@zq-silk/yui 0.15.8 → 0.15.11

package/dist/commands/taskIntegrationCommands.js

@@ -3,7 +3,7 @@ import { assertProjectActive, resolveProject } from "../repository/project.js";
 import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
 import { usageError } from "../errors/cliError.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
-import { createIntegrationAttempt, recordResolutionDecision, supersedeIntegration, updateIntegrationAttempt } from "../integration/integrationAttempt.js";
+import { createIntegrationAttempt, recordResolutionDecision, supersedeIntegration } from "../integration/integrationAttempt.js";
 import { GitIntegrationService } from "../integration/gitIntegrationService.js";
 import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
 import { runTaskIntegrationQueueCommand } from "./taskIntegrationQueueCommands.js";
@@ -171,6 +171,7 @@ async function continueIntegration(args, store, home, now, options) {
     taskLocalActor(store, options.environment, integration.taskId);
     if (integration.status !== "validating"
         && integration.status !== "running"
+        && integration.status !== "conflicted"
         && (integration.status !== "blocked"
             || integration.resolution?.action !== "manual-resolution")) {
         throw usageError(`Integration is not ready to continue: ${integration.id}/${integration.status}.`);
@@ -181,11 +182,13 @@ async function runIntegration(store, home, integration, now, options) {
     const result = await new GitIntegrationService(home, store, undefined, now, options.environment, undefined, options.jobPort).integrate(integration.taskId, integration.id);
     const output = result.status === "committed"
         ? `Integrated ${integrationSourceLabel(result.attempt)} into ${result.attempt.targetRef} with CAS (${result.attempt.id})\n`
-        : result.status === "blocked"
-            ? `Integration ${result.attempt.id} requires a Task Agent resolution decision in ${result.workspace.path}\n`
-            : result.status === "checks-running"
-                ? `Integration ${result.attempt.id} checks are running as DurableJob ${result.job.id}; run 'yui task integration continue ${result.attempt.taskId}/${result.attempt.id}' when the job finishes\n`
-                : `Integration ${result.attempt.id} failed; target ref was not advanced\n`;
+        : result.status === "conflicted"
+            ? `Integration ${result.attempt.id} is conflicted in ${result.workspace.path}; resolve files, then run 'yui task integration continue ${result.attempt.taskId}/${result.attempt.id}' (no prior resolve required)\n`
+            : result.status === "blocked"
+                ? `Integration ${result.attempt.id} needs Leader attention in ${result.workspace.path}: ${result.attempt.summary ?? result.attempt.conflict?.summary ?? "Inspect the current attempt"}\n`
+                : result.status === "checks-running"
+                    ? `Integration ${result.attempt.id} checks are running as DurableJob ${result.job.id}; run 'yui task integration continue ${result.attempt.taskId}/${result.attempt.id}' when the job finishes\n`
+                    : `Integration ${result.attempt.id} failed; inspect its target and preserved evidence\n`;
     return { output, data: result };
 }
 function resolveDecision(args, store, now, environment, home) {
@@ -223,41 +226,16 @@ async function abortIntegration(args, store, now, options, home) {
     const integration = requireIntegration(store, parsed.positionals[0], options.environment);
     requireActiveIntegrationTask(store, integration);
     taskLocalActor(store, options.environment, integration.taskId);
-    if (integration.status !== "running" && integration.status !== "blocked") {
-        throw usageError(`Integration cannot be aborted from ${integration.status}: ${integration.id}.`);
-    }
     const reason = parsed.one.get("--reason");
     if (reason === undefined)
         throw usageError(usage);
-    if (integration.jobId !== undefined && options.jobPort !== undefined) {
-        await options.jobPort.cancelJob(integration.taskId, integration.jobId);
-    }
-    return store.transaction((tx) => {
-        // Re-read inside the transaction: a concurrent `continue` can advance the
-        // Attempt to validating (and then commit the target) after the initial
-        // read.  Aborting a validating or committed Attempt would leave the
-        // target advanced while the Attempt is failed.
-        const current = tx.getIntegrationAttempt(integration.taskId, integration.id);
-        if (current === null) {
-            throw usageError(`Integration Attempt not found: ${integration.taskId}/${integration.id}.`);
-        }
-        if (current.status !== "running" && current.status !== "blocked") {
-            throw usageError(`Integration cannot be aborted from ${current.status}: ${current.id}.`);
-        }
-        taskLocalActor(tx, options.environment, current.taskId);
-        const aborted = updateIntegrationAttempt(current, {
-            status: "failed",
-            checks: [
-                ...(current.checks ?? []),
-                { name: "aborted", outcome: "failed", details: reason }
-            ]
-        }, now);
-        tx.saveIntegrationAttempt(aborted.taskId, aborted);
-        return {
-            output: `Aborted Integration ${aborted.id}; start a new Integration Attempt to retry\n`,
-            data: { integration: aborted }
-        };
-    });
+    const settled = await new GitIntegrationService(home, store, undefined, () => now, options.environment, undefined, options.jobPort).abort(integration.taskId, integration.id, reason, (tx, taskId) => taskLocalActor(tx, options.environment, taskId));
+    return {
+        output: settled.status === "committed"
+            ? `Integration ${settled.id} had already advanced its target; recorded committed, not aborted.\n`
+            : `Aborted Integration ${settled.id}; candidate, workspace and history are preserved. This is not Git abort or proof of Job quiescence. Choose an authorized replacement delivery path.\n`,
+        data: { integration: settled }
+    };
 }
 function supersedeIntegrationCommand(args, store, now, environment, home) {
     const usage = "Task Integration supersede usage: yui task integration supersede <task>/<integration> --reason <text>.";

