@moretea-labs/forge 1.8.1 → 1.8.2

package/src/runtime/standalone-recovery/entry.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from 'child_process';
 import { createHash, randomUUID } from 'crypto';
 import { existsSync } from 'fs';
 import { createServer, type IncomingMessage, type ServerResponse } from 'http';
@@ -42,7 +43,6 @@ import {
   runtimeStatus,
   verifyStableRuntime,
   verifyConfiguredRuntimeReleaseSessionStaticGates,
-  probeReleaseCutoverReadiness,
   watchdogTick,
   type WatchdogState,
   type RecoveryConfig,
@@ -64,6 +64,8 @@ import {
 } from './release';
 import { RECOVERY_MUTATION_IDENTITY_CONTRACT, RECOVERY_MUTATION_IDENTITY_FIELDS } from './mutation-identity-contract';
 import { readReleaseSession } from '../release/release-session';
+import { readRuntimeOwner } from '../root/ownership';
+import { observeRuntimeStatus } from '../root/status';
 import { migrateReleaseDurableState } from '../release/release-state-migration';
 import {
   advanceConfiguredRuntimeRelease,
@@ -91,6 +93,37 @@ const RECOVERY_AUTOMATIC_RELEASE_INTERVAL_MS = 15_000;
 const RECOVERY_AUTOMATIC_RELEASE_FAILURE_BACKOFF_MAX_MS = 15 * 60_000;
 const RECOVERY_AUTOMATIC_RELEASE_STEP_TIMEOUT_MS = 15 * 60_000;
 
