@quantiya/codevibe-claude-plugin 2.0.17 → 2.0.19

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/ConversationPane.d.ts

@@ -8,6 +8,7 @@ export interface ConversationPaneProps {
      * decision. `null`/absent for single-implementor / Companion sessions.
      */
     trackLabelByTaskId?: Map<string, string> | null;
+    gateActionRecoveryBlocked?: boolean;
 }
-export declare function renderConversationEntry(entry: ConversationEntry, trackLabelByTaskId?: Map<string, string> | null): React.ReactElement;
+export declare function renderConversationEntry(entry: ConversationEntry, trackLabelByTaskId?: Map<string, string> | null, gateActionRecoveryBlocked?: boolean): React.ReactElement;
 export declare function ConversationPane(props: ConversationPaneProps): React.ReactElement;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/GatePromptEntry.d.ts

@@ -4,6 +4,7 @@ export interface GatePromptEntryProps {
     entry: Extract<ConversationEntry, {
         kind: 'gate-prompt';
     }>;
+    gateActionRecoveryBlocked?: boolean;
     /**
      * [#469 gate-pin] Best-effort "Track N" label for the gate's owning team
      * track, derived by `<OrchestrationApp>` from `state.team` (taskId → index).

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/decision-attempt-recovery.d.ts

@@ -0,0 +1,70 @@
+import type { Event } from '../types/events';
+import { DecisionAttemptReceiptStore, type DecisionAttemptReceipt, type DecisionAttemptResult, type DecisionSubmissionResult } from './decision-attempt';
+import type { DurableGateResolution } from './types';
+export interface DecisionAttemptRecoveryClient {
+    getDecisionAttempt(input: {
+        sessionId: string;
+        promptId: string;
+        decisionAttemptId: string;
+    }): Promise<DecisionAttemptResult>;
+    getGateResolution(input: {
+        sessionId: string;
+        promptId: string;
+    }): Promise<unknown>;
+    submitGateDecisionV2?(request: Extract<DecisionAttemptReceipt['request'], {
+        promptKind: 'GATE';
+    }>, canonicalRequestHash: string): Promise<DecisionSubmissionResult>;
+    submitGroupDecisionV2?(request: Extract<DecisionAttemptReceipt['request'], {
+        promptKind: 'TASK_GROUP';
+    }>, canonicalRequestHash: string): Promise<DecisionSubmissionResult>;
+}
+export interface GateResolutionQueryResult {
+    sessionId: string;
+    promptId: string;
+    state: 'NOT_FOUND' | 'CLAIMED' | 'RESOLVED';
+    actionable: false;
+    decisionClaimId: string | null;
+    resolutionEventId: string | null;
+    resolutionTimestamp: string | null;
+    resolutionEvent: Event | null;
+    resolution: DurableGateResolution | null;
+}
+/**
+ * Delete one local attempt fence only after a strict durable resolution has
+ * taken authority for the same prompt. A rejected race loser is deliberately
+ * eligible: its own attempt can never become RESOLVED, so the winning
+ * resolution is the handoff that makes deletion safe.
+ */
+export declare function acknowledgeDecisionAttemptAfterResolution(args: {
+    store: DecisionAttemptReceiptStore;
+    receipt: DecisionAttemptReceipt;
+    attempt: DecisionAttemptResult;
+    resolution: DurableGateResolution;
+}): Promise<boolean>;
+/**
+ * Production live/catch-up composition: finish the receipt-backed desktop
+ * effect first, then hand every matching decision-attempt fence to the same
+ * classified durable authority. The returned callback is shared with focused
+ * integration tests so they execute the exact production ordering.
+ */
+export interface DurableResolutionAttemptHandoff {
+    (resolution: DurableGateResolution): Promise<void>;
+    acknowledgeDelayedRejection(receipt: DecisionAttemptReceipt, resolution: DurableGateResolution): Promise<boolean>;
+}
+export declare function createDurableResolutionAttemptHandoff(args: {
+    store: DecisionAttemptReceiptStore;
+    client: Pick<DecisionAttemptRecoveryClient, 'getDecisionAttempt'>;
+    dispatchEffect: (resolution: DurableGateResolution) => Promise<void>;
+}): DurableResolutionAttemptHandoff;
+/**
+ * Reconcile every crash-durable receipt before the composer is enabled.
+ * Ambiguous states remain fenced. Only an explicit actionable terminal reject
+ * removes the receipt without a durable resolution Event.
+ */
+export declare function recoverDecisionAttemptReceipts(args: {
+    sessionId: string;
+    client: DecisionAttemptRecoveryClient;
+    store?: DecisionAttemptReceiptStore;
+    onResolutionEvent: (event: Event) => Promise<DurableGateResolution | null> | DurableGateResolution | null;
+    onActionableRejection: (receipt: DecisionAttemptReceipt, rejectionCode: string) => void;
+}): Promise<void>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/decision-attempt.d.ts

