@zq-silk/yui 0.11.3 → 0.12.0

package/dist/controller/runtime.js

@@ -7,7 +7,7 @@ import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_M
 import { hasRuntimeCleanupObligation, runtimeLifecycleSignalKey, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
-import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
+import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskSession, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { AgentConfigurationCatalogService, validateAgentLaunchConfiguration } from "../executor/agentConfigurationCatalog.js";
 import { isTaskOwnedWorkspace, managedWorkspaceIdentity, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
@@ -754,7 +754,7 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 throw applicationError("INVALID_PARAMS", `Configured Agent does not match Role: ${effective.agentId}.`);
             }
             validateLifecycleEnvironment(request.environment, agent);
-            const mode = roleAgentSessionResumeMode(sessions, effective.agentId, effective, managedWorkspace);
+            const mode = roleAgentSessionResumeMode(sessions, effective.agentId, effective);
             const session = sessions?.sessions[effective.agentId];
             const owner = request.scope === "task"
                 ? { scope: "task", taskId: request.taskId, roleName: request.roleName }
@@ -878,7 +878,7 @@ function assertRuntimeLaunchRequestCurrent(store, request) {
             throw new Error(`Native session changed: ${request.owner.roleName}.`);
         }
         const sessionEffectiveCompatible = request.owner.scope === "task"
-            ? effectiveLaunchSnapshotsCompatibleForTaskMain(session.effective, request.effective, request.managedWorkspace)
+            ? effectiveLaunchSnapshotsCompatibleForTaskSession(session.effective, request.effective)
             : effectiveLaunchSnapshotsCompatible(session.effective, request.effective);
         if (!sessionEffectiveCompatible) {
             throw new Error(`Native session effective launch changed: ${request.owner.roleName}.`);

package/dist/controller/runtimeEventInbox.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, existsSync, fchmodSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { withUpgradeCoordinationLock } from "../storage/upgradeCoordination.js";
-import { createRuntimeObservation } from "../runtime/runtimeObservation.js";
+import { createRuntimeObservation, isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
 export const MAX_RUNTIME_TURN_SUMMARY_BYTES = 32 * 1024;
 export const MAX_RUNTIME_EVENT_FILE_BYTES = 16 * 1024 * 1024;
 const RUNTIME_EVENT_DIRECTORY = join("runtime", "inbox");
@@ -41,7 +41,7 @@ export class FileRuntimeEventInbox {
         return this.publish(event);
     }
     enqueueTurnCompleted(input) {
-        const normalized = normalizeCodexInput(input);
+        const normalized = normalizeNativeTurnCompletedInput(input);
         return this.publish(Object.freeze({
             schemaVersion: 1,
             id: runtimeEventId("native-turn-completed", normalized),
@@ -163,6 +163,15 @@ export class FileRuntimeEventInbox {
         // UpgradeFenceError after the cutover holder releases the lock.
         return withUpgradeCoordinationLock(this.home, () => {
             this.hooks.afterAdmission?.();
+            if (event.type === "runtime-observation"
+                && isRuntimeTokenEvidence(event.observation)) {
+                const existing = this.list().find((candidate) => (candidate.type === "runtime-observation"
+                    && candidate.taskId === event.taskId
+                    && candidate.observation.eventId === event.observation.eventId));
+                if (existing !== undefined) {
+                    return { event: existing, created: false };
+                }
+            }
             return this.publishUnlocked(event);
         });
     }
@@ -281,7 +290,7 @@ function runtimeEventId(type, input) {
     ];
     return `turn-${createHash("sha256").update(JSON.stringify(common)).digest("hex")}`;
 }
-function normalizeCodexInput(input) {
+function normalizeNativeTurnCompletedInput(input) {
     const scope = input.scope;
     if (scope !== "task" && scope !== "global")
         throw invalidEvent();
@@ -305,7 +314,8 @@ function normalizeCodexInput(input) {
             : { title: requireIdentityText(input.title, "Session title") }),
         summary: truncateUtf8(input.summary.trim(), MAX_RUNTIME_TURN_SUMMARY_BYTES)
     };
-    if (common.adapterId !== "codex" || common.summary.length === 0)
+    if ((common.adapterId !== "codex" && common.adapterId !== "claude")
+        || common.summary.length === 0)
         throw invalidEvent();
     return scope === "task"
         ? { ...common, taskId: requireIdentityText(input.taskId, "Task id") }
@@ -333,7 +343,7 @@ function parseRuntimeEvent(value) {
         throw invalidEvent();
     switch (value.type) {
         case "runtime-observation": return parseRuntimeObservationEvent(value);
-        case "native-turn-completed": return parseCodexEvent(value);
+        case "native-turn-completed": return parseNativeTurnCompletedEvent(value);
         case "durable-job-terminal": return parseDurableJobTerminalEvent(value);
         default: throw invalidEvent();
     }
@@ -378,7 +388,7 @@ function parseDurableJobTerminalEvent(value) {
         ...normalized
     });
 }
-function parseCodexEvent(value) {
+function parseNativeTurnCompletedEvent(value) {
     const scope = value.scope;
     const expected = scope === "task"
         ? [
@@ -400,7 +410,7 @@ function parseCodexEvent(value) {
         || !hasExactKeys(value, expected))
         throw invalidEvent();
     const receivedAt = requireTimestamp(value.receivedAt);
-    const normalized = normalizeCodexInput({
+    const normalized = normalizeNativeTurnCompletedInput({
         scope,
         ...(scope === "task" ? { taskId: value.taskId } : {}),
         roleName: value.roleName,

