@moretea-labs/forge 1.5.0-rc.1 → 1.5.1

package/assets/templates/helpers/ensure-task-workflow.sh

@@ -342,7 +342,7 @@ Complete this inventory before implementation. If any line is unknown, keep the
 ## Handoff
 
 - Checks file: `.ai/harness/checks/latest.json`
-- Session handoff: `.ai/harness/handoff/current.md`
+- Session continuation: `.ai/harness/session/continuation.md`
 
 ## Evidence Contract
 
@@ -489,7 +489,7 @@ CONTRACT_TEMPLATE_EOF
 
 ## Verification Evidence
 
-- Waza /check run:
+- Forge /review run:
 - Commands run:
 - Manual checks:
 - Supporting artifacts:
@@ -625,7 +625,7 @@ CURRENT_STATUS_EOF
 }
 
 ensure_auxiliary_files() {
-  mkdir -p plans plans/archive plans/prds plans/sprints tasks/issues tasks/archive tasks/contracts tasks/reviews tasks/notes tasks/workstreams docs/architecture/domains docs/architecture/modules docs/architecture/requests docs/architecture/snapshots docs/architecture/diagrams scripts .ai/context .ai/harness/checks .ai/harness/handoff .ai/harness/scripts .ai/harness/failures .ai/harness/security .ai/harness/planning .ai/harness/architecture .ai/harness/worktrees .ai/harness/runs .ai/harness/jobs .ai/harness/local-jobs .ai/harness/controller .ai/harness/edit-sessions
+  mkdir -p plans plans/archive plans/prds plans/sprints tasks/issues tasks/archive tasks/contracts tasks/reviews tasks/notes tasks/workstreams docs/architecture/domains docs/architecture/modules docs/architecture/requests docs/architecture/snapshots docs/architecture/diagrams scripts .ai/context .ai/harness/checks .ai/harness/session .ai/harness/controller/packets .ai/harness/projections .ai/harness/transfers .ai/harness/scripts .ai/harness/failures .ai/harness/security .ai/harness/planning .ai/harness/architecture .ai/harness/worktrees .ai/harness/runs .ai/harness/jobs .ai/harness/local-jobs .ai/harness/controller .ai/harness/edit-sessions
 
   if [[ ! -f "docs/spec.md" ]]; then
     cat > docs/spec.md <<'SPEC_EOF'
@@ -669,16 +669,16 @@ RESEARCH_README_EOF
     echo "{}" > ".ai/harness/checks/latest.json"
   fi
 
-  if [[ ! -f ".ai/harness/handoff/current.md" ]]; then
-    cat > ".ai/harness/handoff/current.md" <<'HANDOFF_EOF'
-# Harness Handoff
+  if [[ ! -f ".ai/harness/session/continuation.md" ]]; then
+    cat > ".ai/harness/session/continuation.md" <<'HANDOFF_EOF'
+# Forge Session Continuation Snapshot
 
 > **Reason**: bootstrap
 HANDOFF_EOF
   fi
 
-  if [[ ! -f ".ai/harness/handoff/resume.md" ]]; then
-    cat > ".ai/harness/handoff/resume.md" <<'RESUME_EOF'
+  if [[ ! -f ".ai/harness/session/resume.md" ]]; then
+    cat > ".ai/harness/session/resume.md" <<'RESUME_EOF'
 # Codex Resume Packet
 
