chainlesschain 0.166.42 → 0.166.43

package/src/commands/evolution-deployment.js

@@ -0,0 +1,95 @@
+import chalk from "chalk";
+import { logger } from "../lib/logger.js";
+import {
+  configureEvolutionDeployment,
+  getEvolutionDeploymentStatus,
+  setEvolutionDeploymentEnabled,
+} from "../lib/evolution/evolution-deployment-config.js";
+
+function printStatus(status) {
+  logger.log(chalk.bold("Governed Skill evolution deployment"));
+  logger.log(
+    `  Effective:       ${status.effectiveEnabled ? "enabled" : "disabled"}`,
+  );
+  logger.log(`  Source:          ${status.source}`);
+  logger.log(
+    `  Signature:       ${status.verified ? "verified" : "not verified"}`,
+  );
+  logger.log(`  Auto promotion:  HOLD (manual review required)`);
+  logger.log(`  Profile:         ${status.profilePath}`);
+  if (status.descriptorPath)
+    logger.log(`  Descriptor:      ${status.descriptorPath}`);
+  if (status.trustRootPath)
+    logger.log(`  Trust root:      ${status.trustRootPath}`);
+  if (status.commands?.length)
+    logger.log(`  Commands:        ${status.commands.join(", ")}`);
+  if (status.error) logger.log(chalk.red(`  Error:           ${status.error}`));
+}
+
+function output(status, json) {
+  if (json) console.log(JSON.stringify(status, null, 2));
+  else printStatus(status);
+}
+
+function fail(error, json) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (json) console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+  else logger.error(`Failed: ${message}`);
+  process.exitCode = 1;
+}
+
+export function registerEvolutionDeploymentCommands(parent) {
+  const deployment = parent
+    .command("deployment")
+    .description("Configure the signed governed Skill evolution deployment");
+
+  deployment
+    .command("status")
+    .description("Show the effective deployment and signature status")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        output(await getEvolutionDeploymentStatus(), options.json);
+      } catch (error) {
+        fail(error, options.json);
+      }
+    });
+
+  deployment
+    .command("configure")
+    .description("Verify, save, and enable a signed deployment")
+    .requiredOption("--descriptor <path>", "Absolute signed descriptor path")
+    .requiredOption("--trust-root <path>", "Absolute Ed25519 public key path")
+    .option("--disabled", "Save without enabling")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        output(
+          await configureEvolutionDeployment({
+            descriptorPath: options.descriptor,
+            trustRootPath: options.trustRoot,
+            enabled: options.disabled !== true,
+          }),
+          options.json,
+        );
+      } catch (error) {
+        fail(error, options.json);
+      }
+    });
+
+  for (const enabled of [true, false]) {
+    deployment
+      .command(enabled ? "enable" : "disable")
+      .description(
+        `${enabled ? "Enable" : "Disable"} the saved deployment profile`,
+      )
+      .option("--json", "Output as JSON")
+      .action(async (options) => {
+        try {
+          output(await setEvolutionDeploymentEnabled(enabled), options.json);
+        } catch (error) {
+          fail(error, options.json);
+        }
+      });
+  }
+}

package/src/commands/evolution.js

@@ -14,6 +14,7 @@ import { registerEvolutionWorkbenchCommands } from "./evolution-workbench.js";
 import { registerEvolutionAttestorTrustCommands } from "./evolution-attestor-trust.js";
 import { registerGovernedKnowledgeCommands } from "./evolution-knowledge.js";
 import { registerWikiSkillBenchmarkCommands } from "./evolution-benchmark.js";
+import { registerEvolutionDeploymentCommands } from "./evolution-deployment.js";
 import {
   assessCapability,
   recordIncrementalModelMetrics,
@@ -56,6 +57,7 @@ export function registerEvolutionCommand(program, dependencies = {}) {
   registerEvolutionAttestorTrustCommands(evolution, dependencies);
   registerGovernedKnowledgeCommands(evolution, dependencies);
   registerWikiSkillBenchmarkCommands(evolution, dependencies);
+  registerEvolutionDeploymentCommands(evolution);
 
