@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/src/task-budget.ts

@@ -11,6 +11,13 @@ export class TaskBudgetError extends ServiceError {
   }
 }
 
+/** Tools a critic review child may hold and still be left out of the verification busy check. */
+export const READ_ONLY_REVIEW_TOOLS = [
+  'salaam_findings',
+  'salaam_probe',
+  'salaam_repository',
+] as const;
+
 export class TaskBudget {
   constructor(
     readonly store: Store,
@@ -29,6 +36,8 @@ export class TaskBudget {
     store.taskChildFinished = (attempt) => this.releaseChild(attempt);
     store.taskCommandAdmission = (session) => this.command(session);
     store.taskRemainingRuntime = (session) => this.remaining(session);
+    // Only the task's own session: a child's attempt keeps the budget its reservation set.
+    store.taskAttemptRequestLimit = (session) => this.tasks.forSession(session)?.limits.requests;
   }
   task(session: string): WorkTask | null {
     const direct = this.tasks.forSession(session);
@@ -46,16 +55,52 @@ export class TaskBudget {
     );
     return { ...runtime, invocations_spent: n, external_model_usage: n ? 'unknown' : 'none' };
   }
-  active(task: WorkTask): number {
+  /** The child attempt of each running critic review of this task revision whose recorded
+   * tools are all read-only (operator ruling 2026-10-30, option A). Only verification reads may
+   * leave these out of the busy count: the reviewer reads a digest-bound snapshot and cannot
+   * write the workspace, run a command or reach the station (staging card_019a647a169744ff). */
+  private readOnlyReviews(task: WorkTask): string[] {
+    if (
+      !this.store.db
+        .prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='task_critics'")
+        .get()
+    )
+      return [];
+    const rows = this.store.db
+      .prepare(
+        "SELECT c.child_attempt, c.authority FROM task_critics r JOIN child_tasks c ON c.id=r.child_id WHERE r.task_id=? AND r.plan_revision=? AND r.state='running' AND c.parent_session=?",
+      )
+      .all(task.id, task.plan_revision, task.session_id) as {
+      child_attempt: string;
+      authority: string;
+    }[];
+    return rows
+      .filter((r) => {
+        try {
+          const tools = JSON.parse(r.authority) as unknown;
+          return (
+            Array.isArray(tools) &&
+            tools.every((t) => (READ_ONLY_REVIEW_TOOLS as readonly unknown[]).includes(t))
+          );
+        } catch {
+          return false;
+        }
+      })
+      .map((r) => r.child_attempt);
+  }
+  /** Live work in the task's session tree. `verification` leaves out a running read-only review's
+   * child attempt, for verification reads only; admission and concurrency count everything. */
+  active(task: WorkTask, opts: { verification?: boolean } = {}): number {
+    const excluded = JSON.stringify(opts.verification ? this.readOnlyReviews(task) : []);
     const row = this.store.db
       .prepare(
         `WITH tree(id) AS (SELECT ? UNION ALL SELECT child_session FROM child_tasks WHERE parent_session=?) SELECT
-      (SELECT count(*) FROM attempts WHERE session_id IN (SELECT id FROM tree) AND state IN ('accepted','dispatching','running')) +
+      (SELECT count(*) FROM attempts WHERE session_id IN (SELECT id FROM tree) AND state IN ('accepted','dispatching','running') AND id NOT IN (SELECT value FROM json_each(?))) +
       (SELECT count(*) FROM station_calls WHERE session_id IN (SELECT id FROM tree) AND kind='check' AND attempt_id IS NULL AND state IN ('prepared','dispatching')) +
       (SELECT count(*) FROM command_runs WHERE session_id IN (SELECT id FROM tree) AND state NOT IN ('succeeded','failed','cancelled','timed_out','output_limited','interrupted')) +
       (SELECT count(*) FROM external_runs e JOIN child_tasks c ON c.id=e.child_id JOIN attempts a ON a.id=c.child_attempt WHERE c.parent_session=? AND e.stopped=0 AND a.state NOT IN ('accepted','dispatching','running')) AS n`,