 > **Reason**: bootstrap
@@ -833,7 +833,6 @@ ARCHITECTURE_INDEX_EOF
   "harness": {
     "policy_file": ".ai/harness/policy.json",
     "checks_file": ".ai/harness/checks/latest.json",
-    "handoff_file": ".ai/harness/handoff/current.md",
     "failure_log_file": ".ai/harness/failures/latest.jsonl",
     "events_file": ".ai/harness/events.jsonl",
     "architecture_events_file": ".ai/harness/architecture/events.jsonl",
@@ -899,19 +898,21 @@ ARCHITECTURE_INDEX_EOF
       "sync_rule": "only explicitly opted-in repo-to-brain manifest entries may be written to the default brain vault; pointer-only externalized stubs remain check-only"
     }
   },
-  "handoff_resume": {
-    "resume_packet_file": ".ai/harness/handoff/resume.md",
-    "global_handoff_dir": "~/.codex/handoffs",
-    "auto_start_new_session": false
+  "session": {
+    "continuation_file": ".ai/harness/session/continuation.md",
+    "resume_file": ".ai/harness/session/resume.md",
+    "global_resume_dir": "~/.codex/handoffs",
+    "auto_start_new_session": false,
+    "authority": "rebuildable-host-session-cache-only"
   },
   "plan_capture": {
     "script": "scripts/capture-plan.sh",
-    "sources": ["codex-plan-mode", "waza-think", "forge-plan"],
+    "sources": ["host-plan-mode", "forge-plan"],
     "rule": "Codex Plan mode and Waza think planning should capture decision-complete plans into plans/plan-*.md; implementation approval then projects the active approved plan through scripts/plan-to-todo.sh"
   },
   "planning": {
     "pending_orchestration_file": ".ai/harness/planning/pending.json",
-    "source_of_truth": "transient host planning bridge only; plans/ and .ai/harness/active-plan remain authoritative"
+    "source_of_truth": "transient host planning bridge only; captured plans are source artifacts, while migrated Runtime Plan/Work lifecycle state is authoritative in the Canonical Runtime"
   },
   "guards": {
     "edit_plan_gate": "advice",
@@ -956,7 +957,7 @@ ARCHITECTURE_INDEX_EOF
       "existing_changes_unrelated_but_would_block_review",
       "task_requires_clean_validation_surface"
     ],
-    "validation_route": "waza:check",
+    "validation_route": "forge:/review",
     "merge_back": {
       "target": "main",
       "requires_clean_check": true,
@@ -995,17 +996,18 @@ ARCHITECTURE_INDEX_EOF
   },
   "external_tooling": {
     "routing": {
-      "complex": "gstack",
-      "simple": "waza",
-      "knowledge": "gbrain"
+      "primary": "forge",
+      "optional_complex_helper": "gstack",
+      "optional_daily_helper": "waza",
+      "optional_knowledge_helper": "gbrain"
     },
     "hosts": [
       "claude-code",
       "codex"
     ],
-    "mode": "agent-readiness-required",
+    "mode": "optional-enhancements",
     "detection": "init-migrate",
-    "readiness_gate": "scripts/check-agent-tooling.sh --host codex --strict-readiness",
+    "readiness_report": "scripts/check-agent-tooling.sh --host codex",
     "waza": {
       "source_repo": "tw93/Waza",
       "source_url": "https://github.com/tw93/Waza.git",
@@ -1017,14 +1019,14 @@ ARCHITECTURE_INDEX_EOF
       "host_drift_policy": "report-per-host-version-staging-and-upstream-drift"
     },
     "codex_automation_profile": {
-      "required_skills": ["health", "check", "mermaid"],
-      "optional_skills": [],
-      "mode": "codex-runtime-reference",
+      "required_skills": [],
+      "optional_skills": ["health", "check", "mermaid"],
+      "mode": "optional-codex-runtime-reference",
       "source": "~/.codex/skills",
       "routes": {
-        "workflow_health": "waza:health",
-        "review_gate": "waza:check",
-        "architecture_diagram": "mermaid"
+        "workflow_health_optional": "waza:health",
+        "review_helper_optional": "waza:check",
+        "architecture_diagram_optional": "mermaid"
       },
       "vendoring_policy": "do-not-vendor-skill-body"
     },
@@ -1045,7 +1047,7 @@ ARCHITECTURE_INDEX_EOF
       "codex_config_path": "~/.codex/config.toml",
       "claude_config_path": "~/.claude.json",
       "index_dir": ".codegraph",
-      "readiness": "required-for-agent-code-navigation",
+      "readiness": "forge-bundled-backend; host-mcp-optional",
       "hook_policy": "do-not-block-hooks",
       "install_command": "bun add -g @colbymchenry/codegraph && forge tools configure codegraph --target codex --location global",
       "project_init_command": "codegraph init -i .",
@@ -1055,16 +1057,16 @@ ARCHITECTURE_INDEX_EOF
   },
   "agentic_development": {
     "routing": {
-      "product_discovery": "gstack:office-hours",
-      "complex_engineering_plan": "gstack:plan-eng-review",
-      "design_plan": "gstack:plan-design-review",
-      "small_or_medium_plan": "waza:think",
-      "bug_or_regression": "waza:hunt",
-      "post_implementation_review": "waza:check"
+      "direct": "forge:/direct",
+      "plan": "forge:/plan",
+      "debug": "forge:/debug",
+      "review": "forge:/review",
+      "release": "forge:/release",
+      "scale": "forge:/scale"
     },
     "due_diligence": {
       "levels": ["P1_GLOBAL_ARCHITECTURE", "P2_DATA_FLOW_TRACE", "P3_DESIGN_DECISION"],
-      "explicit_report_required_for": ["plan-eng-review", "hunt", "risky_refactor", "deployment", "auth_payment_data", "shared_contract"]
+      "explicit_report_required_for": ["architecture", "debug", "risky_refactor", "deployment", "auth_payment_data", "shared_contract"]
     }
   },
   "enforcement": {

package/assets/templates/helpers/new-plan.sh

@@ -135,7 +135,7 @@ Complete this inventory before implementation. If any line is unknown, keep the
 ## Handoff
 
