agent-conveyor 0.1.13 → 0.1.15

package/dist/cli/typescript-runtime.js

@@ -5,8 +5,9 @@ import { homedir, tmpdir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { taskAuditSync } from "../runtime/audit.js";
-import { appAutopilotPlanSync, appLoopStatusSync, appWakeupDispatchPlanSync, appWakeupPlanSync, directInboxPollCommand, } from "../runtime/app-autonomy.js";
+import { appAutopilotPlanSync, appLoopStatusSync, appWakeupDispatchPlanSync, appWakeupPlanSync, directInboxPollCommand, visibleSessionProtocolLines, } from "../runtime/app-autonomy.js";
 import { classifyBusyWait, classifyStartupOutput } from "../runtime/classify.js";
+import { addCampaignWorkerSlotSync, campaignDashboardSync, campaignStatusSync, createCampaignAssignmentSync, createCampaignSync, recordCampaignAssetReceiptSync, updateCampaignWorkerSlotLifecycleSync, upsertCampaignChannelBriefSync, } from "../runtime/campaigns.js";
 import { exportTaskSync } from "../runtime/export.js";
 import { ingestSessionSync } from "../runtime/ingest.js";
 import { acceptanceCriteriaForTaskSync, loopEvidenceCriterion, recordAdversarialLoopEvidenceSync, recordLoopEvidenceSync, recordVisualDiffLoopEvidenceSync, } from "../runtime/loop-evidence.js";
@@ -134,6 +135,12 @@ export function runTypescriptRuntimeCommand(options) {
         if (parsed.command === "app-wakeup-record-delivery") {
             return runAppWakeupRecordDeliveryCommand(parsed, options);
         }
+        if (parsed.command === "app-worker-rotation-plan") {
+            return runAppWorkerRotationPlanCommand(parsed, options);
+        }
+        if (parsed.command === "app-worker-rotation-record") {
+            return runAppWorkerRotationRecordCommand(parsed, options);
+        }
         if (parsed.command === "app-autopilot") {
             return runAppAutopilotCommand(parsed, options);
         }
@@ -146,6 +153,9 @@ export function runTypescriptRuntimeCommand(options) {
         if (parsed.command === "tasks") {
             return runTasksCommand(parsed, options);
         }
+        if (parsed.command === "campaign") {
+            return runCampaignCommand(parsed, options);
+        }
         if (parsed.command === "start") {
             return runLegacyStartCommand(parsed, options);
         }
@@ -368,10 +378,25 @@ function commandHelpText(program, command) {
             `  ${program} criteria my-task --satisfy 1 --proof "File exists" --evidence-json '{"artifact":{"path":"docs/note.md"}}' --path /tmp/work/workerctl.db`,
         ],
         "finish-task": [
-            `usage: ${program} finish-task <task> --reason <reason> [--require-criteria-audit] ${path}`,
+            `usage: ${program} finish-task <task> --reason <reason> [--require-criteria-audit] ${path} [--json]`,
             "",
             "Examples:",
-            `  ${program} finish-task my-task --reason "Accepted criteria satisfied" --require-criteria-audit --path /tmp/work/workerctl.db`,
+            `  ${program} finish-task my-task --reason "Accepted criteria satisfied" --require-criteria-audit --path /tmp/work/workerctl.db --json`,
+        ],
+        campaign: [
+            `usage: ${program} campaign <create|add-slot|attach-slot|rotate-slot|archive-slot|brief|assign|asset|status|dashboard> --name <campaign> [options] ${path} [--json]`,
+            "",
+            "Examples:",
+            `  ${program} campaign create --name launch --objective "Create launch assets" --metadata-json '{"owner":"ops"}' --json`,
+            `  ${program} campaign add-slot --name launch --slot-key tiktok --role-label "TikTok worker" --channel tiktok --thread-id thread-1 --state active --json`,
+            `  ${program} campaign attach-slot --name launch --slot campaign-slot-id --session-id session-worker --thread-id thread-1 --state active --json`,
+            `  ${program} campaign rotate-slot --name launch --slot campaign-slot-id --expected-thread-id thread-1 --thread-id thread-2 --thread-title "TikTok Worker 2" --json`,
+            `  ${program} campaign archive-slot --name launch --slot campaign-slot-id --expected-thread-id thread-2 --json`,
+            `  ${program} campaign brief --name launch --channel tiktok --brief-json '{"format":"9:16"}' --json`,
+            `  ${program} campaign assign --name launch --slot campaign-slot-id --title "Draft hooks" --instructions "Create hooks" --status active --json`,
+            `  ${program} campaign asset --name launch --slot campaign-slot-id --assignment campaign-assignment-id --asset-type copy --title "Hooks v1" --status needs_review --json`,
+            `  ${program} campaign status --name launch --json`,
+            `  ${program} campaign dashboard --name launch --json`,
         ],
         "manager-ack": [
             `usage: ${program} manager-ack <task> --from-stdin ${path}`,
@@ -399,6 +424,21 @@ function commandHelpText(program, command) {
             `  ${program} app-autopilot status dogfood --path /tmp/work/workerctl.db`,
             `  ${program} app-autopilot stop dogfood --path /tmp/work/workerctl.db --json`,
         ],
+        "app-worker-rotation-plan": [
+            `usage: ${program} app-worker-rotation-plan <task> --old-worker-thread-id ID [--require-handoff] [--reason TEXT] ${path} [--json]`,
+            "",
+            "Emit Codex app actions for replacing a worker thread with a fresh thread.",
+            "The plan fails closed unless the old thread id exactly matches the active bound worker session; it never authorizes archiving a manager or unrelated thread.",
+            "",
+            "Examples:",
+            `  ${program} app-worker-rotation-plan dogfood --old-worker-thread-id thread-old --require-handoff --path /tmp/work/workerctl.db --json`,
+        ],
+        "app-worker-rotation-record": [
+            `usage: ${program} app-worker-rotation-record <task> --old-worker-thread-id OLD --new-worker-thread-id NEW [--new-worker-thread-title TITLE] --archive-status archived|blocked [--reason TEXT] ${path} [--json]`,
+            "",
+            "Record the Codex app worker-thread rotation after the app layer creates the new worker thread and archives or blocks on the old one.",
+            "The command re-checks active binding ownership before updating the worker session to the new thread id.",
+        ],
         pair: [
             `usage: ${program} pair --task <task> --worker-name <worker> --manager-name <manager> [options] ${path}`,
             "",
@@ -431,6 +471,26 @@ function commandHelpText(program, command) {
     };
     return linesByCommand[command] ?? [`usage: ${program} ${command} [-h] [options]`];
 }
+const CAMPAIGN_ACTIONS = new Set(["create", "add-slot", "attach-slot", "rotate-slot", "archive-slot", "brief", "assign", "asset", "status", "dashboard"]);
+const CAMPAIGN_STRING_FLAGS = {
+    "--artifact-path": "artifactPath",
+    "--asset-type": "assetType",
+    "--assignment": "assignment",
+    "--brief-json": "briefJson",
+    "--channel": "channel",
+    "--expected-thread-id": "expectedThreadId",
+    "--instructions": "instructions",
+    "--objective": "objective",
+    "--prompt-summary": "promptSummary",
+    "--review-notes": "reviewNotes",
+    "--role-label": "roleLabel",
+    "--session-id": "sessionId",
+    "--slot": "slot",
+    "--slot-key": "slotKey",
+    "--thread-id": "threadId",
+    "--thread-title": "threadTitle",
+    "--title": "title",
+};
 function parseRuntimeArgs(args, env) {
     const flags = {
         format: "timeline",
@@ -439,8 +499,12 @@ function parseRuntimeArgs(args, env) {
         includeTranscripts: false,
         all: false,
         action: null,
+        artifactPath: null,
+        assetType: null,
+        assignment: null,
         asRole: "all",
         attempts: false,
+        briefJson: null,
         json: false,
         activeOnly: false,
         actor: null,
@@ -454,7 +518,9 @@ function parseRuntimeArgs(args, env) {
         blocker: null,
         busyWaitSeconds: DEFAULT_BUSY_WAIT_SECONDS,
         candidate: null,
+        campaignName: null,
         check: null,
+        channel: null,
         classifyPrompt: null,
         workerCodexAppThreadId: null,
         workerCodexAppThreadTitle: null,
@@ -480,6 +546,7 @@ function parseRuntimeArgs(args, env) {
         epilogueStatus: false,
         epilogueStep: null,
         eventType: null,
+        expectedThreadId: null,
         failureMode: null,
         file: null,
         finishRun: null,
@@ -487,6 +554,7 @@ function parseRuntimeArgs(args, env) {
         fromText: null,
         fromWorkerResponse: null,
         goal: null,
+        instructions: null,
         keepLatest: 20,
         key: "C-c",
         list: false,
@@ -512,7 +580,10 @@ function parseRuntimeArgs(args, env) {
         require: false,
         requireHandoff: false,
         result: null,
+        reviewNotes: null,
+        roleLabel: null,
         review: false,
+        sessionId: null,
         sessionRole: null,
         sessionState: null,
         show: null,
@@ -523,9 +594,13 @@ function parseRuntimeArgs(args, env) {
         statuses: [],
         statusStaleSeconds: DEFAULT_STATUS_STALE_SECONDS,
         submitRole: null,
+        slot: null,
+        slotKey: null,
         subtype: null,
         summary: null,
         source: null,
+        objective: null,
+        promptSummary: null,
         proof: null,
         purpose: null,
         quietAfterCycles: 3,
@@ -568,8 +643,14 @@ function parseRuntimeArgs(args, env) {
         dispatchReceipt: null,
         force: false,
         message: null,
+        newWorkerThreadId: null,
+        newWorkerThreadTitle: null,
+        oldWorkerThreadId: null,
         reason: null,
         threadId: null,
+        threadTitle: null,
+        title: null,
+        archiveStatus: null,
         consumeNext: false,
         wait: false,
         requireAcks: false,
@@ -937,7 +1018,7 @@ function parseRuntimeArgs(args, env) {
             }
         }
         else if (arg === "--require-handoff") {
-            if (command !== "manager-permission") {
+            if (command !== "manager-permission" && command !== "app-worker-rotation-plan") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --require-handoff", explicit, flags, task };
             }
             flags.requireHandoff = true;
@@ -1037,6 +1118,17 @@ function parseRuntimeArgs(args, env) {
             flags.workerctlPath = value.value;
             index += 1;
         }
+        else if (arg === "--campaign") {
+            if (command !== "dashboard") {
+                return { command, enabled, error: "Unsupported TypeScript runtime option: --campaign", explicit, flags, task };
