ai-foreman 1.7.28 → 2.0.0

package/dist/cli/start.js

@@ -1,3 +1,4 @@
+import { nativePolicy, operationInstruction, operationPayload, structuredTurnErrorMessage } from "../structuredOperation.js";
 import { finalQaRoleInstructions, resolveEffectiveQaConfiguration } from "../qaEffectiveConfig.js";
 import { activateQaRecoveryBuilder } from "../qaBuilderActivation.js";
 import { graphContext, sendGraphTurn } from "../graph/turn.js";
@@ -11,7 +12,7 @@ import { captureFrozenQaSource } from "../qaSnapshot.js";
 import { finishStartAdmission, superviseStart, supervisedRunId } from "../supervisedStart.js";
 import { assertBuildAssignmentReconciled, isInterruptedBuilderRecovery, assertInterruptedSourceSnapshot } from "../buildAssignment.js";
 import { durableHumanDecision, HumanDecisionRequired, HumanDecisionCancelled, servicePendingHumanDecisions } from "../humanDecision.js";
-import { requiresBuildApproval, buildScopeRevision, createBuildApprovalGate } from "../buildApproval.js";
+import { requiresBuildApproval, buildScopeRevision, createBuildApprovalGate, validatePlanApprovalBinding, validateFrozenWorkApprovalBinding } from "../buildApproval.js";
 import { Command, Option } from "commander";
 import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { resolve, join, relative } from "node:path";
@@ -34,7 +35,7 @@ import { isTicketsInitialized, loadTicketsConfig, resolveTicketPaths } from "../
 import { hasRollbackOrMitigationPlan, loadTickets } from "../tickets/ticketLoader.js";
 import { StateDb } from "../tickets/stateDb.js";
 import { ticketDefinitionDigest } from "../tickets/riskWaivers.js";
-import { applySharedDeliveryBranch, applySizeBranchPolicy, buildBranchAuditInstruction, buildBranchPlan, parseAuditDependencies } from "../branch/planner.js";
+import { applySharedDeliveryBranch, applySizeBranchPolicy, buildBranchAuditInstruction, buildBranchPlan } from "../branch/planner.js";
 import { currentGitRef, ensureCleanBaseWorktree, generatedTrackerDirtyPaths } from "../branch/git.js";
 import { captureDirtyBaseline } from "../branch/dirtyBaseline.js";
 import { formatGitHubFailure, preflightGh } from "../branch/github.js";
@@ -42,7 +43,7 @@ import { preflightGlab } from "../branch/gitlab.js";
 import { readDeliveryUnitSession, runBranchPlan } from "../branch/runner.js";
 import { branchPlanLogMetadata, presentBranchPlan } from "../branch/presentation.js";
 import { branchTicketScopeProgress, buildRunSessionBinding, checkpointBuildRun, completeBuildRun, createBuildRun, currentBranchRecoveryTicket, currentBranchTicketProgress, recoveryExecutionTickets, finishBranchTicketScope, finishRecoveredTicketScope, heartbeatBuildRun, persistBuildSession, persistCurrentBuildSession, projectBuildRecovery, readBuildRuns, releaseBuildLease, resumeBuildRun } from "../buildRuns.js";
-import { parseProviderContract, qaRemediationProposalV1Schema } from "rafi-spec";
+import { branchAuditOutput, plannerRemediationOutput } from "rafi-spec";
 import { parse as parseYaml } from "yaml";
 import { findResumableBranchSessions, formatBranchContinueCommand, formatBranchSummaryFollowupCommands, } from "../branch/resume.js";
 import { detectGitProvider, loadTicketSetupConfig } from "../tickets/setupConfig.js";
@@ -693,6 +694,20 @@ export function buildStartCommand(options = {}) {
                 ? recoveryRecord.recoveryDecision?.planUpdateApproval === "auto"
                     && (recoveryRecord.recoveryDecision.planUpdateApprovalSource === "explicit-yes" || recoveryRecord.recoveryDecision.planUpdateApprovalSource === "explicit-choice")
                 : Boolean(opts.yes);
+            const recoveryTickets = recoveryRecord?.recoveryDecision?.executionTickets ?? recoveryRecord?.tickets ?? [];
+            // Empty-scope recovery is used by established/supervisor lifecycle
+            // recovery fixtures and has no ticket plan to bind. Ticket-bearing
+            // recovery remains fail-closed on an exact current-plan approval.
