agentxchain 2.155.72 → 2.156.0

package/src/lib/ci-reporter.js

@@ -0,0 +1,188 @@
+import { appendFileSync } from 'node:fs';
+
+/**
+ * Detect CI environment from process.env.
+ * @returns {{ provider: string, run_url: string|null, run_id: string|null, ref: string|null, sha: string|null } | null}
+ */
+export function detectCIEnvironment() {
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    return {
+      provider: 'github_actions',
+      run_url: process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID
+        ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
+        : null,
+      run_id: process.env.GITHUB_RUN_ID || null,
+      ref: process.env.GITHUB_REF || null,
+      sha: process.env.GITHUB_SHA || null,
+    };
+  }
+  if (process.env.GITLAB_CI === 'true') {
+    return {
+      provider: 'gitlab_ci',
+      run_url: process.env.CI_PIPELINE_URL || null,
+      run_id: process.env.CI_PIPELINE_ID || null,
+      ref: process.env.CI_COMMIT_REF_NAME || null,
+      sha: process.env.CI_COMMIT_SHA || null,
+    };
+  }
+  if (process.env.CI === 'true') {
+    return {
+      provider: 'generic',
+      run_url: null,
+      run_id: null,
+      ref: null,
+      sha: null,
+    };
+  }
+  return null;
+}
+
+/**
+ * Format governance report as GitHub Actions annotations.
+ * @param {{ overall: string, subject?: object }} report - Governance report from buildGovernanceReport()
+ * @returns {string} Newline-separated GitHub Actions workflow commands
+ */
+export function formatGitHubAnnotations(report) {
+  const lines = [];
+
+  // Overall run status
+  if (report.overall === 'pass') {
+    lines.push(`::notice title=AgentXchain Governance::Run ${report.subject?.run?.run_id || 'unknown'} — PASS (${report.subject?.run?.phase || 'unknown'} phase)`);
+  } else if (report.overall === 'fail') {
+    lines.push(`::error title=AgentXchain Governance::Run ${report.subject?.run?.run_id || 'unknown'} — FAIL: ${report.message || 'governance check failed'}`);
+  } else {
+    lines.push(`::warning title=AgentXchain Governance::Run ${report.subject?.run?.run_id || 'unknown'} — ${report.overall}: ${report.message || 'review required'}`);
+  }
+
+  // Gate annotations
+  const gates = report.subject?.run?.gate_summary;
+  if (gates && typeof gates === 'object') {
+    for (const [gateName, gateStatus] of Object.entries(gates)) {
+      if (typeof gateStatus !== 'string') continue;
+      const normalizedStatus = gateStatus.toLowerCase();
+      if (normalizedStatus === 'satisfied' || normalizedStatus === 'pass' || normalizedStatus === 'passed') {
+        lines.push(`::notice title=Gate ${gateName}::satisfied`);
+      } else {
+        lines.push(`::warning title=Gate ${gateName}::${gateStatus}`);
+      }
+    }
+  }
+
+  // Decision annotations (first 20 to avoid flooding)
+  const decisions = report.subject?.run?.decisions || [];
+  for (const d of decisions.slice(0, 20)) {
+    lines.push(`::notice title=Decision ${d.id || 'unknown'}::${d.statement || d.summary || 'no statement'}`);
+  }
+
+  // Blocked-on annotation
+  if (report.subject?.run?.blocked_on) {
+    lines.push(`::error title=Blocked::${report.subject.run.blocked_reason || report.subject.run.blocked_on}`);
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * Write governance report summary as GitHub Actions output variables.
+ * @param {{ overall: string, subject?: object }} report
+ * @param {string} outputPath - Path to $GITHUB_OUTPUT file
+ * @returns {string[]} Array of key=value pairs written
+ */
+export function writeGitHubOutputVars(report, outputPath) {
