@moretea-labs/forge 1.7.2 → 1.8.0

package/src/runtime/control-plane/facade/goal-workloop.ts

@@ -1,23 +1,39 @@
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
+import { globMatches } from '../../../cli/mcp/paths';
 import {
   createHandoffItem,
   listHandoffItems,
   type HandoffInboxStoreOptions,
 } from './handoff-inbox-store';
-import { getControllerSession } from './controller-session-store';
+import { getControllerSession } from '../../../../packages/kernel/controller/api/index';
+import { executionPlacement, readForgeInstanceIdentity } from '../../../../packages/kernel/identity/api/index';
+import { projectAutonomousGoalProgression, type ProgressionWorkSnapshot } from '../../../../packages/kernel/progression/api/index';
 import {
+  applyEngineeringBlockerDisposition,
+  buildEngineeringBlockerDispositionReceipt,
+  buildEngineeringContextReceipt,
+  engineeringWorkProfileForRisk,
+  evaluateEngineeringAdmission,
   appendVerificationRecord,
   appendWorkEvidence,
   appendWorkHandoffRef,
+  cancelWorkContract,
   createWorkContract,
+  failWorkContract,
   getWorkContract,
+  isTerminalWorkContractStatus,
   listWorkContracts,
+  readActiveWorkCandidates,
+  recordWorkEvidenceState,
   recordWorkScopeEvidence,
+  recordWorkImplementationReview,
+  requestWorkImplementationReview,
   summarizeWorkContract,
   transitionWorkContractPhase,
   updateWorkContract,
+  type EngineeringAdmissionEvidence,
   type WorkContractStoreOptions,
-} from './work-contract-store';
+} from '../../../../packages/kernel/work/api/index';
 import {
   claimPlanStepForWork,
   completePlanStepForWork,
@@ -26,7 +42,7 @@ import {
 } from './plan-contract-store';
 import { withPrimaryWorkAdmissionLock } from './semantic-admission';
 import { completeWorkWithReceipt } from '../execution/work-completion-authority';
-import { evaluateReadOnlyReviewSourceIdentity, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence, verificationRecordAppliesToCurrentWorkspace } from '../execution/work-evidence-policy';
+import { effectiveCurrentWorkVerificationRecords, evaluateReadOnlyReviewSourceIdentity, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence } from '../execution/work-evidence-policy';
 import { readRequirement } from '../persistence/requirement-store';
 import {
   classifyVerificationOutcome,
@@ -35,6 +51,18 @@ import {
   type CheckDefinitionLike,
 } from './check-normalization';
 import { evaluatePolicyGate } from './policy-gate';
+import {
+  assertImplementationReviewPreDeliveryBoundary,
+  authoritativeImplementationReviewVerificationEvidence,
+  implementationReviewChangedPathDigest,
+  latestImplementationReview,
+  normalizeImplementationReviewChangedPaths,
+  workRequiresImplementationReview,
+  type ImplementationReviewDecision,
+  type ImplementationReviewCandidateIdentity,
+  type WorkImplementationReviewFinding,
+  type WorkImplementationReviewRecord,
+} from '../../../../packages/kernel/work/api/index';
 import { buildFacadeResult } from './facade-result';
 import { validateSuggestedNextActions } from './suggested-actions';
 import { buildWorkContinuationSnapshot } from './work-continuation';
@@ -53,8 +81,9 @@ import type {
 } from './types';
 import { selectExecutionMode } from './types';
 import { resolveWorkspaceAdmissionConstraint } from '../routing/workspace-admission';
+import { resolveContextPlane, type ContextScope } from '../../context/context-plane';
 
-export type GoalWorkloopOperation = 'start' | 'continue' | 'verify' | 'finalize' | 'stop';
+export type GoalWorkloopOperation = 'start' | 'continue' | 'verify' | 'review' | 'finalize' | 'stop';
 
 export interface GoalWorkloopContext {
   workStore: WorkContractStoreOptions;
@@ -63,10 +92,16 @@ export interface GoalWorkloopContext {
   availableChecks?: readonly CheckDefinitionLike[];
   planStore?: PlanContractStoreOptions;
   sourceRevision?: string;
+  /** Explicit only when repository observation proves the Work started from a revision or an unborn HEAD. */
+  sourceBaseState?: 'revision' | 'unborn';
   checkoutId?: string;
   principalId?: string;
   controllerInstanceId?: string;
   workspaceFingerprint?: string;
+  /** Trusted repository observation for placement admission. Never accept this as caller-supplied semantic authority. */
+  workspaceDirty?: boolean;
+  /** Stage-insensitive Git-canonical identity of the exact current review candidate. Derived by the trusted repository adapter. */
+  implementationReviewWorkspaceFingerprint?: string;
   /** Current net repository paths changed from the Work base plus dirty checkout paths. */
   workspaceChangedPaths?: readonly string[];
   /** Durable terminal repository Process ids explicitly bound to this Work + checkout. */
@@ -81,6 +116,8 @@ export type WorkAdmissionRelation = 'continue' | 'extend' | 'parallel' | 'new_go
 
 export interface GoalWorkloopStartInput {
   objective: string;
+  /** Optional exact durable identity reserved by the admission authority before creation. */
+  workId?: string;
   acceptanceCriteria?: string[];
   allowedPaths?: string[];
   /** Non-authoritative first-pass discovery candidates. */
@@ -90,6 +127,8 @@ export interface GoalWorkloopStartInput {
   constraints?: WorkContract['constraints'];
   modeInput: ExecutionModeSelectionInput;
   requestedBy?: WorkContract['requestedBy'];
+  /** Stable durable admission identity for system-originated Work such as recurrent incident repair. */
+  requestId?: string;
   relatedWorkId?: string;
   workRelation?: WorkAdmissionRelation;
   requirementId?: string;
@@ -102,6 +141,8 @@ export interface GoalWorkloopStartInput {
   planStepId?: string;
   /** Explicit technical evidence shape chosen by the semantic Controller. Never inferred from objective/check text. */
   workKind?: Extract<WorkKind, 'repository_change' | 'completed_no_change' | 'read_only_review' | 'investigation' | 'local_effect' | 'remote_effect' | 'reconciliation'>;
+  /** Trusted source-bound evidence resolved by Forge evidence authorities before admission. Never populate this field from raw caller-supplied receipt ids. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
 }
 
 export interface GoalWorkloopAcceptanceEvidenceBinding {
@@ -124,6 +165,15 @@ export interface GoalWorkloopContinueInput {
   acceptanceEvidence?: GoalWorkloopAcceptanceEvidenceBinding[];
   /** Explicit Controller decision after deterministic acceptance failure; never inferred from note text. */
   acceptanceFailureDecision?: 'repair' | 'rescope';
+  /** Trusted refreshed engineering evidence minted by Runtime composition, never copied from raw caller receipt ids. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
+  /** Semantic Controller blocker classification; Forge derives the permitted action and persists the receipt. */
+  engineeringBlocker?: {
+    blockerId: string;
+    classification: 'same_root_cause' | 'unrelated';
+    rationale: string;
+    semanticScopeKeys?: string[];
+  };
 }
 
 export interface GoalWorkloopVerifyInput {
@@ -147,6 +197,13 @@ export interface GoalWorkloopVerifyInput {
   skipped?: boolean;
 }
 
+export interface GoalWorkloopReviewInput {
+  workId: string;
+  decision: ImplementationReviewDecision;
+  rationale: string;
+  findings?: WorkImplementationReviewFinding[];
+}
+
 export interface GoalWorkloopFinalizeInput {
   workId: string;
   forceFailed?: boolean;
@@ -163,6 +220,57 @@ function nowIso(ctx: GoalWorkloopContext): string {
   return ctx.now?.() ?? new Date().toISOString();
 }
 
+function currentImplementationReviewCandidate(
+  ctx: GoalWorkloopContext,
+  work: WorkContract,
+): ImplementationReviewCandidateIdentity {
+  const sourceRevision = ctx.sourceRevision?.trim() ?? '';
+  const verificationWorkspaceFingerprint = ctx.workspaceFingerprint?.trim() ?? '';
+  const workspaceFingerprint = ctx.implementationReviewWorkspaceFingerprint?.trim() ?? '';
+  const changedPaths = normalizeImplementationReviewChangedPaths(
+    ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? [],
+  );
+  if (!sourceRevision || !verificationWorkspaceFingerprint || !workspaceFingerprint) {
+    throw new Error('WORK_IMPLEMENTATION_REVIEW_SOURCE_IDENTITY_REQUIRED');
+  }
+  const verification = authoritativeImplementationReviewVerificationEvidence({
+    repoId: work.repoId,
+    workId: work.workId,
+    requiredCheckIds: work.checks,
+    records: work.checkRefs,
+    sourceRevision,
+    workspaceFingerprint: verificationWorkspaceFingerprint,
+  });
+  if (verification.missingCheckIds.length > 0) {
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
+  }
+  return {
+    sourceRevision,
+    workspaceFingerprint,
+    verificationWorkspaceFingerprint,
+    changedPaths,
+    verificationEvidence: verification.evidence,
+    architectureEvidence: [],
+  };
+}
+
+function implementationReviewAcceptanceSummary(work: WorkContract): string {
+  const summary = work.acceptanceCriteria.map((criterion) => criterion.trim()).filter(Boolean).join(' | ');
+  return (summary || 'No explicit acceptance criteria; reviewer assessed the Work objective and exact current implementation evidence.').slice(0, 2_000);
+}
+
+function implementationReviewSuggestedAction(workId: string): SuggestedNextAction {
+  return {
+    label: 'Review implementation',
+    tool: 'rh_work',
+    operation: 'review',
+    payload: { work_id: workId },
+    risk: 'workspace_write',
+    confidence: 'high',
+    reason: 'Verification is complete; an explicit Controller implementation decision is required before delivery.',
+  };
+}
+
 function workIdFor(objective: string): string {
   const slug = objective
     .toLowerCase()
@@ -172,6 +280,11 @@ function workIdFor(objective: string): string {
   return `work-${slug}-${randomUUID().slice(0, 8)}`;
 }
 
