@piagent/platform 1.2.17 → 1.3.0-ie.9

package/packages/piagent-core/runtime/hooks/session-start-hook.ts

@@ -2,20 +2,30 @@ import path from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import { contextIndexV2Status } from "../../extensions/context-engine.js";
+import { resolveExecutionBackend } from "../../extensions/execution-backend.js";
 import type { ProjectProfile, TaskContract } from "../../extensions/guard-types.js";
 import { pruneCaptureFiles } from "../../extensions/state-retention.js";
-import { migrateTaskState } from "../../extensions/task-state.js";
+import { migrateTaskState, readSessionTaskBinding } from "../../extensions/task-state.js";
+import {
+  pruneTaskJournal
+} from "../../extensions/task-journal.js";
 import {
   CAPTURE_RETENTION_MAX_AGE_MS,
   CAPTURE_RETENTION_MAX_BYTES,
-  CAPTURE_RETENTION_MAX_FILES
+  CAPTURE_RETENTION_MAX_FILES,
+  TASK_JOURNAL_MAX_EVENTS
 } from "../runtime-limits.ts";
 import { currentSessionName, hasOperatorSessionName } from "../session/message-signals.ts";
 import { RuntimeSessionState } from "../session/runtime-state.ts";
 import { buildContextPreflight, buildUsageSnapshot } from "../session/usage.ts";
 import { toolResultCaptureRoot } from "../session/tool-result-compaction.ts";
+import { ensureTaskAuthorityResumePolicy } from "../policy/authority-resume-policy.ts";
+import { buildHandoffProjection, writeHandoffProjection } from "../recovery/handoff-projection.ts";
 import { activeTaskToolGroups } from "../tools/tool-groups.ts";
 import type { PiagentToolGroup } from "../tools/tool-groups.ts";
+import { observeTrajectorySync } from "../trajectory/trajectory-observability.ts";
+import type { TrajectorySyncResult } from "../trajectory/trajectory-runtime.ts";
+import type { ResumeState } from "../recovery/resume-state.ts";
 
 type SessionTaskReference = { taskId?: string; taskRunId?: string };
 
@@ -27,6 +37,7 @@ type SessionStartHookDependencies = {
   taskReference: (ctx: ExtensionContext) => SessionTaskReference | undefined;
   activeTask: (cwd: string, sessionId: string) => TaskContract | undefined;
   resolveTask: (cwd: string, reference: string, sessionId: string) => TaskContract | undefined;
+  resolveTaskAny: (cwd: string, reference: string) => TaskContract | undefined;
   bindTask: (cwd: string, sessionId: string, sessionName: string | undefined, task: TaskContract) => unknown;
   writeTask: (cwd: string, task: TaskContract) => TaskContract;
   capabilityState: (ctx: ExtensionContext) => { ok: boolean; reason?: string; repinned?: string };
@@ -35,7 +46,10 @@ type SessionStartHookDependencies = {
   mcpReadinessNotice: (cwd: string) => string | undefined;
   updateAvailabilityNotice: () => string | undefined;
   contextExcludePatterns: (profile: ProjectProfile) => string[];
+  inspectResume: (cwd: string, task: TaskContract, sessionId: string) => ResumeState;
   telemetry: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
+  syncTrajectory?: (ctx: ExtensionContext, task: TaskContract) => TrajectorySyncResult;
+  afterStart?: (ctx: ExtensionContext) => void;
 };
 
