carthagent 0.0.0-stage → 1.0.7

package/tests/extension.test.mjs

@@ -0,0 +1,921 @@
+import { test } from 'node:test';
+import { fixtureDesign, fixtureReview } from './helpers/tested-design.mjs';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { lockWorkspace, selectReport } from '../lib/workspace.mjs';
+import { saveReport, createReport } from '../lib/reports.mjs';
+
+// Load the project extension even without a global engine installation.
+const requireEngine = createRequire(import.meta.url);
+const { createJiti } = requireEngine('jiti');
+const jiti = createJiti(import.meta.url, { alias: { '@earendil-works/pi-coding-agent': fileURLToPath(new URL('../vendor/agent/index.js', import.meta.url)) } });
+const factory = await jiti.import(fileURLToPath(new URL('../extensions/delivery.ts', import.meta.url)), { default: true });
+const options = {};
+function fixture(t, { approve = true } = {}) {
+  const cwd = mkdtempSync(join(tmpdir(), 'engine extension integration '));
+  t.after(() => rmSync(cwd, { recursive: true, force: true }));
+  writeFileSync(join(cwd, 'app.py'), 'print(1)');
+  const hooks = {}, commands = {}, tools = {}, entries = [], messages = [], flags = { 'delivery-strict': true };
+  const engine = {
+    registerCommand(name, command) { commands[name] = command; },
+    registerFlag() {}, getFlag: name => flags[name],
+    on(name, fn) { hooks[name] = fn; },
+    registerTool(tool) { tools[tool.name] = tool; },
+    appendEntry(customType, data) { entries.push({ type: 'custom', customType, data }); },
+    sendMessage(message) { messages.push(message); },
+  };
+  factory(engine);
+  const ctx = { cwd, hasUI: false, aborted: 0, abort() { this.aborted++; }, sessionManager: { getEntries: () => entries, getBranch: () => entries, getSessionId: () => 'integration-session' }, hasPendingMessages: () => false };
+  const rawCall = (name, params = {}) => tools[name].execute('test-id', params, undefined, undefined, ctx);
+  const inspectReview = async () => {
+    const inspected = JSON.parse((await rawCall('delivery_design', { action: 'inspect' })).content[0].text);
+    return { ...fixtureReview(entries.at(-1).data.plan), captureId: inspected.result.id };
+  };
+  const call = async (name, params = {}) => {
+    if (approve && name === 'delivery_plan' && (params.verification ?? 'required') === 'required') params = { ...params, design: fixtureDesign(params) };
+    if (approve && name === 'delivery_revise' && params.patch?.acceptance) params = { ...params, patch: { ...params.patch, design: fixtureDesign({ ...entries.at(-1).data.plan, ...params.patch }) } };
+    const result = await rawCall(name, params);
+    if (approve && ['delivery_plan', 'delivery_revise'].includes(name)) {
+      const current = entries.at(-1)?.data?.plan;
+      if (current && (current.verification ?? 'required') === 'required') {
+        if (JSON.stringify(current.design) !== JSON.stringify(fixtureDesign(current))) await rawCall('delivery_revise', { reason: 'Bind fixture scenarios to required validators', patch: { design: fixtureDesign(current) } });
+        const plan = entries.at(-1).data.plan;
+        await rawCall('delivery_design', { action: 'validate' });
+        const inspected = JSON.parse((await rawCall('delivery_design', { action: 'inspect' })).content[0].text);
+        await rawCall('delivery_design', { action: 'review', review: { ...fixtureReview(plan), captureId: inspected.result.id } });
+        await rawCall('delivery_design', { action: 'approve' });
+      }
+    }
+    return result;
+  };
+  const plan = { goal: 'Working script', assumptions: [], artifacts: ['app.py'], steps: ['Implement', 'Verify'], acceptance: [{ requirement: 'Runs', checks: ['run'] }], checks: [{ id: 'run', kind: 'runtime', argv: [process.execPath, '-e', 'console.log("passed")'], timeoutSeconds: 5 }] };
+  return { cwd, ctx, hooks, commands, entries, messages, flags, call, plan, inspectReview };
+}
+
+test('live extension refreshes same-run state and rejects superseded mutations and busy checks', async t => {
+  const f = fixture(t);
+  const planned = await f.call('delivery_plan', f.plan);
+  const path = JSON.parse(planned.content[0].text).report;
+  const disk = JSON.parse(readFileSync(path, 'utf8'));
+  disk.stepStatus = { step0: 'done' };
+  saveReport(path, disk);
+  await f.call('delivery_progress', { step: 1, status: 'active' });
+  assert.equal(JSON.parse(readFileSync(path, 'utf8')).stepStatus.step0, 'done');
+  const release = lockWorkspace(f.cwd);
+  await assert.rejects(f.call('delivery_check', { id: 'all' }), /Workspace busy/);
+  release();
+  const other = createReport(f.cwd, { status: 'implementing', plan: f.plan, evidence: {} });
+  selectReport(f.cwd, other.path);
+  await assert.rejects(f.call('delivery_progress', { step: 0, status: 'active' }), /superseded/);
+  f.hooks.agent_end({ messages: [] }, f.ctx);
+  assert.equal(f.messages.length, 0);
+  await f.call('delivery_plan', f.plan); // Explicit new work can supersede an idle run.
+});
+
+test('built-in Jev opt-in persists unavailable advice without unlocking implementation', async t => {
+  const f = fixture(t, { approve: false });
+  f.flags['delivery-jev'] = true;
+  f.flags['delivery-jev-provider'] = 'invalid-provider';
+  await f.call('delivery_plan', { ...f.plan, design: fixtureDesign(f.plan) });
+  await f.call('delivery_design', { action: 'validate' });
+  const first = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  assert.equal(first.advice.mode, 'unavailable');
+  assert.equal(first.planningStatus.locked, true);
+  const again = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  assert.equal(again.advice.reused, true);
+  assert.equal(f.entries.at(-1).data.advisorAttempts.length, 1);
+  f.hooks.session_start({}, f.ctx);
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx).block, true);
+  assert.match(f.hooks.context({ messages: [] }, f.ctx).messages.at(-1).content, /unavailable/);
+});
+
+test('design review accepts captureId beside the action or echoed as review.id', async t => {
+  const f = fixture(t, { approve: false });
+  await f.call('delivery_plan', { ...f.plan, design: fixtureDesign(f.plan) });
+  await f.call('delivery_design', { action: 'validate' });
+  const first = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  assert.equal(first.captureId, first.result.id);
+  // Top-level captureId (the delivery_review shape) is normalized into review.
+  await f.call('delivery_design', { action: 'review', captureId: first.result.id, review: fixtureReview(entriesPlan(f)) });
+  await f.call('delivery_design', { action: 'approve' });
+  // A revision relocks: captureId echoed under the inspect field name works too.