+            if (recoveryRecord && autoApprovePlanUpdates && recoveryTickets.length > 0) {
+                const decision = recoveryRecord.recoveryDecision;
+                if (!decision?.planApproval && !decision?.frozenWorkApproval)
+                    fail("saved --yes approval has no exact plan binding; rerun rafi build:resume --yes to approve the current plan");
+                const approvalCheck = decision.frozenWorkApproval
+                    ? validateFrozenWorkApprovalBinding(cwd, recoveryRecord.runId, recoveryTickets, decision.frozenWorkApproval)
+                    : validatePlanApprovalBinding(cwd, recoveryTickets, decision.planApproval);
+                if (!approvalCheck.valid)
+                    fail(`saved --yes approval is stale (${approvalCheck.reason}); rerun rafi build:resume --yes before provider work`);
+            }
             if (opts.recoveryMode) {
                 const allowed = ["exact-session", "fresh-with-handoff", "fresh-recovery-only", "guided-recovery"];
                 if (!allowed.includes(String(opts.recoveryMode)))
@@ -1293,7 +1308,6 @@ export function buildStartCommand(options = {}) {
                     try {
                         const revision = countDb.continuityHead(runId, "builder")?.authoritativeStateRevision ?? settings.settings_revision;
                         countDb.appendContinuityEvent({ runId, role: "builder", kind: "builder_requested_handoff_delta", payload: request.delta, authoritativeStateRevision: revision });
-                        countDb.publishContinuityCheckpoint({ runId, role: "builder", delta: request.delta, authoritativeStateRevision: revision });
                         compactionCount = countDb.successfulCompactionCount(runId, "builder", predecessor.sessionRef?.() ?? sessionId);
                     }
                     finally {
@@ -1306,6 +1320,7 @@ export function buildStartCommand(options = {}) {
                         predecessorSessionId: sessionId,
                         predecessorSessionRef: predecessor.sessionRef?.(),
                         requestedByBuilder: true,
+                        predecessorDispatchId: request.predecessorDispatchId,
                         roleState: {
                             ...request.roleState,
                             frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"),
@@ -1322,7 +1337,8 @@ export function buildStartCommand(options = {}) {
                         resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
                     }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("builder"));
                     log.write("handoff-transfer", {
-                        requestedByBuilder: true, reason: request.reason, generation: transfer.manifest.generation,
+                        requestedByBuilder: true,
+                        predecessorDispatchId: request.predecessorDispatchId, reason: request.reason, generation: transfer.manifest.generation,
                         predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
                         acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
                     });
@@ -2015,10 +2031,13 @@ export function buildStartCommand(options = {}) {
                     try {
                         auditBuilder = await createBuilder(cwd);
                         auditViewer = printEvents(auditBuilder.events());
-                        const audit = await sendGraphTurn(auditBuilder, buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)), graphContext(cwd, auditBuilder.sessionRef?.()?.cwd ?? cwd, "branch-dependency-audit", plan.nodes.map(node => node.ticket.id).join(" ")), { purpose: "planning" });
+                        const audit = await sendGraphTurn(auditBuilder, `${buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket))}\n${operationInstruction(branchAuditOutput)}`, graphContext(cwd, auditBuilder.sessionRef?.()?.cwd ?? cwd, "branch-dependency-audit", plan.nodes.map(node => node.ticket.id).join(" ")), nativePolicy(branchAuditOutput, { purpose: "planning", journalRunId: auditRunId }));
                         if (audit.isError)
-                            throw new Error(audit.text);
-                        const auditDependencies = parseAuditDependencies(audit.text);
