blun-king-cli 9.1.565 → 9.1.566

package/agent-spine-plugin/src/lib/gateway-runtime.js

@@ -17,6 +17,9 @@ export const GATEWAY_RUNTIME_SCHEMA = "agentspine.gateway-runtime/v1";
 export const GATEWAY_EVENT_SCHEMA = "agentspine.gateway-event/v1";
 export const GOAL_PLAN_SCHEMA = "agentspine.goal-plan/v1";
 export const KNOWLEDGE_GAP_SCHEMA = "agentspine.knowledge-gap/v1";
+export const EXECUTION_OUTCOME_SCHEMA = "agentspine.execution-outcome/v1";
+export const EXECUTION_ATTEMPT_SCHEMA = "agentspine.execution-attempt/v1";
+export const STRATEGY_TRANSFER_PROOF_SCHEMA = "agentspine.strategy-transfer-proof/v1";
 
 const CONFIRMATION = "local-owner-confirmed";
 const MAX_BYTES = 8 * 1024 * 1024;
@@ -33,6 +36,7 @@ const SECRET_KEY_RE = /"(?:api[-_ ]?key|token|password|secret|credential)"\s*:/i
 const AUTHORITY_RE = /\b(?:permission|rights?|roles?|owner|trusted|delegat|authorized|approval|production|payment|spending|tool capability|send capability)\b/i;
 const HEALTH_VALUES = new Set(["stopped", "running", "unknown", "healthy", "degraded", "failed"]);
 const KNOWLEDGE_EVIDENCE = new Set(["owner-input", "objective-observation"]);
+const METRIC_OPERATORS = new Set(["gte", "lte", "eq"]);
 
 function emptyPolicy(root) {
   return { schema: GATEWAY_POLICY_SCHEMA, root, revision: 0, enabled: false, killSwitch: false, goals: [], history: [] };
@@ -136,8 +140,358 @@ function validKnowledgeGap(gap) {
   return gap.resolutionDigest === sha256(JSON.stringify(knowledgeGapResolutionMaterial(gap)));
 }
 
+function executionDecisionMaterial(execution) {
+  return {
+    requiredCapabilities: execution.requiredCapabilities, strategies: execution.strategies,
+    verification: execution.verification, selectedStrategyId: execution.selectedStrategyId,
+    ...(execution.explorationMaxAttempts === undefined ? {} : {
+      explorationMaxAttempts: execution.explorationMaxAttempts,
+      explorationOrder: execution.explorationOrder
+    }),
+    ...(execution.transferKey === undefined ? {} : {
+      transferKey: execution.transferKey, transferMaxAgeDays: execution.transferMaxAgeDays,
+      transferProof: execution.transferProof
+    }),
+    authority: "context-only-decision"
+  };
+}
+
+function sufficientExecutionStrategies(execution) {
+  const required = new Set(execution.requiredCapabilities);
+  return execution.strategies.filter((strategy) => strategy.capabilities.every((capability) => ID_RE.test(capability))
+    && [...required].every((capability) => strategy.capabilities.includes(capability)))
+    .sort((left, right) => left.risk - right.risk || left.cost - right.cost
+      || left.strategyId.localeCompare(right.strategyId));
+}
+
+function selectedExecutionStrategy(execution) {
+  const sufficient = sufficientExecutionStrategies(execution);
+  const minimumRisk = sufficient[0]?.risk;
+  const transferred = execution.transferProof && sufficient.find((strategy) =>
+    strategy.strategyId === execution.transferProof.strategyId && strategy.risk === minimumRisk);
+  return transferred || sufficient[0] || null;
+}
+
+function expectedExplorationOrder(execution) {
+  const sufficient = sufficientExecutionStrategies(execution);
+  const selected = selectedExecutionStrategy(execution);
+  if (!selected) return [];
+  return [selected, ...sufficient.filter((strategy) => strategy.risk === selected.risk
+    && strategy.strategyId !== selected.strategyId)].map((strategy) => strategy.strategyId);
+}
+
+function strategyTransferProofMaterial(proof) {
+  return {
+    transferKey: proof.transferKey, strategyId: proof.strategyId, maxAgeDays: proof.maxAgeDays,
+    evidence: proof.evidence, authority: "context-only-transfer"
+  };
+}
+
+function validStrategyTransferProof(proof) {
+  if (!(proof && proof.schema === STRATEGY_TRANSFER_PROOF_SCHEMA
+    && ID_RE.test(proof.proofId || "") && ID_RE.test(proof.transferKey || "")
+    && ID_RE.test(proof.strategyId || "") && Number.isInteger(proof.maxAgeDays)
+    && proof.maxAgeDays >= 1 && proof.maxAgeDays <= 90 && Array.isArray(proof.evidence)
+    && proof.evidence.length >= 2 && proof.evidence.length <= 8
+    && new Set(proof.evidence.map((item) => item.sourceGoalId)).size === proof.evidence.length
+    && new Set(proof.evidence.map((item) => item.sourceDigest)).size === proof.evidence.length
+    && proof.evidence.every((item) => item && ID_RE.test(item.sourceGoalId || "")
+      && ID_RE.test(item.sourceStepId || "") && ID_RE.test(item.outcomeId || "")
+      && /^[a-f0-9]{64}$/.test(item.outcomeDigest || "")
+      && /^[a-f0-9]{64}$/.test(item.sourceDigest || "")
+      && Number.isFinite(new Date(item.completedAt).getTime()))
+    && /^[a-f0-9]{64}$/.test(proof.proofDigest || "")
+    && proof.authority === "context-only-transfer")) return false;
+  const digest = sha256(JSON.stringify(strategyTransferProofMaterial(proof)));
+  return proof.proofDigest === digest && proof.proofId === "strategy-transfer:" + digest.slice(0, 32);
+}
+
+function sameStrategy(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function sameVerification(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function collectStrategyTransferEvidence(goals, execution, strategy, scope) {
+  if (!execution.transferKey) return { evidence: [], regressed: false };
+  const before = new Date(scope.before);
+  const cutoff = new Date(before.getTime() - execution.transferMaxAgeDays * 86400000);
+  const evidence = []; let regressed = false;
+  for (const goal of goals) {
+    if (goal.goalId === scope.goalId || goal.projectId !== scope.projectId || goal.groupId !== scope.groupId || !goal.plan) continue;
+    for (const step of goal.plan.steps) {
+      const prior = step.execution;
+      const completedAt = step.completedAt && new Date(step.completedAt);
+      const updatedAt = new Date(step.updatedAt);
+      if (!prior || prior.transferKey !== execution.transferKey
+        || !sameVerification(prior.verification, execution.verification)
+        || !sameStrategy(prior.strategies.find((item) => item.strategyId === strategy.strategyId), strategy)
+        || updatedAt > before) continue;
+      for (const outcome of step.executionOutcomes || []) {
+        if (outcome.strategyId !== strategy.strategyId) continue;
+        const observedAt = new Date(outcome.observedAt);
+        if (observedAt < cutoff || observedAt > before || observedAt < new Date(goal.createdAt)) continue;
+        if (!outcome.passed || outcome.blockingDefect) { regressed = true; continue; }
