brainclaw 1.28.0 → 1.28.2

package/dist/core/loops/turn-execution.js

@@ -13,22 +13,23 @@ import { getLoop } from './store.js';
 import { phasePolicy } from './kind-policies.js';
 /** Idempotently materialize every child projection required before launch. */
 export function ensureTurnExecutionProjections(reservation, input, cwd) {
-    if (reservation.claim_id === '')
+    const claimId = input.claim_id ?? reservation.claim_id;
+    if (claimId === '')
         throw new Error('attempt reservation has no claim');
     ensureAssignmentProjection({
         id: input.assignment_id,
         short_label: input.assignment_id,
-        claim_id: reservation.claim_id,
+        claim_id: claimId,
         agent: input.agent,
         agent_id: input.agent_id,
         dispatcher_agent: input.dispatcher_agent,
         dispatcher_session_id: input.dispatcher_session_id,
         scope: input.scope,
         description: input.description,
-        // Assignment is the stable logical attempt. Its contract projection stays
-        // generation-zero; each physical AgentRun below carries its own contract.
-        execution_contract_ref: reservation.execution_contract_ref,
-        capability_snapshot: reservation.capability_snapshot,
+        // Assignment is generation-scoped. Generation zero preserves the historic
+        // deterministic id; every takeover projects a fresh assignment and contract.
+        execution_contract_ref: input.execution_contract_ref ?? reservation.execution_contract_ref,
+        capability_snapshot: input.capability_snapshot ?? reservation.capability_snapshot,
         tags: input.assignment_tags ?? ['coordinate', 'loop', 'turn-owned'],
     }, cwd);
     input.on_projection?.('assignment');
@@ -36,7 +37,7 @@ export function ensureTurnExecutionProjections(reservation, input, cwd) {
         id: input.run_id,
         short_label: input.run_id,
         assignment_id: input.assignment_id,
-        claim_id: reservation.claim_id,
+        claim_id: claimId,
         attempt_index: input.attempt_index ?? 1,
         agent: input.agent,
         agent_id: input.agent_id,
@@ -50,7 +51,7 @@ export function ensureTurnExecutionProjections(reservation, input, cwd) {
         tags: input.run_tags ?? ['turn-owned', 'loop'],
     }, cwd);
     input.on_projection?.('run');
-    ensureClaimAssignmentBinding(reservation.claim_id, input.assignment_id, cwd, {
+    ensureClaimAssignmentBinding(claimId, input.assignment_id, cwd, {
         worktreePath: input.worktree_path,
     });
     input.on_projection?.('claim_binding');
@@ -61,7 +62,7 @@ export function ensureTurnExecutionProjections(reservation, input, cwd) {
         input: input.task,
         turn_id: input.turn_id,
         assignment_id: input.assignment_id,
-        claim_id: reservation.claim_id,
+        claim_id: claimId,
     }, cwd);
     input.on_projection?.('slot_binding');
     input.on_projection?.('before_crossing');
@@ -71,7 +72,11 @@ function preconditionDenied(reason) {
 }
 function authorityDenied(input, turnId, reason) {
     const reservation = getReservation(turnId, input.cwd);
-    const ownsAuthority = reservation?.claim_id === input.claim_id;
+    const chain = resolveTurnGenerationChain(input.cwd, turnId);
+    const authorityClaimId = chain?.status === 'active'
+        ? chain.latest_generation.executor?.claim_id ?? reservation?.claim_id
+        : reservation?.claim_id;
+    const ownsAuthority = authorityClaimId === input.claim_id;
     const crossed = reservation?.launch?.status === 'crossed';
     return {
         kind: 'denied',
@@ -129,13 +134,19 @@ export function prepareTurnExecution(input) {
     }, input.cwd);
     const childIds = deriveChildIds(turnId);
     const existingReservation = getReservation(turnId, input.cwd);
+    const v2 = resolveTurnGenerationChain(input.cwd, turnId);
+    const activeExecutor = v2?.status === 'active' && v2.latest_generation.attempt_epoch > 0
+        ? v2.latest_generation.executor
+        : undefined;
     if (slot.agent !== undefined && slot.agent !== input.agent) {
         return preconditionDenied(`slot ${input.slot_id} belongs to agent '${slot.agent}', not '${input.agent}'`);
     }
     if (slot.agent_id !== undefined && slot.agent_id !== input.agent_id) {
         return preconditionDenied(`slot ${input.slot_id} belongs to agent_id '${slot.agent_id}', not '${input.agent_id ?? 'none'}'`);
     }
-    if (slot.claim_id !== undefined && slot.claim_id !== input.claim_id) {
+    if (slot.claim_id !== undefined
+        && slot.claim_id !== input.claim_id
+        && ['assigned', 'working', 'waiting_input'].includes(slot.status)) {
         return preconditionDenied(`slot ${input.slot_id} is bound to claim ${slot.claim_id}, not ${input.claim_id}`);
