agentxchain 2.146.0 → 2.148.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentxchain",
-  "version": "2.146.0",
+  "version": "2.148.0",
   "description": "CLI for AgentXchain — governed multi-agent software delivery",
   "type": "module",
   "bin": {

package/scripts/publish-npm.sh

@@ -84,6 +84,22 @@ NEW_VERSION="$(node -e "console.log(JSON.parse(require('fs').readFileSync('packa
 echo "New version: ${NEW_VERSION}"
 echo ""
 
+# Publish-gate enforcement: WAYS-OF-WORKING section 9 prohibits bypassing the
+# publish gate with manual npm publish. Even though this script is a documented
+# non-canonical helper (see RELEASE_CUT_SPEC.md section 6), it must not drop
+# below the same release-boundary proof surface (claim-reality-preflight,
+# beta-tester scenarios, release-docs-content, release-preflight) that the
+# canonical publish-npm-on-tag.yml workflow runs via
+# `release-preflight.sh --publish-gate`. Set ALLOW_PUBLISH_GATE_BYPASS=1 only
+# for dry-run/debug paths that have manually established proof (for example,
+# a release-preflight.sh --publish-gate run the operator just watched pass).
+if [[ "${ALLOW_PUBLISH_GATE_BYPASS:-0}" != "1" ]]; then
+  echo "Running release-preflight.sh --publish-gate before npm publish..."
+  bash scripts/release-preflight.sh --publish-gate --target-version "${NEW_VERSION}"
+else
+  echo "WARNING: ALLOW_PUBLISH_GATE_BYPASS=1 set — skipping publish-gate. The operator owns claim-reality/beta-tester proof manually."
+fi
+
 echo "Publishing to npm..."
 if [[ -n "${NPM_TOKEN:-}" ]]; then
   npm publish --access public --//registry.npmjs.org/:_authToken="${NPM_TOKEN}"

package/scripts/sync-homebrew.sh

@@ -244,5 +244,18 @@ fi
 
 echo ""
 echo "====================================="
-echo "SYNC COMPLETE — Homebrew formula updated to ${PACKAGE_NAME}@${TARGET_VERSION}."
+echo "SYNC STEP COMPLETE — Homebrew formula updated to ${PACKAGE_NAME}@${TARGET_VERSION}."
+echo ""
+echo "This is the Phase 2 -> Phase 3 transition step only. It does NOT prove"
+echo "the public npx install path resolves, and it does NOT prove the canonical"
+echo "tap / GitHub Release / repo-mirror downstream truth is consistent."
+echo ""
+echo "Do NOT declare the release complete from this script's exit code alone."
+echo "Complete the release by running ONE of:"
+echo "  - bash cli/scripts/verify-post-publish.sh --target-version ${TARGET_VERSION}"
+echo "    (manual/operator path; includes npx smoke + repo-mirror SHA proof + full test suite)"
+echo "  - bash cli/scripts/release-downstream-truth.sh --target-version ${TARGET_VERSION}"
+echo "    (CI-equivalent path; requires release-postflight.sh to have already run the npx smoke)"
+echo ""
+echo "See DEC-VERIFY-POST-PUBLISH-NPX-001 and DEC-HOMEBREW-SYNC-LOOPHOLE-CLOSE-001."
 exit 0

package/scripts/verify-post-publish.sh

@@ -20,6 +20,8 @@ cd "$CLI_DIR"
 TARGET_VERSION=""
 
 FORMULA_PATH="${CLI_DIR}/homebrew/agentxchain.rb"
+PACKAGE_NAME="$(node -e "console.log(JSON.parse(require('fs').readFileSync('package.json','utf8')).name)")"
+PACKAGE_BIN_NAME="$(node -e "const pkg = JSON.parse(require('fs').readFileSync('package.json','utf8')); if (typeof pkg.bin === 'string') { console.log(pkg.name); process.exit(0); } const names = Object.keys(pkg.bin || {}); if (names.length !== 1) { console.error('package.json bin must declare exactly one entry'); process.exit(1); } console.log(names[0]);")"
 
 formula_url() {
   local formula_path="$1"
@@ -31,6 +33,29 @@ formula_sha() {
   grep -E '^\s*sha256\s+"' "$formula_path" | sed 's/.*sha256 *"\([a-f0-9]*\)".*/\1/' || true
 }
 