   // evolution assess <name> <score>
   evolution

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.43",
+      "cliVersions": ["0.166.43"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.43: configure governed Skill evolution",
+          "body": "- Add a persistent, fail-closed deployment profile for signed governed-evolution\n  descriptors and Ed25519 trust roots. Environment overrides remain available\n  for centrally managed installations.\n- Add `cc evolution deployment status/configure/enable/disable` so administrators\n  can verify and control the deployment without maintaining process environment\n  variables.\n- Expose the same bounded configuration through authenticated App Server topics\n  for `cc ui`; automatic promotion remains `HOLD` and review/release authority\n  stays in the signed deployment host.\n- Document defaults, triggers, review flow, storage locations, and the visual\n  configuration entry points used by both IDE plugins and `cc ui`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.42",

package/src/gateways/ws/evolution-deployment-topic-handlers.js

@@ -0,0 +1,53 @@
+import {
+  configureEvolutionDeployment,
+  getEvolutionDeploymentStatus,
+  setEvolutionDeploymentEnabled,
+} from "../../lib/evolution/evolution-deployment-config.js";
+
+function assertSecureControl(context) {
+  const server = context?.server;
+  const loopback = new Set(["127.0.0.1", "localhost", "::1"]);
+  if (!server?.token && !loopback.has(server?.host)) {
+    throw new Error(
+      "Skill evolution configuration requires a token-protected or loopback-only cc ui",
+    );
+  }
+}
+
+function requiredPath(value, name) {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > 4096 ||
+    /[\r\n\0]/u.test(value)
+  ) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+
+export function createEvolutionDeploymentTopicHandlers(options = {}) {
+  const getStatus = options.getStatus || getEvolutionDeploymentStatus;
+  const configure = options.configure || configureEvolutionDeployment;
+  const setEnabled = options.setEnabled || setEvolutionDeploymentEnabled;
+  return {
+    "evolution.deployment.status": async (_frame, context) => {
+      assertSecureControl(context);
+      return getStatus();
+    },
+    "evolution.deployment.configure": async (frame, context) => {
+      assertSecureControl(context);
+      return configure({
+        descriptorPath: requiredPath(frame?.descriptorPath, "descriptorPath"),
+        trustRootPath: requiredPath(frame?.trustRootPath, "trustRootPath"),
+        enabled: true,
+      });
+    },
+    "evolution.deployment.set-enabled": async (frame, context) => {
+      assertSecureControl(context);
+      if (typeof frame?.enabled !== "boolean")
+        throw new Error("enabled must be a boolean");
+      return setEnabled(frame.enabled);
+    },
+  };
+}

package/src/lib/evolution/evolution-deployment-config.js

@@ -0,0 +1,81 @@
+import {
+  readEvolutionDeploymentProfile,
+  setEvolutionDeploymentProfileEnabled,
+  writeEvolutionDeploymentProfile,
+} from "./evolution-deployment-profile.js";
+import { verifyEvolutionDeployment } from "./evolution-deployment-loader.js";
+
+function environmentSelection(env) {
+  const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
+  const trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  if (!descriptorPath && !trustRootPath) return null;
+  return { descriptorPath, trustRootPath };
+}
+
+export async function getEvolutionDeploymentStatus(options = {}) {
+  const env = options.env || process.env;
+  const saved = await readEvolutionDeploymentProfile(options);
+  const fromEnvironment = environmentSelection(env);
+  const source = fromEnvironment
+    ? "environment"
+    : saved.profile?.enabled
+      ? "profile"
+      : "none";
+  const selected =
+    fromEnvironment || (saved.profile?.enabled ? saved.profile : null);
+  const base = {
+    source,
+    effectiveEnabled: source !== "none",
+    profileEnabled: saved.profile?.enabled === true,
+    profilePath: saved.filePath,
+    descriptorPath:
+      selected?.descriptorPath || saved.profile?.descriptorPath || null,
+    trustRootPath:
+      selected?.trustRootPath || saved.profile?.trustRootPath || null,
+    verified: false,
+    error: saved.error,
+    autoPromotion: "hold",
+  };
+  if (!selected || saved.error) return Object.freeze(base);
+  try {
+    const verified = await verifyEvolutionDeployment(selected, options);
+    return Object.freeze({
+      ...base,
+      verified: true,
+      error: null,
+      revision: verified.descriptor.revision,
+      modulePath: verified.modulePath,
+      moduleDigest: verified.descriptor.moduleDigest,
+      commands: verified.descriptor.commands,
+    });
+  } catch (error) {
+    return Object.freeze({
+      ...base,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export async function configureEvolutionDeployment(
+  { descriptorPath, trustRootPath, enabled = true },
+  options = {},
+) {
+  const verified = await verifyEvolutionDeployment(
+    { descriptorPath, trustRootPath },
+    options,
+  );
+  await writeEvolutionDeploymentProfile(
+    {
+      enabled: enabled === true,
+      descriptorPath: verified.descriptorPath,
+      trustRootPath: verified.trustRootPath,
+    },
+    options,
+  );
+  return getEvolutionDeploymentStatus(options);
+}
+
+export async function setEvolutionDeploymentEnabled(enabled, options = {}) {
+  await setEvolutionDeploymentProfileEnabled(enabled, options);
+  return getEvolutionDeploymentStatus(options);
+}