package/dist/commands/taskIntegrationQueueCommands.js

@@ -138,7 +138,7 @@ async function process(args, store, home, options) {
         if (result.status === "committed") {
             return `${entry.id} committed ${entry.changeSetId} -> ${entry.targetAfter ?? "-"}`;
         }
-        if (result.status === "blocked") {
+        if (result.status === "blocked" || result.status === "conflicted") {
             return `${entry.id} conflicted ${entry.changeSetId}: ${entry.conflictSummary ?? "blocked"}`;
         }
         return `${entry.id} conflicted ${entry.changeSetId}: ${entry.conflictSummary ?? "gate failure"}`;

package/dist/commands/taskRemoteDeliveryCommand.js

@@ -50,7 +50,7 @@ export function createTaskRemoteDeliveryProof(store, task, currentCandidate = nu
         delivery
     };
 }
-export function assertTaskRemoteDeliveryProof(store, task, proof, options = {}) {
+export function assertTaskRemoteDeliveryProof(store, task, proof) {
     if (proof === undefined || proof.schemaVersion !== 1) {
         throw usageError(`Task remote-delivery preflight proof is required: ${task.id}.`);
     }
@@ -60,16 +60,16 @@ export function assertTaskRemoteDeliveryProof(store, task, proof, options = {})
     if (!isDeepStrictEqual(proof.publications, store.listPublicationReferences(task.id))) {
         throw usageError(`Task Publication evidence changed after remote-delivery preflight: ${task.id}.`);
     }
-    assertTaskRemoteDeliveryIntegrated(proof.delivery, options);
+    assertTaskRemoteDeliveryIntegrated(proof.delivery);
     return proof.delivery;
 }
-export function assertTaskRemoteDeliveryIntegrated(delivery, options = {}) {
+export function assertTaskRemoteDeliveryIntegrated(delivery) {
     if (!delivery.allMerged) {
         const headUnavailable = delivery.projects.filter((project) => (project.codeDelivery !== "none"
             && project.coverage === "head-unavailable"));
         if (headUnavailable.length > 0 && delivery.source === "task-completed") {
             throw usageError(`Task ${delivery.taskId} has no frozen completion heads for: ${headUnavailable.map(({ projectId }) => projectId).join(", ")}. Reopen and complete it again to record exact heads before archiving; `
-                + "--force cannot override missing head evidence.");
+                + "An explicitly authorized --force archive retains this evidence gap.");
         }
         const uncovered = delivery.projects
             .filter((project) => project.codeDelivery !== "none" && !project.merged)
@@ -79,7 +79,7 @@ export function assertTaskRemoteDeliveryIntegrated(delivery, options = {}) {
         throw usageError(`Task ${delivery.taskId} is not fully merged into remote delivery: ${uncovered || "expected Project heads are unavailable"}. Record confirmed current-head evidence with task publication upsert, `
             + "or use task archive --abandon for an intentional non-merge.");
     }
-    if (delivery.allVerified || options.forceUnverified === true)
+    if (delivery.allVerified)
         return;
     const unverified = delivery.projects
         .filter((project) => (project.codeDelivery !== "none"
@@ -91,7 +91,7 @@ export function assertTaskRemoteDeliveryIntegrated(delivery, options = {}) {
     throw usageError(`Task ${delivery.taskId} has merged Publication evidence that is not verified: `
         + `${unverified || "verification evidence is unavailable"}. Run task publication verify `
         + "for each Publication, or repeat task archive --integrated --force to explicitly "
-        + "override verification. --force never overrides missing, stale, open, or closed merge evidence.");
+        + "archive despite evidence gaps, retaining the original delivery facts.");
 }
 export function renderTaskRemoteDelivery(delivery, indent = "") {
     const source = `${delivery.source}${delivery.provisional ? " (provisional)" : ""}`;

