@tea-agent/loop-agent 0.1.0-fe-test.0

package/dist/worker/console/operator-actions.js

@@ -0,0 +1,3768 @@
+import { access, readFile } from "node:fs/promises";
+import { buildOperatorCapabilitiesDocument, OFFICIAL_TAIL_ACTION_IDS, } from "../../shared/operator/capabilities.js";
+import { buildOperatorResult, operatorFailed, operatorSucceeded, } from "../../shared/operator/envelope.js";
+import { CANONICAL_TASK_ID_PATTERN, formatLocalBusinessDate, getTaskPaths, loadTaskConfig, } from "../../task/runtime.js";
+import { diffTaskContract, validateDraftForTask, } from "../../task/contract/index.js";
+import { stageUtf8Text } from "./app-data.js";
+import { ALL_CONFIRMATION_CHALLENGES, hashDagBytes, } from "./dag-confirmation.js";
+import { capabilityForObserveTarget, DEFAULT_OBSERVE_BASE_URL, OBSERVE_START_COMMAND, probeAndClassifyObserve, } from "./observe-health-match.js";
+import { buildInspectDeepLink, buildObserveDeepLink, } from "./observe-link.js";
+import { resolveLatestDagRunIdForTask } from "./resolve-dag-run-for-task.js";
+import { repoFingerprintV1 } from "./repo-fingerprint.js";
+import { scheduleOperation, } from "./operation-runner.js";
+import { readinessGateFailure, } from "./pi-readiness.js";
+import { validatePiModelMatrixTiers, writePiModelMatrix, } from "./harness-pi-model-matrix.js";
+import { isAssessmentFreshForDraft } from "./interview/assessment.js";
+import { applyGrillMeAnswer, draftSummary, emptyDraft, isDraftStructurallyComplete, nextGrillMeQuestion, } from "./interview/grill-me.js";
+import { toCanonicalDraftForCli, } from "./draft-store.js";
+import { normalizeConsoleWorkflowKind } from "./workflow-kinds.js";
+import { deriveTaskIdentityFromPrd, nextTaskIdRevision, } from "./prd-identity.js";
+import { appendEngineeringCliArgs, buildDraftFromTaskIntake, parseEngineeringBoundaryFromParams, } from "./prd-intake-bridge.js";
+import { discoverPrdReferences } from "./prd-reference-discovery.js";
+import { clearSemanticIntakeAttempt, SEMANTIC_INTAKE_CLI_TIMEOUT_MS, } from "../../task/source-prepare/semantic-intake.js";
+import nodePath from "node:path";
+import { resolveSiblingAgentWorkerBin } from "./sibling-controller.js";
+import { projectOperationEventSummary, projectOperationForChat, } from "./chat/chat-event-store.js";
+import { OperationWaitError, waitForOperationChange, } from "./operation-wait.js";
+import { MutationGateReceiptStore } from "./mutation-gate-receipt-store.js";
+import { formatIneligibleRerunMessage } from "./recovery-error-copy.js";
+import { evaluateConsoleDagInterruptEligibility } from "../observability/interrupt-eligibility.js";
+import { INTERRUPT_ERROR_MESSAGES, isInterruptReasonCode, normalizeInterruptReasonDetail, } from "../observability/interrupt-eligibility.js";
+import { assessAutonomousExecutionEligibility, deriveEligibilityFactsFromDagSpec, } from "./dag-execution-receipt.js";
+import { issueHumanGateToken, mutationGatePayloadHash, verifyHumanGateToken, } from "./human-gate-token.js";
+const MUTATION_GATE_ACTIONS = new Set([
+    // 2026-08-11: standaloneTaskRerun / workerTaskRetry are autonomous (server
+    // run-facts checks). Destructive DAG reconciliation, live cooperative
+    // interrupt, and Night Scheduler mutations still need the browser Human Gate.
+    "dagReconcileRun",
+    "dagRequestInterrupt",
+    "workerAdmissionPrepare",
+    "workerSchedulerAdd",
+    "workerSchedulerCancel",
+    "workerSchedulerHarvest",
+    "workerSchedulerDiscard",
+]);
+const MUTATION_OR_LONG = new Set([
+    "newTask",
+    "importPrd",
+    "contractApply",
+    "contractAdopt",
+    "contractRecover",
+    "taskAdvance",
+    "dagRunTask",
+    "runDag",
+    "dagRerun",
+    "dagReconcileRun",
+    "dagRequestInterrupt",
+    "standaloneTaskRerun",
+    "workerTaskRetry",
+]);
+function paramsOf(req) {
+    return (req.actionParams ?? {});
+}
+function str(v) {
+    return typeof v === "string" && v.trim() ? v.trim() : undefined;
+}
+const TASK_ID_PLACEHOLDER_RE = /[<>]|^(?:id|task-?id|your-task-id|todo|tbd)$/i;
+/** Mirror of runtime GENERIC_TASK_SLUGS (not exported there); keep in sync. */
+const GENERIC_SLUG_SET = new Set(["test", "fix", "tmp", "new-task"]);
+const TASK_ADVANCE_ALIAS_ACTIONS = new Set(["promoteRun", "closeoutTask"]);
+function taskIdInputError(taskId) {
+    if (!TASK_ID_PLACEHOLDER_RE.test(taskId))
+        return undefined;
+    return `taskId must be a concrete canonical id; placeholder values are not allowed: ${JSON.stringify(taskId)}`;
+}
+/** Extract write-set gate token from task advance operator JSON. */
+function extractWriteSetGateTokenFromCliJson(json, taskId) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const envelope = json;
+    const payload = envelope.result && typeof envelope.result === "object"
+        ? envelope.result
+        : envelope;
+    const gate = payload.gate && typeof payload.gate === "object"
+        ? payload.gate
+        : undefined;
+    const id = typeof gate?.id === "string" ? gate.id : undefined;
+    const digest = typeof gate?.digest === "string" ? gate.digest : undefined;
+    if (!id || !digest)
+        return undefined;
+    // taskId kept for future binding checks / logging symmetry with worker.
+    void taskId;
+    return `${id}:${digest}`;
+}
+function readWriteSetGateToken(reviewPacket) {
+    if (!reviewPacket)
+        return undefined;
+    const token = reviewPacket.writeSetGateToken;
+    return typeof token === "string" && token.includes(":") ? token : undefined;
+}
+/** Extract the review packet from a task advance --dag-output operator JSON. */
+function extractReviewPacketFromCliJson(json) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const envelope = json;
+    const payload = envelope.result && typeof envelope.result === "object"
+        ? envelope.result
+        : envelope;
+    const packet = payload.reviewPacket;
+    return packet && typeof packet === "object"
+        ? packet
+        : undefined;
+}
+/**
+ * Read the live managed Task Contract binding for a task (server-derived).
+ * Returns undefined when the task is not managed or status facts are missing
+ * so callers can fail closed.
+ */
+async function readLiveTaskContractBinding(ctx, taskId) {
+    const showBody = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+    const statusResult = (showBody.result ?? {});
+    const c = showBody.ok ? statusResult.contract : undefined;
+    if (!c?.canonicalHash || typeof c.revision !== "number")
+        return undefined;
+    return {
+        schemaVersion: 1,
+        taskId,
+        revision: c.revision,
+        canonicalHash: c.canonicalHash,
+        taskConfigSha256: c.taskConfigSha256 ?? undefined,
+        projectionVersion: c.projectionVersion ?? undefined,
+        canonicalizerVersion: c.canonicalizerVersion ?? undefined,
+        taskConfigSchemaVersion: c.taskConfigSchemaVersion ?? undefined,
+    };
+}
+function gateError(action, code, message, details) {
+    const status = code === "NOT_FOUND" ? 404 : code === "INVALID_INPUT" ? 400 : 403;
+    return {
+        kind: "error",
+        status,
+        body: operatorFailed({
+            command: action,
+            outcome: "blocked",
+            code,
+            message,
+            details,
+        }),
+    };
+}
+/**
+ * `dag report --json` is `{ schemaVersion, runs: [...] }` (no Operator `ok`).
+ * `runReadCli` used to wrap that as `{ stdout, raw }`, which made the
+ * autonomous rerun gate miss `primaryFailure` even after the UI showed the
+ * report (2026-08-16). Accept both the native report shape and the wrap.
+ */
+function extractDagReportRunFacts(reportResult, runId) {
+    const asRecord = (value) => value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+    const result = asRecord(reportResult);
+    const envelope = Array.isArray(result?.runs)
+        ? result
+        : asRecord(result?.raw);
+    if (!envelope)
+        return undefined;
+    const runs = Array.isArray(envelope.runs) ? envelope.runs : [];
+    const matched = runs.find((entry) => asRecord(entry)?.runId === runId) ?? runs[0];
+    const matchedRec = asRecord(matched);
+    if (matchedRec?.primaryFailure) {
+        return {
+            primaryFailure: asRecord(matchedRec.primaryFailure),
+            primaryRecovery: asRecord(matchedRec.primaryRecovery),
+        };
+    }
+    if (envelope.primaryFailure) {
+        return {
+            primaryFailure: asRecord(envelope.primaryFailure),
+            primaryRecovery: asRecord(envelope.primaryRecovery),
+        };
+    }
+    return undefined;
+}
+/**
+ * 2026-08-11 R2 run-facts check for standaloneTaskRerun (read-only CLI
+ * evidence only — no browser Human Gate). Fails closed when facts are missing.
+ */
+async function assertAutonomousRerunEligible(ctx, runId, taskId) {
+    const report = await runReadCli(ctx, ["dag", "report", "--run-id", runId, "--json"], "dag report");
+    const reportResult = extractDagReportRunFacts(report.ok ? report.result : undefined, runId);
+    const recovery = reportResult?.primaryRecovery;
+    if (!report.ok || !reportResult?.primaryFailure || !recovery) {
+        return gateError("standaloneTaskRerun", "INVALID_INPUT", "cannot read dagReport run facts; standaloneTaskRerun requires server-side run evidence", { runId });
+    }
+    if (recovery.humanRequired === true) {
+        return gateError("standaloneTaskRerun", "HUMAN_CONFIRMATION_REQUIRED", `primaryRecovery requires a human decision (action=${recovery.action ?? "?"}); stop autonomous rerun`, { runId });
+    }
+    const nodeId = reportResult.primaryFailure.scope === "node"
+        ? reportResult.primaryFailure.nodeId
+        : undefined;
+    let planEligible;
+    if (nodeId) {
+        const plan = await runReadCli(ctx, [
+            "dag",
+            "rerun",
+            "--run-id",
+            runId,
+            "--from-node",
+            nodeId,
+            "--plan",
+            "--json",
+        ], "dag rerun plan");
+        const planResult = (plan.result ?? {});
+        if (plan.ok && planResult.eligible === true) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", `node rerun plan is eligible (planHash=${planResult.planHash ?? "?"}); use dagRerun with the fresh planHash instead of standaloneTaskRerun`, { runId, nodeId });
+        }
+        if (!plan.ok && planResult.eligible === undefined) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", "dagRerunPlan run facts unavailable; standaloneTaskRerun fails closed", { runId, nodeId });
+        }
+        planEligible = planResult.eligible;
+    }
+    if (planEligible !== false) {
+        // No ineligible-plan evidence: require an explicit rerun-task recommendation.
+        const recommendsRerunTask = recovery.action === "rerun-after-fix" ||
+            /rerun-task|standalone/i.test(recovery.commandHint ?? "");
+        if (!recommendsRerunTask) {
+            return gateError("standaloneTaskRerun", "HUMAN_CONFIRMATION_REQUIRED", `run facts do not support autonomous standaloneTaskRerun (recovery action=${recovery.action ?? "?"}); stop`, { runId });
+        }
+    }
+    if (taskId) {
+        // Keep the original taskId: the run must still be bound to it.
+        const status = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+        const statusResult = (status.ok ? status.result : undefined);
+        const boundRunId = statusResult?.activeRun?.runId ?? statusResult?.latestRun?.runId;
+        if (!status.ok || !boundRunId || boundRunId !== runId) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", `taskId ${taskId} is not bound to run ${runId}; keep the original taskId for same-task rerun`, { runId, taskId, boundRunId });
+        }
+    }
+    return { kind: "ready" };
+}
+/**
+ * 2026-08-11 read-only facts check for workerTaskRetry: the task must exist
+ * in the pool doctor inventory with status Failed (featureId consistent).
+ */
+async function assertWorkerTaskRetryFacts(ctx, taskId, featureId) {
+    const run = ctx.runCommand ??
+        ((args, options) => ctx.client.runExternal
+            ? ctx.client.runExternal(resolveSiblingAgentWorkerBin(), args, options)
+            : ctx.client.run(args, options));
+    let result;
+    try {
+        result = await run(["pool", "doctor", "--repo", ctx.repoRoot, "--json"], {
+            cwd: ctx.repoRoot,
+            artifactName: "worker-task-retry-facts",
+            expectJson: true,
+        });
+    }
+    catch (error) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `cannot read pool doctor facts: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!result.ok || result.exitCode !== 0 || !result.json) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", "cannot read pool doctor run facts; workerTaskRetry fails closed");
+    }
+    const doctor = result.json;
+    const v2Entry = (doctor.v2 ?? []).find((entry) => entry.taskId === taskId);
+    const legacyEntry = (doctor.legacy ?? []).find((entry) => entry.taskId === taskId && Boolean(entry.featureId));
+    const entry = v2Entry ?? legacyEntry;
+    if (!entry) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `task ${taskId} not found in the pool doctor inventory`, { taskId });
+    }
+    if (entry.status !== "Failed") {
+        return gateError("workerTaskRetry", "HUMAN_CONFIRMATION_REQUIRED", `task ${taskId} is ${entry.status}; only Failed tasks are retry-eligible`, { taskId, status: entry.status });
+    }
+    if (featureId && entry.featureId && entry.featureId !== featureId) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `featureId ${featureId} does not match the pool task ${taskId} (${entry.featureId})`, { taskId, featureId, observedFeatureId: entry.featureId });
+    }
+    return { kind: "ready" };
+}
+/**
+ * Prefer structured stdout JSON failure semantics (findings / message) over bare
+ * `exit N` when stderr is empty — spine audit and similar read CLIs write details
+ * to stdout JSON and exit non-zero with empty stderr.
