codex-orchestrator 2.0.11 → 2.0.12

package/dist/src/v2/runtime.js

@@ -1,35 +1,29 @@
 import { constants } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
-import { execFile, spawn } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { access, link, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, unlink } from 'node:fs/promises';
-import { homedir, hostname, platform } from 'node:os';
+import { homedir, hostname } from 'node:os';
 import { basename, dirname, isAbsolute, join, posix, relative, resolve } from 'node:path';
 import { writeDurableAtomicFile } from './adapters/durable-atomic-file.js';
 import { GitWorktreeManager } from './adapters/worktree.js';
-import { ReviewFeedbackCoordinator } from './review-feedback-coordinator.js';
+import { ReviewFeedbackObserver } from './review-feedback-coordinator.js';
 import { defaultProcessExecutor } from './adapters/command.js';
 import { RunnerAndroidProofController } from './android-proof-runner.js';
 import { AcceptanceProof, CandidateProofInspectionError } from './acceptance-proof.js';
 import { createCheckedChangeCapabilities } from './checked-change.js';
-import { InjectedContainedMutableOperation, InjectedContainedReportOperation, } from './contained-report-operation.js';
+import { InjectedContainedReportOperation } from './contained-report-operation.js';
 import { ContainedImplementationReviewer } from './implementation-reviewer.js';
 import { parseAgentAutoConfig } from './config.js';
-import { WaitingHumanCoordinator } from './waiting-human-coordinator.js';
 import { canonicalJson, parseJsonWithoutDuplicateKeys, sha256, } from './containment.js';
-import { FileProofRecordWriter } from './proof-store.js';
 import { CheckProcessQuiescenceError, parseIssueCheckInvocation, resolveIssueCheckPolicy } from './issue-check-policy.js';
 import { acquireOwnerControlLock, OwnerControlLockBlockedError } from './owner-control-lock.js';
 import { decodeAgentReportForValidation } from './report-envelope.js';
 import { CodexProcess, ProcessQuiescenceError } from './codex-process.js';
 import { FileAndroidLeaseVerifier, FileIosLeaseVerifier } from './mobile-lease.js';
 import { publishRuntimeAssetSnapshot } from './runtime-assets.js';
-import { RouteCoordinator } from './route-coordinator.js';
-import { SpecCoordinator } from './spec-coordinator.js';
-import { createSpecRevision } from './spec-delivery.js';
-import { validateCodeReviewDefects } from './code-review-report.js';
-import { hashRouteDecision, validateRouteReceipt } from './route-decision.js';
-import { OwnerLockContentionError, OwnerLockSafetyError, RunIssue } from './run-issue.js';
+import { OwnerLockContentionError, OwnerLockSafetyError, RunIssue, } from './run-issue.js';
 import { FileRunRecordWriter } from './run-store.js';
+import { captureProcessStartIdentity, observeProcessGroup, observeProcessIdentity } from './process-identity.js';
 import { parseWorkflowExecutionProfile, verifyWorkflowGeneration, } from './workflow-assets.js';
 import { candidateBindingId, candidateBindingSeed, candidateRef, } from './candidate.js';
 export class LocalGitRunIssueAdapter {
@@ -51,12 +45,9 @@ export class LocalGitRunIssueAdapter {
                     throw new Error('candidate expected HEAD diverged');
                 await this.git(['-C', input.worktreePath, 'read-tree', input.expectedHeadSha]);
             }),
-            prepareExecution: (input) => this.prepareCandidateExecution(input),
-            markExecutionLaunched: ({ lease, pid, processGroupId, launchedAt }) => ({
-                ...lease, phase: 'launched', pid, processGroupId, launchedAt,
-            }),
-            inspectExecution: (input) => this.inspectCandidateExecution(input),
-            removeExecution: (input) => this.removeCandidateExecution(input.lease),
+            prepareMaterialization: (input) => this.prepareCandidateMaterialization(input),
+            inspectMaterialization: (input) => this.inspectCandidateMaterialization(input),
+            removeMaterialization: (input) => this.removeCandidateMaterialization(input.materialization),
             copyProofArtifacts: (input) => this.copyCandidateProofArtifacts(input),
             createOrObserveCommit: (input) => this.createOrObserveCandidateCommit(input),
             releasePin: (input) => this.releaseCandidatePin(input.binding, input.expectedPinnedCommitSha),
@@ -98,23 +89,23 @@ export class LocalGitRunIssueAdapter {