package/dist/commands/taskRoleRuntimeStatus.js

@@ -11,6 +11,40 @@ import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { formatRunReceiptId } from "../task/taskRecordReference.js";
 import { operationalTaskRecords } from "../task/taskRecordRetirement.js";
 import { projectSessionTokenMetrics, resolveSessionTokenIdentity } from "../runtime/sessionTokenMetrics.js";
+export function taskRoleHostDiagnostic(host) {
+    const snapshot = host.snapshot;
+    if (snapshot === undefined)
+        return `unavailable: ${host.detail ?? "Host could not be read"}`;
+    const delivery = snapshot.eventDelivery;
+    return [
+        `Provider Host=${snapshot.state}`,
+        delivery === undefined ? "event delivery=unreported (legacy Host)" :
+            `pending facts=${delivery.pending}; native terminals awaiting acknowledgement=${delivery.pendingTerminals}`,
+        delivery?.failure === undefined ? undefined :
+            `reporting failure (${delivery.failure.stage}, ${delivery.failure.observedAt}): ${delivery.failure.detail}`,
+        snapshot.detail
+    ].filter(Boolean).join("; ");
+}
+/** Overlay live reporting evidence without rewriting Run/Provider/business truth. */
+export function withTaskRoleHostObservation(status, host) {
+    if (host === undefined)
+        return status;
+    const snapshot = host.snapshot;
+    if (snapshot !== undefined && (snapshot.nativeSessionId !== status.nativeSession?.nativeSessionId
+        || snapshot.adapterId !== status.nativeSession?.adapterId)) {
+        return { ...status, host: { detail: "Host does not match the recorded native Session." } };
+    }
+    const reportingNeedsAttention = snapshot !== undefined && (snapshot.state === "failed" || snapshot.state === "exited"
+        || snapshot.eventDelivery?.failure !== undefined
+        || (snapshot.eventDelivery?.pendingTerminals ?? 0) > 0);
+    return {
+        ...status, host,
+        ...(reportingNeedsAttention ? {
+            health: "needs-attention",
+            healthReason: `${taskRoleHostDiagnostic(host)}. Formal Run status and business acceptance are unchanged.`
+        } : {})
+    };
+}
 export function inspectTaskRoleRuntimeStatuses(taskId, roles, store, panes, now = new Date()) {
     const taskOpenInputRequestCount = store.listInputRequests(taskId)
         .filter((request) => request.status === "open").length;
@@ -99,6 +133,7 @@ export function renderTaskRoleRuntimeStatus(status) {
             : "none"}`,
         `  Native session   ${nativeSession}`,
         `  AgentRuntime    ${runtime}`,
+        ...(status.host === undefined ? [] : [`  Host reporting   ${taskRoleHostDiagnostic(status.host)}`]),
         `  Session tokens   ${sessionTokens}`,
         `  Runtime cleanup  ${status.runtimeCleanupPending ? "pending" : "none"}`,
         `  tmux pane        ${tmux}`,