     }
     if (slot.current_turn_id !== undefined
@@ -202,13 +213,15 @@ export function prepareTurnExecution(input) {
     catch (error) {
         return preconditionDenied(error instanceof Error ? error.message : String(error));
     }
-    const frozenHarnessBinding = existingReservation?.capability_snapshot?.resolved.harness;
+    const frozenHarnessBinding = activeExecutor?.capability_snapshot.resolved.harness
+        ?? existingReservation?.capability_snapshot?.resolved.harness;
     if (frozenHarnessBinding && JSON.stringify(frozenHarnessBinding) !== JSON.stringify(requestedHarnessBinding)) {
         return preconditionDenied(`harness binding differs from immutable capability snapshot: frozen `
             + `${frozenHarnessBinding.adapter_id}@${frozenHarnessBinding.adapter_version}, requested `
             + `${requestedHarnessBinding.adapter_id}@${requestedHarnessBinding.adapter_version}`);
     }
-    const capabilitySnapshot = existingReservation?.capability_snapshot
+    const capabilitySnapshot = activeExecutor?.capability_snapshot
+        ?? existingReservation?.capability_snapshot
         ?? resolveCapabilitySnapshot(input.agent, capabilityRequirement, input.agent_id, requestedHarnessBinding);
     if (!capabilitySnapshot.accepted) {
         const reasons = capabilitySnapshot.reasons.map((reason) => reason.code).join(', ');
@@ -256,7 +269,6 @@ export function prepareTurnExecution(input) {
     const contractRef = contract
         ? (existingReservation?.execution_contract_ref ?? executionContractRef(contract, capabilitySnapshot))
         : undefined;
-    const v2 = resolveTurnGenerationChain(input.cwd, turnId);
     const activeRollout = resolveActiveAttemptRollout(input.cwd);
     const localHome = readLocalAuthorityHome(input.cwd);
     if (activeRollout && (!localHome || !contractRef)) {
@@ -339,10 +351,16 @@ export function prepareTurnExecution(input) {
         try {
             const generation = v2.latest_generation;
             const generationContract = executionContractForGeneration(reservation, generation);
+            const executor = generation.executor ?? {
+                agent: reservation.agent,
+                agent_id: reservation.agent_id,
+                claim_id: reservation.claim_id,
+                capability_snapshot: reservation.capability_snapshot,
+            };
             let accepted;
             try {
                 accepted = input.accepted_execution_contract
-                    ?? attestHarnessContractAcceptance(generationContract.ref, reservation.capability_snapshot, requestedHarnessBinding);
+                    ?? attestHarnessContractAcceptance(generationContract.ref, executor.capability_snapshot, requestedHarnessBinding);
             }
             catch (error) {
                 return preconditionDenied(`worker contract acceptance unavailable before crossing: ${error instanceof Error ? error.message : String(error)}`);
@@ -357,8 +375,9 @@ export function prepareTurnExecution(input) {
                 turn_id: turnId,
                 assignment_id: generation.assignment_id,
                 run_id: generation.run_id,
-                agent: input.agent,
-                agent_id: input.agent_id,
+                claim_id: executor.claim_id,
+                agent: executor.agent,
+                agent_id: executor.agent_id,
                 dispatcher_agent: input.dispatcher_agent,
                 dispatcher_agent_id: input.dispatcher_agent_id,
                 dispatcher_session_id: input.dispatcher_session_id,
@@ -370,7 +389,7 @@ export function prepareTurnExecution(input) {
                 run_tags: [...(input.run_tags ?? ['turn-owned', 'loop']), `attempt-generation:${generation.attempt_epoch}`],
                 attempt_index: generation.attempt_epoch + 1,
                 execution_contract_ref: generationContract.ref,
-                capability_snapshot: reservation.capability_snapshot,
+                capability_snapshot: executor.capability_snapshot,
                 on_projection: input.on_projection,
             }, input.cwd);
             const crossing = crossActiveAttemptGenerationV2(turnId, generation.attempt_epoch, localHome, input.dispatcher_agent_id ?? input.dispatcher_agent, input.dispatcher_agent_id ?? input.dispatcher_agent, input.cwd);
@@ -387,7 +406,7 @@ export function prepareTurnExecution(input) {
                 workspace_path: generation.workspace_path,
                 contract_status: 'contracted',
                 execution_contract_ref: generationContract.ref,
-                capability_snapshot: reservation.capability_snapshot,
+                capability_snapshot: executor.capability_snapshot,
             };
         }
         catch (error) {