       )
-      .get(task.session_id, task.session_id, task.session_id)!;
+      .get(task.session_id, task.session_id, excluded, task.session_id)!;
     return Number(row.n);
   }
   private deny(session: string, message: string): never {

package/src/task-context.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import type { TaskWork } from './task-work.js';
 import type { ContextAdmission } from './context-admission.js';
+import type { ProjectInstructions } from './project-instructions.js';
 import type { Store } from './store.js';
 import type { Artifacts } from './artifacts.js';
 import { canonical, ServiceError, string, integer, object } from './protocol.js';
@@ -41,6 +42,10 @@ export interface Compaction {
 export class TaskContext {
   work?: TaskWork;
   admitted?: ContextAdmission;
+  /** Interactive sessions only: AGENTS.md guidance loaded automatically (project-instructions.ts). */
+  instructions?: ProjectInstructions;
+  /** Interactive sessions only: a folder checkpoint before every turn (turn-rewind.ts). */
+  checkpoints?: import('./turn-rewind.js').TurnCheckpoints;
   constructor(
     readonly store: Store,
     readonly artifacts: Artifacts,
@@ -99,11 +104,13 @@ export class TaskContext {
     if (Buffer.byteLength(frame) > TASK_FRAME_BYTES)
       throw new ServiceError('context_capacity', 'Mandatory task state exceeds the context budget');
     const admittedContext = this.admitted?.frame(id);
-    return admittedContext
+    const projectInstructions = this.instructions?.frame(id);
+    return admittedContext || projectInstructions
       ? 'SALAAM_TASK_STATE ' +
           canonical({
             ...JSON.parse(frame.slice('SALAAM_TASK_STATE '.length)),
-            admitted_context: admittedContext,
+            ...(admittedContext ? { admitted_context: admittedContext } : {}),
+            ...(projectInstructions ? { project_instructions: projectInstructions } : {}),
           })
       : frame;
   }

package/src/task-critic.ts

@@ -0,0 +1,171 @@
+import { randomUUID } from 'node:crypto';
+import type { Store } from './store.js';
+import type { Artifacts } from './artifacts.js';
+import type { AgentGrant } from './agent-profiles.js';
+import type { WorkTask } from './task-work.js';
+import type { WorkspaceTree } from './workspaces.js';
+import type { ChildTask } from './protocol.js';
+
+/**
+ * The completion critic (item 8). When the admitted plan declares a critic, the built-in reviewer
+ * reads an immutable snapshot of the verified deliverables against the plan's rubric before the
+ * task may complete. Its verdict is bound to the exact verified evidence (checks and tree): any
+ * later change makes it stale. A critical or high finding means changes are needed; a reviewer
+ * that reports nothing at all is a failure, never a pass.
+ */
+export const CRITIC_BUDGET = 4;
+export const CRITIC_REOPENS = 2;
+export type CriticVerdict =
+  | { state: 'pass' }
+  | { state: 'pending' }
+  | { state: 'changes_needed'; findings: CriticFinding[] }
+  | { state: 'failed'; reason: string };
+export interface CriticFinding {
+  path: string;
+  line: number;
+  severity: string;
+  message: string;
+}
+export interface CriticDeps {
+  admit(task: WorkTask, request: string): Promise<AgentGrant>;
+  spawn(
+    task: WorkTask,
+    parentAttempt: string,
+    step: string,
+    prompt: string,
+    budget: number,
+    grant: AgentGrant,
+    snapshot: WorkspaceTree,
+  ): ChildTask;
+  workerId(childId: string): string;
+}
+
+export class TaskCritic {
+  constructor(
+    private readonly store: Store,
+    private readonly artifacts: Artifacts,
+    private readonly deps: CriticDeps,
+  ) {
+    store.db.exec(`CREATE TABLE IF NOT EXISTS task_critics(
+      id TEXT PRIMARY KEY NOT NULL,
+      task_id TEXT NOT NULL,
+      plan_revision INTEGER NOT NULL,
+      evidence_digest TEXT NOT NULL,
