@zq-silk/yui 0.8.2 → 0.8.3

package/README.md

@@ -659,6 +659,28 @@ yui task complete <task-id> --summary-file delivery.txt --refresh-remote
 yui task reopen <task-id>
 ```
 
+When a verified squash-merge Publication records a remote commit that is
+ancestry-divergent from the unchanged, frozen Task-final Review head, a user or
+global Operator may explicitly authorize completion against its identical Git
+tree:
+
+```sh
+yui task complete <task-id> --summary-file delivery.txt \
+  --accept-published-tree <publication-id>
+```
+
+This does not weaken normal freshness checks. Yui requires the current,
+unsuperseded Publication to be merged and verified, its local commit to equal
+the reviewed physical Task head, its remote commit to be ancestry-divergent,
+and both commits to resolve to the same exact tree. `--refresh-remote` fetches
+the remote object graph before resolving that Publication commit. For a Task
+governed by a durable exact final-review contract, the user/Operator command
+persists the exact authorization tuple and wakes the Task Leader; only that
+contract-capable Leader may consume it and complete the Task. Tasks without
+that contract retain the one-step explicit completion path. The Task event
+audit records the authorization and, on completion, the accepted Project,
+Publication, ReviewRound, both commits, and tree.
+
 Completed Tasks reject messages, dispatch, Provider authority changes, retry, and late yields until explicitly reopened, while retaining Task main for inspection or integration. Every isolated WorkItem worktree must be explicitly cleaned as integrated or abandoned before archive; that cleanup also removes its managed branch. Archive requires `--integrated` or `--abandon` to state the Task main outcome and is allowed only after Task main is clean. It removes managed worktrees but retains Task and WorkItem records. The Task main branch is retained as a recovery artifact instead of being silently deleted.
 Task lifecycle completion/selection only suggests valid source states: Draft for activate, active for complete, and completed for reopen.
 

package/dist/cli/commandCatalog.js

@@ -277,8 +277,8 @@ const taskChildren = [
     {
         name: "complete",
         summary: "Complete an active Task and stop automatic wakeups.",
-        usage: "yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote]",
-        options: ["--summary", "--summary-file", "--refresh-remote"],
+        usage: "yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote] [--accept-published-tree <publication-id>]",
+        options: ["--summary", "--summary-file", "--refresh-remote", "--accept-published-tree"],
         fileOptions: ["--summary-file"]
     },
     {
@@ -727,8 +727,8 @@ const taskChildren = [
                     {
                         name: "expand",
                         summary: "Expand one authorized Run context reference.",
-                        usage: "yui task run context expand <task>/<run> <ref-id> [--mode full]",
-                        options: ["--mode"]
+                        usage: "yui task run context expand <task>/<run> <ref-id> [--store <store>] [--mode full]",
+                        options: ["--store", "--mode"]
                     },
                     {
                         name: "delta",
@@ -751,7 +751,7 @@ const taskChildren = [
     {
         name: "review",
         summary: "Control Task-final ReviewRounds.",
-        sections: [{ id: "manage", title: "Commands", entries: ["request", "group", "retry", "finding"] }],
+        sections: [{ id: "manage", title: "Commands", entries: ["request", "force-fresh", "group", "retry", "finding"] }],
         children: [
             {
                 name: "request",
@@ -759,6 +759,11 @@ const taskChildren = [
                 usage: "yui task review request <task> --role <global-role> [--strategy fixed:<count>|adaptive:<max>] [--lane-role <role> ...] [--delta-recheck]",
                 options: ["--role", "--strategy", "--lane-role", "--delta-recheck"]
             },
+            {
+                name: "force-fresh",
+                summary: "Replace one exact non-semantic failed Task-final Review with a distinct full Round.",
+                usage: "yui task review force-fresh <task>/<review-round>"
+            },
             {
                 name: "group",
                 summary: "Resolve a Reviewer ExecutionGroup after its Lanes finish.",

package/dist/cli.js

@@ -48,7 +48,7 @@ import { createUpdatePorts } from "./cli/updatePorts.js";
 import { createReleaseWorkflowPorts } from "./release/releaseWorkflowPorts.js";
 import { readRuntimeIdentity } from "./release/runtimeRelease.js";
 import { renderReleaseActivateResult, renderReleaseInstallResult, renderReleaseList, runReleaseActivate, runReleaseInstall, runReleaseList } from "./commands/releaseCommands.js";
-import { reconcileTaskRemoteBaselines } from "./commands/taskCompletionGate.js";
+import { reconcileTaskRemoteBaselines, verifyTaskCompletionPublishedTree } from "./commands/taskCompletionGate.js";
 import { runTaskBaseStatusCommand } from "./commands/taskBaseCommands.js";
 import { assertTaskBaseFreshnessForCompletion, inspectTaskBaseFreshness } from "./repository/taskBaseFreshness.js";
 import { FileCompletionManager, resolveCliIdentity } from "./completion/fileCompletionManager.js";
@@ -944,6 +944,7 @@ export async function main() {
             }
         }
         let completionSummary;
+        let completionPublishedTreeProof;
         if (resolved[1] === "base" && resolved[2] === "status") {
             const result = await runTaskBaseStatusCommand(resolved.slice(3), store);
             emit(result.output, false, result.data);
@@ -958,12 +959,26 @@ export async function main() {
                 ...(taskFinalReviewContract === undefined
                     ? {}
                     : { taskFinalReviewContract })
-            });
+            }, completionRequest);
             if (!completion.completed && !completion.activeTaskReview) {
-                const freshness = await inspectTaskBaseFreshness(resolved[2], store, {
-                    refresh: refreshRemote
-                });
-                for (const warning of assertTaskBaseFreshnessForCompletion(freshness)) {
+                // An explicit refresh must fetch the remote object graph before the
+                // Publication proof resolves its exact commit. Without the flag the
+                // command remains offline and preserves the existing proof-first path.