+        if (step.status !== "completed" || !completedAt || completedAt < cutoff || completedAt > before
+          || observedAt > completedAt) continue;
+        evidence.push({ sourceGoalId: goal.goalId, sourceStepId: step.stepId, outcomeId: outcome.outcomeId,
+          outcomeDigest: outcome.digest, sourceDigest: outcome.sourceDigest, completedAt: step.completedAt });
+      }
+    }
+  }
+  const unique = [];
+  for (const item of evidence.sort((left, right) => left.completedAt.localeCompare(right.completedAt)
+    || left.outcomeId.localeCompare(right.outcomeId))) {
+    if (!unique.some((entry) => entry.sourceGoalId === item.sourceGoalId || entry.sourceDigest === item.sourceDigest)) unique.push(item);
+  }
+  return { evidence: unique.slice(-8), regressed };
+}
+
+function createStrategyTransferProof(goals, execution, scope) {
+  if (!execution.transferKey) return null;
+  const required = new Set(execution.requiredCapabilities);
+  const sufficient = execution.strategies.filter((strategy) =>
+    [...required].every((capability) => strategy.capabilities.includes(capability)));
+  const minimumRisk = Math.min(...sufficient.map((strategy) => strategy.risk));
+  const proven = sufficient.filter((strategy) => strategy.risk === minimumRisk).map((strategy) => ({
+    strategy, ...collectStrategyTransferEvidence(goals, execution, strategy, scope)
+  })).filter((item) => !item.regressed && item.evidence.length >= 2)
+    .sort((left, right) => right.evidence.length - left.evidence.length
+      || left.strategy.cost - right.strategy.cost || left.strategy.strategyId.localeCompare(right.strategy.strategyId));
+  if (!proven.length) return null;
+  const proof = { schema: STRATEGY_TRANSFER_PROOF_SCHEMA, proofId: null,
+    transferKey: execution.transferKey, strategyId: proven[0].strategy.strategyId,
+    maxAgeDays: execution.transferMaxAgeDays, evidence: proven[0].evidence,
+    proofDigest: null, authority: "context-only-transfer" };
+  proof.proofDigest = sha256(JSON.stringify(strategyTransferProofMaterial(proof)));
+  proof.proofId = "strategy-transfer:" + proof.proofDigest.slice(0, 32);
+  return proof;
+}
+
+function validGoalTransferProofs(goal, goals) {
+  if (!goal.plan) return true;
+  return goal.plan.steps.every((step) => {
+    if (!step.execution?.transferProof) return true;
+    const expected = createStrategyTransferProof(goals, step.execution, {
+      goalId: goal.goalId, projectId: goal.projectId, groupId: goal.groupId, before: goal.createdAt
+    });
+    return JSON.stringify(expected) === JSON.stringify(step.execution.transferProof);
+  });
+}
+
+function validExecutionDecision(execution) {
+  if (!(execution && execution.authority === "context-only-decision"
+    && Array.isArray(execution.requiredCapabilities) && execution.requiredCapabilities.length > 0
+    && execution.requiredCapabilities.length <= 16
+    && new Set(execution.requiredCapabilities).size === execution.requiredCapabilities.length
+    && execution.requiredCapabilities.every((capability) => ID_RE.test(capability || ""))
+    && Array.isArray(execution.strategies) && execution.strategies.length >= 2 && execution.strategies.length <= 8
+    && new Set(execution.strategies.map((strategy) => strategy?.strategyId)).size === execution.strategies.length
+    && execution.strategies.every((strategy) => strategy && ID_RE.test(strategy.strategyId || "")
+      && Array.isArray(strategy.capabilities) && strategy.capabilities.length > 0 && strategy.capabilities.length <= 16
+      && new Set(strategy.capabilities).size === strategy.capabilities.length
+      && strategy.capabilities.every((capability) => ID_RE.test(capability || ""))
+      && Number.isInteger(strategy.risk) && strategy.risk >= 0 && strategy.risk <= 100
+      && Number.isInteger(strategy.cost) && strategy.cost >= 0 && strategy.cost <= 100)
+    && execution.verification && ID_RE.test(execution.verification.evaluatorId || "")
+    && ID_RE.test(execution.verification.metric || "") && METRIC_OPERATORS.has(execution.verification.operator)
+    && Number.isFinite(execution.verification.threshold)
+    && Number.isInteger(execution.verification.minCases) && execution.verification.minCases >= 1
+    && execution.verification.minCases <= 100000 && ID_RE.test(execution.selectedStrategyId || "")
+    && (execution.explorationMaxAttempts === undefined || (Number.isInteger(execution.explorationMaxAttempts)
+      && execution.explorationMaxAttempts >= 2 && execution.explorationMaxAttempts <= 4
+      && Array.isArray(execution.explorationOrder)
+      && execution.explorationOrder.length === execution.explorationMaxAttempts
+      && new Set(execution.explorationOrder).size === execution.explorationOrder.length
+      && execution.explorationOrder.every((strategyId) => ID_RE.test(strategyId || ""))))
+    && (execution.transferKey === undefined || (ID_RE.test(execution.transferKey || "")
+      && Number.isInteger(execution.transferMaxAgeDays) && execution.transferMaxAgeDays >= 1
+      && execution.transferMaxAgeDays <= 90
+      && (execution.transferProof === null || (validStrategyTransferProof(execution.transferProof)
+        && execution.transferProof.transferKey === execution.transferKey
+        && execution.transferProof.maxAgeDays === execution.transferMaxAgeDays))))
+    && /^[a-f0-9]{64}$/.test(execution.decisionDigest || ""))) return false;
+  const selected = selectedExecutionStrategy(execution);
+  return selected?.strategyId === execution.selectedStrategyId
+    && (execution.explorationMaxAttempts === undefined
+      || JSON.stringify(execution.explorationOrder)
+        === JSON.stringify(expectedExplorationOrder(execution).slice(0, execution.explorationMaxAttempts)))
+    && execution.decisionDigest === sha256(JSON.stringify(executionDecisionMaterial(execution)));
+}
+
+function createExecutionDecision(value, field, transferContext) {
+  if (value === null || value === undefined) return null;
+  const execution = {
+    requiredCapabilities: Array.isArray(value.requiredCapabilities)
+      ? value.requiredCapabilities.map((capability) => exactId(capability, `${field}.requiredCapabilities`)) : [],
+    strategies: Array.isArray(value.strategies) ? value.strategies.map((strategy, index) => ({
+      strategyId: exactId(strategy?.strategyId, `${field}.strategies[${index}].strategyId`),
+      capabilities: Array.isArray(strategy?.capabilities)
