codex-orchestrator 2.0.10 → 2.0.12

package/dist/src/v2/run-store.js

@@ -1,78 +1,103 @@
+import { validateActiveAttempt } from './active-attempt.js';
 import { validateDirectReview } from './direct-delivery.js';
-import { validateSpecDelivery } from './spec-delivery.js';
-import { validateRouteExecution, validateRouteReceipt, validateRouteStateInvariant, } from './route-decision.js';
-import { validateWaitingHumanExecution } from './waiting-human.js';
+import { validateDeliveryAuthority } from './delivery-authority.js';
+import { constants } from 'node:fs';
 import { posix } from 'node:path';
+import { open } from 'node:fs/promises';
 import { AtomicStateFile } from './atomic-store.js';
-import { createReviewFeedbackBootstrap, validateImplementationInvocation, validateReviewFeedbackExecution, } from './review-feedback.js';
+import { canonicalJson, sha256 } from './containment.js';
+import { validateCandidateBinding, validateCandidateMaterialization } from './candidate.js';
+import { validateReviewFeedbackRunData, } from './review-feedback.js';
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const GIT_SHA_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 const UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function createPendingEffect(effect) {
+    return { ...structuredClone(effect), effectId: sha256(canonicalJson(effect)) };
+}
 export class WorkflowGenerationUnrecoverableError extends Error {
     constructor() {
         super('workflow-generation-unrecoverable');
         this.name = 'WorkflowGenerationUnrecoverableError';
     }
 }
-export class RouteInitializationUnrecoverableError extends Error {
+export class IssueInitializationUnrecoverableError extends Error {
     constructor() {
-        super('route-initialization-unrecoverable');
-        this.name = 'RouteInitializationUnrecoverableError';
+        super('issue-initialization-unrecoverable');
+        this.name = 'IssueInitializationUnrecoverableError';
     }
 }
 export class FileRunRecordWriter {
     file;
+    maxBytes;
     constructor(path, options = {}) {
         this.file = new AtomicStateFile(path, validateRunStateFile, options);
+        this.maxBytes = options.maxBytes ?? 1024 * 1024;
+    }
+    async inspect() {
+        const bytes = await readOptionalStateFile(this.file.path);
+        if (!bytes)
+            return { status: 'absent', rawSha256: null };
+        const rawSha256 = sha256(bytes);
+        if (bytes.length > this.maxBytes)
+            return { status: 'unsupported', rawSha256 };
+        try {
+            return { status: 'supported', rawSha256, state: parseRawState(bytes) };
+        }
+        catch {
+            return { status: 'unsupported', rawSha256 };
+        }
     }
     async read() {
-        return await this.file.read() ?? emptyRunState();
+        const inspection = await this.inspect();
+        if (inspection.status === 'absent')
+            return emptyRunState();
+        if (inspection.status === 'supported')
+            return inspection.state;
+        throw new Error('run state schema is unsupported');
     }
     async compareAndSwap(expectedGeneration, next) {
         validateRunStateBody(next);
-        return this.file.compareAndSwap(expectedGeneration, { ...structuredClone(next), generation: expectedGeneration + 1 });
+        const candidate = { ...structuredClone(next), generation: expectedGeneration + 1 };
+        return this.file.compareAndSwap(expectedGeneration, candidate);
     }
 }
 export class InMemoryRunRecordWriter {
-    state = emptyRunState();
+    state;
+    async inspect() {
+        if (!this.state)
+            return { status: 'absent', rawSha256: null };
+        const state = structuredClone(this.state);
+        return {
+            status: 'supported',
+            rawSha256: sha256(`${canonicalJson(state)}\n`),
+            state,
+        };
+    }
     async read() {
-        return structuredClone(this.state);
+        return structuredClone(this.state ?? emptyRunState());
     }
     async compareAndSwap(expectedGeneration, next) {
-        if (this.state.generation !== expectedGeneration)
+        if ((this.state?.generation ?? 0) !== expectedGeneration)
             throw new Error('run state generation conflict');
+        validateRunStateBody(next);
         const value = validateRunStateFile({ ...structuredClone(next), generation: expectedGeneration + 1 });
         this.state = value;
         return structuredClone(value);
     }
 }
 export function validateRunStateFile(value) {
-    assertExactObject(value, ['schema', 'version', 'generation', 'runs'], 'run state');
-    if (value.schema !== 'codex-orchestrator.agent-auto-state' || (value.version !== 1 && value.version !== 2))
-        throw new Error('run state schema/version is invalid');
+    assertExactObject(value, ['schema', 'generation', 'runs'], 'run state');
+    if (value.schema !== 'codex-orchestrator.run-state')
+        throw new Error('run state schema is invalid');
     if (!Number.isSafeInteger(value.generation) || value.generation <= 0)
         throw new Error('run state generation is invalid');
     validateRuns(value.runs);
-    if (value.version === 1) {
-        for (const run of value.runs) {
-            if (hasOwn(run, 'reviewFeedback'))
-                throw new Error('V1 run state cannot contain review feedback');
-        }
-        return {