+ */
+function summarizeReadCliFailure(result) {
+    const fromJson = summarizeJsonFailure(result.json);
+    if (fromJson)
+        return fromJson;
+    const stderr = (result.stderr ?? "").trim();
+    if (stderr)
+        return stderr;
+    return `exit ${result.exitCode}`;
+}
+function summarizeJsonFailure(json) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const raw = json;
+    if (Array.isArray(raw.findings)) {
+        const messages = raw.findings
+            .map((finding) => {
+            if (!finding || typeof finding !== "object")
+                return "";
+            const message = finding.message;
+            return typeof message === "string" ? message.trim() : "";
+        })
+            .filter(Boolean);
+        if (messages.length > 0) {
+            const head = messages.slice(0, 6).join("; ");
+            return messages.length > 6 ? `${head}…` : head;
+        }
+    }
+    const nestedError = raw.error;
+    if (nestedError && typeof nestedError === "object") {
+        const message = nestedError.message;
+        if (typeof message === "string" && message.trim())
+            return message.trim();
+    }
+    if (typeof raw.message === "string" && raw.message.trim()) {
+        return raw.message.trim();
+    }
+    return undefined;
+}
+async function runReadCli(ctx, args, command) {
+    const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+    try {
+        const result = await run(args, {
+            cwd: ctx.repoRoot,
+            artifactName: `read-${command.replace(/\s+/g, "-")}`,
+            expectJson: true,
+        });
+        if (result.json && typeof result.json === "object") {
+            const raw = result.json;
+            const env = raw;
+            if (env.schemaVersion === 1 && typeof env.ok === "boolean") {
+                return env;
+            }
+            if (raw.schemaVersion === 1 && Array.isArray(raw.runs)) {
+                return operatorSucceeded(command, raw);
+            }
+            if (command === "dag rerun plan" &&
+                raw.plan &&
+                typeof raw.plan === "object") {
+                const plan = raw.plan;
+                if (raw.ok === true) {
+                    return operatorSucceeded(command, plan);
+                }
+                const blockedReasons = Array.isArray(plan.blockedReasons)
+                    ? plan.blockedReasons.map(String)
+                    : [];
+                const blockingNodes = Array.isArray(plan.blockingNodes)
+                    ? plan.blockingNodes
+                    : [];
+                return buildOperatorResult({
+                    command,
+                    ok: false,
+                    outcome: "rejected",
+                    result: plan,
+                    error: {
+                        code: "DAG_RERUN_INELIGIBLE",
+                        message: formatIneligibleRerunMessage({
+                            blockedReasons,
+                            blockingNodes,
+                        }),
+                        details: {
+                            eligible: false,
+                            planHash: typeof plan.planHash === "string" ? plan.planHash : undefined,
+                        },
+                    },
+                });
+            }
+        }
+        if (result.ok && result.exitCode === 0) {
+            return operatorSucceeded(command, {
+                stdout: result.stdout,
+                raw: result.json,
+            });
+        }
+        const message = summarizeReadCliFailure(result);
+        if (result.json && typeof result.json === "object") {
+            return buildOperatorResult({
+                command,
+                ok: false,
+                outcome: "rejected",
+                result: result.json,
+                error: {
+                    code: "INTERNAL_ERROR",
+                    message,
+                },
+            });
+        }
+        return operatorFailed({
+            command,
+            outcome: "rejected",
+            code: "INTERNAL_ERROR",
+            message,
+        });
+    }
+    catch (error) {
+        return operatorFailed({
+            command,
+            outcome: "needs-reconcile",
+            code: "OPERATION_NEEDS_RECONCILE",
+            message: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+async function acceptOperation(ctx, input) {
+    const created = await ctx.operations.create({
+        clientRequestId: input.clientRequestId,
+        action: input.action,
+        actionParams: input.actionParams,
+        taskId: input.taskId,
+        cliArgs: input.cliArgs,
+        ...(input.externalCommand
+            ? { externalCommand: input.externalCommand }
+            : {}),
+    });
+    if (created.kind === "conflict") {
+        return {
+            kind: "error",
+            status: 409,
+            body: operatorFailed({
+                command: input.action,
+                outcome: "conflict",
+                code: "REQUEST_ID_REUSE_CONFLICT",
+                message: created.message,
+                details: { operationId: created.existing.operationId },
+            }),
+        };
+    }
+    if (created.kind === "idempotent") {
+        return {
+            kind: "accepted",
+            status: 202,
+            body: {
+                operationId: created.operation.operationId,
+                state: created.operation.state,
+                clientRequestId: created.operation.clientRequestId,
+                action: created.operation.action,
+            },
+        };
+    }
+    const runnerDeps = {
+        store: ctx.operations,
+        events: ctx.events,
+        client: ctx.client,
+        repoRoot: ctx.repoRoot,
+        runCommand: ctx.runCommand,
+    };
+    scheduleOperation(created.operation.operationId, runnerDeps);
+    return {
+        kind: "accepted",
+        status: 202,
+        body: {
+            operationId: created.operation.operationId,
+            state: created.operation.state,
+            clientRequestId: created.operation.clientRequestId,
+            action: created.operation.action,
+        },
+    };
+}
+export async function dispatchOperatorAction(ctx, req) {
+    const action = req.action?.trim();
+    if (!action) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "operator",
+                outcome: "invalid",
+                code: "INVALID_INPUT",
+                message: "缺少 action",
+            }),
+        };
+    }
+    const readiness = ctx.getReadiness?.() ?? ctx.readiness;
+    const blocked = readinessGateFailure(readiness, action);
+    if (blocked) {
+        return {
+            kind: "error",
+            status: 412,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "PI_SETUP_REQUIRED",
+                message: blocked.message,
+                details: { state: blocked.state },
+            }),
+        };
+    }
+    const p = paramsOf(req);
+    switch (action) {
+        case "operatorCapabilities": {
+            const doc = buildOperatorCapabilitiesDocument();
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("operator capabilities", doc),
+            };
+        }
+        case "operationGet": {
+            const operationId = str(p.operationId);
+            if (!operationId)
+                return invalid(action, "operationId is required");
+            const operation = await ctx.operations.get(operationId);
+            if (!operation) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `operation not found: ${operationId}`,
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, projectOperationForChat(operation)),
+            };
+        }
+        case "operationList": {
+            const rawLimit = typeof p.limit === "number" ? p.limit : Number(p.limit ?? 20);
+            if (!Number.isFinite(rawLimit))
+                return invalid(action, "limit must be a number");
+            const limit = Math.max(1, Math.min(50, Math.floor(rawLimit)));
+            const state = str(p.state);
+            const actionFilter = str(p.action);
+            const operations = (await ctx.operations.list())
+                .filter((operation) => !state || operation.state === state)
+                .filter((operation) => !actionFilter || operation.action === actionFilter)
+                .slice(-limit)
+                .reverse()
+                .map(projectOperationForChat);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, { operations, limit }),
+            };
+        }
+        case "operationEventSummary": {
+            const operationId = str(p.operationId);
+            if (!operationId)
+                return invalid(action, "operationId is required");
+            const operation = await ctx.operations.get(operationId);
+            if (!operation) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `operation not found: ${operationId}`,
+                    }),
+                };
+            }
+            const rawLimit = typeof p.limit === "number" ? p.limit : Number(p.limit ?? 20);
+            if (!Number.isFinite(rawLimit))
+                return invalid(action, "limit must be a number");
+            const limit = Math.max(1, Math.min(100, Math.floor(rawLimit)));
+            const events = ctx.events
+                .snapshot(operationId)
+                .slice(-limit)
+                .map(projectOperationEventSummary);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, {
+                    operation: projectOperationForChat(operation),
+                    events,
+                    limit,
+                }),
+            };
+        }
+        case "operationWait": {
+            const operationId = str(p.operationId);
+            if (!operationId)
+                return invalid(action, "operationId is required");
+            const rawAfterSeq = p.afterSeq ?? 0;
+            const afterSeq = typeof rawAfterSeq === "number" ? rawAfterSeq : Number(rawAfterSeq);
+            const rawMaxWaitMs = p.maxWaitMs;
+            const maxWaitMs = typeof rawMaxWaitMs === "number"
+                ? rawMaxWaitMs
+                : rawMaxWaitMs === undefined
+                    ? undefined
+                    : Number(rawMaxWaitMs);
+            const rawWakeOn = str(p.wakeOn);
+            const wakeOn = rawWakeOn === "all" || rawWakeOn === "meaningful" ? rawWakeOn : undefined;
+            try {
+                const result = await waitForOperationChange({
+                    operations: ctx.operations,
+                    events: ctx.events,
+                    operationId,
+                    afterSeq,
+                    maxWaitMs,
+                    ...(wakeOn ? { wakeOn } : {}),
+                    poll: async () => {
+                        const current = await ctx.operations.get(operationId);
+                        const runId = current?.dagRunId ??
+                            (typeof current?.actionParams?.runId === "string"
+                                ? current.actionParams.runId
+                                : undefined);
+                        if (!current || !runId)
+                            return false;
+                        const eligibility = await evaluateConsoleDagInterruptEligibility({
+                            repoRoot: ctx.repoRoot,
+                            operations: ctx.operations,
+                            runId,
+                        });
+                        if (!eligibility.interrupt)
+                            return false;
+                        const targetId = eligibility.targetOperationId ?? current.operationId;
+                        return syncTargetInterruptProjection({
+                            operations: ctx.operations,
+                            events: ctx.events,
+                            operationId: targetId,
+                            runId,
+                            interrupt: eligibility.interrupt,
+                        });
+                    },
+                });
+                return {
+                    kind: "sync",
+                    status: 200,
+                    body: operatorSucceeded(action, result),
+                };
+            }
+            catch (error) {
+                if (error instanceof OperationWaitError) {
+                    if (error.code === "NOT_FOUND") {
+                        return {
+                            kind: "error",
+                            status: 404,
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "not-found",
+                                code: "NOT_FOUND",
+                                message: error.message,
+                            }),
+                        };
+                    }
+                    if (error.code === "EVENT_CURSOR_EXPIRED") {
+                        return {
+                            kind: "error",
+                            status: 410,
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "blocked",
+                                code: "EVENT_CURSOR_EXPIRED",
+                                message: error.message,
+                            }),
+                        };
+                    }
+                    return invalid(action, error.message);
+                }
+                throw error;
+            }
+        }
+        case "inspect": {
+            const body = await runReadCli(ctx, ["inspect", "--json"], "inspect");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "doctor": {
+            const body = await runReadCli(ctx, ["doctor", "--json"], "doctor");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "dagReport": {
+            const runId = str(p.runId) ?? str(p.dagRunId);
+            if (!runId) {
+                return invalid(action, "runId is required");
+            }
+            const body = await runReadCli(ctx, ["dag", "report", "--run-id", runId, "--json"], "dag report");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "dagDoctor": {
+            const runId = str(p.runId) ?? str(p.dagRunId);
+            const args = ["dag", "doctor"];
+            if (runId)
+                args.push("--run-id", runId);
+            const body = await runReadCli(ctx, args, "dag doctor");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "dagStatus": {
+            const runId = str(p.runId) ?? str(p.dagRunId);
+            if (!runId)
+                return invalid(action, "runId is required");
+            const body = await runReadCli(ctx, ["dag", "status", "--run-id", runId], "dag status");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "workerPoolDoctor": {
+            const taskId = str(p.taskId);
+            const run = ctx.runCommand ??
+                ((args, options) => ctx.client.runExternal
+                    ? ctx.client.runExternal(resolveSiblingAgentWorkerBin(), args, options)
+                    : ctx.client.run(args, options));
+            let result;
+            try {
+                result = await run(["pool", "doctor", "--repo", ctx.repoRoot, "--json"], {
+                    cwd: ctx.repoRoot,
+                    artifactName: "read-pool-doctor",
+                    expectJson: true,
+                });
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: `cannot read pool doctor facts: ${error instanceof Error ? error.message : String(error)}`,
+                    }),
+                };
+            }
+            if (!result.ok || result.exitCode !== 0 || !result.json) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: summarizeReadCliFailure(result),
+                    }),
+                };
+            }
+            const inventory = result.json;
+            if (!taskId) {
+                return {
+                    kind: "sync",
+                    status: 200,
+                    body: operatorSucceeded(action, inventory),
+                };
+            }
+            const v2 = (inventory.v2 ?? []).filter((entry) => entry.taskId === taskId);
+            const legacy = (inventory.legacy ?? []).filter((entry) => entry.taskId === taskId);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, {
+                    ...inventory,
+                    v2,
+                    legacy,
+                    focusedTaskId: taskId,
+                }),
+            };
+        }
+        case "status": {
+            const taskId = str(p.taskId);
+            if (!taskId) {
+                return invalid(action, "taskId is required");
+            }
+            const body = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+            return {
+                kind: "sync",
+                status: body.ok ? 200 : body.outcome === "not-found" ? 404 : 400,
+                body,
+            };
+        }
+        case "spineCheck": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["spine", "audit", taskId, "--json"], "spine audit");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "sourceInstructions": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["instructions", "source", "--task", taskId, "--json"], "instructions source");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "contractShow": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const body = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+            const snap = (body.result ?? {});
+            const c = snap.contract;
+            const reshaped = {
+                ...body,
+                command: "contractShow",
+                result: {
+                    taskId,
+                    state: {
+                        effectiveStatus: c?.effectiveStatus ?? "legacy-unversioned",
+                        observedCanonicalHash: c?.observedCanonicalHash ?? undefined,
+                        ref: c?.canonicalHash && typeof c.revision === "number"
+                            ? {
+                                schemaVersion: 1,
+                                taskId,
+                                revision: c.revision,
+                                canonicalHash: c.canonicalHash,
+                                taskConfigSha256: c.taskConfigSha256 ?? undefined,
+                                projectionVersion: c.projectionVersion ?? undefined,
+                                canonicalizerVersion: c.canonicalizerVersion ?? undefined,
+                                taskConfigSchemaVersion: c.taskConfigSchemaVersion ?? undefined,
+                            }
+                            : undefined,
+                    },
+                    snapshot: snap,
+                },
+            };
+            const notFound = body.ok === true && snap.exists === false;
+            return {
+                kind: "sync",
+                status: notFound
+                    ? 404
+                    : body.ok
+                        ? 200
+                        : body.outcome === "not-found"
+                            ? 404
+                            : 400,
+                body: reshaped,
+            };
+        }
+        case "contractValidate":
+        case "contractDiff":
+            return dispatchContractValidateOrDiff(ctx, action, p);
+        case "contractDraftSave": {
+            const draft = p.draft;
+            const taskId = str(p.taskId) ?? str(draft?.taskId);
+            if (!taskId || !draft) {
+                return invalid(action, "taskId and draft are required");
+            }
+            const { schemaVersion: _sv, taskId: _tid, ...draftRest } = draft;
+            const saved = await ctx.drafts.save({
+                ...draftRest,
+                schemaVersion: 1,
+                taskId,
+                title: str(draft.title) ?? taskId,
+            });
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("contractDraftSave", {
+                    taskId: saved.draft.taskId,
+                    draftSha256: saved.draftSha256,
+                    path: saved.path,
+                    // never claim canonical
+                    canonical: false,
+                    storage: "console-application-data",
+                }),
+            };
+        }
+        case "interviewStart": {
+            return dispatchInterviewStart(ctx, p);
+        }
+        case "interviewTurn": {
+            return dispatchInterviewTurn(ctx, p);
+        }
+        case "interviewSkip": {
+            return dispatchInterviewSkip(ctx, p);
+        }
+        case "interviewGet": {
+            const sessionId = str(p.sessionId);
+            if (!sessionId)
+                return invalid(action, "sessionId is required");
+            const session = await ctx.interviews.get(sessionId);
+            if (!session) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `interview session not found: ${sessionId}`,
+                    }),
+                };
+            }
+            const draftRec = await ctx.drafts.get(session.taskId);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("interviewGet", {
+                    session,
+                    draft: draftRec?.draft ?? null,
+                    draftSha256: draftRec?.draftSha256 ?? null,
+                    summary: draftRec ? draftSummary(draftRec.draft) : null,
+                }),
+            };
+        }
+        case "refreshReadiness": {
+            if (ctx.refreshReadiness) {
+                const report = await ctx.refreshReadiness();
+                return {
+                    kind: "sync",
+                    status: 200,
+                    body: operatorSucceeded("refreshReadiness", report),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("refreshReadiness", ctx.getReadiness?.() ?? ctx.readiness),
+            };
+        }
+        case "observeLink": {
+            const consoleOrigin = ctx.getConsoleOrigin?.();
+            // Wave 5: prefer unified Console origin; do not fall back to retired 8787 Observe.
