@uchibeke/gallivant 0.2.1 → 0.3.0

package/lib/task_repository_context.mjs

@@ -0,0 +1,65 @@
+// A bounded, read-only description of the selected repository for drafting:
+// the HEAD revision and the tracked, non-ignored, non-private path listing,
+// digested together so the snapshot is pinned to the prepared revision. File
+// contents still reach the planner only through explicitly selected documents.
+// Collection failures are reported as unavailable rather than guessed.
+import { createHash } from "node:crypto";
+import { redact } from "./execution_io.mjs";
+
+export const REPOSITORY_CONTEXT_LIMITS = Object.freeze({ paths: 400, pathBytes: 16_384 });
+// Secret, credential and agent-configuration locations never enter the listing
+// even when a repository tracks them; the same families intake refuses as sources.
+const PRIVATE_PATH = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.aws|\.ssh|\.codex|\.claude|\.aport|\.gallivant|\.agents|\.config|\.npmrc|\.netrc|\.git|credentials?(?:\.[^/]*)?|secrets?(?:\.[^/]*)?|[^/]*\.(?:pem|key|p12|pfx|keystore|jks)|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?)(?:\/|$)/i;
+const unavailable = reason => ({ status: "unavailable", reason, revision: null, digest: null, paths: [], counts: null, readOnly: true });
+const sha = value => createHash("sha256").update(value).digest("hex");
+
+export async function repositorySnapshot(git, checkout, { secrets = [] } = {}) {
+  if (typeof git?.revision !== "function" || typeof git?.treePaths !== "function" || typeof git?.indexPaths !== "function" || typeof git?.ignoredTrackedPaths !== "function" || typeof git?.ignoreRuleChanges !== "function") {
+    return unavailable("the Git adapter cannot enumerate the repository read-only; only explicitly selected documents are supplied as context");
+  }
+  try {
+    const revision = String(await git.revision(checkout)).trim();
+    if (!/^[0-9a-f]{40}$/.test(revision)) return unavailable("the checkout has no resolvable HEAD commit; commit or fetch before preparing");
+    // The listing is the recorded commit's tree, so revision and digest describe
+    // one state. The index decides ignores; a tree path the index no longer
+    // holds (a staged deletion) cannot be evaluated and is excluded.
+    // Ignore rules are evaluated from the checkout's in-tree .gitignore files.
+    // They equal the recorded revision's rules only when none of those files
+    // differs from it; otherwise the listing could change or expose ignored
+    // names without a revision change, so it is reported as unavailable.
+    const ruleChanges = await git.ignoreRuleChanges(checkout, revision);
+    if (ruleChanges.length) return unavailable(`${ruleChanges.length} .gitignore file(s) differ from the recorded revision (${ruleChanges.slice(0, 3).map(p => redact(p, secrets)).join(", ")}${ruleChanges.length > 3 ? ", ..." : ""}); commit or revert them before preparing so ignored paths are evaluated at that revision`);
+    const tracked = await git.treePaths(checkout, revision);
+    const index = new Set(await git.indexPaths(checkout));
+    const ignored = new Set(await git.ignoredTrackedPaths(checkout));
+    // The three listings are not one atomic read. Recheck the revision and the
+    // ignore files afterwards so a concurrent edit between the reads cannot
+    // pair the recorded revision with rules or paths from another state.
+    const [revisionAfter, changesAfter, indexAfter] = [String(await git.revision(checkout)).trim(), await git.ignoreRuleChanges(checkout, revision), await git.indexPaths(checkout)];
+    const sameIndex = indexAfter.length === index.size && indexAfter.every(path => index.has(path));
+    if (revisionAfter !== revision || changesAfter.length || !sameIndex) return unavailable("the checkout's revision, index or .gitignore files changed while the snapshot was being collected; retry once the checkout is stable");
+    const counts = { tracked: tracked.length, ignored: 0, private: 0, unverified: 0, listed: 0, truncated: 0 };
+    const approved = [];
+    for (const path of [...tracked].sort()) {
+      if (ignored.has(path)) { counts.ignored++; continue; }
+      if (typeof path !== "string" || PRIVATE_PATH.test(path) || /[\x00-\x1f\x7f]/.test(path)) { counts.private++; continue; }
+      if (!index.has(path)) { counts.unverified++; continue; }
+      approved.push(path);
+    }
+    // The digest covers the complete approved listing at this revision, even
+    // when the prompt receives a truncated prefix of it.
+    const digest = sha(JSON.stringify({ revision, paths: approved }));
+    const paths = [];
+    let bytes = 0;
+    for (const path of approved) {
+      bytes += Buffer.byteLength(path) + 1;
+      if (paths.length >= REPOSITORY_CONTEXT_LIMITS.paths || bytes > REPOSITORY_CONTEXT_LIMITS.pathBytes) break;
+      paths.push(path);
+    }
+    counts.listed = paths.length;
+    counts.truncated = approved.length - paths.length;
+    return { status: "collected", revision, digest, paths, counts, readOnly: true, collectedAt: new Date().toISOString() };
+  } catch (error) {
+    return unavailable(`repository context could not be collected safely: ${redact(String(error?.message || error), secrets).slice(0, 500)}`);
+  }
+}

package/lib/tasks.mjs

@@ -1,3 +1,6 @@
+import { hosts } from "./hosts.mjs";
+import { assertRepositoryAccess } from "./host_contract.mjs";
+import { hostApi } from "./hosts.mjs";
 // Versioned, in-process task API. Importing this module reads no user config,
 // starts no daemon and makes no network calls. Clients supply the usual context.
