@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/runtime/session/runtime-state.ts

@@ -1,9 +1,11 @@
 import crypto from "node:crypto";
+export { createHostWireSession, observeHostWireInput, HOST_WIRE_PHASE_EDGES } from "../trajectory/trajectory-runtime.ts";
+export type { HostWireSession, HostWireSessionOptions, HostWireOperation } from "../trajectory/trajectory-runtime.ts";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-
 import { isRuntimeOwnedContextEvidenceEntry } from "../../extensions/context-evidence.js";
 import { toolResultFingerprint } from "../../extensions/context-engine.js";
-import { workingTreeSnapshot } from "../../extensions/task-state.js";
+import { ShellVerificationSnapshots } from "../verification/shell-verification-snapshots.ts";
+import { HostProjectVerification } from "../verification/host-project-verification.ts";
 import type { TaskContract } from "../../extensions/guard-types.ts";
 import type { RecoveryHistoryEntry } from "../recovery/recovery-policy.ts";
 import type { ResumeState } from "../recovery/resume-state.ts";
@@ -11,6 +13,7 @@ import { ModelAuthorshipState } from "./model-authorship-state.ts";
 import type { ModelMutationEvidenceCompletion, ModelMutationIdentity } from "./model-authorship-state.ts";
 import type { ModelMutationProof } from "../quality/model-mutation-proof.ts";
 import { PerformanceReviewState } from "./performance-review-state.ts";
+import { SourceCheckoutReadGrants } from "./source-checkout-read-grants.ts";
 import type {
   PerformanceReviewCheckpoint,
   PerformanceReviewCredit,
@@ -30,16 +33,13 @@ export type {
   PerformanceReviewToolKind,
   PerformanceReviewVerifierState
 } from "./performance-review-state.ts";
-
 export type ObservedTaskContext = { path: string; reason: string };
-
 export type InjectedContextPack = {
   queryHash: string;
   confidence: string;
   estimatedTokens: number;
   paths: string[];
 };
-
 export type ContextInjectionItem = {
   path: string;
   estimatedTokens: number;
@@ -53,7 +53,6 @@ export type ContextInjectionItem = {
   generation?: number;
   sensitiveContentRedacted?: boolean;
 };
-
 export type ContextInjectionTelemetry = {
   source: string;
   queryHash: string;
@@ -61,7 +60,6 @@ export type ContextInjectionTelemetry = {
   estimatedTokens: number;
   selectedItems: ContextInjectionItem[];
 };
-
 export type PendingContextDelivery = {
   deliveryId: string;
   taskRunId: string;
@@ -70,8 +68,7 @@ export type PendingContextDelivery = {
   pack?: InjectedContextPack & { retrievalKey: string };
   injection?: ContextInjectionTelemetry;
 };
-
-export type RuntimeTurn = { turnId: string; promptHash: string };
+export type RuntimeTurn = { turnId: string; promptHash: string; lightweightNonAuthorizingChange: boolean };
 
 function evictOldest<K, V>(map: Map<K, V>, maximum: number): void {
   while (map.size > maximum) map.delete(map.keys().next().value as K);
@@ -94,15 +91,13 @@ export class RuntimeSessionState {
   readonly #observedContextBySession = new Map<string, Map<string, ObservedTaskContext>>();
   readonly #preTaskContextBySession = new Map<string, { turnId: string; entries: Map<string, ObservedTaskContext> }>();
   readonly #qualifiedContextEvidenceByTask = new Map<string, Map<string, ObservedTaskContext>>();
-  readonly #shellMutationSnapshots = new Map<string, Record<string, string>>();
+  readonly #shellMutationSnapshots = new ShellVerificationSnapshots();
+  readonly projectVerification = new HostProjectVerification(this.#shellMutationSnapshots);
+  readonly #sourceCheckoutReadGrants = new SourceCheckoutReadGrants();
 
-  constructor(options: { maxObservedContext: number }) {
-    this.#maxObservedContext = options.maxObservedContext;
-  }
+  constructor(options: { maxObservedContext: number }) { this.#maxObservedContext = options.maxObservedContext; }
 
-  sessionKey(ctx: ExtensionContext): string {
-    return `${ctx.cwd}\u0000${ctx.sessionManager.getSessionId()}`;
-  }
+  sessionKey(ctx: ExtensionContext): string { return `${ctx.cwd}\u0000${ctx.sessionManager.getSessionId()}`; }
 
   cacheTaskIdentity(ctx: ExtensionContext, task: TaskContract | undefined): void {
     const key = this.sessionKey(ctx);
@@ -112,11 +107,10 @@ export class RuntimeSessionState {
   }
 
   taskIdentity(ctx: ExtensionContext): { taskId: string; taskRunId: string } | undefined {
-    return this.#taskIdentityBySession.get(this.sessionKey(ctx));
-  }
+    return this.#taskIdentityBySession.get(this.sessionKey(ctx)); }
 
