@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/control-plane/facade/goal-workloop.ts

@@ -1,35 +1,42 @@
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import {
   createHandoffItem,
-  listHandoffItems,
   type HandoffInboxStoreOptions,
 } from './handoff-inbox-store';
-import { getControllerSession } from './controller-session-store';
+import { executionPlacement, readForgeInstanceIdentity } from '../../../../packages/kernel/identity/api/index';
 import {
-  appendVerificationRecord,
+  applyEngineeringBlockerDisposition,
+  buildEngineeringBlockerDispositionReceipt,
+  buildEngineeringContextReceipt,
+  engineeringWorkProfileForRisk,
   appendWorkEvidence,
   appendWorkHandoffRef,
   createWorkContract,
+  failWorkContract,
   getWorkContract,
+  semanticWorkState,
   listWorkContracts,
+  readActiveWorkCandidates,
+  recordWorkEvidenceState,
   recordWorkScopeEvidence,
+  reviseWorkSemanticContext,
   summarizeWorkContract,
   transitionWorkContractPhase,
   updateWorkContract,
+  type EngineeringAdmissionEvidence,
+  type EvaluationPromotionReceipt,
   type WorkContractStoreOptions,
-} from './work-contract-store';
+} from '../../../../packages/kernel/work/api/index';
 import {
-  claimPlanStepForWork,
-  completePlanStepForWork,
   getPlanContract,
+  currentPlanSemanticRevision,
   type PlanContractStoreOptions,
 } from './plan-contract-store';
 import { withPrimaryWorkAdmissionLock } from './semantic-admission';
-import { completeWorkWithReceipt } from '../execution/work-completion-authority';
-import { evaluateReadOnlyReviewSourceIdentity, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence, verificationRecordAppliesToCurrentWorkspace } from '../execution/work-evidence-policy';
-import { readRequirement } from '../persistence/requirement-store';
+import { effectiveCurrentWorkVerificationRecords, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence } from '../execution/work-evidence-policy';
+import { hasSettledWorkDeliveryReceipt } from '../execution/work-completion-authority';
+import { currentRequirementSemanticRevision, readRequirement } from '../persistence/requirement-store';
 import {
-  classifyVerificationOutcome,
   normalizeCheckIds,
   reconcileVerificationHistory,
   type CheckDefinitionLike,
@@ -41,20 +48,17 @@ import { buildWorkContinuationSnapshot } from './work-continuation';
 import type {
   CapabilityRisk,
   EvidenceRef,
-  ExecutionModeSelectionInput,
   FacadeResult,
   PlanContract,
   PolicyDecision,
   SuggestedNextAction,
-  VerificationRecord,
   WorkContract,
+  WorkStartFacts,
   WorkKind,
   WorkRisk,
 } from './types';
-import { selectExecutionMode } from './types';
-import { resolveWorkspaceAdmissionConstraint } from '../routing/workspace-admission';
 
-export type GoalWorkloopOperation = 'start' | 'continue' | 'verify' | 'finalize' | 'stop';
+export type GoalWorkloopOperation = 'start' | 'continue' | 'stop';
 
 export interface GoalWorkloopContext {
   workStore: WorkContractStoreOptions;
@@ -63,10 +67,16 @@ export interface GoalWorkloopContext {
   availableChecks?: readonly CheckDefinitionLike[];
   planStore?: PlanContractStoreOptions;
   sourceRevision?: string;
+  /** Explicit only when repository observation proves the Work started from a revision or an unborn HEAD. */
+  sourceBaseState?: 'revision' | 'unborn';
   checkoutId?: string;
   principalId?: string;
   controllerInstanceId?: string;
   workspaceFingerprint?: string;
+  /** Trusted repository observation for placement admission. Never accept this as caller-supplied semantic authority. */
+  workspaceDirty?: boolean;
+  /** Stage-insensitive Git-canonical identity of the exact current review candidate. Derived by the trusted repository adapter. */
+  implementationReviewWorkspaceFingerprint?: string;
   /** Current net repository paths changed from the Work base plus dirty checkout paths. */
   workspaceChangedPaths?: readonly string[];
   /** Durable terminal repository Process ids explicitly bound to this Work + checkout. */
@@ -81,6 +91,8 @@ export type WorkAdmissionRelation = 'continue' | 'extend' | 'parallel' | 'new_go
 
 export interface GoalWorkloopStartInput {
   objective: string;
+  /** Optional exact durable identity reserved by the admission authority before creation. */
+  workId?: string;
   acceptanceCriteria?: string[];
   allowedPaths?: string[];
   /** Non-authoritative first-pass discovery candidates. */
@@ -88,8 +100,11 @@ export interface GoalWorkloopStartInput {
   forbiddenPaths?: string[];
   checks?: string[];
   constraints?: WorkContract['constraints'];
-  modeInput: ExecutionModeSelectionInput;
+  /** Concrete mechanical request facts. This capability is itself the explicit durable-Work choice. */
+  request: WorkStartFacts;
   requestedBy?: WorkContract['requestedBy'];
+  /** Stable durable admission identity for system-originated Work such as recurrent incident repair. */
+  requestId?: string;
   relatedWorkId?: string;
   workRelation?: WorkAdmissionRelation;
   requirementId?: string;
@@ -97,11 +112,12 @@ export interface GoalWorkloopStartInput {
   issueId?: string;
   approvalConfirmed?: boolean;
   dryRun?: boolean;
-  forceMode?: WorkContract['mode'];
   planId?: string;
   planStepId?: string;
   /** Explicit technical evidence shape chosen by the semantic Controller. Never inferred from objective/check text. */
   workKind?: Extract<WorkKind, 'repository_change' | 'completed_no_change' | 'read_only_review' | 'investigation' | 'local_effect' | 'remote_effect' | 'reconciliation'>;
+  /** Trusted source-bound evidence resolved by Forge evidence authorities before admission. Never populate this field from raw caller-supplied receipt ids. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
 }
 
 export interface GoalWorkloopAcceptanceEvidenceBinding {
@@ -124,32 +140,17 @@ export interface GoalWorkloopContinueInput {
   acceptanceEvidence?: GoalWorkloopAcceptanceEvidenceBinding[];
   /** Explicit Controller decision after deterministic acceptance failure; never inferred from note text. */
   acceptanceFailureDecision?: 'repair' | 'rescope';
-}
-
-export interface GoalWorkloopVerifyInput {
-  workId: string;
-  checkId: string;
-  /** Exact Git revision observed by the authoritative Work-bound verification Process. */
-  sourceRevision?: string;
-  /** Exact dirty-workspace content identity observed by the authoritative check. */
-  workspaceFingerprint?: string;
-  /** Stable semantic check-input identity used for exact evidence reuse. */
-  verificationInputFingerprint?: string;
-  /** Bounded command/invocation audit identity; not part of reusable semantic inputs. */
-  commandFingerprint?: string;
-  /** Persistence-safe Process receipt. Accepted only when its Work/repo/check identity matches this verification. */
-  receipt?: VerificationRecord['receipt'];
-  /** When true, simulate infrastructure failure rather than acceptance fail. */
-  infrastructureFailed?: boolean;
-  /** When true and check is valid, record acceptance failure. */
-  checkFailed?: boolean;
-  /** When true, skip without acceptance implication. */
-  skipped?: boolean;
-}
-
-export interface GoalWorkloopFinalizeInput {
-  workId: string;
-  forceFailed?: boolean;
+  /** Trusted refreshed engineering evidence minted by Runtime composition, never copied from raw caller receipt ids. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
+  /** Semantic Controller blocker classification; Forge derives the permitted action and persists the receipt. */
+  engineeringBlocker?: {
+    blockerId: string;
+    classification: 'same_root_cause' | 'same_root_cause_scope_extension' | 'unrelated';
+    rationale: string;
+    semanticScopeKeys?: string[];
+    /** Required for classification=unrelated: the exact Work that already owns the blocker. */
+    linkedWorkId?: string;
+  };
 }
 
 export interface GoalWorkloopStopInput {
@@ -178,44 +179,41 @@ function handoffIdFor(prefix: string): string {
 
 function workRiskFor(input: GoalWorkloopStartInput): WorkRisk {
   if (input.workKind === 'read_only_review') return 'readonly';
-  const risk = input.modeInput.risk;
-  if (input.modeInput.secretAccess === true || input.modeInput.destructive === true) return 'destructive';
-  if (input.modeInput.remoteWrite === true) return 'high';
+  const risk = input.request.risk;
+  if (input.request.secretAccess === true || input.request.destructive === true) return 'destructive';
+  if (input.request.remoteWrite === true) return 'high';
   if (risk === 'readonly') return 'readonly';
   if (risk === 'destructive' || risk === 'destructive_remote' || risk === 'raw_secret_config') return 'destructive';
   if (risk === 'remote_write') return 'high';
   if (risk === 'local_repo_write') return 'low';
+  if (risk === undefined) return 'low';
   return 'medium';
 }
 
