@zq-silk/yui 0.15.9 → 0.15.12

package/dist/context/taskCatalog.js

@@ -0,0 +1,187 @@
+import { usageError } from "../errors/cliError.js";
+import { contextContentDigest } from "./contextSnapshot.js";
+import { materialize, resolveContextReader } from "./taskContext.js";
+import { CATALOG_ATTENTION } from "../storage/taskCatalog.js";
+const TASK_STATUSES = ["draft", "active", "completed", "cancelled", "archived"];
+const PAGE_BYTES = 32 * 1024;
+const SUMMARY_BYTES = 512;
+const MAX_LIMIT = 100;
+export function parseTaskCatalogOptions(args) {
+    const values = new Map();
+    let all = false;
+    for (let i = 0; i < args.length; i++) {
+        const key = args[i];
+        if (key === "--all" && !all) {
+            all = true;
+            continue;
+        }
+        if (!["--view", "--limit", "--cursor", "--status", "--project", "--search", "--attention"].includes(key)
+            || values.has(key) || args[i + 1] === undefined || args[i + 1].startsWith("--")) {
+            throw usageError("Compact Task list expects --view compact [--all] [--status <status>] [--project <id>] [--search <text>] [--attention <category>] [--limit <1..100>] [--cursor <cursor>].");
+        }
+        values.set(key, args[++i]);
+    }
+    if (values.get("--view") !== "compact")
+        throw usageError("Task list view must be compact.");
+    const status = values.get("--status");
+    if (status !== undefined && !TASK_STATUSES.includes(status)) {
+        throw usageError("Unknown Task catalog status.");
+    }
+    const attention = values.get("--attention");
+    if (attention !== undefined && !CATALOG_ATTENTION.includes(attention)) {
+        throw usageError(`Task catalog attention must be one of: ${CATALOG_ATTENTION.join(", ")}.`);
+    }
+    const limit = values.has("--limit") ? Number(values.get("--limit")) : 20;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_LIMIT)
+        throw usageError("Task catalog limit must be between 1 and 100.");
+    const search = values.get("--search")?.trim();
+    const project = values.get("--project")?.trim();
+    if ((search?.length ?? 0) > 256 || (project?.length ?? 0) > 256 || project === "") {
+        throw usageError("Task catalog filters exceed their text limit.");
+    }
+    return {
+        all: all || status === "archived", limit,
+        ...(status === undefined ? {} : { status: status }),
+        ...(attention === undefined ? {} : { attention: attention }),
+        ...(search ? { search } : {}),
+        ...(project === undefined ? {} : { project }),
+        ...(values.has("--cursor") ? { cursor: values.get("--cursor") } : {})
+    };
+}
+/** Task-local Leaders discover only their Task. Assignment Roles use their
+ * existing Context pack: whole-Task counts would leak unrelated assignments. */
+export function taskCatalogScope(store, environment) {
+    const caller = resolveContextReader(store, environment);
+    if (caller !== undefined && caller.roleName !== "leader") {
+        throw usageError("Task discovery is unavailable to an Assignment-scoped Role; use its authorized Run Context.");
+    }
+    return caller?.taskId;
+}
+export function readTaskCatalog(store, options, environment = {}) {
+    return store.transaction(reader => {
+        const taskId = taskCatalogScope(reader, environment);
+        const { cursor: rawCursor, ...filters } = options;
+        if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > MAX_LIMIT) {
+            throw usageError("Task catalog limit must be between 1 and 100.");
+        }
+        const scope = contextContentDigest({ taskId: taskId ?? null, ...filters });
+        const cursor = rawCursor === undefined ? undefined : decodeCursor(rawCursor, scope);
+        const facts = reader.queryTaskCatalog({
+            ...filters, ...(taskId === undefined ? {} : { taskId }),
+            ...(cursor === undefined ? {} : { after: cursor.after, through: cursor.through }),
+            limit: options.limit + 1
+        });
+        const refs = new Map();
+        const getRef = (id) => {
+            let ref = refs.get(id);
+            if (ref === undefined) {
+                const task = reader.getTask(id);
+                if (task === null)
+                    throw usageError("Task catalog changed during the read; retry.");
+                ref = { taskId: id, ...materialize("task", id, task).ref };
+                refs.set(id, ref);
+            }
+            return ref;
+        };
+        const attention = Object.fromEntries(CATALOG_ATTENTION.map(kind => {
+            const source = facts.attention[kind];
+            const selected = [];
+            for (const id of source.taskIds) {
+                const ref = getRef(id);
+                if (bytes([...selected, ref]) <= 2048)
+                    selected.push(ref);
+            }
+            return [kind, {
+                    count: source.count,
+                    unit: kind === "executionSignals" ? "signals" : "records",
+                    refs: selected,
+                    // Samples identify affected Tasks, not individual records. Count and
+                    // sample size therefore must never be subtracted from one another.
