@xopcai/xopc 0.0.180 → 0.0.188

package/dist/src/gateway/hono/routes/projects.js

@@ -5,30 +5,29 @@ import { listMemoryRecords, upsertMemoryRecord } from "../../../storage/sqlite/m
 import "../../../storage/sqlite/index.js";
 import { ActivityService } from "../../../activity/service.js";
 import "../../../activity/index.js";
-import { buildSessionKey, init_session_key } from "../../../routing/session-key.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
-import { GoalService } from "../../../goals/goal-service.js";
-import "../../../goals/index.js";
-import { WORK_ITEM_ATTACHMENT_MAX_BYTES } from "../../../work-items/work-item-service.js";
-import "../../../work-items/index.js";
-import { OutcomeExecutionService } from "../../../work/outcome-execution-service.js";
+import { TaskRepository } from "../../../tasks/task-repository.js";
+import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../../../projects/workspace-project.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../../projects/project-agent.js";
 import { inferProjectKind } from "../../../projects/project-kind.js";
 import { inferSuggestedProjectDefaultAgentId } from "../../../projects/project-agent-suggestion.js";
 import { buildProjectLoopOverview } from "../../../projects/project-loop.js";
 import "../../../projects/index.js";
-import "../../../work/index.js";
+import { TaskApplicationService } from "../../../tasks/task-application-service.js";
+import { defineTaskContract } from "../../../tasks/task-contract-definition.js";
+import "../../../tasks/index.js";
+import { classifyFileReferenceFsError } from "../../file-reference-errors.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import { parseActivityIncludeRelated, parseActivityQuery } from "./activity.js";
 import { fuzzySearchWorkspaceFiles } from "../../workspace-file-search.js";
 import * as path$1 from "node:path";
+import { randomUUID } from "node:crypto";
 import { readFile, readdir, realpath, stat, writeFile } from "node:fs/promises";
 //#region src/gateway/hono/routes/projects.ts
-init_session_key();
 const log = createGatewayRouteLogger("Projects");
 function parseProjectStatus(raw) {
-	return raw === "active" || raw === "paused" || raw === "archived" ? raw : void 0;
+	return raw === "planned" || raw === "active" || raw === "paused" || raw === "completed" || raw === "cancelled" || raw === "archived" ? raw : void 0;
 }
 function parseLimit(raw, fallback = 50) {
 	if (!raw) return void 0;
@@ -47,6 +46,31 @@ function optionalTextField(body, key) {
 	const value = body[key];
 	return typeof value === "string" ? value : null;
 }
+function stringListField(body, key) {
+	const value = body[key];
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new Error(`${key} must be an array of strings`);
+	return value.map((item) => item.trim()).filter(Boolean);
+}
+function objectField(body, key) {
+	const value = body[key];
+	if (value === void 0) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${key} must be an object`);
+	return value;
+}
+function optionalNumberField(body, key) {
+	const value = body[key];
+	if (value === void 0) return void 0;
+	if (value === null) return null;
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${key} must be a finite number`);
+	return value;
+}
+function projectHealth(value) {
+	return value === "unknown" || value === "on_track" || value === "at_risk" || value === "off_track" ? value : void 0;
+}
+function milestoneStatus(value) {
+	return value === "planned" || value === "active" || value === "completed" || value === "cancelled" ? value : void 0;
+}
 function resolveEffectiveWorkspaceRoot(service, project) {
 	const fixedRoot = project.workspaceRoot?.trim();
 	if (fixedRoot) return fixedRoot;
@@ -64,60 +88,6 @@ function enrichProjectWorkspace(service, project) {
 		effectiveWorkspaceRoot: resolveEffectiveWorkspaceRoot(service, project)
 	};
 }
-function finiteNumberField(value) {
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	if (typeof value === "string" && value.trim()) {
-		const parsed = Number(value);
-		return Number.isFinite(parsed) ? parsed : void 0;
-	}
-}
-function collectUploadedFiles(body) {
-	const raw = body.file ?? body.files ?? body.attachments;
