@thebackstoryis/engineering-with-ai 0.2.9 → 0.3.0-beta.2

package/src/runtime/afk-conductor.mjs

@@ -26,6 +26,9 @@ const moduleDir = dirname(fileURLToPath(import.meta.url));
 const workerPath = resolve(moduleDir, '../afk-worker.mjs');
 const runSchema = 'ewai.afk-run/v1';
 const terminalStates = new Set(['completed', 'cancelled']);
+const runningControls = new Map();
+const authorityChecks = new WeakMap();
+const controlKey = (root, id) => `${resolve(root)}:${id}`;
 
 function git(root, args, options = {}) {
   return execFileSync('git', args, {
@@ -68,12 +71,13 @@ function requireRun(projectRoot, runId) {
   return { paths, run };
 }
 
-function saveRun(paths, run) {
+function saveRun(paths, run, resumeFrom = null) {
   if (existsSync(paths.runPath)) {
     const current = JSON.parse(readFileSync(paths.runPath, 'utf8'));
-    if (current.id === run.id && current.desiredState !== 'running' && run.desiredState === 'running') {
+    if (resumeFrom !== null && JSON.stringify(current) !== resumeFrom) throw new Error('AFK control changed before resume; refresh its current state.');
+    if (resumeFrom === null && current.id === run.id && current.desiredState !== 'running' && run.desiredState === 'running') {
       run.desiredState = current.desiredState;
-      if (current.desiredState === 'cancelled') run.status = 'cancelled';
+      if (current.desiredState === 'cancelled') run.status = 'cancel-requested';
     }
   }
   run.updatedAt = now();
@@ -321,6 +325,15 @@ function spawnWorker(projectRoot, runId) {
 }
 
 export function startAfkRun(projectRoot, slug, options = {}) {
+  if (options.autonomy !== undefined) {
+    const value = options.autonomy;
+    if (!value || Object.getPrototypeOf(value) !== Object.prototype || Object.keys(value).length !== 2
+      || !/^[a-f0-9-]{36}$/.test(value.runId ?? '') || !/^sha256:[a-f0-9]{64}$/.test(value.grantDigest ?? '')
+      || options.foreground !== true || typeof options.dependencies?.authority !== 'function') {
+      throw new Error('Autonomous AFK requires its bounded foreground authority context.');
+    }
+    options.dependencies.authority({ stage: 'prepare', mode: 'command' });
+  }
   const root = resolve(projectRoot);
   const lockParent = resolve(root, '.ewai-pipeline/afk/locks');
   const lockPath = resolve(lockParent, `${slug}.lock`);
@@ -335,6 +348,7 @@ export function startAfkRun(projectRoot, slug, options = {}) {
     if (preflight.status !== 'ready') throw new Error(`AFK preflight blocked: ${preflight.failures.join(' ')}`);
     const indexed = syncIntentIndex(preflight.projectRoot).intents.find((intent) => intent.slug === slug);
     if (!indexed) throw new Error(`Unknown intent slug: ${slug}`);
+    options.dependencies?.authority?.({ stage: 'prepare', mode: 'command' });
     prepareParentBranches(preflight.topology);
     const runId = randomUUID();
     const paths = pathsFor(preflight.projectRoot, runId);
@@ -359,8 +373,11 @@ export function startAfkRun(projectRoot, slug, options = {}) {
       activeWorkers: [],
       tasks: {},
       messages: [],
+      executionStopped: true,
+      ...(options.autonomy ? { autonomy: { ...options.autonomy } } : {}),
     };
     saveRun(paths, run);
+    options.dependencies?.onRun?.(run);
     event(preflight.projectRoot, run, 'Preparing unattended Build execution.', `${preflight.readyTasks.length} task(s) ready; maximum parallelism ${run.maxParallel}.`);
     if (options.foreground === true) return executeAfkRun(preflight.projectRoot, runId, options.dependencies);
     run.pid = spawnWorker(preflight.projectRoot, runId);
@@ -396,29 +413,28 @@ export function pauseAfkRun(projectRoot, runId) {
   return saveRun(paths, run);
 }
 