+            }
+            const value = valueAfter(queue, index, arg);
+            if (value.error) {
+                return { command, enabled, error: value.error, explicit, flags, task };
+            }
+            flags.campaignName = value.value;
+            index += 1;
+        }
         else if (arg === "--output") {
             const value = valueAfter(queue, index, arg);
             if (value.error) {
@@ -1166,7 +1258,7 @@ function parseRuntimeArgs(args, env) {
             index += 1;
         }
         else if (arg === "--metadata-json") {
-            if (command !== "runs" && command !== "loop-evidence") {
+            if (command !== "runs" && command !== "loop-evidence" && command !== "campaign") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --metadata-json", explicit, flags, task };
             }
             const value = valueAfter(queue, index, arg);
@@ -1232,6 +1324,14 @@ function parseRuntimeArgs(args, env) {
             flags.names.push(value.value);
             index += 1;
         }
+        else if (command === "campaign" && Object.prototype.hasOwnProperty.call(CAMPAIGN_STRING_FLAGS, arg)) {
+            const value = valueAfter(queue, index, arg);
+            if (value.error) {
+                return { command, enabled, error: value.error, explicit, flags, task };
+            }
+            flags[CAMPAIGN_STRING_FLAGS[arg]] = value.value;
+            index += 1;
+        }
         else if (arg === "--pid") {
             const parsedValue = valueAfter(queue, index, arg);
             if (parsedValue.error) {
@@ -1668,14 +1768,19 @@ function parseRuntimeArgs(args, env) {
             index += 1;
         }
         else if (arg === "--objective") {
-            if (command !== "manager-config") {
+            if (command !== "manager-config" && command !== "campaign") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --objective", explicit, flags, task };
             }
             const value = valueAfter(queue, index, arg);
             if (value.error) {
                 return { command, enabled, error: value.error, explicit, flags, task };
             }
-            flags.managerObjective = value.value;
+            if (command === "manager-config") {
+                flags.managerObjective = value.value;
+            }
+            else {
+                flags.objective = value.value;
+            }
             index += 1;
         }
         else if (arg === "--recipe") {
@@ -1855,7 +1960,13 @@ function parseRuntimeArgs(args, env) {
             index = queue.length;
         }
         else if (arg === "--reason") {
-            if (command !== "finish-task" && command !== "stop-task" && command !== "record-decision" && command !== "compact-worker" && command !== "app-wakeup-record-delivery") {
+            if (command !== "finish-task"
+                && command !== "stop-task"
+                && command !== "record-decision"
+                && command !== "compact-worker"
+                && command !== "app-wakeup-record-delivery"
+                && command !== "app-worker-rotation-plan"
+                && command !== "app-worker-rotation-record") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --reason", explicit, flags, task };
             }
             const value = valueAfter(queue, index, arg);
@@ -1887,8 +1998,19 @@ function parseRuntimeArgs(args, env) {
             flags.deliveryStatus = value.value;
             index += 1;
         }
+        else if (arg === "--archive-status") {
+            if (command !== "app-worker-rotation-record") {
+                return { command, enabled, error: "Unsupported TypeScript runtime option: --archive-status", explicit, flags, task };
+            }
+            const value = valueAfter(queue, index, arg);
+            if (value.error) {
+                return { command, enabled, error: value.error, explicit, flags, task };
+            }
+            flags.archiveStatus = value.value;
+            index += 1;
+        }
         else if (arg === "--thread-id") {
-            if (command !== "app-wakeup-record-delivery") {
+            if (command !== "app-wakeup-record-delivery" && command !== "campaign") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --thread-id", explicit, flags, task };
             }
             const value = valueAfter(queue, index, arg);
@@ -1898,6 +2020,28 @@ function parseRuntimeArgs(args, env) {
             flags.threadId = value.value;
             index += 1;
         }
+        else if (arg === "--old-worker-thread-id" || arg === "--new-worker-thread-id" || arg === "--new-worker-thread-title") {
+            if (command !== "app-worker-rotation-plan" && command !== "app-worker-rotation-record") {
+                return { command, enabled, error: `Unsupported TypeScript runtime option: ${arg}`, explicit, flags, task };
+            }
+            if (arg !== "--old-worker-thread-id" && command !== "app-worker-rotation-record") {
+                return { command, enabled, error: `Unsupported TypeScript runtime option: ${arg}`, explicit, flags, task };
+            }
+            const value = valueAfter(queue, index, arg);
+            if (value.error) {
+                return { command, enabled, error: value.error, explicit, flags, task };
+            }
+            if (arg === "--old-worker-thread-id") {
+                flags.oldWorkerThreadId = value.value;
+            }
+            else if (arg === "--new-worker-thread-id") {
+                flags.newWorkerThreadId = value.value;
+            }
+            else {
+                flags.newWorkerThreadTitle = value.value;
+            }
+            index += 1;
+        }
         else if (arg === "--message") {
             if (command !== "finish-task"
                 && command !== "stop-task"
@@ -2189,6 +2333,9 @@ function parseRuntimeArgs(args, env) {
                 }
                 flags.statusState = value;
             }
+            else if (command === "campaign") {
+                flags.statusState = value;
+            }
             else if (!isSessionState(value)) {
                 return { command, enabled, error: `Unsupported sessions state: ${value}`, explicit, flags, task };
             }
@@ -2202,7 +2349,7 @@ function parseRuntimeArgs(args, env) {
                 flags.epilogueStatus = true;
                 continue;
             }
-            if (command !== "criteria" && command !== "runs" && command !== "loop-evidence") {
+            if (command !== "criteria" && command !== "runs" && command !== "loop-evidence" && command !== "campaign") {
                 return { command, enabled, error: "Unsupported TypeScript runtime option: --status", explicit, flags, task };
             }
             const parsedValue = valueAfter(queue, index, arg);
@@ -2854,7 +3001,7 @@ function parseRuntimeArgs(args, env) {
             }
         }
         else if (command === "loop-evidence" && flags.subtype === null) {
-            if (!["add", "visual-diff", "visual_diff", "adversarial-check", "adversarial_check"].includes(arg)) {
+            if (!["add", "visual-diff", "visual_diff", "build-passed", "build_passed", "adversarial-check", "adversarial_check"].includes(arg)) {
                 return { command, enabled, error: `Unsupported loop-evidence action: ${arg}`, explicit, flags, task };
             }
             flags.subtype = arg;
@@ -2865,6 +3012,12 @@ function parseRuntimeArgs(args, env) {
             }
             flags.action = arg;
         }
+        else if (command === "campaign" && flags.action === null) {
+            if (!CAMPAIGN_ACTIONS.has(arg)) {
+                return { command, enabled, error: `Unsupported campaign action: ${arg}`, explicit, flags, task };
+            }
+            flags.action = arg;
+        }
         else if ((command === "qa-plan" || command === "qa-run") && flags.subtype === null) {
             flags.subtype = arg;
         }
@@ -3164,7 +3317,7 @@ function runLoopEvidenceCommand(parsed, options) {
     }
     const action = parsed.flags.subtype;
     if (!action) {
-        return unsupportedRuntimeResult(parsed, "loop-evidence requires an action: add, visual-diff, or adversarial-check.");
+        return unsupportedRuntimeResult(parsed, "loop-evidence requires an action: add, visual-diff, build-passed, or adversarial-check.");
     }
     const task = requireTask(parsed);
     if (!parsed.flags.loopRun) {
@@ -3191,6 +3344,24 @@ function runLoopEvidenceCommand(parsed, options) {
             });
             return jsonResult(result);
         }
+        if (action === "build-passed" || action === "build_passed") {
+            if (parsed.flags.evidenceType && parsed.flags.evidenceType !== "build_passed") {
+                return errorResult("loop-evidence build-passed records evidence_type=build_passed; omit --evidence-type or use build_passed.");
+            }
+            const result = recordLoopEvidenceSync(database, {
+                artifactPath: parsed.flags.output,
+                correlationId: parsed.flags.correlationId,
+                evidenceType: "build_passed",
+                iteration: parsed.flags.currentIteration,
+                loopRunId: parsed.flags.loopRun,
+                metadata: jsonObjectArg(parsed.flags.metadataJson, "--metadata-json"),
+                proof: parsed.flags.proof,
+                source,
+                status: parsed.flags.statusState ?? "pass",
+                task,
+            });
+            return jsonResult(result);
+        }
         if (action === "adversarial-check" || action === "adversarial_check") {
             const result = recordAdversarialLoopEvidenceSync(database, {
                 artifactPath: parsed.flags.output,
@@ -3734,6 +3905,319 @@ function runAppWakeupRecordDeliveryCommand(parsed, options) {
         database.close();
     }
 }
+function runAppWorkerRotationPlanCommand(parsed, options) {
+    const taskName = requireTask(parsed);
+    if (!parsed.flags.oldWorkerThreadId) {
+        return errorResult("app-worker-rotation-plan requires --old-worker-thread-id.");
+    }
+    const database = openRuntimeDatabase(parsed, options);
+    try {
+        const timestamp = nowIsoSeconds(options);
+        const dbPath = runtimeDbPath(parsed, options);
+        const plan = appWorkerRotationPlanSync(database, {
+            dbPath,
+            now: timestamp,
+            oldWorkerThreadId: parsed.flags.oldWorkerThreadId,
+            reason: parsed.flags.reason,
+            requireHandoff: parsed.flags.requireHandoff,
+            taskName,