+function linkedEngineeringBlockerWorkId(parentWorkId: string, blockerId: string): string {
+  const digest = createHash('sha256').update(`${parentWorkId}\0${blockerId.trim()}`).digest('hex').slice(0, 24);
+  return `work-linked-engineering-blocker-${digest}`;
+}
+
 function handoffIdFor(prefix: string): string {
   return `hnd-${prefix}-${randomUUID().slice(0, 8)}`;
 }
@@ -188,6 +301,22 @@ function workRiskFor(input: GoalWorkloopStartInput): WorkRisk {
   return 'medium';
 }
 
+function resolvedWorkKindFor(input: GoalWorkloopStartInput): WorkKind {
+  if (input.workKind) return input.workKind;
+  // allowed_paths and discovery hints do not prove repository mutation. External
+  // effects become repository_change only when source-change intent is explicit.
+  const repositoryChangeIntent = (input.modeInput.expectedFiles ?? 0) > 0
+    || (input.modeInput.expectedChangedLines ?? 0) > 0;
+  const typedRecoverableReadOnlyReview = input.modeInput.mutation === false
+    && input.modeInput.requiresInvestigation === true
+    && input.modeInput.requiresRecovery === true;
+  if (typedRecoverableReadOnlyReview) return 'read_only_review';
+  if (input.modeInput.requiresExternalEffect === true && !repositoryChangeIntent) {
+    return input.modeInput.remoteWrite === true ? 'remote_effect' : 'local_effect';
+  }
+  return 'repository_change';
+}
+
 function suggestedForWorkIdentity(workId: string, checks: string[], extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
   const base: SuggestedNextAction[] = [
     {
@@ -259,7 +388,23 @@ export function routeWorkStart(
   const strategyConflictRequiresApproval = input.constraints?.architectureStrategyChange === true
     || input.constraints?.conflictsWithThinHarnessPolicy === true
     || input.constraints?.changesDefaultExecutionStrategy === true;
-  const relatedLifecycleSource = input.relatedWorkId ? getWorkContract(ctx.workStore, input.relatedWorkId) : undefined;
+  let relatedLifecycleSource: WorkContract | undefined;
+  if (input.relatedWorkId) {
+    try {
+      relatedLifecycleSource = getWorkContract(ctx.workStore, input.relatedWorkId);
+    } catch (error) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_RELATED_CONTRACT_INVALID: ${input.relatedWorkId} is malformed and cannot authorize a Work relationship.`,
+        data: {
+          executionStarted: false,
+          workContractCreated: false,
+          invalidWorkId: input.relatedWorkId,
+          invalidWorkError: error instanceof Error ? error.message : String(error),
+        },
+      });
+    }
+  }
   const inheritedReadOnlyReview = Boolean(
     input.workKind === undefined
     && input.workRelation === 'new_goal'
@@ -279,10 +424,21 @@ export function routeWorkStart(
     });
   }
   const requestedWorkKind = input.workKind ?? (inheritedReadOnlyReview ? 'read_only_review' : undefined);
+  const explicitSourceMutationFence = input.allowedPaths !== undefined
+    && input.allowedPaths.length === 0
+    && (input.forbiddenPaths ?? []).some((value) => {
+      const normalized = value.trim().replace(/\\/g, '/');
+      return normalized === '*' || normalized === '**' || normalized === '**/*';
+    });
   const typedReadOnlyReviewRequested = requestedWorkKind === undefined
-    && (input.modeInput.mutation === false || (input.modeInput.mutation === undefined && input.modeInput.risk === 'readonly'))
-    && input.modeInput.requiresInvestigation === true
-    && input.modeInput.requiresRecovery === true;
+    && (
+      explicitSourceMutationFence
+      || (
+        (input.modeInput.mutation === false || (input.modeInput.mutation === undefined && input.modeInput.risk === 'readonly'))
+        && input.modeInput.requiresInvestigation === true
+        && input.modeInput.requiresRecovery === true
+      )
+    );
   const effectiveWorkKind = requestedWorkKind ?? (typedReadOnlyReviewRequested ? 'read_only_review' : undefined);
   const readOnlyReviewRequested = effectiveWorkKind === 'read_only_review';
   const readOnlyMutationConflict = readOnlyReviewRequested && (
@@ -300,12 +456,35 @@ export function routeWorkStart(
       data: { executionStarted: false, workContractCreated: false, workKind: effectiveWorkKind },
     });
   }
+  const contextScopes: ContextScope[] = [];
+  if (input.requirementId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'requirement', id: input.requirementId.trim() });
+  if (input.planId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'plan', id: input.planId.trim() });
+  if (input.relatedWorkId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'work', id: input.relatedWorkId.trim() });
+  const resolvedContext = ctx.workStore.controllerHome
+    ? resolveContextPlane({
+        controllerHome: ctx.workStore.controllerHome,
+        scopes: contextScopes,
+        intent: input.modeInput.routePolicyInput?.intent.taskIntent ?? 'implementation',
+        now: nowIso(ctx),
+      })
+    : undefined;
+  // A terminal continuation is not a new semantic request. Its durable predecessor
+  // and Plan lineage already define the goal scope, while the successor Plan step
+  // becomes the Work objective later in startGoalWorkloop. Do not force the external
+  // Controller to duplicate semantic text merely to satisfy generic route selection.
+  // This fallback is routing context only and never becomes successor Work authority.
+  const routeObjective = input.objective.trim()
+    || (input.workRelation === 'continue' && relatedLifecycleSource?.status === 'completed'
+      ? relatedLifecycleSource.objective.trim()
+      : '');
   const effectiveModeInput: ExecutionModeSelectionInput = {
     ...input.modeInput,
-    objective: input.objective,
+    contextRouteHints: input.modeInput.contextRouteHints ?? resolvedContext?.routeHints,
+    objective: routeObjective,
     knownPaths: input.allowedPaths,
     workspacePlacement: placementConstraint.workspaceMode,
     directMainProhibited: placementConstraint.directMainProhibited,
+    workspaceDirty: ctx.workspaceDirty ?? input.modeInput.workspaceDirty,
     mutation: readOnlyReviewRequested ? false : input.modeInput.mutation ?? input.modeInput.risk !== 'readonly',
     risk: readOnlyReviewRequested ? 'readonly' : input.modeInput.risk,
     approvalConfirmed: input.approvalConfirmed === true,
@@ -383,10 +562,21 @@ export function routeWorkStart(
     // the RouteDecision. The actual repository mutation can pass this Work id
     // to repository_safe_patch_apply / repository_command_execute for evidence
     // attribution while staying on the Direct/Process path.
-    const directOwnershipCandidates = input.relatedWorkId || (input.planId && input.planStepId)
-      ? listWorkContracts({ ...ctx.workStore, status: 'active', limit: 100 })
-          .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary')
-      : [];
+    const directAdmissionSnapshot = input.relatedWorkId || (input.planId && input.planStepId)
+      ? readActiveWorkCandidates({ ...ctx.workStore, limit: 100 })
+      : { contracts: [], invalid: [] };
+    const invalidDirectOwner = directAdmissionSnapshot.invalid.find((candidate) =>
+      candidate.workId === input.relatedWorkId
+      || (input.planId && input.planStepId && candidate.planId === input.planId && candidate.planStepId === input.planStepId));
+    if (invalidDirectOwner) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_ADMISSION_INVALID_OWNER: ${invalidDirectOwner.workId} is malformed and cannot be used as Direct Control ownership authority.`,
+        data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidDirectOwner.workId, invalidWorkError: invalidDirectOwner.error },
+      });
+    }
+    const directOwnershipCandidates = directAdmissionSnapshot.contracts
+      .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
     const directPlan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
     const directPlanStep = directPlan && input.planStepId ? directPlan.steps.find((step) => step.id === input.planStepId) : undefined;
     const directOwner = (input.relatedWorkId
@@ -587,21 +777,215 @@ export function startGoalWorkloop(
     ));
   }
   const at = nowIso(ctx);
+  const resolvedWorkKind = resolvedWorkKindFor(input);
+  const workRisk = workRiskFor(input);
+  // External-effect risk is governed by authorization/confirmation/receipt
+  // semantics. Engineering admission is specifically for repository mutation.
+  const engineeringRisk: WorkRisk = resolvedWorkKind === 'repository_change' ? workRisk : 'readonly';
+  const engineeringProfile = engineeringWorkProfileForRisk(engineeringRisk);
+  const engineeringSourceIdentity = ctx.sourceRevision?.trim()
+    ? { kind: 'revision' as const, revision: ctx.sourceRevision.trim() }
+    : ctx.sourceBaseState === 'unborn'
+      ? { kind: 'unborn' as const }
+      : { kind: 'unknown' as const };
+  let engineeringContext;
+  try {
+    engineeringContext = buildEngineeringContextReceipt({
+      risk: engineeringRisk,
+      sourceIdentity: engineeringSourceIdentity,
+      evidence: input.verifiedEngineeringEvidence,
+      recordedAt: at,
+    });
+  } catch (error) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: error instanceof Error ? error.message : 'ENGINEERING_CONTEXT_INVALID',
+      data: { executionStarted: false, workContractCreated: false, engineeringProfile },
+    });
+  }
+  const engineeringMutation = resolvedWorkKind === 'repository_change'
+    && (input.modeInput.mutation ?? input.modeInput.risk !== 'readonly');
+  const engineeringAdmission = evaluateEngineeringAdmission({
+    profile: engineeringProfile,
+    receipt: engineeringContext,
+    mutation: engineeringMutation,
+  });
+  if (!engineeringAdmission.allowed) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `${engineeringAdmission.code}: ${engineeringProfile.riskClass} mutation is missing required pre-mutation engineering evidence.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        engineeringProfile,
+        engineeringContext,
+        missingEngineeringEvidence: engineeringAdmission.missing,
+      },
+    });
+  }
   const available = ctx.availableChecks ?? [];
   const workspaceMode = placementConstraint.workspaceMode;
-  const activeWorks = listWorkContracts({ ...ctx.workStore, status: 'active', limit: 100 })
+  const activeAdmissionSnapshot = readActiveWorkCandidates({ ...ctx.workStore, limit: 100 });
+  const activeWorks = activeAdmissionSnapshot.contracts
     .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
+  const invalidRelatedWork = input.relatedWorkId
+    ? activeAdmissionSnapshot.invalid.find((candidate) => candidate.workId === input.relatedWorkId)
+    : undefined;
+  if (invalidRelatedWork) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_RELATED_CONTRACT_INVALID: ${invalidRelatedWork.workId} is malformed and cannot authorize a Work relationship.`,
+      data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidRelatedWork.workId, invalidWorkError: invalidRelatedWork.error },
+    });
+  }
+  const relatedLifecycleSource = input.relatedWorkId
+    ? getWorkContract(ctx.workStore, input.relatedWorkId)
+    : undefined;
   const workspaceOwner = ctx.checkoutId
     ? activeWorks.find((candidate) => candidate.checkoutId === ctx.checkoutId
       && candidate.worktreePolicy.required !== true
       && !candidate.worktreeRef)
     : undefined;
+  const terminalContinuationSource = input.workRelation === 'continue'
+    && relatedLifecycleSource
+    && isTerminalWorkContractStatus(relatedLifecycleSource.status)
+    ? relatedLifecycleSource
+    : undefined;
+  if (terminalContinuationSource && !terminalContinuationSource.requirementId && !terminalContinuationSource.planId) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_SUCCESSOR_SEMANTIC_SCOPE_REQUIRED: ${terminalContinuationSource.workId} is terminal but has no Requirement/Plan lineage. Use new_goal or bind an explicit durable semantic authority instead of guessing continuity.`,
+      data: { executionStarted: false, workContractCreated: false, relatedWorkId: terminalContinuationSource.workId },
+    });
+  }
   const explicitRelatedWork = input.relatedWorkId
     ? activeWorks.find((candidate) => candidate.workId === input.relatedWorkId)
     : undefined;
-  const plan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
-  const planStep = plan && input.planStepId ? plan.steps.find((step) => step.id === input.planStepId) : undefined;
+
+  let resolvedPlanId = input.planId?.trim() || undefined;
+  let resolvedPlanStepId = input.planStepId?.trim() || undefined;
+  if (terminalContinuationSource?.planId) {
+    if (resolvedPlanId && resolvedPlanId !== terminalContinuationSource.planId) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_SUCCESSOR_PLAN_MISMATCH: predecessor ${terminalContinuationSource.workId} belongs to ${terminalContinuationSource.planId}, not ${resolvedPlanId}. Supersede/replan explicitly instead of silently moving continuation authority.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, predecessorPlanId: terminalContinuationSource.planId, requestedPlanId: resolvedPlanId },
+      });
+    }
+    resolvedPlanId = terminalContinuationSource.planId;
+  }
+  const plan = resolvedPlanId && ctx.planStore ? getPlanContract(ctx.planStore, resolvedPlanId) : undefined;
