@tea-agent/loop-agent 0.33.7-beta.0 → 0.34.1

package/dist/worker/console/chat/runtime-context.js

@@ -24,9 +24,41 @@ function fullText(text, max = RUNTIME_CONTEXT_TEXT_MAX) {
         return cleaned;
     return `${cleaned.slice(0, max)}\n\n…[truncated ${cleaned.length - max} chars for inspect UI]`;
 }
+/**
+ * Secret-scrub + length-limit a runtime text (system prompt / resource paths)
+ * before it leaves the server. Used by the runtime snapshot projection.
+ */
+export function redactRuntimeText(text, max = RUNTIME_CONTEXT_TEXT_MAX) {
+    if (!text)
+        return "";
+    const cleaned = redact(text);
+    if (cleaned.length <= max)
+        return cleaned;
+    return `${cleaned.slice(0, max)}\n\n…[truncated ${cleaned.length - max} chars for inspect UI]`;
+}
 export function projectRuntimeContext(input) {
     const systemText = fullText(input.systemPrompt) ?? "";
     const suffixText = fullText(input.systemPromptSuffix);
+    const projectResources = (resources) => (resources ?? []).map((resource) => ({
+        name: redactRuntimeText(resource.name, 200),
+        description: redactRuntimeText(resource.description, 600),
+        path: redactRuntimeText(resource.path, 400),
+        baseDir: resource.baseDir ? redactRuntimeText(resource.baseDir, 400) : undefined,
+        scope: resource.scope,
+        source: redactRuntimeText(resource.source, 200),
+        enabled: resource.enabled,
+        version: resource.version ? redactRuntimeText(resource.version, 80) : undefined,
+        cwd: resource.cwd ? redactRuntimeText(resource.cwd, 400) : undefined,
+        resolved: resource.resolved?.map((item) => ({
+            type: item.type,
+            name: redactRuntimeText(item.name, 200),
+            path: redactRuntimeText(item.path, 400),
+            source: redactRuntimeText(item.source, 200),
+            scope: item.scope,
+        })),
+        error: resource.error ? redactRuntimeText(resource.error, 400) : undefined,
+        diagnostics: (resource.diagnostics ?? []).map((diag) => redactRuntimeText(diag, 400)),
+    }));
     return {
         readOnly: true,
         systemPrompt: {
@@ -35,22 +67,26 @@ export function projectRuntimeContext(input) {
             text: systemText,
             charCount: input.systemPrompt.length,
         },
-        skills: input.skills.map((skill) => ({
-            name: skill.name,
-            description: summary(skill.description, 200) ?? "",
-            charCount: skill.charCount,
-            ...(skill.bodyText
-                ? { body: fullText(skill.bodyText, 40_000) }
-                : {}),
-        })),
         resources: {
-            mode: "closed",
-            noContextFiles: true,
-            noSkills: true,
-            noExtensions: true,
+            mode: "open",
+            noContextFiles: false,
+            noSkills: false,
+            noExtensions: false,
             hasBash: true,
             activeToolCount: input.activeTools.length,
             activeTools: [...input.activeTools],
+            contextFiles: (input.contextFiles ?? []).map((file) => ({
+                path: redactRuntimeText(file.path, 400),
+                characters: file.characters,
+            })),
+            skills: projectResources(input.skills),
+            extensions: projectResources(input.extensions),
+            packages: projectResources(input.packages),
+            diagnostics: (input.diagnostics ?? []).map((diag) => ({
+                type: diag.type,
+                message: redactRuntimeText(diag.message, 400),
+                ...(diag.path ? { path: redactRuntimeText(diag.path, 400) } : {}),
+            })),
         },
         model: input.model,
         thinkingLevel: input.thinkingLevel,