@@ -0,0 +1,211 @@
+export declare const DECISION_ATTEMPT_DOMAIN = "codevibe.decision_attempt.v1\0";
+export declare const DECISION_ATTEMPT_RECEIPT_VERSION: 1;
+export type GateDecisionKind = 'ACCEPT' | 'ACCEPT_WITH_NOTES' | 'REJECT_WITH_NOTES' | 'REJECT_RESTART' | 'ABORT_TASK' | 'APPROVE' | 'CANCEL' | 'CONTINUE_WITH';
+export type GroupDecisionKind = Exclude<GateDecisionKind, 'APPROVE' | 'CANCEL' | 'CONTINUE_WITH'>;
+export interface DecisionEncryptedNotes {
+    ciphertextB64: string;
+    keyVersion: 1;
+    sessionId: string;
+}
+export interface CanonicalGateDecisionRequest {
+    decision: GateDecisionKind;
+    decisionAttemptId: string;
+    gateId: string;
+    promptKind: 'GATE';
+    currentRound: number;
+    sessionId: string;
+    taskId: string;
+    notes?: DecisionEncryptedNotes;
+}
+export interface CanonicalGroupDecisionRequest {
+    decision: GroupDecisionKind;
+    decisionAttemptId: string;
+    groupGeneration: number;
+    promptId: string;
+    promptKind: 'TASK_GROUP';
+    sessionId: string;
+    taskGroupId: string;
+    notes?: DecisionEncryptedNotes;
+}
+export type CanonicalDecisionRequest = CanonicalGateDecisionRequest | CanonicalGroupDecisionRequest;
+export type DecisionAttemptTerminal = {
+    state: 'RESOLVED';
+    decisionClaimId: string;
+    resolutionEventId: string;
+    resolutionTimestamp: string;
+} | {
+    state: 'REJECTED';
+    rejectionCode: string;
+    actionable: boolean;
+};
+export interface DecisionAttemptReceipt {
+    version: typeof DECISION_ATTEMPT_RECEIPT_VERSION;
+    request: CanonicalDecisionRequest;
+    canonicalRequestHash: string;
+    canonicalRequestBytesB64: string;
+    createdAt: string;
+    updatedAt: string;
+    terminal?: DecisionAttemptTerminal;
+}
+export type DecisionRejectionCode = 'INVALID_PROMPT' | 'STALE_GENERATION' | 'DECISION_RACE_LOST' | 'ATTEMPT_LIMIT' | 'REQUEST_MISMATCH' | 'ACCOUNT_DELETING' | 'POLICY_REJECTED';
+export type DecisionProgressStatus = 'PENDING' | 'PENDING_ERROR' | 'COMPLETE';
+export type DecisionSubmissionResult = {
+    decisionAttemptId: string;
+    acceptanceStatus: 'SUBMITTED_PENDING';
+    promptId: string;
+    actionable: false;
+    decisionClaimId: null;
+    resolutionStatus: null;
+    workflowStatus: null;
+    resolutionEventId: null;
+    resolutionTimestamp: null;
+    rejectionCode: null;
+} | {
+    decisionAttemptId: string;
+    acceptanceStatus: 'REJECTED';
+    promptId: string;
+    actionable: boolean;
+    decisionClaimId: null;
+    resolutionStatus: null;
+    workflowStatus: null;
+    resolutionEventId: null;
+    resolutionTimestamp: null;
+    rejectionCode: DecisionRejectionCode;
+} | {
+    decisionAttemptId: string;
+    acceptanceStatus: 'ACCEPTED_PENDING';
+    promptId: string;
+    actionable: false;
+    decisionClaimId: string;
+    resolutionStatus: 'PENDING' | 'PENDING_ERROR';
+    workflowStatus: 'PENDING';
+    resolutionEventId: string;
+    resolutionTimestamp: null;
+    rejectionCode: null;
+} | {
+    decisionAttemptId: string;
+    acceptanceStatus: 'ACCEPTED_RESOLVED';
+    promptId: string;
+    actionable: false;
+    decisionClaimId: string;
+    resolutionStatus: 'COMPLETE';
+    workflowStatus: DecisionProgressStatus;
+    resolutionEventId: string;
+    resolutionTimestamp: string;
+    rejectionCode: null;
+};
+export type DecisionAttemptResult = {
+    sessionId: string;
+    promptId: string;
+    decisionAttemptId: string;
+    state: 'NOT_FOUND';
+    canonicalRequestHash: null;
+    decisionClaimId: null;
+    resolutionEventId: null;
+    resolutionTimestamp: null;
+    rejectionCode: null;
+    actionable: false;
+} | {
+    sessionId: string;
+    promptId: string;
+    decisionAttemptId: string;
+    state: 'SUBMITTED';
+    canonicalRequestHash: string;
+    decisionClaimId: null;
+    resolutionEventId: null;
+    resolutionTimestamp: null;
+    rejectionCode: null;
+    actionable: false;
+} | {
+    sessionId: string;
+    promptId: string;
+    decisionAttemptId: string;
+    state: 'CLAIMED';