+                const refreshedFreshness = refreshRemote
+                    ? await inspectTaskBaseFreshness(resolved[2], store, { refresh: true })
+                    : undefined;
+                if (completionRequest.acceptedPublishedTreePublicationId !== undefined) {
+                    completionPublishedTreeProof = await verifyTaskCompletionPublishedTree(completionRequest.taskId, completionRequest.acceptedPublishedTreePublicationId, store);
+                }
+                const freshness = refreshedFreshness
+                    ?? await inspectTaskBaseFreshness(resolved[2], store);
+                for (const warning of assertTaskBaseFreshnessForCompletion(freshness, {
+                    ...(completionPublishedTreeProof === undefined
+                        ? {}
+                        : {
+                            acceptedPublishedTreeProjectId: completionPublishedTreeProof.projectId
+                        })
+                })) {
                     process.stderr.write(`Warning: ${warning}\n`);
                 }
                 // Keep completion offline by default. An explicit refresh is the only
@@ -1002,6 +1017,9 @@ export async function main() {
                     ? {}
                     : { taskFinalReviewContract }),
                 ...(completionSummary === undefined ? {} : { completionSummary }),
+                ...(completionPublishedTreeProof === undefined
+                    ? {}
+                    : { completionPublishedTreeProof }),
                 ...(workItemIntegrationProof === undefined ? {} : { workItemIntegrationProof }),
                 ...(candidateGitSnapshot === undefined ? {} : { candidateGitSnapshot }),
                 ...(candidateMaterialization === undefined
@@ -1673,6 +1691,15 @@ async function actualTaskReviewCandidateForTaskCommand(args, store, preparer, en
             taskId = reference.taskId;
         }
     }
+    else if (args[1] === "review"
+        && args[2] === "force-fresh"
+        && args[3] !== undefined) {
+        const reference = cliTaskRecordReference(args[3], "reviewRound", environment);
+        const round = store.getReviewRound(reference.taskId, reference.localId);
+        if (round !== null && (round.scope ?? "work-item") === "task") {
+            taskId = reference.taskId;
+        }
+    }
     else if (args[1] === "work"
         && args[2] === "review"
         && args[3] === "retry"

package/dist/commands/taskCommands.js

@@ -7,6 +7,7 @@ import { CliError, dataError, roleNotFound, runtimeError, taskNotFound, usageErr
 import { createTaskEvent } from "../event/taskEvent.js";
 import { clearMatchingLeaderStallAttention, isRoleRunStalled, RUN_PROGRESS_EVENT, RUN_RECOVERED_EVENT } from "../scheduler/roleRunStall.js";
 import { readCommandText } from "./textInput.js";
+import { assertTaskCompletionPublishedTreeProof } from "./taskCompletionGate.js";
 import { createRoleSessionSet, roleAgentSessionResumeMode, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
 import { currentProviderActivation, transferProviderAuthority } from "../runtime/providerRuntimeIdentity.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
@@ -36,10 +37,11 @@ import { blockingProviderContinuations, projectProviderContinuations } from "../
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { activateTask, addTaskProjectBinding, archiveTask, completeTask, createTask, retireTask, reopenTask, updateTaskMetadata } from "../task/task.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
+import { TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT } from "../task/publicationReference.js";
 import { projectCompletionReadiness } from "../task/completionReadiness.js";
 import { resolveProject } from "../repository/project.js";
 import { acquireProjectMaintenanceLocks } from "../repository/projectMaintenanceLock.js";
-import { currentWorkItemCandidate, currentWorkItemExecutionGroup, workItemExecutionGroupById, createWorkItem, attachWorkItemExecutionGroup, updateWorkItemExecutionGroup, retireWorkItem, retryFailedWorkItem, submitWorkItemCandidate, updateWorkItemWriteProjects, updateWorkItemStatus } from "../workItem/workItem.js";
+import { currentWorkItemCandidate, governingWorkItemCandidate, currentWorkItemExecutionGroup, workItemExecutionGroupById, createWorkItem, attachWorkItemExecutionGroup, updateWorkItemExecutionGroup, retireWorkItem, retryFailedWorkItem, submitWorkItemCandidate, updateWorkItemWriteProjects, updateWorkItemStatus } from "../workItem/workItem.js";
 import { addExecutionLane, createExecutionGroup, resolveExecutionGroup, restartExecutionLane, updateExecutionLane } from "../execution/executionGroup.js";
 import { sameTaskFinalReviewContract, taskFinalReviewConfig, validateTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
@@ -80,8 +82,12 @@ function legacyWorkItemReviewConfig(config) {
 }
 function storedTaskFinalReviewContract(store, taskId) {
     const contracts = store.listWorkItems(taskId)
-        .flatMap(({ candidates }) => candidates)
-        .flatMap(({ taskFinalReviewContract }) => (taskFinalReviewContract === undefined ? [] : [taskFinalReviewContract]));
+        .flatMap((item) => {
+        const candidate = governingWorkItemCandidate(item);
+        return candidate?.taskFinalReviewContract === undefined
+            ? []
+            : [candidate.taskFinalReviewContract];
+    });
     const first = contracts[0];
     if (first === undefined)
         return undefined;
@@ -97,7 +103,7 @@ function storedTaskFinalReviewContract(store, taskId) {
  * acceptance, and completion mutation must present the same verified
  * capability; shared review-config drift is intentionally irrelevant.
  */
-function taskFinalReviewContractForMutation(store, taskId, options) {
+function taskFinalReviewContractForMutation(store, taskId, options, authorization = {}) {
     const supplied = options.taskFinalReviewContract;
     if (supplied !== undefined) {
         validateTaskFinalReviewContract(supplied);
@@ -113,6 +119,8 @@ function taskFinalReviewContractForMutation(store, taskId, options) {
     if (stored === undefined)
         return supplied;
     if (supplied === undefined) {
+        if (authorization.allowStoredWithoutSupplied === true)
+            return stored;
         throw usageError(`Task final-review contract is missing for ${taskId}.`);
     }
     if (!sameTaskFinalReviewContract(stored, supplied)) {
@@ -121,8 +129,8 @@ function taskFinalReviewContractForMutation(store, taskId, options) {
     return stored;
 }
 export function parseTaskCompletionRequest(args, summaryOverride) {
-    const usage = "Task complete usage: yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote].";
-    const parsed = parseTail(args, new Set(["--summary", "--summary-file"]), usage, new Set(["--refresh-remote"]));
+    const usage = "Task complete usage: yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote] [--accept-published-tree <publication-id>].";
+    const parsed = parseTail(args, new Set(["--summary", "--summary-file", "--accept-published-tree"]), usage, new Set(["--refresh-remote"]));
     exactPositionals(parsed.positionals, 1, usage);
     const inlineSummary = parsed.options.get("--summary");
     const summaryFile = parsed.options.get("--summary-file");
@@ -130,7 +138,14 @@ export function parseTaskCompletionRequest(args, summaryOverride) {
         throw usageError(`Specify exactly one of --summary or --summary-file.`, usage);
     }
     const summary = summaryOverride ?? readCommandText(inlineSummary, summaryFile, "--summary", usage);
-    return { taskId: parsed.positionals[0], summary };
+    const acceptedPublishedTreePublicationId = parsed.options.get("--accept-published-tree");
+    return {
+        taskId: parsed.positionals[0],
+        summary,
+        ...(acceptedPublishedTreePublicationId === undefined
+            ? {}
+            : { acceptedPublishedTreePublicationId })
+    };
 }
 /**
  * Check every read-only completion blocker before a caller resolves remote
@@ -144,7 +159,7 @@ export function parseTaskCompletionRequest(args, summaryOverride) {
  * terminalization precondition before attempting completion.  All blockers
  * are reported in one error instead of one per attempt.
  */
-export function preflightTaskCompletion(taskId, store, options = {}) {
+export function preflightTaskCompletion(taskId, store, options = {}, request = {}) {
     const task = requireTask(store, taskId);
     const actor = taskActor(options, task.id);
     if (task.status === "completed") {
@@ -157,7 +172,15 @@ export function preflightTaskCompletion(taskId, store, options = {}) {
     // Resolve and authenticate the durable Task-local gate before any remote
     // fetch or Integration write.  All checks below mirror the transactional
     // completion path, which remains the final CAS fence after reconciliation.
-    const taskFinalReviewContract = taskFinalReviewContractForMutation(store, task.id, options);
+    // A human/global Operator cannot present the exact managed Leader contract.
+    // For the explicit published-tree path only, let that caller authenticate
+    // the stored contract far enough to persist an exact authorization fact.
+    // The same command must return before any contract-governed completion
+    // mutation; the exact Leader later consumes the authorization with the real
+    // contract capability.
+    const authorizingPublishedTree = request.acceptedPublishedTreePublicationId !== undefined
+        && actor !== "leader";
+    const taskFinalReviewContract = taskFinalReviewContractForMutation(store, task.id, options, { allowStoredWithoutSupplied: authorizingPublishedTree });
     const activeTaskReview = store.listReviewRounds(task.id).some((round) => ((round.scope ?? "work-item") === "task"
         && (round.status === "pending" || round.status === "running")));
     // Issue 06: one shared readiness projection enumerates every blocker.