-            schema: 'codex-orchestrator.agent-auto-state',
-            version: 2,
-            generation: value.generation,
-            runs: value.runs.map((run) => run.lifecycle === 'review-ready'
-                ? { ...structuredClone(run), reviewFeedback: createReviewFeedbackBootstrap() }
-                : structuredClone(run)),
-        };
-    }
     return value;
 }
 function validateRunStateBody(value) {
-    assertExactObject(value, ['schema', 'version', 'runs'], 'run state body');
-    if (value.schema !== 'codex-orchestrator.agent-auto-state' || value.version !== 2)
-        throw new Error('run state schema/version is invalid');
+    assertExactObject(value, ['schema', 'runs'], 'run state body');
+    if (value.schema !== 'codex-orchestrator.run-state')
+        throw new Error('run state schema is invalid');
     validateRuns(value.runs);
 }
 function validateRuns(value) {
@@ -88,21 +113,20 @@ function validateRuns(value) {
 }
 function validateRunRecord(value, field) {
     const optional = [
-        'process',
+        'activeAttempt',
         'checkedChangeSha256',
         'proofId',
+        'proofExecution',
         'proofReceipt',
-        'intent',
+        'pendingEffect',
         'outcomeEvidenceId',
         'terminalOutcome',
-        'routeExecution',
-        'routeReceipt',
-        'waitingHuman',
+        'deliveryAuthority',
         'directReview',
-        'specDelivery',
         'reviewFeedback',
-        'checkQualification',
-        'baselineChecks',
+        'changeBindingVersion',
+        'candidateBinding',
+        'candidateMaterialization',
     ].filter((key) => hasOwn(value, key));
     assertExactObject(value, [
         'runId', 'issueNumber', 'canonicalRepository', 'baseSha', 'branchName', 'worktreePath', 'lifecycle', 'cycle',
@@ -122,11 +146,11 @@ function validateRunRecord(value, field) {
     }
     if (!isLifecycle(value.lifecycle))
         throw new Error(`${field}.lifecycle is invalid`);
-    if (!Number.isSafeInteger(value.cycle) || value.cycle < 1 || value.cycle > 5)
+    if (!Number.isSafeInteger(value.cycle) || value.cycle < 1)
         throw new Error(`${field}.cycle is invalid`);
-    if (value.reportRepairs !== 0 && value.reportRepairs !== 1)
+    if (!Number.isSafeInteger(value.reportRepairs) || value.reportRepairs < 0)
         throw new Error(`${field}.reportRepairs is invalid`);
-    if (value.transportRetries !== 0 && value.transportRetries !== 1)
+    if (!Number.isSafeInteger(value.transportRetries) || value.transportRetries < 0)
         throw new Error(`${field}.transportRetries is invalid`);
     validateIssueSnapshot(value.issueSnapshot, `${field}.issueSnapshot`);
     validateFrozenCriteria(value.frozenCriteria, `${field}.frozenCriteria`);
@@ -137,80 +161,91 @@ function validateRunRecord(value, field) {
     if (workflowGeneration.packageVersion !== value.packageVersion) {
         throw new Error(`${field}.workflowGeneration package version mismatch`);
     }
-    const routeGenerationHash = workflowGeneration.generationHash;
-    if (hasOwn(value, 'routeExecution'))
-        validateRouteExecution(value.routeExecution, routeGenerationHash);
-    if (hasOwn(value, 'routeReceipt'))
-        validateRouteReceipt(value.routeReceipt, routeGenerationHash);
+    if (hasOwn(value, 'deliveryAuthority')) {
+        validateDeliveryAuthority(value.deliveryAuthority, {
+            issueNumber: value.issueSnapshot.number,
+            issueUrl: value.issueSnapshot.url,
+            title: value.issueSnapshot.title,
+            body: value.issueSnapshot.body,
+            authorizationLabel: value.deliveryAuthority.authorizationLabel,
+        });
+    }
+    if (['implementing', 'checking', 'proving', 'reviewing', 'publishing', 'review-ready'].includes(value.lifecycle)
+        && !hasOwn(value, 'deliveryAuthority')) {
+        throw new Error(`${field}.deliveryAuthority is required for delivery progression`);
+    }
     validateStringShaRecord(value.skillHashes, `${field}.skillHashes`);
-    if (hasOwn(value, 'baselineChecks'))
-        validateChecks(value.baselineChecks, `${field}.baselineChecks`, false);
     validateChecks(value.checks, `${field}.checks`);
-    if (hasOwn(value, 'process'))
-        validateProcess(value.process, `${field}.process`);
+    if (hasOwn(value, 'activeAttempt')) {
+        const attempt = validateActiveAttempt(value.activeAttempt);
+        if (attempt.runId !== value.runId)
+            throw new Error(`${field}.activeAttempt run identity is invalid`);
+    }
     if (hasOwn(value, 'checkedChangeSha256'))
         assertSha256(value.checkedChangeSha256, `${field}.checkedChangeSha256`);
     if (hasOwn(value, 'proofId'))
         assertNonEmptyString(value.proofId, `${field}.proofId`);
+    if (hasOwn(value, 'proofExecution'))
+        validateProofExecution(value.proofExecution, `${field}.proofExecution`);
     if (hasOwn(value, 'proofReceipt'))
         validateReceipt(value.proofReceipt, `${field}.proofReceipt`);
-    if (hasOwn(value, 'intent'))
-        validateIntent(value.intent, `${field}.intent`);
+    if (hasOwn(value, 'pendingEffect'))
+        validatePendingEffect(value.pendingEffect, `${field}.pendingEffect`);
     if (hasOwn(value, 'outcomeEvidenceId'))
         assertNonEmptyString(value.outcomeEvidenceId, `${field}.outcomeEvidenceId`);
     if (hasOwn(value, 'terminalOutcome'))
         validateTerminalOutcome(value.terminalOutcome, `${field}.terminalOutcome`);