 import { acquireServiceMutation } from "./daemon.mjs";
@@ -21,11 +24,76 @@ import { executionRunner } from "./execution.mjs";
 import { recoverControl } from "./control.mjs";
 import { canonical } from "./learning_data.mjs";
 import { COMPLETION_CAPABILITIES, completionPolicy, completionView } from "./task_completion.mjs";
-import { ownerDelivery, ownerImplementation, assertDeliveryAnswer } from "./owner_delivery.mjs";
+import { assertDeliveryAnswer } from "./owner_delivery.mjs";
 import { prepareTurn, assertPreparationBoundary, preparationCancellationPending, preparationPreflightRetryable, PREPARATION_PENDING } from "./task_prepare.mjs";
-import { TASK_VERSION, MAX_REPAIRS, MAX_CONTEXT_BYTES, MANAGER_LOCKFILES, requireText, fragments, requireTaskCapacity, parseTaskSources, parseDraft, renderDraft, validateDraft, collectCommands, mappedQuestions } from "./task_contract.mjs";
+import { TASK_VERSION, MAX_REPAIRS, MAX_CONTEXT_BYTES, MANAGER_LOCKFILES, requireText, fragments, fragmentsForTask, FRAGMENT_VERSION, sourceFragmentVersion, requireTaskCapacity, parseTaskSources, parseDraft, renderDraft, validateDraft, collectCommands, mappedQuestions } from "./task_contract.mjs";
+import { MAX_ANSWER_BYTES, MAX_ANSWER_COUNT, MAX_LEGACY_ANSWER_COUNT, MAX_LEGACY_ANSWER_BATCH_BYTES, MAX_ANSWER_ID_CHARACTERS } from "./task_limits.mjs";
+import { DELIVERY_CAPABILITIES, deliveryProfile, savedProfile, typedEraTask, assertProfileBound, profileView, stableProfile, profileAssumption, deliveryQuestion } from "./task_profile.mjs";
+import { prepareModelTurn } from "./task_model_route.mjs";
+import { intakeModelRoute, intakeModelRouteSummary, pinnedModelRoute } from "./task_model_config.mjs";
+import { repositorySnapshot } from "./task_repository_context.mjs";
 
 export { TASK_VERSION } from "./task_contract.mjs";
+export const TASK_ROUTES = Object.freeze(["harness", "model"]);
+
+// The planner route is a saved task property. Harness drafting keeps the
+// existing dispatch; the model route is the bounded text-only request.
+const routedPrepare = (ctx, task, store, failures) => task.route === "model" ? prepareModelTurn(ctx, task, store, failures) : prepareTurn(ctx, task, store, failures);
+
+// A saved typed profile must validate before any mutation can act on it; an
+// unsupported version, or a typed-era record with no profile at all, fails
+// closed with its recovery path and leaves reads open.
+const assertProfileUsable = task => { sourceFragmentVersion(task); const profile = savedProfile(task); if (profile) assertProfileBound(profile, task); };
+
+const authorizedStart = task => task.runAuthorized && (!task.deliveryProfile || Boolean(task.approval));
+
+// Reported, bounded or unknown. Never zero while any call lacks evidence.
+function costView(attempts) {
+  const calls = attempts.filter(a => a.startedAt);
+  if (!calls.length) return { status: "none", usd: 0, detail: "no planning call has been made" };
+  const unknown = calls.filter(a => a.cost == null);
+  if (!unknown.length) return { status: "reported", usd: calls.reduce((sum, a) => sum + a.cost, 0), detail: "sum of provider-reported or usage-derived costs" };
+  if (unknown.every(a => Number.isFinite(a.reservedUsd))) return { status: "bounded", usd: calls.reduce((sum, a) => sum + Math.max(a.cost ?? 0, a.reservedUsd ?? 0), 0), detail: `${unknown.length} call(s) reported no cost; their reservations bound the total` };
+  return { status: "unknown", usd: null, detail: `${unknown.length} call(s) reported no cost and carry no reservation` };
+}
+function routeView(task) {
+  const attempts = task.attempts || [];
+  const usage = attempts.reduce((sum, a) => {
+    const u = a.usage && !Array.isArray(a.usage) ? a.usage : null;
+    return u && Number.isSafeInteger(u.inputTokens) ? { inputTokens: (sum?.inputTokens || 0) + u.inputTokens, outputTokens: (sum?.outputTokens || 0) + (u.outputTokens || 0) } : sum;
+  }, null);
+  const base = { route: task.route || "harness", calls: attempts.length, usage, cost: costView(attempts), tools: [] };
+  if (task.route === "model") return { ...base, kind: "model", adapter: task.modelRoute?.adapter || null, model: task.modelRoute?.model || null, endpointHost: task.modelRoute?.endpointHost || null, limits: task.modelRoute?.budget || null, boundary: attempts.at(-1)?.boundary || null, harness: task.harness };
+  return { ...base, kind: "harness", harness: task.harness, boundary: attempts.at(-1)?.boundary || null, account: attempts.at(-1)?.receipt?.account || null };
+}
+// Everything an owner must see before approving, pinned to one revision and
+// digested so a changed material input is detectable, not merely re-rendered.
+// Reads tolerate an unsupported saved profile (inspection must keep working);
+// every mutation validates it first and fails closed.
+const safeProfile = task => { try { return savedProfile(task); } catch { return null; } };
+function reviewDigest(task) {
+  const profile = safeProfile(task);
+  return contentDigest(JSON.stringify({ original: task.original, ...(task.fragmentVersion === undefined ? {} : { fragmentVersion: task.fragmentVersion }), requirements: task.requirements, answers: task.answers, deliveryProfile: profile ? stableProfile(profile) : task.deliveryProfile ? { unsupported: task.deliveryProfile } : typedEraTask(task) ? { unsupported: null } : null, completion: task.completion || null,
+    harness: task.harness, route: task.route || "harness", modelRoute: task.modelRoute ? { adapter: task.modelRoute.adapter, model: task.modelRoute.model, endpoint: task.modelRoute.endpoint, budget: task.modelRoute.budget, timeoutMs: task.modelRoute.timeoutMs } : null, draft: task.draft?.hash || null, sources: task.context.map(c => ({ path: c.path, hash: c.hash })), verify: task.explicitVerifyCommands || [], repository: task.repositoryContext?.digest || null, allowance: task.allowance }));
+}
+function reviewView(task) {
+  if (!task.draft || !task.output) return null;
+  const profile = safeProfile(task);
+  const requirements = new Map(task.requirements.map(r => [r.id, r]));
+  const screened = [];
+  const requirementMap = task.output.mapping.map(m => {
+    const r = requirements.get(m.requirementId);
+    if (profile && m.screen?.tier === "assumption") screened.push(profileAssumption(profile, r, m.screen));
+    return { requirementId: m.requirementId, source: r?.source || null, text: r?.text,
+      target: m.questionId ? { kind: "question", id: m.questionId } : m.assumption !== undefined ? { kind: "assumption", text: m.assumption } : { kind: "criteria", ids: m.criteria },