 - Checks file: `.ai/harness/checks/latest.json`
-- Session handoff: `.ai/harness/handoff/current.md`
+- Session continuation: `.ai/harness/session/continuation.md`
 
 ## Evidence Contract
 

package/assets/templates/helpers/plan-to-todo.sh

@@ -607,7 +607,7 @@ mkdir -p tasks/notes
 mkdir -p .claude
 mkdir -p .ai/context
 mkdir -p .ai/harness/checks
-mkdir -p .ai/harness/handoff
+mkdir -p .ai/harness/session .ai/harness/controller/packets .ai/harness/projections .ai/harness/transfers
 mkdir -p .ai/harness/failures
 mkdir -p .ai/harness/planning
 mkdir -p .ai/harness/runs
@@ -713,7 +713,7 @@ else
 
 ## Verification Evidence
 
-- Waza /check run:
+- Forge /review run:
 - Commands run:
 - Manual checks:
 - Supporting artifacts:

package/assets/templates/helpers/prepare-codex-handoff.sh

@@ -52,8 +52,8 @@ fi
 codex_home="${CODEX_HOME:-$HOME/.codex}"
 global_dir="$codex_home/handoffs"
 global_file="$global_dir/handoff-$(date '+%y%m%d').md"
-repo_handoff=".ai/harness/handoff/current.md"
-resume_file=".ai/harness/handoff/resume.md"
+repo_handoff=".ai/harness/session/continuation.md"
+resume_file=".ai/harness/session/resume.md"
 
 mkdir -p "$global_dir"
 

package/assets/templates/helpers/prepare-handoff.sh

@@ -45,13 +45,13 @@ if [[ -f ".ai/hooks/lib/workflow-state.sh" ]]; then
     echo "Active plan: $(get_active_plan || printf '(none)')"
     echo "Active contract: $(workflow_active_contract || printf '(none)')"
     echo "Review file: $(workflow_active_review || printf '(none)')"
-    echo "Handoff: $(workflow_handoff_file)"
+    echo "Handoff: $(workflow_session_continuation_file)"
     echo "Resume packet: $(workflow_resume_packet_file)"
     echo "Checks: $(workflow_checks_file)"
     exit 0
   fi
-  workflow_write_handoff "$reason"
-  echo "Updated $(workflow_handoff_file)"
+  workflow_write_session_continuation "$reason"
+  echo "Updated $(workflow_session_continuation_file)"
   if [[ "${FORGE_SKIP_RESUME_REFRESH:-0}" != "1" && -f "scripts/codex-handoff-resume.sh" ]]; then
     bash scripts/codex-handoff-resume.sh --cwd "$(pwd -P)" --reason "$reason" >/dev/null
   fi
@@ -62,20 +62,20 @@ if [[ "$mode" == "status" ]]; then
   echo "Active plan: (none)"
   echo "Active contract: (none)"
   echo "Review file: (none)"
-  echo "Handoff: .ai/harness/handoff/current.md"
-  echo "Resume packet: .ai/harness/handoff/resume.md"
+  echo "Handoff: .ai/harness/session/continuation.md"
+  echo "Resume packet: .ai/harness/session/resume.md"
   echo "Checks: .ai/harness/checks/latest.json"
   exit 0
 fi
 
-mkdir -p .ai/harness/handoff
-cat > .ai/harness/handoff/current.md <<EOF_HANDOFF
-# Harness Handoff
+mkdir -p .ai/harness/session .ai/harness/controller/packets .ai/harness/projections .ai/harness/transfers
+cat > .ai/harness/session/continuation.md <<EOF_HANDOFF
+# Forge Session Continuation Snapshot
 
