@moretea-labs/forge 1.5.0-rc.1 → 1.5.1

package/src/runtime/gateway/mcp/runtime-tools.ts

@@ -14,9 +14,10 @@ import { repositoryControllerRoot } from '../../../cli/repositories/controller-h
 import { cancelExecutionJob, findExecutionJob, getExecutionJob, getExecutionJobByRequestId, listExecutionJobs } from '../../execution/jobs/store';
 import { waitForExecutionJob } from '../../execution/jobs/wait';
 import type { ExecutionJob } from '../../execution/jobs/types';
-import { getProcessHandle, processRuntimeResourceDiagnostics, waitForProcess } from '../../execution/process-runtime';
+import { getProcessHandle, getProcessRecord, processCheckCompletionReceipt, processRuntimeResourceDiagnostics, readPersistedCheckResultReceipt, runPersistedCheckViaProcessRuntime, waitForProcess } from '../../execution/process-runtime';
 import { buildJobOperationDigest } from '../../control-plane/facade/operation-digest';
 import { readWorkHandle, type WorkHandleState } from '../../control-plane/execution/work-handle-store';
+import { executionIdentityForRepository } from '../../control-plane/execution/execution-identity';
 import { reconcileFinalizedDirectEditWorksAfterCommit } from '../../control-plane/execution/direct-edit-work-completion';
 import { readJobEvents } from '../../evidence/event-ledger';
 import { readExecutionArtifact } from '../../evidence/artifact-store';
@@ -41,6 +42,15 @@ import {
 } from '../../health';
 import { applyScheduleDedupe, buildScheduleDedupeReport, createSchedule, getSchedule, getScheduleDecision, listOccurrences, listSchedules, saveSchedule } from '../../workflow/schedules/store';
 import { evaluateSchedule } from '../../workflow/schedules/engine';
+import {
+  createWorkContinuationSchedule,
+  getWorkContinuationSchedule,
+  listWorkContinuationSchedules,
+  pauseWorkContinuationSchedule,
+  resumeWorkContinuationSchedule,
+  triggerWorkContinuationSchedule,
+  type ContinuationControllerType,
+} from '../../workflow/schedules/work-continuation';
 import { createPortfolioWorkflow, getPortfolioWorkflow, listPortfolioWorkflows } from '../../workflow/portfolio/store';
 import { claimsForMcpOperation } from './resource-policy';
 import {
@@ -55,16 +65,6 @@ import {
 } from './router';
 import { assertAutomatedOperationAllowed } from '../../control-plane/governance/external-effects';
 import { getCandidateFinding, listCandidateFindings, recordCandidateFinding } from '../../workflow/findings/store';
-import { addCampaignTask, createCampaign, getCampaign, listCampaigns, setCampaignStatus, validateCreateCampaignTasks } from '../../workflow/campaigns/store';
-import { reconcileCampaign } from '../../workflow/campaigns/engine';
-import { submitCampaignReview } from '../../workflow/campaigns/review';
-import type { CampaignReviewPolicy, CampaignSupervisorAction, CreateCampaignTaskInput } from '../../workflow/campaigns/types';
-import { currentCampaignWorkspace, ensureCampaignWorkspace } from '../../workflow/campaigns/workspace';
-import { cancelCampaign, completeCampaignWorkspace } from '../../workflow/campaigns/cleanup';
-import {
-  assertCampaignOperationSupported,
-  normalizeCampaignDependencyReferences,
-} from '../../workflow/campaigns/normalize';
 import { ensureRepositoryRuntimeStorage } from '../../../cli/repositories/runtime-storage';
 import { assessWorkMode, parseExplicitTaskMode } from '../../../cli/controller/work-mode';
 import { projectBoard } from '../../../cli/controller/issue-store';
@@ -72,16 +72,16 @@ import {
   buildControllerTaskLedgerProjection,
   writeControllerTaskLedgerArtifacts,
 } from '../../../cli/controller/task-ledger';
-import { buildControllerContextPack } from '../../../cli/controller/context-pack';
+import { buildControllerContextPack, CONTROLLER_CONTEXT_IMPACT_DOMAINS, type ControllerContextImpactDomain } from '../../../cli/controller/context-pack';
 import { legacyIssueAuthorityRetired } from '../../../cli/controller/legacy-issue-cutover';
 import { buildControllerOperationalPlan } from '../../../cli/controller/operational-plan';
-import { listControllerChecks, readLatestControllerCheckEvidence, runControllerCheck } from '../../../cli/controller/check-runner';
+import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { repositoryChangeVerify } from '../../../cli/controller/composite-operations';
 import { listActiveAgentJobSnapshots } from '../../../cli/agent-jobs/job-manager';
 import { readAgentExecutableReadinessSnapshot } from '../../../cli/agent-jobs/executable-resolver';
 import {
   commitSelectedPaths,
-  prepareFallbackHandoffArtifacts,
+  prepareTransferArtifacts,
   selectedPathDiff,
   stageSelectedPaths,
 } from '../../../cli/repositories/selected-path-actions';
@@ -284,7 +284,9 @@ export const runtimeToolDefinitions: McpToolDefinition[] = [
     known_paths: { type: 'array', items: { type: 'string' }, description: 'Optional exact paths or globs that should receive highest retrieval priority.' },
     include_globs: { type: 'array', items: { type: 'string' } },
     exclude_globs: { type: 'array', items: { type: 'string' } },
-    structural_context: { type: 'string', enum: ['off', 'auto', 'required'], description: 'Defaults to off. Use auto/required only when call graph, dependency, or impact evidence is useful.' },
+    retrieval_mode: { type: 'string', enum: ['implementation', 'plan', 'debug', 'review'], description: 'Defaults to implementation. Implementation returns current raw impact evidence for ChatGPT to judge; plan/debug/review intentionally widen evidence.' },
+    impact_domains: { type: 'array', items: { type: 'string', enum: [...CONTROLLER_CONTEXT_IMPACT_DOMAINS] }, description: 'Optional GPT-selected cross-cutting evidence dimensions. Forge expands these mechanically in the same retrieval call; it never treats them as proof of semantic completeness.' },
+    structural_context: { type: 'string', enum: ['off', 'auto', 'required'], description: 'Optional override. Defaults to auto for implementation/review and required for plan/debug.' },
     max_files: { type: 'number' },
     max_snippets: { type: 'number' },
     requested_check_ids: { type: 'array', items: { type: 'string' } },
@@ -294,16 +296,41 @@ export const runtimeToolDefinitions: McpToolDefinition[] = [
   }),
   definition('rh_work', 'Preferred ChatGPT facade: bounded planning, direct control, controller ownership, and external SuperController launch.', {
     repo_id: repoId,
-    operation: { type: 'string', enum: ['start', 'continue', 'verify', 'repair', 'finalize', 'stop', 'delegate', 'controller_claim', 'controller_release', 'controller_get_owner', 'launcher_start', 'plan_create', 'plan_get', 'plan_list', 'plan_approve', 'plan_supersede'], description: 'Defaults to start. Complex starts require plan_id and plan_step_id.' },
+    operation: { type: 'string', enum: ['start', 'continue', 'verify', 'repair', 'finalize', 'stop', 'delegate', 'controller_claim', 'controller_release', 'controller_get_owner', 'launcher_start', 'plan_create', 'plan_get', 'plan_list', 'plan_approve', 'plan_supersede', 'schedule_create', 'schedule_list', 'schedule_get', 'schedule_pause', 'schedule_resume', 'schedule_trigger'], description: 'Defaults to start. Complex starts require plan_id and plan_step_id. schedule_* manages bounded external-controller continuation for existing Work.' },
     objective: { type: 'string' },
