@zq-silk/yui 0.8.3 → 0.8.7

package/dist/executor/fileRoleLaunchPlanner.js

@@ -11,15 +11,16 @@ import { compileRoleSessionContext, roleSessionKind } from "../context/roleSessi
 import { materializeSessionBootstrap } from "../context/sessionBootstrapManifest.js";
 import { serializeRunBootstrapEnvelope, serializeRunHostRecoveryEnvelope } from "../context/runContextContract.js";
 import { serializeProviderRetryEnvelope } from "../run/providerRetry.js";
+import { prefixYuiTitleInput } from "../run/runIdentity.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
 import { inspectCodexLaunchConfig } from "./codexConfigConflict.js";
-import { taskRoleSessionTitle } from "../runtime/sessionTitle.js";
+import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
 import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.js";
 import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
 import { activeLiveRoleAgentSession } from "./agentExecutor.js";
 import { effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchSnapshotsCompatible, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
-import { YUI_CONTROL_PLANE_DESCRIPTOR, YUI_TASK_RUNTIME_DESCRIPTOR, assertExactTaskRuntimeState, createExactControlPlaneDescriptor, createExactTaskRuntimeDescriptor, exactControlPlaneCommandPrefix, exactControlPlaneDigest, exactTaskRuntimeDescriptorPath, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
-import { readActiveReleasePointer } from "../release/runtimeRelease.js";
+import { YUI_CONTROL_PLANE_DESCRIPTOR, YUI_TASK_RUNTIME_DESCRIPTOR, assertExactTaskRuntimeState, createExactControlPlaneDescriptor, createExactTaskRuntimeDescriptor, exactControlPlaneDigest, exactTaskRuntimeDescriptorPath, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
+import { detectRunningRelease } from "../release/runtimeRelease.js";
 import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
@@ -52,21 +53,19 @@ export class FileRoleLaunchPlanner {
         this.#createNativeSessionId = options.createNativeSessionId ?? randomUUID;
         this.#cliPath = canonicalPath(options.cliPath
             ?? fileURLToPath(new URL("../cli.js", import.meta.url)));
-        // Freeze the complete control identity before any native process exists.
-        // This value is immutable for the planner/Controller lifetime and is never
-        // rewritten through a shared PATH launcher.
-        // Issue 02: bind the active release build ID so a Session created after a
-        // handover cannot mutate a different control plane.
-        const activeRelease = readActiveReleasePointer(this.home);
+        // Internal callbacks retain one exact command identity for receipt fencing.
+        // Interactive Role commands use ordinary `yui`; their continuity is the
+        // Session Manifest plus protocol/storage and durable runtime identity.
+        const runningRelease = detectRunningRelease(this.#cliPath);
         this.#controlPlane = createExactControlPlaneDescriptor({
             executable: process.execPath,
             cliEntry: this.#cliPath,
             yuiHome: this.home,
-            ...(activeRelease === null
+            ...(runningRelease === null
                 ? {}
                 : {
-                    buildId: activeRelease.buildId,
-                    activeReleaseDigest: activeRelease.packageDigest
+                    buildId: runningRelease.manifest.buildId,
+                    activeReleaseDigest: runningRelease.manifest.packageDigest
                 })
         });
     }
@@ -224,7 +223,7 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "resume" && !compatibleExisting) {
             throw new Error(`Task Role resume effective snapshot drifted: ${task.id}/${role.name}.`);
         }
-        return this.#compile(role, input, { scope: "task", taskId: task.id }, taskRoleSessionTitle(task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
+        return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