+            const baseUrl = consoleOrigin ?? ctx.observeBaseUrl ?? DEFAULT_OBSERVE_BASE_URL;
+            const dagRunId = str(p.dagRunId);
+            const taskId = str(p.taskId);
+            const featureId = str(p.featureId);
+            const workerRunId = str(p.workerRunId);
+            let target;
+            let resolvedFromTask;
+            let fallbackToTask = false;
+            let openHome = false;
+            if (dagRunId) {
+                target = { kind: "dag", dagRunId };
+            }
+            else if (taskId) {
+                // Prefer `#/dag/<runId>` when a run exists; otherwise open `#/task/<taskId>`.
+                resolvedFromTask = await resolveLatestDagRunIdForTask(ctx.repoRoot, taskId);
+                if (resolvedFromTask) {
+                    target = { kind: "dag", dagRunId: resolvedFromTask.dagRunId };
+                }
+                else {
+                    target = { kind: "task", taskId };
+                    fallbackToTask = true;
+                }
+            }
+            else if (featureId) {
+                target = { kind: "feature", featureId };
+            }
+            else if (workerRunId) {
+                target = { kind: "worker", workerRunId };
+            }
+            else {
+                openHome = true;
+            }
+            const requiredCapability = target
+                ? capabilityForObserveTarget(target)
+                : undefined;
+            const usesUnifiedSurface = Boolean(consoleOrigin) &&
+                (!ctx.observeBaseUrl ||
+                    ctx.observeBaseUrl.replace(/\/+$/, "") ===
+                        consoleOrigin?.replace(/\/+$/, ""));
+            if (usesUnifiedSurface) {
+                const inspectPath = target
+                    ? buildInspectDeepLink(consoleOrigin, target).slice(consoleOrigin.length)
+                    : "/inspect/#/";
+                return {
+                    kind: "sync",
+                    status: 200,
+                    body: operatorSucceeded("observeLink", {
+                        url: target
+                            ? buildInspectDeepLink(consoleOrigin, target)
+                            : `${consoleOrigin.replace(/\/+$/, "")}/inspect/#/`,
+                        inspectPath,
+                        status: "same-origin",
+                        requiredCapability: requiredCapability ?? null,
+                        dagRunId: target?.kind === "dag"
+                            ? target.dagRunId
+                            : resolvedFromTask?.dagRunId,
+                        taskId: taskId ?? undefined,
+                        home: openHome || undefined,
+                        fallbackToTask: fallbackToTask || undefined,
+                    }),
+                };
+            }
+            let localFingerprint;
+            try {
+                localFingerprint = repoFingerprintV1(ctx.repoRoot);
+            }
+            catch (error) {
+                return {
+                    kind: "sync",
+                    status: 400,
+                    body: operatorFailed({
+                        command: "observeLink",
+                        outcome: "rejected",
+                        code: "OBSERVE_LINK_BLOCKED",
+                        message: `cannot compute local repoFingerprint: ${error instanceof Error ? error.message : String(error)}`,
+                        details: {
+                            status: "mismatch",
+                            startCommand: OBSERVE_START_COMMAND,
+                        },
+                    }),
+                };
+            }
+            const classified = await probeAndClassifyObserve({
+                baseUrl,
+                localFingerprint,
+                requiredCapability,
+                fetchImpl: ctx.fetchImpl ?? fetch,
+            });
+            if (classified.status !== "match") {
+                return {
+                    kind: "sync",
+                    status: classified.status === "unavailable" ? 503 : 409,
+                    body: operatorFailed({
+                        command: "observeLink",
+                        outcome: classified.status === "unavailable" ? "blocked" : "conflict",
+                        code: "OBSERVE_LINK_BLOCKED",
+                        message: classified.message,
+                        details: {
+                            status: classified.status,
+                            startCommand: OBSERVE_START_COMMAND,
+                            requiredCapability,
+                            healthUrl: classified.url,
+                            localFingerprint,
+                            remoteFingerprint: classified.remoteFingerprint,
+                        },
+                    }),
+                };
+            }
+            const link = openHome
+                ? `${baseUrl.replace(/\/+$/, "")}/`
+                : buildObserveDeepLink(baseUrl, target);
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("observeLink", {
+                    url: link,
+                    status: "match",
+                    requiredCapability: requiredCapability ?? null,
+                    dagRunId: target?.kind === "dag"
+                        ? target.dagRunId
+                        : resolvedFromTask?.dagRunId,
+                    taskId: taskId ?? undefined,
+                    home: openHome || undefined,
+                    fallbackToTask: fallbackToTask || undefined,
+                    note: fallbackToTask
+                        ? `任务 ${taskId} 尚无 DAG run，已打开任务页；运行 DAG 后可直达 run 详情`
+                        : undefined,
+                    resolvedFromTask: resolvedFromTask
+                        ? {
+                            dagRunId: resolvedFromTask.dagRunId,
+                            lifecycle: resolvedFromTask.lifecycle,
+                        }
+                        : undefined,
+                }),
+            };
+        }
+        case "dagValidate": {
+            const dagPath = str(p.dagPath) ?? str(p.dagHandle);
+            const taskId = str(p.taskId);
+            if (!dagPath)
+                return invalid(action, "dagPath is required");
+            const args = ["dag", "validate", "--dag", dagPath, "--json"];
+            if (taskId)
+                args.push("--spine-task", taskId);
+            const body = await runReadCli(ctx, args, "dag validate");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "prepareDagConfirmation": {
+            const dagHandle = str(p.dagHandle) ?? "staged-dag.json";
+            const taskId = str(p.taskId);
+            const operatorAction = str(p.operatorAction);
+            const operatorActionArgs = p.operatorActionArgs;
+            if (operatorActionArgs !== undefined &&
+                (!Array.isArray(operatorActionArgs) ||
+                    operatorActionArgs.some((value) => typeof value !== "string"))) {
+                return invalid(action, "operatorActionArgs must be an array of strings");
+            }
+            if (operatorAction) {
+                const target = buildOperatorCapabilitiesDocument().actions.find((entry) => entry.action === operatorAction &&
+                    OFFICIAL_TAIL_ACTION_IDS.has(entry.action) &&
+                    entry.humanConfirmation === "required");
+                if (!target)
+                    return invalid(action, "operatorAction must name a required official action");
+            }
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            let dagText = str(p.dagText) ?? str(p.dagJson);
+            let staged;
+            // When generated via lifecycle, store writeSet gate token for runDag approve path.
+            let writeSetGateToken;
+            if (!dagText) {
+                // Happy Path: generate + strict-validate via task advance; never confirm empty stub.
+                staged = await stageUtf8Text(ctx.appData, "", { extension: ".json" });
+                const profile = str(p.profile) ?? "auto";
+                const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+                const gen = await run([
+                    "task",
+                    "advance",
+                    taskId,
+                    "--profile",
+                    profile,
+                    "--dag-output",
+                    staged.path,
+                    "--json",
+                ], {
+                    cwd: ctx.repoRoot,
+                    artifactName: "prepare-dag-task-advance",
+                    expectJson: true,
+                    timeoutMs: 180_000,
+                });
+                if (!gen.ok || gen.exitCode !== 0) {
+                    return {
+                        kind: "error",
+                        status: 400,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "invalid",
+                            code: "INVALID_INPUT",
+                            message: gen.stderr?.trim() ||
+                                `task advance (prepare DAG) failed with exit ${gen.exitCode}`,
+                            details: {
+                                exitCode: gen.exitCode,
+                                stdoutPreview: (gen.stdout ?? "").slice(0, 1200),
+                            },
+                        }),
+                    };
+                }
+                dagText = await readFile(staged.path, "utf8");
+                if (!dagText.trim()) {
+                    // Fallback: advance may skip generate-dag when a draft already
+                    // exists; still prefer the task DAG over an empty staged file.
+                    const taskDagPath = getTaskPaths(ctx.repoRoot, taskId).dagDraftPath;
+                    try {
+                        dagText = await readFile(taskDagPath, "utf8");
+                    }
+                    catch {
+                        dagText = "";
+                    }
+                }
+                if (!dagText.trim()) {
+                    return {
+                        kind: "error",
+                        status: 400,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "invalid",
+                            code: "INVALID_INPUT",
+                            message: "task advance produced empty DAG output",
+                        }),
+                    };
+                }
+                writeSetGateToken = extractWriteSetGateTokenFromCliJson(gen.json, taskId);
+                staged = await stageUtf8Text(ctx.appData, dagText, {
+                    extension: ".json",
+                });
+            }
+            else {
+                staged = await stageUtf8Text(ctx.appData, dagText, {
+                    extension: ".json",
+                });
+            }
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                "unknown-controller";
+            // Server-derived bindings only: never trust browser-supplied hashes as success defaults.
+            const draftRec = await ctx.drafts.get(taskId);
+            const sourceBindingSha256 = draftRec
+                ? draftRec.draftSha256
+                : hashDagBytes(`source:${taskId}:${staged.sha256}`);
+            const validateBody = await runReadCli(ctx, ["dag", "validate", "--dag", staged.path, "--json"], "dag validate");
+            if (!validateBody.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: validateBody.error?.message ??
+                            "dag validate failed; cannot prepare confirmation for an invalid DAG",
+                        details: {
+                            validateError: validateBody.error ?? null,
+                            validateResult: validateBody.result ?? null,
+                            dagSha256: staged.sha256,
+                        },
+                    }),
+                };
+            }
+            const validationResultSha256 = hashDagBytes(JSON.stringify({
+                ok: true,
+                command: "dag validate",
+                result: validateBody.result ?? null,
+            }));
+            // Prefer live managed contract observation over client-supplied binding fields.
+            const showBody = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+            const statusResult = (showBody.result ?? {});
+            const c = showBody.ok ? statusResult.contract : undefined;
+            const ref = c?.canonicalHash && typeof c.revision === "number"
+                ? {
+                    revision: c.revision,
+                    canonicalHash: c.canonicalHash,
+                    taskConfigSha256: c.taskConfigSha256 ?? undefined,
+                    projectionVersion: c.projectionVersion ?? undefined,
+                    canonicalizerVersion: c.canonicalizerVersion ?? undefined,
+                    taskConfigSchemaVersion: c.taskConfigSchemaVersion ?? undefined,
+                }
+                : undefined;
+            const showResult = {
+                state: {
+                    effectiveStatus: c?.effectiveStatus,
+                    ref,
+                },
+            };
+            if (!ref?.canonicalHash || typeof ref.revision !== "number") {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable; apply/adopt before prepareDagConfirmation",
+                        details: {
+                            effectiveStatus: showResult.state?.effectiveStatus,
+                            showOk: showBody.ok,
+                        },
+                    }),
+                };
+            }
+            const taskContractBinding = {
+                taskId,
+                revision: ref.revision,
+                canonicalHash: ref.canonicalHash,
+                taskConfigSha256: ref.taskConfigSha256,
+                projectionVersion: ref.projectionVersion,
+                canonicalizerVersion: ref.canonicalizerVersion,
+                taskConfigSchemaVersion: ref.taskConfigSchemaVersion,
+            };
+            const confirmation = await ctx.confirmations.prepare({
+                operatorSessionId: ctx.operatorSessionId,
+                dagHandle,
+                dagBytes: dagText,
+                dagBytesPath: staged.path,
+                sourceBindingSha256,
+                taskContractBinding,
+                controllerFingerprint: controller,
+                validationResultSha256,
+                // Writer scopes must come from server-side review packet only; ignore client writeSet claims.
+                confirmedWriterScopes: [],
+                reviewPacket: {
+                    taskId,
+                    dagHandle,
+                    validationOk: true,
+                    ...(writeSetGateToken ? { writeSetGateToken } : {}),
+                    ...(operatorAction
+                        ? {
+                            operatorAction,
+                            operatorActionArgs: operatorActionArgs ?? [],
+                        }
+                        : {}),
+                },
+            });
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("prepareDagConfirmation", {
+                    confirmation,
+                    requiredChallenges: ALL_CONFIRMATION_CHALLENGES,
+                    dagSha256: staged.sha256,
+                }),
+            };
+        }
+        case "prepareDagExecution": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const profile = str(p.profile) ?? "auto";
+            const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+            // Server-side generate + strict validate only. The model never supplies
+            // DAG bytes or raw paths (AC-02): everything is re-derived here.
+            const staged = await stageUtf8Text(ctx.appData, "", {
+                extension: ".json",
+            });
+            const gen = await run([
+                "task",
+                "advance",
+                taskId,
+                "--profile",
+                profile,
+                "--dag-output",
+                staged.path,
+                "--json",
+            ], {
+                cwd: ctx.repoRoot,
+                artifactName: "prepare-dag-execution-task-advance",
+                expectJson: true,
+                timeoutMs: 180_000,
+            });
+            if (!gen.ok || gen.exitCode !== 0) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: gen.stderr?.trim() ||
+                            `task advance (prepare DAG execution) failed with exit ${gen.exitCode}`,
+                        details: {
+                            exitCode: gen.exitCode,
+                            stdoutPreview: (gen.stdout ?? "").slice(0, 1200),
+                        },
+                    }),
+                };
+            }
+            let dagText;
+            try {
+                dagText = await readFile(staged.path, "utf8");
+            }
+            catch {
+                dagText = "";
+            }
+            if (!dagText.trim()) {
+                // Fallback: advance may skip generate-dag when a draft already
+                // exists; still prefer the task DAG over an empty staged file.