package/dist/context/runContextPack.js

@@ -3,7 +3,7 @@ import { TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT } from "../task/publica
 import { RUN_INPUT_MAX_DELTAS } from "./runInputContract.js";
 import { assertWorkItemDependenciesCompleted } from "../workItem/dependencyGate.js";
 import { governingWorkItemCandidate, workItemExecutionGroupById } from "../workItem/workItem.js";
-import { stableArtifactRef } from "../resources/projectResource.js";
+import { formatGitArtifactRef, validateGitArtifactRef } from "../artifacts/gitArtifactRef.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { contextContentDigest, contextSnapshotRef, createContextSnapshot, validateContextSnapshot } from "./contextSnapshot.js";
 import { MAX_SYNTHESIS_SOURCE_RUNS, sourceRunContextValue } from "./sourceRunContext.js";
@@ -99,14 +99,14 @@ export function freezeWorkItemExecutionAssignmentContextSnapshot(store, input, n
         materialize("L2", "task", task.id, task),
         materialize("L3", "work-item", workItem.id, workItem)
     ];
-    materialized.push(...candidateArtifacts(store, task.id, workItem.candidates));
+    materialized.push(...candidateArtifacts(task.id, workItem.candidates));
     assertWorkItemDependenciesCompleted(store, workItem);
     for (const dependencyId of workItem.dependsOn) {
         const dependency = store.getWorkItem(task.id, dependencyId);
         if (dependency === null)
             throw new Error(`WorkItem dependency disappeared: ${dependencyId}.`);
         materialized.push(materialize("L3", "accepted-work-item", dependency.id, dependency));
-        materialized.push(...candidateArtifacts(store, task.id, dependency.candidates));
+        materialized.push(...candidateArtifacts(task.id, dependency.candidates));
     }
     for (const binding of task.projectBindings) {
         const project = store.getProject(binding.projectId);
@@ -371,7 +371,7 @@ function collectAuthorizedContext(store, run) {
         if (item === null)
             throw new Error(`AgentRun WorkItem not found: ${run.workItemId}.`);
         result.push(materialize("L3", "work-item", item.id, item));
-        result.push(...candidateArtifacts(store, task.id, item.candidates));
+        result.push(...candidateArtifacts(task.id, item.candidates));
         if (view === "worker") {
             assertWorkItemDependenciesCompleted(store, item);
             for (const dependencyId of item.dependsOn) {
@@ -379,7 +379,7 @@ function collectAuthorizedContext(store, run) {
                 if (dependency === null)
                     throw new Error(`WorkItem dependency disappeared: ${dependencyId}.`);
                 result.push(materialize("L3", "accepted-work-item", dependency.id, dependency));
-                result.push(...candidateArtifacts(store, task.id, dependency.candidates));
+                result.push(...candidateArtifacts(task.id, dependency.candidates));
             }
         }
     }
@@ -394,7 +394,7 @@ function collectAuthorizedContext(store, run) {
                 if (candidate === undefined)
                     continue;
                 result.push(materialize("L3", "candidate", `${item.id}/${candidate.id}`, candidate));
-                result.push(...candidateArtifacts(store, task.id, [candidate]));
+                result.push(...candidateArtifacts(task.id, [candidate]));
             }
         }
         if (round.deltaRecheck !== undefined) {
@@ -425,9 +425,12 @@ function collectAuthorizedContext(store, run) {
         }
     }
     if (view === "leader") {
-        for (const artifact of store.listArtifacts(task.id)) {
-            result.push(materialize("L3", "artifact", artifact.id, artifact));
-        }
+        // File artifacts are NOT enumerated into the synchronous context pack: the
+        // core cursor does not cover file edits, and an ambient directory listing
+        // here would be exactly the forbidden update-time mirror (§3.7). The Leader
+        // reads current artifacts on demand via the async `artifact.list` /
+        // `artifact.read` capabilities; frozen Candidate artifacts still enter the
+        // pack as commit-pinned pointers through candidateArtifacts().
         for (const preparation of store.listEnvironmentPreparations(task.id)) {
             result.push(materialize("L3", "environment-preparation", preparation.id, preparation));
         }
@@ -476,16 +479,25 @@ function collectAuthorizedContext(store, run) {
     return [...unique.values()].sort((left, right) => (contextRefIdentity(left.ref).localeCompare(contextRefIdentity(right.ref))));
 }
 /** Only artifacts attached to already-authorized candidates enter a bounded
- * Worker/Reviewer snapshot. Their immutable Home content survives cleanup of
+ * Worker/Reviewer snapshot. Each is a commit-pinned pointer: the commit
+ * self-certifies the frozen bytes, so the pointer is carried as pure data with
+ * NO build-time Git read. The bytes are resolved lazily on the async expand
+ * path (`artifact.read` at the pinned commit); the pointer survives cleanup of
  * the producing workspace and Session. */
-function candidateArtifacts(store, taskId, candidates) {
+function candidateArtifacts(taskId, candidates) {
     return candidates.flatMap((candidate) => (candidate.artifactRefs ?? []).map((ref) => {
-        const artifact = ref.taskId === taskId ? store.getArtifact(taskId, ref.artifactId) : null;
-        const actual = artifact === null ? null : stableArtifactRef(artifact);
-        if (artifact === null || actual?.kind !== ref.kind || actual.digest !== ref.digest) {
-            throw new Error(`Candidate Artifact is unavailable or drifted: ${ref.artifactId}.`);
+        const pinned = validateGitArtifactRef(ref);
+        if (pinned.taskId !== taskId) {
+            throw new Error(`Candidate Artifact belongs to another Task: ${pinned.taskId}.`);
         }
-        return materialize("L3", "artifact", artifact.id, artifact);
+        // The refId is the self-certifying string form; the value is the pure
+        // pointer, never the bytes. inspectValue reconstructs the same pointer.
+        return materialize("L3", "artifact", formatGitArtifactRef(pinned), {
+            taskId: pinned.taskId,
+            commit: pinned.commit,
+            relativePath: pinned.relativePath,
+            ...(pinned.digest === undefined ? {} : { digest: pinned.digest })
+        });
     }));
 }
 /** Lane-specific context that may be layered over an immutable stage base. */

