@zq-silk/yui 0.8.2 → 0.8.6

package/dist/commands/taskCompletionGate.js

@@ -2,7 +2,171 @@ import { usageError } from "../errors/cliError.js";
 import { GitIntegrationService } from "../integration/gitIntegrationService.js";
 import { createIntegrationAttempt } from "../integration/integrationAttempt.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { taskDeliveryPath } from "../task/task.js";
+import { publicationExternalKey } from "../task/publicationReference.js";
+import { isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
+/**
+ * Verify the one supported ancestry waiver before `task complete` mutates any
+ * durable state. The explicit Publication must be the current verified merged
+ * record, bind the exact physical Task head (and, for integrated delivery, its
+ * completed final Review), and name an ancestry-divergent commit with the
+ * exact same Git tree.
+ */
+export async function verifyTaskCompletionPublishedTree(taskId, publicationId, store, options = {}) {
+    const task = store.getTask(taskId);
+    if (task === null)
+        throw usageError(`Task not found: ${taskId}.`);
+    if (task.status !== "active") {
+        throw usageError(`Task is not active: ${task.id}.`);
+    }
+    const publication = requireCurrentVerifiedPublication(store, task.id, publicationId);
+    const binding = task.projectBindings.find(({ projectId }) => (projectId === publication.projectId));
+    if (binding === undefined) {
+        throw usageError(`Publication ${publication.id} Project is not bound to Task ${task.id}: `
+            + `${publication.projectId}.`);
+    }
+    if (publication.localCommit === undefined || publication.remoteCommit === undefined) {
+        throw usageError(`Publication ${publication.id} must record exact local and remote commits.`);
+    }
+    const workspace = requireTaskWorkspace(store, task);
+    const integrated = taskDeliveryPath(task) === "integrated";
+    const latestReview = integrated ? latestTaskFinalReview(store, task.id) : undefined;
+    if (integrated && (latestReview === undefined
+        || !isSemanticReviewRound(latestReview, store)
+        || latestReview.taskCandidate === undefined)) {
+        throw usageError(`Task ${task.id} requires a latest completed Task-final Review before accepting a published tree.`);
+    }
+    const git = options.git ?? new NodeGitWorkspace();
+    const actualHeads = new Map();
+    for (const taskBinding of task.projectBindings) {
+        const entry = workspaceProjectEntry(workspace, taskBinding.projectId);
+        if (entry === undefined || entry.access !== "write") {
+            throw usageError(`Task ${task.id} has no writable managed main workspace for Project ${taskBinding.projectId}.`);
+        }
+        const actualCommit = (await git.inspect(entry.path, "HEAD")).baseCommit;
+        if (latestReview !== undefined) {
+            const reviewedCommit = latestReview.taskCandidate.projects.find(({ projectId }) => (projectId === taskBinding.projectId))?.commit;
+            if (reviewedCommit === undefined) {
+                throw usageError(`Task-final Review ${latestReview.id} omitted Project ${taskBinding.projectId}.`);
+            }
+            if (actualCommit !== reviewedCommit) {
+                throw usageError(`Task-final Review ${latestReview.id} does not match Task head `
+                    + `${taskBinding.projectId}@${actualCommit}.`);
+            }
+        }
+        actualHeads.set(taskBinding.projectId, actualCommit);
+    }
+    if (latestReview !== undefined
+        && actualHeads.size !== latestReview.taskCandidate.projects.length) {
+        throw usageError(`Task-final Review ${latestReview.id} Project set does not match Task ${task.id}.`);
+    }
+    const entry = workspaceProjectEntry(workspace, publication.projectId);
+    const localCommit = actualHeads.get(publication.projectId);
+    if (publication.localCommit !== localCommit) {
+        throw usageError(`Publication ${publication.id} local commit ${publication.localCommit} `
+            + `does not match Task head ${localCommit}.`);
+    }
+    let remoteCommit;
+    let localTree;
+    let remoteTree;
+    try {
+        remoteCommit = (await git.inspect(entry.path, publication.remoteCommit)).baseCommit;
+        [localTree, remoteTree] = await Promise.all([
+            git.resolveTree(entry.path, localCommit),
+            git.resolveTree(entry.path, remoteCommit)
+        ]);
+    }
+    catch (error) {
+        throw usageError(`Publication ${publication.id} commit/tree evidence is unavailable: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (remoteCommit !== publication.remoteCommit) {