+                const taskDagPath = getTaskPaths(ctx.repoRoot, taskId).dagDraftPath;
+                try {
+                    dagText = await readFile(taskDagPath, "utf8");
+                }
+                catch {
+                    dagText = "";
+                }
+            }
+            if (!dagText.trim()) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: "task advance produced empty DAG output",
+                    }),
+                };
+            }
+            const writeSetGateToken = extractWriteSetGateTokenFromCliJson(gen.json, taskId);
+            const finalStaged = await stageUtf8Text(ctx.appData, dagText, {
+                extension: ".json",
+            });
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                "unknown-controller";
+            const draftRec = await ctx.drafts.get(taskId);
+            const sourceBindingSha256 = draftRec
+                ? draftRec.draftSha256
+                : hashDagBytes(`source:${taskId}:${finalStaged.sha256}`);
+            const validateBody = await runReadCli(ctx, ["dag", "validate", "--dag", finalStaged.path, "--json"], "dag validate");
+            if (!validateBody.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: validateBody.error?.message ??
+                            "dag validate failed; cannot prepare execution for an invalid DAG",
+                        details: {
+                            validateError: validateBody.error ?? null,
+                            dagSha256: finalStaged.sha256,
+                        },
+                    }),
+                };
+            }
+            const validationResultSha256 = hashDagBytes(JSON.stringify({
+                ok: true,
+                command: "dag validate",
+                result: validateBody.result ?? null,
+            }));
+            const taskContractBinding = await readLiveTaskContractBinding(ctx, taskId);
+            if (!taskContractBinding) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable; apply/adopt before prepareDagExecution",
+                        details: { taskId },
+                    }),
+                };
+            }
+            // G2 deterministic assessment from server-side facts only.
+            let allowedPaths;
+            let forbiddenPaths;
+            try {
+                const taskConfig = await loadTaskConfig(ctx.repoRoot, taskId);
+                allowedPaths = Array.isArray(taskConfig.allowedPaths)
+                    ? taskConfig.allowedPaths
+                    : [];
+                forbiddenPaths = Array.isArray(taskConfig.forbiddenPaths)
+                    ? taskConfig.forbiddenPaths
+                    : [];
+            }
+            catch {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "task boundary (task.json allowedPaths/forbiddenPaths) unavailable; autonomous execution not permitted",
+                    }),
+                };
+            }
+            const reviewPacket = extractReviewPacketFromCliJson(gen.json) ?? {};
+            let parsedDagSpec;
+            try {
+                parsedDagSpec = JSON.parse(dagText);
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "DAG_GENERATION_FAILED",
+                        message: `generated DAG is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+                    }),
+                };
+            }
+            const derivedFacts = deriveEligibilityFactsFromDagSpec({
+                dagSpec: parsedDagSpec,
+                allowedPaths,
+                forbiddenPaths,
+            });
+            const packetWriters = Array.isArray(reviewPacket.writers)
+                ? reviewPacket.writers.map((writer) => ({
+                    nodeId: writer.nodeId ?? "unknown",
+                    writeSet: Array.isArray(writer.writeSet)
+                        ? writer.writeSet.filter((v) => typeof v === "string")
+                        : [],
+                }))
+                : derivedFacts.writersWriteSets;
+            const packetShellVerification = Array.isArray(reviewPacket.shellVerification)
+                ? reviewPacket.shellVerification.length > 0
+                : derivedFacts.hasStructuredVerification;
+            const eligibility = {
+                writersWriteSets: packetWriters,
+                allowedPaths,
+                forbiddenPaths,
+                broadWriteSetRisk: typeof reviewPacket.broadWriteSetRisk === "boolean"
+                    ? reviewPacket.broadWriteSetRisk
+                    : derivedFacts.broadWriteSetRisk,
+                forbiddenOverlapRisk: typeof reviewPacket.forbiddenOverlapRisk === "boolean"
+                    ? reviewPacket.forbiddenOverlapRisk
+                    : derivedFacts.forbiddenOverlapRisk,
+                hasStructuredVerification: packetShellVerification,
+            };
+            const assessment = assessAutonomousExecutionEligibility(eligibility);
+            if (!assessment.ok) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: assessment.reason,
+                        details: {
+                            taskId,
+                            dagSha256: finalStaged.sha256,
+                            eligibility: "denied",
+                        },
+                    }),
+                };
+            }
+            const prepared = await ctx.dagExecutionReceipts.prepare({
+                operatorSessionId: ctx.operatorSessionId,
+                taskId,
+                dagHandle: "staged-dag.json",
+                dagBytes: dagText,
+                dagBytesPath: finalStaged.path,
+                sourceBindingSha256,
+                taskContractBinding,
+                controllerFingerprint: controller,
+                validationResultSha256,
+                eligibility,
+                reviewPacket: {
+                    taskId,
+                    dagHandle: "staged-dag.json",
+                    validationOk: true,
+                    ...(writeSetGateToken ? { writeSetGateToken } : {}),
+                },
+            });
+            if (!prepared.ok) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: prepared.code,
+                        message: prepared.reason,
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("prepareDagExecution", {
+                    executionId: prepared.receipt.executionId,
+                    eligibility: "approved",
+                    taskId,
+                    dagSha256: finalStaged.sha256,
+                    expiresAt: prepared.receipt.expiresAt,
+                }),
+            };
+        }
+        case "confirmDagConfirmation": {
+            const confirmationId = str(p.confirmationId);
+            const humanGateToken = p.humanGateToken;
+            if (!confirmationId) {
+                return invalid(action, "confirmationId is required");
+            }
+            // Ignore client-supplied binding fields; re-derive current from store + staged bytes + live controller.
+            const conf = await ctx.confirmations.get(confirmationId);
+            if (!conf) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `confirmation not found: ${confirmationId}`,
+                    }),
+                };
+            }
+            let dagBytes;
+            try {
+                dagBytes = await readFile(conf.dagBytesPath, "utf8");
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "conflict",
+                        code: "CONFIRMATION_STALE",
+                        message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                    }),
+                };
+            }
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                conf.controllerFingerprint;
+            const result = await ctx.confirmations.confirm({
+                confirmationId,
+                operatorSessionId: ctx.operatorSessionId,
+                humanGateToken,
+                current: {
+                    dagSha256: hashDagBytes(dagBytes),
+                    sourceBindingSha256: conf.sourceBindingSha256,
+                    controllerFingerprint: controller,
+                    validationResultSha256: conf.validationResultSha256,
+                    taskContractBinding: conf.taskContractBinding,
+                },
+            });
+            if (!result.ok) {
+                return {
+                    kind: "error",
+                    status: confirmationErrorStatus(result.code),
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "rejected",
+                        code: result.code,
+                        message: result.message,
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, { confirmation: result.confirmation }),
+            };
+        }
+        case "newTask": {
+            const taskId = str(p.taskId);
+            const title = str(p.title) ?? taskId;
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            const taskIdError = taskIdInputError(taskId);
+            if (taskIdError)
+                return invalid(action, taskIdError);
+            // Canonical id gate at admission (2026-08-16): non-canonical ids were
+            // accepted here (validateNewTaskId only warns) and every downstream
+            // advance/import then flailed on the malformed task directory. Fail
+            // fast with a concrete suggested id instead.
+            if (!CANONICAL_TASK_ID_PATTERN.test(taskId)) {
+                const slug = taskId
+                    .toLowerCase()
+                    .replace(/[^a-z0-9]+/g, "-")
+                    .replace(/^-+|-+$/g, "")
+                    .slice(0, 48);
+                const suggested = slug && !GENERIC_SLUG_SET.has(slug)
+                    ? `${formatLocalBusinessDate()}-${slug}`
+                    : `${formatLocalBusinessDate()}-${slug || "task"}-r2`;
+                return invalid(action, `taskId must be canonical YYYY-MM-DD-<kebab-slug> (local business date); got "${taskId}" — suggested id: "${suggested}" (e.g. 2026-08-16-tool-preview-edge-test); retry newTask with that id`);
+            }
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: ["task", "advance", taskId, title, "--json"],
+            });
+        }
+        case "taskAdvance": {
+            const taskId = str(p.taskId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            const taskIdError = taskIdInputError(taskId);
+            if (taskIdError)
+                return invalid(action, taskIdError);
+            const args = ["task", "advance", taskId];
+            const title = str(p.title);
+            if (title)
+                args.push(title);
+            const taskKind = str(p.taskKind);
+            if (taskKind)
+                args.push("--task-kind", taskKind);
+            const featureId = str(p.featureId);
+            if (featureId)
+                args.push("--feature-id", featureId);
+            const profile = str(p.profile);
+            if (profile)
+                args.push("--profile", profile);
+            appendEngineeringCliArgs(args, parseEngineeringBoundaryFromParams(p));
+            args.push("--json");
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: args,
+            });
+        }
+        case "bootstrapFromPrd":
+            return dispatchBootstrapFromPrd(ctx, p);
+        case "importPrd": {
+            // Chat / operator path: same intake bridge as bootstrapFromPrd, but
+            // for an existing taskId (create-if-missing via advance --prd).
+            const taskId = str(p.taskId);
+            const content = str(p.content) ?? str(p.fileText);
+            if (!taskId || !content) {
+                return invalid(action, "taskId and content are required");
+            }
+            const taskIdError = taskIdInputError(taskId);
+            if (taskIdError)
+                return invalid(action, taskIdError);
+            const taskKindRaw = str(p.taskKind)?.trim();
+            const taskKind = normalizeConsoleWorkflowKind(taskKindRaw, "standard");
+            const taskKindExplicit = Boolean(taskKindRaw);
+            const engineering = parseEngineeringBoundaryFromParams(p);
+            const identity = deriveTaskIdentityFromPrd(content);
+            const title = str(p.title) ?? identity.title;
+            const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+            const staged = await stageUtf8Text(ctx.appData, content, {
+                extension: ".md",
+            });
+            const imported = await run([
+                "task",
+                "advance",
+                taskId,
+                title,
+                "--prd",
+                staged.path,
+                "--role",
+                "requirement",
+                "--json",
+            ], {
+                cwd: ctx.repoRoot,
+                artifactName: "import-prd-task-advance",
+                expectJson: true,
+                timeoutMs: 60_000,
+            });
+            if (!imported.ok || imported.exitCode !== 0 || imported.timedOut) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "rejected",
+                        code: "INTERNAL_ERROR",
+                        message: imported.stderr?.trim() ||
+                            `task advance --prd failed with exit ${imported.exitCode}`,
+                        details: {
+                            exitCode: imported.exitCode,
+                            timedOut: imported.timedOut,
+                            taskId,
+                        },
+                    }),
+                };
+            }
+            const intakeArgs = ["task", "advance", taskId, "--json"];
+            if (taskKindExplicit) {
+                intakeArgs.push("--task-kind", taskKind);
+            }
+            appendEngineeringCliArgs(intakeArgs, engineering);
+            const intake = await run(intakeArgs, {
+                cwd: ctx.repoRoot,
+                artifactName: "import-prd-task-advance-intake",
+                expectJson: true,
+                timeoutMs: SEMANTIC_INTAKE_CLI_TIMEOUT_MS,
+            });
+            const intakeJson = intake.json ?? null;
+            const intakeOk = intake.ok && intake.exitCode === 0 && !intake.timedOut;
+            const bridged = await buildDraftFromTaskIntake({
+                repoRoot: ctx.repoRoot,
+                taskId,
+                title,
+                taskKind,
+                taskKindExplicit,
+                advanceJson: intakeJson,
+                engineering,
+            });
+            const draftSaved = await ctx.drafts.save(bridged.draft);
+            const parseStatus = intakeOk || bridged.parseStatus !== "pending"
+                ? bridged.parseStatus
+                : "failed";
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, {
+                    taskId,
+                    title: draftSaved.draft.title ?? title,
+                    taskKind,
+                    draftSha256: draftSaved.draftSha256,
+                    parseStatus,
+                    semanticIntake: bridged.semanticIntake,
+                    gaps: bridged.gaps,
+                    lifecycleState: bridged.lifecycleState ?? "intake-incomplete",
+                    intake: {
+                        ok: intakeOk,
+                        exitCode: intake.exitCode,
+                        timedOut: intake.timedOut,
+                    },
+                    import: imported.json ?? null,
+                    draftPreview: {
+                        objective: draftSaved.draft.requirement?.objective ?? null,
+                        scope: draftSaved.draft.requirement?.scope ?? [],
+                        acceptanceCriteria: draftSaved.draft.requirement?.acceptanceCriteria ?? [],
+                        allowedPaths: draftSaved.draft.constraints?.allowedPaths ?? [],
+                    },
+                }),
+            };
+        }
+        case "contractApply": {
+            const taskId = str(p.taskId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            // Require fresh complete assessment bound to current draft
+            const draftRec = await ctx.drafts.get(taskId);
+            if (!draftRec) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: "该任务尚无 Console 草稿，请先保存草稿",
+                    }),
+                };
+            }
+            const assessmentId = str(p.assessmentId) ??
+                draftRec.draft.interviewAssessmentRef?.assessmentId;
+            if (!assessmentId) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "fresh complete Interview assessment required before contractApply",
+                    }),
+                };
+            }
+            const assessment = await ctx.assessments.get(assessmentId);
+            if (!assessment) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "未找到评估结果",
+                    }),
+                };
+            }
+            const fresh = isAssessmentFreshForDraft(assessment, draftRec.draft);
+            if (!fresh.fresh) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: fresh.reason,
+                    }),
+                };
+            }
+            const staged = await stageUtf8Text(ctx.appData, JSON.stringify(toCanonicalDraftForCli(draftRec.draft), null, 2), { extension: ".json" });
+            // Lifecycle apply via task advance --from-draft (managed contract projection).
+            // Optimistic concurrency remains inside applyTaskContract via prepareTaskSource.
+            const statusBody = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+            const statusContract = (statusBody.result ?? {}).contract;
+            const payloadSha = staged.sha256;
+            return acceptOperation(ctx, {
+                action,
+                actionParams: {
+                    taskId,
+                    assessmentId,
+                    draftSha256: draftRec.draftSha256,
+                    requestPayloadSha256: payloadSha,
+                    expectedRevision: Number(p.expectedRevision ?? statusContract?.revision ?? 0),
+                    expectedObservedHash: str(p.expectedObservedHash) ??
