@mstar-harness/dsh 3.9.4 → 3.10.0

package/dist/index.js

@@ -1122,7 +1122,7 @@ var require_lib2 = __commonJS(function(exports, module) {
 });
 
 // src/index.ts
-import { existsSync as existsSync24, readFileSync as readFileSync19, readdirSync as readdirSync14 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync19, readdirSync as readdirSync15 } from "node:fs";
 import { join as join29 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import {
@@ -1138,28 +1138,28 @@ import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync as readFileSync2, statSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "node:path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { basename as basename5, dirname as dirname6, isAbsolute as isAbsolute6, join as join10, relative as relative2, resolve as resolve8 } from "node:path";
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "node:fs";
-import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync2, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname5, join as join7, resolve as resolve6, sep as sep2 } from "node:path";
+import { basename as basename5, dirname as dirname6, isAbsolute as isAbsolute6, join as join10, relative as relative2, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname5, join as join7, resolve as resolve7, sep as sep2 } from "node:path";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, resolve as resolve3 } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute3, join as join4, resolve as resolve4 } from "node:path";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join6 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync as readdirSync2, rmdirSync as rmdirSync2 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join6, resolve as resolve6 } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync9, realpathSync as realpathSync4 } from "node:fs";
-import { isAbsolute as isAbsolute7, join as join11, resolve as resolve9 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join11, resolve as resolve10 } from "node:path";
 import { existsSync as existsSync10 } from "node:fs";
 import { join as join12, dirname as dirname8 } from "node:path";
 import { execFileSync as execFileSync3, spawn } from "node:child_process";
-import { mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync9, realpathSync as realpathSync5, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename7, dirname as dirname9, isAbsolute as isAbsolute8, join as join13, relative as relative3, resolve as resolve10 } from "node:path";
-import { existsSync as existsSync13, readdirSync as readdirSync9, readFileSync as readFileSync12 } from "node:fs";
-import { basename as basename11, isAbsolute as isAbsolute10, join as join17, relative as relative6, resolve as resolve14, sep as sep5 } from "node:path";
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync9, realpathSync as realpathSync5, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename7, dirname as dirname9, isAbsolute as isAbsolute8, join as join13, relative as relative3, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync10, readFileSync as readFileSync12 } from "node:fs";
+import { basename as basename11, isAbsolute as isAbsolute10, join as join17, relative as relative6, resolve as resolve15, sep as sep5 } from "node:path";
 import { existsSync as existsSync14 } from "node:fs";
 import { join as join18 } from "node:path";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
@@ -1702,6 +1702,7 @@ var REQUIRED_FIELDS = [
 var REVIEW_SEAT_ROLES = ["qc-specialist", "qc-specialist-2", "qc-specialist-3", "code-reviewer", "qa-engineer"];
 var BUDGET_LABELS = ["Budget (review / QC seats)", "Budget"];
 var RETURN_SHAPE_LABELS = ["Return shape (review / QC seats)", "Return shape"];
+var TASK_BUDGET_LABELS = ["Task budget (implement / ops rounds)", "Task budget"];
 function violation2(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -1729,6 +1730,8 @@ function parseAssignmentFields(assignmentText) {
       fields.budget = value;
     else if (RETURN_SHAPE_LABELS.includes(label))
       fields.returnShape = value;
+    else if (TASK_BUDGET_LABELS.includes(label))
+      fields.taskBudget = value;
   }
   return fields;
 }
@@ -1843,6 +1846,12 @@ function validateAssignmentFields(assignmentText, opts = {}) {
       violations.push(violation2("high", field.code, `${subject} must declare a round ${field.label} — ${missing}`, field.fix));
     }
   }
+  if (!reviewSeat && !auditRound) {
+    const missing = describeAbsence(fields.taskBudget);
+    if (missing !== undefined) {
+      violations.push(violation2("high", "assignment.field.task-budget-missing", `implement/ops round "${role}" must declare a Task budget — ${missing}`, `add "**Task budget (implement / ops rounds)**: <one implementer round closing the task's declared Files list and verification gates> — capacity contract spec § A1/A2"`));