+                    taskCount: source.taskCount,
+                    omittedTaskRefs: source.taskCount - selected.length,
+                    query: { view: "compact", all: options.all, attention: kind }
+                }];
+        }));
+        const response = {
+            view: "compact",
+            scope: { taskId: taskId ?? null, archived: options.all ? "included" : "excluded",
+                attention: "authorized-catalog-before-filters", executionSignals: "raw-inspection-candidates-not-execution-status" },
+            filters, total: facts.total, counts: facts.counts, attention,
+            tasks: [],
+            nextCursor: null,
+            consistency: "current-per-page; refresh for membership changes; new creation keys after the upper bound excluded",
+            limits: { pageBytes: PAGE_BYTES, summaryBytes: SUMMARY_BYTES, maxTasks: options.limit, attentionTaskRefsPerCategory: 4 }
+        };
+        const through = cursor?.through ?? facts.through;
+        const continuation = (after) => through === null ? null
+            : Buffer.from(JSON.stringify({ version: 1, scope, after, through })).toString("base64url");
+        for (const row of facts.rows.slice(0, options.limit)) {
+            const ref = getRef(row.id);
+            const summary = row.summary === null ? null : truncateUtf8(row.summary, SUMMARY_BYTES);
+            const title = truncateUtf8(row.title, 256);
+            // SQL already limits these fields. Compare against the selected original
+            // only when necessary; length-at-limit is conservatively marked omitted.
+            const item = {
+                id: row.id, title, status: row.status, createdAt: row.createdAt, updatedAt: row.updatedAt,
+                summary, summaryStatus: row.summaryPresent ? "available" : "missing",
+                omitted: { title: row.title.length >= 256 || title !== row.title,
+                    summary: row.summary !== null && (row.summary.length >= 512 || summary !== row.summary) },
+                counts: { workItems: row.workItems, activeRuns: row.activeRuns },
+                attention: Object.fromEntries(CATALOG_ATTENTION.map(kind => [kind, row[kind]])),
+                ref
+            };
+            const next = continuation({ id: row.id, createdAt: row.createdAt });
+            if (bytes({ ok: true, data: { ...response, tasks: [...response.tasks, item], nextCursor: next } }) + 1 > PAGE_BYTES)
+                break;
+            response.tasks.push(item);
+        }
+        if (response.tasks.length < facts.rows.length) {
+            const last = response.tasks.at(-1);
+            if (last === undefined)
+                throw usageError("Task catalog identity/attention metadata exceeds the page byte budget.");
+            response.nextCursor = continuation({ id: last.id, createdAt: last.createdAt });
+        }
+        if (bytes({ ok: true, data: response }) + 1 > PAGE_BYTES)
+            throw usageError("Task catalog metadata exceeds the page byte budget.");
+        return response;
+    });
+}
+export function renderTaskCatalog(result) {
+    return [
+        `Tasks (compact): ${result.tasks.length} shown; ${result.total} matching`,
+        ...result.tasks.map(task => `${task.id}\t${task.status}\t${task.title}\n  ${task.summary ?? "(summary missing)"}`),
+        `Attention across catalog: ${CATALOG_ATTENTION.map(kind => `${kind}=${result.attention[kind].count}`).join(", ")}`,
+        "Expand: yui task context <task-id>; inspect the Task ref for original requirements.",
+        ...(result.nextCursor === null ? [] : [`Next cursor: ${result.nextCursor}`])
+    ].join("\n") + "\n";
+}
+function bytes(value) { return Buffer.byteLength(JSON.stringify(value)); }
+function truncateUtf8(value, max) {
+    let result = "";
+    let size = 0;
+    for (const point of value) {
+        size += Buffer.byteLength(point);
+        if (size > max)
+            break;
+        result += point;
+    }
+    return result;
+}
+function decodeCursor(raw, scope) {
+    try {
+        if (raw.length > 4096 || !/^[A-Za-z0-9_-]+$/.test(raw))
+            throw new Error();
+        const parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+        const validKey = (key) => key && typeof key.id === "string" && key.id.length > 0