 export function registerSessionStartHook(pi: ExtensionAPI, dependencies: SessionStartHookDependencies): void {
@@ -51,6 +65,7 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
     const sessionId = ctx.sessionManager.getSessionId();
     const sessionName = currentSessionName(ctx);
     const taskReference = dependencies.taskReference(ctx);
+    const activeTaskRunId = readSessionTaskBinding(ctx.cwd, sessionId)?.activeTaskRunId ?? taskReference?.taskRunId;
     let captureRetention: Record<string, unknown>;
     try {
       captureRetention = pruneCaptureFiles(toolResultCaptureRoot(ctx.cwd), {
@@ -64,28 +79,99 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
       captureRetention = { removed: 0, kept: 0, bytes: 0, error: message };
       ctx.ui.notify(`Piagent local state needs recovery: ${message}`, "warning");
     }
+    let taskJournalRetention: Record<string, unknown>;
+    try {
+      taskJournalRetention = pruneTaskJournal(ctx.cwd, { maxEvents: TASK_JOURNAL_MAX_EVENTS });
+      const corruptions = Array.isArray(taskJournalRetention.corruptions) ? taskJournalRetention.corruptions : [];
+      if (corruptions.length > 0) ctx.ui.notify(`Piagent task journal needs recovery: ${corruptions[0]}`, "warning");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      taskJournalRetention = { pruned: 0, kept: 0, error: message };
+      ctx.ui.notify(`Piagent task journal needs recovery: ${message}`, "warning");
+    }
 
     const migration = migrateTaskState(ctx.cwd, {
       sessionId,
       sessionName,
-      taskId: taskReference?.taskId
+      taskId: taskReference?.taskId,
+      taskRunId: activeTaskRunId
     });
     if (migration.warnings.length > 0) {
       ctx.ui.notify(`Piagent task-state migration needs recovery: ${migration.warnings.join("; ")}`, "warning");
     }
     let resumedTask = dependencies.activeTask(ctx.cwd, sessionId);
+    let identityConflict: string | undefined;
     if (!resumedTask && taskReference) {
       resumedTask = dependencies.resolveTask(ctx.cwd, taskReference.taskRunId ?? taskReference.taskId ?? "", sessionId);
       if (resumedTask) dependencies.bindTask(ctx.cwd, sessionId, sessionName, resumedTask);
+      else {
+        const referenced = dependencies.resolveTaskAny(ctx.cwd, taskReference.taskRunId ?? taskReference.taskId ?? "");
+        if (referenced && referenced.sessionId !== sessionId) {
+          identityConflict = `Task ${referenced.taskRunId} belongs to session ${referenced.sessionId}; resume into ${sessionId} was refused.`;
+          ctx.ui.notify(`Piagent task recovery is blocked: ${identityConflict}`, "warning");
+        }
+      }
+    }
+    const authorityPolicy = resumedTask?.trace.outcome === "pending"
+      ? ensureTaskAuthorityResumePolicy(ctx.cwd, resumedTask, {
+        authorityProfile: profile.authorityProfile,
+        environment: process.env
+      })
+      : undefined;
+    if (resumedTask?.trace.outcome === "pending" && authorityPolicy?.disposition === "new-attempt-required") {
+      try {
+        writeHandoffProjection(ctx.cwd, buildHandoffProjection(ctx.cwd, resumedTask, {
+          gate: {
+            decision: "fail",
+            missing: [`authority policy handoff: ${authorityPolicy.reason}`],
+            missingVerifyCommands: []
+          },
+          recovery: null
+        }));
+        dependencies.activateToolGroups(ctx, ["intake"]);
+      } catch (error) {
+        ctx.ui.notify(`Piagent authority-policy handoff could not be written: ${error instanceof Error ? error.message : String(error)}`, "warning");
+      }
     }
-    if (resumedTask && resumedTask.sessionName !== sessionName) {
+    if (resumedTask?.trace.outcome === "pending" && authorityPolicy?.disposition === "resume-pinned" && resumedTask.sessionName !== sessionName) {
       resumedTask.sessionName = sessionName;
       resumedTask = dependencies.writeTask(ctx.cwd, resumedTask);
       dependencies.bindTask(ctx.cwd, sessionId, sessionName, resumedTask);
     }
+    if (resumedTask?.workingTreeDigestMigration && resumedTask.workingTreeDigestMigration.status !== "refreshed") dependencies.state.clearDigestMigrationState(ctx, resumedTask.taskRunId, resumedTask.taskId);
     dependencies.state.cacheTaskIdentity(ctx, resumedTask);
+    const resumeState = resumedTask ? dependencies.inspectResume(ctx.cwd, resumedTask, sessionId) : undefined;
+    if (resumeState) dependencies.state.rememberResumeState(resumeState);
+    if (resumedTask && resumeState?.enforcementSafe) observeTrajectorySync(ctx, dependencies.syncTrajectory?.(ctx, resumedTask), dependencies.telemetry);
+    let taskRecovery: Record<string, unknown> | undefined;
     if (resumedTask?.trace.outcome === "pending") {
-      dependencies.activateToolGroups(ctx, activeTaskToolGroups(resumedTask));
+      taskRecovery = {
+        decision: resumeState?.decision ?? "blocked",
+        retryAllowed: resumeState?.decision === "retry",
+        checkpointId: resumeState?.latestCheckpoint?.checkpointId,
+        reason: resumeState?.reason ?? "Resume state unavailable.",
+        checkpoints: resumeState?.journal.checkpoints ?? 0,
+        corruptions: resumeState?.journal.corruptions.length ?? 0,
+        currentTreeDigest: resumeState?.currentTreeDigest,
+        verifierEvidenceCurrent: resumeState?.verifierEvidenceCurrent,
+        staleVerifierEvidence: resumeState?.staleVerifierEvidence,
+        phase: resumeState?.phase,
+        handoff: resumeState?.handoff,
+        reconstruction: resumeState?.reconstruction,
+        authorityPolicy: resumeState?.authorityPolicy
+      };
+      if (resumeState?.enforcementSafe) dependencies.activateToolGroups(ctx, activeTaskToolGroups(resumedTask));
+      if (resumeState?.decision === "blocked") {
+        ctx.ui.notify(`Piagent task recovery is blocked: ${resumeState.reason}`, "warning");
+      } else if (resumeState?.decision === "paused") {
+        ctx.ui.notify(`Piagent task remains paused at ${resumeState.latestCheckpoint?.checkpointId ?? "its latest checkpoint"}.`, "warning");
+      } else if (resumeState?.decision === "retry") {
+        ctx.ui.notify(`Piagent task can retry from ${resumeState.latestCheckpoint?.checkpointId ?? "its latest checkpoint"}.`, "info");
+      } else if (resumeState?.staleVerifierEvidence) {
+        ctx.ui.notify("Piagent resumed the task, but the working tree changed; prior verifier evidence is stale and must be rerun exactly.", "warning");
+      }
+    } else if (identityConflict) {
+      taskRecovery = { decision: "blocked", retryAllowed: false, reason: identityConflict, identityConflict: true };
     }
 