+  if (terminalContinuationSource?.planId && !plan) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_SUCCESSOR_PLAN_NOT_FOUND: ${terminalContinuationSource.planId}. Recover the durable Plan authority before creating a successor Work.`,
+      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: terminalContinuationSource.planId },
+    });
+  }
+  if (terminalContinuationSource?.planStepId && plan && !resolvedPlanStepId) {
+    const predecessorStep = plan.steps.find((step) => step.id === terminalContinuationSource.planStepId);
+    if (!predecessorStep) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_SUCCESSOR_PLAN_STEP_NOT_FOUND: predecessor ${terminalContinuationSource.workId} references ${terminalContinuationSource.planStepId}.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, predecessorPlanStepId: terminalContinuationSource.planStepId },
+      });
+    }
+    const requirementRecord = plan.requirementId && ctx.workStore.controllerHome
+      ? readRequirement({ controllerHome: ctx.workStore.controllerHome }, plan.requirementId)
+      : undefined;
+    const progressionWorks: ProgressionWorkSnapshot[] = plan.steps
+      .flatMap((candidate) => candidate.workId ? [getWorkContract(ctx.workStore, candidate.workId)] : [])
+      .filter((candidate): candidate is NonNullable<typeof candidate> => Boolean(candidate))
+      .map((candidate) => ({
+        workId: candidate.workId,
+        requirementId: candidate.requirementId,
+        planId: candidate.planId,
+        planStepId: candidate.planStepId,
+        status: candidate.status,
+        baseRevision: candidate.baseRevision,
+        completionTargetRevision: candidate.completionReceipt && 'targetRevision' in candidate.completionReceipt
+          ? candidate.completionReceipt.targetRevision
+          : undefined,
+      }));
+    const progression = projectAutonomousGoalProgression({
+      requirement: {
+        requirementId: plan.requirementId ?? terminalContinuationSource.requirementId ?? `plan:${plan.planId}`,
+        state: requirementRecord?.value.state ?? 'active',
+        revision: requirementRecord?.revision ?? 0,
+      },
+      plan: {
+        planId: plan.planId,
+        requirementId: plan.requirementId,
+        sourceRevision: plan.sourceRevision,
+        status: plan.status,
+        steps: plan.steps.map((candidate) => ({ id: candidate.id, dependencies: candidate.dependencies, status: candidate.status, workId: candidate.workId })),
+      },
+      currentSourceRevision: ctx.sourceRevision ?? plan.sourceRevision,
+      works: progressionWorks,
+      controllerRounds: [],
+    });
+    if (progression.kind === 'request_controller_acceptance') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_STEP_SEMANTIC_ACCEPTANCE_REQUIRED: ${plan.planId}/${progression.planStepId ?? predecessorStep.id} has machine-complete delivery. Accept the delivered step before advancing the same semantic goal.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, planStepId: progression.planStepId ?? predecessorStep.id, semanticAcceptanceRequired: true, progression },
+      });
+    }
+    if (progression.reasonCode === 'PLAN_STEP_TERMINAL_WORK_RECONCILIATION_REQUIRED') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_STEP_TERMINAL_WORK_RECONCILIATION_REQUIRED: ${plan.planId}/${progression.planStepId ?? predecessorStep.id} must project terminal Work ${terminalContinuationSource.workId} before semantic progression.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, planStepId: progression.planStepId ?? predecessorStep.id, repairRequired: true, progression },
+      });
+    }
+    if (progression.kind === 'start_next_plan_step' && progression.planStepId) {
+      resolvedPlanStepId = progression.planStepId;
+    } else if (progression.kind === 'request_requirement_acceptance') {
+      return buildFacadeResult({
+        status: 'ok',
+        summary: `CONTINUATION_REQUIREMENT_ACCEPTANCE_REQUIRED: ${plan.planId} is finalized; the semantic Controller must record goal_complete before the Requirement becomes done.`,
+        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'requirement_acceptance_required', requirementAcceptanceRequired: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, requirementId: plan.requirementId, progression },
+      });
+    } else if (progression.kind === 'goal_complete') {
+      return buildFacadeResult({
+        status: 'ok',
+        summary: `CONTINUATION_GOAL_COMPLETE: ${plan.planId} Requirement is already semantically complete; no successor Work was created.`,
+        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'goal_complete', goalComplete: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, requirementId: plan.requirementId, progression },
+      });
+    } else if (progression.reasonCode === 'MULTIPLE_READY_PLAN_STEPS') {
+      const candidates = (progression.dependencyStepIds ?? [])
+        .map((stepId) => plan.steps.find((candidate) => candidate.id === stepId))
+        .filter((candidate): candidate is NonNullable<typeof candidate> => Boolean(candidate));
+      return buildFacadeResult({
+        status: 'ok',
+        summary: `PLAN_SUCCESSOR_STEP_RESOLUTION_REQUIRED: ${plan.planId} has ${candidates.length} executable successor steps. The semantic Controller must select one; Forge will not invent ordering.`,
+        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'resolution_required', resolutionRequired: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, candidatePlanSteps: candidates.map((candidate) => ({ id: candidate.id, objective: candidate.objective })), progression },
+      });
+    } else if (progression.kind === 'request_replan') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_SUCCESSOR_REPLAN_REQUIRED: ${plan.planId} ${progression.reasonCode}.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, progression },
+      });
+    } else if (progression.kind !== 'start_next_plan_step') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_SUCCESSOR_PROGRESSION_BLOCKED: ${plan.planId} ${progression.reasonCode}.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, progression },
+      });
+    }
+  }
+  const planStep = plan && resolvedPlanStepId ? plan.steps.find((step) => step.id === resolvedPlanStepId) : undefined;
   const requestedRequirementId = input.requirementId?.trim() || undefined;
+  const predecessorRequirementId = terminalContinuationSource?.requirementId;
+  if (predecessorRequirementId && requestedRequirementId && predecessorRequirementId !== requestedRequirementId) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_SUCCESSOR_REQUIREMENT_MISMATCH: predecessor ${terminalContinuationSource.workId} belongs to ${predecessorRequirementId}, not ${requestedRequirementId}.`,
+      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, predecessorRequirementId, requestedRequirementId },
+    });
+  }
   if (plan && requestedRequirementId && requestedRequirementId !== plan.requirementId) {
     return buildFacadeResult({
       status: 'blocked',
@@ -609,7 +993,14 @@ export function startGoalWorkloop(
       data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planRequirementId: plan.requirementId, requestedRequirementId },
     });
   }
-  const effectiveRequirementId = requestedRequirementId || plan?.requirementId;
+  if (plan?.requirementId && predecessorRequirementId && plan.requirementId !== predecessorRequirementId) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_SUCCESSOR_PLAN_REQUIREMENT_MISMATCH: predecessor ${terminalContinuationSource!.workId} belongs to ${predecessorRequirementId}, while ${plan.planId} belongs to ${plan.requirementId}.`,
+      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource!.workId, predecessorRequirementId, planId: plan.planId, planRequirementId: plan.requirementId },
+    });
+  }
+  const effectiveRequirementId = requestedRequirementId || plan?.requirementId || predecessorRequirementId;
   if (
     effectiveRequirementId
     && ctx.workStore.controllerHome
@@ -637,33 +1028,68 @@ export function startGoalWorkloop(
     if (mismatches.length > 0) {
       return buildFacadeResult({
         status: 'blocked',
-        summary: `PLAN_STEP_WORK_CONTRACT_MISMATCH: ${input.planId}/${input.planStepId} conflicts with frozen Plan step field(s): ${mismatches.join(', ')}. Replan instead of widening or narrowing Work admission.`,
-        data: { executionStarted: false, workContractCreated: false, planId: input.planId, planStepId: input.planStepId, mismatches },
+        summary: `PLAN_STEP_WORK_CONTRACT_MISMATCH: ${resolvedPlanId}/${resolvedPlanStepId} conflicts with frozen Plan step field(s): ${mismatches.join(', ')}. Replan instead of widening or narrowing Work admission.`,
+        data: { executionStarted: false, workContractCreated: false, planId: resolvedPlanId, planStepId: resolvedPlanStepId, mismatches },
       });
     }
   }
+  const effectiveObjective = planStep?.objective ?? input.objective;
   const effectiveAcceptanceCriteria = planStep?.acceptanceCriteria ?? input.acceptanceCriteria ?? [];
   const effectiveAllowedPaths = planStep?.allowedPaths ?? input.allowedPaths ?? [];
   const effectiveForbiddenPaths = planStep?.forbiddenPaths ?? input.forbiddenPaths ?? [];
   const effectiveChecks = planStep?.checks ?? input.checks ?? [];
   const normalized = normalizeCheckIds(effectiveChecks, available);
-  const boundPlanStepWorks = input.planId && input.planStepId
-    ? activeWorks.filter((candidate) => candidate.planId === input.planId && candidate.planStepId === input.planStepId)
+  const invalidLineageWork = activeAdmissionSnapshot.invalid.find((candidate) =>
+    (input.relatedWorkId && candidate.workId === input.relatedWorkId)
+    || (resolvedPlanId && resolvedPlanStepId && candidate.planId === resolvedPlanId && candidate.planStepId === resolvedPlanStepId));
+  if (invalidLineageWork) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_ADMISSION_INVALID_SEMANTIC_AUTHORITY: ${invalidLineageWork.workId} is malformed but still claims the requested durable Plan/Requirement lineage. Repair that exact authority before creating a sibling Work.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        invalidWorkId: invalidLineageWork.workId,
+        invalidWorkError: invalidLineageWork.error,
+        planId: resolvedPlanId,
+        planStepId: resolvedPlanStepId,
+        requirementId: effectiveRequirementId,
+      },
+    });
+  }
+  const newWorkWillBeIsolated = placementConstraint.requireWorktree
+    || placementConstraint.workspaceMode === 'isolated'
+    || input.modeInput.requiresParallelism === true
+    || routeDecision.requiresIsolation === true;
+  const invalidSharedWorkspaceOwner = !newWorkWillBeIsolated
+    ? activeAdmissionSnapshot.invalid.find((candidate) => candidate.isolation === 'shared'
+      && (!candidate.checkoutId || candidate.checkoutId === ctx.checkoutId))
+    : undefined;
+  if (invalidSharedWorkspaceOwner) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_ADMISSION_INVALID_WORKSPACE_AUTHORITY: ${invalidSharedWorkspaceOwner.workId} is malformed and may still own the shared checkout; isolated placement or exact authority repair is required.`,
+      data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidSharedWorkspaceOwner.workId, invalidWorkError: invalidSharedWorkspaceOwner.error },
+    });
+  }
+  const boundPlanStepWorks = resolvedPlanId && resolvedPlanStepId
+    ? activeWorks.filter((candidate) => candidate.planId === resolvedPlanId && candidate.planStepId === resolvedPlanStepId)
     : [];
   const explicitPlanStepWork = planStep?.workId ? activeWorks.find((candidate) => candidate.workId === planStep.workId) : undefined;
   const planStepWork = explicitPlanStepWork ?? (boundPlanStepWorks.length === 1 ? boundPlanStepWorks[0] : undefined);
-  const requirementWorks = effectiveRequirementId
-    ? activeWorks.filter((candidate) => candidate.requirementId === effectiveRequirementId)
-    : [];
+  // Requirement membership is portfolio ownership, not semantic Work identity.
+  // Only an explicit related Work or the exact bound Plan step may select an
+  // existing Work authority. Siblings under one Requirement remain unrelated
+  // for semantic admission and meet only in placement/resource arbitration.
   const deterministicTarget = input.relatedWorkId
     ? explicitRelatedWork
-    : planStepWork ?? (requirementWorks.length === 1 ? requirementWorks[0] : undefined);
+    : planStepWork;
   const requestedRelation = input.workRelation ?? (input.modeInput.requiresParallelism === true ? 'parallel' : undefined);
   // Only strong semantic bindings participate in ownership resolution. An
   // unrelated active Work or a checkout writer is a placement fact, not a
   // semantic candidate for continue/extend/parallel/new_goal.
   const candidateWorks = [...new Map(
-    [explicitRelatedWork, planStepWork, ...boundPlanStepWorks, ...requirementWorks]
+    [explicitRelatedWork, planStepWork, ...boundPlanStepWorks]
       .filter((candidate): candidate is WorkContract => Boolean(candidate))
       .map((candidate) => [candidate.workId, candidate]),
   ).values()].slice(0, 8);
@@ -697,18 +1123,42 @@ export function startGoalWorkloop(
   });
 