package/dist/controller/runtimeEventProcessor.js

@@ -1,3 +1,4 @@
+import { isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 const DEFAULT_MAX_RUNTIME_EVENTS_PER_DRAIN = 64;
 /** Folds immutable Hook facts in one bounded transaction before acknowledging them. */
@@ -111,7 +112,7 @@ export class FileRuntimeEventProcessor {
         const event = candidate.event;
         let outcome = "applied";
         if (event.type === "native-turn-completed") {
-            outcome = this.applyCodex(event, now);
+            outcome = this.applyNativeTurnCompleted(event, now);
         }
         else if (event.type === "runtime-observation") {
             outcome = this.applyRuntimeObservation(event, now);
@@ -199,7 +200,7 @@ export class FileRuntimeEventProcessor {
         // transaction as the terminal transition.
         void event;
     }
-    applyCodex(event, now) {
+    applyNativeTurnCompleted(event, now) {
         if (event.scope === "task") {
             const task = this.observer.getTask(event.taskId);
             const input = {
@@ -315,17 +316,10 @@ export function coalesceRuntimeProgress(events, instrumentation = {}) {
         }
         const representedByIndex = new Map();
         for (const indices of indicesByStream.values()) {
-            const hasUsage = segment[indices[0]].observation.payload.usage !== undefined;
-            const retainedPositions = hasUsage ? [0] : [];
-            if (hasUsage) {
-                for (let position = 1; position < indices.length; position += 1) {
-                    const previous = segment[indices[position - 1]].observation.payload.usage;
-                    const current = segment[indices[position]].observation.payload.usage;
-                    if (runtimeUsageTotal(current) < runtimeUsageTotal(previous)) {
-                        retainedPositions.push(position);
-                    }
-                }
-            }
+            const hasUsage = isRuntimeTokenEvidence(segment[indices[0]].observation);
+            // Usage facts and incomplete boundaries are authoritative history for
+            // read-only Session token projection, so ingress never coalesces them.
+            const retainedPositions = hasUsage ? indices.map((_, position) => position) : [];
             const lastPosition = indices.length - 1;
             if (retainedPositions.at(-1) !== lastPosition)
                 retainedPositions.push(lastPosition);
@@ -424,12 +418,9 @@ function progressStreamKey(event) {
         fence.nativeSessionId ?? null,
         fence.runId ?? null,
         payload.activity,
-        payload.usage === undefined ? "signal" : "usage"
+        isRuntimeTokenEvidence(event.observation) ? "usage" : "signal"
     ]);
 }
-function runtimeUsageTotal(usage) {
-    return usage.inputTokens + usage.outputTokens;
-}
 function isRuntimeActivityEvent(event) {
     return event.type === "runtime-observation"
         && event.observation.kind === "activity.observed";
@@ -536,6 +527,8 @@ export function createAsyncRuntimeObserver(invoke) {
         observeRuntimeObservation: (input, now) => withNow("observeRuntimeObservation", input, now),
         observeRuntimeTurnCompleted: (input, now) => withNow("observeRuntimeTurnCompleted", input, now),
         observeGlobalRuntimeTurnCompleted: (input, now) => withNow("observeGlobalRuntimeTurnCompleted", input, now),
+        classifyRuntimeTurnCompleted: (input) => call("classifyRuntimeTurnCompleted", [input]),
+        classifyGlobalRuntimeTurnCompleted: (input) => call("classifyGlobalRuntimeTurnCompleted", [input]),
         observeObsoleteRuntimeEvent: (input, now) => withNow("observeObsoleteRuntimeEvent", input, now)
     };
 }
@@ -581,7 +574,7 @@ export class AsyncRuntimeEventProcessor {
             try {
                 let outcome = "applied";
                 if (event.type === "native-turn-completed") {
-                    outcome = await this.applyCodex(event, now);
+                    outcome = await this.applyNativeTurnCompleted(event, now);
                 }
                 else if (event.type === "runtime-observation") {
                     outcome = await this.applyRuntimeObservation(event, now);
@@ -652,7 +645,7 @@ export class AsyncRuntimeEventProcessor {
         }
         return outcome;
     }
-    async applyCodex(event, now) {
+    async applyNativeTurnCompleted(event, now) {
         if (event.scope === "task") {
             const task = await this.observer.getTask(event.taskId);
             const input = {