@@ -647,17 +670,42 @@ function completeTaskCommand(args, store, options) {
     const summary = request.summary;
     const now = clock(options);
     const result = store.transaction((tx) => {
-        const preflight = preflightTaskCompletion(request.taskId, tx, options);
+        const preflight = preflightTaskCompletion(request.taskId, tx, options, request);
         const { task, actor } = preflight;
         if (preflight.completed) {
             return {
                 task,
                 changed: false,
                 runtimeCleanupTargets: [],
-                finalReview: undefined
+                finalReview: undefined,
+                publishedTreeAuthorization: undefined
             };
         }
         const taskFinalContract = preflight.taskFinalReviewContract;
+        const publishedTreeProof = request.acceptedPublishedTreePublicationId === undefined
+            ? undefined
+            : assertTaskCompletionPublishedTreeProof(tx, task, request.acceptedPublishedTreePublicationId, options.completionPublishedTreeProof, actualTaskReviewCandidateForMutation(tx, task, options));
+        const requiresContractHandoff = publishedTreeProof !== undefined
+            && taskFinalContract !== undefined;
+        if (requiresContractHandoff && actor !== "leader") {
+            const existing = matchingPublishedTreeAuthorization(tx, publishedTreeProof);
+            const event = existing ?? recordTaskEventRecord(tx, task.id, TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT, publishedTreeAuthorizationPayload(actor, publishedTreeProof), now);
+            enqueueWork(tx, leaderMailbox(task.id), wakeReason("published-tree-authorized", event.id), now, [eventRef(task.id, event.id)]);
+            return {
+                task,
+                changed: false,
+                runtimeCleanupTargets: [],
+                finalReview: undefined,
+                publishedTreeAuthorization: {
+                    event,
+                    proof: publishedTreeProof,
+                    created: existing === undefined
+                }
+            };
+        }
+        if (publishedTreeProof !== undefined && actor === "leader") {
+            requirePublishedTreeAuthorization(tx, publishedTreeProof);
+        }
         const roles = tx.listRoles(task.id);
         const activeRuns = roles
             .map((role) => ({ role, run: tx.getActiveAgentRun(task.id, role.name) }))
@@ -706,7 +754,8 @@ function completeTaskCommand(args, store, options) {
                 runtimeCleanupTargets: [],
                 finalReview,
                 resumedPendingFinalReview: pendingFinalReviewIds.has(finalReview.id),
-                terminalizedLeaderRun
+                terminalizedLeaderRun,
+                publishedTreeAuthorization: undefined
             };
         }
         // Issue 06: re-validate the full completion readiness inside the
@@ -729,6 +778,17 @@ function completeTaskCommand(args, store, options) {
         tx.clearOperatorNotification(task.id);
         tx.saveOperatorNotification(createTaskTerminalNotification(task.id, "completed", actor, summary, now));
         enqueueWork(tx, { kind: "operator" }, "task-terminal", now, [taskRef(task.id)]);
+        if (publishedTreeProof !== undefined) {
+            recordTaskEvent(tx, task.id, "task.completion-published-tree-accepted", {
+                by: actor,
+                projectId: publishedTreeProof.projectId,
+                publicationId: publishedTreeProof.publicationId,
+                reviewRoundId: publishedTreeProof.reviewRoundId,
+                localCommit: publishedTreeProof.localCommit,
+                remoteCommit: publishedTreeProof.remoteCommit,
+                tree: publishedTreeProof.tree
+            }, now);
+        }
         recordTaskEvent(tx, task.id, "task.completed", { by: actor, summary }, now);
         // A terminal Task must never leave a Task-lane signal that can wake it.
         // The durable records remain intact; only the derived mailbox work is
@@ -747,9 +807,21 @@ function completeTaskCommand(args, store, options) {
             runtimeCleanupTargets,
             finalReview: undefined,
             resumedPendingFinalReview: false,
-            terminalizedLeaderRun
+            terminalizedLeaderRun,
+            publishedTreeAuthorization: undefined
         };
     });
+    if (result.publishedTreeAuthorization !== undefined) {
+        notifyMailbox(options.runtime, leaderMailbox(result.task.id), result.task.id);
+        const authorization = result.publishedTreeAuthorization;
+        return output(authorization.created
+            ? `Authorized published-tree completion for ${result.task.id} as ${authorization.event.id}; exact Task Leader completion is required.\n`
+            : `Published-tree completion is already authorized for ${result.task.id} as ${authorization.event.id}; exact Task Leader completion is required.\n`, {
+            task: result.task,
+            authorizationEvent: authorization.event,
+            publishedTreeProof: authorization.proof
+        });
+    }
     if (result.changed) {
         for (const target of result.runtimeCleanupTargets) {
             // Cleanup owns an independent lifecycle lane. Never fall back to the
@@ -2608,6 +2680,8 @@ function taskReviewCommand(args, store, options) {
     const [command, ...rest] = args;
     if (command === "request")
         return requestTaskReviewRound(rest, store, options);
+    if (command === "force-fresh")
+        return forceFreshTaskReviewRound(rest, store, options);
     if (command === "retry")
         return retryFailedTaskReviewRound(rest, store, options);
     if (command === "group")
@@ -3078,6 +3152,209 @@ function requestTaskReviewRound(args, store, options) {
             : `Task-final delta-recheck requested as ${round.id} (rechecks ${round.deltaRecheck.previousReviewRoundId})\n`
         : `Task-final Review is already ${round.status}: ${round.id}\n`, { reviewRound: round });
 }
+const TASK_FINAL_FORCE_FRESH_EVENT = "review.task-final-force-fresh-requested";
+/**
+ * Creates a distinct full Task-final ReviewRound only when the exact previous
+ * Round failed without producing semantic review evidence. The source Round,
+ * Run, findings, workspace, and terminal report remain immutable history; the
+ * linking Event is both the audit record and the idempotence key.