             purpose: activeRun?.purpose ?? "execution"
         });
     }
@@ -246,7 +245,7 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "resume" && !compatibleExisting) {
             throw new Error(`Global Role resume effective snapshot drifted: ${role.name}.`);
         }
-        return this.#compile(role, input, { scope: "global" }, undefined, compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
+        return this.#compile(role, input, { scope: "global" }, undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
     }
     #compile(role, input, owner, sessionTitle, knownNativeSessionId, workspaceOverride, effective, sessionPolicy) {
         const launchRole = effectiveRoleForLaunch(role, effective);
@@ -346,7 +345,7 @@ export class FileRoleLaunchPlanner {
         const roleConfig = binding.config.adapterId === "claude"
             && owner.scope === "task"
             && input.runId !== undefined
-            ? managedClaudeControlPlaneConfig(binding.config, owner.taskId, managedRun?.workItemId, input.runId, this.#controlPlane, sessionContext.sessionCliPath)
+            ? managedClaudeControlPlaneConfig(binding.config, owner.taskId, managedRun?.workItemId, input.runId)
             : binding.config;
         const effectiveConfig = withNativeProjectDirectories(roleConfig, nativeAdditionalDirectories(effective.workspace, agentWorkspace));
         const compileInput = {
@@ -382,15 +381,14 @@ export class FileRoleLaunchPlanner {
                 CODEX_INTERNAL_ORIGINATOR_OVERRIDE: "codex_exec"
             }
             : {};
-        const preallocatedManagedNativeSessionId = managedControl
-            && binding.adapterId === "claude"
+        const preallocatedNativeSessionId = binding.adapterId === "claude"
             && resumeNativeSessionId === undefined
             ? requireText(input.launchId === undefined
                 ? this.#createNativeSessionId()
                 : nativeSessionIdForLaunch(this.home, input.launchId, input.agentId, input.adapterId), "Native session id")
             : resumeNativeSessionId;
         const managedCompiled = managedControl
-            ? adapter.compileManagedControl(compileInput, launchMode, preallocatedManagedNativeSessionId)
+            ? adapter.compileManagedControl(compileInput, launchMode, preallocatedNativeSessionId)
             : undefined;
         const compiled = managedCompiled !== undefined
             ? managedCompiled
@@ -439,7 +437,7 @@ export class FileRoleLaunchPlanner {
         else if (launchMode === "new") {
             if (managedControl)
                 args.push("--plugin-dir", ensureManagedClaudeLifecyclePlugin(this.home, this.#cliPath));
-            const nativeSessionId = requireText(preallocatedManagedNativeSessionId, "Native session id");
+            const nativeSessionId = requireText(preallocatedNativeSessionId, "Native session id");
             if (!managedControl)
                 args.push("--session-id", nativeSessionId);
             else if (!args.includes("--session-id"))
@@ -495,7 +493,7 @@ export class FileRoleLaunchPlanner {
             ? this.#providerAuthorityForLaunch(owner.taskId, role.name, input.launchId)
             : undefined;
         const providerNativeSessionId = binding.adapterId === "claude"
-            ? preallocatedManagedNativeSessionId
+            ? preallocatedNativeSessionId
             : resumeNativeSessionId;
         const providerControl = managedControl
             ? {
@@ -506,12 +504,13 @@ export class FileRoleLaunchPlanner {
                 ...(providerNativeSessionId === undefined
                     ? {}
                     : { nativeSessionId: providerNativeSessionId }),
+                ...(sessionTitle === undefined ? {} : { sessionTitle }),
                 authority: providerAuthority,
                 ...(carriesInitialTurn
                     ? {