+function resolvedWorkKindFor(input: GoalWorkloopStartInput): WorkKind {
+  if (input.workKind) return input.workKind;
+  if (input.request.requiresExternalEffect === true) {
+    // Mechanical effect classification only: a remote effect differs from a local
+    // effect in receipt identity. Predicted scope size is model strategy and is
+    // never consulted; callers declare `work_kind` when a repository change is
+    // also involved.
+    return input.request.remoteWrite === true ? 'remote_effect' : 'local_effect';
+  }
+  return 'repository_change';
+}
+
 function suggestedForWorkIdentity(workId: string, checks: string[], extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
-  const base: SuggestedNextAction[] = [
-    {
-      label: 'Continue workloop',
-      tool: 'rh_work',
-      operation: 'continue',
-      payload: { work_id: workId },
-      risk: 'readonly',
-      confidence: 'high',
-    },
-    {
-      label: 'Verify registered checks',
-      tool: 'rh_work',
-      operation: 'verify',
-      payload: { work_id: workId, check_id: checks[0] },
-      risk: 'workspace_write',
-      confidence: checks[0] ? 'high' : 'low',
-    },
-    {
-      label: 'Finalize when ready',
-      tool: 'rh_work',
-      operation: 'finalize',
-      payload: { work_id: workId },
-      risk: 'readonly',
-      confidence: 'medium',
-    },
-  ];
-  return validateSuggestedNextActions([...extras, ...base], {
+  const semanticRead: SuggestedNextAction = {
+    label: 'Read current Work semantic context',
+    tool: 'rh_work',
+    operation: 'get',
+    payload: { work_id: workId },
+    risk: 'readonly',
+    confidence: 'high',
+  };
+  // Suggested actions expose facts/capabilities only. The model decides whether
+  // implementation, checks, review, delivery, or semantic completion is next.
+  return validateSuggestedNextActions([...extras, semanticRead], {
     validCheckIds: checks,
   }).actions;
 }
@@ -240,31 +238,36 @@ export function routeWorkStart(
   ctx: GoalWorkloopContext,
   input: GoalWorkloopStartInput,
 ): FacadeResult {
-  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
-  if (placementResolution.ok === false) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `${placementResolution.code}: ${placementResolution.message}`,
-      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
-      rawAvailable: false,
-    });
-  }
-  const placementConstraint = placementResolution.constraint;
+  const workspaceMode: 'current' | 'isolated' = input.constraints?.workspaceMode === 'isolated' || input.constraints?.workspaceMode === 'auto' ? 'isolated' : 'current';
   const canonicalConstraints: WorkContract['constraints'] = {
     ...(input.constraints ?? {}),
-    workspaceMode: placementConstraint.workspaceMode,
-    requireWorktree: placementConstraint.requireWorktree,
-    directMainProhibited: placementConstraint.directMainProhibited,
+    workspaceMode,
   };
   const strategyConflictRequiresApproval = input.constraints?.architectureStrategyChange === true
     || input.constraints?.conflictsWithThinHarnessPolicy === true
     || input.constraints?.changesDefaultExecutionStrategy === true;
-  const relatedLifecycleSource = input.relatedWorkId ? getWorkContract(ctx.workStore, input.relatedWorkId) : undefined;
+  let relatedLifecycleSource: WorkContract | undefined;
+  if (input.relatedWorkId) {
+    try {
+      relatedLifecycleSource = getWorkContract(ctx.workStore, input.relatedWorkId);
+    } catch (error) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_RELATED_CONTRACT_INVALID: ${input.relatedWorkId} is malformed and cannot authorize a Work relationship.`,
+        data: {
+          executionStarted: false,
+          workContractCreated: false,
+          invalidWorkId: input.relatedWorkId,
+          invalidWorkError: error instanceof Error ? error.message : String(error),
+        },
+      });
+    }
+  }
   const inheritedReadOnlyReview = Boolean(
     input.workKind === undefined
     && input.workRelation === 'new_goal'
     && relatedLifecycleSource?.workKind === 'read_only_review'
-    && (relatedLifecycleSource.status === 'cancelled' || relatedLifecycleSource.status === 'completed' || relatedLifecycleSource.status === 'failed'),
+    && semanticWorkState(relatedLifecycleSource) !== 'open',
   );
   if (
     inheritedReadOnlyReview
@@ -279,19 +282,23 @@ export function routeWorkStart(
     });
   }
   const requestedWorkKind = input.workKind ?? (inheritedReadOnlyReview ? 'read_only_review' : undefined);
-  const typedReadOnlyReviewRequested = requestedWorkKind === undefined
-    && (input.modeInput.mutation === false || (input.modeInput.mutation === undefined && input.modeInput.risk === 'readonly'))
-    && input.modeInput.requiresInvestigation === true
-    && input.modeInput.requiresRecovery === true;
+  const explicitSourceMutationFence = input.allowedPaths !== undefined
+    && input.allowedPaths.length === 0
+    && (input.forbiddenPaths ?? []).some((value) => {
+      const normalized = value.trim().replace(/\\/g, '/');
+      return normalized === '*' || normalized === '**' || normalized === '**/*';
+    });
+  // A read-only review is an explicit `work_kind`, or an explicit source-mutation
+  // fence that proves no repository path may change. Forge never infers it from
+  // caller hints about investigation depth or recovery needs.
+  const typedReadOnlyReviewRequested = requestedWorkKind === undefined && explicitSourceMutationFence;
   const effectiveWorkKind = requestedWorkKind ?? (typedReadOnlyReviewRequested ? 'read_only_review' : undefined);
   const readOnlyReviewRequested = effectiveWorkKind === 'read_only_review';
   const readOnlyMutationConflict = readOnlyReviewRequested && (
-    input.modeInput.mutation === true
-    || (input.modeInput.expectedFiles ?? 0) > 0
-    || (input.modeInput.expectedChangedLines ?? 0) > 0
-    || input.modeInput.requiresExternalEffect === true
-    || input.modeInput.remoteWrite === true
-    || input.modeInput.destructive === true
+    input.request.mutation === true
+    || input.request.requiresExternalEffect === true
+    || input.request.remoteWrite === true
+    || input.request.destructive === true
   );
   if (readOnlyMutationConflict) {
     return buildFacadeResult({
@@ -300,151 +307,49 @@ export function routeWorkStart(
       data: { executionStarted: false, workContractCreated: false, workKind: effectiveWorkKind },
     });
   }
-  const effectiveModeInput: ExecutionModeSelectionInput = {
-    ...input.modeInput,
-    objective: input.objective,
-    knownPaths: input.allowedPaths,
-    workspacePlacement: placementConstraint.workspaceMode,
-    directMainProhibited: placementConstraint.directMainProhibited,
-    mutation: readOnlyReviewRequested ? false : input.modeInput.mutation ?? input.modeInput.risk !== 'readonly',
-    risk: readOnlyReviewRequested ? 'readonly' : input.modeInput.risk,
+  // A terminal continuation is not a new semantic request. Its durable predecessor
+  // and Plan lineage already define the goal scope, while the successor Plan step
+  // becomes the Work objective later in startGoalWorkloop.
+  const routeObjective = input.objective.trim()
+    || (input.workRelation === 'continue' && relatedLifecycleSource && semanticWorkState(relatedLifecycleSource) === 'completed'
+      ? relatedLifecycleSource.objective.trim()
+      : '');
+  const effectiveRequest: WorkStartFacts = {
+    ...input.request,
+    objective: routeObjective,
+    workspaceDirty: ctx.workspaceDirty ?? input.request.workspaceDirty,
+    mutation: readOnlyReviewRequested ? false : input.request.mutation ?? input.request.risk !== 'readonly',
+    risk: readOnlyReviewRequested ? 'readonly' : input.request.risk,
     approvalConfirmed: input.approvalConfirmed === true,
     requiresUserApproval: input.approvalConfirmed === true
       ? false
-      : input.modeInput.requiresUserApproval === true || strategyConflictRequiresApproval,
+      : input.request.requiresUserApproval === true || strategyConflictRequiresApproval,
   };
-  if (effectiveModeInput.explicitMode === 'scale' && (!input.planId || !input.planStepId || !ctx.planStore)) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: 'SCALE_PLAN_REQUIRED: explicit Scale execution requires a bound approved PlanContract step.',
-      data: { executionStarted: false, workContractCreated: false, planRequired: true, explicitMode: 'scale' },
-    });
-  }
-  const applyForcedMode = (selected: ReturnType<typeof selectExecutionMode>) => input.forceMode
-    ? {
-        ...selected,
-        mode: input.forceMode,
-        reason: `Forced mode: ${input.forceMode}. ${selected.reason}`,
-        createWorkContract: input.forceMode === 'handoff_only' ? false : selected.requiresWork,
-        createHandoff: input.forceMode === 'handoff_only',
-      }
-    : selected;
-  const evaluateAccessPolicy = (selected: ReturnType<typeof selectExecutionMode>) => evaluatePolicyGate({
-    capabilityId: selected.mode === 'direct_control' ? 'repository.direct_edit' : selected.mode === 'goal_workloop' ? 'controller.goal_workloop' : 'controller.handoff_inbox',
-    risk: effectiveModeInput.risk
-      ?? (input.modeInput.secretAccess === true ? 'raw_secret_config'
-        : input.modeInput.destructive === true ? 'destructive'
-          : input.modeInput.remoteWrite === true ? 'remote_write'
-            : input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true ? 'workspace_write'
-              : selected.mode === 'direct_control' ? 'local_repo_write'
-                : selected.mode === 'goal_workloop' ? 'workspace_write'
-                  : 'readonly'),
+  const evaluateAccessPolicy = () => evaluatePolicyGate({
+    capabilityId: 'controller.work_contract',
+    risk: effectiveRequest.risk
+      ?? (input.request.secretAccess === true ? 'raw_secret_config'
+        : input.request.destructive === true ? 'destructive'
+          : input.request.remoteWrite === true ? 'remote_write'
+            : input.request.requiresApproval === true || input.request.requiresUserApproval === true ? 'workspace_write'
+              : 'workspace_write'),
     accessMode: input.constraints?.accessMode,
     approvalConfirmed: input.approvalConfirmed === true,
     dryRun: input.dryRun === true,
-    directEditBoundary: {
-      scopeClear: effectiveModeInput.scopeClear,
-      maxChangedFiles: effectiveModeInput.expectedFiles,
-      maxChangedLines: effectiveModeInput.expectedChangedLines,
-      pathsExplicit: effectiveModeInput.scopeClear,
-    },
   });
+  // Missing mechanical admission fields are reported to the caller verbatim.
+  // Forge does not translate them into an engineering-mode recommendation.
+  const missingContractFields: string[] = [];
+  if (!input.request.scopeClear) missingContractFields.push('scopeSummary', 'acceptanceCriteria', 'allowedPaths');
+  if (input.objective.trim().length === 0) missingContractFields.push('objective');
 
-  let selectedMode = selectExecutionMode(effectiveModeInput);
-  if (input.forceMode === 'direct_control' && selectedMode.routeDecision.requiresIsolation) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: 'WORKSPACE_PLACEMENT_DIRECT_CONTROL_FORBIDDEN: typed placement requires isolation, so force_mode=direct_control cannot override admission policy.',
-      data: { executionStarted: false, workContractCreated: false, routeDecision: selectedMode.routeDecision },
-      rawAvailable: false,
-    });
-  }
-  let policy = evaluateAccessPolicy(selectedMode);
-  if (policy.decision === 'allowed' && effectiveModeInput.requiresUserApproval !== true) {
-    selectedMode = selectExecutionMode({ ...effectiveModeInput, approvalConfirmed: true });
-    policy = evaluateAccessPolicy(selectedMode);
-  }
-  let mode = applyForcedMode(selectedMode);
-  const routeApprovalRequired = mode.routeDecision.requiresApproval
-    && mode.routeDecision.waitForUser
-    && mode.routeDecision.approvalState !== 'blocked_by_policy';
-  const approvalRequired = policy.decision === 'approval_required' || routeApprovalRequired;
-
-  // Route Policy is the sole execution-depth authority. Existing Work is
-  // ownership context, not a reason to upgrade an otherwise Direct operation
-  // into Durable Work. Explicit Work/Plan ownership is resolved only after a
-  // durable route has already been selected; checkout writer conflicts affect
-  // placement, not semantic task identity.
-
-  if (mode.mode === 'direct_control') {
-    const available = ctx.availableChecks ?? [];
-    const normalized = normalizeCheckIds(input.checks ?? [], available);
-    // Explicit ownership may annotate a Direct operation, but it never changes
-    // the RouteDecision. The actual repository mutation can pass this Work id
-    // to repository_safe_patch_apply / repository_command_execute for evidence
-    // attribution while staying on the Direct/Process path.
-    const directOwnershipCandidates = input.relatedWorkId || (input.planId && input.planStepId)
-      ? listWorkContracts({ ...ctx.workStore, status: 'active', limit: 100 })
-          .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary')
-      : [];
-    const directPlan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
-    const directPlanStep = directPlan && input.planStepId ? directPlan.steps.find((step) => step.id === input.planStepId) : undefined;
-    const directOwner = (input.relatedWorkId
-      ? directOwnershipCandidates.find((candidate) => candidate.workId === input.relatedWorkId)
-      : undefined)
-      ?? (directPlanStep?.workId
-        ? directOwnershipCandidates.find((candidate) => candidate.workId === directPlanStep.workId)
-        : undefined);
-    const suggested = validateSuggestedNextActions([
-      {
-        label: 'Apply bounded direct edit',
-        tool: 'rh_work',
-        operation: 'start',
-        payload: { mode: 'direct_control', objective: input.objective.slice(0, 200) },
-        risk: 'local_repo_write',
-        confidence: 'high',
-        reason: 'Small supervised task stays on Direct Control; no WorkContract created.',
-      },
-      ...normalized.suggestedNextActions,
-      {
-        label: 'Read repository context',
-        tool: 'rh_context',
-        operation: 'get',
-        risk: 'readonly',
-        confidence: 'medium',
-      },
-    ], { validCheckIds: normalized.validCheckIds }).actions;
-
-    return buildFacadeResult({
-      status: policy.decision === 'denied' ? 'blocked' : 'ok',
-      summary: `Direct control recommended. No WorkContract created. ${mode.reason}`,
-      data: {
-        mode,
-        policy,
-        workContractCreated: false,
-        directControlPreserved: true,
-        objective: input.objective.slice(0, 1_000),
-        normalizedChecks: normalized,
-        ...(directOwner ? {
-          ownership: {
-            workId: directOwner.workId,
-            relation: input.workRelation ?? 'continue',
-            executionDepthPreserved: true,
-          },
-        } : {}),
-      },
-      warnings: [...policy.warnings, ...normalized.warnings],
-      suggestedNextActions: suggested,
-      rawAvailable: false,
-    });
-  }
+  const policy = evaluateAccessPolicy();
+  const approvalRequired = policy.decision === 'approval_required';
 
-  // Policy approval decisions stop before Work creation. Ordinary host-managed local work
-  // reaches this point only after the same Route Policy has been replayed with the Access
-  // Policy's explicit allowed decision as authorization evidence.
+  // Policy approval decisions stop before Work creation. Ordinary host-managed
+  // local work reaches this point only after the Access Policy authorized it.
   const blockForHandoff =
-    mode.mode === 'handoff_only'
-    || policy.decision === 'denied'
+    policy.decision === 'denied'
     || policy.decision === 'approval_required';
 
   if (blockForHandoff) {
@@ -453,20 +358,19 @@ export function routeWorkStart(
       repoId: ctx.repoId,
       title: 'Work blocked pending decision',
       severity: policy.decision === 'denied' ? 'blocked' : 'needs_review',
-      creationReason: !input.modeInput.scopeClear
+      creationReason: !input.request.scopeClear
         ? 'invalid_objective'
         : approvalRequired
-          ? (input.modeInput.destructive ? 'destructive_action_requires_confirmation' : 'policy_approval_required')
+          ? (input.request.destructive ? 'destructive_action_requires_confirmation' : 'policy_approval_required')
           : 'missing_authorization',
-      reason: mode.reason,
-      summary: `Handoff-only routing: ${mode.reason}`,
+      reason: policy.reason,
+      summary: `Execution blocked by access policy: ${policy.reason}`,
       currentState: {
         repoId: ctx.repoId,
-        mode: 'handoff_only',
         statusSummary: 'waiting for ChatGPT or user decision; no execution started',
-        blockedBy: mode.missingContractFields,
+        blockedBy: missingContractFields,
       },
-      attemptedActions: ['route_execution_mode'],
+      attemptedActions: ['work_start'],
       evidenceRefs: [],
       blockingDecision: approvalRequired
         ? 'Approve side effects or restate a safer objective.'
@@ -479,27 +383,19 @@ export function routeWorkStart(
             operation: 'start',
             label: 'Approve and start work',
             summary: 'Create the work contract with the original scope and explicit approval.',
-            risk: input.modeInput.destructive ? 'destructive' : 'workspace_write',
+            risk: input.request.destructive ? 'destructive' : 'workspace_write',
             payload: {
               objective: input.objective,
               acceptanceCriteria: input.acceptanceCriteria,
               allowedPaths: input.allowedPaths,
               forbiddenPaths: input.forbiddenPaths,
               checkIds: input.checks,
-              expectedFiles: input.modeInput.expectedFiles,
-              expectedChangedLines: input.modeInput.expectedChangedLines,
-              scopeClear: input.modeInput.scopeClear,
-              requiresInvestigation: input.modeInput.requiresInvestigation,
-              requiresLongRunningChecks: input.modeInput.requiresLongRunningChecks,
-              requiresWorker: input.modeInput.requiresWorker,
-              requiresApproval: input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true,
-              destructive: input.modeInput.destructive === true,
+              scopeClear: input.request.scopeClear,
+              requiresApproval: input.request.requiresApproval === true || input.request.requiresUserApproval === true,
+              destructive: input.request.destructive === true,
               accessMode: input.constraints?.accessMode,
-              workspaceMode: placementConstraint.workspaceMode,
-              requireWorktree: placementConstraint.requireWorktree,
-              directMainProhibited: placementConstraint.directMainProhibited,
+              workspaceMode,
               approvalConfirmed: true,
-              forceMode: 'goal_workloop',
             },
           }
         : undefined,
@@ -516,9 +412,8 @@ export function routeWorkStart(
 