package/dist/worker/console/chat/runtime-selection.js

@@ -7,6 +7,65 @@
  * in a plain Node environment (the React component owns the network race
  * guards; these helpers only define what "matches" and "merged" mean).
  */
+/** Human-readable thinking-level labels (auto is always the first option). */
+export const THINKING_LEVEL_LABELS = {
+    auto: "auto（跟随 Pi 默认等级）",
+    off: "off · 关闭",
+    minimal: "minimal · 极简",
+    low: "low · 低",
+    medium: "medium · 中",
+    high: "high · 高",
+    xhigh: "xhigh · 极高",
+    max: "max · 最高",
+};
+/**
+ * Group (and optionally filter) models by provider, preserving the provider
+ * order of first appearance and the model order within each provider.
+ * The query matches provider id, model id and display name (case-insensitive).
+ * Empty query returns all models grouped — never a fake "no models" list.
+ */
+export function groupModelsByProvider(models, query) {
+    const q = query.trim().toLowerCase();
+    const groups = new Map();
+    for (const model of models) {
+        if (q &&
+            !model.provider.toLowerCase().includes(q) &&
+            !model.id.toLowerCase().includes(q) &&
+            !(model.name ?? "").toLowerCase().includes(q)) {
+            continue;
+        }
+        const list = groups.get(model.provider) ?? [];
+        list.push(model);
+        groups.set(model.provider, list);
+    }
+    return [...groups.entries()].map(([provider, models]) => ({
+        provider,
+        models,
+    }));
+}
+/**
+ * Build the thinking menu options: `auto` is always the first option, followed
+ * by the runtime-supported levels in their canonical order. `effective` is the
+ * Pi actual thinking level (shown as a badge on the auto entry when provided).
+ */
+export function buildThinkingMenuOptions(levels, effective) {
+    const seen = new Set();
+    const options = [];
+    const push = (value) => {
+        if (seen.has(value))
+            return;
+        seen.add(value);
+        options.push({
+            value,
+            label: THINKING_LEVEL_LABELS[value] ?? value,
+            ...(value === "auto" && effective ? { effective } : {}),
+        });
+    };
+    push("auto");
+    for (const level of levels)
+        push(level);
+    return options;
+}
 /** Format a model reference for `<option value>` keys and equality checks. */
 export function formatModelRef(provider, modelId) {
     return `${provider}/${modelId}`;

package/dist/worker/console/chat/session-store.js

@@ -17,6 +17,23 @@ import { dispatchOperatorAction } from "../operator-actions.js";
 import { authorizeOperatorChatTool } from "./tools.js";
 import { projectOperationForChat } from "./chat-event-store.js";
 import { scrubSecrets } from "./explore-tools.js";
+const CHAT_TITLE_MAX_CHARS = 80;
+/** Safe, one-line bounded title used for placeholders and model output. */
+export function cleanChatTitle(value) {
+    const cleaned = value
+        .replace(/```[\s\S]*?```/g, " ")
+        .replace(/^\s*(?:title|标题)\s*[:：-]\s*/i, "")
+        .split(/\r?\n/, 1)[0]
+        .trim()
+        .replace(/^["'“”‘’`]+|["'“”‘’`]+$/g, "")
+        .replace(/[。.!！？?]+$/u, "")
+        .replace(/\s+/g, " ")
+        .slice(0, CHAT_TITLE_MAX_CHARS)
+        .trim();
+    return cleaned && /[\p{L}\p{N}\p{Script=Han}]/u.test(cleaned)
+        ? cleaned
+        : undefined;
+}
 function recordPath(appData, sessionId) {
     return path.join(appData.chats, `${sessionId}.json`);
 }
@@ -43,6 +60,7 @@ export class ChatSessionStore {
             repoRootDisplay: raw.repoRootDisplay ?? this.appData.repoRoot,
             state: raw.state === "archived" ? "archived" : "active",
             ...(typeof raw.title === "string" ? { title: raw.title } : {}),
+            ...(typeof raw.displayTitle === "string" ? { displayTitle: raw.displayTitle } : {}),
             ...(typeof raw.sessionFile === "string" ? { sessionFile: raw.sessionFile } : {}),
             createdAt: raw.createdAt ?? new Date(0).toISOString(),
             updatedAt: raw.updatedAt ?? raw.createdAt ?? new Date(0).toISOString(),
@@ -147,6 +165,21 @@ export class ChatSessionStore {
             return record;
         });
     }
+    /** Persist an automatic title only while the original record remains active and unnamed. */
+    async setAutomaticTitle(sessionId, title) {
+        const cleaned = cleanChatTitle(title);
+        if (!cleaned)
+            return undefined;
+        return this.serialize(sessionId, async () => {
+            const record = await this.get(sessionId);
+            if (!record || record.state !== "active" || record.title)
+                return undefined;
+            record.title = cleaned;
+            record.updatedAt = new Date().toISOString();
+            await writeSecureJson(recordPath(this.appData, sessionId), record);
+            return record;
+        });
+    }
     async setRuntimeSelection(sessionId, selection) {
         return this.serialize(sessionId, async () => {
             const record = await this.get(sessionId);
@@ -194,6 +227,9 @@ export class ChatSessionStore {
                 at: new Date().toISOString(),
             };
             record.messages.push(stored);
+            if (stored.role === "user" && !record.displayTitle) {
+                record.displayTitle = cleanChatTitle(stored.text);
+            }
             record.updatedAt = stored.at;
             await writeSecureJson(recordPath(this.appData, sessionId), record);
             return stored;
@@ -305,6 +341,9 @@ export async function runChatTurn(options) {
         };
     }
     await store.appendMessage(sessionId, { role: "user", text });
+    const afterUserMessage = await store.get(sessionId);
+    if (afterUserMessage)
+        await options.onUserMessagePersisted?.(afterUserMessage);
     let turnError;
     // Collect persistence promises so runChatTurn does not resolve before the
     // chat history / audit trail is durably written (also makes the outcome