-  beginTurn(ctx: ExtensionContext, promptHash: string): RuntimeTurn {
-    const turn = { turnId: crypto.randomUUID(), promptHash };
+  beginTurn(ctx: ExtensionContext, promptHash: string, classification: { lightweightNonAuthorizingChange?: boolean } = {}): RuntimeTurn {
+    const turn = { turnId: crypto.randomUUID(), promptHash, lightweightNonAuthorizingChange: classification.lightweightNonAuthorizingChange === true };
     const sessionKey = this.sessionKey(ctx);
     this.#turnBySession.set(sessionKey, turn);
     this.#preTaskContextBySession.set(sessionKey, { turnId: turn.turnId, entries: new Map() });
@@ -130,10 +124,16 @@ export class RuntimeSessionState {
     return turn && (!promptHash || turn.promptHash === promptHash) ? { ...turn } : undefined;
   }
 
-  hasAdvisedTool(ctx: ExtensionContext, toolName: string): boolean {
-    return this.#advisedTools.has(`${this.sessionKey(ctx)}\u0000${toolName}`);
+  classifyTurn(ctx: ExtensionContext, promptHash: string, classification: { lightweightNonAuthorizingChange: boolean }): RuntimeTurn {
+    const turn = this.currentTurn(ctx, promptHash);
+    if (!turn) return this.beginTurn(ctx, promptHash, classification);
+    turn.lightweightNonAuthorizingChange = classification.lightweightNonAuthorizingChange;
+    this.#turnBySession.set(this.sessionKey(ctx), turn); return { ...turn };
   }
 
+  hasAdvisedTool(ctx: ExtensionContext, toolName: string): boolean {
+    return this.#advisedTools.has(`${this.sessionKey(ctx)}\u0000${toolName}`); }
+
   rememberAdvisedTool(ctx: ExtensionContext, toolName: string): void {
     this.#advisedTools.add(`${this.sessionKey(ctx)}\u0000${toolName}`);
     while (this.#advisedTools.size > 500) {
@@ -157,6 +157,12 @@ export class RuntimeSessionState {
     return [...(this.#observedContextBySession.get(this.sessionKey(ctx))?.values() ?? [])];
   }
 
+  grantSourceCheckoutReadRoot(ctx: ExtensionContext, checkoutPath: string): string {
+    return this.#sourceCheckoutReadGrants.grant(this.sessionKey(ctx), checkoutPath);
+  }
+
+  sourceCheckoutReadRoots(ctx: ExtensionContext): string[] { return this.#sourceCheckoutReadGrants.roots(this.sessionKey(ctx)); }
+
   rememberPreTaskContext(ctx: ExtensionContext, entry: ObservedTaskContext): void {
     const turn = this.currentTurn(ctx);
     const epoch = this.#preTaskContextBySession.get(this.sessionKey(ctx));
@@ -219,30 +225,21 @@ export class RuntimeSessionState {
     return [...(this.#qualifiedContextEvidenceByTask.get(key)?.values() ?? [])].map((entry) => structuredClone(entry));
   }
 
-  #shellMutationSnapshotKey(ctx: ExtensionContext, toolName: string, input: unknown): string {
-    return `${this.sessionKey(ctx)}\u0000${toolResultFingerprint(toolName, input, []).key}`;
+  rememberShellMutationSnapshot(ctx: ExtensionContext, toolName: string, input: unknown, toolCallId?: string): void {
+    this.#shellMutationSnapshots.remember(ctx, toolName, input, toolCallId, this.taskIdentity(ctx)?.taskRunId);
   }
 
-  rememberShellMutationSnapshot(ctx: ExtensionContext, toolName: string, input: unknown): void {
-    this.#shellMutationSnapshots.set(
-      this.#shellMutationSnapshotKey(ctx, toolName, input),
-      workingTreeSnapshot(ctx.cwd) as Record<string, string>
-    );
-    evictOldest(this.#shellMutationSnapshots, 100);
+  consumeShellMutationSnapshot(ctx: ExtensionContext, toolName: string, input: unknown): Record<string, string> | undefined {
+    return this.consumeShellVerificationSnapshot(ctx, toolName, input)?.snapshot as Record<string, string> | undefined;
   }
 
-  consumeShellMutationSnapshot(ctx: ExtensionContext, toolName: string, input: unknown): Record<string, string> | undefined {
-    const key = this.#shellMutationSnapshotKey(ctx, toolName, input);
-    const snapshot = this.#shellMutationSnapshots.get(key);
-    this.#shellMutationSnapshots.delete(key);
-    return snapshot;
+  consumeShellVerificationSnapshot(ctx: ExtensionContext, toolName: string, input: unknown, toolCallId?: string) {
+    return this.#shellMutationSnapshots.consume(ctx, toolName, input, toolCallId, this.taskIdentity(ctx)?.taskRunId);
   }
 
   clearShellMutationSnapshots(ctx: ExtensionContext): void {
-    const prefix = `${this.sessionKey(ctx)}\u0000`;
-    for (const key of this.#shellMutationSnapshots.keys()) {
-      if (key.startsWith(prefix)) this.#shellMutationSnapshots.delete(key);
-    }
+    this.#shellMutationSnapshots.clear(ctx);
+    this.projectVerification.clear(ctx);
   }
 
