@ordewell/core 0.11.3 → 0.12.1

package/dist/parsing.d.mts

@@ -1,5 +1,5 @@
-import { az as RunnerId, aS as Task } from './Task-BL4Idm9r.mjs';
-import { R as RunnerModeInfo } from './ModeResolver-BDAgouuE.mjs';
+import { b3 as RunnerId, bp as Task } from './Task-CxGgN6I0.mjs';
+import { R as RunnerModeInfo } from './ModeResolver-CA2fUU9h.mjs';
 
 declare function parsePlanJson(raw: string, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): Task[];
 

package/dist/parsing.d.ts

@@ -1,5 +1,5 @@
-import { az as RunnerId, aS as Task } from './Task-BL4Idm9r.js';
-import { R as RunnerModeInfo } from './ModeResolver-DyXeZ9ib.js';
+import { b3 as RunnerId, bp as Task } from './Task-CxGgN6I0.js';
+import { R as RunnerModeInfo } from './ModeResolver-B64aUZXJ.js';
 
 declare function parsePlanJson(raw: string, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): Task[];
 

package/dist/parsing.js

@@ -121,7 +121,7 @@ function createTask(overrides = {}) {
     assignedModel: overrides.assignedModel,
     assignedRunner: overrides.assignedRunner ?? DEFAULT_RUNNERS[0],
     // A script task runs in no mode (ADR-0035): one given it would read as a mode it runs in.
-    taskMode: overrides.taskMode ?? (type === "script" ? void 0 : "build"),
+    taskMode: overrides.taskMode ?? (type === "script" || type === "delegated" ? void 0 : "build"),
     autonomy: overrides.autonomy,
     sliceType: overrides.sliceType,
     userStoriesCovered: overrides.userStoriesCovered,
@@ -131,6 +131,12 @@ function createTask(overrides = {}) {
     ...overrides.commands !== void 0 ? { commands: overrides.commands.map((argv) => [...argv]) } : {},
     ...overrides.script !== void 0 ? { script: overrides.script } : {},
     ...overrides.timeoutMs !== void 0 ? { timeoutMs: overrides.timeoutMs } : {},
+    ...overrides.goal !== void 0 ? { goal: overrides.goal } : {},
+    ...overrides.budget !== void 0 ? { budget: { ...overrides.budget } } : {},
+    ...overrides.grants !== void 0 ? { grants: [...overrides.grants] } : {},
+    ...overrides.protectedPaths !== void 0 ? { protectedPaths: [...overrides.protectedPaths] } : {},
+    ...overrides.scope !== void 0 ? { scope: structuredClone(overrides.scope) } : {},
+    ...overrides.readOnly ? { readOnly: true } : {},
     ...overrides.loop ? { loop: { body: [...overrides.loop.body], maxRounds: overrides.loop.maxRounds } } : {},
     ...overrides.loopRound !== void 0 ? { loopRound: overrides.loopRound } : {},
     ...overrides.research !== void 0 ? { research: overrides.research } : {}
@@ -299,8 +305,82 @@ function escapeControlCharsInStrings(json) {
   return out;
 }
 
-// src/services/PlannedTask.ts
-var import_uuid2 = require("uuid");
+// src/services/Mandate.ts
+var GRANTS = ["observe", "steer", "control", "replan", "approve", "delegate", "effect", "research", "merge"];
+var FLOOR_GRANTS = ["observe", "steer", "control", "replan", "approve", "merge"];
+var SHAPE_LIMITS = {
+  depth: { default: 2, hard: 4 },
+  delegatedTasks: { default: 8, hard: 30 },
+  tasksPerPlan: { default: 30, hard: 100 }
+};
+var DEFAULT_CHILD_WALL_CLOCK_MS = 24 * 60 * 60 * 1e3;
+var DELEGATED_GRANTS = [...FLOOR_GRANTS, "research", "delegate"];
+var lesser = (limit) => (parent, request) => {
+  const { hard } = SHAPE_LIMITS[limit];
+  const asked = request[limit];
+  if (asked !== void 0 && asked > hard) return { refused: { field: `limits.${limit}`, asked: String(asked), there: `a hard limit of ${hard}` } };
+  return { value: Math.min(parent[limit], asked ?? parent[limit]) };
+};
+function intersectModels(parent, asked = {}) {
+  const models = { ...asked, ...parent };
+  for (const runner of Object.keys(parent)) {
+    if (asked[runner]) models[runner] = parent[runner].filter((model) => asked[runner].includes(model));
+  }