+            && typeof key.createdAt === "string" && Number.isFinite(Date.parse(key.createdAt));
+        if (parsed.version !== 1 || parsed.scope !== scope || !validKey(parsed.after) || !validKey(parsed.through)
+            || parsed.after.createdAt > parsed.through.createdAt
+            || (parsed.after.createdAt === parsed.through.createdAt
+                && Buffer.compare(Buffer.from(parsed.after.id), Buffer.from(parsed.through.id)) > 0))
+            throw new Error();
+        return parsed;
+    }
+    catch {
+        throw usageError("Invalid Task catalog cursor or cursor belongs to another scope/filter.");
+    }
+}

package/dist/context/taskContext.js

@@ -7,6 +7,8 @@ import { expandTaskMessageResult } from "../message/message.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { runExecutionObservation } from "../agentRun/agentRun.js";
 import { isGitArtifactRefString, parseGitArtifactRef } from "../artifacts/gitArtifactRef.js";
+import { projectTaskRemoteDeliveryFromStore } from "../commands/taskRemoteDeliveryCommand.js";
+import { providerRetryProjection } from "../runtime/providerRetry.js";
 const MAX_RECORDS = 256;
 const MAX_VALUE_BYTES = 4096;
 const MAX_PAGE_BYTES = 128 * 1024;
@@ -33,6 +35,8 @@ export function readTaskContext(store, taskId, environment = {}) {
                 : { ...entry, omitted: false };
             const record = { ...content, ...(entry.ref.store === "run" ? {
                     execution: runExecutionObservation(entry.value, reader.getTaskRoleSessionSet(taskId, entry.value.roleName)?.providerBinding, runtimeEvents)
+                } : {}), ...(entry.ref.store === "role" ? {
+                    providerRetry: providerRetryProjection(reader.getTaskRoleSessionSet(taskId, entry.value.name)?.providerBinding)
                 } : {}) };
             const size = Buffer.byteLength(JSON.stringify(record));
             if (records.length >= MAX_RECORDS || bytes + size > MAX_PAGE_BYTES)
@@ -201,10 +205,9 @@ export async function withContextObservations(core, providers, timeoutMs = 250)
     }));
     return { ...core, observations };
 }
-function authorizeContext(store, taskId, environment) {
+/** Shared current/historical Session read identity; discovery may only narrow it. */
+export function resolveContextReader(store, environment) {
     const caller = resolveManagedTaskReader(store, environment);
-    if (caller !== undefined && caller.taskId !== taskId)
-        throw usageError("Context is outside the caller's Task.");
     if (caller === undefined && environment.YUI_SESSION_SCOPE === "global" && environment.YUI_ROLE !== "operator") {
         throw usageError("Only Operator may read Task context from a global Session.");
     }
@@ -216,6 +219,12 @@ function authorizeContext(store, taskId, environment) {
     if (environment.YUI_SESSION_SCOPE !== undefined && !["task", "global"].includes(environment.YUI_SESSION_SCOPE)) {
         throw usageError("Incomplete managed Context caller identity.");
     }
+    return caller;
+}
+function authorizeContext(store, taskId, environment) {
+    const caller = resolveContextReader(store, environment);
+    if (caller !== undefined && caller.taskId !== taskId)
+        throw usageError("Context is outside the caller's Task.");
     const task = store.getTask(taskId);
     if (task === null)
         throw taskNotFound(taskId);
@@ -227,13 +236,22 @@ function authorizeContext(store, taskId, environment) {
         allow = new Set(pack.authority.readableRefs.map((ref) => `${ref.store}:${ref.refId}`));
         allow.add(`role:${caller.roleName}`);
         allow.add(`turn:${caller.currentRunId}`);
+        // A steer targets exactly one Role's current native Turn and is never shared
+        // Task intent (decision-3 §9). A Leader steer in particular stores as an
+        // untargeted `user` Message (no recipient/WorkItem/Run scope, since a Leader
+        // holds no Assignment), so recognize it explicitly: the shared block below
+        // must never leak it, and the steer-delta block authorizes it only to its own
+        // recipient. `interruptThen.reusedInput` is the interrupt-then composition
+        // whose carried input can itself be a steer.
