@try-works/dsh-recursive-mode 0.4.4 → 0.4.6

package/lib/recursive_ask.tool.d.ts

@@ -1,7 +1,24 @@
 import type { RecursiveRuntime } from './runtime.ts';
+import { RUN_START_GATE_ID } from './run-start.ts';
 /** The identifiers the workflow uses for its three human gates. */
 export declare const ASK_GATE_IDS: readonly ["tdd-mode", "qa-signoff", "gate-block"];
 export type AskGateId = (typeof ASK_GATE_IDS)[number];
+/**
+ * PHASE 0 — THE FOURTH GATE, AND WHY IT IS NOT IN `ASK_GATE_IDS`.
+ *
+ * The three above are the WORKFLOW's gates, and their membership is asserted as exactly those three.
+ * Starting a run is a different kind of decision — it decides whether there is a run at all, and
+ * approving it ARMS A GOAL the harness will keep driving — so its data lives in `run-start.ts` with its
+ * own contract and its own options. Widening the workflow's gate list must not silently widen what may
+ * start a run.
+ */
+export type AskAnyGateId = AskGateId | typeof RUN_START_GATE_ID;
+/** Is this gate id the run-start gate? */
+export declare function isRunStartGate(gateId: string): boolean;
+/** Every gate id `recursive_ask` accepts, workflow gates first. */
+export declare function askGateIds(): string[];
+/** The artifact a gate's answer belongs in — the run-start gate's is fixed to the Phase 0 requirements. */
+export declare function askGateArtifact(gateId: AskAnyGateId): string;
 /** The plugin's own documented bounds — see the module comment on why these are not a claimed mirror. */
 export declare const MAX_HEADER_CHARS = 12;
 export declare const MAX_LABEL_CHARS = 30;
@@ -41,6 +58,21 @@ export declare class AskValidationError extends Error {
 export declare function validateAskQuestion(question: AskQuestion): AskQuestion;
 /** Build the question for a gate, validated. */
 export declare function buildAskQuestion(gateId: AskGateId): AskQuestion;
+/**
+ * PHASE 0 — build the question for ANY accepted gate, including the run-start gate.
+ *
+ * A separate entry point rather than a widened `buildAskQuestion` so the three workflow gates keep the
+ * exact signature and behaviour their callers (and `runtime.phaseRules`) already rely on.
+ */
+export declare function buildAskQuestionFor(gateId: AskAnyGateId): AskQuestion;
+/**
+ * PHASE 0 — validate an answer to ANY accepted gate.
+ *
+ * The run-start gate accepts only the labels IT offered, exactly like the other three, and the check is
+ * the same `ASK_GATES`-shaped test against its own options. An answer of `maybe` is refused rather than
+ * recorded, because a recorded non-answer is the failure mode this whole change exists to prevent.
+ */
+export declare function validateAskAnswerFor(gateId: AskAnyGateId, answer: string): string;
 /**
  * Validate an answer against its gate.
  *
@@ -84,5 +116,110 @@ export declare function pendingGateFor(artifactFile: string, artifactText: strin
  * ⚠ THE WRITE-BACK IS A MARKER LINE, REPLACED IN PLACE when the artifact already carries one. A
  * second `TDD Mode:` line would leave two answers to one question and make "what was decided?"
  * depend on which a reader found first.
+ *
+ * ⚠ PHASE 0 — `run-start` IS RECORDED BY THE PLUGIN, NEVER BY A BARE MARKER WRITE. See
+ * `recordRunStartAnswer`: it is the only path that can arm a run goal, it prefers the blocking human
+ * channel, and it fails closed when no person can be reached.
  */
 export declare function createRecursiveAskTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;
+/**
+ * PHASE 0 — record the answer to the run-start gate, and start the run only if it says so.
+ *
+ * ⚠ THREE OUTCOMES, AND TELLING THEM APART IS THE FIX. The first version of this function collapsed all of
+ * them into one `null`: "the channel threw", "the channel resolved with something unrecognisable", and
+ * "nobody answered" produced the same refusal, whose text asserted a cause ("so no person was asked") the
+ * plugin had already thrown away. A live session paid for that: the call failed after 22.9 s, the operator
+ * could not be told why, and the refusal's own advice prescribed the call that had just failed. So:
+ *
+ *   1. A PERSON WAS REACHED (`unusable`): the channel resolved, so somebody answered, and their answer is
+ *      not a label this gate offered — a skip, a custom value, several labels at once. That is a DECISION
+ *      the gate cannot record, and it is final: neither the caller's `answer` nor `relay=true` may replace
+ *      it. (RM5504)
+ *   2. THE CHANNEL FAILED (`unavailable`): no decision came back at all, and the refusal NAMES THE CAUSE
+ *      from the error the channel threw. Here the run can still be started, because a composition whose