package/dist/context/taskContext.js

@@ -6,6 +6,7 @@ import { sourceRunContextValue } from "./sourceRunContext.js";
 import { expandTaskMessageResult } from "../message/message.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { runExecutionObservation } from "../agentRun/agentRun.js";
+import { isGitArtifactRefString, parseGitArtifactRef } from "../artifacts/gitArtifactRef.js";
 const MAX_RECORDS = 256;
 const MAX_VALUE_BYTES = 4096;
 const MAX_PAGE_BYTES = 128 * 1024;
@@ -226,13 +227,22 @@ function authorizeContext(store, taskId, environment) {
         allow = new Set(pack.authority.readableRefs.map((ref) => `${ref.store}:${ref.refId}`));
         allow.add(`role:${caller.roleName}`);
         allow.add(`turn:${caller.currentRunId}`);
+        // A steer targets exactly one Role's current native Turn and is never shared
+        // Task intent (decision-3 §9). A Leader steer in particular stores as an
+        // untargeted `user` Message (no recipient/WorkItem/Run scope, since a Leader
+        // holds no Assignment), so recognize it explicitly: the shared block below
+        // must never leak it, and the steer-delta block authorizes it only to its own
+        // recipient. `interruptThen.reusedInput` is the interrupt-then composition
+        // whose carried input can itself be a steer.
+        const isSteerMessage = (message) => message.inputControl?.action === "steer"
+            || message.interruptThen?.reusedInput?.action === "steer";
         // A frozen Assignment is not a cutoff for the Task's current user intent.
         // Untargeted human/Operator messages are shared Task requirements; scoped
-        // messages and other Roles' results still require the Assignment's refs.
+        // messages, other Roles' results, and steers still require an explicit grant.
         const sharedMessageIds = new Set(store.listMessages(taskId)
             .filter(message => (message.kind === "user" || message.kind === "operator")
             && message.recipient === undefined && message.workItemId === undefined
-            && message.runId === undefined)
+            && message.runId === undefined && !isSteerMessage(message))
             .map(message => message.id));
         for (const id of sharedMessageIds)
             allow.add(`task-message:${id}`);
@@ -241,6 +251,33 @@ function authorizeContext(store, taskId, environment) {
                 allow.add(`task-event:${event.id}`);
             }
         }
+        // A steer targets this Role's exact current native Turn (decision-3 §9,
+        // message-5 gap E). Unlike a queued or addressed Message — which reaches the
+        // Role through a new AgentRun's frozen Context pack — a steer is pushed into
+        // the *current* turn and is never captured by any frozen snapshot. So the
+        // steer header directs the recipient to reconcile the input "through your
+        // authorized Context read path"; that path must therefore resolve the exact
+        // steer Message it names. Authorize the steers addressed to this caller's
+        // exact current Assignment scope as a live delta — the same way untargeted
+        // user intent is layered on — WITHOUT expanding the frozen Assignment's
+        // readableRefs. Scope is the tightest signal a steer carries (it never gains
+        // a continuation runId), so a steer for a different WorkItem/Round is not
+        // authorized, and only genuine steers gain this read (an ordinary addressed
+        // Message still requires its own frozen delta).
+        const run = store.getRun(taskId, caller.currentRunId);
+        const steerMessageIds = new Set(store.listMessages(taskId)
+            .filter(message => isSteerMessage(message)
+            && message.recipient?.roleName === caller.roleName
+            && message.recipient.workItemId === run?.workItemId
+            && message.recipient.reviewRoundId === run?.reviewRoundId)
+            .map(message => message.id));
+        for (const id of steerMessageIds)
+            allow.add(`task-message:${id}`);
+        for (const event of store.listEvents(taskId)) {
+            if (event.type.startsWith("message.") && steerMessageIds.has(event.payload.messageId)) {
+                allow.add(`task-event:${event.id}`);
+            }
+        }
     }
     return { task, allow, caller };
 }
@@ -302,7 +339,26 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
             return run === null ? null : sourceRunContextValue(run);
         }
         case "review-round": return store.getReviewRound(taskId, refId);
-        case "artifact": return store.getArtifact(taskId, refId);
+        case "artifact": {
+            // A file artifact is addressed by its self-certifying commit-pinned refId
+            // (git:<commit>:<relativePath>). Resolve it to the pure pointer only; the
+            // bytes are read on the async `artifact.read` path, never synchronously in
+            // this transaction.
+            if (!isGitArtifactRefString(refId))
+                return null;
+            try {
+                const pinned = parseGitArtifactRef(refId, taskId);
+                return {
+                    taskId: pinned.taskId,
+                    commit: pinned.commit,
+                    relativePath: pinned.relativePath,
+                    ...(pinned.digest === undefined ? {} : { digest: pinned.digest })
+                };
+            }
+            catch {
+                return null;
+            }
+        }
         case "environment-preparation": return store.getEnvironmentPreparation(taskId, refId);
         case "change-set": return store.getChangeSet(taskId, refId);
         case "managed-workspace": {
@@ -365,8 +421,11 @@ function authorizedEntries(store, taskId, environment) {
         for (const candidate of [...item.candidates].reverse())
             add("candidate", `${item.id}/${candidate.id}`, candidate);
     }
-    for (const artifact of store.listArtifacts(taskId))
-        add("artifact", artifact.id, artifact);
+    // File artifacts are not enumerated into the synchronous Context listing: the
+    // core cursor does not cover file edits and an ambient directory index here
+    // would be the forbidden update-time mirror (§3.7). Current artifacts are
+    // listed on demand via the async `artifact.list` capability; frozen Candidate
+    // artifacts remain reachable as commit-pinned pointers under their Candidate.
     for (const preparation of store.listEnvironmentPreparations(taskId))
         add("environment-preparation", preparation.id, preparation);
     for (const workspace of store.listManagedWorkspaces(taskId))