+      resolvedBy: m.resolvedBy || null, delivery: m.delivery || null, covered: m.covered ?? null, screen: m.screen || null, conflict: m.conflict || null };
+  });
+  return { revision: task.revision, digest: reviewDigest(task), request: { text: task.original, immutable: true, hash: contentDigest(task.original) }, fragmentVersion: task.fragmentVersion ?? 1,
+    requirements: task.requirements, requirementMap, questions: task.questions, assumptions: [...task.output.assumptions, ...screened],
+    draft: { path: task.draft.path, hash: task.draft.hash, revision: task.draft.revision, text: readText(task.draft.path) },
+    deliveryProfile: profileView(task), harness: task.harness, allowance: task.allowance, modelRoute: routeView(task), cost: costView(task.attempts || []),
+    repositoryContext: task.repositoryContext || null, readiness: task.readiness, approval: task.approval || null };
+}
 
 function selectedPaths(selected) {
   if (!Array.isArray(selected) || selected.some(p => typeof p !== "string")) throw taskError("TASK_INPUT", "context must be an array of selected repository file paths");
@@ -85,7 +153,7 @@ function commandCandidates(context, explicit = []) {
 
 const same = isDeepStrictEqual;
 function implementationMatches(task, entry) {
-  return entry.task?.id === task.id && entry.task?.digest === task.readiness?.digest && same(entry.task?.completion, task.completion) && same(entry.task?.ownerDelivery, task.ownerDelivery);
+  return entry.task?.id === task.id && entry.task?.digest === task.readiness?.digest && same(entry.task?.completion, task.completion) && same(entry.task?.ownerDelivery, task.ownerDelivery) && same(entry.task?.deliveryProfile, task.deliveryProfile);
 }
 function questionOwnership(task) {
   const ownership = { ...task.questionMappings };
@@ -105,24 +173,29 @@ const taskRejection = (code, message) => Object.assign(taskError(code, message),
 const beforeTaskEffects = fn => {
   try { return fn(); } catch (error) { error.taskEffects = "none"; throw error; }
 };
+const assertImplementationAvailable = (harness, capability) => {
+  if (!capability.available) throw taskError("EXECUTION_UNAVAILABLE", `${harness} cannot dispatch implementation: ${capability.reason || "implementation transport is unavailable"}; ${capability.fix || "select an available configured implementation harness"}; no planning call was made`);
+};
 const expectRevision = (task, expected) => {
   if (!Number.isSafeInteger(expected) || expected !== task.revision) throw taskRejection("TASK_CONFLICT", `expected revision ${expected ?? "missing"}, current revision ${task.revision}; inspect the task and retry with its current revision`);
 };
 const mutate = (task, store) => { task.revision++; task.updatedAt = new Date().toISOString(); store.save(task); };
 
-export function createTaskService(ctx, { prepare = prepareTurn, decideReady = ready, dispatch = start, daemon = upInBackground, store = taskStore(ctx.home), mutationOwner = null } = {}) {
+export function createTaskService(ctx, { prepare = routedPrepare, decideReady = ready, dispatch = start, daemon = upInBackground, store = taskStore(ctx.home), mutationOwner = null } = {}) {
   const result = task => {
     const entry = task.implementation && ctx.state.get(task.implementation.id);
     const claim = ctx.state.startClaim(entryId(task.repo, task.id));
     const candidates = collectCommands(task.context, task.explicitVerifyCommands || []);
     return {
     version: TASK_VERSION, taskId: task.id, revision: task.revision, status: task.status,
-    original: task.original, repo: task.repo, checkout: task.checkout, callerCwd: task.callerCwd || task.checkout, base: task.base, baseSource: task.baseSource, harness: task.harness,
+    original: task.original, fragmentVersion: task.fragmentVersion ?? 1, repo: task.repo, checkout: task.checkout, callerCwd: task.callerCwd || task.checkout, base: task.base, baseSource: task.baseSource, harness: task.harness,
     questions: task.questions, answers: task.answers, requirements: task.requirements,
     assumptions: task.output?.assumptions || [], mapping: task.output?.mapping || [], stories: task.output?.stories || [],
     draft: task.draft ? { path: task.draft.path, hash: task.draft.hash, revision: task.draft.revision, current: task.draft.requirementsHash === contentDigest(JSON.stringify(task.requirements)), text: readText(task.draft.path) } : null,
     readiness: task.readiness, validation: task.validation || null,
     completion: completionView(task.completion, entry, task.ownerDelivery, entry ? executionRunner(ctx, task.implementation.id, entry.harness)?.current?.() : null),
+    deliveryProfile: profileView(task), route: task.route || "harness", modelRoute: routeView(task), cost: costView(task.attempts || []),
+    repositoryContext: task.repositoryContext || null, review: reviewView(task), approval: task.approval || null,
     errorCode: task.errorCode || null,
     implementation: task.implementation ? { ...task.implementation, state: entry?.state || null, pr: entry?.pr || null, url: entry?.url || null } : null, failures: task.failures,
     dispatchRecovery: claim?.clone || null,
@@ -130,7 +203,7 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     sources: task.context.map(c => ({ path: c.path, hash: c.hash })),
     verifyCommands: candidates.commands.map(command => ({ command, sources: candidates.sources[command] || [] })), commandIssues: candidates.issues,
     artifacts: task.draft ? [{ id: "brief", path: task.draft.path, hash: task.draft.hash }, ...task.output.sources.map(path => ({ id: `source:${path}`, path: join(task.draft.root, path), hash: task.context.find(c => c.path === path).hash }))] : [],
-    nextAction: preparationCancellationPending(task) ? "resume the owned cancellation with the current revision; no new preparation or implementation is authorized" : task.status === "needs-input" ? "answer the saved question IDs using the current revision" : task.status === "ready" ? (task.runAuthorized ? "start the approved revision" : "review the draft, then start with explicit run authorization") : task.status === "started" ? "follow the implementation through status, why, and the tracker" : task.status === "blocked" ? (preparationPreflightRetryable(task) ? "resume the current revision to retry the pre-submit provider check; no model job was submitted" : "resolve the reported failure; inspect the saved evidence before retrying") : "resume preparation with the current revision",