+ *      channel cannot deliver the question would otherwise be unable to start any run — but only by the
+ *      caller asking for the relay in so many words (`relay=true`), which the result reports as
+ *      `source: "relayed"` rather than as a person's own selection. (RM5503)
+ *   3. NO CHANNEL IS MOUNTED: the relayed answer is the only possible source, exactly as before. (RM5502
+ *      when there is no answer either)
+ *
+ * ⚠ AND A CANCELLED OR CLOSED QUESTION IS NEVER RELAYABLE. `ASK_CANCELLED`, `ASK_ABORTED` and
+ * `ASK_TIMED_OUT` are the codes that mean the question was settled from outside this gate — the card was
+ * dismissed, the turn was cancelled, or a foreground window ended. The relay is refused for those, so a
+ * question the operator stopped cannot be turned into an approval by asking again in the same breath.
+ * Every other failure is a composition or capability failure — the question reached nobody — which is the
+ * class the relay exists for.
+ *
+ * ⚠ WHAT THE GATE STILL DOES *NOT* CLAIM: a relayed approval is a relayed approval. The plugin cannot
+ * verify that a person gave the label, and it does not pretend otherwise — the result's `source` and
+ * `channel` fields say where the decision came from, and a direct selection is preferred whenever the
+ * channel can produce one.
+ */
+export declare function recordRunStartAnswer(recursive: RecursiveRuntime, root: string, runId: string, answer: string | undefined, exec: {
+    agent?: unknown;
+    signal?: unknown;
+    callId?: unknown;
+}, relay?: boolean): Promise<Record<string, unknown>>;
+/**
+ * PHASE 0 — WHAT THE BLOCKING CHANNEL ACTUALLY DID.
+ *
+ * ⚠ THIS TYPE EXISTS BECAUSE ITS ABSENCE WAS THE DEFECT. The first version returned a bare `null` from a
+ * `catch {}` for every failure and for every unrecognisable selection, so "the channel threw NO_PROVIDER",
+ * "the caller is not the live root agent", "the person skipped the question" and "the person typed a
+ * custom value" were ONE value. The refusal built from it then asserted the one cause it could not know.
+ * An outcome carries the cause, the raw message, and whether the failure is the class a relay may answer.
+ */
+export type RunStartChannelOutcome = 
+/** The person answered, and their selection is exactly one of the gate's own labels. */
+{
+    kind: 'answered';
+    answer: string;
+}
+/** The channel RESOLVED, so a person was reached — but the answer is not a label this gate offered. */
+ | {
+    kind: 'unusable';
+    detail: string;
+}
+/** The channel THREW: no decision came back, and the cause is named rather than discarded. */
+ | {
+    kind: 'unavailable';
+    cause: string;
+    detail: string;
+    relayable: boolean;
+};
+/**
+ * ⚠ THE CODES THAT MEAN THE QUESTION WAS CANCELLED OR CLOSED rather than never delivered: the person
+ * dismissed the card, their turn was cancelled, or a foreground window ended. A caller may not convert any
+ * of those into an approval by asking for the relay in the same breath. Every other failure means the
+ * question reached nobody — a composition or capability failure, which is the class the relay exists for.
+ */
+export declare const NON_RELAYABLE_CHANNEL_CODES: readonly ["ASK_CANCELLED", "ASK_ABORTED", "ASK_TIMED_OUT"];
+/**
+ * Name the failure of one `ask()` call, without inventing anything about it.
+ *
+ * The cause is the error's own `code` when it has one (the harness's `UserQuestionError` carries
+ * `NO_PROVIDER`, `CALLER_NOT_LIVE`, `DELEGATED_CALLER`, `ASK_ABORTED`, …), else its `name`, else its
+ * JavaScript type. `detail` keeps the message verbatim so a reader sees the channel's own words rather
+ * than this plugin's paraphrase — the paraphrase is exactly how the previous version came to assert a
+ * cause nobody had.
+ */
+export declare function classifyChannelFailure(err: unknown): {
+    cause: string;
+    detail: string;
+    relayable: boolean;
+};
+/**
+ * Ask the run-start question through the blocking channel and report WHAT HAPPENED.
+ *
+ * ⚠ THE CATCH IS THE POINT. It used to be `catch { return null }` — a blocking human question whose
+ * failure cause was erased at the exact moment the cause was the only thing worth knowing. Every path out
+ * of this function now says which path it was.
+ *
+ * The selection is filtered to the gate's OWN labels: a question a UI answered with a free-text custom
+ * value must not become an approval just because it arrived on the right channel.
+ */
+export declare function askRunStartDirectly(channel: NonNullable<RecursiveRuntime['userQuestionsChannel']>, exec: {
+    agent?: unknown;
+    signal?: unknown;
+    callId?: unknown;
+}): Promise<RunStartChannelOutcome>;