     const profileHint = explicitProfile || (projectTrusted && dependencies.projectProfileExists(ctx.cwd))
@@ -95,6 +181,7 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
     const preflight = buildContextPreflight(snapshot, "task", 0);
     const capabilityState = dependencies.capabilityState(ctx);
     const permissionProfile = dependencies.permissionProfile(ctx, profile);
+    const executionBackend = resolveExecutionBackend();
     const contextHint = preflight.recommendation === "fresh-session"
       ? " Context is high; use /fresh task or /fresh scout for new work."
       : preflight.recommendation === "compact"
@@ -111,6 +198,7 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
     const legacyWarning = dependencies.legacyProjectWarning(ctx.cwd);
     if (legacyWarning) ctx.ui.notify(legacyWarning, "warning");
     if (permissionProfile.warning) ctx.ui.notify(permissionProfile.warning, "warning");
+    if (executionBackend.warning) ctx.ui.notify(executionBackend.warning, "warning");
     if (permissionProfile.mode === "trusted-full-access") {
       ctx.ui.notify("Piagent permission profile trusted-full-access is active; protected paths, secret redaction, and destructive/external confirmations remain enforced.", "warning");
     }
@@ -134,7 +222,11 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
       taskMigration: migration,
       taskId: resumedTask?.taskId,
       taskRunId: resumedTask?.taskRunId,
-      captureRetention
+      captureRetention,
+      taskJournalRetention,
+      taskRecovery,
+      executionBackend
     });
+    dependencies.afterStart?.(ctx);
   });
 }