package/dist/controller/runtimeObservationHook.js

@@ -12,6 +12,10 @@ import { resolveRuntimeHookRunFence } from "./runtimeHookRunFence.js";
  * provider-independent RuntimeObservation with an exact generation/Run fence.
  */
 export async function runRuntimeObservationHookCommand(stdinJson, environment = process.env, call = callController, now = new Date(), dependencies = {}) {
+    if (environment.YUI_SESSION_SCOPE === "global") {
+        await runGlobalRuntimeTurnHook(stdinJson, environment, call, now, dependencies);
+        return;
+    }
     const parsed = parseRuntimeObservationHook(stdinJson, environment, now, dependencies);
     const inbox = new FileRuntimeEventInbox(parsed.home);
     for (const observation of parsed.observations)
@@ -26,6 +30,47 @@ export async function runRuntimeObservationHookCommand(stdinJson, environment =
         })
     }, { timeoutMs: 100 }).catch(() => { });
 }
+async function runGlobalRuntimeTurnHook(stdinJson, environment, call, now, dependencies) {
+    const payload = parseObject(stdinJson);
+    const hookEventName = requireIdentity(payload.hook_event_name, "Agent Driver Hook event name");
+    if (hookEventName !== "Stop" && hookEventName !== "StopFailure")
+        return;
+    const driverId = requireIdentity(environment.YUI_DRIVER_ID, "Agent Driver id");
+    const driver = (dependencies.drivers ?? builtinAgentDriverRegistry()).require(driverId);
+    if (driver.adapterId !== "claude" || environment.YUI_ADAPTER_ID !== driver.adapterId) {
+        throw new Error("Global runtime Hook requires the Claude adapter.");
+    }
+    const occurrenceId = `${now.toISOString()}:${(dependencies.sequence ?? monotonicSequence)()}`;
+    const nativeHook = Object.freeze({ hookEventName, payload, occurrenceId });
+    const nativeSessionId = requireIdentity(driver.runtime.nativeSessionId(nativeHook), "Agent Driver native Session id");
+    if (nativeSessionId !== requireIdentity(environment.YUI_NATIVE_SESSION_ID, "YUI native session id")) {
+        throw new Error("Global runtime Hook native Session does not match its launch envelope.");
+    }
+    const home = requireIdentity(environment.YUI_HOME, "YUI_HOME");
+    const roleName = requireIdentity(environment.YUI_ROLE, "Role name");
+    new FileRuntimeEventInbox(home, () => now).enqueueTurnCompleted({
+        scope: "global",
+        roleName,
+        agentId: requireIdentity(environment.YUI_AGENT_ID, "Agent id"),
+        adapterId: "claude",
+        launchId: requireIdentity(environment.YUI_LAUNCH_ID, "Launch id"),
+        nativeSessionId,
+        turnId: optionalIdentity(driver.runtime.nativeTurnId(nativeHook)) ?? occurrenceId,
+        ...(environment.YUI_SESSION_TITLE === undefined
+            ? {}
+            : { title: requireIdentity(environment.YUI_SESSION_TITLE, "Session title") }),
+        summary: globalHookSummary(payload, hookEventName)
+    });
+    await call(home, "scheduler.signal", { key: runtimeLifecycleSignalKey({ scope: "global", roleName }) }, { timeoutMs: 100 }).catch(() => { });
+}
+function globalHookSummary(payload, hookEventName) {
+    for (const field of ["last_assistant_message", "summary", "message", "error"]) {
+        const value = payload[field];
+        if (typeof value === "string" && value.trim().length > 0)
+            return value.trim();
+    }
+    return hookEventName === "Stop" ? "Native Turn completed." : "Native Turn failed.";
+}
 export function parseRuntimeObservationHook(stdinJson, environment, now = new Date(), dependencies = {}) {
     const payload = parseObject(stdinJson);
     const drivers = dependencies.drivers ?? builtinAgentDriverRegistry();