+  const run = report.subject?.run || {};
+  const pairs = [
+    `run_status=${report.overall || 'unknown'}`,
+    `run_id=${run.run_id || ''}`,
+    `phase=${run.phase || ''}`,
+    `blocked=${run.blocked_on ? 'true' : 'false'}`,
+    `turn_count=${(run.turns || []).length}`,
+    `decision_count=${(run.decisions || []).length}`,
+  ];
+
+  if (outputPath) {
+    appendFileSync(outputPath, pairs.join('\n') + '\n');
+  }
+
+  return pairs;
+}
+
+/**
+ * Format governance report as JUnit XML.
+ * @param {{ overall: string, subject?: object }} report
+ * @returns {string} JUnit XML string
+ */
+export function formatJUnitXml(report) {
+  const run = report.subject?.run || {};
+  const gates = run.gate_summary || {};
+  const turns = run.turns || [];
+
+  // Escape XML special characters
+  const esc = (str) => String(str || '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+
+  // Build gate test cases
+  const gateEntries = Object.entries(gates).filter(([, v]) => typeof v === 'string');
+  const gateFailures = gateEntries.filter(([, status]) => {
+    const s = status.toLowerCase();
+    return s !== 'satisfied' && s !== 'pass' && s !== 'passed';
+  });
+  const gateCases = gateEntries.map(([name, status]) => {
+    const s = status.toLowerCase();
+    const passed = s === 'satisfied' || s === 'pass' || s === 'passed';
+    if (passed) {
+      return `    <testcase name="${esc(name)}" classname="agentxchain.gates" time="0" />`;
+    }
+    return [
+      `    <testcase name="${esc(name)}" classname="agentxchain.gates" time="0">`,
+      `      <failure message="${esc(status)}">${esc(name)} gate status: ${esc(status)}</failure>`,
+      '    </testcase>',
+    ].join('\n');
+  });
+
+  // Build turn test cases
+  const turnFailures = turns.filter((t) => t.status === 'failed' || t.status === 'blocked');
+  const turnCases = turns.map((t) => {
+    const name = `${t.turn_id || 'unknown'} (${t.role || 'unknown'})`;
+    const time = typeof t.duration_seconds === 'number' ? t.duration_seconds.toFixed(1) : '0';
+    if (t.status === 'completed' || t.status === 'accepted') {
+      return `    <testcase name="${esc(name)}" classname="agentxchain.turns" time="${time}" />`;
+    }
+    return [
+      `    <testcase name="${esc(name)}" classname="agentxchain.turns" time="${time}">`,
+      `      <failure message="${esc(t.status || 'unknown')}">${esc(t.summary || t.status || 'turn did not complete successfully')}</failure>`,
+      '    </testcase>',
+    ].join('\n');
+  });
+
+  const totalTests = gateEntries.length + turns.length;
+  const totalFailures = gateFailures.length + turnFailures.length;
+  const totalTime = typeof run.duration_seconds === 'number' ? run.duration_seconds.toFixed(1) : '0';
+
+  const xml = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    `<testsuites name="AgentXchain Governance" tests="${totalTests}" failures="${totalFailures}" errors="0" time="${totalTime}">`,
+    `  <testsuite name="Gates" tests="${gateEntries.length}" failures="${gateFailures.length}" errors="0">`,
+    ...gateCases,
+    '  </testsuite>',
+    `  <testsuite name="Turns" tests="${turns.length}" failures="${turnFailures.length}" errors="0">`,
+    ...turnCases,
+    '  </testsuite>',
+    '</testsuites>',
+  ].join('\n');
+
+  return xml;
+}
+
+/**
+ * Derive CI-appropriate exit code from governance report.
+ * @param {{ overall: string }} report
+ * @returns {number} 0 = pass, 1 = fail, 2 = error
+ */
+export function deriveCIExitCode(report) {
+  if (report.overall === 'pass') return 0;
+  if (report.overall === 'fail') return 1;
+  return 2;
+}