                         initialTurn: {
                             attemptId: formatAgentRunReceiptId(owner.taskId, input.runId),
-                            boundedText: managedRunLaunchEnvelope(managedRun, input.mode)
+                            boundedText: managedRunLaunchEnvelope(managedRun, input.mode, sessionTitle)
                         }
                     }
                     : {})
@@ -578,6 +577,7 @@ export class FileRoleLaunchPlanner {
             },
             launch: scopedLaunch,
             session,
+            ...(sessionTitle === undefined ? {} : { sessionTitle }),
             ...(carriesInitialTurn && input.runId !== undefined
                 ? { initialTurnRunId: input.runId }
                 : {})
@@ -645,18 +645,20 @@ export class FileRoleLaunchPlanner {
         return selectEnvironment(source, names);
     }
 }
-function managedRunLaunchEnvelope(run, mode) {
-    if (run.providerRetry?.state === "dispatching") {
-        return serializeProviderRetryEnvelope({
+function managedRunLaunchEnvelope(run, mode, title) {
+    const body = run.providerRetry?.state === "dispatching"
+        ? serializeProviderRetryEnvelope({
             taskId: run.taskId,
             runId: run.id,
             roleName: run.roleName,
             retry: run.providerRetry
-        });
-    }
-    return mode === "resume" && run.pushedAt !== undefined
-        ? serializeRunHostRecoveryEnvelope(run.bootstrapEnvelope)
-        : serializeRunBootstrapEnvelope(run.bootstrapEnvelope);
+        })
+        : mode === "resume" && run.pushedAt !== undefined
+            ? serializeRunHostRecoveryEnvelope(run.bootstrapEnvelope)
+            : serializeRunBootstrapEnvelope(run.bootstrapEnvelope);
+    return title === undefined
+        ? body
+        : prefixYuiTitleInput(body, title);
 }
 export function nativeAgentWorkspace(workspace) {
     return workspace.entries.length === 1
@@ -740,18 +742,17 @@ function ensureManagedClaudeLifecyclePlugin(home, cliPath) {
     }, null, 2)}\n`);
     return root;
 }
-function managedClaudeControlPlaneConfig(config, taskId, workItemId, runId, controlPlane, sessionCliPath) {
+function managedClaudeControlPlaneConfig(config, taskId, workItemId, runId) {
     if (config.permission.strategy !== "configured")
         return config;
-    const exact = exactControlPlaneCommandPrefix(controlPlane);
     const managed = [
-        `Bash(${sessionCliPath} task run context ${taskId}/${runId}:*)`,
-        `Bash(${exact} --json task context ${taskId})`,
-        `Bash(${exact} --json task work list ${taskId})`,
+        `Bash(yui task run context ${taskId}/${runId}:*)`,
+        `Bash(yui --json task context ${taskId})`,
+        `Bash(yui --json task work list ${taskId})`,
         ...(workItemId === undefined
             ? []
-            : [`Bash(${exact} --json task work show ${workItemId})`]),
-        `Bash(${exact} task run yield ${runId} --summary-file -:*)`
+            : [`Bash(yui --json task work show ${workItemId})`]),
+        `Bash(yui task run yield ${runId} --summary-file -:*)`
     ];
     const existing = (config.permission.allowedTools ?? [])
         .filter((rule) => !isManagedYuiBashRule(rule));
@@ -768,15 +769,6 @@ function isManagedYuiBashRule(rule) {
     return /^Bash\(yui(?:\s|:\*|\*|\))/u.test(normalized)
         || /^Bash\(.*\s--yui-control\s/u.test(normalized);
 }
-function renderExactControlPlaneInstructions(descriptor) {
-    const command = exactControlPlaneCommandPrefix(descriptor);
-    return [
-        "Exact Yui control-plane command prefix for this managed Task session:",
-        `\`${command}\``,
-        "Replace the portable bare `yui` token in Yui Role Skills and dispatch instructions with this exact prefix.",
-        "Bare `yui`, a PATH launcher, another checkout CLI, another YUI_HOME, or a changed schema/Controller identity is invalid and fails before Task state is read or written."