+  return models;
+}
+var LIMIT_RULES = {
+  tokens: ({ tokens }, { tokens: asked }) => {
+    if (asked === void 0 || asked <= 0 || asked > tokens) return { refused: { field: "limits.tokens", asked: asked === void 0 ? "none" : String(asked), there: String(tokens) } };
+    return { value: asked };
+  },
+  wallClockMs: ({ wallClockMs: left }, { wallClockMs: asked }) => {
+    if (asked === void 0) return { value: left === null ? DEFAULT_CHILD_WALL_CLOCK_MS : Math.min(left, DEFAULT_CHILD_WALL_CLOCK_MS) };
+    if (asked <= 0 || left !== null && asked > left) return { refused: { field: "limits.wallClockMs", asked: String(asked), there: left === null ? "no limit" : String(left) } };
+    return { value: asked };
+  },
+  depth: ({ depth }, { depth: asked }) => {
+    if (depth <= 0) return { refused: { field: "limits.depth", asked: "a child", there: "no depth left" } };
+    const { hard } = SHAPE_LIMITS.depth;
+    if (asked !== void 0 && asked > hard) return { refused: { field: "limits.depth", asked: String(asked), there: `a hard limit of ${hard}` } };
+    return { value: Math.min(depth - 1, asked ?? depth - 1) };
+  },
+  delegatedTasks: lesser("delegatedTasks"),
+  tasksPerPlan: lesser("tasksPerPlan"),
+  runners: ({ runners }, { runners: asked }) => ({ value: asked ? runners.filter((runner) => asked.includes(runner)) : runners }),
+  models: ({ models }, { models: asked }) => ({ value: intersectModels(models, asked) })
+};
+var COMMAND_GRANTS = {
+  run_plan: "control",
+  run_task: "control",
+  stop_task: "control",
+  stop_run: "control",
+  retry_task: "control",
+  message_task: "steer",
+  answer_approval: "steer",
+  merge_all: "merge",
+  skip_task: "control",
+  force_start: null,
+  mark_complete: null,
+  mark_not_done: null,
+  revert_task: null,
+  interrupt_task: null,
+  force_send_queued: null,
+  remove_queued: null,
+  cancel_resume: null,
+  answer_checkpoint: "steer",
+  approve_review: null,
+  run_script: "control"
+};
+var TOOL_GRANTS = [
+  ...Object.entries(COMMAND_GRANTS).flatMap(([tool, grant]) => grant ? [[tool, grant]] : []),
+  ["submit_plan", "replan"],
+  ["edit_plan", "replan"]
+];
+
+// src/models/lineBreaks.ts
+var BREAKS = "\\n\\v\\f\\r\\u0085\\u2028\\u2029";
+var LINE_BREAK = new RegExp(`\\r\\n|[${BREAKS}]`);
+var ONE_LINE = new RegExp(`^[^${BREAKS}]*$`);
 
 // src/services/ModeResolver.ts
 function resolveDefaultMode(modes, autonomousDefault = false) {
@@ -349,6 +429,142 @@ function readOnlyRunners(runnerModes) {
   return Object.entries(runnerModes).filter(([, ms]) => readOnlyMode(ms)).map(([id]) => id);
 }
 
+// src/models/Delegation.ts
+var SCOPE_LIMITS = { item: 200, items: 50 };
+var NOT_A_DELEGATED_TASKS_FIELDS = ["prompt", "taskMode", "skills", "userSteps", "ops", "commands", "script", "timeoutMs", "research"];
+var DELEGATION_UNAVAILABLE = "delegation is not available in this session";
+function notOnADelegatedMessage(fields) {
+  return `is a delegated task, which holds a goal for a child plan: leave out ${fields.map((f) => `"${f}"`).join(", ")}`;
+}
+function isBudget(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const { tokens } = value;
+  return typeof tokens === "number" && Number.isInteger(tokens) && tokens > 0;
+}
+function wallClockOk(budget) {
+  const { wallClockMs } = budget;
+  return wallClockMs === void 0 || Number.isInteger(wallClockMs) && wallClockMs > 0;
+}
+function readsOnly(task, runnerModes) {
+  if (task.type !== "ai") return false;
+  const mode = runnerModes ? taggedReadOnlyMode(runnerModes[task.assignedRunner]) : "plan";
+  return mode !== void 0 && task.taskMode === mode;
+}
+function atAGate(task) {
+  return task.type === "script" && !task.readOnly || task.ops === true;
+}
+function reaches(tasks, from, target) {
