@zq-silk/yui 0.12.4 → 0.13.1

package/dist/controller/jobControl.js

@@ -11,8 +11,7 @@ import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { resolve, sep } from "node:path";
 import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKey, isDurableJobTerminal, requestDurableJobCancel, retryDurableJobIdempotencyKey } from "../job/durableJob.js";
-import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
-import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
+import { activeLiveRoleAgentSession } from "../executor/agentExecutor.js";
 export function createDurableJobControl(store) {
     return {
         startJob(params, now) {
@@ -63,7 +62,7 @@ export function createDurableJobControl(store) {
                     return null;
                 // rr8: Bind the cancel request to the caller's managed identity. The
                 // same rules as job.start apply, checked against the job's owner.
-                assertCallerAuthorized(tx, caller, current.owner, taskId);
+                assertCallerAuthorized(tx, caller, taskId);
                 const next = requestDurableJobCancel(current, now);
                 if (next !== current)
                     tx.saveDurableJob(taskId, next);
@@ -75,11 +74,7 @@ export function createDurableJobControl(store) {
                 const current = tx.getDurableJob(taskId, jobId);
                 if (current === null)
                     return null;
-                // Acknowledge is a Leader-only recovery decision. Reuse the shared
-                // caller-key, active-Run, receipt, and Session checks, but explicitly
-                // require the Leader role; start/cancel's owner binding intentionally
-                // permits a Worker to operate its own Work Item.
-                assertCallerAuthorized(tx, caller, current.owner, taskId, { leaderOnly: true });
+                assertCallerAuthorized(tx, caller, taskId);
                 const next = acknowledgeUnknownDurableJob(current, now);
                 if (next !== current)
                     tx.saveDurableJob(taskId, next);
@@ -184,9 +179,9 @@ function validateStartParams(store, params) {
         }
     }
     // rr8: Bind the declared owner to the caller's managed identity. A
-    // Reviewer can never start jobs; a Worker can only start jobs owned by
-    // its own Work Item; a Leader or a plain user retains full access.
-    assertCallerAuthorized(store, params.caller, params.owner, params.taskId);
+    // Role is not an authorization boundary. Scope and exact managed Session
+    // identity are verified independently below.
+    assertCallerAuthorized(store, params.caller, params.taskId);
 }
 /**
  * rr8/rr12: Bind the declared job owner to the caller's managed identity. The
@@ -194,49 +189,70 @@ function validateStartParams(store, params) {
  * against durable Run/Session state — a self-reported role or scope is never
  * authority on its own. The rules:
  *
- * - `user` (non-managed): full access, but only when the request carries a
- *   `leaderAssertion` the Controller verifies against the active in-flight
- *   Leader Run. A managed Session that sheds its identity and declares
- *   `scope: "user"` without that proof is rejected.
+ * - `user` (non-managed): rejected because it has no managed Session identity.
+ * - `global`: full Task authority after current Role Session verification.
  * - `task` + mismatched taskId: rejected.
  * - `task` + missing `runId`: rejected (a managed caller must bind to a Run).
  * - `task` + Run not found / not active / `roleName !== role`: rejected — the
  *   claimed Role must be the real Role of an active Run.
- * - `task` + Reviewer: always rejected.
- * - `task` + Leader: must carry `receiptId` and pass the same
- *   active-Run + in-flight-receipt + Session check as `job.acknowledge`, so a
- *   borrowed or stale Leader Run cannot authorize the request.
- * - `task` + any other Role (Worker etc.): the owner must be `work-item` and
- *   the caller's Run must be for that same Work Item.
+ * - `task`: full authority inside the matching Task after active Run and
+ *   per-Session caller-key verification; Role does not narrow it.
  */
 /**
  * rr13: `job.start`/`job.cancel` caller authorization at the Controller
  * boundary. Every identity claim the Controller can verify from durable state
- * (role, runId, receiptId, leaderAssertion) is replayable by any client in the
+ * (role and runId) is replayable by any client in the
  * same Home that reads state.json. The channel itself is therefore not
  * authenticated by those claims alone. A non-replayable per-Session caller key
  * closes the gap:
  *
  * - `user` scope: **rejected outright** for start/cancel. A bare shell or a
- *   managed Session that sheds its identity has no channel binding. The human
- *   operator acts through the Leader Session, which carries a caller key.
+ *   managed Session that sheds its identity has no managed Session binding.
+ * - `global` scope: verified against the current global Role Session.