+        throw usageError(`Publication ${publication.id} remote commit changed: expected `
+            + `${publication.remoteCommit}, found ${remoteCommit}.`);
+    }
+    const [localContainsRemote, remoteContainsLocal] = await Promise.all([
+        git.isAncestor(entry.path, remoteCommit, localCommit),
+        git.isAncestor(entry.path, localCommit, remoteCommit)
+    ]);
+    if (localContainsRemote || remoteContainsLocal) {
+        throw usageError(`Publication ${publication.id} is not ancestry-divergent from Task head ${localCommit}; `
+            + "use normal Task completion.");
+    }
+    if (localTree !== remoteTree) {
+        throw usageError(`Publication ${publication.id} Git trees differ: `
+            + `${localCommit}^{tree}=${localTree}, ${remoteCommit}^{tree}=${remoteTree}.`);
+    }
+    return {
+        taskId: task.id,
+        projectId: publication.projectId,
+        publicationId: publication.id,
+        ...(latestReview === undefined ? {} : { reviewRoundId: latestReview.id }),
+        localCommit,
+        remoteCommit,
+        tree: localTree
+    };
+}
+/** Re-derive every durable half of the asynchronous Git proof under the Task
+ * completion transaction. The physical heads are the CLI snapshot captured
+ * immediately before mutation; any record or head drift fails closed. */
+export function assertTaskCompletionPublishedTreeProof(store, task, publicationId, proof, actualCandidate) {
+    if (proof === undefined
+        || proof.taskId !== task.id
+        || proof.publicationId !== publicationId) {
+        throw usageError(`Published-tree completion proof is missing or mismatched for ${task.id}/${publicationId}.`);
+    }
+    const publication = requireCurrentVerifiedPublication(store, task.id, publicationId);
+    if (publication.projectId !== proof.projectId
+        || publication.localCommit !== proof.localCommit
+        || publication.remoteCommit !== proof.remoteCommit) {
+        throw usageError(`Publication evidence changed before Task completion: ${publication.id}.`);
+    }
+    if (taskDeliveryPath(task) === "integrated") {
+        const latestReview = latestTaskFinalReview(store, task.id);
+        if (latestReview === undefined
+            || latestReview.id !== proof.reviewRoundId
+            || !isSemanticReviewRound(latestReview, store)
+            || latestReview.taskCandidate === undefined
+            || !sameTaskCandidate(latestReview.taskCandidate, actualCandidate)) {
+            throw usageError(`Task-final Review evidence changed before published-tree completion: ${task.id}.`);
+        }
+    }
+    else if (proof.reviewRoundId !== undefined) {
+        throw usageError(`Direct published-tree proof unexpectedly binds a final Review: ${task.id}.`);
+    }
+    const actualCommit = actualCandidate.projects.find(({ projectId }) => (projectId === proof.projectId))?.commit;
+    if (actualCommit !== proof.localCommit) {
+        throw usageError(`Task head changed before published-tree completion: `
+            + `${proof.projectId}@${actualCommit ?? "missing"}.`);
+    }
+    return proof;
+}
+function requireCurrentVerifiedPublication(store, taskId, publicationId) {
+    const publication = store.getPublicationReference(taskId, publicationId);
+    if (publication === null) {
+        throw usageError(`Publication reference not found: ${taskId}/${publicationId}.`);
+    }
+    const current = store.findPublicationReferenceByExternalKey(publicationExternalKey(publication));
+    if (current === null || current.taskId !== taskId || current.id !== publication.id) {
+        throw usageError(`Publication ${publication.id} is not the current unsuperseded record for its external identity.`);
+    }
+    if (publication.state !== "merged" || publication.verification !== "verified") {
+        throw usageError(`Publication ${publication.id} must be merged and verified before Task completion.`);
+    }
+    return publication;
+}
+function latestTaskFinalReview(store, taskId) {
+    return store.listReviewRounds(taskId)
+        .filter((round) => (round.scope ?? "work-item") === "task")
+        .sort((left, right) => (left.id.localeCompare(right.id, undefined, { numeric: true })))
+        .at(-1);
+}
+function sameTaskCandidate(left, right) {
+    return left.projects.length === right.projects.length
+        && left.projects.every((project, index) => (project.projectId === right.projects[index]?.projectId
+            && project.commit === right.projects[index]?.commit));
+}
 /**
  * Reconcile configured remote baselines before a Task completion attempt.