+run_npx_smoke() {
+  local smoke_root
+  local smoke_npmrc
+
+  smoke_root="$(mktemp -d "${TMPDIR:-/tmp}/agentxchain-verify-post-publish.XXXXXX")"
+  mkdir -p "${smoke_root}/home" "${smoke_root}/cache" "${smoke_root}/npm-cache" "${smoke_root}/workspace"
+  smoke_npmrc="${smoke_root}/.npmrc"
+  echo "registry=https://registry.npmjs.org/" > "$smoke_npmrc"
+
+  (
+    cd "${smoke_root}/workspace" || exit 1
+    env -u NODE_AUTH_TOKEN \
+      HOME="${smoke_root}/home" \
+      XDG_CACHE_HOME="${smoke_root}/cache" \
+      NPM_CONFIG_CACHE="${smoke_root}/npm-cache" \
+      NPM_CONFIG_USERCONFIG="${smoke_npmrc}" \
+      npx --yes -p "${PACKAGE_NAME}@${TARGET_VERSION}" -c "${PACKAGE_BIN_NAME} --version"
+  )
+  local status=$?
+  rm -rf "$smoke_root"
+  return "$status"
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --target-version)
@@ -57,7 +82,7 @@ echo "============================================="
 echo ""
 
 # Step 1: Verify npm serves the version
-echo "[1/4] Checking npm registry..."
+echo "[1/5] Checking npm registry..."
 NPM_VERSION="$(npm view "agentxchain@${TARGET_VERSION}" version 2>/dev/null || echo "")"
 if [[ "$NPM_VERSION" != "$TARGET_VERSION" ]]; then
   echo "  FAIL: npm does not serve agentxchain@${TARGET_VERSION} (got: '${NPM_VERSION}')"
@@ -67,7 +92,7 @@ fi
 echo "  OK: npm serves v${TARGET_VERSION}"
 
 # Step 2: Sync the repo mirror to the published tarball
-echo "[2/4] Syncing repo mirror to published tarball..."
+echo "[2/5] Syncing repo mirror to published tarball..."
 bash "${SCRIPT_DIR}/sync-homebrew.sh" --target-version "$TARGET_VERSION"
 echo "  OK: repo mirror synced"
 
@@ -109,8 +134,34 @@ if [[ "$FORMULA_SHA" != "$TARBALL_SHA" ]]; then
 fi
 echo "  OK: repo mirror formula SHA256 matches registry tarball"
 
-# Step 4: Run the full test suite WITHOUT the preflight skip
-echo "[4/5] Running full test suite (no preflight skip)..."
+# Step 4: Recheck the public npx path against the published registry version
+echo "[4/5] Verifying public npx install path..."
+NPX_OUTPUT="$(run_npx_smoke 2>&1 || true)"
+NPX_VERSION="$(printf '%s\n' "$NPX_OUTPUT" | awk -v expected="${TARGET_VERSION}" '
+  {
+    line=$0
+    gsub(/^[[:space:]]+|[[:space:]]+$/, "", line)
+    if (line == expected) {
+      print line
+      found=1
+      exit
+    }
+  }
+  END {
+    if (!found) {
+      exit 1
+    }
+  }
+ ' || true)"
+if [[ "$NPX_VERSION" != "$TARGET_VERSION" ]]; then
+  echo "  FAIL: public npx path did not report ${TARGET_VERSION}"
+  printf '%s\n' "$NPX_OUTPUT"
+  exit 1
+fi
+echo "  OK: public npx path resolves and reports v${TARGET_VERSION}"
+
+# Step 5: Run the full test suite WITHOUT the preflight skip
+echo "[5/5] Running full test suite (no preflight skip)..."
 echo "  This verifies the broader Homebrew mirror contract passes with the real SHA."
 npm test
 echo "  OK: full test suite green"

package/src/commands/reissue-turn.js

@@ -18,8 +18,10 @@ import {
   getActiveTurns,
   getActiveTurn,
   reissueTurn,
+  transitionActiveTurnLifecycle,
 } from '../lib/governed-state.js';
 import { writeDispatchBundle } from '../lib/dispatch-bundle.js';
+import { finalizeDispatchManifest } from '../lib/dispatch-manifest.js';
 
