@tea-agent/loop-agent 0.33.5 → 0.33.6

package/dist/worker/console/operator-actions.js

@@ -1,7 +1,7 @@
 import { access, readFile } from "node:fs/promises";
 import { buildOperatorCapabilitiesDocument } from "../../shared/operator/capabilities.js";
 import { buildOperatorResult, operatorFailed, operatorSucceeded, } from "../../shared/operator/envelope.js";
-import { getTaskPaths } from "../../task/runtime.js";
+import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
 import { diffTaskContract, validateDraftForTask, } from "../../task/contract/index.js";
 import { stageUtf8Text } from "./app-data.js";
 import { ALL_CONFIRMATION_CHALLENGES, hashDagBytes, } from "./dag-confirmation.js";
@@ -19,10 +19,12 @@ import { deriveTaskIdentityFromPrd, nextTaskIdRevision, } from "./prd-identity.j
 import { resolveSiblingAgentWorkerBin } from "./sibling-controller.js";
 import { projectOperationEventSummary, projectOperationForChat, } from "./chat/chat-event-store.js";
 import { MutationGateReceiptStore } from "./mutation-gate-receipt-store.js";
+import { assessAutonomousExecutionEligibility, deriveEligibilityFactsFromDagSpec, } from "./dag-execution-receipt.js";
 import { issueHumanGateToken, mutationGatePayloadHash, verifyHumanGateToken, } from "./human-gate-token.js";
 const MUTATION_GATE_ACTIONS = new Set([
-    "standaloneTaskRerun",
-    "workerTaskRetry",
+    // 2026-08-11: standaloneTaskRerun / workerTaskRetry are autonomous (server
+    // run-facts checks); only Night Scheduler mutations still need the browser
+    // Human Gate.
     "workerAdmissionPrepare",
     "workerSchedulerAdd",
     "workerSchedulerCancel",
@@ -72,6 +74,150 @@ function readWriteSetGateToken(reviewPacket) {
     const token = reviewPacket.writeSetGateToken;
     return typeof token === "string" && token.includes(":") ? token : undefined;
 }
+/** Extract the review packet from a task advance --dag-output operator JSON. */
+function extractReviewPacketFromCliJson(json) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const envelope = json;
+    const payload = envelope.result && typeof envelope.result === "object"
+        ? envelope.result
+        : envelope;
+    const packet = payload.reviewPacket;
+    return packet && typeof packet === "object"
+        ? packet
+        : undefined;
+}
+/**
+ * Read the live managed Task Contract binding for a task (server-derived).
+ * Returns undefined when the task is not managed or status facts are missing
+ * so callers can fail closed.
+ */
+async function readLiveTaskContractBinding(ctx, taskId) {
+    const showBody = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+    const statusResult = (showBody.result ?? {});
+    const c = showBody.ok ? statusResult.contract : undefined;
+    if (!c?.canonicalHash || typeof c.revision !== "number")
+        return undefined;
+    return {
+        schemaVersion: 1,
+        taskId,
+        revision: c.revision,
+        canonicalHash: c.canonicalHash,
+        taskConfigSha256: c.taskConfigSha256 ?? undefined,
+        projectionVersion: c.projectionVersion ?? undefined,
+        canonicalizerVersion: c.canonicalizerVersion ?? undefined,
+        taskConfigSchemaVersion: c.taskConfigSchemaVersion ?? undefined,
+    };
+}
+function gateError(action, code, message, details) {
+    const status = code === "NOT_FOUND" ? 404 : code === "INVALID_INPUT" ? 400 : 403;
+    return {
+        kind: "error",
+        status,
+        body: operatorFailed({
+            command: action,
+            outcome: "blocked",
+            code,
+            message,
+            details,
+        }),
+    };
+}
+/**
+ * 2026-08-11 R2 run-facts check for standaloneTaskRerun (read-only CLI
+ * evidence only — no browser Human Gate). Fails closed when facts are missing.