package/dist/worker/console/chat/shortcuts.js

@@ -3,6 +3,7 @@ export const SHORTCUTS = [
     { command: "/contract", label: "Contract", description: "查看 contract diff 与 apply gate", action: "focus-panel:contract" },
     { command: "/dag", label: "DAG", description: "查看 DAG spine、确认与运行状态", action: "focus-panel:dag" },
     { command: "/interview", label: "Interview", description: "打开 Requirement Interview", action: "focus:interview" },
+    { command: "/reload", label: "Reload session", description: "重新加载当前 Pi 会话的设置、扩展、技能、提示词、主题与上下文文件（不产生消息）", action: "reload" },
     { command: "/help", label: "Shortcuts", description: "显示可用 shortcut", action: "show-help" },
 ];
 /** Pure navigation/display resolver. It deliberately has no mutation decisions. */

package/dist/worker/console/chat/tool-adapter.js

@@ -9,10 +9,12 @@
  *
  * High-risk / long-running actions ARE mapped as tools (2026-07-25 widening),
  * but the registry now declares their modelCallable policy:
- *   - "always": model can invoke; dispatch runs server-side.
+ *   - "always": model can invoke; dispatch runs server-side (2026-08-11:
+ *     runDag/dagRerun/standaloneTaskRerun/workerTaskRetry are autonomous —
+ *     runDag consumes a server-issued single-use execution receipt, and the
+ *     recovery actions pass server-side read-only run-facts checks).
  *   - "prepare-only": model can invoke but the mutation needs a human-origin
- *     confirmation (e.g. runDag needs a confirmationId consumed by a human
- *     confirm via the browser mutation gate — M0-B).
+ *     confirmation (Night Scheduler mutation-gate faces).
  *   - "never": the action is the human confirmation itself (confirmDagConfirmation)
  *     and MUST NOT appear as a model-callable tool (M0-B / roadmap G03).
  *
@@ -30,6 +32,10 @@ import { buildOperatorCapabilitiesDocument } from "../../../shared/operator/capa
  * prepare helpers (prepareDagConfirmation / prepareMutationGate); the browser
  * mutation gate + HMAC token perform the consuming dispatch.
  *
+ * 2026-08-11: runDag / dagRerun / standaloneTaskRerun / workerTaskRetry are no
+ * longer gate-only (autonomous execution + run-facts checks) and drop out of
+ * this derived list automatically.
+ *
  * `contractApply` is also gate-only even though its registry face remains
  * `humanConfirmation: "conditional"` (assessment soft-gate for workspace UI);
  * Chat executes it only via the contract-apply Human Gate route.