     return buildFacadeResult({
       status: policy.decision === 'denied' ? 'blocked' : approvalRequired ? 'approval_required' : 'blocked',
-      summary: `Handoff-only: no WorkContract created and no execution started. ${mode.reason}`,
+      summary: 'Blocked: no WorkContract created and no execution started until the policy decision is resolved.',
       data: {
-        mode,
         policy,
         workContractCreated: false,
         handoffId: handoff.id,
@@ -548,33 +443,20 @@ export function routeWorkStart(
   return startGoalWorkloop(ctx, {
     ...input,
     constraints: canonicalConstraints,
-    modeInput: effectiveModeInput,
+    request: effectiveRequest,
     workKind: effectiveWorkKind,
-  }, policy, 'goal_workloop', mode.routeDecision);
+  }, policy);
 }
 
 export function startGoalWorkloop(
   ctx: GoalWorkloopContext,
   input: GoalWorkloopStartInput,
   policy?: PolicyDecision,
-  executionMode: 'direct_control' | 'goal_workloop' = 'goal_workloop',
-  routeDecision = selectExecutionMode({ ...input.modeInput, objective: input.objective, knownPaths: input.allowedPaths }).routeDecision,
 ): FacadeResult {
-  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
-  if (placementResolution.ok === false) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `${placementResolution.code}: ${placementResolution.message}`,
-      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
-      rawAvailable: false,
-    });
-  }
-  const placementConstraint = placementResolution.constraint;
+  const workspaceMode: 'current' | 'isolated' = input.constraints?.workspaceMode === 'isolated' || input.constraints?.workspaceMode === 'auto' ? 'isolated' : 'current';
   const canonicalConstraints: WorkContract['constraints'] = {
     ...(input.constraints ?? {}),
-    workspaceMode: placementConstraint.workspaceMode,
-    requireWorktree: placementConstraint.requireWorktree,
-    directMainProhibited: placementConstraint.directMainProhibited,
+    workspaceMode,
   };
   const hasStrongAdmissionBinding = Boolean(input.planId || input.planStepId || input.requirementId || input.relatedWorkId || input.workRelation);
   if (hasStrongAdmissionBinding && !ctx.semanticAdmissionLocked) {
@@ -582,38 +464,134 @@ export function startGoalWorkloop(
       { ...ctx, semanticAdmissionLocked: true },
       input,
       policy,
-      executionMode,
-      routeDecision,
     ));
   }
   const at = nowIso(ctx);
+  let resolvedWorkKind: WorkKind;
+  try {
+    resolvedWorkKind = resolvedWorkKindFor(input);
+  } catch (error) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: error instanceof Error ? error.message : 'WORK_KIND_RESOLUTION_INVALID',
+      data: { executionStarted: false, workContractCreated: false },
+      rawAvailable: false,
+    });
+  }
+  const workRisk = workRiskFor(input);
+  // External-effect risk is governed by authorization/confirmation/receipt
+  // semantics. Engineering admission is specifically for repository mutation.
+  const engineeringRisk: WorkRisk = resolvedWorkKind === 'repository_change' ? workRisk : 'readonly';
+  const engineeringProfile = engineeringWorkProfileForRisk(engineeringRisk);
+  const engineeringSourceIdentity = ctx.sourceRevision?.trim()
+    ? { kind: 'revision' as const, revision: ctx.sourceRevision.trim() }
+    : ctx.sourceBaseState === 'unborn'
+      ? { kind: 'unborn' as const }
+      : { kind: 'unknown' as const };
+  let engineeringContext;
+  try {
+    engineeringContext = buildEngineeringContextReceipt({
+      risk: engineeringRisk,
+      sourceIdentity: engineeringSourceIdentity,
+      evidence: input.verifiedEngineeringEvidence,
+      recordedAt: at,
+    });
+  } catch (error) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: error instanceof Error ? error.message : 'ENGINEERING_CONTEXT_INVALID',
+      data: { executionStarted: false, workContractCreated: false, engineeringProfile },
+    });
+  }
+  const engineeringMutation = resolvedWorkKind === 'repository_change'
+    && (input.request.mutation ?? input.request.risk !== 'readonly');
+  // Engineering context is durable model/project guidance only. Safety and
+  // capability admission is enforced by the concrete executor, never here.
+  void engineeringMutation;
   const available = ctx.availableChecks ?? [];
-  const workspaceMode = placementConstraint.workspaceMode;
-  const activeWorks = listWorkContracts({ ...ctx.workStore, status: 'active', limit: 100 })
+  const activeAdmissionSnapshot = readActiveWorkCandidates({ ...ctx.workStore, limit: 100 });
+  const activeWorks = activeAdmissionSnapshot.contracts
     .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
-  const workspaceOwner = ctx.checkoutId
-    ? activeWorks.find((candidate) => candidate.checkoutId === ctx.checkoutId
-      && candidate.worktreePolicy.required !== true
-      && !candidate.worktreeRef)
+  const invalidRelatedWork = input.relatedWorkId
+    ? activeAdmissionSnapshot.invalid.find((candidate) => candidate.workId === input.relatedWorkId)
     : undefined;
+  if (invalidRelatedWork) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_RELATED_CONTRACT_INVALID: ${invalidRelatedWork.workId} is malformed and cannot authorize a Work relationship.`,
+      data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidRelatedWork.workId, invalidWorkError: invalidRelatedWork.error },
+    });
+  }
+  const relatedLifecycleSource = input.relatedWorkId
+    ? getWorkContract(ctx.workStore, input.relatedWorkId)
+    : undefined;
+  const terminalContinuationSource = input.workRelation === 'continue'
+    && relatedLifecycleSource
+    && semanticWorkState(relatedLifecycleSource) !== 'open'
+    ? relatedLifecycleSource
+    : undefined;
+  if (terminalContinuationSource && !terminalContinuationSource.requirementId && !terminalContinuationSource.planId) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_SUCCESSOR_SEMANTIC_SCOPE_REQUIRED: ${terminalContinuationSource.workId} is terminal but has no Requirement/Plan lineage. Use new_goal or bind an explicit durable semantic authority instead of guessing continuity.`,
+      data: { executionStarted: false, workContractCreated: false, relatedWorkId: terminalContinuationSource.workId },
+    });
+  }
   const explicitRelatedWork = input.relatedWorkId
     ? activeWorks.find((candidate) => candidate.workId === input.relatedWorkId)
     : undefined;
-  const plan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
-  const planStep = plan && input.planStepId ? plan.steps.find((step) => step.id === input.planStepId) : undefined;
+
+  let resolvedPlanId = input.planId?.trim() || undefined;
+  const resolvedPlanStepId = input.planStepId?.trim() || undefined;
+  if (terminalContinuationSource?.planId) {
+    if (resolvedPlanId && resolvedPlanId !== terminalContinuationSource.planId) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_SUCCESSOR_PLAN_MISMATCH: predecessor ${terminalContinuationSource.workId} belongs to ${terminalContinuationSource.planId}, not ${resolvedPlanId}. Supersede/replan explicitly instead of silently moving continuation authority.`,
+        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, predecessorPlanId: terminalContinuationSource.planId, requestedPlanId: resolvedPlanId },
+      });
+    }
+    resolvedPlanId = terminalContinuationSource.planId;
+  }
+  // Plan and Plan item references are recorded provenance for this Work. They
+  // never select the successor, own the scope, gate admission or require
+  // acceptance; only the Plan's existence is validated so a Work cannot record a
+  // reference to a Plan authority that does not exist.
+  const plan = resolvedPlanId && ctx.planStore ? getPlanContract(ctx.planStore, resolvedPlanId) : undefined;
+  if (resolvedPlanId && !plan) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: terminalContinuationSource?.planId
+        ? `WORK_SUCCESSOR_PLAN_NOT_FOUND: ${terminalContinuationSource.planId}. Recover the durable Plan authority before creating a successor Work.`
+        : `PLAN_NOT_FOUND: ${resolvedPlanId}. Recover or create the semantic Plan before using it as Work provenance.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        planId: resolvedPlanId,
+        ...(terminalContinuationSource?.planId ? { predecessorWorkId: terminalContinuationSource.workId } : {}),
+      },
+    });
+  }
   const requestedRequirementId = input.requirementId?.trim() || undefined;
-  if (plan && requestedRequirementId && requestedRequirementId !== plan.requirementId) {
+  const predecessorRequirementId = terminalContinuationSource?.requirementId;
+  if (predecessorRequirementId && requestedRequirementId && predecessorRequirementId !== requestedRequirementId) {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `PLAN_REQUIREMENT_MISMATCH: ${plan.planId} is bound to ${plan.requirementId ?? 'no Requirement'}, not ${requestedRequirementId}. Use the Plan relationship authority or replan explicitly.`,
-      data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planRequirementId: plan.requirementId, requestedRequirementId },
+      summary: `WORK_SUCCESSOR_REQUIREMENT_MISMATCH: predecessor ${terminalContinuationSource.workId} belongs to ${predecessorRequirementId}, not ${requestedRequirementId}.`,
+      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, predecessorRequirementId, requestedRequirementId },
     });
   }
-  const effectiveRequirementId = requestedRequirementId || plan?.requirementId;
+  // A selected Plan supplies its Requirement when no explicit/predecessor link exists.
+  // Requirement membership alone never selects sibling Plans or successor Works.
+  const effectiveRequirementId = requestedRequirementId || predecessorRequirementId || plan?.requirementId;
+  if (plan?.requirementId && effectiveRequirementId && plan.requirementId !== effectiveRequirementId) {
+    return buildFacadeResult({ status: 'blocked', summary: `WORK_PLAN_REQUIREMENT_MISMATCH: ${resolvedPlanId} belongs to ${plan.requirementId}, not ${effectiveRequirementId}.`, data: { executionStarted: false, workContractCreated: false } });
+  }
+  const effectiveRequirementRecord = effectiveRequirementId && ctx.workStore.controllerHome ? readRequirement({ controllerHome: ctx.workStore.controllerHome }, effectiveRequirementId) : undefined;
   if (
     effectiveRequirementId
     && ctx.workStore.controllerHome
-    && !readRequirement({ controllerHome: ctx.workStore.controllerHome }, effectiveRequirementId)
+    && !effectiveRequirementRecord
   ) {
     return buildFacadeResult({
       status: 'blocked',
@@ -621,49 +599,55 @@ export function startGoalWorkloop(
       data: { executionStarted: false, workContractCreated: false, requirementId: effectiveRequirementId, planId: plan?.planId },
     });
   }
-  const sameStringSet = (provided: string[] | undefined, frozen: string[]): boolean => {
-    if (provided === undefined) return true;
-    const actual = [...new Set(provided)].sort();
-    const expected = [...new Set(frozen)].sort();
-    return actual.length === expected.length && actual.every((value, index) => value === expected[index]);
-  };
-  if (planStep) {
-    const mismatches = [
-      !sameStringSet(input.acceptanceCriteria, planStep.acceptanceCriteria) && 'acceptance_criteria',
-      !sameStringSet(input.allowedPaths, planStep.allowedPaths) && 'allowed_paths',
-      !sameStringSet(input.forbiddenPaths, planStep.forbiddenPaths) && 'forbidden_paths',
-      !sameStringSet(input.checks, planStep.checks) && 'check_ids',
-    ].filter((value): value is string => Boolean(value));
-    if (mismatches.length > 0) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_STEP_WORK_CONTRACT_MISMATCH: ${input.planId}/${input.planStepId} conflicts with frozen Plan step field(s): ${mismatches.join(', ')}. Replan instead of widening or narrowing Work admission.`,
-        data: { executionStarted: false, workContractCreated: false, planId: input.planId, planStepId: input.planStepId, mismatches },
-      });
-    }
-  }
-  const effectiveAcceptanceCriteria = planStep?.acceptanceCriteria ?? input.acceptanceCriteria ?? [];
-  const effectiveAllowedPaths = planStep?.allowedPaths ?? input.allowedPaths ?? [];
-  const effectiveForbiddenPaths = planStep?.forbiddenPaths ?? input.forbiddenPaths ?? [];
-  const effectiveChecks = planStep?.checks ?? input.checks ?? [];
+  // Work scope is authored by the caller. A referenced Plan item contributes no
+  // objective, paths, checks or acceptance criteria.
+  const effectiveObjective = input.objective;
+  const effectiveAcceptanceCriteria = input.acceptanceCriteria ?? [];
+  const effectiveAllowedPaths = input.allowedPaths ?? [];
+  const effectiveForbiddenPaths = input.forbiddenPaths ?? [];
+  const effectiveChecks = input.checks ?? [];
   const normalized = normalizeCheckIds(effectiveChecks, available);
-  const boundPlanStepWorks = input.planId && input.planStepId
-    ? activeWorks.filter((candidate) => candidate.planId === input.planId && candidate.planStepId === input.planStepId)
-    : [];
-  const explicitPlanStepWork = planStep?.workId ? activeWorks.find((candidate) => candidate.workId === planStep.workId) : undefined;
-  const planStepWork = explicitPlanStepWork ?? (boundPlanStepWorks.length === 1 ? boundPlanStepWorks[0] : undefined);
-  const requirementWorks = effectiveRequirementId
-    ? activeWorks.filter((candidate) => candidate.requirementId === effectiveRequirementId)
-    : [];
-  const deterministicTarget = input.relatedWorkId
-    ? explicitRelatedWork
-    : planStepWork ?? (requirementWorks.length === 1 ? requirementWorks[0] : undefined);
-  const requestedRelation = input.workRelation ?? (input.modeInput.requiresParallelism === true ? 'parallel' : undefined);
+  const invalidLineageWork = activeAdmissionSnapshot.invalid.find((candidate) =>
+    (input.relatedWorkId && candidate.workId === input.relatedWorkId));
+  if (invalidLineageWork) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_ADMISSION_INVALID_SEMANTIC_AUTHORITY: ${invalidLineageWork.workId} is malformed but still claims the requested durable Plan/Requirement lineage. Repair that exact authority before creating a sibling Work.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        invalidWorkId: invalidLineageWork.workId,
+        invalidWorkError: invalidLineageWork.error,
+        planId: resolvedPlanId,
+        planStepId: resolvedPlanStepId,
+        requirementId: effectiveRequirementId,
+      },
+    });
+  }
+  const newWorkWillBeIsolated = workspaceMode === 'isolated';
+  const invalidSharedWorkspaceOwner = !newWorkWillBeIsolated
+    ? activeAdmissionSnapshot.invalid.find((candidate) => candidate.isolation === 'shared'
+      && (!candidate.checkoutId || candidate.checkoutId === ctx.checkoutId))
+    : undefined;
+  if (invalidSharedWorkspaceOwner) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_ADMISSION_INVALID_WORKSPACE_AUTHORITY: ${invalidSharedWorkspaceOwner.workId} is malformed and may still own the shared checkout; isolated placement or exact authority repair is required.`,
+      data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidSharedWorkspaceOwner.workId, invalidWorkError: invalidSharedWorkspaceOwner.error },
+    });
+  }
+  // Requirement membership is portfolio ownership, not semantic Work identity.
+  // Only an explicit related Work may select an existing Work authority. A Plan
+  // item never selects, owns or reuses Work. Siblings under one Requirement
+  // remain unrelated for semantic admission and meet only in
+  // placement/resource arbitration.
+  const deterministicTarget = input.relatedWorkId ? explicitRelatedWork : undefined;
+  const requestedRelation = input.workRelation;
   // Only strong semantic bindings participate in ownership resolution. An
   // unrelated active Work or a checkout writer is a placement fact, not a
   // semantic candidate for continue/extend/parallel/new_goal.
   const candidateWorks = [...new Map(
-    [explicitRelatedWork, planStepWork, ...boundPlanStepWorks, ...requirementWorks]
+    [explicitRelatedWork]
       .filter((candidate): candidate is WorkContract => Boolean(candidate))
       .map((candidate) => [candidate.workId, candidate]),
   ).values()].slice(0, 8);
@@ -684,39 +668,18 @@ export function startGoalWorkloop(
     evidenceRefs: target?.evidenceRefs ?? [],
     suggestedNextActions: target
       ? [{
-          label: 'Continue existing Work',
+          label: 'Inspect existing Work',
           tool: 'rh_work',
-          operation: 'continue',
+          operation: 'get',
           payload: { work_id: target.workId },
           risk: 'readonly',
-          confidence: planStepWork || explicitRelatedWork ? 'high' : 'medium',
-          reason: 'Resolve intent before execution; do not create a second Work until the relationship is explicit.',
+          confidence: explicitRelatedWork ? 'high' : 'medium',
+          reason: 'Resolve intent before execution; semantic Work inspection does not progress lifecycle state.',
         }]
       : [],
     rawAvailable: false,
   });
 