+                            throw new Error(structuredTurnErrorMessage(audit, "Branch dependency audit"));
+                        const auditDependencies = operationPayload(audit, branchAuditOutput).dependencies;
+                        const selectedIds = new Set(plan.nodes.map(node => node.ticket.id));
+                        if (auditDependencies.some(dep => dep.ticket === dep.dependsOn || !selectedIds.has(dep.ticket) || !selectedIds.has(dep.dependsOn)))
+                            throw new Error("Branch audit returned a foreign or self dependency");
                         plan = buildBranchPlan(tickets, states, {
                             steps,
                             baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch ?? currentGitRef(cwd),
@@ -3134,8 +3153,7 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                 `User discussion: ${String(discussion)}`,
                 `Complete QA history:\n${JSON.stringify(context.history, null, 2)}`,
                 `${diffTruncated ? "Builder diff (TRUNCATED at 128 KiB; inspect the actual worktree before relying on it)" : "Full Builder diff"}:\n${diff || "(no tracked diff)"}`,
-                "Return RAFI_QA_REMEDIATION_START, then one JSON object {\"summary\":\"...\",\"fix_instructions\":[\"...\"]}, then RAFI_QA_REMEDIATION_END.",
-                "End with STEP_STATUS: plan_complete | summary=\"QA remediation proposed\"",
+                "Submit the native planner-remediation payload with summary and fix_instructions.",
             ].join("\n\n");
             let resumeSessionId;
             let revision = 0;
@@ -3143,24 +3161,14 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                 revision++;
                 const proposalDigest = createHash("sha256").update(JSON.stringify([scope, round, revision, instruction, planner, captureFrozenQaSource(context.builderWorktree).digest])).digest("hex");
                 const run = await durableReadOnlyProposal({ projectDir, runId, ticketId: context.ticket.id, digest: proposalDigest, operation: () => runRoleInstruction({
-                        projectDir, role: "planner", instruction, label: "QA Planner remediation", agent: planner?.make,
+                        projectDir, role: "planner", instruction, output: plannerRemediationOutput, label: "QA Planner remediation", agent: planner?.make,
                         model: explicitDefaultValue(planner?.model), effort: explicitEffort(planner?.reasoning), fast: planner?.fast,
                         resumeSessionId, permissionConfig: readOnlyPermissionConfig(), sandboxMode: "read-only",
                         logPath: makeRoleLogPath(projectDir, "qa-remediation"), logEvent: "rafi-plan",
                     }) });
-                if (run.turn.result.isError || run.turn.status.kind !== "plan_complete")
+                if (run.turn.result.isError || run.turn.status.kind !== "done")
                     throw new Error(`Planner remediation failed: ${run.turn.status.error ?? run.turn.result.text.slice(0, 500)}`);
-                const match = /RAFI_QA_REMEDIATION_START\s*([\s\S]*?)\s*RAFI_QA_REMEDIATION_END/.exec(run.turn.result.text);
-                if (!match)
-                    throw new Error("Planner remediation did not return the required structured proposal");
-                let parsed;
-                try {
-                    parsed = JSON.parse(match[1].replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, ""));
-                }
-                catch (error) {
-                    throw new Error(`Planner remediation proposal is invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
-                }
-                const proposal = parseProviderContract(qaRemediationProposalV1Schema, parsed, "RAFI_QA_REMEDIATION");
+                const proposal = operationPayload(run.turn.result, plannerRemediationOutput);
                 console.log(`\nPlanner remediation: ${proposal.summary}\n${proposal.fix_instructions.map((item) => `- ${item}`).join("\n")}`);
                 const decision = await ask(`QA remediation approval ${revision}: ${JSON.stringify(proposal)}`, [{ id: "approve", label: "Approve" }, { id: "revise", label: "Revise" }, { id: "cancel", label: "Return to choices" }], () => select({ message: "Use this remediation for a new Builder fix session?", options: [