package/dist/execution/resourceBroker.js

@@ -3,9 +3,13 @@ import { requireIdentity, requireText, requireTimestamp } from "../domain/valida
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { validateExecutionGroup } from "./executionGroup.js";
 export const RESOURCE_BROKER_POLICY_SCHEMA_VERSION = 1;
+/** Compatibility/display default; observed tokens never close execution spend. */
+export const DEFAULT_EXECUTION_STAGE_TOKEN_BUDGET_PER_LANE = 120_000;
 /** One shared hard-stop predicate for admission, recovery, and Leader routing. */
 export function executionStageSpendClosed(resources) {
-    return resources.deadlineReached || resources.exhaustedBudgets.length > 0;
+    return resources.deadlineReached
+        || resources.exhaustedBudgets.includes("tool-calls")
+        || resources.exhaustedBudgets.includes("wall-clock");
 }
 const DEFAULT_ACTIVE_LANES = 4;
 const DEFAULT_ACTIVE_LANES_PER_TASK = 2;
@@ -147,9 +151,6 @@ export function projectExecutionStageResources(input) {
     const tokensObservable = input.usage.tokensObservable ?? true;
     const toolCallsObservable = input.usage.toolCallsObservable ?? true;
     const exhaustedBudgets = [];
-    if (stage?.budget.maxTokens !== undefined
-        && tokens >= stage.budget.maxTokens)
-        exhaustedBudgets.push("tokens");
     if (toolCallsObservable && stage?.budget.maxToolCalls !== undefined
         && toolCalls >= stage.budget.maxToolCalls)
         exhaustedBudgets.push("tool-calls");