+/**
+ * A CLI launched from the primary Runtime's Process Runtime cannot own its
+ * cutover: stopping Stable A cancels that very CLI before the release
+ * transaction can settle. The persistent Recovery daemon/MCP is independent.
+ * Compare the serving Runtime's existing process owner with the actual OS
+ * parent chain, not a caller-supplied scope or model-provided permission flag.
+ */
+function assertIndependentReleaseCliOwner(controllerHome: string): void {
+  const runtime = observeRuntimeStatus(controllerHome);
+  const owner = runtime.running ? readRuntimeOwner(controllerHome) : undefined;
+  if (!owner) return;
+  if (process.platform === 'win32') throw new Error('RECOVERY_CUTOVER_PROCESS_ANCESTRY_UNVERIFIED');
+  let pid = process.ppid;
+  const visited = new Set<number>();
+  for (let depth = 0; depth < 32 && pid > 1; depth += 1) {
+    if (pid === owner.pid) {
+      throw new Error('RECOVERY_CUTOVER_REQUIRES_INDEPENDENT_OWNER: invoke the Recovery daemon/MCP, not a command owned by the primary Runtime');
+    }
+    if (visited.has(pid)) throw new Error('RECOVERY_CUTOVER_PROCESS_ANCESTRY_UNVERIFIED');
+    visited.add(pid);
+    const inspected = spawnSync('ps', ['-o', 'ppid=', '-p', String(pid)], {
+      encoding: 'utf8', timeout: 2_000, maxBuffer: 4 * 1024,
+    });
+    if (inspected.status !== 0) throw new Error('RECOVERY_CUTOVER_PROCESS_ANCESTRY_UNVERIFIED');
+    const parent = Number.parseInt(inspected.stdout.trim(), 10);
+    if (!Number.isInteger(parent) || parent < 1) throw new Error('RECOVERY_CUTOVER_PROCESS_ANCESTRY_UNVERIFIED');
+    pid = parent;
+  }
+  if (pid > 1) throw new Error('RECOVERY_CUTOVER_PROCESS_ANCESTRY_UNVERIFIED');
+}
+
 function option(name: string): string | undefined {
   const index = process.argv.indexOf(name);
   return index >= 0 ? process.argv[index + 1] : undefined;
@@ -194,6 +227,7 @@ async function cli(): Promise<void> {
         config,
         RECOVERY_RUNTIME_RELEASE_PROVIDER,
         `recovery-auto-release:${process.pid}:${Date.now()}`,
+        decision,
       );
       output({ schemaVersion: 1, ok: result.ok, attempted: result.attempted, decision, result });
     } catch (error) {
@@ -219,11 +253,12 @@ async function cli(): Promise<void> {
     }
     case 'list-releases': output(await listReleases(config)); return;
     case 'attest-known-good': output(await attestKnownGood(config)); return;
-    case 'rollback-previous': output(await rollbackPrevious(config)); return;
-    case 'restart-primary-runtime': output(await restartPrimaryRuntime(config, { forceHealthyRestart: true })); return;
-    case 'restart-primary-connector': output(await restartPrimaryConnector(config)); return;
-    case 'recover-primary-runtime': output(await recoverPrimaryRuntime(config)); return;
+    case 'rollback-previous': assertIndependentReleaseCliOwner(config.controllerHome); output(await rollbackPrevious(config)); return;
+    case 'restart-primary-runtime': assertIndependentReleaseCliOwner(config.controllerHome); output(await restartPrimaryRuntime(config, { forceHealthyRestart: true })); return;
+    case 'restart-primary-connector': output(await restartPrimaryConnector(config, { forceHealthyRestart: true, requestId: `recovery-cli:${process.pid}:${Date.now()}` })); return;
+    case 'recover-primary-runtime': assertIndependentReleaseCliOwner(config.controllerHome); output(await recoverPrimaryRuntime(config)); return;
     case 'activate-runtime-release': {
+      assertIndependentReleaseCliOwner(config.controllerHome);
       const releasePath = option('--release-manifest') ?? option('--release-path');
       const expectedActiveReleaseId = option('--expected-active-release');
       const expectedAuthorityRevisionRaw = option('--expected-authority-revision');
@@ -238,14 +273,18 @@ async function cli(): Promise<void> {
       }));
       return;
     }
-    case 'stage-and-activate-runtime-release': output(await stageAndActivateConfiguredRuntimeRelease(config, {}, `recovery-cli:${process.pid}:${Date.now()}`)); return;
+    case 'stage-and-activate-runtime-release': assertIndependentReleaseCliOwner(config.controllerHome); output(await stageAndActivateConfiguredRuntimeRelease(config, {}, `recovery-cli:${process.pid}:${Date.now()}`)); return;
     case 'release-session-status': {
       const sessionId = option('--session-id');
       if (!sessionId) throw new Error('RECOVERY_RELEASE_SESSION_ID_REQUIRED');
       output(readReleaseSession(config.controllerHome, sessionId) ?? null);
       return;
     }
-    case 'release-session-advance': output(await advanceConfiguredRuntimeRelease(config, RECOVERY_RUNTIME_RELEASE_PROVIDER, `recovery-cli:${process.pid}:${Date.now()}`)); return;
+    case 'release-session-advance': {
+      assertIndependentReleaseCliOwner(config.controllerHome);
+      output(await advanceConfiguredRuntimeRelease(config, RECOVERY_RUNTIME_RELEASE_PROVIDER, `recovery-cli:${process.pid}:${Date.now()}`));
+      return;
+    }
     case 'release-session-prepare': output(await prepareConfiguredRuntimeReleaseSession(config, {}, `recovery-cli:${process.pid}:${Date.now()}`)); return;
     case 'release-session-static-verify': {
       const sessionId = option('--session-id');
@@ -260,6 +299,7 @@ async function cli(): Promise<void> {
       return;
     }
     case 'release-session-cutover': {
+      assertIndependentReleaseCliOwner(config.controllerHome);
       const sessionId = option('--session-id');
       if (!sessionId) throw new Error('RECOVERY_RELEASE_SESSION_ID_REQUIRED');
       output(await cutoverConfiguredRuntimeReleaseSession(config, sessionId, `recovery-cli:${process.pid}:${Date.now()}`));
@@ -272,6 +312,7 @@ async function cli(): Promise<void> {
       return;
     }
     case 'release-session-rollback': {
+      assertIndependentReleaseCliOwner(config.controllerHome);
       const sessionId = option('--session-id');
       if (!sessionId) throw new Error('RECOVERY_RELEASE_SESSION_ID_REQUIRED');
       output(await rollbackConfiguredRuntimeReleaseSession(config, sessionId, {}, `recovery-cli:${process.pid}:${Date.now()}`));