+  const byId = new Map(tasks.map((t) => [t.id, t]));
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (task) => task.dependencies.some((id) => {
+    if (seen.has(id)) return false;
+    seen.add(id);
+    const dep = byId.get(id);
+    return dep !== void 0 && (target(dep) || walk(dep));
+  });
+  return walk(from);
+}
+function delegationErrors(tasks, rules = {}) {
+  const errors = [];
+  const delegated = tasks.filter((t) => t.type === "delegated");
+  const fail = (task, field, message) => errors.push({ taskId: task.id, field, message });
+  for (const task of delegated) {
+    const where = `Task "${task.title}"`;
+    if (typeof task.goal !== "string" || !task.goal.trim()) fail(task, "goal", `${where} is a delegated task with no "goal": say what its child plan must achieve`);
+    if (!isBudget(task.budget)) fail(task, "budget", `${where} is a delegated task with no "budget": give it {"tokens": <a whole number>}, and "wallClockMs" if it has a time limit`);
+    else if (!wallClockOk(task.budget)) fail(task, "budget", `${where} has a "wallClockMs" that is not a whole number of milliseconds above 0`);
+    const paths = task.protectedPaths;
+    if (!task.readOnly && (!Array.isArray(paths) || paths.length === 0 || !paths.every((p) => typeof p === "string" && p.trim()))) {
+      fail(task, "protectedPaths", `${where} is a delegated task that lands, with no "protectedPaths": name the paths its child may not change, what its check runs and the configuration that runs it`);
+    }
+    if (task.scope !== void 0 && !scopeOk(task.scope)) fail(task, "scope", `${where} has a "scope" that is not lists of text: "paths", "provides" and "consumes", at most ${SCOPE_LIMITS.items} items of one line and ${SCOPE_LIMITS.item} characters each`);
+    const unknown = (task.grants ?? []).filter((grant) => !GRANTS.includes(grant));
+    if (unknown.length > 0) fail(task, "grants", `${where} asks in "grants" for ${unknown.map((g) => `"${g}"`).join(", ")}, which no grant is: one of ${GRANTS.join(", ")}`);
+    const dependents = tasks.filter((t) => t.dependencies.includes(task.id));
+    if (task.readOnly) {
+      for (const script of dependents.filter((t) => t.type === "script")) {
+        fail(script, "dependencies", `Task "${script.title}" depends on "${task.title}", which is a read-only delegated task, which lands nothing, so a script has nothing to run on: make the check a read-only AI task, which reads its handoff`);
+      }
+    }
+    if (!dependents.some((t) => judges(t, task, rules.runnerModes))) {
+      fail(task, "dependencies", `${where} is a delegated task with no check: add a read-only AI task${task.readOnly ? ", which reads its handoff," : ', or a script task marked "readOnly",'} that depends on it directly`);
+    }
+  }
+  for (const task of tasks.filter((t) => t.type === "script" && t.readOnly)) {
+    if (rules.canSeal === false) fail(task, "readOnly", `Task "${task.title}" is a read-only script task, and this machine has no sandbox to seal one in: make the check a read-only AI task`);
+  }
+  for (const check of tasks.filter((t) => t.loop)) {
+    if (!reaches(tasks, check, (t) => t.type === "delegated")) continue;
+    for (const id of check.loop?.body ?? []) {
+      const body = tasks.find((t) => t.id === id);
+      if (body && atAGate(body)) {
+        fail(body, "loop", `Task "${check.title}" names "${body.title}" in its loop's "body", which waits at a merge gate for work a delegated task's check holds back: make the fix a change task, cut from the integration tip`);
+      }
+    }
+  }
+  return errors;
+}
+function scopeOk(scope) {
+  if (typeof scope !== "object" || scope === null) return false;
+  const { paths, provides, consumes } = scope;
+  const itemOk = (item) => typeof item === "string" && item.trim().length > 0 && item.length <= SCOPE_LIMITS.item && ONE_LINE.test(item);