package/src/lib/claude-local-auth.js

@@ -12,10 +12,23 @@ const CLAUDE_ENV_AUTH_KEYS = [
 const DEFAULT_SMOKE_PROBE_TIMEOUT_MS = 10_000;
 const DEFAULT_SMOKE_PROBE_STDIN = 'ok';
 const CLAUDE_AUTH_FAILURE_RE = /authentication_failed|authentication_error|invalid authentication credentials|unauthorized|API Error:\s*401/i;
+const CODEX_AUTH_FAILURE_RE = /unauthorized|invalid api key|invalid_api_key|authentication failed|authentication_failed|openai[\s\S]{0,200}401|api[_ -]?key[\s\S]{0,200}invalid|401[\s\S]{0,200}(openai|invalid|unauthorized)/i;
 const CLAUDE_NODE_INCOMPATIBILITY_RE =
   /TypeError:\s*Object not disposable|TypeError\(["']Object not disposable["']\)|Object not disposable[\s\S]{0,2000}Node\.js v(?:1[0-9]|20\.[0-4]\.)/i;
 const CLAUDE_COMPATIBLE_NODE_MIN = { major: 20, minor: 5, patch: 0 };
 
+// Rate-limit detection — provider-agnostic patterns for subprocess output.
+// Matches Claude/Anthropic, OpenAI/Codex, and generic rate-limit signatures.
+const RATE_LIMIT_RE = /rate_limit_error|"error"\s*:\s*"rate_limit"|rate[_\s-]?limited|hit[_\s-]your[_\s-]limit|usage\s+limit|rate\s+limit\s+reached|429\s*too\s*many\s*requests|too\s+many\s+requests/i;
+
+// Reset time extraction — best-effort parsing of provider-reported reset delay.
+const RESET_PATTERNS = [
+  /resets?\s+in\s+(\d+)\s*s/i,                   // "Resets in 42s"
+  /retry[_\s-]?after\s*[:=]\s*(\d+)/i,           // "Retry-After: 30"
+  /wait\s+(\d+)\s*s(?:econds?)?/i,               // "Please wait 60 seconds"
+  /(?:rate[_\s-]?limit|too\s+many)[\s\S]{0,80}?(\d+)\s*seconds?/i,  // "Rate limited. Try again in 120 seconds."
+];
+
 function normalizeCommandTokens(runtime) {
   if (Array.isArray(runtime?.command)) {
     return runtime.command.flatMap((element) =>
@@ -37,10 +50,50 @@ export function isClaudeLocalCliRuntime(runtime) {
   return head === 'claude' || head.endsWith('/claude');
 }
 
+export function isCodexLocalCliRuntime(runtime) {
+  const tokens = normalizeCommandTokens(runtime);
+  if (tokens.length === 0) {
+    return false;
+  }
+  const head = tokens[0].toLowerCase();
+  return head === 'codex' || head.endsWith('/codex');
+}
+
+export function isCursorLocalCliRuntime(runtime) {
+  const tokens = normalizeCommandTokens(runtime);
+  if (tokens.length === 0) {
+    return false;
+  }
+  const head = tokens[0].toLowerCase();
+  return head === 'cursor' || head.endsWith('/cursor');
+}
+
+export function isWindsurfLocalCliRuntime(runtime) {
+  const tokens = normalizeCommandTokens(runtime);
+  if (tokens.length === 0) {
+    return false;
+  }
+  const head = tokens[0].toLowerCase();
+  return head === 'windsurf' || head.endsWith('/windsurf');
+}
+
+export function isOpenCodeLocalCliRuntime(runtime) {
+  const tokens = normalizeCommandTokens(runtime);
+  if (tokens.length === 0) {
+    return false;
+  }
+  const head = tokens[0].toLowerCase();
+  return head === 'opencode' || head.endsWith('/opencode');
+}
+
 export function hasClaudeAuthenticationFailureText(text) {
   return typeof text === 'string' && CLAUDE_AUTH_FAILURE_RE.test(text);
 }
 