+    }
+  }
   if (writable) {
     const workingPresent = fields.workingBranch !== undefined && fields.workingBranch !== "";
     const policyPresent = fields.branchPolicy !== undefined && fields.branchPolicy !== "";
@@ -1963,6 +1972,8 @@ var WORKFLOW_SNAPSHOT_FILE = "snapshot.json";
 var WORKFLOW_LIFECYCLE_STATUSES = ["running", "paused", "completed", "failed", "stopped"];
 var WORKFLOW_TERMINAL_STATUSES = ["completed", "failed", "stopped"];
 var WORKFLOW_LIFECYCLE_TYPES = ["plan", "iteration"];
+var WORKFLOW_DELIVERY_KINDS = ["development", "verification/report-only"];
+var WORKFLOW_COMPOUND_OUTCOMES = ["created", "updated", "skipped"];
 function violation3(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -1978,6 +1989,61 @@ function validateWorktreePathValue(violations, value, field) {
     violations.push(violation3("high", "workflow.snapshot.invalid-integration-worktree-path", `${field} must be a non-empty absolute path — got ${JSON.stringify(value)}`, "record the absolute integration checkout path (integration_worktree_path)"));
   }
 }
+function deliveryEvidenceViolations(value, what) {
+  const violations = [];
+  const invalid2 = (message) => {
+    violations.push(violation3("medium", "workflow.snapshot.invalid-delivery-evidence", `${what}: ${message}`));
+  };
+  if (!isPlainObject2(value)) {
+    invalid2("must be an object");
+    return violations;
+  }
+  const members = ["compound", "pr", "merge", "completion"];
+  const unknownMembers = Object.keys(value).filter((key) => !members.includes(key));
+  if (unknownMembers.length > 0)
+    invalid2(`unknown member(s) ${unknownMembers.join(", ")} — expected ${members.join(" | ")}`);
+  const compound = value.compound;
+  if (compound !== undefined) {
+    if (!isPlainObject2(compound))
+      invalid2("compound must be an object");
+    else {
+      const unknown = Object.keys(compound).filter((key) => key !== "outcome" && key !== "reason");
+      if (unknown.length > 0)
+        invalid2(`compound has unknown key(s) ${unknown.join(", ")}`);
+      if (typeof compound.outcome !== "string" || !WORKFLOW_COMPOUND_OUTCOMES.includes(compound.outcome)) {
+        invalid2(`compound.outcome must be one of ${WORKFLOW_COMPOUND_OUTCOMES.join(" | ")} — got ${JSON.stringify(compound.outcome)}`);
+      } else if (compound.outcome === "skipped" && (typeof compound.reason !== "string" || compound.reason.trim() === "")) {
+        invalid2("compound reason is required when the disposition outcome is 'skipped' (contract §4c)");
+      } else if (compound.reason !== undefined && (typeof compound.reason !== "string" || compound.reason.trim() === "")) {
+        invalid2("compound.reason must be a non-empty string when given");
+      }
+    }
+  }
+  const stringMembers = {
+    pr: ["repo", "head", "target"],
+    merge: ["provider", "evidence"],
+    completion: ["policy", "evidence"]
+  };
+  for (const member of ["pr", "merge", "completion"]) {
+    const block = value[member];
+    if (block === undefined)
+      continue;
+    if (!isPlainObject2(block)) {
+      invalid2(`${member} must be an object`);
+      continue;
+    }
+    const fields = stringMembers[member];
+    const unknown = Object.keys(block).filter((key) => !fields.includes(key));
+    if (unknown.length > 0)
+      invalid2(`${member} has unknown key(s) ${unknown.join(", ")}`);
+    for (const field of fields) {
+      if (typeof block[field] !== "string" || block[field].trim() === "") {
+        invalid2(`${member}.${field} must be a non-empty string`);
+      }
+    }
+  }
+  return violations;
+}
 function validateWorkflowSnapshot(doc) {
   const violations = [];
   if (!isPlainObject2(doc)) {
@@ -2043,7 +2109,7 @@ function validateWorkflowSnapshot(doc) {
     if (!isPlainObject2(doc.branch)) {
       violations.push(violation3("medium", "workflow.snapshot.invalid-branch", "branch must be an object"));
     } else {
-      for (const key of ["base", "integration", "target"]) {
+      for (const key of ["base", "source", "integration", "target"]) {
         if (doc.branch[key] !== undefined && (typeof doc.branch[key] !== "string" || doc.branch[key].trim() === "")) {
           violations.push(violation3("medium", "workflow.snapshot.invalid-branch", `branch.${key} must be a non-empty string`));
         }
@@ -2069,6 +2135,20 @@ function validateWorkflowSnapshot(doc) {
   if (doc.compass_ref !== undefined) {
     validateNonEmptyString2(violations, doc.compass_ref, "compass_ref", "workflow.snapshot.missing-compass-ref", "workflow.snapshot.invalid-compass-ref");
   }
+  if (doc.delivery_kind !== undefined) {
+    if (typeof doc.delivery_kind !== "string" || !WORKFLOW_DELIVERY_KINDS.includes(doc.delivery_kind)) {