+    canonicalRequestHash: string;
+    decisionClaimId: string;
+    resolutionEventId: string;
+    resolutionTimestamp: null;
+    rejectionCode: null;
+    actionable: false;
+} | {
+    sessionId: string;
+    promptId: string;
+    decisionAttemptId: string;
+    state: 'RESOLVED';
+    canonicalRequestHash: string;
+    decisionClaimId: string;
+    resolutionEventId: string;
+    resolutionTimestamp: string;
+    rejectionCode: null;
+    actionable: false;
+} | {
+    sessionId: string;
+    promptId: string;
+    decisionAttemptId: string;
+    state: 'REJECTED';
+    canonicalRequestHash: string | null;
+    decisionClaimId: null;
+    resolutionEventId: null;
+    resolutionTimestamp: null;
+    rejectionCode: DecisionRejectionCode;
+    actionable: boolean;
+};
+export declare function canonicalizeGateDecisionRequest(input: Omit<CanonicalGateDecisionRequest, 'promptKind'> & {
+    promptKind?: 'GATE';
+}): CanonicalGateDecisionRequest;
+export declare function canonicalizeGroupDecisionRequest(input: Omit<CanonicalGroupDecisionRequest, 'promptKind' | 'promptId'> & {
+    promptKind?: 'TASK_GROUP';
+    promptId?: string;
+}): CanonicalGroupDecisionRequest;
+export declare function canonicalDecisionRequestBytes(request: CanonicalDecisionRequest): Buffer;
+export declare function canonicalDecisionRequestHash(request: CanonicalDecisionRequest): string;
+export declare function makeDecisionAttemptReceipt(request: CanonicalDecisionRequest, now?: Date): DecisionAttemptReceipt;
+export declare function parseDecisionSubmissionResult(value: unknown): DecisionSubmissionResult;
+export declare function parseDecisionAttemptResult(value: unknown): DecisionAttemptResult;
+export declare class DecisionAttemptReceiptStore {
+    /**
+     * Every store instance targeting the same root shares one session queue.
+     * Production injects one store through submit, subscription/catch-up, and
+     * startup recovery; the process-wide map also keeps accidental sibling
+     * instances from exposing atomic-write temporaries to enumeration.
+     */
+    private static readonly sessionQueues;
+    private readonly rootDir;
+    private readonly syncDirectory;
+    constructor(options?: {
+        rootDir?: string;
+        directorySync?: (directory: string) => Promise<void>;
+    });
+    private receiptPath;
+    private sessionQueueKey;
+    private withSessionLock;
+    private assertNoSymlinkComponents;
+    private atomicWrite;
+    /**
+     * Remove one receipt name and persist that directory-entry transition before
+     * returning. ENOENT is idempotent only after the still-present directory is
+     * synced; an absent directory has no entry that can be resurrected.
+     */
+    private removeDirectoryEntryDurably;
+    private readUnlocked;
+    private sameImmutableIdentity;
+    write(receipt: DecisionAttemptReceipt): Promise<void>;
+    read(sessionId: string, promptId: string, decisionAttemptId: string): Promise<DecisionAttemptReceipt | null>;
+    /**
+     * Return the bounded set of unacknowledged receipts for one session. Paths
+     * are opaque hashes, regular files only, and every receipt is revalidated
+     * against its canonical bytes before it can participate in recovery.
+     */
+    private listForSessionUnlocked;
+    listForSession(sessionId: string): Promise<DecisionAttemptReceipt[]>;
+    markTerminal(receipt: DecisionAttemptReceipt, terminal: DecisionAttemptTerminal, now?: Date): Promise<DecisionAttemptReceipt | null>;
+    /**
+     * Remove an exact receipt only while its caller still owns the synchronous
+     * pre-submit boundary. This transition is intentionally separate from
+     * `acknowledge`: no server attempt exists yet, so inventing a terminal state
+     * would make later recovery contradict the server. The caller MUST invoke it
+     * before calling the submission transport.
+     */
+    abandonUnsubmitted(receipt: DecisionAttemptReceipt): Promise<void>;
+    acknowledge(receipt: DecisionAttemptReceipt): Promise<void>;
+}