+      round INTEGER NOT NULL,
+      child_id TEXT NOT NULL,
+      state TEXT NOT NULL,
+      findings TEXT,
+      reason TEXT,
+      UNIQUE(task_id, plan_revision, evidence_digest))`);
+  }
+  /** Whether this exact verified evidence has a passing critic verdict. */
+  passed(task: WorkTask, evidenceDigest: string): boolean {
+    return (
+      this.store.db
+        .prepare(
+          "SELECT 1 FROM task_critics WHERE task_id=? AND plan_revision=? AND evidence_digest=? AND state='pass'",
+        )
+        .get(task.id, task.plan_revision, evidenceDigest) !== undefined
+    );
+  }
+  /** How many times the critic has sent this plan revision back for changes. */
+  reopens(task: WorkTask): number {
+    return Number(
+      this.store.db
+        .prepare(
+          "SELECT count(*) AS n FROM task_critics WHERE task_id=? AND plan_revision=? AND state='changes_needed'",
+        )
+        .get(task.id, task.plan_revision)!.n,
+    );
+  }
+  /** The verdict for this verified evidence, starting the reviewer the first time it is asked. */
+  async gate(
+    task: WorkTask,
+    evidenceDigest: string,
+    deliverables: { path: string; content: string }[],
+  ): Promise<CriticVerdict> {
+    const critic = task.completion_gate?.critic;
+    if (!critic) return { state: 'pass' };
+    const row = this.store.db
+      .prepare(
+        'SELECT * FROM task_critics WHERE task_id=? AND plan_revision=? AND evidence_digest=?',
+      )
+      .get(task.id, task.plan_revision, evidenceDigest);
+    if (row) return this.settle(row);
+    const last = this.store.db
+      .prepare(
+        'SELECT b.attempt_id FROM task_step_attempts b JOIN task_steps s ON s.id=b.step_id WHERE s.task_id=? ORDER BY b.rowid DESC LIMIT 1',
+      )
+      .get(task.id);
+    if (!last) return { state: 'failed', reason: 'No step attempt for the critic to follow' };
+    if (!deliverables.length)
+      return { state: 'failed', reason: 'No verified deliverables to review' };
+    const round =
+      Number(
+        this.store.db
+          .prepare('SELECT count(*) AS n FROM task_critics WHERE task_id=? AND plan_revision=?')
+          .get(task.id, task.plan_revision)!.n,
+      ) + 1;
+    const snapshot: WorkspaceTree = Object.fromEntries(
+      deliverables.map((d) => [
+        d.path,
+        { content: Buffer.from(d.content, 'utf8').toString('base64'), executable: false },
+      ]),
+    );
+    const grant = await this.deps.admit(task, `critic:${task.id}:${task.plan_revision}`);
+    const child = this.deps.spawn(
+      task,
+      String(last.attempt_id),
+      `critic-${task.plan_revision}-${round}`,
+      [
+        'Judge the delivered work against this rubric before it is accepted:',
+        critic.rubric,
+        '',
+        'Objective: ' + task.objective,
+        'Deliverables (the snapshot): ' + deliverables.map((d) => d.path).join(', '),
+        '',
+        'Report findings with salaam_findings, citing the file and line. Use critical or high only',
+        'for what must change before the work is accepted; medium or low for suggestions. If the',
+        'work meets the rubric, report an empty list.',
+      ].join('\n'),
+      CRITIC_BUDGET,
+      grant,
+      snapshot,
+    );
+    this.store.db
+      .prepare("INSERT INTO task_critics VALUES (?,?,?,?,?,?,'running',NULL,NULL)")
+      .run(randomUUID(), task.id, task.plan_revision, evidenceDigest, round, child.id);
+    return { state: 'pending' };
+  }
+  private settle(row: Record<string, unknown>): CriticVerdict {
+    if (row.state === 'pass') return { state: 'pass' };
+    if (row.state === 'changes_needed')
+      return { state: 'changes_needed', findings: JSON.parse(String(row.findings)) };
+    if (row.state === 'failed') return { state: 'failed', reason: String(row.reason) };
+    const child = this.store.db
+      .prepare('SELECT state FROM child_tasks WHERE id=?')