 > **Generated**: $(date '+%Y-%m-%d %H:%M:%S')
 > **Reason**: ${reason}
 EOF_HANDOFF
-echo "Updated .ai/harness/handoff/current.md"
+echo "Updated .ai/harness/session/continuation.md"
 if [[ "${FORGE_SKIP_RESUME_REFRESH:-0}" != "1" && -f "scripts/codex-handoff-resume.sh" ]]; then
   bash scripts/codex-handoff-resume.sh --cwd "$(pwd -P)" --reason "$reason" >/dev/null
 fi

package/assets/templates/helpers/refresh-current-status.sh

@@ -214,7 +214,7 @@ next_plan_task() {
 
 handoff_next_step() {
   local handoff_file
-  handoff_file="$(json_get '.harness.handoff_file' '.ai/harness/handoff/current.md')"
+  handoff_file="$(json_get '.session.continuation_file' '.ai/harness/session/continuation.md')"
   [[ -f "$handoff_file" ]] || { printf '(none)'; return 0; }
   awk '
     /^## Exact Next Step[[:space:]]*$/ { in_section = 1; next }
@@ -451,7 +451,7 @@ $(git_status_files)
 - Sprints: \`$(json_get '.sprints.dir' 'plans/sprints')/*.sprint.md\`
 - Active sprint marker: \`.ai/harness/sprint/active-sprint\`
 - Workstreams: \`tasks/workstreams/**/*.md\`
-- Handoff: \`.ai/harness/handoff/current.md\`
+- Handoff: \`.ai/harness/session/continuation.md\`
 - Checks: \`.ai/harness/checks/latest.json\`
 EOF_STATUS
 }

package/assets/templates/helpers/ship-worktrees.sh

@@ -308,7 +308,7 @@ pr_body_for_branch() {
 Automated forge ship for \`${branch}\`.
 
 Checks:
-- Waza /check review artifact recommends pass.
+- Forge /review review artifact recommends pass.
 - External acceptance is recorded in the sprint review.
 - \`bash scripts/verify-sprint.sh\` passed before \`contract-worktree.sh finish --no-merge\`.
 

package/assets/templates/helpers/sprint-backlog.sh

@@ -745,7 +745,7 @@ Before editing code, use \`\$think\` to expand this sprint row into a decision-c
 ## Task Breakdown
 
 - [ ] Run \`\$think\` for backlog task \`${target_task}\` using sprint \`${sprint_file}\` and acceptance: ${target_acceptance}
-- [ ] Capture the approved \`\$think\` output with \`scripts/capture-plan.sh --source waza-think --source-ref sprint:${sprint_file}#${target_task}\`
+- [ ] Capture the approved Forge \`/plan\` output with \`scripts/capture-plan.sh --source forge-plan --source-ref sprint:${sprint_file}#${target_task}\`
 - [ ] Verify acceptance: ${target_acceptance}
 BODY_EOF
 

package/assets/templates/helpers/verify-sprint.sh

@@ -366,7 +366,7 @@ contract_command="bash scripts/verify-contract.sh --contract $contract_file --st
 if [[ -f "scripts/sync-brain-docs.sh" && -f ".ai/harness/brain-manifest.json" ]]; then
   bash scripts/sync-brain-docs.sh --all >/dev/null || true
 fi
-if [[ -f "scripts/prepare-codex-handoff.sh" && ( -f ".ai/harness/handoff/current.md" || -f ".ai/harness/handoff/resume.md" ) ]]; then
+if [[ -f "scripts/prepare-codex-handoff.sh" && ( -f ".ai/harness/session/continuation.md" || -f ".ai/harness/session/resume.md" ) ]]; then
   bash scripts/prepare-codex-handoff.sh --reason "forge-verify-sprint" >/dev/null || true
 fi
 set +e
@@ -473,8 +473,8 @@ else
 fi
 handoff_current_exists=false
 handoff_resume_exists=false
-[[ -f ".ai/harness/handoff/current.md" ]] && handoff_current_exists=true
-[[ -f ".ai/harness/handoff/resume.md" ]] && handoff_resume_exists=true
+[[ -f ".ai/harness/session/continuation.md" ]] && handoff_current_exists=true
+[[ -f ".ai/harness/session/resume.md" ]] && handoff_resume_exists=true
 
