@zq-silk/yui 0.8.3 → 0.8.7

package/dist/review/taskFinalReviewContractRebind.js

@@ -0,0 +1,367 @@
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { requireIdentity, requireTimestamp } from "../domain/validation.js";
+import { readActiveReleasePointer, readHandoverFence, readHandoverReceipt, releaseDirectoryName, releasesDirectory, verifyReleaseIntegrity } from "../release/runtimeRelease.js";
+import { exactControlPlaneDigest, parseExactControlPlaneDescriptor } from "../runtime/exactControlPlane.js";
+import { createTaskFinalReviewContract, sameTaskFinalReviewContract, validateTaskFinalReviewContract } from "./taskFinalReviewContract.js";
+import { governingWorkItemCandidate } from "../workItem/workItem.js";
+import { TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT } from "./taskFinalReviewContractEvent.js";
+export { TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT } from "./taskFinalReviewContractEvent.js";
+/**
+ * Resolves the effective Task-final Review contract from its immutable Task
+ * records. Mutation and read-model callers share this adapter so a legal
+ * release rebind cannot be interpreted differently by the two paths.
+ */
+export function resolveRecordedTaskFinalReviewContract(taskId, workItems, reviewRounds, events) {
+    const candidateObservations = workItems.flatMap((item) => {
+        const candidate = governingWorkItemCandidate(item);
+        return candidate?.taskFinalReviewContract === undefined
+            ? []
+            : [{
+                    contract: candidate.taskFinalReviewContract,
+                    createdAt: candidate.createdAt,
+                    source: `Candidate ${item.id}/${candidate.id}`
+                }];
+    });
+    const historicalCandidateObservations = workItems.flatMap((item) => (item.candidates
+        .filter((candidate) => candidate.taskFinalReviewContract !== undefined)
+        .map((candidate) => ({
+        contract: candidate.taskFinalReviewContract,
+        createdAt: candidate.createdAt,
+        source: `Historical Candidate ${item.id}/${candidate.id}`
+    }))));
+    const reviewObservations = reviewRounds.flatMap((round) => ((round.scope ?? "work-item") !== "task"
+        || round.taskFinalReviewContract === undefined
+        ? []
+        : [{
+                contract: round.taskFinalReviewContract,
+                createdAt: round.createdAt,
+                source: `ReviewRound ${round.id}`
+            }]));
+    return resolveTaskFinalReviewContract(taskId, [...candidateObservations, ...reviewObservations], events, historicalCandidateObservations);
+}
+export function createTaskFinalReviewContractRebind(input) {
+    const taskId = requireIdentity(input.taskId, "Task final-review rebind Task id");
+    const reviewerRoleName = requireIdentity(input.reviewerRoleName, "Task final-review rebind Reviewer Role");
+    const fromContract = validateTaskFinalReviewContract(input.fromContract);
+    if (fromContract.taskId !== taskId) {
+        throw new Error("Task final-review rebind contract belongs to another Task.");
+    }
+    if (fromContract.reviewerRoleName !== reviewerRoleName) {
+        throw new Error("Task final-review rebind changes the Reviewer identity.");
+    }
+    const toContract = createTaskFinalReviewContract({
+        taskId,
+        reviewerRoleName,
+        controlPlaneDigest: requireDigest(input.toControlPlaneDigest, "Task final-review rebind target control-plane digest")
+    });
+    if (fromContract.controlPlaneDigest === toContract.controlPlaneDigest) {
+        throw new Error("Task final-review rebind must change the control-plane digest.");
+    }
+    const fromRelease = validateReleaseIdentity(input.fromRelease, "source");
+    const toRelease = validateReleaseIdentity(input.toRelease, "target");
+    if (fromRelease.releaseId === toRelease.releaseId) {
+        throw new Error("Task final-review rebind must cross an immutable release handover.");