+      violations.push(violation3("medium", "workflow.snapshot.invalid-delivery-kind", `delivery_kind must be one of ${WORKFLOW_DELIVERY_KINDS.join(" | ")} — got ${JSON.stringify(doc.delivery_kind)}`));
+    }
+  }
+  if (doc.project !== undefined) {
+    validateNonEmptyString2(violations, doc.project, "project", "workflow.snapshot.missing-project", "workflow.snapshot.invalid-project");
+  }
+  if (doc.completion_policy !== undefined) {
+    validateNonEmptyString2(violations, doc.completion_policy, "completion_policy", "workflow.snapshot.missing-completion-policy", "workflow.snapshot.invalid-completion-policy");
+  }
+  if (doc.delivery !== undefined) {
+    violations.push(...deliveryEvidenceViolations(doc.delivery, "delivery"));
+  }
   const terminal = typeof doc.status === "string" && WORKFLOW_TERMINAL_STATUSES.includes(doc.status);
   if (terminal) {
     if (doc.ended_at === undefined) {
@@ -2283,7 +2363,7 @@ function validateStatusV2(docOrPath, opts = {}) {
   if (typeof docOrPath === "string") {
     try {
       doc = readJson(docOrPath);
-      harnessDir = dirname5(resolve6(docOrPath));
+      harnessDir = dirname5(resolve7(docOrPath));
     } catch (error) {
       return {
         ok: false,
@@ -2391,7 +2471,7 @@ function resolveCompassEnforcement(harnessDir) {
     return { hard: false, source: "none" };
   let entries;
   try {
-    entries = readdirSync2(iterationsDir, { withFileTypes: true });
+    entries = readdirSync3(iterationsDir, { withFileTypes: true });
   } catch {
     return { hard: false, source: "none" };
   }
@@ -2418,7 +2498,7 @@ function resolveCompassEnforcement(harnessDir) {
   return { hard: false, source: "none" };
 }
 function resolveMstarcEnforcement(harnessDir) {
-  const dir = resolve6(harnessDir);
+  const dir = resolve7(harnessDir);
   const rc = loadMstarc(dir, dirname5(dir));
   const value = rc?.config.enforcement;
   if (value === "hard")
@@ -2806,14 +2886,14 @@ function findingsCleanupGate(register, planId, opts) {
   return { ok: violations.length === 0, violations };
 }
 function resolveHarnessDir(startDir = process.cwd(), opts = {}) {
-  const start = resolve8(startDir);
+  const start = resolve9(startDir);
   const explicit = opts.harnessDir ?? process.env.MSTAR_HARNESS_DIR;
   if (explicit)
-    return resolve8(start, explicit);
-  const boundary = resolve8(start, opts.workspaceRoot ?? defaultWorkspaceRoot(start));
+    return resolve9(start, explicit);
+  const boundary = resolve9(start, opts.workspaceRoot ?? defaultWorkspaceRoot(start));
   const rc = loadMstarc(start, boundary);
   if (rc !== null && rc.config.harnessDir)
-    return resolve8(rc.dir, rc.config.harnessDir);
+    return resolve9(rc.dir, rc.config.harnessDir);
   let dir = start;
   for (;; ) {
     if (!isAtOrBelow2(dir, boundary))
@@ -2844,7 +2924,7 @@ function defaultWorkspaceRoot(startDir) {
       if (segment && segment !== ".")
         boundary = dirname6(boundary);
     }
-    return resolve8(boundary);
+    return resolve9(boundary);
   } catch {}
   return startDir;
 }
@@ -2853,10 +2933,10 @@ function isAtOrBelow2(dir, root) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
 }
 function mstarcDirOverride(harnessDir, key) {
-  const dir = resolve8(harnessDir);
+  const dir = resolve9(harnessDir);
   const rc = loadMstarc(dir, dirname6(dir));
   const declared = rc?.config[key];
-  return declared ? resolve8(rc.dir, declared) : null;
+  return declared ? resolve9(rc.dir, declared) : null;
 }
 function assertSafePathComponent(value, what) {
   if (value === "" || value === "." || value === ".." || !/^[A-Za-z0-9._-]+$/.test(value)) {
@@ -2864,7 +2944,7 @@ function assertSafePathComponent(value, what) {
   }
 }
 function canonicalizeNearestExisting(path) {
-  const abs = resolve8(path);
+  const abs = resolve9(path);
   let dir = abs;
   const tail = [];
   for (;; ) {
@@ -2884,7 +2964,7 @@ function canonicalizeNearestExisting(path) {
 }
 function resolveSddDir(harnessDir, planId) {
   assertSafePathComponent(planId, "planId");
-  const base = resolve8(harnessDir);
+  const base = resolve9(harnessDir);
   const declared = mstarcDirOverride(base, "sddDir");
   const sddBase = declared !== null ? declared : join10(base, "sdd");
   return join10(sddBase, planId);
@@ -2893,15 +2973,15 @@ function resolveIterationDir(harnessDir) {
   const declared = mstarcDirOverride(harnessDir, "iterationDir");
   if (declared !== null)
     return declared;
-  return join10(resolve8(harnessDir), "iterations");
+  return join10(resolve9(harnessDir), "iterations");
 }
 function resolveHarnessSubdir(startDir, opts, key, fallback) {
   const harness = resolveHarnessDir(startDir, opts);
   if (harness === null) {
-    throw new Error(`harness dir not found from ${resolve8(startDir)} — cannot resolve the ${fallback} dir (run \`mstar harness scaffold\`, pass opts.harnessDir, or set MSTAR_HARNESS_DIR)`);