+        ? strategy.capabilities.map((capability) => exactId(capability, `${field}.strategies[${index}].capabilities`)) : [],
+      risk: Number(strategy?.risk), cost: Number(strategy?.cost)
+    })) : [],
+    verification: {
+      evaluatorId: exactId(value.verification?.evaluatorId, `${field}.verification.evaluatorId`),
+      metric: exactId(value.verification?.metric, `${field}.verification.metric`),
+      operator: value.verification?.operator,
+      threshold: Number(value.verification?.threshold), minCases: Number(value.verification?.minCases)
+    },
+    selectedStrategyId: null, decisionDigest: null, authority: "context-only-decision"
+  };
+  if (value.transfer !== undefined && value.transfer !== null) {
+    execution.transferKey = exactId(value.transfer?.transferKey, `${field}.transfer.transferKey`);
+    execution.transferMaxAgeDays = Number(value.transfer?.maxAgeDays);
+    execution.transferProof = null;
+    execution.transferProof = createStrategyTransferProof(transferContext.goals, execution, transferContext.scope);
+  }
+  execution.selectedStrategyId = selectedExecutionStrategy(execution)?.strategyId || null;
+  if (value.exploration !== undefined && value.exploration !== null) {
+    execution.explorationMaxAttempts = Number(value.exploration?.maxAttempts);
+    execution.explorationOrder = expectedExplorationOrder(execution).slice(0, execution.explorationMaxAttempts);
+  }
+  execution.decisionDigest = sha256(JSON.stringify(executionDecisionMaterial(execution)));
+  if (!validExecutionDecision(execution)) {
+    throw new Error(`${field} requires 2-8 bounded strategies and one objective verification gate`);
+  }
+  return execution;
+}
+
+function executionOutcomeMaterial(outcome) {
+  return {
+    queueId: outcome.queueId, decisionDigest: outcome.decisionDigest, strategyId: outcome.strategyId,
+    ...(outcome.attempt === undefined ? {} : {
+      attempt: outcome.attempt, previousOutcomeDigest: outcome.previousOutcomeDigest
+    }),
+    capabilitiesUsed: outcome.capabilitiesUsed, evaluatorId: outcome.evaluatorId, metric: outcome.metric,
+    value: outcome.value, cases: outcome.cases, blockingDefect: outcome.blockingDefect,
+    sourceDigest: outcome.sourceDigest, observedAt: outcome.observedAt, passed: outcome.passed,
+    authority: "objective-evidence-only"
+  };
+}
+
+function currentExecutionAttempt(execution, outcomes = []) {
+  if (execution.explorationMaxAttempts === undefined) return null;
+  if (outcomes.length >= execution.explorationMaxAttempts || outcomes.some((outcome) => outcome.passed || outcome.blockingDefect)) {
+    return null;
+  }
+  return {
+    schema: EXECUTION_ATTEMPT_SCHEMA,
+    attempt: outcomes.length + 1, maxAttempts: execution.explorationMaxAttempts,
+    strategyId: execution.explorationOrder[outcomes.length],
+    previousOutcomeDigest: outcomes.at(-1)?.digest || null,
+    decisionDigest: execution.decisionDigest, authority: "context-only-attempt"
+  };
+}
+
+export function executionAttemptForStep(step) {
+  if (!step?.execution || !Array.isArray(step.executionOutcomes)) return null;
+  return currentExecutionAttempt(step.execution, step.executionOutcomes);
+}
+
+function metricPassed(operator, value, threshold) {
+  if (operator === "gte") return value >= threshold;
+  if (operator === "lte") return value <= threshold;
+  return value === threshold;
+}
+
+function validExecutionOutcome(outcome, execution, expectedStrategyId = execution.selectedStrategyId,
+  expectedAttempt = null, previousOutcomeDigest = null) {
+  if (!(outcome && outcome.schema === EXECUTION_OUTCOME_SCHEMA && ID_RE.test(outcome.outcomeId || "")
+    && ID_RE.test(outcome.queueId || "") && outcome.decisionDigest === execution.decisionDigest
+    && outcome.strategyId === expectedStrategyId
+    && (execution.explorationMaxAttempts === undefined
+      ? outcome.attempt === undefined && outcome.previousOutcomeDigest === undefined
+      : outcome.attempt === expectedAttempt && outcome.previousOutcomeDigest === previousOutcomeDigest)
+    && Array.isArray(outcome.capabilitiesUsed)
+    && outcome.capabilitiesUsed.length <= 16 && new Set(outcome.capabilitiesUsed).size === outcome.capabilitiesUsed.length
+    && outcome.capabilitiesUsed.every((capability) => ID_RE.test(capability || ""))
+    && outcome.evaluatorId === execution.verification.evaluatorId && outcome.metric === execution.verification.metric
+    && Number.isFinite(outcome.value) && Number.isInteger(outcome.cases) && outcome.cases >= 0
+    && typeof outcome.blockingDefect === "boolean" && /^[a-f0-9]{64}$/.test(outcome.sourceDigest || "")
+    && Number.isFinite(new Date(outcome.observedAt).getTime()) && typeof outcome.passed === "boolean"
+    && /^[a-f0-9]{64}$/.test(outcome.digest || "") && outcome.authority === "objective-evidence-only")) return false;
+  const strategy = execution.strategies.find((item) => item.strategyId === expectedStrategyId);
+  const used = new Set(outcome.capabilitiesUsed);
+  const expectedPass = execution.requiredCapabilities.every((capability) => used.has(capability))
+    && outcome.capabilitiesUsed.every((capability) => strategy.capabilities.includes(capability))
+    && outcome.cases >= execution.verification.minCases && !outcome.blockingDefect
+    && metricPassed(execution.verification.operator, outcome.value, execution.verification.threshold);
+  const digest = sha256(JSON.stringify(executionOutcomeMaterial(outcome)));
+  return outcome.passed === expectedPass && outcome.digest === digest
+    && outcome.outcomeId === "execution-outcome:" + digest.slice(0, 32);
+}
+
+function validExecutionOutcomeSequence(execution, outcomes) {
+  if (execution.explorationMaxAttempts === undefined) {
+    return outcomes.every((outcome) => validExecutionOutcome(outcome, execution));
+  }
+  if (outcomes.length > execution.explorationMaxAttempts
+    || new Set(outcomes.map((outcome) => outcome.sourceDigest)).size !== outcomes.length) return false;
+  let previous = null;
+  for (let index = 0; index < outcomes.length; index += 1) {
+    const outcome = outcomes[index];
+    if (!validExecutionOutcome(outcome, execution, execution.explorationOrder[index], index + 1, previous)) return false;
+    if (index < outcomes.length - 1 && (outcome.passed || outcome.blockingDefect)) return false;
+    previous = outcome.digest;
+  }
+  return true;
+}
+
+function reviewExecutionResult(execution, priorOutcomes, queueId, report, now) {
