@try-works/dsh-recursive-mode 0.2.4 → 0.3.0

package/src/delegation.ts

@@ -11,11 +11,53 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve, sep } from 'node:path'
 import { contentSha256 } from './review.ts'
 
+/**
+ * Opaque handle to the live direct-parent Agent. The live continuable service
+ * authorizes by EXACT live object identity — `ctx.agents.get(parent.id) ===
+ * parent` (authorizeLineage), `ancestry.has(parent)` (interrupt/drain), and a
+ * `WeakSet` of live ancestry — so this must be the real live `Agent`, never a
+ * structural `{ id }` copy. The seam only ever reads `id`/`session.header.cwd`
+ * for attribution, and never serializes or inspects the live object.
+ */
+export interface SubagentParentHandle {
+  readonly id?: string
+  readonly session?: { readonly header?: { readonly cwd?: string } }
+}
+
+/** Durable identity of one continuable child session (string-branded in the host). */
+export type ContinuableChildId = string
+
+/** Durable identity of one accepted inbox message (string-branded in the host). */
+export type ContinuableMessageId = string
+
+/**
+ * Attribution for a model coordinator's follow-up to one of its children (the
+ * live `CoordinatorMessageSource` subset — see subagent/src/continuation.ts).
+ */
+export interface CoordinatorSourceLike {
+  readonly kind: 'coordinator'
+  readonly form: 'relay'
+  readonly senderSessionId: string
+}
+
+/** Uniform outcome for the interrupt/drain kill-switch helpers. */
+export interface ContinuableOpResult {
+  ok: boolean
+  reason?: string
+}
+
 /** Minimal host-realm contract for ctx.subagents (the seam we call). */
 export interface SubagentsRuntimeLike {
   start(name: string, request: SubagentStartRequestLike): Promise<SubagentResultLike>
   getProvider?(name: string): unknown
   list?(): unknown
+  /** T4: continuable child lifecycle (startContinuable / followup / interrupt / drain). */
+  startContinuable?(spec: ContinuableStartSpecLike): Promise<ContinuableStartLike>
+  /** The parent MUST be the exact live Agent (object-identity authority), never a `{ id }` copy. */
+  followup?(parent: SubagentParentHandle, childId: ContinuableChildId, content: readonly { type: 'text'; text: string }[], options: SubagentFollowupOptionsLike): Promise<ContinuableMessageId>
+  interrupt?(targetSessionId: ContinuableChildId, authority: SubagentInterruptAuthorityLike): void
+  drainContinuableChildren?(parent: SubagentParentHandle, childIds: readonly ContinuableChildId[]): Promise<void>
+  drainContinuableDescendants?(parents: readonly SubagentParentHandle[]): Promise<void>
 }
 
 export interface SubagentStartRequestLike {
@@ -116,11 +158,305 @@ export async function delegate(input: {
   }
 }
 