   hasAutoPackedPrompt(key: string): boolean {
@@ -477,6 +474,7 @@ export class RuntimeSessionState {
     this.#turnBySession.delete(sessionKey);
     this.#observedContextBySession.delete(sessionKey);
     this.#preTaskContextBySession.delete(sessionKey);
+    this.#sourceCheckoutReadGrants.clear(sessionKey);
     this.clearShellMutationSnapshots(ctx);
     if (taskIdentity) {
       this.#performanceReview.clearTask(taskIdentity.taskRunId);

package/packages/piagent-core/runtime/session/source-checkout-read-grants.ts

@@ -0,0 +1,35 @@
+import fs from "node:fs";
+import path from "node:path";
+
+function evictOldest<K, V>(map: Map<K, V>, maximum: number): void {
+  while (map.size > maximum) map.delete(map.keys().next().value as K);
+}
+
+/** Session-local capability grants for immutable shared source checkouts. */
+export class SourceCheckoutReadGrants {
+  readonly #rootsBySession = new Map<string, Map<string, string>>();
+
+  grant(sessionKey: string, checkoutPath: string): string {
+    const canonical = fs.realpathSync.native(checkoutPath);
+    if (!fs.statSync(canonical).isDirectory() || !fs.existsSync(path.join(canonical, ".git"))) {
+      throw new Error("Source checkout grant requires a canonical Git worktree directory");
+    }
+    let roots = this.#rootsBySession.get(sessionKey);
+    if (!roots) {
+      roots = new Map();
+      this.#rootsBySession.set(sessionKey, roots);
+    }
+    roots.set(canonical, canonical);
+    evictOldest(roots, 8);
+    evictOldest(this.#rootsBySession, 100);
+    return canonical;
+  }
+
+  roots(sessionKey: string): string[] {
+    return [...(this.#rootsBySession.get(sessionKey)?.values() ?? [])];
+  }
+
+  clear(sessionKey: string): void {
+    this.#rootsBySession.delete(sessionKey);
+  }
+}

package/packages/piagent-core/runtime/session/system-prompt.ts

@@ -1,18 +1,32 @@
 import type { TaskContract } from "../../extensions/guard-types.ts";
 import { SEMANTIC_COMPACTION_MAX_CHARS } from "../runtime-limits.ts";
-import { criterionGraphGuidance } from "../../extensions/criterion-graph.js";
+import {
+  losslessOperatorRequestFitsWithin,
+  operatorRequestCarryLines
+} from "./operator-request-carry.ts";
+import { presentedAcceptanceCriteria, presentedCriterionGraphGuidance } from "./task-contract-presentation.ts";
 
 const LEGACY_PROJECT_INSTRUCTIONS_START = "Before implementation:\n\n1. Load `.pi/piagent-profile.json` with `piagent_context`.";
 const LEGACY_PROJECT_INSTRUCTIONS_END = "18. If the bundled `pi-subagents` parent skill is available, use it for delegation patterns, review loops, native supervisor coordination, and safety boundaries.";
 const RUNTIME_MANAGED_PROJECT_INSTRUCTIONS = [
   "Piagent runtime-managed task flow:",
   "1. Runtime creates the task contract automatically for a bounded source-changing request before the model starts.",
-  "2. Only when runtime intake pauses for broad, high-risk, or ambiguous scope, call `piagent_task_start` exactly once with project-relative path/glob scope; reuse an active contract.",
-  "3. Use complete runtime-delivered source directly; do not reread it normally. On edit drift/oldText mismatch, use attached recovery; otherwise reread the affected region once. Never retry guessed anchors. Otherwise read only missing source or a concrete criterion-linked focused test. Globs/directories grant scope, not file targets. When creating an explicitly requested new path, do not probe that destination with read first; create it, then read back or verify it. If existence matters, use a non-erroring existence check.",
-  "4. Preserve every runtime-provided verifier exactly and keep commands separate. Run the exact verifier set once on the final tree; rerun only after a later mutation or a runtime-authorized same-tree infrastructure retry. Automatic tasks need no management calls.",
-  "5. Treat the current source and durable Task Contract as authoritative. Keep one writer, bound helper delegation, preserve the user's exact scope, and report unresolved risk. Runtime hooks enforce policy and record context, changes, current-tree verification, trace and final gate. Diagnostic groups appear only for explicit requests or manual high-risk checkpoints."
+  "2. Only when runtime intake pauses for a broad, high-risk, or ambiguous task, call `piagent_task_start` exactly once with project-relative focus paths/globs; reuse an active contract.",
+  "3. Use complete runtime-delivered source directly; do not reread it normally. When the operator names an exact file, work from its delivered/current contents instead of listing or searching merely to rediscover it. Once exact current context is known for a coherent source-and-test or other multi-file change, prefer one apply_patch call over serial edit/write calls. On edit drift/oldText mismatch, use attached recovery; otherwise reread the affected region once. Never retry guessed anchors or batch multiple pattern calls against an unconfirmed target; confirm it once first. Otherwise read only missing source or a concrete criterion-linked focused test. Task scope seeds retrieval and review; it does not limit source mutation. Follow repository evidence across packages or child repos while preserving explicit user constraints. Report only paths and line references actually returned by tools; label inferences and unknowns, and never reread solely to format a citation. When creating an explicitly requested new path, do not probe that destination with read first; create it, then read back or verify it. If existence matters, use a non-erroring existence check.",
+  "4. Preserve every runtime-provided verifier exactly and keep commands separate. When you change source, add or update the smallest focused executable tests that directly exercise every explicit behavior, boundary, and error criterion unless current delivered tests already do; a broad verifier pass without criterion coverage is not completion evidence for that change. Run the exact verifier set once on the final tree; rerun only after a later mutation, an explicit operator request, or a runtime-authorized same-tree infrastructure retry. Do not warm up with an unfocused command already contained in that exact set; use a genuinely criterion-focused test or run the exact set directly. Before any repeat, use piagent_task_gate_check and run only commands reported missing for the current tree; Piagent reuses a durable exact pass on an unchanged tree. Automatic tasks need no other management calls.",
+  "5. Treat the current source, the operator request, and the durable Task Contract as authoritative. The parent model reasons and implements directly. Helpers are off unless explicitly enabled; even then, allow at most one fresh read-only helper only when runtime evidence proves two independent lanes and at least 30% projected net token saving. Never delegate writes, inherit parent history, fan out, or retry a deterministic helper failure. Preserve explicit user constraints and report unresolved risk. Runtime-derived scope is only the initial focus and may expand when implementation evidence requires FE, BE, tests, configuration, or another child repo. Runtime hooks enforce protected paths and approvals and record context, changes, current-tree verification, trace and final gate. Diagnostic groups appear only for explicit requests or manual high-risk checkpoints."
 ].join("\n");
 