-  if (boundPlanStepWorks.length > 1) {
-    return resolutionRequired(`PLAN_STEP_MULTIPLE_PRIMARY_WORKS: ${input.planId}/${input.planStepId} has ${boundPlanStepWorks.length} active primary Work records and requires repair before execution.`);
-  }
-  if (planStep?.workId && !explicitPlanStepWork) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `PLAN_STEP_BOUND_WORK_MISSING: ${input.planId}/${input.planStepId} is bound to ${planStep.workId}, but that Work is not active. Repair the exact binding; do not create a replacement Work.`,
-      data: { executionStarted: false, workContractCreated: false, planId: input.planId, planStepId: input.planStepId, boundWorkId: planStep.workId, repairRequired: true },
-      suggestedNextActions: [{
-        label: 'Diagnose exact Plan step binding',
-        tool: 'rh_work',
-        operation: 'repair',
-        payload: { plan_id: input.planId, plan_step_id: input.planStepId, repair_operation: 'diagnose', dry_run: true },
-        risk: 'readonly',
-        confidence: 'high',
-        reason: 'The Plan step has an exact Work identity but the active Work view cannot resolve it. Diagnose that binding before any replacement Work can be admitted.',
-      }],
-      rawAvailable: false,
-    });
-  }
-
   if ((input.requestedBy ?? 'chatgpt') === 'scheduler') {
     return resolutionRequired(
       deterministicTarget
@@ -725,42 +688,17 @@ export function startGoalWorkloop(
     );
   }
 
-  if (planStepWork && !requestedRelation) {
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `PLAN_STEP_REUSES_ACTIVE_WORK: ${input.planId}/${input.planStepId} already executes as ${planStepWork.workId}; reuse that Work instead of creating another.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        admissionDecision: 'reuse_existing',
-        resolutionRequired: false,
-        work: summarizeWorkContract(planStepWork),
-      },
-      evidenceRefs: planStepWork.evidenceRefs,
-      suggestedNextActions: [{ label: 'Continue existing Work', tool: 'rh_work', operation: 'continue', payload: { work_id: planStepWork.workId }, risk: 'readonly', confidence: 'high' }],
-      rawAvailable: false,
-    });
-  }
-
-  if (requestedRelation === 'continue' || requestedRelation === 'extend') {
+  if ((requestedRelation === 'continue' || requestedRelation === 'extend') && !terminalContinuationSource) {
     if (!deterministicTarget) {
-      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id or bind the request to an active Plan/Requirement before execution.`);
-    }
-    if (requestedRelation === 'extend' && deterministicTarget.planId) {
-      return resolutionRequired(
-        `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${deterministicTarget.workId} is governed by Plan ${deterministicTarget.planId}; record additional discovery in scopeEvidence, but update the authoritative Plan before widening policy or acceptance scope.`,
-        deterministicTarget,
-      );
+      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id before execution.`);
     }
     const selected = requestedRelation === 'extend'
       ? updateWorkContract(ctx.workStore, deterministicTarget.workId, {
           acceptanceCriteria: [...new Set([...deterministicTarget.acceptanceCriteria, ...(input.acceptanceCriteria ?? [])])].slice(0, 30),
-          allowedPaths: [...new Set([...deterministicTarget.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
-          forbiddenPaths: [...new Set([...deterministicTarget.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
           checks: [...new Set([...deterministicTarget.checks, ...normalized.validCheckIds])].slice(0, 30),
           scopeEvidence: {
             initialLikelyPaths: [...new Set([
-              ...(deterministicTarget.scopeEvidence?.initialLikelyPaths ?? deterministicTarget.allowedPaths),
+              ...(deterministicTarget.scopeEvidence?.initialLikelyPaths ?? []),
               ...(input.initialLikelyPaths ?? input.allowedPaths ?? []),
             ])].slice(0, 100),
             inspectedPaths: deterministicTarget.scopeEvidence?.inspectedPaths ?? [],
@@ -782,7 +720,7 @@ export function startGoalWorkloop(
         work: summarizeWorkContract(selected),
       },
       evidenceRefs: selected.evidenceRefs,
-      suggestedNextActions: [{ label: 'Continue existing Work', tool: 'rh_work', operation: 'continue', payload: { work_id: selected.workId }, risk: 'readonly', confidence: 'high' }],
+      suggestedNextActions: [{ label: 'Read existing Work context', tool: 'rh_work', operation: 'get', payload: { work_id: selected.workId }, risk: 'readonly', confidence: 'high' }],
       rawAvailable: false,
     });
   }
@@ -793,112 +731,72 @@ export function startGoalWorkloop(
     );
   }
 