+  await f.call('delivery_revise', { reason: 'Adjust scope', patch: { assumptions: ['new'] } });
+  await f.call('delivery_design', { action: 'validate' });
+  const second = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  const failed = await f.call('delivery_design', { action: 'review', review: fixtureReview(entriesPlan(f)) }).then(() => null, e => e);
+  assert.match(failed.message, new RegExp(second.result.id));
+  await f.call('delivery_design', { action: 'review', review: { ...fixtureReview(entriesPlan(f)), id: second.result.id } });
+  await f.call('delivery_design', { action: 'approve' });
+  // An explicit nested null must not shadow the valid top-level captureId.
+  await f.call('delivery_revise', { reason: 'Second adjustment', patch: { assumptions: ['newer'] } });
+  await f.call('delivery_design', { action: 'validate' });
+  const third = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  await f.call('delivery_design', { action: 'review', captureId: third.result.id, review: { ...fixtureReview(entriesPlan(f)), captureId: null } });
+  await f.call('delivery_design', { action: 'approve' });
+});
+function entriesPlan(f) { return f.entries.at(-1).data.plan; }
+
+test('discovery guide/checkpoint restore, questions, terminal suppression and read permission', async t => {
+  const f = fixture(t, { approve: false });
+  const guide = JSON.parse((await f.call('delivery_design', { action: 'guide' })).content[0].text);
+  assert.equal(guide.authority, 'none'); assert.equal(f.entries.length, 0);
+  f.hooks.before_agent_start({ prompt: 'Implement a new feature', systemPrompt: '' }, f.ctx);
+  for (let i = 0; i < 8; i++) await f.hooks.tool_result({ toolName: 'read', content: [] }, f.ctx);
+  assert.match(f.hooks.context({ messages: [] }, f.ctx).messages[0].content, /8 discovery/);
+  assert.equal(f.hooks.tool_call({ toolName: 'read' }, f.ctx), undefined);
+  assert.equal(f.hooks.tool_call({ toolName: 'code_nav' }, f.ctx), undefined);
+  await f.hooks.tool_result({ toolName: 'code_nav', content: [] }, f.ctx);
+  assert.match(f.hooks.context({ messages: [] }, f.ctx).messages[0].content, /9 discovery/);
+  f.hooks.session_compact({}, f.ctx); f.hooks.session_start({}, f.ctx);
+  assert.match(f.hooks.context({ messages: [] }, f.ctx).messages[0].content, /9 discovery/);
+  const branch = f.ctx.sessionManager.getBranch;
+  f.ctx.sessionManager.getBranch = () => [];
+  f.hooks.session_tree({}, f.ctx);
+  assert.equal(f.hooks.context({ messages: [] }, f.ctx), undefined);
+  f.ctx.sessionManager.getBranch = branch;
+  f.hooks.session_tree({}, f.ctx);
+  assert.match(f.hooks.context({ messages: [] }, f.ctx).messages[0].content, /9 discovery/);
+  f.hooks.input({ source: 'interactive' });
+  f.hooks.before_agent_start({ prompt: 'Explain how this code works', systemPrompt: '' }, f.ctx);
+  for (let i = 0; i < 20; i++) await f.hooks.tool_result({ toolName: 'read', content: [] }, f.ctx);
+  assert.equal(f.hooks.context({ messages: [] }, f.ctx), undefined);
+  f.hooks.input({ source: 'interactive' });
+  f.hooks.before_agent_start({ prompt: 'Implement a new feature', systemPrompt: '' }, f.ctx);
+  f.hooks.tool_call({ toolName: 'bash' }, f.ctx);
+  assert.match(f.hooks.tool_call({ toolName: 'bash' }, f.ctx).reason, /2 blocked/);
+  await f.call('delivery_plan', { ...f.plan, design: fixtureDesign(f.plan) });
+  await f.call('delivery_finish', { status: 'blocked', review: 'Fixture stop', launch: 'n/a', limitations: ['No implementation'] });
+  assert.equal(f.hooks.context({ messages: [] }, f.ctx), undefined);
+});
+
+test('schema repair -> Jev -> approved edit -> checks -> final review completes without changing scope', async t => {
+  const { createServer } = await import('node:http'); let calls = 0;
+  const server = createServer(async (req, res) => {
+    let body = ''; for await (const chunk of req) body += chunk;
+    const payload = JSON.parse(body); assert.equal(payload.state.goal, 'Working script'); assert.ok(payload.state.checks[0].argv); calls++;
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify({ model: 'typesafe/jev-1.13-fixture', answers: { srp: { type: 'noul', noul: .1 }, di: { type: 'noul', noul: .1 }, tests: { type: 'noul', noul: .8 } } }));
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => { server.closeAllConnections(); server.close(); });
+  const f = fixture(t, { approve: false });
+  f.flags['delivery-jev'] = true; f.flags['delivery-jev-broker'] = `http://127.0.0.1:${server.address().port}/jev`;
+  await f.call('delivery_design', { action: 'guide' });
+  const plan = { ...f.plan, steps: [{ id: 'build', title: 'Implement and test', checks: ['run'] }] };
+  plan.design = fixtureDesign(plan); const correct = structuredClone(plan.design); plan.design.scenarios[0].checks = ['wrong'];
+  await f.call('delivery_plan', plan);
+  const validation = JSON.parse((await f.call('delivery_design', { action: 'validate' })).content[0].text);
+  assert.match(validation.next, /No Jev call/); assert.deepEqual(validation.references.checks, ['run']);
+  await assert.rejects(f.call('delivery_design', { action: 'inspect' }), /Fresh passing/); assert.equal(calls, 0);
+  assert.equal(f.entries.at(-1).data.advisorAttempts, undefined);
+  await f.call('delivery_revise', { reason: 'Fix check reference preserving obligations', patch: { design: correct } });
+  await f.call('delivery_design', { action: 'validate' });
+  const inspected = JSON.parse((await f.call('delivery_design', { action: 'inspect' })).content[0].text);
+  assert.equal(calls, 1); assert.equal(inspected.advice.findings[0].category, 'tests'); assert.equal(inspected.planningStatus.locked, true);
+  const current = f.entries.at(-1).data.plan;
+  assert.deepEqual(current.acceptance, plan.acceptance); assert.deepEqual(current.checks, plan.checks);
+  await f.call('delivery_design', { action: 'review', review: { ...fixtureReview(current), captureId: inspected.result.id, challenges: ['Investigated Jev tests topic; fixture checks plumbing, not semantic completeness'] } });
+  await f.call('delivery_design', { action: 'approve' });
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx), undefined);
+  writeFileSync(join(f.cwd, 'app.py'), 'print(2)');
+  f.hooks.session_compact({}, f.ctx);
+  await f.call('delivery_check', { id: 'all' }); await f.call('delivery_progress', { step: 'build', status: 'done' });
+  const capture = JSON.parse((await f.call('delivery_review', { action: 'inspect' })).content[0].text);
+  await f.call('delivery_review', { action: 'record', captureId: capture.id, coverage: [{ requirement: 'Runs', assertions: 'Fixture subprocess exited zero' }], probes: ['Runtime check exit 0'], findings: [], limitations: ['Plumbing fixture, no Git baseline or semantic proof'] });
+  await f.call('delivery_finish', { status: 'verified', review: 'Reviewed fixture', launch: 'python app.py', limitations: ['Plumbing only'] });
+  assert.equal(f.entries.at(-1).data.status, 'verified'); assert.equal(calls, 1);
+});
+
+test('revision tool rejects malformed patches before merging current fields', async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  const before = f.entries.at(-1).data.revision;
+  for (const patch of [null, {}, [], 'invalid', { evidence: {} }]) {
+    await assert.rejects(f.call('delivery_revise', { reason: 'Invalid patch', patch }), /nonempty|Unknown/);
+  }
+  assert.equal(f.entries.at(-1).data.revision, before);
+});
+
+test('real extension loads, gates writes, executes checks and rejects stale evidence', options, async t => {
+  const f = fixture(t);
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }).block, true);
+  assert.equal(f.hooks.tool_call({ toolName: 'bash', input: { command: 'mkdir artifacts' } }, f.ctx).block, true);
+  assert.equal(f.hooks.tool_call({ toolName: 'bash', input: { command: 'ls -la' } }, f.ctx).block, true);
+  await f.call('delivery_plan', f.plan);
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx), undefined);
+  const finish = { status: 'verified', review: 'Reviewed executable behavior.', launch: 'python app.py', limitations: [] };
+  await assert.rejects(f.call('delivery_finish', finish), /Cannot verify/);
+  await f.call('delivery_check', { id: 'all' });
+  await f.call('delivery_finish', finish);
+  assert.equal(f.entries.at(-1).data.status, 'verified');
+  // Undeclared file changes must invalidate evidence, not only artifact roots.