-	return (Array.isArray(raw) ? raw : raw ? [raw] : []).filter((value) => value instanceof File);
-}
-function validateUploadedWorkItemFiles(files) {
-	if (files.length > 10) return `Too many attachments (max 10)`;
-	for (const file of files) if (file.size > 26214400) return `Attachment ${JSON.stringify(file.name || "upload")} exceeds ${Math.floor(WORK_ITEM_ATTACHMENT_MAX_BYTES / (1024 * 1024))}MB limit`;
-	return null;
-}
-async function uploadedFileToBuffer(file) {
-	return {
-		name: file.name || "upload",
-		buffer: Buffer.from(await file.arrayBuffer()),
-		mimeType: file.type || "application/octet-stream"
-	};
-}
-function parseCsvEnum(raw, values) {
-	if (!raw) return void 0;
-	const allowed = new Set(values);
-	const parsed = raw.split(",").map((item) => item.trim()).filter((item) => allowed.has(item));
-	return parsed.length > 0 ? [...new Set(parsed)] : void 0;
-}
-function parseEnumValue(raw, values) {
-	if (typeof raw !== "string") return void 0;
-	return values.includes(raw) ? raw : void 0;
-}
-const WORK_ITEM_STATUSES = [
-	"backlog",
-	"todo",
-	"in_progress",
-	"blocked",
-	"needs_input",
-	"in_review",
-	"done",
-	"cancelled"
-];
-const WORK_ITEM_PRIORITIES = [
-	"urgent",
-	"high",
-	"normal",
-	"low"
-];
-const WORK_ITEM_SUGGESTION_STATUSES = [
-	"pending",
-	"applied",
-	"dismissed"
-];
 const SKIP_FILE_NAMES = new Set([".git", "node_modules"]);
 const PROJECT_FILE_MIME_BY_EXT = {
 	png: "image/png",
@@ -308,36 +278,6 @@ function buildSessionSummaryMemoryContent(sessionKey, explicitSummary) {
 	}).filter(Boolean);
 	return lines.length > 0 ? [`Session summary for ${sessionKey}:`, ...lines].join("\n") : `Session summary for ${sessionKey}: no transcript content available.`;
 }
-function buildWorkItemChatSessionMetadata(params) {
-	return {
-		name: params.title,
-		tags: ["work-item"],
-		sourceChannel: "webchat",
-		sourceChatId: [
-			params.accountId,
-			"direct",
-			params.peerId
-		].join(":"),
-		sessionType: "chat",
-		hiddenFromSessionList: true,
-		routing: {
-			agentId: params.agentId,
-			source: "webchat",
-			accountId: params.accountId,
-			peerKind: "direct",
-			peerId: params.peerId
-		},
-		customData: {
-			genericNewChatShell: false,
-			sourceBinding: {
-				kind: "work_item",
-				sourceId: params.workItemId,
-				version: String(params.updatedAt),
-				attachedAt: Date.now()
-			}
-		}
-	};
-}
 function listFailedProjectWorkflowRuns(projectId, limit = 5) {
 	return getSqliteDatabase().prepare(`SELECT run_id, definition_id, status, created_at_ms, error_message
        FROM workflow_runs
@@ -373,8 +313,6 @@ function projectDigestMemoryRecordId(projectId) {
 function registerProjectsRoutes(authenticated, deps) {
 	const { service } = deps;
 	const activity = new ActivityService();
-	const goals = new GoalService();
-	const workItems = service.workItems;
 	authenticated.post("/api/projects", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const name = textField(body, "name")?.trim();
@@ -405,7 +343,14 @@ function registerProjectsRoutes(authenticated, deps) {
 				createWorkspaceRoot: body.createWorkspaceRoot === true,
 				projectKind: textField(body, "projectKind"),
 				brief: textField(body, "brief"),
-				instructions: textField(body, "instructions")
+				instructions: textField(body, "instructions"),
+				outcome: textField(body, "outcome"),
+				successCriteria: stringListField(body, "successCriteria"),
+				scope: objectField(body, "scope"),
+				nonGoals: stringListField(body, "nonGoals"),
+				health: projectHealth(body.health),
+				ownerId: textField(body, "ownerId"),
+				targetAt: optionalNumberField(body, "targetAt") ?? void 0
 			});
 			return c.json({
 				ok: true,
@@ -545,480 +490,6 @@ function registerProjectsRoutes(authenticated, deps) {
 			...result
 		});
 	});
-	authenticated.get("/api/projects/:id/work-items", async (c) => {
-		const project = service.projects.get(c.req.param("id"));
-		if (!project) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		const result = workItems.listProjectWorkItems(project.id, {
-			status: parseCsvEnum(c.req.query("status"), WORK_ITEM_STATUSES),
-			priority: parseCsvEnum(c.req.query("priority"), WORK_ITEM_PRIORITIES),
-			includeArchived: c.req.query("includeArchived") === "true",
-			search: c.req.query("search"),