package/dist/controller/agentHostObservation.js

@@ -0,0 +1,155 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
+import { createRuntimeObservation } from "../runtime/runtimeObservation.js";
+import { readAgentHostObservationSource } from "../runtime/agentHostProtocol.js";
+import { resolveRuntimeHookRunFence, RuntimeHookRunFenceError } from "./runtimeHookRunFence.js";
+export class AgentHostObservationDeferred extends Error {
+}
+/** Resolve wire facts only here, using the Controller's current authoritative
+ * store. The producer's launch Run is never a substitute for input identity. */
+export function resolveAgentHostObservation(store, event) {
+    const host = readAgentHostObservationSource(event.host);
+    const input = createRuntimeObservation(event.observation);
+    const { fence, kind } = input;
+    const hostKinds = [
+        "host.observed", "session.started", "session.ready", "session.ended", "session.failed",
+        "conversation.observed", "goal.updated", "goal.cleared",
+        "turn.accepted", "turn.completed", "turn.failed", "turn.cancelled",
+        "input.accepted", "input.rejected", "input.delivery-unknown",
+        "operation.started", "operation.completed", "operation.failed", "activity.observed"
+    ];
+    if (!hostKinds.includes(kind)
+        || (kind === "host.observed" ? input.authority !== "host"
+            : input.authority !== "provider-structured" && !(kind === "turn.accepted" && input.authority === "transport"))) {
+        throw new RuntimeHookRunFenceError("Agent Host fact exceeds its event authority.");
+    }
+    let driver;
+    try {
+        driver = builtinAgentDriverRegistry().requireByAdapterId(host.adapterId);
+    }
+    catch {
+        throw new RuntimeHookRunFenceError("Agent Host adapter is unsupported.");
+    }
+    if (event.taskId !== fence.taskId
+        || event.scope !== (fence.taskId === undefined ? "global" : "task") || fence.runId !== undefined
+        || fence.nativeSessionId === undefined
+        || driver.id !== fence.driverId
+        || (host.connection !== undefined && kind !== "host.observed")) {
+        throw new RuntimeHookRunFenceError("Agent Host fact source does not match its observation.");
+    }
+    const sessionStartup = ["session.started", "session.ready", "host.observed"].includes(kind)
+        || (kind === "conversation.observed" && host.startupRunId !== undefined);
+    const sessionFact = sessionStartup
+        || ["conversation.observed", "goal.updated", "goal.cleared"].includes(kind);
+    const directStart = kind === "turn.accepted" && fence.receiptId === `direct:${fence.nativeTurnId}`;
+    const additionalInput = kind.startsWith("input.") && (fence.receiptId?.startsWith("native-input:") || fence.receiptId?.startsWith("turn-input:")
+        || fence.receiptId?.startsWith("steer:"));
+    const terminal = ["turn.completed", "turn.failed", "turn.cancelled", "session.ended", "session.failed"].includes(kind);
+    if (fence.taskId === undefined) {
+        if (host.startupRunId !== undefined)
+            throw new RuntimeHookRunFenceError("Global Host cannot carry a startup Run.");
+        const sessions = store.getGlobalRoleSessionSet(fence.roleName);
+        const session = sessions?.sessions[fence.agentId];
+        if (sessionStartup && (session === undefined || session.status === "ended")) {
+            const role = store.getGlobalRole(fence.roleName);
+            if (role?.activeAgentId === fence.agentId && role.workspace === host.workspace) {
+                throw new AgentHostObservationDeferred("Awaiting exact Global Session adoption.");
+            }
+        }
+        const resolved = resolveRuntimeHookRunFence({
+            YUI_SESSION_SCOPE: "global", YUI_ROLE: fence.roleName, YUI_AGENT_ID: fence.agentId,
+            YUI_ADAPTER_ID: host.adapterId, YUI_WORKSPACE: host.workspace
+        }, host.adapterId, fence.nativeSessionId, {
+            ...(sessionFact || directStart ? { sessionOnly: true } : {
+                exactInput: true,
+                ...(fence.nativeTurnId === undefined ? {} : { nativeTurnId: fence.nativeTurnId }),
+                ...(fence.receiptId === undefined || additionalInput ? {} : { attemptId: fence.receiptId })
+            })
+        }, store);
+        return createRuntimeObservation({
+            ...input, fence: { ...fence,
+                ...(fence.receiptId === undefined && resolved.receiptId !== undefined
+                    ? { receiptId: resolved.receiptId } : {}) }
+        });
+    }
+    const sessions = store.getTaskRoleSessionSet(fence.taskId, fence.roleName);
+    const session = sessions?.sessions[fence.agentId];
+    if (kind === "host.observed" && host.startupRunId === undefined