+  return [paths, provides, consumes].every((list) => list === void 0 || Array.isArray(list) && list.length <= SCOPE_LIMITS.items && list.every(itemOk));
+}
+function judges(task, delegated, runnerModes) {
+  return readsOnly(task, runnerModes) || !delegated.readOnly && task.type === "script" && task.readOnly === true;
+}
+function underProtectedPath(file, protectedPath) {
+  const rule = protectedPath.trim().replace(/^\.\//, "").replace(/\\/g, "/");
+  if (!rule) return false;
+  if (rule.includes("*")) return globRegExp(rule).test(file);
+  const bare = rule.replace(/\/+$/, "");
+  return file === bare || file.startsWith(`${bare}/`);
+}
+function fixedStart(rule) {
+  const bare = rule.trim().replace(/^\.\//, "").replace(/\\/g, "/");
+  const star = bare.indexOf("*");
+  return star === -1 ? bare : bare.slice(0, star);
+}
+function pathsMeet(a, b) {
+  if (underProtectedPath(a.replace(/\/+$/, ""), b) || underProtectedPath(b.replace(/\/+$/, ""), a)) return true;
+  if (!a.includes("*") || !b.includes("*")) return false;
+  const [one, other] = [fixedStart(a), fixedStart(b)];
+  return one.startsWith(other) || other.startsWith(one);
+}
+function narrower(a, b) {
+  return b.includes("*") || !a.includes("*") && a.length >= b.length ? a : b;
+}
+function ordered(tasks, a, b) {
+  return reaches(tasks, a, (t) => t.id === b.id) || reaches(tasks, b, (t) => t.id === a.id);
+}
+function scopeOverlaps(tasks) {
+  const scoped = tasks.filter((t) => t.type === "delegated" && t.scope);
+  const said = [];
+  scoped.forEach((a, i) => {
+    for (const b of scoped.slice(i + 1)) {
+      if (ordered(tasks, a, b)) continue;
+      const declared = (a.scope?.paths ?? []).flatMap((one) => (b.scope?.paths ?? []).filter((other) => pathsMeet(one, other)).map((other) => narrower(one, other)));
+      if (declared.length > 0) said.push(`Tasks "${a.title}" and "${b.title}" both declare ${[...new Set(declared)].join(", ")}, and nothing orders them: give one a dependency on the other, or name an owner.`);
+      for (const name of a.scope?.provides ?? []) {
+        if (b.scope?.provides?.includes(name)) said.push(`Tasks "${a.title}" and "${b.title}" both provide "${name}", and nothing orders them: name one owner.`);
+      }
+      for (const [producer, consumer] of [[a, b], [b, a]]) {
+        for (const name of producer.scope?.provides ?? []) {
+          if (consumer.scope?.consumes?.includes(name)) said.push(`Task "${consumer.title}" consumes "${name}", which "${producer.title}" provides, and nothing orders them: a dependency puts the producer first; without one it gets a line when "${producer.title}" lands.`);
+        }
+      }
+    }
+  });
+  return said;
+}
+function globRegExp(rule) {
+  const pattern = rule.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\/?|\*/g, (star) => star === "*" ? "[^/]*" : "(?:.*/)?");
+  return new RegExp(`^${pattern}(?:/.*)?$`);
+}
+
+// src/services/PlannedTask.ts
+var import_uuid2 = require("uuid");
+
 // src/services/ModelAllowlistResolver.ts
 function effectiveAllowlist(allowlist, runner, modelsByRunner) {
   if (!allowlist || allowlist.length === 0) return void 0;
@@ -433,8 +649,8 @@ function resolveAssignment(write) {
   const live = writer !== "runner" && !!before && !!catalog.liveRunner?.(before.id);
   if (live && moved) return { ok: false, field: "assignedRunner", error: liveRunnerRefusal({ title }) };
   if (live && !sameAssignment(before?.assignedModel, written.assignedModel)) return { ok: false, field: "assignedModel", error: liveModelRefusal({ title }) };
-  if (written.type !== "ai") return { ok: true, task: written, adjustments: [] };
-  const mode = modeFor(write, written, moved);