+    nextAction: preparationCancellationPending(task) ? "resume the owned cancellation with the current revision; no new preparation or implementation is authorized" : task.status === "needs-input" ? "answer the saved question IDs using the current revision" : task.status === "ready" ? (authorizedStart(task) ? "start the approved revision" : "review the draft, then start with explicit run authorization") : task.status === "started" ? "follow the implementation through status, why, and the tracker" : task.status === "blocked" ? (preparationPreflightRetryable(task) ? "resume the current revision to retry the pre-submit provider check; no model job was submitted" : "resolve the reported failure; inspect the saved evidence before retrying") : "resume preparation with the current revision",
     };
   };
   const requestForTask = task => {
@@ -146,6 +219,18 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     }
     return req;
   };
+  const saveDraft = (task, output) => {
+    task.output = output;
+    task.questions = output.questions;
+    for (const q of output.questions) task.questionHistory[q.id] = q;
+    task.questionMappings = { ...task.questionMappings, ...mappedQuestions(output) };
+    const root = ensureDir(join(taskRoot(ctx.home, task.id), "drafts", `revision-${task.revision + 1}`));
+    for (const c of task.context) writeRepositoryText(root, c.path, c.text);
+    const rel = `docs/prds/${task.id}.md`, text = renderDraft(task, output);
+    writeRepositoryText(root, rel, text);
+    task.draft = { root, path: join(root, rel), hash: contentDigest(text), revision: task.revision + 1, requirementsHash: contentDigest(JSON.stringify(task.requirements)) };
+    task.readiness = null;
+  };
   const savedDraft = task => {
     const req = requestForTask(task);
     if (contentDigest(req.text) !== task.draft.hash) {
@@ -208,7 +293,7 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       const claim = ctx.state.startClaim(id);
       if (claim) return block(task, taskError("TASK_DISPATCH_UNKNOWN", `unresolved start claim for ${id}; inspect ${claim.clone?.worktree ? `its clone at ${claim.clone.worktree}, ` : ""}its run and snapshots before recovery; no duplicate was dispatched`));
       if (task.dispatchIntent) return block(task, taskError("TASK_DISPATCH_UNKNOWN", `dispatch acceptance for ${id} is unknown; inspect its saved artifacts before recovery; no duplicate was dispatched`));
-      if (!task.runAuthorized) throw taskError("TASK_AUTHORIZATION", "start requires explicit run authorization");
+      if (!authorizedStart(task)) throw taskError("TASK_AUTHORIZATION", "review the current revision, then start with explicit --run authorization");
       assertPreparationBoundary(task, ctx);
       const req = savedDraft(task);
       if (task.questions.length || !task.readiness?.allow || task.readiness.hash !== task.draft.hash || task.readiness.digest !== captureStartInput(req, task.base).digest) throw taskError("TASK_NOT_READY", "current revision has unresolved requirements or no exact readiness approval; validate it before starting");
@@ -221,10 +306,16 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
         deliveryAllowance = { budgetUsd: task.allowance.budgetUsd - spent, runtimeMs: task.allowance.runtimeMs - task.attempts.reduce((sum, a) => sum + (a.elapsedMs || 0), 0) };
         if (deliveryAllowance.budgetUsd <= 0 || deliveryAllowance.runtimeMs <= 0) throw taskError("TASK_ALLOWANCE", "Preparation exhausted the task allowance; no implementation was dispatched");
       }
+      // The approval pins the reviewed revision. A separate explicit start
+      // records it for typed tasks; historical tasks retain their saved consent.
+      // Any later material change clears it.
+      const digest = reviewDigest(task);
+      if (task.approval && task.approval.digest !== digest) throw taskError("TASK_CONFLICT", "the approved review revision changed; inspect the current review and approve it again before starting");
+      task.approval ??= { revision: task.revision, digest, draftHash: task.draft.hash, readinessDigest: task.readiness.digest, at: new Date().toISOString() };
       task.dispatchIntent = { id, revision: task.revision, digest: task.readiness.digest, at: new Date().toISOString() };
       store.save(task);
       try {
-        task.implementation = await dispatch(ctx, { path: req.path, request: req, base: task.base, task: { id: task.id, revision: task.revision, digest: task.readiness.digest, baseSource: task.baseSource, ...(task.completion ? { completion: task.completion } : {}), ...(task.ownerDelivery ? { ownerDelivery: task.ownerDelivery } : {}), ...(deliveryAllowance ? { deliveryAllowance } : {}) } });
+        task.implementation = await dispatch(ctx, { path: req.path, request: req, base: task.base, task: { id: task.id, revision: task.revision, digest: task.readiness.digest, baseSource: task.baseSource, ...(task.completion ? { completion: task.completion } : {}), ...(task.ownerDelivery ? { ownerDelivery: task.ownerDelivery } : {}), ...(task.deliveryProfile ? { deliveryProfile: task.deliveryProfile, approval: task.approval } : {}), ...(deliveryAllowance ? { deliveryAllowance } : {}) } });
       } catch (e) {
         if (e.startUncertain === false && !ctx.state.get(id) && !ctx.state.startClaim(id)) task.dispatchIntent = null;
         return block(task, e);
@@ -239,6 +330,11 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     }
     return { ...result(task), daemonError: task.daemonError || null };
   };
+  const assertReadyDraft = task => {
+    if (task.status !== "ready") return;
+    const validation = validateDraft(task, savedDraft(task));
+    if (!validation.ok) throw taskError("TASK_CONFLICT", validation.failures.join("\n"));
+  };
   const prepareInternal = async (task, noDaemon = false) => {
     if (task.status === "started") return startInternal(task, noDaemon);
     // An implementation accepted before this safety change still belongs to its
@@ -247,14 +343,15 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     if (["needs-input", "ready"].includes(task.status)) {
       try { assertPreparationBoundary(task, ctx); }
       catch (e) { return block(task, e); }
-      return task.status === "ready" && task.runAuthorized ? startInternal(task, noDaemon) : result(task);
+      assertReadyDraft(task);
+      return task.status === "ready" && authorizedStart(task) ? startInternal(task, noDaemon) : result(task);
     }
     // A blocked legacy timeout may still own a pending remote stop. An explicit
     // resume reconciles only that control; it cannot retry preparation/refusals.