+/**
+ * T4: continuable-child delegation — ONE durable child receives the initial
+ * prompt (startContinuable), each REVISE is delivered as a followup to the SAME
+ * child (FIFO, working set retained), and the parent observes each round's
+ * settlement through the injected `awaitRoundResult` seam (in live usage the
+ * child's settlement lands in the parent's inbox — `reportFrom` is the
+ * CHILD-side API, so the parent-side loop collects via settlement, not by
+ * calling it). A hung reviewer is cancelled with `interruptContinuable`
+ * (keepInbox: the child's pending inbox survives). Falls back to one-shot
+ * `delegate` when the seam has no continuable methods.
+ */
+
+/** What the caller asks for when starting a continuable background child (structural subset). */
+export interface ContinuableStartSpecLike {
+  /** The `ctx.subagents` provider whose continuable-creation capability establishes the child. */
+  readonly provider: string
+  /** The initial delegation's short `description`, persisted as the child's creation label. */
+  readonly label: string
+  /** Optional caller-reserved child identity. */
+  childId?: ContinuableChildId
+  /** The delegation request (prompt + parent + toolFilter + maxDepth; no label/signal/outputSchema). */
+  readonly request: Omit<SubagentStartRequestLike, 'label' | 'signal' | 'outputSchema'>
+  /** Caller cancellation, owning the operation only until inbox acceptance. */
+  readonly signal?: AbortSignalLike
+}
+
+/** Minimal cancellation shape (a live AbortSignal satisfies it). */
+export interface AbortSignalLike {
+  readonly throwIfAborted: () => void
+}
+
+/** Identities returned once a continuable child accepted its initial prompt. */
+export interface ContinuableStartLike {
+  /** The durable child session id, stable across activations. */
+  readonly childId: ContinuableChildId
+  /** The accepted initial prompt's inbox message id. */
+  readonly messageId: ContinuableMessageId
+}
+
+/** Options for following up with one continuable child (structural subset). */
+export interface SubagentFollowupOptionsLike {
+  /** Durable attribution retained on the delivered message. */
+  readonly source: CoordinatorSourceLike
+  /** Caller cancellation, owning the operation only until inbox acceptance. */
+  readonly signal?: AbortSignalLike
+}
+
+/** Authority under which one interrupt request is admitted. */
+export type SubagentInterruptAuthorityLike =
+  | { readonly kind: 'user'; readonly parentSessionId: string }
+  | { readonly kind: 'ancestor'; readonly agent: SubagentParentHandle }
+
+/** One round of a continuable child: the delivered text plus the observed outcome. */
+export interface ContinuableRoundLike {
+  /** The message text delivered as this round's user prompt. */
+  text: string
+  /** The child's observed outcome for this round. */
+  result?: SubagentResultLike
+  /** True when this round's verdict was REVISE (a repair followup followed). */
+  revise?: boolean
+  /** The repair instruction delivered in the followup (only when revise). */
+  repair?: string
+}
+
+/** The full T4 delegation outcome. */
+export interface ContinuableDelegationLike {
+  ok: boolean
+  reason?: string
+  /** The durable child session id (stable across rounds). */
+  childId?: ContinuableChildId
+  /** Inbox message ids: [initial acceptance, ...followups]. */
+  messageIds?: ContinuableMessageId[]
+  rounds: ContinuableRoundLike[]
+  /** Final outcome accepted (last verdict APPROVE + result accepted). */
+  accepted: boolean
+  /** True when the fallback one-shot `delegate()` was used (no continuable seam). */
+  fellBackToOneShot?: boolean
+}
+
+/** Verdict vocabulary shared by T3/T4 (matches the delegated review schema). */
+export type DelegationVerdict = 'APPROVE' | 'REVISE' | 'REJECT'
+
+/** Read the verdict from a review-schema structured result (pure). */
+export function readVerdictFromStructured(result: SubagentResultLike): DelegationVerdict {
+  // SAFETY: reviewOutputSchema() defines verdict as a string enum; the cast reads
+  // one leaf field only, never mutates, and falls back on a non-matching value.
+  const verdict = (result.structured as { verdict?: unknown } | undefined)?.verdict
+  if (verdict === 'APPROVE' || verdict === 'REVISE' || verdict === 'REJECT') return verdict