 if command -v jq >/dev/null 2>&1 && jq -e . "$contract_report" >/dev/null 2>&1; then
   jq -n \
@@ -543,8 +543,8 @@ if command -v jq >/dev/null 2>&1 && jq -e . "$contract_report" >/dev/null 2>&1;
         {name: "allowed_paths", status: ($allowed_paths_check.status // "unavailable")}
       ],
       handoffs: [
-        {file: ".ai/harness/handoff/current.md", exists: $handoff_current_exists},
-        {file: ".ai/harness/handoff/resume.md", exists: $handoff_resume_exists}
+        {file: ".ai/harness/session/continuation.md", exists: $handoff_current_exists},
+        {file: ".ai/harness/session/resume.md", exists: $handoff_resume_exists}
       ],
       files_changed: $files_changed,
       allowed_paths_check: $allowed_paths_check,
@@ -622,8 +622,8 @@ else
     {"name": "allowed_paths", "status": "$(json_escape "$allowed_paths_status")"}
   ],
   "handoffs": [
-    {"file": ".ai/harness/handoff/current.md", "exists": $handoff_current_exists},
-    {"file": ".ai/harness/handoff/resume.md", "exists": $handoff_resume_exists}
+    {"file": ".ai/harness/session/continuation.md", "exists": $handoff_current_exists},
+    {"file": ".ai/harness/session/resume.md", "exists": $handoff_resume_exists}
   ],
   "files_changed": [],
   "allowed_paths_check": {

package/assets/templates/helpers/workstream-sync.sh

@@ -235,7 +235,7 @@ if [[ ! -f "$workstream_file" ]]; then
 > **Architecture Module**: \`${architecture_module}\`
 > **Source Plan**: ${source_plan}
 > **Current Slice**: ${current_slice}
-> **Last Handoff**: \`.ai/harness/handoff/current.md\`
+> **Last Handoff**: \`.ai/harness/session/continuation.md\`
 > **Architecture Request**: ${request_file}
 
 ## Purpose

package/assets/templates/plan.template.md

@@ -60,7 +60,7 @@ Complete this inventory before implementation. If any line is unknown, keep the
 ## Handoff
 
 - Checks file: `.ai/harness/checks/latest.json`
-- Session handoff: `.ai/harness/handoff/current.md`
+- Session continuation: `.ai/harness/session/continuation.md`
 
 ## Evidence Contract
 

package/assets/workflow-contract.v1.json

@@ -151,7 +151,10 @@
       ".ai/harness",
       ".ai/harness/checks",
       ".ai/harness/failures",
-      ".ai/harness/handoff",
+      ".ai/harness/session",
+      ".ai/harness/controller/packets",
+      ".ai/harness/projections",
+      ".ai/harness/transfers",
       ".ai/harness/security",
       ".ai/harness/planning",
       ".ai/harness/architecture",
@@ -256,8 +259,8 @@
       ".ai/harness/events.jsonl",
       ".ai/harness/archive/",
       ".ai/harness/failures/latest.jsonl",
-      ".ai/harness/handoff/current.md",
-      ".ai/harness/handoff/resume.md",
+      ".ai/harness/session/continuation.md",
+      ".ai/harness/session/resume.md",
       ".ai/harness/capability-context/",
       ".ai/harness/security/.gitkeep",
       ".ai/harness/planning/",

package/docs/architecture/current/README.md

@@ -73,7 +73,9 @@ Read the architecture in this order:
 18. `session-aware-execution-and-authorization.md` — Session Context, Work Handle, Goal delegation, and resumable approval boundaries.
 19. `runtime-health-and-resource-lifecycle.md` — shared health evaluation, projection freshness, capability status, attention/history, and bounded ownership-aware cleanup.
 20. `runtime-architecture-simplification.md` — canonical single Runtime lifecycle, release and recovery boundary.
-21. `human-interaction-plane.md` — foreground provider sessions, durable human handoff, profile fencing, and safe resumption.
+21. `human-interaction-plane.md` — foreground provider sessions, bounded human-interaction handoff, profile fencing, and safe resumption.
+22. `control-plane-authority-inventory.md` — single-writer persistence families and frozen legacy writers.
+23. `legacy-governance.md` — RepoHarness inheritance, session-continuation boundary, CLI governance, and deletion rules.
 
 
 ## Architecture Layers
@@ -85,7 +87,7 @@ The approved top-level layers are:
 | Thin Gateway | Authentication, validation, routing, compact reads, durable command acceptance | Long execution, Agent lifetime, heavy checks |
 | Global Control Plane | Repository registry, global quotas, portfolio scheduling | Repository-local workflow mutation |
 | Per-Repository Actor | Repository-local ordering, claims, conflict decisions, integration and release coordination | Cross-repository global locks |
-| Workflow Plane | Issue, Task, Schedule, Occurrence intent and dependency state | Process lifetime and raw logs |
+| Workflow Plane | Requirement, PlanStep, Work, Schedule, Occurrence intent and dependency state | Process lifetime and raw logs |
 | Durable Execution Plane | Job acceptance, dispatch, Run attempts, commands, checks, workers | Product acceptance decisions |
 | Workspace Plane | Workspace/worktree allocation, Git integration, resource leases | Business intent |
 | Evidence Plane | Diffs, checks, logs, artifacts, verification and release evidence | Scheduling policy |
@@ -93,14 +95,13 @@ The approved top-level layers are:
 