package/dist/core/loops/types.js

@@ -25,6 +25,12 @@ export const LoopLinksSchema = z.object({
     sequence_ids: z.array(z.string().min(1)).optional(),
     /** Upstream loop in an ideation → implementation → review pipeline. */
     source_loop_id: z.string().regex(/^lop_[0-9a-z]+$/).optional(),
+    /** Exact upstream artifact that authorized this continuation. */
+    source_artifact_id: z.string().regex(/^art_[0-9a-z]+$/).optional(),
+    /** Sealed digest of source_artifact_id at continuation evaluation time. */
+    source_artifact_digest: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    /** Durable, deterministic identity of the policy decision that created this loop. */
+    continuation_key: z.string().regex(/^[a-f0-9]{64}$/).optional(),
 });
 /**
  * Memory categories a loop phase can request via `context_filter` (pln#492).
@@ -728,6 +734,9 @@ export const LoopEventSchema = z.discriminatedUnion('kind', [
         slot_id: z.string().min(1),
         turn_id: z.string().min(1),
         assignment_id: z.string().min(1),
+        claim_id: z.string().min(1).optional(),
+        agent: z.string().min(1).optional(),
+        agent_id: z.string().min(1).optional(),
         from_epoch: z.number().int().nonnegative(),
         to_epoch: z.number().int().positive(),
         from_run_id: z.string().min(1),

package/dist/core/loops/verbs.js

@@ -586,7 +586,7 @@ function authorizeCompleteTurnAttempt(input, slot, cwd) {
         slot_role: slot.role,
         turn_id: generation.turn_id,
         assignment_id: generation.assignment_id,
-        claim_id: reservation.claim_id ?? slot.claim_id,
+        claim_id: generation.executor?.claim_id ?? slot.claim_id ?? reservation.claim_id,
         run_id: generation.run_id,
         nonce: generation.launch_nonce,
         attempt_epoch: generation.attempt_epoch,