+  // No structured verdict: a completed run with text output is a provisional APPROVE
+  // candidate, but delegation acceptance stays strict (caller evaluates).
+  return 'APPROVE'
+}
+
+/** Read the repair instruction from a review-schema structured result (pure). */
+export function readRepairFromStructured(result: SubagentResultLike): string {
+  // SAFETY: reviewOutputSchema() defines findings as an array of {severity,title,
+  // detail}; the cast reads leaf fields only (no live data, no mutation). The
+  // repair instruction is ALWAYS synthesized from the findings — a child cannot
+  // inject arbitrary instruction text (prompt-injection hygiene).
+  const findings = (result.structured as { findings?: Array<{ title?: string }> } | undefined)?.findings
+  const titles = Array.isArray(findings) ? findings.map(f => f.title ?? '').filter(Boolean) : []
+  if (titles.length > 0) return 'Address the findings: ' + titles.join('; ')
+  return 'REVISE: address the review findings and re-submit.'
+}
+
+/**
+ * Run a multi-round delegated task on ONE durable continuable child:
+ * 1. `startContinuable` (initial prompt) — `start()` is never called.
+ * 2. `awaitRoundResult` observes the child's settlement for that round.
+ * 3. On REVISE: `followup` delivers the repair instruction to the SAME child.
+ * 4. On APPROVE/REJECT: finish (accepted only when the verdict is APPROVE and
+ *    the result evaluates as accepted).
+ *
+ * `awaitRoundResult(childId, messageId)` is the ONLY parent-side observation
+ * seam: in live usage it waits for the child's settlement notice (the child's
+ * `reportFrom` lands in the parent's inbox); in tests it is a fake queue.
+ */
+export async function delegateContinuable(input: {
+  subagents: SubagentsRuntimeLike
+  provider: string
+  label: string
+  prompt: string
+  parent?: SubagentParentHandle
+  toolFilter?: unknown
+  maxDepth?: number
+  childId?: ContinuableChildId
+  maxRounds?: number
+  readVerdict?: (result: SubagentResultLike) => DelegationVerdict
+  readRepair?: (result: SubagentResultLike) => string | undefined
+  awaitRoundResult?: (childId: ContinuableChildId, messageId: ContinuableMessageId) => Promise<SubagentResultLike | null>
+}): Promise<ContinuableDelegationLike> {
+  const { subagents, provider, label, prompt, parent, toolFilter, maxDepth } = input
+  const maxRounds = input.maxRounds ?? 3
+  const readVerdict = input.readVerdict ?? readVerdictFromStructured
+  const readRepair = input.readRepair ?? readRepairFromStructured
+
+  const startContinuable = subagents?.startContinuable
+  const followup = subagents?.followup
+  // A continuable loop MUST observe the child's real settlement AND hold the
+  // exact live parent Agent (the live service authorizes followup by object
+  // identity). When either is missing, fall back to one-shot (which returns the
+  // actual result) rather than fabricating authority and silently APPROVE-ing.
+  const hasContinuableSeam = startContinuable !== undefined && followup !== undefined && input.awaitRoundResult !== undefined
+  if (!hasContinuableSeam || subagents === undefined || parent === undefined) {
+    // Fall back to one-shot delegation (self-audit-safe): never silently drop.
+    try {
+      const oneShot = await delegate({
+        subagents,
+        provider,
+        request: {
+          prompt: [{ type: 'text', text: prompt }],
+          label,
+          toolFilter,
+          maxDepth,
+          parent,
+        },
+      })
+      const verdict = readVerdict(oneShot)
+      return {
+        ok: true,
+        rounds: [{ text: prompt, result: oneShot }],
+        accepted: verdict === 'APPROVE' && evaluateDelegationResult(oneShot).accepted,
+        fellBackToOneShot: true,
+      }
+    } catch (err) {
+      return { ok: false, reason: err instanceof Error ? err.message : String(err), rounds: [], accepted: false, fellBackToOneShot: true }
+    }
+  }
+
+  const messageIds: ContinuableMessageId[] = []
+  const rounds: ContinuableRoundLike[] = []
+  let childId: ContinuableChildId | undefined
+
+  const request: ContinuableStartSpecLike['request'] = {
+    prompt: [{ type: 'text', text: prompt }],
+    parent,
+  }
+  if (toolFilter !== undefined) request.toolFilter = toolFilter
+  if (maxDepth !== undefined) request.maxDepth = maxDepth
+
+  const spec: ContinuableStartSpecLike = {