package/dist/worker/console/chat/tools.js

@@ -4,10 +4,14 @@
  * Operator Chat registers and activates full Pi builtins
  * (read/write/edit/bash/grep/find/ls) plus model-callable operator actions and
  * optional safe-* explore custom tools. Discipline is primarily soft
- * (system prompt: prefer DAG / Human Gate). Hard denies remain for non-Pi
+ * (system prompt: prefer DAG paths). Hard denies remain for non-Pi
  * write channels (apply_patch / full-tools / shell / coding-chat) and for
  * modelCallable="never" actions (e.g. confirmDagConfirmation).
  *
+ * 2026-08-11: runDag / dagRerun / standaloneTaskRerun / workerTaskRetry are
+ * model-callable (autonomous DAG execution); the browser Human Gate still
+ * covers Night Scheduler mutations, contractApply and confirmDagConfirmation.
+ *
  * Interview / Official surfaces keep their own OFFICIAL_DENIED path; this
  * module only filters Chat-side denial so Interview is not widened.
  */

package/dist/worker/console/dag-execution-receipt.js

@@ -0,0 +1,380 @@
+/**
+ * DAG execution receipt — session-bound, TTL, single-use autonomous DAG
+ * execution (2026-08-11 design §5 / §8.3).
+ *
+ * `prepareDagExecution` issues an execution receipt ONLY when the server-side
+ * G2 autonomous-execution assessment passes (bounded writeSet ⊆ allowedPaths,
+ * no forbidden overlap, no broad/destructive risk, structured verification
+ * present, valid bindings). The receipt carries no human-gate token — the
+ * browser Human Gate is not part of this flow.
+ *
+ * `runDag` consumes the receipt exactly once. Consumption re-reads the staged
+ * DAG bytes/hash and re-validates every binding (dag hash, source binding,
+ * task contract binding, controller fingerprint, validation result); any
+ * expiry, cross-session use, replay, or drift fails closed. Error codes reuse
+ * the existing confirmation lifecycle codes (CONFIRMATION_* /
+ * HUMAN_CONFIRMATION_REQUIRED / NOT_FOUND) because registry error codes are
+ * immutable in this task.
+ */
+import { randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { pathMatchesPattern } from "../../shared/git-progress.js";
+import { readJsonIfExists, sha256Utf8, writeSecureJson, } from "./app-data.js";
+import { hashDagBytes, } from "./dag-confirmation.js";
+export const DEFAULT_EXECUTION_RECEIPT_TTL_MS = 30 * 60 * 1000;
+function normalizePathEntry(entry) {
+    return entry.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function isBroadWriteSetEntry(entry) {
+    const normalized = normalizePathEntry(entry);
+    if (!normalized || normalized === "." || normalized === "./")
+        return true;
+    if (normalized === "**")
+        return true;
+    // Placeholder marker (`REPLACE/WITH`) means the writeSet is not concrete yet.
+    return normalized.includes("REPLACE/WITH");
+}
+function isContainedInAllowed(candidate, allowedPaths) {
+    const normalized = normalizePathEntry(candidate);
+    if (!normalized)
+        return false;
+    return allowedPaths.some((allowed) => {
+        const pattern = normalizePathEntry(allowed);
+        if (!pattern || pattern === "." || pattern === "./")
+            return false;
+        return pathMatchesPattern(normalized, pattern);
+    });
+}
+function overlapsForbidden(candidate, forbiddenPaths) {
+    const normalized = normalizePathEntry(candidate);
+    if (!normalized)
+        return true;
+    return forbiddenPaths.some((forbidden) => {
+        const pattern = normalizePathEntry(forbidden);
+        if (!pattern)
+            return false;
+        return (pathMatchesPattern(normalized, pattern) ||
+            pathMatchesPattern(pattern, normalized));
+    });
+}
+/**
+ * G2 deterministic autonomous-execution assessment (design §5.2). Pure and
+ * exported so the dispatcher and unit tests share the exact same code path.
+ * Every condition must pass — any missing fact fails closed.
+ */
+export function assessAutonomousExecutionEligibility(input) {
+    const dangerous = input.dangerousMarkers ?? {};
+    if (dangerous.credentials || dangerous.destructive || dangerous.irreversible) {
+        return {