  * - `task` scope: the caller must present `callerKey` — the
  *   `YUI_JOB_CALLER_KEY` injected at its native Session launch. The Controller
  *   hashes it (SHA-256) and compares against the durable `jobCallerKeyHashes`
  *   map for the caller's Role + Agent. No legacy fallback: an absent hash or a
  *   mismatched key is UNAUTHORIZED.
  *
- * The existing Run/role/WorkItem binding checks (rr8/rr12) run after the key
- * check, so a forged identity that also lacks the key is rejected at the
- * channel boundary before any durable-state lookup.
+ * The existing Run binding checks run after the key check, so a forged
+ * identity that also lacks the key is rejected at the channel boundary.
  */
-function assertCallerAuthorized(store, caller, owner, taskId, options = {}) {
+function assertCallerAuthorized(store, caller, taskId) {
     if (caller.scope === "user") {
         // rr13: A user-scope caller has no per-Session channel binding. Every
-        // durable-state claim it could carry (leaderAssertion etc.) is replayable
+        // durable-state claim it could carry is replayable
         // by any client in the same Home. Reject outright (fail-closed).
         throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed Session caller key; user scope is rejected.");
     }
+    if (caller.scope === "global") {
+        const roleName = caller.role;
+        const agentId = caller.agentId;
+        const role = roleName === undefined ? null : store.getGlobalRole(roleName);
+        const binding = role === null || agentId === undefined
+            ? undefined
+            : role.agentBindings[role.activeAgentId];
+        const sessions = roleName === undefined ? null : store.getGlobalRoleSessionSet(roleName);
+        const session = activeLiveRoleAgentSession(sessions);
+        if (role === null
+            || binding === undefined
+            || agentId === undefined
+            || caller.adapterId === undefined
+            || caller.launchId === undefined
+            || sessions === null
+            || sessions.activeAgentId !== role.activeAgentId
+            || session === null
+            || binding.agentId !== agentId
+            || binding.adapterId !== caller.adapterId
+            || session.agentId !== agentId
+            || session.adapterId !== caller.adapterId
+            || session.launchId !== caller.launchId
+            || (caller.nativeSessionId !== undefined
+                && session.nativeSessionId !== caller.nativeSessionId)) {
+            throw jobControlError("UNAUTHORIZED", "DurableJob control requires the current managed global Agent Session.");
+        }
+        return;
+    }
     if (caller.taskId !== taskId) {
         throw jobControlError("UNAUTHORIZED", "A managed Task Session may not start or cancel Jobs for a different Task.");
     }
@@ -262,29 +278,6 @@ function assertCallerAuthorized(store, caller, owner, taskId, options = {}) {
     if (presentedHash !== expectedHash) {
         throw jobControlError("UNAUTHORIZED", "The managed Session caller key does not match the durable hash.");
     }
-    if (options.leaderOnly && caller.role !== "leader") {
-        throw jobControlError("UNAUTHORIZED", "job.acknowledge requires the current Task Leader Session.");
-    }
-    if (caller.role === "reviewer") {
-        throw jobControlError("UNAUTHORIZED", "A Reviewer may not start or cancel DurableJobs.");
-    }
-    if (caller.role === "leader") {
-        // rr12: Verify the caller is THE current in-flight Task Leader, not a
-        // borrowed or stale Leader Run. This mirrors job.acknowledge.
-        if (caller.receiptId === undefined) {
-            throw jobControlError("UNAUTHORIZED", "A Leader must carry the current in-flight Turn receipt.");
-        }
-        assertLeaderActionRun(store, taskId, {
-            runId: run.id,
-            receiptId: caller.receiptId
-        });
-        return;
-    }
-    // Worker (or any non-leader, non-reviewer managed role): the owner must be
-    // the caller's own Work Item, verified through the caller's Run.
-    if (owner.kind !== "work-item" || run.workItemId !== owner.workItemId) {
-        throw jobControlError("UNAUTHORIZED", "A managed Worker may only start or cancel Jobs owned by its own Work Item.");
-    }
 }
 /**
  * Resolve the managed workspace for the job's owner. Returns null if no
@@ -331,30 +324,6 @@ function readGitHead(path) {
 function isTerminalWorkItemStatus(status) {
     return status === "completed" || status === "failed" || status === "retired";
 }
-/**
- * rr5/f5: Verify that the caller is the current in-flight Task Leader. The
- * runId must identify the active Leader Run and the receiptId must match the
- * Run's current in-flight Turn receipt. This binds the assertion to the
- * Leader identity/session the Controller already tracks — a bare flag or a
- * stale Run/receipt pair is rejected.
- */
-function assertLeaderActionRun(store, taskId, assertion) {
-    const run = store.getActiveAgentRun(taskId, "leader");