+    provider,
+    label,
+    request,
+  }
+  if (input.childId !== undefined) spec.childId = input.childId
+  try {
+    const started = await startContinuable(spec)
+    childId = started.childId
+    messageIds.push(started.messageId)
+    rounds.push({ text: prompt })
+
+    for (let round = 0; round < maxRounds; round += 1) {
+      const current = rounds[round]
+      const observed = await input.awaitRoundResult!(childId, messageIds[messageIds.length - 1])
+      if (observed === null) {
+        return { ok: false, reason: 'continuable child produced no settlement for round ' + (round + 1), childId, messageIds, rounds, accepted: false }
+      }
+      current.result = observed
+      const verdict = readVerdict(observed)
+      if (verdict !== 'REVISE') {
+        const accepted = verdict === 'APPROVE' && evaluateDelegationResult(observed).accepted
+        return {
+          ok: accepted,
+          reason: accepted ? 'delegation completed' : 'delegation stopped with verdict ' + verdict,
+          childId,
+          messageIds,
+          rounds,
+          accepted,
+        }
+      }
+      // REVISE: send the repair instruction to the SAME child (FIFO, context retained).
+      const repair = readRepair(observed)
+      if (!repair) {
+        return { ok: false, reason: 'REVISE verdict without a repair instruction', childId, messageIds, rounds, accepted: false }
+      }
+      const followupId = await followup(
+        parent,
+        childId,
+        [{ type: 'text', text: repair }],
+        { source: { kind: 'coordinator', form: 'relay', senderSessionId: parent.id ?? '' } },
+      )
+      messageIds.push(followupId)
+      current.revise = true
+      current.repair = repair
+      rounds.push({ text: repair })
+    }
+    return { ok: false, reason: 'max rounds reached without an APPROVE', childId, messageIds, rounds, accepted: false }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    // Failure preserves the child (a later followup may still resume it); the
+    // kill switch is explicit (interruptContinuable), never implicit.
+    return { ok: false, reason: message, childId, messageIds, rounds, accepted: false }
+  }
+}
+
+/**
+ * T4 kill switch: interrupt one live continuable child's current turn. Admission
+ * is synchronous, the effect asynchronous, and the child's pending inbox is
+ * preserved (keepInbox semantics) — a followup later resumes the parked queue.
+ */
+export function interruptContinuable(
+  subagents: SubagentsRuntimeLike,
+  childId: ContinuableChildId,
+  parentSessionId: string,
+): ContinuableOpResult {
+  const interrupt = subagents?.interrupt
+  if (interrupt === undefined) {
+    return { ok: false, reason: 'no continuable interrupt seam' }
+  }
+  try {
+    interrupt(childId, { kind: 'user', parentSessionId })
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) }
+  }
+}
+
+/**
+ * T4 closeout: release one continuable child (host drains its Activation and
+ * disposes its handle). No-op when the seam lacks the method (one-shot hosts).
+ */
+export async function drainContinuableChildren(
+  subagents: SubagentsRuntimeLike,
+  parent: SubagentParentHandle,
+  childIds: readonly ContinuableChildId[],
+): Promise<ContinuableOpResult> {
+  if (subagents?.drainContinuableChildren === undefined || childIds.length === 0) return { ok: true }
+  try {
+    await subagents.drainContinuableChildren(parent, childIds)
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) }
+  }
+}
+
+/**
+ * T4 closeout (host teardown path): release every continuable descendant below
+ * the given live parents (mirrors the live `drainContinuableDescendants`).
+ * No-op when the seam lacks the method; the host owns this at session teardown.
+ */
+export async function drainContinuableDescendants(
+  subagents: SubagentsRuntimeLike | null,
+  parents: readonly SubagentParentHandle[],
+): Promise<ContinuableOpResult> {
+  const drain = subagents?.drainContinuableDescendants
+  if (drain === undefined || parents.length === 0) return { ok: true }
+  try {
+    await drain(parents)
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) }
+  }
+}
+
 export interface Reference {
   path: string
   lineRange?: string
 }
-
 export interface ReferenceCheck {
   ok: boolean
   failures: string[]