+        const isSteerMessage = (message) => message.inputControl?.action === "steer"
+            || message.interruptThen?.reusedInput?.action === "steer";
         // A frozen Assignment is not a cutoff for the Task's current user intent.
         // Untargeted human/Operator messages are shared Task requirements; scoped
-        // messages and other Roles' results still require the Assignment's refs.
+        // messages, other Roles' results, and steers still require an explicit grant.
         const sharedMessageIds = new Set(store.listMessages(taskId)
             .filter(message => (message.kind === "user" || message.kind === "operator")
             && message.recipient === undefined && message.workItemId === undefined
-            && message.runId === undefined)
+            && message.runId === undefined && !isSteerMessage(message))
             .map(message => message.id));
         for (const id of sharedMessageIds)
             allow.add(`task-message:${id}`);
@@ -242,6 +260,33 @@ function authorizeContext(store, taskId, environment) {
                 allow.add(`task-event:${event.id}`);
             }
         }
+        // A steer targets this Role's exact current native Turn (decision-3 §9,
+        // message-5 gap E). Unlike a queued or addressed Message — which reaches the
+        // Role through a new AgentRun's frozen Context pack — a steer is pushed into
+        // the *current* turn and is never captured by any frozen snapshot. So the
+        // steer header directs the recipient to reconcile the input "through your
+        // authorized Context read path"; that path must therefore resolve the exact
+        // steer Message it names. Authorize the steers addressed to this caller's
+        // exact current Assignment scope as a live delta — the same way untargeted
+        // user intent is layered on — WITHOUT expanding the frozen Assignment's
+        // readableRefs. Scope is the tightest signal a steer carries (it never gains
+        // a continuation runId), so a steer for a different WorkItem/Round is not
+        // authorized, and only genuine steers gain this read (an ordinary addressed
+        // Message still requires its own frozen delta).
+        const run = store.getRun(taskId, caller.currentRunId);
+        const steerMessageIds = new Set(store.listMessages(taskId)
+            .filter(message => isSteerMessage(message)
+            && message.recipient?.roleName === caller.roleName
+            && message.recipient.workItemId === run?.workItemId
+            && message.recipient.reviewRoundId === run?.reviewRoundId)
+            .map(message => message.id));
+        for (const id of steerMessageIds)
+            allow.add(`task-message:${id}`);
+        for (const event of store.listEvents(taskId)) {
+            if (event.type.startsWith("message.") && steerMessageIds.has(event.payload.messageId)) {
+                allow.add(`task-event:${event.id}`);
+            }
+        }
     }
     return { task, allow, caller };
 }
@@ -263,6 +308,8 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
     switch (family) {
         case "task": return refId === taskId ? task : null;
         case "task-brief": return refId === taskId ? store.getTaskBrief(taskId) : null;
+        case "remote-delivery": return refId === taskId && allow === undefined
+            ? projectTaskRemoteDeliveryFromStore(store, task) : null;
         case "role": return store.getRole(taskId, refId);
         case "role-profile": {
             const role = store.getRole(taskId, refId);
@@ -361,6 +408,8 @@ function authorizedEntries(store, taskId, environment) {
     };
     add("task", taskId, task);
     add("task-brief", taskId, store.getTaskBrief(taskId));
+    if (allow === undefined)
+        add("remote-delivery", taskId, projectTaskRemoteDeliveryFromStore(store, task));
     for (const role of store.listRoles(taskId)) {
         add("role", role.name, role);
         add("role-profile", role.name, roleProfile(role));
@@ -428,7 +477,7 @@ function authorizedEntries(store, taskId, environment) {
         add("task-event", event.id, event);
     return entries;
 }
-function materialize(store, refId, value) {
+export function materialize(store, refId, value) {
     const digest = contextContentDigest(value);
     const record = value;
     return { ref: { store, refId, revision: String(record.revision ?? record.updatedAt ?? record.createdAt ?? digest), digest }, value };