                         { value: "approve", label: "Approve (Recommended)" }, { value: "revise", label: "Discuss/revise" }, { value: "cancel", label: "Cancel and return to choices" },
@@ -3173,7 +3181,7 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                 if (isCancel(feedback))
                     break;
                 resumeSessionId = run.sessionId;
-                instruction = `Revise the complete QA remediation proposal using this feedback: ${String(feedback)}. Keep the exact structured envelope and final plan_complete marker.`;
+                instruction = `Revise the complete QA remediation proposal using this feedback: ${String(feedback)}. Use the native planner-remediation contract.`;
             }
         }
     };

package/dist/cli/tickets.js

@@ -1,9 +1,11 @@
+import { streamTicketPopulation } from "../ticketPopulationPaging.js";
+import { operationPayload } from "../structuredOperation.js";
 import { Command } from "commander";
 import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { riskNoteRepairProposalV1Schema, zodIssues } from "rafi-spec";
+import { riskNoteRepairOutput, riskNoteRepairProposalV1Schema, zodIssues } from "rafi-spec";
 import { select, text, confirm, isCancel, multiselect } from "@clack/prompts";
 import { loadConfig } from "../config.js";
 import { Log } from "../log.js";
@@ -20,7 +22,7 @@ import { DEFAULT_TICKET_SETUP, configuredPlanningSources, configuredAppName, def
 import { deactivateSource, discardStagedSourceCaptures, loadSourceRegistry, refreshSourceRegistry, registerSourceRequests, removeSource, saveSourceRegistry, } from "../sources/sourceRegistry.js";
 import { fetchAndSnapshotUrl, snapshotExternalLocalFile } from "../tickets/sourceFetch.js";
 import { checkpointInterview, completeInterview, createInterviewRecord, failInterview, readInterviewRecords, resumeInterviewRecord, } from "../interviews.js";
-import { applyTicketPopulation, assertRiskPlanOnlyCorrection, authorizeTicketRetirements, extractTicketPopulationProposal, materializeTicketPopulation, recoverTicketPublications, TicketPopulationValidationError, TICKET_POPULATION_PROPOSAL_END, TICKET_POPULATION_PROPOSAL_START } from "../ticketPopulation.js";
+import { applyTicketPopulation, assertRiskPlanOnlyCorrection, authorizeTicketRetirements, materializeTicketPopulation, recoverTicketPublications, TicketPopulationValidationError } from "../ticketPopulation.js";
 import { loadTickets, saveTickets, validateTicketDefs } from "../tickets/ticketLoader.js";
 import { resolveTicketPaths } from "../tickets/config.js";
 import { formatAllTicketDetails, formatTicketDetails, getAllTicketDetails, getTicketDetails } from "../tickets/details.js";
@@ -31,6 +33,7 @@ import { listTicketGroups, previewTicketGroupRepair, repairTicketGroups } from "
 import { StateDb } from "../tickets/stateDb.js";
 import { ticketDefinitionDigest } from "../tickets/riskWaivers.js";
 import { hasRollbackOrMitigationPlan } from "../tickets/ticketLoader.js";
+import { migrateTrackerRules } from "../tickets/renderMarkdown.js";
 let nestedTicketCommandDepth = 0;
 class TicketInterviewCancelled extends Error {
 }
@@ -195,23 +198,13 @@ Return ticket content using Foreman's schema:
 - title, area, priority, size, risk, depends_on, summary, acceptance, required_tests, likely_files, rollback, notes.
 - Keep dependencies, acceptance criteria, testing expectations, file hints, risk notes, and implementation notes from the source material. For each ticket, use only the mapped approved slice's acceptance and required tests; do not copy plan-level acceptance criteria or add requirements about sibling slices or unfinished tickets. A ticket's acceptance must remain implementable and verifiable when its own slice is delivered.
 - Preserve additive-slice independence without inventing an absence test: each ticket's own behavior and tests should work against the shared approved baseline and must not depend on sibling implementation. Do not add wording such as "with the sibling absent/present," "without [sibling] present," or "with this slice alone" unless the approved plan explicitly requires sibling absence testing or an isolated branch. Otherwise use positive own-ticket checks, the shared project tests, and the combined-result check.