+ */
+function forceFreshTaskReviewRound(args, store, options) {
+    const usage = "Task review force-fresh usage: yui task review force-fresh <task>/<review-round>.";
+    exactPositionals(args, 1, usage);
+    const reference = taskRecordReference(args[0], "reviewRound", "ReviewRound reference", options);
+    const now = clock(options);
+    const result = store.transaction((tx) => {
+        const source = tx.getReviewRound(reference.taskId, reference.localId);
+        if (source === null) {
+            throw dataError(`ReviewRound not found: ${reference.taskId}/${reference.localId}.`);
+        }
+        const task = requireTask(tx, reference.taskId);
+        if (task.status !== "active")
+            throw usageError(`Task is not active: ${task.id}.`);
+        if (taskActor(options, task.id) !== "leader") {
+            throw usageError("Only the Task Leader may force a fresh Task-final ReviewRound.");
+        }
+        if ((source.scope ?? "work-item") !== "task") {
+            throw usageError(`ReviewRound ${source.id} is not a Task-final ReviewRound.`);
+        }
+        const replacementEvents = tx.listEvents(task.id).filter((event) => (event.type === TASK_FINAL_FORCE_FRESH_EVENT
+            && event.payload.sourceReviewRoundId === source.id));
+        if (replacementEvents.length > 1) {
+            throw dataError(`ReviewRound ${source.id} has duplicate force-fresh audit events.`);
+        }
+        const replacementEvent = replacementEvents[0];
+        if (replacementEvent !== undefined) {
+            const replacementId = replacementEvent.payload.reviewRoundId;
+            const replacement = replacementId === undefined
+                ? null
+                : tx.getReviewRound(task.id, replacementId);
+            if (replacement === null
+                || replacement.id === source.id
+                || (replacement.scope ?? "work-item") !== "task"
+                || replacement.workItemId !== source.workItemId
+                || replacement.candidateId !== source.candidateId
+                || replacement.reviewerRoleName !== source.reviewerRoleName
+                || replacement.deltaRecheck !== undefined
+                || !sameTaskFinalReviewContract(replacement.taskFinalReviewContract, source.taskFinalReviewContract)
+                || !isSameTaskReviewCandidate(replacement.taskCandidate, source.taskCandidate)
+                || replacementEvent.payload.workItemId !== replacement.workItemId
+                || replacementEvent.payload.candidateId !== replacement.candidateId
+                || replacementEvent.payload.reviewerRoleName !== replacement.reviewerRoleName
+                || replacementEvent.payload.taskCandidate !== JSON.stringify(replacement.taskCandidate)) {
+                throw dataError(`Force-fresh audit for ${source.id} does not match its replacement Round.`);
+            }
+            return { round: replacement, source, created: false };
+        }
+        const semanticBlocker = forceFreshSemanticBlocker(tx, source);
+        if (semanticBlocker !== null) {
+            throw usageError(`ReviewRound ${source.id} is not eligible for force-fresh: ${semanticBlocker}`);
+        }
+        if (source.taskCandidate === undefined) {
+            throw dataError(`ReviewRound ${source.id} has no frozen Task candidate.`);
+        }
+        const taskFinalContract = taskFinalReviewContractForMutation(tx, task.id, options);
+        if (!sameTaskFinalReviewContract(source.taskFinalReviewContract, taskFinalContract)) {
+            throw usageError(`Task final-review contract does not match ReviewRound ${source.id}.`);
+        }
+        if (source.executionGroup !== undefined
+            && (source.executionGroup.strategy.mode !== "fixed"
+                || source.executionGroup.strategy.count !== 1
+                || source.executionGroup.lanes.length !== 1
+                || source.executionGroup.lanes[0].roleName !== source.reviewerRoleName)) {
+            throw usageError(`ReviewRound ${source.id} is not a single-Reviewer full Review; force-fresh is refused.`);
+        }
+        const item = tx.getWorkItem(task.id, source.workItemId);
+        const candidate = item?.candidates.find(({ id }) => id === source.candidateId);
+        if (item === null || item === undefined || candidate === undefined) {
+            throw dataError(`Final Review anchor Candidate is no longer available: `
+                + `${source.workItemId}/${source.candidateId}.`);
+        }
+        const provenance = taskReviewProvenance(tx, task, options);
+        if (!isSameTaskReviewCandidate(source.taskCandidate, provenance.candidate)) {
+            throw usageError(`Final ReviewRound ${source.id} freezes a candidate that is no longer the current Task candidate.`);
+        }
+        const producerCollision = taskReviewProducerCollision(provenance, source.reviewerRoleName);
+        if (producerCollision !== null)
+            throw usageError(producerCollision);
+        const taskRounds = reviewRoundsByIdentity(tx.listReviewRounds(task.id)
+            .filter((entry) => (entry.scope ?? "work-item") === "task"));
+        const sourceIndex = taskRounds.findIndex(({ id }) => id === source.id);
+        if (sourceIndex < 0) {
+            throw dataError(`Final ReviewRound is not in Task history: ${source.id}.`);
+        }
+        const laterRound = taskRounds.slice(sourceIndex + 1).at(-1);
+        if (laterRound !== undefined) {
+            throw usageError(`A newer Task-final ReviewRound already exists after ${source.id}: `
+                + `${laterRound.id}/${laterRound.status}.`);
+        }
+        assertNoConflictingTaskReviewRound(taskRounds, source.id);
+        assertTaskReviewRequestLane(tx, task.id, source.reviewerRoleName);
+        let reviewer = tx.getRole(task.id, source.reviewerRoleName);
+        if (reviewer === null) {
+            if (tx.getGlobalRole(source.reviewerRoleName) === null) {
+                throw usageError(`Global Role not found: ${source.reviewerRoleName}.`);
+            }
+            reviewer = createTaskRole(tx, task, source.reviewerRoleName, undefined, now, source.reviewerRoleName);
+            tx.saveRole(task.id, reviewer);
+        }
+        let created = createTaskReviewRound(tx.nextReviewRoundId(task.id), task.id, source.workItemId, source.candidateId, source.reviewerRoleName, "leader", source.taskCandidate, now, taskFinalContract);
+        const group = createExecutionGroup(`execution-group-${created.id}`, task.id, {
+            purpose: "review",
+            target: executionTargetForReviewRound(task, created, item, candidate),
+            strategy: { mode: "fixed", count: 1 },
+            lanes: [{ roleName: reviewer.name, reviewRoundId: created.id }]
+        }, now);
+        created = { ...created, executionGroup: group };
+        tx.saveReviewRound(task.id, created);
+        recordTaskEvent(tx, task.id, TASK_FINAL_FORCE_FRESH_EVENT, {
+            sourceReviewRoundId: source.id,
+            ...(source.reviewerRunId === undefined ? {} : { sourceReviewerRunId: source.reviewerRunId }),
+            reviewRoundId: created.id,
+            workItemId: created.workItemId,
+            candidateId: created.candidateId,
+            reviewerRoleName: created.reviewerRoleName,
+            taskCandidate: JSON.stringify(created.taskCandidate),
+            reason: "source-round-failed-without-semantic-review",
+            leaderActionRunId: taskLeaderActionRunId(tx, task.id, options.environment, options.yuiHome) ?? "leader"
+        }, now);
+        return { round: created, source, created: true };
+    });
+    return output(result.created
+        ? `Fresh Task-final Review requested as ${result.round.id} after ${result.source.id}\n`
+        : `Fresh Task-final Review already requested as ${result.round.id} after ${result.source.id}\n`, { reviewRound: result.round, sourceReviewRound: result.source });
+}
+/** Returns the exact semantic evidence that makes a failed Round ineligible. */
+function forceFreshSemanticBlocker(store, round) {
+    if (round.status !== "failed")
+        return `source status is ${round.status}, not failed.`;
+    if ((round.checks ?? []).length > 0)
+        return "the Round records review checks.";
+    if (round.evidenceCommit !== undefined)
+        return "the Round records a review evidence commit.";
+    if (round.report !== round.summary) {
+        return "the Round stores a report distinct from its failure summary.";
+    }
+    if (runtimeFailureSummaryHasReviewerOutput(round.report ?? "")) {
+        return "the Round stores non-empty Reviewer output in its runtime failure summary.";
+    }
+    if (round.deltaRecheck?.disposition !== undefined