-    if (run === null || run.status !== "active" || run.id !== assertion.runId) {
-        throw jobControlError("UNAUTHORIZED", "job.acknowledge requires the current active Task Leader Run.");
-    }
-    const expectedReceipt = formatAgentRunReceiptId(taskId, run.id);
-    if (assertion.receiptId !== expectedReceipt) {
-        throw jobControlError("UNAUTHORIZED", "job.acknowledge Leader receipt does not match the current Run.");
-    }
-    const sessions = store.getTaskRoleSessionSet(taskId, "leader");
-    if (sessions === null
-        || sessions.inFlight === null
-        || sessions.inFlight.runId !== run.id
-        || sessions.inFlight.receiptId !== agentRunDeliveryReceiptId(run)) {
-        throw jobControlError("UNAUTHORIZED", "job.acknowledge Leader Run is not in flight.");
-    }
-}
 /**
  * Strict `job.start` params parsing. Throws CoreApplicationError-shaped errors
  * so the socket layer reports INVALID_PARAMS without leaking internals.
@@ -430,8 +399,7 @@ export function parseDurableJobCancelParams(value) {
 }
 /**
  * rr26: `job.acknowledge` carries the same managed task caller as
- * job.start/job.cancel.  A replayable leaderAssertion without the ephemeral
- * Session caller key is rejected by assertCallerAuthorized.
+ * job.start/job.cancel.
  */
 export function parseDurableJobAcknowledgeParams(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)
@@ -508,9 +476,8 @@ function parseSteps(value) {
  * boundary (fail-closed). A non-managed caller must explicitly resolve to
  * `{scope: "user"}`; the Controller never defaults a missing identity to
  * user scope. A present caller must carry a valid `scope` and may carry
- * optional `taskId`, `role`, `runId`, `receiptId`, and `leaderAssertion`
- * fields. The identity is verified against durable Run state by
- * `assertCallerAuthorized`; parsing only validates the JSON shape.
+ * optional managed Session identity fields. The identity is verified against
+ * durable state by `assertCallerAuthorized`; parsing only validates the JSON shape.
  */
 function parseCaller(value) {
     if (value === undefined) {
@@ -521,14 +488,15 @@ function parseCaller(value) {
     }
     const record = value;
     const allowed = new Set([
-        "scope", "taskId", "role", "runId", "receiptId", "leaderAssertion", "callerKey"
+        "scope", "taskId", "role", "agentId", "adapterId", "launchId", "nativeSessionId",
+        "runId", "callerKey"
     ]);
     for (const key of Object.keys(record)) {
         if (!allowed.has(key)) {
             throw jobControlError("INVALID_PARAMS", "job caller is invalid.");
         }
     }
-    if (record.scope !== "user" && record.scope !== "task") {
+    if (record.scope !== "user" && record.scope !== "global" && record.scope !== "task") {
         throw jobControlError("INVALID_PARAMS", "job caller scope is invalid.");
     }
     const optionalId = (key) => {
@@ -539,9 +507,11 @@ function parseCaller(value) {
     };
     const taskId = optionalId("taskId");
     const role = optionalId("role");
+    const agentId = optionalId("agentId");
+    const adapterId = optionalId("adapterId");
+    const launchId = optionalId("launchId");
+    const nativeSessionId = optionalId("nativeSessionId");
     const runId = optionalId("runId");
-    const receiptId = optionalId("receiptId");
-    const leaderAssertion = parseLeaderAssertion(record.leaderAssertion);
     const callerKey = record.callerKey === undefined
         ? undefined
         : requiredId(record.callerKey, "job caller callerKey");
@@ -549,30 +519,14 @@ function parseCaller(value) {
         scope: record.scope,
         ...(taskId === undefined ? {} : { taskId }),
         ...(role === undefined ? {} : { role }),
+        ...(agentId === undefined ? {} : { agentId }),
+        ...(adapterId === undefined ? {} : { adapterId }),
+        ...(launchId === undefined ? {} : { launchId }),
+        ...(nativeSessionId === undefined ? {} : { nativeSessionId }),
         ...(runId === undefined ? {} : { runId }),
-        ...(receiptId === undefined ? {} : { receiptId }),
-        ...(leaderAssertion === undefined ? {} : { leaderAssertion }),
         ...(callerKey === undefined ? {} : { callerKey })
     };
 }
-/**
- * rr12: Parse a `leaderAssertion` sub-object (`{runId, receiptId}`) carried by
- * a user-scope caller. Returns undefined when absent; throws on a malformed
- * shape.
- */
-function parseLeaderAssertion(value) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== "object" || value === null || Array.isArray(value)
-        || Object.keys(value).length !== 2) {
-        throw jobControlError("INVALID_PARAMS", "job caller leaderAssertion must have runId and receiptId.");
-    }
-    const record = value;
-    return {
-        runId: requiredId(record.runId, "job caller leaderAssertion runId"),
-        receiptId: requiredId(record.receiptId, "job caller leaderAssertion receiptId")
-    };
-}
 function parseStringMap(value, label) {
     if (value === undefined)
         return {};