-function stopWorkers(run) {
-  for (const worker of run.activeWorkers ?? []) {
-    if (processAlive(worker.pid)) {
-      try { process.kill(worker.pid, 'SIGTERM'); } catch { /* already gone */ }
-    }
-  }
-}
-
 export function cancelAfkRun(projectRoot, runId) {
   const { paths, run } = requireRun(projectRoot, runId);
   if (terminalStates.has(run.status)) return run;
   run.desiredState = 'cancelled';
-  run.status = 'cancelled';
-  stopWorkers(run);
-  abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-cancelled' });
-  run.activeWorkers = [];
-  event(paths.projectRoot, run, 'Unattended Build execution cancelled.', 'Active task leases were safely abandoned.', 'blocked');
-  return saveRun(paths, run);
+  run.status = processAlive(run.pid) ? 'cancel-requested' : 'cancel-unknown';
+  run.cancellation = { status: run.status === 'cancel-requested' ? 'requested' : 'unknown', requestedAt: now() };
+  // Only the process that owns the child handle may signal it. Another local
+  // caller persists the request for that owner's bounded control poll.
+  const saved = saveRun(paths, run);
+  for (const controller of runningControls.get(controlKey(projectRoot, runId)) ?? []) controller.abort();
+  event(paths.projectRoot, run, 'Unattended Build cancellation requested.', 'Termination is not yet confirmed; work and leases are retained.', 'blocked');
+  return saved;
 }
 
-export function resumeAfkRun(projectRoot, runId) {
+export function resumeAfkRun(projectRoot, runId, options = {}) {
   const { paths, run } = requireRun(projectRoot, runId);
+  const resumeFrom = JSON.stringify(run);
   if (run.status === 'completed' || run.status === 'cancelled') throw new Error(`AFK run is ${run.status} and cannot resume.`);
+  if (run.desiredState === 'cancelled' || run.executionStopped !== true) throw new Error('AFK execution needs a verified recovery decision before resuming.');
+  if (run.autonomy && (run.status !== 'paused' || run.activeWorkers?.length || options.foreground !== true
+    || options.autonomy?.runId !== run.autonomy.runId || options.autonomy?.grantDigest !== run.autonomy.grantDigest
+    || typeof options.dependencies?.authority !== 'function')) throw new Error('Autonomous AFK resume requires the same bounded foreground authority context.');
   if (processAlive(run.pid)) throw new Error('AFK conductor is already running.');
   const preflight = preflightAfkRun(paths.projectRoot, run.slug, {
     provider: run.providers.join(','),
@@ -426,12 +442,19 @@ export function resumeAfkRun(projectRoot, runId) {
     ignoreRunId: run.id,
   });
   if (preflight.status !== 'ready') throw new Error(`AFK recovery preflight blocked: ${preflight.failures.join(' ')}`);
-  stopWorkers(run);
-  abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-recovered' });
+  if (run.autonomy) options.dependencies.authority({ stage: 'prepare', mode: 'command' });
+  else abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-recovered' });
   run.desiredState = 'running';
   run.status = 'running';
   run.topology = preflight.topology;
   run.activeWorkers = [];
+  if (run.autonomy) {
+    run.timeoutMs = Math.min(run.timeoutMs, options.timeoutMs);
+    if (!Number.isFinite(run.timeoutMs) || run.timeoutMs < 1) throw new Error('Autonomous AFK resume requires a bounded timeout.');
+    run.pid = null; saveRun(paths, run, resumeFrom); options.dependencies.onRun?.(run);
+    return executeAfkRun(paths.projectRoot, run.id, options.dependencies);
+  }
+  run.pid = null; saveRun(paths, run, resumeFrom);
   run.pid = spawnWorker(paths.projectRoot, run.id);
   event(paths.projectRoot, run, 'Recovering unattended Build execution.', 'Abandoned leases were released; task evidence will be revalidated before continuing.');
   return saveRun(paths, run);
@@ -596,20 +619,52 @@ function taskState(run, task, update = {}) {
   run.tasks[task.id] = { ...(run.tasks[task.id] ?? {}), id: task.id, ...update, updatedAt: now() };
 }
 