  *
@@ -169,7 +333,7 @@ async function hasCompletedTaskFinalReviewForCurrentCandidate(store, task, works
         .filter((round) => (round.scope ?? "work-item") === "task")
         .sort((left, right) => left.id.localeCompare(right.id, undefined, { numeric: true }));
     const latest = rounds.at(-1);
-    if (latest === undefined || latest.status !== "completed")
+    if (latest === undefined || !isSemanticReviewRound(latest, store))
         return false;
     if (latest.taskCandidate === undefined)
         return false;
@@ -202,7 +366,7 @@ function latestCommittedIntegration(store, taskId, projectId) {
 function hasFrozenTaskBaseline(store, taskId, projectId, currentCommit) {
     return store.listReviewRounds(taskId)
         .some((round) => ((round.scope ?? "work-item") === "task"
-        && round.status === "completed"
+        && isSemanticReviewRound(round, store)
         && round.taskCandidate !== undefined
         && round.taskCandidate.projects.some((entry) => (entry.projectId === projectId && entry.commit === currentCommit))));
 }

package/dist/commands/taskContextCommand.js

@@ -4,6 +4,7 @@ import { formatTimestamp } from "../output/timePresentation.js";
 import { isRoleRunStalled, latestStallProgressAt } from "../scheduler/roleRunStall.js";
 import { buildTaskExecutionProjection } from "../scheduler/taskExecutionProjection.js";
 import { projectNextAction } from "../task/nextAction.js";
+import { taskDeliveryPath } from "../task/task.js";
 import { inspectTaskRoleSessionRecovery } from "./taskRoleRuntimeStatus.js";
 import { summarizeExecutionGroup } from "../execution/executionGroup.js";
 import { currentWorkItemExecutionGroup } from "../workItem/workItem.js";
@@ -51,6 +52,7 @@ export function runTaskContextCommand(args, store) {
         }
         return {
             task,
+            deliveryPath: taskDeliveryPath(task),
             execution,
             reviewConfig: reader.getReviewConfig(),
             brief: reader.getTaskBrief(task.id),
@@ -137,9 +139,12 @@ export function runTaskContextCommand(args, store) {
         ...(managedWorkspaces.length === 0
             ? ["  None."]