 export async function reissueTurnCommand(opts) {
   const context = loadProjectContext();
@@ -91,6 +93,20 @@ export async function reissueTurnCommand(opts) {
     console.log(chalk.red(`Turn reissued but dispatch bundle failed: ${bundleResult.error}`));
     process.exit(1);
   }
+  // BUG-51 follow-up: every command that writes a dispatch bundle for an
+  // active turn must finalize the manifest so adapter-side
+  // `verifyDispatchManifestForAdapter` enforcement matches fresh dispatches.
+  // Reissue does not run after_dispatch hooks, so finalization happens
+  // immediately after writeDispatchBundle.
+  const manifestResult = finalizeDispatchManifest(root, result.newTurn.turn_id, {
+    run_id: result.state.run_id,
+    role: result.newTurn.assigned_role,
+  });
+  if (!manifestResult.ok) {
+    console.log(chalk.red(`Turn reissued but dispatch manifest failed: ${manifestResult.error}`));
+    process.exit(1);
+  }
+  transitionActiveTurnLifecycle(root, result.newTurn.turn_id, 'dispatched');
 
   // Print summary
   console.log('');

package/src/commands/reject-turn.js

@@ -2,9 +2,10 @@ import chalk from 'chalk';
 import { existsSync } from 'fs';
 import { join } from 'path';
 import { loadProjectContext, loadProjectState } from '../lib/config.js';
-import { getActiveTurns, rejectGovernedTurn } from '../lib/governed-state.js';
+import { getActiveTurns, rejectGovernedTurn, transitionActiveTurnLifecycle } from '../lib/governed-state.js';
 import { validateStagedTurnResult } from '../lib/turn-result-validator.js';
 import { writeDispatchBundle } from '../lib/dispatch-bundle.js';
+import { finalizeDispatchManifest } from '../lib/dispatch-manifest.js';
 import { deriveRecoveryDescriptor } from '../lib/blocked-state.js';
 import { getDispatchTurnDir, getTurnStagingResultPath } from '../lib/turn-paths.js';
 
@@ -51,6 +52,18 @@ export async function rejectTurnCommand(opts) {
       console.log(chalk.red(`Turn rejected but dispatch bundle rewrite failed: ${bundleResult.error}`));
       process.exit(1);
     }
+    // BUG-51 follow-up: finalize the manifest so adapter verification matches
+    // fresh dispatches. reject-for-retry does not run after_dispatch hooks,
+    // so finalize immediately after writeDispatchBundle.
+    const manifestResult = finalizeDispatchManifest(root, validation.turn.turn_id, {
+      run_id: result.state.run_id,
+      role: validation.turn.assigned_role,
+    });
+    if (!manifestResult.ok) {
+      console.log(chalk.red(`Turn rejected but dispatch manifest failed: ${manifestResult.error}`));
+      process.exit(1);
+    }
+    transitionActiveTurnLifecycle(root, validation.turn.turn_id, 'dispatched');
     printDispatchBundleWarnings(bundleResult);
   }
 

package/src/commands/restart.js

@@ -23,11 +23,13 @@ import {
   normalizeGovernedStateShape,
   reconcileApprovalPausesWithConfig,
   reconcileRecoveryActionsWithConfig,
+  transitionActiveTurnLifecycle,
   STATE_PATH,
   HISTORY_PATH,
   LEDGER_PATH,
 } from '../lib/governed-state.js';
 import { writeDispatchBundle } from '../lib/dispatch-bundle.js';
+import { finalizeDispatchManifest } from '../lib/dispatch-manifest.js';
 import { getDispatchTurnDir } from '../lib/turn-paths.js';
 import { consumeNextApprovedIntent } from '../lib/intake.js';
 import { deriveRecoveryDescriptor } from '../lib/blocked-state.js';
@@ -404,6 +406,19 @@ export async function restartCommand(opts) {
         console.log(chalk.dim('Run `agentxchain reissue-turn` to reissue with a fresh bundle.'));
         process.exit(1);
       }
+      // BUG-51 follow-up: finalize the dispatch manifest so adapter-side
+      // verification matches fresh dispatches via `run`/`step`/`resume`.
+      // restart does not run after_dispatch hooks here, so finalize
+      // immediately after writeDispatchBundle.
+      const manifestResult = finalizeDispatchManifest(root, turnId, {
+        run_id: assignedState.run_id,
+        role: assignedRole,
+      });
+      if (!manifestResult.ok) {
+        console.log(chalk.red(`Turn assigned but dispatch manifest failed: ${manifestResult.error}`));
+        process.exit(1);
+      }
+      transitionActiveTurnLifecycle(root, turnId, 'dispatched');
       for (const bw of bundleResult.warnings || []) {
         console.log(chalk.yellow(`Dispatch bundle warning: ${bw}`));
       }