+  writeFileSync(join(f.cwd, 'new_config.json'), '{}');
+  await assert.rejects(f.call('delivery_finish', finish), /stale checks/);
+});
+test('terminal deliveries stop context reminders and repair turns across restore', options, async t => {
+  for (const status of ['verified', 'blocked']) {
+    const f = fixture(t);
+    await f.call('delivery_plan', f.plan);
+    assert.match(f.hooks.context({ messages: [] }).messages.at(-1).content, /Inspect freshness before execution/);
+    await f.call('delivery_check', { id: 'all' });
+    await f.call('delivery_finish', { status, review: 'Reviewed', launch: 'python app.py', limitations: status === 'blocked' ? ['External prerequisite unavailable'] : [] });
+    for (const restore of [false, true]) {
+      if (restore) f.hooks.session_start({}, f.ctx);
+      assert.equal(f.hooks.context({ messages: [] }), undefined);
+      f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+      assert.equal(f.messages.length, 0);
+    }
+    await f.call('delivery_plan', f.plan);
+    assert.match(f.hooks.context({ messages: [] }).messages.at(-1).content, /Inspect freshness before execution/);
+  }
+});
+
+test('session restoration adopts a newer same-run dashboard report without reviving repairs', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  const disk = structuredClone(f.entries.at(-1).data);
+  disk.status = 'blocked';
+  const path = join(f.cwd, '.harness', 'integration-session', disk.runId, 'report.json');
+  saveReport(path, disk);
+  f.hooks.session_start({}, f.ctx);
+  assert.match((await f.call('delivery_status')).content[0].text, /blocked/);
+  f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+  assert.equal(f.messages.length, 0);
+  await f.call('delivery_finish', { status: 'blocked', review: 'Restored', launch: 'none', limitations: ['fixture'] });
+  assert.ok(f.entries.at(-1).data.storageVersion > disk.storageVersion);
+});
+
+test('fresh passing evidence advertises delivery_finish and repeated unchanged status polling is blocked', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  const checked = JSON.parse((await f.call('delivery_check', { id: 'all' })).content[0].text);
+  assert.equal(checked.readyToFinish, true);
+  assert.match(checked.next, /delivery_finish/);
+
+  const status = JSON.parse((await f.call('delivery_status')).content[0].text);
+  assert.equal(status.status, 'verifying', 'explicit finish is still required');
+  assert.deepEqual(status.pendingChecks, []);
+  assert.equal(status.readyToFinish, true);
+  assert.match(status.next, /Do not call delivery_status again/);
+
+  for (let i = 0; i < 3; i++) {
+    assert.equal(f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx), undefined);
+  }
+  const blocked = f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx);
+  assert.equal(blocked.block, true);
+  assert.match(blocked.reason, /Repeated unchanged delivery_status/);
+  assert.equal(f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx).block, true, 'blocked retries stay blocked');
+  const workspaceChange = join(f.cwd, 'workspace-change.txt');
+  writeFileSync(workspaceChange, 'changed');
+  assert.equal(f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx), undefined, 'workspace changes permit a fresh read');
+  rmSync(workspaceChange);
+
+  // A productive delivery action resets the guard; explicit finish remains the
+  // only transition to verified.
+  assert.equal(f.hooks.tool_call({ toolName: 'delivery_finish' }, f.ctx), undefined);
+  await f.call('delivery_finish', { status: 'verified', review: 'Reviewed fresh evidence.', launch: 'python app.py', limitations: [] });
+  assert.equal(f.entries.at(-1).data.status, 'verified');
+});
+
+test('real extension serializes sibling checks without tool errors', options, async t => {
+  const f = fixture(t);
+  f.plan.checks.push({ ...f.plan.checks[0], id: 'second' });
+  await f.call('delivery_plan', f.plan);
+  await Promise.all([f.call('delivery_check', { id: 'run' }), f.call('delivery_check', { id: 'second' })]);
+  assert.ok(f.entries.at(-1).data.evidence.run.passed);
+  assert.ok(f.entries.at(-1).data.evidence.second.passed);
+});
+test('compaction context survives restore, branching clears stale contracts', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  f.hooks.session_start({}, f.ctx);
+  const context = f.hooks.context({ messages: [] });
+  assert.match(context.messages[0].content, /Working script/);
+  f.entries.length = 0;
+  f.hooks.session_tree({}, f.ctx);
+  assert.match((await f.call('delivery_status')).content[0].text, /No delivery contract/);
+});
+test('context archives only after approval, large captures stay retrievable, compaction cannot unlock stale source', async t => {
+  const f = fixture(t, { approve: false });
+  const plan = { ...f.plan, design: fixtureDesign(f.plan) };
+  plan.design.scenarios[0].assertion = 'Exact assertion '.repeat(6000);
+  await f.call('delivery_plan', plan);
+  await f.call('delivery_design', { action: 'validate' });
+  const inspected = await f.call('delivery_design', { action: 'inspect' });
+  const view = JSON.parse(inspected.content[0].text);
+  assert.ok(view.captureArchive.path);
+  const capture = JSON.parse(readFileSync(view.captureArchive.path));
+  assert.equal(capture.plan.design.scenarios[0].assertion, plan.design.scenarios[0].assertion);
+  assert.equal(inspected.details.deliveryCapture.id, capture.id);
+  await f.call('delivery_design', { action: 'review', review: { ...fixtureReview(plan), captureId: capture.id } });
+  await f.call('delivery_design', { action: 'approve' });
+  const status = JSON.parse((await f.call('delivery_status')).content[0].text);
+  assert.equal(status.plan, undefined); assert.equal(status.planning.history, undefined);
+  assert.deepEqual(status.acceptance, plan.acceptance);
+  f.hooks.before_provider_request({ payload: { messages: [{ role: 'user', content: 'PRIVATE_TEXT' }] } });
+  const log = readFileSync(join(f.cwd, '.harness', 'integration-session', capture.runId, 'context-metrics.jsonl'), 'utf8');
+  assert.doesNotMatch(log, /PRIVATE_TEXT/);
+  writeFileSync(join(f.cwd, 'app.py'), 'print(2)');
+  f.hooks.session_compact({}, f.ctx);
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx).block, true);
+  const recovered = f.hooks.context({ messages: [{ role: 'user', content: 'Summary says approved' }] }, f.ctx);
+  assert.match(recovered.messages.at(-1).content, /grants no authority/);
+  assert.match(recovered.messages.map(m => m.content).join('\n'), /Runs/);
+});