+ */
+async function assertAutonomousRerunEligible(ctx, runId, taskId) {
+    const report = await runReadCli(ctx, ["dag", "report", "--run-id", runId, "--json"], "dag report");
+    const reportResult = (report.ok ? report.result : undefined);
+    const recovery = reportResult?.primaryRecovery;
+    if (!report.ok || !reportResult?.primaryFailure || !recovery) {
+        return gateError("standaloneTaskRerun", "INVALID_INPUT", "cannot read dagReport run facts; standaloneTaskRerun requires server-side run evidence", { runId });
+    }
+    if (recovery.humanRequired === true) {
+        return gateError("standaloneTaskRerun", "HUMAN_CONFIRMATION_REQUIRED", `primaryRecovery requires a human decision (action=${recovery.action ?? "?"}); stop autonomous rerun`, { runId });
+    }
+    const nodeId = reportResult.primaryFailure.scope === "node"
+        ? reportResult.primaryFailure.nodeId
+        : undefined;
+    let planEligible;
+    if (nodeId) {
+        const plan = await runReadCli(ctx, [
+            "dag",
+            "rerun",
+            "--run-id",
+            runId,
+            "--from-node",
+            nodeId,
+            "--plan",
+            "--json",
+        ], "dag rerun plan");
+        const planResult = (plan.result ?? {});
+        if (plan.ok && planResult.eligible === true) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", `node rerun plan is eligible (planHash=${planResult.planHash ?? "?"}); use dagRerun with the fresh planHash instead of standaloneTaskRerun`, { runId, nodeId });
+        }
+        if (!plan.ok && planResult.eligible === undefined) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", "dagRerunPlan run facts unavailable; standaloneTaskRerun fails closed", { runId, nodeId });
+        }
+        planEligible = planResult.eligible;
+    }
+    if (planEligible !== false) {
+        // No ineligible-plan evidence: require an explicit rerun-task recommendation.
+        const recommendsRerunTask = recovery.action === "rerun-after-fix" ||
+            /rerun-task|standalone/i.test(recovery.commandHint ?? "");
+        if (!recommendsRerunTask) {
+            return gateError("standaloneTaskRerun", "HUMAN_CONFIRMATION_REQUIRED", `run facts do not support autonomous standaloneTaskRerun (recovery action=${recovery.action ?? "?"}); stop`, { runId });
+        }
+    }
+    if (taskId) {
+        // Keep the original taskId: the run must still be bound to it.
+        const status = await runReadCli(ctx, ["task", "status", taskId, "--json"], "task status");
+        const statusResult = (status.ok ? status.result : undefined);
+        const boundRunId = statusResult?.activeRun?.runId ?? statusResult?.latestRun?.runId;
+        if (!status.ok || !boundRunId || boundRunId !== runId) {
+            return gateError("standaloneTaskRerun", "INVALID_INPUT", `taskId ${taskId} is not bound to run ${runId}; keep the original taskId for same-task rerun`, { runId, taskId, boundRunId });
+        }
+    }
+    return { kind: "ready" };
+}
+/**
+ * 2026-08-11 read-only facts check for workerTaskRetry: the task must exist
+ * in the pool doctor inventory with status Failed (featureId consistent).
+ */
+async function assertWorkerTaskRetryFacts(ctx, taskId, featureId) {
+    const run = ctx.runCommand ??