-- Preserve the approved slice's documentation policy exactly. Documentation is off by default; do not invent a documentation requirement because a docs directory exists. When documentation is required, retain its exact targets and criteria so the Builder and independent QA can enforce it.
+- Rafi copies documentation policy and QA preparation decisions directly from the approved slice. Do not include these host-owned fields in your proposal or invent additional requirements. Preserve the approved acceptance and tests.
 - File names and likely_files are implementation hints, not an exhaustive allowlist. Do not invent acceptance criteria or tests that require an exact changed-file list; allow other relevant files needed to complete the approved work. Preserve explicit user-established security, privacy, access, and other safety restrictions. Rafi manages ticket lifecycle state; do not require the Builder to mark tickets done in a document.
 - For every Medium or High risk ticket, \`rollback\` is required. It must state a concrete rollback or mitigation action: what is disabled, reverted, or contained, and how recovery or impact is verified. \`notes\` may add context but never satisfies this requirement. Low-risk tickets may use \`rollback: null\`.
 - Do not store mutable status/progress fields in .tickets/tickets.yaml.
 - Dependencies must reference slice_ref values. Include the exact IDs of existing populated tickets whose removed slices should become obsolete.
 
-If source content does not cleanly map to the new schema, ask for guidance instead of guessing. Use:
-STEP_STATUS: needs_input | question="..." choices="..."
-
-Output one JSON object between ${TICKET_POPULATION_PROPOSAL_START} and ${TICKET_POPULATION_PROPOSAL_END} with shape:
-{"version":1,"plan_id":"approved plan ID","revision":1,"tickets":[{"slice_ref":"slc_low","title":"...","area":"...","priority":"P1","size":"S","risk":"Low","summary":"...","acceptance":["..."],"required_tests":["..."],"likely_files":["..."],"documentation":{"required":false,"targets":[],"criteria":[]},"depends_on":[],"rollback":null,"notes":null},{"slice_ref":"slc_medium","title":"...","area":"...","priority":"P1","size":"S","risk":"Medium","summary":"...","acceptance":["..."],"required_tests":["..."],"likely_files":["..."],"documentation":{"required":false,"targets":[],"criteria":[]},"depends_on":["slc_low"],"rollback":"Disable the feature flag, restore the previous handler, and verify the affected error rate returns to baseline.","notes":null}],"retirements":["exact existing ticket ID"]}
-Triple-check that every approved slice appears exactly once.
-
-End with exactly one marker line as the final non-empty line:
-STEP_STATUS: done | summary="populated Foreman tickets from existing project ticket sources"
-or
-STEP_STATUS: blocked | reason="why ticket population cannot proceed"`;
+If source content does not cleanly map to the approved plan, return a needs-input or blocked result instead of guessing. Return the full proposal in result.payload of the native ticket-population response. The proposal contains version, plan_id, revision, tickets, and retirements. Do not allocate final ticket IDs.`;
 }
 /** A bounded correction loop ended without a publishable proposal. */
 export class TicketPopulationRiskCorrectionExhaustedError extends Error {
@@ -531,6 +524,18 @@ async function cmdSetupUpdateCli(opts) {
             saveSourceRegistry(dir, patch.sourceRegistry);
         registrySaved = true;
         syncTicketLimits(dir, next.limits);
+        if (isTicketsInitialized(dir)) {
+            const ticketsConfig = loadTicketsConfig(dir);
+            const trackerRulesPath = join(dir, ticketsConfig.paths.trackerRules);
+            if (existsSync(trackerRulesPath)) {
+                const before = readFileSync(trackerRulesPath, "utf8");
+                const migrated = migrateTrackerRules(before, ticketsConfig.paths.progressDoc);
+                if (migrated.disposition !== "unchanged") {