+        && (session === undefined || session.status === "ended")) {
+        const role = store.getRole(fence.taskId, fence.roleName);
+        const task = store.getTask(fence.taskId);
+        if (role?.activeAgentId === fence.agentId && role.workspace === host.workspace
+            && task !== null && ["active", "draft"].includes(task.status)) {
+            // A runless Session launch is adopted by the existing launch coordinator
+            // after its Host returns the native id. Retain custody until that commit;
+            // it must not itself authorize or invent the Session.
+            throw new AgentHostObservationDeferred("Awaiting exact Session adoption.");
+        }
+    }
+    const knownStartup = sessionStartup && store.listEvents(fence.taskId).some(e => e.type === "runtime.observation" && e.payload.eventId === input.eventId);
+    const startup = sessionStartup && host.startupRunId !== undefined && !knownStartup;
+    const options = {
+        ...(fence.nativeTurnId === undefined || sessionFact || directStart ? {} : { nativeTurnId: fence.nativeTurnId }),
+        ...(fence.receiptId === undefined || additionalInput || sessionFact || directStart
+            ? {} : { attemptId: fence.receiptId }),
+        ...(terminal || additionalInput ? { terminal: true } : {}),
+        ...((sessionFact && !startup) || directStart || (terminal && fence.receiptId === undefined) ? { sessionOnly: true } : {}),
+        ...(!sessionFact && !directStart ? { exactInput: true } : {}),
+        ...(startup ? {
+            startupRunId: host.startupRunId,
+            startupSession: driver.capabilities.observation.sessionBootstrap
+        } : {})
+    };
+    // Idempotent replay of an already applied startup must not be rejected just
+    // because its Run has since ended. All raw fields still match the saved fact.
+    const resolved = resolveRuntimeHookRunFence({
+        YUI_SESSION_SCOPE: "task", YUI_TASK_ID: fence.taskId,
+        YUI_ROLE: fence.roleName, YUI_AGENT_ID: fence.agentId,
+        YUI_ADAPTER_ID: host.adapterId, YUI_WORKSPACE: host.workspace
+    }, host.adapterId, fence.nativeSessionId, options, store);
+    return createRuntimeObservation({
+        ...input,
+        fence: {
+            ...fence,
+            ...(resolved.runId === undefined ? {} : { runId: resolved.runId }),
+            ...(fence.receiptId === undefined && resolved.receiptId !== undefined
+                ? { receiptId: resolved.receiptId } : {})
+        }
+    });
+}
+/** Custody and account evidence share the same exact Session validation and
+ * commit/ACK boundary as activity. They contain locations, never credentials. */
+export function recordAgentHostConnection(store, event, input, now) {
+    const host = readAgentHostObservationSource(event.host);
+    const connection = host.connection;
+    if (connection === undefined)
+        throw new RuntimeHookRunFenceError("Host connection evidence is missing.");
+    const fence = input.fence;
+    const owner = connection.processOwner;
+    if (owner !== undefined) {
+        if (owner.owner.scope !== (fence.taskId === undefined ? "global" : "task")
+            || (owner.owner.scope === "task" && owner.owner.taskId !== fence.taskId)
+            || owner.owner.roleName !== fence.roleName || owner.agentId !== fence.agentId
+            || owner.adapterId !== host.adapterId || owner.nativeSessionId !== fence.nativeSessionId
+            || owner.providerRoot.attribution !== "owned-child") {
+            throw new RuntimeHookRunFenceError("Host process custody does not match its exact Session.");
+        }
+        store.saveSessionOwner(owner);
+    }
+    if (connection.account !== undefined) {
+        if (host.adapterId !== "codex")
+            throw new RuntimeHookRunFenceError("Native account evidence requires Codex.");
+        // Global Roles have no Task event stream. Process custody above is still
+        // recorded under the exact Global owner; Task account history stays Task-scoped.
+        if (fence.taskId === undefined)
+            return;
+        const exists = store.listEvents(fence.taskId).some(e => e.type === "runtime.native-connection-bound"
+            && e.payload.roleName === fence.roleName && e.payload.agentId === fence.agentId
+            && e.payload.nativeSessionId === fence.nativeSessionId);
+        if (!exists)
+            store.saveEvent(fence.taskId, createTaskEvent(store.nextEventId(fence.taskId), fence.taskId, "runtime.native-connection-bound", {
+                roleName: fence.roleName, agentId: fence.agentId, nativeSessionId: fence.nativeSessionId,
+                ...connection.account
+            }, now));
+    }
+}

