@yeaft/webchat-agent 1.0.531 → 1.0.532

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.531",
+  "version": "1.0.532",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/work-center/bridge.js

@@ -20,7 +20,7 @@ let shutdownPromise = null;
 let serviceFactory = null;
 
 const BROWSER_DETAIL_OPS = new Set([
-  'get', 'create', 'update', 'start', 'cancel', 'resume', 'post_work_item_message', 'action_input', 'retry_action', 'guide', 'retry',
+  'get', 'create', 'update', 'start', 'cancel', 'resume', 'extend_budget', 'post_work_item_message', 'action_input', 'retry_action', 'guide', 'retry',
 ]);
 const BROWSER_ACTION_DEBUG_OPS = new Set(['get_action_messages', 'get_action_requests', 'get_action_request']);
 // `files` is an internal server-to-Agent field. The browser relay rejects any
@@ -39,7 +39,8 @@ const BROWSER_FILE_FIELDS = Object.freeze({
   ],
   action_input: ['id', 'text', 'actionId', 'revision', 'generation', 'quote', 'files'],
   retry_action: ['id', 'actionId', 'revision', 'generation'],
-  resume: ['id', 'revision'],
+  resume: ['id', 'revision', 'executionControlRevision'],
+  extend_budget: ['id', 'executionControlRevision', 'additions'],
   delete: ['id', 'revision'],
   guide: ['id', 'guidance', 'actionId', 'revision', 'generation', 'files'],
   get_action_messages: ['id', 'actionId', 'generation', 'cursor', 'limit'],

package/yeaft/work-center/capabilities.js

@@ -0,0 +1,44 @@
+/**
+ * Work Center reuses builtin tool implementations, but owns their lifecycle.
+ * Keep the executable subset and the Coordinator's capability description in
+ * one place. This is a host policy, not a claim that shell/MCP is sandboxed.
+ */
+export const WORK_ITEM_TOOL_NAMES = Object.freeze([
+  'FileRead', 'FileWrite', 'FileEdit', 'ApplyPatch', 'Glob', 'Grep',
+  'ListDir', 'Bash', 'WebSearch', 'WebFetch', 'ViewImage', 'Skill',
+]);
+
+export function workItemBuiltinToolNames(hasAttachments = false) {
+  return WORK_ITEM_TOOL_NAMES.filter(name => !hasAttachments || name !== 'Bash');
+}
+
+/** Only identities/roles needed for assignment, never VP souls or credentials. */
+export function workItemCapabilityContext(vps = [], { hasAttachments = false } = {}) {
+  const bounded = (value, limit) => typeof value === 'string' ? value.slice(0, limit) : '';
+  const selected = [];
+  for (const vp of vps.slice(0, 48)) {
+    // An id must round-trip to the registry; never offer a truncated identity.
+    if (typeof vp.id !== 'string' || !vp.id || vp.id.length > 128) continue;
+    const candidate = {
+      id: vp.id,
+      name: bounded(vp.name, 120),
+      role: bounded(vp.role, 200),
+      traits: (Array.isArray(vp.traits) ? vp.traits : []).slice(0, 8).map(value => bounded(value, 80)),
+    };
+    if (Buffer.byteLength(JSON.stringify([...selected, candidate]), 'utf8') > 8 * 1024) break;
+    selected.push(candidate);
+  }
+  return {
+    executor: 'yeaft-engine',
+    tools: workItemBuiltinToolNames(hasAttachments),
+    vps: selected,
+    omittedVpCount: Math.max(0, vps.length - selected.length),
+    mcp: 'Workspace-configured MCP tools are resolved by the executor. Availability and authorization must be verified, not inferred from a VP name.',
+    limitations: [
+      'No unmanaged background jobs, recursive sub-agents, or Session transcript access.',
+      'VP roles provide expertise, not missing tools, credentials, permissions, or external environments.',
+      'Use one Action for local investigation, implementation and tests when no independent boundary is needed.',
+      'Missing permission or an unavailable required capability is a blocker, not a reason to create more roles.',
+    ],
+  };
+}

package/yeaft/work-center/completion-contract.js

@@ -14,20 +14,28 @@ export function normalizeContractPatch(value) {
     patch.acceptanceCriteria = criteria;
   }
   if (Object.hasOwn(value, 'deliveryTarget')) {
-    if (!['workspace_files', 'pull_request', 'merge'].includes(value.deliveryTarget)) {
-      throw new Error('contractPatch.deliveryTarget must be workspace_files, pull_request, or merge');
+    if (!['response', 'workspace_files', 'pull_request', 'merge'].includes(value.deliveryTarget)) {
+      throw new Error('contractPatch.deliveryTarget must be response, workspace_files, pull_request, or merge');
     }
     patch.deliveryTarget = value.deliveryTarget;
   }
   return Object.keys(patch).length > 0 ? patch : null;
 }
 
