '').trim();
+  if (!last.verdict || last.verdict === 'OK' || !orderId) return continuation;
+  return continuation +
+    ` Ready retry line: retry: ${last.run} — ${last.reason} (repeats that pass under order ${orderId}).`;
+}
+
+function lastRunHints(runsRootPath, chain, grantReason) {
+  const last = lastRunOutcome(runsRootPath, chain);
+  if (!last) {
+    return 'Last run: none. Outcome: none. Ready grant line: none (there is no run to continue).';
+  }
+  return `Last run: ${last.run}. Outcome: ${last.status} — ${last.reason}. ` +
+    readyGrantLines(runsRootPath, chain, grantReason);
+}
+
+/**
+ * Applies the one-continuation limit and all continuation safety gates before a folder is created.
+ *
+ * The limit is counted over the runs carrying THIS order id, not over the whole chain. The chain
+ * also ties runs together by slug and by the fingerprint of the task text, which is what catches a
+ * repeat that renamed itself — but counting continuations that way makes the escape hatch
+ * unreachable: the operator's rule is "more passes than one need a new order id", and a new order
+ * id lands in the same chain through the task hash. A task would then be refused with a grant
+ * for having spent its continuation and refused without one for already having runs — permanently
+ * unrunnable, which is a worse failure than the retry storm this limit exists to stop.
+ */
+export function continuationRefusal(runsRootPath, chain, isContinue, orderId, grant) {
+  const continuation = normalizeGrant(grant);
+  // Plan_63 D9: only header grant objects authorize a pass; a string is no grant.
+  if (!isContinue || !continuation) return null;
+
+  const namedDirectory = namedRunDirectory(runsRootPath, continuation.run);
+  if (!namedDirectory) {
+    return (
+      `${orderInputName('continue')} is refused: the orchestrator named run “${continuation.run}”, but it does not ` +
+      `exist as a run folder in this project's runs directory ${runsRootPath}. ` +
+      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
+      `${grantExample} ${grantAction} The submitted grant was not rewritten. ` +
+      'The run folder was not created; quota was not spent.'
+    );
+  }
+
+  const last = chain[chain.length - 1];
+  // Continuing the last run appends a later run, so the old grant stops matching by itself; this
+  // incident needs no counter or new state to make an orchestrator grant single-use.
+  if (!last || !sameRun(runsRootPath, continuation.run, last)) {
+    return (
+      `${orderInputName('continue')} is refused: grant ${continuation.run} is not the LAST run of this task's chain; ` +
+      `the current last run is ${last || 'none'}. A continuation is single-use: continuing the ` +
+      'last run appends a later run, so the old grant stops matching by itself — no counter or new ' +
+      `state is used. ${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
+      `${grantExample} ${grantAction} The run folder was not created; quota was not spent.`
+    );
+  }
+
+  const wanted = String(orderId ?? '').trim();
+  // Plan_75 D1, TradeForge capacity incident: a retry spends no new pass, even after an OK verdict.