             : managedWorkspaces.map((workspace) => (`  ${managedWorkspaceLabel(workspace)}: ${workspace.root} (${workspace.entries.filter(({ access }) => access === "write").length} writable / ${workspace.entries.length} Projects)`))),
+        `Delivery: ${taskDeliveryPath(task)}`,
         `Completion evidence: ${task.requireIntegration
             ? "WorkItem, ChangeSet, and committed Integration required"
-            : "delivery integration not required"}`,
+            : task.projectBindings.length > 0
+                ? "clean committed Task main required"
+                : "no Project evidence required"}`,
         `Global review: ${reviewConfig === null
             ? "disabled"
             : `${reviewConfig.roleName} (${reviewConfig.trigger})`}`,

package/dist/commands/taskInputCommands.js

@@ -8,6 +8,8 @@ import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
 import { enqueueWork } from "../coordination/workMailboxQueue.js";
 import { clearMatchingLeaderStallAttention, isRoleRunStalled, RUN_RECOVERED_EVENT } from "../scheduler/roleRunStall.js";
 import { terminalizeExactTaskRun } from "../lifecycle/exactRunTerminalization.js";
+import { hasRuntimeCleanupObligation, isRuntimeLaunchReservation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { isLinuxProcessLive, listOwnedProcessTree } from "../runtime/sessionOwnerIdentity.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
 const LEADER_ROLE = "leader";
 export function runTaskInputCommand(args, store, options) {
@@ -270,16 +272,33 @@ export function isCurrentGlobalOperator(store, environment) {
     const role = store.getGlobalRole("operator");
     if (role === null)
         return false;
-    const sessions = store.getGlobalRoleSessionSet(role.name);
-    const session = activeLiveRoleAgentSession(sessions);
-    if (sessions === null || session === null || sessions.activeAgentId !== role.activeAgentId) {
-        return false;
-    }
     const agentId = exactIdentity(environment.YUI_AGENT_ID);
     const adapterId = exactIdentity(environment.YUI_ADAPTER_ID);
     const launchId = exactIdentity(environment.YUI_LAUNCH_ID);
     const nativeSessionId = exactIdentity(environment.YUI_NATIVE_SESSION_ID);
     const binding = role.agentBindings[role.activeAgentId];
+    if (agentId === undefined
+        || adapterId === undefined
+        || launchId === undefined
+        || binding === undefined
+        || binding.agentId !== agentId
+        || binding.adapterId !== adapterId)
+        return false;
+    const sessions = store.getGlobalRoleSessionSet(role.name);
+    const session = activeLiveRoleAgentSession(sessions);
+    if (sessions === null || session === null || sessions.activeAgentId !== role.activeAgentId) {
+        // Codex learns its native Session ID only after the first Turn. During
+        // that narrow bootstrap window, authenticate against the durable launch
+        // reservation and its strongly attributed live process owner instead.
+        return nativeSessionId === undefined
+            && binding.adapterId === "codex"
+            && currentProcessBelongsToReservedGlobalLaunch(store, {
+                roleName: role.name,
+                agentId,
+                adapterId,
+                launchId
+            });
+    }
     // A fresh Codex launch discovers its native Session asynchronously. Its
     // launch envelope therefore cannot carry YUI_NATIVE_SESSION_ID, but the
     // durable Session still binds that provider identity to the exact launch
@@ -292,11 +311,7 @@ export function isCurrentGlobalOperator(store, environment) {
             && session.adapterId === "codex"
             && session.launchId !== undefined
             && session.launchId === launchId));
-    return agentId !== undefined
-        && adapterId !== undefined
-        && launchId !== undefined
-        && binding !== undefined
-        && binding.agentId === session.agentId
+    return binding.agentId === session.agentId
         && binding.adapterId === session.adapterId
         && session.agentId === agentId
         && session.adapterId === adapterId