-    ].join("\n");
-}
 function canonicalPath(path) {
     const absolute = resolve(path);
     try {

package/dist/integration/gitIntegrationService.js

@@ -1,5 +1,6 @@
 import { execFile, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
 import { lstat, mkdir, open, rm, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
@@ -18,6 +19,8 @@ import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
 import { recordIntegrationCheckJob, requireLeaderDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
 import { createManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
+import { readRuntimeIdentity } from "../release/runtimeRelease.js";
+import { findReusableIntegrationCheckEvidence, INTEGRATION_RUNTIME_RELEASE_ENV } from "./integrationCheckEvidenceReuse.js";
 const executeFile = promisify(execFile);
 const INTEGRATION_OPERATIONAL_ENVIRONMENT_NAMES = [
     "PATH",
@@ -300,8 +303,6 @@ export class GitIntegrationService {
      */
     async #startCheckJob(attempt, workspace, path, managedWorkspace, repositoryPath, gate) {
         const runtime = this.#runtimePreparation(attempt, managedWorkspace);
-        this.runtimeIsolation.activate(runtime);
-        const environment = await integrationCheckEnvironment(this.environment, runtime);
         const head = await gitLine(["-C", path, "rev-parse", "HEAD^{commit}"]);
         const steps = gate === undefined
             ? attempt.checkCommands.map((command, index) => ({
@@ -319,6 +320,30 @@ export class GitIntegrationService {
                     timeoutMs: 30 * 60_000
                 }))
             ];
+        const releaseId = integrationRuntimeReleaseIdentity(this.home);
+        if (gate === undefined && releaseId !== null) {
+            const reusable = findReusableIntegrationCheckEvidence({
+                taskId: attempt.taskId,
+                projectId: attempt.projectId,
+                currentAttemptId: attempt.id,
+                candidateCommit: head,
+                checkCommands: attempt.checkCommands,
+                runtimeReleaseId: releaseId,
+                attempts: this.store.listIntegrationAttempts(attempt.taskId),
+                jobs: this.store.listDurableJobs(attempt.taskId),
+                logExists: (homeRelativePath) => existsSync(join(this.home, homeRelativePath)),
+                logPathFor: (job, relativeLogPath) => (join(job.artifactsLocator, "logs", relativeLogPath))
+            });
+            if (reusable !== null) {
+                return this.#finalizeGateSuccess(attempt, workspace, repositoryPath, head, [...reusable.checks]);
+            }
+        }
+        this.runtimeIsolation.activate(runtime);
+        const baseEnvironment = await integrationCheckEnvironment(this.environment, runtime);
+        const environment = Object.freeze({
+            ...baseEnvironment,
+            ...(releaseId === null ? {} : { [INTEGRATION_RUNTIME_RELEASE_ENV]: releaseId })
+        });
         // Persist the gate identity before starting the job so a plan edit
         // during the gate never misattributes the evidence on resume.
         let persisted = attempt;
@@ -906,6 +931,29 @@ function integrationRuntimeLaunchId(home, integrationId) {
         .digest("hex");
     return `${integrationId}-${homeDigest}`;
 }
+/**
+ * Reuse is enabled only for an immutable installed release. Development
+ * checkouts have no content-addressed release identity, so they rerun.
+ */
+function integrationRuntimeReleaseIdentity(home) {
+    try {
+        const receipt = readRuntimeIdentity(home);
+        const release = receipt?.activeRelease;
+        if (receipt === null
+            || receipt.mode !== "primary"
+            || receipt.dualOwner
+            || release === null
+            || release === undefined
+            || receipt.packageDigest !== release.packageDigest
+            || receipt.buildId !== release.buildId) {
+            return null;
+        }
+        return release.releaseId;
+    }
+    catch {
+        return null;
+    }
+}
 function checkFailureReason(completion) {
     if (completion.timedOut)
         return "Command timed out after 1800 seconds.";

package/dist/integration/integrationCheckEvidenceReuse.js

@@ -0,0 +1,53 @@
+/** Internal, Controller-derived release fence carried by Integration jobs. */
+export const INTEGRATION_RUNTIME_RELEASE_ENV = "YUI_INTEGRATION_RUNTIME_RELEASE_ID";
+/**
+ * Find exact reusable evidence without creating cache state. Every identity
+ * field is read from the existing IntegrationAttempt and DurableJob records.