+export function hasCodexAuthenticationFailureText(text) {
+  return typeof text === 'string' && CODEX_AUTH_FAILURE_RE.test(text);
+}
+
 export function hasClaudeNodeIncompatibilityText(text) {
   return typeof text === 'string' && CLAUDE_NODE_INCOMPATIBILITY_RE.test(text);
 }
@@ -49,6 +102,41 @@ export function hasClaudeBareFlag(runtime) {
   return normalizeCommandTokens(runtime).includes('--bare');
 }
 
+/**
+ * Returns true if the text contains any provider rate-limit signature.
+ * Provider-agnostic — works for Claude, OpenAI/Codex, Cursor, Windsurf, OpenCode, and generic 429 patterns.
+ */
+export function hasProviderRateLimitText(text) {
+  return typeof text === 'string' && RATE_LIMIT_RE.test(text);
+}
+
+/**
+ * Returns true if any log line contains a rate-limit signature.
+ * Mirrors hasClaudeAuthFailureOutput / hasCodexAuthFailureOutput pattern.
+ */
+export function hasRateLimitOutput(logs) {
+  if (!Array.isArray(logs)) return false;
+  return logs.some((line) => hasProviderRateLimitText(line));
+}
+
+/**
+ * Best-effort extraction of reset delay from subprocess output text.
+ * Returns milliseconds or null if no reset time is found.
+ */
+export function parseRateLimitResetMs(text) {
+  if (typeof text !== 'string') return null;
+  for (const pattern of RESET_PATTERNS) {
+    const match = text.match(pattern);
+    if (match) {
+      const seconds = Number.parseInt(match[1], 10);
+      if (seconds > 0 && seconds <= 3600) {
+        return seconds * 1000;
+      }
+    }
+  }
+  return null;
+}
+
 function parseNodeVersion(raw) {
   const match = String(raw || '').trim().match(/^v?(\d+)\.(\d+)\.(\d+)/);
   if (!match) return null;
@@ -310,4 +398,4 @@ export async function runClaudeSmokeProbe(opts) {
   });
 }
 
-export { CLAUDE_ENV_AUTH_KEYS, normalizeCommandTokens };
+export { CLAUDE_ENV_AUTH_KEYS, normalizeCommandTokens, RESET_PATTERNS };

package/src/lib/connector-probe.js

@@ -28,6 +28,24 @@ const KNOWN_CLI_AUTHORITY_FLAGS = [
     weak_flags: ['--full-auto'],
     label: 'OpenAI Codex CLI',
   },
+  {
+    binary: 'cursor',
+    authoritative_flag: '--background-agent',
+    weak_flags: [],
+    label: 'Cursor IDE',
+  },
+  {
+    binary: 'windsurf',
+    authoritative_flag: '--agent',
+    weak_flags: [],
+    label: 'Windsurf IDE',
+  },
+  {
+    binary: 'opencode',
+    authoritative_flag: '--non-interactive',
+    weak_flags: [],
+    label: 'OpenCode CLI',
+  },
 ];
 
 /**
@@ -37,6 +55,9 @@ const KNOWN_CLI_AUTHORITY_FLAGS = [
 const KNOWN_CLI_TRANSPORTS = {
   claude: ['stdin'],
   codex: ['argv', 'stdin'],
+  cursor: ['dispatch_bundle_only'],
+  windsurf: ['dispatch_bundle_only'],
+  opencode: ['stdin'],
 };
 
 function formatCommand(command, args = []) {

package/src/lib/continuous-run.js

@@ -47,6 +47,7 @@ import { getDispatchLogPath, getTurnStagingResultPath } from './turn-paths.js';
 import { reconcileOperatorHead } from './operator-commit-reconcile.js';
 import { getContinuityStatus } from './continuity-status.js';
 import { resolveGovernedRole } from './role-resolution.js';
+import { writeSessionCheckpoint } from './session-checkpoint.js';
 import {
   archiveStaleIntentsForRun,
   formatLegacyIntentMigrationNotice,
@@ -63,7 +64,7 @@ import {
 