     if (task.status === "blocked" && !preparationCancellationPending(task)) {
       if (!preparationPreflightRetryable(task)) return result(task);
       task.status = "preparing";
-      task.failures = task.preflightFailure.validationFailures || [];
+      task.failures = task.preflightFailure?.validationFailures || [];
       task.errorCode = null;
       delete task.preflightFailure;
       mutate(task, store);
@@ -266,7 +363,7 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     if (task.status === "validating") {
       try {
         const validated = await validateInternal(task);
-        return task.runAuthorized && validated.readiness?.allow ? await startInternal(task, noDaemon) : validated;
+        return authorizedStart(task) && validated.readiness?.allow ? await startInternal(task, noDaemon) : validated;
       } catch (e) { return block(task, e); }
     }
     // Rebuild inferred candidates on reopen; a legacy cached command is not an
@@ -279,7 +376,15 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
         // Reconcile an already-owned turn before rejecting legacy oversized
         // state, so usage/cleanup survive recovery. Never launch a new turn.
         const previous = task.attempts.at(-1);
-        if (!previous || (previous.settled && previous.consumed)) requireTaskCapacity(task);
+        if (!previous || (previous.settled && previous.consumed)) {
+          requireTaskCapacity(task);
+          assertRepositoryAccess(ctx.capabilitiesFor?.(task.harness) || capabilitiesFor(task.harness), (ctx.hosts ?? hosts).select(task).repository);
+          try { assertImplementationAvailable(task.harness, ctx.capabilitiesFor?.(task.harness) || capabilitiesFor(task.harness)); }
+          catch (error) {
+            if (error.code === "EXECUTION_UNAVAILABLE") task.preflightFailure = { code: error.code, stage: "implementation-availability", attemptCount: task.attempts.length, validationFailures: [...failures] };
+            throw error;
+          }
+        }
         message = await prepare(ctx, task, store, failures);
         if (message === PREPARATION_PENDING) return result(task); // Owned remote preparation is pending.
         if (Array.isArray(ctx.taskSecrets) && message !== redact(message, ctx.taskSecrets)) throw taskError("TASK_SECRET", "Preparation output contains credential material; inspect the private provider record before recovery");
@@ -288,17 +393,7 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       catch (e) { if (e.code === "TASK_INPUT") task.readiness = null; return block(task, e); }
       try {
         const output = parseDraft(message, task);
-        task.output = output;
-        task.questions = output.questions;
-        for (const q of output.questions) task.questionHistory[q.id] = q;
-        task.questionMappings = { ...task.questionMappings, ...mappedQuestions(output) };
-        const root = ensureDir(join(taskRoot(ctx.home, task.id), "drafts", `revision-${task.revision + 1}`));
-        for (const c of task.context) writeRepositoryText(root, c.path, c.text);
-        const rel = `docs/prds/${task.id}.md`;
-        const text = renderDraft(task, output);
-        writeRepositoryText(root, rel, text);
-        task.draft = { root, path: join(root, rel), hash: contentDigest(text), revision: task.revision + 1, requirementsHash: contentDigest(JSON.stringify(task.requirements)) };
-        task.readiness = null;
+        saveDraft(task, output);
         const validation = validateDraft(task, requestForTask(task));
         task.validation = { ok: validation.ok, failures: validation.failures };
         if (output.questions.length) {
@@ -324,31 +419,49 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       try {
         const validated = await validateInternal(task);
         if (!validated.readiness?.allow) return validated;
-        return task.runAuthorized ? await startInternal(task, noDaemon) : validated;
+        return authorizedStart(task) ? await startInternal(task, noDaemon) : validated;
       } catch (e) { return block(task, e); }
     }
   };
   const service = {
     version: TASK_VERSION,
-    capabilities: () => ({ version: TASK_VERSION, providers: executionCapabilities(), completion: COMPLETION_CAPABILITIES }),
+    capabilities: () => ({ version: TASK_VERSION, providers: executionCapabilities(), completion: COMPLETION_CAPABILITIES, delivery: DELIVERY_CAPABILITIES, routes: TASK_ROUTES, modelRoute: intakeModelRouteSummary(ctx.config, ctx.env ?? process.env) }),
     inspect: ({ taskId }) => result(store.read(taskId)),
     list: () => ({ version: TASK_VERSION, tasks: store.list().map(result) }),
-    prepare: async ({ text, dir = process.cwd(), repo = null, base = null, harness = null, context = [], requestId = null, run = false, noDaemon = false, verifyCommands = [], completion }) => {
+    prepare: async ({ text, dir = process.cwd(), repo = null, base = null, harness = null, context = [], requestId = null, run = false, noDaemon = false, verifyCommands = [], completion, delivery, route = null }) => {
       // Capture before any async repository resolution or isolated planning turn.
       // Repository selection can differ from the invocation directory.
       const callerCwd = process.cwd();
       beforeTaskEffects(() => requireText(text, "task request"));
       const selectedCompletion = beforeTaskEffects(() => completionPolicy(completion));
-      const originalRequirements = beforeTaskEffects(() => requireTaskCapacity({ requirements: fragments(text) }));
+      // Typed delivery input is validated before any effect; the resolved
+      // repository and base are bound into the profile once they are known.
+      beforeTaskEffects(() => deliveryProfile(delivery, { completion: completion === undefined ? undefined : selectedCompletion.target, repository: "owner/name", base: "main" }));
+      if (route !== null && !TASK_ROUTES.includes(route)) throw taskRejection("TASK_INPUT", `route must be one of ${TASK_ROUTES.join(", ")}`);
+      // Identity retries may belong to the original line-based fragmenter.
+      // Enforce the legacy floor before repository reads, then apply current
+      // clause limits only after confirming that this identity is new.
+      const capacityVersion = requestId === null ? FRAGMENT_VERSION : 1;
+      const originalRequirements = beforeTaskEffects(() => requireTaskCapacity({ fragmentVersion: capacityVersion, requirements: fragmentsForTask({ fragmentVersion: capacityVersion }, text) }));
       if (requestId !== null) beforeTaskEffects(() => requireText(requestId, "request identity", 256));
       beforeTaskEffects(() => selectedPaths(context)); // Pure path checks precede even legacy identity replay.
       const checkout = await ctx.git.toplevel(resolve(callerCwd, dir));
-      const info = await ctx.gh.repoInfo(checkout);
-      if (!/^[\w.-]+\/[\w.-]+$/.test(info.nameWithOwner)) throw taskRejection("TASK_INPUT", "repository must resolve to owner/name");
+      const info = await hostApi(ctx).repoInfo(checkout);
+      const selectedHost = beforeTaskEffects(() => (ctx.hosts ?? hosts).select(info.nameWithOwner));
       if (repo && repo.toLowerCase() !== info.nameWithOwner.toLowerCase()) throw taskRejection("TASK_CONFLICT", "selected repository does not match the checkout");
       const selected = harness || Object.keys(ctx.config.harness)[0];
-      beforeTaskEffects(() => capabilitiesFor(selected));
+      const capability = beforeTaskEffects(() => ctx.capabilitiesFor?.(selected) || capabilitiesFor(selected));
+      beforeTaskEffects(() => assertRepositoryAccess(capability, selectedHost.repository));
       if (!ctx.config.harness[selected]) throw taskRejection("TASK_INPUT", `harness ${selected} is not configured`);
+      // Route selection: an available harness with a declared preparation
+      // boundary drafts through existing dispatch; otherwise the operator's
+      // configured model route, if enabled. Neither is chosen by request text.