-function executeCommand(command, cwd, outputPath, timeoutMs) {
-  let exitCode = 0;
-  let output = '';
+async function invokeControlled(projectRoot, run, task, invocation, invoke = invokeProvider) {
+  const paths = pathsFor(projectRoot, run.id), controller = new AbortController();
+  const key = controlKey(projectRoot, run.id), controls = runningControls.get(key) ?? new Set();
+  controls.add(controller); runningControls.set(key, controls);
+  let authorityError = null;
+  const guard = () => {
+    try {
+      if (requireRun(projectRoot, run.id).run.desiredState === 'cancelled') controller.abort();
+      authorityChecks.get(run)?.({ stage: 'check', mode: invocation.mode ?? 'command' });
+    }
+    catch (error) { authorityError = error; controller.abort(); }
+  };
+  let timer;
   try {
-    output = execFileSync('/bin/sh', ['-lc', command], {
-      cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: timeoutMs,
-    });
+    guard();
+    if (authorityError) throw authorityError;
+    authorityChecks.get(run)?.({ stage: 'dispatch', mode: invocation.mode ?? 'command' });
+    // Persist uncertainty before the launch. A dead conductor must not leave
+    // an old true flag that lets resume abandon a still-running worker's lease.
+    run.executionStopped = false;
+    saveRun(paths, run);
+    timer = setInterval(guard, 50);
+    const result = await invoke(invocation, { signal: controller.signal, onStart(pid) {
+      taskState(run, task, { pid });
+      run.activeWorkers = [...(run.activeWorkers ?? []).filter(worker => worker.taskId !== task.id), { taskId: task.id, pid }];
+      saveRun(paths, run);
+    } });
+    guard();
+    if (result.executionStopped === true) run.activeWorkers = (run.activeWorkers ?? []).filter(worker => worker.taskId !== task.id);
+    else run.unconfirmedExecution = true;
+    if (authorityError) throw authorityError;
+    if (run.unconfirmedExecution) throw new Error('AFK execution is not confirmed stopped; recovery is required.');
+    run.executionStopped = (run.activeWorkers ?? []).length === 0;
+    saveRun(paths, run);
+    return result;
   } catch (error) {
-    exitCode = Number(error.status ?? 1);
-    output = `${error.stdout ?? ''}${error.stderr ?? ''}`;
-  }
-  mkdirSync(dirname(outputPath), { recursive: true });
-  writeFileSync(outputPath, output, 'utf8');
-  return { command, exitCode, outputPath };
+    if ((run.activeWorkers ?? []).some(worker => worker.taskId === task.id)) run.unconfirmedExecution = true;
+    throw error;
+  } finally { clearInterval(timer); controls.delete(controller); if (!controls.size) runningControls.delete(key); }
+}
+
+async function executeCommand(command, cwd, outputPath, timeoutMs, projectRoot, run, task) {
+  const result = await invokeControlled(projectRoot, run, task, { provider: 'command', command: '/bin/sh',
+    args: ['-lc', command], cwd, prompt: '', timeoutMs, logPath: outputPath });
+  if (result.cancelled || result.timedOut || requireRun(projectRoot, run.id).run.desiredState === 'cancelled') throw new Error('AFK command stopped before completion.');
+  return { command, exitCode: result.exitCode, outputPath };
 }
 
 function writeTaskEvidence(projectRoot, run, result, postMerge) {
@@ -695,6 +750,7 @@ No declared stop condition occurred.
 Automated task and integration evidence passed. Human QA remains governed by the later EWAI delivery gate.
 `;
   writeFileSync(reportPath, report, 'utf8');
+  return [reportPath, evidencePath, reviewPath, ...commands.map(command => resolve(delivery.deliveryRoot, command.output_path))];
 }
 