package/src/commands/resume.js

@@ -8,8 +8,8 @@
  *   - resolves target role from routing or --role override
  *   - if idle + no run_id → initializeGovernedRun() + assign
  *   - if paused + run_id exists → resume same run + assign
- *   - if paused + current_turn with failed status → re-dispatch same turn
- *   - if active + current_turn exists → reject (no double assignment)
+ *   - if blocked + retained active turn with failed status → re-dispatch same turn
+ *   - if active + an active turn already exists → reject (no double assignment)
  *   - materializes a turn-scoped dispatch bundle under .agentxchain/dispatch/turns/<turn_id>/
  *   - exits without waiting for turn completion
  */
@@ -26,6 +26,8 @@ import {
   getActiveTurns,
   getActiveTurnCount,
   reactivateGovernedRun,
+  reconcilePhaseAdvanceBeforeDispatch,
+  transitionActiveTurnLifecycle,
   STATE_PATH,
 } from '../lib/governed-state.js';
 import { writeDispatchBundle, getDispatchTurnDir, getTurnStagingResultPath } from '../lib/dispatch-bundle.js';
@@ -120,70 +122,25 @@ export async function resumeCommand(opts) {
     process.exit(1);
   }
 
-  // §47: paused + retained turn with failed/retrying status → re-dispatch same turn
-  if (state.status === 'paused' && activeCount > 0) {
-    // Resolve which turn to re-dispatch
-    let retainedTurn = null;
-    if (opts.turn) {
-      retainedTurn = activeTurns[opts.turn];
-      if (!retainedTurn) {
-        console.log(chalk.red(`No active turn found for --turn ${opts.turn}`));
-        process.exit(1);
-      }
-    } else if (activeCount > 1) {
-      console.log(chalk.red('Multiple retained turns exist. Use --turn <id> to specify which to re-dispatch.'));
-      for (const turn of Object.values(activeTurns)) {
-        console.log(`  ${chalk.yellow('●')} ${turn.turn_id} — ${chalk.bold(turn.assigned_role)} (${turn.status})`);
-      }
-      console.log('');
-      console.log(chalk.dim('Example: agentxchain resume --turn <turn_id>'));
-      process.exit(1);
-    } else {
-      retainedTurn = Object.values(activeTurns)[0];
-    }
-
-    const turnStatus = retainedTurn.status;
-    if (turnStatus === 'failed' || turnStatus === 'retrying') {
-      printResumeRunContext({ root, state, config });
-      console.log(chalk.yellow(`Re-dispatching failed turn: ${retainedTurn.turn_id}`));
-      console.log(`  Role:    ${retainedTurn.assigned_role}`);
-      console.log(`  Attempt: ${retainedTurn.attempt}`);
-      console.log('');
-
-      const reactivated = reactivateGovernedRun(root, state, { via: turnResumeVia, notificationConfig: config });
-      if (!reactivated.ok) {
-        console.log(chalk.red(`Failed to reactivate run: ${reactivated.error}`));
-        process.exit(1);
-      }
-      state = reactivated.state;
-      if (reactivated.migration_notice) {
-        console.log(chalk.yellow(reactivated.migration_notice));
-      }
-      if (reactivated.phantom_notice) {
-        console.log(chalk.yellow(reactivated.phantom_notice));
-      }
-
-      // Write dispatch bundle for the existing turn
-      const bundleResult = writeDispatchBundle(root, state, config);
-      if (!bundleResult.ok) {
-        console.log(chalk.red(`Failed to write dispatch bundle: ${bundleResult.error}`));
-        process.exit(1);
-      }
-      printDispatchBundleWarnings(bundleResult);
-
-      // after_dispatch hooks with bundle-core tamper protection
-      const hooksConfig = config.hooks || {};
-      if (hooksConfig.after_dispatch?.length > 0) {
-        const afterDispatchResult = runAfterDispatchHooks(root, hooksConfig, state, retainedTurn);
-        if (!afterDispatchResult.ok) {
-          process.exit(1);
-        }
-      }
-
-      printDispatchSummary(state, config, retainedTurn);
-      return;
-    }
-  }
+  // Removed (Turn 25): the §47 `paused + retained turn → re-dispatch failed/retrying`
+  // branch is provably unreachable under the current schema and migration contract:
+  //
+  //   1. `cli/src/lib/schema.js:184` rejects `status: 'paused'` unless
+  //      `pending_phase_transition` or `pending_run_completion` is set.
+  //   2. The guard above (line 119) short-circuits with `printRecoverySummary`
+  //      whenever either pending field is set — so any schema-valid paused state
+  //      exits before reaching this point.
+  //   3. Legacy on-disk shapes that pre-date the schema constraint (paused +
+  //      `blocked_on: 'human:...'` / `blocked_on: 'escalation:...'` with no
+  //      pending approval) are auto-migrated to `status: 'blocked'` by
+  //      `normalizeStateForRead` in `governed-state.js:2191-2204` before
+  //      `loadProjectState` returns.
+  //
+  // The reachable retained-turn re-dispatch path is the `blocked + activeCount > 0`
+  // branch immediately below, which legacy paused-pause shapes are migrated into.
+  // Per `DEC-UNREACHABLE-BRANCH-COVERAGE-001`, dead branches are removed (not
+  // patched defensively) once the schema citation + migration citation are
+  // documented in code and the coverage matrix.
 