package/src/lib/evolution/evolution-deployment-loader.js

@@ -2,6 +2,7 @@ import { createHash, createPublicKey, verify } from "node:crypto";
 import { readFile, realpath } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import { types as utilTypes } from "node:util";
+import { readEvolutionDeploymentProfile } from "./evolution-deployment-profile.js";
 
 export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA =
   "chainlesschain.evolution-deployment-descriptor/v1";
@@ -223,7 +224,9 @@ async function loadBuiltInFactories(commandName) {
       import("./evolution-eval-process-supervisor.js"),
       import("./governed-skill-synthesis-attestor-trust-approval-client.js"),
       import("./governed-skill-synthesis-attestor-trust-operations-client.js"),
-      import("./governed-skill-synthesis-attestor-trust-operations-cli-host.js"),
+      import(
+        "./governed-skill-synthesis-attestor-trust-operations-cli-host.js"
+      ),
     ]);
     factories.createEvolutionWorkbenchCliHost = createEvolutionWorkbenchCliHost;
     factories.createEvolutionWorkbenchReviewRuntime =
@@ -350,8 +353,9 @@ async function loadBuiltInFactories(commandName) {
     commandName === "stream" ||
     commandName === "ui"
   ) {
-    const { createAgentEvolutionRuntimeComposition } =
-      await import("./agent-evolution-runtime-composition.js");
+    const { createAgentEvolutionRuntimeComposition } = await import(
+      "./agent-evolution-runtime-composition.js"
+    );
     factories.createAgentEvolutionRuntimeComposition =
       createAgentEvolutionRuntimeComposition;
   }
@@ -414,20 +418,14 @@ function bindFactoriesToModule(factories, moduleDigest) {
   return Object.freeze(result);
 }
 
-export async function loadEvolutionDeploymentCommandDependencies(
-  commandName,
+export async function verifyEvolutionDeployment(
+  { descriptorPath, trustRootPath },
   {
-    env = process.env,
     read = readFile,
     resolveRealPath = realpath,
-    importModule = (url) => import(url),
-    additionalFactories = {},
+    includeModuleBytes = false,
   } = {},
 ) {
-  if (!SUPPORTED_COMMANDS.has(commandName)) return null;
-  const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
-  const trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
-  if (!descriptorPath && !trustRootPath) return null;
   if (!descriptorPath || !trustRootPath)
     throw new Error(
       "evolution deployment requires both descriptor and trust root",
@@ -458,7 +456,6 @@ export async function loadEvolutionDeploymentCommandDependencies(
     )
   )
     throw new Error("evolution deployment descriptor signature rejected");
-  if (!descriptor.commands.includes(commandName)) return null;
 