-  const placementConflict = Boolean(workspaceOwner);
-  const needsWorktree = executionMode === 'goal_workloop' && (placementConstraint.requireWorktree
-    || placementConflict
-    || input.modeInput.requiresParallelism === true
-    || routeDecision.requiresIsolation === true);
-  if (!needsWorktree && workspaceOwner) {
+  // Repository topology is caller-owned. Forge records the selected placement
+  // and lets concrete WorkHandle/Lease/Git authorities report real conflicts at
+  // the mutation boundary instead of inferring isolation from semantic context.
+  const needsWorktree = workspaceMode === 'isolated';
+  const requestedWorkId = input.workId?.trim();
+  if (requestedWorkId && !/^work-[a-z0-9][a-z0-9-]{0,199}$/i.test(requestedWorkId)) {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WORKSPACE_OWNERSHIP_INVARIANT: unresolved admission reached checkout ${ctx.checkoutId} while active Work ${workspaceOwner.workId} owns it. This is an internal routing invariant, not a normal fallback path.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        conflictType: 'workspace_single_writer_invariant',
-        existingWork: summarizeWorkContract(workspaceOwner),
-      },
-      evidenceRefs: workspaceOwner.evidenceRefs,
-      rawAvailable: false,
+      summary: 'WORK_ID_INVALID: explicit Work ids must use the canonical work-<slug> form.',
+      data: { executionStarted: false, workContractCreated: false },
     });
   }
-  const generatedWorkId = workIdFor(input.objective);
-  if (input.planId || input.planStepId) {
-    if (!input.planId || !input.planStepId || !ctx.planStore || !ctx.sourceRevision || !plan || !planStep) {
-      return buildFacadeResult({ status: 'blocked', summary: 'PLAN_CONTEXT_REQUIRED: plan_id, plan_step_id, an executable Plan step and a current source revision are required.', data: { executionStarted: false } });
-    }
-    if (plan.status !== 'approved' && plan.status !== 'executing') {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_NOT_EXECUTABLE: ${plan.planId} is ${plan.status}`, data: { executionStarted: false, planId: plan.planId } });
-    }
-    if (plan.sourceRevision !== ctx.sourceRevision) {
-      const invalidated = claimPlanStepForWork(ctx.planStore, {
-        planId: input.planId,
-        stepId: input.planStepId,
-        workId: generatedWorkId,
-        sourceRevision: ctx.sourceRevision,
-      });
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_SOURCE_DRIFT: ${invalidated.planId} was invalidated because its source revision no longer matches. Replan before execution.`,
-        data: { planId: invalidated.planId, executionStarted: false, workContractCreated: false, replanRequired: true },
-      });
-    }
-    const unresolved = planStep.dependencies.filter((dependency) => plan.steps.find((candidate) => candidate.id === dependency)?.status !== 'completed');
-    if (unresolved.length > 0) {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_DEPENDENCIES_PENDING: ${unresolved.join(', ')}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
-    }
-    if (planStep.status === 'completed') {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_ALREADY_COMPLETED: ${planStep.id}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
-    }
-  }
+  const generatedWorkId = requestedWorkId ?? workIdFor(effectiveObjective);
   const initialSuggestedNextActions = suggestedForWorkIdentity(
     generatedWorkId,
     normalized.validCheckIds,
     normalized.suggestedNextActions,
   );
-  // allowed_paths and initial_likely_paths are policy/discovery fences, not proof
-  // that this Work owns a repository mutation. External-effect Work therefore
-  // needs either an explicit repository_change semantic choice or concrete
-  // expected source-change evidence before Forge treats it as repository_change.
-  const repositoryChangeIntent = input.workKind === 'repository_change'
-    || (input.modeInput.expectedFiles ?? 0) > 0
-    || (input.modeInput.expectedChangedLines ?? 0) > 0;
-  const typedRecoverableReadOnlyReview = input.workKind === undefined
-    && input.modeInput.mutation === false
-    && input.modeInput.requiresInvestigation === true
-    && input.modeInput.requiresRecovery === true;
-  const resolvedWorkKind = input.workKind ?? (
-    typedRecoverableReadOnlyReview
-      ? 'read_only_review'
-      : input.modeInput.requiresExternalEffect === true
-        && !repositoryChangeIntent
-        ? (input.modeInput.remoteWrite === true ? 'remote_effect' : 'local_effect')
-        : 'repository_change'
-  );
   const remoteDeliveryRequired = resolvedWorkKind === 'repository_change'
-    && input.modeInput.requiresExternalEffect === true
-    && input.modeInput.remoteWrite === true;
+    && input.request.requiresExternalEffect === true
+    && input.request.remoteWrite === true;
+  const effectiveConstraints: WorkContract['constraints'] = {
+    ...canonicalConstraints,
+    ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
+  };
+  const worktreeReason = needsWorktree
+    ? 'Caller explicitly selected isolated repository placement.'
+    : 'Caller selected the current repository checkout.';
+  const forgeInstanceId = ctx.workStore.controllerHome
+    ? readForgeInstanceIdentity(ctx.workStore.controllerHome)?.instanceId
+    : undefined;
   const work = createWorkContract(ctx.workStore, {
     workId: generatedWorkId,
     repoId: ctx.repoId,
     checkoutId: needsWorktree ? undefined : ctx.checkoutId,
+    executionPlacement: executionPlacement({
+      ...(forgeInstanceId ? { forgeInstanceId } : {}),
+      repositoryId: ctx.repoId,
+      ...(!needsWorktree && ctx.checkoutId ? { checkoutId: ctx.checkoutId } : {}),
+    }),
     principalId: ctx.principalId,
     controllerInstanceId: ctx.controllerInstanceId,
     baseRevision: ctx.sourceRevision,
+    repositoryBaseState: ctx.sourceBaseState ?? (ctx.sourceRevision ? 'revision' : undefined),
     workspaceFingerprint: needsWorktree ? undefined : ctx.workspaceFingerprint,
-    routeDecisionFingerprint: routeDecision.inputFingerprint,
-    routeDecision,
-    mode: executionMode,
-    objective: input.objective,
+    objective: effectiveObjective,
     acceptanceCriteria: effectiveAcceptanceCriteria,
-    constraints: {
-      ...canonicalConstraints,
-      ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
-    },
-    risk: workRiskFor(input),
+    constraints: effectiveConstraints,
+    risk: workRisk,
+    engineeringContext,
     // Remote delivery is a risk/effect dimension, not a reason to erase a
     // repository-change Work's semantic identity. Pure external actions with no
     // repository-change signal remain remote_effect and keep plugin receipt semantics.
     workKind: resolvedWorkKind,
-    status: 'running',
+    dispatchState: 'running',
     phase: 'implementation',
     issueId: input.issueId,
     taskId: input.taskId,
     requirementId: effectiveRequirementId,
-    planId: input.planId,
-    planStepId: input.planStepId,
-    planSourceRevision: input.planId ? ctx.sourceRevision : undefined,
-    scopeSummary: input.modeInput.scopeClear ? 'scope declared at start' : 'scope incomplete',
+    requirementRevision: effectiveRequirementRecord ? currentRequirementSemanticRevision(effectiveRequirementRecord.value) : undefined,
+    predecessorWorkId: terminalContinuationSource?.workId,
+    planId: resolvedPlanId,
+    planRevision: plan ? currentPlanSemanticRevision(plan) : undefined,
+    planStepId: resolvedPlanStepId,
+    planSourceRevision: resolvedPlanStepId ? plan?.sourceRevision : undefined,
+    scopeSummary: input.request.scopeClear ? 'scope declared at start' : 'scope incomplete',
     scopeEvidence: {
       initialLikelyPaths: [...new Set(input.initialLikelyPaths ?? effectiveAllowedPaths)].slice(0, 100),
       inspectedPaths: [],
@@ -908,18 +806,9 @@ export function startGoalWorkloop(
     allowedPaths: effectiveAllowedPaths,
     forbiddenPaths: effectiveForbiddenPaths,
     checks: normalized.validCheckIds,
-    driver: {
-      preferred: executionMode === 'direct_control'
-        ? 'direct_edit'
-        : input.modeInput.requiresWorker === true ? 'external_controller' : needsWorktree ? 'isolated_worktree' : 'direct_edit',
-      allowWorker: false,
-      allowDirectEdit: executionMode === 'direct_control' || (input.modeInput.requiresWorker !== true && !needsWorktree),
-    },
     worktreePolicy: {
       required: needsWorktree,
-      reason: needsWorktree
-        ? 'Isolation was explicitly requested or required for parallel execution.'
-        : 'Current workspace is the stability-first default; isolation remains opt-in.',
+      reason: worktreeReason,
     },
     worktreeRef: undefined,
     evidencePolicy: {
@@ -928,8 +817,8 @@ export function startGoalWorkloop(
       maxEvidenceRefs: 20,
     },
     approvalPolicy: {
-      required: input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true,
-      reasons: input.modeInput.requiresApproval || input.modeInput.requiresUserApproval ? ['approval requested at start'] : [],
+      required: input.request.requiresApproval === true || input.request.requiresUserApproval === true,
+      reasons: input.request.requiresApproval || input.request.requiresUserApproval ? ['approval requested at start'] : [],
       confirmed: input.approvalConfirmed === true,
     },
     recoveryPolicy: {
@@ -938,52 +827,26 @@ export function startGoalWorkloop(
       handoffOnAmbiguity: true,
     },
     requestedBy: input.requestedBy ?? 'chatgpt',
-    evidenceRefs: [initialEvidence(input.objective)],
+    requestId: input.requestId?.trim() || undefined,
+    evidenceRefs: [initialEvidence(effectiveObjective)],
     policyDecisions: policy ? [policy] : [],
     suggestedNextActions: initialSuggestedNextActions,
-    continuationPrompt: `Continue work ${ctx.repoId}: ${input.objective.slice(0, 200)}`,
+    continuationPrompt: `Continue work ${ctx.repoId}: ${effectiveObjective.slice(0, 200)}`,
   });
 
-  if (input.planId && input.planStepId && ctx.planStore && ctx.sourceRevision) {
-    try {
-      const claimed = claimPlanStepForWork(ctx.planStore, {
-        planId: input.planId,
-        stepId: input.planStepId,
-        workId: work.workId,
-        sourceRevision: ctx.sourceRevision,
-      });
-      if (claimed.status === 'invalidated_by_drift') {
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: `PLAN_SOURCE_DRIFT: ${claimed.planId} was invalidated because its source revision no longer matches. Repair or replan before execution.`,
-          data: { executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), planId: claimed.planId, canonicalWorkRetained: true, replanRequired: true },
-        });
-      }
-    } catch (error) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: error instanceof Error ? error.message : 'PLAN_STEP_CLAIM_FAILED',
-        data: { planId: input.planId, planStepId: input.planStepId, executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), canonicalWorkRetained: true },
-      });
-    }
-  }
-
   return buildFacadeResult({
     status: 'ok',
-    summary: executionMode === 'direct_control'
-      ? `Direct-control Work lineage started as ${work.workId}.`
-      : `Goal workloop started as ${work.workId}.`,
+    summary: terminalContinuationSource
+      ? `Successor Work ${work.workId} continues semantic lineage from terminal ${terminalContinuationSource.workId}${resolvedPlanId && resolvedPlanStepId ? ` at ${resolvedPlanId}/${resolvedPlanStepId}` : ''}.`
+      : `Work started as ${work.workId}.`,
     data: {
-      mode: {
-        mode: executionMode,
-        reason: executionMode === 'direct_control'
-          ? 'A lightweight WorkContract records the mutation while execution stays on Direct Control.'
-          : 'WorkContract created for multi-step recoverable work.',
-        createWorkContract: true,
-        createHandoff: false,
-        missingContractFields: [],
-        requiresWork: true,
-        routeDecision,
+      // Caller-visible placement facts only. Execution mode tokens, route reasons
+      // and RouteDecision are legacy orchestration metadata, not Work semantics.
+      placement: {
+        workContractCreated: true,
+        worktreeRequired: work.worktreePolicy.required,
+        isolated: work.worktreePolicy.required,
+        requiresRecovery: work.recoveryPolicy.allowSelfHealing === true || false,
       },
       workContractCreated: true,
       work: summarizeWorkContract(work),
@@ -1009,10 +872,10 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  if (work.status === 'cancelled' || work.status === 'completed' || work.status === 'failed') {
+  if (semanticWorkState(work) !== 'open') {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WorkContract ${work.workId} is terminal (${work.status}); continue is not allowed.`,
+      summary: `WorkContract ${work.workId} is terminal (${semanticWorkState(work)}); continue is not allowed.`,
       data: { work: summarizeWorkContract(work) },
       suggestedNextActions: [
         {
@@ -1026,35 +889,123 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  if ((input.reviewFindings?.length ?? 0) > 0 && work.workKind !== 'read_only_review') {
+  if (semanticWorkState(work) === 'open' && hasSettledWorkDeliveryReceipt(work)) {
     return buildFacadeResult({
-      status: 'blocked',
-      summary: `READ_ONLY_REVIEW_FINDINGS_KIND_REQUIRED: ${work.workId} is ${work.workKind}, not read_only_review.`,
-      data: { work: summarizeWorkContract(work), reviewFindingsRecorded: false },
+      status: 'ok',
+      summary: `Continue: physical delivery is settled for ${work.workId}; semantic Work remains open for explicit Controller judgment.`,
+      data: {
+        work: summarizeWorkContract(work),
+        backgroundCompleted: false,
+        nextStep: 'semantic_decision',
+        deliverySettled: true,
+        semanticWorkState: 'open',
+      },
+      evidenceRefs: work.evidenceRefs.slice(0, 5),
     });
   }
-  if (work.workKind === 'read_only_review') {
-    const sourceIdentity = evaluateReadOnlyReviewSourceIdentity(work, ctx.sourceRevision, ctx.workspaceChangedPaths);
-    if (sourceIdentity.status !== 'complete') {
+
+  if (input.verifiedEngineeringEvidence) {
+    const sourceIdentity = ctx.sourceRevision?.trim()
+      ? { kind: 'revision' as const, revision: ctx.sourceRevision.trim() }
+      : ctx.sourceBaseState === 'unborn'
+        ? { kind: 'unborn' as const }
+        : { kind: 'unknown' as const };
+    let refreshedEngineeringContext;
+    try {
+      refreshedEngineeringContext = buildEngineeringContextReceipt({
+        risk: work.risk,
+        sourceIdentity,
+        evidence: input.verifiedEngineeringEvidence,
+        recordedAt: nowIso(ctx),
+      });
+    } catch (error) {
       return buildFacadeResult({
         status: 'blocked',
-        summary: `READ_ONLY_REVIEW_SOURCE_IDENTITY_REQUIRED: ${sourceIdentity.reasons.join(' ')}`,
-        data: { work: summarizeWorkContract(work), sourceIdentityProven: false },
+        summary: error instanceof Error ? error.message : 'ENGINEERING_CONTEXT_INVALID',
+        data: { work: summarizeWorkContract(work), engineeringEvidenceUpdated: false },
       });
     }
+    work = updateWorkContract(ctx.workStore, work.workId, { engineeringContext: refreshedEngineeringContext });
   }
 