+        });
+        const eventId = emitTelemetrySync(database, {
+            actor: "manager",
+            attributes: {
+                actions: plan.actions.map((action) => ({
+                    status: action.status,
+                    thread_id: action.thread.id,
+                    type: action.type,
+                })),
+                blockers: plan.blockers,
+                eligible: plan.eligible,
+                handoff_id: plan.handoff?.id ?? null,
+                old_worker_thread_id: parsed.flags.oldWorkerThreadId,
+                reason: parsed.flags.reason,
+            },
+            correlation: {
+                command: "app-worker-rotation-plan",
+                old_worker_thread_id: parsed.flags.oldWorkerThreadId,
+            },
+            eventType: "app_worker_rotation_planned",
+            severity: plan.eligible ? "info" : "warning",
+            summary: `Codex app worker rotation ${plan.eligible ? "planned" : "blocked"} for ${plan.task.name}.`,
+            taskId: plan.task.id,
+            timestamp,
+        });
+        const output = {
+            ...plan,
+            receipt: {
+                event_id: eventId,
+                event_type: "app_worker_rotation_planned",
+                recorded_at: timestamp,
+            },
+        };
+        if (parsed.flags.json) {
+            return jsonResult(output);
+        }
+        return {
+            exitCode: 0,
+            handled: true,
+            stdout: renderAppWorkerRotationPlanText(output),
+        };
+    }
+    finally {
+        database.close();
+    }
+}
+function runAppWorkerRotationRecordCommand(parsed, options) {
+    const taskName = requireTask(parsed);
+    if (!parsed.flags.oldWorkerThreadId) {
+        return errorResult("app-worker-rotation-record requires --old-worker-thread-id.");
+    }
+    if (!parsed.flags.newWorkerThreadId) {
+        return errorResult("app-worker-rotation-record requires --new-worker-thread-id.");
+    }
+    const archiveStatus = parseAppWorkerArchiveStatus(parsed.flags.archiveStatus);
+    if (archiveStatus instanceof Error) {
+        return errorResult(archiveStatus.message);
+    }
+    const database = openRuntimeDatabase(parsed, options);
+    try {
+        const timestamp = nowIsoSeconds(options);
+        const dbPath = runtimeDbPath(parsed, options);
+        const plan = appWorkerRotationPlanSync(database, {
+            dbPath,
+            now: timestamp,
+            oldWorkerThreadId: parsed.flags.oldWorkerThreadId,
+            reason: parsed.flags.reason,
+            requireHandoff: false,
+            taskName,
+        });
+        if (!plan.eligible) {
+            throw new Error(`Cannot record worker rotation; active worker ownership check failed: ${plan.blockers.join(", ")}`);
+        }
+        if (archiveStatus === "archived") {
+            database.prepare(`
+        update sessions
+        set codex_app_thread_id = ?, codex_app_thread_title = ?, last_heartbeat_at = null
+        where id = ? and role = 'worker'
+      `).run(parsed.flags.newWorkerThreadId, parsed.flags.newWorkerThreadTitle, plan.old_worker.session_id);
+        }
+        const eventId = emitTelemetrySync(database, {
+            actor: "manager",
+            attributes: {
+                archive_status: archiveStatus,
+                binding_id: plan.guard.binding_id,
+                handoff_id: plan.handoff?.id ?? null,
+                new_worker_thread_id: parsed.flags.newWorkerThreadId,
+                new_worker_thread_title: parsed.flags.newWorkerThreadTitle,
+                old_worker_session_id: plan.old_worker.session_id,
+                old_worker_thread_id: parsed.flags.oldWorkerThreadId,
+                reason: parsed.flags.reason,
+                session_updated: archiveStatus === "archived",
+            },
+            correlation: {
+                command: "app-worker-rotation-record",
+                new_worker_thread_id: parsed.flags.newWorkerThreadId,
+                old_worker_thread_id: parsed.flags.oldWorkerThreadId,
+            },
+            eventType: "app_worker_rotation_recorded",
+            severity: archiveStatus === "archived" ? "info" : "warning",
+            summary: `Codex app worker rotation ${archiveStatus} for ${plan.task.name}.`,
+            taskId: plan.task.id,
+            timestamp,
+        });
+        const output = {
+            archive: {
+                old_worker_thread_id: parsed.flags.oldWorkerThreadId,
+                status: archiveStatus,
+            },
+            guard: plan.guard,
+            new_worker: {
+                codex_app_thread_id: parsed.flags.newWorkerThreadId,
+                codex_app_thread_title: parsed.flags.newWorkerThreadTitle,
+                session_id: plan.old_worker.session_id,
+                session_updated: archiveStatus === "archived",
+            },
+            old_worker: plan.old_worker,
+            receipt: {
+                event_id: eventId,
+                event_type: "app_worker_rotation_recorded",
+                recorded_at: timestamp,
+            },
+            task: plan.task,
+        };
+        if (parsed.flags.json) {
+            return jsonResult(output);
+        }
+        return {
+            exitCode: 0,
+            handled: true,
+            stdout: [
+                `App worker rotation ${archiveStatus} for ${plan.task.name}.`,
+                `Old worker thread: ${parsed.flags.oldWorkerThreadId}`,
+                `New worker thread: ${parsed.flags.newWorkerThreadId}`,
+                `Receipt: ${eventId}`,
+            ].join("\n") + "\n",
+        };
+    }
+    finally {
+        database.close();
+    }
+}
+function parseAppWorkerArchiveStatus(value) {
+    if (value === "archived" || value === "blocked") {
+        return value;
+    }
+    return new Error("app-worker-rotation-record requires --archive-status archived|blocked");
+}
+function appWorkerRotationPlanSync(database, options) {
+    const task = taskRowForPair(database, options.taskName);
+    if (task === null) {
+        throw new Error(`Unknown task: ${options.taskName}`);
+    }
+    const binding = activeBindingForTaskSync(database, task.name);
+    const worker = sessionRow(database, binding.worker_session_name, "worker");
+    const manager = sessionRow(database, binding.manager_session_name, "manager");
+    const handoff = latestWorkerHandoffFullSync(database, task.id);
+    const blockers = [];
+    const exactThreadMatch = worker.codex_app_thread_id === options.oldWorkerThreadId;
+    if (binding.state !== "active") {
+        blockers.push("active_binding_not_active");
+    }
+    if (worker.state !== "active") {
+        blockers.push("worker_session_not_active");
+    }
+    if (worker.tmux_session !== null) {
+        blockers.push("worker_session_is_tmux_backed");
+    }
+    if (!worker.codex_app_thread_id) {
+        blockers.push("missing_worker_codex_app_thread_id");
+    }
+    if (!exactThreadMatch) {
+        blockers.push("old_worker_thread_id_mismatch");
+    }
+    if (manager.id === worker.id || manager.codex_app_thread_id === worker.codex_app_thread_id) {
+        blockers.push("manager_worker_thread_not_distinct");
+    }
+    if (options.requireHandoff) {
+        if (handoff === null) {
+            blockers.push("missing_worker_handoff");
+        }
+        else if (handoff.worker_session_id !== worker.id) {
+            blockers.push("handoff_worker_session_mismatch");
+        }
+    }
+    const guard = {
+        active_binding: binding.state === "active",
+        binding_id: binding.binding_id,
+        exact_thread_match: exactThreadMatch,
+        expected_old_worker_thread_id: options.oldWorkerThreadId,
+        manager_session_id: manager.id,
+        manager_thread_id: manager.codex_app_thread_id,
+        require_handoff: options.requireHandoff,
+        role: "worker",
+        task_id: task.id,
+        worker_session_id: worker.id,
+        worker_state: worker.state,
+    };
+    const eligible = blockers.length === 0;
+    const replacementTitle = replacementWorkerThreadTitle(task.name, worker.codex_app_thread_title);
+    const recordCommand = `${conveyorPollInvocation()} app-worker-rotation-record ${shellQuote(task.name)} --old-worker-thread-id ${shellQuote(options.oldWorkerThreadId)} --new-worker-thread-id <new.thread.id> --new-worker-thread-title <new.thread.title> --archive-status archived --path ${shellQuote(options.dbPath)} --json`;
+    return {
+        actions: eligible
+            ? [
+                {
+                    guard,
+                    prompt: replacementWorkerPrompt({
+                        dbPath: options.dbPath,
+                        handoff,
+                        reason: options.reason,
+                        taskName: task.name,
+                    }),
+                    role: "worker",
+                    send_ready: true,
+                    status: "ready_to_create",
+                    thread: { id: null, title: replacementTitle },
+                    type: "create_replacement_worker_thread",
+                },
+                {
+                    guard,
+                    role: "worker",
+                    send_ready: true,
+                    status: "ready_to_archive",
+                    thread: { id: worker.codex_app_thread_id, title: worker.codex_app_thread_title },
+                    type: "archive_old_worker_thread",
+                },
+            ]
+            : [],
+        blockers,
+        eligible,
+        guard,
+        handoff: handoff === null
+            ? null
+            : {
+                created_at: handoff.created_at,
+                id: handoff.id,
+                next_steps: handoff.next_steps,
+                summary: handoff.summary,
+                worker_session_id: handoff.worker_session_id,
+            },
+        old_worker: {
+            codex_app_thread_id: worker.codex_app_thread_id,
+            codex_app_thread_title: worker.codex_app_thread_title,
+            name: worker.name,
+            session_id: worker.id,
+        },
+        record_command: eligible ? recordCommand : null,
+        task: { id: task.id, name: task.name },
+    };
+}
+function replacementWorkerThreadTitle(taskName, oldTitle) {
+    const base = oldTitle && oldTitle.trim().length > 0 ? oldTitle.trim() : `${taskName} worker`;
+    return `${base} fresh`;
+}
+function replacementWorkerPrompt(options) {
+    const handoffLines = options.handoff === null
+        ? ["No saved handoff was required for this rotation plan."]