@@ -439,7 +480,7 @@ export const RECOVERY_TOOLS = [
   { name: 'attest_known_good', description: 'Record the active release as known-good only after full independent verification succeeds.', inputSchema: mutationInputSchema() },
   { name: 'rollback_previous', description: 'While Canonical Runtime is stopped, atomically restore its attested previous whole-Runtime release and SQLite backup.', inputSchema: mutationInputSchema() },
   { name: 'restart_primary_runtime', description: 'Explicitly restart the installed canonical Forge Runtime service, including when currently healthy, then require whole-Runtime verification after exact Recovery machine identity matches.', inputSchema: mutationInputSchema() },
-  { name: 'restart_primary_connector', description: 'Restart the explicitly configured primary OAuth/Connector service only after exact Recovery machine identity and local Canonical Runtime verification succeed.', inputSchema: mutationInputSchema() },
+  { name: 'restart_primary_connector', description: 'Explicitly restart the configured primary OAuth/Connector service, including when endpoint probes pass, only after exact Recovery machine identity and local Canonical Runtime verification succeed; verify the listener and public endpoint again afterward.', inputSchema: mutationInputSchema() },
   { name: 'recover_primary_runtime', description: 'Stop the canonical Runtime, restore the attested previous whole-Runtime release and SQLite backup, restart it, and require verification.', inputSchema: mutationInputSchema() },
   { name: 'activate_runtime_release', description: 'Activate an already staged immutable Runtime release only if machine identity and caller-observed active release/authority revision are still current. Reverse activation of current.previous is rejected; use rollback_previous/recover_primary_runtime instead.', inputSchema: mutationInputSchema({ release_path: { type: 'string', minLength: 8, maxLength: 1024, description: 'Absolute path to the staged immutable Runtime release directory.' }, expected_active_release_id: { type: 'string', minLength: 1, maxLength: 256 }, expected_authority_revision: { type: 'integer', minimum: 1 } }, ['release_path', 'expected_active_release_id', 'expected_authority_revision']) },
   { name: 'pin_runtime_release', description: 'Pin one extant legacy/home-bound immutable Runtime release so retention preserves it for explicit Runtime-only recovery activation. Portable source candidates are rejected and must use ReleaseSession.', inputSchema: mutationInputSchema({ release_path: { type: 'string', minLength: 8, maxLength: 1024, description: 'Absolute path to the immutable Runtime release directory or manifest.' } }, ['release_path']) },
@@ -781,7 +822,7 @@ export async function dispatchRecoveryTool(config: RecoveryConfig, name: string,
     case 'restart_primary_connector': {
       if (!requestId(args.request_id)) throw new Error('RECOVERY_REQUEST_ID_REQUIRED');
       assertRecoveryGatewayMutationIdentity(config, args);
-      return mutationResponse(config, await restartPrimaryConnector(config, { requestId: `recovery-gateway:${args.request_id}` }));
+      return mutationResponse(config, await restartPrimaryConnector(config, { requestId: `recovery-gateway:${args.request_id}`, forceHealthyRestart: true }));
     }
     case 'recover_primary_runtime': {
       if (!requestId(args.request_id)) throw new Error('RECOVERY_REQUEST_ID_REQUIRED');
@@ -995,6 +1036,14 @@ async function runAutomaticReleaseReconciliationStep(
         : 'automatic release reconciliation failed';
     throw new Error(`RECOVERY_AUTOMATIC_RELEASE_STEP_FAILED: ${detail.slice(0, 500)}`);
   }
+  // An idle-window timeout is a legitimate no-cutover outcome, but not
+  // forward progress. Feed it into the existing phase/revision backoff so
+  // repeated drains cannot monopolize the Connector every 15 seconds.
+  if (parsed.decision?.action === 'cutover'
+    && typeof parsed.result?.detail === 'string'
+    && parsed.result.detail.startsWith('RELEASE_SESSION_CUTOVER_DEFERRED_FOR_MCP_ACTIVITY')) {
+    throw new Error(`RECOVERY_AUTOMATIC_RELEASE_CUTOVER_DEFERRED: ${parsed.result.detail.slice(0, 500)}`);
+  }
   if (parsed.decision?.action) {
     process.stdout.write(JSON.stringify({
       at: new Date().toISOString(),
@@ -1017,27 +1066,10 @@ async function startAutomaticReleaseReconciliation(config: RecoveryConfig): Prom
         () => configuredRuntimeReleaseSourceState(config),
       );
       observed.fingerprint = decision.required ? releaseReconciliationFingerprint(decision) : undefined;
-      if (decision.required && decision.action === 'cutover') {
-        const gate = await probeReleaseCutoverReadiness(config);
-        if (!gate.ready) {
-          process.stdout.write(JSON.stringify({
-            at: new Date().toISOString(),
-            action: 'automatic_release_cutover_deferred',
-            reason: gate.detail,
-            sessionId: decision.session?.sessionId,
-            phase: decision.session?.phase,
-            activeSessions: gate.activeSessions,
-            activePosts: gate.activePosts,
-            activeStreams: gate.activeStreams,
-            initializing: gate.initializing,
-            latestActivityAgeMs: gate.latestActivityAgeMs,
-          }) + '\n');
-        } else {
-          await runAutomaticReleaseReconciliationStep(config, observed, decision);
-        }
-      } else {
-        await runAutomaticReleaseReconciliationStep(config, observed, decision);
-      }
+      // ReleaseSession cutover owns the one Connector drain/quietness fence.
+      // A read-only busy pre-gate here would prevent that drain from ever
+      // starting under sustained MCP traffic, starving the verified candidate.
+      if (decision.required) await runAutomaticReleaseReconciliationStep(config, observed, decision);
     } catch (error) {
       failure = error instanceof Error ? error.message : String(error);
       process.stderr.write(`automatic release reconciliation failed: ${failure}\n`);