+        || round.deltaRecheck?.reasoning !== undefined) {
+        return "the Round records a semantic delta-recheck disposition.";
+    }
+    const semanticLane = round.executionGroup?.lanes.find((lane) => (lane.status === "yielded"
+        || lane.status === "completed"
+        || lane.result?.report !== undefined
+        || (lane.result?.checks ?? []).length > 0
+        || (lane.result?.findings ?? []).length > 0
+        || (lane.result?.evidence ?? []).length > 0
+        || lane.result?.evidenceCommit !== undefined));
+    if (semanticLane !== undefined) {
+        return `Reviewer Lane ${semanticLane.id} delivered semantic evidence.`;
+    }
+    const yieldedRun = store.listAgentRuns(round.taskId).find((run) => (run.purpose === "review"
+        && run.reviewRoundId === round.id
+        && run.status === "yielded"));
+    if (yieldedRun !== undefined)
+        return `Reviewer Run ${yieldedRun.id} yielded a report.`;
+    const finding = store.listReviewFindings(round.taskId).find((entry) => (entry.firstReviewRoundId === round.id || entry.lastReviewRoundId === round.id));
+    if (finding !== undefined)
+        return `Review finding ${finding.id} references the Round.`;
+    const semanticEvent = store.listEvents(round.taskId).find((event) => (event.type === "review.completed" && event.payload.reviewRoundId === round.id));
+    if (semanticEvent !== undefined)
+        return `Review completion Event ${semanticEvent.id} exists.`;
+    if (looksLikeStructuredReviewReport(round.report ?? "")) {
+        return "the Round stores a structured reviewer report.";
+    }
+    return null;
+}
+function runtimeFailureSummaryHasReviewerOutput(summary) {
+    const match = /(?:^|\n)last_assistant_message:[ \t]*([\s\S]*)$/u.exec(summary);
+    const output = match?.[1];
+    return output !== undefined && output.trim().length > 0;
+}
+function looksLikeStructuredReviewReport(report) {
+    let parsed;
+    try {
+        parsed = JSON.parse(report);
+    }
+    catch {
+        return false;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return false;
+    const record = parsed;
+    return [
+        "summary",
+        "report",
+        "checks",
+        "findings",
+        "evidence",
+        "evidenceCommit",
+        "deltaDisposition",
+        "deltaReasoning"
+    ].some((key) => Object.hasOwn(record, key));
+}
 /**
  * Issue 07: re-validates the CLI-computed delta preflight inside the store
  * transaction.  The previous Round must be a completed acceptance (a full
@@ -3307,13 +3584,16 @@ function taskRunCommand(args, store, options) {
 function runContextCommand(args, store, options) {
     const [first, ...rest] = args;
     if (first === "expand") {
-        if (rest.length < 2 || rest.length > 4 || (rest.length > 2
-            && !(rest.length === 4 && rest[2] === "--mode" && rest[3] === "full"))) {
-            throw usageError("Task run context expand usage: yui task run context expand <task>/<run> <ref-id> [--mode full].");
+        const usage = "Task run context expand usage: yui task run context expand <task>/<run> <ref-id> [--store <store>] [--mode full].";
+        const parsed = parseTail(rest, new Set(["--store", "--mode"]), usage);
+        exactPositionals(parsed.positionals, 2, usage);
+        const mode = parsed.options.get("--mode");
+        if (mode !== undefined && mode !== "full") {
+            throw usageError("Run Context expansion mode must be full.", usage);
         }
-        const { taskId, runId } = parseRunContextReference(rest[0]);
+        const { taskId, runId } = parseRunContextReference(parsed.positionals[0]);
         authorizeRunContext(store, taskId, runId, options.environment);
-        const expanded = store.transaction((tx) => expandRunContextRef(tx, taskId, runId, rest[1]));
+        const expanded = store.transaction((tx) => expandRunContextRef(tx, taskId, runId, parsed.positionals[1], optionalNonEmptyOption(parsed.options, "--store")));
         return output(`${JSON.stringify(expanded, null, 2)}\n`, { context: expanded });
     }
     if (first === "delta") {
@@ -4051,15 +4331,20 @@ function assertPendingFinalReviewWorkspaceEvidence(store, task, round) {
     }
 }
 function latestTaskReviewContractAnchor(store, task, taskFinalContract) {
-    const item = [...store.listWorkItems(task.id)]
-        .filter(({ candidates }) => candidates.some(({ taskFinalReviewContract: candidateContract }) => (sameTaskFinalReviewContract(candidateContract, taskFinalContract))))
-        .sort((left, right) => (left.updatedAt.localeCompare(right.updatedAt) || left.id.localeCompare(right.id)))
+    const anchor = store.listWorkItems(task.id)
+        .flatMap((item) => {
+        const candidate = governingWorkItemCandidate(item);
+        return candidate !== undefined && sameTaskFinalReviewContract(candidate.taskFinalReviewContract, taskFinalContract)
+            ? [{ item, candidate }]
+            : [];
+    })
+        .sort((left, right) => (left.item.updatedAt.localeCompare(right.item.updatedAt)
+        || left.item.id.localeCompare(right.item.id)))
         .at(-1);
-    const candidate = item?.candidates.filter(({ taskFinalReviewContract: candidateContract }) => (sameTaskFinalReviewContract(candidateContract, taskFinalContract))).at(-1);
-    if (item === undefined || candidate === undefined) {
+    if (anchor === undefined) {
         throw usageError(`Task ${task.id} has no WorkItem Candidate to anchor its final Review.`);
     }
-    return { item, candidate };
+    return anchor;
 }
 /**
  * Leader-only retry of an exact failed Task-final review Run. The old failed
@@ -5379,6 +5664,44 @@ function recordTaskEventRecord(store, taskId, type, payload, now) {
     store.saveEvent(taskId, event);
     return event;
 }
+function publishedTreeAuthorizationPayload(actor, proof) {
+    return {
+        by: actor,
+        projectId: proof.projectId,
+        publicationId: proof.publicationId,
+        reviewRoundId: proof.reviewRoundId,
+        localCommit: proof.localCommit,
+        remoteCommit: proof.remoteCommit,
+        tree: proof.tree
+    };
+}
+function matchingPublishedTreeAuthorization(store, proof) {
+    const events = store.listEvents(proof.taskId);
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type === "task.completed" || event.type === "task.reopened")
+            return undefined;
+        if (event.type === TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT
+            && (event.payload.by === "user" || event.payload.by === "operator")
+            && event.payload.projectId === proof.projectId
+            && event.payload.publicationId === proof.publicationId
+            && event.payload.reviewRoundId === proof.reviewRoundId
+            && event.payload.localCommit === proof.localCommit
+            && event.payload.remoteCommit === proof.remoteCommit
+            && event.payload.tree === proof.tree) {
+            return event;
+        }
+    }
+    return undefined;
+}
+function requirePublishedTreeAuthorization(store, proof) {
+    const authorization = matchingPublishedTreeAuthorization(store, proof);
+    if (authorization === undefined) {
+        throw usageError(`Published-tree completion requires explicit user or global Operator authorization for `
+            + `${proof.taskId}/${proof.publicationId} at Task-final Review ${proof.reviewRoundId}.`);
+    }
+    return authorization;
+}
 /** Keeps a free-text run-fact note bounded so an event payload stays compact. */
 function truncateEventNote(note) {
     const normalized = note.trim();
@@ -6327,6 +6650,9 @@ function workItemRef(taskId, id) {
 function messageRef(taskId, id) {
     return { type: "message", taskId, id };
 }
+function eventRef(taskId, id) {
+    return { type: "event", taskId, id };
+}
 function notifyMailbox(runtime, target, compatibilityTaskId) {
     if (runtime?.notifyMailboxChanged !== undefined) {
         runtime.notifyMailboxChanged(target);

package/dist/commands/taskCompletionGate.js

@@ -2,7 +2,159 @@ import { usageError } from "../errors/cliError.js";
 import { GitIntegrationService } from "../integration/gitIntegrationService.js";
 import { createIntegrationAttempt } from "../integration/integrationAttempt.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { publicationExternalKey } from "../task/publicationReference.js";
 import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
+/**
+ * Verify the one supported ancestry waiver before `task complete` mutates any
+ * durable state. The explicit Publication must be the current verified merged
+ * record, bind the exact reviewed physical Task head, and name an
+ * ancestry-divergent commit with the exact same Git tree.