+ */
+export function findReusableIntegrationCheckEvidence(input) {
+    const attempts = [...input.attempts]
+        .filter((attempt) => (attempt.taskId === input.taskId
+        && attempt.id !== input.currentAttemptId
+        && attempt.projectId === input.projectId
+        && sameOrderedText(attempt.checkCommands, input.checkCommands)))
+        .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+    for (const attempt of attempts) {
+        if (attempt.jobId === undefined)
+            continue;
+        const job = input.jobs.find((candidate) => (candidate.id === attempt.jobId
+            && candidate.taskId === input.taskId
+            && candidate.owner.kind === "integration-attempt"
+            && candidate.owner.integrationAttemptId === attempt.id));
+        const resultSteps = job?.result?.steps ?? [];
+        const logPaths = resultSteps.map((step) => (input.logPathFor?.(job, step.logPath) ?? step.logPath));
+        if (job === undefined
+            || job.projectId !== input.projectId
+            || job.head !== input.candidateCommit
+            || job.status !== "succeeded"
+            || job.result?.outcome !== "succeeded"
+            || job.env[INTEGRATION_RUNTIME_RELEASE_ENV] !== input.runtimeReleaseId
+            || job.steps.length !== input.checkCommands.length
+            || job.steps.some((step, index) => (step.name !== `check-${index + 1}`
+                || step.command !== input.checkCommands[index]))
+            || resultSteps.length !== input.checkCommands.length
+            || resultSteps.some((step, index) => (step.name !== `check-${index + 1}`
+                || step.exitCode !== 0
+                || step.signal !== null
+                || step.timedOut
+                || step.head !== input.candidateCommit
+                || (input.logExists !== undefined && !input.logExists(logPaths[index]))))) {
+            continue;
+        }
+        const checks = resultSteps.map((step, index) => ({
+            name: input.checkCommands[index],
+            outcome: "passed",
+            details: `Reused successful check evidence from ${attempt.id}/${job.id}.`,
+            logPath: logPaths[index]
+        }));
+        return Object.freeze({ sourceAttempt: attempt, sourceJob: job, checks });
+    }
+    return null;
+}
+function sameOrderedText(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}

package/dist/observability/executionAudit.js

@@ -18,6 +18,7 @@ import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.j
 import { classifyAgentRunFailure, classifyIntegrationAttempt, classifyReviewRound, classifyWakeReasons, countFaultClasses } from "./faultClassification.js";
 import { RUNTIME_LAUNCH_KINDS, RUNTIME_LAUNCH_PHASES } from "../runtime/launchDiagnostics.js";
 import { UNSUPPORTED } from "./runtimeIdentity.js";
+import { projectTaskOrchestration } from "./orchestrationMetrics.js";
 export function createProductionExecutionAuditPorts() {
     return {
         openStore: (home) => openCompatibleFileTaskStore(home),
@@ -206,6 +207,7 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
             events: section,
             providerRetries: section,
             workItems: section,
+            orchestration: section,
             storage: section,
             runtimeProtocol: section,
             topLongRunning: section
@@ -443,7 +445,7 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
                         else if (round.deltaRecheck.disposition === "requires-full-review")
                             deltaEscalated += 1;
                     }
-                    const classification = classifyReviewRound(round);
+                    const classification = classifyReviewRound(round, store);
                     if (classification.faultClass === "review-infra")
                         infraFailed += 1;
                     else if (classification.faultClass === "review-semantic-negative") {
@@ -674,6 +676,37 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
             return failed(error);
         }
     })();
+    const orchestration = (() => {
+        try {
+            const metrics = taskIds.flatMap((taskId) => {
+                const task = store.getTask(taskId);
+                if (task === null)
+                    return [];
+                return [projectTaskOrchestration({
+                        task,
+                        runs: withinWindow(store.listAgentRuns(taskId), options),
+                        roleSessionSets: sessionSetsWithinWindow(store.listRoleSessionSets(taskId), options),
+                        workItems: withinWindow(store.listWorkItems(taskId), options),
+                        changeSets: withinWindow(store.listChangeSets(taskId), options),
+                        reviewRounds: withinWindow(store.listReviewRounds(taskId), options),
+                        reviewFindings: withinWindow(store.listReviewFindings(taskId), options),
+                        integrations: withinWindow(store.listIntegrationAttempts(taskId), options),
+                        durableJobs: withinWindow(store.listDurableJobs(taskId), options),
+                        publications: withinWindow(store.listPublicationReferences(taskId), options),
+                        decisions: withinWindow(store.listDecisions(taskId), options),
+                        events: withinWindow(store.listEvents(taskId), options),
+                        managedWorkspaces: withinWindow(store.listManagedWorkspaces(taskId), options)
+                    })];
+            });
+            return ok({
+                tasks: metrics,
+                advisoryCount: metrics.reduce((total, task) => total + task.advisories.length, 0)
+            });
+        }
+        catch (error) {
+            return failed(error);
+        }
+    })();
     const storage = (() => {
         try {
             let stateJsonBytes = UNSUPPORTED;
@@ -834,8 +867,21 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
         events,
         providerRetries,
         workItems,
+        orchestration,
         storage,
         runtimeProtocol,
         topLongRunning
     };
 }
+function withinWindow(records, options) {
+    return records.filter((record) => inWindow(record.createdAt, options));
+}
+function sessionSetsWithinWindow(sets, options) {
+    if (options.since === undefined && options.until === undefined)
+        return sets;
+    return sets.map((set) => ({
+        ...set,
+        sessions: Object.fromEntries(Object.entries(set.sessions).filter(([, session]) => (inWindow(session.createdAt, options)))),
+        history: (set.history ?? []).filter((session) => inWindow(session.createdAt, options))
+    }));
+}

package/dist/observability/faultClassification.js

@@ -1,3 +1,4 @@
+import { classifyReviewRoundOutcome } from "../review/reviewOutcomeClassifier.js";
 export const FAULT_CLASSES = [
     "provider-transient",
     "policy-denied",
@@ -73,15 +74,16 @@ export function classifyAgentRunFailure(run, structured) {
  * Review execution failure (the Round itself failed to execute/deliver) is
  * `review-infra`; a completed Round with failed checks is a semantic negative.