+  if (written.type !== "ai" && written.type !== "delegated") return { ok: true, task: written, adjustments: [] };
+  const mode = written.type === "delegated" ? { ok: true, mode: void 0 } : modeFor(write, written, moved);
   if (!mode.ok) return { ok: false, field: "taskMode", error: mode.error };
   const model = live ? { ok: true, assignment: written.assignedModel } : modelFor(write, moved);
   if (!model.ok) return { ok: false, field: "assignedModel", error: model.error };
@@ -578,6 +794,7 @@ function loopErrors(tasks) {
     const fail = (message) => errors.push({ taskId: check.id, field: "loop", message: `${where} ${message}` });
     if (parent) fail(`has a "loop", but only a top-level task can be a loop's check`);
     if (check.type === "user") fail("is a manual task, so it cannot be a loop's check: a check is an AI task, which reports through task_complete, or a script task, whose exit status decides");
+    if (check.type === "delegated") fail("is a delegated task, so it cannot be a loop's check: a round would start a new child on what is left of its budget. Add a check that depends on it, and put the loop on that");
     if (check.subtasks?.length) fail("is a loop's check, which has no subtasks: each round runs it again whole");
     if (!isRoundCount(loop.maxRounds)) fail(roundsMessage(loop.maxRounds));
     if (!Array.isArray(loop.body) || loop.body.length === 0) fail('has a "loop" with an empty "body": name the tasks that fix what it finds');
@@ -610,6 +827,7 @@ function loopErrors(tasks) {
       bodyOwner.set(id, check);
       if (body.loop) fail(`names "${body.title}" in its loop's "body", which has a loop of its own: a loop has no loop inside its body`);
       if (body.type === "user") fail(`names manual task "${body.title}" in its loop's "body": a body is AI or script tasks, which Ordewell runs again each round`);
+      if (body.type === "delegated") fail(`names delegated task "${body.title}" in its loop's "body": a round would start a new child on what is left of its budget`);
       if (body.subtasks?.length) fail(`names "${body.title}" in its loop's "body", which has subtasks: each round runs a body task again whole, so make each step a task of the body`);
     }
   }
@@ -653,6 +871,28 @@ function notOnAScript(raw) {
     return value !== void 0 && value !== null && value !== false && !(Array.isArray(value) && value.length === 0);
   });
 }
+function notOnADelegated(raw) {
+  return NOT_A_DELEGATED_TASKS_FIELDS.filter((f) => {
+    const value = raw[f];
+    return value !== void 0 && value !== null && value !== false && !(Array.isArray(value) && value.length === 0);
+  });
+}
+function delegatedFields(raw, base) {
+  const list = (value) => Array.isArray(value) ? value.map(String) : void 0;
+  const goal = text(raw.goal) ?? base.goal;
+  const budget = (isRecord(raw.budget) ? raw.budget : void 0) ?? base.budget;
+  const grants = list(raw.grants) ?? base.grants;
+  const protectedPaths = list(raw.protectedPaths) ?? base.protectedPaths;
+  const scope = (isRecord(raw.scope) ? raw.scope : void 0) ?? base.scope;
+  return {
+    ...goal !== void 0 ? { goal } : {},
+    ...budget ? { budget } : {},
+    ...grants ? { grants } : {},
+    ...protectedPaths ? { protectedPaths } : {},
+    ...scope ? { scope } : {},
+    ...raw.readOnly === true || raw.readOnly === void 0 && base.readOnly ? { readOnly: true } : {}
+  };
+}
 function notOnAScriptMessage(fields) {
   return `is a script task, which runs its "commands" or "script" with no model: leave out ${fields.map((f) => `"${f}"`).join(", ")}`;
 }
@@ -710,27 +950,35 @@ function plannedTask(spec, catalog, at = {}) {
   const plannerId = text(raw.id);
   const id = freshIds || !plannerId ? newId() : plannerId;
   if (freshIds && plannerId) renamed.set(plannerId, id);