                         throw new Error('orphan candidate ref cleanup failed');
                 }
             }
-            const executionRoot = canonicalFilesystemPath(resolve(input.workspaceRoot, '.candidate-executions'));
-            const activeExecutions = new Map(input.activeExecutions.map((execution) => [
-                canonicalFilesystemPath(execution.path), execution.candidateCommitSha,
+            const materializationRoot = canonicalFilesystemPath(resolve(input.workspaceRoot, '.candidate-materializations'));
+            const activeMaterializations = new Map(input.activeMaterializations.map((materialization) => [
+                canonicalFilesystemPath(materialization.path), materialization.candidateCommitSha,
             ]));
             for (const worktree of await this.worktrees.listWorktrees(root)) {
                 const path = canonicalFilesystemPath(worktree.path);
-                const relativePath = relative(executionRoot, path);
+                const relativePath = relative(materializationRoot, path);
                 if (relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))) {
-                    const expectedCommit = activeExecutions.get(path);
+                    const expectedCommit = activeMaterializations.get(path);
                     if (expectedCommit) {
                         if (worktree.branch !== undefined || await this.getHead(path).catch(() => '') !== expectedCommit) {
-                            throw new Error('persisted candidate execution owner diverged');
+                            throw new Error('persisted candidate materialization diverged');
                         }
                     }
                     else {
                         if (worktree.branch !== undefined)
-                            throw new Error('orphan candidate execution unexpectedly owns a branch');
+                            throw new Error('orphan candidate materialization unexpectedly owns a branch');
                         await this.git(['-C', root, 'worktree', 'remove', '--force', path]);
                     }
                 }
@@ -215,11 +206,11 @@ export class LocalGitRunIssueAdapter {
                 && await this.commitMatches(root, observed, binding.expectedHeadSha, binding.candidateTreeSha) ? 'matching' : 'diverged';
         });
     }
-    async prepareCandidateExecution(input) {
+    async prepareCandidateMaterialization(input) {
         return this.candidateOperation('candidate-materialization-io-failed', async () => {
             const root = await this.repositoryFromWorkspaceRoot(input.workspaceRoot);
             this.candidateRepositories.set(input.binding.candidateRef, root);
-            const path = join(input.workspaceRoot, '.candidate-executions', input.runId, input.binding.bindingId, `${input.operation}-${input.attemptId}`);
+            const path = join(input.workspaceRoot, '.candidate-materializations', input.runId, input.binding.bindingId, input.materializationId);
             const existing = (await this.worktrees.listWorktrees(root)).find((worktree) => sameFilesystemPath(worktree.path, path));
             if (existing) {
                 const clean = await this.worktrees.isWorktreeClean(path);
@@ -231,17 +222,16 @@ export class LocalGitRunIssueAdapter {
                 await mkdir(dirname(path), { recursive: true });
                 await this.git(['-C', root, 'worktree', 'add', '--detach', path, input.binding.candidateCommitSha]);
             }
-            return { kind: 'prepared', lease: {
+            return { kind: 'prepared', materialization: {
                     version: 2, bindingId: input.binding.bindingId, candidateCommitSha: input.binding.candidateCommitSha,
-                    path, operation: input.operation, attemptId: input.attemptId, phase: 'prepared', pid: null,
-                    processGroupId: null, preparedAt: new Date().toISOString(), launchedAt: null,
+                    path,
                 } };
         });
     }
-    async inspectCandidateExecution(input) {
+    async inspectCandidateMaterialization(input) {
         return this.candidateOperation('candidate-materialization-io-failed', async () => {
             try {
-                const stat = await lstat(input.lease.path);
+                const stat = await lstat(input.materialization.path);
                 if (stat.isSymbolicLink() || !stat.isDirectory())
                     return 'mutated';
             }