+test('agent_end queues at most two repairs and does not revive cancelled work', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  const event = reason => ({ messages: [{ role: 'assistant', stopReason: reason }] });
+  f.hooks.agent_end(event('aborted'), f.ctx);
+  assert.equal(f.messages.length, 0);
+  f.hooks.agent_end(event('stop'), f.ctx);
+  f.hooks.agent_end(event('stop'), f.ctx);
+  f.hooks.agent_end(event('stop'), f.ctx);
+  assert.equal(f.messages.length, 2);
+  await f.call('delivery_finish', { status: 'blocked', review: 'Environment unavailable', launch: 'python app.py', limitations: ['No renderer available'] });
+  f.hooks.input({ source: 'interactive' });
+  f.hooks.agent_end(event('stop'), f.ctx);
+  assert.equal(f.messages.length, 2);
+});
+test('repair nudges quote the failing check, its exit code and its output tail', options, async t => {
+  const f = fixture(t);
+  f.plan.checks[0].argv = [process.execPath, '-e', 'console.log("probe detail: only 2 sampled colors"); process.exit(9)'];
+  await f.call('delivery_plan', f.plan);
+  await assert.rejects(f.call('delivery_check', { id: 'run' }), /"code": 9/);
+  // The failing check's evidence carries a persisted output tail for status/compaction.
+  const state = f.entries.at(-1).data;
+  assert.equal(state.evidence.run.passed, false);
+  assert.match(state.evidence.run.outputTail, /probe detail: only 2 sampled colors/);
+  f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+  assert.equal(f.messages.length, 1);
+  const content = f.messages[0].content;
+  assert.match(content, /check run failed \(exit 9, timedOut false\)/);
+  assert.match(content, /probe detail: only 2 sampled colors/);
+  assert.match(content, /pending checks: run/);
+  // Compaction context keeps only a short tail, not the full 1200-character evidence copy.
+  const context = f.hooks.context({ messages: [] });
+  assert.match(context.messages.at(-1).content, /"passed":false/);
+  assert.ok(context.messages.at(-1).content.length < 4000);
+});
+test('bash timeout cap bounds runaway shell commands when configured', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  // Disabled by default: un-timed commands stay un-timed.
+  const runaway = { toolName: 'bash', input: { command: 'find / -name verify_ursina.py' } };
+  f.hooks.tool_call(runaway, f.ctx);
+  assert.equal(runaway.input.timeout, undefined);
+  // Enabled: caps missing and oversized timeouts, preserves tighter explicit ones.
+  f.flags['delivery-bash-cap'] = 120;
+  f.hooks.tool_call(runaway, f.ctx);
+  assert.equal(runaway.input.timeout, 120);
+  const tight = { toolName: 'bash', input: { command: 'ls', timeout: 10 } };
+  f.hooks.tool_call(tight, f.ctx);
+  assert.equal(tight.input.timeout, 10);
+  const over = { toolName: 'powershell', input: { command: 'x', timeout: 9999 } };
+  f.hooks.tool_call(over, f.ctx);
+  assert.equal(over.input.timeout, 120);
+  // Non-shell tools and blocked-write gating are untouched.
+  const read = { toolName: 'read', input: { path: 'app.py' } };
+  f.hooks.tool_call(read);
+  assert.equal(read.input.timeout, undefined);
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }).block, true);
+});
+test('edit calls normalize a JSON-encoded edits array', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  const event = {
+    toolName: 'edit',
+    input: {
+      path: 'app.py',
+      edits: JSON.stringify([{ oldText: 'print(1)', newText: 'print(2)' }]),
+    },
+  };
+  assert.equal(f.hooks.tool_call(event, f.ctx), undefined);
+  assert.deepEqual(event.input.edits, [{ oldText: 'print(1)', newText: 'print(2)' }]);
+});
+test('bash cap blocks process-wide termination but allows targeted child cleanup', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  f.flags['delivery-bash-cap'] = 120;
+  for (const command of [
+    'pkill -f python',
+    'killall node',
+    'kill -9 -1',
+    'kill 0',
+    'taskkill /IM python.exe /F',
+    'Stop-Process -Name python',
+    'Get-Process | Stop-Process',
+  ]) {
+    const broadKill = { toolName: 'bash', input: { command } };
+    assert.match(
+      f.hooks.tool_call(broadKill, f.ctx).reason,
+      /Broad process termination/
+    );
+  }
+
+  const targetedKill = {
+    toolName: 'bash',
+    input: { command: 'kill "$child_pid"' }
+  };
+  assert.equal(f.hooks.tool_call(targetedKill, f.ctx), undefined);
+  assert.equal(targetedKill.input.timeout, 120);
+});
+test('bounded runs cap whole-file rewrites per path and pace tool loops', options, async t => {
+  const f = fixture(t);
+  f.flags['delivery-strict'] = false;
+  f.flags['delivery-rewrite-cap'] = 2;
+  await f.call('delivery_plan', f.plan);
+  const write = path => f.hooks.tool_call({ toolName: 'write', input: { path } }, f.ctx);
+  f.flags['delivery-protect-existing'] = true;
+  f.hooks.session_start({}, f.ctx);
+  assert.match(write('app.py').reason, /Preserve the existing app.py implementation/);
+  assert.equal(f.hooks.tool_call({ toolName: 'edit', input: { path: 'app.py' } }, f.ctx), undefined);
+  assert.match(
+    f.hooks.tool_call(
+      { toolName: 'bash', input: { command: `cat > "${join(f.cwd, 'app.py')}" <<'EOF'\nprint(2)\nEOF` } },
+      f.ctx,
+    ).reason,
+    /Shell redirection cannot replace/,
+  );
+  assert.match(
+    f.hooks.tool_call(
+      { toolName: 'bash', input: { command: "python - <<'PY'\nwith open('app.py', 'w') as f:\n f.write('print(2)')\nPY" } },
+      f.ctx,
+    ).reason,
+    /script cannot replace/,
+  );
+  assert.match(
+    f.hooks.tool_call(
+      { toolName: 'bash', input: { command: `mv /tmp/replacement.py "${join(f.cwd, 'app.py')}"` } },
+      f.ctx,
+    ).reason,
+    /cannot remove or replace/,
+  );
+  f.flags['delivery-protect-existing'] = false;
+  f.hooks.session_start({}, f.ctx);
+  assert.equal(write('app.py'), undefined);
+  assert.equal(write('app.py'), undefined);
+  assert.match(write('app.py').reason, /Full-file rewrite limit reached/);
+  assert.equal(write('README.md'), undefined);
+  assert.equal(f.hooks.tool_call({ toolName: 'edit', input: { path: 'app.py' } }, f.ctx), undefined);
+  assert.match(
+    f.hooks.tool_call(
+      { toolName: 'write', input: { path: f.cwd.replace(/^\/+/, '') + '/nested.py' } },
+      f.ctx,
+    ).reason,
+    /recreates the working directory/,
+  );
+  assert.match(
+    f.hooks.tool_call(
+      { toolName: 'write', input: { path: `${f.cwd.split('/').at(-1)}/nested.py` } },
+      f.ctx,
+    ).reason,
+    /recreates the working directory/,
+  );
+
+  f.flags['delivery-turn-delay-ms'] = 20;
+  const started = Date.now();