+// Reject even falsy/raw patch fields before normalization can hide an attempted change.
+export function assertCoordinatorContractAuthority(value, userOriginated) {
+  if (userOriginated === true || !value || typeof value !== 'object') return;
+  if (['title', 'goal', 'acceptanceCriteria', 'deliveryTarget'].some(key => Object.hasOwn(value, key))) {
+    throw new Error('Automatic Work Center Coordinator contract and delivery target changes are forbidden; refinement requires a user-originated turn');
+  }
+}
+
 function normalizeAcceptanceChecks(value, criteria) {
   if (!Array.isArray(value) || value.length !== criteria.length) return null;
   const checks = value.map((raw, index) => {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
     const criterion = typeof raw.criterion === 'string' ? raw.criterion.trim() : '';
-    const status = ['passed', 'deferred', 'not_applicable'].includes(raw.status) ? raw.status : '';
+    const status = ['passed', 'failed', 'deferred', 'not_applicable'].includes(raw.status) ? raw.status : '';
     const evidence = typeof raw.evidence === 'string' ? raw.evidence.trim().slice(0, 1_000) : '';
     if (criterion !== criteria[index] || !status || !evidence) return null;
     return { criterion, status, evidence };

package/yeaft/work-center/controller.js

@@ -176,6 +176,13 @@ export class WorkflowController {
     return this.store.getWorkItemDetail(id);
   }
 
+  extendBudget(id, input = {}) {
+    if (!Number.isSafeInteger(input.executionControlRevision)) {
+      throw new Error('executionControlRevision is required to extend execution budget');
+    }
+    return this.store.extendExecutionBudget(id, input.executionControlRevision, input.additions || {});
+  }
+
   resume(id, input = {}) {
     const revision = Number(input.revision);
     if (!Number.isInteger(revision) || revision < 1) {
@@ -195,7 +202,7 @@ export class WorkflowController {
           renderSessionContextSnapshot(workItem.sessionContext),
         ),
       };
-    });
+    }, input.executionControlRevision);
     if (!detail) throw new Error(`WorkItem not found: ${id}`);
     return detail;
   }

package/yeaft/work-center/coordinator.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { resolveMaxOutputTokens } from '../models.js';
+import { callCoordinatorWithResourceControl } from './resource-control.js';
 import { normalizeSessionMessageQuote, sessionMessageQuotePrompt } from '../session-message-quote.js';
 import {
   LLMAuthError,
@@ -8,8 +9,9 @@ import {
   LLMServerError,
 } from '../llm/adapter.js';
 import { resolveWorkItemModel, selectWorkItemVp } from './assignment.js';
-import { normalizeContractPatch } from './completion-contract.js';
+import { assertCoordinatorContractAuthority, normalizeContractPatch } from './completion-contract.js';
 import { normalizeOutputs } from './evidence.js';
+import { deriveGoalProgress } from './goal-state.js';
 import {
   normalizeDynamicActionClosures,
   prepareDynamicActionMutation,
@@ -19,6 +21,7 @@ import { applyCoordinatorReplan } from './plan-mutation.js';
 import { buildWorkItemAttachmentContext } from './attachments.js';
 import { sanitizeDiagnosticText } from './debug-projection.js';
 import { generatedActionGraphRules } from './workflow.js';
+import { workItemCapabilityContext } from './capabilities.js';
 
 const COORDINATOR_MAX_REPLY_CHARS = 8_000;
 const COORDINATOR_MAX_INSTRUCTION_CHARS = 8_000;
@@ -184,7 +187,7 @@ const COORDINATOR_SYSTEM_PROMPT = `You are the Work Center Coordinator. The user
 