package/dist/core/reviewer-policy.js

@@ -0,0 +1,39 @@
+import { listAgentIdentities } from './agent-registry.js';
+import { resolveExecutionCandidate } from './execution-contract.js';
+export const REVIEWER_SELECTION_POLICY_VERSION = 'reviewer-selection-v1';
+/**
+ * Select a concrete review worker from project-registered identities.
+ *
+ * The shared execution-contract resolver supplies capability checks and stable
+ * ordering. The policy additionally enforces reviewer independence by
+ * excluding every identity frozen onto an implementation slot.
+ */
+export function selectImplementationReviewer(source, cwd) {
+    if (source.kind !== 'implementation') {
+        throw new Error(`reviewer_selection_source_invalid: loop ${source.id} is ${source.kind}`);
+    }
+    const excludedImplementers = source.slots
+        .filter((slot) => Boolean(slot.agent))
+        .map((slot) => ({ agent: slot.agent, ...(slot.agent_id ? { agent_id: slot.agent_id } : {}) }));
+    const excludedNames = new Set(excludedImplementers.map((identity) => identity.agent.normalize('NFC')));
+    const excludedIds = new Set(excludedImplementers.flatMap((identity) => identity.agent_id ? [identity.agent_id.normalize('NFC')] : []));
+    const identities = listAgentIdentities(cwd)
+        .filter((identity) => identity.kind !== 'human')
+        .filter((identity) => !excludedNames.has(identity.agent_name.normalize('NFC')) && !excludedIds.has(identity.agent_id.normalize('NFC')))
+        .map((identity) => ({ agent: identity.agent_name, agent_id: identity.agent_id }));
+    const resolution = resolveExecutionCandidate(identities, { roles: ['review'], required_surfaces: ['cli_spawn'], execution_surfaces: [], required_tools: [] });
+    if (resolution.kind !== 'selected') {
+        const reasons = resolution.evaluated
+            .map((candidate) => `${candidate.agent}:${candidate.snapshot.reasons.map((reason) => reason.code).join('+') || 'excluded'}`)
+            .join(', ');
+        throw new Error(`continuation_reviewer_unavailable: no independent spawnable reviewer${reasons ? ` (${reasons})` : ''}`);
+    }
+    return {
+        policy_version: REVIEWER_SELECTION_POLICY_VERSION,
+        agent: resolution.selected.agent,
+        agent_id: resolution.selected.agent_id,
+        evaluated: resolution.evaluated,
+        excluded_implementers: excludedImplementers,
+    };
+}
+//# sourceMappingURL=reviewer-policy.js.map

package/dist/core/schema.js

@@ -923,11 +923,18 @@ export const ActionRequiredResponseSchema = z.object({
     responded_by_id: z.string().optional(),
     responded_at: z.string(),
 });
+export const ActionRequiredTargetSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('assignment'), assignment_id: z.string() }),
+    z.object({ kind: z.literal('continuation'), continuation_id: z.string().regex(/^ctn_[a-f0-9]{24}$/) }),
+]);
 export const ActionRequiredSchema = z.object({
     schema_version: z.number().int().positive().optional(),
     id: z.string(),
     short_label: z.string().optional(),
-    assignment_id: z.string(),
+    /** Legacy top-level assignment link; retained for v1 records. */
+    assignment_id: z.string().optional(),
+    /** Discriminated approval target. New records always persist this field. */
+    target: ActionRequiredTargetSchema.optional(),
     run_id: z.string().optional(),
     claim_id: z.string().optional(),
     message_id: z.string().optional(),
@@ -949,6 +956,14 @@ export const ActionRequiredSchema = z.object({
     resolved_at: z.string().optional(),
     response: ActionRequiredResponseSchema.optional(),
     tags: TagsWithDefaultSchema,
+}).superRefine((action, ctx) => {
+    const target = action.target ?? (action.assignment_id ? { kind: 'assignment', assignment_id: action.assignment_id } : undefined);
+    if (!target) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['target'], message: 'ActionRequired requires an assignment or continuation target' });
+    }
+    if (target?.kind === 'assignment' && action.assignment_id && target.assignment_id !== action.assignment_id) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['target'], message: 'assignment target must match assignment_id' });
+    }
 });
 // --- Runtime notes schemas ---
 export const RuntimeNoteTypeSchema = z.enum(['observation', 'session_start', 'session_end']);