+            ok: false,
+            reason: "DAG involves credentials, destructive operations, or irreversible migration; human authorization required",
+        };
+    }
+    if (!input.hasStructuredVerification) {
+        return {
+            ok: false,
+            reason: "DAG has no structured shell verification; autonomous execution not permitted",
+        };
+    }
+    if (input.broadWriteSetRisk) {
+        return {
+            ok: false,
+            reason: "writeSet contains broad/placeholder entries; autonomous execution not permitted",
+        };
+    }
+    if (input.forbiddenOverlapRisk) {
+        return {
+            ok: false,
+            reason: "writeSet overlaps forbidden paths; autonomous execution not permitted",
+        };
+    }
+    if (!Array.isArray(input.allowedPaths) || !Array.isArray(input.forbiddenPaths)) {
+        return {
+            ok: false,
+            reason: "task boundary (allowedPaths/forbiddenPaths) unavailable; autonomous execution not permitted",
+        };
+    }
+    for (const writer of input.writersWriteSets ?? []) {
+        if (!Array.isArray(writer.writeSet))
+            continue;
+        for (const entry of writer.writeSet) {
+            if (!isContainedInAllowed(entry, input.allowedPaths)) {
+                return {
+                    ok: false,
+                    reason: `writer ${writer.nodeId} writeSet entry "${entry}" is outside allowedPaths`,
+                };
+            }
+            if (overlapsForbidden(entry, input.forbiddenPaths)) {
+                return {
+                    ok: false,
+                    reason: `writer ${writer.nodeId} writeSet entry "${entry}" overlaps forbiddenPaths`,
+                };
+            }
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Extract the deterministic G2 facts from a generated DAG spec (staged bytes).
+ * Mirrors the CLI review-packet semantics (generate-task-dag.ts) so the
+ * console never trusts client-supplied claims. Missing facts fail closed.
+ */
+export function deriveEligibilityFactsFromDagSpec(input) {
+    const spec = (input.dagSpec ?? {});
+    const tasks = Array.isArray(spec.tasks) ? spec.tasks : [];
+    const defaultWritePolicy = spec.defaults?.writePolicy;
+    const resolvePolicy = (task) => task.writePolicy ?? defaultWritePolicy ?? "none";
+    const stringList = (value) => Array.isArray(value)
+        ? value.filter((v) => typeof v === "string")
+        : [];
+    const writers = tasks
+        .filter((task) => resolvePolicy(task) === "exclusive" &&
+        stringList(task.writeSet).length > 0)
+        .map((task) => ({
+        nodeId: task.id ?? "unknown",
+        writeSet: stringList(task.writeSet),
+    }));
+    const allWriteSetEntries = writers.flatMap((writer) => writer.writeSet);
+    const broadWriteSetRisk = allWriteSetEntries.some(isBroadWriteSetEntry);
+    const forbiddenOverlapRisk = tasks.some((task) => stringList(task.writeSet).some((entry) => [...stringList(task.forbiddenPaths), ...input.forbiddenPaths].some((forbidden) => pathMatchesPattern(entry, forbidden) ||
+        pathMatchesPattern(forbidden, entry))));
+    const hasStructuredVerification = tasks.some((task) => {
+        if (task.executor !== "shell" || !task.shell)
+            return false;
+        if (/verify|verification/i.test(task.id ?? ""))
+            return true;
+        const commands = stringList(task.shell.commands);
+        return commands.some((command) => /(vitest|npm run (lint|typecheck|test)|check-repo\.sh|loop-agent-standard-verify)/.test(command));
+    });
+    return {
+        writersWriteSets: writers,
+        allowedPaths: input.allowedPaths,
+        forbiddenPaths: input.forbiddenPaths,
+        broadWriteSetRisk,
+        forbiddenOverlapRisk,
+        hasStructuredVerification,
+    };
+}
+function receiptPath(appData, executionId) {
+    const dir = appData.dagReceipts ??
+        path.join(path.dirname(appData.confirmations), "dag-receipts");
+    return path.join(dir, `${executionId}.json`);
+}
+export function newExecutionId() {
+    return `exec_${randomBytes(12).toString("hex")}`;