+        ((args, options) => ctx.client.runExternal
+            ? ctx.client.runExternal(resolveSiblingAgentWorkerBin(), args, options)
+            : ctx.client.run(args, options));
+    let result;
+    try {
+        result = await run(["pool", "doctor", "--repo", ctx.repoRoot, "--json"], {
+            cwd: ctx.repoRoot,
+            artifactName: "worker-task-retry-facts",
+            expectJson: true,
+        });
+    }
+    catch (error) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `cannot read pool doctor facts: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!result.ok || result.exitCode !== 0 || !result.json) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", "cannot read pool doctor run facts; workerTaskRetry fails closed");
+    }
+    const doctor = result.json;
+    const v2Entry = (doctor.v2 ?? []).find((entry) => entry.taskId === taskId);
+    const legacyEntry = (doctor.legacy ?? []).find((entry) => entry.taskId === taskId && Boolean(entry.featureId));
+    const entry = v2Entry ?? legacyEntry;
+    if (!entry) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `task ${taskId} not found in the pool doctor inventory`, { taskId });
+    }
+    if (entry.status !== "Failed") {
+        return gateError("workerTaskRetry", "HUMAN_CONFIRMATION_REQUIRED", `task ${taskId} is ${entry.status}; only Failed tasks are retry-eligible`, { taskId, status: entry.status });
+    }
+    if (featureId && entry.featureId && entry.featureId !== featureId) {
+        return gateError("workerTaskRetry", "INVALID_INPUT", `featureId ${featureId} does not match the pool task ${taskId} (${entry.featureId})`, { taskId, featureId, observedFeatureId: entry.featureId });
+    }
+    return { kind: "ready" };
+}
 /**
  * Prefer structured stdout JSON failure semantics (findings / message) over bare
  * `exit N` when stderr is empty — spine audit and similar read CLIs write details
@@ -889,6 +1035,239 @@ export async function dispatchOperatorAction(ctx, req) {
                 }),
             };
         }
+        case "prepareDagExecution": {
+            const taskId = str(p.taskId);
+            if (!taskId)
+                return invalid(action, "taskId is required");
+            const profile = str(p.profile) ?? "auto";
+            const run = ctx.runCommand ?? ((a, o) => ctx.client.run(a, o));
+            // Server-side generate + strict validate only. The model never supplies
+            // DAG bytes or raw paths (AC-02): everything is re-derived here.
+            const staged = await stageUtf8Text(ctx.appData, "", {
+                extension: ".json",
+            });
+            const gen = await run([
+                "task",
+                "advance",
+                taskId,
+                "--profile",
+                profile,
+                "--dag-output",
+                staged.path,
+                "--json",
+            ], {
+                cwd: ctx.repoRoot,
+                artifactName: "prepare-dag-execution-task-advance",
+                expectJson: true,
+                timeoutMs: 180_000,
+            });
+            if (!gen.ok || gen.exitCode !== 0) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: gen.stderr?.trim() ||
+                            `task advance (prepare DAG execution) failed with exit ${gen.exitCode}`,
+                        details: {
+                            exitCode: gen.exitCode,
+                            stdoutPreview: (gen.stdout ?? "").slice(0, 1200),
+                        },
+                    }),
+                };
+            }
+            let dagText;
+            try {
+                dagText = await readFile(staged.path, "utf8");
+            }
+            catch {
+                dagText = "";
+            }
+            if (!dagText.trim()) {
+                // Fallback: advance may skip generate-dag when a draft already
+                // exists; still prefer the task DAG over an empty staged file.
+                const taskDagPath = getTaskPaths(ctx.repoRoot, taskId).dagDraftPath;
+                try {
+                    dagText = await readFile(taskDagPath, "utf8");
+                }
+                catch {
+                    dagText = "";
+                }
+            }
+            if (!dagText.trim()) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: "task advance produced empty DAG output",
+                    }),
+                };
+            }
+            const writeSetGateToken = extractWriteSetGateTokenFromCliJson(gen.json, taskId);
+            const finalStaged = await stageUtf8Text(ctx.appData, dagText, {
+                extension: ".json",
+            });
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                "unknown-controller";
+            const draftRec = await ctx.drafts.get(taskId);
+            const sourceBindingSha256 = draftRec
+                ? draftRec.draftSha256
+                : hashDagBytes(`source:${taskId}:${finalStaged.sha256}`);
+            const validateBody = await runReadCli(ctx, ["dag", "validate", "--dag", finalStaged.path, "--json"], "dag validate");
+            if (!validateBody.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: "INVALID_INPUT",
+                        message: validateBody.error?.message ??
+                            "dag validate failed; cannot prepare execution for an invalid DAG",
+                        details: {
+                            validateError: validateBody.error ?? null,
+                            dagSha256: finalStaged.sha256,
+                        },
+                    }),
+                };
+            }
+            const validationResultSha256 = hashDagBytes(JSON.stringify({
+                ok: true,
+                command: "dag validate",
+                result: validateBody.result ?? null,
+            }));
+            const taskContractBinding = await readLiveTaskContractBinding(ctx, taskId);
+            if (!taskContractBinding) {
+                return {
+                    kind: "error",
+                    status: 409,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable; apply/adopt before prepareDagExecution",
+                        details: { taskId },
+                    }),
+                };
+            }
+            // G2 deterministic assessment from server-side facts only.