 Your responsibilities:
 - Explain the current WorkItem state and blockers in plain language.
-- Keep the WorkItem title, goal, acceptance criteria, and unfinished Action graph aligned with the user's latest intent.
+- Change title, goal, acceptance criteria, or delivery target only in an explicit user-originated refinement turn. Automatic advance/recovery must preserve the user contract and address its gaps, never relax it.
 - Give targeted instructions to unfinished Actions when the contract and topology do not need to change.
 - Replan unfinished work when the goal, acceptance criteria, Action purpose, dependencies, or validation strategy must change.
 - Preserve completed Action history. Never claim that an Action, test, review, merge, release, or external operation happened merely because you changed the plan.
@@ -237,14 +240,17 @@ Return exactly one JSON object and no surrounding prose:
 
 Rules:
 - answer: explain state only. Never use it for an automatic advance trigger.
+- Never mutate title, goal, acceptanceCriteria, or deliveryTarget during automatic advance/recovery. contractPatch is allowed only for explicit user-originated refinement, never to make existing evidence pass. For an older WorkItem with no acceptance criteria, request_human to establish its completion condition before commissioning new work.
 - create_actions: create 1..8 currently runnable Actions. Every Action needs type, objective, approach, expectedOutcome, capability, candidateVpIds, assignmentReason, sourceActionIds, workspaceMode, and optional maxAttempts/separateFromActionTypes. sourceActionIds are context/audit references, never scheduling dependencies. Do not include dependsOnActionIds, dependsOnStageIds, stages, or a graph.
-- If no existing VP can execute a required capability, create one create_vp Action assigned to the existing VP best suited to author that specialist. After it completes, create the original Action with the new VP id. Never fail or retry the original Action merely because its capability label has no match.
+- A missing skill/capability label is not a missing execution capability. Prefer an existing VP with a task-specific brief. Missing tools, credentials, or authorization require request_human; never expand roles as a workaround. create_vp is only appropriate when creating a persistent role is itself an explicit user deliverable.
 - closeActions may accompany create_actions. Each entry is {"actionId":"failed or waiting durable Action id","reason":"why it is no longer required"}. Close only work made obsolete by replacement evidence or a clarified contract. Closed Actions remain audit history, are never acceptance evidence, and do not block completion.
 - guide_actions: target 1..8 unfinished non-running Actions by durable actionId.
-- request_human: use when external information or a user decision is genuinely required. Before creating mutating or delivery Actions, ask whether the delivery boundary is files only, PR, or merge when the contract does not already say. After the user answers, persist it with contractPatch.deliveryTarget = workspace_files | pull_request | merge before creating more Actions.
+- request_human: use when external information or a user decision is genuinely required. Before creating mutating or delivery Actions, ask whether the delivery boundary is a response/report, workspace files, PR, or merge when the contract does not already say. After the user answers, persist it with contractPatch.deliveryTarget = response | workspace_files | pull_request | merge before creating more Actions.
 - complete: only when every acceptance criterion has canonical completed Run evidence and there are no unfinished Actions after applying optional closeActions. Include summary, ordered acceptanceResults with evidenceRunIds, evidenceRunIds, and residualRisks. Reuse structured outputs already present on canonical Runs; do not create repetitive evidence-packaging Actions.
 - Preserve completed and closed Action history. Never claim tests, review, merge, release, or external effects without canonical Run evidence.
-- Action templates are reusable capabilities, not a prescribed workflow. Create the smallest useful Action boundary, not tool-call-sized work.
+- Action templates are reusable capabilities, not a prescribed workflow. A simple Action includes its local tools and necessary tests; do not impose research/design/implement/test/review/deliver stages.
+- Read goalProgress.remainingCriteria, delivery, and blockers first. Resource limits are shared by coordination and all execution, including retries; reserve enough for verification and delivery. Never create a new Action or role merely to evade an exhausted attempt limit. Each new Action must close a concrete current gap. Prefer optional goalRefs: {"criteria":["exact unmet criterion"],"blockerActionIds":["current blocker Action id"],"delivery":false}, plus rationale explaining why this work changes the observed state. Repeating an objective requires goalRefs and a concrete new rationale; do not package already sufficient evidence.
+- response delivery is a substantive answer/report in a canonical completed Run summary with evidence and valid checks; do not invent a file, PR, or extra delivery Action.
 - Never return destructive cancellation. The user owns the explicit cancel control.`;
 