     work_id: { type: 'string' },
     handoff_id: { type: 'string', description: 'Optional existing HandoffItem used to resume controller context.' },
     controller_id: { type: 'string', description: 'Stable external SuperController identity for controller_claim/release.' },
     controller_type: { type: 'string', enum: ['chatgpt', 'codex', 'grok', 'claude', 'human'], description: 'Controller kind for claims and launcher_start.' },
     session_id: { type: 'string', description: 'Controller-owned session identity used for an exclusive Work lease.' },
-    lease_ms: { type: 'number', description: 'Controller lease duration, bounded to one hour.' },
+    lease_ms: { type: 'number', description: 'Authenticated Controller ownership lease duration, bounded to one hour. Legacy launcher callers may still use this as a launch-reservation TTL.' },
+    launch_reservation_ms: { type: 'number', description: 'Short duplicate-spawn reservation TTL for launcher_start or schedule_create; does not grant Work ownership.' },
     executable: { type: 'string', description: 'External controller executable for launcher_start. This is owned by the Launcher, not the Kernel.' },
     launch_args: { type: 'array', items: { type: 'string' }, description: 'Provider-specific arguments for launcher_start.' },
+    browser_session_id: { type: 'string', description: 'Saved Forge ChatGPT browser session to continue when controller_type=chatgpt.' },
+    conversation_url: { type: 'string', description: 'Explicit https://chatgpt.com conversation URL used when no saved Forge browser session exists.' },
+    continuation_prompt: { type: 'string', description: 'Additional bounded continuation instruction appended to the Work/Handoff prompt.' },
+    schedule_id: { type: 'string', description: 'Schedule identity for schedule_get/pause/resume/trigger.' },
+    schedule_name: { type: 'string', description: 'Human-readable schedule name; defaults to Continue Work <work_id>.' },
+    schedule_request_id: { type: 'string', description: 'Stable idempotency key for schedule_create.' },
+    trigger_type: { type: 'string', enum: ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'] },
+    every_minutes: { type: 'number', description: 'Interval trigger cadence in minutes.' },
+    cron_expression: { type: 'string' },
+    schedule_timezone: { type: 'string' },
+    catch_up_minutes: { type: 'number' },
+    calendar_at: { type: 'string' },
+    condition: { type: 'object' },
+    event_name: { type: 'string' },
+    event_id: { type: 'string' },
+    event_data: { type: 'object' },
+    dependency_job_ids: { type: 'array', items: { type: 'string' } },
+    max_failures: { type: 'number' },
+    cooldown_minutes: { type: 'number' },
+    daily_budget_minutes: { type: 'number' },
+    shadow_mode: { type: 'boolean', description: 'Defaults to true. Set false only after the continuation path has been validated.' },
+    backoff_base_minutes: { type: 'number' },
+    backoff_max_minutes: { type: 'number' },
+    include_occurrences: { type: 'boolean' },
     plan_id: { type: 'string' },
     plan_step_id: { type: 'string', description: 'Approved PlanContract step to bind to a complex Goal Workloop start.' },
     scope_key: { type: 'string', description: 'Stable normalized scope identity used to prevent overlapping active plans.' },
@@ -405,7 +432,7 @@ export const runtimeToolDefinitions: McpToolDefinition[] = [
     paths: { type: 'array', items: { type: 'string' } },
     message: { type: 'string' },
   }, ['paths', 'message'], false),
-  definition('prepare_handoff_artifacts', 'Refresh repo-local handoff artifacts and fall back to minimal current/resume files when helper scripts are unavailable.', {
+  definition('prepare_transfer_artifacts', 'Refresh rebuildable session continuation plus a selected-path patch transfer artifact when recovery context is needed.', {
     repo_id: repoId,
     reason: { type: 'string' },
   }, [], false),
@@ -887,62 +914,6 @@ export const runtimeToolDefinitions: McpToolDefinition[] = [
     max_candidates: { type: 'number' },
     confirm_cleanup: { type: 'boolean' },
   }, [], false),
-  definition('create_campaign', 'Create a durable ChatGPT-supervised repository campaign.', {
-    repo_id: repoId,
-    checkout_id: { type: 'string', description: 'Optional source checkout used to create the Campaign workspace.' },
-    request_id: { type: 'string' },
-    semantic_key: { type: 'string' },
-    title: { type: 'string' },
-    goal: { type: 'string' },
-    acceptance_criteria: { type: 'array', items: { type: 'string' } },
-    non_goals: { type: 'array', items: { type: 'string' } },
-    review_policy: { type: 'string', enum: ['every_task', 'failures_and_final', 'final_only'] },
-    tasks: { type: 'array', items: { type: 'object' } },
-    budget: { type: 'object' },
-    supervisor: { type: 'object' },
-    workspace: { type: 'object', description: 'Workspace policy. Defaults to an isolated long-lived Campaign worktree. Set mode=current to opt out.' },
-  }, ['request_id', 'title', 'goal', 'tasks'], false),
-  definition('list_campaigns', 'List durable campaigns for one repository.', { repo_id: repoId, limit: { type: 'number' } }),
-  definition('get_campaign', 'Read one durable campaign.', { repo_id: repoId, campaign_id: { type: 'string' } }, ['campaign_id']),
-  definition('add_campaign_task', 'Add one task to a non-terminal campaign.', {
-    repo_id: repoId,
-    campaign_id: { type: 'string' },
-    request_id: { type: 'string' },
-    expected_revision: { type: 'number' },
-    task: { type: 'object' },
-  }, ['campaign_id', 'request_id', 'task'], false),
-  definition('pause_campaign', 'Pause a campaign without holding execution resources.', {
-    repo_id: repoId, campaign_id: { type: 'string' }, request_id: { type: 'string' }, expected_revision: { type: 'number' }, reason: { type: 'string' },
-  }, ['campaign_id', 'request_id'], false),
-  definition('resume_campaign', 'Resume a paused or supervisor-waiting campaign.', {
-    repo_id: repoId, campaign_id: { type: 'string' }, request_id: { type: 'string' }, expected_revision: { type: 'number' },
-  }, ['campaign_id', 'request_id'], false),
-  definition('cancel_campaign', 'Cancel a campaign and reconcile child Jobs and managed workspace resources before reaching a terminal state.', {
-    repo_id: repoId, campaign_id: { type: 'string' }, request_id: { type: 'string' }, expected_revision: { type: 'number' }, reason: { type: 'string' },
-  }, ['campaign_id', 'request_id'], false),
-  definition('get_campaign_review_packet', 'Read one bounded open review packet for ChatGPT or another supervisor.', {
-    repo_id: repoId, campaign_id: { type: 'string' }, checkpoint_id: { type: 'string' },
-  }, ['campaign_id']),
-  definition('submit_campaign_review', 'Submit one nonce- and goal-revision-bound supervisor decision.', {
-    repo_id: repoId,
-    campaign_id: { type: 'string' },
-    checkpoint_id: { type: 'string' },
-    checkpoint_nonce: { type: 'string' },
-    goal_revision: { type: 'number' },
-    expected_campaign_revision: { type: 'number' },
-    request_id: { type: 'string' },
-    action: { type: 'string', enum: ['accept', 'request_changes', 'retry', 'skip', 'pause', 'resume', 'approve_final', 'revise_goal', 'escalate'] },
-    summary: { type: 'string' },
-    instructions: { type: 'string' },