-			sortBy: c.req.query("sortBy"),
-			sortOrder: c.req.query("sortOrder"),
-			limit: parseLimit(c.req.query("limit")),
-			offset: c.req.query("offset") ? Math.max(0, Number.parseInt(c.req.query("offset"), 10) || 0) : void 0
-		});
-		return c.json({
-			ok: true,
-			...result
-		});
-	});
-	authenticated.post("/api/projects/:id/work-items", async (c) => {
-		const project = service.projects.get(c.req.param("id"));
-		if (!project) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		const contentType = c.req.header("content-type") || "";
-		let body;
-		let files = [];
-		if (contentType.includes("multipart/form-data")) {
-			try {
-				body = await c.req.parseBody({ all: true });
-			} catch {
-				return c.json({
-					ok: false,
-					error: "Invalid multipart body"
-				}, 400);
-			}
-			files = collectUploadedFiles(body);
-		} else body = await c.req.json().catch(() => ({}));
-		const attachmentError = validateUploadedWorkItemFiles(files);
-		if (attachmentError) return c.json({
-			ok: false,
-			error: attachmentError
-		}, 413);
-		const title = textField(body, "title")?.trim();
-		if (!title) return c.json({
-			ok: false,
-			error: "Work item title is required"
-		}, 400);
-		const status = parseEnumValue(body.status, WORK_ITEM_STATUSES);
-		const priority = parseEnumValue(body.priority, WORK_ITEM_PRIORITIES);
-		const dueAt = finiteNumberField(body.dueAt);
-		if (Object.hasOwn(body, "status") && !status) return c.json({
-			ok: false,
-			error: "Invalid work item status"
-		}, 400);
-		if (Object.hasOwn(body, "priority") && !priority) return c.json({
-			ok: false,
-			error: "Invalid work item priority"
-		}, 400);
-		if (Object.hasOwn(body, "dueAt") && dueAt === void 0 && body.dueAt !== null) return c.json({
-			ok: false,
-			error: "Invalid dueAt"
-		}, 400);
-		const uploads = [];
-		for (const file of files) uploads.push(await uploadedFileToBuffer(file));
-		const item = workItems.createProjectWorkItem(project.id, {
-			title,
-			description: textField(body, "description"),
-			status,
-			priority,
-			ownerAgentId: textField(body, "ownerAgentId") || project.defaultAgentId || void 0,
-			nextAction: textField(body, "nextAction"),
-			blockedReason: textField(body, "blockedReason"),
-			dueAt
-		});
-		for (const upload of uploads) await workItems.addAttachment(item.id, upload);
-		const created = files.length > 0 ? workItems.getWorkItem(item.id) ?? item : item;
-		return c.json({
-			ok: true,
-			item: created
-		}, 201);
-	});
-	authenticated.get("/api/work-items", (c) => {
-		const result = workItems.listWorkItems({
-			status: parseCsvEnum(c.req.query("status"), WORK_ITEM_STATUSES),
-			priority: parseCsvEnum(c.req.query("priority"), WORK_ITEM_PRIORITIES),
-			includeArchived: c.req.query("includeArchived") === "true",
-			search: c.req.query("search"),
-			sortBy: c.req.query("sortBy"),
-			sortOrder: c.req.query("sortOrder"),
-			limit: parseLimit(c.req.query("limit")),
-			offset: c.req.query("offset") ? Math.max(0, Number.parseInt(c.req.query("offset"), 10) || 0) : void 0
-		});
-		return c.json({
-			ok: true,
-			...result
-		});
-	});
-	authenticated.get("/api/work-items/:id", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			item
-		});
-	});
-	authenticated.get("/api/work-items/:id/attachments", async (c) => {
-		const attachments = workItems.listAttachments(c.req.param("id"));
-		if (!attachments) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			attachments
-		});
-	});
-	authenticated.post("/api/work-items/:id/attachments", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		let body;
-		try {
-			body = await c.req.parseBody({ all: true });
-		} catch {
-			return c.json({
-				ok: false,
-				error: "Invalid multipart body"
-			}, 400);
-		}
-		const files = collectUploadedFiles(body);
-		if (!files.length) return c.json({
-			ok: false,
-			error: "Missing file field"
-		}, 400);
-		const attachmentError = validateUploadedWorkItemFiles(files);
-		if (attachmentError) return c.json({
-			ok: false,
-			error: attachmentError
-		}, 413);
-		const attachments = [];
-		for (const file of files) {
-			const upload = await uploadedFileToBuffer(file);
-			const attachment = await workItems.addAttachment(item.id, upload);
-			if (attachment) attachments.push(attachment);