package/dist/integration/gitIntegrationService.js

@@ -16,7 +16,7 @@ import { acquireProjectMaintenanceLocks } from "../repository/projectMaintenance
 import { taskWorkspaceRefSegment } from "../repository/taskWorkspaceIdentity.js";
 import { FileTaskRuntimeIsolation } from "../runtime/taskRuntimeIsolation.js";
 import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
-import { recordIntegrationCheckJob, requireLeaderDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
+import { recordIntegrationCheckJob, requireResolutionDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
 import { createManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { readRuntimeIdentity } from "../release/runtimeRelease.js";
@@ -228,7 +228,7 @@ export class GitIntegrationService {
             }
             catch (error) {
                 if (error instanceof RemoteBaselineConflictError) {
-                    const pending = requireLeaderDecision(current, {
+                    const pending = requireResolutionDecision(current, {
                         affectedPaths: error.affectedPaths,
                         summary: error.message
                     }, this.now());
@@ -592,7 +592,7 @@ export class GitIntegrationService {
                     await git(["-C", candidatePath, "cherry-pick", "--skip"]);
                     continue;
                 }
-                const pending = requireLeaderDecision(attempt, {
+                const pending = requireResolutionDecision(attempt, {
                     affectedPaths,
                     summary: `ChangeSet ${changeSetId} conflicts with ${attempt.targetRef}.`
                 }, this.now());

package/dist/integration/integrationAttempt.js

@@ -4,7 +4,7 @@ import { normalizeCheckResult } from "./checkResult.js";
 export function createIntegrationAttempt(input, now) {
     const timestamp = now.toISOString();
     return validateIntegrationAttempt({
-        schemaVersion: 4,
+        schemaVersion: 5,
         id: input.id,
         taskId: input.taskId,
         projectId: input.projectId,
@@ -37,7 +37,7 @@ export function recordIntegrationCheckJob(attempt, jobId, now) {
         updatedAt: now.toISOString()
     });
 }
-export function requireLeaderDecision(attempt, report, now) {
+export function requireResolutionDecision(attempt, report, now) {
     validateIntegrationAttempt(attempt);
     const continuingAfterResolution = attempt.status === "blocked"
         && attempt.resolution?.action === "manual-resolution";
@@ -52,7 +52,7 @@ export function requireLeaderDecision(attempt, report, now) {
         updatedAt: now.toISOString()
     });
 }
-export function recordResolutionDecision(attempt, decision, now) {
+export function recordResolutionDecision(attempt, decision, decidedBy, now) {
     validateIntegrationAttempt(attempt);
     if (attempt.status !== "blocked" || attempt.conflict === undefined) {
         throw new Error("Integration has no pending semantic decision.");
@@ -67,13 +67,19 @@ export function recordResolutionDecision(attempt, decision, now) {
         resolution: {
             action: decision.action,
             rationale: requireText(decision.rationale, "Resolution rationale"),
-            decidedBy: "leader",
+            decidedBy: requireTaskControlActor(decidedBy),
             decidedAt: timestamp
         },
         updatedAt: timestamp,
         ...(decision.action === "reject" ? { endedAt: timestamp } : {})
     });
 }
+function requireTaskControlActor(value) {
+    if (value !== "user" && value !== "operator" && value !== "leader") {
+        throw new Error(`Integration decision actor is invalid: ${String(value)}.`);
+    }
+    return value;
+}
 const TERMINAL_STATUSES = ["committed", "superseded", "failed"];
 export function updateIntegrationAttempt(attempt, patch, now) {
     validateIntegrationAttempt(attempt);
@@ -117,8 +123,8 @@ export function supersedeIntegration(attempt, reason, now) {
     });
 }
 export function validateIntegrationAttempt(attempt) {
-    if (attempt.schemaVersion !== 4) {
-        throw new Error("IntegrationAttempt must use schemaVersion 4.");
+    if (attempt.schemaVersion !== 5) {
+        throw new Error("IntegrationAttempt must use schemaVersion 5.");
     }
     validateTaskRecordReference({
         taskId: attempt.taskId,
@@ -162,9 +168,7 @@ export function validateIntegrationAttempt(attempt) {
             throw new Error(`Resolution action is invalid: ${String(attempt.resolution.action)}.`);
         }
         requireText(attempt.resolution.rationale, "Resolution rationale");
-        if (attempt.resolution.decidedBy !== "leader") {
-            throw new Error("Only the Leader may record a ResolutionDecision.");
-        }
+        requireTaskControlActor(attempt.resolution.decidedBy);
         requireTimestamp(attempt.resolution.decidedAt, "Resolution decidedAt");
     }
     attempt.checks?.forEach(normalizeCheckResult);