+      const modelRoute = intakeModelRoute(ctx.config, ctx.env ?? process.env);
+      const harnessUsable = Boolean(capability.available && capability.preparation);
+      // Live route availability matters only when a task is created; an exact
+      // retry of a saved task replays below even if the credential is absent now.
+      let selectedRoute = route;
+      if (route === null) selectedRoute = harnessUsable ? "harness" : modelRoute.enabled ? "model" : "harness";
       const selection = beforeTaskEffects(() => resolveBase({ config: ctx.config, repo: info.nameWithOwner, defaultBranch: info.defaultBranch, asked: base }));
       const resolvedBase = selection.base;
       if (!resolvedBase) throw taskRejection("TASK_INPUT", "repository has no resolved base; supply --base");
@@ -357,38 +470,54 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       const id = requestId ? `task-${contentDigest(JSON.stringify([info.nameWithOwner.toLowerCase(), requestId])).slice(0, 24)}` : `task-${randomBytes(12).toString("hex")}`;
       return store.locked(id, async () => {
         // Omitted policy retains legacy request signatures and replay identity.
-        const signature = contentDigest(JSON.stringify({ text, checkout, base: resolvedBase, harness: selected, context, verifyCommands, run, ...(completion === undefined ? {} : { completion: selectedCompletion }) }));
+        const profile = beforeTaskEffects(() => deliveryProfile(delivery, { completion: completion === undefined ? undefined : selectedCompletion.target, repository: info.nameWithOwner, base: resolvedBase }));
+        // Omitted typed inputs retain legacy request signatures and replay identity.
+        const signature = contentDigest(JSON.stringify({ text, checkout, base: resolvedBase, harness: selected, context, verifyCommands, run, ...(completion === undefined ? {} : { completion: selectedCompletion }), ...(delivery === undefined ? {} : { delivery: stableProfile(profile) }), ...(route === null ? {} : { route }) }));
         let task;
         try { task = store.read(id); } catch (e) { if (e.code !== "TASK_NOT_FOUND") throw e; }
         if (task) {
           if (task.signature !== signature) throw taskRejection("TASK_CONFLICT", "request identity already belongs to different input; reopen that task or use a new identity");
+          beforeTaskEffects(() => assertProfileUsable(task));
+          const savedVersion = beforeTaskEffects(() => sourceFragmentVersion(task));
+          if (savedVersion !== capacityVersion) beforeTaskEffects(() => requireTaskCapacity({ fragmentVersion: savedVersion, requirements: fragmentsForTask(task, text) }));
           if (["ready", "needs-input"].includes(task.status)) {
             if (ctx.state.get(entryId(task.repo, task.id))) return startInternal(task, noDaemon);
             try { assertPreparationBoundary(task, ctx); }
             catch (e) { return block(task, e); }
           }
+          assertReadyDraft(task);
           // Retries retain the first accepted path base, including version-1
           // records whose signatures predate callerCwd. Readiness may have been
           // saved just before a crash; honor its already-persisted authorization.
-          return ["preparing", "validating"].includes(task.status) || (task.status === "ready" && task.runAuthorized)
+          return ["preparing", "validating"].includes(task.status) || (task.status === "ready" && authorizedStart(task))
             ? prepareInternal(task, noDaemon) : result(task);
         }
-        // Only new tasks use this ownership version. Saved request identities,
-        // approved drafts and provider receipts retain their original semantics.
-        const delivery = beforeTaskEffects(() => ownerDelivery(text));
-        const requirements = delivery ? ownerImplementation(delivery).flatMap(text => fragments(text)).map((r, i) => ({ ...r, id: `r-${i + 1}` })) : originalRequirements;
-        beforeTaskEffects(() => requireTaskCapacity({ requirements, ...(delivery ? { ownerDelivery: delivery } : {}) }));
+        // Planning cannot make an unavailable implementation transport usable.
+        // Saved results above remain inspectable/replayable without a fresh call.
+        beforeTaskEffects(() => assertImplementationAvailable(selected, capability));
+        if (route === "model" && !modelRoute.enabled) throw taskRejection("TASK_MODEL_ROUTE", `${modelRoute.reason}; no model call was made`);
+        // New tasks use only the typed profile. The free-text ownership
+        // partition is never created here; saved request identities, approved
+        // drafts and provider receipts retain their original semantics.
+        const requirements = capacityVersion === FRAGMENT_VERSION ? originalRequirements : beforeTaskEffects(() => requireTaskCapacity({ fragmentVersion: FRAGMENT_VERSION, requirements: fragments(text) }));
+        beforeTaskEffects(() => requireTaskCapacity({ requirements, deliveryProfile: profile }));
         const selectedFiles = beforeTaskEffects(() => selectedContext(checkout, context, [], ctx.taskSecrets ?? null));
         const explicit = beforeTaskEffects(() => [...explicitCommands(verifyCommands)]);
         const candidates = beforeTaskEffects(() => commandCandidates(selectedFiles, explicit));
+        const repositoryContext = await repositorySnapshot(ctx.git, checkout, { secrets: ctx.taskSecrets ?? [] });
+        // Pin the complete route selection; later turns execute against it and
+        // the review digest covers it, so a configuration change cannot swap the
+        // route under an existing draft. The credential stays in the environment.