-		}
-		return c.json({
-			ok: true,
-			attachments,
-			item: workItems.getWorkItem(item.id)
-		}, 201);
-	});
-	authenticated.get("/api/work-items/:id/attachments/:attachmentId/content", async (c) => {
-		const result = await workItems.readAttachment(c.req.param("id"), c.req.param("attachmentId"));
-		if (!result) return c.json({
-			ok: false,
-			error: "Attachment not found"
-		}, 404);
-		return new Response(result.buffer, { headers: {
-			"Content-Type": result.attachment.mimeType,
-			"Content-Length": String(result.attachment.size),
-			"Content-Disposition": `inline; filename="${encodeURIComponent(result.attachment.fileName)}"`,
-			"Cache-Control": "private, max-age=31536000, immutable"
-		} });
-	});
-	authenticated.delete("/api/work-items/:id/attachments/:attachmentId", async (c) => {
-		const attachment = await workItems.removeAttachment(c.req.param("id"), c.req.param("attachmentId"));
-		if (!attachment) return c.json({
-			ok: false,
-			error: "Attachment not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			attachment,
-			item: workItems.getWorkItem(c.req.param("id"))
-		});
-	});
-	authenticated.patch("/api/work-items/:id", async (c) => {
-		const body = await c.req.json().catch(() => ({}));
-		const status = Object.hasOwn(body, "status") ? parseEnumValue(body.status, WORK_ITEM_STATUSES) : void 0;
-		const priority = Object.hasOwn(body, "priority") ? parseEnumValue(body.priority, WORK_ITEM_PRIORITIES) : void 0;
-		const dueAt = Object.hasOwn(body, "dueAt") ? body.dueAt === null ? null : typeof body.dueAt === "number" && Number.isFinite(body.dueAt) ? body.dueAt : void 0 : void 0;
-		const archivedAt = Object.hasOwn(body, "archivedAt") ? body.archivedAt === null ? null : typeof body.archivedAt === "number" && Number.isFinite(body.archivedAt) ? body.archivedAt : void 0 : void 0;
-		if (status === void 0 && Object.hasOwn(body, "status")) return c.json({
-			ok: false,
-			error: "Invalid work item status"
-		}, 400);
-		if (priority === void 0 && Object.hasOwn(body, "priority")) return c.json({
-			ok: false,
-			error: "Invalid work item priority"
-		}, 400);
-		if (dueAt === void 0 && Object.hasOwn(body, "dueAt")) return c.json({
-			ok: false,
-			error: "Invalid dueAt"
-		}, 400);
-		if (archivedAt === void 0 && Object.hasOwn(body, "archivedAt")) return c.json({
-			ok: false,
-			error: "Invalid archivedAt"
-		}, 400);
-		const item = workItems.updateWorkItem(c.req.param("id"), {
-			...Object.hasOwn(body, "title") ? { title: textField(body, "title") ?? "" } : {},
-			...Object.hasOwn(body, "description") ? { description: optionalTextField(body, "description") } : {},
-			...Object.hasOwn(body, "status") ? { status } : {},
-			...Object.hasOwn(body, "priority") ? { priority } : {},
-			...Object.hasOwn(body, "ownerAgentId") ? { ownerAgentId: optionalTextField(body, "ownerAgentId") } : {},
-			...Object.hasOwn(body, "nextAction") ? { nextAction: optionalTextField(body, "nextAction") } : {},
-			...Object.hasOwn(body, "blockedReason") ? { blockedReason: optionalTextField(body, "blockedReason") } : {},
-			...Object.hasOwn(body, "dueAt") ? { dueAt } : {},
-			...Object.hasOwn(body, "archivedAt") ? { archivedAt } : {}
-		});
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			item
-		});
-	});
-	authenticated.delete("/api/work-items/:id", async (c) => {
-		const item = workItems.updateWorkItem(c.req.param("id"), { archivedAt: Date.now() });
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			item
-		});
-	});
-	authenticated.get("/api/work-items/:id/events", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			events: workItems.listEvents(item.id)
-		});
-	});
-	authenticated.get("/api/work-items/:id/update-suggestions", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		const status = parseEnumValue(c.req.query("status"), WORK_ITEM_SUGGESTION_STATUSES);
-		if (c.req.query("status") && !status) return c.json({
-			ok: false,
-			error: "Invalid suggestion status"
-		}, 400);
-		return c.json({
-			ok: true,
-			suggestions: workItems.listUpdateSuggestions(item.id, status)
-		});
-	});
-	authenticated.post("/api/work-items/:id/update-suggestions", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		const body = await c.req.json().catch(() => ({}));