-    revised_goal: { type: 'object' },
-    submitted_by: { type: 'string' },
-  }, ['campaign_id', 'checkpoint_id', 'checkpoint_nonce', 'goal_revision', 'request_id', 'action', 'summary'], false),
-  definition('accept_campaign', 'Record human acceptance after final supervisor approval.', {
-    repo_id: repoId, campaign_id: { type: 'string' }, request_id: { type: 'string' }, expected_revision: { type: 'number' },
-  }, ['campaign_id', 'request_id'], false),
-  definition('reconcile_campaign', 'Run one bounded campaign reconciliation pass immediately.', {
-    repo_id: repoId, campaign_id: { type: 'string' },
-  }, ['campaign_id'], false),
   definition('create_schedule', 'Create a bounded repository Schedule. Shadow mode defaults to true.', {
     repo_id: repoId,
     request_id: { type: 'string' },
@@ -1542,7 +1513,7 @@ function compactControllerContextSummaryPayload(payload: Record<string, unknown>
 function authenticatedFacadeControllerIdentity(
   ctx: MultiRepositoryMcpToolContext,
   args: Record<string, unknown>,
-): { controllerId: string; principalId: string; sessionId: string; controllerInstanceId: string } {
+): { controllerId: string; principalId: string; sessionId: string; controllerInstanceId: string; controllerType: 'chatgpt' | 'codex' | 'claude' | 'grok' | 'human' } {
   const principalId = ctx.principalId?.trim();
   const sessionId = ctx.sessionId?.trim();
   if (!principalId || !sessionId) {
@@ -1556,10 +1527,18 @@ function authenticatedFacadeControllerIdentity(
   if (requestedSessionId && requestedSessionId !== sessionId) {
     throw new Error('CONTROLLER_SESSION_CONTEXT_MISMATCH: session_id must match the authenticated MCP session');
   }
+  const requestedControllerType = typeof args.controller_type === 'string' && ['chatgpt', 'codex', 'claude', 'grok', 'human'].includes(args.controller_type)
+    ? args.controller_type as 'chatgpt' | 'codex' | 'claude' | 'grok' | 'human'
+    : undefined;
+  const transportControllerType = ctx.controllerType;
+  if (transportControllerType && requestedControllerType && requestedControllerType !== transportControllerType) {
+    throw new Error('CONTROLLER_TYPE_CONTEXT_MISMATCH: controller_type must match the authenticated transport provider');
+  }
   return {
     controllerId: principalId,
     principalId,
     sessionId,
+    controllerType: transportControllerType ?? requestedControllerType ?? 'chatgpt',
     controllerInstanceId: ctx.controllerInstanceId?.trim() || currentControllerInstanceId(),
   };
 }
@@ -1709,66 +1688,6 @@ function pluginRepository(
     : selected(ctx, args);
 }
 
-const CAMPAIGN_AGENT_OPERATIONS = new Set(['dispatch_task', 'launch_issue', 'dispatch_ready_tasks', 'retry_task_run', 'quick_agent_session']);
-const CAMPAIGN_CONTROL_OPERATIONS = new Set(['create_campaign', 'add_campaign_task', 'pause_campaign', 'resume_campaign', 'cancel_campaign', 'submit_campaign_review', 'accept_campaign', 'reconcile_campaign']);
-
-function campaignAutomationDeprecated(): boolean {
-  return true;
-}
-
-function campaignTaskInput(
-  raw: unknown,
-  repoIdValue: string,
-  checkoutId?: string,
-): CreateCampaignTaskInput {
-  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('CAMPAIGN_TASK_INVALID');
-  const value = raw as Record<string, unknown>;
-  const taskId = String(value.task_id ?? value.taskId ?? '').trim();
-  const title = String(value.title ?? '').trim();
-  const rawOperation = String(value.operation ?? '').trim();
-  const operation = rawOperation ? assertCampaignOperationSupported(rawOperation) : '';
-  if (!taskId || !title || !operation) throw new Error('CAMPAIGN_TASK_INVALID: task_id, title, and operation are required');
-  if (CAMPAIGN_CONTROL_OPERATIONS.has(operation)) throw new Error(`CAMPAIGN_RECURSIVE_OPERATION_DENIED: ${operation}`);
-  const argumentsValue = value.arguments && typeof value.arguments === 'object' && !Array.isArray(value.arguments)
-    ? { ...(value.arguments as Record<string, unknown>) }
-    : {};
-  if (CAMPAIGN_AGENT_OPERATIONS.has(operation)) argumentsValue.isolate = true;
-  assertAutomatedOperationAllowed(operation, argumentsValue);
-  const requestedClaims = Array.isArray(value.resource_claims)
-    ? value.resource_claims.flatMap((rawClaim) => {
-      if (!rawClaim || typeof rawClaim !== 'object') return [];
-      const claim = rawClaim as Record<string, unknown>;
-      const resourceKey = String(claim.resource_key ?? claim.resourceKey ?? '').trim();
-      const mode = String(claim.mode ?? 'write');
-      if (!resourceKey || !['read', 'write', 'exclusive'].includes(mode)) return [];
-      return [{ resourceKey, mode: mode as 'read' | 'write' | 'exclusive' }];
-    })
-    : [];
-  const executor = value.executor && typeof value.executor === 'object' && !Array.isArray(value.executor)
-    ? value.executor as Record<string, unknown>
-    : undefined;
-  return {
-    taskId,
-    title,
-    objective: typeof value.objective === 'string' ? value.objective : undefined,
-    operation,
-    arguments: argumentsValue,
-    dependsOn: normalizeCampaignDependencyReferences(Array.isArray(value.depends_on ?? value.dependsOn) ? (value.depends_on ?? value.dependsOn) as unknown[] : []),
-    priority: ['P0', 'P1', 'P2', 'P3', 'P4'].includes(String(value.priority)) ? String(value.priority) as 'P0' | 'P1' | 'P2' | 'P3' | 'P4' : 'P1',
-    resourceClaims: requestedClaims.length > 0 ? requestedClaims : claimsForMcpOperation(operation, argumentsValue, repoIdValue, checkoutId),
-    reviewRequired: value.review_required === undefined ? true : value.review_required === true,
-    requiresChanges: value.requires_changes === true || value.requiresChanges === true,
-    maxAttempts: typeof value.max_attempts === 'number' ? value.max_attempts : undefined,
-    executor: executor ? {
-      enableDevRunner: executor.enable_dev_runner === undefined ? undefined : executor.enable_dev_runner === true,
-      enableChatgptBrowser: executor.enable_chatgpt_browser === true,
-      allowedAgents: Array.isArray(executor.allowed_agents) ? executor.allowed_agents.map(String) : undefined,
-      runnerTimeoutMs: typeof executor.runner_timeout_ms === 'number' ? executor.runner_timeout_ms : undefined,
-      runnerMaxTimeoutMs: typeof executor.runner_max_timeout_ms === 'number' ? executor.runner_max_timeout_ms : undefined,
-    } : undefined,
-  };
-}
-
 function expectedRevision(args: Record<string, unknown>, key = 'expected_revision'): number | undefined {
   return typeof args[key] === 'number' ? Math.trunc(args[key] as number) : undefined;
 }
@@ -2574,11 +2493,11 @@ async function runFacadeRepair(
   return result(facade as unknown as Record<string, unknown>, facade.status === 'blocked' || facade.status === 'approval_required' || facade.status === 'failed');
 }
 
-function runFacadeVerify(
+async function runFacadeVerify(
   ctx: MultiRepositoryMcpToolContext,
   repository: ReturnType<typeof selected>,
   args: Record<string, unknown>,
-): CallToolResult {
+): Promise<CallToolResult> {
   const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
   const checks = listControllerChecks(repository.canonicalRoot);
   const workloopCtx = {
@@ -2643,16 +2562,166 @@ function runFacadeVerify(
     return result(facade as unknown as Record<string, unknown>, facade.status === 'failed');
   }
 
-  // Real registered check execution path.