+                    writeFileSync(trackerRulesPath, migrated.content, "utf8");
+                    console.log(`foreman tickets setup: ${migrated.disposition === "replaced-legacy" ? "upgraded" : "refreshed"} Rafi-managed tracker rules`);
+                }
+            }
+        }
         console.log(`foreman tickets setup: updated ticket setup in ${join(dir, "rafi-config.yaml")}`);
         if (isTicketsInitialized(dir)) {
             const rows = cmdQueue(dir, 1);
@@ -1465,8 +1470,14 @@ export async function cmdPopulateCli(opts) {
         if (contextSources.length) {
             console.log(`foreman tickets: context sources ${contextSources.join(" ")}`);
         }
-        let turn = await foreman.runInstruction(buildPopulateInstruction(approvedPlan.path, contextSources, ticketsConfig.paths.progressDoc));
-        planningRecord = checkpointInterview(dir, planningRecord, { runtime: { runtime: roleBuilder.runtime, model: roleBuilder.model, sessionId: builder.sessionId() }, decisions: { ...planningRecord.decisions, proposalResponse: turn.result.text } });
+        const population = (instruction, correction) => streamTicketPopulation({
+            projectDir: dir, interviewId: planningRecord.id, correction, instruction,
+            checkpoint: scope => { planningRecord = checkpointInterview(dir, planningRecord, { decisions: { ...planningRecord.decisions, populationArtifact: scope } }); },
+            dispatch: (instruction, policy) => foreman.runInstruction(instruction, policy),
+        });
+        const initialPopulation = await population(buildPopulateInstruction(approvedPlan.path, contextSources, ticketsConfig.paths.progressDoc), 0);
+        let turn = initialPopulation.turn;
+        planningRecord = checkpointInterview(dir, planningRecord, { runtime: { runtime: roleBuilder.runtime, model: roleBuilder.model, sessionId: builder.sessionId() }, decisions: { ...planningRecord.decisions, proposalResponse: turn.result.text, structuredResponse: turn.result.structured } });
         log.write("ticket-populate", {
             statusKind: turn.status.kind,
             summary: turn.status.summary,
@@ -1484,7 +1495,9 @@ export async function cmdPopulateCli(opts) {
             throw new Error(`needs human — ${turn.status.error ?? "builder did not emit done"}`);
         }
         const existing = loadTickets(resolveTicketPaths(ticketsConfig, dir).tickets);
-        let proposal = extractTicketPopulationProposal(turn.result.text);
+        if (!turn.result.selectedDispatch)
+            throw new Error("Ticket population response has no sealed dispatch tuple");
+        let proposal = initialPopulation.proposal;
         let proposalArtifact = savePopulationProposalArtifact(dir, planningRecord.id, approvedPlan, proposal);
         let materialized;
         let populationWaiver;
@@ -1510,18 +1523,22 @@ export async function cmdPopulateCli(opts) {
                     continue;
                 }
                 console.log(`foreman tickets: ${ids} need risk plans; asking Ticket Maker for a targeted correction (${correction + 1}/2)`);
-                const correctionTurn = await foreman.runInstruction(`Correct the existing ticket population proposal only. Do not change plan_id, revision, slice_ref mappings, ticket IDs, dependencies, scope, ownership, acceptance criteria, tests, retirements, or any field except \`rollback\` for these tickets: ${ids}. Each listed ticket is Medium or High risk and requires a concrete rollback or mitigation plan in \`rollback\`; \`notes\` cannot satisfy this requirement. Return the complete replacement JSON proposal between ${TICKET_POPULATION_PROPOSAL_START} and ${TICKET_POPULATION_PROPOSAL_END}, followed by STEP_STATUS: done.`);