package/dist/facts.js

@@ -1,8 +1,8 @@
 // Generated by scripts/emit-site-facts.mjs at build time. Do not edit manually.
-// Source: brainclaw v1.28.0 on 2026-08-24T07:09:07.814Z
+// Source: brainclaw v1.28.2 on 2026-08-25T18:22:09.950Z
 export const FACTS = {
-  "version": "1.28.0",
-  "generated_at": "2026-08-24T07:09:07.814Z",
+  "version": "1.28.2",
+  "generated_at": "2026-08-25T18:22:09.950Z",
   "tools": {
     "count": 70,
     "published_count": 68,
@@ -478,7 +478,7 @@ export const FACTS = {
   },
   "bench": {
     "schema": "brainclaw.bench.v1",
-    "generated_at": "2026-08-24T07:09:05.728Z",
+    "generated_at": "2026-08-25T18:22:07.761Z",
     "node_version": "v24.19.0",
     "platform": "linux-x64",
     "repeats": 3,
@@ -487,7 +487,7 @@ export const FACTS = {
         "name": "cold_onboard",
         "volume": "empty",
         "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
-        "duration_ms_median": 81,
+        "duration_ms_median": 82,
         "payload_chars_median": 1640,
         "payload_tokens_est_median": 410
       },
@@ -495,7 +495,7 @@ export const FACTS = {
         "name": "warm_work",
         "volume": "medium",
         "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
-        "duration_ms_median": 120,
+        "duration_ms_median": 132,
         "payload_chars_median": 2626,
         "payload_tokens_est_median": 657
       },
@@ -504,8 +504,8 @@ export const FACTS = {
         "volume": "medium",
         "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
         "duration_ms_median": 13,
-        "payload_chars_median": 1305,
-        "payload_tokens_est_median": 326
+        "payload_chars_median": 1629,
+        "payload_tokens_est_median": 407
       }
     ]
   }

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.28.0",
-  "generated_at": "2026-08-24T07:09:07.814Z",
+  "version": "1.28.2",
+  "generated_at": "2026-08-25T18:22:09.950Z",
   "tools": {
     "count": 70,
     "published_count": 68,
@@ -476,7 +476,7 @@
   },
   "bench": {
     "schema": "brainclaw.bench.v1",
-    "generated_at": "2026-08-24T07:09:05.728Z",
+    "generated_at": "2026-08-25T18:22:07.761Z",
     "node_version": "v24.19.0",
     "platform": "linux-x64",
     "repeats": 3,
@@ -485,7 +485,7 @@
         "name": "cold_onboard",
         "volume": "empty",
         "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
-        "duration_ms_median": 81,
+        "duration_ms_median": 82,
         "payload_chars_median": 1640,
         "payload_tokens_est_median": 410
       },
@@ -493,7 +493,7 @@
         "name": "warm_work",
         "volume": "medium",
         "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
-        "duration_ms_median": 120,
+        "duration_ms_median": 132,
         "payload_chars_median": 2626,
         "payload_tokens_est_median": 657
       },
@@ -502,8 +502,8 @@
         "volume": "medium",
         "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
         "duration_ms_median": 13,
-        "payload_chars_median": 1305,
-        "payload_tokens_est_median": 326
+        "payload_chars_median": 1629,
+        "payload_tokens_est_median": 407
       }
     ]
   }

package/docs/cli.md

@@ -1016,9 +1016,11 @@ research, and debug; they are not a review-only command group.
 | `takeover <loop_id>` | slot, turn, expected epoch, cause, liveness evidence, external-effect policy, next workspace and coordinator identity | Fence one physical generation and arm a successor without changing the logical Assignment. |
 | `advance <loop_id>` | — | Advance through the protocol; optional `--to-phase`, `--force`, `--reason`. |
 | `add-artifact <loop_id>` | `--phase --type --body` | Attach a typed artifact; optional producer and ref. |
+| `continue <loop_id>` | — | Evaluate an attested Ideation→Implementation or Implementation→Review action and persist/apply `AUTO`, `REQUIRE_APPROVAL`, or `DENY`; options: `--action-index`, `--autonomy-mode`, `--risk`. Review continuation selects an independent registered reviewer and fails closed if none is available. |
 
 ```bash
 brainclaw loop advance lop_abc --json
+brainclaw loop continue lop_abc --autonomy-mode autonomous --risk normal --json
 brainclaw loop takeover lop_abc \
   --slot lsl_abc --turn-id tat_abc --expected-epoch 0 \
   --cause "worker is no longer live" \
@@ -1028,7 +1030,7 @@ brainclaw loop takeover lop_abc \
 ```
 