+            let allowedPaths;
+            let forbiddenPaths;
+            try {
+                const taskConfig = await loadTaskConfig(ctx.repoRoot, taskId);
+                allowedPaths = Array.isArray(taskConfig.allowedPaths)
+                    ? taskConfig.allowedPaths
+                    : [];
+                forbiddenPaths = Array.isArray(taskConfig.forbiddenPaths)
+                    ? taskConfig.forbiddenPaths
+                    : [];
+            }
+            catch {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: "task boundary (task.json allowedPaths/forbiddenPaths) unavailable; autonomous execution not permitted",
+                    }),
+                };
+            }
+            const reviewPacket = extractReviewPacketFromCliJson(gen.json) ?? {};
+            const derivedFacts = deriveEligibilityFactsFromDagSpec({
+                dagSpec: JSON.parse(dagText),
+                allowedPaths,
+                forbiddenPaths,
+            });
+            const packetWriters = Array.isArray(reviewPacket.writers)
+                ? reviewPacket.writers.map((writer) => ({
+                    nodeId: writer.nodeId ?? "unknown",
+                    writeSet: Array.isArray(writer.writeSet)
+                        ? writer.writeSet.filter((v) => typeof v === "string")
+                        : [],
+                }))
+                : derivedFacts.writersWriteSets;
+            const packetShellVerification = Array.isArray(reviewPacket.shellVerification)
+                ? reviewPacket.shellVerification.length > 0
+                : derivedFacts.hasStructuredVerification;
+            const eligibility = {
+                writersWriteSets: packetWriters,
+                allowedPaths,
+                forbiddenPaths,
+                broadWriteSetRisk: typeof reviewPacket.broadWriteSetRisk === "boolean"
+                    ? reviewPacket.broadWriteSetRisk
+                    : derivedFacts.broadWriteSetRisk,
+                forbiddenOverlapRisk: typeof reviewPacket.forbiddenOverlapRisk === "boolean"
+                    ? reviewPacket.forbiddenOverlapRisk
+                    : derivedFacts.forbiddenOverlapRisk,
+                hasStructuredVerification: packetShellVerification,
+            };
+            const assessment = assessAutonomousExecutionEligibility(eligibility);
+            if (!assessment.ok) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "HUMAN_CONFIRMATION_REQUIRED",
+                        message: assessment.reason,
+                        details: {
+                            taskId,
+                            dagSha256: finalStaged.sha256,
+                            eligibility: "denied",
+                        },
+                    }),
+                };
+            }
+            const prepared = await ctx.dagExecutionReceipts.prepare({
+                operatorSessionId: ctx.operatorSessionId,
+                taskId,
+                dagHandle: "staged-dag.json",
+                dagBytes: dagText,
+                dagBytesPath: finalStaged.path,
+                sourceBindingSha256,
+                taskContractBinding,
+                controllerFingerprint: controller,
+                validationResultSha256,
+                eligibility,
+                reviewPacket: {
+                    taskId,
+                    dagHandle: "staged-dag.json",
+                    validationOk: true,
+                    ...(writeSetGateToken ? { writeSetGateToken } : {}),
+                },
+            });
+            if (!prepared.ok) {
+                return {
+                    kind: "error",
+                    status: 403,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: prepared.code,
+                        message: prepared.reason,
+                    }),
+                };
+            }
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("prepareDagExecution", {
+                    executionId: prepared.receipt.executionId,
+                    eligibility: "approved",
+                    taskId,
+                    dagSha256: finalStaged.sha256,
+                    expiresAt: prepared.receipt.expiresAt,
+                }),
+            };
+        }
         case "confirmDagConfirmation": {
             const confirmationId = str(p.confirmationId);
             const humanGateToken = p.humanGateToken;
@@ -1110,14 +1489,118 @@ export async function dispatchOperatorAction(ctx, req) {
             });
         }
         case "runDag": {
-            // Only confirmationId — never raw dag path from browser
-            const confirmationId = str(p.confirmationId);
+            // Model path (AC-02): only executionId — never a raw dag path from
+            // the model. The browser Human Gate route (chat human-gate dag-run)
+            // still dispatches with confirmationId for the preserved global
+            // Human Gate flow; that path is not model-reachable (the confirmation
+            // must be in "confirmed" state, which requires a server-signed
+            // human-gate token verified by confirmDagConfirmation).