package/lib/recursive_closeout.tool.d.ts

@@ -4,5 +4,15 @@ import type { RecursiveRuntime } from './runtime.ts';
  * SESSION's workspace only (R1 workspace-scoping invariant). The run is resolved
  * via the session agent's cwd -> workspace registry; a runId outside the current
  * workspace is rejected.
+ *
+ * A RUN ID IS A NAME, NOT A PATH HERE TOO, and "outside the current workspace is rejected" is NOT enough
+ * on its own: `closeoutRun` joins the id onto the run layer and then writes a receipt under it, and its
+ * scoping check is `runDir.startsWith(runRoot)` — a string prefix test, not containment. A `..\` segment
+ * that lands on a SIBLING of the run layer passes that check whenever the sibling's name begins with
+ * `run`, so a path-shaped id can still receive a write. MEASURED pre-fix: `..\run-away` and `../run-away`
+ * were accepted and reached the report; the other shapes below were stopped only by the sibling not
+ * existing, which is the operator's filesystem deciding, not the tool. The rule is `run-id.ts`; this
+ * boundary is where the name enters, so this is where it is refused, with `recursive_init`'s refusal shape
+ * — `BAD_RUN_ID` (RM1107), same detail sentence.
  */
 export declare function createRecursiveCloseoutTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;

package/lib/recursive_init.tool.d.ts

@@ -1,2 +1,25 @@
 import type { RecursiveRuntime } from './runtime.ts';
+/**
+ * PHASE 0 — SCAFFOLDING IS NOT STARTING, AND THE TOOL SAYS SO AT THE MOMENT IT MATTERS.
+ *
+ * A spec may legitimately exist before a run does: this tool writes the run directory and every phase
+ * document, and it still does. What it must NOT do is start the run, because starting is creating and
+ * arming the goal the harness drives autonomous rounds from. That is the owner's rule — *"phase 0
+ * requires explicit approval to start a run and goal"* — so the description below names the gate and the
+ * result carries `runStartApproval`, which is the pointer a caller needs: the run is inert until
+ * `recursive_ask` answers `run-start`.
+ *
+ * `runStartApproval` is read from the run's own Phase 0 artifact on every call, so it is the TRUE state
+ * rather than "this call created something": re-initialising an APPROVED run reports `approved: true`
+ * (and the run keeps its goal), which is what a caller re-scaffolding a run it already started needs to
+ * see.
+ *
+ * AND A RUN ID IS A NAME, NOT A PATH. This is the boundary where the name enters, so it is the boundary
+ * that refuses a path-shaped one — loudly, and before `initRun` can mkdir anything. The check lives here
+ * (through the shared `run-id.ts` rule) rather than in `runtime.ts` because `initRun` is not the only
+ * caller and because the runtime's `join(root, '.recursive', 'run', runId)` is CORRECT for a name; what
+ * was missing was a gate on the name. Teaching the runtime to accept a path would silently relocate the
+ * run layer instead of rejecting the call. See `run-id.ts` for the rule, the evidence behind it, and the
+ * "do not fix this back" note.
+ */
 export declare function createRecursiveInitTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;

package/lib/recursive_phase.tool.d.ts

@@ -5,5 +5,13 @@ import type { RecursiveRuntime } from './runtime.ts';
  * (runtime.phaseRules -> phaseRulesFor) as the once-per-phase pre-step
  * reminder, so the agent can re-ask for the rules without re-injecting them on
  * every step. Returns { error } when no active phase is found.
+ *
+ * A RUN ID IS A NAME, NOT A PATH HERE TOO, INCLUDING WHEN IT IS OMITTED. Omitted and path-shaped are
+ * different cases and must stay different: omitted means "the latest run by mtime", which `resolveRunDir`
+ * answers by DISCOVERY rather than by joining anything, and that case is untouched below. A path-shaped id,
+ * by contrast, is joined by `phaseRules` -> `resolveRunDir` and then read, and `recordInjection` WRITES
+ * `memory-injections.json` under whatever directory it resolved to — with no scoping check at all on this
+ * path. So the gate fires only on an id that was actually supplied, and `run-id.ts` owns the rule. The
+ * refusal is `recursive_init`'s, `BAD_RUN_ID` (RM1107), composed identically.
  */
 export declare function createRecursivePhaseTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;

