brainclaw 1.27.0 → 1.28.1

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.27.0",
-  "generated_at": "2026-08-23T22:12:22.907Z",
+  "version": "1.28.1",
+  "generated_at": "2026-08-24T17:40:07.204Z",
   "tools": {
     "count": 70,
     "published_count": 68,
@@ -476,7 +476,7 @@
   },
   "bench": {
     "schema": "brainclaw.bench.v1",
-    "generated_at": "2026-08-23T22:12:20.808Z",
+    "generated_at": "2026-08-24T17:40:05.036Z",
     "node_version": "v24.19.0",
     "platform": "linux-x64",
     "repeats": 3,
@@ -485,7 +485,7 @@
         "name": "cold_onboard",
         "volume": "empty",
         "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
-        "duration_ms_median": 76,
+        "duration_ms_median": 85,
         "payload_chars_median": 1640,
         "payload_tokens_est_median": 410
       },
@@ -493,7 +493,7 @@
         "name": "warm_work",
         "volume": "medium",
         "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
-        "duration_ms_median": 123,
+        "duration_ms_median": 128,
         "payload_chars_median": 2626,
         "payload_tokens_est_median": 657
       },
@@ -501,7 +501,7 @@
         "name": "first_edit",
         "volume": "medium",
         "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
-        "duration_ms_median": 14,
+        "duration_ms_median": 11,
         "payload_chars_median": 1305,
         "payload_tokens_est_median": 326
       }

package/docs/cli.md

@@ -1016,9 +1016,11 @@ research, and debug; they are not a review-only command group.
 | `takeover <loop_id>` | slot, turn, expected epoch, cause, liveness evidence, external-effect policy, next workspace and coordinator identity | Fence one physical generation and arm a successor without changing the logical Assignment. |
 | `advance <loop_id>` | — | Advance through the protocol; optional `--to-phase`, `--force`, `--reason`. |
 | `add-artifact <loop_id>` | `--phase --type --body` | Attach a typed artifact; optional producer and ref. |
+| `continue <loop_id>` | — | Evaluate an attested Ideation→Implementation or Implementation→Review action and persist/apply `AUTO`, `REQUIRE_APPROVAL`, or `DENY`; options: `--action-index`, `--autonomy-mode`, `--risk`. Review continuation selects an independent registered reviewer and fails closed if none is available. |
 
 ```bash
 brainclaw loop advance lop_abc --json
+brainclaw loop continue lop_abc --autonomy-mode autonomous --risk normal --json
 brainclaw loop takeover lop_abc \
   --slot lsl_abc --turn-id tat_abc --expected-epoch 0 \
   --cause "worker is no longer live" \
@@ -1028,7 +1030,7 @@ brainclaw loop takeover lop_abc \
 ```
 
 The full public lifecycle (`open`, `get`, `list`, `pause`, `resume`, `close`,
-`bind`, `verify`, `request_input`, `provide_input`, and the verbs above) is the
+`bind`, `verify`, `continue`, `request_input`, `provide_input`, and the verbs above) is the
 MCP `bclaw_loop(intent)` facade. Direct MCP `open` requires
 `allow_orphan=true`; review and ideation normally start through
 `bclaw_coordinate` so opening and dispatch stay one operation. See the
@@ -2032,7 +2034,7 @@ The default catalog is intentionally small and centred on the canonical grammar.
 |---|---|
 | `bclaw_coordinate(intent)` | Assign, consult, review, reroute, or summarize across agents. Pass `open_loop: true` on `intent="review"` to also dispatch the reviewer turn. |
 | `bclaw_dispatch(intent)` | Parallelize execute across a sequence's lanes (analysis / execute / review). |
-| `bclaw_loop(intent)` | Open, inspect, or drive a multi-turn loop. The public lifecycle is `open`, `get`, `list`, `turn`, `complete_turn`, `advance`, `add_artifact`, `pause`, `resume`, and `close`; implementation loops also add engine-only `bind` (validate the linked sequence and enter `execute`, never spawn) and `verify`, and any kind may use `request_input` / `provide_input`. Trusted `turn(dispatch=true)` is the common worker launch path. `bclaw_coordinate` / `bclaw_dispatch` remain ergonomic shortcuts. A direct `open` must include `allow_orphan: true` to acknowledge that the caller will dispatch or drive it. |
+| `bclaw_loop(intent)` | Open, inspect, or drive a multi-turn loop. `continue` persists and applies policy-governed cross-loop progression through the public mutation path. Implementation loops add engine-only `bind` and `verify`; any kind may use `request_input` / `provide_input`. Trusted `turn(dispatch=true)` remains the only worker launch path. A direct `open` must include `allow_orphan: true`. |
 