package/packages/piagent-core/runtime/hooks/tool-call-hook.ts

@@ -0,0 +1,93 @@
+import crypto from "node:crypto";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import { toolResultFingerprint } from "../../extensions/context-engine.js";
+import { observeTrajectorySync } from "../trajectory/trajectory-observability.ts";
+import type { TrajectorySyncResult } from "../trajectory/trajectory-runtime.ts";
+
+type ToolCallEvent = {
+  toolCallId?: string;
+  toolName: string;
+  input?: unknown;
+};
+
+type ToolCallDecision = { block: true; reason: string } | void | undefined;
+
+type ToolCallHookDependencies = {
+  beforeAuthorize?: (event: ToolCallEvent, ctx: ExtensionContext) => Promise<ToolCallDecision> | ToolCallDecision;
+  authorize: (event: ToolCallEvent, ctx: ExtensionContext) => Promise<ToolCallDecision> | ToolCallDecision;
+  reviewBudgetDecision?: (event: ToolCallEvent, ctx: ExtensionContext) => ToolCallDecision;
+  afterDecision?: (
+    event: ToolCallEvent,
+    ctx: ExtensionContext,
+    metadata: { toolCallId: string; allowed: boolean; reason?: string }
+  ) => void;
+  extractLikelyPath: (cwd: string, input: Record<string, unknown>) => string | undefined;
+  redactText: (input: string) => string;
+  telemetry: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
+  activity?: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
+  afterAuthorized?: (
+    event: ToolCallEvent,
+    ctx: ExtensionContext,
+    metadata: { toolCallId: string }
+  ) => TrajectorySyncResult | undefined;
+};
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {};
+}
+
+export function registerToolCallHook(pi: ExtensionAPI, dependencies: ToolCallHookDependencies): void {
+  pi.on("tool_call", async (event, ctx) => {
+    const typedEvent = event as ToolCallEvent;
+    const input = asRecord(typedEvent.input);
+    const callFingerprint = toolResultFingerprint(typedEvent.toolName, input, []);
+    const target = dependencies.extractLikelyPath(ctx.cwd, input);
+    const toolCallId = typedEvent.toolCallId ?? callFingerprint.key;
+    const resolvedEvent = { ...typedEvent, toolCallId };
+    const command = typeof input.command === "string"
+      ? input.command
+      : typeof input.cmd === "string"
+        ? input.cmd
+        : undefined;
+    const record = dependencies.activity ?? dependencies.telemetry;
+    const recordedAt = new Date().toISOString();
+    record(ctx, {
+      activityId: `call:${toolCallId}`,
+      event: "tool_call",
+      recordedAt,
+      toolCallId,
+      toolName: typedEvent.toolName,
+      inputHash: callFingerprint.inputHash,
+      targetHash: target ? crypto.createHash("sha256").update(target).digest("hex") : undefined,
+      targetPath: target ? dependencies.redactText(target) : undefined,
+      command: command ? dependencies.redactText(command) : undefined
+    });
+    const preparationDecision = await dependencies.beforeAuthorize?.(resolvedEvent, ctx);
+    const authorizationDecision = preparationDecision && typeof preparationDecision === "object" && preparationDecision.block
+      ? preparationDecision
+      : await dependencies.authorize(resolvedEvent, ctx);
+    const decision = authorizationDecision && typeof authorizationDecision === "object" && authorizationDecision.block
+      ? authorizationDecision
+      : dependencies.reviewBudgetDecision?.(resolvedEvent, ctx);
+    const blockedDecision = decision && typeof decision === "object" ? decision : undefined;
+    record(ctx, {
+      activityId: `decision:${toolCallId}`,
+      event: "tool_decision",
+      recordedAt: new Date().toISOString(),
+      toolCallId,
+      toolName: typedEvent.toolName,
+      targetPath: target ? dependencies.redactText(target) : undefined,
+      command: command ? dependencies.redactText(command) : undefined,
+      decision: blockedDecision?.block ? "blocked" : "allowed",
+      reason: blockedDecision?.reason ? dependencies.redactText(blockedDecision.reason) : undefined
+    });
+    if (!blockedDecision?.block) {
+      observeTrajectorySync(ctx, dependencies.afterAuthorized?.(resolvedEvent, ctx, { toolCallId }), dependencies.telemetry);
+    }
+    dependencies.afterDecision?.(resolvedEvent, ctx, { toolCallId, allowed: !blockedDecision?.block, reason: blockedDecision?.reason });
+    return decision;
+  });
+}