+  const ofThisOrder = chain.filter((run) => {
+    const status = readJson(path.join(runsRootPath, run, 'status.json'));
+    return String(status?.order_id ?? '').trim() === wanted && !String(status?.retry_of ?? '').trim();
+  });
+  if (ofThisOrder.length === 0) return null;
+  if (ofThisOrder.length > 1) {
+    const spent = ofThisOrder.map((run) => path.join(runsRootPath, run)).join(', ');
+    return (
+      `${orderInputName('continue')} is refused: order “${wanted}” already spent its allowed continuation on ${spent}. ` +
+      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
+      'A further pass needs a new order id from the orchestrator. The run folder was not ' +
+      'created; quota was not spent.'
+    );
+  }
+  const previous = path.join(runsRootPath, ofThisOrder[0]);
+  const status = readJson(path.join(previous, 'status.json'));
+  const meta = readJson(path.join(previous, 'meta.json'));
+  if (!meta?.status || status?.state === 'running') {
+    return (
+      `${orderInputName('continue')} is refused: previous run ${previous} has no finished verdict and may still ` +
+      `be editing the worktree. Repeat without ${orderInputName('continue')} to attach to it. ` +
+      `${lastRunHints(runsRootPath, chain, continuation.reason)} The run folder was ` +
+      'not created; quota was not spent.'
+    );
+  }
+  return null;
+}
+
+export function retryRefusal(runsRootPath, chain, isContinue, orderId, grant, liveness = workerMayBeAlive) {
+  const refuse = (message) => `${message} The run folder was not created; quota was not spent.`;
+  const runDir = namedRunDirectory(runsRootPath, grant?.run);
+  if (!runDir) {
+    return refuse(`Retry is refused: ${grant?.run || 'none'} is not a bare existing run folder in ${runsRootPath}.`);
+  }
+  const last = chain[chain.length - 1];
+  // Plan_75 D1: appending the TradeForge retry makes this grant single-use without a new counter.
+  if (!last || !sameRun(runsRootPath, grant.run, last)) {
+    return refuse(`Retry is refused: grant ${grant.run} is not the LAST run of this task's chain; a retry is single-use.`);
+  }
+  const status = readJson(path.join(runDir, 'status.json'));
+  const wanted = String(orderId ?? '').trim();
+  const previousOrder = String(status?.order_id ?? '').trim();
+  if (!previousOrder || previousOrder !== wanted) {
+    return refuse(`Retry is refused: run ${grant.run} order_id ${previousOrder || '(missing)'} differs from order ${wanted}. ` +
+      'A retry repeats its own order; a run without order_id predates orders — start a new order.');
+  }
+  const meta = readJson(path.join(runDir, 'meta.json'));
+  // Plan_75 D1: a verdict alone must not let a retry overlap the failed advise's live writer.
+  if (!meta?.status || liveness({ runDir, status })) {
+    return refuse(`Retry is refused: run ${grant.run} has no finished verdict or its worker may still be alive and writing. ` +
+      `Repeat without ${orderInputName('retry')} to attach to it.`);
+  }
+  if (meta.status === 'OK') {
+    return refuse(`Retry is refused: run ${grant.run} ended OK. A retry repeats a failed pass; use continue: for the next pass.`);
+  }
+  return null;
+}