package/dist/executor/agentExecutor.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { hasRecentTurnId, rememberRecentTurnId, validatePendingTurnCompletion, validateRecentTurnIds } from "./turnCompletion.js";
-import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchSnapshotsCompatibleForTaskReview, validateEffectiveLaunchSnapshot } from "./effectiveLaunch.js";
+import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskSession, validateEffectiveLaunchSnapshot } from "./effectiveLaunch.js";
 import { rebindProviderRuntimeRun, validateProviderRuntimeBinding } from "../runtime/providerRuntimeIdentity.js";
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 export function createRoleSessionSet(owner, activeAgentId, now) {
@@ -69,7 +69,7 @@ export function recordRoleAgentSession(set, input, now) {
     if (existing !== undefined && existing.nativeSessionId === nativeSessionId
         && !effectiveLaunchSnapshotsCompatible(existing.effective, effective)
         && !(set.owner.scope === "task"
-            && effectiveLaunchSnapshotsCompatibleForTaskReview(existing.effective, effective))) {
+            && effectiveLaunchSnapshotsCompatibleForTaskSession(existing.effective, effective))) {
         throw new Error(`Role Agent session effective launch cannot change: ${agentId}.`);
     }
     if (existing !== undefined && existing.nativeSessionId !== nativeSessionId
@@ -264,7 +264,7 @@ export function rememberRoleAgentCompletedTurn(set, agentId, nativeSessionId, tu
     };
     return validateRoleSessionSet(updated);
 }
-export function roleAgentSessionResumeMode(set, agentId, desired, workspace) {
+export function roleAgentSessionResumeMode(set, agentId, desired) {
     if (set === null)
         return "new";
     validateRoleSessionSet(set);
@@ -287,7 +287,7 @@ export function roleAgentSessionResumeMode(set, agentId, desired, workspace) {
         return "new";
     }
     const compatible = set.owner.scope === "task"
-        ? effectiveLaunchSnapshotsCompatibleForTaskMain(session.effective, desired, workspace)
+        ? effectiveLaunchSnapshotsCompatibleForTaskSession(session.effective, desired)
         : effectiveLaunchSnapshotsCompatible(session.effective, desired);
     if (compatible)
         return "resume";

package/dist/executor/effectiveLaunch.js

@@ -79,50 +79,20 @@ export function effectiveLaunchSnapshotsCompatible(existing, desired) {
     return isDeepStrictEqual(withoutDesiredRevision(existing), withoutDesiredRevision(desired));
 }
 /**
- * A Task-owned main workspace is a mutable checkout: Integration advances its
- * durable Git heads while an idle native Session keeps the immutable launch
- * configuration with which it started. A later Run may resume that exact
- * Session only when the current durable Task workspace proves that every
- * non-commit workspace identity and every other launch field is unchanged.
- * A Task-final Reviewer workspace is also mutable between semantic Rounds: it
- * keeps one Role-owned physical identity while its frozen commits and Round
- * identity advance. WorkItem and ExecutionLane workspaces remain strict.
+ * Task Role Sessions keep one physical workspace while Run-scoped facts move.
+ * Candidate commits, ReviewRound identity and desired-revision bookkeeping do
+ * not define a native Session. Agent, adapter, permission, model, sandbox,
+ * manifest, Role context and physical workspace identity still do.
  */
-export function effectiveLaunchSnapshotsCompatibleForTaskMain(existing, desired, workspace) {
+export function effectiveLaunchSnapshotsCompatibleForTaskSession(existing, desired) {
     if (effectiveLaunchSnapshotsCompatible(existing, desired))
         return true;
     validateEffectiveLaunchSnapshot(existing);
     validateEffectiveLaunchSnapshot(desired);
-    if (workspace === null || workspace === undefined)
+    if ((existing.reviewRoundId === undefined) !== (desired.reviewRoundId === undefined)) {
         return false;
-    validateManagedWorkspace(workspace);
-    const durableWorkspace = {
-        root: workspace.root,
-        entries: workspace.entries.map((entry) => ({ ...entry }))
-    };
-    if (!isDeepStrictEqual(desired.workspace, durableWorkspace))
-        return false;
-    if (workspace.owner.type === "review-round") {
-        return effectiveLaunchSnapshotsCompatibleForTaskReview(existing, desired);
     }
-    if (workspace.owner.type !== "task")
-        return false;
-    return isDeepStrictEqual(taskMainCompatibleSnapshot(existing), taskMainCompatibleSnapshot(desired));
-}
-/**
- * Same Task Reviewer Role, same stable physical workspace and launch policy,
- * but a new semantic ReviewRound and frozen head. The native Session keeps its
- * conversation; each AgentRun still records the new exact Round snapshot.
- */
-export function effectiveLaunchSnapshotsCompatibleForTaskReview(existing, desired) {
-    validateEffectiveLaunchSnapshot(existing);
-    validateEffectiveLaunchSnapshot(desired);
-    if (existing.reviewRoundId === undefined
-        || existing.reviewBaseCommit === undefined
-        || desired.reviewRoundId === undefined
-        || desired.reviewBaseCommit === undefined)
-        return false;
-    return isDeepStrictEqual(taskReviewCompatibleSnapshot(existing), taskReviewCompatibleSnapshot(desired));
+    return isDeepStrictEqual(taskSessionCompatibleSnapshot(existing), taskSessionCompatibleSnapshot(desired));
 }
 /** Preserves a fixed Session's launch configuration while freezing fresh Task-main Git facts. */
 export function effectiveLaunchWithTaskMainWorkspace(existing, workspace) {
@@ -139,17 +109,7 @@ export function effectiveLaunchWithTaskMainWorkspace(existing, workspace) {
         }
     });
 }
-function taskMainCompatibleSnapshot(snapshot) {
-    const { sourceDesiredRevision: _sourceDesiredRevision, workspace, ...launch } = snapshot;
-    return {
-        ...launch,
-        workspace: {
-            root: workspace.root,
-            entries: workspace.entries.map(({ baseCommit: _baseCommit, ...entry }) => entry)
-        }
-    };
-}
-function taskReviewCompatibleSnapshot(snapshot) {
+function taskSessionCompatibleSnapshot(snapshot) {
     const { sourceDesiredRevision: _sourceDesiredRevision, reviewRoundId: _reviewRoundId, reviewBaseCommit: _reviewBaseCommit, workspace, ...launch } = snapshot;
     return {
         ...launch,