@@ -251,43 +241,41 @@ export class LocalGitRunIssueAdapter {
                 throw error;
             }
             const [head, tree, changed] = await Promise.all([
-                this.getHead(input.lease.path),
-                this.git(['-C', input.lease.path, 'rev-parse', 'HEAD^{tree}']).then((value) => value.trim()),
-                this.worktrees.listChangedFilesIgnoringUntrackedRoot(input.lease.path, input.artifactDir),
+                this.getHead(input.materialization.path),
+                this.git(['-C', input.materialization.path, 'rev-parse', 'HEAD^{tree}']).then((value) => value.trim()),
+                this.worktrees.listChangedFilesIgnoringUntrackedRoot(input.materialization.path, input.artifactDir),
             ]);
             return head === input.binding.candidateCommitSha && tree === input.binding.candidateTreeSha && changed.length === 0 ? 'matching' : 'mutated';
         });
     }
-    async removeCandidateExecution(lease) {
+    async removeCandidateMaterialization(materialization) {
         return this.candidateOperation('candidate-materialization-io-failed', async () => {
-            if (lease.phase === 'launched' && lease.processGroupId && processGroupIsAlive(lease.processGroupId))
-                throw new Error('candidate execution process is still active');
-            const root = await this.repositoryFromWorkspaceRoot(lease.path);
-            const registered = (await this.worktrees.listWorktrees(root)).find((worktree) => sameFilesystemPath(worktree.path, lease.path));
+            const root = await this.repositoryFromWorkspaceRoot(materialization.path);
+            const registered = (await this.worktrees.listWorktrees(root)).find((worktree) => sameFilesystemPath(worktree.path, materialization.path));
             if (!registered)
                 return;
-            if (registered.branch !== undefined || await this.getHead(lease.path) !== lease.candidateCommitSha)
-                throw new Error('candidate execution owner diverged');
-            await this.git(['-C', root, 'worktree', 'remove', '--force', lease.path]);
+            if (registered.branch !== undefined || await this.getHead(materialization.path) !== materialization.candidateCommitSha)
+                throw new Error('candidate materialization diverged');
+            await this.git(['-C', root, 'worktree', 'remove', '--force', materialization.path]);
         });
     }
     async copyCandidateProofArtifacts(input) {
         return this.candidateOperation('candidate-materialization-io-failed', async () => {
             const proofRoot = `${input.artifactDir}/${input.proofId}`;
-            const repositoryRoot = await this.repositoryFromWorkspaceRoot(input.lease.path);
+            const repositoryRoot = await this.repositoryFromWorkspaceRoot(input.materialization.path);
             const registered = (await this.worktrees.listWorktrees(repositoryRoot))
-                .find((worktree) => sameFilesystemPath(worktree.path, input.lease.path));
+                .find((worktree) => sameFilesystemPath(worktree.path, input.materialization.path));
             if (!registered || registered.branch !== undefined
-                || await this.getHead(input.lease.path).catch(() => '') !== input.lease.candidateCommitSha) {
+                || await this.getHead(input.materialization.path).catch(() => '') !== input.materialization.candidateCommitSha) {
                 return { kind: 'artifact-conflict', relativePath: proofRoot };
             }
-            const sourceRoot = await inspectSafeArtifactRoot(input.lease.path);
+            const sourceRoot = await inspectSafeArtifactRoot(input.materialization.path);
             const destinationRoot = await inspectSafeArtifactRoot(input.issueWorktreePath);
             for (const artifact of input.artifacts) {
                 if (artifact.relativePath !== proofRoot && !artifact.relativePath.startsWith(`${proofRoot}/`))
                     return { kind: 'artifact-conflict', relativePath: artifact.relativePath };
                 try {
-                    const source = join(input.lease.path, artifact.relativePath);
+                    const source = join(input.materialization.path, artifact.relativePath);
                     const destination = join(input.issueWorktreePath, artifact.relativePath);
                     const sourceBytes = await readRegularFileWithoutSymlinkAncestors(sourceRoot, source);