package/src/runtime/standalone-recovery/operation-lock.ts

@@ -24,6 +24,16 @@ export type RecoveryOperationLockAttempt =
   | { acquired: true; handle: RecoveryOperationLockHandle }
   | { acquired: false; owner: RecoveryOperationLockRecord };
 
+/** Preserve the competing owner identities when lock acquisition detects a race. */
+export class RecoveryOperationLockRaceError extends Error {
+  constructor(
+    readonly existing: RecoveryOperationLockRecord,
+    readonly latest: RecoveryOperationLockRecord | undefined,
+  ) {
+    super('RECOVERY_OPERATION_LOCK_RACE');
+  }
+}
+
 function processStartTime(pid: number): string | undefined {
   const result = spawnSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], {
     encoding: 'utf8',
@@ -123,7 +133,7 @@ export function acquireRecoveryOperationLock(input: {
         if (!latest || latest.instanceId !== existing.instanceId) {
           if (attempt === 1) {
             if (latest && recoveryOperationLockOwnerAlive(latest)) return { acquired: false, owner: latest };
-            throw new Error('RECOVERY_OPERATION_LOCK_RACE');
+            throw new RecoveryOperationLockRaceError(existing, latest);
           }
           continue;
         }

package/src/runtime/workflow/schedules/chatgpt-automation-migration.ts

@@ -1,4 +1,5 @@
 import type { RepositorySchedule } from '../../../../packages/kernel/scheduler/api/index';
+
 import {
   DEFAULT_CHATGPT_AUTOMATION_MODEL,
   DEFAULT_CHATGPT_AUTOMATION_REASONING,

package/src/runtime/workflow/schedules/engine.ts

@@ -51,6 +51,7 @@ import type {
 const execFileAsync = promisify(execFile);
 const LIVE_MAINTENANCE_OPERATION = 'runtime_maintenance_apply';
 const EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
+const CONTROLLER_PROGRESSION_OPERATION = 'controller_progression';
 const BROWSER_PROBE_OPERATION = 'browser_probe';
 const GITHUB_ISSUE_WATCH_OPERATION = 'github_issue_watch';
 const DEFAULT_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS = 60_000;
@@ -60,6 +61,7 @@ function isDeterministicSchedule(schedule: RepositorySchedule): boolean {
   // Kernel executes only typed, bounded dispatch operations.
   return schedule.action.operation === LIVE_MAINTENANCE_OPERATION
     || schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION
+    || schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION
     || schedule.action.operation === BROWSER_PROBE_OPERATION
     || schedule.action.operation === GITHUB_ISSUE_WATCH_OPERATION;
 }
@@ -87,6 +89,7 @@ async function workspaceDirty(controllerHome: string, repoId: string): Promise<b
 
 function workBoundScheduleWorkId(schedule: RepositorySchedule): string | undefined {
   if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+    && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION
     && schedule.action.operation !== BROWSER_PROBE_OPERATION) return undefined;
   const value = schedule.action.arguments?.work_id;
   return typeof value === 'string' && value.trim() ? value.trim() : undefined;
@@ -246,7 +249,7 @@ export function classifyChatgptWakeFailure(reason: string): ChatgptWakeFailureCl
   return 'ordinary_failure';
 }
 
-async function executeExternalControllerWake(
+async function executeControllerProgression(
   controllerHome: string,
   schedule: RepositorySchedule,
   occurrence: ScheduleOccurrence,
@@ -311,12 +314,20 @@ async function executeExternalControllerWake(
     );
   }
 
+  if (schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION
+    && (typeof args.controller_binding_id !== 'string' || !args.controller_binding_id.trim())) {
+    throw new Error(`SCHEDULE_CONTROLLER_PROGRESSION_BINDING_REQUIRED:${workId}`);
+  }
+
   const hadLegacySessionIdentity = typeof args.controller_session_id === 'string' && args.controller_session_id.trim().length > 0;
 
   // Explicit compatibility migration for schedules written before Kernel V2 B4.
   // Provider metadata is copied once into the adapter-owned binding and the
   // Schedule is rewritten to exact Work/ControllerSession/ControllerBinding ids.
   if (!bindingRecord) {
+    if (schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION) {
+      throw new Error(`SCHEDULE_CONTROLLER_PROGRESSION_BINDING_NOT_FOUND:${workId}`);
+    }
     const binding = ensureScheduledControllerBinding(
       { controllerHome, repoId: schedule.repoId },
       { workId, session: retainedSession, scheduleName: schedule.name, args },
@@ -388,6 +399,8 @@ async function executeExternalControllerWake(
         continuationHint,
         allowSemanticWaitRecovery: controllerType === 'chatgpt',
         scheduleName: schedule.name,
+        scheduleId: schedule.scheduleId,
+        scheduleOccurrenceId: occurrence.occurrenceId,
         bindingArgs: args,
       },
     );
@@ -442,13 +455,17 @@ async function executeExternalControllerWake(
 