  */
-export function classifyReviewRound(round) {
-    if (round.status === "failed") {
+export function classifyReviewRound(round, evidence) {
+    const outcome = classifyReviewRoundOutcome(round, evidence);
+    if (outcome?.kind === "non-semantic") {
         return {
             faultClass: "review-infra",
             basis: "structured",
-            evidence: "round status=failed"
+            evidence: outcome.reason
         };
     }
-    if (round.status === "completed" && (round.checks ?? []).some((c) => c.outcome === "failed")) {
+    if (outcome?.kind === "semantic" && (round.checks ?? []).some((c) => c.outcome === "failed")) {
         const failed = (round.checks ?? [])
             .filter((c) => c.outcome === "failed")
             .map((c) => c.name)

package/dist/observability/orchestrationMetrics.js

@@ -0,0 +1,196 @@
+import { classifyReviewRoundOutcome } from "../review/reviewOutcomeClassifier.js";
+import { projectFirstProgressStopLoss } from "../runtime/firstProgressStopLoss.js";
+import { taskDeliveryPath } from "../task/task.js";
+/** One Task's orchestration cost and advisory projection, with no writes. */
+export function projectTaskOrchestration(facts) {
+    const evidence = {
+        listAgentRuns: () => facts.runs,
+        listReviewFindings: () => facts.reviewFindings,
+        listEvents: () => facts.events
+    };
+    const fullRounds = facts.reviewRounds.filter((round) => round.deltaRecheck === undefined);
+    const deltaRounds = facts.reviewRounds.filter((round) => round.deltaRecheck !== undefined);
+    const classifications = new Map(facts.reviewRounds.map((round) => [round.id, classifyReviewRoundOutcome(round, evidence)]));
+    const semanticRounds = facts.reviewRounds.filter((round) => (classifications.get(round.id)?.kind === "semantic"));
+    const p1P2Findings = facts.reviewFindings.filter((finding) => ((finding.severity === "p1" || finding.severity === "p2")
+        && semanticRounds.some((round) => round.id === finding.firstReviewRoundId))).length;
+    const candidateTimes = [
+        ...facts.changeSets.map(({ createdAt }) => createdAt),
+        ...facts.workItems.flatMap((item) => item.candidates
+            .filter((candidate) => candidate.gitSnapshot !== undefined
+            || candidate.taskMainSnapshot?.projects.some((project) => (project.baseCommit !== project.headCommit)))
+            .map(({ createdAt }) => createdAt))
+    ].sort();
+    const firstCommitAt = candidateTimes[0];
+    const integrationIdentities = new Map();
+    for (const job of facts.durableJobs) {
+        if (job.owner.kind !== "integration-attempt")
+            continue;
+        const integrationAttemptId = job.owner.integrationAttemptId;
+        const attempt = facts.integrations.find(({ id }) => id === integrationAttemptId);
+        if (attempt === undefined || attempt.jobId !== job.id)
+            continue;
+        const identity = `${attempt.projectId}\0${job.head}\0${JSON.stringify(attempt.checkCommands)}`;
+        integrationIdentities.set(identity, (integrationIdentities.get(identity) ?? 0) + 1);
+    }
+    const repeatedIdentities = [...integrationIdentities.values()]
+        .reduce((total, count) => total + Math.max(0, count - 1), 0);
+    const leaderSessions = facts.roleSessionSets.find(({ owner }) => owner.roleName === "leader") ?? null;
+    const firstProgress = projectFirstProgressStopLoss({
+        sessions: leaderSessions,
+        events: facts.events,
+        workItems: facts.workItems,
+        reviewRounds: facts.reviewRounds,
+        integrations: facts.integrations
+    });
+    const advisories = projectAdvisories(facts, classifications, fullRounds, repeatedIdentities, firstProgress.exhausted);
+    const publicationAt = facts.task.completedAt === undefined
+        ? undefined