+  const attempt = currentExecutionAttempt(execution, priorOutcomes);
+  const expectedStrategyId = attempt?.strategyId || execution.selectedStrategyId;
+  if (!report || report.strategyId !== expectedStrategyId || !Array.isArray(report.capabilitiesUsed)
+    || !report.outcome || report.outcome.evaluatorId !== execution.verification.evaluatorId
+    || report.outcome.metric !== execution.verification.metric) {
+    return { passed: false, outcome: null, reason: "Objective execution evidence is missing or invalid." };
+  }
+  let outcome;
+  try {
+    outcome = {
+      schema: EXECUTION_OUTCOME_SCHEMA, outcomeId: null, queueId,
+      decisionDigest: execution.decisionDigest, strategyId: report.strategyId,
+      ...(attempt === null ? {} : { attempt: attempt.attempt, previousOutcomeDigest: attempt.previousOutcomeDigest }),
+      capabilitiesUsed: report.capabilitiesUsed.map((capability) => exactId(capability, "execution.capabilitiesUsed")),
+      evaluatorId: report.outcome.evaluatorId, metric: report.outcome.metric,
+      value: Number(report.outcome.value), cases: Number(report.outcome.cases),
+      blockingDefect: report.outcome.blockingDefect === true, sourceDigest: String(report.outcome.sourceDigest || ""),
+      observedAt: timestamp(report.outcome.observedAt || now), passed: false, digest: null,
+      authority: "objective-evidence-only"
+    };
+    if (new Date(outcome.observedAt) > new Date(now)
+      || (attempt && priorOutcomes.some((prior) => prior.sourceDigest === outcome.sourceDigest))) {
+      return { passed: false, outcome: null, reason: "Objective execution evidence is missing or invalid." };
+    }
+    const strategy = execution.strategies.find((item) => item.strategyId === expectedStrategyId);
+    const used = new Set(outcome.capabilitiesUsed);
+    outcome.passed = execution.requiredCapabilities.every((capability) => used.has(capability))
+      && outcome.capabilitiesUsed.every((capability) => strategy.capabilities.includes(capability))
+      && outcome.cases >= execution.verification.minCases && !outcome.blockingDefect
+      && metricPassed(execution.verification.operator, outcome.value, execution.verification.threshold);
+    outcome.digest = sha256(JSON.stringify(executionOutcomeMaterial(outcome)));
+    outcome.outcomeId = "execution-outcome:" + outcome.digest.slice(0, 32);
+  } catch {
+    return { passed: false, outcome: null, reason: "Objective execution evidence is missing or invalid." };
+  }
+  if (!validExecutionOutcome(outcome, execution, expectedStrategyId, attempt?.attempt ?? null,
+    attempt?.previousOutcomeDigest ?? null)
+    || !validExecutionOutcomeSequence(execution, [...priorOutcomes, outcome])) {
+    return { passed: false, outcome: null, reason: "Objective execution evidence is missing or invalid." };
+  }
+  const nextAttempt = !outcome.passed && !outcome.blockingDefect
+    ? currentExecutionAttempt(execution, [...priorOutcomes, outcome]) : null;
+  return { passed: outcome.passed, outcome, nextAttempt,
+    reason: outcome.passed ? null : "The objective execution gate did not pass." };
+}
+
 function planDefinitionMaterial(steps) {
-  return steps.map(({ stepId, title, successCriterion, dependsOn }) => ({ stepId, title, successCriterion, dependsOn }));
+  return steps.map(({ stepId, agentId, resources, execution, title, successCriterion, dependsOn }) => ({
+    stepId, ...(agentId === undefined ? {} : { agentId }),
+    ...(resources === undefined ? {} : { resources }), ...(execution === undefined ? {} : { execution }),
+    title, successCriterion, dependsOn
+  }));
 }
 
 function validGoalPlan(plan) {
@@ -149,6 +503,14 @@ function validGoalPlan(plan) {
   if (ids.size !== plan.steps.length || ids.has(undefined)) return false;
   for (const step of plan.steps) {
     if (!(ID_RE.test(step.stepId || "") && typeof step.title === "string" && step.title.length > 0 && step.title.length <= 500
+      && (step.agentId === undefined || ID_RE.test(step.agentId || ""))
+      && (step.resources === undefined || (Array.isArray(step.resources) && step.resources.length <= 16
+        && new Set(step.resources).size === step.resources.length && step.resources.every((resource) => ID_RE.test(resource || ""))))
+      && (step.execution === undefined || step.execution === null || validExecutionDecision(step.execution))
+      && (step.executionOutcomes === undefined || (Array.isArray(step.executionOutcomes) && step.executionOutcomes.length <= 8
+        && new Set(step.executionOutcomes.map((outcome) => outcome.outcomeId)).size === step.executionOutcomes.length
+        && (step.executionOutcomes.length === 0 || (step.execution
+          && validExecutionOutcomeSequence(step.execution, step.executionOutcomes)))))
       && typeof step.successCriterion === "string" && step.successCriterion.length > 0 && step.successCriterion.length <= 1000
       && Array.isArray(step.dependsOn) && new Set(step.dependsOn).size === step.dependsOn.length
       && step.dependsOn.every((dependency) => ids.has(dependency) && dependency !== step.stepId)
@@ -161,7 +523,8 @@ function validGoalPlan(plan) {
         && new Set(step.knowledgeGaps.map((gap) => gap.gapId)).size === step.knowledgeGaps.length
         && step.knowledgeGaps.every((gap) => validKnowledgeGap(gap)
           && gap.goalStepId === step.stepId && gap.planDefinitionsDigest === plan.definitionsDigest)))
-      && Number.isFinite(new Date(step.updatedAt).getTime()))) return false;
+      && Number.isFinite(new Date(step.updatedAt).getTime())
+      && (step.executionOutcomes || []).every((outcome) => new Date(outcome.observedAt) <= new Date(step.updatedAt)))) return false;
   }
   const visiting = new Set(); const visited = new Set();
   const visit = (stepId) => {
@@ -181,6 +544,8 @@ function validGoalPlan(plan) {
   if (plan.steps.some((step) => (step.knowledgeGaps || []).filter((gap) => gap.status === "open").length > 1)) return false;
   if (plan.steps.some((step) => (step.knowledgeGaps || []).some((gap) => gap.status === "open")
     && step.status !== "blocked")) return false;
+  if (plan.steps.some((step) => step.execution && step.status === "completed"
+    && !(step.executionOutcomes || []).some((outcome) => outcome.passed))) return false;
   if (plan.definitionsDigest !== sha256(JSON.stringify(planDefinitionMaterial(plan.steps)))) return false;
   const current = plan.steps.filter((step) => ["active", "blocked"].includes(step.status));