-    if (hasOwn(value, 'waitingHuman')) {
-        if (!routeGenerationHash)
-            throw new WorkflowGenerationUnrecoverableError();
-        validateWaitingHumanExecution(value.waitingHuman, {
-            runId: value.runId,
-            lifecycle: value.lifecycle,
-            workflowGenerationHash: routeGenerationHash,
-            routeReceipt: hasOwn(value, 'routeReceipt') ? value.routeReceipt : undefined,
-            terminalOutcome: hasOwn(value, 'terminalOutcome') ? value.terminalOutcome : undefined,
-        });
-    }
     if (hasOwn(value, 'directReview')) {
-        if (!hasOwn(value, 'routeReceipt') || value.routeReceipt.route !== 'direct') {
-            throw new Error(`${field}.directReview requires a direct route`);
-        }
-        const rawProcess = hasOwn(value, 'process') && hasOwn(value.process, 'purpose')
-            ? value.process
-            : undefined;
-        const process = rawProcess && !['spec-author', 'spec-review'].includes(rawProcess.purpose)
-            ? {
-                purpose: rawProcess.purpose,
-                resumeLifecycle: rawProcess.resumeLifecycle,
-                resumeReviewStage: rawProcess.resumeReviewStage,
-            }
-            : undefined;
+        if (!hasOwn(value, 'deliveryAuthority'))
+            throw new Error(`${field}.directReview requires delivery authority`);
         validateDirectReview(value.directReview, {
             lifecycle: value.lifecycle,
             ...(hasOwn(value, 'terminalOutcome') ? { terminalOutcome: directTerminalOutcome(value.terminalOutcome) } : {}),
-            ...(process ? { process: {
-                    purpose: process.purpose,
-                    resumeLifecycle: process.resumeLifecycle,
-                    resumeReviewStage: process.resumeReviewStage,
-                } } : {}),
+            ...(hasOwn(value, 'terminalOutcome') && value.terminalOutcome.status === 'internal-error'
+                ? { terminalCode: value.terminalOutcome.code }
+                : {}),
         });
     }
-    if (hasOwn(value, 'specDelivery')) {
-        if (!hasOwn(value, 'routeReceipt') || value.routeReceipt.route !== 'spec-required') {
-            throw new Error(`${field}.specDelivery requires a spec-required route`);
+    if (hasOwn(value, 'reviewFeedback')) {
+        validateReviewFeedbackRunData(value.reviewFeedback);
+        validateReviewFeedbackRunInvariant(value, field);
+    }
+    if (hasOwn(value, 'changeBindingVersion') && value.changeBindingVersion !== 2)
+        throw new Error(`${field}.changeBindingVersion is invalid`);
+    if (hasOwn(value, 'candidateBinding'))
+        validateCandidateBinding(value.candidateBinding, `${field}.candidateBinding`, value.runId);
+    if (hasOwn(value, 'candidateMaterialization'))
+        validateCandidateMaterialization(value.candidateMaterialization, `${field}.candidateMaterialization`);
+    if (hasOwn(value, 'candidateBinding') !== hasOwn(value, 'changeBindingVersion'))
+        throw new Error(`${field} candidate binding version is incomplete`);
+    if (hasOwn(value, 'candidateMaterialization')) {
+        if (!hasOwn(value, 'candidateBinding'))
+            throw new Error(`${field}.candidateMaterialization requires candidate binding`);
+        const binding = value.candidateBinding;
+        const materialization = value.candidateMaterialization;
+        if (materialization.bindingId !== binding.bindingId || materialization.candidateCommitSha !== binding.candidateCommitSha) {
+            throw new Error(`${field}.candidateMaterialization binding is invalid`);
         }
-        const spec = validateSpecDelivery(value.specDelivery);
-        if (spec.issueNumber !== value.issueNumber || spec.runId !== value.runId
-            || spec.workflowGenerationSha256 !== routeGenerationHash) {
-            throw new Error(`${field}.specDelivery identity binding is invalid`);
+    }
+    if (hasOwn(value, 'pendingEffect') && hasOwn(value.pendingEffect, 'candidateRef')) {
+        if (!hasOwn(value, 'candidateBinding'))
+            throw new Error(`${field}.pendingEffect candidate ref requires candidate binding`);
+        const binding = value.candidateBinding;
+        const pendingEffect = value.pendingEffect;
+        if (pendingEffect.candidateRef !== binding.candidateRef || pendingEffect.treeSha !== binding.candidateTreeSha) {
+            throw new Error(`${field}.pendingEffect candidate binding is invalid`);
         }
     }
-    if (hasOwn(value, 'reviewFeedback')) {
-        validateReviewFeedbackExecution(value.reviewFeedback);
-        validateReviewFeedbackRunInvariant(value, field);
+    if (value.pendingEffect?.kind === 'candidate-pin-release') {
+        if (!hasOwn(value, 'candidateBinding'))
+            throw new Error(`${field}.candidate pin cleanup requires candidate binding`);
+        const binding = value.candidateBinding;
+        const pendingEffect = value.pendingEffect;
+        if (pendingEffect.bindingId !== binding.bindingId
+            || pendingEffect.expectedPinnedCommitSha !== binding.candidateCommitSha) {
+            throw new Error(`${field}.candidate pin cleanup binding is invalid`);
+        }
     }
-    if (hasOwn(value, 'checkQualification'))
-        validateCheckQualification(value.checkQualification, `${field}.checkQualification`);
     assertTimestamp(value.createdAt, `${field}.createdAt`);