+                        statusContract?.observedCanonicalHash ??
+                        null,
+                    effectiveStatus: statusContract?.effectiveStatus,
+                },
+                clientRequestId,
+                taskId,
+                cliArgs: [
+                    "task",
+                    "advance",
+                    taskId,
+                    "--from-draft",
+                    staged.path,
+                    "--json",
+                ],
+            });
+        }
+        case "dagRunTask": {
+            const taskId = str(p.taskId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !clientRequestId) {
+                return invalid(action, "taskId and clientRequestId are required");
+            }
+            const taskIdError = taskIdInputError(taskId);
+            if (taskIdError)
+                return invalid(action, taskIdError);
+            const out = await stageUtf8Text(ctx.appData, "", { extension: ".json" });
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                // Lifecycle generate + strict validate; stops at writeSet gate.
+                cliArgs: [
+                    "task",
+                    "advance",
+                    taskId,
+                    "--profile",
+                    str(p.profile) ?? "auto",
+                    "--dag-output",
+                    out.path,
+                    "--json",
+                ],
+            });
+        }
+        case "runDag": {
+            // Model path (AC-02): only executionId — never a raw dag path from
+            // the model. The browser Human Gate route (chat human-gate dag-run)
+            // still dispatches with confirmationId for the preserved global
+            // Human Gate flow; that path is not model-reachable (the confirmation
+            // must be in "confirmed" state, which requires a server-signed
+            // human-gate token verified by confirmDagConfirmation).
+            const clientRequestId = str(req.clientRequestId);
+            const executionId = str(p.executionId);
+            if (!clientRequestId) {
+                return invalid(action, "runDag requires clientRequestId");
+            }
+            if (executionId && str(p.confirmationId)) {
+                return invalid(action, "runDag accepts either executionId or confirmationId, not both");
+            }
+            if (!executionId) {
+                const confirmationId = str(p.confirmationId);
+                if (!confirmationId) {
+                    return invalid(action, "runDag requires executionId (autonomous) or confirmationId (browser Human Gate)");
+                }
+                // Preserved browser Human Gate flow (dag-confirmation.ts untouched).
+                const conf = await ctx.confirmations.get(confirmationId);
+                if (!conf) {
+                    return {
+                        kind: "error",
+                        status: 404,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "not-found",
+                            code: "NOT_FOUND",
+                            message: `confirmation not found: ${confirmationId}`,
+                        }),
+                    };
+                }
+                // Re-read staged DAG bytes and hash.
+                let dagBytes;
+                try {
+                    dagBytes = await readFile(conf.dagBytesPath, "utf8");
+                }
+                catch (error) {
+                    return {
+                        kind: "error",
+                        status: 409,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "conflict",
+                            code: "CONFIRMATION_STALE",
+                            message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                        }),
+                    };
+                }
+                const dagSha256 = hashDagBytes(dagBytes);
+                const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                    conf.controllerFingerprint;
+                const consumed = await ctx.confirmations.consume({
+                    confirmationId,
+                    operatorSessionId: ctx.operatorSessionId,
+                    current: {
+                        dagSha256,
+                        sourceBindingSha256: conf.sourceBindingSha256,
+                        taskContractBinding: conf.taskContractBinding,
+                        controllerFingerprint: controller,
+                        validationResultSha256: conf.validationResultSha256,
+                    },
+                });
+                if (!consumed.ok) {
+                    return {
+                        kind: "error",
+                        status: confirmationErrorStatus(consumed.code),
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "rejected",
+                            code: consumed.code,
+                            message: consumed.message,
+                        }),
+                    };
+                }
+                const taskId = conf.taskContractBinding.taskId;
+                const gateToken = readWriteSetGateToken(conf.reviewPacket);
+                if (gateToken) {
+                    return acceptOperation(ctx, {
+                        action,
+                        actionParams: { confirmationId },
+                        clientRequestId,
+                        taskId,
+                        cliArgs: [
+                            "task",
+                            "advance",
+                            taskId,
+                            "--approve-gate",
+                            gateToken,
+                            "--json",
+                        ],
+                    });
+                }
+                return acceptOperation(ctx, {
+                    action,
+                    actionParams: { confirmationId },
+                    clientRequestId,
+                    taskId,
+                    cliArgs: [
+                        "dag",
+                        "execute",
+                        "--dag",
+                        conf.dagBytesPath,
+                        "--cwd",
+                        ctx.repoRoot,
+                        "--json",
+                    ],
+                });
+            }
+            const receipt = await ctx.dagExecutionReceipts.get(executionId);
+            if (!receipt) {
+                return {
+                    kind: "error",
+                    status: 404,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "not-found",
+                        code: "NOT_FOUND",
+                        message: `execution receipt not found: ${executionId}`,
+                    }),
+                };
+            }
+            const taskId = receipt.taskId;
+            // Live server-derived bindings only; any drift fails closed inside
+            // consume (staged bytes/hash + controller + task binding + source).
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                receipt.controllerFingerprint;
+            let sourceBindingSha256 = receipt.sourceBindingSha256;
+            try {
+                const draftRec = await ctx.drafts.get(taskId);
+                if (draftRec)
+                    sourceBindingSha256 = draftRec.draftSha256;
+            }
+            catch {
+                // keep the receipt binding; consume will still compare it
+            }
+            const liveBinding = await readLiveTaskContractBinding(ctx, taskId);
+            if (!liveBinding) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable at consume time",
+                        details: { taskId },
+                    }),
+                };
+            }
+            const consumed = await ctx.dagExecutionReceipts.consume({
+                executionId,
+                operatorSessionId: ctx.operatorSessionId,
+                controllerFingerprint: controller,
+                taskContractBinding: liveBinding,
+                sourceBindingSha256,
+                validationResultSha256: receipt.validationResultSha256,
+            });
+            if (!consumed.ok) {
+                return {
+                    kind: "error",
+                    status: confirmationErrorStatus(consumed.code),
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "rejected",
+                        code: consumed.code,
+                        message: consumed.message,
+                    }),
+                };
+            }
+            const gateToken = readWriteSetGateToken(receipt.reviewPacket);
+            const dispatchRun = async () => {
+                if (gateToken) {
+                    // Standard lifecycle path: the execution receipt replaces the
+                    // browser confirm; the gate token is still consumed by the CLI.
+                    return acceptOperation(ctx, {
+                        action,
+                        actionParams: { executionId },
+                        clientRequestId,
+                        taskId,
+                        cliArgs: [
+                            "task",
+                            "advance",
+                            taskId,
+                            "--approve-gate",
+                            gateToken,
+                            "--json",
+                        ],
+                    });
+                }
+                // Advanced: execute the server-staged DAG bytes (never a model path).
+                return acceptOperation(ctx, {
+                    action,
+                    actionParams: { executionId },
+                    clientRequestId,
+                    taskId,
+                    cliArgs: [
+                        "dag",
+                        "execute",
+                        "--dag",
+                        receipt.dagBytesPath,
+                        "--cwd",
+                        ctx.repoRoot,
+                        "--json",
+                    ],
+                });
+            };
+            const accepted = await dispatchRun();
+            if (accepted.kind === "accepted") {
+                await ctx.dagExecutionReceipts.markDispatched(executionId, accepted.body.operationId);
+            }
+            return accepted;
+        }
+        case "dagRerunPlan": {
+            const runId = str(p.runId);
+            const fromNode = str(p.fromNode);
+            if (!runId || !fromNode) {
+                return invalid(action, "runId and fromNode are required");
+            }
+            const body = await runReadCli(ctx, [
+                "dag",
+                "rerun",
+                "--run-id",
+                runId,
+                "--from-node",
+                fromNode,
+                "--plan",
+                "--json",
+            ], "dag rerun plan");
+            return { kind: "sync", status: body.ok ? 200 : 400, body };
+        }
+        case "dagRerun": {
+            const runId = str(p.runId);
+            const fromNode = str(p.fromNode);
+            const planHash = str(p.planHash);
+            const reason = str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            if (!runId || !fromNode || !planHash || !reason || !clientRequestId) {
+                return invalid(action, "runId, fromNode, planHash, reason, and clientRequestId are required");
+            }
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                cliArgs: [
+                    "dag",
+                    "rerun",
+                    "--run-id",
+                    runId,
+                    "--from-node",
+                    fromNode,
+                    "--plan-hash",
+                    planHash,
+                    "--request-id",
+                    clientRequestId,
+                    "--reason",
+                    reason,
+                    "--json",
+                ],
+            });
+        }
+        case "dagInterruptEligibility": {
+            const runId = str(p.runId) ?? str(p.dagRunId);
+            if (!runId)
+                return invalid(action, "runId is required");
+            const eligibility = await evaluateConsoleDagInterruptEligibility({
+                repoRoot: ctx.repoRoot,
+                operations: ctx.operations,
+                runId,
+            });
+            if (eligibility.interrupt && eligibility.targetOperationId) {
+                await syncTargetInterruptProjection({
+                    operations: ctx.operations,
+                    events: ctx.events,
+                    operationId: eligibility.targetOperationId,
+                    runId,
+                    interrupt: eligibility.interrupt,
+                });
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, eligibility),
+            };
+        }
+        case "dagRequestInterrupt": {
+            const runId = str(p.runId);
+            const reasonCode = str(p.reasonCode);
+            const reasonDetail = str(p.reasonDetail) ?? str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            if (!runId || !reasonCode || !reasonDetail || !clientRequestId) {
+                return invalid(action, "runId, reasonCode, reasonDetail, and clientRequestId are required");
+            }
+            if (!isInterruptReasonCode(reasonCode)) {
+                return invalid(action, `reasonCode must be one of requirements-changed | suspected-runaway | resource-protection | operator-request | other`);
+            }
+            try {
+                normalizeInterruptReasonDetail(reasonDetail);
+            }
+            catch (error) {
+                return invalid(action, error instanceof Error ? error.message : String(error));
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const eligibility = await evaluateConsoleDagInterruptEligibility({
+                repoRoot: ctx.repoRoot,
+                operations: ctx.operations,
+                runId,
+            });
+            if (!eligibility.eligible || !eligibility.targetOperationId || !eligibility.expectedRunnerIdentity) {
+                const failed = interruptActionFailed(action, eligibility.reasonCodes[0] ?? "RUN_NOT_ACTIVE", eligibility.message);
+                return failed;
+            }
+            const expected = eligibility.expectedRunnerIdentity;
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: {
+                    runId,
+                    reasonCode,
+                    reasonDetail,
+                    targetOperationId: eligibility.targetOperationId,
+                    expectedRunnerIdentity: expected,
+                },
+                clientRequestId,
+                cliArgs: [
+                    "dag",
+                    "request-interrupt",
+                    "--run-id",
+                    runId,
+                    "--request-id",
+                    clientRequestId,
+                    "--target-operation-id",
+                    eligibility.targetOperationId,
+                    "--reason-code",
+                    reasonCode,
+                    "--reason",
+                    reasonDetail,
+                    "--expected-runner-pid",
+                    String(expected.pid),
+                    "--expected-runner-hostname",
+                    expected.hostname,
+                    "--expected-runner-started-at",
+                    expected.startedAt,
+                    "--expected-controller-fingerprint",
+                    expected.controllerFingerprint,
+                    "--json",
+                ],
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "dagReconcileRun": {
+            // S6 Recovery: orphan/interrupted runs — structured reason is the human
+            // confirmation surface (CLI eligibility still fail-closed).
+            const runId = str(p.runId);
+            const reason = str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            const reconcileActionRaw = str(p.reconcileAction) ?? "supersede";
+            if (reconcileActionRaw !== "supersede" &&
+                reconcileActionRaw !== "abandon") {
+                return invalid(action, "reconcileAction must be supersede or abandon");
+            }
+            const reconcileAction = reconcileActionRaw;
+            if (!runId || !reason || !clientRequestId) {
+                return invalid(action, "runId, reason, and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: {
+                    runId,
+                    reason,
+                    reconcileAction,
+                },
+                clientRequestId,
+                cliArgs: [
+                    "dag",
+                    "reconcile-run",
+                    "--run-id",
+                    runId,
+                    "--action",
+                    reconcileAction,
+                    "--reason",
+                    reason,
+                    "--json",
+                ],
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "standaloneTaskRerun": {
+            const runId = str(p.runId);
+            const reason = str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            if (!runId || !reason || !clientRequestId) {
+                return invalid(action, "runId, reason, and clientRequestId are required");
+            }
+            // 2026-08-11: read-only run-facts check replaces the browser Human
+            // Gate (R2). Fails closed when evidence is missing.
+            const gated = await assertAutonomousRerunEligible(ctx, runId, str(p.taskId));
+            if (gated.kind === "error")
+                return gated;
+            const profile = str(p.profile);
+            const taskId = str(p.taskId);
+            const cliArgs = [
+                "dag",
+                "rerun-task",
+                "--run-id",
+                runId,
+                "--reason",
+                reason,
+                "--request-id",
+                clientRequestId,
+                "--json",
+            ];
+            if (profile)
+                cliArgs.push("--profile", profile);
+            if (taskId)
+                cliArgs.push("--task-id", taskId);
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs,
+            });
+        }
+        case "workerTaskRetry": {
+            const taskId = str(p.taskId);
+            const featureId = str(p.featureId);
+            const reason = str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            if (!taskId || !reason || !clientRequestId) {
+                return invalid(action, "taskId, reason, and clientRequestId are required");
+            }
+            // 2026-08-11: read-only pool facts check replaces the browser Human
+            // Gate (task must exist in Failed state; featureId consistent).