 ## Source-of-Truth Rules
 
-- Issue and Task files own durable work intent.
-- Jobs own asynchronous system-operation state.
-- Runs own individual Agent execution attempts.
+- Migrated Requirement, ExecutionPlan/PlanStep, Work, dependency, receipt, validation, and approval lifecycle state is single-writer state in `<durable-controller-home>/control-plane.sqlite` as defined by `control-plane-authority-inventory.md`.
+- Git owns source code and accepted source artifacts such as specs, design notes, and captured plans; those artifacts are not a second lifecycle writer after migration.
+- Jobs own asynchronous system-operation state and Runs own individual Agent execution attempts.
 - Edit Sessions own transactional direct modifications.
-- Verification records own exact-revision completion evidence.
-- Event logs own audit history.
-- Atomic snapshots and indexes are projections optimized for reads and recovery.
-- The controller task ledger projection (`.ai/harness/controller/task-ledger.json` and `.ai/harness/handoff/controller-current.md`) is a compact recovery/read model derived from durable Issue, Task, Run, and worklog state; its `status` field is a deterministic continuation hint for controller recovery, not a competing mutable task source.
+- Verification records own exact-revision completion evidence; event logs own audit history.
+- Atomic snapshots, indexes, task-ledger files, historical Issue/Task aliases, `tasks/current.md`, and `.ai/harness/session/*` are projections or compatibility/session caches only.
+- The legacy controller task-ledger projection is read-only after control-plane cutover and cannot mutate Requirement/Plan/Work state.
 - The controller context pack is a transient Projection Plane read model for scoped code investigation. It may return live Git metadata, validation hints, ranked candidate files, and bounded raw snippets, but it must not become source-of-truth for implementation decisions or replace exact source, diff, and validation review.
 - Chat history, UI state, worker self-reports, and in-memory maps are never durable truth.
 

package/docs/architecture/current/approved-target-architecture.zh-CN.md

@@ -162,7 +162,7 @@ src/cli/agent-jobs/*
 
 Repo Actor 负责：
 
-当前仓库的 Issue/Task 状态
+当前仓库的 Requirement/Work 状态
 任务依赖
 资源占用
 工作区写入权
@@ -1462,7 +1462,7 @@ Push/Publish
 1. Resolve Repository
 2. Read compact snapshot
 3. Classify work mode
-4. Create or select Issue/Task
+4. Create or select Requirement/Work
 5. Declare scope and resources
 6. Persist requestId
 7. Repo Actor schedules work

package/docs/architecture/current/architecture-invariants.md

@@ -267,7 +267,7 @@ A valid outcome may be `nothing_to_do`.
 
 **Current Implementation — MUST**
 
-Automated triage may create a Candidate Finding. It may create or update a formal Issue/Task only when evidence and configured policy justify it.
+Automated triage may create a Candidate Finding. It may promote a formal Requirement/Work only when evidence and configured policy justify it; legacy Issue/Task records are read-only after control-plane cutover.
 
 The same semantic problem must deduplicate across occurrences. “The Agent suggests an optimization” is not sufficient evidence by itself.
 
@@ -289,7 +289,7 @@ Versioned design documents cannot override the current set.
 
 **Current Implementation — MUST**
 
-A capability may be labeled implemented only when a repository path and an executable check support the claim. Future gaps or regressions must be linked to an Issue/Task or ADR rather than hidden by documentation wording. The completed migration record is not permission to weaken a boundary without updating code, tests and the current architecture set.
+A capability may be labeled implemented only when a repository path and an executable check support the claim. Future gaps or regressions must be linked to a Requirement/Work item or ADR rather than hidden by documentation wording. The completed migration record is not permission to weaken a boundary without updating code, tests and the current architecture set.
 