+  await f.hooks.tool_result({ toolName: 'read', isError: false });
+  assert.ok(Date.now() - started >= 15);
+
+  f.flags['delivery-turn-delay-ms'] = 10;
+  const scaled = Date.now();
+  await f.hooks.tool_result(
+    { toolName: 'read', isError: false },
+    { getContextUsage: () => ({ tokens: 100001 }) },
+  );
+  assert.ok(Date.now() - scaled >= 25);
+
+  f.flags['delivery-turn-delay-ms'] = 0;
+  f.flags['delivery-tool-output-cap'] = 100;
+  const bounded = await f.hooks.tool_result({
+    toolName: 'bash',
+    isError: false,
+    content: [{ type: 'text', text: `${'head'.repeat(30)}${'tail'.repeat(30)}` }],
+  });
+  assert.equal(bounded.content[0].text.length, 100);
+  assert.match(bounded.content[0].text, /characters omitted/);
+  assert.match(bounded.content[0].text, /^head/);
+  assert.match(bounded.content[0].text, /tail$/);
+});
+test('optional delivery context is explicit and task agnostic', options, t => {
+  const f = fixture(t);
+  writeFileSync(join(f.cwd, 'quality-context.md'), 'Require evidence from the public user path.');
+  f.flags['delivery-context'] = 'quality-context.md';
+  f.hooks.session_start({}, f.ctx);
+  const context = f.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'Build a voxel game' });
+  assert.match(context.systemPrompt, /Require evidence from the public user path/);
+  assert.doesNotMatch(context.systemPrompt, /camera.ui_lens.set_film_size/);
+  assert.match(context.systemPrompt, /Preserve every user requirement/);
+});
+test('failed infrastructure probes append diagnostics while preserving original output', async t => {
+  const f = fixture(t);
+  const event = { toolName: 'bash', content: [{ type: 'text', text: 'Cannot find module tsx; exit code: 1' }] };
+  assert.equal(await f.hooks.tool_result(event, f.ctx), undefined);
+  const result = await f.hooks.tool_result(event, f.ctx);
+  assert.equal(result.content[0].text, event.content[0].text);
+  assert.match(result.content[1].text, /Diagnostic checkpoint/);
+  assert.equal(f.entries.length, 0);
+});
+test('standard mode accepts compact contracts and bounded discovery probe', async t => {
+  const f = fixture(t, { approve: false }); f.flags['delivery-workflow'] = 'standard';
+  const result = await f.call('delivery_plan', f.plan);
+  assert.match(result.content[0].text, /Implement now/);
+  assert.equal(f.hooks.tool_call({ toolName: 'write', input: { path: 'new.py' } }, f.ctx), undefined);
+  const probe = JSON.parse((await f.call('delivery_probe', { kind: 'node-version' })).content[0].text);
+  assert.equal(probe.code, 0); assert.equal(probe.evidence, false);
+  await assert.rejects(f.call('delivery_probe', { kind: 'shell' }), /Unknown discovery/);
+  await f.call('delivery_check', { id: 'all' });
+  await assert.rejects(f.call('delivery_finish', { status: 'verified', review: 'done', launch: 'n/a', limitations: [] }), /Review:/);
+});
+test('resumed runs keep their planned workflow guidance regardless of the launch flag', async t => {
+  const f = fixture(t, { approve: false });
+  await f.call('delivery_plan', f.plan);
+  assert.equal(f.entries.at(-1).data.workflowMode, 'strict');
+  f.flags['delivery-workflow'] = 'standard';
+  f.hooks.session_start({}, f.ctx);
+  const resumed = f.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'continue the implementation' }, f.ctx).systemPrompt;
+  assert.doesNotMatch(resumed, /Standard delivery:/);
+  assert.match(f.hooks.tool_call({ toolName: 'write', input: { path: 'app.py' } }, f.ctx).reason, /approve/);
+  const g = fixture(t, { approve: false }); g.flags['delivery-workflow'] = 'standard';
+  await g.call('delivery_plan', g.plan);
+  g.flags['delivery-workflow'] = 'strict';
+  g.hooks.session_start({}, g.ctx);
+  assert.match(g.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'continue the implementation' }, g.ctx).systemPrompt, /Standard delivery:/);
+});
+test('required validators cannot be omitted or replaced by model plans', options, async t => {
+  const f = fixture(t);
+  const manifest = join(f.cwd, 'validators.json');
+  writeFileSync(manifest, JSON.stringify({ version: 1, checks: [{ id: 'oracle', kind: 'test', argv: [process.execPath, '-e', 'process.exit(9)'], timeoutSeconds: 5 }] }));
+  f.flags['delivery-validators'] = manifest;
+  f.hooks.session_start({}, f.ctx);
+  await f.call('delivery_plan', f.plan);
+  const state = f.entries.at(-1).data;
+  assert.ok(state.plan.checks.some(c => c.id === 'required_oracle'));
+  await f.call('delivery_check', { id: 'run' });
+  await assert.rejects(f.call('delivery_finish', { status: 'verified', review: 'All good', launch: 'python app.py', limitations: [] }), /required_oracle/);
+  await assert.rejects(f.call('delivery_check', { id: 'all' }), /"code": 9/);
+  f.plan.checks.push({ id: 'required_oracle', kind: 'runtime', argv: [process.execPath, '-e', 'process.exit(0)'], timeoutSeconds: 5 });
+  await f.call('delivery_plan', f.plan);
+  assert.match(f.entries.at(-1).data.plan.checks.find(c => c.id === 'required_oracle').argv[2], /exit\(9\)/);
+});
+test('invalid required manifest fails closed', options, async t => {
+  const f = fixture(t);
+  f.flags['delivery-validators'] = join(f.cwd, 'missing.json');
+  f.hooks.session_start({}, f.ctx);
+  await assert.rejects(f.call('delivery_plan', f.plan), /Invalid required validators/);
+});
+test('source mutation by a verifier is recorded as failed evidence', options, async t => {
+  const f = fixture(t);
+  f.plan.checks[0].argv = [process.execPath, '-e', 'require("node:fs").writeFileSync("app.py", "changed")'];
+  await f.call('delivery_plan', f.plan);
+  await assert.rejects(f.call('delivery_check', { id: 'run' }), /changedDuringCheck/);
+  assert.equal(f.entries.at(-1).data.evidence.run.passed, false);
+});
+test('request guidance is injected behind the scenes and survives follow-ups', options, async t => {
+  const f = fixture(t);
+  writeFileSync(join(f.cwd, 'package.json'), JSON.stringify({ dependencies: { next: '15.1.7' } }));
+  const prompt = 'Add authenticated trades and a portfolio time series chart backed by a third-party API';
+  const started = f.hooks.before_agent_start({ systemPrompt: 'base', prompt }, f.ctx);
+  for (const id of ['web-application', 'authenticated-web', 'transactional-data', 'external-api', 'data-visualization']) assert.match(started.systemPrompt, new RegExp(`\\[${id}\\]`));
+  await f.call('delivery_plan', f.plan);
+  const state = f.entries.at(-1).data;
+  // Persisted only for internal continuity across resumes and follow-up prompts.