+  // Real checks share the same persisted Process Runtime path as run_check and
+  // work_validate. Never synchronously block the MCP facade on long native tests.
   try {
-    const executed = runControllerCheck(repository.canonicalRoot, classified.normalizedCheckId!);
-    const infrastructureFailed = executed.failureClass === 'infrastructure_failure'
-      || executed.timedOut === true;
-    const checkFailed = !executed.ok && !infrastructureFailed;
+    const normalizedCheckId = classified.normalizedCheckId!;
+    const requestId = typeof args.request_id === 'string' && args.request_id.trim()
+      ? args.request_id.trim()
+      : undefined;
+    const observedGitHead = repositoryGitStatus(repository).head;
+    const workContract = workId ? getWorkContract(store, workId) : undefined;
+    if (workId && !workContract) throw new Error(`WORK_NOT_FOUND: ${workId}`);
+    const executed = await runPersistedCheckViaProcessRuntime({
+      controllerHome: ctx.controllerHome,
+      repoId: repository.repoId,
+      checkoutId: repository.activeCheckoutId,
+      repoRoot: repository.canonicalRoot,
+      executionIdentity: executionIdentityForRepository(repository, workId ? { workId } : {}),
+      checkId: normalizedCheckId,
+      timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
+      // rh_work.verify is a control-plane continuation primitive: callers should
+      // be able to keep working and later reattach to the exact same Process.
+      interactiveWaitMs: 0,
+      requestId,
+      workId: workId || undefined,
+      commandId: requestId,
+      verificationSnapshot: workContract ? {
+        workId: workContract.workId,
+        allowedPaths: workContract.allowedPaths,
+        forbiddenPaths: workContract.forbiddenPaths,
+      } : undefined,
+    });
+
+    if (executed.mode === 'durable') {
+      return result(buildFacadeResult({
+        status: 'blocked',
+        summary: `Check ${normalizedCheckId} requires an explicit durable workflow; no acceptance result was recorded.`,
+        data: {
+          verification: {
+            checkId: normalizedCheckId,
+            outcome: 'deferred',
+            isAcceptanceFailure: false,
+            isInfrastructureIssue: false,
+            durable: executed.durable,
+            observedGitHead,
+          },
+        },
+        suggestedNextActions: [{
+          label: 'Continue Work with the durable check requirement',
+          tool: 'rh_work',
+          operation: 'continue',
+          payload: { work_id: workId || undefined },
+          risk: 'workspace_write',
+          confidence: 'high',
+        }],
+      }) as unknown as Record<string, unknown>, true);
+    }
+
+    const handle = executed.process;
+    if (!handle) throw new Error(`PROCESS_CHECK_HANDLE_MISSING: ${normalizedCheckId}`);
+    const record = getProcessRecord(ctx.controllerHome, repository.repoId, handle.processId);
+    const checkContentRevision = record?.checkExecution?.revision;
+
+    if (!handle.completed) {
+      return result(buildFacadeResult({
+        status: 'ok',
+        summary: `Check ${normalizedCheckId} is running through Process Runtime; continue other work and reattach to ${handle.processId}.`,
+        data: {
+          verification: {
+            checkId: normalizedCheckId,
+            outcome: 'running',
+            isAcceptanceFailure: false,
+            isInfrastructureIssue: false,
+            executed: true,
+            completed: false,
+            processId: handle.processId,
+            processStatus: handle.status,
+            deduplicated: handle.deduplicated === true,
+            semanticDeduplicated: handle.semanticDeduplicated === true,
+            checkContentRevision,
+            observedGitHead,
+            verificationIsolation: workContract ? 'work_snapshot' : 'shared_checkout',
+            revisionSemantics: 'checkContentRevision is a content-bound Check identity; observedGitHead is Git HEAD and is not interchangeable.',
+          },
+        },
+        rawAvailable: false,
+      }) as unknown as Record<string, unknown>);
+    }
+
+    if (!record) throw new Error(`PROCESS_CHECK_RECORD_MISSING: ${handle.processId}`);
+    const receipt = processCheckCompletionReceipt(record, {
+      repoId: repository.repoId,
+      checkId: normalizedCheckId,
+      processId: handle.processId,
+      ...(record.checkExecution ? {
+        checkoutId: repository.activeCheckoutId,
+        workId: workId || undefined,
+        requestId,
+        checkExecution: {
+          cacheKey: record.checkExecution.cacheKey,
+          revision: record.checkExecution.revision,
+          definitionDigest: record.checkExecution.definitionDigest,
+          environmentFingerprint: record.checkExecution.environmentFingerprint,
+          timeoutMs: record.checkExecution.timeoutMs,
+          scopeKey: record.checkExecution.scopeKey,
+        },
+      } : {}),
+    });
+    const structuredCheckResult = readPersistedCheckResultReceipt(record.origin?.checkResultReceiptPath);
+    const structuredResultMatchesProcess = Boolean(
+      structuredCheckResult
+      && record.checkExecution?.cacheKey
+      && structuredCheckResult.checkId === normalizedCheckId
+      && structuredCheckResult.cacheKey === record.checkExecution.cacheKey,
+    );
+    const legacyEvidence = record.origin?.checkResultReceiptPath
+      ? undefined
+      : readLatestControllerCheckEvidence(repository.canonicalRoot, normalizedCheckId);
+    const legacyEvidenceMatchesProcess = Boolean(
+      legacyEvidence?.cacheKey
+      && record.checkExecution?.cacheKey
+      && legacyEvidence.cacheKey === record.checkExecution.cacheKey,
+    );
+    const resultMatchesProcess = structuredResultMatchesProcess || legacyEvidenceMatchesProcess;
+    const failureClass = structuredResultMatchesProcess
+      ? structuredCheckResult?.failureClass
+      : legacyEvidenceMatchesProcess ? legacyEvidence?.failureClass : undefined;
+    const infrastructureFailed = receipt.timedOut
+      || receipt.cancelled
+      || !resultMatchesProcess
+      || (!receipt.ok && failureClass !== 'acceptance_failure');
+    const checkFailed = !receipt.ok && !infrastructureFailed;
+    const boundedStatus = receipt.ok ? 'pass' : infrastructureFailed ? 'infrastructure_failure' : 'fail';
+    const commonVerification = {
+      checkId: normalizedCheckId,
+      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
+      isAcceptanceFailure: checkFailed,
+      isInfrastructureIssue: infrastructureFailed,
+      executed: true,
+      completed: true,
+      processId: receipt.processId,
+      processStatus: receipt.runtimeStatus,
+      ok: receipt.ok,
+      timedOut: receipt.timedOut,
+      cancelled: receipt.cancelled,
+      failureClass: infrastructureFailed ? 'infrastructure_failure' : failureClass,
+      deduplicated: handle.deduplicated === true,
+      semanticDeduplicated: handle.semanticDeduplicated === true,
+      checkContentRevision: receipt.checkRevision,
+      observedGitHead,
+      revisionSemantics: 'checkContentRevision is a content-bound Check identity; observedGitHead is Git HEAD and is not interchangeable.',
+      evidenceArtifactPath: record.origin?.workVerificationSnapshot ? undefined : receipt.artifactPath,
+      evidenceReceiptId: receipt.receiptId,
+      checkResultReceiptId: structuredCheckResult?.receiptId,
+      verificationIsolation: record.origin?.workVerificationSnapshot ? 'work_snapshot' : 'shared_checkout',
+      boundedStatus,
+    };
+
     if (workId) {
       const facade = verifyGoalWorkloop(workloopCtx, {
         workId,
-        checkId: classified.normalizedCheckId!,
+        checkId: normalizedCheckId,
         infrastructureFailed,
         checkFailed,
       });
@@ -2663,46 +2732,26 @@ function runFacadeVerify(
           ...data,
           verification: {
             ...(typeof data.verification === 'object' && data.verification ? data.verification as Record<string, unknown> : {}),
-            executed: true,
-            registeredCheckId: classified.normalizedCheckId,
-            ok: executed.ok,
-            timedOut: executed.timedOut,
-            failureClass: executed.failureClass,
-            cacheHit: executed.cacheHit,
-            validatedRevision: executed.validatedRevision,
-            originalExecutedAt: executed.originalExecutedAt,
-            // Never return raw stdout/stderr to ChatGPT by default.