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/decision-effect.d.ts

@@ -0,0 +1,39 @@
+import type { DurableGateResolution, PostDecisionAction } from './types';
+declare const RECEIPT_VERSION: 1;
+export interface DecisionEffectReceipt {
+    version: typeof RECEIPT_VERSION;
+    sessionId: string;
+    promptId: string;
+    decisionClaimId: string;
+    resolutionEventId: string;
+    descriptorHash: string;
+    resolution: DurableGateResolution;
+    state: 'PENDING' | 'COMPLETE';
+    createdAt: string;
+    updatedAt: string;
+}
+export type DecisionEffectHandler = (resolution: DurableGateResolution, postAction: PostDecisionAction | null) => Promise<void> | void;
+export declare function durableResolutionDescriptorHash(resolution: DurableGateResolution): string;
+export declare class DecisionEffectReceiptStore {
+    private readonly rootDir;
+    constructor(options?: {
+        rootDir?: string;
+    });
+    private receiptPath;
+    private assertNoSymlinkComponents;
+    private atomicWrite;
+    read(sessionId: string, decisionClaimId: string): Promise<DecisionEffectReceipt | null>;
+    reserve(resolution: DurableGateResolution, now?: Date): Promise<DecisionEffectReceipt>;
+    complete(receipt: DecisionEffectReceipt, now?: Date): Promise<DecisionEffectReceipt>;
+    listForSession(sessionId: string): Promise<DecisionEffectReceipt[]>;
+}
+export declare function postDecisionActionForResolution(resolution: DurableGateResolution): PostDecisionAction | null;
+export declare class DecisionEffectDispatcher {
+    private readonly store;
+    private readonly handler;
+    private readonly afterComplete?;
+    constructor(store: DecisionEffectReceiptStore, handler: DecisionEffectHandler, afterComplete?: ((resolution: DurableGateResolution) => Promise<void> | void) | undefined);
+    dispatch(resolution: DurableGateResolution): Promise<void>;
+    replayPending(sessionId: string): Promise<void>;
+}
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/emit-shell-event.d.ts

@@ -1,5 +1,5 @@
 import { AppSyncClient } from '../appsync';
-import { type Session } from '../types';
+import { CreateEventInput, type Session } from '../types';
 import type { E1ProducerKind } from '../e1';
 /**
  * §3 LOCK lines 173-181. Names + per-type metadata shapes are part of
@@ -33,6 +33,18 @@ export interface ShellEventEmit {
     timestamp?: string;
     /** Pre-minted nonce when encrypted metadata must bind the response nonce. */
     writerEventNonce?: string;
+    /** P16/P20 encrypted terminal-result authority. All four fields are atomic. */
+    writerEventKind?: 'WORKSPACE_OUTCOME';
+    writerSessionGenerationId?: string;
+    writerOutcomeSubject?: {
+        subjectKind: 'task';
+        subjectId: string;
+    } | {
+        subjectKind: 'task_group';
+        subjectId: string;
+        groupGeneration: number;
+    };
+    writerCausalPredecessor?: Record<string, unknown>;
     /** Proven local key mismatch: emit the safe legacy joined fallback. */
     disableWriterAttestation?: boolean;
     ownerToken?: string;
@@ -51,6 +63,12 @@ export interface EmitShellEventDeps {
     appsyncClient: Pick<AppSyncClient, 'createEvent'>;
     getSessionKey: (sessionId: string) => Promise<string | null>;
     session?: Session;
+    /**
+     * Persist an exact encrypted/signed input without sending it. Reserved for
+     * crash-safe workspace-outcome drafts that must remain undiscoverable until
+     * their hosted COMMIT boundary is confirmed.
+     */
+    prepareOnly?: (input: CreateEventInput) => Promise<void>;
 }
 export type ShellEventEmitResult = {
     emitted: true;
@@ -66,7 +84,7 @@ export type ShellEventEmitResult = {
     };
 } | {
     emitted: false;
-    reason: 'missing_session_key' | 'auth_required' | 'auth_unavailable' | 'create_failed' | 'definitive_rejection' | 'invalid_response' | 'writer_ineligible';
+    reason: 'missing_session_key' | 'auth_required' | 'auth_unavailable' | 'create_failed' | 'definitive_rejection' | 'invalid_response' | 'prepared_only' | 'writer_ineligible';
     error?: unknown;
 };
 /**