+  if (input.engineeringBlocker) {
+    if (!work.engineeringContext || work.engineeringContext.sourceIdentity.kind !== 'revision') {
+      return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_SOURCE_IDENTITY_REQUIRED', data: { work: summarizeWorkContract(work) } });
+    }
+    let blocker;
+    let linkedWork: WorkContract | undefined;
+    try {
+      let linkedWorkId: string | undefined;
+      if (input.engineeringBlocker.classification === 'unrelated') {
+        // Forge does not decompose work on the model's behalf. An unrelated blocker
+        // must name the Work that already owns it; the caller creates that Work
+        // explicitly (rh_work start) and passes its exact id here.
+        const declaredLinkedWorkId = input.engineeringBlocker.linkedWorkId?.trim();
+        if (!declaredLinkedWorkId) {
+          return buildFacadeResult({
+            status: 'blocked',
+            summary: 'ENGINEERING_BLOCKER_LINKED_WORK_REQUIRED: an unrelated blocker must name the Work that owns it via linked_work_id; Forge never creates a child Work automatically.',
+            data: { work: summarizeWorkContract(work), linkedWorkCreated: false },
+            suggestedNextActions: [{
+              label: 'Start the owning Work explicitly',
+              tool: 'rh_work',
+              operation: 'start',
+              payload: { objective: `Resolve unrelated blocker ${input.engineeringBlocker.blockerId}: ${input.engineeringBlocker.rationale}` },
+              risk: 'readonly',
+              confidence: 'medium',
+            }],
+          });
+        }
+        linkedWork = getWorkContract(ctx.workStore, declaredLinkedWorkId);
+        if (!linkedWork) {
+          return buildFacadeResult({
+            status: 'blocked',
+            summary: `ENGINEERING_BLOCKER_LINKED_WORK_UNKNOWN: ${declaredLinkedWorkId} is not a readable Work.`,
+            data: { work: summarizeWorkContract(work), linkedWorkId: declaredLinkedWorkId, linkedWorkCreated: false },
+          });
+        }
+        linkedWorkId = linkedWork.workId;
+      }
+      blocker = buildEngineeringBlockerDispositionReceipt({
+        sourceRevision: work.engineeringContext.sourceIdentity.revision,
+        blockerId: input.engineeringBlocker.blockerId,
+        classification: input.engineeringBlocker.classification,
+        semanticScopeKeys: input.engineeringBlocker.semanticScopeKeys ?? work.engineeringContext.semanticScope?.keys ?? [],
+        ...(linkedWork ? { linkedWorkId: linkedWork.workId } : {}),
+        rationale: input.engineeringBlocker.rationale,
+        recordedAt: nowIso(ctx),
+      });
+      const nextEngineering = applyEngineeringBlockerDisposition(work.engineeringContext, blocker);
+      work = updateWorkContract(ctx.workStore, work.workId, { engineeringContext: nextEngineering });
+    } catch (error) {
+      return buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'ENGINEERING_BLOCKER_INVALID', data: { work: summarizeWorkContract(work) } });
+    }
+    if (blocker.action === 'extend_candidate') {
+      work = appendWorkEvidence(ctx.workStore, work.workId, {
+        title: 'same-root candidate scope extension',
+        summary: `Blocker ${blocker.blockerId} remains inside the current architecture authority; continue the exact candidate without Design re-entry or sibling Work.`,
+        detailLevel: 'summary',
+      });
+    } else {
+      work = appendWorkEvidence(ctx.workStore, work.workId, {
+        title: 'engineering blocker observation',
+        summary: `Recorded ${blocker.classification} blocker ${blocker.blockerId}; it is model guidance, not a Work continuation gate.`,
+        detailLevel: 'summary',
+      });
+    }
+  }
+
+  if ((input.reviewFindings?.length ?? 0) > 0 && work.workKind !== 'read_only_review') {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `READ_ONLY_REVIEW_FINDINGS_KIND_REQUIRED: ${work.workId} is ${work.workKind}, not read_only_review.`,
+      data: { work: summarizeWorkContract(work), reviewFindingsRecorded: false },
+    });
+  }
   const explicitPolicyScope = input.allowedPaths !== undefined
     || input.forbiddenPaths !== undefined
     || input.checks !== undefined;
   if (explicitPolicyScope) {
-    if (work.planId) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${work.workId} is governed by Plan ${work.planId}; continue cannot widen frozen policy scope. Replan the authoritative Plan instead.`,
-        data: { work: summarizeWorkContract(work), planId: work.planId, policyScopeUpdated: false },
-      });
-    }
     const normalizedChecks = normalizeCheckIds(input.checks ?? [], ctx.availableChecks ?? []);
     if (normalizedChecks.invalidCheckIds.length > 0) {
       return buildFacadeResult({
@@ -1064,12 +1015,10 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       });
     }
     work = updateWorkContract(ctx.workStore, work.workId, {
-      allowedPaths: [...new Set([...work.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
-      forbiddenPaths: [...new Set([...work.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
       checks: [...new Set([...work.checks, ...normalizedChecks.validCheckIds])].slice(0, 30),
       scopeEvidence: {
         initialLikelyPaths: [...new Set([
-          ...(work.scopeEvidence?.initialLikelyPaths ?? work.allowedPaths),
+          ...(work.scopeEvidence?.initialLikelyPaths ?? []),
           ...(input.allowedPaths ?? []),
         ])].slice(0, 100),
         inspectedPaths: work.scopeEvidence?.inspectedPaths ?? [],
@@ -1185,8 +1134,11 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     }
   }
 
-  const currentCheckRefs = work.checkRefs.filter((record) =>
-    verificationRecordAppliesToCurrentWorkspace(record, ctx.sourceRevision, ctx.workspaceFingerprint));
+  const currentCheckRefs = effectiveCurrentWorkVerificationRecords(
+    work,
+    ctx.sourceRevision,
+    ctx.workspaceFingerprint,
+  );
   const history = reconcileVerificationHistory(
     currentCheckRefs.map((record) => ({ checkId: record.checkId, outcome: record.outcome, recordedAt: record.recordedAt })),
   );
@@ -1201,7 +1153,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       detailLevel: 'summary',
     });
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: `Controller chose bounded ${decision} after acceptance failure; implementation may resume before re-verification.`,
@@ -1224,148 +1175,36 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  // Ambiguous acceptance failure without an explicit bounded Controller decision →
-  // ask once per distinct failure evidence. Repeated continue calls must not
-  // manufacture an unbounded handoff loop. A resolved handoff remains the decision
-  // authority until newer valid-fail evidence; an unresolved matching handoff is reused.
-  if (history.acceptanceFailures.length > 0 && !explicitAcceptanceRepair && work.recoveryPolicy.handoffOnAmbiguity) {
+  // Acceptance failure is a model/controller decision point, not a human blocker.
+  // Do not manufacture Handoff/UserRequest state for repair vs re-scope.
+  if (history.acceptanceFailures.length > 0 && !explicitAcceptanceRepair) {
     const failureReason = `Acceptance checks failed: ${history.acceptanceFailures.join(', ')}`;
-    const latestFailureAt = work.checkRefs
-      .filter((record) => record.outcome === 'valid_fail' && history.acceptanceFailures.includes(record.checkId))
-      .map((record) => record.recordedAt)
-      .sort((left, right) => right.localeCompare(left))[0];
-    const matchingHandoffs = listHandoffItems({ ...ctx.handoffStore, status: 'all', limit: 100 })
-      .filter((item) => (
-        item.workId === input.workId
-        && item.creationReason === 'ambiguous_outcome'
-        && item.title === 'Acceptance failure needs review'
-        && item.reason === failureReason
-        && (!latestFailureAt || item.createdAt >= latestFailureAt)
-      ));
-    const activeHandoff = matchingHandoffs.find((item) => item.status === 'pending' || item.status === 'acknowledged');
-    if (activeHandoff) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `Continue remains paused for ChatGPT review through existing handoff ${activeHandoff.id}.`,
-        data: {
-          work: summarizeWorkContract(work),
-          handoffId: activeHandoff.id,
-          acceptanceFailures: history.acceptanceFailures,
-          infrastructureIssues: history.infrastructureIssues,
-          backgroundCompleted: false,
-        },
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        suggestedNextActions: [{
-          label: 'Get handoff',
-          tool: 'rh_inbox',
-          operation: 'get',
-          payload: { handoff_id: activeHandoff.id },
-          risk: 'readonly',
-          confidence: 'high',
-        }],
-      });
-    }
-
-    const resolvedHandoff = matchingHandoffs.find((item) => item.status === 'resolved');
-    if (!resolvedHandoff) {
-      const continuation = buildWorkContinuationSnapshot(work);
-      const handoff = createHandoffItem(ctx.handoffStore, {
-        id: handoffIdFor('continue'),
-        repoId: ctx.repoId,
-        workId: work.workId,
-        title: 'Acceptance failure needs review',
-        severity: 'needs_review',
-        creationReason: 'ambiguous_outcome',
-        reason: failureReason,
-        summary: 'Continue paused; ChatGPT must decide repair vs re-scope.',
-        currentState: {
-          repoId: ctx.repoId,
-          workId: work.workId,
-          mode: work.mode,
-          statusSummary: 'waiting_for_review after acceptance failure',
-          checks: history.acceptanceFailures.map((checkId) => ({ checkId, ok: false, outcome: 'valid_fail' as const })),
-          workSemantics: continuation.semantics,
-          reconciliationRequired: continuation.reconciliationRequired,
-          nextSafeAction: continuation.nextSafeAction,
-        },
-        attemptedActions: ['continue'],
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        blockingDecision: 'Decide whether to repair code, adjust acceptance criteria, or stop.',
-        recommendedDecision: 'Inspect evidence and either repair or stop the workloop.',
-        recommendedPrompt: work.continuationPrompt ?? `Continue from work ${work.workId}.`,
-        recommendedContinuationPrompt: continuation.continuationPrompt,
-        suggestedNextActions: [
-          {
-            label: 'Read work context',
-            tool: 'rh_context',
-            operation: 'get',
-            payload: { work_id: work.workId },
-            risk: 'readonly',
-          },
-        ],
-      });
-      transitionWorkContractPhase(ctx.workStore, work.workId, {
-        status: 'ready',
-        phase: 'verification',
-        state: 'blocked',
-        summary: `Acceptance failure requires review through handoff ${handoff.id}.`,
-        evidenceRefs: work.evidenceRefs,
-      });
-      const updated = appendWorkHandoffRef(ctx.workStore, work.workId, handoff.id);
-
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `Continue paused for ChatGPT review; handoff ${handoff.id} created. No background execution pretended.`,
-        data: {
-          work: summarizeWorkContract(updated),
-          handoffId: handoff.id,
-          acceptanceFailures: history.acceptanceFailures,
-          infrastructureIssues: history.infrastructureIssues,
-          backgroundCompleted: false,
-        },
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        suggestedNextActions: [
-          {
-            label: 'Get handoff',
-            tool: 'rh_inbox',
-            operation: 'get',
-            payload: { handoff_id: handoff.id },
-            risk: 'readonly',
-            confidence: 'high',
-          },
-        ],
-      });
-    }
-
-    transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'active',
-      summary: `Resolved acceptance-failure handoff ${resolvedHandoff.id} authorizes bounded continuation to re-verification.`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    work = getWorkContract(ctx.workStore, work.workId) ?? work;
     return buildFacadeResult({
-      status: 'ok',
-      summary: `Continue accepted resolved acceptance-failure handoff ${resolvedHandoff.id}; re-verification may resume.`,
+      status: 'blocked',
+      summary: `${failureReason}. The model must explicitly choose bounded repair or re-scope before continuing; no human Handoff was created.`,
       data: {
         work: summarizeWorkContract(work),
-        handoffId: resolvedHandoff.id,
         acceptanceFailures: history.acceptanceFailures,
         infrastructureIssues: history.infrastructureIssues,
         backgroundCompleted: false,
-        nextStep: 'verify',
-        remainingChecks: history.acceptanceFailures,
+        acceptanceFailureDecisionRequired: true,
       },
       evidenceRefs: work.evidenceRefs.slice(0, 5),
-      suggestedNextActions: suggestedForWork(work),
+      suggestedNextActions: [{
+        label: 'Inspect Work before repair or re-scope',
+        tool: 'rh_context',
+        operation: 'get',
+        payload: { work_id: work.workId },
+        risk: 'readonly',
+        confidence: 'high',
+        reason: 'Acceptance evidence is factual input; the model chooses the next capability without a Work lifecycle transition.',
+      }],
     });
   }
 
   // Infrastructure issues: suggest self-healing, not acceptance failure.
   if (history.infrastructureIssues.length > 0) {
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: `Infrastructure issues require repair: ${history.infrastructureIssues.join(', ')}.`,
@@ -1414,7 +1253,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       },
     ]).actions;
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: implementationEvidence.reasons.join(' '),
@@ -1443,24 +1281,15 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
 