   if (boundPlanStepWorks.length > 1) {
-    return resolutionRequired(`PLAN_STEP_MULTIPLE_PRIMARY_WORKS: ${input.planId}/${input.planStepId} has ${boundPlanStepWorks.length} active primary Work records and requires repair before execution.`);
+    return resolutionRequired(`PLAN_STEP_MULTIPLE_PRIMARY_WORKS: ${resolvedPlanId}/${resolvedPlanStepId} has ${boundPlanStepWorks.length} active primary Work records and requires repair before execution.`);
   }
+  if (terminalContinuationSource && requestedRelation === 'continue' && planStepWork) {
+    if (planStepWork.predecessorWorkId !== terminalContinuationSource.workId) {
+      return resolutionRequired(
+        `PLAN_STEP_SUCCESSOR_LINEAGE_CONFLICT: ${resolvedPlanId}/${resolvedPlanStepId} is already owned by ${planStepWork.workId}, but its predecessor is ${planStepWork.predecessorWorkId ?? 'none'} rather than ${terminalContinuationSource.workId}.`,
+        planStepWork,
+      );
+    }
+    return buildFacadeResult({
+      status: 'ok',
+      summary: `PLAN_STEP_REUSES_SUCCESSOR_WORK: ${resolvedPlanId}/${resolvedPlanStepId} already continues terminal ${terminalContinuationSource.workId} as ${planStepWork.workId}.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        admissionDecision: 'reuse_existing',
+        resolutionRequired: false,
+        predecessorWorkId: terminalContinuationSource.workId,
+        work: summarizeWorkContract(planStepWork),
+      },
+      evidenceRefs: planStepWork.evidenceRefs,
+      suggestedNextActions: [{ label: 'Continue successor Work', tool: 'rh_work', operation: 'continue', payload: { work_id: planStepWork.workId }, risk: 'readonly', confidence: 'high' }],
+      rawAvailable: false,
+    });
+  }
+
   if (planStep?.workId && !explicitPlanStepWork) {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `PLAN_STEP_BOUND_WORK_MISSING: ${input.planId}/${input.planStepId} is bound to ${planStep.workId}, but that Work is not active. Repair the exact binding; do not create a replacement Work.`,
-      data: { executionStarted: false, workContractCreated: false, planId: input.planId, planStepId: input.planStepId, boundWorkId: planStep.workId, repairRequired: true },
+      summary: `PLAN_STEP_BOUND_WORK_MISSING: ${resolvedPlanId}/${resolvedPlanStepId} is bound to ${planStep.workId}, but that Work is not active. Repair the exact binding; do not create a replacement Work.`,
+      data: { executionStarted: false, workContractCreated: false, planId: resolvedPlanId, planStepId: resolvedPlanStepId, boundWorkId: planStep.workId, repairRequired: true },
       suggestedNextActions: [{
         label: 'Diagnose exact Plan step binding',
         tool: 'rh_work',
         operation: 'repair',
-        payload: { plan_id: input.planId, plan_step_id: input.planStepId, repair_operation: 'diagnose', dry_run: true },
+        payload: { plan_id: resolvedPlanId, plan_step_id: resolvedPlanStepId, repair_operation: 'diagnose', dry_run: true },
         risk: 'readonly',
         confidence: 'high',
         reason: 'The Plan step has an exact Work identity but the active Work view cannot resolve it. Diagnose that binding before any replacement Work can be admitted.',
@@ -728,7 +1178,7 @@ export function startGoalWorkloop(
   if (planStepWork && !requestedRelation) {
     return buildFacadeResult({
       status: 'ok',
-      summary: `PLAN_STEP_REUSES_ACTIVE_WORK: ${input.planId}/${input.planStepId} already executes as ${planStepWork.workId}; reuse that Work instead of creating another.`,
+      summary: `PLAN_STEP_REUSES_ACTIVE_WORK: ${resolvedPlanId}/${resolvedPlanStepId} already executes as ${planStepWork.workId}; reuse that Work instead of creating another.`,
       data: {
         executionStarted: false,
         workContractCreated: false,
@@ -742,9 +1192,9 @@ export function startGoalWorkloop(
     });
   }
 