-            evidenceArtifactPath: executed.artifactPath,
-            boundedStatus: executed.ok ? 'pass' : infrastructureFailed ? 'infrastructure_failure' : 'fail',
+            ...commonVerification,
           },
         },
+        warnings: infrastructureFailed
+          ? [...facade.warnings, resultMatchesProcess ? 'infrastructure_failure is distinct from acceptance failure' : 'check result receipt did not match the terminal Process semantic identity']
+          : facade.warnings,
       } as unknown as Record<string, unknown>, facade.status === 'failed');
     }
+
     return result(buildFacadeResult({
       status: checkFailed ? 'failed' : 'ok',
       summary: infrastructureFailed
-        ? `Infrastructure failure while running ${classified.normalizedCheckId}; not an acceptance failure.`
-        : executed.ok
-          ? `Check ${classified.normalizedCheckId} passed.`
-          : `Check ${classified.normalizedCheckId} failed acceptance.`,
-      data: {
-        verification: {
-          checkId: classified.normalizedCheckId,
-          outcome: infrastructureFailed ? 'infrastructure_failure' : executed.ok ? 'valid_pass' : 'valid_fail',
-          isAcceptanceFailure: checkFailed,
-          isInfrastructureIssue: infrastructureFailed,
-          executed: true,
-          evidenceArtifactPath: executed.artifactPath,
-          cacheHit: executed.cacheHit,
-          validatedRevision: executed.validatedRevision,
-          originalExecutedAt: executed.originalExecutedAt,
-          failureClass: executed.failureClass,
-        },
-      },
-      warnings: infrastructureFailed ? ['infrastructure_failure is distinct from acceptance failure'] : [],
-      suggestedNextActions: executed.ok
-        ? [{ label: 'Continue work', tool: 'rh_work', operation: 'continue', payload: { work_id: workId || undefined }, risk: 'readonly' }]
-        : [{ label: 'Diagnose if infrastructure', tool: 'rh_work', operation: 'repair', payload: { repair_operation: 'diagnose', dry_run: true }, risk: 'readonly' }],
+        ? `Infrastructure failure while running ${normalizedCheckId}; not an acceptance failure.`
+        : receipt.ok
+          ? `Check ${normalizedCheckId} passed with persisted Process evidence.`
+          : `Check ${normalizedCheckId} failed acceptance.`,
+      data: { verification: commonVerification },
+      warnings: infrastructureFailed
+        ? [resultMatchesProcess ? 'infrastructure_failure is distinct from acceptance failure' : 'check result receipt did not match the terminal Process semantic identity']
+        : [],
       rawAvailable: false,
     }) as unknown as Record<string, unknown>, checkFailed);
   } catch (error) {
@@ -2724,7 +2773,7 @@ function runFacadeVerify(
     }
     return result(buildFacadeResult({
       status: 'ok',
-      summary: `Infrastructure failure invoking check runner for ${classified.normalizedCheckId}; not acceptance failure.`,
+      summary: `Infrastructure failure invoking Process Runtime for ${classified.normalizedCheckId}; not acceptance failure.`,
       data: {
         verification: {
           checkId: classified.normalizedCheckId,
@@ -2993,7 +3042,15 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             recommendedContinuationPrompt: typeof args.recommended_continuation_prompt === 'string' ? args.recommended_continuation_prompt : undefined,
             suggestedNextActions: [],
           });
-          return result(buildFacadeResult({ summary: `Created handoff ${item.id}.`, data: { item: summarizeHandoffItem(item) } }) as unknown as Record<string, unknown>);
+          let ownershipReleased = false;
+          if (item.workId && ctx.principalId?.trim() && ctx.sessionId?.trim()) {
+            const owner = getControllerSession(store, item.workId);
+            if (owner && owner.controllerId === ctx.principalId.trim() && owner.sessionId === ctx.sessionId.trim()) {
+              releaseControllerSession(store, item.workId, owner.controllerId);
+              ownershipReleased = true;
+            }
+          }
+          return result(buildFacadeResult({ summary: `Created handoff ${item.id}.`, data: { item: summarizeHandoffItem(item), ownershipReleased } }) as unknown as Record<string, unknown>);
         }
         // Default list: pending summary only.
         const items = listHandoffItems({ ...store, status: 'pending', limit: typeof args.limit === 'number' ? args.limit : 50 });
@@ -3023,9 +3080,16 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           const list = (value: unknown): string[] => Array.isArray(value)
             ? value.map(String).map((entry) => entry.trim()).filter(Boolean)
             : [];
-          const structuralContext = args.structural_context === 'auto' || args.structural_context === 'required'
+          const retrievalMode = args.retrieval_mode === 'plan' || args.retrieval_mode === 'debug' || args.retrieval_mode === 'review'
+            ? args.retrieval_mode
+            : 'implementation';
+          const impactDomains = list(args.impact_domains)
+            .filter((domain): domain is ControllerContextImpactDomain => CONTROLLER_CONTEXT_IMPACT_DOMAINS.includes(domain as ControllerContextImpactDomain));
+          const structuralContext = args.structural_context === 'off' || args.structural_context === 'auto' || args.structural_context === 'required'
             ? args.structural_context
-            : 'off';
+            : retrievalMode === 'plan' || retrievalMode === 'debug'
+              ? 'required'
+              : 'auto';
           const pack = buildControllerContextPack(repository.canonicalRoot, ctx.policy, {
             description: query,
             searchTerms: [query],
@@ -3035,6 +3099,8 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             maxFiles: typeof args.max_files === 'number' ? args.max_files : undefined,
             maxSnippets: typeof args.max_snippets === 'number' ? args.max_snippets : undefined,
             structuralContext,
+            retrievalMode,
+            impactDomains,
           });
           const warnings = structuralContext === 'required' && !pack.structuralContext.requiredSatisfied
             ? [pack.structuralContext.fallbackReason ?? 'Required structural context is not ready; lexical retrieval results are returned as degraded evidence.']