   if (state.status === 'blocked' && activeCount > 0) {
     let retainedTurn = null;
@@ -244,6 +201,21 @@ export async function resumeCommand(opts) {
       }
     }
 
+    // BUG-51 follow-up: see comment in paused/failed retained-turn branch.
+    // The blocked re-dispatch path has the same watchdog/manifest invariant.
+    const manifestResult = finalizeDispatchManifest(root, retainedTurn.turn_id, {
+      run_id: state.run_id,
+      role: retainedTurn.assigned_role,
+    });
+    if (!manifestResult.ok) {
+      console.log(chalk.red(`Failed to finalize dispatch manifest: ${manifestResult.error}`));
+      process.exit(1);
+    }
+    const dispatched = transitionActiveTurnLifecycle(root, retainedTurn.turn_id, 'dispatched');
+    if (dispatched.ok) {
+      state = dispatched.state;
+    }
+
     printDispatchSummary(state, config, retainedTurn);
     return;
   }
@@ -299,6 +271,24 @@ export async function resumeCommand(opts) {
     }
   }
 
+  const phaseReconciliation = reconcilePhaseAdvanceBeforeDispatch(root, config, state);
+  if (!phaseReconciliation.ok && !phaseReconciliation.state) {
+    console.log(chalk.red(`Failed to reconcile phase gate before dispatch: ${phaseReconciliation.error}`));
+    process.exit(1);
+  }
+  state = phaseReconciliation.state || state;
+  if (phaseReconciliation.advanced) {
+    console.log(chalk.green(`Advanced phase before dispatch: ${phaseReconciliation.from_phase} → ${phaseReconciliation.to_phase}`));
+  }
+  if (state.pending_phase_transition || state.pending_run_completion) {
+    printRecoverySummary(state, 'This run is awaiting approval.', config);
+    process.exit(1);
+  }
+  if (state.status === 'blocked') {
+    printRecoverySummary(state, 'This run is blocked.', config);
+    process.exit(1);
+  }
+
   // Print run-context header before dispatch
   printResumeRunContext({ root, state, config });
 
@@ -360,6 +350,11 @@ export async function resumeCommand(opts) {
     process.exit(1);
   }
 