-  if (requestedRelation === 'continue' || requestedRelation === 'extend') {
+  if ((requestedRelation === 'continue' || requestedRelation === 'extend') && !terminalContinuationSource) {
     if (!deterministicTarget) {
-      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id or bind the request to an active Plan/Requirement before execution.`);
+      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id or bind the request to an exact active Plan step before execution.`);
     }
     if (requestedRelation === 'extend' && deterministicTarget.planId) {
       return resolutionRequired(
@@ -793,12 +1243,38 @@ export function startGoalWorkloop(
     );
   }
 
-  const placementConflict = Boolean(workspaceOwner);
-  const needsWorktree = executionMode === 'goal_workloop' && (placementConstraint.requireWorktree
-    || placementConflict
+  // Pure remote effects do not participate in repository workspace ownership.
+  // An unrelated canonical writer, dirty checkout, or repository parallelism must
+  // not manufacture a Git worktree for browser/API work that has no source authority.
+  // Explicit typed isolation remains authoritative for the rare remote effect that
+  // genuinely declares a repository workspace requirement.
+  const repositoryWorkspaceParticipant = resolvedWorkKind !== 'remote_effect';
+  const placementConflict = repositoryWorkspaceParticipant && Boolean(workspaceOwner);
+  const trustedDirtyPaths = ctx.workspaceChangedPaths
+    ? [...new Set(ctx.workspaceChangedPaths.map((path) => path.trim()).filter(Boolean))].sort()
+    : undefined;
+  const dirtyWorkspaceOwnershipConflict = repositoryWorkspaceParticipant
+    && input.modeInput.workspaceDirty === true
+    && (
+      !trustedDirtyPaths
+      || trustedDirtyPaths.length === 0
+      || effectiveAllowedPaths.length === 0
+      || trustedDirtyPaths.some((path) => (
+        effectiveForbiddenPaths.some((pattern) => globMatches(pattern, path))
+        || !effectiveAllowedPaths.some((pattern) => globMatches(pattern, path))
+      ))
+    );
+  const automaticRepositoryIsolation = repositoryWorkspaceParticipant && (
+    placementConflict
+    || dirtyWorkspaceOwnershipConflict
     || input.modeInput.requiresParallelism === true
-    || routeDecision.requiresIsolation === true);
-  if (!needsWorktree && workspaceOwner) {
+  );
+  const needsWorktree = executionMode === 'goal_workloop' && (
+    placementConstraint.requireWorktree
+    || automaticRepositoryIsolation
+    || routeDecision.requiresIsolation === true
+  );
+  if (!needsWorktree && workspaceOwner && repositoryWorkspaceParticipant) {
     return buildFacadeResult({
       status: 'blocked',
       summary: `WORKSPACE_OWNERSHIP_INVARIANT: unresolved admission reached checkout ${ctx.checkoutId} while active Work ${workspaceOwner.workId} owns it. This is an internal routing invariant, not a normal fallback path.`,
@@ -812,9 +1288,17 @@ export function startGoalWorkloop(
       rawAvailable: false,
     });
   }
-  const generatedWorkId = workIdFor(input.objective);
-  if (input.planId || input.planStepId) {
-    if (!input.planId || !input.planStepId || !ctx.planStore || !ctx.sourceRevision || !plan || !planStep) {
+  const requestedWorkId = input.workId?.trim();
+  if (requestedWorkId && !/^work-[a-z0-9][a-z0-9-]{0,199}$/i.test(requestedWorkId)) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: 'WORK_ID_INVALID: explicit Work ids must use the canonical work-<slug> form.',
+      data: { executionStarted: false, workContractCreated: false },
+    });
+  }
+  const generatedWorkId = requestedWorkId ?? workIdFor(effectiveObjective);
+  if (resolvedPlanId || resolvedPlanStepId) {
+    if (!resolvedPlanId || !resolvedPlanStepId || !ctx.planStore || !ctx.sourceRevision || !plan || !planStep) {
       return buildFacadeResult({ status: 'blocked', summary: 'PLAN_CONTEXT_REQUIRED: plan_id, plan_step_id, an executable Plan step and a current source revision are required.', data: { executionStarted: false } });
     }
     if (plan.status !== 'approved' && plan.status !== 'executing') {
@@ -822,8 +1306,8 @@ export function startGoalWorkloop(
     }
     if (plan.sourceRevision !== ctx.sourceRevision) {
       const invalidated = claimPlanStepForWork(ctx.planStore, {
-        planId: input.planId,
-        stepId: input.planStepId,
+        planId: resolvedPlanId,
+        stepId: resolvedPlanStepId,
         workId: generatedWorkId,
         sourceRevision: ctx.sourceRevision,
       });
@@ -846,46 +1330,48 @@ export function startGoalWorkloop(
     normalized.validCheckIds,
     normalized.suggestedNextActions,
   );
-  // allowed_paths and initial_likely_paths are policy/discovery fences, not proof
-  // that this Work owns a repository mutation. External-effect Work therefore
-  // needs either an explicit repository_change semantic choice or concrete
-  // expected source-change evidence before Forge treats it as repository_change.
-  const repositoryChangeIntent = input.workKind === 'repository_change'
-    || (input.modeInput.expectedFiles ?? 0) > 0
-    || (input.modeInput.expectedChangedLines ?? 0) > 0;
-  const typedRecoverableReadOnlyReview = input.workKind === undefined
-    && input.modeInput.mutation === false
-    && input.modeInput.requiresInvestigation === true
-    && input.modeInput.requiresRecovery === true;
-  const resolvedWorkKind = input.workKind ?? (
-    typedRecoverableReadOnlyReview
-      ? 'read_only_review'
-      : input.modeInput.requiresExternalEffect === true
-        && !repositoryChangeIntent
-        ? (input.modeInput.remoteWrite === true ? 'remote_effect' : 'local_effect')
-        : 'repository_change'
-  );
   const remoteDeliveryRequired = resolvedWorkKind === 'repository_change'
     && input.modeInput.requiresExternalEffect === true
     && input.modeInput.remoteWrite === true;
+  const effectiveConstraints: WorkContract['constraints'] = {
+    ...canonicalConstraints,
+    ...(needsWorktree ? { workspaceMode: 'isolated' as const, requireWorktree: true } : {}),
+    ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
+  };
+  const worktreeReason = placementConstraint.requireWorktree || routeDecision.requiresIsolation === true
+    ? 'Typed placement or Route Policy requires isolated execution.'
+    : dirtyWorkspaceOwnershipConflict
+      ? 'Trusted repository observation found dirty paths outside or ambiguous to the Work path fence; isolated placement prevents unrelated changes from entering Work ownership or verification.'
+      : placementConflict
+        ? 'The selected checkout is already owned by another active Work; this Work requires isolated placement.'
+        : repositoryWorkspaceParticipant && input.modeInput.requiresParallelism === true
+          ? 'Parallel Work requires isolated placement.'
+          : 'Current workspace is the stability-first default; isolation remains opt-in.';
+  const forgeInstanceId = ctx.workStore.controllerHome
+    ? readForgeInstanceIdentity(ctx.workStore.controllerHome)?.instanceId
+    : undefined;
   const work = createWorkContract(ctx.workStore, {
     workId: generatedWorkId,
     repoId: ctx.repoId,
     checkoutId: needsWorktree ? undefined : ctx.checkoutId,
+    executionPlacement: executionPlacement({
+      ...(forgeInstanceId ? { forgeInstanceId } : {}),
+      repositoryId: ctx.repoId,
+      ...(!needsWorktree && ctx.checkoutId ? { checkoutId: ctx.checkoutId } : {}),
+    }),
     principalId: ctx.principalId,
     controllerInstanceId: ctx.controllerInstanceId,
     baseRevision: ctx.sourceRevision,
+    repositoryBaseState: ctx.sourceBaseState ?? (ctx.sourceRevision ? 'revision' : undefined),
     workspaceFingerprint: needsWorktree ? undefined : ctx.workspaceFingerprint,
     routeDecisionFingerprint: routeDecision.inputFingerprint,
     routeDecision,
     mode: executionMode,
-    objective: input.objective,
+    objective: effectiveObjective,
     acceptanceCriteria: effectiveAcceptanceCriteria,
-    constraints: {
-      ...canonicalConstraints,
-      ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
-    },
-    risk: workRiskFor(input),
+    constraints: effectiveConstraints,
+    risk: workRisk,
+    engineeringContext,
     // Remote delivery is a risk/effect dimension, not a reason to erase a
     // repository-change Work's semantic identity. Pure external actions with no
     // repository-change signal remain remote_effect and keep plugin receipt semantics.
@@ -895,9 +1381,10 @@ export function startGoalWorkloop(
     issueId: input.issueId,
     taskId: input.taskId,
     requirementId: effectiveRequirementId,
-    planId: input.planId,
-    planStepId: input.planStepId,
-    planSourceRevision: input.planId ? ctx.sourceRevision : undefined,
+    predecessorWorkId: terminalContinuationSource?.workId,
+    planId: resolvedPlanId,
+    planStepId: resolvedPlanStepId,
+    planSourceRevision: resolvedPlanId ? ctx.sourceRevision : undefined,
     scopeSummary: input.modeInput.scopeClear ? 'scope declared at start' : 'scope incomplete',
     scopeEvidence: {
       initialLikelyPaths: [...new Set(input.initialLikelyPaths ?? effectiveAllowedPaths)].slice(0, 100),
@@ -917,9 +1404,7 @@ export function startGoalWorkloop(
     },
     worktreePolicy: {
       required: needsWorktree,
-      reason: needsWorktree
-        ? 'Isolation was explicitly requested or required for parallel execution.'
-        : 'Current workspace is the stability-first default; isolation remains opt-in.',
+      reason: worktreeReason,
     },
     worktreeRef: undefined,
     evidencePolicy: {
@@ -938,17 +1423,18 @@ export function startGoalWorkloop(
       handoffOnAmbiguity: true,
     },
     requestedBy: input.requestedBy ?? 'chatgpt',
-    evidenceRefs: [initialEvidence(input.objective)],
+    requestId: input.requestId?.trim() || undefined,
+    evidenceRefs: [initialEvidence(effectiveObjective)],
     policyDecisions: policy ? [policy] : [],
     suggestedNextActions: initialSuggestedNextActions,
-    continuationPrompt: `Continue work ${ctx.repoId}: ${input.objective.slice(0, 200)}`,
+    continuationPrompt: `Continue work ${ctx.repoId}: ${effectiveObjective.slice(0, 200)}`,
   });
 