@@ -3308,6 +3374,78 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         if (!allowedFacadeOperations('rh_work').includes(operation)) {
           return invalidFacadeOperation('rh_work', operation);
         }
+        if (operation.startsWith('schedule_')) {
+          try {
+            const workId = String(args.work_id ?? '').trim();
+            const scheduleId = String(args.schedule_id ?? '').trim();
+            if (operation === 'schedule_create') {
+              const controllerType = String(args.controller_type ?? 'chatgpt').trim();
+              if (!['chatgpt', 'codex', 'claude', 'grok'].includes(controllerType)) throw new Error('CONTROLLER_TYPE_INVALID');
+              const triggerTypeRaw = String(args.trigger_type ?? '').trim();
+              const triggerType = ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'].includes(triggerTypeRaw)
+                ? triggerTypeRaw as 'interval' | 'cron' | 'calendar' | 'condition' | 'repository-event' | 'dependency-checkpoint' | 'manual'
+                : undefined;
+              const created = createWorkContinuationSchedule(ctx.controllerHome, repository.repoId, {
+                workId,
+                controllerType: controllerType as ContinuationControllerType,
+                executable: typeof args.executable === 'string' ? args.executable : undefined,
+                launchArgs: Array.isArray(args.launch_args) ? args.launch_args.map(String) : undefined,
+                launchReservationMs: typeof args.launch_reservation_ms === 'number' ? args.launch_reservation_ms : typeof args.lease_ms === 'number' ? args.lease_ms : undefined,
+                handoffId: typeof args.handoff_id === 'string' ? args.handoff_id : undefined,
+                browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
+                conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
+                continuationPrompt: typeof args.continuation_prompt === 'string' ? args.continuation_prompt : undefined,
+                scheduleName: typeof args.schedule_name === 'string' ? args.schedule_name : undefined,
+                requestId: typeof args.schedule_request_id === 'string' ? args.schedule_request_id : undefined,
+                triggerType,
+                everyMinutes: typeof args.every_minutes === 'number' ? args.every_minutes : undefined,
+                cronExpression: typeof args.cron_expression === 'string' ? args.cron_expression : undefined,
+                timezone: typeof args.schedule_timezone === 'string' ? args.schedule_timezone : undefined,
+                catchUpMinutes: typeof args.catch_up_minutes === 'number' ? args.catch_up_minutes : undefined,
+                calendarAt: typeof args.calendar_at === 'string' ? args.calendar_at : undefined,
+                condition: args.condition && typeof args.condition === 'object' && !Array.isArray(args.condition) ? args.condition as never : undefined,
+                eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
+                dependencyJobIds: Array.isArray(args.dependency_job_ids) ? args.dependency_job_ids.map(String) : undefined,
+                maxFailures: typeof args.max_failures === 'number' ? args.max_failures : undefined,
+                cooldownMinutes: typeof args.cooldown_minutes === 'number' ? args.cooldown_minutes : undefined,
+                dailyBudgetMinutes: typeof args.daily_budget_minutes === 'number' ? args.daily_budget_minutes : undefined,
+                shadowMode: typeof args.shadow_mode === 'boolean' ? args.shadow_mode : undefined,
+                backoffBaseMinutes: typeof args.backoff_base_minutes === 'number' ? args.backoff_base_minutes : undefined,
+                backoffMaxMinutes: typeof args.backoff_max_minutes === 'number' ? args.backoff_max_minutes : undefined,
+                stopConditions: Array.isArray(args.stop_conditions) ? args.stop_conditions.map(String) : undefined,
+              });
+              return result(buildFacadeResult({ summary: `Continuation schedule ${created.schedule.scheduleId} is configured for Work ${workId}.`, data: { schedule: created.schedule, work: buildWorkContinuationSnapshot(created.work) } }) as unknown as Record<string, unknown>);
+            }
+            if (operation === 'schedule_list') {
+              const listed = listWorkContinuationSchedules(ctx.controllerHome, repository.repoId, { workId: workId || undefined, includeOccurrences: args.include_occurrences === true });
+              return result(buildFacadeResult({ summary: `Found ${listed.schedules.length} Work continuation schedule(s).`, data: listed }) as unknown as Record<string, unknown>);
+            }
+            if (!scheduleId) throw new Error('SCHEDULE_ID_REQUIRED');
+            if (operation === 'schedule_get') {
+              const fetched = getWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, args.include_occurrences === true);
+              return result(buildFacadeResult({ summary: `Continuation schedule ${scheduleId}.`, data: fetched }) as unknown as Record<string, unknown>);
+            }
+            if (operation === 'schedule_pause') {
+              const schedule = pauseWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, typeof args.reason === 'string' ? args.reason : undefined);
+              return result(buildFacadeResult({ summary: `Continuation schedule ${scheduleId} is paused.`, data: { schedule } }) as unknown as Record<string, unknown>);
+            }
+            if (operation === 'schedule_resume') {
+              const schedule = resumeWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId);
+              return result(buildFacadeResult({ summary: `Continuation schedule ${scheduleId} is resumed.`, data: { schedule } }) as unknown as Record<string, unknown>);
+            }
+            if (operation === 'schedule_trigger') {
+              const occurrence = await triggerWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, {
+                source: typeof args.event_name === 'string' && args.event_name.trim() ? 'repository-event' : 'manual',
+                eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
+                eventId: typeof args.event_id === 'string' ? args.event_id : undefined,
+                data: args.event_data && typeof args.event_data === 'object' && !Array.isArray(args.event_data) ? args.event_data as Record<string, unknown> : undefined,
+              });
+              return result(buildFacadeResult({ summary: occurrence ? `Continuation schedule ${scheduleId} produced ${occurrence.decision}.` : `Continuation schedule ${scheduleId} produced no occurrence.`, data: { occurrence } }) as unknown as Record<string, unknown>);
+            }
+          } catch (error) {
+            return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Schedule operation failed.', data: {} }) as unknown as Record<string, unknown>, true);
+          }
+        }
         if (operation === 'controller_get_owner') {
           const owner = getControllerSession(store, String(args.work_id ?? '').trim());
           return result(buildFacadeResult({ summary: owner ? `Work is claimed by ${owner.controllerId}.` : 'Work has no active controller owner.', data: { owner } }) as unknown as Record<string, unknown>);
@@ -3354,13 +3492,14 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               executable: typeof args.executable === 'string' && args.executable.trim() ? args.executable.trim() : undefined,
               args: Array.isArray(args.launch_args) ? args.launch_args.map(String) : [],
               workId: String(args.work_id ?? '').trim(),
-              controllerId: String(args.controller_id ?? '').trim(),
-              sessionId: String(args.session_id ?? '').trim(),
-              leaseMs: typeof args.lease_ms === 'number' ? args.lease_ms : undefined,
+              launchReservationMs: typeof args.launch_reservation_ms === 'number' ? args.launch_reservation_ms : typeof args.lease_ms === 'number' ? args.lease_ms : undefined,
               handoffId: typeof args.handoff_id === 'string' ? args.handoff_id : undefined,
+              browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
+              conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
+              continuationPrompt: typeof args.continuation_prompt === 'string' ? args.continuation_prompt : undefined,
               cwd: repository.canonicalRoot,
             });
-            return result(buildFacadeResult({ summary: `Thin Launcher started ${launched.controllerType}.`, data: { pid: launched.pid, executable: launched.executable, workId: String(args.work_id ?? ''), controllerId: launched.controllerId, sessionId: launched.sessionId } }) as unknown as Record<string, unknown>);