+  assert.deepEqual(state.guidanceProfiles, ['web-application', 'authenticated-web', 'transactional-data', 'external-api', 'data-visualization']);
+  assert.equal(state.plan.guidanceProfiles, undefined);
+  assert.doesNotMatch(readFileSync(join(f.cwd, '.harness', 'integration-session', state.runId, 'plan.d2'), 'utf8'), /guidance/i);
+  const followUp = f.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'Fix that failure' }, f.ctx);
+  assert.match(followUp.systemPrompt, /\[transactional-data\]/);
+  assert.match(followUp.systemPrompt, /\[data-visualization\]/);
+});
+
+test('blocked delivery succeeds and finishes cleanly even when evidence scope limit is exceeded', options, async t => {
+  const f = fixture(t);
+  const oldEnv = process.env.CARTHAGENT_MAX_FILES;
+  t.after(() => {
+    if (oldEnv === undefined) delete process.env.CARTHAGENT_MAX_FILES;
+    else process.env.CARTHAGENT_MAX_FILES = oldEnv;
+  });
+
+  // Create plan
+  await f.call('delivery_plan', f.plan);
+
+  // Set tight file limit (1 file) and add a second file
+  process.env.CARTHAGENT_MAX_FILES = '1';
+  writeFileSync(join(f.cwd, 'extra.txt'), 'extra');
+
+  // delivery_status tolerates scope limit
+  const status = await f.call('delivery_status');
+  assert.match(status.content[0].text, /scope error/);
+
+  // delivery_check reports scope error with guidance
+  await assert.rejects(
+    f.call('delivery_check', { id: 'run' }),
+    /Evidence scope exceeds/
+  );
+
+  // delivery_finish with status='verified' must still fail
+  await assert.rejects(
+    f.call('delivery_finish', {
+      status: 'verified',
+      review: 'Trying to verify despite scope limits',
+      launch: 'python app.py',
+      limitations: [],
+    }),
+    /Evidence scope exceeds/
+  );
+
+  // delivery_finish with status='blocked' must SUCCEED without looping or throwing
+  const finishBlocked = await f.call('delivery_finish', {
+    status: 'blocked',
+    review: 'Repository exceeds evidence scope limit; cannot run fingerprint',
+    launch: 'python app.py',
+    limitations: ['Repository exceeds maximum file count limit for automated checks.'],
+  });
+  assert.equal(finishBlocked.content[0].type, 'text');
+  const lastEntry = f.entries.at(-1).data;
+  assert.equal(lastEntry.status, 'blocked');
+  assert.equal(lastEntry.handoff.fingerprint, 'unfingerprinted:scope_exceeded');
+
+  // agent_end should NOT trigger follow-up nudges since status is blocked
+  f.messages.length = 0;
+  f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+  assert.equal(f.messages.length, 0);
+});
+
+test('informational receipts get a classification hint, build tasks do not', options, t => {
+  const f = fixture(t);
+  const question = f.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'what does app.py do?' }, f.ctx);
+  assert.match(question.systemPrompt, /Receipt check/);
+  assert.match(question.systemPrompt, /verification:"none"/);
+  const build = f.hooks.before_agent_start({ systemPrompt: 'base', prompt: 'build a task cli with tests' }, f.ctx);
+  assert.doesNotMatch(build.systemPrompt, /Receipt check/);
+});
+
+test('verification:none plan finishes cleanly with no checks and no repair nudges', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', { ...f.plan, verification: 'none', checks: [], acceptance: [] });
+  assert.equal(f.entries.at(-1).data.plan.verification, 'none');
+  // delivery_check explains the route to finish instead of erroring into a loop.
+  const noChecks = await f.call('delivery_check', { id: 'all' });
+  assert.match(noChecks.content[0].text, /no checks to run/);
+  const finish = { status: 'verified', review: 'Answered the question from source.', launch: 'n/a', limitations: [] };
+  await f.call('delivery_finish', finish);
+  const handoff = f.entries.at(-1).data.handoff;
+  assert.equal(handoff.status, 'verified');
+  assert.equal(handoff.verification, 'none');
+  assert.equal(handoff.advisory, true);
+  // Unlike a required verified run with a stale fingerprint, informative plans are terminal.
+  f.messages.length = 0;
+  f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+  assert.equal(f.messages.length, 0);
+});
+
+test('advisory commands cannot bypass approval; informational finish remains available', options, async t => {
+  const f = fixture(t);
+  const failing = { ...f.plan, verification: 'advisory' };
+  failing.checks = [{ ...f.plan.checks[0], argv: [process.execPath, '-e', 'console.log("advisory context"); process.exit(4)'] }];
+  await f.call('delivery_plan', failing);
+  await assert.rejects(f.call('delivery_check', { id: 'all' }), /Implementation locked/);
+  assert.deepEqual(f.entries.at(-1).data.evidence, {});
+  // Advisory classification cannot authorize arbitrary process execution.
+  await f.call('delivery_finish', { status: 'verified', review: 'Reported the measured failure as context.', launch: 'n/a', limitations: ['advisory check failed by design'] });
+  const handoff = f.entries.at(-1).data.handoff;
+  assert.equal(handoff.advisory, true);
+  assert.equal(handoff.verification, 'advisory');
+  f.messages.length = 0;
+  f.hooks.agent_end({ messages: [{ role: 'assistant', stopReason: 'stop' }] }, f.ctx);
+  assert.equal(f.messages.length, 0);
+});
+
+test('pre-verify reclassification is refused once evidence exists', options, async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  // No evidence yet: the pre-verify re-check may downgrade to informational.