+      .get(String(row.child_id));
+    if (!child || child.state === 'accepted') return { state: 'pending' };
+    const report = this.store.db
+      .prepare('SELECT artifact_id FROM specialist_reports WHERE worker_id=?')
+      .get(this.deps.workerId(String(row.child_id)));
+    const set = (state: string, findings: CriticFinding[] | null, reason: string | null) =>
+      this.store.db
+        .prepare('UPDATE task_critics SET state=?,findings=?,reason=? WHERE id=?')
+        .run(state, findings ? JSON.stringify(findings) : null, reason, String(row.id));
+    if (!report) {
+      const reason = 'The critic returned no findings report';
+      set('failed', null, reason);
+      return { state: 'failed', reason };
+    }
+    const findings = (
+      JSON.parse(this.artifacts.read(String(report.artifact_id))).findings as CriticFinding[]
+    ).map(({ path, line, severity, message }) => ({ path, line, severity, message }));
+    if (findings.some((f) => f.severity === 'critical' || f.severity === 'high')) {
+      set('changes_needed', findings, null);
+      return { state: 'changes_needed', findings };
+    }
+    set('pass', findings, null);
+    return { state: 'pass' };
+  }
+}

package/src/task-driver.ts

@@ -1,3 +1,6 @@
+import { CRITIC_REOPENS } from './task-critic.js';
+import { requiredChecks } from './task-policy.js';
+import { RATE_LIMIT_STOP, RateLimitRetries } from './rate-limit-retries.js';
 import { randomUUID } from 'node:crypto';
 import type { Store } from './store.js';
 import type { TaskWork, WorkTask } from './task-work.js';
@@ -15,6 +18,7 @@ export class TaskDriver {
   awaitingAuthorityRenewal?: (session: string) => boolean;
   private active?: Promise<void>;
   private stopped = true;
+  readonly rateLimits: RateLimitRetries;
   constructor(
     readonly store: Store,
     readonly tasks: TaskWork,
@@ -24,6 +28,7 @@ export class TaskDriver {
     readonly children: ChildWork,
     readonly coding: CodingWork,
   ) {
+    this.rateLimits = new RateLimitRetries(store);
     tasks.assertProgressionBinding = (task, binding) => {
       if (canonical(this.verification.binding(task)) !== binding)
         throw new ServiceError(
@@ -374,6 +379,20 @@ export class TaskDriver {
       return;
     }
     if (task.steps.some((s) => ['interrupted', 'failed', 'cancelled'].includes(s.state))) {
+      // A provider 429 is retried as a fresh attempt of the step after a backoff; past the limit,
+      // or with no progression step left, the task stops with a block recovery can settle.
+      const retry = this.rateLimits.decide(task);
+      if (retry.action === 'wait') return;
+      if (retry.action === 'retry' && Number(r.remaining_steps) >= 1) {
+        if (!(await this.worker(task)) || this.stopped) return;
+        this.tasks.retryStep(task.id, retry.step, retry.n, Number(r.auto_epoch));
+        return;
+      }
+      if (retry.action !== 'none') {
+        this.budget.block(task.session_id, RATE_LIMIT_STOP);
+        this.stop(task, RATE_LIMIT_STOP);
+        return;
+      }
       this.stop(task, 'An interrupted or failed step requires explicit operator review');
       return;
     }
@@ -420,13 +439,41 @@ export class TaskDriver {
       // the native workspace. Wait for the whole set before testing freshness;
       // finishAsync still performs the final transactional evidence validation.
       if (
-        task.acceptance.some((check) => {
+        requiredChecks(task).some((check) => {
           const receipt = this.verification.latest(task, check.key, null);
           return receipt?.state === 'accepted' || receipt?.state === 'running';
         })
       )
         return;
-      for (const check of task.acceptance) if (!(await this.check(task, check.key, null))) return;
+      for (const check of requiredChecks(task))
+        if (!(await this.check(task, check.key, null))) return;
+      // Item 8: a declared critic reviews the verified deliverables before completion.