     assertTimestamp(value.updatedAt, `${field}.updatedAt`);
     const terminal = ['review-ready', 'blocked', 'transport-failed', 'cancelled', 'internal-error'].includes(value.lifecycle);
@@ -222,29 +257,32 @@ function validateRunRecord(value, field) {
         || value.checks.some((check) => check.status === 'failed'))) {
         throw new Error(`${field} proving requires passed checks and checked change proof identity`);
     }
-    if (value.lifecycle === 'publishing' && !hasOwn(value, 'proofReceipt'))
-        throw new Error(`${field} publishing requires proofReceipt`);
-    if (value.lifecycle === 'safe-halt' && !hasOwn(value, 'process'))
-        throw new Error(`${field} safe-halt requires retained process evidence`);
-    if (value.lifecycle === 'review-ready' && (!hasOwn(value, 'proofReceipt') || hasOwn(value, 'intent'))) {
-        throw new Error(`${field} review-ready requires proofReceipt and no intent`);
-    }
-    if (terminal && hasOwn(value, 'process'))
-        throw new Error(`${field} terminal lifecycle cannot retain process ownership`);
-    if (terminal && hasOwn(value, 'intent') && value.lifecycle !== 'transport-failed')
-        throw new Error(`${field} terminal lifecycle cannot retain intent`);
-    if (value.lifecycle === 'transport-failed' && hasOwn(value, 'intent')
+    if ((value.lifecycle === 'reviewing' || value.lifecycle === 'publishing') && !hasOwn(value, 'proofReceipt')) {
+        throw new Error(`${field} review and publication require proofReceipt`);
+    }
+    if (value.lifecycle === 'safe-halt' && !hasOwn(value, 'activeAttempt'))
+        throw new Error(`${field} safe-halt requires an active attempt`);
+    const reviewReadyEffect = value.pendingEffect?.kind;
+    const reviewReadyEffectAllowed = reviewReadyEffect === undefined
+        || ['review-activation-labels', 'blocked-labels', 'continuation-worktree-create', 'outcome-evidence'].includes(reviewReadyEffect);
+    if (value.lifecycle === 'review-ready' && (!hasOwn(value, 'proofReceipt') || !reviewReadyEffectAllowed)) {
+        throw new Error(`${field} review-ready requires proofReceipt and only a review continuation or terminal effect`);
+    }
+    const retainedCandidateEffect = value.lifecycle === 'blocked'
+        && value.terminalOutcome?.status === 'blocked'
+        && value.terminalOutcome.kind === 'safety'
+        && !value.terminalOutcome.resumable
+        && hasOwn(value, 'candidateBinding')
+        && (value.pendingEffect?.kind === 'initial-commit' || value.pendingEffect?.kind === 'review-update-commit');
+    const settlingOutcomeEvidence = value.pendingEffect?.kind === 'outcome-evidence';
+    if (terminal && hasOwn(value, 'pendingEffect') && value.lifecycle !== 'transport-failed'
+        && !retainedCandidateEffect && !settlingOutcomeEvidence)
+        throw new Error(`${field} terminal lifecycle cannot retain pending effect`);
+    if (value.lifecycle === 'transport-failed' && hasOwn(value, 'pendingEffect')
+        && !settlingOutcomeEvidence
         && value.terminalOutcome.resumable) {
-        throw new Error(`${field} resumable transport failure cannot retain intent`);
+        throw new Error(`${field} resumable transport failure cannot retain pending effect`);
     }
-    if (value.lifecycle === 'waiting-human' && !hasOwn(value, 'waitingHuman'))
-        throw new Error(`${field} waiting-human lifecycle requires waitingHuman execution`);
-    validateRouteStateInvariant({
-        lifecycle: value.lifecycle,
-        routeExecution: value.routeExecution,
-        routeReceipt: value.routeReceipt,
-        generationHash: routeGenerationHash,
-    });
 }
 function directTerminalOutcome(outcome) {
     if (outcome.status === 'review-ready')
@@ -265,83 +303,31 @@ function validateWorkflowGeneration(value, field) {
     }
     assertSha256(value.contentSha256, `${field}.contentSha256`);
 }
-function validateProcess(value, field) {
-    assertExactObject(value, [
-        'pid', 'processGroupId', 'startedAt', 'baseline', 'purpose', 'resumeLifecycle', 'resumeReviewStage',
-    ], field);
-    assertPositiveInteger(value.pid, `${field}.pid`);
-    assertPositiveInteger(value.processGroupId, `${field}.processGroupId`);
-    assertTimestamp(value.startedAt, `${field}.startedAt`);
-    assertExactObject(value.baseline, [
-        'headSha', 'indexTreeSha', 'trackedContentSha256', 'untrackedContentSha256', 'worktreeIdentity',
-    ], `${field}.baseline`);
-    assertGitSha(value.baseline.headSha, `${field}.baseline.headSha`);
-    assertGitSha(value.baseline.indexTreeSha, `${field}.baseline.indexTreeSha`);
-    assertSha256(value.baseline.trackedContentSha256, `${field}.baseline.trackedContentSha256`);
-    assertSha256(value.baseline.untrackedContentSha256, `${field}.baseline.untrackedContentSha256`);
-    assertNonEmptyString(value.baseline.worktreeIdentity, `${field}.baseline.worktreeIdentity`);
-    if (!['route', 'implementation', 'code-review', 'proof', 'spec-author', 'spec-review'].includes(value.purpose)) {
-        throw new Error(`${field}.purpose is invalid`);
-    }
-    if (!isLifecycle(value.resumeLifecycle))
-        throw new Error(`${field}.resumeLifecycle is invalid`);
-    if (value.resumeReviewStage !== null && ![
-        'review-full', 'review-repair', 'review-closure',
-    ].includes(value.resumeReviewStage))
-        throw new Error(`${field}.resumeReviewStage is invalid`);