package/dist/integration/integrationQueueService.js

@@ -701,11 +701,11 @@ export async function reconcileIntegrationQueueEntry(store, taskId, entryId, git
 }
 /**
  * A conflicted entry may carry a blocked IntegrationAttempt waiting for a
- * leader decision.  Requeue or supersede IS that decision — the blocked
+ * Task Agent decision. Requeue or supersede IS that decision — the blocked
  * attempt is abandoned — so resolve it as rejected (terminal `failed`)
  * rather than leaving it to block Task retirement.
  */
-function resolveBlockedAttempt(store, taskId, entry, decision, now) {
+function resolveBlockedAttempt(store, taskId, entry, decision, decidedBy, now) {
     if (entry.integrationAttemptId === undefined)
         return;
     const attempt = store.getIntegrationAttempt(taskId, entry.integrationAttemptId);
@@ -714,7 +714,7 @@ function resolveBlockedAttempt(store, taskId, entry, decision, now) {
     const rejected = recordResolutionDecision(attempt, {
         action: "reject",
         rationale: `Integration Attempt rejected by queue ${decision}.`
-    }, now());
+    }, decidedBy, now());
     store.saveIntegrationAttempt(taskId, rejected);
 }
 /**
@@ -737,7 +737,7 @@ function assertRecoverableAttempt(store, taskId, entry, action) {
     }
 }
 /** Retry a conflicted item (for example after a gate failure was fixed). */
-export function requeueIntegrationQueueEntry(store, taskId, entryId, now = () => new Date()) {
+export function requeueIntegrationQueueEntry(store, taskId, entryId, decidedBy, now = () => new Date()) {
     // The committed-Attempt guard, the blocked-Attempt finalization, and the
     // queue write must be atomic: a concurrent manual-resolution continue can
     // commit the Attempt between the guard and the write, leaving the queue
@@ -749,20 +749,20 @@ export function requeueIntegrationQueueEntry(store, taskId, entryId, now = () =>
             throw new Error(`Integration queue entry not found: ${taskId}/${entryId}.`);
         }
         assertRecoverableAttempt(tx, taskId, entry, "requeue");
-        resolveBlockedAttempt(tx, taskId, entry, "requeue", now);
+        resolveBlockedAttempt(tx, taskId, entry, "requeue", decidedBy, now);
         const waiting = markIntegrationQueueRequeued(entry, now());
         tx.saveIntegrationQueueEntry(taskId, waiting);
         return waiting;
     });
 }
-export function supersedeIntegrationQueueEntry(store, taskId, entryId, reason, now = () => new Date()) {
+export function supersedeIntegrationQueueEntry(store, taskId, entryId, reason, decidedBy, now = () => new Date()) {
     return store.transaction((tx) => {
         const entry = tx.getIntegrationQueueEntry(taskId, entryId);
         if (entry === null) {
             throw new Error(`Integration queue entry not found: ${taskId}/${entryId}.`);
         }
         assertRecoverableAttempt(tx, taskId, entry, "supersede");
-        resolveBlockedAttempt(tx, taskId, entry, "supersede", now);
+        resolveBlockedAttempt(tx, taskId, entry, "supersede", decidedBy, now);
         const superseded = markIntegrationQueueSuperseded(entry, reason, now());
         tx.saveIntegrationQueueEntry(taskId, superseded);
         return superseded;