package/packages/piagent-core/runtime/hooks/tool-result-hook.ts

@@ -3,34 +3,30 @@ import { fileURLToPath } from "node:url";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import { toolResultFingerprint } from "../../extensions/context-engine.js";
+import type { TaskContract } from "../../extensions/guard-types.ts";
 import { matchesProtectedPath } from "../../extensions/policy-core.js";
+import { changedSnapshotFiles, taskDeltaFilesFromSnapshot } from "../../extensions/task-contract-view.js";
+import { classifyVerificationFailure } from "../../extensions/verification-intelligence.js";
 import { redactForStorage, redactSensitiveText } from "../../extensions/redaction-core.js";
-import {
-  appendObservedBashResult,
-  observedBashResultFromToolResultEvent
-} from "../../extensions/runtime-evidence.js";
-import {
-  attachToolResultCompactionDetails,
-  compactToolResultDetails,
-  compactToolResultTextContent
-} from "../session/tool-result-compaction.ts";
-import type { ToolResultCaptureSummary } from "../session/tool-result-compaction.ts";
-import { RuntimeSessionState } from "../session/runtime-state.ts";
-import type { ObservedTaskContext } from "../session/runtime-state.ts";
-
-type ToolResultEvent = {
-  toolName: string;
-  input?: unknown;
-  content?: unknown;
-  details?: unknown;
-  isError?: boolean;
-  usage?: unknown;
-};
+import { appendObservedBashResult, hashEvidenceCommand, observedBashResultFromToolResultEvent } from "../../extensions/runtime-evidence.js";
+import { workingTreeSnapshot, workingTreeSnapshotHasUnavailableEvidence } from "../../extensions/task-state.js";
+import { workingTreeObservation } from "../../extensions/working-tree-digest.js";
+import { boundedGitDiffReview } from "../quality/performance-assurance.ts";
+import { currentFileContentDigests } from "../quality/model-mutation-proof.ts";
+import { boundedPerformanceReviewResultText } from "../quality/performance-review-evidence.ts";
+import { attachToolResultCompactionDetails, compactToolResultDetails, compactToolResultTextContent, type ToolResultCaptureSummary } from "../session/tool-result-compaction.ts";
+import { RuntimeSessionState, type ObservedTaskContext } from "../session/runtime-state.ts";
+import { observeTrajectorySync } from "../trajectory/trajectory-observability.ts";
+import type { TrajectorySyncResult } from "../trajectory/trajectory-runtime.ts";
 
+type ToolResultEvent = { toolCallId?: string; toolName: string; input?: unknown; content?: unknown; details?: unknown; isError?: boolean; usage?: unknown };
 type ObservedBashResult = NonNullable<ReturnType<typeof observedBashResultFromToolResultEvent>>;
+type ObservedVerificationResult = ObservedBashResult & { outputText?: string };
+type WorkingTreeObservation = ReturnType<typeof workingTreeObservation>;
 
 type ToolResultHookDependencies = {
   state: RuntimeSessionState;
+  activeTask: (ctx: ExtensionContext) => TaskContract | undefined;
   maxManifestFiles: number;
   readProtectedPaths: (ctx: ExtensionContext) => string[];
   recordObservedBash: (observed: ObservedBashResult) => void;
@@ -47,19 +43,34 @@ type ToolResultHookDependencies = {
     event: ToolResultEvent,
     pendingContext: ObservedTaskContext[],
     maxManifestFiles: number,
-    shellSnapshotBefore?: Record<string, string>
+    shellSnapshotBefore?: Record<string, string>, eventTree?: WorkingTreeObservation
   ) => unknown;
   recordObservedTaskVerification: (
     pi: ExtensionAPI,
     ctx: ExtensionContext,
-    observed: ObservedBashResult,
+    observed: ObservedVerificationResult,
     pendingContext: ObservedTaskContext[],
-    maxManifestFiles: number
+    maxManifestFiles: number, shellSnapshotBefore?: Record<string, string>, eventTree?: WorkingTreeObservation
   ) => unknown;
   extractLikelyPath: (cwd: string, input: Record<string, unknown>) => string | undefined;
+  mutationTargets: (cwd: string, toolName: string, input: Record<string, unknown>) => string[];
   isShellTool: (toolName: string) => boolean;
   telemetry: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
+  activity?: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
   now: () => string;
+  completeSemanticRepair?: (
+    ctx: ExtensionContext,
+    event: ToolResultEvent,
+    metadata: {
+      toolCallId: string;
+      success: boolean;
+      exitCode: number;
+      currentWorkingTreeDigest: string;
+      changedPaths: string[];
+      retryableFailure: boolean; correctiveFailure: boolean;
+    }
+  ) => TrajectorySyncResult | undefined;
+  syncTrajectory?: (ctx: ExtensionContext, contextObserved: boolean) => TrajectorySyncResult | undefined;
 };
 