+        : [
+            `Saved handoff id: ${String(options.handoff.id)}`,
+            `Saved handoff summary: ${String(options.handoff.summary)}`,
+            `Saved handoff next steps: ${JSON.stringify(options.handoff.next_steps ?? [])}`,
+        ];
+    return [
+        "Use the manage-codex-workers skill.",
+        `You are the replacement Codex app worker thread for task ${options.taskName}.`,
+        options.reason ? `Rotation reason: ${options.reason}` : "Rotation reason: fresh worker context for Codex app usage.",
+        ...handoffLines,
+        "",
+        "Resume from the saved handoff and continue through Conveyor only. Do not rely on the archived worker thread for context beyond the handoff above.",
+        ...visibleSessionProtocolLines("worker"),
+        `Run: ${disposableAppHeartbeatCommand("worker", options.taskName, options.dbPath)}`,
+        `If the heartbeat output asks for direct inbox polling, run: ${sessionPollCommand("worker", options.taskName, options.dbPath)}`,
+        "If no item is consumed, stop after a one-line idle receipt.",
+    ].join("\n");
+}
+function renderAppWorkerRotationPlanText(plan) {
+    const lines = [
+        `App worker rotation for ${plan.task.name}: ${plan.eligible ? "ready" : "blocked"}`,
+        `Old worker thread: ${plan.old_worker.codex_app_thread_id ?? "(missing)"}`,
+    ];
+    if (plan.blockers.length > 0) {
+        lines.push(`Blockers: ${plan.blockers.join(", ")}`);
+    }
+    for (const action of plan.actions) {
+        lines.push(`${action.type}: ${action.status}`);
+        if (action.thread.id || action.thread.title) {
+            lines.push(`  thread: ${action.thread.title ?? "(untitled)"} ${action.thread.id ?? "(new)"}`);
+        }
+    }
+    if (plan.record_command) {
+        lines.push(`Record after app tools: ${plan.record_command}`);
+    }
+    if (plan.receipt) {
+        lines.push(`Receipt: ${plan.receipt.event_id}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
 function runAppAutopilotCommand(parsed, options) {
     const action = parsed.flags.action;
     if (action !== "start" && action !== "stop" && action !== "status") {
@@ -4049,6 +4533,7 @@ const QA_PLAN_SCENARIOS = new Set([
     "tmux-errors",
     "dispatch-completion",
     "ralph-loop",
+    "ship-it-loop",
     "adversarial-triggers",
     "goalbuddy-conveyor",
 ]);
@@ -4182,6 +4667,52 @@ function qaPlan(scenario) {
             ],
         };
     }
+    if (scenario === "ship-it-loop") {
+        return {
+            authority_boundaries: [
+                "Do not push a branch before repo.push_branch is permitted.",
+                "Do not open or update a PR before repo.open_pr is permitted.",
+                "Do not treat CI monitoring as CI truth; record explicit ci_green evidence.",
+                "Do not resolve conflicts without a bounded manager instruction and retry limit.",
+                "Do not merge before repo.merge_green_pr, ci_green, mergeability, manager_merge_decision, merge, post_merge_verification, and adversarial_check evidence exist.",
+            ],
+            correlation_markers: [
+                { correlation_id: "ship-it-push-permission", purpose: "push branch permission gate" },
+                { correlation_id: "ship-it-open-pr-permission", purpose: "open PR permission gate" },
+                { correlation_id: "ship-it-merge-permission", purpose: "merge permission gate" },
+                { correlation_id: "ship-it-missing-evidence", purpose: "missing lifecycle evidence block" },
+                { correlation_id: "ship-it-conflict-block", purpose: "conflict retry limit proof" },
+                { correlation_id: "ship-it-allowed-closeout", purpose: "allowed closeout after all lifecycle evidence" },
+            ],
+            evidence_template: {
+                branch_ready: { branch: "<branch>", commit_sha: "<sha>" },
+                branch_pushed: { remote: "origin", branch: "<branch>" },
+                pr_url: { url: "<pull request URL>" },
+                ci_green: { command: "gh pr checks --required", status: "green" },
+                mergeability_clean: { conflicts: false, mergeable_state: "clean" },
+                manager_merge_decision: { decision: "merge_ready", manager_verified: true },
+                merge: { merge_sha: "<sha>" },
+                post_merge_verification: { command: "<post-merge check>", status: "pass" },
+                adversarial_check: { failure_mode: "<risk>", check: "<proof>", result: "<outcome>" },
+            },
+            expected_observations: [
+                "push, PR creation, and merge commands fail closed until their manager permissions are granted",
+                "missing lifecycle evidence blocks a continue_iteration before worker delivery",
+                "unresolved conflicts are represented as bounded blockers, not hidden behind CI green",
+                "a fresh retry delivers only after branch, PR, CI, mergeability, manager decision, merge, post-merge, and adversarial evidence exists",
+                "the recipe and prompts keep merge readiness as a manager decision, not a worker claim",
+            ],
+            scenario,
+            steps: [
+                "Create a disposable no-tmux task with the ship_it_loop template.",
+                "Run the permission-gate checks for repo.push_branch, repo.open_pr, and repo.merge_green_pr.",
+                "Attempt a lifecycle continuation before evidence and verify missing evidence blocks before worker delivery.",
+                "Record partial PR/CI evidence and verify mergeability/manager-decision/merge/post-merge proof is still required.",
+                "Record conflict retry-limit evidence as blocked when unresolved.",
+                "Record all lifecycle receipts plus structured adversarial proof and verify a fresh retry reaches the worker inbox.",
+            ],
+        };
+    }
     if (scenario === "adversarial-triggers") {
         return {
             correlation_markers: [
@@ -4282,6 +4813,7 @@ const SUPPORTED_QA_RUN_SCENARIOS = new Set([
     "generic-loop-template",
     "generic-loop-template-browser",
     "ralph-loop-guardrails",
+    "ship-it-loop",
     "test-coverage-loop",
 ]);
 function isSupportedQaRunScenario(scenario) {
@@ -4324,6 +4856,9 @@ function runQaScenario(scenario, context) {
     if (scenario === "build-clear-loop") {
         return qaRunBuildClearLoop(context);
     }
+    if (scenario === "ship-it-loop") {
+        return qaRunShipItLoop(context);
+    }
     if (scenario === "adversarial-triggers") {
         return qaRunAdversarialTriggers(context);
     }
@@ -4669,6 +5204,166 @@ function qaRunBuildClearLoop(context) {
         template_metadata: templateMetadata,
     };
 }
+function qaRunShipItLoop(context) {
+    const slug = randomUUID().slice(0, 8);
+    const checks = [];
+    const generatedTasks = [];
+    const pushTask = createQaBoundTask(context, slug, "ship-it-push-permission");
+    generatedTasks.push(generatedTask(pushTask, "ship-it-push-permission"));
+    checks.push(qaRunPermissionGate(context, pushTask, {
+        checkName: "ship_it_push_branch_requires_repo_push_branch",
+        correlationId: "ship-it-push-permission-denied",
+        message: "Push branch origin/codex/ship-it-loop.",
+        permission: "repo.push_branch",
+    }));
+    qaConfigureManagerPermissions(context, pushTask, ["repo.push_branch"]);
+    checks.push(qaRunPermissionGate(context, pushTask, {
+        checkName: "ship_it_push_branch_delivers_after_permission",
+        correlationId: "ship-it-push-permission-allowed",
+        expectAllowed: true,
+        message: "Push branch origin/codex/ship-it-loop after manager permission.",
+        permission: "repo.push_branch",
+    }));
+    const prTask = createQaBoundTask(context, slug, "ship-it-open-pr-permission");
+    generatedTasks.push(generatedTask(prTask, "ship-it-open-pr-permission"));
+    checks.push(qaRunPermissionGate(context, prTask, {
+        checkName: "ship_it_open_pr_requires_repo_open_pr",
+        correlationId: "ship-it-open-pr-permission-denied",
+        message: "Open PR for ship-it loop.",
+        permission: "repo.open_pr",
+    }));
+    qaConfigureManagerPermissions(context, prTask, ["repo.open_pr"]);
+    checks.push(qaRunPermissionGate(context, prTask, {
+        checkName: "ship_it_open_pr_delivers_after_permission",
+        correlationId: "ship-it-open-pr-permission-allowed",
+        expectAllowed: true,
+        message: "Open PR for ship-it loop after manager permission.",
+        permission: "repo.open_pr",
+    }));
+    const mergeTask = createQaBoundTask(context, slug, "ship-it-merge-permission");
+    generatedTasks.push(generatedTask(mergeTask, "ship-it-merge-permission"));
+    checks.push(qaRunPermissionGate(context, mergeTask, {
+        checkName: "ship_it_merge_requires_repo_merge_green_pr",
+        correlationId: "ship-it-merge-permission-denied",
+        message: "Merge PR after verified closeout.",
+        permission: "repo.merge_green_pr",
+    }));
+    qaConfigureManagerPermissions(context, mergeTask, ["repo.merge_green_pr"]);
+    checks.push(qaRunPermissionGate(context, mergeTask, {
+        checkName: "ship_it_merge_delivers_after_permission",
+        correlationId: "ship-it-merge-permission-allowed",
+        expectAllowed: true,
+        message: "Merge PR after verified closeout and manager permission.",
+        permission: "repo.merge_green_pr",
+    }));
+    const lifecycleTask = createQaBoundTask(context, slug, "ship-it-lifecycle");
+    generatedTasks.push(generatedTask(lifecycleTask, "ship-it-lifecycle"));
+    const templateMetadata = loopTemplateMetadata("ship_it_loop", {
+        currentIteration: 1,
+        maxIterations: 2,
+        seedPromptSha256: "qa-run-ship-it-seed",
+    });
+    const run = createQaRalphLoopRun(context, lifecycleTask, {
+        currentIteration: 1,
+        maxIterations: 2,
+        metadata: templateMetadata,
+        preset: "ship_it_loop",
+        requiredBeforeContinue: asStringArray(templateMetadata.required_before_continue),
+        seedPromptSha256: "qa-run-ship-it-seed",
+        stopConditions: asStringArray(templateMetadata.stop_conditions),
+    });
+    enqueueQaContinue(context, lifecycleTask, run.id, "ship-it-missing-evidence", "Run ship-it continuation before lifecycle evidence.");
+    const missing = qaDispatchContinueOnce(context, "ship-it-missing-evidence");
+    const missingCounts = qaDeliveryCounts(context, lifecycleTask);
+    qaExpectBlocked(missing, missingCounts, {
+        message: "ship_it_loop missing lifecycle evidence",
+        missingEvidence: asStringArray(templateMetadata.required_before_continue),
+        reason: "missing_required_evidence",
+    });
+    checks.push(qaCheck("ship_it_lifecycle_blocks_before_any_evidence", missing, missingCounts));
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "branch_ready", "ship-it-branch-ready", {
+        metadata: { branch: "codex/ship-it-loop", commit_sha: "1111111111111111111111111111111111111111" },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "branch_pushed", "ship-it-branch-pushed", {
+        metadata: { branch: "codex/ship-it-loop", remote: "origin" },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "pr_url", "ship-it-pr-url", {
+        metadata: { url: "https://github.example.test/acme/repo/pull/42" },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "ci_green", "ship-it-ci-green", {
+        metadata: { command: "gh pr checks 42 --required", status: "green" },
+        status: "green",
+    });
+    enqueueQaContinue(context, lifecycleTask, run.id, "ship-it-partial-evidence", "Run ship-it continuation after PR and CI but before merge readiness.");
+    const partial = qaDispatchContinueOnce(context, "ship-it-partial-evidence");
+    const partialCounts = qaDeliveryCounts(context, lifecycleTask);
+    qaExpectBlocked(partial, partialCounts, {
+        message: "ship_it_loop partial lifecycle evidence",
+        missingEvidence: ["mergeability_clean", "manager_merge_decision", "merge", "post_merge_verification", "adversarial_check"],
+        reason: "missing_required_evidence",
+    });
+    checks.push(qaCheck("ship_it_lifecycle_blocks_before_mergeability_and_manager_decision", partial, partialCounts));
+    const artifactDir = qaArtifactDir(context, "ship-it-loop", slug, run.id);
+    const conflictReceipt = join(artifactDir, "conflict-blocked.json");
+    mkdirSync(dirname(conflictReceipt), { recursive: true });
+    const conflictPayload = {
+        conflict_state: "unresolved",
+        max_retries: 2,
+        retry_count: 2,