+export const SEMANTIC_COMPACTION_CANCELLED_PREFIX = "[Piagent semantic compaction cancelled:";
+
+export function semanticCompactionCancelled(value: unknown): boolean {
+  return String(value ?? "").startsWith(SEMANTIC_COMPACTION_CANCELLED_PREFIX);
+}
+
+function semanticCompactionCancellation(task?: TaskContract): string {
+  return `${SEMANTIC_COMPACTION_CANCELLED_PREFIX} authoritative durable task truth and exact verifiers exceed the ${SEMANTIC_COMPACTION_MAX_CHARS}-character carry target. Keep the current session context unchanged; do not summarize, hash, truncate, or reconstruct authoritative task truth.${task?.operatorRequestDigest ? ` Contract digest: ${task.operatorRequestDigest}.` : ""}]`;
+}
+
 export function rewriteLegacyProjectInstructions(systemPrompt: string): {
   systemPrompt: string;
   rewritten: boolean;
@@ -34,7 +48,7 @@ export function compactManagedProjectInstructions(
 ): { systemPrompt: string; compacted: boolean } {
   const concise = mode === "protected"
     ? "Piagent protected-path policy: do not read, disclose, or mutate protected content. Refuse without tool calls."
-    : "Piagent runtime task is injected below. Root project instructions are already loaded; do not re-read root AGENTS.md. Treat current source and the durable Task Contract as authoritative; preserve the user's exact scope, keep one writer, bound helpers, and report unresolved risk. Use complete runtime-delivered source directly without rereading it normally. On edit drift/oldText mismatch, use attached recovery; otherwise reread the affected region once. Never retry guessed anchors. Otherwise read only missing source or a concrete criterion-linked focused test. Globs/directories grant scope, not file targets. For an explicitly requested new path, create it without a speculative read, then read back or verify it. Preserve every runtime verifier exactly and keep commands separate. Run the exact verifier set once on the final tree; rerun only after a later mutation or a runtime-authorized same-tree infrastructure retry. Make no task-management calls.";
+    : "Piagent runtime task is injected below. Root project instructions are already loaded; do not re-read root AGENTS.md. Treat current source, the operator request, and the durable Task Contract as authoritative; preserve explicit user constraints and report unresolved risk. The parent reasons and implements directly. Helpers are opt-in and limited to one fresh read-only helper only with two independent lanes and at least 30% projected net token saving; never delegate writes, inherit parent history, fan out, or retry a deterministic helper failure. Runtime-derived scope is an initial retrieval/review focus, not a mutation boundary; follow repository evidence across packages and child repos. Use complete runtime-delivered source directly without rereading it normally. For an exact operator-named file, use delivered/current contents instead of listing or searching merely to rediscover it. Once exact current context is known for a coherent source-and-test or other multi-file change, prefer one apply_patch call over serial edit/write calls. On edit drift/oldText mismatch, use attached recovery; otherwise reread the affected region once. Never retry guessed anchors or batch pattern calls against an unconfirmed target; confirm it once first. Otherwise read only missing source or a concrete criterion-linked focused test. When source is changed, add or update the smallest focused executable tests for every explicit behavior, boundary, and error criterion unless delivered tests already cover them; a broad verifier pass alone is not completion evidence for that change. Report only tool-observed paths and line references; label inferences and unknowns, and never reread solely to format a citation. For an explicitly requested new path, create it without a speculative read, then read back or verify it. Preserve every runtime verifier exactly and keep commands separate. Run the exact verifier set once on the final tree. Do not warm up with an unfocused command already contained in that exact set; rerun only after a later mutation or a runtime-authorized same-tree infrastructure retry. Make no task-management calls.";
   const markerStart = "<!-- piagent-managed:start -->";
   const markerEnd = "<!-- piagent-managed:end -->";
   const start = systemPrompt.indexOf(markerStart);
@@ -70,27 +84,75 @@ function compactCarryOverList(values: unknown[], limit: number, itemChars: numbe
   return selected.join(", ") || "none recorded";
 }
 