package/src/home/lib/runner/launcher.mjs

@@ -16,6 +16,7 @@ import {
   abandonedBranchDrift,
 } from '../write-meta.mjs';
 import { TASK_HASH_SCHEME } from '../meta/chain.mjs';
+import { orderInputName } from '../order-schema.mjs';
 import { EXIT } from './exit-codes.mjs';
 import { passGate } from './pass-gate.mjs';
 import { setRun } from './run-context.mjs';
@@ -85,15 +86,15 @@ export const runDirPath = (root, slug, runStamp = stamp()) => {
 
 /**
  * Everything a run needs before a single token of someone else's quota is spent, and every
- * refusal that costs nothing: bad arguments, an open chain without --continue, a busy
+ * refusal that costs nothing: bad arguments, an open chain without a `continue:` grant, a busy
  * worktree, a dead Codex sandbox, a missing Codex CLI. All in the process the caller is free
  * to kill — so a killed caller can only ever interrupt a run that was already paid for.
  */
 export async function launcher(argv = process.argv.slice(2)) {
   loadRunEnv();
   const opts = parseArgs(argv);
-  opts.phase = resolveRunPhase(opts, RUN_ENV.budgets);
   const { task: taskText, header } = settleTaskInput(opts);
+  opts.phase = resolveRunPhase(opts, RUN_ENV.budgets);
   // Plan_59 D5/D6: blind choices and design authority must be checked before the paid probe.
   const taskGate = taskPreflight({ agent: opts.agent, taskText, header });
   if (taskGate.refusal) die(taskGate.refusal, EXIT.FAIL);
@@ -102,13 +103,12 @@ export async function launcher(argv = process.argv.slice(2)) {
   const repoRoot = isGitRepo ? topLevel.stdout.trim() : opts.repo;
   // Plan_27 moved impossible scope failures ahead of the run directory: an absolute pattern had
   // already cost 18 minutes before the verdict could prove it matched nothing.
-  // Every agent, not only the writing one: a pattern that cannot match gives a scout empty coverage
-  // instead of an answer. Only codex-build may declare a not-yet-existing path, so only its scope
-  // carries --scope-new; for the other two the list is empty and every pattern must match.
+  // Plan_63 D6: only codex-build's header accepts `scope:` and `scope new:`; for the other agents both
+  // lists are empty and the check passes. Only paths named in `scope new:` may be absent.
   const scopeRefusal = validateScope(repoRoot, opts.scopePatterns, opts.scopeNewPatterns);
   if (scopeRefusal) {
     die(
-      `${scopeRefusal.flag} pattern ${JSON.stringify(scopeRefusal.pattern)} refused: ` +
+      `${orderInputName(scopeRefusal.label)} pattern ${JSON.stringify(scopeRefusal.pattern)} refused: ` +
         `${scopeRefusal.reason}. ` +
         `Action: ${scopeRefusal.action}. The run folder was not created; quota was not spent.`,
     );
@@ -224,8 +224,8 @@ export async function launcher(argv = process.argv.slice(2)) {
       );
     }
 
-    // The sub-questions this run will be graded against come only from the orchestrator's
-    // repeatable flags. They are written before the task is assembled so the prompt and verdict
+    // The sub-questions this run will be graded against come only from the task document's
+    // `Questions` section. They are written before the task is assembled so the prompt and verdict
     // read the same ordered list, including a valid one-question order.
     const questions = opts.agent === 'codex-scout' ? questionsFromTexts(opts.questions) : [];
     if (opts.agent === 'codex-scout') {
@@ -344,7 +344,7 @@ export async function launcher(argv = process.argv.slice(2)) {
       `STARTED agent=${opts.agent} slug=${opts.slug} order-id=${opts.orderId} worker-pid=${worker.pid}`,
     );
     console.log(
-      'To get the verdict, repeat the identical command with the same --order-id; it will attach to this run and will not start a second run.',
+      `To get the verdict, repeat the identical command with the same ${orderInputName('order id')}; it will attach to this run and will not start a second run.`,
     );
     return EXIT.OK;
   } finally {

package/src/home/lib/runner/order-options.mjs

@@ -0,0 +1,30 @@
+/** Normalises one order's values into runner options, whatever channel carried them (Plan_63 D5). */
+import path from 'node:path';
+
+export function orderOptions(agentType, order, { cwd = process.cwd() } = {}) {
+  const options = { orderId: (order.get('order id') ?? '').trim() };
+  const problems = [];
+  // Left unset when absent: the role's configured profile fills the gap, and a default here would always win.
+  // Plan_56 step 3 leaves effort support to the live catalogue and Codex at run start.
+  if (order.has('effort')) {
+    options.effort = order.get('effort');
+    if (!options.effort || /\s/.test(options.effort)) {
+      problems.push({ label: 'effort',
+        reason: `must be a non-empty single word with no whitespace; got ${JSON.stringify(options.effort)}` });
+    }
+  }
+  options.repo = path.resolve(order.get('repository') || cwd);
+  options.slug = (order.get('slug') || options.orderId).replace(/[^A-Za-z0-9._-]+/g, '-');
+  // Plan_29 incident: a generic slug let an honest order inherit a days-old chain.
+  if (!/[A-Za-z0-9]/.test(options.slug)) {
+    problems.push({ label: order.has('slug') ? 'slug' : 'order id',
+      reason: `produces an unusable run folder name after sanitization: ${JSON.stringify(options.slug)} must contain a letter or digit.` });
+  }
+  options.changeset = order.get('changeset') || 'uncommitted';
+  const declaredScopePatterns = (order.get('scope') || '').split(',').map((p) => p.trim()).filter(Boolean);
+  options.scopeNewPatterns = (order.get('scope new') || '').split(',').map((p) => p.trim()).filter(Boolean);
+  // Plan_27 keeps ordinary patterns strict: only paths named explicitly as new may be absent.
+  options.scopePatterns = [...declaredScopePatterns, ...options.scopeNewPatterns];
+  if (order.has('phase')) options.phase = order.get('phase');
+  return { options, problems };
+}