+        status: "blocked",
+        stop_reason: "conflict_retry_limit_reached",
+    };
+    writeFileSync(conflictReceipt, `${JSON.stringify(sortJson(conflictPayload), null, 2)}\n`);
+    checks.push({
+        artifact_path: conflictReceipt,
+        conflict: conflictPayload,
+        name: "ship_it_conflict_retry_blocks_after_limit",
+        status: "passed",
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "mergeability_clean", "ship-it-mergeability-clean", {
+        metadata: { conflicts: false, mergeable_state: "clean" },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "manager_merge_decision", "ship-it-manager-merge-decision", {
+        metadata: { decision: "merge_ready", manager_verified: true },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "merge", "ship-it-merge", {
+        metadata: { merge_sha: "2222222222222222222222222222222222222222" },
+    });
+    qaRecordLoopEvidence(context, lifecycleTask, run.id, "post_merge_verification", "ship-it-post-merge-verification", {
+        metadata: { command: "git rev-parse HEAD && npm test -- --runInBand", status: "pass" },
+    });
+    qaRecordAdversarialEvidence(context, lifecycleTask, run.id, "ship-it-adversarial-proof", {
+        check: "Inspect permission denials, missing-evidence blocks, conflict retry receipt, and final evidence set.",
+        failure_mode: "A ship-it loop could merge after CI green while conflicts, manager decision, or post-merge proof are missing.",
+        result: "Dispatch stayed blocked until mergeability, manager decision, merge, post-merge, and adversarial receipts were present.",
+    });
+    enqueueQaContinue(context, lifecycleTask, run.id, "ship-it-allowed-closeout", "Run ship-it continuation after all lifecycle evidence.");
+    const allowed = qaDispatchContinueOnce(context, "ship-it-allowed-closeout");
+    const allowedCounts = qaDeliveryCounts(context, lifecycleTask);
+    qaExpectDelivered(allowed, allowedCounts, "ship_it_loop allowed closeout");
+    checks.push(qaCheck("ship_it_lifecycle_retry_delivers_after_all_evidence", allowed, allowedCounts));
+    return {
+        artifacts: { conflict_receipt: conflictReceipt, db_path: context.dbPath },
+        checks,
+        generated_at: new Date().toISOString(),
+        generated_tasks: generatedTasks,
+        replay_commands: [
+            "conveyor loop-templates --show ship_it_loop --json",
+            "conveyor manager-recipes --show ship-it-loop --json",
+            "conveyor manager-permission <task> repo.push_branch --require",
+            "conveyor manager-permission <task> repo.open_pr --require",
+            "conveyor manager-permission <task> repo.merge_green_pr --require",
+            "conveyor loop-evidence add <task> --loop-run <run-id> --iteration 1 --evidence-type branch_ready",
+            "conveyor loop-evidence add <task> --loop-run <run-id> --iteration 1 --evidence-type ci_green",
+            "conveyor loop-evidence adversarial-check <task> --loop-run <run-id> --iteration 1 --failure-mode <failure> --check <check> --result <result>",
+            `conveyor dispatch --once --type continue_iteration --dispatcher-id ${context.dispatcherId} --path ${context.dbPath}`,
+        ],
+        result: "passed",
+        scenario: "ship-it-loop",
+        template: "ship_it_loop",
+        template_metadata: templateMetadata,
+    };
+}
 function qaRunAdversarialTriggers(context) {
     const slug = randomUUID().slice(0, 8);
     const triggerDefinitions = listLoopTriggers();
@@ -4966,24 +5661,27 @@ function enqueueQaContinue(context, task, runId, correlationId, message) {
     }
 }
 function qaDispatchContinueOnce(context, expectedCorrelationId) {
+    return qaDispatchCommandOnce(context, "continue_iteration", expectedCorrelationId);
+}
+function qaDispatchCommandOnce(context, commandType, expectedCorrelationId) {
     const before = openDatabaseSync(context.dbPath);
     try {
         initializeDatabaseSync(before);
         const rows = before.prepare(`
       select correlation_id, state
       from commands
-      where type = 'continue_iteration' and state in ('pending', 'attempted')
+      where type = ? and state in ('pending', 'attempted')
       order by created_at, id
-    `).all();
+    `).all(commandType);
         const seen = rows.map((row) => `${row.correlation_id}:${row.state}`);
         if (rows.length !== 1 || rows[0]?.correlation_id !== expectedCorrelationId || rows[0]?.state !== "pending") {
-            throw new Error(`qa-run continue_iteration dispatch queue is not clean; expected only ${expectedCorrelationId}, found ${JSON.stringify(seen)}`);
+            throw new Error(`qa-run ${commandType} dispatch queue is not clean; expected only ${expectedCorrelationId}, found ${JSON.stringify(seen)}`);
         }
     }
     finally {
         before.close();
     }
-    const parsed = parseRuntimeArgs(["dispatch", "--type", "continue_iteration", "--path", context.dbPath], {
+    const parsed = parseRuntimeArgs(["dispatch", "--type", commandType, "--path", context.dbPath], {
         AGENT_CONVEYOR_TS_RUNTIME: "1",
     });
     const processed = dispatchOncePass(parsed, context.runtimeOptions, {
@@ -4993,13 +5691,68 @@ function qaDispatchContinueOnce(context, expectedCorrelationId) {
         limit: 1,
     });
     if (processed.length !== 1) {
-        throw new Error(`expected exactly one continue_iteration dispatch item, got ${processed.length}`);
+        throw new Error(`expected exactly one ${commandType} dispatch item, got ${processed.length}`);
     }
     if (processed[0]?.correlation_id !== expectedCorrelationId) {
         throw new Error(`qa-run dispatched unexpected command ${String(processed[0]?.correlation_id)}`);
     }
     return processed[0] ?? {};
 }
+function qaConfigureManagerPermissions(context, task, permissions) {
+    const result = runTypescriptRuntimeCommand({
+        ...context.runtimeOptions,
+        args: [
+            "manager-config",
+            task.task_name,
+            "--mode",
+            "strict",
+            "--objective",
+            "Ship-it lifecycle QA permission contract.",
+            ...permissions.flatMap((permission) => ["--permit", permission]),
+            "--path",
+            context.dbPath,
+        ],
+        env: {
+            ...(context.runtimeOptions.env ?? {}),
+            AGENT_CONVEYOR_TS_RUNTIME: "1",
+        },
+    });
+    qaRequire(result.exitCode === 0, `manager-config permission setup failed: ${result.stderr ?? result.stdout ?? ""}`);
+}
+function qaRunPermissionGate(context, task, options) {
+    const database = openDatabaseSync(context.dbPath);
+    try {
+        initializeDatabaseSync(database);
+        createCommandSync(database, {
+            commandType: "nudge_worker",
+            correlationId: options.correlationId,
+            payload: { message: options.message, ship_it: { required_permission: options.permission } },
+            requiredPermission: options.permission,
+            taskId: task.task_id,
+        });
+    }
+    finally {
+        database.close();
+    }
+    const dispatch = qaDispatchCommandOnce(context, "nudge_worker", options.correlationId);
+    const counts = qaDeliveryCounts(context, task);
+    if (options.expectAllowed === true) {
+        qaExpectDelivered(dispatch, counts, `${options.permission} permission gate`);
+    }
+    else {
+        qaRequire(dispatch.state === "failed", `${options.permission} gate did not fail without permission`);
+        qaRequire(String(dispatch.error ?? "").includes("manager permission required"), `${options.permission} gate failed for the wrong reason`);
+        qaRequire(counts.worker_inbox_count === 0, `${options.permission} denied gate left worker inbox mail`);
+    }
+    return {
+        ...counts,
+        command_type: "nudge_worker",
+        dispatch,
+        name: options.checkName,
+        permission: options.permission,
+        status: "passed",
+    };
+}
 function qaDeliveryCounts(context, task) {
     const database = openDatabaseSync(context.dbPath);
     try {
@@ -5309,6 +6062,269 @@ function runTasksCommand(parsed, options) {
         database.close();
     }
 }
+function runCampaignCommand(parsed, options) {
+    if (parsed.task) {
+        return errorResult(`Unexpected argument: ${parsed.task}`);
+    }
+    const action = parsed.flags.action;
+    if (!action) {
+        return errorResult("campaign requires an action: create, add-slot, brief, assign, asset, or status");
+    }
+    const campaign = campaignNameArg(parsed);
+    const database = openRuntimeDatabase(parsed, options);
+    try {
+        if (action === "create") {
+            const objective = requiredStringFlag(parsed.flags.objective, "--objective");
+            const metadata = jsonObjectArg(parsed.flags.metadataJson, "--metadata-json");
+            const campaignId = createCampaignSync(database, {
+                metadata,
+                name: campaign,
+                objective,
+            });
+            return campaignResult(parsed, {
+                action,
+                campaign,
+                campaign_id: campaignId,
+                created: true,
+            }, [`campaign ${campaign} created ${campaignId}`]);
+        }
+        if (action === "add-slot") {
+            const slotKey = requiredStringFlag(parsed.flags.slotKey, "--slot-key");
+            const roleLabel = requiredStringFlag(parsed.flags.roleLabel, "--role-label");
+            const state = campaignSlotStateArg(parsed.flags.statusState);
+            const metadata = jsonObjectArg(parsed.flags.metadataJson, "--metadata-json");
+            const slotId = addCampaignWorkerSlotSync(database, {
+                campaign,
+                channel: parsed.flags.channel,
+                codexAppThreadId: parsed.flags.threadId,
+                codexAppThreadTitle: parsed.flags.threadTitle,
+                metadata,
+                roleLabel,
+                sessionId: parsed.flags.sessionId,
+                slotKey,
+                ...(state ? { state } : {}),
+            });
+            return campaignResult(parsed, {
+                action,
+                campaign,
+                created: true,
+                slot_id: slotId,
+                slot_key: slotKey,
+            }, [`campaign ${campaign} slot ${slotKey} created ${slotId}`]);
+        }
+        if (action === "attach-slot") {
+            const slot = requiredStringFlag(parsed.flags.slot, "--slot");
+            const state = campaignSlotStateArg(parsed.flags.statusState) ?? "active";
+            const record = updateCampaignWorkerSlotLifecycleSync(database, {
+                campaign,
+                codexAppThreadId: parsed.flags.threadId,
+                codexAppThreadTitle: parsed.flags.threadTitle,
+                metadata: jsonObjectArg(parsed.flags.metadataJson, "--metadata-json"),
+                sessionId: parsed.flags.sessionId,
+                slot,
+                state,
+            });
+            return campaignResult(parsed, {
+                action,
+                campaign,
+                slot: record,
+                updated: true,
+            }, [`campaign ${campaign} slot ${record.slot_key} attached ${record.id}`]);
+        }
+        if (action === "rotate-slot") {
+            const slot = requiredStringFlag(parsed.flags.slot, "--slot");
+            const expectedThreadId = requiredStringFlag(parsed.flags.expectedThreadId, "--expected-thread-id");
+            const nextThreadId = requiredStringFlag(parsed.flags.threadId, "--thread-id");
+            const record = updateCampaignWorkerSlotLifecycleSync(database, {
+                campaign,
+                codexAppThreadId: nextThreadId,
+                codexAppThreadTitle: parsed.flags.threadTitle,
+                expectedThreadId,
+                sessionId: parsed.flags.sessionId,
+                slot,
+                state: campaignSlotStateArg(parsed.flags.statusState) ?? "active",
+            });
+            return campaignResult(parsed, {
+                action,
+                campaign,
+                expected_thread_id: expectedThreadId,
+                slot: record,
+                updated: true,
+            }, [`campaign ${campaign} slot ${record.slot_key} rotated ${expectedThreadId} -> ${record.codex_app_thread_id ?? "none"}`]);
+        }
+        if (action === "archive-slot") {
+            const slot = requiredStringFlag(parsed.flags.slot, "--slot");
+            const expectedThreadId = requiredStringFlag(parsed.flags.expectedThreadId, "--expected-thread-id");
+            const record = updateCampaignWorkerSlotLifecycleSync(database, {
+                campaign,