+  const dispatched = transitionActiveTurnLifecycle(root, turn.turn_id, 'dispatched');
+  if (dispatched.ok) {
+    state = dispatched.state;
+  }
+
   printDispatchSummary(state, config);
 }
 

package/src/commands/run.js

@@ -18,6 +18,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { loadProjectContext, loadProjectState } from '../lib/config.js';
 import { runLoop } from '../lib/run-loop.js';
+import { transitionActiveTurnLifecycle } from '../lib/runner-interface.js';
 import { buildRunExport } from '../lib/export.js';
 import { buildGovernanceReport, formatGovernanceReportMarkdown } from '../lib/report.js';
 import { validateParentRun } from '../lib/run-history.js';
@@ -49,6 +50,8 @@ import { resolveContinuousOptions, executeContinuousRun } from '../lib/continuou
 import { createDispatchProgressTracker } from '../lib/dispatch-progress.js';
 import { emitRunEvent } from '../lib/run-events.js';
 import { checkpointAcceptedTurn } from '../lib/turn-checkpoint.js';
+import { failTurnStartup } from '../lib/stale-turn-watchdog.js';
+import { hasMinimumTurnResultShape } from '../lib/turn-result-shape.js';
 
 export async function runCommand(opts) {
   const context = loadProjectContext();
@@ -314,20 +317,49 @@ export async function executeGovernedRun(context, opts = {}) {
       if (!manifestResult.ok) {
         return { accept: false, reason: `dispatch manifest failed: ${manifestResult.error}` };
       }
+      transitionActiveTurnLifecycle(projectRoot, turn.turn_id, 'dispatched');
 
       // ── Route to adapter ──────────────────────────────────────────────
       const tracker = createDispatchProgressTracker(projectRoot, turn, {
         adapter_type: runtimeType,
       });
+      let startupStarted = false;
+      let runningMarked = false;
+
+      const ensureStartingState = (pid = null, at = new Date().toISOString()) => {
+        if (startupStarted) return;
+        startupStarted = true;
+        transitionActiveTurnLifecycle(projectRoot, turn.turn_id, 'starting', { pid, at });
+        tracker.start();
+        if (pid != null) {
+          tracker.setPid(pid);
+        }
+        emitRunEvent(projectRoot, 'dispatch_progress', {
+          run_id: state.run_id,
+          phase: state.phase,
+          status: state.status,
+          turn: { turn_id: turn.turn_id, assigned_role: roleId },
+          payload: { milestone: 'started', output_lines: 0, elapsed_seconds: 0, silent_seconds: 0 },
+        });
+      };
+
+      const ensureRunningState = (stream = 'stdout', at = new Date().toISOString()) => {
+        if (runningMarked) return;
+        runningMarked = true;
+        transitionActiveTurnLifecycle(projectRoot, turn.turn_id, 'running', { stream, at });
+      };
 
       const adapterOpts = {
         signal: combineAbortSignals(controller.signal, ctx.dispatchAbortSignal),
         onStatus: (msg) => log(chalk.dim(`  ${msg}`)),
         verifyManifest: true,
         turnId: turn.turn_id,
+        onSpawnAttached: ({ pid, at }) => ensureStartingState(pid, at),
+        onFirstOutput: ({ at, stream }) => ensureRunningState(stream, at),
       };
 
       const recordOutputActivity = (stream, text) => {
+        ensureRunningState(stream);
         const lines = text.split('\n').length - 1 || 1;
         const wasSilent = tracker.onOutput(stream, lines);
         if (wasSilent) {
@@ -368,23 +400,17 @@ export async function executeGovernedRun(context, opts = {}) {
 
       let adapterResult;
 