   return current.length <= 1 && (plan.currentStepId === null
@@ -195,15 +560,19 @@ function activateNextPlanStep(plan, now) {
   return next;
 }
 
-function createGoalPlan(steps, now) {
+function createGoalPlan(steps, now, defaultAgentId, transferContext) {
   if (!Array.isArray(steps) || steps.length === 0 || steps.length > 32) throw new Error("goal plan requires 1-32 steps");
   const normalized = steps.map((step, index) => ({
     stepId: exactId(step?.stepId ?? step?.id, `steps[${index}].stepId`),
+    agentId: exactId(step?.agentId ?? defaultAgentId, `steps[${index}].agentId`),
+    resources: Array.isArray(step?.resources)
+      ? step.resources.map((resource) => exactId(resource, `steps[${index}].resources`)) : [],
+    execution: createExecutionDecision(step?.execution, `steps[${index}].execution`, transferContext),
     title: safeText(step?.title, `steps[${index}].title`, 500),
     successCriterion: safeText(step?.successCriterion, `steps[${index}].successCriterion`),
     dependsOn: Array.isArray(step?.dependsOn) ? step.dependsOn.map((dependency) => exactId(dependency, `steps[${index}].dependsOn`)) : [],
     status: "pending", checkpoint: null, blocker: null, completedAt: null, completedByQueueId: null,
-    knowledgeGaps: [], updatedAt: now
+    knowledgeGaps: [], executionOutcomes: [], updatedAt: now
   }));
   const plan = { schema: GOAL_PLAN_SCHEMA, revision: 0, currentStepId: null, steps: normalized,
     definitionsDigest: sha256(JSON.stringify(planDefinitionMaterial(normalized))), authority: "context-only-plan" };
@@ -216,6 +585,31 @@ function currentPlanStep(goal) {
   return goal.plan?.steps.find((step) => step.stepId === goal.plan.currentStepId) || null;
 }
 
+function planStepAgentId(goal, step) {
+  return step?.agentId ?? goal.agentId;
+}
+
+function planStepResources(step) {
+  return Array.isArray(step?.resources) ? step.resources : [];
+}
+
+function queuePlanStep(policy, item) {
+  if (!item.goalStepId) return null;
+  return policy.goals.find((goal) => goal.goalId === item.goalId)?.plan?.steps
+    .find((step) => step.stepId === item.goalStepId) || null;
+}
+
+function conflictingResources(policy, candidate, leased) {
+  const wanted = new Set(planStepResources(queuePlanStep(policy, candidate)));
+  if (!wanted.size || candidate.projectId !== leased.projectId || candidate.groupId !== leased.groupId) return [];
+  return planStepResources(queuePlanStep(policy, leased)).filter((resource) => wanted.has(resource));
+}
+
+function effectiveQueuePriority(policy, item) {
+  if (!item.goalId) return item.priority;
+  return policy.goals.find((goal) => goal.goalId === item.goalId)?.priority ?? item.priority;
+}
+
 function createKnowledgeGap(goal, step, queueId, request, now) {
   const gap = {
     schema: KNOWLEDGE_GAP_SCHEMA, gapId: null, goalId: goal.goalId, goalStepId: step.stepId,
@@ -244,8 +638,8 @@ function planQueueKey(goalId, stepId, phase, suffix = "") {
 
 function newGoalQueue(goal, step, kind, key, current, availableAt = current) {
   return { queueId: "gateway-queue:" + sha256(key).slice(0, 32), dedupeKey: key, kind,
-    agentId: goal.agentId, projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
-    goalStepId: step?.stepId || null, channelEventId: null, priority: PRIORITY[kind], status: "pending",
+    agentId: planStepAgentId(goal, step), projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
+    goalStepId: step?.stepId || null, channelEventId: null, priority: goal.priority, status: "pending",
     attempts: 0, lease: null, availableAt, createdAt: current, updatedAt: current,
     completedAt: null, lastError: null, authority: "execution-state-only" };
 }
@@ -345,6 +739,7 @@ function normalizePolicy(value, root) {
   if (!value || value.schema !== GATEWAY_POLICY_SCHEMA || value.root !== root
     || !Number.isInteger(value.revision) || typeof value.enabled !== "boolean" || typeof value.killSwitch !== "boolean"
     || !Array.isArray(value.goals) || !Array.isArray(value.history) || value.goals.some((item) => !validGoal(item))
+    || value.goals.some((item) => !validGoalTransferProofs(item, value.goals))
     || value.history.some((item) => !validPolicyHistory(item))) {
     throw new Error("gateway policy is invalid; autonomous runtime is disabled");
   }
@@ -471,14 +866,25 @@ export async function assignGoal({ root = process.cwd(), goalId, agentId, ownerS
       readJson(paths.gatewayRuntimePath, paths.catalog.root, normalizeRuntime, emptyRuntime),
       loadPersonaRuntime(paths.catalog.root, paths.catalog)
     ]);
-    agentId = exactId(agentId, "agentId"); projectId = exactId(projectId, "projectId"); groupId = exactId(groupId, "groupId", true);
-    assertActivePersona(personas.policy, personas.runtime, agentId, projectId, groupId);
+    goalId = exactId(goalId, "goalId"); agentId = exactId(agentId, "agentId");
+    projectId = exactId(projectId, "projectId"); groupId = exactId(groupId, "groupId", true);
+    const leadIdentity = assertActivePersona(personas.policy, personas.runtime, agentId, projectId, groupId);
     const createdAt = timestamp(now);
     const active = policy.goals.find((item) => item.agentId === agentId && item.status === "active" && item.goalId !== goalId);
     if (active) throw new Error("an agent may have only one active focused goal");
-    const plan = steps === null ? null : createGoalPlan(steps, createdAt);
+    const plan = steps === null ? null : createGoalPlan(steps, createdAt, agentId, {
+      goals: policy.goals, scope: { goalId, projectId, groupId, before: createdAt }
+    });
+    if (plan) {
+      for (const stepAgentId of new Set(plan.steps.map((step) => step.agentId))) {
+        const stepIdentity = assertActivePersona(personas.policy, personas.runtime, stepAgentId, projectId, groupId);
+        if (stepIdentity.binding.tenantId !== leadIdentity.binding.tenantId) {
+          throw new Error("goal-plan team members must share the authenticated tenant and exact project group");
+        }
+      }
+    }
     const firstStep = plan ? plan.steps.find((step) => step.stepId === plan.currentStepId) : null;
-    const goal = { goalId: exactId(goalId, "goalId"), agentId, ownerSubjectId: exactId(ownerSubjectId, "ownerSubjectId"),
+    const goal = { goalId, agentId, ownerSubjectId: exactId(ownerSubjectId, "ownerSubjectId"),
       projectId, groupId, priority: Number(priority), successCriterion: safeText(successCriterion, "successCriterion"),