+      if (task.completion_gate?.critic) {
+        const verdict = await this.verification.criticGateAsync(task);
+        if (verdict.state === 'pending') return;
+        if (verdict.state === 'failed') {
+          this.stop(task, 'Critic review failed: ' + verdict.reason);
+          return;
+        }
+        if (verdict.state === 'changes_needed') {
+          const round = this.verification.critic!.reopens(task);
+          if (round > CRITIC_REOPENS || Number(r.remaining_steps) < 1) {
+            this.stop(task, 'Critic requested changes');
+            return;
+          }
+          if (!(await this.worker(task)) || this.stopped) return;
+          this.tasks.reopenForCritic(
+            task.id,
+            task.steps.at(-1)!.id,
+            round,
+            Number(r.auto_epoch),
+            verdict.findings
+              .map((f) => `- ${f.path}:${f.line} (${f.severity}) ${f.message}`)
+              .join('\n'),
+          );
+          return;
+        }
+      }
       await this.verification.finishAsync(
         task.id,
         'auto-finish:' + task.id + ':' + task.plan_revision,

package/src/task-policy.ts

@@ -17,11 +17,41 @@ export interface TaskLimits {
   output_token_bound: number | null;
   verification_runs: number;
 }
+/** Item 8: checks required at completion, next to the acceptance checks. The critic is not yet
+ * admitted, so it is always null. */
+export interface CompletionGate {
+  /** The built-in reviewer judges the verified deliverables against this rubric. */
+  critic: { rubric: string } | null;
+  hooks: TaskCheck[];
+}
 export interface TaskPolicy {
   acceptance: TaskCheck[];
   deliverables: string[];
   limits: TaskLimits;
+  /** Present only when the plan declares one, so a plan without it keeps its exact shape. */
+  completion_gate?: CompletionGate;
+}
+/** Every check completion requires: the acceptance checks, then each hook as hook-<key>. */
+export function requiredChecks(
+  policy: Pick<TaskPolicy, 'acceptance' | 'completion_gate'>,
+): TaskCheck[] {
+  return [
+    ...policy.acceptance,
+    ...(policy.completion_gate?.hooks ?? []).map((h) => ({ ...h, key: 'hook-' + h.key })),
+  ];
 }
+const check = (v: unknown, keys: Set<string>, what: string): TaskCheck => {
+  const c = object(v),
+    key = string(c.key, what + ' key', 64);
+  if (!/^[a-zA-Z0-9_-]+$/.test(key) || keys.has(key))
+    throw new ServiceError('invalid_plan', what + ' keys must be unique identifiers', 400);
+  keys.add(key);
+  return {
+    key,
+    command: string(c.command, what + ' command', 4096),
+    cwd: c.cwd === undefined || c.cwd === '.' ? '.' : filePath(c.cwd),
+  };
+};
 export const DEFAULT_TASK_LIMITS: TaskLimits = {
   requests: 64,
   runtime_ms: 900000,
@@ -36,18 +66,7 @@ export function taskPolicy(value: Record<string, unknown>): TaskPolicy {
   if (!Array.isArray(raw) || raw.length > 8)
     throw new ServiceError('invalid_plan', 'Supply at most eight acceptance checks', 400);
   const keys = new Set<string>();
-  const acceptance = raw.map((v) => {
-    const c = object(v),
-      key = string(c.key, 'check key', 64);
-    if (!/^[a-zA-Z0-9_-]+$/.test(key) || keys.has(key))
-      throw new ServiceError('invalid_plan', 'Acceptance keys must be unique identifiers', 400);
-    keys.add(key);
-    return {
-      key,
-      command: string(c.command, 'check command', 4096),
-      cwd: c.cwd === undefined || c.cwd === '.' ? '.' : filePath(c.cwd),
-    };
-  });
+  const acceptance = raw.map((v) => check(v, keys, 'Acceptance'));
   const paths = value.deliverables ?? [];
   if (!Array.isArray(paths) || paths.length > 32)