+    throw new Error(`harness dir not found from ${resolve9(startDir)} — cannot resolve the ${fallback} dir (run \`mstar harness scaffold\`, pass opts.harnessDir, or set MSTAR_HARNESS_DIR)`);
   }
   const declared = mstarcDirOverride(harness, key);
-  return declared !== null ? declared : join10(resolve8(harness), fallback);
+  return declared !== null ? declared : join10(resolve9(harness), fallback);
 }
 function resolveWorkflowDir(startDir = process.cwd(), opts = {}) {
   return resolveHarnessSubdir(startDir, opts, "workflowDir", "workflows");
@@ -3080,7 +3160,7 @@ function l1PreDispatchCheck(input, opts = {}) {
   const violations = [];
   const checkoutCache = new Map;
   const checkout = (path) => {
-    const key = resolve9(path);
+    const key = resolve10(path);
     if (!checkoutCache.has(key))
       checkoutCache.set(key, probeCheckout(path, opts));
     return checkoutCache.get(key);
@@ -3131,7 +3211,7 @@ function l1PreDispatchCheck(input, opts = {}) {
     }
   }
   const identityViolation = (aPath, bPath, code, describe, fix) => {
-    if (resolve9(aPath) === resolve9(bPath)) {
+    if (resolve10(aPath) === resolve10(bPath)) {
       return violation8("critical", code, `${describe} — the same checkout (normalized path equality) is not isolation`, fix);
     }
     if (!existsSync9(aPath) || !existsSync9(bPath))
@@ -3192,7 +3272,7 @@ function l2PreDispatchCheck(input, opts = {}) {
       violations.push(violation8("high", "worktree.l2.track-path-relative", `track ${index + 1} worktreePath "${track.worktreePath}" is not an absolute path — L2 tracks MUST use absolute worktree checkout paths (consistent with the lease validator's absolute worktree_path enforcement)`, `use an absolute path for track ${index + 1} (e.g. /Users/<you>/worktrees/<branch>)`));
       return;
     }
-    const normalized = resolve9(track.worktreePath);
+    const normalized = resolve10(track.worktreePath);
     if (seenPaths.has(normalized)) {
       violations.push(violation8("high", "worktree.l2.track-path-collision", `duplicate worktreePath "${track.worktreePath}" across parallel tracks — L2 parallel-writable isolation requires a distinct absolute Worktree path per track (N parallel invokes ≠ isolation)`, "give every parallel track its own git worktree checkout"));
       return;
@@ -3374,7 +3454,7 @@ function hasWorkflowSnapshot(harnessDir) {
   if (!isDirectory2(workflowsDir))
     return false;
   try {
-    for (const entry of readdirSync6(workflowsDir, { withFileTypes: true })) {
+    for (const entry of readdirSync7(workflowsDir, { withFileTypes: true })) {
       if (entry.isDirectory() && isFile2(join13(workflowsDir, entry.name, "snapshot.json")))
         return true;
     }
@@ -3384,9 +3464,9 @@ function hasWorkflowSnapshot(harnessDir) {
   return false;
 }
 function checkoutRootNearestExisting(dir, boundary) {
-  const stop = resolve10(boundary);
-  const startInside = isInside(resolve10(dir), stop);
-  let current = resolve10(dir);
+  const stop = resolve11(boundary);
+  const startInside = isInside(resolve11(dir), stop);
+  let current = resolve11(dir);
   for (;; ) {
     const probed = probeCheckoutRoot(current);
     if (probed !== null)
@@ -3440,12 +3520,12 @@ function sddWorkspace(planId, opts = {}) {
   const harnessOverride = opts.harnessDir ?? (process.env.MSTAR_HARNESS_DIR || undefined);
   let harnessDir;
   if (harnessOverride) {
-    harnessDir = resolve10(root, harnessOverride);
+    harnessDir = resolve11(root, harnessOverride);
   } else {
     const rc = findMstarc(root, root);
     const rcHarnessDir = rc !== null ? parseMstarc(readFileSync9(rc, "utf8")).harnessDir : undefined;
     if (rcHarnessDir) {
-      harnessDir = resolve10(rc !== null ? dirname9(rc) : root, rcHarnessDir);
+      harnessDir = resolve11(rc !== null ? dirname9(rc) : root, rcHarnessDir);
     } else {
       const probed = probeHarnessWithStatus(root);
       if (probed) {
@@ -3477,7 +3557,7 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
   const bound = opts.context;
   const observedCwd = opts.cwd ?? process.cwd();
   if (bound) {
-    const inputPlan = canonicalizeNearestExisting(resolve10(observedCwd, planFile));
+    const inputPlan = canonicalizeNearestExisting(resolve11(observedCwd, planFile));
     if (inputPlan !== canonicalizeNearestExisting(bound.planFile)) {
       throwGateFail([
         contextViolation("high", "sdd.context.plan-file-mismatch", `plan file "${planFile}" does not match the bound context plan file "${bound.planFile}" — ` + "bound mode extracts only the resolved context's plan; refused before any read or write")
@@ -3493,7 +3573,7 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
   let out;
   let mkdirAfterGate = null;
   if (outFile) {
-    out = bound ? resolve10(observedCwd, outFile) : outFile;