-}
-function validateChecks(value, field, allowUnchangedFailure = true) {
+function validateChecks(value, field) {
     if (!Array.isArray(value) || value.length > 256)
         throw new Error(`${field} is invalid`);
     const ids = new Set();
     for (const [index, check] of value.entries()) {
-        assertExactObject(check, ['id', 'command', 'status', 'outputSha256'], `${field}[${index}]`);
+        const candidate = hasOwn(check, 'bindingId') || hasOwn(check, 'candidateTreeSha') || hasOwn(check, 'checkPolicySha256');
+        assertExactObject(check, [
+            'id', 'command', 'status', 'outputSha256',
+            ...(candidate ? ['bindingId', 'candidateTreeSha', 'checkPolicySha256'] : []),
+        ], `${field}[${index}]`);
         assertNonEmptyString(check.id, `${field}[${index}].id`);
         assertNonEmptyString(check.command, `${field}[${index}].command`);
-        if (check.status !== 'passed' && check.status !== 'failed'
-            && (check.status !== 'unchanged-failure' || !allowUnchangedFailure))
+        if (check.status !== 'passed' && check.status !== 'failed')
             throw new Error(`${field}[${index}].status is invalid`);
         assertSha256(check.outputSha256, `${field}[${index}].outputSha256`);
+        if (candidate) {
+            assertSha256(check.bindingId, `${field}[${index}].bindingId`);
+            assertGitSha(check.candidateTreeSha, `${field}[${index}].candidateTreeSha`);
+            assertSha256(check.checkPolicySha256, `${field}[${index}].checkPolicySha256`);
+        }
         if (ids.has(check.id))
             throw new Error(`${field} IDs must be unique`);
         ids.add(check.id);
     }
 }
-function validateCheckQualification(value, field) {
-    const optional = [
-        ...(hasOwn(value, 'implementationStarted') ? ['implementationStarted'] : []),
-        ...(hasOwn(value, 'repairInvocation') ? ['repairInvocation'] : []),
-        ...(hasOwn(value, 'deniedPathsBaseline') ? ['deniedPathsBaseline'] : []),
-    ];
-    assertExactObject(value, ['version', 'checkPolicySha256', 'repairAttempts', 'checks', ...optional], field);
-    if (value.version !== 1)
-        throw new Error(`${field}.version is invalid`);
-    assertSha256(value.checkPolicySha256, `${field}.checkPolicySha256`);
-    if (!Number.isSafeInteger(value.repairAttempts) || value.repairAttempts < 0 || value.repairAttempts > 5) {
-        throw new Error(`${field}.repairAttempts is invalid`);
-    }
-    validateChecks(value.checks, `${field}.checks`, false);
-    if (hasOwn(value, 'implementationStarted') && typeof value.implementationStarted !== 'boolean') {
-        throw new Error(`${field}.implementationStarted is invalid`);
-    }
-    if (hasOwn(value, 'repairInvocation') && value.repairInvocation !== null) {
-        validateImplementationInvocation(value.repairInvocation);
-    }
-    if (hasOwn(value, 'deniedPathsBaseline'))
-        assertSha256(value.deniedPathsBaseline, `${field}.deniedPathsBaseline`);
-    if (hasOwn(value, 'deniedPathsBaseline') !== (hasOwn(value, 'repairInvocation') && value.repairInvocation !== null)) {
-        throw new Error(`${field}.deniedPathsBaseline requires a repair invocation`);
-    }
-    const repairInvocation = hasOwn(value, 'repairInvocation')
-        ? value.repairInvocation
-        : undefined;
-    if (value.implementationStarted === true && repairInvocation !== null && repairInvocation !== undefined) {
-        throw new Error(`${field} cannot own qualification repair and implementation launches together`);
-    }
-    if (repairInvocation?.phase === 'launched' && value.repairAttempts === 0) {
-        throw new Error(`${field}.repairAttempts must reserve a launched repair`);
-    }
-}
 function validateIssueSnapshot(value, field) {
     const optional = hasOwn(value, 'comments') ? ['comments'] : [];
     assertExactObject(value, ['number', 'title', 'body', 'url', 'state', 'labels', ...optional], field);
@@ -398,53 +384,58 @@ function validateStringList(value, field) {
     for (const item of value)
         assertNonEmptyString(item, field);
 }
-function validateIntent(value, field) {
+function validatePendingEffect(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         throw new Error(`${field} is invalid`);
     const kind = value.kind;
-    if (kind === 'claim-labels' || kind === 'labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'expected'], field);
+    const identity = ['effectId', 'kind'];
+    if (kind === 'claim-labels' || kind === 'final-labels') {
+        assertExactObject(value, [...identity, 'issueNumber', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         validateStringArray(value.expected, `${field}.expected`);
     }
-    else if (kind === 'commit') {
-        assertExactObject(value, ['kind', 'parentSha', 'treeSha', 'message'], field);
+    else if (kind === 'initial-commit') {
+        assertExactObject(value, [...identity, 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
         assertGitSha(value.parentSha, `${field}.parentSha`);
         assertGitSha(value.treeSha, `${field}.treeSha`);
         assertNonEmptyString(value.message, `${field}.message`);
+        if (hasOwn(value, 'candidateRef'))
+            assertCandidateRef(value.candidateRef, `${field}.candidateRef`);
     }
-    else if (kind === 'push') {
-        assertExactObject(value, ['kind', 'branch', 'sha'], field);