     const supervisorEnrollment = progression.status === 'chatgpt_enrolled'
       ? progression.supervisorEnrollment
-      : { status: 'not_eligible' as const };
+      : progression.status === 'scheduled_supervisor_woken'
+        ? { status: 'enrolled' as const, taskId: progression.taskId, effectId: progression.effectId }
+        : { status: 'not_eligible' as const };
+    const supervisorOwnsTurn = progression.status === 'chatgpt_enrolled' || progression.status === 'scheduled_supervisor_woken';
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrence.occurrenceId,
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
       ...(supervisorEnrollment.status === 'enrolled'
+        && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION
         ? { enabled: false, pausedReason: 'workflow_supervisor_owns_outer_turn' }
         : current.enabled ? { pausedReason: undefined } : {}),
     }));
@@ -457,18 +474,22 @@ async function executeExternalControllerWake(
       status: 'dispatched',
       reason: progression.status === 'chatgpt_enrolled'
         ? `Workflow Supervisor reserved the exact ChatGPT effect ${progression.supervisorEnrollment.effectId ?? progression.relayScopeId}; Scheduler issued no provider send.`
-        : progression.reused
-          ? `Controller continuation occurrence ${occurrence.occurrenceId} was already durably dispatched; external replay suppressed and semantic round closure is still pending.`
-          : `ControllerHost accepted durable binding ${bindingRecord.binding.bindingId} for Work ${workId}; dispatch ${progression.providerDispatchReceiptId ?? progression.relayScopeId}; semantic round closure is still pending.`,
+        : progression.status === 'scheduled_supervisor_woken'
+          ? `Scheduler occurrence ${occurrence.occurrenceId} woke the same Workflow Supervisor task and reserved effect ${progression.effectId}; Scheduler issued no provider send.`
+          : progression.reused
+            ? `Controller continuation occurrence ${occurrence.occurrenceId} was already durably dispatched; external replay suppressed and semantic round closure is still pending.`
+            : `ControllerHost accepted durable binding ${bindingRecord.binding.bindingId} for Work ${workId}; dispatch ${progression.providerDispatchReceiptId ?? progression.relayScopeId}; semantic round closure is still pending.`,
     });
     appendWorkEvidence(workStore, workId, {
       evidenceId: dispatchedOccurrence.occurrenceId,
-      title: progression.status === 'chatgpt_enrolled'
+      title: supervisorOwnsTurn
         ? 'scheduled Workflow Supervisor effect reserved'
         : 'scheduled Controller continuation dispatched',
-      summary: progression.status === 'chatgpt_enrolled'
-        ? `Schedule ${schedule.scheduleId} materialized the exact ControllerRound occurrence and Supervisor effect; Supervisor owns ChatGPT delivery.`
-        : `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} resumed the exact Work-bound ControllerSession through ControllerHost.`,
+      summary: progression.status === 'scheduled_supervisor_woken'
+        ? `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} woke the same Work-bound Supervisor task; Supervisor owns ChatGPT delivery.`
+        : progression.status === 'chatgpt_enrolled'
+          ? `Schedule ${schedule.scheduleId} materialized the exact ControllerRound occurrence and Supervisor effect; Supervisor owns ChatGPT delivery.`
+          : `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} resumed the exact Work-bound ControllerSession through ControllerHost.`,
       detailLevel: 'summary',
     });
     return dispatchedOccurrence;
@@ -724,8 +745,9 @@ export async function evaluateSchedule(
   }
 
   const args = schedule.action.arguments ?? {};
-  if (schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION) {
-    return executeExternalControllerWake(controllerHome, schedule, occurrence, timestamp, args);
+  if (schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION
+    || schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION) {
+    return executeControllerProgression(controllerHome, schedule, occurrence, timestamp, args);
   }
 
   if (schedule.action.operation === GITHUB_ISSUE_WATCH_OPERATION) {
@@ -772,7 +794,7 @@ export async function evaluateSchedule(
           ? `${args.continuation_prompt}\n\nGitHub issue watcher detected: ${issueSummary}`
           : `GitHub issue watcher detected actionable issue changes: ${issueSummary}. Read current Work/Plan/evidence and process these issues through the bounded repair workflow.`,
       };
-      const wake = await executeExternalControllerWake(controllerHome, schedule, occurrence, timestamp, wakeArgs, evidence, { transientWakeFailure: true });
+      const wake = await executeControllerProgression(controllerHome, schedule, occurrence, timestamp, wakeArgs, evidence, { transientWakeFailure: true });
       if (wake.status !== 'failed') persistObservation();
       return wake;
     } catch (error) {
@@ -836,7 +858,7 @@ export async function evaluateSchedule(
               : `Scheduled browser watcher ${schedule.scheduleId} detected that authentication is required (${probe.authReason ?? 'login marker'}). Inspect the external dependency and request user login only if it cannot be restored safely.`;
           if (workId) {
             const wakeArgs = { ...args, continuation_prompt: authPrompt };
-            return executeExternalControllerWake(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, authReason: probe.authReason });
+            return executeControllerProgression(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, authReason: probe.authReason });
           }
           const controllerType = typeof args.controller_type === 'string' ? args.controller_type.trim() : 'chatgpt';
           if (controllerType !== 'chatgpt') {
@@ -917,7 +939,7 @@ export async function evaluateSchedule(
           ? args.continuation_prompt
           : `Scheduled browser watcher ${schedule.scheduleId} detected a changed external observation. Read the current external state, correlate it with Work ${workId}, and continue only the bounded Work objective.`,
       };
-      return executeExternalControllerWake(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, observationStatus });
+      return executeControllerProgression(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, observationStatus });
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error);
       const failed = applyScheduleFailure(controllerHome, schedule.scheduleId, schedule.repoId, occurrence.occurrenceId, {

package/src/runtime/workflow/schedules/pending-activation.ts

@@ -5,6 +5,7 @@ import { resolveControllerHome } from '../../../cli/repositories/controller-home
 import { getSchedule, saveSchedule } from '../../../../packages/kernel/scheduler/api/index';
 
 const EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
+const CONTROLLER_PROGRESSION_OPERATION = 'controller_progression';
 