 function coordinatorSystemPrompt(language, detail) {
@@ -438,6 +444,8 @@ export function normalizeCoordinatorResponse(value, detail, options = {}) {
   const source = parsed?.decision && typeof parsed.decision === 'object' && !Array.isArray(parsed.decision)
     ? parsed.decision
     : {};
+  const automatic = options.automatic === true || (options.recovery === true && options.userOriginated !== true);
+  assertCoordinatorContractAuthority(source.contractPatch, !automatic && options.userOriginated !== false);
   const dynamic = isDynamicWorkItem(detail);
   const allowedKinds = dynamic
     ? (options.automatic === true
@@ -474,9 +482,6 @@ export function normalizeCoordinatorResponse(value, detail, options = {}) {
     };
   }
   if (kind === 'request_human') {
-    if (options.automatic === true && source.contractPatch?.deliveryTarget) {
-      throw new Error('Automatic Work Center Coordinator delivery target changes are forbidden');
-    }
     const contractPatch = dynamic ? normalizeContractPatch(source.contractPatch) : null;
     return {
       reply,
@@ -505,9 +510,6 @@ export function normalizeCoordinatorResponse(value, detail, options = {}) {
     };
   }
   if (dynamic && kind === 'create_actions') {
-    if (options.automatic === true && source.contractPatch?.deliveryTarget) {
-      throw new Error('Automatic Work Center Coordinator delivery target changes are forbidden');
-    }
     const contractPatch = normalizeContractPatch(source.contractPatch);
     if (requiresDeliveryBoundaryDecision(detail, source.actions)) {
       throw new Error('Work Center delivery target is unconfirmed; the delivery boundary requires request_human before creating mutating or delivery Actions');
@@ -530,6 +532,7 @@ export function normalizeCoordinatorResponse(value, detail, options = {}) {
         actions: detail.actions || [],
         decision,
         availableVpIds: options.availableVpIds,
+        automatic,
       }),
     };
   }
@@ -583,7 +586,7 @@ function finalizedCriteria(detail, contractPatch) {
   return criteria;
 }
 
-function coordinatorSnapshot(detail) {
+export function coordinatorSnapshot(detail) {
   const runs = Array.isArray(detail.runs) ? detail.runs : [];
   const canonicalRunByAction = new Map();
   for (const action of detail.actions || []) {
@@ -655,8 +658,25 @@ function coordinatorSnapshot(detail) {
     throw new Error('Active Actions cannot be represented within the Coordinator snapshot budget');
   }
 