-  if (input.planId && input.planStepId && ctx.planStore && ctx.sourceRevision) {
+  if (resolvedPlanId && resolvedPlanStepId && ctx.planStore && ctx.sourceRevision) {
     try {
       const claimed = claimPlanStepForWork(ctx.planStore, {
-        planId: input.planId,
-        stepId: input.planStepId,
+        planId: resolvedPlanId,
+        stepId: resolvedPlanStepId,
         workId: work.workId,
         sourceRevision: ctx.sourceRevision,
       });
@@ -963,16 +1449,18 @@ export function startGoalWorkloop(
       return buildFacadeResult({
         status: 'blocked',
         summary: error instanceof Error ? error.message : 'PLAN_STEP_CLAIM_FAILED',
-        data: { planId: input.planId, planStepId: input.planStepId, executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), canonicalWorkRetained: true },
+        data: { planId: resolvedPlanId, planStepId: resolvedPlanStepId, executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), canonicalWorkRetained: true },
       });
     }
   }
 
   return buildFacadeResult({
     status: 'ok',
-    summary: executionMode === 'direct_control'
-      ? `Direct-control Work lineage started as ${work.workId}.`
-      : `Goal workloop started as ${work.workId}.`,
+    summary: terminalContinuationSource
+      ? `Successor Work ${work.workId} continues semantic lineage from terminal ${terminalContinuationSource.workId}${resolvedPlanId && resolvedPlanStepId ? ` at ${resolvedPlanId}/${resolvedPlanStepId}` : ''}.`
+      : executionMode === 'direct_control'
+        ? `Direct-control Work lineage started as ${work.workId}.`
+        : `Goal workloop started as ${work.workId}.`,
     data: {
       mode: {
         mode: executionMode,
@@ -1026,6 +1514,150 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  if (input.verifiedEngineeringEvidence) {
+    const sourceIdentity = ctx.sourceRevision?.trim()
+      ? { kind: 'revision' as const, revision: ctx.sourceRevision.trim() }
+      : ctx.sourceBaseState === 'unborn'
+        ? { kind: 'unborn' as const }
+        : { kind: 'unknown' as const };
+    let refreshedEngineeringContext;
+    try {
+      refreshedEngineeringContext = buildEngineeringContextReceipt({
+        risk: work.risk,
+        sourceIdentity,
+        evidence: input.verifiedEngineeringEvidence,
+        recordedAt: nowIso(ctx),
+      });
+    } catch (error) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: error instanceof Error ? error.message : 'ENGINEERING_CONTEXT_INVALID',
+        data: { work: summarizeWorkContract(work), engineeringEvidenceUpdated: false },
+      });
+    }
+    const priorDesign = work.engineeringContext?.evidence.designDecisionReceipt;
+    if (work.engineeringContext?.designState === 'revisit_required' && priorDesign) {
+      const nextDesign = refreshedEngineeringContext.evidence.designDecisionReceipt;
+      if (!nextDesign || nextDesign.supersedesReceiptId !== priorDesign.receiptId) {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: 'ENGINEERING_DESIGN_SUPERSESSION_REQUIRED: same-root-cause re-entry requires a new design receipt that explicitly supersedes the prior design.',
+          data: { work: summarizeWorkContract(work), priorDesignReceiptId: priorDesign.receiptId },
+        });
+      }
+      if (refreshedEngineeringContext.evidence.independentCritiqueReceipt?.decision !== 'approved') {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: 'ENGINEERING_DESIGN_CRITIQUE_APPROVAL_REQUIRED: same-root-cause re-entry requires an independently approved critique of the superseding design.',
+          data: { work: summarizeWorkContract(work), priorDesignReceiptId: priorDesign.receiptId, nextDesignReceiptId: nextDesign.receiptId },
+        });
+      }
+    }
+    work = updateWorkContract(ctx.workStore, work.workId, { engineeringContext: refreshedEngineeringContext });
+  }
+
+  if (work.engineeringContext?.designState === 'revisit_required') {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: 'ENGINEERING_DESIGN_REVISIT_REQUIRED: same-root-cause design authority must be explicitly superseded and independently approved before further Work mutation.',
+      data: { work: summarizeWorkContract(work) },
+      suggestedNextActions: [{
+        label: 'Refresh design evidence',
+        tool: 'rh_context',
+        operation: 'search',
+        payload: { work_id: work.workId, query: 'Refresh current source and design evidence for this Work before engineering re-entry.' },
+        risk: 'readonly',
+      }],
+    });
+  }
+
+  if (input.engineeringBlocker) {
+    if (!work.engineeringContext || work.engineeringContext.sourceIdentity.kind !== 'revision') {
+      return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_SOURCE_IDENTITY_REQUIRED', data: { work: summarizeWorkContract(work) } });
+    }
+    let blocker;
+    let linkedWork: WorkContract | undefined;
+    try {
+      let linkedWorkId: string | undefined;
+      if (input.engineeringBlocker.classification === 'unrelated') {
+        linkedWorkId = linkedEngineeringBlockerWorkId(work.workId, input.engineeringBlocker.blockerId);
+        linkedWork = getWorkContract(ctx.workStore, linkedWorkId);
+        if (!linkedWork) {
+          const linked = routeWorkStart(ctx, {
+            workId: linkedWorkId,
+            objective: `Resolve unrelated blocker ${input.engineeringBlocker.blockerId}: ${input.engineeringBlocker.rationale}`,
+            acceptanceCriteria: [
+              `Resolve blocker ${input.engineeringBlocker.blockerId} without widening Work ${work.workId}.`,
+              'Return bounded evidence or a precise wake/blocker condition to the owning Controller.',
+            ],
+            allowedPaths: [],
+            initialLikelyPaths: [],
+            forbiddenPaths: [],
+            checks: [],
+            modeInput: {
+              scopeClear: false,
+              mutation: false,
+              requiresInvestigation: true,
+              requiresRecovery: true,
+              requiresParallelism: true,
+            },
+            requestedBy: 'chatgpt',
+            relatedWorkId: work.workId,
+            workRelation: 'parallel',
+            requirementId: work.requirementId,
+            workKind: 'investigation',
+            constraints: { accessMode: work.constraints.accessMode },
+          });
+          linkedWork = getWorkContract(ctx.workStore, linkedWorkId);
+          if (linked.status !== 'ok' || !linkedWork) {
+            return buildFacadeResult({
+              status: 'blocked',
+              summary: `ENGINEERING_LINKED_WORK_ADMISSION_FAILED: ${linked.summary}`,
+              data: { work: summarizeWorkContract(work), linkedWorkId, linkedWorkCreated: false },
+            });
+          }
+        }
+      }
+      blocker = buildEngineeringBlockerDispositionReceipt({
+        sourceRevision: work.engineeringContext.sourceIdentity.revision,
+        blockerId: input.engineeringBlocker.blockerId,
+        classification: input.engineeringBlocker.classification,
+        semanticScopeKeys: input.engineeringBlocker.semanticScopeKeys ?? work.engineeringContext.semanticScope?.keys ?? [],
+        ...(linkedWork ? { linkedWorkId: linkedWork.workId } : {}),
+        rationale: input.engineeringBlocker.rationale,
+        recordedAt: nowIso(ctx),
+      });
+      const nextEngineering = applyEngineeringBlockerDisposition(work.engineeringContext, blocker);
+      work = updateWorkContract(ctx.workStore, work.workId, { engineeringContext: nextEngineering });
+    } catch (error) {
+      return buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'ENGINEERING_BLOCKER_INVALID', data: { work: summarizeWorkContract(work) } });
+    }
+    const returnToDesign = blocker.action === 'return_to_design';
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: returnToDesign
+        ? `Same-root-cause blocker ${blocker.blockerId} requires Product/Design re-entry before further mutation.`
+        : `Unrelated blocker ${blocker.blockerId} is linked to ${blocker.linkedWorkId}; current Work semantic scope is unchanged.`,
+      data: {
+        work: summarizeWorkContract(work),
+        engineeringBlocker: blocker,
+        ...(linkedWork ? { linkedWork: summarizeWorkContract(linkedWork), linkedWorkCreated: true } : {}),
+        nextStep: blocker.action,
+      },
+      suggestedNextActions: returnToDesign
+        ? [{
+            label: 'Refresh design evidence',
+            tool: 'rh_context',
+            operation: 'search',
+            payload: { work_id: work.workId, query: 'Refresh current source and design evidence for this Work before engineering re-entry.' },
+            risk: 'readonly',
+          }]
+        : linkedWork
+          ? [{ label: 'Continue linked Work', tool: 'rh_work', operation: 'continue', payload: { work_id: linkedWork.workId }, risk: 'workspace_write' }]
+          : [],
+    });
+  }
+
   if ((input.reviewFindings?.length ?? 0) > 0 && work.workKind !== 'read_only_review') {
     return buildFacadeResult({
       status: 'blocked',
@@ -1185,8 +1817,11 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     }
   }
 