-function boundedCarryOver(value: string): string {
+function boundedCarryOver(value: string, task?: TaskContract): string {
   if (value.length <= SEMANTIC_COMPACTION_MAX_CHARS) return value;
-  const marker = "\n\n[Piagent carry-over shortened; the durable Task Contract remains authoritative.]\n\n";
+  const operatorTruth = operatorRequestCarryLines(task);
+  if (task && operatorTruth.length > 0) {
+    const fallback = [
+    "Create a structured Piagent carry-over summary.",
+    `Current task: ${compactCarryOverText(task.taskId, 160)} (${task.riskLane})`,
+    ...operatorTruth,
+    "Acceptance criteria:",
+    ...presentedAcceptanceCriteria(task).slice(0, 8).map((criterion, index) => `- ${index + 1}. ${compactCarryOverText(criterion, 160)}`),
+    `Changed files: ${compactCarryOverList(task.changedFiles, 6, 80)}`,
+    ...(task.verifyCommands.length > 0 ? ["Exact verify commands:", ...task.verifyCommands.map((command, index) => `${index + 1}. ${command}`)] : ["Exact verify commands: not recorded"]),
+    `Outcome/blocker: ${task.trace.outcome}${task.trace.friction ? `; ${compactCarryOverText(task.trace.friction, 240)}` : ""}`,
+    "Preserve the authoritative operator request and every atomic acceptance criterion, plus current repository facts, task progress, exact verifier evidence, blockers, and next action.",
+    "Discard stale tool logs and speculative reasoning. Do not convert assumptions into facts."
+    ].join("\n");
+    if (fallback.length <= SEMANTIC_COMPACTION_MAX_CHARS) return fallback;
+    const minimal = [
+      "Create a structured Piagent carry-over summary.",
+      `Current task: ${compactCarryOverText(task.taskId, 120)} (${task.riskLane})`,
+      ...operatorTruth,
+      "Exact verify commands:", ...task.verifyCommands.map((command, index) => `${index + 1}. ${command}`),
+      `Outcome/blocker: ${task.trace.outcome}${task.trace.friction ? `; ${compactCarryOverText(task.trace.friction, 200)}` : ""}`,
+      "The complete operator request above is the acceptance source of truth. Continue only from current source and these exact verifiers."
+    ].join("\n");
+    return minimal.length <= SEMANTIC_COMPACTION_MAX_CHARS ? minimal : semanticCompactionCancellation(task);
+  }
+  if (task) {
+    const manual = [
+      "Create a structured Piagent carry-over summary.",
+      `Current task: ${compactCarryOverText(task.taskId, 120)} (${task.riskLane})`,
+      `Goal: ${task.summary}`,
+      `Expected output: ${task.expectedOutput}`,
+      "Acceptance criteria:", ...presentedAcceptanceCriteria(task).map((criterion, index) => `${index + 1}. ${criterion}`),
+      "Exact verify commands:", ...task.verifyCommands.map((command, index) => `${index + 1}. ${command}`),
+      "Continue only from current source and every durable task clause above."
+    ].join("\n");
+    return manual.length <= SEMANTIC_COMPACTION_MAX_CHARS ? manual : semanticCompactionCancellation(task);
+  }
+  const marker = "\n\n[Piagent carry-over shortened; no durable task contract was available.]\n\n";
   const available = SEMANTIC_COMPACTION_MAX_CHARS - marker.length;
   const head = Math.floor(available * 0.72);
   return `${value.slice(0, head).trimEnd()}${marker}${value.slice(-(available - head)).trimStart()}`;
 }
 