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -1,5 +1,6 @@
 import type { OrchestrationStore } from './store';
-import type { ConversationEntry, PostDecisionAction } from './types';
+import type { ConversationEntry, DurableGateResolution, PostDecisionAction } from './types';
+import { DecisionAttemptReceiptStore, type CanonicalGateDecisionRequest, type CanonicalGroupDecisionRequest, type DecisionAttemptReceipt, type DecisionSubmissionResult } from './decision-attempt';
 /**
  * Minimal SDK contract for the `applyUserDecision` wire. Structurally
  * compatible with the full `AppSyncClient.applyUserDecision` signature — keeps
@@ -7,6 +8,9 @@ import type { ConversationEntry, PostDecisionAction } from './types';
  * inject a stub). Mirrors `ApplyUserDecisionClient` in `<OrchestrationApp>`.
  */
 export interface ApplyUserDecisionClient {
+    submitGateDecisionV2?(request: CanonicalGateDecisionRequest, canonicalRequestHash: string): Promise<DecisionSubmissionResult>;
+    submitGroupDecisionV2?(request: CanonicalGroupDecisionRequest, canonicalRequestHash: string): Promise<DecisionSubmissionResult>;
+    /** Retained only as a structural compatibility member for older test/plugin clients. */
     applyUserDecision(input: {
         gateId: string;
         taskId: string;
@@ -18,7 +22,10 @@ export interface ApplyUserDecisionClient {
         decision: string;
         postAction: PostDecisionAction;
     }>;
+    /** Test-only structural injection; the production AppSync client omits it. */
+    decisionAttemptReceiptStore?: DecisionAttemptReceiptStoreSurface;
 }
+type DecisionAttemptReceiptStoreSurface = Pick<DecisionAttemptReceiptStore, 'write' | 'markTerminal' | 'abandonUnsubmitted' | 'acknowledge'>;
 /** Dependencies common to both the TTY + non-TTY gate-resolution paths. */
 export interface GateDecisionSubmitDeps {
     store: OrchestrationStore;
@@ -26,6 +33,14 @@ export interface GateDecisionSubmitDeps {
     appsyncClient: ApplyUserDecisionClient;
     /** Just-in-time session-key resolver (only consulted when notes are present). */
     getSessionKey: (sessionId: string) => Promise<string | null>;
+    /** Optional override for isolated tests; production uses the durable 0600 store. */
+    decisionAttemptReceiptStore?: DecisionAttemptReceiptStoreSurface;
+    /**
+     * Production effect-completion barrier for a response that loses after the
+     * winner Event was already classified. It returns false when no matching
+     * completed/in-flight durable handoff exists, leaving the receipt fenced.
+     */
+    acknowledgeDelayedRejection?: (receipt: DecisionAttemptReceipt, resolution: DurableGateResolution) => Promise<boolean>;
     /**
      * Optional — notified after a successful `applyUserDecision` with the engine's
      * `postAction` (the QuorumLoop wires it to discard the shadow on a
@@ -47,7 +62,7 @@ export interface GateDecisionSubmitDeps {
      * 2026-06-11, option-4 "Reject and restart"). `undefined` when no shadow was
      * mapped at decision time (or no loop is wired).
      */
-    onTerminalDecision?: (taskId: string, postAction: PostDecisionAction, expectedShadow?: unknown) => void;
+    onTerminalDecision?: (taskId: string, postAction: PostDecisionAction, expectedShadow?: unknown) => Promise<void> | void;
     /**
      * Optional — resolves the live shadow INSTANCE for a task at decision time. Read
      * ONCE at the TOP of `submitGateDecision` (BEFORE the `applyUserDecision` SDK
@@ -94,6 +109,7 @@ export declare function submitGateDecision(deps: GateDecisionSubmitDeps, promptE
     taskId: string;
     sessionId: string;
     currentRound: number;
+    decisionProtocolVersion?: 1 | 2;
     decision: string;
     notes?: string;
 }): Promise<void>;
@@ -157,6 +173,8 @@ export interface GroupDecisionSubmitDeps {
      * post-image proof before marking accepted or clearing reviewed bundles.
      */
     finalizeAcceptedGroup: (taskGroupId: string) => Promise<void>;
+    /** Count the exact distinct materialized paths before accepted-state GC. */
+    getRetainedFileCount?: (taskGroupId: string) => Promise<number>;
     /**
      * HIGH-1 / LOCK #589-J — persist the CLAIMED-but-not-COMMITted decision to the
      * durable record, called IMMEDIATELY after the CLAIM phase mints `claimToken`