     throw new ServiceError('invalid_plan', 'Supply at most 32 deliverable paths', 400);
@@ -88,5 +107,38 @@ export function taskPolicy(value: Record<string, unknown>): TaskPolicy {
       throw new ServiceError('invalid_budget', 'Invocation limit must be 1–64', 400);
     limits.invocations = n;
   }
-  return { acceptance, deliverables, limits };
+  let completion_gate: CompletionGate | undefined;
+  if (value.completion_gate !== undefined) {
+    const g = object(value.completion_gate);
+    const hooks = g.hooks;
+    const c = g.critic;
+    const critic =
+      c === null
+        ? null
+        : (() => {
+            const v = object(c);
+            if (Object.keys(v).join(',') !== 'rubric')
+              throw new ServiceError('invalid_plan', 'A critic names only its rubric', 400);
+            return { rubric: string(v.rubric, 'critic rubric', 4096) };
+          })();
+    if (
+      Object.keys(g).sort().join(',') !== 'critic,hooks' ||
+      !Array.isArray(hooks) ||
+      hooks.length > 8 ||
+      (!critic && hooks.length < 1)
+    )
+      throw new ServiceError(
+        'invalid_plan',
+        'A completion gate has a critic or 1–8 hooks, and at most 8 hooks',
+        400,
+      );
+    const hookKeys = new Set<string>();
+    completion_gate = { critic, hooks: hooks.map((v) => check(v, hookKeys, 'Hook')) };
+    if (
+      requiredChecks({ acceptance, completion_gate }).length !==
+      new Set(requiredChecks({ acceptance, completion_gate }).map((c) => c.key)).size
+    )
+      throw new ServiceError('invalid_plan', 'A hook collides with an acceptance check', 400);
+  }
+  return { acceptance, deliverables, limits, ...(completion_gate ? { completion_gate } : {}) };
 }

package/src/task-verification.ts

@@ -1,3 +1,5 @@
+import type { TaskCritic, CriticVerdict } from './task-critic.js';
+import { requiredChecks } from './task-policy.js';
 import { StationTaskVerification, type StationCheckEvidence } from './station-task-verification.js';
 import type { StationWork } from './station-work.js';
 import { randomUUID } from 'node:crypto';
@@ -63,7 +65,7 @@ export class TaskVerification {
   }
   assertIdle(task: WorkTask, stationInspection?: string): void {
     if (
-      this.budget.active(task) > 0 ||
+      this.budget.active(task, { verification: true }) > 0 ||
       this.store.db
         .prepare("SELECT 1 FROM compactions WHERE session_id=? AND state='running'")
         .get(task.session_id)
@@ -156,7 +158,7 @@ export class TaskVerification {
           throw new ServiceError('task_settled', 'Revise a cancelled task before completing it');
         this.assertIdle(task);
         if (!this.station) this.coding.assertSafe(task.session_id);
-        if (!task.acceptance.some((c) => c.key === key))
+        if (!requiredChecks(task).some((c) => c.key === key))
           throw new ServiceError('invalid_check', 'Check is not in this task plan');
         if (
           step &&
@@ -215,7 +217,7 @@ export class TaskVerification {
       return;
     }
     const task = this.tasks.get(receipt.task_id),
-      check = task.acceptance.find((c) => c.key === receipt.check_key);
+      check = requiredChecks(task).find((c) => c.key === receipt.check_key);
     try {
       const existing = this.store.db
         .prepare('SELECT id FROM command_runs WHERE session_id=? AND step_key=?')
@@ -485,6 +487,32 @@ export class TaskVerification {
       );
     return this.finishRecorded(id, request, expected, exception, authorize);
   }
+  /** Item 8: the completion critic, when the service has one. */
+  critic?: TaskCritic;
+  /** The critic's verdict on the current fresh verified evidence, starting it the first time.