package/dist/controller/agentHostObservation.js

@@ -0,0 +1,155 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
+import { createRuntimeObservation } from "../runtime/runtimeObservation.js";
+import { readAgentHostObservationSource } from "../runtime/agentHostProtocol.js";
+import { resolveRuntimeHookRunFence, RuntimeHookRunFenceError } from "./runtimeHookRunFence.js";
+export class AgentHostObservationDeferred extends Error {
+}
+/** Resolve wire facts only here, using the Controller's current authoritative
+ * store. The producer's launch Run is never a substitute for input identity. */
+export function resolveAgentHostObservation(store, event) {
+    const host = readAgentHostObservationSource(event.host);
+    const input = createRuntimeObservation(event.observation);
+    const { fence, kind } = input;
+    const hostKinds = [
+        "host.observed", "session.started", "session.ready", "session.ended", "session.failed",
+        "conversation.observed", "goal.updated", "goal.cleared",
+        "turn.accepted", "turn.completed", "turn.failed", "turn.cancelled",
+        "input.accepted", "input.rejected", "input.delivery-unknown",
+        "operation.started", "operation.completed", "operation.failed", "activity.observed"
+    ];
+    if (!hostKinds.includes(kind)
+        || (kind === "host.observed" ? input.authority !== "host"
+            : input.authority !== "provider-structured" && !(kind === "turn.accepted" && input.authority === "transport"))) {
+        throw new RuntimeHookRunFenceError("Agent Host fact exceeds its event authority.");
+    }
+    let driver;
+    try {
+        driver = builtinAgentDriverRegistry().requireByAdapterId(host.adapterId);
+    }
+    catch {
+        throw new RuntimeHookRunFenceError("Agent Host adapter is unsupported.");
+    }
+    if (event.taskId !== fence.taskId
+        || event.scope !== (fence.taskId === undefined ? "global" : "task") || fence.runId !== undefined
+        || fence.nativeSessionId === undefined
+        || driver.id !== fence.driverId
+        || (host.connection !== undefined && kind !== "host.observed")) {
+        throw new RuntimeHookRunFenceError("Agent Host fact source does not match its observation.");
+    }
+    const sessionStartup = ["session.started", "session.ready", "host.observed"].includes(kind)
+        || (kind === "conversation.observed" && host.startupRunId !== undefined);
+    const sessionFact = sessionStartup
+        || ["conversation.observed", "goal.updated", "goal.cleared"].includes(kind);
+    const directStart = kind === "turn.accepted" && fence.receiptId === `direct:${fence.nativeTurnId}`;
+    const additionalInput = kind.startsWith("input.") && (fence.receiptId?.startsWith("native-input:") || fence.receiptId?.startsWith("turn-input:")
+        || fence.receiptId?.startsWith("steer:"));
+    const terminal = ["turn.completed", "turn.failed", "turn.cancelled", "session.ended", "session.failed"].includes(kind);
+    if (fence.taskId === undefined) {
+        if (host.startupRunId !== undefined)
+            throw new RuntimeHookRunFenceError("Global Host cannot carry a startup Run.");
+        const sessions = store.getGlobalRoleSessionSet(fence.roleName);
+        const session = sessions?.sessions[fence.agentId];
+        if (sessionStartup && (session === undefined || session.status === "ended")) {
+            const role = store.getGlobalRole(fence.roleName);
+            if (role?.activeAgentId === fence.agentId && role.workspace === host.workspace) {
+                throw new AgentHostObservationDeferred("Awaiting exact Global Session adoption.");
+            }
+        }
+        const resolved = resolveRuntimeHookRunFence({
+            YUI_SESSION_SCOPE: "global", YUI_ROLE: fence.roleName, YUI_AGENT_ID: fence.agentId,
+            YUI_ADAPTER_ID: host.adapterId, YUI_WORKSPACE: host.workspace
+        }, host.adapterId, fence.nativeSessionId, {
+            ...(sessionFact || directStart ? { sessionOnly: true } : {
+                exactInput: true,
+                ...(fence.nativeTurnId === undefined ? {} : { nativeTurnId: fence.nativeTurnId }),
+                ...(fence.receiptId === undefined || additionalInput ? {} : { attemptId: fence.receiptId })
+            })
+        }, store);
+        return createRuntimeObservation({
+            ...input, fence: { ...fence,