 export function buildSemanticCompactionInstructions(task?: TaskContract): string {
+  if (!losslessOperatorRequestFitsWithin(task, SEMANTIC_COMPACTION_MAX_CHARS)) {
+    return semanticCompactionCancellation(task);
+  }
+  const criteria = task ? presentedAcceptanceCriteria(task) : [];
+  const executionMap = task ? presentedCriterionGraphGuidance(task, 8) : [];
+  const operatorTruth = operatorRequestCarryLines(task);
+  const criteriaLimit = operatorTruth.length > 0 ? 8 : criteria.length;
+  const criterionChars = operatorTruth.length > 0 ? 180 : 280;
   const taskState = task
     ? [
         `Current task: ${compactCarryOverText(task.taskId, 160)} (${task.riskLane})`,
         `Session: ${compactCarryOverText(task.sessionName ?? task.sessionId, 160)}`,
-        `Goal: ${compactCarryOverText(task.summary, 600)}`,
+        `Goal: ${operatorTruth.length > 0 ? compactCarryOverText(task.summary, 600) : task.summary}`,
+        ...operatorTruth,
+        `Expected output: ${operatorTruth.length > 0 ? compactCarryOverText(task.expectedOutput, 500) : task.expectedOutput}`,
         "Acceptance criteria:",
-        ...task.acceptanceCriteria.slice(0, 12).map((criterion, index) => `- ${index + 1}. ${compactCarryOverText(criterion, 280)}`),
-        `Scope: ${compactCarryOverList(task.scope, 8, 80)}`,
-        ...(criterionGraphGuidance(task.criterionGraph, 8).length > 0 ? ["Execution map (planning only):", ...criterionGraphGuidance(task.criterionGraph, 8).map((line: string) => `- ${line}`)] : []),
+        ...criteria.slice(0, criteriaLimit).map((criterion, index) => `- ${index + 1}. ${operatorTruth.length > 0 ? compactCarryOverText(criterion, criterionChars) : criterion}`),
+        `Initial focus (advisory): ${compactCarryOverList(task.scope, 8, 80)}`,
+        "Initial focus guides retrieval/review and neither authorizes nor forbids mutation.",
+        ...(executionMap.length > 0 ? ["Execution map (planning only):", ...executionMap.map((line: string) => `- ${line}`)] : []),
         `Changed files: ${compactCarryOverList(task.changedFiles, 8, 100)}`,
         task.verifyCommands.length > 0
-          ? ["Exact verify commands:", ...task.verifyCommands.slice(0, 8).map((command, index) => `${index + 1}. ${compactCarryOverText(command, 180)}`)].join("\n")
+          ? ["Exact verify commands:", ...task.verifyCommands.map((command, index) => `${index + 1}. ${command}`)].join("\n")
           : "Exact verify commands: not recorded",
         `Outcome/blocker: ${task.trace.outcome}${task.trace.friction ? `; ${compactCarryOverText(task.trace.friction, 320)}` : ""}`,
         "Full task truth is file-backed by the durable Task Contract; do not inspect private Piagent state directly."
@@ -105,5 +167,5 @@ export function buildSemanticCompactionInstructions(task?: TaskContract): string
     "- superseded plans, repeated reads, raw tool logs, successful intermediate output, and speculative reasoning",
     "- full source excerpts that can be re-read from the repository", "",
     "Do not convert assumptions into facts. Mark unknowns explicitly. After compaction, re-read current files before editing."
-  ].join("\n"));
+  ].join("\n"), task);
 }

package/packages/piagent-core/runtime/session/task-contract-presentation.ts

@@ -0,0 +1,39 @@
+import type { TaskContract } from "../../extensions/guard-types.ts";
+import { criterionGraphGuidance } from "../../extensions/criterion-graph.js";
+
+export const LEGACY_RUNTIME_SCOPE_CRITERION = "Changes stay within the runtime-derived task scope.";
+
+function isLegacyRuntimeScopeCriterion(value: unknown): boolean {
+  return typeof value === "string" && value.trim() === LEGACY_RUNTIME_SCOPE_CRITERION;
+}
+
+export function presentedAcceptanceCriteria(
+  task: Pick<TaskContract, "acceptanceCriteria">
+): string[] {
+  return task.acceptanceCriteria.filter((criterion) => !isLegacyRuntimeScopeCriterion(criterion));
+}
+
+export function presentedCriterionGraphGuidance(
+  task: Pick<TaskContract, "criterionGraph">,
+  maximumLines = 12
+): string[] {
+  const graph = task.criterionGraph;
+  if (!graph) return [];
+  const removedNodeIds = new Set(
+    graph.nodes
+      .filter((node) => isLegacyRuntimeScopeCriterion(node.obligation))
+      .map((node) => node.id)
+  );
+  if (removedNodeIds.size === 0) return criterionGraphGuidance(graph, maximumLines);
+  const presentedGraph = {
+    ...graph,
+    nodes: graph.nodes
+      .filter((node) => !removedNodeIds.has(node.id))
+      .map((node) => ({
+        ...node,
+        dependsOn: node.dependsOn.filter((dependency) => !removedNodeIds.has(dependency))
+      })),
+    order: graph.order.filter((nodeId) => !removedNodeIds.has(nodeId))
+  };
+  return criterionGraphGuidance(presentedGraph, maximumLines);
+}