package/lib/recursive_scratch.tool.d.ts

@@ -3,5 +3,15 @@ import type { RecursiveRuntime } from './runtime.ts';
  * `recursive_scratch` — read/write/append the run-scoped disposable scratchpad
  * (R5) under the CURRENT session workspace only (R1). Scratch is git-ignored
  * and never citable as an Input.
+ *
+ * A RUN ID IS A NAME, NOT A PATH HERE TOO. `scratchRun` joins it onto the run layer, and it then WRITES
+ * (write/append) into the directory it landed on, so a path-shaped id does not merely fail to find a run:
+ * with a `..\` segment it can find and write into a SIBLING of the run layer, because the runtime's
+ * workspace-scoping check is `runDir.startsWith(runRoot)` — a string prefix test, not containment — and a
+ * sibling directory whose name begins with `run` passes it. MEASURED pre-fix: `..\run-away` was accepted
+ * and `scratchRun` wrote `scratch.md` into `<workspace>\.recursive\run-away\scratch\`. The rule is
+ * `run-id.ts`; the gate sits here, at the boundary where the name enters, rather than in `scratchRun`, for
+ * the same reason `recursive_init`'s does. Refusal shape is `recursive_init`'s, `BAD_RUN_ID` (RM1107),
+ * composed identically: one rule, one message.
  */
 export declare function createRecursiveScratchTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;

package/lib/recursive_worktree.tool.d.ts

@@ -3,5 +3,21 @@ import type { RecursiveRuntime } from './runtime.ts';
  * `recursive_worktree` — create a linked git worktree for a run and/or
  * promote a branch up the dev/stage/main chain. Workspace-scoped: the
  * operations run under the SESSION's control-plane root only.
+ *
+ * A RUN ID IS A NAME, NOT A PATH HERE TOO, and this is the worst place to be without the rule: a `create`
+ * builds TWO things out of the id — the linked worktree directory `.worktrees/<runId>` AND the git branch
+ * `recursive/<runId>` (git accepts '/' inside a ref) — so a path-shaped id used to leave a worktree and a
+ * ref behind, not just a folder. MEASURED pre-fix, per id, against a fresh repo: `nested/child-run`
+ * returned ok:true and created BOTH `.worktrees/nested/child-run` and
+ * `refs/heads/recursive/nested/child-run`, while the shapes git itself refuses as ref syntax
+ * (`recursive//tmp/x`, `recursive/C:…`, `.hidden-run`, a trailing space) failed the worktree add and
+ * created neither. The rule is `run-id.ts` and is not restated here; the gate sits at this boundary, ahead
+ * of `createRunWorktree`, so the refusal no longer depends on git happening to dislike the ref name.
+ *
+ * The refusal is `BAD_RUN_ID` (RM1107), composed exactly as `recursive_init` composes it — same code, same
+ * detail, same sentence. One message for one rule is what keeps a caller from having to learn a second
+ * vocabulary for the same defect, and the shared remedy it carries ("call recursive_init again") is right
+ * for this tool as well: a `create` for a run that does not exist yet is exactly what `recursive_init`
+ * with `createWorktree: true` does.
  */
 export declare function createRecursiveWorktreeTool(recursive: RecursiveRuntime): import("@deepseek-ai/dsh-tools").ToolDefinition;