+                ...(fence.receiptId === undefined && resolved.receiptId !== undefined
+                    ? { receiptId: resolved.receiptId } : {}) }
+        });
+    }
+    const sessions = store.getTaskRoleSessionSet(fence.taskId, fence.roleName);
+    const session = sessions?.sessions[fence.agentId];
+    if (kind === "host.observed" && host.startupRunId === undefined
+        && (session === undefined || session.status === "ended")) {
+        const role = store.getRole(fence.taskId, fence.roleName);
+        const task = store.getTask(fence.taskId);
+        if (role?.activeAgentId === fence.agentId && role.workspace === host.workspace
+            && task !== null && ["active", "draft"].includes(task.status)) {
+            // A runless Session launch is adopted by the existing launch coordinator
+            // after its Host returns the native id. Retain custody until that commit;
+            // it must not itself authorize or invent the Session.
+            throw new AgentHostObservationDeferred("Awaiting exact Session adoption.");
+        }
+    }
+    const knownStartup = sessionStartup && store.listEvents(fence.taskId).some(e => e.type === "runtime.observation" && e.payload.eventId === input.eventId);
+    const startup = sessionStartup && host.startupRunId !== undefined && !knownStartup;
+    const options = {
+        ...(fence.nativeTurnId === undefined || sessionFact || directStart ? {} : { nativeTurnId: fence.nativeTurnId }),
+        ...(fence.receiptId === undefined || additionalInput || sessionFact || directStart
+            ? {} : { attemptId: fence.receiptId }),
+        ...(terminal || additionalInput ? { terminal: true } : {}),
+        ...((sessionFact && !startup) || directStart || (terminal && fence.receiptId === undefined) ? { sessionOnly: true } : {}),
+        ...(!sessionFact && !directStart ? { exactInput: true } : {}),
+        ...(startup ? {
+            startupRunId: host.startupRunId,
+            startupSession: driver.capabilities.observation.sessionBootstrap
+        } : {})
+    };
+    // Idempotent replay of an already applied startup must not be rejected just
+    // because its Run has since ended. All raw fields still match the saved fact.
+    const resolved = resolveRuntimeHookRunFence({
+        YUI_SESSION_SCOPE: "task", YUI_TASK_ID: fence.taskId,
+        YUI_ROLE: fence.roleName, YUI_AGENT_ID: fence.agentId,
+        YUI_ADAPTER_ID: host.adapterId, YUI_WORKSPACE: host.workspace
+    }, host.adapterId, fence.nativeSessionId, options, store);
+    return createRuntimeObservation({
+        ...input,
+        fence: {
+            ...fence,
+            ...(resolved.runId === undefined ? {} : { runId: resolved.runId }),
+            ...(fence.receiptId === undefined && resolved.receiptId !== undefined
+                ? { receiptId: resolved.receiptId } : {})
+        }
+    });
+}
+/** Custody and account evidence share the same exact Session validation and
+ * commit/ACK boundary as activity. They contain locations, never credentials. */
+export function recordAgentHostConnection(store, event, input, now) {
+    const host = readAgentHostObservationSource(event.host);
+    const connection = host.connection;
+    if (connection === undefined)
+        throw new RuntimeHookRunFenceError("Host connection evidence is missing.");
+    const fence = input.fence;
+    const owner = connection.processOwner;
+    if (owner !== undefined) {
+        if (owner.owner.scope !== (fence.taskId === undefined ? "global" : "task")
+            || (owner.owner.scope === "task" && owner.owner.taskId !== fence.taskId)
+            || owner.owner.roleName !== fence.roleName || owner.agentId !== fence.agentId
+            || owner.adapterId !== host.adapterId || owner.nativeSessionId !== fence.nativeSessionId
+            || owner.providerRoot.attribution !== "owned-child") {
+            throw new RuntimeHookRunFenceError("Host process custody does not match its exact Session.");
+        }
+        store.saveSessionOwner(owner);
+    }
+    if (connection.account !== undefined) {
+        if (host.adapterId !== "codex")
+            throw new RuntimeHookRunFenceError("Native account evidence requires Codex.");
+        // Global Roles have no Task event stream. Process custody above is still
+        // recorded under the exact Global owner; Task account history stays Task-scoped.