             const clientRequestId = str(req.clientRequestId);
-            if (!confirmationId || !clientRequestId) {
-                return invalid(action, "runDag requires confirmationId and clientRequestId only");
+            const executionId = str(p.executionId);
+            if (!clientRequestId) {
+                return invalid(action, "runDag requires clientRequestId");
             }
-            const conf = await ctx.confirmations.get(confirmationId);
-            if (!conf) {
+            if (executionId && str(p.confirmationId)) {
+                return invalid(action, "runDag accepts either executionId or confirmationId, not both");
+            }
+            if (!executionId) {
+                const confirmationId = str(p.confirmationId);
+                if (!confirmationId) {
+                    return invalid(action, "runDag requires executionId (autonomous) or confirmationId (browser Human Gate)");
+                }
+                // Preserved browser Human Gate flow (dag-confirmation.ts untouched).
+                const conf = await ctx.confirmations.get(confirmationId);
+                if (!conf) {
+                    return {
+                        kind: "error",
+                        status: 404,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "not-found",
+                            code: "NOT_FOUND",
+                            message: `confirmation not found: ${confirmationId}`,
+                        }),
+                    };
+                }
+                // Re-read staged DAG bytes and hash.
+                let dagBytes;
+                try {
+                    dagBytes = await readFile(conf.dagBytesPath, "utf8");
+                }
+                catch (error) {
+                    return {
+                        kind: "error",
+                        status: 409,
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "conflict",
+                            code: "CONFIRMATION_STALE",
+                            message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                        }),
+                    };
+                }
+                const dagSha256 = hashDagBytes(dagBytes);
+                const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                    conf.controllerFingerprint;
+                const consumed = await ctx.confirmations.consume({
+                    confirmationId,
+                    operatorSessionId: ctx.operatorSessionId,
+                    current: {
+                        dagSha256,
+                        sourceBindingSha256: conf.sourceBindingSha256,
+                        taskContractBinding: conf.taskContractBinding,
+                        controllerFingerprint: controller,
+                        validationResultSha256: conf.validationResultSha256,
+                    },
+                });
+                if (!consumed.ok) {
+                    return {
+                        kind: "error",
+                        status: confirmationErrorStatus(consumed.code),
+                        body: operatorFailed({
+                            command: action,
+                            outcome: "rejected",
+                            code: consumed.code,
+                            message: consumed.message,
+                        }),
+                    };
+                }
+                const taskId = conf.taskContractBinding.taskId;
+                const gateToken = readWriteSetGateToken(conf.reviewPacket);
+                if (gateToken) {
+                    return acceptOperation(ctx, {
+                        action,
+                        actionParams: { confirmationId },
+                        clientRequestId,
+                        taskId,
+                        cliArgs: [
+                            "task",
+                            "advance",
+                            taskId,
+                            "--approve-gate",
+                            gateToken,
+                            "--json",
+                        ],
+                    });
+                }
+                return acceptOperation(ctx, {
+                    action,
+                    actionParams: { confirmationId },
+                    clientRequestId,
+                    taskId,
+                    cliArgs: [
+                        "dag",
+                        "execute",
+                        "--dag",
+                        conf.dagBytesPath,
+                        "--cwd",
+                        ctx.repoRoot,
+                        "--json",
+                    ],
+                });
+            }
+            const receipt = await ctx.dagExecutionReceipts.get(executionId);
+            if (!receipt) {
                 return {
                     kind: "error",
                     status: 404,
@@ -1125,40 +1608,45 @@ export async function dispatchOperatorAction(ctx, req) {
                         command: action,
                         outcome: "not-found",
                         code: "NOT_FOUND",
-                        message: `confirmation not found: ${confirmationId}`,
+                        message: `execution receipt not found: ${executionId}`,
                     }),
                 };
             }
-            // Re-read staged DAG bytes and hash
-            let dagBytes;
+            const taskId = receipt.taskId;
+            // Live server-derived bindings only; any drift fails closed inside
+            // consume (staged bytes/hash + controller + task binding + source).