+        : facts.publications
+            .map((reference) => reference.mergedAt ?? reference.createdAt)
+            .filter((timestamp) => timestamp <= facts.task.completedAt)
+            .sort()
+            .at(-1);
+    return Object.freeze({
+        taskId: facts.task.id,
+        deliveryPath: taskDeliveryPath(facts.task),
+        timeToFirstProjectCommitMs: firstCommitAt === undefined
+            ? null
+            : Math.max(0, Date.parse(firstCommitAt) - Date.parse(facts.task.createdAt)),
+        runs: {
+            total: facts.runs.length,
+            byStatus: counts(facts.runs.map(({ status }) => status)),
+            byRole: counts(facts.runs.map(({ roleName }) => roleName))
+        },
+        workItems: facts.workItems.length,
+        reviews: {
+            full: fullRounds.length,
+            delta: deltaRounds.length,
+            nonSemantic: [...classifications.values()].filter((value) => value?.kind === "non-semantic").length,
+            ambiguous: [...classifications.values()].filter((value) => value?.kind === "ambiguous").length,
+            p1P2Findings,
+            p1P2FindingsPerSemanticReview: semanticRounds.length === 0
+                ? 0
+                : p1P2Findings / semanticRounds.length
+        },
+        integrations: {
+            attempts: facts.integrations.length,
+            failed: facts.integrations.filter(({ status }) => status === "failed").length,
+            repeatedIdentities,
+            evidenceReuses: facts.integrations.filter((attempt) => ((attempt.checks ?? []).some(({ details }) => details?.startsWith("Reused successful check evidence from ")))).length
+        },
+        providerGenerationsBeforeFirstProgress: firstProgress.generationsBeforeFirstProgress,
+        publicationToCompletionMs: publicationAt === undefined || facts.task.completedAt === undefined
+            ? null
+            : Math.max(0, Date.parse(facts.task.completedAt) - Date.parse(publicationAt)),
+        terminalWorkspaceCount: terminalWorkspaceCount(facts),
+        advisories
+    });
+}
+function projectAdvisories(facts, classifications, fullRounds, repeatedIdentities, stopLoss) {
+    const result = [];
+    if (taskDeliveryPath(facts.task) === "direct"
+        && (facts.workItems.length > 0 || facts.reviewRounds.length > 0 || facts.integrations.length > 0)) {
+        result.push({
+            code: "direct-protocol-overhead",
+            reason: "Direct delivery accumulated WorkItem, Review, or Integration protocol overhead; keep the fix Leader-direct or explicitly promote it to integrated delivery.",
+            refs: [
+                ...facts.workItems.map(({ id }) => `work-item:${id}`),
+                ...facts.reviewRounds.map(({ id }) => `review-round:${id}`),
+                ...facts.integrations.map(({ id }) => `integration-attempt:${id}`)
+            ]
+        });
+    }
+    const initial = facts.workItems.filter(({ dependsOn }) => dependsOn.length === 0);
+    if (taskDeliveryPath(facts.task) === "integrated" && initial.length > 1) {
+        result.push({
+            code: "guarded-workitem-fanout",
+            reason: `${initial.length} initial WorkItems were created for an integrated Task; start with one bounded fix unless independence is explicit.`,
+            refs: initial.map(({ id }) => `work-item:${id}`)
+        });
+    }
+    const repairItems = facts.workItems.filter((item) => (item.acceptance.some((line) => line.startsWith("review-finding:"))));
+    const byRound = new Map();
+    for (const item of repairItems) {
+        const roundIds = new Set(item.acceptance.flatMap((line) => {
+            const findingId = line.startsWith("review-finding:") ? line.slice("review-finding:".length) : "";
+            const finding = facts.reviewFindings.find(({ id }) => id === findingId);