package/src/home/lib/runner/order-owner.mjs

@@ -1,5 +1,6 @@
 /** Keeps the runner and producer hook on one definition of which task owns an order id. */
 import { TASK_HASH_SCHEME } from '../meta/chain.mjs';
+import { orderInputName } from '../order-schema.mjs';
 
 const byStartThenName = (left, right) => {
   const leftAt = String(left.status.started_at || '');
@@ -41,6 +42,6 @@ export function orderOwnerConflictText(owner, ownerDir, orderId) {
       `Its answer is already on disk in that folder (codex-bridge read "${ownerDir}"). ` +
       'Another pass of that order needs a continue:/retry: header line; a new task needs a new order id.';
   }
-  return `${identity} with a different task. Use a new order id (--order-id), or a continue:/retry: header line ` +
+  return `${identity} with a different task. Use a new order id (${orderInputName('order id')}), or a continue:/retry: header line ` +
     'if this is another pass of that order.';
 }

package/src/home/lib/runner/pass-gate.mjs

@@ -14,6 +14,7 @@ import { attach } from './attach.mjs';
 import { continuationRefusal, retryRefusal, readyGrantLines } from './continuation.mjs';
 import { advisorTaskOrRefuse } from './advise-carry.mjs';
 import { scopeRunRefusal } from './preflight.mjs';
+import { orderInputName } from '../order-schema.mjs';
 
 export async function passGate({ opts, taskText, header, projectRunsRoot, repoRoot, beforeWait }) {
   // A second pass at the same task is a real need — after a timeout or a LIMIT the work has
@@ -24,14 +25,14 @@ export async function passGate({ opts, taskText, header, projectRunsRoot, repoRo
   // The task is identified by its text as well as by its slug, because the slug is chosen by
   // whoever repeats the run: on 2026-08-02 a dispatcher whose launcher was killed restarted
   // the identical order as `<slug>-v2` and spent 46k on it. Refused before the folder exists,
-  // like --scope.
+  // like an impossible scope.
   const taskHash = taskFingerprint(taskText);
   const grant = header.grant;
   // OW-040, 2026-09-30: only a retry repeats failed scope without spending advise's continuation.
   if (opts.agent === 'codex-advisor' && opts.phase === 'scope' && opts.continue && grant?.kind !== 'retry') {
-    die('codex-advisor --phase scope refuses --continue: a scope pass is never continued, and continuing one ' +
+    die(`codex-advisor ${orderInputName('phase')} scope refuses ${orderInputName('continue')}: a scope pass is never continued, and continuing one ` +
       "spends the order's single continuation that its advise phase needs. Action: repeat the scope under a new order id " +
-      "without --continue and without a continue: grant, then run advise as that order's continuation; a " +
+      `without ${orderInputName('continue')} and without a continue: grant, then run advise as that order's continuation; a ` +
       'scope run that failed is repeated with a `retry:` grant instead. The run folder was not created; quota was not spent.');
   }
   let continuationGrant = grant?.kind === 'continue' ? grant : null;
@@ -46,11 +47,12 @@ export async function passGate({ opts, taskText, header, projectRunsRoot, repoRo
   let attachedExitCode = opts.continue ? await attachExistingRun() : null;
   if (attachedExitCode !== null) return { exitCode: attachedExitCode };
 