+        const pinnedRoute = selectedRoute === "model" ? pinnedModelRoute(modelRoute.route) : null;
         task = {
-          version: TASK_VERSION, id, revision: 1, original: text, signature, requestId,
+          version: TASK_VERSION, fragmentVersion: FRAGMENT_VERSION, id, revision: 1, original: text, signature, requestId,
           checkout, callerCwd, repo: info.nameWithOwner.toLowerCase(), defaultBranch: info.defaultBranch, base: resolvedBase, baseSource: selection.source, harness: selected,
-          context: selectedFiles, explicitVerifyCommands: explicit, commandCandidates: candidates, completion: selectedCompletion,
-          ...(delivery ? { ownerDelivery: delivery } : {}),
+          context: selectedFiles, explicitVerifyCommands: explicit, commandCandidates: candidates, completion: { version: 1, target: profile.completion.condition },
+          deliveryProfile: profile, route: selectedRoute, repositoryContext, approval: null,
+          ...(pinnedRoute ? { modelRoute: pinnedRoute } : {}),
           requirements, answers: {}, questionHistory: {}, questionMappings: {}, questions: [],
           output: null, draft: null, readiness: null, implementation: null, dispatchIntent: null,
-          runAuthorized: run === true, status: "preparing", repairs: 0, attempts: [], failures: [],
+          runAuthorized: false, status: "preparing", repairs: 0, attempts: [], failures: [],
           allowance: { budgetUsd: ctx.config.max_budget_usd, runtimeMs: ctx.config.run_timeout_minutes * 60_000 },
           createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), operations: {},
         };
@@ -399,36 +528,72 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
     answer: async ({ taskId, expectedRevision, answers, operationId, context = [], verifyCommands = [], noDaemon = false }) => store.locked(taskId, async () => {
       const task = store.read(taskId);
       beforeTaskEffects(() => requireText(operationId, "answer operation identity", 256));
-      if (!answers || Array.isArray(answers) || typeof answers !== "object" || !Object.keys(answers).length) throw taskRejection("TASK_INPUT", "answers must map saved question IDs to text");
+      if (!answers || Array.isArray(answers) || typeof answers !== "object") throw taskRejection("TASK_INPUT", "answers must map saved question IDs to text");
+      const answerIds = Object.keys(answers);
+      if (!answerIds.length) throw taskRejection("TASK_INPUT", "answers must map saved question IDs to text");
+      const replayingOperation = Object.hasOwn(task.operations, operationId);
+      const answerCountLimit = replayingOperation ? MAX_LEGACY_ANSWER_COUNT : MAX_ANSWER_COUNT;
+      if (answerIds.length > answerCountLimit) throw taskRejection("TASK_INPUT", `answer batch exceeds ${answerCountLimit} question IDs`);
+      const answerByteLimit = replayingOperation ? MAX_LEGACY_ANSWER_BATCH_BYTES : MAX_ANSWER_BYTES;
+      let answerBytes = 0;
+      const answerEntries = [];
+      for (const id of answerIds) {
+        const value = answers[id];
+        if (typeof value !== "string") {
+          // Saved operations accepted text only, so a non-text retry cannot
+          // match. Preserve its conflict result without serializing the value.
+          if (replayingOperation) throw taskRejection("TASK_CONFLICT", "answer identity already belongs to different answers");
+          throw taskRejection("TASK_INPUT", "answers must map saved question IDs to text");
+        }
+        answerEntries.push([id, value]);
+        answerBytes += Buffer.byteLength(id) + Buffer.byteLength(value);
+        if (answerBytes > answerByteLimit) {
+          const limitDescription = replayingOperation ? "legacy answer operation" : "answer batch";
+          throw taskRejection("TASK_INPUT", `${limitDescription} exceeds ${answerByteLimit} total UTF-8 bytes`);
+        }
+      }
+      // Caller-owned accessors/proxies must not change values after the byte
+      // check. Hash, validate, construct requirements and persist this snapshot.
+      const answerSnapshot = Object.fromEntries(answerEntries);
+      // New over-limit work stops before canonical hashing or semantic parsing.
+      // Existing receipts can replay only within the maximum batch that the old
+      // per-answer limits and question-ID schema could have accepted.
       beforeTaskEffects(() => selectedPaths(context)); // Duplicate answers still never reread accepted files.
       // Retain exact legacy retries; new receipts ignore object member order.
-      const signatureInput = { answers, verifyCommands, ...(context.length ? { context } : {}) };
+      const signatureInput = { answers: answerSnapshot, verifyCommands, ...(context.length ? { context } : {}) };
       const signature = "canonical-v1:" + contentDigest(canonical(JSON.parse(JSON.stringify(signatureInput))));
-      if (Object.hasOwn(task.operations, operationId)) {
+      // An exact replay can resume preparation or dispatch; it needs a usable
+      // saved profile just like a new answer does.
+      beforeTaskEffects(() => assertProfileUsable(task));
+      if (replayingOperation) {
         if (task.operations[operationId] !== signature && task.operations[operationId] !== contentDigest(JSON.stringify(signatureInput))) throw taskRejection("TASK_CONFLICT", "answer identity already belongs to different answers");
-        return ["preparing", "validating"].includes(task.status) || (task.status === "ready" && task.runAuthorized)
+        assertReadyDraft(task);
+        return ["preparing", "validating"].includes(task.status) || (task.status === "ready" && authorizedStart(task))
           ? prepareInternal(task, noDaemon) : result(task);
       }
       expectRevision(task, expectedRevision);
       if (task.status !== "needs-input") throw taskRejection("TASK_CONFLICT", "this intake is not waiting for answers");
+      beforeTaskEffects(() => assertProfileUsable(task));
       beforeTaskEffects(() => assertPreparationBoundary(task, ctx));
       let questionMappings;
       try { questionMappings = questionOwnership(task); }
       catch (e) { throw taskRejection("TASK_CONFLICT", `${e.message}; inspect the saved brief before answering`); }
-      for (const [id, value] of Object.entries(answers)) {
+      for (const [id, value] of answerEntries) {
         beforeTaskEffects(() => requireText(value, `answer ${id}`));
-        beforeTaskEffects(() => assertDeliveryAnswer(task, value));
+        // Legacy free-text contracts keep their saved answer grammar. Typed
+        // tasks screen answer fragments against the profile after drafting.