-		const sourceKind = parseEnumValue(body.sourceKind, [
-			"chat",
-			"goal",
-			"workflow_run",
-			"automation"
-		]);
-		const sourceId = textField(body, "sourceId")?.trim();
-		if (!sourceKind) return c.json({
-			ok: false,
-			error: "Invalid sourceKind"
-		}, 400);
-		if (!sourceId) return c.json({
-			ok: false,
-			error: "sourceId is required"
-		}, 400);
-		const patchBody = body.patch && typeof body.patch === "object" && !Array.isArray(body.patch) ? body.patch : {};
-		const status = Object.hasOwn(patchBody, "status") ? parseEnumValue(patchBody.status, WORK_ITEM_STATUSES) : void 0;
-		if (Object.hasOwn(patchBody, "status") && !status) return c.json({
-			ok: false,
-			error: "Invalid work item status"
-		}, 400);
-		const confidence = typeof body.confidence === "number" && Number.isFinite(body.confidence) ? Math.max(0, Math.min(1, body.confidence)) : void 0;
-		const suggestion = workItems.createUpdateSuggestion(item.id, {
-			sourceKind,
-			sourceId,
-			patch: {
-				...Object.hasOwn(patchBody, "status") ? { status } : {},
-				...Object.hasOwn(patchBody, "nextAction") ? { nextAction: optionalTextField(patchBody, "nextAction") } : {},
-				...Object.hasOwn(patchBody, "blockedReason") ? { blockedReason: optionalTextField(patchBody, "blockedReason") } : {}
-			},
-			progressNote: optionalTextField(body, "progressNote") ?? void 0,
-			rationale: optionalTextField(body, "rationale") ?? void 0,
-			confidence
-		});
-		if (!suggestion) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			suggestion
-		}, 201);
-	});
-	authenticated.post("/api/work-item-update-suggestions/:id/apply", async (c) => {
-		const result = workItems.applyUpdateSuggestion(c.req.param("id"));
-		if (!result) return c.json({
-			ok: false,
-			error: "Suggestion not found or already resolved"
-		}, 404);
-		return c.json({
-			ok: true,
-			item: result.item,
-			suggestion: result.suggestion
-		});
-	});
-	authenticated.post("/api/work-item-update-suggestions/:id/dismiss", async (c) => {
-		const suggestion = workItems.dismissUpdateSuggestion(c.req.param("id"));
-		if (!suggestion) return c.json({
-			ok: false,
-			error: "Suggestion not found or already resolved"
-		}, 404);
-		return c.json({
-			ok: true,
-			suggestion
-		});
-	});
-	authenticated.post("/api/work-items/:id/start-chat", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		const project = service.projects.get(item.projectId);
-		if (!project) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		const agentId = resolveProjectAgentId({
-			config: service.currentConfig,
-			projects: service.projects,
-			explicitAgentId: item.ownerAgentId,
-			projectId: project.id
-		});
-		const peerId = `work_item_${Date.now()}`;
-		const sessionKey = buildSessionKey({
-			agentId,
-			source: "webchat",
-			accountId: "default",
-			peerKind: "direct",
-			peerId
-		});
-		await service.sessionIndexInstance.saveMessages(sessionKey, [], { metadata: buildWorkItemChatSessionMetadata({
-			agentId,
-			accountId: "default",
-			peerId,
-			workItemId: item.id,
-			title: item.title,
-			updatedAt: item.updatedAt
-		}) });
-		service.projects.attachSession(sessionKey, project.id);
-		const session = await service.sessions.getSession(sessionKey);
-		workItems.addLink(item.id, {
-			kind: "chat",
-			targetId: sessionKey,
-			title: session?.name || item.title,
-			statusSnapshot: session?.status
-		}, "chat_started");
-		const updated = item.status === "todo" || item.status === "backlog" ? workItems.updateWorkItem(item.id, { status: "in_progress" }) : workItems.getWorkItem(item.id);
-		return c.json({
-			ok: true,
-			session,
-			item: updated
-		}, 201);
-	});
-	authenticated.post("/api/work-items/:id/workflows/run", async (c) => {
-		const item = workItems.getWorkItem(c.req.param("id"));
-		if (!item) return c.json({
-			ok: false,
-			error: "Work item not found"
-		}, 404);
-		const project = service.projects.get(item.projectId);
-		if (!project) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		if (item.status === "done" || item.status === "cancelled" || item.archivedAt) return c.json({
-			ok: false,
-			error: "Work item is not active"
-		}, 409);
-		const body = await c.req.json().catch(() => ({}));