 function normalizeRelative(cwd: string, candidate: unknown): string | undefined {
@@ -88,6 +99,45 @@ function isPlainRecord(value: unknown): value is Record<string, unknown> {
   return prototype === Object.prototype || prototype === null;
 }
 
+function numericExitCode(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isInteger(value)) return value;
+  if (typeof value === "string" && /^-?\d+$/.test(value.trim())) return Number.parseInt(value, 10);
+  return undefined;
+}
+
+function successfulToolResult(event: ToolResultEvent): boolean {
+  if (event.isError === true) return false;
+  const details = isPlainRecord(event.details) ? event.details : {};
+  const exitCode = numericExitCode(details.exitCode ?? details.status);
+  return exitCode === undefined || exitCode === 0;
+}
+
+function boundedToolResultText(content: unknown): string {
+  const text = typeof content === "string"
+    ? content
+    : Array.isArray(content)
+      ? content
+          .filter((block) => block && typeof block === "object" && (block as { type?: unknown }).type === "text")
+          .map((block) => String((block as { text?: unknown }).text ?? ""))
+          .join("\n")
+      : "";
+  return text.slice(-20_000);
+}
+
+function patchLineStats(details: unknown): { additions?: number; deletions?: number } {
+  if (!details || typeof details !== "object") return {};
+  const patch = (details as Record<string, unknown>).patch;
+  if (typeof patch !== "string" || !patch.trim()) return {};
+  let additions = 0;
+  let deletions = 0;
+  for (const line of patch.split(/\r?\n/)) {
+    if (line.startsWith("+++ ") || line.startsWith("--- ")) continue;
+    if (line.startsWith("+")) additions += 1;
+    else if (line.startsWith("-")) deletions += 1;
+  }
+  return { additions, deletions };
+}
+
 function countChangedStringLeaves(before: unknown, after: unknown): number {
   if (typeof before === "string" && typeof after === "string") return before === after ? 0 : 1;
   if (Array.isArray(before) && Array.isArray(after)) {
@@ -188,6 +238,8 @@ export function filterProtectedPathListContent(
 