                     if (sha256(sourceBytes) !== artifact.sha256)
@@ -518,6 +506,13 @@ export class LocalGitRunIssueAdapter {
     listChangedFiles(worktreePath) {
         return this.worktrees.listChangedFiles(worktreePath);
     }
+    async diffTrees(worktreePath, previousTreeSha, candidateTreeSha) {
+        const [names, patch] = await Promise.all([
+            this.git(['-C', worktreePath, 'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', previousTreeSha, candidateTreeSha], { maxOutputBytes: 1024 * 1024 }),
+            this.git(['-C', worktreePath, 'diff', '--binary', '--full-index', '--no-ext-diff', previousTreeSha, candidateTreeSha, '--'], { maxOutputBytes: 1024 * 1024 }),
+        ]);
+        return { changedFiles: names.split('\0').filter(Boolean).sort(), patch };
+    }
     listChangedFilesIgnoringUntrackedRoot(worktreePath, ignoredRoot) {
         return this.worktrees.listChangedFilesIgnoringUntrackedRoot(worktreePath, ignoredRoot);
     }
@@ -784,106 +779,84 @@ export class ContainedImplementationAgent {
     async run(input) {
         const config = this.dependencies.config();
         const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
-        const promptFacts = implementationPromptFacts(input);
-        const operation = this.operation(config, canonicalRepository, promptFacts);
-        const result = await operation.run({
-            operation: input.operation, runId: input.runId, worktreePath: input.worktreePath,
-            workflowGeneration: input.workflowGeneration, promptFacts, signal: input.signal,
-            context: { repairOnly: input.repairOnly, reworkFindings: [...input.reworkFindings] },
-            invocationState: input.invocationState, beforeLaunch: input.beforeLaunch,
+        const attemptId = input.attemptId;
+        const attempt = await prepareContainedAttempt({
+            orchestratorHome: this.dependencies.orchestratorHome,
+            canonicalRepository,
+            runId: input.runId,
+            attemptId,
+            operationId: input.operation,
+            workflowGeneration: input.workflowGeneration,
+            bootId: this.dependencies.bootId,
         });
-        if (result.status === 'completed')
-            return { kind: 'completed', attemptId: result.attemptId,
-                report: decodeAgentReportForValidation(result.reportBytes) };
-        if (result.status === 'cancelled')
-            return { kind: 'cancelled' };
-        if (result.status === 'retryable')
-            return { kind: 'transport-failed', resumable: true, code: result.code };
-        if (result.status === 'safe-halt')
-            return { kind: 'safe-halt', code: result.code };
-        return result.kind === 'external'
-            ? { kind: 'transport-failed', resumable: true, code: result.code }
-            : { kind: 'safe-halt', code: result.code };
-    }
-    async settle(input) {
-        const config = this.dependencies.config();
-        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
-        const promptFacts = implementationPromptFacts(input);
-        const result = await this.operation(config, canonicalRepository, promptFacts).settle({
-            operation: input.operation, runId: input.runId, worktreePath: input.worktreePath,
-            workflowGeneration: input.workflowGeneration, promptFacts, signal: input.signal,
-            context: { repairOnly: input.repairOnly, reworkFindings: [...input.reworkFindings] },
-            invocationState: input.invocationState,
+        const baseline = await this.dependencies.git.snapshot(input.worktreePath);
+        await input.onPrepared?.({
+            attemptId,
+            reportPath: attempt.reportPath,
+            preparedAt: (this.dependencies.now ?? (() => new Date().toISOString()))(),
+            baseline,
         });
-        return result.status === 'settled' ? { kind: 'settled' } : { kind: 'safe-halt', code: result.code };
-    }
-    operation(config, canonicalRepository, promptFacts) {
-        return new InjectedContainedMutableOperation({
-            host: hostname(), bootId: this.dependencies.bootId,
-            now: this.dependencies.now ?? (() => new Date().toISOString()),
-            createAttemptId: this.dependencies.createAttemptId ?? randomUUID,
-            prepare: async ({ operation: worker, attemptId, runId, workflowGeneration }) => ({
-                operation: worker, generationHash: workflowGeneration.generationHash,