@@ -304,6 +319,29 @@ export function isCurrentGlobalOperator(store, environment) {
         && session.launchId === launchId
         && nativeSessionMatches;
 }
+function currentProcessBelongsToReservedGlobalLaunch(store, input) {
+    if (store.getSessionOwner === undefined || store.getWorkMailbox === undefined)
+        return false;
+    const mailbox = store.getWorkMailbox(runtimeLifecycleTarget({
+        scope: "global",
+        roleName: input.roleName
+    }));
+    if (!isRuntimeLaunchReservation(mailbox?.processing, input.launchId)
+        || hasRuntimeCleanupObligation(mailbox))
+        return false;
+    const owner = store.getSessionOwner(input.launchId);
+    if (owner === null
+        || owner.owner.scope !== "global"
+        || owner.owner.roleName !== input.roleName
+        || owner.agentId !== input.agentId
+        || owner.adapterId !== input.adapterId
+        || owner.launchId !== input.launchId
+        || owner.providerRoot.attribution !== "launch-env"
+        || !isLinuxProcessLive(owner.providerRoot.pid, owner.providerRoot.startIdentity)) {
+        return false;
+    }
+    return listOwnedProcessTree(owner.providerRoot.pid, owner.providerRoot.processGroupId).some(({ pid }) => pid === process.pid);
+}
 function inputAnswerer(environment) {
     const env = environment ?? {};
     if (env.YUI_SESSION_SCOPE === undefined && env.YUI_ROLE === undefined)

package/dist/commands/taskNextActionCommand.js

@@ -2,6 +2,8 @@ import { taskNotFound, usageError } from "../errors/cliError.js";
 import { projectNextAction } from "../task/nextAction.js";
 import { projectCompletionReadiness } from "../task/completionReadiness.js";
 import { extractReviewFindings, planRepairWave } from "../task/repairWave.js";
+import { taskDeliveryPath } from "../task/task.js";
+import { projectTaskOrchestration } from "../observability/orchestrationMetrics.js";
 /**
  * Issue 07 (Leader convergence): read-only `yui task next-action <task>`.
  * Folds the existing durable records into exactly one protocol-level next
@@ -55,7 +57,29 @@ export function runTaskNextActionCommand(args, store) {
                 throw taskNotFound(taskId);
             completionReadiness = projectCompletionReadiness(readinessFacts);
         }
-        return { action, repairWave, completionReadiness, knowledgeProposals };
+        const orchestration = projectTaskOrchestration({
+            task: reader.getTask(taskId),
+            runs: reader.listAgentRuns(taskId),
+            roleSessionSets: reader.listRoleSessionSets(taskId),
+            workItems: reader.listWorkItems(taskId),
+            changeSets: reader.listChangeSets(taskId),
+            reviewRounds: reader.listReviewRounds(taskId),
+            reviewFindings: reader.listReviewFindings(taskId),
+            integrations: reader.listIntegrationAttempts(taskId),
+            durableJobs: reader.listDurableJobs(taskId),
+            publications: reader.listPublicationReferences(taskId),
+            decisions: reader.listDecisions(taskId),
+            events: reader.listEvents(taskId),
+            managedWorkspaces: reader.listManagedWorkspaces(taskId)
+        });
+        return {
+            deliveryPath: taskDeliveryPath(facts.task),
+            action,
+            repairWave,
+            completionReadiness,
+            knowledgeProposals,
+            orchestration
+        };
     });
     if (asJson) {
         return {
@@ -66,7 +90,7 @@ export function runTaskNextActionCommand(args, store) {
     }
     return {
         kind: "output",
-        output: renderNextAction(data.action, data.repairWave, data.completionReadiness, data.knowledgeProposals),
+        output: renderNextAction(data.action, data.deliveryPath, data.repairWave, data.completionReadiness, data.knowledgeProposals, data.orchestration.advisories),
         data
     };
 }
@@ -84,9 +108,10 @@ function repairWaveFor(action, facts) {
         return null;
     return planRepairWave(round.id, findings);
 }
-function renderNextAction(action, repairWave, completionReadiness, knowledgeProposals) {