package/lib/run-id.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A RUN ID IS A NAME, NOT A PATH.
+ *
+ * WHY THIS MODULE EXISTS. Every consumer of a run id JOINS it onto a directory
+ * that already carries the meaning "the run layer":
+ *
+ *     join(root, '.recursive', 'run', runId)   // runtime.ts, run.ts, handoff.ts, scratch.ts
+ *     join(repoRoot, '.worktrees', runId)      // worktree.ts (a linked worktree)
+ *     'recursive/' + runId                     // worktree.ts (the run's git branch)
+ *
+ * `join` is a PATH operation: absolute paths, drive specifiers and `..` segments
+ * are all legal input to it, and each one silently changes what the call means.
+ * A caller who passes `E:\tmp\rm-live-diagnostics\01-calculator-lib` is asking
+ * for a run "on another drive"; what they get is a `mkdir` of
+ *
+ *     <workspace>\.recursive\run\E:\tmp\rm-live-diagnostics\01-calculator-lib
+ *
+ * which is not drive-qualified at all — on POSIX and Windows alike the colon is
+ * just another character in a relative component. The result is a bogus nested
+ * folder INSIDE the workspace, created before anything can refuse it, surfacing
+ * far away as an ENOENT-shaped runtime failure (RM5501) with the operator's
+ * filesystem already dirty.
+ *
+ * SO THE RULE IS ENFORCED WHERE THE NAME ENTERS, and NOT by teaching the runtime
+ * to accept a path. The joins in `runtime.ts` are CORRECT for a name; what was
+ * missing was a gate on the name. Do not "fix" this back: a run on another drive
+ * or in a worktree is reached through the session's control-plane root
+ * (`recursive_worktree`, `00-worktree.md`) — the run layer is never relocated by
+ * smuggling a path into the id.
+ *
+ * The charset below is deliberately the SAME one the read path already uses
+ * (`live-route.ts` `DOC_SAFE_RE`) so a name this gate accepts is a name that
+ * route can serve.
+ */
+/**
+ * The accepted shape, as prose that can be embedded in a model-facing parameter
+ * description and in a refusal detail, so the rule is stated once.
+ */
+export declare const RUN_ID_RULE = "letters, digits, dot, underscore or dash only, no leading or trailing dot, no path separator, no drive specifier and no \"..\" segment";
+/** Two ids in the shapes the scaffold convention actually produces. */
+export declare const RUN_ID_EXAMPLES = "01-calculator-lib, fixture-run";
+/**
+ * Longest run id accepted. Directory-name components cap at 255 bytes on NTFS
+ * and ext4; a run id also becomes a git ref component (`recursive/<runId>`) and
+ * a prefix of every lock/receipt filename inside the run, so the ceiling is set
+ * well below the filesystem limit rather than at it.
+ */
+export declare const RUN_ID_MAX_LENGTH = 100;
+/**
+ * Why a run id is refused, or `null` when it is a usable NAME.
+ *
+ * The returned string is the SPECIFIC problem (which rule the id broke), with no
+ * trailing punctuation and no sentence of its own, so a caller can hand it to
+ * `toolError('BAD_RUN_ID', …)` as the detail. `RUN_ID_RULE` states the shape.
+ *
+ * The order of the checks is part of the message quality: a Windows absolute
+ * path is reported as a drive-qualified path (what the caller passed) rather
+ * than as a separator complaint (what that path is made of).
+ */
+export declare function runIdProblem(raw: string): string | null;
+/** True when `raw` is a usable run NAME. Convenience for callers that only branch. */
+export declare function isValidRunId(raw: string): boolean;

package/lib/run-start.d.ts

@@ -0,0 +1,55 @@
+/** The gate id `recursive_ask` answers for a run start. Deliberately NOT in ASK_GATE_IDS. */
+export declare const RUN_START_GATE_ID = "run-start";
+/** The Phase 0 artifact the approval is recorded in. */
+export declare const RUN_START_ARTIFACT = "00-requirements.md";
+/** The artifact field the approval reads back from. */
+export declare const RUN_START_MARKER = "Run Start";
+/** The approving label. The ONLY label that starts a run. */
+export declare const RUN_START_APPROVE = "Start run";
+/** The withholding label: the spec stays a spec. */
+export declare const RUN_START_HOLD = "Hold";
+/**
+ * WHY THIS GATE IS NOT IN `ASK_GATE_IDS`. Those three are the WORKFLOW's gates — phase-3 test
+ * evidence, phase-5 sign-off, resolving a gate block — and their membership is asserted as exactly
+ * three. Starting a run is a different kind of decision: it is the one that decides whether there is
+ * a run at all. It lives here, with its own contract, so widening the workflow's gate list cannot
+ * quietly widen what may start a run.
+ */
+export declare const RUN_START_GATE: {
+    readonly id: "run-start";
+    readonly header: "Start run";
+    readonly question: "Approve phase 0 and start this run? Approving creates an armed goal the harness will keep driving.";
+    readonly options: readonly [{
+        readonly label: "Start run";
+        readonly description: "Record the approval and arm the run goal.";
+    }, {
+        readonly label: "Hold";
+        readonly description: "Leave the spec inert: no run goal, no autonomous rounds.";
+    }];
+    readonly marker: "Run Start";
+};
+/** The durable line an approval writes. */
+export declare function runStartApprovalLine(): string;
+/** Is a `run-start` answer the approving one? */
+export declare function isRunStartApproval(answer: string): boolean;
+/** Where the Phase 0 requirements artifact lives for a run rooted at `root`. */
+export declare function runStartArtifactPath(root: string, runId: string): string;
+/** The artifact text, or null when the file is absent (a read failure is not an approval). */
+export declare function readRunStartArtifact(root: string, runId: string): string | null;
+/**
+ * The approval state of a run, read from its Phase 0 artifact.
+ *
+ * ⚠ MATCHED ON THE VALUE, NOT ON THE LINE'S PRESENCE. `getMdFieldValue` returns the field's VALUE, so
+ * a recorded `- Run Start: Hold` is refused here — a check for "is there a Run Start line?" would read
+ * a refusal as consent, which is the one mistake this whole module exists to prevent.
+ */
+export declare function readRunStartApproval(root: string, runId: string): {
+    approved: boolean;
+    artifact: string;
+    reason: string;
+};
+/**
+ * The ONE refusal reason the projection returns before approval, exported so every caller branches on
+ * the same string instead of re-typing it (a re-typed reason is a caller that silently stops matching).
+ */
+export declare const RUN_START_NOT_APPROVED = "run not started: phase 0 approval has not been granted";