 const CONTINUOUS_SESSION_PATH = '.agentxchain/continuous-session.json';
 const PRODUCTIVE_TIMEOUT_RETRY_MAX_PER_RUN = 1;
-const PRODUCTIVE_TIMEOUT_RETRY_DEADLINE_MINUTES = 60;
+const PRODUCTIVE_TIMEOUT_RETRY_DEADLINE_MINUTES = 120;
 const PROVIDER_REQUEST_TIMEOUT_RE = /request timed out|timed out waiting for (?:provider|api)|provider request timed out/i;
 
 function getRoadmapReplenishmentTriageHints(root) {
@@ -636,9 +637,21 @@ function clearGhostBlockerAfterReissue(root, state) {
     escalation: null,
   };
   writeGovernedState(root, nextState);
+  writeSessionCheckpoint(root, nextState, 'blocker_cleared');
   return nextState;
 }
 
+function isGovernedRunStillActiveForSession(root, config, session) {
+  try {
+    const state = loadProjectState(root, config);
+    if (!state || state.status !== 'active') return false;
+    if (session.current_run_id && state.run_id && session.current_run_id !== state.run_id) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Slice 2d (Turn 201): read the per-turn adapter dispatch log and return the
  * most recent stderr excerpt + exit code + signal from `process_exit` or
@@ -1253,7 +1266,7 @@ function reconcileContinuousStartupState(context, session, contOpts, log) {
  * @param {string} root
  * @param {string} visionPath - Absolute path to VISION.md
  * @param {{ triageApproval?: string }} options
- * @returns {{ ok: boolean, intentId?: string, section?: string, goal?: string, error?: string, idle?: boolean }}
+ * @returns {{ ok: boolean, intentId?: string, section?: string, goal?: string, source?: string, error?: string, idle?: boolean }}
  */
 export function seedFromVision(root, visionPath, options = {}) {
   const roadmapResult = deriveRoadmapCandidates(root);
@@ -1313,6 +1326,9 @@ export function seedFromVision(root, visionPath, options = {}) {
         reason: 'roadmap-open-work auto-approval',
       });
       if (!approveResult.ok) {
+        if (approveResult.error === 'scope_overlap_detected') {
+          return { ok: true, idle: true, deferred_reason: 'scope_overlap', overlap: approveResult.overlap };
+        }
         return { ok: false, error: `approve failed: ${approveResult.error}` };
       }
     }
@@ -1388,6 +1404,9 @@ export function seedFromVision(root, visionPath, options = {}) {
         reason: 'roadmap-replenishment auto-approval (BUG-77)',
       });
       if (!approveResult.ok) {
+        if (approveResult.error === 'scope_overlap_detected') {
+          return { ok: true, idle: true, deferred_reason: 'scope_overlap', overlap: approveResult.overlap };
+        }
         return { ok: false, error: `approve failed: ${approveResult.error}` };
       }
     }
@@ -1402,6 +1421,15 @@ export function seedFromVision(root, visionPath, options = {}) {
     };
   }
 
+  if (exhaustion.reason === 'vision_fully_mapped' || exhaustion.reason === 'vision_no_actionable_scope') {
+    return {
+      ok: true,
+      idle: true,
+      source: 'vision_exhausted',
+      reason: exhaustion.reason,
+    };
+  }
+
   const result = deriveVisionCandidates(root, visionPath);
   if (!result.ok) {
     return { ok: false, error: result.error };
@@ -1462,6 +1490,9 @@ export function seedFromVision(root, visionPath, options = {}) {
       reason: 'vision-derived auto-approval',
     });
     if (!approveResult.ok) {
+      if (approveResult.error === 'scope_overlap_detected') {
+        return { ok: true, idle: true, deferred_reason: 'scope_overlap', overlap: approveResult.overlap };
+      }
       return { ok: false, error: `approve failed: ${approveResult.error}` };
     }
   }
@@ -2289,7 +2320,7 @@ export async function advanceContinuousRunOnce(context, session, contOpts, execu
     if (seeded.source === 'roadmap_open_work') {
       log(`Roadmap-derived: ${visionObjective}`);
     } else if (seeded.source === 'roadmap_replenishment') {
-      log(`Roadmap-replenishment (roadmap exhausted, vision open): ${visionObjective}`);
+      log(`Roadmap exhausted, vision still open, deriving next increment: ${visionObjective}`);
     } else {
       log(`Vision-derived: ${visionObjective}`);
     }
@@ -2551,6 +2582,23 @@ export async function executeContinuousRun(context, contOpts, executeGovernedRun
     while (!stopping) {
       const step = await advanceContinuousRunOnce(context, session, contOpts, executeGovernedRun, log);
 