package/src/enforcement.ts

@@ -46,7 +46,7 @@ const LOCK_TOOL_NAMES = new Set(['recursive_lock', 'recursive_lock_phase'])
  * Pure predicate: inspects the pending tool execution (name + args) against
  * the run tree under the given worktree root.
  */
-export type ToolGuardDecision = { kind: 'allow' } | { kind: 'deny'; reason: string } | { kind: 'ask'; reason?: string }
+export type ToolGuardDecision = { kind: 'allow'; warn?: string } | { kind: 'deny'; reason: string } | { kind: 'ask'; reason?: string }
 
 export interface ToolExecLike {
   name: string
@@ -108,6 +108,21 @@ export function evaluateToolGuard(
   return { kind: 'allow' }
 }
 
+/**
+ * T6 (approval ask→policy bridge): an `ask` decision must never be a silent
+ * allow. Under `strict` it coerces to `deny`; under `advisory` it stays `allow`
+ * but flags a `warn` so the caller never lets it through unlogged. Non-ask
+ * decisions pass through unchanged.
+ */
+export function coerceAskToDecision(decision: ToolGuardDecision, mode: EnforcementMode = 'advisory'): ToolGuardDecision {
+  if (decision.kind !== 'ask') return decision
+  if (mode === 'strict') {
+    return { kind: 'deny', reason: decision.reason ?? 'ask under strict enforcement denies' }
+  }
+  // advisory: allow, but carry the warning so the caller logs (never silent).
+  return { kind: 'allow', warn: decision.reason ?? 'ask under advisory enforcement allows' }
+}
+
 /** Resolve a tool-target path to an absolute path under the worktree root. */
 function resolveTargetPath(target: string, worktreeRoot: string): string | null {
   const normalized = target.replace(/\\/g, '/')