 export interface PendingContinuationActivationMarker {
   schemaVersion: 1;
@@ -53,8 +54,9 @@ export function queuePendingContinuationActivation(
   scheduleId: string,
 ): PendingContinuationActivationMarker {
   const schedule = getSchedule(controllerHome, repoId, scheduleId);
-  if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION) {
-    throw new Error('PENDING_CONTINUATION_ACTIVATION_REQUIRES_EXTERNAL_CONTROLLER_WAKE');
+  if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+    && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION) {
+    throw new Error('PENDING_CONTINUATION_ACTIVATION_REQUIRES_WORK_CONTINUATION');
   }
   const workId = schedule.action.arguments?.work_id;
   if (typeof workId !== 'string' || !workId.trim()) {
@@ -108,7 +110,8 @@ export function applyPendingContinuationActivations(controllerHome: string): Pen
       const marker = readMarker(path);
       const schedule = getSchedule(controllerHome, marker.repoId, marker.scheduleId);
       const workId = schedule.action.arguments?.work_id;
-      if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION || workId !== marker.workId) {
+      if ((schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+        && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION) || workId !== marker.workId) {
         results.push({ ...marker, status: 'failed', reason: 'Schedule no longer targets the queued Work continuation.' });
         continue;
       }
@@ -122,7 +125,11 @@ export function applyPendingContinuationActivations(controllerHome: string): Pen
         results.push({ ...marker, status: 'already_active' });
         continue;
       }
-      saveSchedule(controllerHome, { ...schedule, policy: { ...schedule.policy, shadowMode: false } });
+      saveSchedule(controllerHome, {
+        ...schedule,
+        action: { ...schedule.action, operation: CONTROLLER_PROGRESSION_OPERATION },
+        policy: { ...schedule.policy, shadowMode: false },
+      });
       rmSync(path, { force: true });
       results.push({ ...marker, status: 'activated' });
     } catch (error) {

package/src/runtime/workflow/schedules/work-continuation.ts

@@ -28,6 +28,13 @@ import type {
 export type ContinuationControllerType = Exclude<ControllerType, 'human'>;
 export type WorkScheduleMode = 'continuation' | 'browser_watch' | 'browser_keepalive';
 
+const CONTROLLER_PROGRESSION_OPERATION = 'controller_progression';
+const LEGACY_EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
+
+function isWorkContinuationOperation(operation: string): boolean {
+  return operation === CONTROLLER_PROGRESSION_OPERATION || operation === LEGACY_EXTERNAL_CONTROLLER_WAKE_OPERATION;
+}
+
 export interface WorkContinuationScheduleInput {
   workId?: string;
   scheduleMode?: WorkScheduleMode;
@@ -93,7 +100,7 @@ function activeWork(controllerHome: string, repoId: string, workId: string): Wor
 }
 