package/dist/controller/clientRuntime.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { findLiveControllerProcessForHome } from "../core/controllerProcessIdentity.js";
+import { findLiveControllerProcessForHome, inspectLiveControllerProcess } from "../core/controllerProcessIdentity.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 import { callController, ControllerClientError, readControllerDiscovery, stopOrphanedFileTaskController } from "../core/controllerClient.js";
 import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
@@ -185,6 +185,9 @@ export async function stopFileTaskController(home, options = {}) {
         ...(expectedPid === undefined ? {} : { expectedPid }) };
     try {
         const result = await stopControllerGracefully(home, bounded);
+        if (result.stopped && physical !== undefined) {
+            await waitForControllerProcessExit(home, physical, options);
+        }
         if (result.stopped || options.call !== undefined)
             return result;
     }
@@ -196,6 +199,18 @@ export async function stopFileTaskController(home, options = {}) {
         ...(physical === undefined ? {} : { expectedProcessStartIdentity: physical.processStartIdentity }) });
     return stopped === undefined ? { stopped: false, alreadyStopped: true } : { stopped: true, pid: stopped.pid };
 }
+async function waitForControllerProcessExit(home, controller, options) {
+    const timeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
+    const homeFilesystemId = readHomeFilesystemId(home);
+    const deadline = Date.now() + timeoutMs;
+    while (inspectLiveControllerProcess(controller.pid, homeFilesystemId, controller.processStartIdentity) !== undefined) {
+        if (Date.now() >= deadline) {
+            throw new ControllerClientError("CONTROLLER_TIMEOUT", `Controller process ${controller.pid} did not exit within ${timeoutMs} ms.`);
+        }
+        await delay(pollMs);
+    }
+}
 async function stopControllerGracefully(home, options) {
     const call = options.call ?? ((h, method, params) => callController(h, method, params, {
         timeoutMs: options.requestTimeoutMs
@@ -558,7 +573,7 @@ export class FileTaskWorkflowRuntime {
             && entry.archiveBlocked));
         if (blockers.length === 0)
             return;
-        throw new WorkspaceCleanupBlockedError("physical-resource-live", `task:${taskId}`, true, `Task archive blocked: ${blockers.length} owned physical resource(s) still live: `
+        throw new WorkspaceCleanupBlockedError("physical-resource-live", `task:${taskId}`, true, `Task workspace cleanup blocked: ${blockers.length} owned physical resource(s) live or unverified: `
             + blockers.map((entry) => (`${entry.owner.roleName}/${entry.nativeSessionId ?? "unknown-session"}`
                 + ` (pid ${entry.physical?.alive === true ? entry.physical.pid : "?"})`)).join("; "));
     }