+                const correctedPopulation = await population(`Correct the existing ticket population proposal only. Do not change plan_id, revision, slice_ref mappings, ticket IDs, dependencies, scope, ownership, acceptance criteria, tests, retirements, or any field except \`rollback\` for these tickets: ${ids}. Each listed ticket is Medium or High risk and requires a concrete rollback or mitigation plan in \`rollback\`; \`notes\` cannot satisfy this requirement. Return the complete replacement proposal through native ticket-population pages.`, correction + 1);
+                const correctionTurn = correctedPopulation.turn;
                 if (correctionTurn.result.isError || (correctionTurn.status.kind !== "done" && correctionTurn.status.kind !== "plan_complete")) {
                     throw new Error(`Ticket Maker could not correct missing risk plans for ${ids}: ${correctionTurn.status.reason ?? correctionTurn.status.error ?? correctionTurn.result.text.slice(0, 200)}`);
                 }
                 turn = correctionTurn;
                 planningRecord = checkpointInterview(dir, planningRecord, {
                     runtime: { runtime: roleBuilder.runtime, model: roleBuilder.model, sessionId: builder.sessionId() },
-                    decisions: { ...planningRecord.decisions, proposalResponse: turn.result.text, riskPlanCorrections: correction + 1 },
+                    decisions: { ...planningRecord.decisions, proposalResponse: turn.result.text, structuredResponse: turn.result.structured, riskPlanCorrections: correction + 1 },
                 });
-                const corrected = extractTicketPopulationProposal(turn.result.text);
+                const corrected = correctedPopulation.proposal;
                 assertRiskPlanOnlyCorrection(proposal, corrected, err.repairableRiskSliceRefs);
                 proposal = corrected;
+                if (!turn.result.selectedDispatch)
+                    throw new Error("Ticket population correction has no sealed dispatch tuple");
+                // A correction is immutable lineage, never a rewrite of the terminal proposal.
                 proposalArtifact = savePopulationProposalArtifact(dir, planningRecord.id, approvedPlan, proposal);
             }
         }
@@ -1584,13 +1601,12 @@ export async function cmdRepairRiskNotesCli(opts) {
             "You are Ticket Maker in read-only repair mode. Do not edit files.",
             "For every listed ticket, supply a concrete rollback or mitigation plan. Do not change any other field or add/remove tickets.",
             `Tickets requiring repair:\n${JSON.stringify(targets.map(ticket => ({ id: ticket.id, title: ticket.title, risk: ticket.risk, summary: ticket.summary, acceptance: ticket.acceptance, required_tests: ticket.required_tests })), null, 2)}`,
-            `Return exactly one JSON object between ${RISK_NOTE_REPAIR_START} and ${RISK_NOTE_REPAIR_END}: {"version":1,"tickets":[{"id":"T001","rollback":"Concrete reversal or mitigation steps."}]}.`,
-            "End with STEP_STATUS: done | summary=\"risk-note repair proposed\"",
+            `Submit the native risk-note-repair payload: {"version":1,"tickets":[{"id":"T001","rollback":"Concrete reversal or mitigation steps."}]}.`,
         ].join("\n\n");
-        const turn = await foreman.runInstruction(instruction);
+        const turn = await foreman.runInstruction(instruction, { output: riskNoteRepairOutput });
         if (turn.result.isError || (turn.status.kind !== "done" && turn.status.kind !== "plan_complete"))
             throw new Error(`Ticket Maker could not propose risk-plan repairs: ${turn.status.reason ?? turn.status.error ?? turn.result.text.slice(0, 300)}`);
-        const proposal = extractRiskNoteRepairProposal(turn.result.text);
+        const proposal = operationPayload(turn.result, riskNoteRepairOutput);
         const repaired = applyRiskNoteRepairProposal(current, proposal);
         for (const target of targets)
             console.log(`  ${target.id}: ${proposal.tickets.find(item => item.id === target.id).rollback.trim()}`);

package/dist/continuity.d.ts

@@ -1,5 +1,6 @@
 import type { ContinuityDelta, ResolvedAgentSettings } from "rafi-spec";