+    out = bound ? resolve11(observedCwd, outFile) : outFile;
   } else if (bound) {
     out = join13(bound.sddDir, `task-${taskN}-brief.md`);
     mkdirAfterGate = bound.sddDir;
@@ -3536,7 +3616,7 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
   if (printed.length === 0) {
     throw new SddScriptError(`task ${taskN} not found in ${planFile} (no heading matching Task ${taskN})`, 3);
   }
-  return bound ? resolve10(observedCwd, out) : out;
+  return bound ? resolve11(observedCwd, out) : out;
 }
 function isInside(child, ancestor) {
   const rel = relative3(ancestor, child);
@@ -3574,11 +3654,11 @@ function checkSddAction(context, action) {
   const featureReal = canonicalDir(context.featureCwd);
   const canonicalSddDir = canonicalizeNearestExisting(context.sddDir);
   const canonicalPlanFile = canonicalizeNearestExisting(context.planFile);
-  const cwdResolved = resolve10(action.cwd);
+  const cwdResolved = resolve11(action.cwd);
   const checkTarget = (baseDir, target, kind) => {
     if (featureReal === null)
       return;
-    const targetAbs = resolve10(baseDir, target);
+    const targetAbs = resolve11(baseDir, target);
     const canonical = canonicalizeNearestExisting(targetAbs);
     if (!isInside(canonical, featureReal)) {
       const declaredPrefix = targetAbs === featureReal || targetAbs.startsWith(`${featureReal}/`);
@@ -3606,10 +3686,10 @@ function checkSddAction(context, action) {
       add("sdd.context.target-missing", "artifact checks require the destination target");
       return { ok: false, violations };
     }
-    const targetAbs = resolve10(cwdResolved, action.target);
+    const targetAbs = resolve11(cwdResolved, action.target);
     const canonical = canonicalizeNearestExisting(targetAbs);
     if (!isInside(canonical, canonicalSddDir) && canonical !== canonicalPlanFile) {
-      const rawSddDir = resolve10(context.sddDir);
+      const rawSddDir = resolve11(context.sddDir);
       const declaredPrefix = targetAbs === rawSddDir || targetAbs.startsWith(`${rawSddDir}/`) || targetAbs === canonicalSddDir || targetAbs.startsWith(`${canonicalSddDir}/`) || targetAbs === canonicalPlanFile;
       if (declaredPrefix) {
         add("sdd.context.artifact-symlink-escape", `artifact target "${targetAbs}" canonicalizes to "${canonical}", outside the plan's control sddDir — symlink escape refused before write`);
@@ -4361,7 +4441,7 @@ function referenceExists(repoRoot, docText) {
       const dir = stack.pop();
       let entries;
       try {
-        entries = readdirSync9(dir, { withFileTypes: true });
+        entries = readdirSync10(dir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -4382,7 +4462,7 @@ function referenceExists(repoRoot, docText) {
   for (const { ref, isSymbol, module } of refs) {
     if (!isSymbol || module === undefined) {
       const candidate = ref.replace(LINE_SUFFIX_RE, "").replace(ANCHOR_RE, "");
-      if (existsSync13(resolve14(repoRoot, candidate))) {
+      if (existsSync13(resolve15(repoRoot, candidate))) {
         checked++;
       } else {
         violations.push(violation11("medium", "compound.reference.missing-file", `referenced path \`${ref}\` does not exist under ${repoRoot} (compound-refresh Phase 2: referenced code still exists?)`, "update the doc to reference an existing path, or delete the stale reference"));
@@ -4402,7 +4482,7 @@ function collectKnowledgeDocs(dir) {
     const current = stack.pop();
     let entries;
     try {
-      entries = readdirSync9(current, { withFileTypes: true });
+      entries = readdirSync10(current, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -4457,9 +4537,9 @@ function isFileLikeRoot(root) {
   return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename11(root));
 }
 function scopeGuard(path, allowedRoots) {
-  const resolved = resolve14(path);
+  const resolved = resolve15(path);
   for (const root of allowedRoots) {
-    const r = resolve14(root);
+    const r = resolve15(root);
     if (isFileLikeRoot(r)) {
       if (resolved === r)
         return { ok: true, violations: [] };
@@ -5056,7 +5136,7 @@ function skillLocalConfig(config) {
 }
 
 // src/gates/catalog.ts
-import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync4, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync5, realpathSync as realpathSync6 } from "node:fs";
 import { basename as basename6, isAbsolute as isAbsolute9, join as join19, relative as relative7, sep as sep3 } from "node:path";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 
@@ -5066,7 +5146,7 @@ import { join as join14 } from "node:path";
 
 // src/gates/dispatch.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { basename as basename3, join as join8, resolve as resolve7 } from "node:path";
+import { basename as basename3, join as join8, resolve as resolve8 } from "node:path";
 