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-prompts.d.ts

@@ -99,6 +99,8 @@ export interface GatePromptOption {
  */
 export interface GatePromptEnvelope {
     readonly promptKind: GatePromptKind;
+    /** Immutable server stamp; absent only on legacy v1 prompt Events. */
+    readonly decisionProtocolVersion?: 1 | 2;
     readonly taskId: string;
     readonly gateId: string;
     readonly currentRound: number;
@@ -120,6 +122,8 @@ export interface GatePromptEnvelope {
     readonly packetHash?: string;
     readonly groupEscalation?: {
         readonly taskGroupId: string;
+        readonly groupGeneration?: number;
+        readonly protocolVersion: 1 | 2;
     };
 }
 /**

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-resolution-event.d.ts

@@ -0,0 +1,10 @@
+import type { Event } from '../types/events';
+import type { DurableGateResolution } from './types';
+/** A known decision may execute only through its exact closed recipe pair. */
+export declare function supportedResolutionLabel(decision: unknown, effectRecipe: unknown): string | null;
+/**
+ * Accept only the unforgeable server-authored P16/P20 resolution profile.
+ * Returning null is intentionally fail-open for prompt availability: an
+ * untrusted Notification remains generic and can never retire an action.
+ */
+export declare function classifyDurableGateResolution(event: Event, displayedSessionId: string): DurableGateResolution | null;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -5,6 +5,7 @@ import { OrchestrationStore } from './store';
 import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
 import { type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from './gate-decision-submit';
+import { type WorkspaceOutcomeSinkTap } from './workspace-terminal-coordinator';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
 import { loadReviewerWizardData } from './slash-routes/reviewers';
 import { createShellEventEmitter } from './emit-shell-event';
@@ -13,7 +14,7 @@ import { type BrainstormPanelActiveAgent } from './brainstorm-quorum';
 import { type RunAuditBrowserResult } from './audit-runner';
 import { type RunFlagCommandResult } from './flag-command';
 import { Tier } from './types';
-import type { ConversationEntry, PendingClarification } from './types';
+import type { ConversationEntry, DurableGateResolution, PendingClarification } from './types';
 import { type GatePromptEnvelope, type DecryptedReviewSummaryInput } from './gate-prompts';
 import type { Event, UpdateEventStatusInput } from '../types/events';
 import { type StructuralSummaryGenerator } from '../structural-summary';
@@ -116,6 +117,8 @@ export interface RunOrchestrationShellArgs {
      * subscription, no team mode, no status node (byte-identical behavior).
      */
     localExecutor?: LocalExecutor;
+    /** Shell-installed writer-outcome coordinator used by v2 team promotion. */
+    workspaceOutcomeTap?: WorkspaceOutcomeSinkTap;
     /**
      * CP-12 W3 §3.5 — store-tap installed by `cli.ts` so the team-mode LE's
      * per-track shell events (W2.b `emitTrackProgress` NOTIFICATIONs carrying
@@ -362,7 +365,7 @@ export declare const TASK_REVIEW_SUMMARY_FETCH_TIMEOUT_MS = 5000;
  * unit-testable with a mock).
  */
 export type ReviewSummaryFetcher = (taskId: string, gateId: string, sessionId: string) => Promise<DecryptedReviewSummaryInput | null>;
-export declare function handleSubscribedEvent(event: Event, store: OrchestrationStore, sessionKeyResolver?: (sessionId: string) => Promise<string | null>, reviewSummaryFetcher?: ReviewSummaryFetcher, maybeAutoContinue?: (envelope: GatePromptEnvelope) => boolean): void;
+export declare function handleSubscribedEvent(event: Event, store: OrchestrationStore, sessionKeyResolver?: (sessionId: string) => Promise<string | null>, reviewSummaryFetcher?: ReviewSummaryFetcher, maybeAutoContinue?: (envelope: GatePromptEnvelope) => boolean, onDurableGateResolution?: (resolution: DurableGateResolution) => Promise<void> | void): void;
 /**
  * Route a `USER_PROMPT` sent from the paired MOBILE companion into the shell's
  * SERIALIZED submission pipeline so the planner processes it EXACTLY like a typed
@@ -427,6 +430,7 @@ export declare function createSubscribedEventDispatcher(deps: {
     sessionKeyResolver?: (sessionId: string) => Promise<string | null>;
     reviewSummaryFetcher?: ReviewSummaryFetcher;
     maybeAutoContinue?: (envelope: GatePromptEnvelope) => boolean;
+    onDurableGateResolution?: (resolution: DurableGateResolution) => Promise<void> | void;
     updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>;
 }): (event: Event) => void;
 /**