+            const gated = await assertWorkerTaskRetryFacts(ctx, taskId, featureId);
+            if (gated.kind === "error")
+                return gated;
+            const args = [
+                "task",
+                "retry",
+                taskId,
+                "--repo",
+                ctx.repoRoot,
+                "--reason",
+                reason,
+            ];
+            if (featureId)
+                args.push("--feature-id", featureId);
+            return acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: args,
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+        }
+        case "workerAdmissionPrepare": {
+            const featureDir = str(p.featureDir);
+            const taskId = str(p.taskId);
+            const at = str(p.at);
+            const tz = str(p.tz);
+            const taskCard = str(p.taskCard);
+            const clientRequestId = str(req.clientRequestId);
+            if (!featureDir || !taskId || !at || !clientRequestId) {
+                return invalid(action, "featureDir, taskId, at, and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const args = [
+                "admission",
+                "prepare",
+                "--repo",
+                ctx.repoRoot,
+                "--feature-dir",
+                featureDir,
+                "--task-id",
+                taskId,
+                "--at",
+                at,
+                "--json",
+            ];
+            if (tz)
+                args.push("--tz", tz);
+            if (taskCard)
+                args.push("--task-card", taskCard);
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                taskId,
+                cliArgs: args,
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "workerSchedulerAdd": {
+            const scheduleId = str(p.scheduleId);
+            const approveGate = str(p.approveGate);
+            const clientRequestId = str(req.clientRequestId);
+            if (!scheduleId || !approveGate || !clientRequestId) {
+                return invalid(action, "scheduleId, approveGate, and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                cliArgs: [
+                    "scheduler",
+                    "add",
+                    scheduleId,
+                    "--repo",
+                    ctx.repoRoot,
+                    "--approve-gate",
+                    approveGate,
+                    "--json",
+                ],
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "workerSchedulerCancel": {
+            const scheduleId = str(p.scheduleId);
+            const reason = str(p.reason);
+            const clientRequestId = str(req.clientRequestId);
+            if (!scheduleId || !clientRequestId) {
+                return invalid(action, "scheduleId and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const args = [
+                "scheduler",
+                "cancel",
+                scheduleId,
+                "--repo",
+                ctx.repoRoot,
+                "--json",
+            ];
+            if (reason)
+                args.push("--reason", reason);
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                cliArgs: args,
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "workerSchedulerHarvest": {
+            const scheduleId = str(p.scheduleId);
+            const clientRequestId = str(req.clientRequestId);
+            if (!scheduleId || !clientRequestId) {
+                return invalid(action, "scheduleId and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                cliArgs: [
+                    "scheduler",
+                    "harvest",
+                    scheduleId,
+                    "--repo",
+                    ctx.repoRoot,
+                    "--json",
+                ],
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "workerSchedulerDiscard": {
+            const scheduleId = str(p.scheduleId);
+            const reason = str(p.reason);
+            const force = p.force === true;
+            const clientRequestId = str(req.clientRequestId);
+            if (!scheduleId || !reason || !clientRequestId) {
+                return invalid(action, "scheduleId, reason, and clientRequestId are required");
+            }
+            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            if (gated.kind === "error")
+                return gated;
+            if (gated.kind === "idempotent")
+                return gated.result;
+            const args = [
+                "scheduler",
+                "discard",
+                scheduleId,
+                "--repo",
+                ctx.repoRoot,
+                "--reason",
+                reason,
+                "--json",
+            ];
+            if (force)
+                args.push("--force");
+            const accepted = await acceptOperation(ctx, {
+                action,
+                actionParams: p,
+                clientRequestId,
+                cliArgs: args,
+                externalCommand: resolveSiblingAgentWorkerBin(),
+            });
+            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
+            return accepted;
+        }
+        case "prepareMutationGate": {
+            const targetAction = str(p.action);
+            const actionParams = p.actionParams &&
+                typeof p.actionParams === "object" &&
+                !Array.isArray(p.actionParams)
+                ? p.actionParams
+                : undefined;
+            if (!targetAction || !actionParams) {
+                return invalid(action, "action and actionParams are required");
+            }
+            if (!MUTATION_GATE_ACTIONS.has(targetAction)) {
+                return invalid(action, "action must be a mutation-gate target (dagReconcileRun | dagRequestInterrupt | workerAdmissionPrepare | workerSchedulerAdd | workerSchedulerCancel | workerSchedulerHarvest | workerSchedulerDiscard)");
+            }
+            const secret = ctx.humanGateSecret;
+            if (!secret) {
+                return {
+                    kind: "error",
+                    status: 503,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "INTERNAL_ERROR",
+                        message: "humanGateSecret is not configured on action context",
+                    }),
+                };
+            }
+            const paramsHash = mutationGatePayloadHash({
+                action: targetAction,
+                operatorSessionId: ctx.operatorSessionId,
+                actionParams,
+            });
+            const expiresAt = new Date(Date.now() + 30 * 60_000).toISOString();
+            const receiptId = `mut_${crypto.randomUUID()}`;
+            const humanGateToken = issueHumanGateToken({ confirmationId: receiptId, payloadHash: paramsHash, expiresAt }, secret);
+            const store = new MutationGateReceiptStore(ctx.appData);
+            const receipt = await store.prepare({
+                receiptId,
+                operatorSessionId: ctx.operatorSessionId,
+                action: targetAction,
+                paramsHash,
+                actionParams,
+                expiresAt,
+                humanGateToken,
+            });
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("prepareMutationGate", {
+                    receiptId: receipt.receiptId,
+                    action: receipt.action,
+                    expiresAt: receipt.expiresAt,
+                    paramsHash: receipt.paramsHash,
+                    humanGateToken: receipt.humanGateToken,
+                    state: receipt.state,
+                }),
+            };
+        }
+        case "savePiModelMatrix": {
+            // 「模型与认证」页模型矩阵编辑器：三档字符串值经校验后原子写入
+            // harness.json executors.pi，并自动重测 readiness。写路径本身由 HTTP
+            // 层 evaluateMutationGate 拦截（cookie + confirmation 头 + origin）。
+            const matrixInput = p.matrix ?? p;
+            const validation = validatePiModelMatrixTiers(matrixInput);
+            if (!validation.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: validation.code,
+                        message: validation.message,
+                        ...(validation.tier ? { details: { tier: validation.tier } } : {}),
+                    }),
+                };
+            }
+            try {
+                await writePiModelMatrix(ctx.repoRoot, validation.tiers);
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 500,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "PI_MODEL_MATRIX_WRITE_FAILED",
+                        message: error instanceof Error ? error.message : String(error),
+                    }),
+                };
+            }
+            // 保存成功自动重测 readiness（复用 probePiReadiness），让页面立即
+            // 展示新的 modelsAvailable / modelsMessage / piModelMatrix（AC-4）。
+            const report = ctx.refreshReadiness
+                ? await ctx.refreshReadiness()
+                : ctx.getReadiness?.() ?? ctx.readiness;
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("savePiModelMatrix", {
+                    tiers: validation.tiers,
+                    readiness: report,
+                }),
+            };
+        }
+        default: {
+            // M5 official-command coverage uses one generic tail for newly registered
+            // CLI actions. It remains inside dispatchOperatorAction (the sole dispatch
+            // surface) and only accepts argv arrays declared by the capability schema.
+            // 2026-08-18: high-frequency entries got real descriptions; membership is
+            // now derived from OFFICIAL_TAIL_ACTION_IDS, not description prefixes.
+            const capability = buildOperatorCapabilitiesDocument().actions.find((entry) => entry.action === action && OFFICIAL_TAIL_ACTION_IDS.has(entry.action));
+            if (capability) {
+                const rawArgs = p.args;
+                if (rawArgs !== undefined &&
+                    (!Array.isArray(rawArgs) ||
+                        rawArgs.some((value) => typeof value !== "string"))) {
+                    return invalid(action, "args must be an array of strings");
+                }
+                if (TASK_ADVANCE_ALIAS_ACTIONS.has(action) && Array.isArray(rawArgs)) {
+                    const aliasTaskId = str(rawArgs[0]);
+                    const taskIdError = aliasTaskId
+                        ? taskIdInputError(aliasTaskId)
+                        : undefined;
+                    if (taskIdError)
+                        return invalid(action, taskIdError);
+                }
+                if (capability.humanConfirmation === "required") {
+                    const confirmationId = str(p.confirmationId);
+                    if (!confirmationId)
+                        return invalid(action, "confirmationId is required");
+                    const conf = await ctx.confirmations.get(confirmationId);
+                    if (!conf) {
+                        return {
+                            kind: "error",
+                            status: 404,
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "not-found",
+                                code: "NOT_FOUND",
+                                message: `confirmation not found: ${confirmationId}`,
+                            }),
+                        };
+                    }
+                    const confirmedArgs = conf.reviewPacket?.operatorActionArgs;
+                    const requestedArgs = rawArgs ?? [];
+                    if (conf.operatorSessionId !== ctx.operatorSessionId ||
+                        conf.reviewPacket?.operatorAction !== action ||
+                        !Array.isArray(confirmedArgs) ||
+                        JSON.stringify(confirmedArgs) !== JSON.stringify(requestedArgs)) {
+                        return {
+                            kind: "error",
+                            status: 403,
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "blocked",
+                                code: "HUMAN_CONFIRMATION_REQUIRED",
+                                message: "confirmation receipt is not bound to this action, arguments, and operator session",
+                            }),
+                        };
+                    }
+                    let receiptBytes;
+                    try {
+                        receiptBytes = await readFile(conf.dagBytesPath, "utf8");
+                    }
+                    catch (error) {
+                        return {
+                            kind: "error",
+                            status: 409,
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "conflict",
+                                code: "CONFIRMATION_STALE",
+                                message: `cannot re-read confirmation receipt bytes: ${error instanceof Error ? error.message : String(error)}`,
+                            }),
+                        };
+                    }
+                    const consumed = await ctx.confirmations.consume({
+                        confirmationId,
+                        operatorSessionId: ctx.operatorSessionId,
+                        current: {
+                            dagSha256: hashDagBytes(receiptBytes),
+                            sourceBindingSha256: conf.sourceBindingSha256,
+                            taskContractBinding: conf.taskContractBinding,
+                            controllerFingerprint: ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                                conf.controllerFingerprint,
+                            validationResultSha256: conf.validationResultSha256,
+                        },
+                    });
+                    if (!consumed.ok) {
+                        return {
+                            kind: "error",
+                            status: confirmationErrorStatus(consumed.code),
+                            body: operatorFailed({
+                                command: action,
+                                outcome: "rejected",
+                                code: consumed.code,
+                                message: consumed.message,
+                            }),
+                        };
+                    }
+                }
+                const prefix = capability.cli
+                    .replace(/^(loop-agent|agent-worker)\s+/, "")
+                    .split(/\s+/);
+                const args = [...prefix, ...(rawArgs ?? [])];
+                if (TASK_ADVANCE_ALIAS_ACTIONS.has(action) && !args.includes("--json")) {
+                    args.push("--json");
+                }
+                if (capability.kind === "read") {
+                    if (!args.includes("--json"))
+                        args.push("--json");
+                    const body = await runReadCli(ctx, args, prefix.join(" "));
+                    return { kind: "sync", status: body.ok ? 200 : 400, body };
+                }
+                const clientRequestId = str(req.clientRequestId);
+                if (!clientRequestId)
+                    return invalid(action, "clientRequestId is required");
+                return acceptOperation(ctx, {
+                    action,
+                    actionParams: p,
+                    clientRequestId,
+                    cliArgs: args,
+                    ...(capability.cli.startsWith("agent-worker ")
+                        ? { externalCommand: resolveSiblingAgentWorkerBin() }
+                        : {}),
+                });
+            }
+            return {
+                kind: "error",
+                status: 400,
+                body: operatorFailed({
+                    command: action,
+                    outcome: "invalid",
+                    code: "INVALID_INPUT",
+                    message: `unknown or unsupported action: ${action}`,
+                }),
+            };
+        }
+    }
+}
+async function consumeMutationGateReceipt(ctx, action, p) {
+    const confirmationId = str(p.confirmationId);
+    const humanGateToken = p.humanGateToken;
+    if (!confirmationId) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "confirmationId is required — call prepareMutationGate then confirm via the browser Human Gate",
+            }),
+        };
+    }
+    const secret = ctx.humanGateSecret;
+    if (!secret) {
+        return {
+            kind: "error",
+            status: 503,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "INTERNAL_ERROR",
+                message: "humanGateSecret is not configured on action context",
+            }),
+        };
+    }
+    const store = new MutationGateReceiptStore(ctx.appData);
+    const receipt = await store.get(confirmationId);
+    if (!receipt || receipt.operatorSessionId !== ctx.operatorSessionId) {
+        return {
+            kind: "error",
+            status: 404,
+            body: operatorFailed({
+                command: action,
+                outcome: "not-found",
+                code: "NOT_FOUND",
+                message: `mutation gate receipt not found: ${confirmationId}`,
+            }),
+        };
+    }
+    if (receipt.action !== action) {
+        return {
+            kind: "error",
+            status: 403,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "mutation gate receipt is bound to a different action",
+            }),
+        };
+    }
+    const { confirmationId: _cid, humanGateToken: _tok, ...boundParams } = p;
+    const expectedHash = mutationGatePayloadHash({
+        action,
+        operatorSessionId: ctx.operatorSessionId,
+        actionParams: receipt.actionParams,
+    });
+    if (expectedHash !== receipt.paramsHash) {
+        return {
+            kind: "error",
+            status: 403,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "mutation gate receipt params hash mismatch",
+            }),
+        };
+    }
+    // Bound params from the receipt must match the dispatch params (minus gate fields).
+    const presentedParams = {};
+    for (const key of Object.keys(receipt.actionParams)) {
+        presentedParams[key] = boundParams[key];
+    }
+    const presentedHash = mutationGatePayloadHash({
+        action,
+        operatorSessionId: ctx.operatorSessionId,
+        actionParams: presentedParams,
+    });
+    if (presentedHash !== receipt.paramsHash) {
+        return {
+            kind: "error",
+            status: 403,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "dispatch params do not match the prepared mutation gate receipt",
+            }),
+        };
+    }
+    const check = verifyHumanGateToken(humanGateToken, { confirmationId: receipt.receiptId, payloadHash: receipt.paramsHash }, secret);
+    if (!check.ok) {
+        return {
+            kind: "error",
+            status: 403,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: check.message,
+            }),
+        };
+    }
+    const reserved = await store.tryReserve(confirmationId);
+    if (!reserved.ok) {
+        return {
+            kind: "error",
+            status: reserved.code === "NOT_FOUND"
+                ? 404
+                : reserved.code === "EXPIRED"
+                    ? 410
+                    : 409,
+            body: operatorFailed({
+                command: action,
+                outcome: "rejected",
+                code: reserved.code === "EXPIRED"
+                    ? "CONFIRMATION_EXPIRED"
+                    : "HUMAN_CONFIRMATION_REQUIRED",
+                message: reserved.message,
+            }),
+        };
+    }
+    if (!reserved.reserved) {
+        const operationId = reserved.receipt.operationId;
+        if (operationId) {
+            const existing = await ctx.operations.get(operationId);
+            if (existing) {
+                return {
+                    kind: "idempotent",
+                    result: {
+                        kind: "accepted",
+                        status: 202,
+                        body: {
+                            operationId: existing.operationId,
+                            state: existing.state,
+                            clientRequestId: existing.clientRequestId,
+                            action: existing.action,
+                        },
+                    },
+                };
+            }
+        }
+        return {
+            kind: "error",
+            status: 409,
+            body: operatorFailed({
+                command: action,
+                outcome: "conflict",
+                code: "CONFIRMATION_CONSUMED",
+                message: `mutation gate receipt already ${reserved.reason}`,
+                details: { operationId },
+            }),
+        };
+    }
+    return { kind: "ready", receiptId: confirmationId };
+}
+async function finalizeMutationGateReceipt(ctx, receiptId, accepted) {
+    const store = new MutationGateReceiptStore(ctx.appData);
+    if (accepted.kind === "accepted") {
+        await store.markDispatched(receiptId, accepted.body.operationId);
+        return;
+    }
+    await store.releaseToPrepared(receiptId);
+}
+async function taskExistsOnDisk(repoRoot, taskId) {
+    try {
+        await access(getTaskPaths(repoRoot, taskId).taskConfigPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function allocateUniqueTaskId(repoRoot, preferredId) {
+    for (let revision = 1; revision <= 50; revision += 1) {
+        const candidate = nextTaskIdRevision(preferredId, revision);
+        if (!(await taskExistsOnDisk(repoRoot, candidate)))
+            return candidate;
+    }
+    throw new Error(`unable to allocate unique taskId near ${preferredId}`);
+}
+async function dispatchBootstrapFromPrd(ctx, p) {
+    const content = str(p.content) ?? str(p.fileText);
+    if (!content?.trim()) {
+        return invalid("bootstrapFromPrd", "content is required");
+    }
+    const parsedDocs = parseBootstrapDocuments(p.documents);
+    if (!parsedDocs.ok) {
+        return invalid("bootstrapFromPrd", parsedDocs.message);
+    }
+    const documents = parsedDocs.documents;
+    // B1: free-form prose that references repo-local markdown paths (e.g.