+            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
+                receipt.controllerFingerprint;
+            let sourceBindingSha256 = receipt.sourceBindingSha256;
             try {
-                dagBytes = await readFile(conf.dagBytesPath, "utf8");
+                const draftRec = await ctx.drafts.get(taskId);
+                if (draftRec)
+                    sourceBindingSha256 = draftRec.draftSha256;
             }
-            catch (error) {
+            catch {
+                // keep the receipt binding; consume will still compare it
+            }
+            const liveBinding = await readLiveTaskContractBinding(ctx, taskId);
+            if (!liveBinding) {
                 return {
                     kind: "error",
                     status: 409,
                     body: operatorFailed({
                         command: action,
-                        outcome: "conflict",
-                        code: "CONFIRMATION_STALE",
-                        message: `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`,
+                        outcome: "blocked",
+                        code: "BINDING_DRIFT",
+                        message: "managed Task Contract binding unavailable at consume time",
+                        details: { taskId },
                     }),
                 };
             }
-            const dagSha256 = hashDagBytes(dagBytes);
-            const controller = ctx.client.getIdentity?.()?.packageFingerprint?.value ??
-                conf.controllerFingerprint;
-            const consumed = await ctx.confirmations.consume({
-                confirmationId,
+            const consumed = await ctx.dagExecutionReceipts.consume({
+                executionId,
                 operatorSessionId: ctx.operatorSessionId,
-                current: {
-                    dagSha256,
-                    sourceBindingSha256: conf.sourceBindingSha256,
-                    taskContractBinding: conf.taskContractBinding,
-                    controllerFingerprint: controller,
-                    validationResultSha256: conf.validationResultSha256,
-                },
+                controllerFingerprint: controller,
+                taskContractBinding: liveBinding,
+                sourceBindingSha256,
+                validationResultSha256: receipt.validationResultSha256,
             });
             if (!consumed.ok) {
                 return {
@@ -1172,41 +1660,48 @@ export async function dispatchOperatorAction(ctx, req) {
                     }),
                 };
             }
-            const taskId = conf.taskContractBinding.taskId;
-            const gateToken = readWriteSetGateToken(conf.reviewPacket);
-            if (gateToken) {
-                // Standard lifecycle path: human confirmation maps to writeSet gate approve.
+            const gateToken = readWriteSetGateToken(receipt.reviewPacket);
+            const dispatchRun = async () => {
+                if (gateToken) {
+                    // Standard lifecycle path: the execution receipt replaces the
+                    // browser confirm; the gate token is still consumed by the CLI.
+                    return acceptOperation(ctx, {
+                        action,
+                        actionParams: { executionId },
+                        clientRequestId,
+                        taskId,
+                        cliArgs: [
+                            "task",
+                            "advance",
+                            taskId,
+                            "--approve-gate",
+                            gateToken,
+                            "--json",
+                        ],
+                    });
+                }
+                // Advanced: execute the server-staged DAG bytes (never a model path).
                 return acceptOperation(ctx, {
                     action,
-                    actionParams: { confirmationId },
+                    actionParams: { executionId },
                     clientRequestId,
                     taskId,
                     cliArgs: [
-                        "task",
-                        "advance",
-                        taskId,
-                        "--approve-gate",
-                        gateToken,
+                        "dag",
+                        "execute",
+                        "--dag",
+                        receipt.dagBytesPath,
+                        "--cwd",
+                        ctx.repoRoot,
                         "--json",
                     ],
                 });
+            };
+            const accepted = await dispatchRun();
+            if (accepted.kind === "accepted") {
+                await ctx.dagExecutionReceipts.markDispatched(executionId, accepted.body.operationId);
             }
-            // Advanced: arbitrary staged DagSpec (client-supplied dagText) until dag execute rename.