   if (work.checks.length > 0 && history.validPasses.length < work.checks.length) {
     const remaining = work.checks.filter((checkId) => !history.validPasses.includes(checkId));
-    const suggested = validateSuggestedNextActions(
-      remaining.map((checkId) => ({
-        label: `Verify ${checkId}`,
-        tool: 'rh_work' as const,
-        operation: 'verify',
-        payload: { work_id: work.workId, check_id: checkId },
-        risk: 'workspace_write' as const,
-        confidence: 'high' as const,
-      })),
-      { validCheckIds: work.checks },
-    ).actions;
-    transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'active',
-      summary: `Verification remains for: ${remaining.join(', ')}.`,
-      evidenceRefs: work.evidenceRefs,
-    });
+    const suggested = validateSuggestedNextActions([{
+      label: 'Inspect Work and check evidence',
+      tool: 'rh_context',
+      operation: 'get',
+      payload: { work_id: work.workId },
+      risk: 'readonly',
+      confidence: 'high',
+      reason: 'Registered checks are independent execution evidence; they do not progress Work lifecycle state.',
+    }]).actions;
     const updated = updateWorkContract(ctx.workStore, work.workId, {
       suggestedNextActions: suggested,
       continuationPrompt: input.note
@@ -1469,12 +1298,12 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
     return buildFacadeResult({
       status: 'ok',
-      summary: `Continue: next step is verification of ${remaining[0]}. No background work was completed.`,
+      summary: `Registered check evidence is still missing for: ${remaining.join(', ')}. Run checks through the check capability; Work semantic state is unchanged.`,
       data: {
         work: summarizeWorkContract(updated),
         remainingChecks: remaining,
         backgroundCompleted: false,
-        nextStep: 'verify',
+        nextStep: 'run_check',
       },
       suggestedNextActions: suggested,
     });
@@ -1500,7 +1329,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       },
     ]).actions;
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: work.workKind === 'read_only_review' ? 'verification' : 'implementation',
       state: 'active',
       summary: work.workKind === 'read_only_review'
@@ -1530,200 +1358,13 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  const suggested = validateSuggestedNextActions([
-    {
-      label: 'Finalize work',
-      tool: 'rh_work',
-      operation: 'finalize',
-      payload: { work_id: work.workId },
-      risk: 'readonly',
-      confidence: 'high',
-    },
-  ]).actions;
-  transitionWorkContractPhase(ctx.workStore, work.workId, {
-    status: 'running',
-    phase: 'delivery',
-    state: 'active',
-    summary: work.workKind === 'read_only_review'
-      ? 'Read-only review evidence is source-bound and clean; semantic no-change finalization is next.'
-      : 'Implementation and verification evidence are sufficient; exact delivery and cleanup receipt is next.',
-    evidenceRefs: work.evidenceRefs,
-  });
-  const updated = updateWorkContract(ctx.workStore, work.workId, {
-    suggestedNextActions: suggested,
-  });
-  return buildFacadeResult({
-    status: 'ok',
-    summary: `Continue: checks satisfied or none required; ready to finalize after ChatGPT review.`,
-    data: {
-      work: summarizeWorkContract(updated),
-      backgroundCompleted: false,
-      nextStep: 'finalize',
-    },
-    suggestedNextActions: suggested,
-  });
-}
-
-export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopVerifyInput): FacadeResult {
-  const work = getWorkContract(ctx.workStore, input.workId);
-  if (!work) {
-    return buildFacadeResult({
-      status: 'not_found',
-      summary: `WorkContract ${input.workId} not found.`,
-      data: { workId: input.workId },
-    });
-  }
-
-  const available = ctx.availableChecks ?? work.checks.map((id) => ({ id }));
-  const classified = classifyVerificationOutcome({
-    checkId: input.checkId,
-    available,
-    infrastructureFailed: input.infrastructureFailed,
-    checkFailed: input.checkFailed,
-    skipped: input.skipped,
-  });
-  if (work.status === 'completed' || work.status === 'cancelled' || work.status === 'failed') {
-    const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
-    const existing = [...work.checkRefs].reverse().find((record) => record.checkId === resolvedCheckId);
-    const completed = work.status === 'completed';
-    return buildFacadeResult({
-      status: completed ? 'ok' : 'blocked',
-      summary: `WorkContract ${work.workId} is terminal (${work.status}); verification was not re-executed.`,
-      data: {
-        work: summarizeWorkContract(work),
-        verification: {
-          checkId: resolvedCheckId,
-          ...(existing ? { outcome: existing.outcome } : {}),
-          terminal: true,
-          idempotent: true,
-          reexecuted: false,
-          isAcceptanceFailure: existing?.outcome === 'valid_fail',
-          isInfrastructureIssue: existing?.outcome === 'invalid_check_id' || existing?.outcome === 'infrastructure_failure',
-          doesNotRequestTaskChanges: existing?.outcome !== 'valid_fail',
-        },
-        backgroundCompleted: false,
-      },
-      evidenceRefs: existing?.evidenceRef ? [existing.evidenceRef] : [],
-      warnings: classified.warnings,
-      suggestedNextActions: [{ label: 'Inspect work via context', tool: 'rh_context', operation: 'get', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high' }],
-    });
-  }
-
-  const at = nowIso(ctx);
-  const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
-  const receipt = input.receipt
-    && input.receipt.repoId === work.repoId
-    && input.receipt.workId === work.workId
-    && input.receipt.checkId === resolvedCheckId
-    ? input.receipt
-    : undefined;
-  const sourceRevision = receipt && input.sourceRevision?.trim() ? input.sourceRevision.trim() : undefined;
-  const verificationSummary = receipt
-    ? `${classified.summary} Durable Process receipt ${receipt.receiptId}.`
-    : classified.summary;
-  const record: VerificationRecord = {
-    checkId: resolvedCheckId,
-    outcome: classified.outcome,
-    summary: verificationSummary,
-    recordedAt: at,
-    sourceRevision,
-    workspaceFingerprint: receipt && sourceRevision ? input.workspaceFingerprint : undefined,
-    verificationInputFingerprint: receipt && sourceRevision ? input.verificationInputFingerprint : undefined,
-    commandFingerprint: receipt && sourceRevision ? input.commandFingerprint : undefined,
-    startedAt: receipt?.startedAt,
-    completedAt: receipt?.finishedAt,
-    receipt,
-    evidenceRef: {
-      title: `verification:${classified.outcome}`,
-      summary: verificationSummary,
-      detailLevel: 'summary',
-    },
-  };
-
-  // Supersede prior invalid/infrastructure noise when a valid outcome arrives for the same check.
-  let checkRefs = work.checkRefs;
-  if (classified.outcome === 'valid_pass' || classified.outcome === 'valid_fail') {
-    checkRefs = work.checkRefs.map((existing) => {
-      if (
-        existing.checkId === record.checkId
-        && (existing.outcome === 'invalid_check_id' || existing.outcome === 'infrastructure_failure')
-      ) {
-        return { ...existing, outcome: 'superseded' as const, summary: `Superseded by ${classified.outcome} at ${at}` };
-      }
-      return existing;
-    });
-    updateWorkContract(ctx.workStore, work.workId, { checkRefs });
-  }
-
-  const updated = appendVerificationRecord(ctx.workStore, work.workId, record);
-  if (record.evidenceRef) appendWorkEvidence(ctx.workStore, work.workId, record.evidenceRef);
-
-  const status =
-    classified.outcome === 'invalid_check_id' || classified.outcome === 'infrastructure_failure'
-      ? 'ok'
-      : classified.outcome === 'valid_fail'
-        ? 'failed'
-        : 'ok';
-
-  const completionEvidence = classified.outcome === 'valid_pass'
-    ? evaluateWorkCompletionEvidence(updated, sourceRevision, input.workspaceFingerprint)
-    : undefined;
-  const validPassReadyToFinalize = completionEvidence?.status === 'complete';
-  const suggested = validateSuggestedNextActions(
-    classified.outcome === 'valid_pass'
-      ? [{
-          label: validPassReadyToFinalize ? 'Finalize work' : 'Continue workloop',
-          tool: 'rh_work',
-          operation: validPassReadyToFinalize ? 'finalize' : 'continue',
-          payload: { work_id: work.workId },
-          risk: 'readonly',
-          confidence: 'high',
-        }]
-      : classified.outcome === 'valid_fail'
-        ? [{
-            label: 'Continue for review handoff',
-            tool: 'rh_work',
-            operation: 'continue',
-            payload: { work_id: work.workId },
-            risk: 'readonly',
-            confidence: 'high',
-          }]
-        : [{
-            label: 'Diagnose infrastructure (dry-run)',
-            tool: 'rh_work',
-            operation: 'repair',
-            payload: { work_id: work.workId, repair_operation: 'diagnose', dry_run: true },
-            risk: 'readonly',
-            confidence: 'high',
-          }],
-    { validCheckIds: work.checks },
-  ).actions;
-
-  return buildFacadeResult({
-    status: status === 'failed' ? 'failed' : 'ok',
-    summary: classified.summary,
-    data: {
-      work: summarizeWorkContract(updated),
-      verification: {
-        checkId: record.checkId,
-        outcome: classified.outcome,
-        isAcceptanceFailure: classified.isAcceptanceFailure,
-        isInfrastructureIssue: classified.isInfrastructureIssue,
-        // Explicitly separate pollution classes for ChatGPT.
-        doesNotRequestTaskChanges: !classified.isAcceptanceFailure,
-      },
-      backgroundCompleted: false,
-      ...(classified.outcome === 'valid_pass'
-        ? { nextStep: validPassReadyToFinalize ? 'finalize' : 'continue' }
-        : {}),
-    },
-    warnings: classified.warnings,
-    evidenceRefs: record.evidenceRef ? [record.evidenceRef] : [],
-    suggestedNextActions: suggested,
-  });
+  // Completion evidence is observational. It cannot choose a review/finalize
+  // transition or tell the model which capability to invoke next.
+  const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: [] });
+  return buildFacadeResult({ status: 'ok', summary: 'Continue: current Work evidence recorded.', data: { work: summarizeWorkContract(updated), backgroundCompleted: false }, suggestedNextActions: [] });
 }
 