-                ...await prepareContainedAttempt({
-                    orchestratorHome: this.dependencies.orchestratorHome, canonicalRepository, runId, attemptId,
-                    operationId: worker, workflowGeneration, bootId: this.dependencies.bootId,
+        try {
+            try {
+                const recovered = await readRegularFile(attempt.reportPath);
+                return { kind: 'completed', attemptId, report: decodeAgentReportForValidation(recovered) };
+            }
+            catch (error) {
+                if (!isErrorCode(error, 'ENOENT'))
+                    return { kind: 'internal-error' };
+            }
+            const result = await (this.dependencies.process ?? new CodexProcess()).run({
+                codexPath: config.codex.command,
+                cwd: input.worktreePath,
+                schemaPath: attempt.schemaPath,
+                reportPath: attempt.reportPath,
+                toolHome: attempt.toolHome,
+                tmpDir: attempt.tmpDir,
+                safePath: this.dependencies.safePath,
+                parentCodexHome: this.dependencies.parentCodexHome,
+                parentEnv: process.env,
+                prompt: [
+                    `Package profile instructions: ${attempt.profile.developerInstructions}`,
+                    `Follow the exact operation at ${attempt.operationPath}.`,
+                    `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
+                    `Implement issue #${input.issue.number}: ${input.issue.title}`,
+                    `Implementation cycle: ${input.cycle}.`,
+                    ...(input.reviewFeedbackRound ? [`Pull-request feedback repair round: ${input.reviewFeedbackRound}.`] : []),
+                    ...(input.reviewFeedback?.length ? [`Frozen trusted pull-request feedback: ${canonicalJson(input.reviewFeedback)}`] : []),
+                    `Exact delivery authority: ${canonicalJson(input.deliveryAuthority)}`,
+                    `Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`,
+                    ...(input.reworkFindings.length > 0 ? [`Repair these verified findings: ${canonicalJson(input.reworkFindings)}`] : []),
+                    ...(input.repairOnly ? ['Report repair only: do not modify any worktree file; emit a schema-valid implementation report for the existing change.'] : []),
+                    'Do not commit, push, publish, or print credentials or local auth paths.',
+                ].join('\n'),
+                timeoutMs: config.codex.timeoutMs,
+                idleTimeoutMs: config.codex.idleTimeoutMs,
+                operationPolicy: attempt.policy,
+                executionProfile: attempt.profile,
+                onSpawned: async ({ pid, processGroupId }) => input.onLaunched?.({
+                    attemptId, pid, processGroupId, launchedAt: (this.dependencies.now ?? (() => new Date().toISOString()))(),
                 }),
-            }),
-            snapshot: (worktreePath) => this.dependencies.git.snapshot(worktreePath),
-            readReport: async (path) => readRegularFile(path).then((bytes) => ({ status: 'available', bytes }))
-                .catch((error) => isErrorCode(error, 'ENOENT') ? { status: 'absent' } : { status: 'unknown' }),
-            processStartIdentity: readProcessStartIdentity,
-            inspectProcess: inspectReportProcess,
-            launch: async ({ attempt, worktreePath, signal, onSpawned }) => {
-                try {
-                    const result = await (this.dependencies.process ?? new CodexProcess()).run({
-                        codexPath: config.codex.command, cwd: worktreePath, schemaPath: attempt.schemaPath,
-                        reportPath: attempt.reportPath, toolHome: attempt.toolHome, tmpDir: attempt.tmpDir,
-                        safePath: this.dependencies.safePath, parentCodexHome: this.dependencies.parentCodexHome,
-                        parentEnv: process.env,
-                        prompt: [
-                            `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                            `Follow the exact operation at ${attempt.operationPath}.`,
-                            `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
-                            ...promptFacts,
-                        ].join('\n'),
-                        timeoutMs: config.codex.timeoutMs, idleTimeoutMs: config.codex.idleTimeoutMs,