+            return finding === undefined ? [] : [finding.firstReviewRoundId];
+        }));
+        for (const roundId of roundIds)
+            byRound.set(roundId, [...(byRound.get(roundId) ?? []), item]);
+    }
+    for (const [roundId, items] of byRound) {
+        if (items.length < 2 || hasRepairFanoutDecision(facts.decisions, roundId, items))
+            continue;
+        result.push({
+            code: "review-repair-fanout",
+            reason: `Findings from Review ${roundId} were split across ${items.length} WorkItems without a durable Decision explaining independent ownership.`,
+            refs: [`review-round:${roundId}`, ...items.map(({ id }) => `work-item:${id}`)]
+        });
+    }
+    if (repeatedIdentities > 0) {
+        result.push({
+            code: "repeated-integration-check",
+            reason: `${repeatedIdentities} Integration DurableJob(s) reran the same candidate commit and ordered checks.`,
+            refs: facts.durableJobs
+                .filter(({ owner }) => owner.kind === "integration-attempt")
+                .map(({ id }) => `durable-job:${id}`)
+        });
+    }
+    const semanticFull = fullRounds.filter((round) => classifications.get(round.id)?.kind === "semantic")
+        .sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+    const recent = semanticFull.slice(-3);
+    const recentIds = new Set(recent.map(({ id }) => id));
+    const newFinding = facts.reviewFindings.some(({ firstReviewRoundId }) => recentIds.has(firstReviewRoundId));
+    if (semanticFull.length > 2 && !newFinding) {
+        result.push({
+            code: "review-budget-exhausted",
+            reason: `${semanticFull.length} full semantic Reviews ran and the latest three produced no new finding; stop repeating full rounds without a changed head or new risk.`,
+            refs: recent.map(({ id }) => `review-round:${id}`)
+        });
+    }
+    if (stopLoss) {
+        result.push({
+            code: "provider-first-progress-stop-loss",
+            reason: "Two fresh Leader generations produced no first durable progress; hand off to the unique Operator before another generation.",
+            refs: [facts.task.id]
+        });
+    }
+    return result;
+}
+function hasRepairFanoutDecision(decisions, roundId, items) {
+    return decisions.some((decision) => {
+        const text = `${decision.title}\n${decision.rationale}`;
+        return text.includes(roundId) && items.every(({ id }) => text.includes(id));
+    });
+}
+function terminalWorkspaceCount(facts) {
+    return facts.managedWorkspaces.filter(({ owner }) => {
+        if (owner.type === "task")
+            return false;
+        if (owner.type === "work-item") {
+            return terminalStatus(facts.workItems.find(({ id }) => id === owner.workItemId)?.status);
+        }
+        if (owner.type === "review-round") {
+            return terminalStatus(facts.reviewRounds.find(({ id }) => id === owner.reviewRoundId)?.status);
+        }
+        if (owner.type === "integration-attempt") {
+            return terminalStatus(facts.integrations.find(({ id }) => id === owner.integrationAttemptId)?.status);
+        }
+        if (owner.workItemId !== undefined) {
+            return terminalStatus(facts.workItems.find(({ id }) => id === owner.workItemId)?.status);
+        }
+        return owner.reviewRoundId !== undefined
+            && terminalStatus(facts.reviewRounds.find(({ id }) => id === owner.reviewRoundId)?.status);
+    }).length;
+}
+function terminalStatus(status) {
+    return status !== undefined && !["pending", "running", "awaiting_acceptance", "blocked", "validating"].includes(status);
+}
+function counts(values) {
+    const result = {};
+    for (const value of values)
+        result[value] = (result[value] ?? 0) + 1;
+    return Object.freeze(result);
+}