   const modulePath = await resolveRealPath(descriptor.modulePath);
   const moduleBytes = await read(modulePath);
@@ -466,6 +463,58 @@ export async function loadEvolutionDeploymentCommandDependencies(
     throw new Error("evolution deployment module size is invalid");
   if (sha256(moduleBytes) !== descriptor.moduleDigest)
     throw new Error("evolution deployment module digest mismatch");
+  return Object.freeze({
+    descriptor,
+    descriptorPath: await resolveRealPath(descriptorPath),
+    trustRootPath: await resolveRealPath(trustRootPath),
+    modulePath,
+    ...(includeModuleBytes ? { moduleBytes } : {}),
+  });
+}
+
+export async function loadEvolutionDeploymentCommandDependencies(
+  commandName,
+  {
+    env = process.env,
+    read = readFile,
+    resolveRealPath = realpath,
+    importModule = (url) => import(url),
+    additionalFactories = {},
+  } = {},
+) {
+  if (!SUPPORTED_COMMANDS.has(commandName)) return null;
+  let descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
+  let trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  let fromSavedProfile = false;
+  if (!descriptorPath && !trustRootPath) {
+    const saved = await readEvolutionDeploymentProfile({ env });
+    if (!saved.error && saved.profile?.enabled) {
+      descriptorPath = saved.profile.descriptorPath;
+      trustRootPath = saved.profile.trustRootPath;
+      fromSavedProfile = true;
+    }
+  }
+  if (!descriptorPath && !trustRootPath) return null;
+  if (!descriptorPath || !trustRootPath)
+    throw new Error(
+      "evolution deployment requires both descriptor and trust root",
+    );
+  let verified;
+  try {
+    verified = await verifyEvolutionDeployment(
+      { descriptorPath, trustRootPath },
+      { read, resolveRealPath, includeModuleBytes: true },
+    );
+  } catch (error) {
+    // A saved profile may become stale after files are moved or rotated. Keep
+    // governed capabilities fail-closed while allowing `deployment status`,
+    // `configure`, and `disable` to start so the operator can recover. Explicit
+    // environment overrides remain strict and surface the error immediately.
+    if (fromSavedProfile) return null;
+    throw error;
+  }
+  const { descriptor, moduleBytes } = verified;
+  if (!descriptor.commands.includes(commandName)) return null;
   // Import the exact bytes that were authenticated. Importing modulePath here
   // would reopen a pathname-replacement window between hashing and execution.
   // Deployment entrypoints are therefore single-file ESM bundles; any external

package/src/lib/evolution/evolution-deployment-profile.js

@@ -0,0 +1,114 @@
+import { randomUUID } from "node:crypto";
+import { readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import { resolveConfigDataRoot } from "../paths.js";
+import {
+  PRIVATE_FILE_MODE,
+  ensurePrivateDirectory,
+  ensurePrivateFile,
+} from "../secure-fs.js";
+
+export const EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
+  "chainlesschain.evolution-deployment-profile/v1";
+
+export function getEvolutionDeploymentProfilePath({
+  env = process.env,
+  cwd = process.cwd(),
+} = {}) {
+  return join(
+    resolveConfigDataRoot({ env, cwd }).path,
+    "evolution",
+    "deployment-profile.json",
+  );
+}
+
+function normalizeProfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError("evolution deployment profile must be an object");
+  const keys = Object.keys(value).sort();
+  const expected = ["descriptorPath", "enabled", "schema", "trustRootPath"];
+  if (JSON.stringify(keys) !== JSON.stringify(expected.sort()))
+    throw new TypeError("evolution deployment profile has unexpected fields");
+  if (value.schema !== EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA)
+    throw new TypeError("evolution deployment profile schema is invalid");
+  if (typeof value.enabled !== "boolean")
+    throw new TypeError("evolution deployment profile enabled is invalid");
+  for (const [name, path] of [
+    ["descriptorPath", value.descriptorPath],
+    ["trustRootPath", value.trustRootPath],
+  ]) {
+    if (typeof path !== "string" || !isAbsolute(path))
+      throw new TypeError(
+        `evolution deployment profile ${name} must be absolute`,
+      );
+  }
+  return Object.freeze({
+    schema: value.schema,
+    enabled: value.enabled,
+    descriptorPath: value.descriptorPath,
+    trustRootPath: value.trustRootPath,
+  });
+}
+
+export async function readEvolutionDeploymentProfile(options = {}) {
+  const filePath =
+    options.filePath || getEvolutionDeploymentProfilePath(options);
+  try {
+    const profile = normalizeProfile(
+      JSON.parse(await readFile(filePath, "utf8")),
+    );
+    return Object.freeze({ filePath, profile, error: null });
+  } catch (error) {
+    if (error?.code === "ENOENT")
+      return Object.freeze({ filePath, profile: null, error: null });
+    return Object.freeze({
+      filePath,
+      profile: null,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export async function writeEvolutionDeploymentProfile(input, options = {}) {
+  const profile = normalizeProfile({
+    schema: EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
+    enabled: input?.enabled === true,
+    descriptorPath: input?.descriptorPath,
+    trustRootPath: input?.trustRootPath,
+  });
+  const filePath =
+    options.filePath || getEvolutionDeploymentProfilePath(options);
+  ensurePrivateDirectory(dirname(filePath));
+  const temporaryPath = join(
+    dirname(filePath),
+    `.deployment-profile.${randomUUID()}.tmp`,
+  );
+  try {
+    await writeFile(temporaryPath, `${JSON.stringify(profile, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: PRIVATE_FILE_MODE,
+      flag: "wx",
+    });
+    ensurePrivateFile(temporaryPath);
+    await rename(temporaryPath, filePath);
+    ensurePrivateFile(filePath);
+  } catch (error) {
+    await unlink(temporaryPath).catch(() => {});
+    throw error;
+  }
+  return Object.freeze({ filePath, profile });
+}
+
+export async function setEvolutionDeploymentProfileEnabled(
+  enabled,
+  options = {},
+) {
+  const current = await readEvolutionDeploymentProfile(options);
+  if (current.error) throw new Error(current.error);
+  if (!current.profile)
+    throw new Error("evolution deployment profile is not configured");
+  return writeEvolutionDeploymentProfile(
+    { ...current.profile, enabled: enabled === true },
+    { ...options, filePath: current.filePath },
+  );
+}