 **Sequences**:
 

package/docs/concepts/loop-engine.md

@@ -363,6 +363,7 @@ Additional shared and engine-owned actions complete the lifecycle:
 - **request_input** / **provide_input** — bounded, evidence-backed operator clarification usable by any protocol.
 - **bind** — implementation-loop engine action that validates the linked sequence and advances to `execute`; it never launches a worker.
 - **verify** — implementation/debug engine action that runs the opener-configured command outside the loop lock, then records a verification-attested report.
+- **continue** — orchestration action above the Loop engine. It evaluates an attested `next_action`, persists `AUTO | REQUIRE_APPROVAL | DENY`, and applies supported actions through the same public `open`/`bind` handlers.
 
 Artifact authority is sealed at these verb boundaries. `produced_by` is
 derived from the authenticated slot/engine/coordinator context. A narrative
@@ -396,6 +397,7 @@ type BclawLoopInput = BclawLoopCallerEnvelope & (
   | { intent: 'close';         loop_id: LoopId; status: 'completed' | 'cancelled' | 'blocked'; reason?: string; expected_version?: number }
   | { intent: 'verify';        loop_id: LoopId }
   | { intent: 'bind';          loop_id: LoopId; dry_run?: boolean; lanes?: string[]; auto_execute?: boolean; model?: string; max_assignments?: number }
+  | { intent: 'continue';      loop_id: LoopId; action_index?: number; autonomy_mode?: 'autonomous' | 'require_approval' | 'deny'; risk?: 'normal' | 'protected' }
   | { intent: 'request_input'; loop_id: LoopId; slot_id: SlotId; phase: string; question_text: string; evidence: string[]; suggested_default?: string; options?: OperatorQuestionOption[]; pause_scope: 'slot' | 'loop'; on_timeout: 'use_default' | 'cancel_loop' | 'continue_incomplete'; timeout_at?: string; expected_version?: number }
   | { intent: 'provide_input'; loop_id: LoopId; replies_to: string; resolved_via: 'answer' | 'choose' | 'skip' | 'timeout_default'; answer_text?: string; chosen_option_id?: string; by?: 'operator' | 'system'; expected_version?: number }
   | { intent: 'get';           loop_id: LoopId; include_events?: boolean }
@@ -470,6 +472,29 @@ The shared lifecycle verbs are `turn`, `complete_turn`, `advance`,
 use engine-only `bind` to validate their linked sequence and enter `execute`,
 then `turn(dispatch:true)` for worker slots; `verify` runs their declared command.
 
+### Persisted continuation authority
+
+An accepted ideation synthesis and an attested implementation handoff no
+longer expose ungoverned downstream mutations. Their `next_actions` point to
+`bclaw_loop(intent="continue")`. The
+continuation record binds the source loop, iteration, sealed artifact digest,
+canonical action hash and policy version into a deterministic key. It is
+written before the downstream mutation.
+
+For Ideation→Implementation, `AUTO` invokes the ordinary public `open` handler
+with that key in `linked.continuation_key`, then invokes engine-only `bind`.
+For Implementation→Review, it deterministically selects a project-registered,
+spawnable review-capable identity that did not occupy an implementation slot,
+then invokes the ordinary public `bclaw_coordinate(intent="review",
+open_loop=true)` path. If no independent reviewer exists, it fails closed.
+A retry first scans existing loops for the key, so a crash after either public
+mutation but before the response reuses the same loop. A live concurrent owner
+is observed rather than stolen.
+`REQUIRE_APPROVAL` creates an `ActionRequired` whose discriminated target is
+the continuation; approval resumes the same record, while rejection or expiry
+persists `DENY`. Unsupported actions, placeholders, missing evidence and
+ambiguous downstreams fail closed.
+
 ### Clarification is a cross-cutting primitive
 
 Clarification is deliberately not a sixth protocol. Any workflow can call

package/docs/loops/implementation.md

@@ -19,6 +19,11 @@ validates the plan/sequence link and advances to `execute`. It never launches
 a worker. `execute ↔ verify` iterates until the verify command is green or
 the cycle cap is hit.
 