+            return result(buildFacadeResult({ summary: `Thin Launcher started ${launched.controllerType}.`, data: { pid: launched.pid, executable: launched.executable, workId: String(args.work_id ?? ''), reservationId: launched.reservationId } }) as unknown as Record<string, unknown>);
           } catch (error) {
             return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Launcher failed.', data: {} }) as unknown as Record<string, unknown>, true);
           }
@@ -3449,7 +3588,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         }
 
         if (operation === 'verify') {
-          return runFacadeVerify(ctx, repository, args);
+          return await runFacadeVerify(ctx, repository, args);
         }
 
         if (operation === 'delegate') {
@@ -3555,7 +3694,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               resumedControllerSession = resumeControllerSession(store, {
                 workId,
                 controllerId: identity.controllerId,
-                controllerType: currentOwner?.controllerType ?? 'chatgpt',
+                controllerType: identity.controllerType,
                 sessionId: identity.sessionId,
                 principalId: identity.principalId,
                 controllerInstanceId: identity.controllerInstanceId,
@@ -3896,17 +4035,17 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           ...(directEditWorkCompletion ? { directEditWorkCompletion } : {}),
         }, Boolean(committed.error));
       }
-      case 'prepare_handoff_artifacts': {
+      case 'prepare_transfer_artifacts': {
         const repository = selected(ctx, args);
-        const handoff = prepareFallbackHandoffArtifacts(repository, { reason: args.reason });
+        const transfer = prepareTransferArtifacts(repository, { reason: args.reason });
         const taskLedger = writeControllerTaskLedgerArtifacts(repository.canonicalRoot, { reason: args.reason });
         return result({
           repoId: repository.repoId,
           checkoutId: repository.activeCheckoutId,
-          ...handoff,
+          ...transfer,
           taskLedger: taskLedger.projection,
           artifacts: [
-            ...handoff.artifacts,
+            ...transfer.artifacts,
             ...taskLedger.artifacts,
           ],
         });
@@ -5109,8 +5248,8 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             break;
           }
           case 'recovery.create_patch_handoff':
-            payload = prepareFallbackHandoffArtifacts(repository, { reason }) as unknown as Record<string, unknown>;
-            affectedPaths = ['.ai/handoff'];
+            payload = prepareTransferArtifacts(repository, { reason }) as unknown as Record<string, unknown>;
+            affectedPaths = ['.ai/harness/transfers', '.ai/harness/session'];
             break;
           case 'recovery.workspace_auth_login_prepare':
             payload = { skipped: true, nextTool: 'workspace_auth_login_prepare', reason: 'Auth login is a non-secret handoff and should be prepared through the dedicated typed tool.' };
@@ -5601,223 +5740,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           model: typeof args.model === 'string' ? args.model : undefined,
         }) });
       }
-      case 'create_campaign': {
-        const repository = selected(ctx, args);
-        if (campaignAutomationDeprecated()) {
-          return result({
-            error: {
-              code: 'CAMPAIGN_DEPRECATED',
-              message: 'Campaign creation is retired. Create a PlanContract and WorkContracts, then launch an external Controller.',
-            },
-            deprecated: true,
-            migration: ['rh_work.plan_create', 'rh_work.plan_approve', 'rh_work.controller_claim', 'rh_work.launcher_start'],
-            repoId: repository.repoId,
-          }, true);
-        }
-        const rawTasks = Array.isArray(args.tasks) ? args.tasks : [];
-        const requestId = String(args.request_id ?? '').trim();
-        const title = String(args.title ?? '').trim();
-        const goal = String(args.goal ?? '').trim();
-        if (!requestId) throw new Error('CAMPAIGN_REQUEST_ID_REQUIRED');
-        if (!title) throw new Error('CAMPAIGN_TITLE_REQUIRED');
-        if (!goal) throw new Error('CAMPAIGN_GOAL_REQUIRED');
-        const budget = args.budget && typeof args.budget === 'object' && !Array.isArray(args.budget)
-          ? args.budget as Record<string, unknown>
-          : {};
-        const budgetInput = {
-          maxParallelTasks: typeof budget.max_parallel_tasks === 'number' ? budget.max_parallel_tasks : undefined,
-          maxExecutionJobs: typeof budget.max_execution_jobs === 'number' ? budget.max_execution_jobs : undefined,
-          maxSupervisorReviews: typeof budget.max_supervisor_reviews === 'number' ? budget.max_supervisor_reviews : undefined,
-          defaultTaskMaxAttempts: typeof budget.default_task_max_attempts === 'number' ? budget.default_task_max_attempts : undefined,
-          taskTimeoutMs: typeof budget.task_timeout_ms === 'number' ? budget.task_timeout_ms : undefined,
-          retryBaseDelayMs: typeof budget.retry_base_delay_ms === 'number' ? budget.retry_base_delay_ms : undefined,
-          retryMaxDelayMs: typeof budget.retry_max_delay_ms === 'number' ? budget.retry_max_delay_ms : undefined,
-          reviewPacketMaxBytes: typeof budget.review_packet_max_bytes === 'number' ? budget.review_packet_max_bytes : undefined,
-        };
-        // Validate task shape, DAG, and governance before creating any Git refs or worktrees.
-        const sourceTasks = rawTasks.map((task) => campaignTaskInput(task, repository.repoId, repository.activeCheckoutId));
-        validateCreateCampaignTasks(sourceTasks, budgetInput);
-        // Validate supervisor policy before allocating a Git worktree. Invalid
-        // recursive or external-effect operations must leave no workspace behind.
-        const supervisor = args.supervisor && typeof args.supervisor === 'object' && !Array.isArray(args.supervisor)
-          ? args.supervisor as Record<string, unknown>
-          : {};
-        const supervisorMode = supervisor.mode === 'operation'
-          ? 'operation'
-          : supervisor.mode === 'workspace_agent' ? 'workspace_agent' : 'pull';
-        const supervisorOperation = typeof supervisor.operation === 'string' && supervisor.operation.trim()
-          ? assertCampaignOperationSupported(supervisor.operation)
-          : undefined;
-        const workspaceAgentId = typeof supervisor.workspace_agent_id === 'string'
-          ? supervisor.workspace_agent_id.trim()
-          : typeof supervisor.workspaceAgentId === 'string' ? supervisor.workspaceAgentId.trim() : undefined;
-        const conversationKey = typeof supervisor.conversation_key === 'string'
-          ? supervisor.conversation_key.trim()
-          : typeof supervisor.conversationKey === 'string' ? supervisor.conversationKey.trim() : undefined;
-        const supervisorArguments = supervisor.arguments && typeof supervisor.arguments === 'object' && !Array.isArray(supervisor.arguments)
-          ? supervisor.arguments as Record<string, unknown>
-          : undefined;
-        if (supervisorOperation) {
-          if (CAMPAIGN_CONTROL_OPERATIONS.has(supervisorOperation)) throw new Error(`CAMPAIGN_RECURSIVE_OPERATION_DENIED: ${supervisorOperation}`);
-          assertAutomatedOperationAllowed(supervisorOperation, supervisorArguments ?? {});
-        }
-        if (supervisorMode === 'operation' && !supervisorOperation) throw new Error('CAMPAIGN_SUPERVISOR_OPERATION_REQUIRED');
-        if (supervisorMode === 'workspace_agent' && !workspaceAgentId) throw new Error('CAMPAIGN_WORKSPACE_AGENT_ID_REQUIRED');
-
-        const workspaceInput = args.workspace && typeof args.workspace === 'object' && !Array.isArray(args.workspace)
-          ? args.workspace as Record<string, unknown>
-          : {};
-        const workspaceMode = workspaceInput.mode === 'current' ? 'current' : 'isolated';
-        const workspace = workspaceMode === 'current'
-          ? currentCampaignWorkspace(repository)
-          : ensureCampaignWorkspace(ctx.controllerHome, repository, {
-            requestId,
-            title,
-            baseRef: typeof workspaceInput.base_ref === 'string'
-              ? workspaceInput.base_ref
-              : typeof workspaceInput.baseRef === 'string' ? workspaceInput.baseRef : undefined,
-            branchName: typeof workspaceInput.branch_name === 'string'
-              ? workspaceInput.branch_name
-              : typeof workspaceInput.branchName === 'string' ? workspaceInput.branchName : undefined,
-          });
-        const campaignCheckoutId = workspace.checkoutId ?? repository.activeCheckoutId;
-        const campaign = createCampaign(ctx.controllerHome, {
-          repoId: repository.repoId,