 function continuationSchedule(schedule: RepositorySchedule): RepositorySchedule {
-  if (!['external_controller_wake', 'browser_probe'].includes(schedule.action.operation)) {
+  if (!isWorkContinuationOperation(schedule.action.operation) && schedule.action.operation !== 'browser_probe') {
     throw new Error(`SCHEDULE_NOT_WORK_CONTINUATION: ${schedule.scheduleId}`);
   }
   return schedule;
@@ -194,7 +201,7 @@ export function createWorkContinuationSchedule(
   }
   if (!requestedWorkId && scheduleMode === 'browser_keepalive' && controllerType !== 'chatgpt') throw new Error('STANDALONE_BROWSER_KEEPALIVE_CHATGPT_REQUIRED');
   const trigger = normalizedTrigger(input);
-  const operation = scheduleMode === 'continuation' ? 'external_controller_wake' : 'browser_probe';
+  const operation = scheduleMode === 'continuation' ? CONTROLLER_PROGRESSION_OPERATION : 'browser_probe';
   const name = input.scheduleName?.trim()
     || (scheduleMode === 'browser_watch' ? `Watch external state for Work ${work!.workId}`
       : scheduleMode === 'browser_keepalive'
@@ -240,7 +247,7 @@ export function createWorkContinuationSchedule(
   // Work may legitimately observe several independent external targets.
   if (scheduleMode === 'continuation') {
     const existing = listSchedules(controllerHome, repoId)
-      .filter((candidate) => candidate.action.operation === 'external_controller_wake')
+      .filter((candidate) => isWorkContinuationOperation(candidate.action.operation))
       .filter((candidate) => candidate.action.arguments?.work_id === work!.workId);
     const authoritative = [...existing].reverse().find((candidate) => candidate.enabled) ?? existing.at(-1);
     if (authoritative) {
@@ -302,7 +309,7 @@ export function listWorkContinuationSchedules(
   options: WorkContinuationScheduleListOptions = {},
 ): { schedules: RepositorySchedule[]; occurrences?: ScheduleOccurrence[] } {
   const schedules = listSchedules(controllerHome, repoId)
-    .filter((entry) => ['external_controller_wake', 'browser_probe'].includes(entry.action.operation))
+    .filter((entry) => isWorkContinuationOperation(entry.action.operation) || entry.action.operation === 'browser_probe')
     .filter((entry) => !options.workId || entry.action.arguments?.work_id === options.workId);
   if (!options.includeOccurrences) return { schedules };
   const scheduleIds = new Set(schedules.map((entry) => entry.scheduleId));
@@ -342,6 +349,44 @@ export function resumeWorkContinuationSchedule(controllerHome: string, repoId: s
   const schedule = continuationSchedule(getSchedule(controllerHome, repoId, scheduleId));
   const workId = typeof schedule.action.arguments?.work_id === 'string' ? schedule.action.arguments.work_id : '';
   activeWork(controllerHome, repoId, workId);
+  if (schedule.action.operation === LEGACY_EXTERNAL_CONTROLLER_WAKE_OPERATION) {
+    const trigger = schedule.trigger;
+    const migrated = createWorkContinuationSchedule(controllerHome, repoId, {
+      workId,
+      scheduleName: schedule.name,
+      controllerType: typeof schedule.action.arguments?.controller_type === 'string'
+        ? schedule.action.arguments.controller_type as ContinuationControllerType
+        : undefined,
+      continuationPrompt: typeof schedule.action.arguments?.continuation_hint === 'string'
+        ? schedule.action.arguments.continuation_hint
+        : typeof schedule.action.arguments?.continuation_prompt === 'string'
+          ? schedule.action.arguments.continuation_prompt
+          : undefined,
+      triggerType: trigger.type,
+      everyMinutes: trigger.everyMinutes,
+      cronExpression: trigger.cronExpression,
+      timezone: trigger.timezone,
+      catchUpMinutes: trigger.catchUpMinutes,
+      calendarAt: trigger.calendarAt,
+      condition: trigger.condition,
+      eventName: trigger.eventName,
+      dependencyJobIds: trigger.dependencyJobIds,
+      maxFailures: schedule.policy.maxFailures,
+      cooldownMinutes: schedule.policy.cooldownMinutes,
+      dailyBudgetMinutes: schedule.policy.dailyBudgetMinutes,
+      shadowMode: schedule.policy.shadowMode,
+      backoffBaseMinutes: schedule.policy.backoffBaseMinutes,
+      backoffMaxMinutes: schedule.policy.backoffMaxMinutes,
+      stopConditions: schedule.stopConditions,
+    }).schedule;
+    return saveSchedule(controllerHome, {
+      ...migrated,
+      enabled: true,
+      pausedReason: undefined,
+      consecutiveFailures: 0,
+      nextEligibleAt: undefined,
+    });
+  }
   return saveSchedule(controllerHome, {
     ...schedule,
     enabled: true,
@@ -378,7 +423,7 @@ export async function triggerWorkContinuationRepositoryEvent(
 ): Promise<Array<{ scheduleId: string; occurrenceId?: string; status?: string }>> {
   const schedules = listWorkContinuationSchedules(controllerHome, repoId, { workId: input.workId }).schedules
     .filter((schedule) => schedule.enabled)
-    .filter((schedule) => schedule.action.operation === 'external_controller_wake')
+    .filter((schedule) => isWorkContinuationOperation(schedule.action.operation))
     .filter((schedule) => schedule.trigger.type === 'repository-event' && schedule.trigger.eventName === eventName);
   const triggered: Array<{ scheduleId: string; occurrenceId?: string; status?: string }> = [];
   for (const schedule of schedules) {
@@ -404,7 +449,7 @@ export function eventDrivenContinuationSchedule(
 ): RepositorySchedule {
   const workSchedules = listWorkContinuationSchedules(controllerHome, repoId, { workId: input.workId }).schedules;
   const existing = workSchedules
-    .filter((schedule) => schedule.action.operation === 'external_controller_wake')
+    .filter((schedule) => isWorkContinuationOperation(schedule.action.operation))
     .reverse()
     .find((schedule) => schedule.enabled)
     ?? workSchedules.at(-1);

package/supervisor/client.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { createConnection } from 'node:net';
 import { workflowSupervisorSocketPath } from './paths';
-import type { WorkflowSupervisorAutomationStatus, WorkflowSupervisorConsumerStatus, WorkflowSupervisorContinuationProof, WorkflowSupervisorDiscoveredConversation, WorkflowSupervisorEffect, WorkflowSupervisorTask, WorkflowSupervisorTaskInput, WorkflowSupervisorTaskStall, WorkflowSupervisorTerminalState } from './types';
+import type { WorkflowSupervisorConsumerStatus, WorkflowSupervisorContinuationProof, WorkflowSupervisorDiscoveredConversation, WorkflowSupervisorEffect, WorkflowSupervisorTask, WorkflowSupervisorTaskInput, WorkflowSupervisorTaskStall, WorkflowSupervisorTerminalState } from './types';
 
 interface RpcResponse<T> { id: string; ok: boolean; result?: T; error?: { code?: string; message?: string } }
 