+function renderNextAction(action, deliveryPath, repairWave, completionReadiness, knowledgeProposals, orchestrationAdvisories) {
     const lines = [
         `Task: ${action.taskId}`,
+        `Delivery: ${deliveryPath}`,
         `Next action: ${action.kind}`,
         `Reason: ${action.reason}`,
         ...(action.refs.length === 0
@@ -131,6 +156,10 @@ function renderNextAction(action, repairWave, completionReadiness, knowledgeProp
             lines.push(`Completion readiness: ${completionReadiness.blockers.length} blocker(s)`, ...completionReadiness.blockers.map((blocker) => `  ${blocker.code} (${blocker.ref.kind} ${blocker.ref.id}): ${blocker.reason}`
                 + ` — fix: ${blocker.fix}`));
         }
+        if (completionReadiness.advisories.length > 0) {
+            lines.push(`Completion advisories (non-blocking): ${completionReadiness.advisories.length}`, ...completionReadiness.advisories.map((advisory) => `  ${advisory.code} (${advisory.ref.kind} ${advisory.ref.id}): ${advisory.reason}`
+                + ` — fix before archive: ${advisory.fix}`));
+        }
     }
     if (repairWave !== null) {
         lines.push(`Repair wave (${repairWave.openFindingCount} open finding(s), ${repairWave.groups.length} group(s)):`, ...repairWave.groups.map((group) => `  ${group.id}: findings ${group.findingIds.join(", ")}`
@@ -141,5 +170,9 @@ function renderNextAction(action, repairWave, completionReadiness, knowledgeProp
         lines.push(`Knowledge proposals (non-blocking): ${knowledgeProposals.length} pending`, ...knowledgeProposals.map((proposal) => `  ${proposal.projectId}/${proposal.proposalId}: ${proposal.title}`
             + ` — review: yui project knowledge proposals list ${proposal.projectId}`));
     }
+    if (orchestrationAdvisories.length > 0) {
+        lines.push(`Orchestration advisories (non-blocking): ${orchestrationAdvisories.length}`, ...orchestrationAdvisories.map((advisory) => `  ${advisory.code}: ${advisory.reason}`
+            + (advisory.refs.length === 0 ? "" : ` — refs ${advisory.refs.join(", ")}`)));
+    }
     return `${lines.join("\n")}\n`;
 }

package/dist/context/runContextPack.js

@@ -1,3 +1,4 @@
+import { TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT } from "../task/publicationReference.js";
 import { RUN_BOOTSTRAP_MAX_DELTAS } from "./runContextContract.js";
 import { contextContentDigest, contextSnapshotRef, createContextSnapshot, validateContextSnapshot } from "./contextSnapshot.js";
 export const RUN_CONTEXT_PACK_SCHEMA_VERSION = 1;
@@ -123,11 +124,12 @@ export function buildRunContextPack(store, taskId, runId) {
     });
     return pack;
 }
-export function expandRunContextRef(store, taskId, runId, refId) {
+export function expandRunContextRef(store, taskId, runId, refId, refStore) {
     const pack = buildRunContextPack(store, taskId, runId);
-    const authorized = pack.pointers.filter((ref) => ref.refId === refId);
+    const authorized = pack.pointers.filter((ref) => (ref.refId === refId && (refStore === undefined || ref.store === refStore)));
+    const selector = refStore === undefined ? refId : `${refStore}/${refId}`;
     if (authorized.length !== 1) {
-        throw new Error(`Run Context ref is not uniquely authorized: ${refId}.`);
+        throw new Error(`Run Context ref is not uniquely authorized: ${selector}.`);
     }
     const run = requireExactRun(store, taskId, runId);
     const snapshotRef = run.assignment.contextSnapshotRef;
@@ -135,7 +137,7 @@ export function expandRunContextRef(store, taskId, runId, refId) {
         ? collectAuthorizedContext(store, run).find(({ ref }) => (contextRefIdentity(ref) === contextRefIdentity(authorized[0])))
         : store.getContextSnapshot(taskId, snapshotRef.id)?.resources.find(({ ref }) => (contextRefIdentity(ref) === contextRefIdentity(authorized[0])));
     if (materialized === undefined || materialized.ref.digest !== authorized[0].digest) {
-        throw new Error(`Run Context ref is unavailable or drifted: ${refId}.`);
+        throw new Error(`Run Context ref is unavailable or drifted: ${selector}.`);