package/src/goals-projection.ts

@@ -0,0 +1,149 @@
+/**
+ * goals-projection.ts (T1, STRENGTHENING-PLAN): project a recursive run into the
+ * native `goals` service so the run is a first-class durable, resumable,
+ * blockable object — and a gate block is durable + UI-visible rather than a
+ * one-line advisory.
+ *
+ * Pure/structural: this module takes a `GoalServiceLike` seam (the real
+ * `ctx.goals` satisfies it structurally) and an opaque `AgentHandle`, and never
+ * imports the host `@deepseek-ai/dsh-goal` package. The real service's methods
+ * take a live `Agent` and throw if the agent is not the registry's live
+ * instance, so callers pass the live agent from a tool/pre-step `exec`.
+ *
+ * Safety rule: the projection NEVER clobbers a foreign goal. A goal whose
+ * objective is not a `recursive-run:<id>` marker is left untouched (only a
+ * completed goal may be replaced, per the service contract).
+ */
+import type { RunState } from './lifecycle.ts'
+
+/** Native goal phase (mirrors @deepseek-ai/dsh-goal GoalPhase). */
+export type GoalPhase = 'active' | 'paused' | 'blocked' | 'complete'
+
+/** CSA identity for one exact goal revision. */
+export interface GoalRefLike {
+  id: string
+  revision: number
+}
+
+/** Input resolved by the service when the round cap is omitted. */
+export interface CreateGoalRequestLike {
+  objective: string
+  maxGoalRounds?: number
+}
+
+/** The subset of the goal view the projection reads. */
+export interface GoalViewLike extends GoalRefLike {
+  objective?: string
+  phase?: GoalPhase
+}
+
+/** Opaque handle to the live DSH Agent; the projection never inspects it further. */
+export interface AgentHandle {
+  session?: { header?: { cwd?: string } }
+}
+
+/** Structural seam for the live `goals` service (real methods return GoalView). */
+export interface GoalServiceLike {
+  get(agent: AgentHandle): GoalViewLike | undefined
+  create(agent: AgentHandle, req: CreateGoalRequestLike): GoalViewLike
+  block(agent: AgentHandle, ref: GoalRefLike, reason: { code: string; message: string }): GoalViewLike
+  pause(agent: AgentHandle, ref: GoalRefLike): GoalViewLike
+  resume(agent: AgentHandle, ref: GoalRefLike): GoalViewLike
+  complete(agent: AgentHandle, ref: GoalRefLike): GoalViewLike
+  clear(agent: AgentHandle, ref: GoalRefLike): GoalRefLike
+}
+
+/** Outcome of a run→goal sync. */
+export type SyncResult =
+  | { ok: true; phase: GoalPhase; ref?: GoalRefLike; created?: boolean }
+  | { ok: false; reason: string }
+
+/** Marker embedded in the goal objective so a goal can be matched to its run. */
+export function runGoalTag(runId: string): string {
+  return 'recursive-run:' + runId
+}
+
+/** The durable objective string for a run goal. */
+export function goalObjective(runId: string, runState: RunState = 'active'): string {
+  return runGoalTag(runId) + ' · ' + runState
+}
+
+/** Map a run state onto the native goal phase it should project to. */
+export const RUN_TO_GOAL_PHASE = {
+  new: 'active', active: 'active', paused: 'paused', blocked: 'blocked', complete: 'complete',
+} as const satisfies Record<RunState, GoalPhase>
+
+/** Is this goal's objective the marker for `runId`? */
+export function isRunGoal(goal: GoalViewLike | undefined, runId: string): boolean {
+  return goal?.objective?.startsWith(runGoalTag(runId)) === true
+}
+
+/** Read a live ref (id + revision) for a goal. */
+function refOf(goal: GoalViewLike): GoalRefLike {
+  return { id: goal.id, revision: goal.revision }
+}
+
+/** Commit a phase mutation; the real service returns a truthy GoalView on success. */
+function mutatePhase(service: GoalServiceLike, agent: AgentHandle, ref: GoalRefLike, target: GoalPhase): boolean {
+  switch (target) {
+    case 'blocked': return !!service.block(agent, ref, { code: 'run-gate-block', message: 'recursive run gate block' })
+    case 'paused': return !!service.pause(agent, ref)
+    case 'complete': return !!service.complete(agent, ref)
+    case 'active': return !!service.resume(agent, ref)
+  }
+}
+
+/**
+ * Sync a run's durable goal to the requested phase. Safe: never touches a goal
+ * whose objective is not this run's marker, and never re-creates over a
+ * non-complete foreign goal.
+ */
+export function syncRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string, runState: RunState): SyncResult {
+  if (!service) return { ok: false, reason: 'no goals service' }
+  const target = RUN_TO_GOAL_PHASE[runState]
+  const current = service.get(agent)
+
+  // 1. Existing goal for this run -> mutate to the requested phase (no-op at target).
+  if (current && isRunGoal(current, runId)) {
+    const phase = current.phase ?? 'active'
+    const ref = refOf(current)
+    if (phase === target) return { ok: true, phase: target, ref }
+    // A completed goal is final: the contract allows it to be REPLACED, not resumed.
+    if (phase === 'complete') {
+      const created = service.create(agent, { objective: goalObjective(runId, runState) })
+      return { ok: true, phase: target, ref: refOf(created), created: true }
+    }
+    const ok = mutatePhase(service, agent, ref, target)
+    return ok ? { ok: true, phase: target, ref } : { ok: false, reason: 'goal mutation failed' }
+  }
+
+  // 2. A completed goal may be replaced; every other current phase must be
+  //    cleared or resumed instead. Never clobber a foreign goal.
+  if (current) {
+    if (current.phase === 'complete') {
+      const created = service.create(agent, { objective: goalObjective(runId, runState) })
+      return { ok: true, phase: target, ref: refOf(created), created: true }
+    }
+    return { ok: false, reason: 'a non-matching active goal exists (foreign goal not touched)' }
+  }
+
+  // 3. No current goal -> create and arm.
+  const created = service.create(agent, { objective: goalObjective(runId, runState) })
+  return { ok: true, phase: target, ref: refOf(created), created: true }
+}
+
+/** Block the current run goal (used on a gate-block). Never touches a foreign goal. */
+export function blockRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string, reason: { code: string; message: string }): SyncResult {
+  if (!service) return { ok: false, reason: 'no goals service' }
+  const current = service.get(agent)
+  if (!current) return { ok: false, reason: 'no current goal to block' }
+  if (!isRunGoal(current, runId)) return { ok: false, reason: 'current goal is not for this run (foreign goal not touched)' }
+  const ref = refOf(current)
+  const ok = !!service.block(agent, ref, reason)
+  return ok ? { ok: true, phase: 'blocked', ref } : { ok: false, reason: 'goal block failed' }
+}
+
+/** Bridge a run's blocked goal back to active (used on a reopen). */
+export function resumeRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string): SyncResult {
+  return syncRunGoal(service, agent, runId, 'active')
+}