package/dist/executor/fileRoleLaunchPlanner.js

@@ -1,4 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { realpathSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -17,7 +18,7 @@ import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
 import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.js";
 import { classifyWorkspacePreflight, formatWorkspacePreflightError } from "./workspacePreflightClassification.js";
 import { activeLiveRoleAgentSession } from "./agentExecutor.js";
-import { effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchSnapshotsCompatible, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
+import { effectiveLaunchSnapshotsCompatibleForTaskSession, effectiveLaunchSnapshotsCompatible, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
 import { YUI_CONTROL_PLANE_DESCRIPTOR, YUI_TASK_RUNTIME_DESCRIPTOR, assertExactTaskRuntimeState, createExactControlPlaneDescriptor, createExactTaskRuntimeDescriptor, exactControlPlaneDigest, exactTaskRuntimeDescriptorPath, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
 import { detectRunningRelease } from "../release/runtimeRelease.js";
 import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
@@ -35,6 +36,7 @@ export class FileRoleLaunchPlanner {
     #nativeAgentEnvironment;
     #createNativeSessionId;
     #cliPath;
+    #inspectWorkspacePhysicalState;
     #controlPlane;
     #resourceRegistrarValue;
     constructor(home, store, options = {}) {
@@ -51,6 +53,8 @@ export class FileRoleLaunchPlanner {
         this.#agentEnvironment = this.#selectConfiguredAgentEnvironment(sourceEnvironment);
         this.#nativeAgentEnvironment = this.#selectConfiguredNativeEnvironment(sourceEnvironment);
         this.#createNativeSessionId = options.createNativeSessionId ?? randomUUID;
+        this.#inspectWorkspacePhysicalState = options.inspectWorkspacePhysicalState
+            ?? inspectWorkspacePhysicalState;
         this.#cliPath = canonicalPath(options.cliPath
             ?? fileURLToPath(new URL("../cli.js", import.meta.url)));
         // Internal callbacks retain one exact command identity for receipt fencing.
@@ -143,7 +147,7 @@ export class FileRoleLaunchPlanner {
         const main = this.store.getTaskWorkspace(task.id);
         // Quick Win (EXE-04/EXE-08): classify workspace preflight failures so
         // split-brain state is never reported as a transient Provider failure.
-        const preflight = classifyWorkspacePreflight(this.store, task, input.roleName, activeRun === null ? null : { id: activeRun.id, workspace: activeRun.workspace });
+        const preflight = classifyWorkspacePreflight(this.store, task, input.roleName, activeRun === null ? null : { id: activeRun.id, workspace: activeRun.workspace }, this.#inspectWorkspacePhysicalState);
         if (preflight !== null) {
             throw new Error(formatWorkspacePreflightError(preflight));
         }
@@ -215,7 +219,7 @@ export class FileRoleLaunchPlanner {
         const existing = sessionSet?.sessions[effective.agentId];
         const compatibleExisting = existing !== undefined
             && (input.mode === "resume"
-                ? effectiveLaunchSnapshotsCompatibleForTaskMain(existing.effective, effective, runWorkspace ?? workspace)
+                ? effectiveLaunchSnapshotsCompatibleForTaskSession(existing.effective, effective)
                 : effectiveLaunchSnapshotsCompatible(existing.effective, effective));
         if (input.mode === "resume" && !compatibleExisting) {
             throw new Error(`Task Role resume effective snapshot drifted: ${task.id}/${role.name}.`);
@@ -322,9 +326,6 @@ export class FileRoleLaunchPlanner {
         const managedRun = owner.scope === "task" && input.runId !== undefined
             ? this.store.getAgentRun(owner.taskId, input.runId)
             : null;
-        const managedSessionSet = owner.scope === "task" && input.runId !== undefined
-            ? this.store.getTaskRoleSessionSet(owner.taskId, role.name)
-            : null;
         const driver = builtinAgentDriverRegistry().require(builtinDriverIdForAdapter(configured.adapterId));
         if (owner.scope === "task" && input.runId !== undefined) {
             const admission = managedRuntimeAdmission(driver.capabilities);
@@ -401,6 +402,9 @@ export class FileRoleLaunchPlanner {
         let args = [...compiled.argv];
         let command = configured.command;