     }
     const bytes = Buffer.byteLength(JSON.stringify(materialized.value), "utf8");
     if (bytes > RUN_CONTEXT_EXPAND_MAX_BYTES) {
@@ -261,6 +263,19 @@ function collectAuthorizedContext(store, run) {
         for (const message of store.listMessages(task.id).slice(-16)) {
             result.push(materialize("L4", "task-message", message.id, message));
         }
+        const publishedTreeAuthorizations = [];
+        const events = store.listEvents(task.id);
+        for (let index = events.length - 1; index >= 0; index -= 1) {
+            const event = events[index];
+            if (event.type === "task.completed" || event.type === "task.reopened")
+                break;
+            if (event.type === TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT) {
+                publishedTreeAuthorizations.push(event);
+            }
+        }
+        for (const event of publishedTreeAuthorizations.reverse().slice(-16)) {
+            result.push(materialize("L4", "task-event", event.id, event));
+        }
         for (const request of store.listOpenInputRequests([task.id])) {
             result.push(materialize("L4", "input-request", request.id, request));
         }

package/dist/context/sessionBootstrapManifest.js

@@ -1,10 +1,79 @@
 import { createHash } from "node:crypto";
-import { chmodSync } from "node:fs";
+import { chmodSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { exactControlPlaneCommandPrefix, exactControlPlaneDigest, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
 export { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
+/** Read back one immutable Session Manifest and verify its content digest. */
+export function readSessionBootstrapManifest(path) {
+    const source = resolve(path);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(source, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Session Manifest is unreadable: ${source}.`, { cause: error });
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("Session Manifest is invalid.");
+    }
+    const record = parsed;
+    const claimedDigest = requireDigest(record.digest, "Session Manifest digest");
+    const { digest: _digest, ...body } = record;
+    if (digest(body) !== claimedDigest) {
+        throw new Error("Session Manifest digest does not match its immutable content.");
+    }
+    if (record.schemaVersion !== SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION
+        || record.protocol !== SESSION_CONTEXT_PROTOCOL
+        || record.owner === null
+        || typeof record.owner !== "object"
+        || (record.owner.scope !== "global"
+            && record.owner.scope !== "task")
+        || typeof record.effectiveRevision !== "number"
+        || !Number.isSafeInteger(record.effectiveRevision)
+        || record.effectiveRevision < 1
+        || (record.roleKind !== "operator"
+            && record.roleKind !== "global"
+            && record.roleKind !== "leader"
+            && record.roleKind !== "worker"
+            && record.roleKind !== "reviewer")
+        || record.controlPlane === null
+        || typeof record.controlPlane !== "object"
+        || !Array.isArray(record.skills)
+        || record.roleProfileRef === null
+        || typeof record.roleProfileRef !== "object"
+        || record.contextProtocol === null
+        || typeof record.contextProtocol !== "object") {
+        throw new Error("Session Manifest shape is invalid.");
+    }
+    const owner = record.owner;
+    if (owner.scope === "task" && typeof owner.taskId !== "string") {
+        throw new Error("Task Session Manifest owner is invalid.");
+    }
+    const control = record.controlPlane;
+    requireText(control.descriptorPath, "Session Manifest control descriptor path");
+    requireText(control.sessionCliPath, "Session Manifest CLI path");
+    requireDigest(control.digest, "Session Manifest control-plane digest");
+    for (const skill of record.skills) {
+        if (skill === null || typeof skill !== "object") {
+            throw new Error("Session Manifest Skill entry is invalid.");
+        }