package/src/index.ts

@@ -9,10 +9,13 @@ import { createRecursiveLockTool } from './recursive_lock.tool.ts'
 import { createRecursiveLintTool } from './recursive_lint.tool.ts'
 import { createRecursiveCloseoutTool } from './recursive_closeout.tool.ts'
 import { createRecursiveScratchTool } from './recursive_scratch.tool.ts'
-import { createRecursiveWorktreeTool } from './recursive_worktree.tool.ts'
+import { createRecursiveWorktreeTool } from './recursive_worktree.tool.ts'
 import { createRecursivePhaseTool } from './recursive_phase.tool.ts'
+import { createRecursiveAuditTeamTool } from './recursive_audit_team.tool.ts'
 import { registerRecursiveCommand } from './commands.ts'
-import { evaluateToolGuard } from './enforcement.ts'
+import { evaluateToolGuard, coerceAskToDecision } from './enforcement.ts'
+import type { GoalServiceLike } from './goals-projection.ts'
+import type { TeamRuntimeLike } from './teams-loop.ts'
 import { renderRecursivePolicy } from './policy.ts'
 import { fsPolicyIntent } from './fs-intent.ts'
 import { snapshotWorkspace } from './snapshot.ts'
@@ -30,7 +33,7 @@ export { createRecursiveLockTool } from './recursive_lock.tool.ts'
 export { createRecursiveLintTool } from './recursive_lint.tool.ts'
 export { createRecursiveCloseoutTool } from './recursive_closeout.tool.ts'
 export { createRecursiveScratchTool } from './recursive_scratch.tool.ts'
-export { createRecursiveWorktreeTool } from './recursive_worktree.tool.ts'
+export { createRecursiveWorktreeTool } from './recursive_worktree.tool.ts'
 export { createRecursivePhaseTool } from './recursive_phase.tool.ts'
 export * from './status.ts'
 export {
@@ -70,6 +73,7 @@ export * from './enforcement.ts'
 export * from './policy.ts'
 export * from './snapshot.ts'
 export * from './live-route.ts'
+export * from './teams-loop.ts'
 
 /**
  * Bundle plugin entry. The Loader activates this row once `tools` is available
@@ -101,10 +105,26 @@ export function apply(ctx: Context, config?: { shellOnly?: boolean; repoRoot?: s
     // property access requires inject and would fail boot when undeclared.
     // Resolve the control-plane root strictly from the session agent's cwd.
     const workspaceRegistry = ctx.get('workspaceRegistry') as never
-    const recursive = new RecursiveRuntime(ctx, { repoRoot: config?.repoRoot ?? process.cwd(), workspaceRegistry })
+    // T1 (goals projection): the goals service is on the host plane; it resolves
+    // from inside the recursive-realm via inheritance (same as workspaceRegistry).
+    // SAFETY: the goals service is an optional host service (could be absent); the
+    // run projection treats null as "no goal backing" and never throws.
+    const goals = ctx.get('goals') as GoalServiceLike | null
+    const recursive = new RecursiveRuntime(ctx, { repoRoot: config?.repoRoot ?? process.cwd(), workspaceRegistry, goals })
 