+  await f.call('delivery_plan', { ...f.plan, verification: 'none', checks: [], acceptance: [] });
+  assert.equal(f.entries.at(-1).data.plan.verification, 'none');
+  await f.call('delivery_plan', f.plan);
+  await f.call('delivery_check', { id: 'run' });
+  await assert.rejects(
+    f.call('delivery_plan', { ...f.plan, verification: 'none', checks: [], acceptance: [] }),
+    /Cannot downgrade verification after checks have run/,
+  );
+});
+
+test('required validators force verification:required on an informational plan', options, async t => {
+  const f = fixture(t);
+  const manifest = join(f.cwd, 'validators.json');
+  writeFileSync(manifest, JSON.stringify({ version: 1, checks: [{ id: 'oracle', kind: 'test', argv: [process.execPath, '-e', 'process.exit(0)'], timeoutSeconds: 5 }] }));
+  f.flags['delivery-validators'] = manifest;
+  f.hooks.session_start({}, f.ctx);
+  await f.call('delivery_plan', { ...f.plan, verification: 'none', checks: [], acceptance: [] });
+  const state = f.entries.at(-1).data;
+  assert.equal(state.plan.verification, 'required');
+  assert.ok(state.plan.checks.some(c => c.id === 'required_oracle'));
+});
+
+
+test('session budget survives replan, input and branch restoration; only command resets', options, async t => {
+  const f = fixture(t);
+  f.flags['delivery-max-tools'] = '2';
+  f.hooks.agent_start({}, f.ctx);
+  await f.call('delivery_plan', f.plan);
+  assert.equal(f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx), undefined);
+  await f.call('delivery_plan', f.plan);
+  f.hooks.input({ source: 'user' });
+  f.hooks.session_tree({}, f.ctx);
+  assert.equal(f.hooks.tool_call({ toolName: 'delivery_status' }, f.ctx), undefined);
+  assert.equal(f.hooks.tool_call({ toolName: 'read' }, f.ctx).block, true);
+  f.hooks.agent_end({ messages: [] }, f.ctx);
+  assert.equal(f.messages.length, 1);
+  const stop = JSON.parse(f.messages[0].content);
+  assert.equal(stop.reason, 'tool-calls');
+  assert.deepEqual(stop.requirements, f.plan.acceptance);
+  assert.ok(f.ctx.aborted > 0);
+  f.commands['delivery-budget-reset'].handler('', f.ctx);
+  assert.equal(f.hooks.tool_call({ toolName: 'read' }, f.ctx), undefined);
+});
+
+test('elapsed budget aborts an active turn without a tool and stays stopped on restore', options, async t => {
+  const f = fixture(t);
+  f.flags['delivery-max-seconds'] = '1';
+  f.hooks.agent_start({}, f.ctx);
+  await new Promise(resolve => setTimeout(resolve, 1150));
+  assert.equal(f.ctx.aborted, 1);
+  assert.equal(JSON.parse(f.messages[0].content).reason, 'elapsed-time');
+  f.hooks.session_start({}, f.ctx);
+  f.hooks.agent_start({}, f.ctx);
+  assert.equal(f.messages.length, 1);
+  assert.equal(f.ctx.aborted, 2);
+  f.hooks.session_shutdown();
+});
+
+test('repair allowance persists across user follow-ups and stops automatic continuation', options, async t => {
+  const f = fixture(t);
+  f.flags['delivery-max-repairs'] = '1';
+  await f.call('delivery_plan', f.plan);
+  const event = { messages: [{ role: 'assistant', stopReason: 'stop' }] };
+  f.hooks.agent_end(event, f.ctx);
+  assert.equal(f.messages.length, 1);
+  f.hooks.input({ source: 'user' });
+  f.hooks.session_start({}, f.ctx);
+  f.hooks.agent_end(event, f.ctx);
+  assert.equal(f.messages.length, 2);
+  assert.equal(JSON.parse(f.messages[1].content).reason, 'repair-rounds');
+});
+
+test('revision tool preserves evidence, progress and discoveries across restore and compaction', async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  await f.call('delivery_progress', { step: 0, status: 'done' });
+  await f.call('delivery_check', { id: 'all' });
+  const original = structuredClone(f.entries.at(-1).data);
+  await f.call('delivery_revise', { reason: 'Discovered a second caller during repository inspection', patch: {
+    steps: ['Inspect second caller', ...f.plan.steps], assumptions: ['Keep the old caller compatible'],
+  } });
+  const revised = f.entries.at(-1).data;
+  assert.equal(revised.runId, original.runId);
+  assert.equal(revised.revision, original.revision + 1);
+  assert.equal(revised.evidence.run.revision, revised.revision);
+  assert.equal(revised.evidence.run.logPath, original.evidence.run.logPath);
+  assert.equal(revised.stepStatus.step1, 'done');
+  f.hooks.session_start({}, f.ctx);
+  const context = f.hooks.context({ messages: [] }).messages.map(m => m.content).join('\n');
+  assert.match(context, /Keep the old caller compatible/);
+  assert.match(context, /Discovered a second caller/);
+  assert.match(context, /"step1":"done"/);
+  const status = JSON.parse((await f.call('delivery_status')).content[0].text);
+  assert.deepEqual(status.pendingChecks, []);
+  assert.equal(status.revisions, undefined, 'full snapshots stay in report, not status context');
+  assert.equal(status.revisionHistory.length, 1);
+  writeFileSync(join(f.cwd, 'app.py'), 'print(2)');
+  await f.call('delivery_revise', { reason: 'Implementation changed', patch: { goal: f.plan.goal } });
+  assert.deepEqual(JSON.parse((await f.call('delivery_status')).content[0].text).pendingChecks, ['run']);
+});
+
+test('repeated full plans cannot erase verification history to allow downgrades', async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  await f.call('delivery_check', { id: 'all' });
+  const changed = structuredClone(f.plan);
+  changed.checks[0].timeoutSeconds = 6;
+  await f.call('delivery_plan', changed);
+  assert.deepEqual(f.entries.at(-1).data.evidence, {});
+  await assert.rejects(f.call('delivery_plan', { ...f.plan, verification: 'none', acceptance: [], checks: [] }), /Cannot downgrade/);
+  await f.call('delivery_finish', { status: 'blocked', review: 'Need external decision', launch: 'n/a', limitations: ['Missing decision'] });
+  await assert.rejects(f.call('delivery_revise', { reason: 'Resume without tests', patch: { verification: 'none', acceptance: [], checks: [] } }), /Cannot downgrade/);
+});
+
+test('structured steps and promised outputs are enforced consistently by status and finish', async t => {
+  const f = fixture(t);
+  f.plan.steps = [
+    { id: 'build', title: 'Implement', checks: ['run'] },
+    { id: 'review', title: 'Review compatibility', dependsOn: ['build'] },
+  ];
+  f.plan.outputs = ['artifacts/report.json'];
+  await f.call('delivery_plan', f.plan);
+  await assert.rejects(f.call('delivery_progress', { step: 'review', status: 'active' }), /dependencies/);
+  const checked = JSON.parse((await f.call('delivery_check', { id: 'all' })).content[0].text);
+  assert.equal(checked.readyToFinish, false);
+  const finish = { status: 'verified', review: 'Reviewed', launch: 'n/a', limitations: [] };