+        if (fence.taskId === undefined)
+            return;
+        const exists = store.listEvents(fence.taskId).some(e => e.type === "runtime.native-connection-bound"
+            && e.payload.roleName === fence.roleName && e.payload.agentId === fence.agentId
+            && e.payload.nativeSessionId === fence.nativeSessionId);
+        if (!exists)
+            store.saveEvent(fence.taskId, createTaskEvent(store.nextEventId(fence.taskId), fence.taskId, "runtime.native-connection-bound", {
+                roleName: fence.roleName, agentId: fence.agentId, nativeSessionId: fence.nativeSessionId,
+                ...connection.account
+            }, now));
+    }
+}

package/dist/controller/clientRuntime.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { findLiveControllerProcessForHome } from "../core/controllerProcessIdentity.js";
+import { findLiveControllerProcessForHome, inspectLiveControllerProcess } from "../core/controllerProcessIdentity.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 import { callController, ControllerClientError, readControllerDiscovery, stopOrphanedFileTaskController } from "../core/controllerClient.js";
 import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
@@ -185,6 +185,9 @@ export async function stopFileTaskController(home, options = {}) {
         ...(expectedPid === undefined ? {} : { expectedPid }) };
     try {
         const result = await stopControllerGracefully(home, bounded);
+        if (result.stopped && physical !== undefined) {
+            await waitForControllerProcessExit(home, physical, options);
+        }
         if (result.stopped || options.call !== undefined)
             return result;
     }
@@ -196,6 +199,18 @@ export async function stopFileTaskController(home, options = {}) {
         ...(physical === undefined ? {} : { expectedProcessStartIdentity: physical.processStartIdentity }) });
     return stopped === undefined ? { stopped: false, alreadyStopped: true } : { stopped: true, pid: stopped.pid };
 }
+async function waitForControllerProcessExit(home, controller, options) {
+    const timeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
+    const homeFilesystemId = readHomeFilesystemId(home);
+    const deadline = Date.now() + timeoutMs;
+    while (inspectLiveControllerProcess(controller.pid, homeFilesystemId, controller.processStartIdentity) !== undefined) {
+        if (Date.now() >= deadline) {
+            throw new ControllerClientError("CONTROLLER_TIMEOUT", `Controller process ${controller.pid} did not exit within ${timeoutMs} ms.`);
+        }
+        await delay(pollMs);
+    }
+}
 async function stopControllerGracefully(home, options) {
     const call = options.call ?? ((h, method, params) => callController(h, method, params, {
         timeoutMs: options.requestTimeoutMs
@@ -558,7 +573,7 @@ export class FileTaskWorkflowRuntime {
             && entry.archiveBlocked));
         if (blockers.length === 0)
             return;
-        throw new WorkspaceCleanupBlockedError("physical-resource-live", `task:${taskId}`, true, `Task archive blocked: ${blockers.length} owned physical resource(s) still live: `
+        throw new WorkspaceCleanupBlockedError("physical-resource-live", `task:${taskId}`, true, `Task workspace cleanup blocked: ${blockers.length} owned physical resource(s) live or unverified: `
             + blockers.map((entry) => (`${entry.owner.roleName}/${entry.nativeSessionId ?? "unknown-session"}`
                 + ` (pid ${entry.physical?.alive === true ? entry.physical.pid : "?"})`)).join("; "));