+    }
+    return Object.freeze({
+        schemaVersion: 1,
+        taskId,
+        reviewerRoleName,
+        fromContract,
+        toContract,
+        fromRelease,
+        toRelease,
+        handoverId: requireIdentity(input.handoverId, "Task final-review rebind handover id"),
+        authorizedBy: requireText(input.authorizedBy, "Task final-review rebind authorizer")
+    });
+}
+export function taskFinalReviewContractRebindPayload(rebind) {
+    const validated = createTaskFinalReviewContractRebind({
+        ...rebind,
+        toControlPlaneDigest: rebind.toContract.controlPlaneDigest
+    });
+    return {
+        schemaVersion: "1",
+        taskId: validated.taskId,
+        reviewerRoleName: validated.reviewerRoleName,
+        fromContractDigest: validated.fromContract.digest,
+        toContractDigest: validated.toContract.digest,
+        fromControlPlaneDigest: validated.fromContract.controlPlaneDigest,
+        toControlPlaneDigest: validated.toContract.controlPlaneDigest,
+        fromReleaseId: validated.fromRelease.releaseId,
+        fromReleaseVersion: validated.fromRelease.version,
+        fromReleaseBuildId: validated.fromRelease.buildId,
+        fromReleasePackageDigest: validated.fromRelease.packageDigest,
+        ...(validated.fromRelease.sourceCommit === undefined
+            ? {}
+            : { fromReleaseSourceCommit: validated.fromRelease.sourceCommit }),
+        toReleaseId: validated.toRelease.releaseId,
+        toReleaseVersion: validated.toRelease.version,
+        toReleaseBuildId: validated.toRelease.buildId,
+        toReleasePackageDigest: validated.toRelease.packageDigest,
+        ...(validated.toRelease.sourceCommit === undefined
+            ? {}
+            : { toReleaseSourceCommit: validated.toRelease.sourceCommit }),
+        handoverId: validated.handoverId,
+        authorizedBy: validated.authorizedBy
+    };
+}
+export function taskFinalReviewContractRebindFromEvent(event) {
+    if (event.type !== TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT) {
+        throw new Error(`Task event is not a final-review contract rebind: ${event.id}.`);
+    }
+    const payload = event.payload;
+    if (payload.schemaVersion !== "1") {
+        throw new Error(`Task final-review rebind event schema is invalid: ${event.id}.`);
+    }
+    if (payload.taskId !== event.taskId) {
+        throw new Error(`Task final-review rebind event belongs to another Task: ${event.id}.`);
+    }
+    const fromContract = createTaskFinalReviewContract({
+        taskId: payload.taskId,
+        reviewerRoleName: payload.reviewerRoleName,
+        controlPlaneDigest: payload.fromControlPlaneDigest
+    });
+    if (fromContract.digest !== payload.fromContractDigest) {
+        throw new Error(`Task final-review rebind source digest is invalid: ${event.id}.`);
+    }
+    const rebind = createTaskFinalReviewContractRebind({
+        taskId: payload.taskId,
+        reviewerRoleName: payload.reviewerRoleName,
+        fromContract,
+        toControlPlaneDigest: payload.toControlPlaneDigest,
+        fromRelease: releaseIdentityFromPayload(payload, "from"),
+        toRelease: releaseIdentityFromPayload(payload, "to"),
+        handoverId: payload.handoverId,
+        authorizedBy: payload.authorizedBy
+    });
+    if (rebind.toContract.digest !== payload.toContractDigest) {
+        throw new Error(`Task final-review rebind target digest is invalid: ${event.id}.`);
+    }
+    return rebind;
+}
+/**
+ * Historical Candidate and Review records remain immutable. Before the first
+ * explicit rebind event, older Yui releases may have emitted successive
+ * control-plane contracts without a rebind event. Preserve that legacy prefix
+ * as a forward-only sequence, then require one strict append-only rebind chain.
+ * Any Reviewer change, reversion, fork, or post-rebind drift fails closed.
+ */
+export function resolveTaskFinalReviewContract(taskId, observations, events, historicalObservations = []) {
+    const normalizedTaskId = requireIdentity(taskId, "Task final-review contract Task id");
+    const orderedObservations = [...observations]
+        .map((observation) => ({
+        contract: validateTaskFinalReviewContract(observation.contract),
+        createdAt: requireTimestamp(observation.createdAt, "Task final-review observation createdAt"),
+        source: requireText(observation.source, "Task final-review observation source")
+    }))
+        .sort(compareCreatedAt);
+    const orderedHistoricalObservations = [...historicalObservations]
+        .map((observation) => ({
+        contract: validateTaskFinalReviewContract(observation.contract),
+        createdAt: requireTimestamp(observation.createdAt, "Task final-review historical observation createdAt"),
+        source: requireText(observation.source, "Task final-review historical observation source")
+    }))
+        .sort(compareCreatedAt);
+    const orderedEvents = events
+        .filter(({ type }) => type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT)
+        .map((event) => ({
+        event,
+        createdAt: requireTimestamp(event.createdAt, "Task final-review rebind event createdAt"),
+        rebind: taskFinalReviewContractRebindFromEvent(event)
+    }))
+        .sort((left, right) => compareCreatedAt(left, right)
+        || left.event.id.localeCompare(right.event.id, undefined, { numeric: true }));
+    if (orderedObservations.length === 0 && orderedEvents.length === 0)
+        return undefined;
+    for (const observation of [...orderedObservations, ...orderedHistoricalObservations]) {
+        if (observation.contract.taskId !== normalizedTaskId) {
+            throw new Error(`${observation.source} carries a final-review contract for another Task.`);
+        }
+    }
+    const firstRebindAt = orderedEvents[0]?.createdAt;
+    const primaryLegacyObservations = firstRebindAt === undefined
+        ? orderedObservations
+        : orderedObservations.filter(({ createdAt }) => createdAt < firstRebindAt);
+    const historicalRebindSource = orderedEvents[0] === undefined
+        ? undefined
+        : orderedHistoricalObservations.find((observation) => (observation.createdAt < orderedEvents[0].createdAt
+            && sameTaskFinalReviewContract(observation.contract, orderedEvents[0].rebind.fromContract)));
+    const legacyObservations = primaryLegacyObservations.length > 0
+        ? primaryLegacyObservations
+        : historicalRebindSource === undefined ? [] : [historicalRebindSource];
+    if (legacyObservations.length === 0) {
+        throw new Error(`Task ${normalizedTaskId} has a final-review rebind without an established source contract.`);
+    }
+    const initial = legacyObservations[0].contract;
+    const reviewerRoleName = initial.reviewerRoleName;
+    let effective = initial;
+    const legacyContractDigests = new Set([initial.digest]);
+    for (const observation of legacyObservations) {
+        if (observation.contract.reviewerRoleName !== reviewerRoleName) {
+            throw new Error(`${observation.source} changes the Task final-review Reviewer identity.`);
+        }
+        if (sameTaskFinalReviewContract(observation.contract, effective))
+            continue;
+        if (legacyContractDigests.has(observation.contract.digest)) {
+            throw new Error(`${observation.source} reverts a legacy Task final-review contract.`);
+        }
+        legacyContractDigests.add(observation.contract.digest);
+        effective = observation.contract;
+    }
+    for (const entry of orderedEvents) {
+        const { rebind } = entry;
+        if (!sameTaskFinalReviewContract(effective, rebind.fromContract)) {
+            throw new Error(`Task final-review rebind chain forks at ${entry.event.id}.`);
+        }
+        if (rebind.reviewerRoleName !== initial.reviewerRoleName) {
+            throw new Error(`Task final-review rebind changes Reviewer identity at ${entry.event.id}.`);
+        }
+        effective = rebind.toContract;
+    }
+    for (const observation of orderedObservations) {
+        if (firstRebindAt === undefined || observation.createdAt < firstRebindAt)
+            continue;
+        let expected = legacyObservations.at(-1).contract;
+        for (const entry of orderedEvents) {
+            if (entry.createdAt > observation.createdAt)
+                break;
+            expected = entry.rebind.toContract;
+        }
+        if (!sameTaskFinalReviewContract(observation.contract, expected)) {
+            throw new Error(`${observation.source} does not match the effective Task final-review contract at creation.`);
+        }
+    }
+    return Object.freeze({
+        initial,
+        effective,
+        rebinds: Object.freeze(orderedEvents.map(({ rebind }) => rebind))
+    });
+}
+/**
+ * Builds the immutable release proof while the caller holds the release
+ * handover lock. The current exact control descriptor is supplied only by the
+ * CLI preflight; caller-provided target identities are checked against it.
+ */
+export function prepareTaskFinalReviewContractRebindProof(input) {
+    const home = resolve(input.home);
+    const taskId = requireIdentity(input.taskId, "Task final-review rebind Task id");
+    const fromControlPlaneDigest = requireDigest(input.fromControlPlaneDigest, "Task final-review rebind source control-plane digest");
+    const toControlPlaneDigest = requireDigest(input.toControlPlaneDigest, "Task final-review rebind target control-plane digest");
+    if (fromControlPlaneDigest === toControlPlaneDigest) {
+        throw new Error("Task final-review rebind source and target control planes are identical.");
+    }
+    if (exactControlPlaneDigest(input.currentControlPlane) !== toControlPlaneDigest) {
+        throw new Error("Task final-review rebind target is not the current exact control plane.");
+    }
+    if (resolve(input.currentControlPlane.yuiHome) !== home) {
+        throw new Error("Task final-review rebind target control plane belongs to another Home.");
+    }
+    const fromReleaseId = requireText(input.fromReleaseId, "Source release id");
+    const toReleaseId = requireText(input.toReleaseId, "Target release id");
+    if (fromReleaseId === toReleaseId) {
+        throw new Error("Task final-review rebind source and target releases are identical.");
+    }
+    if (readHandoverFence(home) !== null) {
+        throw new Error("Task final-review rebind is blocked by an unfinished release handover.");
+    }
+    const active = readActiveReleasePointer(home);
+    if (active === null
+        || active.releaseId !== toReleaseId
+        || active.buildId !== input.currentControlPlane.buildId
+        || active.packageDigest !== input.currentControlPlane.activeReleaseDigest) {
+        throw new Error("The active release does not match the requested target release and exact control plane.");
+    }
+    const sourcePath = join(home, "runtime", "control-plane", `${fromControlPlaneDigest}.json`);
+    const sourceControl = parseExactControlPlaneDescriptor(readFileSync(sourcePath, "utf8"));
+    if (exactControlPlaneDigest(sourceControl) !== fromControlPlaneDigest) {
+        throw new Error("Task final-review rebind source control-plane descriptor digest is invalid.");
+    }
+    if (resolve(sourceControl.yuiHome) !== home) {
+        throw new Error("Task final-review rebind source control plane belongs to another Home.");
+    }
+    const fromRelease = installedReleaseIdentity(home, fromReleaseId, sourceControl, "source");
+    const toRelease = installedReleaseIdentity(home, toReleaseId, input.currentControlPlane, "target");
+    const handover = readHandoverReceipt(home);
+    if (handover === null
+        || handover.outcome !== "completed"
+        || handover.activatedReleaseId !== toReleaseId
+        || typeof handover.handoverId !== "string"
+        || handover.handoverId.length === 0) {
+        throw new Error("Task final-review rebind requires the completed release handover that activated the target.");
+    }
+    return Object.freeze({
+        schemaVersion: 1,
+        taskId,
+        fromControlPlaneDigest,
+        toControlPlaneDigest,
+        fromRelease,
+        toRelease,
+        handoverId: handover.handoverId
+    });
+}
+function installedReleaseIdentity(home, releaseId, control, label) {
+    if (control.buildId === undefined || control.activeReleaseDigest === undefined) {
+        throw new Error(`Task final-review rebind ${label} control plane is not an immutable release.`);
+    }
+    let manifest;
+    try {
+        manifest = verifyReleaseIntegrity(join(releasesDirectory(home), releaseId));
+    }
+    catch (error) {
+        throw new Error(`Task final-review rebind ${label} release is unknown or invalid: ${releaseId}.`, { cause: error });
+    }
+    if (releaseDirectoryName(manifest) !== releaseId
+        || manifest.buildId !== control.buildId
+        || manifest.packageDigest !== control.activeReleaseDigest) {
+        throw new Error(`Task final-review rebind ${label} release does not match its control plane.`);
+    }
+    return validateReleaseIdentity({
+        releaseId,
+        version: manifest.version,
+        buildId: manifest.buildId,
+        packageDigest: manifest.packageDigest,
+        ...(manifest.sourceCommit === undefined ? {} : { sourceCommit: manifest.sourceCommit })
+    }, label);
+}
+function releaseIdentityFromPayload(payload, prefix) {
+    const title = prefix === "from" ? "From" : "To";
+    return validateReleaseIdentity({
+        releaseId: payload[`${prefix}ReleaseId`],
+        version: payload[`${prefix}ReleaseVersion`],
+        buildId: payload[`${prefix}ReleaseBuildId`],
+        packageDigest: payload[`${prefix}ReleasePackageDigest`],
+        ...(payload[`${prefix}ReleaseSourceCommit`] === undefined
+            ? {}
+            : { sourceCommit: payload[`${prefix}ReleaseSourceCommit`] })
+    }, title);
+}
+function validateReleaseIdentity(value, label) {
+    return Object.freeze({
+        releaseId: requireText(value.releaseId, `Task final-review rebind ${label} release id`),
+        version: requireText(value.version, `Task final-review rebind ${label} release version`),
+        buildId: requireText(value.buildId, `Task final-review rebind ${label} release build id`),
+        packageDigest: requireDigest(value.packageDigest, `Task final-review rebind ${label} release package digest`),
+        ...(value.sourceCommit === undefined
+            ? {}
+            : { sourceCommit: requireText(value.sourceCommit, `Task final-review rebind ${label} source commit`) })
+    });
+}
+function compareCreatedAt(left, right) {
+    return left.createdAt.localeCompare(right.createdAt);
+}
+function requireDigest(value, label) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value;
+}
+function requireText(value, label) {
+    if (typeof value !== "string" || value.includes("\0")) {
+        throw new Error(`${label} is invalid.`);
+    }
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}

package/dist/run/runIdentity.js

@@ -1,82 +1,22 @@
 import { MAX_SESSION_TITLE_LENGTH } from "../runtime/sessionTitle.js";
-const TITLED_RUN_SEPARATOR = " · Run ";
-/** Adds the causal token consumed by the native Turn-complete Hook. */
-export function markYuiRunInput(input, runId, title) {
+/**
+ * Prefixes managed launch input with its session title. The bootstrap body
+ * exposes the exact current Run identity to the Agent, while structured
+ * delivery metadata and control hooks retain the delivery fence.
+ */
+export function prefixYuiTitleInput(input, title) {
     const text = input.replace(/\r/g, "").trim();
-    return managedRunInput(text, runId, title);
-}
-/** Replaces the causal token on an input already owned by a persisted Yui Run. */
-export function retagYuiRunInput(input, runId, title) {
-    const lines = input.replace(/\r/g, "").split("\n");
-    if (lines.length < 3
-        || lines[1] !== ""
-        || runIdFromHeader(lines[0]) === undefined) {
-        throw new Error("Managed Run input header is required.");
-    }
-    return managedRunInput(lines.slice(2).join("\n").trim(), runId, title);
-}
-function managedRunInput(text, runId, title) {
-    const id = requireRunId(runId);
     if (text.length === 0)
-        throw new Error("Run input is required.");
-    return `${requireRunTitle(title)}${TITLED_RUN_SEPARATOR}${id}\n\n${text}`;
-}
-/** Reads the last managed Yui header from Codex's structured input-messages. */
-export function yuiRunIdFromInputMessages(value) {
-    if (!Array.isArray(value))
-        return undefined;
-    let found;
-    for (const entry of value) {
-        if (typeof entry !== "string")
-            continue;
-        const lines = entry.replace(/\r/g, "").split("\n");
-        if (lines.length < 3 || lines[1] !== "")
-            continue;
-        const runId = runIdFromHeader(lines[0]);
-        if (runId !== undefined)
-            found = runId;
-    }
-    return found;
-}
-/** Removes only a valid managed Run header, preserving user-authored lookalikes. */
-export function yuiRunBodyFromInputMessage(value) {
-    const lines = value.replace(/\r/g, "").trim().split("\n");
-    return lines.length >= 3
-        && lines[1] === ""
-        && runIdFromHeader(lines[0]) !== undefined
-        ? lines.slice(2).join("\n")
-        : lines.join("\n");
-}
-function runIdFromHeader(line) {
-    const separator = line.lastIndexOf(TITLED_RUN_SEPARATOR);
-    if (separator > 0) {
-        try {
-            requireRunTitle(line.slice(0, separator));
-            return requireRunId(line.slice(separator + TITLED_RUN_SEPARATOR.length));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    return undefined;
+        throw new Error("Managed input body is required.");
+    return `${requireRunTitle(title)}\n\n${text}`;
 }
 function requireRunTitle(value) {
     const title = value.trim();
     if (title.length === 0
         || title.length > MAX_SESSION_TITLE_LENGTH
-        || !title.startsWith("Yui · ")
-        || /[\r\n\0]/u.test(title)) {
+        || /[\r\n\0]/u.test(title)
+        || !title.startsWith("Yui ")) {
         throw new Error("Run title is invalid.");
     }
     return title;
 }
-function requireRunId(value) {
-    const id = value.trim();
-    if (id.length === 0
-        || id.length > 1_024
-        || ["__proto__", "prototype", "constructor", ".", ".."].includes(id)
-        || /[\/\\\0\s]/.test(id)) {
-        throw new Error("Run id is invalid.");
-    }
-    return id;
-}

package/dist/runtime/agentHost.js

@@ -13,9 +13,8 @@ import { ProviderDeliveryUnknownError, ProviderConversationMissingError, Provide
 import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
 import { validateRuntimeProcessExitObservation } from "./processExitObservation.js";
 import { readRuntimeStopReceipt, removeRuntimeStopReceipt } from "./runtimeStopReceipt.js";
+import { AGENT_HOST_CONTROL_TIMEOUT_MS, AGENT_HOST_READY_TIMEOUT_MS } from "./runtimeDeadlines.js";
 export const AGENT_HOST_CONTROL_PROTOCOL = "yui-agent-host/v2";
-const HOST_CONTROL_TIMEOUT_MS = 35_000;
-const HOST_READY_TIMEOUT_MS = 35_000;
 const HOST_CONTROL_MAX_BYTES = 32 * 1024;
 export function serializeAgentHostLaunchControl(control) {
     return JSON.stringify(validateControl(control));
@@ -599,7 +598,7 @@ export async function inspectAgentHost(input) {
     return result.snapshot;
 }
 export async function waitForAgentHostLaunchAck(input) {
-    const deadline = Date.now() + (input.timeoutMs ?? HOST_READY_TIMEOUT_MS);
+    const deadline = Date.now() + (input.timeoutMs ?? AGENT_HOST_READY_TIMEOUT_MS);
     let lastError;
     while (Date.now() < deadline) {
         try {
@@ -634,7 +633,7 @@ async function sendAgentHostControl(input) {
         const timer = setTimeout(() => {
             client.destroy();
             reject(new Error("Agent Host control request timed out."));
-        }, HOST_CONTROL_TIMEOUT_MS);
+        }, AGENT_HOST_CONTROL_TIMEOUT_MS);
         let settled = false;
         const settle = (callback, value) => {
             if (settled)

package/dist/runtime/codexAppServerRuntime.js

@@ -39,6 +39,12 @@ export class CodexAppServerRuntime {
         const result = await this.transport.request("thread/resume", { threadId: id });
         return parseThreadSnapshot(result, id, true);
     }
+    async setConversationName(input) {
+        await this.transport.request("thread/name/set", {
+            threadId: text(input.conversationId, "Codex thread id"),
+            name: text(input.name, "Codex thread name")
+        });
+    }
     async readConversation(conversationId) {
         const id = text(conversationId, "Codex thread id");
         const result = await this.transport.request("thread/read", {

package/dist/runtime/exactControlPlane.js

@@ -9,7 +9,6 @@ import { hasRuntimeCleanupObligation, isRuntimeLaunchReservation, runtimeLifecyc
 import { nativeSessionIdForLaunch } from "./preallocatedNativeSession.js";
 import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
-import { readActiveReleasePointer } from "../release/runtimeRelease.js";
 export const EXACT_CONTROL_ARGUMENT = "--yui-control";
 export const YUI_CONTROL_PLANE_DESCRIPTOR = "YUI_CONTROL_PLANE_DESCRIPTOR";
 export const YUI_TASK_RUNTIME_DESCRIPTOR = "YUI_TASK_RUNTIME_DESCRIPTOR";
@@ -174,43 +173,67 @@ export async function assertExactControlPlanePreflight(input, options = {}) {
             + `(expected ${descriptor.identity.aggregateSchemaVersion}, found `
             + `${storage.currentAggregateSchemaVersion ?? "unknown"}).`);
     }
-    // Issue 02: bind the descriptor to the active release. A descriptor that
-    // carries a build ID must match the Home's active release pointer; a
-    // descriptor without a build ID is rejected once a Home has an active
-    // release (old Sessions cannot mutate a released control plane). Homes
-    // without an active release pointer keep the legacy continuity contract.
-    const readActiveRelease = options.readActiveRelease ?? defaultReadActiveRelease;
-    const activeRelease = readActiveRelease(descriptor.yuiHome);
-    if (descriptor.buildId !== undefined) {
-        if (activeRelease === null) {
-            throw new Error("Exact control-plane descriptor names a release build but the Home has "
-                + "no active release pointer.");
+    // A frozen descriptor authenticates the command that created it; it no
+    // longer pins the Home's deployment pointer for the lifetime of a Session.