+}
+export class DagExecutionReceiptStore {
+    appData;
+    constructor(appData) {
+        this.appData = appData;
+    }
+    async get(executionId) {
+        const rec = await readJsonIfExists(receiptPath(this.appData, executionId));
+        if (!rec)
+            return undefined;
+        return this.materializeExpiry(rec);
+    }
+    async materializeExpiry(rec, now = Date.now()) {
+        if (rec.state === "prepared" && Date.parse(rec.expiresAt) <= now) {
+            const expired = {
+                ...rec,
+                state: "expired",
+                staleReason: rec.staleReason ?? "ttl exceeded (30min default)",
+            };
+            await writeSecureJson(receiptPath(this.appData, rec.executionId), expired);
+            return expired;
+        }
+        return rec;
+    }
+    /**
+     * Issue a single-use execution receipt. G2 eligibility is re-checked here
+     * (fail closed) in addition to the dispatcher's pre-check.
+     */
+    async prepare(input) {
+        const assessment = assessAutonomousExecutionEligibility(input.eligibility);
+        if (!assessment.ok) {
+            return {
+                ok: false,
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                reason: assessment.reason,
+            };
+        }
+        if (!input.dagBytes ||
+            !input.dagBytesPath ||
+            !input.sourceBindingSha256 ||
+            !input.controllerFingerprint ||
+            !input.validationResultSha256 ||
+            !input.taskContractBinding?.taskId) {
+            return {
+                ok: false,
+                code: "INVALID_INPUT",
+                reason: "missing server-derived DAG/binding facts for execution receipt",
+            };
+        }
+        const now = input.now ?? new Date();
+        const ttl = input.ttlMs ?? DEFAULT_EXECUTION_RECEIPT_TTL_MS;
+        const executionId = newExecutionId();
+        const rec = {
+            schemaVersion: 1,
+            executionId,
+            state: "prepared",
+            preparedAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + ttl).toISOString(),
+            operatorSessionId: input.operatorSessionId,
+            taskId: input.taskId,
+            dagHandle: input.dagHandle,
+            dagSha256: hashDagBytes(input.dagBytes),
+            dagBytesPath: input.dagBytesPath,
+            sourceBindingSha256: input.sourceBindingSha256,
+            taskContractBinding: input.taskContractBinding,
+            controllerFingerprint: input.controllerFingerprint,
+            validationResultSha256: input.validationResultSha256,
+            reviewPacket: input.reviewPacket,
+        };
+        await writeSecureJson(receiptPath(this.appData, executionId), rec);
+        return { ok: true, receipt: rec };
+    }
+    /**
+     * Atomic single-use consume for runDag. Re-reads the staged DAG bytes and
+     * re-validates every binding; any drift/expiry/session/replay fails closed.
+     */
+    async consume(input) {
+        const rec = await this.get(input.executionId);
+        if (!rec) {
+            return {
+                ok: false,
+                code: "NOT_FOUND",
+                message: `execution receipt not found: ${input.executionId}`,
+            };
+        }
+        if (rec.state === "expired") {
+            return {
+                ok: false,
+                code: "CONFIRMATION_EXPIRED",
+                message: "execution receipt expired",
+                receipt: rec,
+            };
+        }
+        if (rec.state === "consumed") {
+            return {
+                ok: false,
+                code: "CONFIRMATION_CONSUMED",
+                message: "execution receipt already consumed (single-use)",
+                receipt: rec,
+            };
+        }
+        if (rec.state === "stale") {
+            return {
+                ok: false,
+                code: "CONFIRMATION_STALE",
+                message: rec.staleReason ?? "execution receipt is stale",
+                receipt: rec,
+            };
+        }