+    else if (kind === 'initial-push') {
+        assertExactObject(value, [...identity, 'branch', 'sha'], field);
         assertNonEmptyString(value.branch, `${field}.branch`);
         assertGitSha(value.sha, `${field}.sha`);
     }
-    else if (kind === 'pr') {
-        assertExactObject(value, ['kind', 'owner', 'repo', 'head', 'base', 'issueNumber', 'marker'], field);
+    else if (kind === 'draft-pr') {
+        assertExactObject(value, [...identity, 'owner', 'repo', 'head', 'base', 'issueNumber', 'marker'], field);
         for (const key of ['owner', 'repo', 'head', 'base', 'marker'])
             assertNonEmptyString(value[key], `${field}.${key}`);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
     }
-    else if (kind === 'comment') {
-        assertExactObject(value, ['kind', 'issueNumber', 'marker', 'bodySha256'], field);
+    else if (kind === 'claim-comment' || kind === 'handoff-comment') {
+        assertExactObject(value, [...identity, 'issueNumber', 'marker', 'bodySha256'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertNonEmptyString(value.marker, `${field}.marker`);
         assertSha256(value.bodySha256, `${field}.bodySha256`);
     }
     else if (kind === 'review-activation-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'expected'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         validateStringArray(value.expected, `${field}.expected`);
     }
     else if (kind === 'review-update-commit') {
-        assertExactObject(value, ['kind', 'batchId', 'parentSha', 'treeSha', 'message'], field);
+        assertExactObject(value, [...identity, 'batchId', 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertGitSha(value.parentSha, `${field}.parentSha`);
         assertGitSha(value.treeSha, `${field}.treeSha`);
         assertNonEmptyString(value.message, `${field}.message`);
+        if (hasOwn(value, 'candidateRef'))
+            assertCandidateRef(value.candidateRef, `${field}.candidateRef`);
     }
     else if (kind === 'review-update-push') {
-        assertExactObject(value, ['kind', 'batchId', 'branch', 'priorRemoteSha', 'sha', 'treeSha'], field);
+        assertExactObject(value, [...identity, 'batchId', 'branch', 'priorRemoteSha', 'sha', 'treeSha'], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertNonEmptyString(value.branch, `${field}.branch`);
         assertGitSha(value.priorRemoteSha, `${field}.priorRemoteSha`);
@@ -452,7 +443,7 @@ function validateIntent(value, field) {
         assertGitSha(value.treeSha, `${field}.treeSha`);
     }
     else if (kind === 'review-summary') {
-        assertExactObject(value, ['kind', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'marker', 'bodySha256', 'epochHeadSha'], field);
+        assertExactObject(value, [...identity, 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'marker', 'bodySha256', 'epochHeadSha'], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertPositiveInteger(value.pullRequestNumber, `${field}.pullRequestNumber`);
         assertNonEmptyString(value.pullRequestNodeId, `${field}.pullRequestNodeId`);
@@ -461,7 +452,7 @@ function validateIntent(value, field) {
         assertGitSha(value.epochHeadSha, `${field}.epochHeadSha`);
     }
     else if (kind === 'review-final-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'epochHeadSha', 'expected'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'epochHeadSha', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         assertPositiveInteger(value.pullRequestNumber, `${field}.pullRequestNumber`);
@@ -470,27 +461,61 @@ function validateIntent(value, field) {
         validateStringArray(value.expected, `${field}.expected`);
     }
     else if (kind === 'review-blocked-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'expected', 'blockKind', 'evidenceCode'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'expected', 'blockKind', 'evidenceCode'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         validateStringArray(value.expected, `${field}.expected`);
-        if (value.blockKind !== 'safety' && value.blockKind !== 'exhausted')
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.blockKind)) {
             throw new Error(`${field}.blockKind is invalid`);
+        }
         assertNonEmptyString(value.evidenceCode, `${field}.evidenceCode`);
     }
     else if (kind === 'blocked-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'expected', 'blockKind', 'resumable', 'evidenceCode'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'expected', 'blockKind', 'resumable', 'evidenceCode'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         validateStringArray(value.expected, `${field}.expected`);
-        if (!['external', 'safety', 'exhausted'].includes(value.blockKind))
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.blockKind))
             throw new Error(`${field}.blockKind is invalid`);
         if (typeof value.resumable !== 'boolean')
             throw new Error(`${field}.resumable is invalid`);
         assertNonEmptyString(value.evidenceCode, `${field}.evidenceCode`);
     }
+    else if (kind === 'worktree-create') {
+        assertExactObject(value, [...identity, 'worktreePath', 'branchName', 'baseBranch', 'baseSha'], field);
+        assertAbsolutePath(value.worktreePath, `${field}.worktreePath`);
+        assertNonEmptyString(value.branchName, `${field}.branchName`);
+        assertNonEmptyString(value.baseBranch, `${field}.baseBranch`);