+  const progress = deriveGoalProgress(detail);
+  const goalProgress = {
+    contractRevision: progress.contractRevision,
+    completedCriteriaCount: progress.completedCriteriaCount,
+    totalCriteriaCount: progress.totalCriteriaCount,
+    remainingCriteria: boundedJsonArray(progress.remainingCriteria.map(value => truncateUtf8(value, 768)), 2 * 1024),
+    delivery: { ...progress.delivery, evidenceRunIds: progress.delivery.evidenceRunIds.slice(0, 24) },
+    criteria: boundedJsonArray(progress.criteria.map(item => ({ ...item,
+      criterion: truncateUtf8(item.criterion, 768), evidenceRunIds: item.evidenceRunIds.slice(0, 24),
+      ...(item.conflictingRunIds ? { conflictingRunIds: item.conflictingRunIds.slice(0, 24) } : {}),
+    })), 2 * 1024),
+    blockers: boundedJsonArray(progress.blockers.map(item => ({ ...item, reason: truncateUtf8(item.reason, 384) })), 1 * 1024),
+  };
+  goalProgress.omittedCriteriaCount = progress.criteria.length - goalProgress.criteria.length;
+  goalProgress.omittedRemainingCriteriaCount = progress.remainingCriteria.length - goalProgress.remainingCriteria.length;
+  goalProgress.omittedBlockerCount = progress.blockers.length - goalProgress.blockers.length;
   return {
     workItem,
+    goalProgress,
     actions,
     omittedCompletedActionCount: Math.max(0, completed.length - actions.filter(action => ['completed', 'closed'].includes(action.status)).length),
     conversation: coordinatorHistory(detail.messages),
@@ -772,7 +792,8 @@ export class WorkItemCoordinator {
       : detail?.actions?.find(candidate => (
           candidate.id === detail.currentActionId && candidate.status === 'failed'
         ));
-    if (!detail || ['done', 'cancelled'].includes(detail.status) || action?.status !== 'failed') return null;
+    if (!detail || ['done', 'cancelled'].includes(detail.status) || action?.status !== 'failed'
+        || !this.store.canAutomaticallyCoordinate(id)) return null;
     const started = this.store.beginCoordinatorTurn(id, '', {
       revision: detail.revision,
       planRevision: detail.planRevision,
@@ -896,7 +917,10 @@ export class WorkItemCoordinator {
           try {
             let result;
             try {
-              const latestMessage = `Current WorkItem snapshot:\n${snapshotText}\n\n${recovery ? 'Automatic failure recovery trigger' : 'Latest user message'}:\n${text}${attachmentContext.promptBlock}${correction}`;
+              const capabilities = JSON.stringify(workItemCapabilityContext(vps, {
+                hasAttachments: started.detail.attachments?.length > 0,
+              }));
+              const latestMessage = `Available execution capabilities (role metadata is descriptive, not authorization):\n${capabilities}\n\nCurrent WorkItem snapshot:\n${snapshotText}\n\n${recovery ? 'Automatic failure recovery trigger' : 'Latest user message'}:\n${text}${attachmentContext.promptBlock}${correction}`;
               const content = attachmentContext.promptParts.length > 0
                 ? [{ type: 'text', text: latestMessage }, ...attachmentContext.promptParts]
                 : latestMessage;
@@ -925,15 +949,9 @@ export class WorkItemCoordinator {
                 result = providerTurn.response;
               } else {
                 result = await Promise.race([
-                runtime.adapter.call({
+                callCoordinatorWithResourceControl(runtime.adapter, this.store, providerTurn, claim, {
                   ...requestBody,
                   signal: abortController.signal,
-                  onRequestStart: () => {
-                    if (!this.store.dispatchCoordinatorProviderTurn(providerTurn.id, claim)) {
-                      abortController.abort('work_center_coordinator_dispatch_fence_lost');
-                      throw new Error('Coordinator provider turn lost its dispatch fence');
-                    }
-                  },
                 }).then(response => {
                   const persisted = this.store.respondCoordinatorProviderTurn(
                     providerTurn.id, providerTurn.requestHash, response, claim,
@@ -956,6 +974,7 @@ export class WorkItemCoordinator {
             normalized = normalizeCoordinatorResponse(result?.text, started.detail, {
               recovery,
               automatic: started.fence.automatic === true,
+              userOriginated: started.fence.userOriginated === true,
               recoveryActionId: started.fence.recovery?.actionId || null,
               availableVpIds: vps.map(vp => vp.id),
             });
@@ -1037,12 +1056,14 @@ export class WorkItemCoordinator {
         : recovery ? 'coordinator.recovery_completed' : 'coordinator.turn_completed', detail);
       return detail;
     } catch (error) {
+      if (providerTurn) this.store.settleCoordinatorRequest(providerTurn.id, null, false);
       if (providerTurn?.status === 'responded') {
         this.store.rejectCoordinatorProviderTurn(providerTurn.id, error, started.fence.claim);
       }
       const detail = this.store.failCoordinatorTurn(started.turnId, error, {
         ...started.fence,
         speaker,
+        interrupted: abortController.signal.aborted || this.shuttingDown,
       });
       if (detail) {
         options.onUpdate?.('coordinator.turn_failed', detail);