 async function implementTask(projectRoot, run, task, provider, dependencies = {}) {
@@ -720,14 +776,15 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
     });
     saveRun(paths, run);
     event(projectRoot, run, `Preparing isolated worktree for ${task.id}.`, task.name);
+    authorityChecks.get(run)?.({ stage: 'worktree', mode: 'command' });
     mkdirSync(dirname(worktree), { recursive: true });
     git(repository.root, ['worktree', 'add', '-b', actualBranch, worktree, repository.parentBranch]);
     const baseHead = git(worktree, ['rev-parse', 'HEAD']);
-    const red = executeCommand(
+    const red = await executeCommand(
       task.red_green_refactor.red_command,
       worktree,
       resolve(logRoot, 'red.txt'),
-      run.timeoutMs,
+      run.timeoutMs, projectRoot, run, task,
     );
     red.stage = 'red';
     if (red.exitCode === 0) throw new Error(`${task.id} red command already passes; the task contract is stale and must be reconciled.`);
@@ -742,14 +799,7 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
       mode: 'implementation',
     });
     invocation.logPath = resolve(logRoot, 'implementation.log');
-    const result = await invoke(invocation, {
-      onStart(pid) {
-        taskState(run, task, { pid });
-        run.activeWorkers = [...(run.activeWorkers ?? []).filter((item) => item.taskId !== task.id), { taskId: task.id, pid }];
-        saveRun(paths, run);
-      },
-    });
-    run.activeWorkers = (run.activeWorkers ?? []).filter((item) => item.taskId !== task.id);
+    const result = await invokeControlled(projectRoot, run, task, invocation, invoke);
     if (requireRun(projectRoot, run.id).run.desiredState === 'cancelled') {
       throw new Error('AFK run was cancelled while the task agent was active.');
     }
@@ -762,19 +812,19 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
       token: lease.token,
       durationMs: Math.min(86_400_000, run.timeoutMs + 10 * 60 * 1000),
     });
-    const green = executeCommand(
+    const green = await executeCommand(
       task.red_green_refactor.green_command,
       worktree,
       resolve(logRoot, 'green.txt'),
-      run.timeoutMs,
+      run.timeoutMs, projectRoot, run, task,
     );
     green.stage = 'green';
     if (green.exitCode !== 0) throw new Error(`${task.id} green command failed after implementation.`);
-    const refactor = executeCommand(
+    const refactor = await executeCommand(
       task.red_green_refactor.green_command,
       worktree,
       resolve(logRoot, 'refactor.txt'),
-      run.timeoutMs,
+      run.timeoutMs, projectRoot, run, task,
     );
     refactor.stage = 'refactor';
     if (refactor.exitCode !== 0) throw new Error(`${task.id} refactor verification failed.`);
@@ -785,7 +835,8 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
     taskState(run, task, { status: 'checking-scope', changedFiles: changed });
     saveRun(paths, run);
     event(projectRoot, run, `Checking implementation scope for ${task.id}.`, `${changed.length} changed path(s) in ${repository.name}.`);
-    git(worktree, ['add', '-A']);
+    authorityChecks.get(run)?.({ stage: 'accept', mode: 'implementation' });
+    git(worktree, ['add', '--', ...changed]);
     git(worktree, ['commit', '-m', `feat(${run.slug}): implement ${task.id}`]);
     const implementationCommit = git(worktree, ['rev-parse', 'HEAD']);
 
@@ -798,20 +849,17 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
       mode: 'review',
     });
     reviewInvocation.logPath = resolve(logRoot, 'review.log');
-    const review = await invoke(reviewInvocation, {
-      onStart(pid) {
-        taskState(run, task, { pid, status: 'reviewing' });
-        run.activeWorkers = [{ taskId: task.id, pid }];
-        saveRun(paths, run);
-      },
-    });
-    run.activeWorkers = [];
+    const review = await invokeControlled(projectRoot, run, task, reviewInvocation, invoke);
     if (requireRun(projectRoot, run.id).run.desiredState === 'cancelled') {
       throw new Error('AFK run was cancelled during fresh-context review.');
     }
     if (review.timedOut || review.exitCode !== 0 || !/^VERDICT:\s*PASS\s*$/im.test(review.output)) {
       throw new Error(`Fresh-context review did not pass; see ${relative(projectRoot, review.logPath)}.`);
     }
+    authorityChecks.get(run)?.({ stage: 'accept', mode: 'review' });
+    if (git(worktree, ['rev-parse', 'HEAD']) !== implementationCommit || gitDirty(worktree)) {
+      throw new Error('Fresh-context review changed the inspected implementation.');
+    }
     heartbeatExecutionLease(projectRoot, lease.id, {
       token: lease.token,
       durationMs: Math.min(86_400_000, run.timeoutMs + 10 * 60 * 1000),
@@ -830,18 +878,19 @@ async function implementTask(projectRoot, run, task, provider, dependencies = {}
     if (control.desiredState === 'cancelled') {
       return { task, cancelled: true, error };
     }
-    if (lease) {
+    if (lease && !run.unconfirmedExecution) {
       try { releaseExecutionLease(projectRoot, lease.id, { token: lease.token, outcome: 'blocked' }); } catch { /* recovery handles it */ }
     }
     taskState(run, task, { status: 'blocked', error: error.message });
-    run.activeWorkers = (run.activeWorkers ?? []).filter((item) => item.taskId !== task.id);
+    if (!run.unconfirmedExecution) run.activeWorkers = (run.activeWorkers ?? []).filter((item) => item.taskId !== task.id);
     saveRun(paths, run);
     event(projectRoot, run, `${task.id} needs attention.`, error.message, 'blocked', true);
     return { task, error };
   }
 }
 