+                expectedThreadId,
+                slot,
+                state: "archived",
+            });
+            return campaignResult(parsed, {
+                action,
+                campaign,
+                expected_thread_id: expectedThreadId,
+                slot: record,
+                updated: true,
+            }, [`campaign ${campaign} slot ${record.slot_key} archived ${record.id}`]);
+        }
+        if (action === "brief") {
+            const channel = requiredStringFlag(parsed.flags.channel, "--channel");
+            if (parsed.flags.briefJson === null) {
+                return errorResult("campaign brief requires --brief-json");
+            }
+            const briefId = upsertCampaignChannelBriefSync(database, {
+                brief: jsonObjectArg(parsed.flags.briefJson, "--brief-json"),
+                campaign,
+                channel,
+            });
+            return campaignResult(parsed, {
+                action,
+                brief_id: briefId,
+                campaign,
+                channel,
+                upserted: true,
+            }, [`campaign ${campaign} brief ${channel} upserted ${briefId}`]);
+        }
+        if (action === "assign") {
+            const slot = requiredStringFlag(parsed.flags.slot, "--slot");
+            const title = requiredStringFlag(parsed.flags.title, "--title");
+            const instructions = requiredStringFlag(parsed.flags.instructions, "--instructions");
+            const status = campaignAssignmentStatusArg(parsed.flags.statusState);
+            const metadata = jsonObjectArg(parsed.flags.metadataJson, "--metadata-json");
+            const assignmentId = createCampaignAssignmentSync(database, {
+                campaign,
+                instructions,
+                metadata,
+                slot,
+                title,
+                ...(status ? { status } : {}),
+            });
+            return campaignResult(parsed, {
+                action,
+                assignment_id: assignmentId,
+                campaign,
+                created: true,
+                slot_id: slot,
+            }, [`campaign ${campaign} assignment created ${assignmentId}`]);
+        }
+        if (action === "asset") {
+            const slot = requiredStringFlag(parsed.flags.slot, "--slot");
+            const title = requiredStringFlag(parsed.flags.title, "--title");
+            const assetType = campaignAssetTypeArg(requiredStringFlag(parsed.flags.assetType, "--asset-type"));
+            const status = campaignAssetStatusArg(parsed.flags.statusState);
+            const metadata = jsonObjectArg(parsed.flags.metadataJson, "--metadata-json");
+            const assetReceiptId = recordCampaignAssetReceiptSync(database, {
+                artifactPath: parsed.flags.artifactPath,
+                assetType,
+                assignment: parsed.flags.assignment,
+                campaign,
+                channel: parsed.flags.channel,
+                metadata,
+                promptSummary: parsed.flags.promptSummary,
+                reviewNotes: parsed.flags.reviewNotes,
+                slot,
+                title,
+                ...(status ? { status } : {}),
+            });
+            return campaignResult(parsed, {
+                action,
+                asset_receipt_id: assetReceiptId,
+                campaign,
+                created: true,
+                slot_id: slot,
+            }, [`campaign ${campaign} asset receipt created ${assetReceiptId}`]);
+        }
+        if (action === "status") {
+            const status = campaignStatusSync(database, campaign);
+            return campaignResult(parsed, status, renderCampaignStatusText(status));
+        }
+        if (action === "dashboard") {
+            const dashboard = campaignDashboardSync(database, campaign);
+            return campaignResult(parsed, dashboard, renderCampaignDashboardText(dashboard));
+        }
+        return errorResult(`Unsupported campaign action: ${action}`);
+    }
+    finally {
+        database.close();
+    }
+}
+function campaignResult(parsed, payload, lines) {
+    return parsed.flags.json ? jsonResult(payload) : textResult(lines);
+}
+function campaignNameArg(parsed) {
+    if (parsed.flags.names.length !== 1) {
+        throw new Error("campaign requires exactly one --name <campaign>");
+    }
+    return parsed.flags.names[0];
+}
+function requiredStringFlag(value, flag) {
+    if (value === null || value.length === 0) {
+        throw new Error(`campaign requires ${flag}`);
+    }
+    return value;
+}
+function campaignSlotStateArg(value) {
+    if (value === null) {
+        return undefined;
+    }
+    if (value === "active" || value === "archived" || value === "blocked" || value === "idle" || value === "planned") {
+        return value;
+    }
+    throw new Error("--state must be one of: active, archived, blocked, idle, planned");
+}
+function campaignAssignmentStatusArg(value) {
+    if (value === null) {
+        return undefined;
+    }
+    if (value === "active" || value === "blocked" || value === "cancelled" || value === "done" || value === "queued") {
+        return value;
+    }
+    throw new Error("--status must be one of: active, blocked, cancelled, done, queued");
+}
+function campaignAssetStatusArg(value) {
+    if (value === null) {
+        return undefined;
+    }
+    if (value === "approved" || value === "draft" || value === "needs_review" || value === "published" || value === "rejected") {
+        return value;
+    }
+    throw new Error("--status must be one of: approved, draft, needs_review, published, rejected");
+}
+function campaignAssetTypeArg(value) {
+    if (value === "audio" || value === "copy" || value === "hyperframes" || value === "image" || value === "other" || value === "video") {
+        return value;
+    }
+    throw new Error("--asset-type must be one of: audio, copy, hyperframes, image, other, video");
+}
+function renderCampaignStatusText(status) {
+    return [
+        `campaign ${status.campaign.name} ${status.campaign.status}`,
+        `slots ${status.slots.length}`,
+        `assignments ${statusCountsText(status.assignment_counts)}`,
+        `assets ${statusCountsText(status.asset_counts)}`,
+        `briefs ${status.channel_briefs.length}`,
+    ];
+}
+function renderCampaignDashboardText(dashboard) {
+    const lines = [
+        `campaign ${dashboard.campaign.name} ${dashboard.campaign.status}`,
+        `next ${dashboard.next_manager_action.action}: ${dashboard.next_manager_action.reason}`,
+        `workers active=${dashboard.summary.active_slots} stale=${dashboard.summary.stale_slots} blocked=${dashboard.summary.blocked_slots} archived=${dashboard.summary.archived_slots}`,
+        `assignments ${statusCountsText(dashboard.assignment_counts)}`,
+        `assets ${statusCountsText(dashboard.asset_counts)}`,
+        `approvals needs_review=${dashboard.approvals.needs_review} approved=${dashboard.approvals.approved} rejected=${dashboard.approvals.rejected} published=${dashboard.approvals.published}`,
+        `blockers ${dashboard.blockers.length}`,
+    ];
+    for (const slot of dashboard.slots.slice(0, 8)) {
+        lines.push(`slot ${slot.slot_key} ${slot.state} ${slot.lifecycle.state} assignments=${slot.assignments.length} assets=${slot.assets.length}`);
+    }
+    return lines;
+}
+function statusCountsText(counts) {
+    return Object.entries(counts).map(([status, count]) => `${status}=${count}`).join(" ");
+}
 function runLegacyStartCommand(parsed, options) {
     if (!parsed.task) {
         return errorResult("start requires a session.");
@@ -5503,7 +6519,14 @@ function runInstallSkillsCommand(parsed, options) {
     return { exitCode: 0, handled: true, stdout: `${lines.join("\n")}\n` };
 }
 function dashboardLaunchPayload(parsed) {
-    const query = parsed.flags.taskName ? `?task=${encodeURIComponent(parsed.flags.taskName)}` : "";
+    const queryParams = new URLSearchParams();
+    if (parsed.flags.taskName) {
+        queryParams.set("task", parsed.flags.taskName);
+    }
+    if (parsed.flags.campaignName) {
+        queryParams.set("campaign", parsed.flags.campaignName);
+    }
+    const query = queryParams.toString() ? `?${queryParams.toString()}` : "";
     const command = [
         "npm",
         "run",
@@ -5519,6 +6542,9 @@ function dashboardLaunchPayload(parsed) {
     if (parsed.flags.taskName) {
         command.push("--task", parsed.flags.taskName);
     }
+    if (parsed.flags.campaignName) {
+        command.push("--campaign", parsed.flags.campaignName);
+    }
     if (parsed.flags.path) {
         command.push("--db-path", parsed.flags.path);
     }
@@ -5529,6 +6555,7 @@ function dashboardLaunchPayload(parsed) {
         ensure_dispatch: parsed.flags.require,
         host: parsed.flags.host,
         port: parsed.flags.port,
+        campaign: parsed.flags.campaignName,
         task: parsed.flags.taskName,
         url: `http://${parsed.flags.host}:${parsed.flags.port}/${query}`,
     };
@@ -11942,8 +12969,10 @@ const MANAGER_PERMISSION_ACTION_NAMES = new Set([
     "context.fetch_prs",
     "context.spawn_reviewer",
     "repo.merge_green_pr",
+    "repo.monitor_ci",
     "repo.open_pr",
     "repo.push_branch",
+    "repo.resolve_conflicts",
     "verification.run_cargo",
     "verification.run_playwright",
     "verification.run_pytest",
@@ -14100,6 +15129,7 @@ const DEFERRED_HEADING_RE = /\b(follow[- ]?up|deferred)\b/i;
 const LIST_ITEM_RE = /^\s*(?:[-*+]|\d+[.)]|\[[ xX]\])\s+(?<text>.+?)\s*$/;
 const EMPTY_ITEM_RE = /^(?:n\/?a|none|no follow[- ]?ups?|no deferred(?: criteria)?|nothing)$/i;
 const INDENTED_CONTINUATION_RE = /^\s+\S/;
+const CLOSEOUT_CRITERION_RE = /\b(?:finish-task|require-criteria-audit|task (?:is )?(?:marked )?done|mark(?:ed)? (?:the )?task done|terminal closeout|verified task closeout|heartbeat teardown|final manager (?:report|decision)|manager final (?:report|handoff)|closeout proof|control-plane closeout)\b/i;
 function planCriteriaCommands(task, text, options) {
     const { suggestions, warnings } = parseWorkerCriteriaResponse(text);
     return {
@@ -14161,6 +15191,11 @@ function parseWorkerCriteriaResponse(text) {
     else if (suggestions.length === 0) {
         warnings.push("Clear criteria headings were found, but no bullet or numbered criteria items were detected.");
     }
+    for (const suggestion of suggestions) {
+        if (suggestion.classification?.kind === "manager_closeout_proof") {
+            warnings.push(`Criterion "${suggestion.criterion}" appears to describe manager closeout/control-plane proof. Keep closeout proof in the manager final report, audit, replay, or epilogue evidence instead of accepted worker/task criteria unless this task is explicitly Conveyor closeout QA.`);
+        }
+    }
     return { suggestions, warnings };
 }
 function headingStatus(line) {
@@ -14182,12 +15217,23 @@ function makeCriteriaSuggestion(text, status) {
         return null;
     }
     return {
+        classification: classifyCriteriaSuggestion(criterion),
         criterion,
         rationale: status === "deferred" ? DEFAULT_DEFERRED_RATIONALE : null,
         source: "worker_proposed",
         status,
     };
 }
+function classifyCriteriaSuggestion(criterion) {
+    if (!CLOSEOUT_CRITERION_RE.test(criterion)) {
+        return null;
+    }
+    return {
+        kind: "manager_closeout_proof",
+        reason: "The criterion names manager closeout mechanics rather than the worker/task outcome being accepted.",
+        recommendation: "keep_out_of_acceptance_criteria",
+    };
+}
 function suggestionToArgv(task, suggestion, options) {
     const argv = [
         "conveyor",
@@ -14257,6 +15303,8 @@ function isDefaultRuntimeCommand(command) {
         || command === "app-wakeup-plan"
         || command === "app-wakeup-dispatch"
         || command === "app-wakeup-record-delivery"
+        || command === "app-worker-rotation-plan"
+        || command === "app-worker-rotation-record"
         || command === "app-autopilot"
         || command === "loop-templates"
         || command === "loop-triggers"
@@ -14272,6 +15320,7 @@ function isDefaultRuntimeCommand(command) {
         || command === "replay"
         || command === "export-task"
         || command === "tasks"
+        || command === "campaign"
         || command === "bind"
         || command === "unbind"
         || command === "create-disposable-binding"
@@ -14723,7 +15772,6 @@ function unsupportedLifecycleTaskOptions(parsed, finish) {
         || parsed.flags.includeFullTranscripts
         || parsed.flags.includeLegacy
         || parsed.flags.includeTranscripts