package/yeaft/work-center/dynamic-coordination.js

@@ -1,4 +1,6 @@
 import { randomUUID } from 'node:crypto';
+import { assertCoordinatorContractAuthority, normalizeContractPatch } from './completion-contract.js';
+import { deriveGoalProgress } from './goal-state.js';
 import {
   BUILT_IN_ACTION_TYPES,
   MAX_WORK_ITEM_ACTIONS,
@@ -110,7 +112,9 @@ export function prepareDynamicActionMutation({
   actions,
   decision,
   availableVpIds = null,
+  automatic = false,
 }) {
+  assertCoordinatorContractAuthority(decision?.contractPatch, !automatic);
   if (!isDynamicWorkItem(workItem)) {
     throw new Error('Work Center dynamic Action creation requires a Coordinator-driven WorkItem');
   }
@@ -131,10 +135,20 @@ export function prepareDynamicActionMutation({
   if (supersedeActionIds.some(actionId => closeActionIds.has(actionId))) {
     throw new Error('Work Center cannot both close and supersede the same Action');
   }
+  const contractPatch = normalizeContractPatch(decision.contractPatch);
   const effectiveWorkItem = {
     ...workItem,
-    ...(decision.contractPatch || {}),
+    ...(contractPatch || {}),
   };
+  if (contractPatch && ['title', 'goal', 'acceptanceCriteria', 'deliveryTarget']
+    .some(key => JSON.stringify(effectiveWorkItem[key]) !== JSON.stringify(workItem[key]))) {
+    effectiveWorkItem.revision = (Number(workItem.revision) || 1) + 1;
+  }
+  const progress = deriveGoalProgress({ ...effectiveWorkItem, actions });
+  if (progress.totalCriteriaCount > 0 && !progress.remainingCriteria.length
+      && progress.delivery.status === 'passed' && !progress.blockers.length) {
+    throw new Error('Action creation requires an unmet goal condition or blocker; current evidence already supports completion');
+  }
   const createdActions = requested.map((raw, index) => {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
       throw new Error('Work Center Coordinator Action specification must be an object');
@@ -187,6 +201,18 @@ export function prepareDynamicActionMutation({
         throw new Error(`Work Center integrate Action source is not a completed isolated write: ${invalid}`);
       }
     }
+    // Optional refs are persisted inside the existing brief envelope, keeping
+    // historical Actions readable without a schema migration.
+    const goalRefs = normalizeDynamicGoalRefs(raw.goalRefs, effectiveWorkItem, actions);
+    const repeated = actions.some(previous => !['closed', 'superseded', 'cancelled'].includes(previous.status)
+      && previous.type === type && previous.brief?.objective === brief.objective)
+      || requested.slice(0, index).some(previous => previous.type === type && previous.objective?.trim() === brief.objective);
+    const rationale = raw.rationale || (goalRefs ? raw.goalRefs.rationale : '');
+    if (repeated && (!goalRefs || typeof rationale !== 'string' || rationale.trim().length < 20)) {
+      throw new Error('Repeated Action requires goalRefs and a concrete rationale explaining the remaining gap or changed evidence');
+    }
+    if (goalRefs) brief.goalRefs = goalRefs;
+    if (typeof rationale === 'string' && rationale.trim()) brief.rationale = rationale.trim().slice(0, 2_000);
     const action = {
       id,
       type,
@@ -233,11 +259,34 @@ export function prepareDynamicActionMutation({
     createdActions,
     closeActions,
     supersedeActionIds,
-    contractPatch: decision.contractPatch || null,
+    contractPatch,
     workItemType,
   };
 }
 
+/** Optional explicit connection to an unmet criterion, delivery boundary, or blocker. */
+export function normalizeDynamicGoalRefs(value, workItem, actions = []) {
+  if (value == null) return null;
+  if (typeof value !== 'object' || Array.isArray(value)) throw new Error('Action goalRefs must be an object');
+  const criteria = uniqueStrings(value.criteria);
+  const blockerActionIds = uniqueStrings(value.blockerActionIds);
+  const delivery = value.delivery === true;
+  const progress = deriveGoalProgress({ ...workItem, actions });
+  if (!criteria.length && !blockerActionIds.length && !delivery) {
+    throw new Error('Action goalRefs must address an unmet criterion, delivery condition, or blocker');
+  }
+  if (criteria.some(criterion => !progress.remainingCriteria.includes(criterion))) {
+    throw new Error('Action goalRefs references an unknown or already satisfied criterion');
+  }
+  if (blockerActionIds.some(id => !progress.blockers.some(blocker => blocker.actionId === id))) {
+    throw new Error('Action goalRefs references an unknown or resolved blocker');
+  }
+  if (delivery && progress.delivery.status === 'passed') {
+    throw new Error('Action goalRefs references an already satisfied delivery condition');
+  }
+  return { criteria, blockerActionIds, delivery };
+}
+
 function normalizeEvidenceRunIds(value) {
   return uniqueStrings(value);
 }