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/quorum-loop.d.ts

@@ -21,6 +21,7 @@ import type { SubstrateHandle } from '../substrate/types';
 import type { VerdictClassifier } from '../reviewer/verdict-classifier';
 import type { AgentKind as ReviewerAgentKind, ReviewerRole, VerdictKind } from '../reviewer/types';
 import type { OnProgress } from './task-progress';
+import type { WorkspaceOutcomeSink } from './workspace-terminal-coordinator';
 import { runShellCommand } from '../local-executor/verification-gates/shell-runner';
 import type { PostDecisionAction, Tier } from './types';
 import type { ContinuationPacketWriter } from '../continuation/packet-writer';
@@ -552,6 +553,7 @@ export declare function teamRound0GateId(taskId: string, taskGroupId: string, tr
 export declare class QuorumLoop {
     private readonly deps;
     private readonly sleep;
+    private workspaceOutcomeSink?;
     /** The active task this desktop is driving (set at start_task). */
     private activeTaskId;
     /** Tasks whose next automatic revise round must start a fresh review baseline. */
@@ -1146,6 +1148,9 @@ export declare class QuorumLoop {
      */
     private lastWorkspaceOutcome;
     constructor(deps: QuorumLoopDeps);
+    /** Installed by the session-owning shell after both objects are constructed. */
+    setWorkspaceOutcomeSink(sink: WorkspaceOutcomeSink | undefined): void;
+    isWorkspaceTaskTerminallyRetired(taskId: string): boolean;
     /** The current active task id (for the recovery poll). */
     get activeTask(): string | null;
     /** Arm an explicit, one-shot comprehensive baseline for the active task. */
@@ -1402,6 +1407,12 @@ export declare class QuorumLoop {
     private ensureShadowLocked;
     /** The shadow for `taskId` (introspection / the terminal promote/discard handlers). */
     shadowForTask(taskId: string): WorkspaceShadow | undefined;
+    /**
+     * Durable-decision restart guard. Once the deterministic successor gate has
+     * entered execution, the task's mapped shadow belongs to that successor and
+     * must never be discarded as the parent gate's rejected snapshot.
+     */
+    gateExecutionHasStarted(gateId: string): boolean;
     /**
      * Spawn the EXECUTE-mode implementor for one round in the task's SHADOW,
      * capture the shadow-vs-real diff, and submit it as the execute-first

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/supervision-catch-up.d.ts

@@ -0,0 +1,7 @@
+import type { Event } from '../types/events';
+/**
+ * `listSupervisionEvents` returns one globally newest-first DynamoDB walk.
+ * Reverse a copy only after every page has been drained so page boundaries do
+ * not invert causal prompt → resolution → workspace-outcome ordering.
+ */
+export declare function chronologicalSupervisionEvents(newestFirstEvents: readonly Event[]): Event[];