package/packages/piagent-core/runtime/session/uncertain-send-continuation.ts

@@ -0,0 +1,231 @@
+import { captureWorkspaceVerificationSnapshot } from "../../extensions/workspace-verification-snapshot.js";
+import { diagnosticDeliveryMatchesTask, type DiagnosticDelivery } from "../recovery/diagnostic-delivery.ts";
+import type { TaskContract } from "../../extensions/guard-types.js";
+import {
+  handoffIdentityMatchesTask,
+  readHandoffProjection,
+  taskAcceptanceDisposition,
+  type HandoffProjection
+} from "../recovery/handoff-projection.ts";
+
+export const UNCERTAIN_SEND_RECEIPT_TYPE = "piagent-uncertain-send-continuation-v1";
+
+function folded(value: unknown): string {
+  return String(value ?? "")
+    .normalize("NFD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .replace(/đ/g, "d")
+    .replace(/Đ/g, "D")
+    .replace(/\s+/g, " ")
+    .trim()
+    .toLowerCase();
+}
+
+/**
+ * Identify the narrow uncertain-delivery recovery protocol. Generic requests
+ * such as "continue" or "check the previous work" intentionally do not match:
+ * they remain free to start a different task in the same session.
+ */
+export function isUncertainSendContinuation(value: unknown): boolean {
+  const text = folded(value);
+  if (!text) return false;
+  const switchesWork = /\b(?:new|different|separate|unrelated)\s+(?:request|task|work)\b/.test(text)
+    || /\b(?:task|yeu cau|cong viec|viec)\s+moi\b/.test(text);
+  if (switchesWork) return false;
+  const interrupted = /\b(?:connection|delivery|send|session)\b.{0,100}\b(?:interrupted|disconnected|dropped|lost|uncertain)\b/.test(text)
+    || /\bket noi\b.{0,100}\b(?:gian doan|bi ngat|bi mat)\b/.test(text);
+  const mayHaveArrived = /\b(?:previous|prior|last)\s+(?:send|message|request)\b.{0,100}\b(?:may|might|could)\s+have\s+been\s+(?:delivered|sent|received)\b/.test(text)
+    || /\b(?:delivery|send|receipt)\b.{0,100}\b(?:unknown|uncertain|unconfirmed)\b/.test(text)
+    || /\b(?:tin nhan|yeu cau|lan gui)\s+(?:truoc|vua roi)\b.{0,100}\bco the\b.{0,60}\b(?:da gui|da nhan|duoc gui)\b/.test(text);
+  const sameRequest = /\bcontinue\b.{0,100}\b(?:same|original|previous|prior)\s+(?:request|task|work)\b/.test(text)
+    || /\bdurable\s+session\s+state\b/.test(text)
+    || /\bwithout\s+duplicating\b/.test(text)
+    || /\btiep tuc\b.{0,100}\b(?:cung|yeu cau|task|cong viec)\b/.test(text)
+    || /\bkhong\s+(?:lap lai|trung lap)\b/.test(text);
+  return interrupted && mayHaveArrived && sameRequest;
+}
+
+function bounded(values: unknown, maximum = 8): string[] {
+  return [...new Set((Array.isArray(values) ? values : [])
+    .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
+    .map((value) => value.trim()))]
+    .slice(0, maximum);
+}
+
+export type TerminalUncertainSendReceipt = {
+  customType: typeof UNCERTAIN_SEND_RECEIPT_TYPE;
+  content: string;
+  details: {
+    schemaVersion: 1;
+    version: typeof UNCERTAIN_SEND_RECEIPT_TYPE;
+    state: "settled";
+    taskId: string;
+    taskRunId: string;
+    outcome: TaskContract["trace"]["outcome"];
+    gateDecision: "pass" | "fail";
+    completionApproved: boolean;
+    diagnosticDelivery?: DiagnosticDelivery;
+    changedFiles: string[];
+    missing: string[];
+    nextSafeAction: string;
+    replayed: false;
+    modelTurnStarted: false;
+  };
+};
+
+export type TerminalUncertainSendBinding = {
+  task: TaskContract;
+  text: string;
+  receipt?: TerminalUncertainSendReceipt;
+};
+
+export type UncertainSendRuntimeIntake = {
+  intake: {
+    started: false;
+    text: string;
+    task?: TaskContract;
+    plannedContext: [];
+    plannedContextComplete: true;
+    continuation: "terminal-uncertain-send";
+  };
+  trace: Record<string, unknown>;
+  task?: TaskContract;
+};
+
+type HandoffReader = (cwd: string, taskRunId: string) => HandoffProjection | undefined;
+
+/**
+ * Project a privacy-safe terminal receipt from the immediately prior durable
+ * task. Missing/corrupt/mismatched handoff state returns undefined so callers
+ * can fail closed without claiming that delivery or completion was observed.
+ */
+export function terminalUncertainSendReceipt(
+  cwd: string,
+  task: TaskContract | undefined,
+  readHandoff: HandoffReader = readHandoffProjection
+): TerminalUncertainSendReceipt | undefined {
+  if (!task || task.trace.outcome === "pending") return undefined;
+  let handoff;
+  try {
+    handoff = readHandoff(cwd, task.taskRunId);
+  } catch {
+    return undefined;
+  }
+  if (!handoff
+    || !handoffIdentityMatchesTask(handoff.identity, task)
+    || handoff.state.taskOutcome !== task.trace.outcome) return undefined;
+  if (handoff.state.completionApproved === true || handoff.state.diagnosticDelivery) {
+    const authoritativeAcceptance = taskAcceptanceDisposition(task);
+    if (handoff.acceptance.required !== authoritativeAcceptance.required
+      || handoff.acceptance.satisfied !== authoritativeAcceptance.satisfied