package/lib/runtime.d.ts

@@ -15,7 +15,7 @@ import { type SubagentsRuntimeLike, type SubagentStartRequestLike, type Subagent
 import { type RecursivePhaseState } from './lifecycle.ts';
 import { type EnforcementConfig, type ToolGuardDecision, type ToolExecLike } from './enforcement.ts';
 import { type CreateWorktreeResult, type PromoteBranchResult } from './worktree.ts';
-import { syncRunGoal, type GoalServiceLike } from './goals-projection.ts';
+import { syncRunGoal, type GoalServiceLike, type SyncResult } from './goals-projection.ts';
 import { type TeamRuntimeLike, type AuditToPassResult, type TeamCallerHandle, type TeamTaskViewLike, type AuditRoundOutcome } from './teams-loop.ts';
 import type { ContinuableChildId, ContinuableMessageId } from './delegation.ts';
 declare module '@deepseek-ai/cordis' {
@@ -39,6 +39,41 @@ export interface LintArtifactResult {
     warnings: string[];
     passed: boolean;
 }
+/**
+ * PHASE 0 — the structural seam for the host's human-question channel (`ctx.userQuestions`).
+ *
+ * Declared here as a minimal seam for the same reason as every other harness touchpoint in this plugin:
+ * the live `UserQuestionService` satisfies it structurally, so the plugin never imports the host package,
+ * and a test can drive the run-start gate with a fake that behaves like the real one. The error case is
+ * part of the contract, not an afterthought: the real `ask()` REJECTS (NO_PROVIDER / CALLER_NOT_LIVE /
+ * ASK_ABORTED) instead of resolving with something that could be mistaken for an answer, which is what
+ * lets `recursive_ask` fail closed rather than invent an approval.
+ */
+export interface UserQuestionsLike {
+    ask(request: {
+        questions: Array<{
+            id: string;
+            header?: string;
+            question: string;
+            options?: Array<{
+                label: string;
+                description?: string;
+            }>;
+        }>;
+        agent?: unknown;
+        signal?: AbortSignal;
+        /** Links the card to the tool call that asked, the way plan-mode's exit does. */
+        wait?: {
+            callId?: unknown;
+        };
+    }): Promise<{
+        answers: Array<{
+            id: string;
+            selected: string[];
+            custom?: string;
+        }>;
+    }>;
+}
 /**
  * T15 (G): the folded status PLUS the rolling guard-decision evidence. Declared
  * as an intersection rather than by editing RecursiveStatusResult/foldRun — the
@@ -79,8 +114,20 @@ export declare class RecursiveRuntime extends Service {
         subagents?: SubagentsRuntimeLike | null;
         workflow?: WorkflowEngineLike | null;
     });
-    /** T10: the native jobs registry, when the composition mounts one. */
+    /**
+     * T10: the native jobs registry, when the composition mounts one. */
     private readonly jobs;
+    /**
+     * PHASE 0 — attach the goals service after construction.
+     *
+     * The composition resolves `goals` with ONE `ctx.get` at apply time and passes it to the constructor,
+     * which is fine for a service that is already mounted. This seam exists for the two cases that pattern
+     * cannot cover: a composition that mounts `goals` later (the same late-attach reason `attachSubagents`
+     * and `attachLlmInventory` exist), and a test that needs the REAL runtime wired to a structural fake —
+     * a fake passed through the plugin's Config is dropped, because the Config schema is the settings
+     * namespace and strips keys it does not declare.
+     */
+    attachGoals(service: GoalServiceLike | null): void;
     /**
      * T23 — write a gate's answer into an artifact as a marker line.
      *
@@ -160,7 +207,7 @@ export declare class RecursiveRuntime extends Service {
     knownProviderNames(): string[];
     private readonly repoRoot;
     private readonly workspaceRegistry;
-    private readonly goalsService;
+    private goalsService;
     /**
      * T27 — the hook registry, EXPOSED so a sibling plugin can participate in a run
      * without patching this one:
@@ -216,10 +263,49 @@ export declare class RecursiveRuntime extends Service {
         history?: string;
         lock?: LockArtifactResult;
     }>;
+    /**
+     * PHASE 0 — read a run's start approval from its own Phase 0 artifact.
+     *
+     * The approval is a DURABLE line in `.recursive/run/<runId>/00-requirements.md`, not a value held in
+     * memory, for the reason every other gate here is durable: a decision that only exists in a session
+     * cannot be cited, and cannot survive the session it was made in. Read-only; asking changes nothing.
+     */
+    readRunStartApproval(root: string, runId: string): {
+        approved: boolean;
+        artifact: string;
+        reason: string;
+    };
+    /**
+     * PHASE 0 — the harness's blocking human-question channel (`ctx.userQuestions`), when this composition
+     * mounts one.
+     *
+     * ⚠ WHY THE PLUGIN REACHES FOR THIS AT ALL. The other three gates answer through a question card and a
+     * relayed label, which is fine for a decision the workflow acts on later. STARTING A RUN is different:
+     * the first human turn is the only place the harness can say "arming this goal means autonomous rounds"
+     * BEFORE arming it. This channel is the same one plan-mode's exit uses; `ask()` resolves only with a
+     * real answer from a real person, and it THROWS when there is no answerer or no live root agent. So the
+     * absence of this service cannot be papered over: `recursive_ask` refuses the run-start gate and names
+     * the missing channel (RM5502).
+     */
+    private userQuestions;
+    /** Late-bind the human-question channel when the composition mounts it. */
+    attachUserQuestions(service: UserQuestionsLike | null): void;
+    /** The human-question channel this composition mounted, or null. */