+Binding validates the complete graph: every sequence item must reference a
+linked, existing plan (and an existing step when `stepId` is present). Explicit
+sequence lanes are paired deterministically with worker slots, one slot per
+lane. Each slot then carries its lane, plan/step ids, and `scope_hint`.
+
 ## Default protocol
 
 ```
@@ -67,6 +72,11 @@ iteration** — this guards the narrated-verify anti-pattern where a slot
 claims it verified without actually running the command. `command_green` in
 the iteration engine reads the reports produced against this gate.
 
+For bound lanes, call `bclaw_loop(intent='verify', slot_id=…)`. The command
+runs in that slot assignment's worktree. Omitting `slot_id` when several lane
+worktrees exist fails closed, and `command_green` requires a current-iteration
+green report from every bound lane.
+
 ## Stop condition
 
 ```ts
@@ -96,6 +106,9 @@ the iteration engine reads the reports produced against this gate.
 scope claim created by `turn(dispatch=true)`, and the common driver runs in
 the worktree bound to that claim. `bind` creates neither claim nor assignment.
 `session_id` is observability-only.
+Dispatch also uses the bound `scope_hint` to retrieve only path-related
+decisions, constraints, traps and runtime context (while retaining unscoped
+project-wide memory).
 [Attempt authority](../concepts/attempt-authority.md#ordered-dispatch)
 mints a deterministic `turn_id` from `(loop_id, slot_id, iteration)` on
 every dispatch, so a concurrent re-dispatch hits `reservation_exists` and
@@ -105,6 +118,13 @@ uses `(loop_id, slot_id, phase, iteration)` for a versioned successor logical
 turn. This is a Loop Engine rule shared by every kind, not implementation-loop
 special handling.
 
+At `handoff_ready`, the facade emits a structured `next_actions` call for
+`bclaw_coordinate(intent='review', open_loop=true)`. It remains explicit: the
+engine does not invent a reviewer or silently mutate external state. The
+created review loop persists `linked.source_loop_id`, while the implementation
+loop received the same provenance from its ideation source, so `list/get`
+surfaces the pipeline chain without a separate registry.
+
 ## Recovery
 
 - **Execute worker crashed mid-iteration.** Launch grant lease expires;

package/docs/mcp-schema-changelog.md

@@ -408,7 +408,16 @@ will still succeed. A follow-up PR will strip the dead handler code.
   changelog records the published MCP surface fingerprint. When a tool
   name, tier, category, or input schema changes, the test fails until
   this section is updated.
-- MCP public surface fingerprint: `sha256:81243f3d507c274e`
+- MCP public surface fingerprint: `sha256:be86e5571fcd0226`
+  (updated 2026-08-24 for persisted continuation authority: additive
+  `bclaw_loop(intent="continue")` inputs `action_index`, `autonomy_mode`, and
+  `risk`; the intent evaluates an attested Ideation→Implementation action,
+  persists AUTO/REQUIRE_APPROVAL/DENY, and reuses the public open/bind path.)
+  Previous: `sha256:681c47cba85b79c3`
+  (`LoopSlotInput` gains optional `lane`, `scope_hint`, `plan_ids`, and
+  `step_ids` fields so implementation-loop lane scope and provenance survive
+  through the public facade. Existing callers remain valid.)
+  Previous: `sha256:81243f3d507c274e`
   (updated 2026-08-23 for the common Loop Engine worker driver: `turn` exposes
   real dispatch/model/candidate controls and `complete_turn` exposes the full
   AttemptAuthority fence; bind remains engine-only with compatibility inputs.)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainclaw",
-  "version": "1.27.0",
+  "version": "1.28.1",
   "description": "Shared project memory for humans and coding agents.",
   "type": "module",
   "repository": {