-          checkoutId: campaignCheckoutId,
-          workspace,
-          requestId,
-          semanticKey: typeof args.semantic_key === 'string' && args.semantic_key.trim()
-            ? args.semantic_key.trim()
-            : `campaign:${repository.repoId}:${createHash('sha256').update(`${String(args.title ?? '')}:${String(args.goal ?? '')}`).digest('hex').slice(0, 20)}`,
-          title,
-          goal,
-          acceptanceCriteria: stringList(args.acceptance_criteria),
-          nonGoals: stringList(args.non_goals),
-          reviewPolicy: ['every_task', 'failures_and_final', 'final_only'].includes(String(args.review_policy))
-            ? String(args.review_policy) as CampaignReviewPolicy
-            : 'every_task',
-          tasks: rawTasks.map((task) => campaignTaskInput(task, repository.repoId, campaignCheckoutId)),
-          budget: budgetInput,
-          supervisor: {
-            mode: supervisorMode,
-            operation: supervisorMode === 'operation' ? supervisorOperation : undefined,
-            workspaceAgentId: supervisorMode === 'workspace_agent' ? workspaceAgentId : undefined,
-            conversationKey: supervisorMode === 'workspace_agent' ? conversationKey : undefined,
-            arguments: supervisorMode === 'operation' ? supervisorArguments : undefined,
-            priority: ['P0', 'P1', 'P2', 'P3', 'P4'].includes(String(supervisor.priority)) ? String(supervisor.priority) as 'P0' | 'P1' | 'P2' | 'P3' | 'P4' : undefined,
-            resourceClaims: supervisorMode === 'operation' && supervisorOperation
-              ? claimsForMcpOperation(supervisorOperation, supervisorArguments ?? {}, repository.repoId, campaignCheckoutId)
-              : undefined,
-            triggerCooldownMs: typeof supervisor.trigger_cooldown_ms === 'number' ? supervisor.trigger_cooldown_ms : undefined,
-            maxTriggerAttempts: typeof supervisor.max_trigger_attempts === 'number' ? supervisor.max_trigger_attempts : undefined,
-            decisionTimeoutMs: typeof supervisor.decision_timeout_ms === 'number' ? supervisor.decision_timeout_ms : undefined,
-          },
-          createdBy: 'chatgpt',
-        });
-        return result({ ...campaign, next: 'Use get_campaign_review_packet when the campaign opens a checkpoint.' });
-      }
-      case 'list_campaigns': {
-        const repository = selected(ctx, args);
-        return result({ campaigns: listCampaigns(ctx.controllerHome, repository.repoId, typeof args.limit === 'number' ? args.limit : 100) });
-      }
-      case 'get_campaign': {
-        const repository = selected(ctx, args);
-        return result({ campaign: getCampaign(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? '')) });
-      }
-      case 'add_campaign_task': {
-        const repository = selected(ctx, args);
-        if (campaignAutomationDeprecated()) {
-          return result({
-            error: { code: 'CAMPAIGN_DEPRECATED', message: 'Campaign task creation is retired. Add a WorkContract to an approved PlanContract instead.' },
-            deprecated: true,
-            repoId: repository.repoId,
-          }, true);
-        }
-        const campaignId = String(args.campaign_id ?? '');
-        const existingCampaign = getCampaign(ctx.controllerHome, repository.repoId, campaignId);
-        const campaign = addCampaignTask(
-          ctx.controllerHome,
-          repository.repoId,
-          campaignId,
-          String(args.request_id ?? ''),
-          campaignTaskInput(args.task, repository.repoId, existingCampaign.checkoutId),
-          expectedRevision(args),
-        );
-        return result({ campaign });
-      }
-      case 'pause_campaign': {
-        const repository = selected(ctx, args);
-        return result({ campaign: setCampaignStatus(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''), String(args.request_id ?? ''), 'paused', typeof args.reason === 'string' ? args.reason : undefined, expectedRevision(args)) });
-      }
-      case 'resume_campaign': {
-        const repository = selected(ctx, args);
-        if (campaignAutomationDeprecated()) {
-          return result({
-            error: { code: 'CAMPAIGN_DEPRECATED', message: 'Campaign automation cannot be resumed. Use reconcile_campaign once to migrate outstanding tasks to WorkContracts.' },
-            deprecated: true,
-            repoId: repository.repoId,
-          }, true);
-        }
-        const campaign = setCampaignStatus(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''), String(args.request_id ?? ''), 'active', undefined, expectedRevision(args));
-        return result({ campaign, warning: 'Campaign reconcile is frozen; use reconcile_campaign once to migrate pending tasks to WorkContracts.' });
-      }
-      case 'cancel_campaign': {
-        const repository = selected(ctx, args);
-        return result({ campaign: await cancelCampaign(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''), String(args.request_id ?? ''), typeof args.reason === 'string' ? args.reason : undefined, expectedRevision(args)) });
-      }
-      case 'get_campaign_review_packet': {
-        const repository = selected(ctx, args);
-        const campaign = getCampaign(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''));
-        const checkpointId = typeof args.checkpoint_id === 'string' && args.checkpoint_id.trim()
-          ? args.checkpoint_id.trim()
-          : campaign.checkpoints.filter((checkpoint) => checkpoint.status === 'open').at(-1)?.checkpointId;
-        if (!checkpointId) throw new Error('CAMPAIGN_OPEN_CHECKPOINT_NOT_FOUND');
-        const checkpoint = campaign.checkpoints.find((entry) => entry.checkpointId === checkpointId);
-        if (!checkpoint || checkpoint.status !== 'open') throw new Error(`CAMPAIGN_OPEN_CHECKPOINT_NOT_FOUND: ${checkpointId}`);
-        return result({ campaignId: campaign.campaignId, campaignRevision: campaign.revision, checkpoint: { ...checkpoint, packet: checkpoint.packet } });
-      }
-      case 'submit_campaign_review': {
-        const repository = selected(ctx, args);
-        const revised = args.revised_goal && typeof args.revised_goal === 'object' && !Array.isArray(args.revised_goal)
-          ? args.revised_goal as Record<string, unknown>
-          : undefined;
-        const campaign = submitCampaignReview(ctx.controllerHome, {
-          repoId: repository.repoId,
-          campaignId: String(args.campaign_id ?? ''),
-          checkpointId: String(args.checkpoint_id ?? ''),
-          nonce: String(args.checkpoint_nonce ?? ''),
-          goalRevision: Number(args.goal_revision),
-          expectedCampaignRevision: expectedRevision(args, 'expected_campaign_revision'),
-          requestId: String(args.request_id ?? ''),
-          decision: {
-            action: String(args.action ?? '') as CampaignSupervisorAction,
-            summary: String(args.summary ?? ''),
-            instructions: typeof args.instructions === 'string' ? args.instructions : undefined,
-            revisedGoal: revised ? {
-              statement: String(revised.statement ?? ''),
-              acceptanceCriteria: stringList(revised.acceptance_criteria),
-              nonGoals: stringList(revised.non_goals),
-              reason: typeof revised.reason === 'string' ? revised.reason : undefined,
-            } : undefined,
-            submittedBy: typeof args.submitted_by === 'string' ? args.submitted_by : 'chatgpt',
-          },
-        });
-        return result({ campaign, warning: 'Campaign reconcile is frozen; review state is retained for migration.' });
-      }
-      case 'accept_campaign': {
-        const repository = selected(ctx, args);
-        const current = getCampaign(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''));
-        if (current.status !== 'ready_for_human_acceptance') throw new Error(`CAMPAIGN_NOT_READY_FOR_ACCEPTANCE: ${current.status}`);
-        const requestId = String(args.request_id ?? '');
-        setCampaignStatus(ctx.controllerHome, repository.repoId, current.campaignId, requestId, 'completed', 'Accepted by human.', expectedRevision(args));
-        const campaign = completeCampaignWorkspace(ctx.controllerHome, repository.repoId, current.campaignId, requestId);
-        return result({ campaign });
-      }
-      case 'reconcile_campaign': {
-        const repository = selected(ctx, args);
-        const reconciliation = reconcileCampaign(ctx.controllerHome, repository.repoId, String(args.campaign_id ?? ''));
-        return result({ reconciliation, campaign: getCampaign(ctx.controllerHome, repository.repoId, reconciliation.campaignId) });
-      }
       case 'create_schedule': {
         const repository = selected(ctx, args);
         const operation = String(args.operation ?? '').trim();