package/src/lib/public-ide-capability-manifest.js

@@ -61,6 +61,7 @@ const VSCODE_COMMANDS = [
   "chainlesschain.plugins.manage",
   "chainlesschain.skills.retrieve",
   "chainlesschain.evolution.workbench",
+  "chainlesschain.evolution.configure",
   "chainlesschain.worktree.tasks",
   "chainlesschain.chrome.connector",
   "chainlesschain.artifacts.show",
@@ -118,6 +119,7 @@ const JETBRAINS_ACTIONS = [
   "chainlesschain.plugins.Manage",
   "chainlesschain.skills.Retrieve",
   "chainlesschain.evolution.Workbench",
+  "chainlesschain.evolution.Configure",
   "chainlesschain.worktree.Tasks",
   "chainlesschain.chrome.Connector",
   "chainlesschain.workspace.ScanAutoExec",

package/src/lib/read-file-loop-guard.js

@@ -75,7 +75,7 @@ export class ReadFileLoopGuard {
       if (
         targeted &&
         !entry.rereads.has(fingerprint) &&
-        entry.rereads.size < 128
+        entry.rereads.size < 3
       ) {
         entry.rereads.add(fingerprint);
         page.readRecovery = { action: "targeted-review" };
@@ -161,8 +161,6 @@ export class ReadFileLoopGuard {
       return;
     if (tool === "read_file") {
       if (result?.readProgress?.newContent === true) this.batch.advanced = true;
-      if (result?.readRecovery?.action === "targeted-review")
-        this.batch.advanced = true;
       if (result?.readProgress?.newContent === false) this.batch.duplicates++;
     } else if (
       (tool === "run_code" || tool === "run_shell") &&
@@ -207,9 +205,24 @@ export class ReadFileLoopGuard {
     );
   }
 
+  get hasRecoveryReads() {
+    return (
+      this.hasUnreadPages ||
+      [...this.progress.values()].some((entry) => entry.rereads.size < 3)
+    );
+  }
+
   canContinue(filePath, args = {}) {
+    const entry = this.progress.get(keyFor(filePath, args));
     return (
-      this.progress.get(keyFor(filePath, args))?.summary?.reachedEnd === false
+      entry?.summary?.reachedEnd === false ||
+      (!!entry &&
+        entry.rereads.size < 3 &&
+        Number.isSafeInteger(args.offset) &&
+        args.offset > 0 &&
+        Number.isSafeInteger(args.limit) &&
+        args.limit > 0 &&
+        args.limit <= 80)
     );
   }
 

package/src/lib/remote-read-loop-guard.js

@@ -429,9 +429,22 @@ export class RemoteReadLoopGuard {
     this.offeredRevision = this.revision;
     const entry = this.targets.get(this.activeKey);
     entry.recoveryOffered = true;
+    // Keep the shell available for local reproduction and validation. Only
+    // repeated reads of the stalled remote target are narrowed below.
+    if (entry.tool === "run_shell" && entry.github) return [];
     return [entry.tool];
   }
 