 The full public lifecycle (`open`, `get`, `list`, `pause`, `resume`, `close`,
-`bind`, `verify`, `request_input`, `provide_input`, and the verbs above) is the
+`bind`, `verify`, `continue`, `request_input`, `provide_input`, and the verbs above) is the
 MCP `bclaw_loop(intent)` facade. Direct MCP `open` requires
 `allow_orphan=true`; review and ideation normally start through
 `bclaw_coordinate` so opening and dispatch stay one operation. See the
@@ -2032,7 +2034,7 @@ The default catalog is intentionally small and centred on the canonical grammar.
 |---|---|
 | `bclaw_coordinate(intent)` | Assign, consult, review, reroute, or summarize across agents. Pass `open_loop: true` on `intent="review"` to also dispatch the reviewer turn. |
 | `bclaw_dispatch(intent)` | Parallelize execute across a sequence's lanes (analysis / execute / review). |
-| `bclaw_loop(intent)` | Open, inspect, or drive a multi-turn loop. The public lifecycle is `open`, `get`, `list`, `turn`, `complete_turn`, `advance`, `add_artifact`, `pause`, `resume`, and `close`; implementation loops also add engine-only `bind` (validate the linked sequence and enter `execute`, never spawn) and `verify`, and any kind may use `request_input` / `provide_input`. Trusted `turn(dispatch=true)` is the common worker launch path. `bclaw_coordinate` / `bclaw_dispatch` remain ergonomic shortcuts. A direct `open` must include `allow_orphan: true` to acknowledge that the caller will dispatch or drive it. |
+| `bclaw_loop(intent)` | Open, inspect, or drive a multi-turn loop. `continue` persists and applies policy-governed cross-loop progression through the public mutation path. Implementation loops add engine-only `bind` and `verify`; any kind may use `request_input` / `provide_input`. Trusted `turn(dispatch=true)` remains the only worker launch path. A direct `open` must include `allow_orphan: true`. |
 