-  const currentCheckRefs = work.checkRefs.filter((record) =>
-    verificationRecordAppliesToCurrentWorkspace(record, ctx.sourceRevision, ctx.workspaceFingerprint));
+  const currentCheckRefs = effectiveCurrentWorkVerificationRecords(
+    work,
+    ctx.sourceRevision,
+    ctx.workspaceFingerprint,
+  );
   const history = reconcileVerificationHistory(
     currentCheckRefs.map((record) => ({ checkId: record.checkId, outcome: record.outcome, recordedAt: record.recordedAt })),
   );
@@ -1530,38 +2165,35 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  const suggested = validateSuggestedNextActions([
-    {
-      label: 'Finalize work',
-      tool: 'rh_work',
-      operation: 'finalize',
-      payload: { work_id: work.workId },
-      risk: 'readonly',
-      confidence: 'high',
-    },
-  ]).actions;
+  const changedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? []);
+  if (workRequiresImplementationReview(work.workKind, changedPaths)) {
+    recordWorkScopeEvidence(ctx.workStore, work.workId, { actualChangedPaths: changedPaths });
+    transitionWorkContractPhase(ctx.workStore, work.workId, {
+      status: 'running',
+      phase: 'verification',
+      state: 'satisfied',
+      summary: 'Exact Work completion evidence proves the current candidate is verified and eligible for implementation review.',
+      evidenceRefs: work.evidenceRefs,
+    });
+    requestWorkImplementationReview(ctx.workStore, work.workId, 'Implementation and verification evidence are complete; explicit Controller implementation review is required before delivery.');
+    const suggested = validateSuggestedNextActions([implementationReviewSuggestedAction(work.workId)]).actions;
+    const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+    return buildFacadeResult({
+      status: 'ok',
+      summary: 'Continue: implementation and verification evidence are complete; explicit implementation review is next.',
+      data: { work: summarizeWorkContract(updated), backgroundCompleted: false, nextStep: 'review' },
+      suggestedNextActions: suggested,
+    });
+  }
+  const suggested = validateSuggestedNextActions([{
+    label: 'Finalize work', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high',
+  }]).actions;
   transitionWorkContractPhase(ctx.workStore, work.workId, {
-    status: 'running',
-    phase: 'delivery',
-    state: 'active',
-    summary: work.workKind === 'read_only_review'
-      ? 'Read-only review evidence is source-bound and clean; semantic no-change finalization is next.'
-      : 'Implementation and verification evidence are sufficient; exact delivery and cleanup receipt is next.',
-    evidenceRefs: work.evidenceRefs,
-  });
-  const updated = updateWorkContract(ctx.workStore, work.workId, {
-    suggestedNextActions: suggested,
-  });
-  return buildFacadeResult({
-    status: 'ok',
-    summary: `Continue: checks satisfied or none required; ready to finalize after ChatGPT review.`,
-    data: {
-      work: summarizeWorkContract(updated),
-      backgroundCompleted: false,
-      nextStep: 'finalize',
-    },
-    suggestedNextActions: suggested,
+    status: 'running', phase: 'delivery', state: 'active',
+    summary: 'Source-free Work evidence is complete; implementation review is not required and semantic finalization is next.', evidenceRefs: work.evidenceRefs,
   });
+  const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+  return buildFacadeResult({ status: 'ok', summary: 'Continue: evidence is complete; ready to finalize.', data: { work: summarizeWorkContract(updated), backgroundCompleted: false, nextStep: 'finalize' }, suggestedNextActions: suggested });
 }
 
 export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopVerifyInput): FacadeResult {
@@ -1668,17 +2300,49 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
   const completionEvidence = classified.outcome === 'valid_pass'
     ? evaluateWorkCompletionEvidence(updated, sourceRevision, input.workspaceFingerprint)
     : undefined;
-  const validPassReadyToFinalize = completionEvidence?.status === 'complete';
+  const validPassReadyForNextBoundary = completionEvidence?.status === 'complete';
+  const currentChangedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? updated.scopeEvidence?.actualChangedPaths ?? []);
+  const latestReview = latestImplementationReview(updated.implementationReviews);
+  const approvedReviewRemainsAuthoritative = Boolean(
+    validPassReadyForNextBoundary
+    && updated.phase === 'delivery'
+    && updated.phaseEvidence.review.state === 'satisfied'
+    && latestReview?.decision === 'approved'
+    && sourceRevision
+    && input.workspaceFingerprint
+    && latestReview.sourceRevision === sourceRevision
+    && latestReview.verificationWorkspaceFingerprint === input.workspaceFingerprint
+    && latestReview.changedPathDigest === implementationReviewChangedPathDigest(currentChangedPaths)
+  );
+  const reviewRequiredAfterPass = validPassReadyForNextBoundary
+    && !approvedReviewRemainsAuthoritative
+    && workRequiresImplementationReview(updated.workKind, currentChangedPaths);
+  if (approvedReviewRemainsAuthoritative && updated.evidenceState !== 'valid') {
+    recordWorkEvidenceState(ctx.workStore, updated.workId, 'valid');
+  }
+  if (reviewRequiredAfterPass) {
+    recordWorkScopeEvidence(ctx.workStore, updated.workId, { actualChangedPaths: [...(ctx.workspaceChangedPaths ?? [])] });
+    transitionWorkContractPhase(ctx.workStore, updated.workId, {
+      status: 'running',
+      phase: 'verification',
+      state: 'satisfied',
+      summary: 'All required exact Work verification receipts are current; implementation review admission is now allowed.',
+      evidenceRefs: updated.evidenceRefs,
+    });
+    requestWorkImplementationReview(ctx.workStore, updated.workId, 'Verification is complete; explicit Controller implementation review is required before delivery.');
+  }
   const suggested = validateSuggestedNextActions(
     classified.outcome === 'valid_pass'
-      ? [{
-          label: validPassReadyToFinalize ? 'Finalize work' : 'Continue workloop',
-          tool: 'rh_work',
-          operation: validPassReadyToFinalize ? 'finalize' : 'continue',
-          payload: { work_id: work.workId },
-          risk: 'readonly',
-          confidence: 'high',
-        }]
+      ? [reviewRequiredAfterPass
+          ? implementationReviewSuggestedAction(work.workId)
+          : {
+              label: validPassReadyForNextBoundary ? 'Finalize work' : 'Continue workloop',
+              tool: 'rh_work',
+              operation: validPassReadyForNextBoundary ? 'finalize' : 'continue',
+              payload: { work_id: work.workId },
+              risk: 'readonly',
+              confidence: 'high',
+            }]
       : classified.outcome === 'valid_fail'
         ? [{
             label: 'Continue for review handoff',
@@ -1714,7 +2378,7 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
       },
       backgroundCompleted: false,
       ...(classified.outcome === 'valid_pass'
-        ? { nextStep: validPassReadyToFinalize ? 'finalize' : 'continue' }
+        ? { nextStep: reviewRequiredAfterPass ? 'review' : validPassReadyForNextBoundary ? 'finalize' : 'continue' }
         : {}),
     },
     warnings: classified.warnings,
@@ -1723,6 +2387,70 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
   });
 }
 
+export function reviewGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopReviewInput): FacadeResult {
+  let work = getWorkContract(ctx.workStore, input.workId);
+  if (!work) return buildFacadeResult({ status: 'not_found', summary: `WorkContract ${input.workId} not found.`, data: { workId: input.workId } });
+  if (work.status === 'completed' || work.status === 'cancelled' || work.status === 'failed') {
+    return buildFacadeResult({ status: 'blocked', summary: `WorkContract ${work.workId} is terminal (${work.status}); implementation review was not recorded.`, data: { work: summarizeWorkContract(work) } });
+  }
+  const reviewerPrincipalId = ctx.principalId?.trim() ?? '';
+  if (!reviewerPrincipalId) {
+    return buildFacadeResult({ status: 'blocked', summary: 'WORK_IMPLEMENTATION_REVIEW_REVIEWER_REQUIRED: authenticated reviewer principal is required.', data: { work: summarizeWorkContract(work) } });
+  }
+  if (!input.rationale?.trim()) {
+    return buildFacadeResult({ status: 'blocked', summary: 'WORK_IMPLEMENTATION_REVIEW_RATIONALE_REQUIRED: explicit review rationale is required.', data: { work: summarizeWorkContract(work) } });
+  }
+  try {
+    const candidate = currentImplementationReviewCandidate(ctx, work);
+    recordWorkScopeEvidence(ctx.workStore, work.workId, { actualChangedPaths: [...candidate.changedPaths] });
+    work = getWorkContract(ctx.workStore, work.workId) ?? work;
+    if (work.phase !== 'review') {
+      throw new Error('WORK_IMPLEMENTATION_REVIEW_PHASE_REQUIRED: verify or continue the exact candidate into review before recording a decision.');
+    }
+    const at = nowIso(ctx);
+    const review: WorkImplementationReviewRecord = {
+      schemaVersion: 1,
+      reviewId: `impl-review-${randomUUID().slice(0, 12)}`,
+      workId: work.workId,
+      reviewerPrincipalId,
+      decision: input.decision,
+      rationale: input.rationale.trim().slice(0, 4_000),
+      findings: (input.findings ?? []).slice(0, 100).map((finding) => ({
+        severity: finding.severity,
+        category: finding.category.trim().slice(0, 160),
+        summary: finding.summary.trim().slice(0, 1_000),
+        ...(finding.path?.trim() ? { path: finding.path.trim() } : {}),
+        ...(finding.symbol?.trim() ? { symbol: finding.symbol.trim().slice(0, 240) } : {}),
+      })),
+      sourceRevision: candidate.sourceRevision,
+      workspaceFingerprint: candidate.workspaceFingerprint,
+      verificationWorkspaceFingerprint: candidate.verificationWorkspaceFingerprint,
+      changedPaths: [...candidate.changedPaths],
+      changedPathDigest: implementationReviewChangedPathDigest(candidate.changedPaths),
+      acceptanceCriteriaSummary: implementationReviewAcceptanceSummary(work),
+      verificationEvidence: [...candidate.verificationEvidence],
+      architectureEvidence: [...(candidate.architectureEvidence ?? [])],
+      recordedAt: at,
+    };
+    const updated = recordWorkImplementationReview(ctx.workStore, work.workId, review);
+    const suggested = validateSuggestedNextActions(input.decision === 'approved'
+      ? [{ label: 'Finalize reviewed work', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'workspace_write', confidence: 'high' }]
+      : input.decision === 'changes_required'
+        ? [{ label: 'Continue implementation repairs', tool: 'rh_work', operation: 'continue', payload: { work_id: work.workId }, risk: 'workspace_write', confidence: 'high' }]
+        : [{ label: 'Inspect blocked review evidence', tool: 'rh_context', operation: 'get', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high' }]).actions;
+    const persisted = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+    return buildFacadeResult({
+      status: input.decision === 'blocked' ? 'blocked' : 'ok',
+      summary: `Implementation review ${review.reviewId}: ${input.decision}.`,
+      data: { work: summarizeWorkContract(persisted), review, nextStep: input.decision === 'approved' ? 'finalize' : input.decision === 'changes_required' ? 'continue' : 'blocked' },
+      suggestedNextActions: suggested,
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return buildFacadeResult({ status: 'blocked', summary: message, data: { work: summarizeWorkContract(work) }, suggestedNextActions: suggestedForWork(work) });
+  }
+}
+
 export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopFinalizeInput): FacadeResult {
   const work = getWorkContract(ctx.workStore, input.workId);
   if (!work) {
@@ -1764,6 +2492,65 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  const currentChangedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? []);
+  if (workRequiresImplementationReview(work.workKind, currentChangedPaths)) {
+    try {
+      const candidate = currentImplementationReviewCandidate(ctx, work);
+      assertImplementationReviewPreDeliveryBoundary({
+        repoId: work.repoId,
+        workId: work.workId,
+        workKind: work.workKind,
+        reviews: work.implementationReviews,
+        candidate,
+        requiredCheckIds: work.checks,
+        verificationRecords: work.checkRefs,
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const reviewDecisionBlocked = /WORK_IMPLEMENTATION_REVIEW_(REQUIRED|STALE|CHANGES_REQUIRED|BLOCKED)/.test(message);
+      if (reviewDecisionBlocked) {
+        transitionWorkContractPhase(ctx.workStore, work.workId, {
+          status: 'running',
+          phase: 'verification',
+          state: 'satisfied',
+          summary: `Current exact verification remains authoritative, but implementation review must be renewed before delivery: ${message}`,
+          evidenceRefs: work.evidenceRefs,
+        });
+        requestWorkImplementationReview(ctx.workStore, work.workId, `Pre-delivery implementation review gate requires a renewed Controller decision: ${message}`);
+        const suggested = validateSuggestedNextActions([implementationReviewSuggestedAction(work.workId)]).actions;
+        const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: message,
+          data: { work: summarizeWorkContract(updated), nextStep: 'review' },
+          suggestedNextActions: suggested,
+        });
+      }
+      transitionWorkContractPhase(ctx.workStore, work.workId, {
+        status: 'running',
+        phase: 'verification',
+        state: 'active',
+        summary: `Pre-delivery review could not prove an exact verified candidate: ${message}`,
+        evidenceRefs: work.evidenceRefs,
+      });
+      const suggested = validateSuggestedNextActions([{
+        label: 'Verify exact candidate',
+        tool: 'rh_work',
+        operation: 'verify',
+        payload: { work_id: work.workId, check_id: work.checks[0] },
+        risk: 'workspace_write',
+        confidence: work.checks[0] ? 'high' : 'medium',
+      }], { validCheckIds: work.checks }).actions;
+      const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: message,
+        data: { work: summarizeWorkContract(updated), nextStep: 'verify' },
+        suggestedNextActions: suggested,
+      });
+    }
+  }
+
   const completionEvidence = evaluateWorkCompletionEvidence(
     work,
     ctx.sourceRevision,
@@ -1774,11 +2561,9 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
   const history = completionEvidence.history;
 