-    const repairedRoots = new Set<string>()
+    const repairedRoots = new Set<string>()
     const reminderGate = new ReminderOnceGate()
+    // T3 (agentTeams task loop): wire the live ctx.agentTeams service (optional —
+    // absent in compositions without the experimental agent-team row) into the
+    // turn-driven task-board tool. The whole-loop driver (auditToPass) is also
+    // exported for callers with a settlement observer.
+    // SAFETY: ctx.get returns the live service as an opaque value; the single
+    // boundary cast asserts it satisfies the TeamRuntimeLike structural seam
+    // (createTask/updateTask plus optional wait/interrupt/board reads). The
+    // live service's real Agent parameter is a superset of TeamCallerHandle, so
+    // the seam passes the exact live Agent the tool extracts from exec.agent.
+    const agentTeams = ctx.get('agentTeams') as TeamRuntimeLike | undefined
+
     const disposers = [
       ctx.tools.register(createRecursiveStatusTool(recursive)),
       ctx.tools.register(createRecursiveInitTool(recursive)),
@@ -112,8 +132,9 @@ export function apply(ctx: Context, config?: { shellOnly?: boolean; repoRoot?: s
       ctx.tools.register(createRecursiveLintTool(recursive)),
       ctx.tools.register(createRecursiveCloseoutTool(recursive)),
       ctx.tools.register(createRecursiveScratchTool(recursive)),
-      ctx.tools.register(createRecursiveWorktreeTool(recursive)),
+      ctx.tools.register(createRecursiveWorktreeTool(recursive)),
       ctx.tools.register(createRecursivePhaseTool(recursive)),
+      ...(agentTeams ? [ctx.tools.register(createRecursiveAuditTeamTool(agentTeams))] : []),
     ]
 
     // /recursive command (R4): preset-scoped registration, workspace-scoped dispatch.
@@ -167,7 +188,16 @@ export function apply(ctx: Context, config?: { shellOnly?: boolean; repoRoot?: s
         const decision = evaluateToolGuard(exec as never, root, '', recursive.enforcementConfig.toolGuards)
         if (decision.kind === 'allow') return typeof next === 'function' ? next() : { kind: 'allow' }
         if (decision.kind === 'deny') return decision
-        // ask -> in advisory we let it through with a warn (the approval seam is Phase D)
+        // T6 (approval ask→policy bridge): an `ask` must never be a silent
+        // allow. Strict coerces to deny; advisory allows but carries a warn that
+        // the caller logs below. The approval seam is the follow-on (Phase D).
+        const coerced = coerceAskToDecision(decision, recursive.enforcementConfig.toolGuards)
+        if (coerced.kind === 'deny') return coerced
+        if (coerced.kind === 'allow' && coerced.warn) {
+          // Package-tagged host logging; never a silent pass under approval=never.
+          console.warn('[recursive] tool guard (advisory): ' + coerced.warn + ' — allowing')
+        }
+        return typeof next === 'function' ? next() : { kind: 'allow' }
       }))
     }
 
@@ -212,10 +242,10 @@ export function apply(ctx: Context, config?: { shellOnly?: boolean; repoRoot?: s
         const phasePath = join(runDir, phase)
         const status = existsSync(phasePath) ? getLockStatus(phasePath) : null
         if (status !== 'DRAFT') return { kind: 'enter', messages } as const
-        if (!reminderGate.shouldInject(root, runId, phase)) return { kind: 'enter', messages } as const
-                // LIVE BUG 6 (0.2.1): inject the lint-rules reminder AT MOST ONCE PER PHASE.
-                // The scaffold repair above is deduped via repairedRoots; the reminder itself was
-                // not, so every pre-step while DRAFT re-injected it.
+        if (!reminderGate.shouldInject(root, runId, phase)) return { kind: 'enter', messages } as const
+                // LIVE BUG 6 (0.2.1): inject the lint-rules reminder AT MOST ONCE PER PHASE.
+                // The scaffold repair above is deduped via repairedRoots; the reminder itself was
+                // not, so every pre-step while DRAFT re-injected it.
                 const reminder = phaseLintRulesMessage(phase)
         return {
           kind: 'enter',