+      if (step.status === 'failed' && isGovernedRunStillActiveForSession(root, context.config, session)) {
+        session.status = 'running';
+        writeContinuousSession(root, session);
+        emitRunEvent(root, 'session_failed_recovered_active_run', {
+          run_id: session.current_run_id || null,
+          phase: null,
+          status: 'active',
+          payload: {
+            session_id: session.session_id,
+            failed_action: step.action || null,
+            failed_reason: step.stop_reason || null,
+          },
+        });
+        log('Session failure recovered - governed run still active, continuing.');
+        continue;
+      }
+
       // Terminal states
       if (step.status === 'completed' || step.status === 'idle_exit' || step.status === 'failed' || step.status === 'blocked' || step.status === 'stopped' || step.status === 'vision_exhausted' || step.status === 'vision_expansion_exhausted' || step.status === 'session_budget') {
         const terminalMessage = describeContinuousTerminalStep(step, contOpts);

package/src/lib/dashboard/bridge-server.js

@@ -287,14 +287,19 @@ export function createBridgeServer({ agentxchainDir, dashboardDir, port = 3847,
       try {
         const eventsPath = join(agentxchainDir, 'events.jsonl');
         if (!existsSync(eventsPath)) return;
-        const content = readFileSync(eventsPath, 'utf8');
-        if (content.length <= lastEventsFileSize) {
+        // Read as Buffer so .length is byte count, consistent with the
+        // byte-based lastEventsFileSize initialized at startup.  The old
+        // code read as 'utf8' (string), whose .length is *character* count
+        // — a mismatch that caused a full-replay on the first invalidation
+        // when events contained multi-byte UTF-8 content.
+        const contentBuf = readFileSync(eventsPath);
+        if (contentBuf.length <= lastEventsFileSize) {
           // File was truncated — reset and push all
-          if (content.length < lastEventsFileSize) lastEventsFileSize = 0;
+          if (contentBuf.length < lastEventsFileSize) lastEventsFileSize = 0;
           else return;
         }
-        const newContent = content.slice(lastEventsFileSize);
-        lastEventsFileSize = content.length;
+        const newContent = contentBuf.slice(lastEventsFileSize).toString('utf8');
+        lastEventsFileSize = contentBuf.length;
         const lines = newContent.split('\n').filter(Boolean);
         for (const line of lines) {
           try {

package/src/lib/dispatch-bundle.js

@@ -797,6 +797,9 @@ function renderContext(state, config, root, turn, role) {
       lines.push('');
       lines.push(`- **Turn:** ${lastTurn.turn_id}`);
       lines.push(`- **Role:** ${lastTurn.role}`);
+      if (lastTurn.runtime_id) {
+        lines.push(`- **Runtime:** ${lastTurn.runtime_id}`);
+      }
       lines.push(`- **Summary:** ${lastTurn.summary}`);
       if (lastTurn.decisions?.length) {
         lines.push('- **Decisions:**');
@@ -1412,12 +1415,13 @@ function renderDecisionHistory(root, warnings = []) {
   const lines = [];
   lines.push('## Decision History');
   lines.push('');
-  lines.push('| ID | Phase | Role | Statement |');
-  lines.push('|----|-------|------|-----------|');
+  lines.push('| ID | Phase | Role | Runtime | Statement |');
+  lines.push('|----|-------|------|---------|-----------|');
   for (const d of displayed) {
     // Escape pipes in statement to avoid breaking the table
     const stmt = (d.statement || '').replace(/\|/g, '\\|').replace(/\n/g, ' ');
-    lines.push(`| ${d.id} | ${d.phase || ''} | ${d.role || ''} | ${stmt} |`);
+    const runtimeId = (d.runtime_id || '').replace(/\|/g, '\\|').replace(/\n/g, ' ');
+    lines.push(`| ${d.id} | ${d.phase || ''} | ${d.role || ''} | ${runtimeId} | ${stmt} |`);
   }
   if (totalCount > DECISION_HISTORY_MAX_ENTRIES) {
     lines.push('');