-      // Emit dispatch_progress started event and begin tracking
-      tracker.start();
-      emitRunEvent(projectRoot, 'dispatch_progress', {
-        run_id: state.run_id,
-        phase: state.phase,
-        status: state.status,
-        turn: { turn_id: turn.turn_id, assigned_role: roleId },
-        payload: { milestone: 'started', output_lines: 0, elapsed_seconds: 0, silent_seconds: 0 },
-      });
-
       try {
         if (runtimeType === 'api_proxy') {
+          ensureStartingState(null);
+          ensureRunningState('request');
           log(chalk.dim(`  Dispatching to API proxy: ${runtime?.provider || '?'} / ${runtime?.model || '?'}`));
           tracker.requestStarted();
           adapterResult = await dispatchApiProxy(projectRoot, state, cfg, adapterOpts);
           if (adapterResult.ok) tracker.responseReceived();
         } else if (runtimeType === 'mcp') {
+          ensureStartingState(null);
+          ensureRunningState('request');
           const transport = resolveMcpTransport(runtime);
           log(chalk.dim(`  Dispatching to MCP ${transport}: ${describeMcpRuntimeTarget(runtime)}`));
           tracker.requestStarted();
@@ -395,6 +421,8 @@ export async function executeGovernedRun(context, opts = {}) {
           log(chalk.dim(`  Dispatching to local CLI: ${runtime?.command || '(default)'}  transport: ${transport}`));
           adapterResult = await dispatchLocalCli(projectRoot, state, cfg, adapterOpts);
         } else if (runtimeType === 'remote_agent') {
+          ensureStartingState(null);
+          ensureRunningState('request');
           log(chalk.dim(`  Dispatching to remote agent: ${describeRemoteAgentTarget(runtime)}`));
           tracker.requestStarted();
           adapterResult = await dispatchRemoteAgent(projectRoot, state, cfg, adapterOpts);
@@ -413,6 +441,10 @@ export async function executeGovernedRun(context, opts = {}) {
         throw err;
       }
 
+      if (adapterResult.ok && runtimeType === 'local_cli' && !runningMarked) {
+        ensureRunningState('staged_result', adapterResult.firstOutputAt || new Date().toISOString());
+      }
+
       // Emit completion/failure progress event and clean up tracker
       const progressState = tracker.getState();
       const elapsedSec = Math.round((Date.now() - new Date(progressState.started_at)) / 1000);
@@ -439,6 +471,19 @@ export async function executeGovernedRun(context, opts = {}) {
         return { accept: false, reason: 'dispatch timed out' };
       }
 
+      if (adapterResult.startupFailure) {
+        const freshState = loadProjectState(projectRoot, cfg) || state;
+        failTurnStartup(projectRoot, freshState, cfg, turn.turn_id, {
+          failure_type: adapterResult.startupFailureType || 'no_subprocess_output',
+          threshold_ms: cfg?.run_loop?.startup_watchdog_ms ?? 30_000,
+          running_ms: freshState?.active_turns?.[turn.turn_id]?.started_at
+            ? Math.max(0, Date.now() - new Date(freshState.active_turns[turn.turn_id].started_at).getTime())
+            : 0,
+          recommendation: `Turn ${turn.turn_id} failed to start within the startup watchdog window. Run \`agentxchain reissue-turn --turn ${turn.turn_id} --reason ghost\` to recover.`,
+        });
+        return { accept: false, blocked: true, reason: adapterResult.error || 'turn startup failed' };
+      }
+
       // Adapter failure
       if (!adapterResult.ok) {
         if (shouldSuggestManualQaFallback({
@@ -472,6 +517,18 @@ export async function executeGovernedRun(context, opts = {}) {
         return { accept: false, reason: `failed to parse staged result: ${err.message}` };
       }
 
+      // Per DEC-MINIMUM-TURN-RESULT-SHAPE-001: the staged-result read shortcut
+      // must refuse payloads that lack the minimum governed envelope. Adapter
+      // pre-stage guards already reject these, but this is the final boundary
+      // before acceptance projection — fail closed on tampered or legacy
+      // adapter output rather than trust upstream.
+      if (!hasMinimumTurnResultShape(turnResult)) {
+        return {
+          accept: false,
+          reason: 'staged result missing minimum governed envelope (schema_version + identity + lifecycle fields)',
+        };
+      }
+
       return { accept: true, turnResult };
     },
 

package/src/commands/schedule.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { loadProjectContext } from '../lib/config.js';
+import { loadProjectContext, loadProjectState } from '../lib/config.js';
 import {
   SCHEDULE_STATE_PATH,
   DAEMON_STATE_PATH,
@@ -97,19 +97,37 @@ function buildScheduleProvenance(entry) {
   };
 }
 