 ## Invariant 26 — Runtime Source Identity Is Controller-Scoped
 

package/docs/architecture/current/automation-and-schedule-engine.md

@@ -120,7 +120,7 @@ Triage inputs should be bounded:
 ```text
 repository health
 active Jobs and Runs
-current Issue/Task queue
+current Requirement/Work queue
 recent failed checks
 recent accepted work
 Git summary and dirty ownership
@@ -158,7 +158,17 @@ Deterministic rules are preferred for:
 - release gate status;
 - repository disabled/frozen state.
 
-An Agent may assist when semantic analysis is required, such as grouping related failures or proposing a bounded improvement. Its output remains a proposal evaluated by deterministic policy.
+Semantic analysis remains external-controller-owned. Forge does not invent the next product or code decision inside the Schedule Engine. A Schedule may use the deterministic `external_controller_wake` action to resume an already bounded Work through Thin Launcher. The wake operation only transports the persisted Work/Handoff context to an external Controller; it does not interpret the model response inside the Kernel.
+
+`external_controller_wake` accepts a `work_id`, `controller_type`, and optional launcher/session metadata. For ChatGPT, Thin Launcher prefers a saved Forge browser session (`browser_session_id`), then an explicit `https://chatgpt.com/...` conversation URL, then a new browser consult. Codex/Claude remain external CLI controllers. If the Work already has an active Controller lease, the Occurrence is a deterministic no-op rather than spawning a competing controller.
+
+The stable ChatGPT tool surface manages this policy through `rh_work` rather than exposing another Schedule tool. `rh_work.schedule_create/list/get/pause/resume/trigger` binds only an existing non-terminal Work to `external_controller_wake`; callers cannot use the facade to schedule an arbitrary MCP or repository operation. Creation is idempotent by a stable schedule request identity, defaults to `shadow_mode=true`, limits active occurrences to one, and carries explicit failure/cooldown/daily-budget/backoff policy.
+
+A Work continuation Schedule is acceptance-driven, not perpetual. Before every wake, Forge re-reads the bound Work. A missing Work pauses the Schedule; a terminal Work (`completed`, `cancelled`, or another terminal Work state) deterministically disables the Schedule and returns `nothing_to_do`. An active Controller lease also returns `nothing_to_do`. Therefore the recurring trigger is only a wake policy for unfinished bounded Work, never a forever-running agent.
+
+Thin Launcher does not pre-claim Controller ownership. It records a short Controller-Home launch reservation (configured with `launch_reservation_ms`) only to fence duplicate spawns while the provider starts. The external provider must connect to Forge MCP and call `rh_work continue` with its authenticated transport identity; that authenticated principal/session becomes the Work owner. This separation prevents the scheduler from impersonating ChatGPT/Codex/Claude and preserves the Controller-session identity fence. Detached CLI providers also use their non-interactive execution contracts (`codex ... exec` and `claude --print`) instead of launching interactive TUIs with ignored stdio.
+
+For Codex, Thin Launcher injects the currently ready Canonical Runtime MCP endpoint per invocation instead of mutating `~/.codex/config.toml`. The Runtime bearer token is passed only through the child environment (`FORGE_RUNTIME_MCP_TOKEN`); the temporary Codex MCP configuration references that environment variable and sends non-secret forwarded principal/session headers derived from the launch reservation. This makes a scheduled Codex self-contained while keeping authentication material out of argv, logs, and durable provider config. CLI providers without a safe Forge MCP bootstrap must fail closed rather than launch detached work that cannot report ownership/evidence back to Runtime.
 
 ## 9. Candidate Finding Governance
 
@@ -324,7 +334,7 @@ Notify on:
 - human review requirement;
 - release readiness;
 - budget exhaustion that changes expected outcome;
-- newly promoted Issue/Task.
+- newly promoted Requirement/Work.
 
 Do not notify repeatedly for unchanged no-op or unchanged blocker state.
 
@@ -438,16 +448,6 @@ Schedules may perform bounded repository work but cannot push, merge, publish, d
 
 New mutation Schedules begin in Shadow Mode until their decisions are reviewed. This is an operational rollout rule, not an implementation gap.
 
-## 26. ChatGPT-Supervised Campaigns
-
-Campaigns complement Schedules. A Schedule answers *when should a bounded occurrence run*; a Campaign answers *how should a multi-step goal progress across many bounded Jobs and review checkpoints*.
-
-Campaign reconciliation is event-driven and restart-safe. It uses short per-Campaign mutations, deterministic child request IDs, persisted retry timestamps, bounded parallelism, and the existing global scheduler/resource-claim system. It does not hold locks while ChatGPT, Codex, browser automation, or a human is working.
-