 // src/gates/workflow-selection.ts
 import { existsSync as existsSync3, readdirSync, realpathSync, statSync as statSync2 } from "node:fs";
@@ -5570,7 +5650,7 @@ function leaseGateViolations(harnessDir, exec, writable, prompt, hint) {
     const wt = worktree === undefined ? undefined : firstToken(worktree);
     if (isNaValue(wt)) {
       violations.push(leaseViolation("lease.dispatch.worktree-mismatch", "Assignment declares no Worktree path — cannot confirm this dispatch matches execution_lease.worktree_path", "add the absolute Worktree path to the Assignment (must equal the lease worktree_path)"));
-    } else if (resolve7(wt) !== resolve7(String(lease.worktree_path ?? ""))) {
+    } else if (resolve8(wt) !== resolve8(String(lease.worktree_path ?? ""))) {
       violations.push(leaseViolation("lease.dispatch.worktree-mismatch", `Assignment Worktree path "${wt}" differs from execution_lease.worktree_path "${String(lease.worktree_path)}"`, "align the Assignment with the lease worktree path (or update the lease)"));
     }
     const forms = parseAssignmentBranchForms(header);
@@ -5839,10 +5919,16 @@ function assignmentTextFromFields(fields) {
     lines.push(`**Delegation**: ${fields.delegation}`);
   if (fields.taskCategory !== undefined)
     lines.push(`**Task category**: ${fields.taskCategory}`);
+  if (fields.taskBudget !== undefined)
+    lines.push(`**Task budget (implement / ops rounds)**: ${fields.taskBudget}`);
   if (fields.workingBranch !== undefined)
     lines.push(`**Working branch**: ${fields.workingBranch}`);
   if (fields.branchPolicy !== undefined)
     lines.push(`**Branch policy**: ${fields.branchPolicy}`);
+  if (fields.budget !== undefined)
+    lines.push(`**Budget (review / QC seats)**: ${fields.budget}`);
+  if (fields.returnShape !== undefined)
+    lines.push(`**Return shape (review / QC seats)**: ${fields.returnShape}`);
   return lines.join(`
 `);
 }
@@ -7428,7 +7514,7 @@ function projectRollupSource(harnessDir, residuals) {
   if (existsSync15(projectsDir)) {
     let entries;
     try {
-      entries = readdirSync4(projectsDir, { withFileTypes: true });
+      entries = readdirSync5(projectsDir, { withFileTypes: true });
     } catch {
       entries = [];
     }
@@ -7505,7 +7591,7 @@ function projectRegisters(harnessDir) {
     return [];
   let entries;
   try {
-    entries = readdirSync4(projectsDir, { withFileTypes: true });
+    entries = readdirSync5(projectsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -7994,11 +8080,11 @@ function installEngineStatusEndpoint(ctx, options) {
 }
 
 // src/gates/status.ts
-import { existsSync as existsSync17, readdirSync as readdirSync7 } from "node:fs";
-import { basename as basename8, join as join21, relative as relative9, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename8, join as join21, relative as relative9, resolve as resolve12 } from "node:path";
 var LOGGER_NAME = "mstar/status-gate";
 function harnessDocKindOfTarget(harnessDir, targetPath) {
-  const resolved = resolve11(targetPath);
+  const resolved = resolve12(targetPath);
   const name = basename8(resolved);
   if (name !== STATUS_FILE && name !== WORKFLOW_SNAPSHOT_FILE && name !== PROJECT_REGISTER_FILE)
     return null;
@@ -8068,7 +8154,7 @@ function projectRegisterDocs(harnessDir) {
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
   let entries;
   try {
-    entries = readdirSync7(projectsDir, { withFileTypes: true });
+    entries = readdirSync8(projectsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -8151,7 +8237,7 @@ async function editIntentListener(ctx, resolver, config, adapter, target, actor,
 
 // src/gates/skill-lint.ts
 import { existsSync as existsSync18, readFileSync as readFileSync13 } from "node:fs";
-import { basename as basename9, dirname as dirname12, resolve as resolve13, sep as sep6 } from "node:path";
+import { basename as basename9, dirname as dirname12, resolve as resolve14, sep as sep6 } from "node:path";
 var SKILL_LINT_LOGGER = "mstar/skill-lint";
 
 class SkillLintVetoError extends Error {
@@ -8192,7 +8278,7 @@ function lintSkillDoc(doc, options = {}) {
   return violations.length === 0 ? { ok: true, violations } : { ok: false, violations };
 }
 function lintSkillWrite(doc, options) {
-  const skillId = basename9(dirname12(resolve13(options.target)));
+  const skillId = basename9(dirname12(resolve14(options.target)));
   const result = lintSkillDoc(doc, { skillId });
   if (options.hard && !result.ok) {
     throw new SkillLintVetoError(options.target, result.violations);
@@ -8207,8 +8293,8 @@ function skillRootsOf(config) {
 function isSkillTarget(roots, target) {
   if (basename9(target.displayPath) !== "SKILL.md")
     return false;
-  const resolvedPath = resolve13(target.displayPath);
-  return roots.some((root) => resolvedPath.startsWith(resolve13(root) + sep6));