 **Sequences**:
 

package/docs/code-map.md

@@ -47,6 +47,8 @@ brainclaw code-map status
 ```
 Code Map status
   Store:    present
+  Root:     /workspace/apps/api
+  Path:     /workspace/apps/api/.brainclaw/code
   Freshness: fresh
   Files:    142
   Nodes:    1873
@@ -212,6 +214,14 @@ Code Map to **that child** — the same per-project scoping that powers `bclaw_w
 juggling. A submodule that is itself an application (under e.g. `apps/`) is indexed
 like any other directory.
 
+Both CLI and MCP status responses disclose the exact resolved project root and
+Code Map store path. The MCP response additionally includes `active_source`, the
+resolved project identity, the running server version, and the package version
+visible on disk. In a monorepo, compare these fields before concluding that an
+index is missing: a root store and a child store are intentionally distinct. If
+the versions differ, restart the MCP server; if the roots differ, select the
+intended project/session (or pass `cascade=true` at the workspace root).
+
 ### Cascading a multi-project workspace (`--cascade`)
 
 In a `project_mode: multi-project` workspace, one refresh at the root can index

package/docs/concepts/loop-engine.md

@@ -363,6 +363,7 @@ Additional shared and engine-owned actions complete the lifecycle:
 - **request_input** / **provide_input** — bounded, evidence-backed operator clarification usable by any protocol.
 - **bind** — implementation-loop engine action that validates the linked sequence and advances to `execute`; it never launches a worker.
 - **verify** — implementation/debug engine action that runs the opener-configured command outside the loop lock, then records a verification-attested report.
+- **continue** — orchestration action above the Loop engine. It evaluates an attested `next_action`, persists `AUTO | REQUIRE_APPROVAL | DENY`, and applies supported actions through the same public `open`/`bind` handlers.
 
 Artifact authority is sealed at these verb boundaries. `produced_by` is
 derived from the authenticated slot/engine/coordinator context. A narrative
@@ -396,6 +397,7 @@ type BclawLoopInput = BclawLoopCallerEnvelope & (
   | { intent: 'close';         loop_id: LoopId; status: 'completed' | 'cancelled' | 'blocked'; reason?: string; expected_version?: number }
   | { intent: 'verify';        loop_id: LoopId }
   | { intent: 'bind';          loop_id: LoopId; dry_run?: boolean; lanes?: string[]; auto_execute?: boolean; model?: string; max_assignments?: number }
+  | { intent: 'continue';      loop_id: LoopId; action_index?: number; autonomy_mode?: 'autonomous' | 'require_approval' | 'deny'; risk?: 'normal' | 'protected' }
   | { intent: 'request_input'; loop_id: LoopId; slot_id: SlotId; phase: string; question_text: string; evidence: string[]; suggested_default?: string; options?: OperatorQuestionOption[]; pause_scope: 'slot' | 'loop'; on_timeout: 'use_default' | 'cancel_loop' | 'continue_incomplete'; timeout_at?: string; expected_version?: number }
   | { intent: 'provide_input'; loop_id: LoopId; replies_to: string; resolved_via: 'answer' | 'choose' | 'skip' | 'timeout_default'; answer_text?: string; chosen_option_id?: string; by?: 'operator' | 'system'; expected_version?: number }
   | { intent: 'get';           loop_id: LoopId; include_events?: boolean }
@@ -470,6 +472,29 @@ The shared lifecycle verbs are `turn`, `complete_turn`, `advance`,
 use engine-only `bind` to validate their linked sequence and enter `execute`,
 then `turn(dispatch:true)` for worker slots; `verify` runs their declared command.
 
+### Persisted continuation authority
+
+An accepted ideation synthesis and an attested implementation handoff no
+longer expose ungoverned downstream mutations. Their `next_actions` point to
+`bclaw_loop(intent="continue")`. The
+continuation record binds the source loop, iteration, sealed artifact digest,
+canonical action hash and policy version into a deterministic key. It is
+written before the downstream mutation.
+
+For Ideation→Implementation, `AUTO` invokes the ordinary public `open` handler
+with that key in `linked.continuation_key`, then invokes engine-only `bind`.
+For Implementation→Review, it deterministically selects a project-registered,
+spawnable review-capable identity that did not occupy an implementation slot,
+then invokes the ordinary public `bclaw_coordinate(intent="review",
+open_loop=true)` path. If no independent reviewer exists, it fails closed.
+A retry first scans existing loops for the key, so a crash after either public
+mutation but before the response reuses the same loop. A live concurrent owner
+is observed rather than stolen.
+`REQUIRE_APPROVAL` creates an `ActionRequired` whose discriminated target is
+the continuation; approval resumes the same record, while rejection or expiry
+persists `DENY`. Unsupported actions, placeholders, missing evidence and
+ambiguous downstreams fail closed.
+
 ### Clarification is a cross-cutting primitive
 
 Clarification is deliberately not a sixth protocol. Any workflow can call
@@ -493,6 +518,11 @@ The Loop engine is a **control plane**; existing primitives remain the **data pl
 
 A Loop never copies these objects — it links them. Deleting the linked primitive does not break the loop; the reference just becomes dangling, surfaced in diagnostics.
 
+Inline `LoopArtifact.body` values are capped at **4096 UTF-8 bytes**, not 4096
+characters. Larger task and result text remains available through its source
+object or a `ref`; any inline projection is byte-truncated with an explicit
+`…[truncated]` marker. This contract is identical for review and ideation.
+
 ## Per-protocol guides
 
 Each of the five kinds has its own operator-facing guide with the same

package/docs/mcp-schema-changelog.md

@@ -408,7 +408,12 @@ will still succeed. A follow-up PR will strip the dead handler code.
   changelog records the published MCP surface fingerprint. When a tool
   name, tier, category, or input schema changes, the test fails until
   this section is updated.
-- MCP public surface fingerprint: `sha256:681c47cba85b79c3`
+- MCP public surface fingerprint: `sha256:be86e5571fcd0226`
+  (updated 2026-08-24 for persisted continuation authority: additive
+  `bclaw_loop(intent="continue")` inputs `action_index`, `autonomy_mode`, and
+  `risk`; the intent evaluates an attested Ideation→Implementation action,
+  persists AUTO/REQUIRE_APPROVAL/DENY, and reuses the public open/bind path.)
+  Previous: `sha256:681c47cba85b79c3`
   (`LoopSlotInput` gains optional `lane`, `scope_hint`, `plan_ids`, and
   `step_ids` fields so implementation-loop lane scope and provenance survive
   through the public facade. Existing callers remain valid.)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainclaw",
-  "version": "1.28.0",
+  "version": "1.28.2",
   "description": "Shared project memory for humans and coding agents.",
   "type": "module",
   "repository": {