+    get userQuestionsChannel(): UserQuestionsLike | null;
     /**
      * T1 (goals projection): project the run into the native goals service so it is
      * a first-class durable, resumable, blockable object. Best-effort — the run's
      * filesystem state is the source of truth; a goal is the durable projection.
+     *
+     * ⚠ PHASE 0 — AND IT ARMS NOTHING UNLESS THE RUN WAS STARTED. `create` returns an ARMED goal, and an
+     * armed goal is the harness driving autonomous rounds, so this is the one place where "project the
+     * state" can quietly equal "start the run". The approval is therefore REQUIRED from the caller and
+     * has no default here: a caller that has not resolved the run's approval cannot arm a goal by
+     * forgetting to pass one, and `syncRunGoal` refuses every branch that would create one without it.
+     *
+     * Unapproved is the EXPECTED state for a scaffolded run, so the refusal comes back as a plain
+     * `{ ok: false }` carrying {@link RUN_START_NOT_APPROVED}: callers must treat that as normal work,
+     * never as a warning (see `armRunGoalIfApproved`, the one caller that arms).
      */
     projectRunToGoal(agent: {
         session?: {
@@ -227,15 +313,21 @@ export declare class RecursiveRuntime extends Service {
                 cwd?: string;
             };
         };
-    } | null | undefined, runId: string, state?: Parameters<typeof syncRunGoal>[3]): {
-        ok: true;
-        phase: import("./goals-projection.ts").GoalPhase;
-        ref?: import("./goals-projection.ts").GoalRefLike;
-        created?: boolean;
-    } | {
-        ok: boolean;
-        reason: string;
-    };
+    } | null | undefined, runId: string, state?: Parameters<typeof syncRunGoal>[3], approved?: boolean): SyncResult;
+    /**
+     * PHASE 0 — the approved-run arm step: read the run's approval from `root` and project the goal only
+     * if it is there. This is the phase-progress path (`syncRunGoal` reached on ordinary work), so the
+     * unapproved case is deliberately silent: `{ ok: false, reason: RUN_START_NOT_APPROVED }` with no
+     * goal, no write and no throw. Read on EVERY call rather than cached, because the approval can arrive
+     * mid-session and a cached "not yet" would leave an approved run unable to arm until a plugin reload.
+     */
+    armRunGoalIfApproved(agent: {
+        session?: {
+            header?: {
+                cwd?: string;
+            };
+        };
+    } | null | undefined, root: string, runId: string, state?: Parameters<typeof syncRunGoal>[3]): SyncResult;
     /** T1: block the run's goal on a gate-block (durable + UI-visible). */
     blockRunToGoal(agent: {
         session?: {
@@ -246,31 +338,20 @@ export declare class RecursiveRuntime extends Service {
     } | null | undefined, runId: string, reason: {
         code: string;
         message: string;
-    }): {
-        ok: true;
-        phase: import("./goals-projection.ts").GoalPhase;
-        ref?: import("./goals-projection.ts").GoalRefLike;
-        created?: boolean;
-    } | {
-        ok: boolean;
-        reason: string;
-    };
-    /** T1: re-arm the run's goal on a reopen (blocked/paused -> active). */
+    }): SyncResult;
+    /**
+     * T1: re-arm the run's goal on a reopen (blocked/paused -> active). Never starts an unstarted run —
+     * REOPEN IS NOT A BACK DOOR TO STARTING A RUN. `approved` is required for the same reason as in
+     * `projectRunToGoal`: the phase-0 gate cannot be defaulted open. An approved run's approval outlives
+     * a reopen because it is a durable line in the run's own Phase 0 artifact, not a held value.
+     */
     resumeRunToGoal(agent: {
         session?: {
             header?: {
                 cwd?: string;
             };
         };
-    } | null | undefined, runId: string): {
-        ok: true;
-        phase: import("./goals-projection.ts").GoalPhase;
-        ref?: import("./goals-projection.ts").GoalRefLike;
-        created?: boolean;
-    } | {
-        ok: boolean;
-        reason: string;
-    };
+    } | null | undefined, runId: string, approved?: boolean): SyncResult;
     /**
      * Workspace-scoped control-plane root (R1 binding invariant).
      * Resolves the session agent's canonical cwd -> workspace path via the
@@ -571,6 +652,31 @@ export declare class RecursiveRuntime extends Service {
         existing: string[];
         worktree?: CreateWorktreeResult;
     }>;
+    /**
+     * PHASE 0 — THE APPROVAL ACT: record the human's `Start run` decision and arm the run's goal.
+     *
+     * ⚠ THE ONLY PATH THAT STARTS A RUN. It exists as one method rather than as "write a line, then
+     * project the goal" at the tool, because those two steps must not be separable: an approval recorded
+     * without the arm (or an arm without the record) is exactly the half-state that made this defect hard
+     * to see. `tests/run-start-approval.spec.ts` drives both halves through this one call.
+     *
+     * The approval line goes into the run's own Phase 0 artifact, so it is durable, citable, and survives
+     * the session — and so a reader of the run can answer "was this run started, and by what?" without the
+     * transcript. `answer` is validated against the gate's own labels before it reaches here.
+     */
+    approveRunStart(root: string, runId: string, agent?: {
+        session?: {
+            header?: {
+                cwd?: string;
+            };
+        };
+    } | null, answer?: string): {
+        ok: boolean;
+        reason: string;
+        path: string;
+        replaced: boolean;
+        goal: SyncResult;
+    };
     /**
      * Create a linked worktree for a run under the given workspace root. The
      * worktree branch defaults to `recursive/<runId>` and is cut from the given