-  const type = raw.type === "user" || raw.type === "ai" || raw.type === "script" ? raw.type : base.type ?? "ai";
+  const delegating = catalog.delegationRefusal === null;
+  const type = raw.type === "user" || raw.type === "ai" || raw.type === "script" || raw.type === "delegated" ? raw.type : base.type ?? "ai";
   const ai = type === "ai";
   const script = type === "script";
+  const delegated = type === "delegated";
+  const sealedScript = script && (catalog.sealsScripts?.({ ...Array.isArray(raw.commands) ? { commands: raw.commands } : {}, ...typeof raw.script === "string" ? { script: raw.script } : {}, ...typeof raw.timeoutMs === "number" ? { timeoutMs: raw.timeoutMs } : {} }) === true || delegating && raw.readOnly === true);
   const assignedRunner = text(raw.assignedRunner) ?? base.assignedRunner ?? catalog.runners[0] ?? DEFAULT_RUNNERS[0];
   const description = text(raw.description) ?? base.description ?? title;
-  const notScripts = script ? notOnAScript(raw) : [];
+  const notScripts = script ? notOnAScript(raw).filter((f) => !(sealedScript && f === "readOnly")) : [];
   if (notScripts.length > 0) errors.push({ taskId: id, field: notScripts[0], message: `${where} ${notOnAScriptMessage(notScripts)}` });
+  if (delegated) {
+    if (!delegating) errors.push({ taskId: id, field: "type", message: catalog.delegationRefusal ?? `${where} is a delegated task, and ${DELEGATION_UNAVAILABLE}.` });
+    const extra = notOnADelegated(raw);
+    if (extra.length > 0) errors.push({ taskId: id, field: extra[0], message: `${where} ${notOnADelegatedMessage(extra)}` });
+  }
   const body = bodyFields(raw, base);
   const shapeErrors = scriptBodyErrors({ type, ...body.raw }).filter((e) => body.malformed.has(e.field));
   for (const e of shapeErrors) errors.push({ taskId: id, field: e.field, message: `${where} ${e.message}` });
   const loop = loopSpec(raw.loop);
   if ("error" in loop) errors.push({ taskId: id, field: "loop", message: `${where} ${loop.error}` });
   if (raw.ops === true && !ai && !script) errors.push({ taskId: id, field: "ops", message: `${where} ${opsPlacementRefusal(type, !!parent)}` });
-  if (raw.taskMode !== void 0 && !script) ignored.push({ taskId: id, field: "taskMode", message: `${where}: ${MODE_NOT_THE_PLANNERS}` });
+  if (raw.taskMode !== void 0 && !script && !delegated) ignored.push({ taskId: id, field: "taskMode", message: `${where}: ${MODE_NOT_THE_PLANNERS}` });
   if (type === "user" && raw.readOnly === true) ignored.push({ taskId: id, field: "readOnly", message: `${where}: ${MANUAL_NOT_READ_ONLY}` });
   const ops = raw.ops !== void 0 ? raw.ops === true : base.ops;
   if (ai && ops && raw.readOnly === true) ignored.push({ taskId: id, field: "readOnly", message: `${where}: ${OPS_NOT_READ_ONLY}` });
   const asked = typeof raw.readOnly === "boolean" ? raw.readOnly : void 0;
   const readOnly = ai && !ops && (asked ?? from?.readOnly ?? parent?.readOnly ?? false);
   if (raw.research !== void 0 && typeof raw.research !== "boolean") errors.push({ taskId: id, field: "research", message: `${where}: "research" must be a boolean` });
-  const assignedModel = ai ? modelOf(raw, base.assignedModel) : void 0;
+  const assignedModel = ai || delegated ? modelOf(raw, base.assignedModel) : void 0;
   const slice = (value) => value === "AFK" || value === "HITL" ? value : void 0;
   const autonomy = ai ? slice(raw.autonomy) ?? base.autonomy ?? parent?.autonomy : void 0;
   const sliceType = slice(raw.sliceType) ?? base.sliceType ?? (ai ? parent?.sliceType : void 0);
@@ -753,7 +1001,7 @@ function plannedTask(spec, catalog, at = {}) {
     type,
     dependencies: Array.isArray(raw.dependencies) ? raw.dependencies.map(String) : base.dependencies ?? [],
     // What a merge or split carries over for a runner is nothing a script runs.