package/yeaft/work-center/goal-state.js

@@ -0,0 +1,135 @@
+import { normalizeEvidence, normalizeOutputs } from './evidence.js';
+import { runMatchesActionIdentity } from './action-identity.js';
+
+const CHECK_STATUSES = new Set(['passed', 'failed', 'deferred', 'not_applicable']);
+const INACTIVE = new Set(['closed', 'superseded', 'cancelled']);
+const NEGATIVE = new Set(['failed', 'error', 'pending']);
+const revision = value => Math.max(1, Number(value) || 1);
+
+export function validGoalChecks(run, criteria) {
+  return Array.isArray(run?.acceptanceChecks) && run.acceptanceChecks.length === criteria.length
+    && run.acceptanceChecks.every((check, index) => (
+      check?.criterion === criteria[index] && CHECK_STATUSES.has(check.status)
+      && typeof check.evidence === 'string' && check.evidence.trim()
+    ));
+}
+
+export function hasContradictoryEvidence(run) {
+  return !!run?.error || run?.reviewDecision === 'changes_requested'
+    || [...normalizeEvidence(run?.evidence), ...normalizeOutputs(run?.outputs)]
+      .some(item => NEGATIVE.has(item.status));
+}
+
+/**
+ * Read only durable identities, never a model's progress estimate. Older records
+ * use Action.contractRevision when the optional execution manifest is absent.
+ * A completed Run needs its canonical pointer; failed/waiting Actions use their
+ * latest terminal attempt only to report blockers/contradictions, never proof.
+ */
+export function currentGoalRuns(detail) {
+  const runs = Array.isArray(detail?.runs) ? detail.runs : [];
+  const result = [];
+  for (const action of detail?.actions || []) {
+    if (INACTIVE.has(action.status) || action.status === 'running'
+        || revision(action.contractRevision) !== revision(detail.revision)) continue;
+    const owned = runs.filter(run => run.actionId === action.id
+      && (!run.workItemId || run.workItemId === detail.id)
+      && (!action.workItemId || action.workItemId === detail.id)
+      && runMatchesActionIdentity(run, action)
+      && (run.executionManifest?.actionGeneration == null || revision(run.executionManifest.actionGeneration) === revision(action.generation))
+      && (!run.executionManifest?.actionSpecHash || run.executionManifest.actionSpecHash === action.specHash)
+      && revision(run.executionManifest?.contractRevision ?? action.contractRevision) === revision(detail.revision)
+      && revision(run.contextSnapshot?.contract?.revision ?? action.contractRevision) === revision(detail.revision)
+      && ['completed', 'failed', 'waiting'].includes(run.status));
+    const run = action.status === 'completed'
+      ? owned.find(candidate => candidate.id === action.resultRunId && candidate.status === 'completed')
+      : ['failed', 'waiting'].includes(action.status)
+        ? owned.sort((a, b) => Number(b.endedAt || b.startedAt) - Number(a.endedAt || a.startedAt))[0]
+        : null;
+    if (run) result.push(run);
+  }
+  return result;
+}
+
+/** Derived, restart-safe projection; no new database state or migrations. */
+export function deriveGoalProgress(detail) {
+  const contract = Array.isArray(detail?.acceptanceCriteria) ? detail.acceptanceCriteria : [];
+  const runs = currentGoalRuns(detail);
+  const proof = runs.filter(run => run.status === 'completed' && normalizeEvidence(run.evidence).length > 0
+    && !hasContradictoryEvidence(run) && validGoalChecks(run, contract));
+  const byId = new Map((detail?.actions || []).map(action => [action.id, action]));
+  // Retrying, guiding, or closing an Action is not a correction. Keep historical
+  // negative observations until a newer current canonical Run disproves them.
+  // These attempts can invalidate proof but can never establish it.
+  const observations = (detail?.runs || []).filter(run => {
+    const action = byId.get(run.actionId);
+    return action && (!run.workItemId || run.workItemId === detail.id)
+      && (!action.workItemId || action.workItemId === detail.id)
+      && ['completed', 'failed', 'waiting', 'retryable'].includes(run.status)
+      && revision(run.executionManifest?.contractRevision ?? action.contractRevision) === revision(detail.revision)