-  // The 2026-08-10_220535_plan25-2-install-table-two-roots incident exposed this ordering:
-  // a grant without its flag must refuse before attach can print an older run's verdict.
+  // The 2026-08-10_220535_plan25-2-install-table-two-roots incident exposed this ordering: an
+  // invalid grant must refuse before attach can print an older run's verdict (Plan_63 D8: the
+  // grant alone means continuation, so "grant without flag" no longer exists).
   // markAbandoned() ran before this gate, so a dead runner already has meta.json with FAIL.
   // A run without a verdict can therefore only still be in flight; ordinary repeats go through
-  // attach() after this gate. Repeated --continue calls attach first because their grant is spent.
+  // attach() after this gate. Repeated continuation calls attach first because their grant is spent.
   if (grant?.kind === 'retry') {
     const retryError = retryRefusal(projectRunsRoot, startedChain, opts.continue, opts.orderId, grant);
     if (retryError) die(retryError);
@@ -92,14 +94,14 @@ export async function passGate({ opts, taskText, header, projectRunsRoot, repoRo
     const lastSlug = String(readJson(path.join(projectRunsRoot, last, 'status.json'))?.slug || '');
     const renamed = lastSlug && lastSlug.toLowerCase() !== String(opts.slug).toLowerCase();
     die(
-      `--continue is required: ${
+      `${orderInputName('continue')} is required: ${
         renamed
           ? `this task already ran in this repository under the name “${lastSlug}”`
           : `runs for task “${opts.slug}” already exist in this repository`
       } (${startedChain.length}), latest: ${path.join(projectRunsRoot, last)}. ` +
         'A repeat run is allowed, but the orchestrator decides, not the runner: it read the ' +
-        'previous response and knows whether work remains. Add --continue if you are finishing ' +
-        'the same task; changing --slug with the same task text does not stop it being a repeat. ' +
+        `previous response and knows whether work remains. Add ${orderInputName('continue')} if you are finishing ` +
+        `the same task; changing ${orderInputName('slug')} with the same task text does not stop it being a repeat. ` +
         `${readyGrantLines(projectRunsRoot, startedChain)} ` +
         'The run folder was not created; quota was not spent.',
     );

package/src/home/lib/runner/preflight.mjs

@@ -11,6 +11,7 @@ import { activeRunDetails, readJson } from '../write-meta.mjs';
 import { probeCodexAvailability } from './codex-availability.mjs';
 import { agentRole } from '../agents.mjs';
 import { die } from './args.mjs';
+import { orderInputName } from '../order-schema.mjs';
 
 /** Plan_60 D2: only conclusive evidence says UNAVAILABLE; an unclear probe stays an ordinary refusal. */
 export async function codexAvailabilityRefusal({ probe = probeCodexAvailability } = {}) {
@@ -84,15 +85,15 @@ export function scopeRunRefusal({ agent, phase, runsRoot, grantRun }) {
 export function resolveRunPhase({ agent, phase, continue: isContinue }, budgets) {
   // Plan_59 D7: phase 2 must retain the scope run's predictions before quota is spent.
   if (agent === 'codex-advisor' && phase === 'advise' && !isContinue) {
-    die('codex-advisor --phase advise requires --continue: phase 2 continues the scope run of the same order ' +
+    die(`codex-advisor ${orderInputName('phase')} advise requires a ${orderInputName('continue')} grant naming the scope run: phase 2 continues the scope run of the same order ` +
       'so it can settle the risks phase 1 predicted. The run folder was not created; quota was not spent.');
   }
   const phases = budgets[agentRole(agent)];
   const names = Object.keys(phases);
   if (phase === undefined && names.length === 1 && names[0] === 'default') return 'default';
   if (phase !== undefined && Object.hasOwn(phases, phase)) return phase;
-  die(`${phase === undefined ? '--phase is required' : `undeclared --phase ${JSON.stringify(phase)}`} ` +
-    `for ${agent}. Action: pass --phase <name>; allowed phases: ${names.join(', ')}. ` +
+  die(`${phase === undefined ? `${orderInputName('phase')} is required` : `undeclared ${orderInputName('phase')} ${JSON.stringify(phase)}`} ` +
+    `for ${agent}. Action: pass ${orderInputName('phase')} <name>; allowed phases: ${names.join(', ')}. ` +
     'The run folder was not created; quota was not spent.');
 }