-function buildScheduleExecutionResult(entryId, execution, fallbackState, action = 'ran') {
-  const state = execution.result?.state || fallbackState || null;
+export function buildScheduleExecutionResult(entryId, execution, fallbackState, action = 'ran') {
+  const state = fallbackState || execution.result?.state || null;
+  const blockedReason = state?.blocked_reason || null;
+  const recoveryAction = blockedReason?.recovery?.recovery_action || null;
+  const blockedCategory = blockedReason?.category || null;
   return {
     id: entryId,
     action,
     run_id: state?.run_id || null,
     stop_reason: execution.result?.stop_reason || null,
     exit_code: execution.exitCode,
+    recovery_action: recoveryAction,
+    blocked_category: blockedCategory,
   };
 }
 
+function resolveScheduleExecutionState(root, config, execution, fallbackState) {
+  const executionState = execution.result?.state || null;
+  const liveState = loadProjectState(root, config);
+
+  if (execution.result?.stop_reason === 'blocked' || execution.result?.stop_reason === 'reject_exhausted') {
+    if (liveState?.status === 'blocked' && liveState?.blocked_reason) {
+      return liveState;
+    }
+  }
+
+  return executionState || liveState || fallbackState || null;
+}
+
 function recordScheduleExecution(context, entryId, execution, fallbackState, nowIso, action = 'ran') {
-  const state = execution.result?.state || fallbackState || null;
+  const state = resolveScheduleExecutionState(context.root, context.config, execution, fallbackState);
   const runId = state?.run_id || null;
   const startedAt = state?.created_at || nowIso;
 
@@ -197,7 +215,7 @@ async function continueActiveScheduledRun(context, opts = {}) {
   }
 
   const blocked = execution.result?.stop_reason === 'blocked';
-  const action = blocked && opts.tolerateBlockedRun ? 'blocked' : 'continued';
+  const action = blocked ? 'blocked' : 'continued';
   const result = recordScheduleExecution(context, scheduleId, execution, state, opts.at || new Date().toISOString(), action);
 
   if (execution.exitCode !== 0 && !(opts.tolerateBlockedRun && blocked)) {
@@ -312,7 +330,7 @@ async function runDueSchedules(context, opts = {}) {
       execution,
       execution.result?.state || null,
       nowIso,
-      blocked && opts.tolerateBlockedRun ? 'blocked' : 'ran',
+      blocked ? 'blocked' : 'ran',
     ));
 
     if (execution.exitCode !== 0) {
@@ -489,6 +507,8 @@ async function advanceScheduleContinuousSession(context, entry, opts = {}) {
     run_id: step.run_id || null,
     intent_id: step.intent_id || null,
     runs_completed: session.runs_completed,
+    recovery_action: step.recovery_action || null,
+    blocked_category: step.blocked_category || null,
   };
 }
 
@@ -536,7 +556,12 @@ export async function scheduleRunDueCommand(opts) {
       } else if (entry.action === 'preemption_failed') {
         console.log(chalk.red(`Schedule preemption failed: ${entry.id} (${entry.error || 'unknown error'})`));
       } else if (entry.action === 'blocked') {
-        console.log(chalk.yellow(`Schedule waiting on unblock: ${entry.id}`));
+        if (entry.recovery_action) {
+          const categorySuffix = entry.blocked_category ? ` (${entry.blocked_category})` : '';
+          console.log(chalk.yellow(`Schedule blocked: ${entry.id}${categorySuffix}. Recovery: ${entry.recovery_action}`));
+        } else {
+          console.log(chalk.yellow(`Schedule waiting on unblock: ${entry.id}`));
+        }
       } else if (entry.action === 'skipped') {
         console.log(chalk.yellow(`Schedule skipped: ${entry.id} (${entry.reason})`));
       } else if (entry.action === 'not_due') {
@@ -709,6 +734,8 @@ export async function scheduleDaemonCommand(opts) {
         runs_completed: contResult.runs_completed ?? null,
       };
       if (contResult.reason) contResultEntry.reason = contResult.reason;
+      if (contResult.recovery_action) contResultEntry.recovery_action = contResult.recovery_action;
+      if (contResult.blocked_category) contResultEntry.blocked_category = contResult.blocked_category;
 
       result = {
         ok: contResult.ok !== false && nonContResult.ok,