+        assertGitSha(value.baseSha, `${field}.baseSha`);
+    }
+    else if (kind === 'continuation-worktree-create') {
+        assertExactObject(value, [...identity, 'worktreePath', 'branchName', 'baseBranch', 'publishedHeadSha'], field);
+        assertAbsolutePath(value.worktreePath, `${field}.worktreePath`);
+        assertNonEmptyString(value.branchName, `${field}.branchName`);
+        assertNonEmptyString(value.baseBranch, `${field}.baseBranch`);
+        assertGitSha(value.publishedHeadSha, `${field}.publishedHeadSha`);
+    }
+    else if (kind === 'candidate-pin-release') {
+        assertExactObject(value, [...identity, 'bindingId', 'expectedPinnedCommitSha'], field);
+        assertSha256(value.bindingId, `${field}.bindingId`);
+        assertGitSha(value.expectedPinnedCommitSha, `${field}.expectedPinnedCommitSha`);
+    }
+    else if (kind === 'outcome-evidence') {
+        assertExactObject(value, [...identity, 'path', 'runId', 'code', 'summary', 'recordedAt', 'bytesSha256'], field);
+        assertNonEmptyString(value.path, `${field}.path`);
+        if (typeof value.runId !== 'string' || !UUID_V4_PATTERN.test(value.runId))
+            throw new Error(`${field}.runId is invalid`);
+        assertNonEmptyString(value.code, `${field}.code`);
+        assertNonEmptyString(value.summary, `${field}.summary`);
+        assertTimestamp(value.recordedAt, `${field}.recordedAt`);
+        assertSha256(value.bytesSha256, `${field}.bytesSha256`);
+    }
     else {
         throw new Error(`${field}.kind is invalid`);
     }
+    assertSha256(value.effectId, `${field}.effectId`);
+    const { effectId, ...payload } = value;
+    if (effectId !== sha256(canonicalJson(payload)))
+        throw new Error(`${field}.effectId does not match its payload`);
 }
 function validateTerminalOutcome(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
@@ -503,11 +528,13 @@ function validateTerminalOutcome(value, field) {
             assertGitSha(value.continuationEpoch, `${field}.continuationEpoch`);
     }
     else if (status === 'blocked') {
-        assertExactObject(value, ['status', 'kind', 'resumable', 'evidencePath'], field);
-        if (!['external', 'safety', 'exhausted'].includes(value.kind))
+        assertExactObject(value, ['status', 'kind', 'resumable', 'evidencePath', ...(hasOwn(value, 'blocker') ? ['blocker'] : [])], field);
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.kind))
             throw new Error(`${field}.kind is invalid`);
         if (typeof value.resumable !== 'boolean')
             throw new Error(`${field}.resumable is invalid`);
+        if (hasOwn(value, 'blocker'))
+            validateBlockerDetail(value.blocker, `${field}.blocker`);
     }
     else if (status === 'transport-failed') {
         assertExactObject(value, ['status', 'resumable', 'evidencePath'], field);
@@ -526,6 +553,19 @@ function validateTerminalOutcome(value, field) {
     }
     assertNonEmptyString(value.evidencePath, `${field}.evidencePath`);
 }
+function validateBlockerDetail(value, field) {
+    assertExactObject(value, ['kind', 'summary', 'attempted', 'resumable', ...(hasOwn(value, 'reviewerRejectionDetail') ? ['reviewerRejectionDetail'] : [])], field);
+    assertNonEmptyString(value.kind, `${field}.kind`);
+    assertNonEmptyString(value.summary, `${field}.summary`);
+    if (!Array.isArray(value.attempted) || value.attempted.length > 256)
+        throw new Error(`${field}.attempted is invalid`);
+    for (const attempted of value.attempted)
+        assertNonEmptyString(attempted, `${field}.attempted`);
+    if (typeof value.resumable !== 'boolean')
+        throw new Error(`${field}.resumable is invalid`);
+    if (hasOwn(value, 'reviewerRejectionDetail'))
+        assertNonEmptyString(value.reviewerRejectionDetail, `${field}.reviewerRejectionDetail`);
+}
 function validateReceipt(value, field) {
     assertExactObject(value, ['proofId', 'bindingSha256', 'summary', 'publishableEvidence', 'localEvidenceId'], field);
     assertNonEmptyString(value.proofId, `${field}.proofId`);
@@ -543,6 +583,18 @@ function validateReceipt(value, field) {
         assertNonEmptyString(evidence.description, `${field}.publishableEvidence.description`);
     }
 }
+function validateProofExecution(value, field) {
+    assertExactObject(value, ['startedAt', 'transportRetryCount', 'reportRepairCount', 'reportRepairFindings'], field);
+    assertTimestamp(value.startedAt, `${field}.startedAt`);
+    if (!Number.isSafeInteger(value.transportRetryCount) || value.transportRetryCount < 0)
+        throw new Error(`${field}.transportRetryCount is invalid`);
+    if (!Number.isSafeInteger(value.reportRepairCount) || value.reportRepairCount < 0)
+        throw new Error(`${field}.reportRepairCount is invalid`);
+    validateStringList(value.reportRepairFindings, `${field}.reportRepairFindings`);
+    if ((value.reportRepairCount === 0) !== (value.reportRepairFindings.length === 0)) {
+        throw new Error(`${field} report repair state is invalid`);
+    }
+}
 function validateStringShaRecord(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         throw new Error(`${field} is invalid`);
@@ -563,7 +615,40 @@ function validateStringArray(value, field) {
         throw new Error(`${field} must be sorted and unique`);
 }
 function emptyRunState() {
-    return { schema: 'codex-orchestrator.agent-auto-state', version: 2, generation: 0, runs: [] };