-		const definitionId = textField(body, "definitionId")?.trim();
-		if (!definitionId) return c.json({
-			ok: false,
-			error: "Missing definitionId"
-		}, 400);
-		const agentId = resolveProjectAgentId({
-			config: service.currentConfig,
-			projects: service.projects,
-			explicitAgentId: item.ownerAgentId,
-			projectId: project.id
-		});
-		const goalText = textField(body, "goal")?.trim() || item.nextAction || item.title;
-		const attachments = item.attachments?.map((attachment) => ({
-			id: attachment.id,
-			fileName: attachment.fileName,
-			type: attachment.type,
-			mimeType: attachment.mimeType,
-			size: attachment.size
-		}));
-		const input = Object.hasOwn(body, "input") ? body.input : {
-			workItem: {
-				id: item.id,
-				title: item.title,
-				description: item.description,
-				status: item.status,
-				priority: item.priority,
-				nextAction: item.nextAction,
-				blockedReason: item.blockedReason,
-				attachments
-			},
-			project: {
-				id: project.id,
-				name: project.name,
-				description: project.description,
-				brief: project.brief,
-				instructions: project.instructions,
-				workspaceRoot: project.workspaceRoot
-			}
-		};
-		const rawTokenBudget = body.tokenBudget;
-		const tokenBudget = rawTokenBudget === null ? null : typeof rawTokenBudget === "number" && Number.isFinite(rawTokenBudget) ? rawTokenBudget : void 0;
-		const result = await service.createWorkflowRunService().startWorkflowRun({
-			agentId,
-			definitionId,
-			projectId: project.id,
-			workItemId: item.id,
-			goal: goalText,
-			input,
-			source: { kind: "webui" },
-			concurrency: finiteNumberField(body.concurrency),
-			maxSubagents: finiteNumberField(body.maxSubagents),
-			tokenBudget
-		});
-		if (result.ok === false) return c.json({
-			ok: false,
-			error: result.message,
-			code: result.code
-		}, result.httpStatus);
-		workItems.addLink(item.id, {
-			kind: "workflow_run",
-			targetId: result.runId,
-			title: goalText,
-			statusSnapshot: "queued"
-		}, "workflow_started");
-		const updated = item.status === "todo" || item.status === "backlog" ? workItems.updateWorkItem(item.id, { status: "in_progress" }) : workItems.getWorkItem(item.id);
-		return c.json({
-			ok: true,
-			runId: result.runId,
-			sessionKey: result.sessionKey,
-			item: updated
-		}, 202);
-	});
 	authenticated.post("/api/projects/:id/digest-memory", async (c) => {
 		const project = service.projects.getWithDetails(c.req.param("id"));
 		if (!project) return c.json({
@@ -1027,7 +498,18 @@ function registerProjectsRoutes(authenticated, deps) {
 		}, 404);
 		const loop = buildProjectLoopOverview({
 			project,
-			goals: service.projects.listGoalIds(project.id, 100).map((id) => goals.get(id)).filter((goal) => Boolean(goal)),
+			tasks: new TaskRepository().listByProject(project.id, 100).map((task) => {
+				const model = new TaskReadModelProjector().project(task);
+				return {
+					id: task.id,
+					title: task.title,
+					phase: task.phase,
+					operationalState: model.operationalState,
+					attention: model.attention.map((item) => item.summary),
+					priority: task.priority,
+					updatedAt: task.updatedAt
+				};
+			}),
 			recentWorkflowRuns: project.recentWorkflowRuns,
 			failedWorkflowRuns: listFailedProjectWorkflowRuns(project.id),
 			memoryRecords: listMemoryRecords({
@@ -1079,26 +561,51 @@ function registerProjectsRoutes(authenticated, deps) {
 			error: "Missing title"
 		}, 400);
 		const reason = typeof body.reason === "string" ? body.reason.trim() : "";
-		const goal = new OutcomeExecutionService().create({
-			objective: title,
-			description: reason || void 0,
-			agentId: resolveProjectAgentId({
-				config: service.currentConfig,
-				projects: service.projects,
-				projectId: project.id
-			}),
-			priority: body.priority === "low" || body.priority === "normal" || body.priority === "high" ? body.priority : "high",
-			source: "api",
+		const agentId = resolveProjectAgentId({
+			config: service.currentConfig,
+			projects: service.projects,
 			projectId: project.id
-		}).goal;
-		const blocked = goals.setStatus(goal.id, "blocked", { reason: reason || title });
-		if (reason) goals.setContextMessage({
-			goalId: goal.id,
-			text: reason
+		});
+		const contract = defineTaskContract(title);