package/dist/milestone/milestone.js

@@ -1,15 +1,21 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
-export function createMilestone(id, taskId, title, summary, now) {
+export function createMilestone(id, taskId, title, summary, createdBy, now) {
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         id: validateTaskRecordReference({ taskId, localId: id }, "milestone").localId,
         taskId: requireSafeIdentity(taskId, "Task id"),
         title: requireText(title, "Milestone title"),
         summary: requireText(summary, "Milestone summary"),
-        createdBy: "leader",
+        createdBy: requireTaskControlActor(createdBy),
         createdAt: now.toISOString()
     };
 }
+function requireTaskControlActor(value) {
+    if (value !== "user" && value !== "operator" && value !== "leader") {
+        throw new Error(`Milestone createdBy is invalid: ${String(value)}.`);
+    }
+    return value;
+}
 function requireSafeIdentity(value, label) {
     const normalized = requireText(value, label);
     if (["__proto__", "prototype", "constructor", ".", ".."].includes(normalized)

package/dist/review/deltaRecheck.js

@@ -127,7 +127,7 @@ export function buildDeltaRecheckDispatchContext(input) {
         "- finding: the diff introduces a material problem; report it as a finding.",
         "- requires-full-review: you cannot prove equivalence (uncertainty, cross-scope,",
         "  semantic change, evidence doubt). This is the safe default.",
-        "Yui verified only the technical delta boundary; the Leader selected this mode.",
+        "Yui verified only the technical delta boundary; a Task-control Agent selected this mode.",
         `Previous accepted ReviewRound: ${previousRound.id}@${record.previousBaseCommit}`,
         `Previous acceptance summary: ${compact(previousRound.summary ?? previousRound.report ?? "")}`,
         ...(round.taskCandidate?.projects.map((project) => {

package/dist/review/reviewFinding.js

@@ -6,8 +6,8 @@ export const BLOCKING_FINDING_DISPOSITIONS = [
     "open",
     "fixed-pending-review"
 ];
-/** Dispositions the Leader may set explicitly. */
-export const LEADER_FINDING_DISPOSITIONS = [
+/** Dispositions a Task-control Agent may set explicitly. */
+export const TASK_CONTROL_FINDING_DISPOSITIONS = [
     "fixed-pending-review",
     "verified-fixed",
     "accepted-risk",
@@ -86,7 +86,7 @@ export function createReviewFinding(id, taskId, input, now) {
  */
 export function disposeReviewFinding(finding, input) {
     validateReviewFinding(finding);
-    if (!LEADER_FINDING_DISPOSITIONS.includes(input.disposition)) {
+    if (!TASK_CONTROL_FINDING_DISPOSITIONS.includes(input.disposition)) {
         throw new Error(`ReviewFinding disposition is not a Leader decision: ${input.disposition}.`);
     }
     if (finding.disposition !== "open" && finding.disposition !== "fixed-pending-review") {