+    return { schema: 'codex-orchestrator.run-state', generation: 0, runs: [] };
+}
+function parseRawState(bytes) {
+    let value;
+    try {
+        value = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new Error('run state JSON is malformed');
+    }
+    return validateRunStateFile(value);
+}
+async function readOptionalStateFile(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (isErrorCode(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile())
+            throw new Error(`${path} is not a regular file`);
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+}
+function isErrorCode(error, code) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
 }
 function validateReviewFeedbackRunInvariant(run, field) {
     const feedback = run.reviewFeedback;
@@ -573,22 +658,18 @@ function validateReviewFeedbackRunInvariant(run, field) {
         || batch.priorPublishedHeadSha !== feedback.previousPublishedHeadSha)) {
         throw new Error(`${field}.reviewFeedback active batch identity binding is invalid`);
     }
-    const retainedQuiescentHistory = (feedback.phase === 'idle' || feedback.phase === 'bootstrap-required') && !batch
-        && run.lifecycle === 'blocked' && run.terminalOutcome?.status === 'blocked';
-    if ((feedback.phase === 'bootstrap-required' || feedback.phase === 'idle')
-        && run.lifecycle !== 'review-ready' && !retainedQuiescentHistory) {
-        throw new Error(`${field}.reviewFeedback quiescent phase requires review-ready lifecycle`);
-    }
-    if (['frozen', 'repairing'].includes(feedback.phase) && !['implementing', 'reworking', 'checking', 'proving', 'safe-halt'].includes(run.lifecycle)) {
-        throw new Error(`${field}.reviewFeedback active repair phase has invalid lifecycle`);
+    const retainedQuiescentHistory = !batch && run.lifecycle === 'blocked' && run.terminalOutcome?.status === 'blocked';
+    if (!batch && run.lifecycle !== 'review-ready' && !retainedQuiescentHistory) {
+        throw new Error(`${field}.reviewFeedback quiescent data requires review-ready lifecycle`);
     }
-    if (feedback.phase === 'verified' && run.lifecycle !== 'publishing') {
-        throw new Error(`${field}.reviewFeedback verified phase requires publishing lifecycle`);
+    if (batch && !feedback.verifiedReceipt
+        && !['implementing', 'checking', 'proving', 'reviewing', 'safe-halt'].includes(run.lifecycle)) {
+        throw new Error(`${field}.reviewFeedback active batch has invalid lifecycle`);
     }
-    if (feedback.phase === 'publishing' && run.lifecycle !== 'publishing') {
-        throw new Error(`${field}.reviewFeedback publishing phase requires publishing lifecycle`);
-    }
-    if (feedback.phase === 'verified' || feedback.phase === 'publishing') {
+    if (feedback.verifiedReceipt) {
+        if (run.lifecycle !== 'reviewing' && run.lifecycle !== 'publishing') {
+            throw new Error(`${field}.reviewFeedback verified batch requires review or publication lifecycle`);
+        }
         const verified = feedback.verifiedReceipt;
         if (!verified || verified.batchId !== batch?.batchId
             || verified.checkedChangeSha256 !== run.checkedChangeSha256
@@ -597,16 +678,10 @@ function validateReviewFeedbackRunInvariant(run, field) {
             throw new Error(`${field}.reviewFeedback verification receipt binding is invalid`);
         }
     }
-    if (feedback.phase === 'blocked-safety' || feedback.phase === 'blocked-exhausted') {
-        if (run.lifecycle !== 'blocked' || run.terminalOutcome?.status !== 'blocked' || run.terminalOutcome.resumable
-            || run.terminalOutcome.kind !== (feedback.phase === 'blocked-safety' ? 'safety' : 'exhausted')) {
-            throw new Error(`${field}.reviewFeedback terminal projection mismatch`);
-        }
-    }
 }
 function isLifecycle(value) {
     return typeof value === 'string' && [
-        'claimed', 'triaging', 'routed', 'waiting-human', 'spec-authoring', 'implementing', 'reworking', 'checking', 'proving', 'publishing', 'safe-halt',
+        'claimed', 'implementing', 'checking', 'proving', 'reviewing', 'publishing', 'safe-halt',
         'review-ready', 'blocked', 'transport-failed', 'cancelled', 'internal-error',
     ].includes(value);
 }
@@ -625,6 +700,10 @@ function assertNonEmptyString(value, field) {
     if (typeof value !== 'string' || value.length === 0 || value.length > 16 * 1024)
         throw new Error(`${field} is invalid`);
 }
+function assertAbsolutePath(value, field) {
+    if (typeof value !== 'string' || !value.startsWith('/') || posix.normalize(value) !== value)
+        throw new Error(`${field} is invalid`);
+}
 function assertPositiveInteger(value, field) {
     if (!Number.isSafeInteger(value) || value <= 0)
         throw new Error(`${field} is invalid`);
@@ -637,6 +716,11 @@ function assertGitSha(value, field) {
     if (typeof value !== 'string' || !GIT_SHA_PATTERN.test(value))
         throw new Error(`${field} must be a Git object ID`);
 }
+function assertCandidateRef(value, field) {
+    if (typeof value !== 'string' || !/^refs\/codex-orchestrator\/candidates\/[0-9a-f-]{36}\/[0-9a-f]{64}$/u.test(value)) {
+        throw new Error(`${field} is invalid`);
+    }
+}
 function assertTimestamp(value, field) {
     if (typeof value !== 'string' || Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value)
         throw new Error(`${field} is invalid`);