-function integrateTask(projectRoot, run, result) {
+async function integrateTask(projectRoot, run, result) {
+  authorityChecks.get(run)?.({ stage: 'integrate', mode: 'command' });
   const { task, lease } = result;
   const repository = result.repository;
   const specsRepository = run.topology.repositories.find((candidate) => candidate.name === run.topology.specsRepository);
@@ -858,7 +907,24 @@ function integrateTask(projectRoot, run, result) {
     rmSync(evidenceBackup, { recursive: true, force: true });
     cpSync(taskEvidenceRoot, evidenceBackup, { recursive: true });
   }
-  let codeCommitted = false;
+  let codeCommitted = false, integrationConflict = false, mergeStarted = false;
+  const baselines = new Map(), ownedEvidence = new Map();
+  const assertIntegrationState = (staged = false) => {
+    for (const [root, baseline] of baselines) {
+      const owned = path => ownedEvidence.has(resolve(root, path))
+        && sha256(readFileSync(resolve(root, path))) === ownedEvidence.get(resolve(root, path));
+      const stagedDelta = git(root, ['diff', '--cached', '--name-only', '-z', baseline.tree]).split('\0').filter(Boolean);
+      const workingDelta = git(root, ['diff', '--name-only', '-z']).split('\0').filter(Boolean);
+      const untracked = git(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean);
+      if (git(root, ['rev-parse', 'HEAD']) !== baseline.head || git(root, ['branch', '--show-current']) !== baseline.branch
+        || stagedDelta.some(path => !staged || !owned(path) || sha256(execFileSync('git', ['show', `:${path}`],
+          { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })) !== ownedEvidence.get(resolve(root, path)))
+        || [...workingDelta, ...untracked].some(path => !owned(path))) {
+        integrationConflict = true;
+        throw new Error('Repository changed outside the owned integration; preserve the checkout for review.');
+      }
+    }
+  };
   try {
     heartbeatExecutionLease(projectRoot, lease.id, {
       token: lease.token,
@@ -868,27 +934,61 @@ function integrateTask(projectRoot, run, result) {
     if (currentBranch !== repository.parentBranch) {
       throw new Error(`Repository ${repository.name} moved to ${currentBranch || '<detached>'}; expected ${repository.parentBranch}.`);
     }
+    for (const root of new Set([repository.root, specsRepository.root])) {
+      if (gitDirty(root)) { integrationConflict = true; throw new Error('Repository must still be clean before integration.'); }
+      baselines.set(root, { head: git(root, ['rev-parse', 'HEAD']), branch: git(root, ['branch', '--show-current']), tree: git(root, ['write-tree']) });
+    }
     git(repository.root, ['merge', '--no-ff', '--no-commit', result.actualBranch]);
+    mergeStarted = true;
+    baselines.get(repository.root).tree = git(repository.root, ['write-tree']);
     const postMerge = [];
     for (const [index, command] of (task.merge?.post_merge_checks ?? []).entries()) {
       const outputPath = resolve(delivery.deliveryRoot, 'tasks', task.id, 'evidence', `post-merge-${index + 1}.txt`);
-      const check = executeCommand(command, repository.root, outputPath, run.timeoutMs);
+      const check = await executeCommand(command, repository.root, outputPath, run.timeoutMs, projectRoot, run, task);
       const evidencePath = relative(delivery.deliveryRoot, outputPath).replaceAll('\\', '/');
       postMerge.push({ command, exit_code: check.exitCode, output_path: evidencePath, output_sha256: sha256(readFileSync(outputPath)) });
+      ownedEvidence.set(realpathSync(outputPath), postMerge.at(-1).output_sha256);
       if (check.exitCode !== 0) throw new Error(`Post-merge check failed: ${command}`);
     }
-    writeTaskEvidence(projectRoot, run, result, postMerge);
+    authorityChecks.get(run)?.({ stage: 'accept', mode: 'command' });
+    assertIntegrationState();
+    for (const path of writeTaskEvidence(projectRoot, run, result, postMerge)) ownedEvidence.set(realpathSync(path), sha256(readFileSync(path)));
     const validated = validateTaskReport(deliveryPaths(projectRoot, run.slug).deliveryRoot, task);