       nextSafeStep: safeText(firstStep?.title || nextSafeStep, "nextSafeStep"), deadline: deadline === null ? null : timestamp(deadline),
       status: "active", checkpoint: null, heartbeatAt: null, blocker: null, createdAt, updatedAt: createdAt,
@@ -496,6 +902,10 @@ export async function assignGoal({ root = process.cwd(), goalId, agentId, ownerS
       if ((blockedStep.knowledgeGaps || []).some((gap) => gap.status === "open")) {
         throw new Error("blocked goal plan has an open knowledge gap; resolve it with goal-clarify");
       }
+      if (blockedStep.execution?.explorationMaxAttempts !== undefined
+        && currentExecutionAttempt(blockedStep.execution, blockedStep.executionOutcomes || []) === null) {
+        throw new Error("bounded exploration is exhausted or stopped by a blocking defect; assign a new goal ID");
+      }
       policy.history.push({ kind: "goal", at: createdAt, value: structuredClone(previous), authority: "authenticated-goal-policy" });
       blockedStep.status = "active"; blockedStep.blocker = null; blockedStep.updatedAt = createdAt;
       previous.status = "active"; previous.blocker = null; previous.updatedAt = createdAt; previous.plan.revision += 1;
@@ -640,11 +1050,32 @@ export async function reconcileGateway({ root = process.cwd(), now = new Date()
       outbox.status = "delivery-unknown"; outbox.updatedAt = current;
       appendReceipt(runtime, "delivery-unknown", outbox.outboxId, current, { reason: "crash-during-send" });
     }
+    let policyChanged = false;
     if (policy.enabled && !policy.killSwitch) {
       for (const goal of policy.goals.filter((item) => item.status === "active" && item.plan)) {
         const step = currentPlanStep(goal);
         if (!step) throw new Error("active goal plan has no current step");
+        try {
+          assertActivePersona(personas.policy, personas.runtime, planStepAgentId(goal, step), goal.projectId, goal.groupId);
+        } catch {
+          policy.history.push({ kind: "goal", at: current, value: structuredClone(goal), authority: "authenticated-goal-policy" });
+          const blocker = "Assigned team member is unavailable in this exact project group.";
+          step.status = "blocked"; step.blocker = blocker; step.updatedAt = current;
+          goal.status = "blocked"; goal.blocker = blocker; goal.updatedAt = current; goal.plan.revision += 1;
+          for (const queued of runtime.queue.filter((item) => item.goalId === goal.goalId
+            && item.goalStepId === step.stepId && ["pending", "leased"].includes(item.status))) {
+            preserve(runtime, "queue", queued, "step-agent-unavailable", current);
+            queued.status = "cancelled"; queued.lease = null; queued.completedAt = current; queued.updatedAt = current;
+            for (const lane of runtime.lanes.filter((item) => item.queueId === queued.queueId && item.status === "leased")) {
+              lane.status = "expired"; lane.updatedAt = current;
+            }
+            appendReceipt(runtime, "step-agent-unavailable", queued.queueId, current, { goalStepId: step.stepId });
+          }
+          policy.revision += 1; policyChanged = true;
+          continue;
+        }
         const runnable = runtime.queue.some((item) => item.goalId === goal.goalId && item.goalStepId === step.stepId
+          && item.agentId === planStepAgentId(goal, step)
           && ["pending", "leased", "awaiting-delivery"].includes(item.status));
         if (!runnable) {
           const key = planQueueKey(goal.goalId, step.stepId, "recovery", String(goal.plan.revision));
@@ -657,13 +1088,15 @@ export async function reconcileGateway({ root = process.cwd(), now = new Date()
       }
       for (const goal of policy.goals.filter((item) => item.status === "active" && item.deadline
         && new Date(item.deadline) <= new Date(current))) {
-        try { assertActivePersona(personas.policy, personas.runtime, goal.agentId, goal.projectId, goal.groupId); }
+        const step = currentPlanStep(goal);
+        const deadlineAgentId = planStepAgentId(goal, step);
+        try { assertActivePersona(personas.policy, personas.runtime, deadlineAgentId, goal.projectId, goal.groupId); }
         catch { continue; }
         const key = "goal:" + goal.goalId + ":deadline:" + goal.deadline;
         if (!runtime.queue.some((item) => item.dedupeKey === key)) runtime.queue.push({
           queueId: "gateway-queue:" + sha256(key).slice(0, 32), dedupeKey: key, kind: "deadline",
-          agentId: goal.agentId, projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
-          goalStepId: currentPlanStep(goal)?.stepId || null, channelEventId: null, priority: PRIORITY.deadline, status: "pending", attempts: 0, lease: null,
+          agentId: deadlineAgentId, projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
+          goalStepId: step?.stepId || null, channelEventId: null, priority: PRIORITY.deadline, status: "pending", attempts: 0, lease: null,
           availableAt: current, createdAt: current, updatedAt: current, completedAt: null, lastError: null,
           authority: "execution-state-only"
         });
@@ -691,7 +1124,10 @@ export async function reconcileGateway({ root = process.cwd(), now = new Date()
     runtime.health.gateway = policy.enabled && !policy.killSwitch ? "running" : "stopped";
     runtime.health.scheduler = "healthy"; runtime.health.queue = "healthy"; runtime.health.lastReconciledAt = current;
     runtime.revision += 1;
-    await writeJson(paths.gatewayRuntimePath, runtime);
+    if (policyChanged) await Promise.all([
+      writeJson(paths.gatewayPolicyPath, policy), writeJson(paths.gatewayRuntimePath, runtime)
+    ]);
+    else await writeJson(paths.gatewayRuntimePath, runtime);
     return { policy, runtime, recovered: true };
   });
 }
@@ -710,7 +1146,8 @@ export async function claimGatewayWork({ root = process.cwd(), workerId, leaseSe
     if (!Number.isInteger(seconds) || seconds < 15 || seconds > 900) throw new Error("leaseSeconds must be 15-900");
     const items = runtime.queue.filter((item) => item.status === "pending" && new Date(item.availableAt) <= new Date(current)
       && !currentLane(runtime, item.agentId));
-    items.sort((a, b) => b.priority - a.priority || a.createdAt.localeCompare(b.createdAt) || a.queueId.localeCompare(b.queueId));
+    items.sort((a, b) => effectiveQueuePriority(policy, b) - effectiveQueuePriority(policy, a)