+		const created = new TaskApplicationService().create({
+			idempotencyKey: randomUUID(),
+			title,
+			projectId: project.id,
+			delegateAgentId: agentId,
+			priority: body.priority === "low" || body.priority === "normal" || body.priority === "high" ? body.priority : "high",
+			contract: {
+				...contract,
+				acceptancePolicy: "manual",
+				outputDestinations: []
+			},
+			dependencies: [],
+			context: [],
+			authorityGrants: [],
+			activation: {
+				mode: "capture",
+				phase: "ready"
+			}
+		});
+		if (created.ok === false) return c.json({
+			ok: false,
+			error: created.reason
+		}, 409);
+		const blocked = new TaskApplicationService().execute({
+			taskId: created.model.task.id,
+			expectedVersion: created.model.task.version,
+			idempotencyKey: randomUUID(),
+			command: {
+				type: "add_wait",
+				wait: {
+					kind: "paused",
+					reason: reason || title,
+					condition: {}
+				}
+			}
 		});
 		return c.json({
 			ok: true,
-			blocker: blocked ?? goals.get(goal.id)
+			blocker: blocked.ok ? blocked.model : created.model
 		}, 201);
 	});
 	authenticated.post("/api/projects/:id/pin", async (c) => {
@@ -1140,11 +647,130 @@ function registerProjectsRoutes(authenticated, deps) {
 			project: enrichProjectWorkspace(service, project)
 		});
 	});
+	authenticated.get("/api/projects/:id/milestones", (c) => {
+		const project = service.projects.get(c.req.param("id"));
+		if (!project) return c.json({
+			ok: false,
+			error: "Project not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			items: service.projects.listMilestones(project.id)
+		});
+	});
+	authenticated.post("/api/projects/:id/milestones", async (c) => {
+		const body = await c.req.json().catch(() => ({}));
+		const title = textField(body, "title")?.trim();
+		if (!title) return c.json({
+			ok: false,
+			error: "Missing title"
+		}, 400);
+		if (body.status !== void 0 && !milestoneStatus(body.status)) return c.json({
+			ok: false,
+			error: "Invalid milestone status"
+		}, 400);
+		try {
+			const milestone = service.projects.createMilestone(c.req.param("id"), {
+				title,
+				description: textField(body, "description"),
+				status: milestoneStatus(body.status),
+				targetAt: optionalNumberField(body, "targetAt") ?? void 0,
+				sortOrder: optionalNumberField(body, "sortOrder") ?? void 0
+			});
+			return c.json({
+				ok: true,
+				milestone
+			}, 201);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.patch("/api/projects/:id/milestones/:milestoneId", async (c) => {
+		const body = await c.req.json().catch(() => ({}));
+		if (body.status !== void 0 && !milestoneStatus(body.status)) return c.json({
+			ok: false,
+			error: "Invalid milestone status"
+		}, 400);
+		try {
+			const milestone = service.projects.updateMilestone(c.req.param("id"), c.req.param("milestoneId"), {
+				...textField(body, "title") !== void 0 ? { title: textField(body, "title") } : {},
+				...optionalTextField(body, "description") !== void 0 ? { description: optionalTextField(body, "description") } : {},
+				...body.status !== void 0 ? { status: milestoneStatus(body.status) } : {},
+				...body.targetAt !== void 0 ? { targetAt: optionalNumberField(body, "targetAt") } : {},
+				...body.sortOrder !== void 0 ? { sortOrder: optionalNumberField(body, "sortOrder") } : {}
+			});
+			return c.json({
+				ok: true,
+				milestone
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 404);
+		}
+	});
+	authenticated.delete("/api/projects/:id/milestones/:milestoneId", (c) => {
+		return service.projects.deleteMilestone(c.req.param("id"), c.req.param("milestoneId")) ? c.json({ ok: true }) : c.json({
+			ok: false,
+			error: "Milestone not found"
+		}, 404);
+	});
+	authenticated.get("/api/projects/:id/updates", (c) => {
+		const project = service.projects.get(c.req.param("id"));
+		if (!project) return c.json({
+			ok: false,
+			error: "Project not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			items: service.projects.listUpdates(project.id, parseLimit(c.req.query("limit"), 20))
+		});
+	});
+	authenticated.post("/api/projects/:id/updates", async (c) => {
+		const body = await c.req.json().catch(() => ({}));
+		const summary = textField(body, "summary")?.trim();
+		const health = projectHealth(body.health);