 import type { BuilderAdapter, CompactResult, ContextUsage, NativeAutoCompactionPolicy, NativeCompaction, ProviderSessionUsage, ProviderSettingSwitch, RuntimeFailure, TurnResult } from "./adapters/types.js";
+import type { BuilderHandoffRequest } from "./handoffs.js";
 export declare const CONTINUITY_MARKER = "RAFI_CONTINUITY_DELTA:";
 export declare class ContinuityValidationError extends Error {
     readonly problems: string[];
@@ -22,12 +23,8 @@ export declare class SessionUnavailableContinuityError extends Error {
     readonly guidedRecovery: boolean;
     constructor(runId: string, role: "builder" | "qa", failure: RuntimeFailure);
 }
+export declare const CONTINUITY_REQUIRED_INSTRUCTION = "Include the required bounded continuity object in the operation response; continuity cannot be null for this session.";
 export declare function validateContinuityDelta(value: unknown): ContinuityDelta;
-export declare function parseContinuityDelta(text: string): {
-    delta?: ContinuityDelta;
-    cleanText: string;
-    error?: ContinuityValidationError;
-};
 export declare function mergeContinuityDeltas(deltas: readonly ContinuityDelta[]): ContinuityDelta;
 export declare function baselineContinuityDelta(nextAction?: string): ContinuityDelta;
 export declare function continuityInstruction(role?: "builder" | "qa"): string;
@@ -53,7 +50,7 @@ export interface ContinuityAdapterOptions {
     /** Explicit compatibility recovery may replace a dead predecessor lease only after its first valid checkpoint. */
     replaceRecoveryLeaseAfterCheckpoint?: boolean;
     /** Host-owned validated Builder handoff request processing at a safe turn boundary. */
-    handleHandoffRequest?: (text: string, predecessor: BuilderAdapter, frozenAction: string) => Promise<BuilderAdapter | undefined>;
+    handleHandoffRequest?: (text: string | BuilderHandoffRequest, predecessor: BuilderAdapter, frozenAction: string) => Promise<BuilderAdapter | undefined>;
     /** QA journals each provider turn separately; wrappers must not repair or redispatch inside one host turn. */
     durableSingleTurn?: boolean;
 }
@@ -79,15 +76,16 @@ export declare class ContinuityAdapter implements BuilderAdapter {
     /** Establish an explicitly requested fresh owner before context probes or work. */
     validateFreshRecovery(): Promise<void>;
     get agent(): "claude" | "codex";
-    sendTurn(instruction: string, policy?: {
-        handback?: boolean;
-        responseOnly?: boolean;
-        logicalActionId?: string;
-        purpose?: import("./providerPhase.js").ProviderTurnPurpose;
-    }): Promise<TurnResult>;
+    /** Every confirmed dispatch publishes a checkpoint, so continuity is mandatory. */
+    structuredDispatchRequirement(): import("./adapters/types.js").StructuredDispatchRequirement;
+    sendTurn(instruction: string, policy?: import("./adapters/types.js").TurnRequest): Promise<TurnResult>;
     private sendTurnOwned;
+    postConfirmedDispatch(reference: import("./adapters/types.js").ConfirmedDispatchReference): Promise<TurnResult>;
     observeEvents(listener: (event: import("./adapters/types.js").BuilderEvent) => void): () => void;
     acceptHandbackTurn(turn: TurnResult): void;
+    /** Explicit restart recovery of the already accepted action; never repeats acceptance. */
+    resumePlannedContinuation(): Promise<TurnResult | undefined>;
+    recoverConfirmedPublications(): Promise<void>;
     sessionId(): string | undefined;
     sessionRef(): import("rafi-spec").ProviderSessionRefV1 | undefined;
     prepareSession(): Promise<import("rafi-spec").ProviderSessionRefV1>;
@@ -109,9 +107,7 @@ export declare class ContinuityAdapter implements BuilderAdapter {
     /** Keep the observable wrapper and event stream stable while moving to an accepted successor. */
     adoptValidatedSuccessor(successor: BuilderAdapter): Promise<void>;
     private publish;
-    private moveRecoveryLeaseAfterCheckpoint;
     private recordSessionUnavailable;
-    private reconstructionHandoff;
     private revision;
     private pumpEvents;
 }