+      || a.createdAt.localeCompare(b.createdAt) || a.queueId.localeCompare(b.queueId));
     let item = null; let revoked = false;
     for (const candidate of items) {
       try {
@@ -725,7 +1162,8 @@ export async function claimGatewayWork({ root = process.cwd(), workerId, leaseSe
       if (candidate.goalStepId) {
         const goal = policy.goals.find((entry) => entry.goalId === candidate.goalId);
         const step = goal && currentPlanStep(goal);
-        if (!goal?.plan || goal.status !== "active" || step?.stepId !== candidate.goalStepId || step.status !== "active") {
+        if (!goal?.plan || goal.status !== "active" || step?.stepId !== candidate.goalStepId || step.status !== "active"
+          || candidate.agentId !== planStepAgentId(goal, step)) {
           preserve(runtime, "queue", candidate, "plan-step-stale", current);
           candidate.status = "cancelled"; candidate.completedAt = current; candidate.updatedAt = current;
           appendReceipt(runtime, "plan-step-stale", candidate.queueId, current, { goalStepId: candidate.goalStepId });
@@ -733,6 +1171,9 @@ export async function claimGatewayWork({ root = process.cwd(), workerId, leaseSe
           continue;
         }
       }
+      const resourceConflict = runtime.queue.some((leased) => leased.status === "leased"
+        && leased.queueId !== candidate.queueId && conflictingResources(policy, candidate, leased).length > 0);
+      if (resourceConflict) continue;
       item = candidate;
       break;
     }
@@ -778,9 +1219,10 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
     const lane = runtime.lanes.find((entry) => entry.queueId === item.queueId && entry.workerId === workerId && entry.status === "leased");
     if (!lane) throw new Error("agent lane lease is missing");
     const boundGoal = item.goalId ? policy.goals.find((entry) => entry.goalId === item.goalId) : null;
+    const boundStep = item.goalStepId ? boundGoal && currentPlanStep(boundGoal) : null;
     if (item.goalStepId) {
-      const step = boundGoal && currentPlanStep(boundGoal);
-      if (!boundGoal?.plan || boundGoal.status !== "active" || step?.stepId !== item.goalStepId || step.status !== "active") {
+      if (!boundGoal?.plan || boundGoal.status !== "active" || boundStep?.stepId !== item.goalStepId
+        || boundStep.status !== "active" || item.agentId !== planStepAgentId(boundGoal, boundStep)) {
         throw new Error("run completion is not bound to the current active goal step");
       }
     }
@@ -792,8 +1234,14 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
     if (knowledgeGapRequest && (result?.blocked || result?.completed)) {
       throw new Error("knowledge gap result cannot also complete or generically block a step");
     }
+    let executionReview = boundStep?.execution && result?.completed
+      ? reviewExecutionResult(boundStep.execution, boundStep.executionOutcomes || [],
+        item.queueId, result.execution, current) : null;
+    if (executionReview && (boundStep.executionOutcomes || []).length >= 8) {
+      executionReview = { passed: false, outcome: null, reason: "Execution outcome history is full." };
+    }
     const text = result?.text ? safeText(result.text, "result.text", 16000) : null;
-    let clarification = null;
+    let clarification = null; let exploration = null;
     preserve(runtime, "queue", item, "run-completed", current);
     if (item.channelEventId) {
       if (!text) throw new Error("a channel obligation requires a non-empty response");
@@ -814,13 +1262,15 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
       }
       item.status = "awaiting-delivery";
     } else {
-      item.status = result?.blocked || knowledgeGapRequest ? "blocked" : "completed"; item.completedAt = current;
+      item.status = result?.blocked || knowledgeGapRequest || (executionReview && !executionReview.passed)
+        ? "blocked" : "completed"; item.completedAt = current;
       const goal = boundGoal;
       if (goal) {
         policy.history.push({ kind: "goal", at: current, value: structuredClone(goal), authority: "authenticated-goal-policy" });
         const checkpoint = result?.checkpoint === undefined ? goal.checkpoint : safeCheckpoint(result.checkpoint);
         goal.checkpoint = checkpoint; goal.heartbeatAt = current;
-        goal.blocker = result?.blocked ? safeText(result.blocker || "Run blocked.", "blocker", 500) : null;
+        goal.blocker = result?.blocked ? safeText(result.blocker || "Run blocked.", "blocker", 500)
+          : executionReview && !executionReview.passed ? executionReview.reason : null;
         if (goal.plan && item.goalStepId) {
           const step = currentPlanStep(goal);
           step.checkpoint = checkpoint; step.updatedAt = current;
@@ -847,7 +1297,38 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
             goal.plan.revision += 1;
           } else if (result?.blocked) {
             step.status = "blocked"; step.blocker = goal.blocker; goal.status = "blocked";
+          } else if (executionReview && !executionReview.passed) {
+            if (executionReview.outcome) step.executionOutcomes.push(executionReview.outcome);
+            if (executionReview.outcome && executionReview.nextAttempt) {
+              item.status = "completed"; step.status = "active"; step.blocker = null;
+              goal.status = "active"; goal.blocker = null; goal.nextSafeStep = step.title;
+              goal.plan.revision += 1;
+              const key = planQueueKey(goal.goalId, step.stepId, "explore",
+                executionReview.outcome.digest.slice(0, 20));
+              let queued = runtime.queue.find((entry) => entry.dedupeKey === key);
+              if (!queued) {
+                queued = newGoalQueue(goal, step, "follow-up", key, current);
+                runtime.queue.push(queued);
+              }
+              exploration = { queueId: queued.queueId, ...executionReview.nextAttempt };
+              appendReceipt(runtime, "execution-exploration-continued", queued.queueId, current, {
+                goalStepId: step.stepId, failedOutcomeId: executionReview.outcome.outcomeId,
+                attempt: executionReview.nextAttempt.attempt,
+                strategyId: executionReview.nextAttempt.strategyId
+              });
+            } else {
+              step.status = "blocked"; step.blocker = goal.blocker; goal.status = "blocked";