package/src/lib/dispatch-progress.js

@@ -199,6 +199,15 @@ export function createDispatchProgressTracker(root, turn, options = {}) {
       writeProgress();
     },
 
+    /** Record adapter keepalive without treating it as governed startup proof. */
+    heartbeat(summary = 'Adapter keepalive') {
+      state.activity_type = 'heartbeat';
+      state.activity_summary = summary;
+      state.last_activity_at = new Date().toISOString();
+      dirty = true;
+      maybeWrite();
+    },
+
     /** Update PID after spawn (local_cli). */
     setPid(newPid) {
       state.pid = newPid;

package/src/lib/governed-state.js

@@ -3672,7 +3672,7 @@ export function assignGovernedTurn(root, config, roleId, options = {}) {
   const baseline = captureBaseline(root);
 
   const now = new Date().toISOString();
-  const timeoutMinutes = 20;
+  const timeoutMinutes = config?.timeouts?.per_turn_minutes || 120;
   const nextSequence = (state.turn_sequence || 0) + 1;
 
   // Record which turns are concurrent siblings (for conflict detection context)
@@ -3954,7 +3954,7 @@ export function reissueTurn(root, config, opts = {}) {
 
   // Create the new turn
   const newTurnId = `turn_${randomBytes(8).toString('hex')}`;
-  const timeoutMinutes = 20;
+  const timeoutMinutes = config?.timeouts?.per_turn_minutes || 120;
   const nextSequence = (state.turn_sequence || 0) + 1;
 
   const newTurn = {
@@ -4868,7 +4868,7 @@ function _acceptGovernedTurnLocked(root, config, opts) {
 
   const derivedRef = deriveAcceptedRef(observation, artifactType, state.accepted_integration_ref);
   const verificationReplay = (config.policies || []).some((policy) => policy?.rule === 'require_reproducible_verification')
-    ? replayVerificationMachineEvidence({ root, verification: turnResult.verification })
+    ? replayVerificationMachineEvidence({ root, verification: turnResult.verification, allowCommandExecution: true })
     : null;
 
   if (verificationReplay?.workspace_guard?.ok === false) {
@@ -5238,6 +5238,7 @@ function _acceptGovernedTurnLocked(root, config, opts) {
         turn_id: turnResult.turn_id,
         role: turnResult.role,
         phase: state.phase,
+        runtime_id: turnResult.runtime_id,
         category: decision.category,
         statement: decision.statement,
         rationale: decision.rationale,
@@ -6488,7 +6489,7 @@ export function rejectGovernedTurn(root, config, validationResult, reasonOrOptio
     const retryStartedAt = new Date().toISOString();
     retryTurn.baseline = captureBaseline(root);
     retryTurn.started_at = retryStartedAt;
-    retryTurn.deadline_at = new Date(Date.now() + 20 * 60 * 1000).toISOString();
+    retryTurn.deadline_at = new Date(Date.now() + (config?.timeouts?.per_turn_minutes || 120) * 60 * 1000).toISOString();
 
     if (isConflictReject) {
       retryTurn.assigned_sequence = Math.max(

package/src/lib/intake.js

@@ -28,6 +28,7 @@ import {
   derivePhaseScopeFromIntentMetadata,
   getPhaseOrder,
 } from './intent-phase-scope.js';
+import { checkIntentScopeOverlap } from './scope-overlap.js';
 
 const VALID_SOURCES = ['manual', 'ci_failure', 'git_ref_change', 'schedule', 'vision_scan', 'vision_idle_expansion'];
 const VALID_PRIORITIES = ['p0', 'p1', 'p2', 'p3'];
@@ -886,6 +887,25 @@ export function approveIntent(root, intentId, options = {}) {
     return { ok: false, error: `cannot approve from status "${intent.status}" (must be triaged or blocked)`, exitCode: 1 };
   }
 