         let session;
+        if (binding.adapterId === "claude" && (managedControl || owner.scope === "global")) {
+            args.push("--plugin-dir", ensureClaudeLifecyclePlugin(this.home, this.#cliPath));
+        }
         if (binding.adapterId === "codex") {
             // Global/interactive Codex sessions still use notify for presentation.
             // Managed Runs use the structured Driver Hook as their sole lifecycle
@@ -423,8 +427,6 @@ export class FileRoleLaunchPlanner {
                 : null;
         }
         else if (launchMode === "new") {
-            if (managedControl)
-                args.push("--plugin-dir", ensureManagedClaudeLifecyclePlugin(this.home, this.#cliPath));
             const nativeSessionId = requireText(preallocatedNativeSessionId, "Native session id");
             if (!managedControl)
                 args.push("--session-id", nativeSessionId);
@@ -433,9 +435,6 @@ export class FileRoleLaunchPlanner {
             session = readySession(input.agentId, binding.adapterId, nativeSessionId, effective);
         }
         else {
-            if (managedControl) {
-                args.push("--plugin-dir", ensureManagedClaudeLifecyclePlugin(this.home, this.#cliPath));
-            }
             session = readySession(input.agentId, binding.adapterId, resumeNativeSessionId, effective);
         }
         const managedClaudeRun = binding.adapterId === "claude"
@@ -473,10 +472,12 @@ export class FileRoleLaunchPlanner {
         if (owner.scope === "task" && (input.mode === "new" || input.mode === "resume")) {
             jobCallerKey = randomBytes(32).toString("hex");
         }
+        // Every managed launch for an unpushed Run owns that Run's first Provider
+        // write, whether it creates or resumes the native Conversation. Keeping
+        // resume on the same launch handshake prevents a durable AgentRun from
+        // existing without a corresponding Provider Turn.
         const carriesInitialTurn = managedControl
-            && managedRun?.pushedAt === undefined
-            && (managedSessionSet?.providerBinding === null
-                || managedSessionSet?.providerBinding === undefined);
+            && managedRun?.pushedAt === undefined;
         const providerAuthority = managedControl
             ? this.#providerAuthorityForLaunch(owner.taskId, role.name, input.launchId)
             : undefined;
@@ -698,11 +699,11 @@ function workspaceScopeEnvironment(environment, workspace) {
         ])))
     };
 }
-function ensureManagedClaudeLifecyclePlugin(home, cliPath) {
+function ensureClaudeLifecyclePlugin(home, cliPath) {
     const root = join(resolve(home), "runtime", "claude-lifecycle-plugin");
     writeTextFileAtomically(join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify({
         name: "yui-runtime-lifecycle",
-        description: "Yui-owned exact Run lifecycle transport",
+        description: "Yui-owned native lifecycle transport",
         version: "1.0.0"
     }, null, 2)}\n`);
     const command = {
@@ -766,6 +767,25 @@ function canonicalPath(path) {
         return absolute;
     }
 }
+const inspectWorkspacePhysicalState = (entry) => {
+    const headResult = spawnSync("git", ["-C", entry.path, "rev-parse", "HEAD"], { encoding: "utf8", shell: false, timeout: 5_000 });
+    if (headResult.error !== undefined || headResult.status !== 0) {
+        throw new Error(`Managed workspace physical HEAD could not be inspected: ${entry.projectId} @ ${entry.path}.`);
+    }
+    const physicalCommit = headResult.stdout.trim().toLowerCase();
+    if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(physicalCommit)) {
+        throw new Error(`Managed workspace physical HEAD is invalid: ${entry.projectId}.`);
+    }
+    const ancestorResult = spawnSync("git", ["-C", entry.path, "merge-base", "--is-ancestor", entry.baseCommit, physicalCommit], { encoding: "utf8", shell: false, timeout: 5_000 });
+    if (ancestorResult.error !== undefined
+        || (ancestorResult.status !== 0 && ancestorResult.status !== 1)) {
+        throw new Error(`Managed workspace lineage could not be inspected: ${entry.projectId} @ ${entry.path}.`);
+    }
+    return {
+        physicalCommit,
+        recordedBaseIsAncestor: ancestorResult.status === 0
+    };
+};
 function shellQuote(value) {
     return `'${value.replaceAll("'", "'\"'\"'")}'`;
 }