     if (validated.status !== 'complete') throw new Error(`Merged task evidence is invalid: ${validated.errors.join('; ')}`);
-    git(repository.root, ['add', '-A']);
+    assertIntegrationState();
+    const evidencePaths = [...ownedEvidence.keys()].map(path => relative(specsRepository.root, path));
+    git(specsRepository.root, ['add', '--', ...evidencePaths]);
+    assertIntegrationState(true);
+    const expectedTrees = new Map([...baselines.keys()].map(root => [root, git(root, ['write-tree'])]));
+    const taskCommit = git(repository.root, ['rev-parse', result.actualBranch]);
     git(repository.root, ['commit', '-m', `merge(${run.slug}): integrate ${task.id}`]);
     const codeMergeCommit = git(repository.root, ['rev-parse', 'HEAD']);
     codeCommitted = true;
     if (repository.root !== specsRepository.root) {
-      git(specsRepository.root, ['add', '-A']);
+      assertIntegrationStateForEvidence();
       git(specsRepository.root, ['commit', '-m', `docs(${run.slug}): record ${task.id} delivery evidence`]);
     }
+    function assertIntegrationStateForEvidence() {
+      const baseline = baselines.get(specsRepository.root);
+      if (git(specsRepository.root, ['rev-parse', 'HEAD']) !== baseline.head
+        || git(specsRepository.root, ['branch', '--show-current']) !== baseline.branch
+        || git(specsRepository.root, ['write-tree']) !== expectedTrees.get(specsRepository.root)
+        || git(specsRepository.root, ['diff', '--name-only']) || git(specsRepository.root, ['ls-files', '--others', '--exclude-standard'])) {
+        throw new Error('Evidence repository changed during owned integration; preserve it for review.');
+      }
+    }
     const evidenceCommit = git(specsRepository.root, ['rev-parse', 'HEAD']);
+    const transitions = [...baselines].map(([root, baseline]) => ({ root, before: baseline.head, branch: baseline.branch,
+      after: root === repository.root ? codeMergeCommit : evidenceCommit }));
+    for (const transition of transitions) {
+      if (git(transition.root, ['rev-parse', 'HEAD']) !== transition.after || git(transition.root, ['rev-parse', 'HEAD^1']) !== transition.before
+        || git(transition.root, ['rev-parse', 'HEAD^{tree}']) !== expectedTrees.get(transition.root)
+        || git(transition.root, ['branch', '--show-current']) !== transition.branch || gitDirty(transition.root)
+        || transition.root === repository.root && git(transition.root, ['rev-parse', 'HEAD^2']) !== taskCommit) {
+        throw new Error('Owned integration commit changed unexpectedly; preserve the checkout for review.');
+      }
+    }
+    authorityChecks.get(run)?.({ stage: 'integrated', mode: 'command', transitions });
     releaseExecutionLease(projectRoot, lease.id, { token: lease.token, outcome: 'completed' });
     taskState(run, task, {
       status: 'completed', mergeCommit: codeMergeCommit, evidenceCommit,
@@ -899,12 +999,13 @@ function integrateTask(projectRoot, run, result) {
     rmSync(evidenceBackup, { recursive: true, force: true });
     try { git(repository.root, ['worktree', 'remove', '--force', result.worktree]); } catch { /* retain for diagnosis */ }
   } catch (error) {
-    if (!codeCommitted) {
+    try { if (!codeCommitted) assertIntegrationState(true); } catch { integrationConflict = true; }
+    if (mergeStarted && !codeCommitted && !run.unconfirmedExecution && !integrationConflict) {
       try { git(repository.root, ['merge', '--abort']); } catch { /* no merge to abort */ }
       rmSync(taskEvidenceRoot, { recursive: true, force: true });
       if (hadTaskEvidence) cpSync(evidenceBackup, taskEvidenceRoot, { recursive: true });
     }
-    try { releaseExecutionLease(projectRoot, lease.id, { token: lease.token, outcome: 'blocked' }); } catch { /* recovery handles it */ }
+    if (!run.unconfirmedExecution) try { releaseExecutionLease(projectRoot, lease.id, { token: lease.token, outcome: 'blocked' }); } catch { /* recovery handles it */ }
     taskState(run, task, { status: 'blocked', error: error.message });
     saveRun(paths, run);
     event(projectRoot, run, `${task.id} integration blocked.`, error.message, 'blocked', true);
@@ -914,16 +1015,24 @@ function integrateTask(projectRoot, run, result) {
 