-        || parsed.flags.json
         || parsed.flags.limit !== null
         || parsed.flags.names.length > 0
         || parsed.flags.output !== null
@@ -15879,7 +16927,91 @@ const ADVERSARIAL_CHECK_REQUIREMENT = {
     required: ["failure_mode", "check", "result"],
     type: "object",
 };
+const SHIP_IT_ARTIFACT_REQUIREMENTS = {
+    adversarial_check: ADVERSARIAL_CHECK_REQUIREMENT,
+    branch_pushed: {
+        description: "Receipt that the worker branch was pushed only after repo.push_branch was permitted.",
+        properties: {
+            branch: { type: "string" },
+            remote: { type: "string" },
+        },
+        required: ["branch", "remote"],
+        type: "object",
+    },
+    branch_ready: {
+        description: "Branch and commit evidence for the candidate ship-it change.",
+        properties: {
+            branch: { type: "string" },
+            commit_sha: { type: "string" },
+        },
+        required: ["branch", "commit_sha"],
+        type: "object",
+    },
+    ci_green: {
+        description: "Explicit CI/check evidence. Prefer gh pr checks --required, or record why no required checks exist.",
+        properties: {
+            command: { type: "string" },
+            status: { type: "string" },
+        },
+        required: ["command", "status"],
+        type: "object",
+    },
+    manager_merge_decision: {
+        description: "Manager-owned decision that all required evidence has been independently verified and merge is allowed.",
+        properties: {
+            decision: { type: "string" },
+            manager_verified: { type: "boolean" },
+        },
+        required: ["decision", "manager_verified"],
+        type: "object",
+    },
+    merge: {
+        description: "Merge receipt recorded only after repo.merge_green_pr, CI, mergeability, and manager decision gates pass.",
+        properties: {
+            merge_sha: { type: "string" },
+        },
+        required: ["merge_sha"],
+        type: "object",
+    },
+    mergeability_clean: {
+        description: "Evidence that the PR is mergeable or conflicts were resolved within the manager-approved retry limit.",
+        properties: {
+            conflicts: { type: "boolean" },
+            mergeable_state: { type: "string" },
+        },
+        required: ["conflicts", "mergeable_state"],
+        type: "object",
+    },
+    post_merge_verification: {
+        description: "Post-merge or main-branch verification receipt.",
+        properties: {
+            command: { type: "string" },
+            status: { type: "string" },
+        },
+        required: ["command", "status"],
+        type: "object",
+    },
+    pr_url: {
+        description: "Pull request URL recorded only after repo.open_pr was permitted.",
+        properties: {
+            url: { type: "string" },
+        },
+        required: ["url"],
+        type: "object",
+    },
+};
 const LOOP_TEMPLATES = {
+    app_visible_build_loop: {
+        artifactRequirements: { adversarial_check: ADVERSARIAL_CHECK_REQUIREMENT },
+        cleanupPolicy: "off",
+        description: "Require build evidence and adversarial proof between visible Codex app iterations without a cleanup gate.",
+        maxIterations: 2,
+        name: "app_visible_build_loop",
+        recommendedTools: ["verification.run_tests"],
+        requiredBeforeContinue: ["build_passed", "adversarial_check"],
+        stopConditions: ["max_iterations", "required_evidence"],
+        tags: ["build", "codex_app", "visible_session"],
+    },
     build_then_clear: {
         artifactRequirements: {},
         cleanupPolicy: "clear",
@@ -15913,6 +17045,27 @@ const LOOP_TEMPLATES = {
         stopConditions: ["max_iterations", "required_evidence"],
         tags: ["repo", "ci"],
     },
+    ship_it_loop: {
+        artifactRequirements: SHIP_IT_ARTIFACT_REQUIREMENTS,
+        cleanupPolicy: "clear",
+        description: "Require branch, push, PR, CI, mergeability, manager merge decision, merge, post-merge, and adversarial evidence before ship-it continuation.",
+        maxIterations: 2,
+        name: "ship_it_loop",
+        recommendedTools: ["gh", "verification.run_tests", "git"],
+        requiredBeforeContinue: [
+            "branch_ready",
+            "branch_pushed",
+            "pr_url",
+            "ci_green",
+            "mergeability_clean",
+            "manager_merge_decision",
+            "merge",
+            "post_merge_verification",
+            "adversarial_check",
+        ],
+        stopConditions: ["max_iterations", "required_evidence", "manager_accepts"],
+        tags: ["repo", "ci", "merge", "ship_it"],
+    },
     test_coverage_loop: {
         artifactRequirements: { adversarial_check: ADVERSARIAL_CHECK_REQUIREMENT },
         cleanupPolicy: "clear",
@@ -16035,6 +17188,9 @@ const MANAGER_RECIPES = {
             "PR/CI/merge or satisfied_on_main proof",
             "parent receipt update before the next child",
         ],
+        finalReportRequirements: [
+            "Record manager closeout proof, including final task state and any finish-task/heartbeat teardown receipt, in the final report instead of accepted worker criteria.",
+        ],
         guidelines: [
             "Keep exactly one child board active at a time.",
             "Before activating the next child, update the parent receipt.",
@@ -16058,6 +17214,9 @@ const MANAGER_RECIPES = {
         displayName: "Nudge / What's Next Manager",
         epilogues: [],
         evidenceGates: ["manager decision", "worker receipt", "accepted criteria closure"],
+        finalReportRequirements: [
+            "Record status, residual risk, and any finish-task or terminal closeout proof in the final report, not as worker acceptance criteria.",
+        ],
         guidelines: [
             "Prefer wait over nudge while the worker is active.",
             "Ask for must-have current-task criteria versus follow-ups when scope changes.",
@@ -16085,6 +17244,9 @@ const MANAGER_RECIPES = {
         displayName: "PR/CI/Merge Ralph Loop",
         epilogues: ["draft-pr", "record-handoff"],
         evidenceGates: ["pr_url", "ci_green", "merge", "adversarial_check"],
+        finalReportRequirements: [
+            "Record PR URL, CI, merge, handoff, finish-task, and cleanup receipts in the final report; keep accepted criteria focused on deliverable proof.",
+        ],
         guidelines: ["Merge only after green CI and recorded manager decision evidence."],
         loopTemplate: "pr_ci_merge_loop",
         mode: "strict",
@@ -16094,6 +17256,57 @@ const MANAGER_RECIPES = {
         supportPatterns: ["Inbox / No-Tmux App Loop", "Recovery / Resume / Handoff"],
         tools: ["verification.run_tests", "context.fetch_prs"],
     },
+    "ship-it-loop": {
+        acceptance: [
+            "Branch, push, PR URL, CI-green, mergeability, manager merge decision, merge, post-merge verification, and adversarial proof are recorded.",
+            "Push, PR creation, conflict resolution, and merge actions are each gated by explicit manager permissions.",
+            "Merge readiness is a manager decision after independent verification, not a worker claim or CI-green shortcut.",
+        ],
+        cleanup: "clear after saved handoff",
+        description: "Drive a visible manager-worker ship-it loop through branch push, PR, CI, conflict handling, manager merge decision, merge, and post-merge receipts.",
+        disallowedActions: [
+            "Do not push branches before repo.push_branch is permitted.",
+            "Do not open or update PRs before repo.open_pr is permitted.",
+            "Do not resolve conflicts before repo.resolve_conflicts is permitted and retry bounds are recorded.",
+            "Do not merge before repo.merge_green_pr is permitted, CI is green, mergeability is clean, and the manager records merge_ready.",
+        ],
+        displayName: "Autonomous Ship-It Loop",
+        epilogues: ["draft-pr", "record-handoff"],
+        evidenceGates: [
+            "branch_ready",
+            "branch_pushed",
+            "pr_url",
+            "ci_green",
+            "mergeability_clean",
+            "manager_merge_decision",
+            "merge",
+            "post_merge_verification",
+            "adversarial_check",
+        ],
+        finalReportRequirements: [
+            "Record branch, PR URL, CI/check output, mergeability/conflict status, manager merge decision, merge SHA, post-merge verification, finish-task, and heartbeat teardown proof in the final report.",
+        ],
+        guidelines: [
+            "Keep all PR lifecycle phases visible in the manager and worker sessions.",
+            "Treat CI-green, mergeability, and worker receipts as claims until the manager verifies them.",
+            "Use a bounded conflict retry and block with evidence when conflicts remain unresolved.",
+        ],
+        loopTemplate: "ship_it_loop",
+        mode: "strict",
+        name: "ship-it-loop",
+        objective: "Supervise a worker from implementation through explicit branch, PR, CI, conflict, merge, and post-merge evidence gates.",
+        permissions: [
+            "repo.push_branch",
+            "repo.open_pr",
+            "repo.monitor_ci",
+            "repo.resolve_conflicts",
+            "repo.merge_green_pr",
+            "worker_session.compact",
+            "worker_session.clear",
+        ],
+        supportPatterns: ["Inbox / No-Tmux App Loop", "Recovery / Resume / Handoff"],
+        tools: ["gh", "git", "verification.run_tests", "context.fetch_prs"],
+    },
     "test-coverage-loop": {
         acceptance: [
             "Coverage or targeted test evidence is recorded before another worker pass.",
@@ -16105,6 +17318,9 @@ const MANAGER_RECIPES = {
         displayName: "Test Coverage Loop",
         epilogues: [],
         evidenceGates: ["test_coverage", "adversarial_check"],
+        finalReportRequirements: [
+            "Record final closeout and finish-task proof in the manager final report; do not make closeout mechanics a test-coverage criterion.",
+        ],
         guidelines: ["Record coverage evidence before asking for another worker pass."],
         loopTemplate: "test_coverage_loop",
         mode: "strict",
@@ -16131,6 +17347,9 @@ const MANAGER_RECIPES = {
             "diff_below_threshold",
             "adversarial_check",
         ],
+        finalReportRequirements: [
+            "Record final visual decision, closeout, and cleanup proof in the manager final report; keep accepted criteria focused on visible-output evidence.",
+        ],
         guidelines: ["Compare visible output against references before requesting another pass."],
         loopTemplate: "visual_diff_loop",
         mode: "guided",
@@ -16149,6 +17368,9 @@ const MANAGER_RECIPE_ALIASES = {
     "pr ci merge ralph loop": "pr-ci-merge-ralph-loop",
     "pr/ci/merge ralph loop": "pr-ci-merge-ralph-loop",
     "ralph loop": "pr-ci-merge-ralph-loop",
+    "ship it": "ship-it-loop",
+    "ship it loop": "ship-it-loop",
+    "ship-it": "ship-it-loop",
     "test coverage": "test-coverage-loop",
     "test coverage loop": "test-coverage-loop",
     "ux polish": "ux-polish-loop",
@@ -16182,6 +17404,7 @@ function managerRecipeSummary(name) {
         display_name: recipe.displayName,
         epilogues: [...recipe.epilogues],
         evidence_gates: [...recipe.evidenceGates],
+        final_report_requirements: [...recipe.finalReportRequirements],
         guidelines: [...recipe.guidelines],
         locked_summary_template: lockedManagerRecipeSummary(recipe),
         loop_template: recipe.loopTemplate,
@@ -16236,6 +17459,7 @@ function lockedManagerRecipeSummary(recipe) {
         `Epilogues: ${recipe.epilogues.length > 0 ? recipe.epilogues.join(", ") : "none"}`,
         `Cleanup: ${recipe.cleanup}`,
         `Evidence gates: ${recipe.evidenceGates.length > 0 ? recipe.evidenceGates.join(", ") : "manager-reviewed evidence"}`,
+        `Final report: ${recipe.finalReportRequirements.join("; ")}`,
         `Not allowed: ${recipe.disallowedActions.length > 0 ? recipe.disallowedActions.join("; ") : "unconfirmed custom actions"}`,
         "User confirmed: <yes|no>",
     ].join("\n");
@@ -16542,7 +17766,7 @@ function loopStatusSummarySync(database, options) {
     const matchingCommands = commandRows.filter((row) => commandRowMatchesRun(row, options.run.id));
     const commandStates = countBy(matchingCommands.map((row) => row.state));
     const notificationRows = database.prepare(`
-    select state, payload_json
+    select consumed_at, state, payload_json
     from routed_notifications
     where task_id = ?