     }

package/dist/controller/controller.js

@@ -701,6 +701,8 @@ export class FileTaskController {
     #onMaintenanceFenceDefer;
     #leaderWakeFence;
     #jobSupervisor;
+    #globalInputDelivery;
+    #providerRetry;
     #continuationReconciler;
     #current;
     #operatorCurrent;
@@ -710,6 +712,7 @@ export class FileTaskController {
     #operatorStartupRetryArmed = false;
     #lastOperatorSignalIdentity;
     #stopped = false;
+    #workspaceWaitAbort = new AbortController();
     #lastRuntimeDrain;
     #runtimeDrainPasses = 0;
     #runtimeListedEvents = 0;
@@ -723,7 +726,11 @@ export class FileTaskController {
         this.#now = options.now ?? (() => new Date());
         this.#startedAt = this.#now();
         this.#onError = options.onError ?? (() => { });
-        this.#workspacePreparer = options.workspacePreparer;
+        const workspacePreparer = options.workspacePreparer;
+        this.#workspacePreparer = workspacePreparer === undefined ? undefined : {
+            prepareTaskWorkspace: (taskId) => workspacePreparer.prepareTaskWorkspace(taskId, this.#workspaceWaitAbort.signal),
+            activateTaskWorkspace: (taskId, environment) => workspacePreparer.activateTaskWorkspace(taskId, environment, this.#workspaceWaitAbort.signal)
+        };
         this.#deliveryRetryMs = positiveInteger(options.deliveryRetryMs, DEFAULT_DELIVERY_RETRY_MS, "Controller delivery retry delay");
         this.#deliveryRetryLimit = positiveInteger(options.deliveryRetryLimit, DEFAULT_DELIVERY_RETRY_LIMIT, "Controller delivery retry limit");
         this.#deliveryTimeoutMs = positiveInteger(options.deliveryTimeoutMs, DEFAULT_DELIVERY_TIMEOUT_MS, "Controller delivery timeout");
@@ -747,6 +754,8 @@ export class FileTaskController {
         this.#leaderWakeFence = options.leaderWakeFence;
         this.#jobSupervisor = options.jobSupervisor;
         this.#continuationReconciler = options.continuationReconciler;
+        this.#globalInputDelivery = options.globalInputDelivery;
+        this.#providerRetry = options.providerRetry;
         this.#signalScheduler = new MailboxScheduler(async (keys) => { await this.#requestPass({ kind: "dirty", keys }); }, {
             windowMs: options.signalWindowMs ?? DEFAULT_SIGNAL_WINDOW_MS,
             onError: this.#onError,
@@ -844,6 +853,7 @@ export class FileTaskController {
     }
     stop() {
         this.#stopped = true;
+        this.#workspaceWaitAbort.abort(new Error("Controller stopped while waiting for Project maintenance."));
         this.#signalScheduler.stop();
         this.#operatorSignalScheduler.stop();
         if (this.#deadlineTimer !== undefined) {
@@ -986,6 +996,8 @@ export class FileTaskController {
                         }
                     }
                     const firstRuntimeDrain = await this.#drainRuntimeEvents();
+                    await this.#providerRetry?.reconcile();
+                    await this.#globalInputDelivery?.();
                     for (const taskId of runtimeTaskFailureIds(firstRuntimeDrain)) {
                         runtimeFailedTaskIds.add(taskId);
                     }
@@ -1328,7 +1340,7 @@ export class FileTaskController {
                     at: Date.parse(request.policy.timeoutAt)
                 }]
             : []);
-        const nearest = nearestDeadlineBatch(deadlines);
+        const nearest = nearestDeadlineBatch([...deadlines, ...(this.#providerRetry?.deadlines() ?? [])]);
         if (nearest === null)
             return;
         const now = this.#now().getTime();