+ */
+export async function verifyTaskCompletionPublishedTree(taskId, publicationId, store, options = {}) {
+    const task = store.getTask(taskId);
+    if (task === null)
+        throw usageError(`Task not found: ${taskId}.`);
+    if (task.status !== "active") {
+        throw usageError(`Task is not active: ${task.id}.`);
+    }
+    const publication = requireCurrentVerifiedPublication(store, task.id, publicationId);
+    const binding = task.projectBindings.find(({ projectId }) => (projectId === publication.projectId));
+    if (binding === undefined) {
+        throw usageError(`Publication ${publication.id} Project is not bound to Task ${task.id}: `
+            + `${publication.projectId}.`);
+    }
+    if (publication.localCommit === undefined || publication.remoteCommit === undefined) {
+        throw usageError(`Publication ${publication.id} must record exact local and remote commits.`);
+    }
+    const workspace = requireTaskWorkspace(store, task);
+    const latestReview = latestTaskFinalReview(store, task.id);
+    if (latestReview === undefined
+        || latestReview.status !== "completed"
+        || latestReview.taskCandidate === undefined) {
+        throw usageError(`Task ${task.id} requires a latest completed Task-final Review before accepting a published tree.`);
+    }
+    const git = options.git ?? new NodeGitWorkspace();
+    const actualHeads = new Map();
+    for (const taskBinding of task.projectBindings) {
+        const entry = workspaceProjectEntry(workspace, taskBinding.projectId);
+        if (entry === undefined || entry.access !== "write") {
+            throw usageError(`Task ${task.id} has no writable managed main workspace for Project ${taskBinding.projectId}.`);
+        }
+        const reviewedCommit = latestReview.taskCandidate.projects.find(({ projectId }) => (projectId === taskBinding.projectId))?.commit;
+        if (reviewedCommit === undefined) {
+            throw usageError(`Task-final Review ${latestReview.id} omitted Project ${taskBinding.projectId}.`);
+        }
+        const actualCommit = (await git.inspect(entry.path, "HEAD")).baseCommit;
+        if (actualCommit !== reviewedCommit) {
+            throw usageError(`Task-final Review ${latestReview.id} does not match Task head `
+                + `${taskBinding.projectId}@${actualCommit}.`);
+        }
+        actualHeads.set(taskBinding.projectId, actualCommit);
+    }
+    if (actualHeads.size !== latestReview.taskCandidate.projects.length) {
+        throw usageError(`Task-final Review ${latestReview.id} Project set does not match Task ${task.id}.`);
+    }
+    const entry = workspaceProjectEntry(workspace, publication.projectId);
+    const localCommit = actualHeads.get(publication.projectId);
+    if (publication.localCommit !== localCommit) {
+        throw usageError(`Publication ${publication.id} local commit ${publication.localCommit} `
+            + `does not match Task head ${localCommit}.`);
+    }
+    let remoteCommit;
+    let localTree;
+    let remoteTree;
+    try {
+        remoteCommit = (await git.inspect(entry.path, publication.remoteCommit)).baseCommit;
+        [localTree, remoteTree] = await Promise.all([
+            git.resolveTree(entry.path, localCommit),
+            git.resolveTree(entry.path, remoteCommit)
+        ]);
+    }
+    catch (error) {
+        throw usageError(`Publication ${publication.id} commit/tree evidence is unavailable: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (remoteCommit !== publication.remoteCommit) {
+        throw usageError(`Publication ${publication.id} remote commit changed: expected `
+            + `${publication.remoteCommit}, found ${remoteCommit}.`);
+    }
+    const [localContainsRemote, remoteContainsLocal] = await Promise.all([
+        git.isAncestor(entry.path, remoteCommit, localCommit),
+        git.isAncestor(entry.path, localCommit, remoteCommit)
+    ]);
+    if (localContainsRemote || remoteContainsLocal) {
+        throw usageError(`Publication ${publication.id} is not ancestry-divergent from Task head ${localCommit}; `
+            + "use normal Task completion.");
+    }
+    if (localTree !== remoteTree) {
+        throw usageError(`Publication ${publication.id} Git trees differ: `
+            + `${localCommit}^{tree}=${localTree}, ${remoteCommit}^{tree}=${remoteTree}.`);
+    }
+    return {
+        taskId: task.id,
+        projectId: publication.projectId,
+        publicationId: publication.id,
+        reviewRoundId: latestReview.id,
+        localCommit,
+        remoteCommit,
+        tree: localTree
+    };
+}
+/** Re-derive every durable half of the asynchronous Git proof under the Task
+ * completion transaction. The physical heads are the CLI snapshot captured
+ * immediately before mutation; any record or head drift fails closed. */
+export function assertTaskCompletionPublishedTreeProof(store, task, publicationId, proof, actualCandidate) {
+    if (proof === undefined
+        || proof.taskId !== task.id
+        || proof.publicationId !== publicationId) {
+        throw usageError(`Published-tree completion proof is missing or mismatched for ${task.id}/${publicationId}.`);
+    }
+    const publication = requireCurrentVerifiedPublication(store, task.id, publicationId);
+    if (publication.projectId !== proof.projectId
+        || publication.localCommit !== proof.localCommit
+        || publication.remoteCommit !== proof.remoteCommit) {
+        throw usageError(`Publication evidence changed before Task completion: ${publication.id}.`);
+    }
+    const latestReview = latestTaskFinalReview(store, task.id);
+    if (latestReview === undefined
+        || latestReview.id !== proof.reviewRoundId
+        || latestReview.status !== "completed"
+        || latestReview.taskCandidate === undefined
+        || !sameTaskCandidate(latestReview.taskCandidate, actualCandidate)) {
+        throw usageError(`Task-final Review evidence changed before published-tree completion: ${task.id}.`);
+    }
+    const actualCommit = actualCandidate.projects.find(({ projectId }) => (projectId === proof.projectId))?.commit;
+    if (actualCommit !== proof.localCommit) {
+        throw usageError(`Task head changed before published-tree completion: `
+            + `${proof.projectId}@${actualCommit ?? "missing"}.`);
+    }
+    return proof;
+}
+function requireCurrentVerifiedPublication(store, taskId, publicationId) {
+    const publication = store.getPublicationReference(taskId, publicationId);
+    if (publication === null) {
+        throw usageError(`Publication reference not found: ${taskId}/${publicationId}.`);
+    }
+    const current = store.findPublicationReferenceByExternalKey(publicationExternalKey(publication));
+    if (current === null || current.taskId !== taskId || current.id !== publication.id) {
+        throw usageError(`Publication ${publication.id} is not the current unsuperseded record for its external identity.`);
+    }
+    if (publication.state !== "merged" || publication.verification !== "verified") {
+        throw usageError(`Publication ${publication.id} must be merged and verified before Task completion.`);
+    }
+    return publication;
+}
+function latestTaskFinalReview(store, taskId) {
+    return store.listReviewRounds(taskId)
+        .filter((round) => (round.scope ?? "work-item") === "task")
+        .sort((left, right) => (left.id.localeCompare(right.id, undefined, { numeric: true })))
+        .at(-1);
+}
+function sameTaskCandidate(left, right) {
+    return left.projects.length === right.projects.length
+        && left.projects.every((project, index) => (project.projectId === right.projects[index]?.projectId
+            && project.commit === right.projects[index]?.commit));
+}
 /**
  * Reconcile configured remote baselines before a Task completion attempt.