+      && revision(run.contextSnapshot?.contract?.revision ?? action.contractRevision) === revision(detail.revision);
+  });
+  const observedAt = run => Number(run.endedAt || run.startedAt) || 0;
+  // Subsequent writes can invalidate earlier tests. A later read-only observation
+  // does not invalidate unrelated proof; after a write, re-check the affected
+  // contract rather than completing from a pre-change observation.
+  // Retiring a writer is not rollback. Include historical attempts, including
+  // failed/closed/superseded generations, in the freshness watermark.
+  const writes = (detail?.runs || []).filter(run => {
+    const action = byId.get(run.actionId);
+    return action && (!run.workItemId || run.workItemId === detail.id)
+      && action.workspaceMode && action.workspaceMode !== 'read'
+      && revision(run.executionManifest?.contractRevision ?? action.contractRevision) === revision(detail.revision);
+  });
+  // Ending after another writer is insufficient: tests may have run before its
+  // mutation. Without a durable ordering at equal timestamps, require a new
+  // observation. The writer's own end-to-end proof remains usable.
+  const freshProof = proof.filter(run => writes.every(writer => writer.id === run.id
+    || (Number(run.startedAt) || observedAt(run)) > observedAt(writer)));
+  const contradictions = contract.map((criterion, index) => observations.filter(run => (
+    run.acceptanceChecks?.[index]?.criterion === criterion
+      && (run.acceptanceChecks[index].status === 'failed'
+        || (run.acceptanceChecks[index].status !== 'not_applicable' && hasContradictoryEvidence(run)))
+  )));
+  const latestContradictionAt = contradictions.map(runs => Math.max(-Infinity, ...runs.map(observedAt)));
+  const criteria = contract.map((criterion, index) => {
+    // A correction establishes new proof; it never revives an older disproved
+    // Run. Overlapping/tied observations cannot establish corrective ordering.
+    const passing = freshProof.filter(run => run.acceptanceChecks[index].status === 'passed'
+      && (Number(run.startedAt) || observedAt(run)) > latestContradictionAt[index]);
+    const conflicts = passing.length ? [] : contradictions[index];
+    const evidenceRunIds = passing.map(run => run.id);
+    return {
+      criterion,
+      status: conflicts.length ? 'failed' : evidenceRunIds.length ? 'passed' : 'unmet',
+      evidenceRunIds: conflicts.length ? [] : evidenceRunIds,
+      ...(conflicts.length ? { conflictingRunIds: conflicts.map(run => run.id) } : {}),
+    };
+  });
+  const target = detail?.deliveryTarget || null;
+  const outputKind = { workspace_files: 'file', pull_request: 'pr', merge: 'commit' }[target];
+  const deliveryRunIds = freshProof.filter(run => target === 'response'
+    ? typeof run.summary === 'string' && run.summary.trim()
+      // Summaries are indivisible: do not deliver one whose applicable claims
+      // predate a contradiction, even after a different Run corrects it.
+      && run.acceptanceChecks.every((check, index) => check.status !== 'failed'
+        && (check.status === 'not_applicable'
+          || (Number(run.startedAt) || observedAt(run)) > latestContradictionAt[index]))
+    : outputKind && normalizeOutputs(run.outputs).some(output => output.kind === outputKind && !NEGATIVE.has(output.status)))
+    .map(run => run.id);
+  const blockers = (detail?.actions || []).filter(action => ['failed', 'waiting'].includes(action.status))
+    .map(action => {
+      const run = runs.find(candidate => candidate.actionId === action.id);
+      return { actionId: action.id, status: action.status, reason: run?.waitingReason || run?.error || action.brief?.objective || '' };
+    });
+  return {
+    contractRevision: revision(detail?.revision),
+    criteria,
+    remainingCriteria: criteria.filter(item => item.status !== 'passed').map(item => item.criterion),
+    completedCriteriaCount: criteria.filter(item => item.status === 'passed').length,
+    totalCriteriaCount: criteria.length,
+    evidenceRunIds: [...new Set(criteria.flatMap(item => item.evidenceRunIds))],
+    blockers,
+    delivery: { target, status: deliveryRunIds.length ? 'passed' : 'unmet', evidenceRunIds: deliveryRunIds },
+  };
+}