+  const resolvedPath = resolve14(target.displayPath);
+  return roots.some((root) => resolvedPath.startsWith(resolve14(root) + sep6));
 }
 function skillNameOf(target) {
   return basename9(dirname12(target.displayPath));
@@ -8223,7 +8309,7 @@ function gateSkillIntent(ctx, harnessDir, config, target) {
       return;
     if (!isSkillTarget(roots, target))
       return;
-    const skillPath = resolve13(target.displayPath);
+    const skillPath = resolve14(target.displayPath);
     if (!existsSync18(skillPath))
       return;
     let doc;
@@ -8275,8 +8361,8 @@ async function skillWriteIntentListener(ctx, resolver, config, target, actor, ne
 }
 
 // src/gates/seams.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15, readdirSync as readdirSync10 } from "node:fs";
-import { basename as basename10, dirname as dirname13, join as join22, resolve as resolve15, sep as sep8 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync15, readdirSync as readdirSync11 } from "node:fs";
+import { basename as basename10, dirname as dirname13, join as join22, resolve as resolve16, sep as sep8 } from "node:path";
 
 // ../engine/dist/audit.js
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
@@ -8486,7 +8572,7 @@ function isMarkdownDoc(path) {
 function isAuditPlanTarget(path) {
   if (!isMarkdownDoc(path))
     return false;
-  const segments = resolve15(path).split(sep8);
+  const segments = resolve16(path).split(sep8);
   for (let i = 0;i < segments.length; i++) {
     if (segments[i] !== "plans")
       continue;
@@ -8497,7 +8583,7 @@ function isAuditPlanTarget(path) {
   return false;
 }
 function isRolesTarget(path) {
-  const segments = resolve15(path).split(sep8);
+  const segments = resolve16(path).split(sep8);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
     return false;
@@ -8507,14 +8593,14 @@ function isRolesTarget(path) {
   return rest[0] === "SKILL.md" || rest[0] === "references" && rest[rest.length - 1].endsWith(".md");
 }
 function rolesDirOf(path) {
-  const segments = resolve15(path).split(sep8);
+  const segments = resolve16(path).split(sep8);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
     return dirname13(path);
   return idx === 0 ? sep8 : join22(sep8, ...segments.slice(1, idx + 1));
 }
 function isSeamTarget(seam, harnessDir, target) {
-  const path = resolve15(target.displayPath);
+  const path = resolve16(target.displayPath);
   switch (seam) {
     case "design-md": {
       const base = basename10(path);
@@ -8525,7 +8611,7 @@ function isSeamTarget(seam, harnessDir, target) {
     case "compound": {
       if (harnessDir === null)
         return false;
-      return path.startsWith(resolve15(join22(harnessDir, "knowledge")) + sep8) && isMarkdownDoc(path);
+      return path.startsWith(resolve16(join22(harnessDir, "knowledge")) + sep8) && isMarkdownDoc(path);
     }
     case "roles":
       return isRolesTarget(path);
@@ -8567,7 +8653,7 @@ function validateCompoundDoc(doc, _path, harnessDir) {
 function validateRolesState(rolesDir, skillsRoot = dirname13(rolesDir)) {
   const violations = [...validateRoleMapping(rolesDir).violations];
   const skillTexts = {};
-  for (const entry of readdirSync10(skillsRoot, { withFileTypes: true })) {
+  for (const entry of readdirSync11(skillsRoot, { withFileTypes: true })) {
     if (!entry.isDirectory() || !entry.name.startsWith("mstar-"))
       continue;
     const skillFile = join22(skillsRoot, entry.name, "SKILL.md");
@@ -8604,7 +8690,7 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
   try {
     if (!isSeamTarget(seam, harnessDir, target))
       return;
-    const path = resolve15(target.displayPath);
+    const path = resolve16(target.displayPath);
     if (!existsSync19(path))
       return;
     let doc;
@@ -8676,7 +8762,7 @@ function lintRolesWrite(doc, options) {
 
 // src/gates/tools.ts
 import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
-import { join as join23, resolve as resolve17 } from "node:path";
+import { join as join23, resolve as resolve18 } from "node:path";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 var ITERATION_VIOLATION_SCHEMA = {
   type: "object",
@@ -8896,7 +8982,7 @@ function registerSeamTools(ctx, resolver) {
       presentCall: (args) => ({ card: "generic", title: "Validate DESIGN.md", kind: "other", rawInput: args.dir }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        const abs = resolve17(args.dir);
+        const abs = resolve18(args.dir);
         const lightPath = join23(abs, "DESIGN.md");
         if (!existsSync20(lightPath))
           throw new Error(`design file not found: ${lightPath}`);
@@ -8950,7 +9036,7 @@ function registerSeamTools(ctx, resolver) {
       presentCall: (args) => ({ card: "generic", title: "Validate audit plan", kind: "other", rawInput: args.plan_path }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        const abs = resolve17(args.plan_path);