  *

package/dist/context/runContextPack.js

@@ -1,3 +1,4 @@
+import { TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT } from "../task/publicationReference.js";
 import { RUN_BOOTSTRAP_MAX_DELTAS } from "./runContextContract.js";
 import { contextContentDigest, contextSnapshotRef, createContextSnapshot, validateContextSnapshot } from "./contextSnapshot.js";
 export const RUN_CONTEXT_PACK_SCHEMA_VERSION = 1;
@@ -123,11 +124,12 @@ export function buildRunContextPack(store, taskId, runId) {
     });
     return pack;
 }
-export function expandRunContextRef(store, taskId, runId, refId) {
+export function expandRunContextRef(store, taskId, runId, refId, refStore) {
     const pack = buildRunContextPack(store, taskId, runId);
-    const authorized = pack.pointers.filter((ref) => ref.refId === refId);
+    const authorized = pack.pointers.filter((ref) => (ref.refId === refId && (refStore === undefined || ref.store === refStore)));
+    const selector = refStore === undefined ? refId : `${refStore}/${refId}`;
     if (authorized.length !== 1) {
-        throw new Error(`Run Context ref is not uniquely authorized: ${refId}.`);
+        throw new Error(`Run Context ref is not uniquely authorized: ${selector}.`);
     }
     const run = requireExactRun(store, taskId, runId);
     const snapshotRef = run.assignment.contextSnapshotRef;
@@ -135,7 +137,7 @@ export function expandRunContextRef(store, taskId, runId, refId) {
         ? collectAuthorizedContext(store, run).find(({ ref }) => (contextRefIdentity(ref) === contextRefIdentity(authorized[0])))
         : store.getContextSnapshot(taskId, snapshotRef.id)?.resources.find(({ ref }) => (contextRefIdentity(ref) === contextRefIdentity(authorized[0])));
     if (materialized === undefined || materialized.ref.digest !== authorized[0].digest) {
-        throw new Error(`Run Context ref is unavailable or drifted: ${refId}.`);
+        throw new Error(`Run Context ref is unavailable or drifted: ${selector}.`);
     }
     const bytes = Buffer.byteLength(JSON.stringify(materialized.value), "utf8");
     if (bytes > RUN_CONTEXT_EXPAND_MAX_BYTES) {
@@ -261,6 +263,19 @@ function collectAuthorizedContext(store, run) {
         for (const message of store.listMessages(task.id).slice(-16)) {
             result.push(materialize("L4", "task-message", message.id, message));
         }
+        const publishedTreeAuthorizations = [];
+        const events = store.listEvents(task.id);
+        for (let index = events.length - 1; index >= 0; index -= 1) {
+            const event = events[index];
+            if (event.type === "task.completed" || event.type === "task.reopened")
+                break;
+            if (event.type === TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT) {
+                publishedTreeAuthorizations.push(event);
+            }
+        }
+        for (const event of publishedTreeAuthorizations.reverse().slice(-16)) {
+            result.push(materialize("L4", "task-event", event.id, event));
+        }
         for (const request of store.listOpenInputRequests([task.id])) {
             result.push(materialize("L4", "input-request", request.id, request));
         }

package/dist/context/sessionBootstrapManifest.js

@@ -57,7 +57,7 @@ export function materializeSessionBootstrap(input) {
             }
             : {
                 loadCommand: `\"${sessionCliPath}\" task run context \"$YUI_TASK_ID/<run-id>\" --json`,
-                expandCommand: `\"${sessionCliPath}\" task run context expand \"$YUI_TASK_ID/<run-id>\" <ref-id> --mode full --json`
+                expandCommand: `\"${sessionCliPath}\" task run context expand \"$YUI_TASK_ID/<run-id>\" <ref-id> --store <store> --mode full --json`
             }
     };
     const manifest = Object.freeze({ ...body, digest: digest(body) });

package/dist/repository/gitWorkspace.js

@@ -15,15 +15,18 @@ export class RemoteBaselineConflictError extends Error {
 }
 /** The small Git boundary used by project registration and Task workspaces. */
 export class NodeGitWorkspace {
+    async resolveTree(repositoryPath, commit) {
+        return gitLine([
+            "-C", repositoryPath,
+            "rev-parse", "--verify", "--end-of-options", `${commit}^{tree}`
+        ]);
+    }
     async findCommitWithSameTreeInHistory(input) {
         const source = (await this.inspect(input.repositoryPath, input.sourceCommit)).baseCommit;
         const history = (await this.inspect(input.repositoryPath, input.historyHead)).baseCommit;
         if (await this.isAncestor(input.repositoryPath, source, history))
             return source;
-        const sourceTree = await gitLine([
-            "-C", input.repositoryPath,
-            "rev-parse", "--verify", "--end-of-options", `${source}^{tree}`
-        ]);
+        const sourceTree = await this.resolveTree(input.repositoryPath, source);
         const pageSize = 1000;
         for (let skip = 0;; skip += pageSize) {
             const output = await git([

package/dist/repository/taskBaseFreshness.js

@@ -107,10 +107,12 @@ export async function inspectTaskBaseFreshness(taskId, store, options = {}) {
     }));
     return { taskId, refreshed: options.refresh === true, entries };
 }
-export function assertTaskBaseFreshnessForCompletion(report) {
+export function assertTaskBaseFreshnessForCompletion(report, options = {}) {
     const warnings = [];
     for (const entry of report.entries) {
-        if (entry.status === "behind" || entry.status === "diverged") {
+        const acceptedPublishedTree = options.acceptedPublishedTreeProjectId === entry.projectId;
+        if ((entry.status === "behind" || entry.status === "diverged")
+            && !acceptedPublishedTree) {
             throw usageError(`Task ${report.taskId} Project ${entry.projectId} base is ${entry.status}; `
                 + `run 'yui task base status ${report.taskId} --refresh' and choose an explicit delivery base. `
                 + "Safe resolutions are to rebase or merge the Task workspace onto the refreshed remote base, "

package/dist/run/agentRun.js

@@ -67,11 +67,11 @@ export function withAgentRunContextSnapshot(run, snapshot, deltaRefIds = []) {
     if (run.status !== "active" || run.pushedAt !== undefined || run.deliveredAt !== undefined) {
         throw new Error(`Cannot bind Context Snapshot after Run delivery: ${run.id}.`);
     }
-    const assignment = validateRunAssignment(Object.freeze({
+    const assignment = createRunAssignment({
         ...run.assignment,
         contextSnapshotRef: snapshot,
         deltaRefIds
-    }));
+    });
     return validateAgentRun(Object.freeze({
         ...run,
         assignment,

package/dist/scheduler/wakeReason.js

@@ -22,6 +22,7 @@ export const WAKE_REASON_KINDS = Object.freeze([
     "leader-run-failed",
     "role-run-failed",
     "job-finished",
+    "published-tree-authorized",
     "force-wake"
 ]);
 const IMMEDIATE_KINDS = new Set([

package/dist/storage/sqliteStore.js

@@ -732,6 +732,8 @@ export class SqliteTaskStore {
             return null;
         return {
             ...base,
+            agentRuns: this.listAgentRuns(taskId),
+            roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: this.#sortById(this.#listPayload("managed_workspaces", "task_id = ?", [taskId]), (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: this.#sortById(this.#listPayload("durable_jobs", "task_id = ?", [taskId]), (job) => job.id),
             integrationQueueEntries: this.#sortById(this.#listPayload("integration_queue", "task_id = ?", [taskId]), (entry) => entry.id),

package/dist/storage/taskStore.js

@@ -442,6 +442,8 @@ export class FileTaskStore {
         }
         return {
             ...base,
+            agentRuns: this.listAgentRuns(taskId),
+            roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: values(aggregate.managedWorkspaces, (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: values(aggregate.durableJobs, "id"),
             integrationQueueEntries: values(aggregate.integrationQueue, "id"),

package/dist/task/completionReadiness.js

@@ -142,6 +142,8 @@ export function projectCompletionReadiness(facts, options = {}) {
     }
     // Provider continuations that may still write the Workspace.
     for (const continuation of blockingProviderContinuations(facts.events)) {
+        if (!providerContinuationBlocksCompletion(continuation, facts))
+            continue;
         const identity = continuation.identity;
         blockers.push({
             code: "blocking-provider-continuation",
@@ -209,6 +211,47 @@ export function projectCompletionReadiness(facts, options = {}) {
     });
     return { taskId: task.id, ready: sorted.length === 0, blockers: sorted };
 }
+/**
+ * A terminal Run releases only its completion blocker, never its immutable
+ * continuation audit. Missing or inconsistent ownership remains ambiguous and
+ * therefore fail-closed. A live exact native Session can still deliver or
+ * write for a terminal Run, so it retains the blocker until that Session is
+ * stopped, broken, or replaced by another Conversation identity.