+    // "请参照这三个prd路径 docs/product-analysis/foo.md …") only materializes
+    // the sentence itself. Discover the referenced files and import them as
+    // additional documents so intake has real requirement facts to structure.
+    let autoImportedReferences = [];
+    let unresolvedReferences = [];
+    const autoDocs = [];
+    if (!documents) {
+        const discovery = await discoverPrdReferences({
+            prose: content,
+            repoRoot: ctx.repoRoot,
+        });
+        autoImportedReferences = discovery.references.map((r) => ({
+            repoRelative: r.repoRelative,
+            role: r.role,
+        }));
+        unresolvedReferences = discovery.unresolved;
+        for (const ref of discovery.references) {
+            const absolute = nodePath.resolve(ctx.repoRoot, ref.repoRelative);
+            const refContent = await readFile(absolute, "utf-8").catch(() => "");
+            if (!refContent.trim())
+                continue;
+            autoDocs.push({
+                name: ref.repoRelative.split("/").pop() ?? ref.repoRelative,
+                content: refContent,
+                fileName: ref.repoRelative,
+            });
+        }
+    }
+    const taskKindRaw = str(p.taskKind)?.trim();
+    const taskKind = normalizeConsoleWorkflowKind(taskKindRaw, "standard");
+    const taskKindExplicit = Boolean(taskKindRaw);
+    const engineering = parseEngineeringBoundaryFromParams(p);
+    const identity = deriveTaskIdentityFromPrd(content);
+    let taskId;
+    try {
+        taskId = await allocateUniqueTaskId(ctx.repoRoot, identity.taskId);
+    }
+    catch (error) {
+        return {
+            kind: "error",
+            status: 409,
+            body: operatorFailed({
+                command: "bootstrapFromPrd",
+                outcome: "conflict",
+                code: "REQUEST_ID_REUSE_CONFLICT",
+                message: error instanceof Error ? error.message : String(error),
+            }),
+        };
+    }
+    const title = identity.title;
+    const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+    // Standard lifecycle entry: task advance create + PRD import(s).
+    const advanceCreate = await run(["task", "advance", taskId, title, "--json"], {
+        cwd: ctx.repoRoot,
+        artifactName: "bootstrap-task-advance-create",
+        expectJson: true,
+        timeoutMs: 60_000,
+    });
+    if (!advanceCreate.ok ||
+        advanceCreate.exitCode !== 0 ||
+        advanceCreate.timedOut) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "bootstrapFromPrd",
+                outcome: "rejected",
+                code: "INTERNAL_ERROR",
+                message: advanceCreate.stderr?.trim() ||
+                    `task advance (create) failed with exit ${advanceCreate.exitCode}`,
+                details: {
+                    exitCode: advanceCreate.exitCode,
+                    timedOut: advanceCreate.timedOut,
+                    taskId,
+                    title,
+                    stdoutPreview: (advanceCreate.stdout ?? "").slice(0, 400),
+                },
+            }),
+        };
+    }
+    const succeededImports = [];
+    const importResults = [];
+    const runImportViaAdvance = async (label, text, name, role = "requirement") => {
+        const staged = await stageUtf8Text(ctx.appData, text, {
+            extension: ".md",
+        });
+        const imported = await run([
+            "task",
+            "advance",
+            taskId,
+            "--prd",
+            staged.path,
+            "--role",
+            role,
+            "--json",
+        ], {
+            cwd: ctx.repoRoot,
+            artifactName: `bootstrap-task-advance-prd-${label}`,
+            expectJson: true,
+            timeoutMs: 60_000,
+        });
+        if (!imported.ok || imported.exitCode !== 0) {
+            return {
+                kind: "error",
+                status: 400,
+                body: operatorFailed({
+                    command: "bootstrapFromPrd",
+                    outcome: "rejected",
+                    code: "INTERNAL_ERROR",
+                    message: imported.stderr?.trim() ||
+                        `task advance --prd failed for "${name}" with exit ${imported.exitCode}. 任务已创建但不完整，请用 CLI 补 PRD 或换 taskId 重试。`,
+                    details: {
+                        exitCode: imported.exitCode,
+                        taskId,
+                        failedName: name,
+                        succeededImports: [...succeededImports],
+                    },
+                }),
+            };
+        }
+        succeededImports.push(name);
+        importResults.push(imported.json ?? null);
+        return null;
+    };
+    if (documents && documents.length > 0) {
+        for (const doc of documents) {
+            const failure = await runImportViaAdvance(doc.name, doc.content, doc.name);
+            if (failure)
+                return failure;
+        }
+        const composedFailure = await runImportViaAdvance("composed", content, "composed");
+        if (composedFailure)
+            return composedFailure;
+    }
+    else if (autoDocs.length > 0) {
+        // B1: discovered repo-local references become explicit imports (role
+        // inferred per document), then the prose itself imports as composed.
+        const roleByBase = new Map(autoImportedReferences.map((r) => {
+            const base = r.repoRelative.split("/").pop() ?? r.repoRelative;
+            return [base, r.role];
+        }));
+        for (const doc of autoDocs) {
+            const role = roleByBase.get(doc.name) ?? "requirement";
+            const failure = await runImportViaAdvance(doc.name, doc.content, doc.name, role);
+            if (failure)
+                return failure;
+        }
+        const composedFailure = await runImportViaAdvance("composed", content, "composed");
+        if (composedFailure)
+            return composedFailure;
+    }
+    else {
+        const staged = await stageUtf8Text(ctx.appData, content, {
+            extension: ".md",
+        });
+        const imported = await run(["task", "advance", taskId, "--prd", staged.path, "--json"], {
+            cwd: ctx.repoRoot,
+            artifactName: "bootstrap-task-advance-prd",
+            expectJson: true,
+            timeoutMs: 60_000,
+        });
+        if (!imported.ok || imported.exitCode !== 0) {
+            return {
+                kind: "error",
+                status: 400,
+                body: operatorFailed({
+                    command: "bootstrapFromPrd",
+                    outcome: "rejected",
+                    code: "INTERNAL_ERROR",
+                    message: imported.stderr?.trim() ||
+                        `task advance --prd failed with exit ${imported.exitCode}`,
+                    details: { exitCode: imported.exitCode, taskId },
+                }),
+            };
+        }
+        importResults.push(imported.json ?? null);
+    }
+    // C: a fresh import (manual or discovered) is new evidence; clear the
+    // one-shot semantic-intake attempt marker so intake may run again.
+    if (succeededImports.length > 0) {
+        await clearSemanticIntakeAttempt(ctx.repoRoot, taskId);
+    }
+    // Phase 2 (design 2026-08-11): drive task advance intake after import so
+    // deterministic parse + one-shot Semantic Intake run on archived references.
+    // Timeout is longer than import: Pi MED may take minutes.
+    const intakeArgs = ["task", "advance", taskId, "--json"];
+    if (taskKindExplicit) {
+        intakeArgs.push("--task-kind", taskKind);
+    }
+    appendEngineeringCliArgs(intakeArgs, engineering);
+    const intake = await run(intakeArgs, {
+        cwd: ctx.repoRoot,
+        artifactName: "bootstrap-task-advance-intake",
+        expectJson: true,
+        timeoutMs: SEMANTIC_INTAKE_CLI_TIMEOUT_MS,
+    });
+    const intakeJson = intake.json ?? null;
+    const intakeOk = intake.ok && intake.exitCode === 0 && !intake.timedOut;
+    const bridged = await buildDraftFromTaskIntake({
+        repoRoot: ctx.repoRoot,
+        taskId,
+        title,
+        taskKind,
+        taskKindExplicit,
+        advanceJson: intakeJson,
+        engineering,
+    });
+    // Never fall back to grill-me product templates when intake fails.
+    const draftSaved = await ctx.drafts.save(bridged.draft);
+    const parseStatus = intakeOk || bridged.parseStatus !== "pending"
+        ? bridged.parseStatus
+        : "failed";
+    return {
+        kind: "sync",
+        status: 200,
+        body: operatorSucceeded("bootstrapFromPrd", {
+            taskId,
+            title: draftSaved.draft.title ?? title,
+            taskKind,
+            identitySource: identity.source,
+            preferredTaskId: identity.taskId,
+            draftSha256: draftSaved.draftSha256,
+            parseStatus,
+            semanticIntake: bridged.semanticIntake,
+            gaps: bridged.gaps,
+            lifecycleState: bridged.lifecycleState ??
+                (intakeOk ? "intake-incomplete" : "intake-incomplete"),
+            intake: {
+                ok: intakeOk,
+                exitCode: intake.exitCode,
+                timedOut: intake.timedOut,
+                json: intakeJson,
+            },
+            import: importResults.length === 1 ? importResults[0] : null,
+            imports: importResults,
+            documentNames: documents && documents.length > 0
+                ? [...documents.map((d) => d.name), "composed"]
+                : autoDocs.length > 0
+                    ? [...autoDocs.map((d) => d.name), "composed"]
+                    : undefined,
+            autoImportedReferences: autoImportedReferences.length > 0
+                ? autoImportedReferences
+                : undefined,
+            unresolvedReferences: unresolvedReferences.length > 0 ? unresolvedReferences : undefined,
+            draftPreview: {
+                objective: draftSaved.draft.requirement?.objective ?? null,
+                scope: draftSaved.draft.requirement?.scope ?? [],
+                acceptanceCriteria: draftSaved.draft.requirement?.acceptanceCriteria ?? [],
+            },
+        }),
+    };
+}
+const MAX_BOOTSTRAP_DOCUMENTS = 8;
+function parseBootstrapDocuments(raw) {
+    if (raw === undefined || raw === null) {
+        return { ok: true, documents: null };
+    }
+    if (!Array.isArray(raw)) {
+        return { ok: false, message: "documents must be an array" };
+    }
+    if (raw.length === 0) {
+        return { ok: true, documents: null };
+    }
+    if (raw.length > MAX_BOOTSTRAP_DOCUMENTS) {
+        return {
+            ok: false,
+            message: `documents supports at most ${MAX_BOOTSTRAP_DOCUMENTS} entries`,
+        };
+    }
+    const documents = [];
+    for (let i = 0; i < raw.length; i += 1) {
+        const entry = raw[i];
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            return { ok: false, message: `documents[${i}] must be an object` };
+        }
+        const rec = entry;
+        const name = str(rec.name)?.trim();
+        const content = str(rec.content);
+        const fileName = str(rec.fileName)?.trim();
+        if (!name) {
+            return { ok: false, message: `documents[${i}].name is required` };
+        }
+        if (!content?.trim()) {
+            return {
+                ok: false,
+                message: `documents[${i}].content is required`,
+            };
+        }
+        documents.push({
+            name,
+            content,
+            ...(fileName ? { fileName } : {}),
+        });
+    }
+    return { ok: true, documents };
+}
+async function ensureDraft(ctx, taskId, title, options) {
+    const existing = await ctx.drafts.get(taskId);
+    if (existing) {
+        const seededKind = str(options?.taskKind);
+        if (seededKind && !existing.draft.taskKind?.trim()) {
+            const saved = await ctx.drafts.save({
+                ...existing.draft,
+                taskKind: normalizeConsoleWorkflowKind(seededKind),
+            });
+            return { draft: saved.draft, draftSha256: saved.draftSha256 };
+        }
+        return { draft: existing.draft, draftSha256: existing.draftSha256 };
+    }
+    const created = await ctx.drafts.save(emptyDraft(taskId, title, { taskKind: options?.taskKind }));
+    return { draft: created.draft, draftSha256: created.draftSha256 };
+}
+async function finalizeInterviewIfComplete(ctx, sessionId, draft) {
+    const question = nextGrillMeQuestion(draft);
+    if (question) {
+        const session = await ctx.interviews.setCurrentQuestion(sessionId, {
+            id: question.id,
+            text: `${question.text}\n\n推荐：${question.recommendation}`,
+            affectsFields: question.affectsFields,
+            risk: question.risk,
+        }, "eliciting");
+        const saved = await ctx.drafts.save(draft);
+        return {
+            session,
+            draft: saved.draft,
+            draftSha256: saved.draftSha256,
+            question,
+        };
+    }
+    if (!isDraftStructurallyComplete(draft)) {
+        const saved = await ctx.drafts.save({
+            ...draft,
+            openQuestions: listResidualNotes(draft),
+        });
+        const current = await ctx.interviews.get(sessionId);
+        if (!current) {
+            return {
+                session: undefined,
+                draft: saved.draft,
+                draftSha256: saved.draftSha256,
+            };
+        }
+        const blocked = await ctx.interviews.save({
+            ...current,
+            state: "validation-blocked",
+            currentQuestion: undefined,
+        });
+        return {
+            session: blocked,
+            draft: saved.draft,
+            draftSha256: saved.draftSha256,
+        };
+    }
+    const saved = await ctx.drafts.save({
+        ...draft,
+        openQuestions: [],
+    });
+    const assessment = await ctx.assessments.create({
+        draft: saved.draft,
+        instructionVersion: "grill-me@1",
+        provider: "console",
+        model: "deterministic-integrity-v1",
+        sessionId,
+        turnId: `turn_${saved.draftSha256.slice(0, 12)}`,
+        outcome: "complete",
+    });
+    const withRef = await ctx.drafts.save({
+        ...saved.draft,
+        interviewAssessmentRef: {
+            assessmentId: assessment.assessmentId,
+            draftSha256: saved.draftSha256,
+        },
+    });
+    const session = await ctx.interviews.markDraftReady(sessionId, withRef.draft, withRef.draftSha256);
+    await ctx.interviews.save({
+        ...session,
+        assessmentId: assessment.assessmentId,
+        state: "draft-ready",
+        currentQuestion: undefined,
+    });
+    const ready = await ctx.interviews.get(sessionId);
+    return {
+        session: ready,
+        draft: withRef.draft,
+        draftSha256: withRef.draftSha256,
+        assessmentId: assessment.assessmentId,
+    };
+}
+function listResidualNotes(draft) {
+    return [
+        `validation-blocked: Draft still missing required Interview fields: ${JSON.stringify(draftSummary(draft).gaps)}`,
+    ];
+}
+async function dispatchInterviewStart(ctx, p) {
+    const taskId = str(p.taskId);
+    if (!taskId)
+        return invalid("interviewStart", "taskId is required");
+    const title = str(p.title) ?? taskId;
+    const taskKind = str(p.taskKind);
+    const { draft } = await ensureDraft(ctx, taskId, title, { taskKind });
+    const session = await ctx.interviews.create({
+        taskId,
+        operatorSessionId: ctx.operatorSessionId,
+        instructionVersion: "grill-me@1",
+    });
+    const finalized = await finalizeInterviewIfComplete(ctx, session.sessionId, draft);
+    return {
+        kind: "sync",
+        status: 200,
+        body: operatorSucceeded("interviewStart", {
+            session: finalized.session,
+            draft: finalized.draft,
+            draftSha256: finalized.draftSha256,
+            assessmentId: finalized.assessmentId ?? null,
+            question: finalized.question
+                ? {
+                    id: finalized.question.id,
+                    text: finalized.question.text,
+                    recommendation: finalized.question.recommendation,
+                    affectsFields: finalized.question.affectsFields,
+                    risk: finalized.question.risk,
+                    gapId: finalized.question.gapId,
+                }
+                : null,
+            summary: draftSummary(finalized.draft),
+            zeroExtraQuestions: !finalized.question && Boolean(finalized.assessmentId),
+        }),
+    };
+}
+/**
+ * Skip interactive grilling only when requirement structure is already present
+ * (from PRD intake) and remaining gaps are engineering/taskKind that can take
+ * non-template recommendations. Never invent console product templates.