-            return acceptOperation(ctx, {
-                action,
-                actionParams: { confirmationId },
-                clientRequestId,
-                taskId,
-                cliArgs: [
-                    "dag",
-                    "execute",
-                    "--dag",
-                    conf.dagBytesPath,
-                    "--cwd",
-                    ctx.repoRoot,
-                    "--json",
-                ],
-            });
+            return accepted;
         }
         case "dagRerunPlan": {
             const runId = str(p.runId);
@@ -1263,11 +1758,11 @@ export async function dispatchOperatorAction(ctx, req) {
             if (!runId || !reason || !clientRequestId) {
                 return invalid(action, "runId, reason, and clientRequestId are required");
             }
-            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            // 2026-08-11: read-only run-facts check replaces the browser Human
+            // Gate (R2). Fails closed when evidence is missing.
+            const gated = await assertAutonomousRerunEligible(ctx, runId, str(p.taskId));
             if (gated.kind === "error")
                 return gated;
-            if (gated.kind === "idempotent")
-                return gated.result;
             const profile = str(p.profile);
             const taskId = str(p.taskId);
             const cliArgs = [
@@ -1285,15 +1780,13 @@ export async function dispatchOperatorAction(ctx, req) {
                 cliArgs.push("--profile", profile);
             if (taskId)
                 cliArgs.push("--task-id", taskId);
-            const accepted = await acceptOperation(ctx, {
+            return acceptOperation(ctx, {
                 action,
                 actionParams: p,
                 clientRequestId,
                 taskId,
                 cliArgs,
             });
-            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
-            return accepted;
         }
         case "workerTaskRetry": {
             const taskId = str(p.taskId);
@@ -1303,11 +1796,11 @@ export async function dispatchOperatorAction(ctx, req) {
             if (!taskId || !reason || !clientRequestId) {
                 return invalid(action, "taskId, reason, and clientRequestId are required");
             }
-            const gated = await consumeMutationGateReceipt(ctx, action, p);
+            // 2026-08-11: read-only pool facts check replaces the browser Human
+            // Gate (task must exist in Failed state; featureId consistent).
+            const gated = await assertWorkerTaskRetryFacts(ctx, taskId, featureId);
             if (gated.kind === "error")
                 return gated;
-            if (gated.kind === "idempotent")
-                return gated.result;
             const args = [
                 "task",
                 "retry",
@@ -1319,7 +1812,7 @@ export async function dispatchOperatorAction(ctx, req) {
             ];
             if (featureId)
                 args.push("--feature-id", featureId);
-            const accepted = await acceptOperation(ctx, {
+            return acceptOperation(ctx, {
                 action,
                 actionParams: p,
                 clientRequestId,
@@ -1327,8 +1820,6 @@ export async function dispatchOperatorAction(ctx, req) {
                 cliArgs: args,
                 externalCommand: resolveSiblingAgentWorkerBin(),
             });
-            await finalizeMutationGateReceipt(ctx, gated.receiptId, accepted);
-            return accepted;
         }
         case "workerAdmissionPrepare": {
             const featureDir = str(p.featureDir);
@@ -1510,7 +2001,7 @@ export async function dispatchOperatorAction(ctx, req) {
                 return invalid(action, "action and actionParams are required");
             }
             if (!MUTATION_GATE_ACTIONS.has(targetAction)) {
-                return invalid(action, "action must be a mutation-gate target (standaloneTaskRerun | workerTaskRetry | workerAdmissionPrepare | workerSchedulerAdd | workerSchedulerCancel | workerSchedulerHarvest | workerSchedulerDiscard)");
+                return invalid(action, "action must be a mutation-gate target (workerAdmissionPrepare | workerSchedulerAdd | workerSchedulerCancel | workerSchedulerHarvest | workerSchedulerDiscard)");
             }
             const secret = ctx.humanGateSecret;
             if (!secret) {