 export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResultHookDependencies): void {
   pi.on("tool_result", async (event, ctx) => {
+    const taskIdentity = dependencies.state.taskIdentity(ctx);
+    const resultToolCallId = event.toolCallId ?? toolResultFingerprint(event.toolName, event.input, []).key;
     const readProtectedPaths = dependencies.readProtectedPaths(ctx);
     const observed = observedBashResultFromToolResultEvent(event, ctx.cwd);
     if (observed) {
@@ -209,10 +261,129 @@ export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResul
     const shellSnapshotBefore = dependencies.isShellTool(event.toolName)
       ? dependencies.state.consumeShellMutationSnapshot(ctx, event.toolName, event.input)
       : undefined;
-    dependencies.recordObservedTaskChanges(pi, ctx, event, pendingContext, dependencies.maxManifestFiles, shellSnapshotBefore);
+    const currentTask = dependencies.activeTask(ctx);
+    const eventTree = currentTask
+      ? workingTreeObservation(workingTreeSnapshot(ctx.cwd) as Record<string, string>)
+      : undefined;
+    dependencies.recordObservedTaskChanges(pi, ctx, event, pendingContext, dependencies.maxManifestFiles, shellSnapshotBefore, eventTree);
     if (observed) {
-      dependencies.recordObservedTaskVerification(pi, ctx, observed, pendingContext, dependencies.maxManifestFiles);
+      dependencies.recordObservedTaskVerification(
+        pi,
+        ctx,
+        { ...observed, outputText: boundedToolResultText(event.content) },
+        pendingContext,
+        dependencies.maxManifestFiles, shellSnapshotBefore, eventTree
+      );
+    }
+
+    const normalizedToolName = String(event.toolName ?? "").toLowerCase();
+    const directMutationTool = ["edit", "write", "apply_patch"].includes(normalizedToolName);
+    const directMutationTargets = directMutationTool
+      ? dependencies.mutationTargets(ctx.cwd, event.toolName, isPlainRecord(event.input) ? event.input : {})
+      : [];
+    const modelMutationIdentity = taskIdentity
+      ? { ...taskIdentity, sessionId: ctx.sessionManager.getSessionId() }
+      : undefined;
+    const currentSnapshot = taskIdentity ? eventTree?.snapshot : undefined;
+    const currentTreeDigest = taskIdentity ? eventTree?.digest : undefined;
+    const directMutationResult = modelMutationIdentity && currentSnapshot
+      ? dependencies.state.completeAuthorizedModelMutation(
+          modelMutationIdentity,
+          resultToolCallId,
+          successfulToolResult(event),
+          currentSnapshot,
+          currentFileContentDigests(ctx.cwd, directMutationTargets)
+        )
+      : { changedPaths: [] as string[], recordedDigests: {} as Record<string, string> };
+    const shellChangedPaths = taskIdentity && currentSnapshot && shellSnapshotBefore
+      ? changedSnapshotFiles(shellSnapshotBefore, currentSnapshot)
+      : [];
+    if (modelMutationIdentity && shellChangedPaths.length > 0) {
+      dependencies.state.invalidateSuccessfulModelMutationPaths(modelMutationIdentity, shellChangedPaths);
+    }
+    const outputText = boundedToolResultText(event.content);
+    const performanceReviewOutputText = boundedPerformanceReviewResultText(event.content);
+    const observedExitCode = observed?.exitCode
+      ?? numericExitCode(isPlainRecord(event.details) ? event.details.exitCode ?? event.details.status : undefined)
+      ?? (event.isError === true ? 1 : 0);
+    const failure = observedExitCode === 0
+      ? undefined
+      : classifyVerificationFailure(outputText, observedExitCode);
+    const performanceResult = taskIdentity && currentSnapshot && currentTreeDigest
+      ? dependencies.state.completePerformanceReviewTool(taskIdentity.taskRunId, resultToolCallId, {
+          success: successfulToolResult(event),
+          postWorkingTreeDigest: currentTreeDigest,
+          postWorkingTreeSnapshot: currentSnapshot,
+          exitCode: observedExitCode,
+          failure
+        })
+      : "unmatched";
+    const semanticRepairSync = currentTreeDigest
+      ? dependencies.completeSemanticRepair?.(ctx, event, {
+          toolCallId: resultToolCallId,
+          success: successfulToolResult(event),
+          exitCode: observedExitCode,
+          currentWorkingTreeDigest: currentTreeDigest,
+          changedPaths: [...new Set([...directMutationResult.changedPaths, ...shellChangedPaths])].sort(),
+          retryableFailure: failure?.retryable === true, correctiveFailure: failure?.sourceMutationPermission === "eligible-in-scope" && failure?.confidence === "high"
+        })
+      : undefined;
+    observeTrajectorySync(ctx, semanticRepairSync, dependencies.telemetry);
+
+    const checkpointAfterResult = taskIdentity ? dependencies.state.performanceReviewCheckpoint(taskIdentity.taskRunId) : undefined;
+    const unexpectedTreeChange = directMutationResult.changedPaths.length > 0
+      || shellChangedPaths.length > 0
+      || Boolean(checkpointAfterResult && currentTreeDigest && checkpointAfterResult.workingTreeDigest !== currentTreeDigest);
+    if (taskIdentity && performanceResult === "unmatched" && unexpectedTreeChange && dependencies.state.performanceReviewCheckpoint(taskIdentity.taskRunId)) {
+      dependencies.state.invalidatePerformanceReviewCheckpoint(taskIdentity.taskRunId);
+    }
+    const reviewCandidate = currentTask?.trace.outcome === "pending"
+      && currentSnapshot
+      && !workingTreeSnapshotHasUnavailableEvidence(currentSnapshot)
+      && performanceReviewOutputText !== undefined
+      ? boundedGitDiffReview({
+          toolName: event.toolName,
+          input: event.input,
+          changedFiles: taskDeltaFilesFromSnapshot(currentTask, currentSnapshot),
+          outputText: performanceReviewOutputText,
+          authoredFileDigests: modelMutationIdentity && currentSnapshot
+            ? dependencies.state.successfulModelMutationDigests(modelMutationIdentity, currentSnapshot)
+            : undefined,
+          currentFileDigests: currentSnapshot
+        })
+      : undefined;
+    const existingCredit = taskIdentity && currentTreeDigest
+      ? dependencies.state.performanceReviewCredit(taskIdentity.taskRunId, currentTreeDigest)
+      : undefined;
+    const successfulDirectMutation = successfulToolResult(event)
+      && directMutationTool;
+    const shellTreeChanged = shellChangedPaths.length > 0;
+    if (taskIdentity && currentTreeDigest && (reviewCandidate || existingCredit || successfulDirectMutation || shellSnapshotBefore)) {
+      if (shellTreeChanged || directMutationResult.changedPaths.length > 0) {
+        dependencies.state.invalidatePerformanceReviewCredit(taskIdentity.taskRunId);
+      }
+      if (reviewCandidate && successfulToolResult(event) && currentTask) {
+        const commandHash = hashEvidenceCommand(reviewCandidate.command);
+        if (commandHash) {
+          const credit = {
+            workingTreeDigest: currentTreeDigest,
+            commandHash,
+            reviewedPaths: reviewCandidate.reviewedPaths,
+            recordedAt: dependencies.now()
+          };
+          dependencies.state.rememberPerformanceReviewCredit(taskIdentity.taskRunId, credit);
+          dependencies.telemetry(ctx, {
+            event: "performance_review_credit_recorded",
+            taskId: currentTask.taskId,
+            taskRunId: currentTask.taskRunId,
+            workingTreeDigest: currentTreeDigest,
+            commandHash,
+            reviewedPaths: reviewCandidate.reviewedPaths
+          });
+        }
+      }
     }
+    observeTrajectorySync(ctx, dependencies.syncTrajectory?.(ctx, Boolean(observedContextEntry)), dependencies.telemetry);
 