-    prompt: script ? void 0 : text(raw.prompt) || base.prompt || (ai ? description || title || void 0 : void 0),
+    prompt: script || delegated ? void 0 : text(raw.prompt) || base.prompt || (ai ? description || title || void 0 : void 0),
     userSteps: Array.isArray(raw.userSteps) ? raw.userSteps.map((s) => isRecord(s) ? s : {}).map((s) => ({ order: Number(s.order ?? 0), instruction: String(s.instruction ?? ""), completed: false })) : base.userSteps,
     subtasks,
     assignedModel,
@@ -761,15 +1009,17 @@ function plannedTask(spec, catalog, at = {}) {
     autonomy,
     sliceType,
     userStoriesCovered: Array.isArray(raw.userStoriesCovered) ? raw.userStoriesCovered.map(String) : base.userStoriesCovered,
-    ops: script ? void 0 : ops,
+    ops: script || delegated ? void 0 : ops,
     research: typeof raw.research === "boolean" ? raw.research : base.research,
-    skills: script ? void 0 : from ? inheritedSkills(raw.skills, base.skills) : skillNames(raw.skills),
+    skills: script || delegated ? void 0 : from ? inheritedSkills(raw.skills, base.skills) : skillNames(raw.skills),
     ...body.fields,
-    ..."loop" in loop && loop.loop ? { loop: loop.loop } : {}
+    ..."loop" in loop && loop.loop ? { loop: loop.loop } : {},
+    ...delegated ? delegatedFields(raw, base) : {},
+    ...sealedScript ? { readOnly: true } : {}
   };
-  let taskMode = script ? void 0 : base.taskMode;
+  let taskMode = script || delegated ? void 0 : base.taskMode;
   let landedModel = assignedModel;
-  if (ai && catalog.runners.includes(assignedRunner)) {
+  if ((ai || delegated) && catalog.runners.includes(assignedRunner)) {
     const resolved = resolveAssignment({
       writer: catalog.models ? "edit" : "plan",
       task: { ...createTask(fields), taskMode },
@@ -780,7 +1030,7 @@ function plannedTask(spec, catalog, at = {}) {
     if (!resolved.ok) {
       errors.push({ taskId: id, field: resolved.field === "taskMode" ? "readOnly" : resolved.field, message: `${where}: ${resolved.error}` });
     } else {
-      taskMode = resolved.task.taskMode;
+      taskMode = delegated ? void 0 : resolved.task.taskMode;
       landedModel = resolved.task.assignedModel;
       adjustments.push(...resolved.adjustments);
     }
@@ -792,13 +1042,13 @@ function plannedTask(spec, catalog, at = {}) {
 }
 function checkPlanRunners(tasks, runners) {
   if (!runners) return [];
-  return flattenTasksWithParents(tasks).filter(({ task: t }) => t.type === "ai" && !runners.includes(t.assignedRunner)).map(({ task: t, parent }) => ({
+  return flattenTasksWithParents(tasks).filter(({ task: t }) => (t.type === "ai" || t.type === "delegated") && !runners.includes(t.assignedRunner)).map(({ task: t, parent }) => ({
     taskId: t.id,
     field: "assignedRunner",
     message: `${taskWhere(t.title, parent?.title)} has invalid assignedRunner "${t.assignedRunner}". Expected one of: ${runners.join(", ")}`
   }));
 }
-function checkPlanInvariants(tasks, runners, runnerModes) {
+function checkPlanInvariants(tasks, runners, runnerModes, delegation = {}) {
   const rows = flattenTasksWithParents(tasks);
   const errors = [];
   const seen = /* @__PURE__ */ new Set();
@@ -827,6 +1077,10 @@ function checkPlanInvariants(tasks, runners, runnerModes) {