package/dist/review/reviewRound.js

@@ -5,7 +5,7 @@ import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { assertExecutionGroupTransition, resetReviewExecutionLane, validateExecutionGroup } from "../execution/executionGroup.js";
 export function createReviewRound(id, taskId, workItemId, candidateId, reviewerRoleName, requestedBy, reviewBaseCommit, now, executionGroup) {
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         workItemId: requireIdentity(workItemId, "Work Item id"),
@@ -21,7 +21,7 @@ export function createReviewRound(id, taskId, workItemId, candidateId, reviewerR
 export function createTaskReviewRound(id, taskId, reviewerRoleName, requestedBy, taskCandidate, now, taskFinalReviewContract, executionGroup) {
     const candidate = validateTaskReviewCandidate(taskCandidate);
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         reviewerRoleName: requireIdentity(reviewerRoleName, "Reviewer Role"),
@@ -47,7 +47,7 @@ export function createTaskReviewRound(id, taskId, reviewerRoleName, requestedBy,
 export function createTaskDeltaReviewRound(id, taskId, reviewerRoleName, requestedBy, taskCandidate, deltaRecheck, now, taskFinalReviewContract, executionGroup) {
     const candidate = validateTaskReviewCandidate(taskCandidate);
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         reviewerRoleName: requireIdentity(reviewerRoleName, "Reviewer Role"),
@@ -138,7 +138,7 @@ export function finishReviewRound(round, status, summary, now, result = {}) {
  * returns to pending so infrastructure retries do not manufacture a new
  * semantic ReviewRound or duplicate findings.
  */
-export function retryTaskReviewRound(round, executionLaneId) {
+export function retryTaskReviewRound(round, requestedBy, executionLaneId) {
     validateReviewRound(round);
     if ((round.scope ?? "work-item") !== "task") {
         throw new Error(`Only a Task-final ReviewRound can be retried in place: ${round.id}.`);
@@ -180,7 +180,7 @@ export function retryTaskReviewRound(round, executionLaneId) {
         // Keep the historical attempt Group and Lane addressable from AgentRun
         // history while resetting the Lane for another dispatch attempt.
         ...(retryExecutionGroup === undefined ? {} : { executionGroup: retryExecutionGroup }),
-        requestedBy: "leader",
+        requestedBy: validateReviewRequestSource(requestedBy),
         status: "pending",
         ...(round.workspace === undefined ? {} : { workspace: round.workspace }),
         createdAt: round.createdAt
@@ -359,8 +359,8 @@ export function updateReviewExecutionGroup(round, executionGroup) {
     return validateReviewRound({ ...round, executionGroup });
 }
 export function validateReviewRound(round) {
-    if (round.schemaVersion !== 5)
-        throw new Error("ReviewRound must use schemaVersion 5.");
+    if (round.schemaVersion !== 6)
+        throw new Error("ReviewRound must use schemaVersion 6.");
     validateTaskRecordReference({ taskId: round.taskId, localId: round.id }, "reviewRound");
     requireIdentity(round.reviewerRoleName, "Reviewer Role");
     requireCommit(round.reviewBaseCommit, "Review base commit");
@@ -637,7 +637,10 @@ function requireCommit(value, label) {
     return commit;
 }
 function validateReviewRequestSource(source) {
-    if (source !== "policy" && source !== "leader") {
+    if (source !== "policy"
+        && source !== "user"
+        && source !== "operator"
+        && source !== "leader") {
         throw new Error(`Review request source is invalid: ${String(source)}.`);
     }
     return source;