   if (input.forceFailed || completionEvidence.status === 'failed') {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'failed',
-      phase: 'cleanup',
-      state: 'failed',
-      summary: `Work failed acceptance/finalization: ${history.acceptanceFailures.join(', ') || 'forced failure'}.`,
+    const updated = failWorkContract(ctx.workStore, work.workId, {
+      phase: work.phase,
+      summary: `Work failed acceptance/finalization while in ${work.phase}: ${history.acceptanceFailures.join(', ') || 'forced failure'}.`,
       evidenceRefs: work.evidenceRefs,
     });
     if (updated.planId && updated.planStepId && ctx.planStore) {
@@ -2017,10 +2802,7 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
   }
 
   const destructiveCleanup = input.authorizeDestructiveCleanup === true;
-  transitionWorkContractPhase(ctx.workStore, work.workId, {
-    status: 'cancelled',
-    phase: 'cleanup',
-    state: 'skipped',
+  cancelWorkContract(ctx.workStore, work.workId, {
     summary: input.reason ? `Stopped: ${input.reason}` : 'Work stopped without destructive cleanup.',
     evidenceRefs: work.evidenceRefs,
   });
@@ -2068,15 +2850,22 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
   });
 }
 
+export interface GoalWorkloopTrustedInput {
+  /** Runtime-composed source-bound evidence. This channel is intentionally separate from raw MCP/tool arguments. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
+}
+
 export function runGoalWorkloop(
   ctx: GoalWorkloopContext,
   operation: GoalWorkloopOperation,
   args: Record<string, unknown>,
+  trusted: GoalWorkloopTrustedInput = {},
 ): FacadeResult {
   switch (operation) {
     case 'start':
       return routeWorkStart(ctx, {
         objective: String(args.objective ?? ''),
+        workId: typeof args.work_id === 'string' ? args.work_id : undefined,
         acceptanceCriteria: Array.isArray(args.acceptance_criteria) ? args.acceptance_criteria.map(String) : undefined,
         allowedPaths: Array.isArray(args.allowed_paths) ? args.allowed_paths.map(String) : undefined,
         initialLikelyPaths: Array.isArray(args.initial_likely_paths) ? args.initial_likely_paths.map(String) : undefined,
@@ -2090,7 +2879,7 @@ export function runGoalWorkloop(
           requiresInvestigation: args.requires_investigation === true,
           requiresLongRunningChecks: args.requires_long_running_checks === true,
           requiresParallelism: args.requires_parallelism === true,
-          explicitMode: args.mode === 'scale' ? 'scale' : undefined,
+          explicitMode: args.mode === 'plan' || args.mode === 'scale' ? args.mode : undefined,
           needsDependencies: args.needs_dependencies === true,
           requiresRecovery: args.requires_recovery === true,
           requiresWorker: args.requires_worker === true,
@@ -2117,6 +2906,7 @@ export function runGoalWorkloop(
         requirementId: typeof args.requirement_id === 'string' ? args.requirement_id : undefined,
         planId: typeof args.plan_id === 'string' ? args.plan_id : undefined,
         planStepId: typeof args.plan_step_id === 'string' ? args.plan_step_id : undefined,
+        verifiedEngineeringEvidence: trusted.verifiedEngineeringEvidence,
         workKind: args.work_kind === 'repository_change'
           || args.work_kind === 'completed_no_change'
           || args.work_kind === 'read_only_review'
@@ -2127,7 +2917,24 @@ export function runGoalWorkloop(
           ? args.work_kind
           : undefined,
       });
-    case 'continue':
+    case 'continue': {
+      let engineeringBlocker: GoalWorkloopContinueInput['engineeringBlocker'];
+      if (args.engineering_blocker !== undefined) {
+        if (!args.engineering_blocker || typeof args.engineering_blocker !== 'object' || Array.isArray(args.engineering_blocker)) {
+          return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_INVALID', data: { workId: String(args.work_id ?? '') } });
+        }
+        const rawBlocker = args.engineering_blocker as Record<string, unknown>;
+        const classification = rawBlocker.classification;
+        if (classification !== 'same_root_cause' && classification !== 'unrelated') {
+          return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_CLASSIFICATION_INVALID', data: { workId: String(args.work_id ?? '') } });
+        }
+        engineeringBlocker = {
+          blockerId: String(rawBlocker.blocker_id ?? ''),
+          classification,
+          rationale: String(rawBlocker.rationale ?? ''),
+          semanticScopeKeys: Array.isArray(rawBlocker.semantic_scope_keys) ? rawBlocker.semantic_scope_keys.map(String) : undefined,
+        };
+      }
       return continueGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),
         note: typeof args.note === 'string' ? args.note : undefined,
@@ -2147,7 +2954,10 @@ export function runGoalWorkloop(
         acceptanceFailureDecision: args.acceptance_failure_decision === 'repair' || args.acceptance_failure_decision === 'rescope'
           ? args.acceptance_failure_decision
           : undefined,
+        verifiedEngineeringEvidence: trusted.verifiedEngineeringEvidence,
+        engineeringBlocker,
       });
+    }
     case 'verify':
       return verifyGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),
@@ -2156,6 +2966,31 @@ export function runGoalWorkloop(
         checkFailed: args.check_failed === true,
         skipped: args.skipped === true,
       });
+    case 'review': {
+      if (args.review_decision !== 'approved' && args.review_decision !== 'changes_required' && args.review_decision !== 'blocked') {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: 'WORK_IMPLEMENTATION_REVIEW_DECISION_REQUIRED: operation=review requires an explicit approved, changes_required, or blocked decision.',
+          data: { workId: String(args.work_id ?? '') },
+        });
+      }
+      return reviewGoalWorkloop(ctx, {
+        workId: String(args.work_id ?? ''),
+        decision: args.review_decision,
+        rationale: typeof args.review_rationale === 'string' ? args.review_rationale : '',
+        findings: Array.isArray(args.implementation_review_findings)
+          ? args.implementation_review_findings
+              .filter((value): value is Record<string, unknown> => Boolean(value) && typeof value === 'object')
+              .map((value) => ({
+                severity: value.severity === 'critical' || value.severity === 'high' || value.severity === 'medium' || value.severity === 'low' || value.severity === 'info' ? value.severity : 'info',
+                category: typeof value.category === 'string' ? value.category : '',
+                summary: typeof value.summary === 'string' ? value.summary : '',
+                ...(typeof value.path === 'string' ? { path: value.path } : {}),
+                ...(typeof value.symbol === 'string' ? { symbol: value.symbol } : {}),
+              }))
+          : undefined,
+      });
+    }
     case 'finalize':
       return finalizeGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),