-A failed task blocks only descendants in the Campaign DAG. Independent tasks remain dispatchable. Pull-mode Supervisor waiting creates no periodic write loop. Agent operations force worktree isolation while preserving the executor's normal engineering and Computer Use capabilities.
-
-Campaigns stop at `ready_for_human_acceptance`; remote merge, publish, deploy, and release authority remain outside the autonomous loop.
-
-### Campaign workspace hierarchy
+### Deferred activation across a natural Runtime restart
 
-A supervised Campaign defaults to a deterministic long-lived feature worktree. Its checkout identity is persisted on the Campaign and copied to every child ExecutionJob. Agent Runs may create short-lived task worktrees, but their automatic integration target is the Campaign checkout, never the repository's unrelated active checkout. Human acceptance does not merge or remove the Campaign worktree.
+A continuation Schedule may be deliberately created with `shadowMode=true` while the currently running immutable Runtime predates the Controller-wake implementation required by that Schedule. Forge can persist a one-time pending continuation activation marker in Controller Home. Old Runtime releases do not read this marker. The first naturally restarted Runtime containing the pending-activation implementation consumes the marker before starting its sole Scheduler, verifies that the Schedule is still enabled and still targets the same `external_controller_wake` Work, flips only `shadowMode` to `false`, and removes the marker. If the Schedule was explicitly disabled in the meantime, the marker is cancelled instead. This preserves one Scheduler authority and avoids introducing a second cron/LaunchAgent or forcing a rollout solely to enable continuation.

package/docs/architecture/current/codegraph-context-provider.md

@@ -13,7 +13,7 @@ The missing capability is not another top-level MCP tool. It is a Context Plane
 ## Constraints
 
 1. The default workflow remains unchanged. No explicit mode directive still uses the existing automatic Direct-first routing.
-2. `-plan`, `-debug`, and `-campaign` are opt-in routing instructions. CodeGraph must not add latency to ordinary Direct edits by default.
+2. `-plan` and `-debug` are opt-in routing instructions. CodeGraph must not add latency to ordinary Direct edits by default.
 3. Forge continues to support Node.js `>=20.10.0`.
 4. CodeGraph's embedded SDK requires Node.js `>=22.5` to open its SQLite database through `node:sqlite`.
 5. CodeGraph's CLI/MCP server uses its own bundled runtime and may auto-sync the index. Planning must not silently mutate source files or silently refresh derived indexes.
@@ -102,7 +102,7 @@ Expected mode usage:
 - ordinary Direct: `off`
 - explicit `-debug`: `auto`
 - explicit `-plan`: `required` when a CodeGraph index is present; otherwise return a clear degraded-plan warning and use bounded text search
-- Campaign planning/review: `auto` or `required` depending on the campaign contract
+- Goal/Plan planning and review: `auto` or `required` when structural evidence materially improves the decision
 
 When enabled, graph results augment candidate ranking. They do not replace raw source reads. Important files selected through CodeGraph still pass through `resolveMcpPath` and `readRepositoryRange` before implementation.
 

package/docs/architecture/current/control-plane-authority-inventory.md

@@ -80,3 +80,15 @@ The final cutover tests prove:
 Any later non-critical compatibility residue is recorded as a
 MaintenanceFinding. It does not reopen a completed Requirement unless the user
 outcome itself regresses.
+
+## Session continuation versus HandoffItem
+
+The frozen `handoff artifact writes` rule refers to lifecycle/decision handoff state. Current hooks may write only the ignored, rebuildable host-session cache under `.ai/harness/session/`; those files are projections for fresh-session context and are never control-plane writers.
+
+A decision requiring ChatGPT or user judgement is represented by Runtime `HandoffItem` and surfaced through `rh_inbox`. Session Markdown cannot create, acknowledge, resolve, dismiss, supersede, or expire a `HandoffItem`.
+
+`HandoffItem` persistence intentionally remains Controller-owned JSON at `Controller Home/repositories/<repoId>/handoff-inbox/index.json`, written atomically under the repository handoff-inbox lock. It is the sole authority for the attention/decision inbox. It is not moved into the Requirement/Plan/Work SQLite tables merely for storage uniformity: those tables own transactional delivery lifecycle, while the inbox owns bounded human/controller judgement points. Runtime restart recovery reopens this Controller Home record; repo-local session, projection, controller-packet, and transfer files are never replayed into it.
+
+Repo-local recovery artifacts now have disjoint namespaces: `.ai/harness/session/` for rebuildable host-session context, `.ai/harness/controller/packets/` for bounded external-controller packets, `.ai/harness/projections/` for read-only compatibility/status views, and `.ai/harness/transfers/` for patch-transfer artifacts. The generic `.ai/harness/handoff/` namespace is retired.
+
+See `docs/architecture/current/legacy-governance.md` for the RepoHarness-to-Forge disposition rules.