+        const entry = skill;
+        requireText(entry.id, "Session Manifest Skill id");
+        requireText(entry.path, "Session Manifest Skill path");
+        requireDigest(entry.digest, "Session Manifest Skill digest");
+    }
+    const profile = record.roleProfileRef;
+    requireDigest(profile.digest, "Session Manifest Role Profile digest");
+    requireText(profile.path, "Session Manifest Role Profile path");
+    const protocol = record.contextProtocol;
+    requireText(protocol.loadCommand, "Session Manifest Context load command");
+    if (protocol.expandCommand !== undefined) {
+        requireText(protocol.expandCommand, "Session Manifest Context expand command");
+    }
+    return Object.freeze(parsed);
+}
 export function materializeSessionBootstrap(input) {
     const home = resolve(input.yuiHome);
     const controlDigest = exactControlPlaneDigest(input.controlPlane);
@@ -57,7 +126,7 @@ export function materializeSessionBootstrap(input) {
             }
             : {
                 loadCommand: `\"${sessionCliPath}\" task run context \"$YUI_TASK_ID/<run-id>\" --json`,
-                expandCommand: `\"${sessionCliPath}\" task run context expand \"$YUI_TASK_ID/<run-id>\" <ref-id> --mode full --json`
+                expandCommand: `\"${sessionCliPath}\" task run context expand \"$YUI_TASK_ID/<run-id>\" <ref-id> --store <store> --mode full --json`
             }
     };
     const manifest = Object.freeze({ ...body, digest: digest(body) });
@@ -79,3 +148,15 @@ function digest(value) {
     const bytes = typeof value === "string" ? value : JSON.stringify(value);
     return createHash("sha256").update(bytes).digest("hex");
 }
+function requireDigest(value, label) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value;
+}
+function requireText(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value.trim();
+}

package/dist/controller/clientRuntime.js

@@ -10,12 +10,9 @@ import { EPHEMERAL_DOMAIN_ENVIRONMENT_NAMES } from "./domainIdentity.js";
 import { YUI_VERSION, yuiVersionIdentity } from "../version.js";
 import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
 import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePreparer.js";
+import { CONTROLLER_SHUTDOWN_TIMEOUT_MS, LIFECYCLE_REQUEST_TIMEOUT_MS } from "../runtime/runtimeDeadlines.js";
 const STARTUP_TIMEOUT_MS = 5_000;
-// A lifecycle RPC may legitimately occupy the Controller for 30 seconds.
-// Restart must allow that request to drain before deciding shutdown is stuck.
-const SHUTDOWN_TIMEOUT_MS = 45_000;
 const POLL_INTERVAL_MS = 50;
-const LIFECYCLE_REQUEST_TIMEOUT_MS = 30_000;
 const ENVIRONMENT_REFRESH_TIMEOUT_MS = 500;
 const CONFIGURATION_REFRESH_TIMEOUT_MS = 500;
 const CONTROLLER_OPERATIONAL_ENVIRONMENT = [
@@ -168,7 +165,7 @@ function spawnDetachedFileTaskController(home, environment) {
 /** Stops the per-home Controller and waits until its owned discovery is gone. */
 export async function stopFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
-    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     const expectedPid = options.expectedPid === undefined
         ? undefined
@@ -224,7 +221,7 @@ export async function stopFileTaskController(home, options = {}) {
 /** Restarts only the per-home Controller process; managed tmux sessions remain untouched. */
 export async function restartFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
-    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     let current = null;
     let previousPid;
@@ -529,7 +526,10 @@ export class FileTaskWorkflowRuntime {
             && this.workspacePreparer !== undefined) {
             await this.workspacePreparer.prepareTaskWorkspace(taskId);
         }
-        await callFileTaskController(this.home, "scheduler.scan", {}, this.clientOptions);
+        await callFileTaskController(this.home, "scheduler.scan", {}, {
+            ...this.clientOptions,
+            requestTimeoutMs: LIFECYCLE_REQUEST_TIMEOUT_MS
+        });
     }
 }
 const MANAGED_RUNTIME_ENVIRONMENT = new Set(YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES);