@zq-silk/yui 2.0.0 → 2.2.0

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -267,7 +267,8 @@ export class FileSchedulerStoreAdapter {
             default:
                 outcome = "obsolete";
         }
-        if (outcome === "applied" && !isRunTerminalObservation(input)) {
+        if (outcome === "applied" && !isRunTerminalObservation(input)
+            && input.kind !== "goal.updated" && input.kind !== "goal.cleared") {
             this.persistRuntimeObservation(input, now);
         }
         return outcome;
@@ -700,7 +701,7 @@ export class FileSchedulerStoreAdapter {
             return "applied";
         });
     }
-    persistRuntimeObservation(input, now) {
+    persistRuntimeObservation(input, now, notifyGoal = true) {
         this.store.transaction((store) => {
             const taskId = input.fence.taskId;
             const events = store.listEvents(taskId);
@@ -762,8 +763,7 @@ export class FileSchedulerStoreAdapter {
                     ? "provider-continuation-report"
                     : "provider-continuation-settled", now);
             }
-            if ((input.kind === "goal.cleared"
-                || (input.kind === "goal.updated" && input.payload.goalStatus !== "active"))
+            if (notifyGoal && (input.kind === "goal.cleared" || input.kind === "goal.updated")
                 && input.fence.roleName !== "leader") {
                 routeRoleEvent(store, observationEvent, input.fence.roleName, input.kind === "goal.cleared"
                     ? "provider-goal-cleared"
@@ -2363,6 +2363,8 @@ export class FileSchedulerStoreAdapter {
     observeProviderGoal(input, now) {
         return this.store.transaction((store) => {
             const taskId = input.fence.taskId;
+            if (hasPersistedRuntimeObservation(store.listEvents(taskId), input))
+                return "applied";
             const sessions = store.getTaskRoleSessionSet(taskId, input.fence.roleName);
             const binding = sessions?.providerBinding;
             if (sessions === null || sessions === undefined || binding === null || binding === undefined
@@ -2383,7 +2385,16 @@ export class FileSchedulerStoreAdapter {
                         ? {}
                         : { tokenBudget: input.payload.goalTokenBudget })
                 });
+            // Startup/re-attachment observes current state, not necessarily a change.
+            // Compare under the same transaction that persists and routes the fact.
+            if (isDeepStrictEqual(binding.goal, updated.goal)) {
+                // Retain the existing dedup evidence: an old empty observation replayed
+                // after a later real update must not clear that newer state.
+                this.persistRuntimeObservation(input, now, false);
+                return "applied";
+            }
             store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, updated, now));
+            this.persistRuntimeObservation(input, now);
             return "applied";
         });
     }
@@ -3127,14 +3138,16 @@ function mapRole(store, role) {
         ? resolveEffectiveLaunch({
             role,
             purpose,
-            ...(workspace === undefined ? {} : { workspace })
+            ...(workspace === undefined ? {} : { workspace }),
+            ...(item === null ? {} : { workItemWriteProjectIds: item.writeProjectIds })
         })
         : liveSession !== null && workspace?.owner.type === "task"
             ? effectiveLaunchWithTaskMainWorkspace(liveSession.effective, workspace)
             : liveSession?.effective ?? resolveEffectiveLaunch({
                 role,
                 purpose,
-                ...(workspace === undefined ? {} : { workspace })
+                ...(workspace === undefined ? {} : { workspace }),
+                ...(item === null ? {} : { workItemWriteProjectIds: item.writeProjectIds })
             });
     return {
         taskId: role.taskId,

package/dist/controller/jobControl.js

@@ -19,6 +19,7 @@ import { requireManagedTaskCaller, ManagedRuntimeDriftError } from "../runtime/m
 import { CliError } from "../errors/cliError.js";
 import { assertJobAssignmentScope, JobAssignmentScopeError } from "../job/jobAssignmentScope.js";
 import { assertContextRecordReadable } from "../context/taskContext.js";
+import { assertTaskProjectWriteAuthority } from "../task/taskAuthority.js";
 export function createDurableJobControl(store) {
     const authority = createJobCallAuthority(store);
     return {
@@ -167,8 +168,27 @@ export function authorizeJobStart(store, job) {
         throw jobDomainError("Job caller binding was revoked; no execution was started.");
     }
     requireJobAssignment(store, job, { scope, role });
+    assertLeaderJobWriteScope(store, job, { scope, role });
     validateJobTarget(store, job);
 }
+function assertLeaderJobWriteScope(store, target, caller) {
+    if (caller.scope !== "task" || caller.role !== "leader")
+        return;
+    if (target.owner.kind !== "task" && target.owner.kind !== "integration-attempt") {
+        throw jobControlError("UNAUTHORIZED", "Direct Leader delivery does not grant another Assignment or Review workspace. Use the owning executor for its Job.");
+    }
+    const { taskId, projectId } = target;
+    const session = activeLiveRoleAgentSession(store.getTaskRoleSessionSet(taskId, caller.role));
+    try {
+        assertTaskProjectWriteAuthority(store, {
+            YUI_SESSION_SCOPE: "task", YUI_TASK_ID: taskId, YUI_ROLE: caller.role,
+            YUI_NATIVE_SESSION_ID: caller.nativeSessionId ?? session?.nativeSessionId
+        }, taskId, projectId);
+    }
+    catch (error) {
+        throw jobControlError("UNAUTHORIZED", error instanceof Error ? error.message : String(error));
+    }
+}
 function requireJobAssignment(store, target, caller) {
     try {
         assertJobAssignmentScope(store, target, caller);
@@ -244,6 +264,7 @@ function assertNonSecretJobInput(params) {
 function validateStartParams(store, params) {
     validateJobTarget(store, params);
     assertCallerAuthorized(store, params.caller, params.taskId);
+    assertLeaderJobWriteScope(store, params, params.caller);
     if (params.caller.scope === "task") {
         const session = store.getTaskRoleSessionSet(params.taskId, params.caller.role);
         if (session?.sessions[session.activeAgentId]?.effective.executionAuthority !== "delivery") {

package/dist/executor/agentExecutor.js

@@ -317,7 +317,7 @@ export function roleAgentSessionResumeMode(set, agentId, desired) {
     if (roleSessionMayContinue(session.effective, desired))
         return "resume";
     throw new Error(`Role Agent session cannot continue under the next launch: ${agentId}. `
-        + "Its Agent, adapter or physical workspace changed. Explicitly select a new Session "
+        + "Its Agent, adapter, physical workspace or captured authority changed. Explicitly select a new Session "
         + "after resolving existing execution and resource ownership.");
 }
 export function bindTaskRoleProviderRuntime(set, binding, updatedAt) {

package/dist/executor/effectiveLaunch.js

@@ -117,8 +117,8 @@ export function sameEffectiveLaunch(existing, desired) {
  *
  * Only facts that make continuation impossible participate: the Session
  * protocol, the provider identity that owns the conversation, and the physical
- * workspace the Session runs in. Launch configuration such as model, effort,
- * permission, Role context, declared write scope, and AgentRun-scoped facts like
+ * workspace and captured authority the Session runs with. Launch configuration
+ * such as model, effort, provider permission, Role context, and AgentRun-scoped facts like
  * ReviewRound identity or candidate commits shape the next Host process
  * instead of ending the Session; that divergence is acknowledged where the
  * configuration changes and stays visible as launch provenance.
@@ -151,6 +151,8 @@ function sessionContinuitySnapshot(snapshot) {
     return {
         schemaVersion: snapshot.schemaVersion,
         executionAuthority: snapshot.executionAuthority,
+        profileAccess: snapshot.profileAccess,
+        writeProjectIds: snapshot.writeProjectIds,
         contextProtocolVersion: snapshot.contextProtocolVersion,
         agentId: snapshot.agentId,
         // Two products on one connection plan are two different conversations. A
@@ -329,6 +331,8 @@ function effectiveLaunchConfigUnchecked(snapshot) {
             : claudeConfigFromSnapshot(snapshot);
 }
 function effectiveWriteProjects(input, workspace) {
+    if (input.purpose === "planning" || input.executionAuthority === "planning")
+        return [];
     if (input.purpose === "review") {
         if (!("taskId" in input.role)) {
             throw new Error("Review launch requires a Task Role.");
@@ -358,9 +362,18 @@ function effectiveWriteProjects(input, workspace) {
         .map(({ projectId }) => projectId), "Workspace writable Project");
     if (!("taskId" in input.role))
         return [];
-    // A managed workspace describes what exists, not who is authorized to
-    // mutate it. Only an explicit WorkItem write scope can grant Task writes.
-    if (input.workItemWriteProjectIds === undefined)
+    // Direct delivery belongs to the Leader in this Task's adopted main
+    // workspace. Assignment scope (including explicit []) still takes priority.
+    // Never infer authority from a path, a different owner's workspace or a
+    // desired Profile change to an already-frozen Session.
+    if (input.workItemWriteProjectIds === undefined) {
+        return input.role.name === "leader"
+            && input.role.defaultAccess === "write"
+            && input.workspace?.owner.type === "task"
+            && input.workspace.owner.taskId === input.role.taskId
+            ? workspaceWrite : [];
+    }
+    if (input.role.defaultAccess !== "write")
         return [];
     const requested = uniqueIdentities(input.workItemWriteProjectIds, "WorkItem writable Project");
     if (requested.length === 0)

package/dist/executor/fileRoleLaunchPlanner.js

@@ -216,7 +216,7 @@ export class FileRoleLaunchPlanner {
             // attempt was rejected, cancelled, or completed.
             assertProviderConversationReplaceable(sessionSet.providerBinding);
         }
-        return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
+        return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, {
             purpose
         });
     }
@@ -246,9 +246,9 @@ export class FileRoleLaunchPlanner {
         }
         return this.#compile(role, input, { scope: "global" }, input.mode === "new" && role.name === "operator"
             ? operatorSessionTitle(this.#now(), this.store.getConfig().timeZone)
-            : undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
+            : undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, { purpose: "execution" });
     }
-    #compile(role, input, owner, sessionTitle, knownNativeSessionId, workspaceOverride, effective, sessionPolicy) {
+    #compile(role, input, owner, sessionTitle, knownNativeSessionId, effective, sessionPolicy) {
         const launchRole = effectiveRoleForLaunch(role, effective);
         const binding = activeRoleAgentBinding(launchRole);
         if (binding.agentId !== input.agentId || binding.adapterId !== input.adapterId) {
@@ -580,7 +580,7 @@ export class FileRoleLaunchPlanner {
             childLifecycle: driver.capabilities.lifecycle.providerProcess
         };
         const scopedLaunch = owner.scope === "task"
-            ? this.#applyWorkspaceScope(owner.taskId, role, launch, workspaceOverride)
+            ? this.#applyWorkspaceScope(launch, effective)
             : launch;
         const ordinaryConversationLaunch = withCodexThreadEnvironment(scopedLaunch);
         return {
@@ -640,20 +640,11 @@ export class FileRoleLaunchPlanner {
         }
         return { attemptId: run.attemptId, turnId: run.nativeTurnId };
     }
-    #applyWorkspaceScope(taskId, role, launch, workspaceOverride) {
-        const workspace = workspaceOverride
-            ?? (role.name === "leader"
-                ? this.store.getTaskWorkspace(taskId)
-                : this.store.listWorkItems(taskId)
-                    .find((item) => item.assignee === role.name && item.status === "open") === undefined
-                    ? this.store.getTaskWorkspace(taskId)
-                    : this.store.getWorkItemWorkspace(taskId, this.store.listWorkItems(taskId).find((item) => item.assignee === role.name && item.status === "open").id));
-        if (workspace === null || workspace === undefined)
-            return launch;
+    #applyWorkspaceScope(launch, effective) {
         return {
             ...launch,
             env: {
-                ...workspaceScopeEnvironment(launch.env, workspace)
+                ...workspaceScopeEnvironment(launch.env, effective)
             }
         };
     }
@@ -711,16 +702,21 @@ function resolveTaskRoleEffectiveLaunch(store, role, purpose = "execution") {
         ...(item === null ? {} : { workItemWriteProjectIds: item.writeProjectIds })
     });
 }
-function workspaceScopeEnvironment(environment, workspace) {
+function workspaceScopeEnvironment(environment, effective) {
+    const entries = effective.workspace.entries.map(entry => ({
+        ...entry,
+        access: entry.access === "write" && effective.writeProjectIds.includes(entry.projectId)
+            ? "write" : "read"
+    }));
     return {
         ...environment,
-        YUI_WRITABLE_PROJECT_IDS: JSON.stringify(workspace.entries
+        YUI_WRITABLE_PROJECT_IDS: JSON.stringify(entries
             .filter(({ access }) => access === "write")
             .map(({ projectId }) => projectId)),
-        YUI_CONTEXT_PROJECT_IDS: JSON.stringify(workspace.entries
+        YUI_CONTEXT_PROJECT_IDS: JSON.stringify(entries
             .filter(({ access }) => access === "read")
             .map(({ projectId }) => projectId)),
-        YUI_WORKSPACE_PROJECTS: JSON.stringify(Object.fromEntries(workspace.entries.map(({ projectId, directory, access, path }) => [
+        YUI_WORKSPACE_PROJECTS: JSON.stringify(Object.fromEntries(entries.map(({ projectId, directory, access, path }) => [
             projectId,
             { directory, access, path }
         ])))

package/dist/integration/gitIntegrationService.js

@@ -1,5 +1,5 @@
 import { execFile, spawn } from "node:child_process";
-import { lstat, mkdir, open, rm, stat } from "node:fs/promises";
+import { lstat, mkdir, open, realpath, rm, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { selectEnvironment } from "../agent/launchEnvironment.js";
@@ -14,6 +14,7 @@ import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { FileTaskRuntimeIsolation } from "../runtime/taskRuntimeIsolation.js";
 import { integrationTmuxSocketRoot, managedIntegrationRuntimeRoot } from "../storage/homeLayout.js";
 import { advanceTaskProjectCommit } from "../task/task.js";
+import { taskIntegrationSettlementCheckout, taskIntegrationTargetCheckout } from "../task/taskAuthority.js";
 import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
 import { recordGateArtifactReuse } from "../verification/gateArtifact.js";
 import { touchGateArtifact } from "../verification/gateArtifactStore.js";
@@ -75,8 +76,12 @@ export class GitIntegrationService {
     #resourceRegistrar() {
         return this.#resourceRegistrarValue ??= new ResourceRegistrar(this.home, this.now);
     }
+    #targetCheckout(attempt) {
+        return taskIntegrationTargetCheckout(this.store, this.environment, attempt.taskId, attempt.projectId, attempt.targetRef);
+    }
     async integrate(taskId, integrationId, signal) {
         let initial = requireIntegration(this.store, taskId, integrationId);
+        this.#targetCheckout(initial);
         if (!["running", "conflicted", "blocked", "validating"].includes(initial.status)) {
             throw new Error(`Integration cannot continue from ${initial.status}.`);
         }
@@ -95,6 +100,7 @@ export class GitIntegrationService {
                 throw new Error("Integration changed before execution admission; read its current record.");
             }
             initial = currentUnderFence;
+            this.#targetCheckout(initial);
             const task = this.store.getTask(initial.taskId);
             if (task === null || !task.projectBindings.some(({ projectId }) => projectId === initial.projectId)) {
                 throw new Error(`Integration Task Project is unavailable: ${initial.taskId}.`);
@@ -116,6 +122,7 @@ export class GitIntegrationService {
                 || taskRepository === undefined) {
                 throw new Error(`Integration Task clone is unavailable: ${task.id}/${project.id}.`);
             }
+            await assertTargetCheckout(taskRepository, initial.targetRef, this.#targetCheckout(initial));
             // Issue 08: a Project with a VerificationPlan gates through its plan
             // (bootstrap + L2) and reuses exact-SHA artifacts; an unconfigured
             // Project keeps the existing explicit check path unchanged.
@@ -193,7 +200,7 @@ export class GitIntegrationService {
                 // moved or its worktree is dirty, so the check commands never run on a
                 // target that cannot be advanced.  advanceTargetRef re-verifies both
                 // after the checks, so a move during the gate is still fenced at CAS.
-                await assertTargetReadyForChecks(taskRepository, current.targetRef, current.beforeCommit);
+                await assertTargetReadyForChecks(taskRepository, current.targetRef, current.beforeCommit, this.#targetCheckout(current));
                 if (gate !== undefined) {
                     return await this.#runVerificationGate(current, workspace, prepared.path, managedWorkspace, taskRepository, gate);
                 }
@@ -221,7 +228,7 @@ export class GitIntegrationService {
                     checks: checkResults
                 }, this.now());
                 this.store.saveIntegrationAttempt(task.id, current);
-                await advanceTargetRef(taskRepository, current.targetRef, candidateCommit, current.beforeCommit);
+                await advanceTargetRef(taskRepository, current.targetRef, candidateCommit, current.beforeCommit, this.#targetCheckout(current));
                 const committed = this.#recordCommitted(current);
                 return this.#terminalResult("committed", committed, workspace);
             }
@@ -234,7 +241,7 @@ export class GitIntegrationService {
                     if (target === current.candidateCommit) {
                         try {
                             await assertIntegrationCandidate(workspace.path, current.candidateCommit, workspace.branch);
-                            await assertTargetReadyForChecks(taskRepository, current.targetRef, current.candidateCommit);
+                            await assertTargetReadyForChecks(taskRepository, current.targetRef, current.candidateCommit, this.#targetCheckout(current));
                             const committed = this.#recordCommitted(current);
                             return this.#terminalResult("committed", committed, workspace);
                         }
@@ -307,8 +314,21 @@ export class GitIntegrationService {
                 }
                 const target = await resolveRef(mainEntry.path, attempt.targetRef);
                 if (target === attempt.candidateCommit && target !== attempt.beforeCommit) {
-                    await assertTargetReadyForChecks(mainEntry.path, attempt.targetRef, target);
-                    return this.#recordCommitted(attempt, authorize);
+                    if (attempt.checks.some(check => check.outcome === "failed")
+                        || attempt.jobId !== undefined
+                            && jobs.find(job => job.id === attempt.jobId).status !== "succeeded") {
+                        throw new Error("Delivered Integration lacks successful candidate check evidence; inspect before settlement.");
+                    }
+                    await assertIntegrationCandidate(workspace.root, attempt.candidateCommit, workspaceEntry.branch);
+                    assertRecordedSourceCandidate(attempt, { path: workspace.root, branch: workspaceEntry.branch });
+                    await assertTargetReadyForChecks(mainEntry.path, attempt.targetRef, target, taskIntegrationSettlementCheckout(this.store, this.environment, taskId, attempt.projectId, attempt.targetRef));
+                    return this.#recordCommitted(attempt, (tx, id) => {
+                        authorize(tx, id);
+                        taskIntegrationSettlementCheckout(tx, this.environment, id, attempt.projectId, attempt.targetRef);
+                        if (JSON.stringify(requireIntegration(tx, id, integrationId)) !== JSON.stringify(attempt)) {
+                            throw new Error("Integration changed before delivered settlement; inspect its current record.");
+                        }
+                    });
                 }
                 if (target !== attempt.beforeCommit) {
                     throw new Error(`Target moved to ${target}; cannot prove this Integration is unadvanced. Inspect before settlement.`);
@@ -419,7 +439,7 @@ export class GitIntegrationService {
             throw new Error(`Integration check admission requires a running, proven candidate: ${attempt.id}.`);
         }
         await assertIntegrationCandidate(path, attempt.candidateCommit, workspace.branch);
-        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit);
+        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit, this.#targetCheckout(attempt));
         const { runtime, head, steps, environment, inputDigest } = await this.#checkSpecification(attempt, managedWorkspace, gate);
         if (attempt.checkInputDigest !== undefined && attempt.checkInputDigest !== inputDigest) {
             throw new Error("Integration check conditions changed since admission; inspect the original Job, then abort or start a new attempt.");
@@ -479,7 +499,7 @@ export class GitIntegrationService {
         const job = await this.jobPort.getJob(attempt.taskId, attempt.jobId);
         assertCheckJobIdentity(attempt, job, path);
         await assertIntegrationCandidate(path, job.head, workspace.branch);
-        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit);
+        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit, this.#targetCheckout(attempt));
         if (gate?.planDigest !== attempt.gatePlanDigest
             || gate?.toolchainDigest !== attempt.gateToolchainDigest) {
             throw new Error("Integration verification plan/toolchain changed; the original Job cannot prove the current gate.");
@@ -642,7 +662,7 @@ export class GitIntegrationService {
             checks
         }, this.now());
         this.store.saveIntegrationAttempt(attempt.taskId, validating);
-        await advanceTargetRef(repositoryPath, validating.targetRef, candidateCommit, validating.beforeCommit);
+        await advanceTargetRef(repositoryPath, validating.targetRef, candidateCommit, validating.beforeCommit, this.#targetCheckout(validating));
         const committed = this.#recordCommitted(validating);
         return this.#terminalResult("committed", committed, workspace);
     }
@@ -709,9 +729,9 @@ export class GitIntegrationService {
                 }
                 assertCheckJobIdentity(attempt, job, workspace.path);
             }
-            await advanceTargetRef(repositoryPath, attempt.targetRef, attempt.candidateCommit, attempt.beforeCommit);
+            await advanceTargetRef(repositoryPath, attempt.targetRef, attempt.candidateCommit, attempt.beforeCommit, this.#targetCheckout(attempt));
         }
-        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.candidateCommit);
+        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.candidateCommit, this.#targetCheckout(attempt));
         const committed = this.#recordCommitted(attempt);
         return this.#terminalResult("committed", committed, workspace);
     }
@@ -1138,12 +1158,12 @@ async function resolveRef(repositoryPath, ref) {
  * {@link advanceTargetRef} re-verifies both before the CAS, so a target that
  * moves during the gate is still fenced.
  */
-async function assertTargetReadyForChecks(repositoryPath, targetRef, expectedHead) {
+async function assertTargetReadyForChecks(repositoryPath, targetRef, expectedHead, expectedCheckout) {
     const current = await resolveRef(repositoryPath, targetRef);
     if (current !== expectedHead) {
         throw new Error(`Target moved to ${current}; expected ${expectedHead}.`);
     }
-    const checkedOutPaths = await checkedOutWorktreePaths(repositoryPath, fullTargetRef(targetRef));
+    const checkedOutPaths = await assertTargetCheckout(repositoryPath, targetRef, expectedCheckout);
     if (checkedOutPaths.length > 1) {
         throw new Error(`Integration target is checked out in multiple worktrees: ${targetRef}.`);
     }
@@ -1156,9 +1176,18 @@ async function assertTargetReadyForChecks(repositoryPath, targetRef, expectedHea
         }
     }
 }
-async function advanceTargetRef(repositoryPath, targetRef, candidateCommit, expectedHead) {
+async function assertTargetCheckout(repositoryPath, targetRef, expectedCheckout) {
+    const paths = await checkedOutWorktreePaths(repositoryPath, fullTargetRef(targetRef));
+    if (expectedCheckout !== undefined && (await realpath(repositoryPath) !== await realpath(expectedCheckout)
+        || paths.length !== 1 || await realpath(paths[0]) !== await realpath(expectedCheckout)
+        || (await git(["-C", expectedCheckout, "symbolic-ref", "HEAD"])).trim() !== fullTargetRef(targetRef))) {
+        throw new Error("Managed Leader Integration target must be physically checked out in its captured Task-main workspace.");
+    }
+    return paths;
+}
+async function advanceTargetRef(repositoryPath, targetRef, candidateCommit, expectedHead, expectedCheckout) {
     const ref = fullTargetRef(targetRef);
-    const checkedOutPaths = await checkedOutWorktreePaths(repositoryPath, ref);
+    const checkedOutPaths = await assertTargetCheckout(repositoryPath, targetRef, expectedCheckout);
     if (checkedOutPaths.length === 0) {
         await git([
             "-C", repositoryPath, "update-ref",
@@ -1182,6 +1211,9 @@ async function advanceTargetRef(repositoryPath, targetRef, candidateCommit, expe
     if (current !== expectedHead) {
         throw new Error(`Target moved to ${current}; expected ${expectedHead}.`);
     }
+    if (expectedCheckout !== undefined) {
+        await assertTargetCheckout(repositoryPath, targetRef, expectedCheckout);
+    }
     // The candidate may be a rebased upstream result and therefore need not be
     // a descendant of the old Task head. Advance the branch with a real
     // compare-and-swap, then update only this checkout's index and worktree.
@@ -1193,6 +1225,9 @@ async function advanceTargetRef(repositoryPath, targetRef, candidateCommit, expe
         candidateCommit,
         expectedHead
     ]);
+    if (expectedCheckout !== undefined) {
+        await assertTargetCheckout(repositoryPath, targetRef, expectedCheckout);
+    }
     await git(["-C", checkout, "read-tree", "--reset", "-u", candidateCommit]);
     const advanced = await resolveRef(repositoryPath, targetRef);
     if (advanced !== candidateCommit) {

package/dist/kernel/accessAssessment.js

@@ -0,0 +1 @@
+export {};

package/dist/kernel/builtinCapabilities.js

@@ -452,7 +452,34 @@ export function createBuiltinCapabilities(host, store, jobs, signal = () => unde
             throw new Error(`Permission unavailable: ${permission}.`);
         }
         return { taskIds: [task.id], projectIds: task.projectBindings.map((binding) => binding.projectId) };
-    }, BUILTIN_CAPABILITIES);
+    }, BUILTIN_CAPABILITIES, (context, descriptor, input) => {
+        const caller = current(context);
+        const params = input;
+        const via = caller.scope === "global" ? "operator"
+            : caller.role === "leader" ? "leader-input" : "leader-message";
+        const forCaller = (access) => caller.scope === "user" && access.state === "requestable" ? { state: "hidden" } : access;
+        const pluginAccess = plugins.assess(context.targetId, descriptor, input, via);
+        if (pluginAccess)
+            return forCaller(pluginAccess);
+        if (input === undefined)
+            return undefined;
+        if (descriptor.name === "resource.local.read") {
+            return forCaller(resources.assessLocalAccess(context.targetId, params.resourceId, "read", via));
+        }
+        if (descriptor.name === "environment.prepare") {
+            const plan = params.plan;
+            return plan.kind === "local"
+                ? forCaller(resources.assessLocalAccess(context.targetId, plan.resourceId, plan.access, via))
+                : { state: "authorized" };
+        }
+        if (descriptor.name === "task.read" || descriptor.name === "config.read"
+            || descriptor.name === "resource.workspaces" || descriptor.name === "environment.list") {
+            return { state: "authorized" };
+        }
+        // Other domain operations retain their exact execution checks. Do not
+        // claim target authorization from a descriptor's coarse permission alone.
+        return undefined;
+    });
     const plugins = createPluginService(store, host, registry);
     return {
         registry,

package/dist/kernel/capabilityRegistry.js

@@ -17,11 +17,13 @@ const reserved = new Set(["yui", "task", "context", "config", "job", "resource",
 export class CapabilityRegistry {
     host;
     authorize;
+    assess;
     #descriptors = [];
     #coreProviders = new Set();
-    constructor(host, authorize, builtins = []) {
+    constructor(host, authorize, builtins = [], assess) {
         this.host = host;
         this.authorize = authorize;
+        this.assess = assess;
         this.#publish(builtins, true);
         builtins.forEach((entry) => this.#coreProviders.add(entry.provider.id));
     }
@@ -38,7 +40,7 @@ export class CapabilityRegistry {
         if (!prepared.length)
             throw new Error("Plugin must contribute capabilities.");
         const available = [
-            ...this.search(context).filter((entry) => entry.provider.id !== prepared[0].provider.id),
+            ...this.#authorized(context).filter((entry) => entry.provider.id !== prepared[0].provider.id),
             ...prepared
         ];
         const check = (entry, path) => {
@@ -47,7 +49,8 @@ export class CapabilityRegistry {
                 throw new Error("Required capability dependency cycle.");
             for (const dependency of entry.required ?? []) {
                 const matches = available.filter((candidate) => candidate.name === dependency.name
-                    && candidate.contractVersion === dependency.contractVersion && candidate.unavailable === undefined);
+                    && candidate.contractVersion === dependency.contractVersion && candidate.unavailable === undefined
+                    && (prepared.includes(candidate) || this.host.isAvailable(candidate.provider)));
                 if (matches.length !== 1)
                     throw new Error(`Required capability is missing or ambiguous: ${dependency.name}.`);
                 check(matches[0], new Set([...path, entry]));
@@ -58,9 +61,9 @@ export class CapabilityRegistry {
     disable(providerId) {
         this.#descriptors = this.#descriptors.filter((entry) => entry.provider.id !== providerId);
     }
-    search(context, query = "") {
+    #authorized(context) {
         const visibility = this.authorize(context);
-        const authorized = this.#descriptors.filter((entry) => visible(entry.scope, visibility))
+        return this.#descriptors.filter((entry) => visible(entry.scope, visibility))
             .filter((entry) => {
             try {
                 this.authorize(context, entry);
@@ -70,25 +73,28 @@ export class CapabilityRegistry {
                 return false;
             }
         });
-        return authorized.filter((entry) => `${entry.name} ${entry.summary}`.toLowerCase().includes(query.toLowerCase()))
-            .map((entry) => {
-            const unavailable = this.#unavailable(entry, authorized, new Set());
-            return unavailable === undefined ? entry : Object.freeze({ ...entry, unavailable });
-        });
     }
-    describe(context, request) {
+    search(context, query = "") {
+        // Descriptor discovery must not acquire or inspect runtime Providers. These
+        // are templates: without input, no exact-target authorization is asserted.
+        return this.#authorized(context).filter((entry) => `${entry.name} ${entry.summary}`.toLowerCase().includes(query.toLowerCase()))
+            .map(entry => {
+            const access = this.assess?.(context, entry, undefined);
+            return access ? { ...entry, access } : entry;
+        }).filter(entry => !("access" in entry) || entry.access?.state !== "hidden");
+    }
+    #select(context, request, execution) {
         try {
-            const candidates = this.search(context).filter((entry) => entry.name === request.name
+            const authorized = this.#authorized(context);
+            const candidates = authorized.filter((entry) => entry.name === request.name
                 && (request.contractVersion === undefined || request.contractVersion === entry.contractVersion)
                 && (request.providerId === undefined || request.providerId === entry.provider.id));
             if (!candidates.length)
                 return result("unavailable", "No authorized compatible Provider is available.");
-            const available = candidates.filter((entry) => entry.unavailable === undefined);
-            if (!available.length)
-                return {
-                    ...result("unavailable", candidates.map((entry) => `${entry.provider.id}: ${entry.unavailable}`).join("; ")),
-                    candidates
-                };
+            const available = execution ? candidates.filter(entry => this.#unavailable(entry, authorized, new Set()) === undefined) : candidates;
+            if (!available.length) {
+                return { ...result("unavailable", candidates.map(entry => `${entry.provider.id}: ${this.#unavailable(entry, authorized, new Set())}`).join("; ")), candidates };
+            }
             if (available.length > 1)
                 return { ...result("ambiguous", "Select an explicit Provider and contract version."), candidates };
             const selected = available[0];
@@ -101,6 +107,32 @@ export class CapabilityRegistry {
             return result("denied", "Current call authority is unavailable.");
         }
     }
+    describe(context, request) {
+        const selected = this.#select(context, request, false);
+        if (selected.kind !== "value")
+            return selected;
+        const descriptor = selected.value;
+        if (Object.hasOwn(request, "input")) {
+            const error = capabilitySchemaError(descriptor.inputSchema, request.input);
+            if (error)
+                return result("invalid", error);
+            try {
+                this.authorize(context, descriptor, request.input);
+            }
+            catch {
+                return result("denied", "Current call authority is unavailable.");
+            }
+        }
+        try {
+            const access = this.assess?.(context, descriptor, request.input);
+            if (access?.state === "hidden")
+                return result("unavailable", "No authorized compatible Provider is available.");
+            return access ? { ...selected, value: { ...descriptor, access } } : selected;
+        }
+        catch (error) {
+            return result("failed", error instanceof Error ? error.message : "Authorization assessment failed.");
+        }
+    }
     call(context, request) {
         return this.#call(context, request, "external-operation");
     }
@@ -112,7 +144,11 @@ export class CapabilityRegistry {
         catch {
             return result("invalid", "Capability request must be cloneable data.");
         }
-        const resolved = this.describe(context, request);
+        // Execution selects independently of discovery assessment and rechecks the
+        // exact input below. A requestable descriptor never grants admission.
+        const resolved = this.#select(context, {
+            name: request.name, contractVersion: request.contractVersion, providerId: request.providerId
+        }, true);
         if (resolved.kind !== "value")
             return resolved;
         const descriptor = resolved.value;
@@ -135,6 +171,15 @@ export class CapabilityRegistry {
         catch {
             return { ...result("denied", "Current call authority was revoked."), ...origin };
         }
+        try {
+            const access = this.assess?.(context, descriptor, request.input);
+            if (access && access.state !== "authorized") {
+                return { ...result("denied", "Exact target authorization is required."), ...origin };
+            }
+        }
+        catch (error) {
+            return { ...result("failed", error instanceof Error ? error.message : "Authorization assessment failed."), ...origin };
+        }
         const operations = [];
         let effect = "none";
         const observe = (operation) => {