-export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopFinalizeInput): FacadeResult {
+export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopStopInput): FacadeResult {
   const work = getWorkContract(ctx.workStore, input.workId);
   if (!work) {
     return buildFacadeResult({
@@ -1733,326 +1374,38 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  if (work.status === 'cancelled') {
+  const destructiveCleanup = input.authorizeDestructiveCleanup === true;
+  if (semanticWorkState(work) === 'completed') {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WorkContract ${work.workId} was cancelled; finalize is not allowed.`,
+      summary: `WORK_CANCEL_COMPLETED: ${work.workId}`,
       data: { work: summarizeWorkContract(work) },
     });
   }
-
-  // A Work-owned completion receipt is the strongest delivery/cleanup authority.
-  // Physical finalization records status=completed + receipt atomically. A facade
-  // retry must be idempotent and must never re-run weaker pre-delivery evidence
-  // evaluation that could attempt to demote an already completed Work.
-  if (work.status === 'completed' && work.completionReceipt) {
-    if (work.planId && work.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: work.planId, stepId: work.planStepId, work });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: succeeded for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(work),
-        finalStatus: 'completed',
-        completionReceipt: work.completionReceipt,
-        idempotent: true,
-        hiddenFailure: false,
-      },
-      evidenceRefs: work.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  const completionEvidence = evaluateWorkCompletionEvidence(
-    work,
-    ctx.sourceRevision,
-    ctx.workspaceFingerprint,
-    ctx.workBoundProcessEvidenceIds,
-    ctx.workspaceChangedPaths,
-  );
-  const history = completionEvidence.history;
-
-  if (input.forceFailed || completionEvidence.status === 'failed') {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'failed',
-      phase: 'cleanup',
-      state: 'failed',
-      summary: `Work failed acceptance/finalization: ${history.acceptanceFailures.join(', ') || 'forced failure'}.`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    if (updated.planId && updated.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: updated.planId, stepId: updated.planStepId, work: updated });
-    }
-    return buildFacadeResult({
-      status: 'failed',
-      summary: `Finalize result: failed. Acceptance failures: ${history.acceptanceFailures.join(', ') || 'forced'}.`,
-      data: {
-        work: summarizeWorkContract(updated),
-        finalStatus: 'failed',
-        acceptanceFailures: history.acceptanceFailures,
-        infrastructureIssues: history.infrastructureIssues,
-        invalidCheckIds: history.invalidCheckIds,
-        // Failures are not hidden.
-        hiddenFailure: false,
-      },
-      suggestedNextActions: [
-        {
-          label: 'List handoffs',
-          tool: 'rh_inbox',
-          operation: 'list',
-          risk: 'readonly',
-        },
-      ],
-    });
-  }
-
-  // Weak refs, partial checks, invalid ids, and infrastructure issues never imply successful completion.
-  if (completionEvidence.status === 'incomplete') {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'ready',
-      phase: 'verification',
-      state: 'blocked',
-      summary: `Completion evidence remains incomplete: ${completionEvidence.reasons.join(' ')}`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `Finalize result: waiting_for_review. ${completionEvidence.reasons.join(' ')}`,
-      data: {
-        work: summarizeWorkContract(updated),
-        finalStatus: 'ready',
-        infrastructureIssues: history.infrastructureIssues,
-        invalidCheckIds: history.invalidCheckIds,
-        validPasses: history.validPasses,
-        missingChecks: completionEvidence.missingChecks,
-        durableResultEvidence: completionEvidence.durableResultEvidence,
-        ignoredWeakReferences: {
-          workerRef: Boolean(work.workerRef),
-          worktreeRef: Boolean(work.worktreeRef),
-        },
-        hiddenFailure: false,
-      },
-      suggestedNextActions: [
-        {
-          label: 'Continue workloop',
-          tool: 'rh_work',
-          operation: 'continue',
-          payload: { work_id: work.workId },
-          risk: 'readonly',
-        },
-      ],
-    });
-  }
-
-  // Read-only review completion is semantic no-change authority, not Git delivery.
-  // The exact source/workspace fence is re-evaluated above at finalize time; only
-  // a clean review with persisted inspected paths and zero findings can close.
-  if (work.workKind === 'read_only_review' && !work.completionReceipt) {
-    const reviewEvidence = work.readOnlyReviewEvidence!;
-    const recordedAt = nowIso(ctx);
-    const completed = completeWorkWithReceipt(
-      ctx.workStore,
-      work.workId,
-      {
-        schemaVersion: 1,
-        receiptId: `ROR-WORK-${randomUUID()}`,
-        source: 'read_only_review',
-        workId: work.workId,
-        baseRevision: work.baseRevision!,
-        sourceRevision: ctx.sourceRevision!,
-        ...(ctx.workspaceFingerprint ? { workspaceFingerprint: ctx.workspaceFingerprint } : {}),
-        workspaceChangedPaths: [],
-        inspectedPaths: reviewEvidence.inspectedPaths,
-        findingCount: 0,
-        recordedAt,
-      },
-      'completed_no_change',
-      'read_only_review',
-    );
-    if (completed.planId && completed.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: clean read-only review completed with no source change for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(completed),
-        finalStatus: 'completed',
-        completionOutcome: 'completed_no_change',
-        completionReceipt: completed.completionReceipt,
-        inspectedPathCount: reviewEvidence.inspectedPaths.length,
-        hiddenFailure: false,
-      },
-      evidenceRefs: completed.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  // For a controller-local effect Work, the semantic Controller's explicit
-  // finalize call is the terminalization decision, but it is admissible only
-  // after durable result evidence exists. Record one canonical Work receipt here
-  // instead of routing an effect-only Work through Git delivery. Remote effects
-  // remain bound to their durable plugin action receipt in the plugin layer.
-  if (work.workKind === 'local_effect' && !work.completionReceipt && completionEvidence.durableResultEvidence) {
-    const recordedAt = nowIso(ctx);
-    const completed = completeWorkWithReceipt(
-      ctx.workStore,
-      work.workId,
-      {
-        schemaVersion: 1,
-        receiptId: `LFX-WORK-${randomUUID()}`,
-        source: 'local_effect',
-        workId: work.workId,
-        operation: 'controller_work/local_effect',
-        target: { kind: 'controller_local', id: work.workId },
-        changed: true,
-        recordedAt,
-      },
-      'completed_local',
-      'local_effect',
-    );
-    if (completed.planId && completed.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: succeeded for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(completed),
-        finalStatus: 'completed',
-        completionReceipt: completed.completionReceipt,
-        validPasses: history.validPasses,
-        hiddenFailure: false,
-      },
-      evidenceRefs: completed.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  // Checks and result evidence are necessary but not sufficient. Delivery and
-  // cleanup must produce the exact Work-owned receipt before Work can become
-  // terminal; a Run exit or a missing receipt is never completion authority.
-  if (!work.completionReceipt) {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'ready',
-      phase: 'delivery',
-      state: 'blocked',
-      summary: 'Exact delivery and cleanup completion receipt is required.',
-      evidenceRefs: work.evidenceRefs,
-    });
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `Finalize blocked for ${work.workId}: an exact delivery and cleanup completion receipt is required.`,
-      data: { work: summarizeWorkContract(updated), finalStatus: 'ready', completionReceiptRequired: true },
-      suggestedNextActions: [{ label: 'Complete Work delivery and cleanup', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'local_repo_write' }],
-    });
-  }
-
-  const updated = getWorkContract(ctx.workStore, work.workId)!;
-  if (updated.planId && updated.planStepId && ctx.planStore) {
-    completePlanStepForWork(ctx.planStore, { planId: updated.planId, stepId: updated.planStepId, work: updated });
-  }
-  return buildFacadeResult({
-    status: 'ok',
-    summary: `Finalize result: succeeded for ${work.workId}.`,
-    data: {
-      work: summarizeWorkContract(updated),
-      finalStatus: 'completed',
-      validPasses: history.validPasses,
-      hiddenFailure: false,
-    },
-    evidenceRefs: work.evidenceRefs.slice(0, 5),
-    suggestedNextActions: [
-      {
-        label: 'Read controller status',
-        tool: 'rh_status',
-        operation: 'get',
-        risk: 'readonly',
-      },
-    ],
-  });
-}
-
-export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopStopInput): FacadeResult {
-  const work = getWorkContract(ctx.workStore, input.workId);
-  if (!work) {
-    return buildFacadeResult({
-      status: 'not_found',
-      summary: `WorkContract ${input.workId} not found.`,
-      data: { workId: input.workId },
-    });
-  }
-
-  const owner = ctx.workStore.controllerHome
-    ? getControllerSession({ controllerHome: ctx.workStore.controllerHome, repoId: ctx.repoId }, work.workId)
-    : undefined;
-  if (owner) {
-    const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
-    const ownerInstanceId = owner.controllerInstanceId?.trim();
-    const callerPrincipal = ctx.principalId?.trim();
-    const callerInstanceId = ctx.controllerInstanceId?.trim();
-    const sameAuthority = Boolean(
-      callerPrincipal
-      && ownerPrincipal === callerPrincipal
-      && (!ownerInstanceId || ownerInstanceId === callerInstanceId),
-    );
-    if (!sameAuthority) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `WORK_TERMINALIZATION_ACTIVE_CONTROLLER_FENCE: ${work.workId} has a newer active Controller claim generation ${owner.claimGeneration ?? 1}.`,
-        data: {
-          work: summarizeWorkContract(work),
-          activeController: {
-            controllerId: owner.controllerId,
-            principalId: ownerPrincipal,
-            controllerInstanceId: owner.controllerInstanceId,
-            sessionId: owner.sessionId,
-            claimGeneration: owner.claimGeneration ?? 1,
-          },
-          finalStatus: work.status,
-        },
-      });
-    }
-  }
-
-  const destructiveCleanup = input.authorizeDestructiveCleanup === true;
-  transitionWorkContractPhase(ctx.workStore, work.workId, {
-    status: 'cancelled',
-    phase: 'cleanup',
-    state: 'skipped',
-    summary: input.reason ? `Stopped: ${input.reason}` : 'Work stopped without destructive cleanup.',
-    evidenceRefs: work.evidenceRefs,
-  });
-  const updated = updateWorkContract(ctx.workStore, work.workId, {
-    continuationPrompt: input.reason
-      ? `Stopped: ${input.reason}`.slice(0, 2_000)
-      : work.continuationPrompt,
-    // Authorization is not proof of cleanup. Preserve the reference until a real
-    // cleanup handler verifies ownership, cleanliness and successful removal.
-    worktreeRef: work.worktreeRef,
+  const semanticRevision = Number.isInteger(work.semanticRevision) && Number(work.semanticRevision) > 0
+    ? Number(work.semanticRevision)
+    : 1;
+  const updated = reviseWorkSemanticContext(ctx.workStore, work.workId, {
+    expectedRevision: semanticRevision,
+    state: 'cancelled',
+    resultRefs: work.evidenceRefs
+      .flatMap((evidence) => [evidence.evidenceId, evidence.artifactId])
+      .map((value) => value?.trim())
+      .filter((value): value is string => Boolean(value)),
   });
   const planId = updated.planId;
   const planStepId = updated.planStepId;
   let plan = planId && ctx.planStore
     ? getPlanContract(ctx.planStore, planId)
     : undefined;
-  if (plan && planId && planStepId && ctx.planStore) {
-    const step = plan.steps.find((entry) => entry.id === planStepId);
-    if (step?.workId === updated.workId) {
-      plan = completePlanStepForWork(ctx.planStore, { planId, stepId: planStepId, work: updated });
-    }
-  }
 
   return buildFacadeResult({
     status: 'ok',
-    summary: `WorkContract ${work.workId} cancelled/stopped. Evidence retained. Worktree cleanup ${destructiveCleanup ? 'authorized but pending verification' : 'not performed'}.`,
+    summary: `WorkContract ${work.workId} cancelled/stopped. Evidence retained. Managed resource cleanup/retention is settled by the canonical Work finalization service.`,
     data: {
       work: summarizeWorkContract(updated),
       finalStatus: 'cancelled',
       evidenceRetained: true,
-      worktreeDeleted: false,
-      cleanupPending: destructiveCleanup && Boolean(work.worktreeRef),
       destructiveCleanupAuthorized: destructiveCleanup,
       ...(plan ? { plan } : {}),
     },
@@ -2068,32 +1421,36 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
   });
 }
 
+export interface GoalWorkloopTrustedInput {
+  /** Runtime-composed source-bound evidence. This channel is intentionally separate from raw MCP/tool arguments. */
+  verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
+  /**
+   * Evaluator-minted evidence for one exact candidate. Kept off the raw MCP
+   * argument surface so callers cannot manufacture architecture evidence.
+   */
+  evaluationPromotionReceipt?: EvaluationPromotionReceipt;
+}
+
 export function runGoalWorkloop(
   ctx: GoalWorkloopContext,
   operation: GoalWorkloopOperation,
   args: Record<string, unknown>,
+  trusted: GoalWorkloopTrustedInput = {},
 ): FacadeResult {
   switch (operation) {
     case 'start':
       return routeWorkStart(ctx, {
         objective: String(args.objective ?? ''),
+        workId: typeof args.work_id === 'string' ? args.work_id : undefined,
         acceptanceCriteria: Array.isArray(args.acceptance_criteria) ? args.acceptance_criteria.map(String) : undefined,
         allowedPaths: Array.isArray(args.allowed_paths) ? args.allowed_paths.map(String) : undefined,
         initialLikelyPaths: Array.isArray(args.initial_likely_paths) ? args.initial_likely_paths.map(String) : undefined,
         forbiddenPaths: Array.isArray(args.forbidden_paths) ? args.forbidden_paths.map(String) : undefined,
         checks: Array.isArray(args.check_ids) ? args.check_ids.map(String) : undefined,
-        modeInput: {
+        request: {
           objective: typeof args.objective === 'string' ? args.objective : undefined,
-          expectedFiles: typeof args.expected_files === 'number' ? args.expected_files : undefined,
-          expectedChangedLines: typeof args.expected_changed_lines === 'number' ? args.expected_changed_lines : undefined,
           scopeClear: args.scope_clear === undefined ? true : args.scope_clear === true,
-          requiresInvestigation: args.requires_investigation === true,
-          requiresLongRunningChecks: args.requires_long_running_checks === true,
-          requiresParallelism: args.requires_parallelism === true,
-          explicitMode: args.mode === 'scale' ? 'scale' : undefined,
-          needsDependencies: args.needs_dependencies === true,
           requiresRecovery: args.requires_recovery === true,
-          requiresWorker: args.requires_worker === true,
           requiresExternalEffect: args.requires_external_effect === true,
           requiresApproval: args.requires_approval === true,
           requiresUserApproval: args.requires_user_approval === true,
@@ -2107,9 +1464,6 @@ export function runGoalWorkloop(
         issueId: typeof args.issue_id === 'string' ? args.issue_id : undefined,
         approvalConfirmed: args.approval_confirmed === true,
         dryRun: args.dry_run === true,
-        forceMode: args.force_mode === 'direct_control' || args.force_mode === 'goal_workloop' || args.force_mode === 'handoff_only'
-          ? args.force_mode
-          : undefined,
         relatedWorkId: typeof args.related_work_id === 'string' ? args.related_work_id : undefined,
         workRelation: args.work_relation === 'continue' || args.work_relation === 'extend' || args.work_relation === 'parallel' || args.work_relation === 'new_goal'
           ? args.work_relation
@@ -2117,6 +1471,7 @@ export function runGoalWorkloop(
         requirementId: typeof args.requirement_id === 'string' ? args.requirement_id : undefined,
         planId: typeof args.plan_id === 'string' ? args.plan_id : undefined,
         planStepId: typeof args.plan_step_id === 'string' ? args.plan_step_id : undefined,
+        verifiedEngineeringEvidence: trusted.verifiedEngineeringEvidence,
         workKind: args.work_kind === 'repository_change'
           || args.work_kind === 'completed_no_change'
           || args.work_kind === 'read_only_review'
@@ -2127,7 +1482,25 @@ export function runGoalWorkloop(
           ? args.work_kind
           : undefined,
       });
-    case 'continue':
+    case 'continue': {
+      let engineeringBlocker: GoalWorkloopContinueInput['engineeringBlocker'];
+      if (args.engineering_blocker !== undefined) {
+        if (!args.engineering_blocker || typeof args.engineering_blocker !== 'object' || Array.isArray(args.engineering_blocker)) {
+          return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_INVALID', data: { workId: String(args.work_id ?? '') } });
+        }
+        const rawBlocker = args.engineering_blocker as Record<string, unknown>;
+        const classification = rawBlocker.classification;
+        if (classification !== 'same_root_cause' && classification !== 'same_root_cause_scope_extension' && classification !== 'unrelated') {
+          return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_CLASSIFICATION_INVALID', data: { workId: String(args.work_id ?? '') } });
+        }
+        engineeringBlocker = {
+          blockerId: String(rawBlocker.blocker_id ?? ''),
+          classification,
+          rationale: String(rawBlocker.rationale ?? ''),
+          semanticScopeKeys: Array.isArray(rawBlocker.semantic_scope_keys) ? rawBlocker.semantic_scope_keys.map(String) : undefined,
+          linkedWorkId: typeof rawBlocker.linked_work_id === 'string' ? rawBlocker.linked_work_id : undefined,
+        };
+      }
       return continueGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),
         note: typeof args.note === 'string' ? args.note : undefined,
@@ -2147,20 +1520,10 @@ export function runGoalWorkloop(
         acceptanceFailureDecision: args.acceptance_failure_decision === 'repair' || args.acceptance_failure_decision === 'rescope'
           ? args.acceptance_failure_decision
           : undefined,
+        verifiedEngineeringEvidence: trusted.verifiedEngineeringEvidence,
+        engineeringBlocker,
       });
-    case 'verify':
-      return verifyGoalWorkloop(ctx, {
-        workId: String(args.work_id ?? ''),
-        checkId: String(args.check_id ?? args.checkId ?? ''),
-        infrastructureFailed: args.infrastructure_failed === true,
-        checkFailed: args.check_failed === true,
-        skipped: args.skipped === true,
-      });
-    case 'finalize':
-      return finalizeGoalWorkloop(ctx, {
-        workId: String(args.work_id ?? ''),
-        forceFailed: args.force_failed === true,
-      });
+    }
     case 'stop':
       return stopGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),