 export async function executeAfkRun(projectRoot, runId, dependencies = {}) {
   const { paths, run } = requireRun(projectRoot, runId);
+  if (run.desiredState !== 'running' && run.executionStopped === true && !(run.activeWorkers ?? []).length) {
+    run.status = run.desiredState === 'paused' ? 'paused' : 'cancelled'; run.pid = null;
+    if (run.desiredState === 'cancelled') run.cancellation = { ...run.cancellation, status: 'confirmed', settledAt: now() };
+    return saveRun(paths, run);
+  }
   run.pid = process.pid;
   run.status = 'running';
   saveRun(paths, run);
+  if (dependencies.authority) authorityChecks.set(run, dependencies.authority);
   try {
+    if (run.autonomy && !authorityChecks.has(run)) throw new Error('Autonomous AFK run requires its original live authority context.');
     while (run.desiredState === 'running') {
       const graph = readGraph(paths.projectRoot, run.slug);
       const check = validateTaskGraph(deliveryPaths(paths.projectRoot, run.slug).deliveryRoot, { slug: run.slug });
       if (check.status !== 'pass') throw new Error(`Task graph became invalid: ${check.errors.map((item) => item.message).join('; ')}`);
       if (check.completedTasks.length === graph.tasks.length) {
         run.status = 'completed';
+        run.executionStopped = !run.unconfirmedExecution;
         run.pid = null;
         event(paths.projectRoot, run, 'All AFK Build tasks are integrated.', 'EWAI Build remains open for its canonical phase gate and subsequent lifecycle stages.');
         return saveRun(paths, run);
@@ -939,9 +1048,14 @@ export async function executeAfkRun(projectRoot, runId, dependencies = {}) {
       const control = requireRun(paths.projectRoot, run.id).run;
       run.desiredState = control.desiredState;
       if (run.desiredState === 'cancelled') {
-        run.status = 'cancelled';
+        run.status = run.unconfirmedExecution ? 'cancel-unknown' : 'cancelled';
+        run.cancellation = { ...control.cancellation, status: run.unconfirmedExecution ? 'unknown' : 'confirmed', settledAt: now() };
+        run.executionStopped = !run.unconfirmedExecution;
         run.pid = null;
-        run.activeWorkers = [];
+        if (!run.unconfirmedExecution) {
+          abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-cancelled' });
+          run.activeWorkers = [];
+        }
         return saveRun(paths, run);
       }
       const failed = results.find((result) => result.error);
@@ -949,12 +1063,13 @@ export async function executeAfkRun(projectRoot, runId, dependencies = {}) {
       const order = waveDefinition?.merge_order ?? wave.map((task) => task.id);
       for (const id of order) {
         const result = results.find((candidate) => candidate.task.id === id);
-        if (result) integrateTask(paths.projectRoot, run, result);
+        if (result) await integrateTask(paths.projectRoot, run, result);
       }
       const refreshed = requireRun(paths.projectRoot, run.id).run;
       run.desiredState = refreshed.desiredState;
       if (run.desiredState === 'paused') {
         run.status = 'paused';
+        run.executionStopped = !run.unconfirmedExecution;
         run.pid = null;
         event(paths.projectRoot, run, 'Unattended Build safely paused.', 'The active wave finished and no new task was leased.');
         return saveRun(paths, run);
@@ -962,12 +1077,17 @@ export async function executeAfkRun(projectRoot, runId, dependencies = {}) {
     }
     return saveRun(paths, run);
   } catch (error) {
-    run.status = 'blocked';
+    const control = requireRun(paths.projectRoot, run.id).run;
+    run.desiredState = control.desiredState;
+    run.status = control.desiredState === 'cancelled' ? run.unconfirmedExecution ? 'cancel-unknown' : 'cancelled' : 'blocked';
+    if (control.desiredState === 'cancelled') run.cancellation = { ...control.cancellation,
+      status: run.unconfirmedExecution ? 'unknown' : 'confirmed', settledAt: now() };
     run.pid = null;
     run.messages.push({ at: now(), message: error.message });
-    abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-blocked' });
+    run.executionStopped = !run.unconfirmedExecution;
+    if (!run.unconfirmedExecution) abandonExecutionLeasesForRun(paths.projectRoot, run.id, { outcome: 'conductor-blocked' });
     event(paths.projectRoot, run, 'Unattended Build is blocked.', error.message, 'blocked', true);
     saveRun(paths, run);
     return run;
-  }
+  } finally { authorityChecks.delete(run); }
 }