     order by created_at, id
@@ -16575,6 +17799,12 @@ function loopStatusSummarySync(database, options) {
             .filter((value) => typeof value === "string" && value.length > 0))].sort();
     const telemetryEvents = telemetryEventsForRunSync(database, { runId: options.run.id, taskId: options.task.id });
     const telemetryByType = countBy(telemetryEvents.map((event) => event.event_type));
+    const appTaskDispatch = appTaskDispatchSummarySync(database, {
+        commandRows,
+        notificationRows,
+        runScopedActivityTotal: matchingCommands.length + matchingNotifications.length + telemetryEvents.length,
+        taskId: options.task.id,
+    });
     const failedCommandCount = commandStates.failed ?? 0;
     const failureCounts = loopFailureCountsSync(database, {
         failedCommandCount,
@@ -16595,6 +17825,7 @@ function loopStatusSummarySync(database, options) {
             total: evidenceItems.length,
             types: evidenceTypes,
         },
+        app_task_dispatch: appTaskDispatch,
         failures: failureCounts,
         inbox: {
             worker_unconsumed: workerInbox,
@@ -16638,6 +17869,52 @@ function telemetryEventsForRunSync(database, options) {
     limit 1000
   `).all(options.taskId, options.runId);
 }
+function appTaskDispatchSummarySync(database, options) {
+    const taskDispatchEventTypes = [
+        "app_autopilot_started",
+        "app_autopilot_stopped",
+        "app_heartbeat",
+        "app_wakeup_delivery_recorded",
+        "app_wakeup_dispatch_planned",
+        "command_created",
+        "dispatch_inbox_consumed",
+    ];
+    const telemetryRows = database.prepare(`
+    select event_type, timestamp
+    from telemetry_events
+    where task_id = ?
+      and event_type in (${taskDispatchEventTypes.map(() => "?").join(", ")})
+    order by timestamp, id
+  `).all(options.taskId, ...taskDispatchEventTypes);
+    const telemetryByType = countBy(telemetryRows.map((row) => row.event_type));
+    const commandStates = countBy(options.commandRows.map((row) => row.state));
+    const notificationStates = countBy(options.notificationRows.map((row) => row.state));
+    const recordsTotal = options.commandRows.length + options.notificationRows.length + telemetryRows.length;
+    const blindToRun = options.runScopedActivityTotal === 0 && recordsTotal > 0;
+    return {
+        commands: {
+            states: sortJson(commandStates),
+            total: options.commandRows.length,
+        },
+        latest_event_at: telemetryRows.at(-1)?.timestamp ?? null,
+        note: blindToRun
+            ? "Requested run has no run-scoped activity, but task-level app Dispatch records exist."
+            : null,
+        notifications: {
+            delivered_unconsumed: options.notificationRows
+                .filter((row) => row.state === "delivered" && row.consumed_at === null).length,
+            states: sortJson(notificationStates),
+            total: options.notificationRows.length,
+        },
+        records_total: recordsTotal,
+        telemetry: {
+            by_event_type: sortJson(telemetryByType),
+            command_created: telemetryByType.command_created ?? 0,
+            dispatch_inbox_consumed: telemetryByType.dispatch_inbox_consumed ?? 0,
+            total: telemetryRows.length,
+        },
+    };
+}
 function loopFailureCountsSync(database, options) {
     const failedCycles = database.prepare(`
     select count(distinct mc.id) as count
@@ -16727,6 +18004,8 @@ function renderLoopStatusText(result) {
     const notifications = result.notifications;
     const inbox = result.inbox;
     const telemetry = result.telemetry;
+    const appTaskDispatch = result.app_task_dispatch;
+    const appTaskDispatchTelemetry = appTaskDispatch?.telemetry;
     return [
         `task: ${task.name} (${task.state})`,
         `run: ${run.name || run.id} (${run.status})`,
@@ -16735,6 +18014,7 @@ function renderLoopStatusText(result) {
         `notifications: ${notifications.delivered}/${notifications.total} delivered`,
         `worker_unconsumed: ${inbox.worker_unconsumed}`,
         `dispatch_inbox_consumed: ${telemetry.dispatch_inbox_consumed}`,
+        `app_task_dispatch: ${appTaskDispatch?.records_total ?? 0} records ${JSON.stringify(appTaskDispatchTelemetry?.by_event_type ?? {})}${appTaskDispatch?.note ? ` (${appTaskDispatch.note})` : ""}`,
         `failures: ${JSON.stringify(result.failures ?? {})}`,
         `recommendation: ${result.recommendation}`,
     ].join("\n") + "\n";
@@ -17250,6 +18530,7 @@ function disposableWorkerHandoff(taskName, runName, dbPath) {
         "",
         `You are the worker for task ${taskName}${loopClause}.`,
         "Keep polling your Conveyor worker inbox until there are no items left or the loop reaches max_iterations. Consume the next item now, treat each consumed item as the manager's next instruction, complete the requested work, and report changed files, exact commands run, evidence, and any residual risk.",
+        ...visibleSessionProtocolLines("worker"),
         "After completing or blocking on a consumed item, send the manager a durable Conveyor notification before your final answer. A direct app-thread final answer is not a manager receipt and is not task completion.",
         `Run: ${notifyCommand}`,
         `Then run: ${dispatchCommand}`,
@@ -17332,9 +18613,11 @@ function disposableHeartbeatRecommendations(taskName, dbPath) {
                 `After a successful app-thread send, record it with: ${deliveryReceiptCommands.sent}`,
                 `For healthy skipped actions, record: ${deliveryReceiptCommands.skipped}`,
                 `For missing-thread blocked actions, record: ${deliveryReceiptCommands.blocked}`,
+                ...visibleSessionProtocolLines("manager"),
                 "If an item is consumed, execute only that manager instruction, verify worker claims before recording conclusions, update Conveyor state as appropriate, and produce exactly one next worker task.",
                 "If no item is consumed, stop after a one-line idle receipt.",
                 "Do not delete, pause, or disable manager or worker heartbeat automation after an idle poll; an idle poll is only a quiet interval.",
+                "Keep manager closeout/control-plane proof out of accepted worker criteria; record finish-task, final task state, and heartbeat teardown proof in the manager final report or audit receipts.",
                 `If all accepted criteria are satisfied, deferred, or rejected and there is no next worker task, record the terminal manager decision, run or report the result of: ${terminalCloseoutCommand}`,
                 "After verified task closeout, explicitly report heartbeat teardown status; if the task remains managed/active, report that as a control-plane blocker instead of calling the loop complete.",
             ].join("\n"),
@@ -17348,6 +18631,7 @@ function disposableHeartbeatRecommendations(taskName, dbPath) {
                 `Run the worker app heartbeat for task ${taskName}.`,
                 `Run: ${workerHeartbeatCommand}`,
                 `If the heartbeat output asks for direct inbox polling, run: ${workerInboxCommand}`,
+                ...visibleSessionProtocolLines("worker"),
                 "If an item is consumed, execute only that single worker instruction and return exact commands, compact evidence for any completion claim, blockers/residual risk, and exactly one next recommended worker task.",
                 "Before your final answer after any consumed item, notify the manager durably; a direct app-thread final answer is not a manager receipt and is not task completion.",
                 `Run: ${workerNotifyCommand}`,
@@ -17583,6 +18867,7 @@ function startManagerBootstrapPrompt(database, options) {
         "- Treat acceptance criteria as living supervision state.",
         "- Inspect `manager_context.acceptance_criteria` each cycle.",
         "- If worker progress reveals new edge cases, tests, polish, or scope boundaries, ask the worker to propose must-have vs follow-up criteria.",
+        "- Keep manager closeout/control-plane proof out of accepted worker criteria; record finish-task, final task state, teardown, and final-report proof in manager closeout evidence instead.",
         "- Before finishing, compare worker receipts/verification against accepted open criteria.",
         `- For each accepted criterion that is proven, record evidence with \`${satisfyCriterionCommand}\`.`,
         `- When all accepted criteria are satisfied, deferred, or rejected, finish the task with \`${workerctl} finish-task ${taskLine} --reason "Accepted criteria satisfied" --require-criteria-audit${pathSuffix}\`.`,