+ */
+async function dispatchInterviewSkip(ctx, p) {
+    const taskId = str(p.taskId);
+    if (!taskId)
+        return invalid("interviewSkip", "taskId is required");
+    const title = str(p.title) ?? taskId;
+    const taskKind = str(p.taskKind);
+    let { draft } = await ensureDraft(ctx, taskId, title, { taskKind });
+    const requirementGaps = new Set([
+        "objective",
+        "scope",
+        "nonGoals",
+        "acceptanceCriteria",
+    ]);
+    const currentGaps = draftSummary(draft).gaps;
+    const missingRequirement = currentGaps.filter((g) => requirementGaps.has(g));
+    if (missingRequirement.length > 0) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "interviewSkip",
+                outcome: "invalid",
+                code: "REQUIREMENT_INCOMPLETE",
+                message: "无法跳过：需求层尚未结构化（缺 objective/scope/AC 等）。请先导入 PRD 完成 intake，或手动访谈补齐，禁止用模板冒充解析结果。",
+                details: {
+                    gaps: currentGaps,
+                    missingRequirement,
+                },
+            }),
+        };
+    }
+    const accepted = [];
+    // Only auto-accept engineering / taskKind recommendations; never product templates.
+    const autoAcceptGaps = new Set([
+        "taskKind",
+        "allowedPaths",
+        "forbiddenPaths",
+        "verifyCommands",
+    ]);
+    for (let i = 0; i < 24; i += 1) {
+        const question = nextGrillMeQuestion(draft);
+        if (!question)
+            break;
+        if (!autoAcceptGaps.has(question.gapId))
+            break;
+        // Refuse placeholder recommendations that are not real path/command values.
+        if (question.gapId === "allowedPaths" &&
+            (/请|示例|模板|（/.test(question.recommendation) ||
+                !question.recommendation.includes("*"))) {
+            break;
+        }
+        draft = applyGrillMeAnswer(draft, question, {
+            response: "accept-recommendation",
+        });
+        accepted.push(question.gapId);
+    }
+    if (!isDraftStructurallyComplete(draft)) {
+        const saved = await ctx.drafts.save({
+            ...draft,
+            openQuestions: listResidualNotes(draft),
+        });
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "interviewSkip",
+                outcome: "invalid",
+                code: "ENGINEERING_BOUNDARY_REQUIRED",
+                message: "无法跳过：工程边界（allowedPaths / forbiddenPaths / verify）尚未确认，请在访谈中填写或通过 CLI flags 提供",
+                details: {
+                    gaps: draftSummary(saved.draft).gaps,
+                    acceptedRecommendations: accepted,
+                },
+            }),
+        };
+    }
+    const session = await ctx.interviews.create({
+        taskId,
+        operatorSessionId: ctx.operatorSessionId,
+        instructionVersion: "grill-me@1+skip",
+    });
+    const priorAssumptions = Array.isArray(draft.assumptions)
+        ? draft.assumptions
+        : [];
+    const finalized = await finalizeInterviewIfComplete(ctx, session.sessionId, {
+        ...draft,
+        assumptions: [
+            ...priorAssumptions,
+            "operator skipped interactive interview; grill-me recommendations applied",
+        ],
+    });
+    if (!finalized.assessmentId) {
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: "interviewSkip",
+                outcome: "invalid",
+                code: "INVALID_INPUT",
+                message: "跳过访谈后未能签发完整评估",
+                details: { gaps: draftSummary(finalized.draft).gaps },
+            }),
+        };
+    }
+    // Re-tag assessment provenance as explicit skip (finalize uses deterministic model).
+    const assessment = await ctx.assessments.get(finalized.assessmentId);
+    if (assessment) {
+        await ctx.assessments.save({
+            ...assessment,
+            provider: "console-skip",
+            model: "accept-recommendations-v1",
+            instructionVersion: "grill-me@1+skip",
+        });
+    }
+    return {
+        kind: "sync",
+        status: 200,
+        body: operatorSucceeded("interviewSkip", {
+            session: finalized.session,
+            draft: finalized.draft,
+            draftSha256: finalized.draftSha256,
+            assessmentId: finalized.assessmentId,
+            question: null,
+            summary: draftSummary(finalized.draft),
+            skipped: true,
+            acceptedRecommendations: accepted,
+            complete: true,
+        }),
+    };
+}
+async function dispatchInterviewTurn(ctx, p) {
+    const sessionId = str(p.sessionId);
+    if (!sessionId)
+        return invalid("interviewTurn", "sessionId is required");
+    const session = await ctx.interviews.get(sessionId);
+    if (!session) {
+        return {
+            kind: "error",
+            status: 404,
+            body: operatorFailed({
+                command: "interviewTurn",
+                outcome: "not-found",
+                code: "NOT_FOUND",
+                message: `interview session not found: ${sessionId}`,
+            }),
+        };
+    }
+    const questionId = str(p.questionId) ?? session.currentQuestion?.id;
+    if (!questionId || !session.currentQuestion) {
+        return invalid("interviewTurn", "no open question; call interviewStart or interviewGet");
+    }
+    if (session.currentQuestion.id !== questionId) {
+        return invalid("interviewTurn", "questionId does not match open question");
+    }
+    const response = str(p.response) ??
+        (str(p.acceptRecommendation) === "true"
+            ? "accept-recommendation"
+            : str(p.text)
+                ? "override"
+                : "accept-recommendation");
+    const text = str(p.text);
+    const draftRec = await ctx.drafts.get(session.taskId);
+    const draft = draftRec?.draft ?? emptyDraft(session.taskId);
+    const gapId = questionId.replace(/^q-/, "");
+    const question = nextGrillMeQuestion(draft)?.id === questionId
+        ? nextGrillMeQuestion(draft)
+        : {
+            id: questionId,
+            gapId,
+            text: session.currentQuestion.text,
+            recommendation: extractRecommendation(session.currentQuestion.text),
+            affectsFields: session.currentQuestion.affectsFields,
+            risk: session.currentQuestion.risk ?? "medium",
+        };
+    if (response === "defer" && question.risk === "high") {
+        return {
+            kind: "error",
+            status: 403,
+            body: operatorFailed({
+                command: "interviewTurn",
+                outcome: "blocked",
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "高风险访谈问题不可暂缓",
+                details: { questionId, risk: question.risk },
+            }),
+        };
+    }
+    await ctx.interviews.recordAnswer(sessionId, {
+        questionId,
+        response,
+        text,
+        at: new Date().toISOString(),
+    });
+    const updatedDraft = applyGrillMeAnswer(draft, question, { response, text });
+    const finalized = await finalizeInterviewIfComplete(ctx, sessionId, updatedDraft);
+    return {
+        kind: "sync",
+        status: 200,
+        body: operatorSucceeded("interviewTurn", {
+            session: finalized.session,
+            draft: finalized.draft,
+            draftSha256: finalized.draftSha256,
+            assessmentId: finalized.assessmentId ?? null,
+            question: finalized.question
+                ? {
+                    id: finalized.question.id,
+                    text: finalized.question.text,
+                    recommendation: finalized.question.recommendation,
+                    affectsFields: finalized.question.affectsFields,
+                    risk: finalized.question.risk,
+                    gapId: finalized.question.gapId,
+                }
+                : null,
+            summary: draftSummary(finalized.draft),
+            complete: Boolean(finalized.assessmentId),
+        }),
+    };
+}
+function extractRecommendation(questionText) {
+    const m = questionText.match(/推荐[：:]\s*(.+)$/m);
+    return m?.[1]?.trim() || "";
+}
+function invalid(action, message) {
+    return {
+        kind: "error",
+        status: 400,
+        body: operatorFailed({
+            command: action,
+            outcome: "invalid",
+            code: "INVALID_INPUT",
+            message,
+        }),
+    };
+}
+function interruptActionFailed(action, code, message) {
+    const blocked = code === "INTERRUPT_ALREADY_PENDING" ||
+        code === "INTERRUPT_NEEDS_RECONCILE" ||
+        code === "RUN_ALREADY_TERMINAL" ||
+        code === "RUN_NOT_CONSOLE_OWNED" ||
+        code === "RUNNER_IDENTITY_MISMATCH" ||
+        code === "RUN_NOT_ACTIVE";
+    return {
+        kind: "error",
+        status: code === "INVALID_INPUT" ? 400 : 409,
+        body: operatorFailed({
+            command: action,
+            outcome: blocked ? "blocked" : "invalid",
+            code,
+            message: message || INTERRUPT_ERROR_MESSAGES[code] || message,
+        }),
+    };
+}
+async function syncTargetInterruptProjection(input) {
+    const current = await input.operations.get(input.operationId);
+    if (!current)
+        return false;
+    if (current.interrupt?.status === input.interrupt.status &&
+        current.interrupt?.requestId === input.interrupt.requestId) {
+        return false;
+    }
+    const nextStatus = input.interrupt.status;
+    if (nextStatus !== "requested" &&
+        nextStatus !== "acknowledged" &&
+        nextStatus !== "settled" &&
+        nextStatus !== "needs-reconcile") {
+        return false;
+    }
+    await input.operations.update(input.operationId, {
+        dagRunId: current.dagRunId ?? input.runId,
+        interrupt: {
+            status: nextStatus,
+            ...(input.interrupt.requestId
+                ? { requestId: input.interrupt.requestId }
+                : {}),
+            ...(input.interrupt.reasonCode
+                ? { reasonCode: input.interrupt.reasonCode }
+                : {}),
+            ...(input.interrupt.requestedAt
+                ? { requestedAt: input.interrupt.requestedAt }
+                : {}),
+            ...(input.interrupt.acknowledgedAt
+                ? { acknowledgedAt: input.interrupt.acknowledgedAt }
+                : {}),
+            ...(input.interrupt.settledAt
+                ? { settledAt: input.interrupt.settledAt }
+                : {}),
+            ...(input.interrupt.outcome ? { outcome: input.interrupt.outcome } : {}),
+        },
+    });
+    input.events.append(input.operationId, {
+        kind: "state",
+        message: `interrupt ${nextStatus}`,
+        data: {
+            interruptStatus: nextStatus,
+            runId: input.runId,
+        },
+    });
+    return true;
+}
+function confirmationErrorStatus(code) {
+    if (code === "NOT_FOUND")
+        return 404;
+    if (code === "HUMAN_CONFIRMATION_REQUIRED")
+        return 403;
+    return 409;
+}
+async function dispatchContractValidateOrDiff(ctx, action, p) {
+    const taskId = str(p.taskId);
+    const draftText = str(p.draftJson) ?? str(p.inputText);
+    if (!taskId)
+        return invalid(action, "taskId is required");
+    let draft;
+    try {
+        if (!draftText) {
+            const stored = await ctx.drafts.get(taskId);
+            if (!stored) {
+                return invalid(action, "draftJson or stored draft required");
+            }
+            draft = toCanonicalDraftForCli(stored.draft);
+        }
+        else {
+            draft = JSON.parse(draftText);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: action,
+                outcome: "invalid",
+                code: "INVALID_INPUT",
+                message: `invalid draft JSON: ${message}`,
+            }),
+        };
+    }
+    try {
+        if (action === "contractValidate") {
+            const validation = await validateDraftForTask({
+                repoRoot: ctx.repoRoot,
+                taskId,
+                draft: draft,
+            });
+            if (!validation.ok) {
+                return {
+                    kind: "sync",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: validation.errors.join("; "),
+                        details: { errors: validation.errors },
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded(action, {
+                    taskId,
+                    warnings: validation.warnings,
+                }),
+            };
+        }
+        const diff = await diffTaskContract({
+            repoRoot: ctx.repoRoot,
+            taskId,
+            draft: draft,
+        });
+        return {
+            kind: "sync",
+            status: 200,
+            body: operatorSucceeded(action, { taskId, diff }),
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            kind: "error",
+            status: 400,
+            body: operatorFailed({
+                command: action,
+                outcome: "blocked",
+                code: "INTERNAL_ERROR",
+                message,
+            }),
+        };
+    }
+}
+export function isMutationAction(action) {
+    return MUTATION_OR_LONG.has(action);
+}