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-recursive-mode",
   "description": "recursive-mode workflow as a DeepSeek Harness bundle: RecursiveRuntime service + 13 recursive_* tools (recursive_status, recursive_init, recursive_lock, recursive_lint, recursive_closeout, recursive_scratch, recursive_worktree, recursive_phase, recursive_audit_team, recursive_review, recursive_delegate, recursive_ask, recursive_preview)",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/scripts/test-recursive-mode-smoke.ts

@@ -185,7 +185,11 @@ async function main() {
       complete: (_agent, ref) => { goalCurrent = { ...(goalCurrent ?? { id: ref.id, revision: ref.revision }), phase: 'complete', revision: ref.revision + 1 }; return goalCurrent },
       clear: (_agent, ref) => { goalCurrent = undefined; return { id: ref.id, revision: ref.revision + 1 } },
     }
-    const goalSync = syncRunGoal(goalService, {}, '10-smoke', 'active')
+    // PHASE 0: scaffolding a run must not start it. Without an approval the projection creates NOTHING —
+    // this is the defect the gate closes, so the smoke script proves the refusal as well as the arm.
+    const unapproved = syncRunGoal(goalService, {}, '10-smoke', 'active')
+    check('PHASE 0 no goal without approval', unapproved.ok === false && goalCurrent === undefined)
+    const goalSync = syncRunGoal(goalService, {}, '10-smoke', 'active', true)
     check('T1 run goal armed', goalSync.ok === true && goalCurrent?.objective === 'recursive-run:10-smoke · active')
     const goalBlock = blockRunGoal(goalService, {}, '10-smoke', { code: 'prerequisite-blockers', message: 'monotonic lock-order' })
     check('T1 gate-block blocks the run goal', goalBlock.ok === true && goalCurrent?.phase === 'blocked')