+  await assert.rejects(f.call('delivery_finish', finish), /Incomplete steps/);
+  await f.call('delivery_progress', { step: 'build', status: 'done' });
+  await f.call('delivery_progress', { step: 'review', status: 'done' });
+  await assert.rejects(f.call('delivery_finish', finish), /Missing outputs: artifacts\/report.json/);
+  const { mkdirSync } = await import('node:fs');
+  mkdirSync(join(f.cwd, 'artifacts'));
+  writeFileSync(join(f.cwd, 'artifacts', 'report.json'), '{}');
+  await assert.rejects(f.call('delivery_finish', finish), /delivery_review/);
+  const capture = JSON.parse((await f.call('delivery_review', { action: 'inspect' })).content[0].text);
+  await f.call('delivery_review', { action: 'record', captureId: capture.id, coverage: [{ requirement: 'Runs', assertions: 'runtime command exits zero' }], probes: ['node runtime probe returned passed'], findings: [], limitations: ['No Git baseline in this fixture'] });
+  assert.equal(JSON.parse((await f.call('delivery_status')).content[0].text).readyToFinish, true);
+  await f.call('delivery_finish', finish);
+});
+
+test('review acceptance gaps persist through session restore and cannot be relabeled as limitations', async t => {
+  const f = fixture(t);
+  await f.call('delivery_plan', f.plan);
+  await f.call('delivery_check', { id: 'all' });
+  const capture = JSON.parse((await f.call('delivery_review', { action: 'inspect' })).content[0].text);
+  const review = { action: 'record', captureId: capture.id, coverage: [{ requirement: 'Runs', assertions: 'Only component behavior checked', status: 'unverified' }], probes: ['component check exited zero'], findings: [], limitations: [] };
+  const result = JSON.parse((await f.call('delivery_review', review)).content[0].text);
+  assert.equal(result.recorded, false);
+  assert.equal(f.entries.at(-1).data.reviewFindings.length, 1);
+  await f.hooks.session_start({}, f.ctx);
+  review.coverage[0] = { requirement: 'Runs', assertions: 'component check exited zero' };
+  review.limitations = ['No integration test'];
+  assert.equal(JSON.parse((await f.call('delivery_review', review)).content[0].text).recorded, false);
+  await assert.rejects(f.call('delivery_finish', { status: 'verified', review: 'done', launch: 'n/a', limitations: review.limitations }), /Unresolved review finding/);
+  const resolved = await f.call('delivery_review', { ...review, resolutions: [{ id: result.unresolvedFindings[0].id, change: 'Checked actual entrypoint', evidence: 'Entrypoint executes and returns expected output' }] });
+  assert.equal(JSON.parse(resolved.content[0].text).recorded, true);
+  await f.call('delivery_finish', { status: 'verified', review: 'entrypoint checked', launch: 'n/a', limitations: [] });
+});
+
+test('all checks collects failures and independent successes rather than stopping at first failure', async t => {
+  const f = fixture(t);
+  f.plan.checks = [
+    { ...f.plan.checks[0], argv: [process.execPath, '-e', 'console.log("first failure"); process.exit(7)'] },
+    { ...f.plan.checks[0], id: 'second' },
+    { ...f.plan.checks[0], id: 'third', argv: [process.execPath, '-e', 'process.exit(9)'] },
+  ];
+  await f.call('delivery_plan', f.plan);
+  await assert.rejects(f.call('delivery_check', { id: 'all' }), /All requested checks ran/);
+  const evidence = f.entries.at(-1).data.evidence;
+  assert.equal(evidence.run.code, 7);
+  assert.equal(evidence.second.passed, true);
+  assert.equal(evidence.third.code, 9);
+});
+
+test('revision respects workspace supersession and user-owned validators', async t => {
+  const f = fixture(t);
+  const manifest = join(f.cwd, 'validators.json');
+  writeFileSync(manifest, JSON.stringify({ version: 1, checks: [{ id: 'oracle', kind: 'test', argv: [process.execPath, '-e', 'process.exit(9)'], timeoutSeconds: 5 }] }));
+  f.flags['delivery-validators'] = manifest;
+  f.hooks.session_start({}, f.ctx);
+  await f.call('delivery_plan', f.plan);
+  await f.call('delivery_revise', { reason: 'Try overriding validator', patch: { checks: [...f.plan.checks, { ...f.plan.checks[0], id: 'required_oracle' }] } });
+  assert.match(f.entries.at(-1).data.plan.checks.find(c => c.id === 'required_oracle').argv[2], /exit\(9\)/);
+  const other = createReport(f.cwd, { status: 'implementing', plan: f.plan, evidence: {} });
+  selectReport(f.cwd, other.path);
+  await assert.rejects(f.call('delivery_revise', { reason: 'Stale writer', patch: { goal: 'Changed' } }), /superseded/);
+});
+
+test('budget status command reports remaining allowance without consuming tools', options, t => {
+  const f = fixture(t);
+  f.flags['delivery-max-tools'] = '2';
+  f.hooks.agent_start({}, f.ctx);
+  f.hooks.tool_call({ toolName: 'read' }, f.ctx);
+  f.commands['delivery-budget-status'].handler('', f.ctx);
+  const status = JSON.parse(f.messages.at(-1).content);
+  assert.equal(status.tools, 1);
+  assert.equal(status.remaining.tools, 1);
+  assert.equal(status.reason, null);
+});
+
+
+test('unapproved tasks fail closed for shell, custom tools, tests and disabled legacy strict flag', async t => {
+  const f = fixture(t, { approve: false });
+  f.flags['delivery-strict'] = false;
+  for (const toolName of ['write', 'edit', 'bash', 'powershell', 'custom_runner', 'delivery_check', 'delivery_progress']) {
+    assert.equal(f.hooks.tool_call({ toolName, input: { command: 'ls' } }, f.ctx).block, true);
+  }
+  for (const toolName of ['read', 'ls', 'find', 'grep', 'delivery_plan']) assert.equal(f.hooks.tool_call({ toolName }, f.ctx), undefined);
+  await f.call('delivery_plan', { ...f.plan, design: fixtureDesign(f.plan) });
+  await assert.rejects(f.call('delivery_check', { id: 'all' }), /Implementation locked/);
+  await f.call('delivery_design', { action: 'validate' });
+  await f.call('delivery_design', { action: 'review', review: await f.inspectReview() });
+  await f.call('delivery_design', { action: 'approve' });
+  f.hooks.session_start({}, f.ctx);
+  writeFileSync(join(f.cwd, 'app.py'), 'changed before first mutation');
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx).block, true);
+  await f.call('delivery_design', { action: 'validate' });
+  await f.call('delivery_design', { action: 'review', review: await f.inspectReview() });
+  await f.call('delivery_design', { action: 'approve' });
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx), undefined);
+  await f.call('delivery_revise', { reason: 'New assumption', patch: { assumptions: ['Retain compatibility'] } });
+  assert.equal(f.hooks.tool_call({ toolName: 'write' }, f.ctx).block, true);
+});