+		if (!summary || !health) return c.json({
+			ok: false,
+			error: "Missing summary or valid health"
+		}, 400);
+		try {
+			const update = service.projects.createUpdate(c.req.param("id"), {
+				health,
+				summary,
+				progress: stringListField(body, "progress"),
+				risks: stringListField(body, "risks"),
+				nextSteps: stringListField(body, "nextSteps"),
+				actor: objectField(body, "actor") ?? { kind: "user" }
+			});
+			return c.json({
+				ok: true,
+				update
+			}, 201);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
 	authenticated.patch("/api/projects/:id", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const status = parseProjectStatus(body.status);
 		const defaultAgentPatch = optionalTextField(body, "defaultAgentId");
 		const defaultAgentId = defaultAgentPatch === void 0 ? void 0 : normalizeProjectAgentId(defaultAgentPatch);
+		if (body.status !== void 0 && !status) return c.json({
+			ok: false,
+			error: "Invalid project status"
+		}, 400);
+		if (body.health !== void 0 && !projectHealth(body.health)) return c.json({
+			ok: false,
+			error: "Invalid project health"
+		}, 400);
 		if (defaultAgentId && !isValidProjectAgentId(service.currentConfig, defaultAgentId)) return c.json({
 			ok: false,
 			error: "Default agent not found"
@@ -1158,7 +784,14 @@ function registerProjectsRoutes(authenticated, deps) {
 				...optionalTextField(body, "workspaceRoot") !== void 0 ? { workspaceRoot: optionalTextField(body, "workspaceRoot") } : {},
 				createWorkspaceRoot: body.createWorkspaceRoot === true,
 				...optionalTextField(body, "brief") !== void 0 ? { brief: optionalTextField(body, "brief") } : {},
-				...optionalTextField(body, "instructions") !== void 0 ? { instructions: optionalTextField(body, "instructions") } : {}
+				...optionalTextField(body, "instructions") !== void 0 ? { instructions: optionalTextField(body, "instructions") } : {},
+				...optionalTextField(body, "outcome") !== void 0 ? { outcome: optionalTextField(body, "outcome") } : {},
+				...body.successCriteria !== void 0 ? { successCriteria: stringListField(body, "successCriteria") } : {},
+				...body.scope !== void 0 ? { scope: objectField(body, "scope") } : {},
+				...body.nonGoals !== void 0 ? { nonGoals: stringListField(body, "nonGoals") } : {},
+				...body.health !== void 0 ? { health: projectHealth(body.health) } : {},
+				...optionalTextField(body, "ownerId") !== void 0 ? { ownerId: optionalTextField(body, "ownerId") } : {},
+				...body.targetAt !== void 0 ? { targetAt: optionalNumberField(body, "targetAt") } : {}
 			});
 			return c.json({
 				ok: true,
@@ -1364,6 +997,7 @@ function registerProjectsRoutes(authenticated, deps) {
 			}
 		}, resolved.status);
 		let st = null;
+		let statError = null;
 		let absolutePath = resolved.absolutePath;
 		try {
 			absolutePath = await realpath(resolved.absolutePath);
@@ -1375,22 +1009,41 @@ function registerProjectsRoutes(authenticated, deps) {
 				}
 			}, 400);
 			st = await stat(absolutePath);
-		} catch {
-			st = null;
+		} catch (err) {
+			statError = err;
 		}
 		const displayName = path$1.basename(rawPath);
-		if (!st) return c.json({
-			ok: true,
-			payload: {
-				inputPath: rawPath,
-				displayName,
-				scope: "missing",
-				exists: false,
-				absolutePath: resolved.absolutePath,
-				capabilities: ["copyPath"],
-				errorCode: "FILE_NOT_FOUND"
+		if (!st) {
+			const failure = classifyFileReferenceFsError(statError);
+			if (failure.code !== "FILE_NOT_FOUND") {
+				log.warn({
+					err: statError,
+					projectId: resolved.projectId,
+					workspaceRoot: resolved.root,
+					candidate: resolved.absolutePath,
+					errorCode: failure.code
+				}, `Project file reference access failed: ${failure.message}`);
+				return c.json({
+					ok: false,
+					error: {
+						code: failure.code,
+						message: failure.message
+					}
+				}, failure.status === 403 ? 403 : 500);
 			}
-		});
+			return c.json({
+				ok: true,
+				payload: {
+					inputPath: rawPath,
+					displayName,
+					scope: "missing",
+					exists: false,
+					absolutePath: resolved.absolutePath,
+					capabilities: ["copyPath"],
+					errorCode: "FILE_NOT_FOUND"
+				}
+			});
+		}
 		return c.json({
 			ok: true,
 			payload: {