+        if (task.ownerDelivery || !task.deliveryProfile) beforeTaskEffects(() => assertDeliveryAnswer(task, value));
         if (!task.questions.some(q => q.id === id)) throw taskRejection("TASK_INPUT", `unknown answer identifier ${id}`);
         if (task.answers[id] && task.answers[id] !== value) throw taskRejection("TASK_CONFLICT", `answer ${id} is already accepted`);
       }
-      const requirements = beforeTaskEffects(() => requireTaskCapacity({ ...task, questionMappings, answers: { ...task.answers, ...answers }, requirements: [...task.requirements, ...Object.entries(answers).flatMap(([id, value]) => fragments(value, `a-${id}`))] }));
+      const requirements = beforeTaskEffects(() => requireTaskCapacity({ ...task, questionMappings, answers: { ...task.answers, ...answerSnapshot }, requirements: [...task.requirements, ...answerEntries.flatMap(([id, value]) => fragmentsForTask(task, value, `a-${id}`))] }));
       const selectedFiles = beforeTaskEffects(() => context.length ? selectedContext(task.checkout, context, task.context, ctx.taskSecrets ?? null) : task.context);
       const explicit = beforeTaskEffects(() => [...new Set([...(task.explicitVerifyCommands || []), ...explicitCommands(verifyCommands)])]);
       const candidates = beforeTaskEffects(() => commandCandidates(selectedFiles, explicit));
       // Backfill only ownership proven by a saved unresolved mapping, never by
       // an older question's claimed requirement list alone.
       task.questionMappings = questionMappings;
-      for (const [id, value] of Object.entries(answers)) {
+      for (const [id, value] of answerEntries) {
         task.answers[id] = value;
       }
       task.requirements = requirements;
@@ -441,13 +606,44 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       task.questions = task.questions.filter(q => !task.answers[q.id]);
       task.status = task.questions.length ? "needs-input" : "preparing";
       task.readiness = null;
+      // New material input: the owner reviews the next revision again. For typed
+      // tasks that includes earlier `--run` consent, which covered the revision
+      // the owner saw, not the one an answer will produce. Legacy tasks keep
+      // their documented persisted authorization.
+      task.approval = null;
+      if (task.deliveryProfile) task.runAuthorized = false;
       mutate(task, store);
       return task.status === "preparing" ? prepareInternal(task, noDaemon) : result(task);
     }),
     resume: async ({ taskId, expectedRevision, noDaemon = false }) => store.locked(taskId, async () => {
       const task = store.read(taskId);
       expectRevision(task, expectedRevision);
+      beforeTaskEffects(() => assertProfileUsable(task));
       const id=entryId(task.repo,task.id),entry=ctx.state.get(id);
+      if (!entry && task.status === "needs-input" && task.deliveryProfile && task.questions.some(q => q.id.length > MAX_ANSWER_ID_CHARACTERS)) {
+        // An old pending question may exceed the wire limit. Explicit resume
+        // replaces only proven generated IDs, with no inference or dispatch;
+        // immutable sources, accepted answers and old history remain intact.
+        beforeTaskEffects(() => assertPreparationBoundary(task, ctx));
+        if (task.implementation || task.dispatchIntent || ctx.state.startClaim(id)) throw taskRejection("TASK_CONFLICT", "implementation ownership must be reconciled before replacing a saved question identifier; inspect the saved run and start claim");
+        try { task.questionMappings = questionOwnership(task); }
+        catch (error) { throw taskRejection("TASK_CONFLICT", `${error.message}; inspect the saved brief before resuming`); }
+        const replacements = new Map();
+        for (const q of task.questions.filter(q => q.id.length > MAX_ANSWER_ID_CHARACTERS)) {
+          const requirement = task.requirements.find(r => q.requirements.length === 1 && r.id === q.requirements[0]);
+          if (!requirement || q.id !== `q-delivery-${requirement.id}` || Object.hasOwn(task.answers, q.id)) throw taskRejection("TASK_CONFLICT", "oversized question is not a pending generated delivery question; preserve its history and prepare a new task");
+          replacements.set(q.id, deliveryQuestion(task.deliveryProfile, requirement, task));
+        }
+        const output = parseDraft(JSON.stringify({ ...task.output,
+          questions: task.output.questions.map(q => replacements.get(q.id) || q),
+          mapping: task.output.mapping.map(m => replacements.has(m.questionId) ? { ...m, questionId: replacements.get(m.questionId).id } : m),
+        }), task);
+        saveDraft(task, output);
+        task.approval = null; task.runAuthorized = false;
+        task.validation = { ok: false, failures: ["answer the bounded delivery question on this revision before readiness"] };
+        mutate(task, store);
+        return result(task);
+      }
       if (entry) {
         if (!implementationMatches(task, entry)) throw taskRejection("TASK_CONFLICT", "implementation ownership or completion target differs from the approved intake");
         const runner=executionRunner(ctx,id,task.harness);
@@ -475,17 +671,22 @@ export function createTaskService(ctx, { prepare = prepareTurn, decideReady = re
       if (task.status === "preparing") throw taskRejection("TASK_NOT_READY", "resume preparation with the current revision before validating its draft");
       if (!task.draft) throw taskRejection("TASK_NOT_READY", "no generated draft to validate");
       if (task.status === "started") return result(task);
+      beforeTaskEffects(() => assertProfileUsable(task));
       beforeTaskEffects(() => assertPreparationBoundary(task, ctx));
       return validateInternal(task);
     }),
     start: async ({ taskId, expectedRevision, run = false, noDaemon = false }) => store.locked(taskId, async () => {
       const task = store.read(taskId);
       expectRevision(task, expectedRevision);
+      beforeTaskEffects(() => assertProfileUsable(task));
       if (task.status !== "started" && !ctx.state.get(entryId(task.repo, task.id))) beforeTaskEffects(() => assertPreparationBoundary(task, ctx));
-      if (run === true && !task.runAuthorized) {
+      if (run === true && (!task.runAuthorized || (task.deliveryProfile && !task.approval))) {
         if (task.questions.length || !task.readiness?.allow) throw taskRejection("TASK_NOT_READY", "resolve requirements and validate the current draft before authorizing start");
         const request = savedDraft(task);
-        if (!validateDraft(task, request).ok) throw taskRejection("TASK_CONFLICT", "approved requirements changed; no start authorization was saved");
+        const validation = validateDraft(task, request);
+        if (!validation.ok) throw taskRejection("TASK_CONFLICT", validation.failures.join("\n"));
+        // Explicit approval of exactly this reviewed revision.
+        task.approval = { revision: task.revision, digest: reviewDigest(task), draftHash: task.draft.hash, readinessDigest: task.readiness.digest, at: new Date().toISOString() };
         task.runAuthorized = true; mutate(task, store);
       }
       return startInternal(task, noDaemon);