+ */
+function providerContinuationBlocksCompletion(continuation, facts) {
+    if (continuation.identityConflict)
+        return true;
+    const ownerRun = facts.agentRuns.find(({ id }) => id === continuation.runId);
+    if (ownerRun === undefined
+        || ownerRun.taskId !== continuation.taskId
+        || ownerRun.roleName !== continuation.roleName
+        || ownerRun.effective.agentId !== continuation.identity.accountScope) {
+        return true;
+    }
+    if (ownerRun.status !== "failed" && ownerRun.status !== "yielded")
+        return true;
+    const sessions = facts.roleSessionSets.find(({ owner }) => (owner.taskId === continuation.taskId && owner.roleName === continuation.roleName));
+    const session = sessions?.sessions[continuation.identity.accountScope];
+    if (session !== undefined
+        && session.status !== "stopped"
+        && session.status !== "broken"
+        && session.nativeSessionId === continuation.identity.conversationId) {
+        return true;
+    }
+    const binding = sessions?.providerBinding;
+    if (binding === undefined || binding === null
+        || binding.providerNamespace !== continuation.identity.providerNamespace
+        || binding.accountScope !== continuation.identity.accountScope) {
+        return false;
+    }
+    const conversationIsCurrent = binding.conversations.some((conversation) => (conversation.conversationId === continuation.identity.conversationId
+        && conversation.epoch === binding.currentConversationEpoch
+        && conversation.status === "current"));
+    const activationIsLive = binding.activations.some((activation) => (activation.activationId === continuation.identity.activationId
+        && activation.conversationId === continuation.identity.conversationId
+        && activation.status === "active"));
+    return conversationIsCurrent && activationIsLive;
+}
 function workspaceBlocker(facts, taskId, workspace) {
     const owner = workspace.owner;
     switch (owner.type) {

package/dist/task/nextAction.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { sameTaskFinalReviewContract, validateTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
-import { currentWorkItemCandidate } from "../workItem/workItem.js";
+import { currentWorkItemCandidate, governingWorkItemCandidate } from "../workItem/workItem.js";
 const OPEN_WORK_ITEM_STATUSES = new Set(["pending", "running", "awaiting_acceptance"]);
 export function projectNextAction(facts) {
     const { task } = facts;
@@ -602,8 +602,7 @@ function selectOpenWorkItem(workItems) {
 }
 function taskFinalReviewContract(facts) {
     const contract = facts.workItems
-        .flatMap((item) => item.candidates)
-        .map((candidate) => candidate.taskFinalReviewContract)
+        .map((item) => governingWorkItemCandidate(item)?.taskFinalReviewContract)
         .find((contract) => contract !== undefined);
     return contract === undefined ? undefined : validateTaskFinalReviewContract(contract);
 }
@@ -680,7 +679,10 @@ function detectProtocolInconsistency(facts) {
     const changeSetIds = new Set(facts.changeSets.map((changeSet) => changeSet.id));
     const workItemById = new Map(facts.workItems.map((item) => [item.id, item]));
     const contractedCandidates = facts.workItems
-        .flatMap((item) => item.candidates.map((candidate) => ({ item, candidate })))
+        .flatMap((item) => {
+        const candidate = governingWorkItemCandidate(item);
+        return candidate === undefined ? [] : [{ item, candidate }];
+    })
         .filter(({ candidate }) => candidate.taskFinalReviewContract !== undefined);
     if (contractedCandidates.length > 1) {
         const first = validateTaskFinalReviewContract(contractedCandidates[0].candidate.taskFinalReviewContract);

package/dist/task/publicationReference.js

@@ -1,6 +1,7 @@
 import { requireIdentity, requireText, requireTimestamp } from "../domain/validation.js";
 import { validateTaskRecordReference } from "./taskRecordReference.js";
 export const PUBLICATION_REFERENCE_SCHEMA_VERSION = 1;
+export const TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT = "task.completion-published-tree-authorized";
 const PROVIDERS = new Set(["github", "gitlab"]);
 const EXTERNAL_KINDS = new Set(["pull-request", "merge-request"]);
 const STATES = new Set(["open", "merged", "closed"]);

package/dist/workItem/workItem.js

@@ -567,6 +567,18 @@ export function currentWorkItemCandidate(workItem) {
         ? workItem.candidates.at(-1)
         : undefined;
 }
+/**
+ * Resolve the one Candidate that still governs Task delivery semantics.
+ * Awaiting Candidates remain under Leader disposition, while completed
+ * Candidates freeze accepted delivery evidence. Failed, retired, pending,
+ * and running WorkItems retain Candidate history only for audit; older
+ * Candidates on the same WorkItem are superseded by its latest Candidate.
+ */
+export function governingWorkItemCandidate(workItem) {
+    return workItem.status === "awaiting_acceptance" || workItem.status === "completed"
+        ? workItem.candidates.at(-1)
+        : undefined;
+}
 export function updateWorkItemWriteProjects(workItem, writeProjectIds, now) {
     validateWorkItem(workItem);
     if (isTerminalStatus(workItem.status)) {

package/dist/workspace/workItemChangeSetManager.js

@@ -4,6 +4,7 @@ import { createChangeSetManifest } from "../integration/changeSetManifest.js";
 import { deriveManifestTags } from "../integration/manifestTags.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
 import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
+import { governingWorkItemCandidate } from "../workItem/workItem.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { captureManagedGitChanges } from "./gitChangeSetCapture.js";
 const CAPTURABLE_WORK_ITEM_STATUSES = new Set([
@@ -427,7 +428,7 @@ function latestExactDirectAnchorId(store, taskId, contract) {
         return undefined;
     return store.listWorkItems(taskId)
         .filter((item) => {
-        const candidate = item.candidates.at(-1);
+        const candidate = governingWorkItemCandidate(item);
         return candidate?.source.type === "direct"
             && sameTaskFinalReviewContract(candidate.taskFinalReviewContract, contract);
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -521,9 +521,14 @@ authorized expansions.
   completion; routine retries and routing do not need an InputRequest.
 - A failed review is terminal evidence, not an automatic retry. Retry a
   WorkItem review with a new `task work review`, accept with an explicit
-  rationale, or ask the user. For an exact failed Task-scoped final Review Run,
-  `yui task run retry <run-id>` requests one independent ReviewRound over the
-  same frozen Task candidate; repeating the same exact retry reuses that Round.
+  rationale, or ask the user. `yui task run retry <run-id>` retries an exact
+  failed Task-final Reviewer execution under the same semantic ReviewRound. If
+  that immutable Round itself failed without any semantic report, checks,
+  yield, evidence, or finding, the Leader may run
+  `yui task review force-fresh <task>/<review-round>` to create one distinct
+  full Round over the identical frozen heads. It fails closed for every
+  semantic or ambiguous prior result; target the new failed Round explicitly
+  if another non-semantic failure occurs.
 - If the same non-resource user choice or unavailable external fact repeats,
   persist context and create an InputRequest instead of looping. Never use an
   InputRequest to solicit authorization for an unrequested real-resource test;

package/skills/yui-runtime/SKILL.md

@@ -23,12 +23,17 @@ For every managed Task Run:
    context-load failure if the pack is missing, stale, unauthorized, malformed,
    or mismatched. Never request an inline/full-prompt fallback.
 4. Use pack summaries and pointers first. Expand only an authorized ref when
-   its full value is needed:
+   its full value is needed, selecting it by the pointer's exact `store` and
+   `refId`:
 
    ```sh
-   "$YUI_SESSION_CLI" task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --mode full --json
+   "$YUI_SESSION_CLI" task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
    ```
 
+   A bare `<ref-id>` remains supported only when it identifies exactly one
+   authorized pointer. If multiple stores use that id, bare expansion fails
+   closed; never guess which store was intended.
+
 5. On a later wake, request only the declared delta after the last pack cursor.
    If no cursor is available, reload the exact pack; do not reconstruct state
    from transcript memory.