+        if (rec.state !== "prepared") {
+            return {
+                ok: false,
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: `execution receipt is ${rec.state}; re-prepare required`,
+                receipt: rec,
+            };
+        }
+        if (rec.operatorSessionId !== input.operatorSessionId) {
+            return {
+                ok: false,
+                code: "HUMAN_CONFIRMATION_REQUIRED",
+                message: "session mismatch; execution receipt cannot be consumed across operator sessions",
+                receipt: rec,
+            };
+        }
+        // Re-read staged DAG bytes and re-hash (fail closed on any drift).
+        let dagBytes;
+        try {
+            dagBytes = await readFile(rec.dagBytesPath, "utf8");
+        }
+        catch (error) {
+            const stale = await this.markStale(rec.executionId, `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`);
+            return {
+                ok: false,
+                code: "CONFIRMATION_STALE",
+                message: "cannot re-read staged DAG bytes",
+                receipt: stale,
+            };
+        }
+        const dagSha256 = hashDagBytes(dagBytes);
+        if (dagSha256 !== rec.dagSha256) {
+            const stale = await this.markStale(rec.executionId, "staged DAG bytes drift (hash mismatch on consume)");
+            return {
+                ok: false,
+                code: "CONFIRMATION_STALE",
+                message: "staged DAG bytes drift (hash mismatch on consume)",
+                receipt: stale,
+            };
+        }
+        const drift = detectReceiptBindingDrift(rec, {
+            sourceBindingSha256: input.sourceBindingSha256,
+            taskContractBinding: input.taskContractBinding,
+            controllerFingerprint: input.controllerFingerprint,
+            validationResultSha256: input.validationResultSha256,
+        });
+        if (drift) {
+            const stale = await this.markStale(rec.executionId, drift);
+            return {
+                ok: false,
+                code: "CONFIRMATION_STALE",
+                message: drift,
+                receipt: stale,
+            };
+        }
+        const now = input.now ?? new Date();
+        const consumed = {
+            ...rec,
+            state: "consumed",
+            consumedAt: now.toISOString(),
+        };
+        await writeSecureJson(receiptPath(this.appData, rec.executionId), consumed);
+        return { ok: true, receipt: consumed };
+    }
+    /** Record the operation id that consumed this receipt (post-accept). */
+    async markDispatched(executionId, operationId) {
+        const rec = await this.get(executionId);
+        if (!rec || rec.state !== "consumed")
+            return rec;
+        const dispatched = {
+            ...rec,
+            consumedOperationId: operationId,
+        };
+        await writeSecureJson(receiptPath(this.appData, executionId), dispatched);
+        return dispatched;
+    }
+    async markStale(executionId, reason) {
+        const rec = await this.get(executionId);
+        if (!rec) {
+            throw new Error(`execution receipt not found: ${executionId}`);
+        }
+        const stale = {
+            ...rec,
+            state: "stale",
+            staleReason: reason,
+        };
+        await writeSecureJson(receiptPath(this.appData, executionId), stale);
+        return stale;
+    }
+}
+function detectReceiptBindingDrift(rec, current) {
+    if (current.sourceBindingSha256 !== rec.sourceBindingSha256) {
+        return "sourceBindingSha256 binding drift";
+    }
+    if (current.controllerFingerprint !== rec.controllerFingerprint) {
+        return "controllerFingerprint binding drift";
+    }
+    if (current.validationResultSha256 !== rec.validationResultSha256) {
+        return "validationResultSha256 binding drift";
+    }
+    const a = sha256Utf8(JSON.stringify(rec.taskContractBinding));
+    const b = sha256Utf8(JSON.stringify(current.taskContractBinding));
+    if (a !== b)
+        return "taskContractBinding drift";
+    return undefined;
+}