     let resultContent: unknown = event.content;
     let resultDetails: unknown = event.details;
@@ -292,9 +463,17 @@ export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResul
       resultDetails = attachToolResultCompactionDetails(resultDetails, compactionCaptures);
     }
 
-    dependencies.telemetry(ctx, {
+    const resultFingerprintId = event.toolCallId ?? fingerprint.key;
+    const record = dependencies.activity ?? dependencies.telemetry;
+    const resultTarget = dependencies.extractLikelyPath(ctx.cwd, isPlainRecord(event.input) ? event.input : {});
+    const lineStats = patchLineStats(event.details);
+    record(ctx, {
+      activityId: `result:${resultFingerprintId}`,
       event: "tool_result",
+      recordedAt: dependencies.now(),
+      toolCallId: resultFingerprintId,
       toolName: event.toolName,
+      targetPath: resultTarget ? dependencies.redactText(resultTarget) : undefined,
       inputHash: fingerprint.inputHash,
       outputHash: fingerprint.outputHash,
       outputChars: fingerprint.outputChars,
@@ -304,6 +483,9 @@ export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResul
       compactedCaptures: compactionCaptures.length,
       sensitiveValuesRedacted,
       isError: event.isError,
+      exitCode: observed?.exitCode ?? (dependencies.isShellTool(event.toolName) ? event.isError ? 1 : 0 : undefined),
+      exitCodeExact: observed?.exitCode !== undefined,
+      ...lineStats,
       usage: event.usage
     });