package/dist/storage/migration/productionRegistry.js

@@ -57,6 +57,8 @@ const REVIEW_ROUND_GIT_SNAPSHOT_FROM_VERSION = 3;
 const REVIEW_ROUND_GIT_SNAPSHOT_TO_VERSION = 4;
 const REVIEW_ROUND_TASK_ANCHOR_FROM_VERSION = 4;
 const REVIEW_ROUND_TASK_ANCHOR_TO_VERSION = 5;
+const REVIEW_ROUND_ACTOR_FROM_VERSION = 5;
+const REVIEW_ROUND_ACTOR_TO_VERSION = 6;
 const ACTIVE_RUN_POINTER_FROM_VERSION = 1;
 const ACTIVE_RUN_POINTER_TO_VERSION = 2;
 const ACTIVE_RUN_POINTER_NAMESPACE_FROM_VERSION = 2;
@@ -69,6 +71,10 @@ const INTEGRATION_ATTEMPT_FROM_VERSION = 2;
 const INTEGRATION_ATTEMPT_TO_VERSION = 3;
 const INTEGRATION_ATTEMPT_GATE_IDENTITY_FROM_VERSION = 3;
 const INTEGRATION_ATTEMPT_GATE_IDENTITY_TO_VERSION = 4;
+const INTEGRATION_ATTEMPT_ACTOR_FROM_VERSION = 4;
+const INTEGRATION_ATTEMPT_ACTOR_TO_VERSION = 5;
+const MILESTONE_ACTOR_FROM_VERSION = 1;
+const MILESTONE_ACTOR_TO_VERSION = 2;
 const INTEGRATION_QUEUE_FROM_VERSION = 0;
 const INTEGRATION_QUEUE_TO_VERSION = 1;
 const CONTEXT_SNAPSHOT_FROM_VERSION = 0;
@@ -174,12 +180,15 @@ export function createProductionStorageRegistry() {
         .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_FROM_VERSION, REVIEW_ROUND_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_GIT_SNAPSHOT_FROM_VERSION, REVIEW_ROUND_GIT_SNAPSHOT_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(reviewRoundTaskAnchorStep())
+        .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_ACTOR_FROM_VERSION, REVIEW_ROUND_ACTOR_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(recordFamilyStep("activeRunPointer", ACTIVE_RUN_POINTER_FROM_VERSION, ACTIVE_RUN_POINTER_TO_VERSION, "activeRuns"))
         .registerOfflineMigration(managedWorkspaceFamilyStep())
         .registerOfflineMigration(activeRunPointerNamespaceStep())
         .registerOfflineMigration(changeSetManifestStep())
         .registerOfflineMigration(integrationAttemptSupersededStep())
         .registerOfflineMigration(recordFamilyStep("integrationAttempt", INTEGRATION_ATTEMPT_GATE_IDENTITY_FROM_VERSION, INTEGRATION_ATTEMPT_GATE_IDENTITY_TO_VERSION, "integrationAttempts"))
+        .registerOfflineMigration(recordFamilyStep("integrationAttempt", INTEGRATION_ATTEMPT_ACTOR_FROM_VERSION, INTEGRATION_ATTEMPT_ACTOR_TO_VERSION, "integrationAttempts"))
+        .registerOfflineMigration(recordFamilyStep("milestone", MILESTONE_ACTOR_FROM_VERSION, MILESTONE_ACTOR_TO_VERSION, "milestones"))
         .registerOfflineMigration(integrationQueueIntroductionStep())
         .registerOfflineMigration(contextSnapshotIntroductionStep())
         .registerCompatible(storedTaskDurableJobsStep())

package/dist/storage/taskStore.js

@@ -67,13 +67,13 @@ export const CURRENT_CONTEXT_SNAPSHOT_SCHEMA_VERSION = 1;
 export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 3;
 export const CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION = 2;
 export const CURRENT_WORK_ITEM_SCHEMA_VERSION = 12;
-export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 5;
+export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 6;
 export const CURRENT_CHANGE_SET_SCHEMA_VERSION = 3;
-export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 4;
+export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 5;
 export const CURRENT_MESSAGE_SCHEMA_VERSION = 3;
 export const CURRENT_INPUT_REQUEST_SCHEMA_VERSION = 2;
 export const CURRENT_DECISION_SCHEMA_VERSION = 1;
-export const CURRENT_MILESTONE_SCHEMA_VERSION = 1;
+export const CURRENT_MILESTONE_SCHEMA_VERSION = 2;
 export const CURRENT_EVENT_SCHEMA_VERSION = 2;
 export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 1;
 export const CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION = 1;
@@ -2621,8 +2621,10 @@ function storedMilestone(value) {
     validateTaskRecordReference({ taskId: milestone.taskId, localId: milestone.id }, "milestone");
     requireNormalizedText(milestone.title, "Milestone title");
     requireNormalizedText(milestone.summary, "Milestone summary");
-    if (milestone.createdBy !== "leader") {
-        throw new StorageRecordError("Milestone createdBy must be leader.");
+    if (milestone.createdBy !== "user"
+        && milestone.createdBy !== "operator"
+        && milestone.createdBy !== "leader") {
+        throw new StorageRecordError("Milestone createdBy is invalid.");
     }
     requireTimestamp(milestone.createdAt, "Milestone createdAt");
     return milestone;
@@ -3950,9 +3952,8 @@ function validReviewRoundTransition(existing, candidate) {
         || !isDeepStrictEqual(existing.taskCandidate, candidate.taskCandidate)
         || !sameTaskFinalReviewContract(existing.taskFinalReviewContract, candidate.taskFinalReviewContract)
         || !compatibleExecutionGroups(existing.executionGroup, candidate.executionGroup)
-        // Issue 06: a Leader retry resets a failed Task-final Round to pending;
-        // the retry is itself a Leader request, so requestedBy may change from
-        // the original policy/contract value to "leader".
+        // Issue 06: an explicit Task-control retry resets a failed Task-final
+        // Round to pending, so requestedBy may change from the original actor.
         || (existing.requestedBy !== candidate.requestedBy
             && !(existing.status === "failed"
                 && candidate.status === "pending"