       const extra = notAScriptsFields(t);
       if (extra.length > 0) fail(extra[0], `${where} ${notOnAScriptMessage(extra)}`);
     }
+    if (t.type === "delegated") {
+      if (parent !== null) fail("type", `${where} is a delegated task: only a top-level task can be delegated`);
+      if (t.subtasks?.length) fail("subtasks", `${where} is a delegated task, which has no subtasks: its child plan's tasks are its child's own`);
+    }
     for (const e of scriptBodyErrors(t)) fail(e.field, `${where} ${e.message}`);
     if (t.ops && t.taskMode !== void 0 && t.taskMode === taggedReadOnlyMode(runnerModes?.[t.assignedRunner])) {
       fail("taskMode", `${where} is an ops task, which acts in the workspace, so it cannot use the read-only profile`);
@@ -834,6 +1088,7 @@ function checkPlanInvariants(tasks, runners, runnerModes) {
   }
   errors.push(...checkPlanRunners(tasks, runners));
   errors.push(...loopErrors(tasks));
+  errors.push(...delegationErrors(tasks, { ...runnerModes ? { runnerModes } : {}, ...delegation }));
   for (const { task: t, parent } of rows) {
     for (const error of dependencyTargetErrors(tasks, t.id, t.dependencies.filter((id) => id !== t.id))) {
       errors.push({ taskId: t.id, field: "dependencies", message: `${taskWhere(t.title, parent?.title)}: ${error}` });
@@ -883,7 +1138,7 @@ function parsePlanObject(json, raw, runners, runnerModes, autonomousDefault = fa
   const [first] = result.errors;
   throw new PlanParseError(first.message, raw, { semantic: first.taskId !== void 0 });
 }
-function validatePlanTasks(obj, runners, runnerModes, autonomousDefault = false) {
+function validatePlanTasks(obj, runners, runnerModes, autonomousDefault = false, delegation = {}) {
   const rawTasks = isRecord2(obj) ? obj.tasks : void 0;
   if (!Array.isArray(rawTasks)) {
     return { ok: false, errors: [{ field: "tasks", message: "Invalid plan: missing tasks array" }] };
@@ -891,7 +1146,7 @@ function validatePlanTasks(obj, runners, runnerModes, autonomousDefault = false)
   if (rawTasks.length === 0) {
     return { ok: false, errors: [{ field: "tasks", message: "Plan contained no tasks" }] };
   }
-  const planned = rawTasks.map((t) => plannedTask(t, { runners, runnerModes, autonomousDefault }));
+  const planned = rawTasks.map((t) => plannedTask(t, { runners, runnerModes, autonomousDefault, ...delegation }));
   const tasks = planned.map((p) => p.task);
   const errors = [
     ...sliceRequired(tasks),
@@ -902,7 +1157,8 @@ function validatePlanTasks(obj, runners, runnerModes, autonomousDefault = false)
   const ignored = planned.flatMap((p) => p.ignored);
   const warnings = [
     ...ignored.some((i) => i.field === "taskMode") ? [`"taskMode" is not yours to set and was ignored: each task runs in its runner's mode for the user's autonomy level, or its read-only mode when you set "readOnly": true.`] : [],
-    ...ignored.filter((i) => i.field === "readOnly").map((i) => `${i.message}: it was ignored.`)
+    ...ignored.filter((i) => i.field === "readOnly").map((i) => `${i.message}: it was ignored.`),
+    ...scopeOverlaps(tasks)
   ];
   return warnings.length > 0 ? { ok: true, tasks, warnings } : { ok: true, tasks };
 }