+   * Reads the evidence outside the finishing transaction, so starting the reviewer can never be
+   * rolled back with a refused finish; the finish itself re-checks the verdict against its own
+   * evidence. */
+  async criticGateAsync(task: WorkTask): Promise<CriticVerdict> {
+    if (!task.completion_gate?.critic) return { state: 'pass' };
+    if (!this.critic || !this.station)
+      return { state: 'failed', reason: 'A critic needs the station verification boundary' };
+    const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
+    if (checks.some((c) => !c || c.state !== 'passed')) return { state: 'pending' };
+    const fresh = await this.station.withFreshMany(
+      checks.map((c) => c!.id),
+      task.deliverables,
+      (evidence, deliverables) => ({ evidence, deliverables }),
+    );
+    return this.critic.gate(
+      task,
+      digest(fresh.evidence),
+      (fresh.deliverables as { path: string; content: string }[]).map(({ path, content }) => ({
+        path,
+        content,
+      })),
+    );
+  }
   async finishAsync(
     id: string,
     request: string,
@@ -521,7 +549,7 @@ export class TaskVerification {
         'verification_required',
         'Configured checks and deliverables required',
       );
-    const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+    const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
     if (checks.some((c) => !c || c.state !== 'passed'))
       throw new ServiceError('verification_required', 'Passed configured checks required');
     return this.station.withFreshMany(
@@ -541,7 +569,7 @@ export class TaskVerification {
     if (view.completion?.state === 'succeeded') {
       try {
         const evidence = JSON.parse(this.artifacts.read(String(view.completion.artifact_id)));
-        const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+        const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
         if (checks.some((c) => !c || c.state !== 'passed' || !evidence.checks.includes(c.id)))
           throw Error('Changed checks');
         view.completion.fresh = await this.station.withFreshMany(
@@ -578,7 +606,7 @@ export class TaskVerification {
       this.assertIdle(task);
       if (task.steps.some((s) => s.state !== 'completed'))
         throw new ServiceError('verification_required', 'Every step must be reviewed or verified');
-      const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+      const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
       const missing: string[] = [];
       if (!task.acceptance.length) missing.push('No configured acceptance checks');
       if (!task.deliverables.length) missing.push('No configured deliverable paths');
@@ -589,7 +617,7 @@ export class TaskVerification {
             ? !protectedResult.evidence.some((e) => e.check_id === checks[n]!.id)
             : !this.fresh(checks[n]!))
         )
-          missing.push('Fresh check required: ' + task.acceptance[n]!.key);
+          missing.push('Fresh check required: ' + requiredChecks(task)[n]!.key);
       let workspace: { id: string; revision: number; digest: string } | null = null,
         deliverables: unknown[] = [],
         diff: unknown = null;
@@ -597,7 +625,17 @@ export class TaskVerification {
         if (protectedResult) {
           const e = protectedResult.evidence[0]!;
           workspace = { id: 'station:' + e.root_digest, revision: 0, digest: e.tree_digest };
-          deliverables = protectedResult.deliverables;
+          // Keep each deliverable's verified bytes as a session artifact, committed with the
+          // completion, so publication reads the verified revision and never the live workspace.
+          deliverables = (
+            protectedResult.deliverables as { path: string; sha256: string; content: string }[]
+          ).map(({ path, sha256, content }) => {
+            if (typeof content !== 'string')
+              throw new ServiceError('verification_required', 'Deliverable bytes unavailable');
+            const artifact = this.artifacts.prepare(task.session_id, content);
+            artifact.commit();
+            return { path, sha256, artifact_id: artifact.id };
+          });
           diff = {
             backend: 'linux-systemd-station-v1',
             root_digest: e.root_digest,
@@ -617,6 +655,12 @@ export class TaskVerification {
       } catch (error) {
         missing.push('Workspace verification unavailable: ' + (error as Error).message);
       }
+      // Item 8: a declared critic must have passed this exact verified evidence.
+      if (
+        task.completion_gate?.critic &&
+        !(protectedResult && this.critic?.passed(task, digest(protectedResult.evidence)))
+      )
+        missing.push('Critic review required');
       if (missing.length && !exception)
         throw new ServiceError('verification_required', missing.join('; '));
       if (exception) {
@@ -702,7 +746,7 @@ export class TaskVerification {
           if (completion.state === 'succeeded')
             fresh =
               fresh &&
-              task.acceptance.every((check) => {
+              requiredChecks(task).every((check) => {
                 const latest = this.latest(task, check.key, null);
                 return !!latest && evidence.checks.includes(latest.id) && this.fresh(latest);
               });