+              appendReceipt(runtime, executionReview.outcome ? "execution-gate-failed" : "execution-proof-invalid",
+                item.queueId, current, { goalStepId: step.stepId,
+                  outcomeId: executionReview.outcome?.outcomeId || null });
+            }
           } else if (result?.completed) {
+            if (executionReview?.outcome) {
+              step.executionOutcomes.push(executionReview.outcome);
+              appendReceipt(runtime, "execution-gate-passed", item.queueId, current, {
+                goalStepId: step.stepId, outcomeId: executionReview.outcome.outcomeId
+              });
+            }
             step.status = "completed"; step.completedAt = current; step.completedByQueueId = item.queueId; step.blocker = null;
             goal.plan.currentStepId = null; goal.plan.revision += 1;
             const next = activateNextPlanStep(goal.plan, current);
@@ -877,8 +1358,8 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
             : "goal:" + goal.goalId + ":follow-up:" + checkpointDigest;
           if (!runtime.queue.some((entry) => entry.dedupeKey === key)) runtime.queue.push({
             queueId: "gateway-queue:" + sha256(key).slice(0, 32), dedupeKey: key, kind: "follow-up",
-            agentId: goal.agentId, projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
-            goalStepId: step?.stepId || null, channelEventId: null, priority: PRIORITY["follow-up"], status: "pending", attempts: 0, lease: null,
+            agentId: planStepAgentId(goal, step), projectId: goal.projectId, groupId: goal.groupId, goalId: goal.goalId,
+            goalStepId: step?.stepId || null, channelEventId: null, priority: goal.priority, status: "pending", attempts: 0, lease: null,
             availableAt: new Date(new Date(current).getTime() + 60000).toISOString(), createdAt: current, updatedAt: current,
             completedAt: null, lastError: null, authority: "execution-state-only"
           });
@@ -889,7 +1370,8 @@ export async function completeGatewayRun({ root = process.cwd(), queueId, worker
     runtime.health.host = "healthy"; runtime.health.worker = "healthy"; runtime.health.lastTickAt = current;
     appendReceipt(runtime, "run-terminal", item.queueId, current, { status: item.status, goalStepId: item.goalStepId || null }); runtime.revision += 1;
     await Promise.all([writeJson(paths.gatewayPolicyPath, policy), writeJson(paths.gatewayRuntimePath, runtime)]);
-    return { item, outbox: runtime.outbox.find((entry) => entry.queueId === item.queueId) || null, clarification };
+    return { item, outbox: runtime.outbox.find((entry) => entry.queueId === item.queueId) || null,
+      clarification, exploration, executionReview };
   });
 }
 
@@ -1047,6 +1529,7 @@ export function gatewayRuntimeFindings(policy, runtime) {
   const goalIds = new Set();
   for (const goal of policy.goals) {
     if (!validGoal(goal)) findings.push("invalid-goal:" + (goal?.goalId || "unknown"));
+    else if (!validGoalTransferProofs(goal, policy.goals)) findings.push("invalid-strategy-transfer:" + goal.goalId);
     if (goalIds.has(goal.goalId)) findings.push("duplicate-goal:" + goal.goalId);
     goalIds.add(goal.goalId);
     if (goal.status === "active" && active.has(goal.agentId)) findings.push("multiple-active-goals:" + goal.agentId);
@@ -1061,7 +1544,9 @@ export function gatewayRuntimeFindings(policy, runtime) {
     queueIds.add(item.queueId); dedupeKeys.add(item.dedupeKey);
     if (item.goalStepId) {
       const goal = policy.goals.find((entry) => entry.goalId === item.goalId);
-      if (!goal?.plan?.steps.some((step) => step.stepId === item.goalStepId)) findings.push("orphan-goal-step:" + item.queueId);
+      const step = goal?.plan?.steps.find((entry) => entry.stepId === item.goalStepId);
+      if (!step) findings.push("orphan-goal-step:" + item.queueId);
+      else if (item.agentId !== planStepAgentId(goal, step)) findings.push("goal-step-agent-mismatch:" + item.queueId);
     }
   }
   const outboxIds = new Set(); const idempotencyKeys = new Set();
@@ -1108,12 +1593,31 @@ export async function gatewayContext({ root = process.cwd(), agentId = null } =
   const { policy, runtime } = await loadGatewayRuntime(root);
   const findings = gatewayRuntimeFindings(policy, runtime);
   if (findings.length) throw new Error("gateway runtime failed closed: " + findings.join(", "));
-  const goals = policy.goals.filter((item) => agentId === null || item.agentId === exactId(agentId, "agentId"));
-  const queue = runtime.queue.filter((item) => agentId === null || item.agentId === exactId(agentId, "agentId"));
+  const exactAgentId = agentId === null ? null : exactId(agentId, "agentId");
+  const goals = policy.goals.filter((item) => exactAgentId === null || item.agentId === exactAgentId
+    || item.plan?.steps.some((step) => planStepAgentId(item, step) === exactAgentId));
+  const executionAttempts = goals.map((goal) => {
+    const step = currentPlanStep(goal); const attempt = executionAttemptForStep(step);
+    return attempt && (exactAgentId === null || planStepAgentId(goal, step) === exactAgentId)
+      ? { goalId: goal.goalId, goalStepId: step.stepId, ...attempt } : null;
+  }).filter(Boolean);
+  const queue = runtime.queue.filter((item) => exactAgentId === null || item.agentId === exactAgentId);
   const queueIds = new Set(queue.map((item) => item.queueId));
+  const leased = runtime.queue.filter((item) => item.status === "leased");
+  const resourceWaits = queue.filter((item) => item.status === "pending").map((item) => {
+    const blockers = leased.map((entry) => ({ entry, resources: conflictingResources(policy, item, entry) }))
+      .filter(({ resources }) => resources.length > 0);
+    return blockers.length ? {
+      queueId: item.queueId,
+      resources: [...new Set(blockers.flatMap(({ resources }) => resources))].sort(),
+      blockedByQueueIds: blockers.map(({ entry }) => entry.queueId).sort(),
+      authority: "execution-state-only"
+    } : null;
+  }).filter(Boolean);
   return { schema: "agentspine.gateway-context/v1", enabled: policy.enabled, killSwitch: policy.killSwitch,
     goals: structuredClone(goals), queue: structuredClone(queue),
     outbox: structuredClone(runtime.outbox.filter((item) => queueIds.has(item.queueId))),
+    resourceWaits, executionAttempts,
     health: structuredClone(runtime.health), healthFindings: gatewayHealthFindings(policy, runtime),
     authority: "execution-state-only" };
 }