package/dist/executor/workspacePreflightClassification.js

@@ -21,7 +21,7 @@ function ownerLabel(owner) {
  * This is a read-only check: it never mutates Git state, creates Sessions, or
  * writes recovery records.
  */
-export function classifyWorkspacePreflight(store, task, roleName, activeRun) {
+export function classifyWorkspacePreflight(store, task, roleName, activeRun, inspectPhysical) {
     const main = store.getTaskWorkspace(task.id);
     const bindings = task.projectBindings.map(({ projectId, directory }) => ({ projectId, directory }));
     // 1. Owner validation: the Task main workspace must be a durable,
@@ -83,6 +83,27 @@ export function classifyWorkspacePreflight(store, task, roleName, activeRun) {
             };
         }
     }
+    // 3. Physical validation: committed work may advance a managed branch, so
+    // HEAD need not equal its recorded base. It must, however, still descend
+    // from that immutable boundary. A reset/repoint outside the lineage is
+    // physical drift and must fail before Provider launch.
+    if (inspectPhysical !== undefined) {
+        const effective = activeRun?.workspace ?? main;
+        for (const entry of effective.entries) {
+            const physical = inspectPhysical(entry);
+            if (!physical.recordedBaseIsAncestor) {
+                return {
+                    kind: "physical-drift",
+                    reason: `Managed workspace physical HEAD left its recorded lineage: ${task.id}/${roleName}.`,
+                    taskId: task.id,
+                    roleName,
+                    projectId: entry.projectId,
+                    expectedCommit: entry.baseCommit,
+                    physicalCommit: physical.physicalCommit
+                };
+            }
+        }
+    }
     return null;
 }
 /**
@@ -108,7 +129,7 @@ export function formatWorkspacePreflightError(classification) {
                 + "` to inspect the split state, then repair or re-sync the workspace.");
             break;
         case "physical-drift":
-            lines.push(`  Project ${classification.projectId}: expected ${classification.expectedCommit}, physical HEAD is ${classification.physicalCommit}.`);
+            lines.push(`  Project ${classification.projectId}: recorded base ${classification.expectedCommit}, physical HEAD is ${classification.physicalCommit}.`);
             lines.push("  The physical workspace has drifted from the recorded baseline.");
             lines.push("  Use `yui task base status " + classification.taskId + "` to inspect the drift.");
             break;