+  // --- Scope overlap guard (M10) ---
+  if (!options.forceScope) {
+    const charterText = intent.charter || '';
+    const acceptanceItems = Array.isArray(intent.acceptance_contract) ? intent.acceptance_contract : [];
+    if (charterText) {
+      const overlapCheck = checkIntentScopeOverlap(root, charterText, acceptanceItems, {
+        threshold: options.scopeOverlapThreshold ?? 0.4,
+      });
+      if (overlapCheck.overlapping) {
+        return {
+          ok: false,
+          error: 'scope_overlap_detected',
+          overlap: overlapCheck,
+          exitCode: 3,
+        };
+      }
+    }
+  }
+
   const approver = options.approver || 'operator';
   const previousStatus = intent.status;
   const reason = options.reason || (previousStatus === 'blocked' ? 're-approved after block resolution' : 'approved for planning');
@@ -1077,13 +1097,19 @@ export function startIntent(root, intentId, options = {}) {
 
   // Load governed state
   const statePath = join(root, STATE_PATH);
+  let state;
   if (!existsSync(statePath)) {
-    return { ok: false, error: 'No governed state.json found', exitCode: 2 };
-  }
-
-  let state = loadProjectState(root, config);
-  if (!state) {
-    return { ok: false, error: 'Failed to parse governed state.json', exitCode: 2 };
+    // RB-11: cold-start. No state.json yet — synthesize an idle state so the
+    // bootstrap below initializes a fresh governed run, matching the `run`
+    // command. Without this, `intake start` (and continuous mode, which starts
+    // its first derived intent via this path) cannot start lights-out from a
+    // clean initialized project.
+    state = { status: 'idle', run_id: null };
+  } else {
+    state = loadProjectState(root, config);
+    if (!state) {
+      return { ok: false, error: 'Failed to parse governed state.json', exitCode: 2 };
+    }
   }
 
   const allowCompletedRestart = options.allowTerminalRestart === true

package/src/lib/normalized-config.js

@@ -444,6 +444,8 @@ export function validateV4Config(data, projectRoot) {
       }
       if (rt.type === 'local_cli') {
         validateRuntimePositiveInteger(`Runtime "${id}": startup_watchdog_ms`, rt.startup_watchdog_ms, errors);
+        validateRuntimePositiveInteger(`Runtime "${id}": startup_heartbeat_ms`, rt.startup_heartbeat_ms, errors);
+        validateRuntimePositiveInteger(`Runtime "${id}": liveness_heartbeat_ms`, rt.liveness_heartbeat_ms, errors);
       }
       // Validate prompt_transport for local_cli runtimes
       if (rt.type === 'local_cli' && rt.prompt_transport) {
@@ -639,6 +641,8 @@ export function validateRunLoopConfig(runLoop) {
     return errors;
   }
   validateRunLoopPositiveInteger('run_loop.startup_watchdog_ms', runLoop.startup_watchdog_ms, errors);
+  validateRunLoopPositiveInteger('run_loop.startup_heartbeat_ms', runLoop.startup_heartbeat_ms, errors);
+  validateRunLoopPositiveInteger('run_loop.liveness_heartbeat_ms', runLoop.liveness_heartbeat_ms, errors);
   validateRunLoopPositiveInteger('run_loop.stale_turn_threshold_ms', runLoop.stale_turn_threshold_ms, errors);
   if (runLoop.continuous !== undefined && runLoop.continuous !== null) {
     validateRunLoopContinuousConfig('run_loop.continuous', runLoop.continuous, errors);