+  shouldPause(tool, args = {}) {
+    const target = remoteReadTarget(tool, args);
+    const entry = target && this.targets.get(target.key);
+    return !!(
+      entry?.github &&
+      entry.recoveryOffered &&
+      entry.repeats >= RECOVERY_AFTER
+    );
+  }
+
   get workflowHint() {
     const active = this.targets.get(this.activeKey);
     if (active?.github && !active.pullRequest) {

package/src/lib/task-progress-tracker.js

@@ -81,6 +81,7 @@ export class TaskProgressTracker {
     this.childFindings = new Map();
     this.lastActions = [];
     this.remoteInspections = [];
+    this.localFindings = [];
   }
 
   retainChildResult(id, result, owner = "root") {
@@ -120,6 +121,32 @@ export class TaskProgressTracker {
         typeof args.old_string === "string" &&
         args.old_string === args.new_string);
 
+    if (!failed && (tool === "search_files" || tool === "read_file")) {
+      const evidence = result.content ?? result.matches ?? result.output;
+      const excerpt = boundedText(
+        typeof evidence === "string" ? evidence : JSON.stringify(evidence),
+        1000,
+      );
+      if (excerpt) {
+        const entry = {
+          owner,
+          tool,
+          path: boundedText(args.path || result.path, 320),
+          query: boundedText(args.pattern, 200),
+          range: result.range,
+          excerpt,
+        };
+        const owned = [
+          ...this.localFindings.filter((item) => item.owner === owner),
+          entry,
+        ].slice(-4);
+        this.localFindings = [
+          ...this.localFindings.filter((item) => item.owner !== owner),
+          ...owned,
+        ].slice(-MAX_CHECKPOINT_OWNERS * 4);
+      }
+    }
+
     if (tool === "spawn_sub_agent")
       this.retainChildResult(result?.subAgentId, result, owner);
     if (tool === "todo_write" && !failed && Array.isArray(args.todos)) {
@@ -224,6 +251,7 @@ export class TaskProgressTracker {
       guidance:
         message +
         " For an implementation task, make the smallest justified, authorized change and validate it. " +
+        "For a bug fix, state the observed failure, your leading root-cause hypothesis and the smallest test that can disprove it. Run that focused reproduction or diagnostic next; use its actual output to choose the next step. Do not keep reading adjacent files without naming the specific missing fact. A timeout alone does not establish that increasing the timeout is the fix. " +
         "For research/review, synthesize evidence-backed findings; do not write files merely to clear this warning. " +
         "If evidence is insufficient, name the exact missing fact and use a focused search or bounded computation. " +
         "Do not restart general investigation, rewrite the plan, or delegate the same research. " +
@@ -239,11 +267,15 @@ export class TaskProgressTracker {
       !this.plans.size &&
       !this.childFindings.size &&
       !this.lastActions.length &&
-      !this.remoteInspections.length
+      !this.remoteInspections.length &&
+      !this.localFindings.length
     )
       return null;
     const checkpoint = {
       bounded: true,
+      recentLocalFindings: this.localFindings
+        .filter((entry) => entry.owner === owner)
+        .map(({ owner: _owner, ...entry }) => entry),
       recentToolOutcomes: this.lastActions
         .filter((entry) => entry.owner === owner)
         .map(({ tool, path, output }) => ({ tool, path, output })),
@@ -265,6 +297,7 @@ export class TaskProgressTracker {
     // Only counters are inherited across isolated child contracts. Source
     // material belongs to the loop that observed it or received the child result.
     if (
+      !checkpoint.recentLocalFindings.length &&
       !checkpoint.recentToolOutcomes.length &&
       !checkpoint.recentRemoteInspections.length &&
       !checkpoint.reportedPlans.length &&
@@ -275,6 +308,8 @@ export class TaskProgressTracker {
       if (checkpoint.reportedPlans.length > 1) checkpoint.reportedPlans.pop();
       else if (checkpoint.childFindings.length)
         checkpoint.childFindings.shift();
+      else if (checkpoint.recentLocalFindings.length)
+        checkpoint.recentLocalFindings.shift();
       else if (checkpoint.recentRemoteInspections.length)
         checkpoint.recentRemoteInspections.shift();
       else if (checkpoint.recentToolOutcomes.length)