@@ -63,12 +63,16 @@ export async function getWorkflowSupervisorTask(forgeHome: string, taskId: strin
 
 export async function reviseWorkflowSupervisorTaskObjective(forgeHome: string, input: {
   taskId: string; objective: string; expectedObjectiveSha256: string; requestId: string; authorizedBy?: string;
-}): Promise<{ task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean; objectiveSha256: string; refreshedEffect?: WorkflowSupervisorEffect }> {
+  workId?: string; requirementId?: string; expectedCompletionContractSha256?: string;
+}): Promise<{ task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean; objectiveSha256: string; completionContractSha256: string; semanticBindingChanged: boolean; refreshedEffect?: WorkflowSupervisorEffect }> {
   return await rpc(forgeHome, 'task_revise_objective', {
     task_id: input.taskId,
     objective: input.objective,
     expected_objective_sha256: input.expectedObjectiveSha256,
     request_id: input.requestId,
+    ...(input.workId?.trim() ? { work_id: input.workId.trim() } : {}),
+    ...(input.requirementId?.trim() ? { requirement_id: input.requirementId.trim() } : {}),
+    ...(input.expectedCompletionContractSha256?.trim() ? { expected_completion_contract_sha256: input.expectedCompletionContractSha256.trim() } : {}),
     ...(input.authorizedBy?.trim() ? { authorized_by: input.authorizedBy.trim() } : {}),
   }, SUPERVISOR_RPC_MUTATION_TIMEOUT_MS);
 }
@@ -89,6 +93,13 @@ export async function listWorkflowSupervisorTasks(forgeHome: string, activeOnly
   const result = await rpc<{ tasks: WorkflowSupervisorTask[] }>(forgeHome, 'task_list', { active_only: activeOnly });
   return result.tasks;
 }
+/** Explicit read-only terminal history. Native ChatGPT archive is not inferred. */
+export async function listWorkflowSupervisorTerminalTasks(forgeHome: string): Promise<Array<{ task: WorkflowSupervisorTask; terminal: WorkflowSupervisorTerminalState }>> {
+  const result = await rpc<{ terminalTasks: Array<{ task: WorkflowSupervisorTask; terminal: WorkflowSupervisorTerminalState }> }>(
+    forgeHome, 'task_list', { terminal_only: true },
+  );
+  return result.terminalTasks;
+}
 /** Operator-only recovery; never exposed to the browser Native Messaging host. */
 export async function recoverWorkflowSupervisorTask(forgeHome: string, input: { taskId: string; sourceEffectId?: string; requestId: string; reason: string; supersedeUnknown?: boolean; authorizedBy?: string }): Promise<{ recoveryEffect: WorkflowSupervisorEffect; action: 'retry_authorized' | 'recovery_reserved' | 'unknown_superseded' }> {
   return await rpc(forgeHome, 'task_recover', {
@@ -106,6 +117,24 @@ export async function getWorkflowSupervisorTaskStall(forgeHome: string, taskId:
   return await rpc<WorkflowSupervisorTaskStall>(forgeHome, 'task_stall', { task_id: taskId });
 }
 
+/** One-way binding of a Work-owned Supervisor task to its canonical Scheduler lane. */
+export async function bindWorkflowSupervisorScheduledWake(forgeHome: string, input: {
+  taskId: string; repoId: string; workId: string; scheduleId: string;
+}): Promise<{ task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean }> {
+  return await rpc(forgeHome, 'task_bind_scheduled_wake', {
+    task_id: input.taskId, repo_id: input.repoId, work_id: input.workId, schedule_id: input.scheduleId,
+  }, SUPERVISOR_RPC_MUTATION_TIMEOUT_MS);
+}
+
+/** Scheduler occurrence is the idempotency identity; an unknown send outcome is never replayed. */
+export async function wakeWorkflowSupervisorScheduledTask(forgeHome: string, input: {
+  taskId: string; scheduleId: string; occurrenceId: string;
+}): Promise<{ effect: WorkflowSupervisorEffect; deduplicated: boolean }> {
+  return await rpc(forgeHome, 'task_wake_scheduled', {
+    task_id: input.taskId, schedule_id: input.scheduleId, occurrence_id: input.occurrenceId,
+  }, SUPERVISOR_RPC_MUTATION_TIMEOUT_MS);
+}
+
 /**
  * Operator-only conversation migration for a standalone Supervisor task whose
  * exact conversation became permanently unusable. It is explicit and bounded by
@@ -163,18 +192,6 @@ export async function reserveWorkflowSupervisorEnrollment(forgeHome: string, tas
   }, SUPERVISOR_RPC_MUTATION_TIMEOUT_MS);
 }
 
-export async function recordWorkflowSupervisorAutomationReceipt(
-  forgeHome: string,
-  input: { taskId: string; conversationId: string; status: WorkflowSupervisorAutomationStatus; receiptId: string },
-): Promise<unknown> {
-  return await rpc(forgeHome, 'automation_receipt', {
-    task_id: input.taskId,
-    conversation_id: input.conversationId,
-    automation_status: input.status,
-    receipt_id: input.receiptId,
-  }, SUPERVISOR_RPC_MUTATION_TIMEOUT_MS);
-}
-
 export interface WorkflowSupervisorEffectDispatchBudget {
   effectId: string;
   generations: number;