+        const abs = resolve18(args.plan_path);
         if (!existsSync20(abs))
           throw new Error(`plan file not found: ${abs}`);
         const text = readFileSync16(abs, "utf8");
@@ -8990,17 +9076,17 @@ function registerSeamTools(ctx, resolver) {
       presentCall: (args) => ({ card: "generic", title: "Validate knowledge doc", kind: "other", rawInput: args.doc_path }),
       isConcurrencySafe: () => false,
       async execute(args, exec) {
-        const abs = resolve17(args.doc_path);
+        const abs = resolve18(args.doc_path);
         if (!existsSync20(abs))
           throw new Error(`knowledge doc not found: ${abs}`);
         const text = readFileSync16(abs, "utf8");
         const base = validateCompoundDoc(text, abs, args.repo_root !== undefined ? null : resolver.forAgent(exec.agent));
         const violations = [...base.violations];
         if (args.repo_root !== undefined) {
-          violations.push(...referenceExists(resolve17(args.repo_root), text).violations);
+          violations.push(...referenceExists(resolve18(args.repo_root), text).violations);
         }
         if (args.knowledge_dir !== undefined) {
-          const knowledgeDir = resolve17(args.knowledge_dir);
+          const knowledgeDir = resolve18(args.knowledge_dir);
           violations.push(...assertIndexRows(knowledgeDir).violations);
           violations.push(...scopeGuard(abs, [knowledgeDir]).violations);
         }
@@ -9035,10 +9121,10 @@ function registerSeamTools(ctx, resolver) {
       presentCall: (args) => ({ card: "generic", title: "Validate roles mapping", kind: "other", rawInput: args.roles_dir }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        const rolesDir = resolve17(args.roles_dir);
+        const rolesDir = resolve18(args.roles_dir);
         if (!existsSync20(join23(rolesDir, "SKILL.md")))
           throw new Error(`roles dir not found: ${rolesDir}`);
-        const result = validateRolesState(rolesDir, args.skills_root !== undefined ? resolve17(args.skills_root) : undefined);
+        const result = validateRolesState(rolesDir, args.skills_root !== undefined ? resolve18(args.skills_root) : undefined);
         return { ok: result.ok, violations: result.violations.map(iterationViolationView) };
       }
     }));
@@ -9188,8 +9274,8 @@ class DshHostAdapter extends Service3 {
 }
 
 // src/gates/agent-personas.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync12, statSync as statSync8 } from "node:fs";
-import { join as join25, resolve as resolve18, sep as sep9 } from "node:path";
+import { readFileSync as readFileSync17, readdirSync as readdirSync13, statSync as statSync8 } from "node:fs";
+import { join as join25, resolve as resolve19, sep as sep9 } from "node:path";
 var ROLE_ID_PATTERN = /^[a-z0-9-]{1,32}$/;
 var defaultCache = new Map;
 function personaFor(roleId, lookup, warn) {
@@ -9206,7 +9292,7 @@ function personaFor(roleId, lookup, warn) {
 function subagentRoleIds(agentsDir) {
   let names;
   try {
-    names = readdirSync12(agentsDir);
+    names = readdirSync13(agentsDir);
   } catch {
     return [];
   }
@@ -9230,8 +9316,8 @@ function subagentRoleIds(agentsDir) {
 function defaultFromMirror(agentsDir, roleId, warn) {
   if (!ROLE_ID_PATTERN.test(roleId))
     return;
-  const root = resolve18(agentsDir);
-  const file = resolve18(agentsDir, `${roleId}.md`);
+  const root = resolve19(agentsDir);
+  const file = resolve19(agentsDir, `${roleId}.md`);
   if (!file.startsWith(root + sep9))
     return;
   let stat;
@@ -9881,7 +9967,7 @@ function registerWorkflowLedger(ctx, resolver, workflowAskCache) {
 }
 
 // src/gates/goal-bridge.ts
-import { existsSync as existsSync22, readdirSync as readdirSync13 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync14 } from "node:fs";
 import { join as join27 } from "node:path";
 var GOAL_BRIDGE_LOGGER = "mstar/goal-bridge";
 var GOAL_CHANGE_EVENT_TYPE = "goal/change";
@@ -9904,7 +9990,7 @@ function errorMessage4(error) {
 function projectRegisterPointer(harnessDir) {
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
   try {
-    for (const entry of readdirSync13(projectsDir, { withFileTypes: true })) {
+    for (const entry of readdirSync14(projectsDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
       const registerPath = join27(projectsDir, entry.name, PROJECT_REGISTER_FILE);
@@ -10598,7 +10684,7 @@ function registerMstarCommands(ctx) {
   if (dir === undefined)
     return;
   ctx.inject(["commands"], (commandsCtx) => {
-    for (const file of readdirSync14(dir).sort()) {
+    for (const file of readdirSync15(dir).sort()) {
       if (!file.endsWith(".md"))
         continue;
       const parsed = parseCommandMarkdown(readFileSync19(join29(dir, file), "utf8"));