+      || handoff.acceptance.criteriaCount !== authoritativeAcceptance.criteriaCount
+      || handoff.acceptance.dispositionDigest !== authoritativeAcceptance.dispositionDigest) return undefined;
+  }
+  const diagnosticDelivery = handoff.state.diagnosticDelivery;
+  if (diagnosticDelivery && !diagnosticDeliveryMatchesTask(diagnosticDelivery, task, taskAcceptanceDisposition(task).dispositionDigest)) return undefined;
+  if (diagnosticDelivery) {
+    try {
+      const current = captureWorkspaceVerificationSnapshot(cwd);
+      if (!current.proofCapable || current.digest !== handoff.tree.currentDigest
+        || current.workspaceRevisionDigest !== handoff.tree.workspaceRevisionDigest) return undefined;
+    } catch { return undefined; }
+  }
+  const changedFiles = bounded(handoff.changedFiles.current, 12);
+  const missing = bounded(handoff.state.missing, 12);
+  const approved = handoff.state.completionApproved === true;
+  const lines = [
+    "[Piagent delivery receipt]",
+    `The immediately preceding task already settled as ${handoff.state.taskOutcome}; its durable contract was reused and no command, mutation, message, or model turn was replayed.`,
+    `Completion approved: ${approved ? "yes" : "no"}. Gate: ${handoff.state.gateDecision}.`,
+    ...(diagnosticDelivery ? ["Diagnostic delivery only: unproved criteria remain pending; no quality claim."] : []),
+    ...(changedFiles.length > 0 ? [`Changed files: ${changedFiles.join(", ")}.`] : []),
+    ...(missing.length > 0 ? [`Still missing: ${missing.join("; ")}.`] : []),
+    `Next safe action: ${handoff.nextSafeAction.action}.`
+  ];
+  return {
+    customType: UNCERTAIN_SEND_RECEIPT_TYPE,
+    content: lines.join("\n"),
+    details: {
+      schemaVersion: 1,
+      version: UNCERTAIN_SEND_RECEIPT_TYPE,
+      state: "settled",
+      taskId: task.taskId,
+      taskRunId: task.taskRunId,
+      outcome: task.trace.outcome,
+      gateDecision: handoff.state.gateDecision,
+      completionApproved: approved,
+      ...(diagnosticDelivery ? { diagnosticDelivery } : {}),
+      changedFiles,
+      missing,
+      nextSafeAction: handoff.nextSafeAction.action,
+      replayed: false,
+      modelTurnStarted: false
+    }
+  };
+}
+
+export function unavailableUncertainSendContext(task?: TaskContract): string {
+  const identity = task
+    ? `durable task ${task.taskId} (${task.taskRunId})`
+    : "the immediately preceding durable task";
+  return [
+    "[Piagent uncertain-send continuation]",
+    `Reuse ${identity}; do not create a replacement task or repeat prior mutations/messages.`,
+    "Its terminal handoff receipt is missing, corrupt, or identity-mismatched, so completion must not be inferred.",
+    "Report that the durable receipt is unavailable and require state inspection or an explicit new request before any further mutation."
+  ].join("\n");
+}
+
+/**
+ * Bind a synthetic reconnect continuation to the terminal task already bound
+ * to this durable session. This decision is intentionally separate from
+ * generic task intake so a receipt recovery cannot become a new read-only
+ * task merely because the previous operation settled before the client saw it.
+ */
+export function terminalUncertainSendBinding(
+  cwd: string,
+  task: TaskContract | undefined,
+  prompt: unknown,
+  readHandoff: HandoffReader = readHandoffProjection
+): TerminalUncertainSendBinding | undefined {
+  if (!task || task.trace.outcome === "pending" || !isUncertainSendContinuation(prompt)) return undefined;
+  const receipt = terminalUncertainSendReceipt(cwd, task, readHandoff);
+  return {
+    task,
+    text: receipt
+      ? `${receipt.content}\nRecovery-turn rule: return only this durable receipt; do not call tools, repeat work, or start another task.`
+      : unavailableUncertainSendContext(task),
+    receipt
+  };
+}
+
+export function uncertainSendRuntimeIntake(
+  cwd: string,
+  task: TaskContract | undefined,
+  prompt: unknown,
+  sessionId: string
+): UncertainSendRuntimeIntake | undefined {
+  if (!isUncertainSendContinuation(prompt) || task?.trace.outcome === "pending") return undefined;
+  const binding = terminalUncertainSendBinding(cwd, task, prompt);
+  return {
+    intake: {
+      started: false,
+      task: binding?.task,
+      text: binding?.text ?? unavailableUncertainSendContext(),
+      plannedContext: [],
+      plannedContextComplete: true,
+      continuation: "terminal-uncertain-send"
+    },
+    trace: {
+      event: binding ? "uncertain_send_terminal_task_bound" : "uncertain_send_task_binding_unavailable",
+      taskId: binding?.task.taskId,
+      taskRunId: binding?.task.taskRunId,
+      sessionId,
+      receiptAvailable: Boolean(binding?.receipt),
+      replacementTaskStarted: false,
+      replayed: false,
+      modelTurnStarted: true
+    },
+    task: binding?.task
+  };
+}