+    // Continuity is the protocol/storage contract checked above and the durable
+    // Task/Role/Run identity checked below. This lets a compatible Controller or
+    // active release advance without invalidating a still-current Session.
+    if (options.checkController !== false) {
+        const call = options.callController ?? defaultCallController;
+        try {
+            const status = await call(descriptor.yuiHome, "controller.status", {});
+            assertControllerContinuityIdentity(status, descriptor.identity);
         }
-        if (activeRelease.buildId !== descriptor.buildId) {
-            throw new Error("Exact control-plane release changed since the descriptor was frozen "
-                + `(expected ${descriptor.buildId}, active ${activeRelease.buildId}).`);
+        catch (error) {
+            if (!isDefinitelyNotRunning(error))
+                throw error;
         }
-        if (descriptor.activeReleaseDigest !== undefined
-            && activeRelease.packageDigest !== descriptor.activeReleaseDigest) {
-            throw new Error("Exact control-plane release digest does not match the active release pointer.");
+    }
+    return descriptor;
+}
+/**
+ * Compatibility gate for an ordinary `yui` invocation inside a managed
+ * Session. The Session Manifest and durable runtime state authenticate the
+ * actor separately; this gate proves that the current CLI can safely share the
+ * Home with its storage and Controller without pinning package/build identity.
+ */
+export async function assertCompatibleControlPlanePreflight(input, options = {}) {
+    const home = canonicalPath(input.actualHome);
+    const identity = validateVersionIdentity(options.identity ?? yuiVersionIdentity());
+    const storage = (options.inspectStorage ?? inspectStorageSchema)(home);
+    if (storage.status !== "current") {
+        const compatibleRecordOnlyOlder = storage.status === "unsupported"
+            && storage.incompatibleComponent === "record"
+            && storage.direction === "older"
+            && storage.currentLayoutVersion === identity.storageLayoutVersion
+            && storage.currentAggregateSchemaVersion === identity.aggregateSchemaVersion;
+        if (!compatibleRecordOnlyOlder) {
+            throw new Error(`Managed control-plane storage is not current: ${storage.status}.`);
         }
+        (options.openCompatibleStore ?? openCompatibleFileTaskStore)(home).getConfig();
     }
-    else if (activeRelease !== null) {
-        throw new Error("Exact control-plane descriptor predates the active release; old Sessions "
-            + "cannot mutate a released control plane. Re-launch through the current release.");
+    if (storage.currentLayoutVersion !== identity.storageLayoutVersion) {
+        throw new Error("Managed control-plane storage layout is incompatible "
+            + `(expected ${identity.storageLayoutVersion}, found `
+            + `${storage.currentLayoutVersion ?? "unknown"}).`);
+    }
+    if (storage.currentAggregateSchemaVersion !== identity.aggregateSchemaVersion) {
+        throw new Error("Managed control-plane aggregate schema is incompatible "
+            + `(expected ${identity.aggregateSchemaVersion}, found `
+            + `${storage.currentAggregateSchemaVersion ?? "unknown"}).`);
     }
     if (options.checkController !== false) {
         const call = options.callController ?? defaultCallController;
         try {
-            const status = await call(descriptor.yuiHome, "controller.status", {});
-            assertControllerContinuityIdentity(status, descriptor.identity);
+            const status = await call(home, "controller.status", {});
+            assertControllerContinuityIdentity(status, identity);
         }
         catch (error) {
             if (!isDefinitelyNotRunning(error))
                 throw error;
         }
     }
-    return descriptor;
+    return identity;
 }
 export function assertControllerStatusIdentity(status, expected = yuiVersionIdentity()) {
     if (!isRecord(status) || status.running !== true) {
@@ -539,16 +562,3 @@ function isRecord(value) {
 function isDefinitelyNotRunning(error) {
     return isRecord(error) && error.code === "CONTROLLER_NOT_RUNNING";
 }
-function defaultReadActiveRelease(home) {
-    try {
-        const pointer = readActiveReleasePointer(home);
-        return pointer === null
-            ? null
-            : { buildId: pointer.buildId, packageDigest: pointer.packageDigest };
-    }
-    catch {
-        // A damaged pointer fails closed: treat it as an active release the
-        // descriptor cannot match, rather than silently skipping the gate.
-        return { buildId: "unknown", packageDigest: "unknown" };
-    }
-}