-                        operationPolicy: attempt.policy, executionProfile: attempt.profile, onSpawned,
-                    }, signal);
-                    if (result.kind === 'cancelled')
-                        return { status: 'cancelled' };
-                    if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind))
-                        return { status: 'retryable', code: `mutable-operation-${result.kind}` };
-                    if (result.kind !== 'completed' || result.report.kind !== 'available')
-                        return { status: 'retryable', code: 'mutable-operation-report-unavailable' };
-                    return { status: 'completed', reportBytes: result.report.bytes };
-                }
-                catch (error) {
-                    return error instanceof ProcessQuiescenceError
-                        ? { status: 'safe-halt' }
-                        : { status: 'retryable', code: 'mutable-operation-launch-failed' };
-                }
-            },
-        });
+            }, input.signal);
+            if (result.kind === 'cancelled')
+                return { kind: 'cancelled' };
+            if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout', 'launch-gate-failed'].includes(result.kind)) {
+                return { kind: 'transport-failed', resumable: true };
+            }
+            if (result.kind !== 'completed' || result.report.kind !== 'available')
+                return { kind: 'internal-error' };
+            return {
+                kind: 'completed',
+                attemptId,
+                report: decodeAgentReportForValidation(result.report.bytes),
+            };
+        }
+        catch (error) {
+            if (!(error instanceof ProcessQuiescenceError))
+                return { kind: 'internal-error' };
+            return { kind: 'safe-halt' };
+        }
     }
 }
-function implementationPromptFacts(input) {
-    const task = input.operation === 'qualification-repair' ? [
-        `Pre-implementation qualification repair for issue #${input.issue.number}: ${input.issue.title}`,
-        'Do not implement the issue acceptance criteria yet. Repair only the reported scoped-check failures so the existing worktree qualifies for implementation.',
-        'You may modify the product files required by those failures. Return changedFiles as the complete cumulative worktree change set.',
-    ] : [`Implement issue #${input.issue.number}: ${input.issue.title}`];
-    return [...task,
-        `Implementation cycle: ${input.cycle}.`,
-        ...(input.reviewFeedbackRound ? [`Pull-request feedback repair round: ${input.reviewFeedbackRound}.`] : []),
-        ...(input.reviewFeedback?.length ? [`Frozen trusted pull-request feedback: ${canonicalJson(input.reviewFeedback)}`] : []),
-        ...(input.operation !== 'qualification-repair' ? [`Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`] : []),
-        ...(input.reworkFindings.length > 0 ? [`Repair these verified findings: ${canonicalJson(input.reworkFindings)}`] : []),
-        ...(input.phaseFacts?.length ? [`Phase-owned invocation correlation: ${canonicalJson(input.phaseFacts)}`] : []),
-        ...(input.repairOnly ? ['Report repair only: do not modify any worktree file; emit a schema-valid implementation report for the existing change.'] : []),
-        'Do not commit, push, publish, or print credentials or local auth paths.',
-    ];
-}
 export class ContainedProofAgent {
     dependencies;
     constructor(dependencies) {
@@ -892,54 +865,150 @@ export class ContainedProofAgent {
     async run(input) {
         if (!input.workflowGeneration)
             throw new Error('proof workflow generation is required');
-        if (!input.iosProofInputs)
-            throw new Error('runner-owned iOS proof inputs are required');
         const config = this.dependencies.config();
+        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
         const issueWorktreePath = resolve(this.dependencies.targetRoot, config.runner.workspaceRoot, `issue-${input.issue.number}`);
         const worktreePath = input.worktreePath ? resolve(input.worktreePath) : issueWorktreePath;
+        const attempt = await prepareContainedAttempt({
+            orchestratorHome: this.dependencies.orchestratorHome,
+            canonicalRepository,
+            runId: input.runId,
+            attemptId: input.attemptId ?? (this.dependencies.createAttemptId ?? randomUUID)(),
+            operationId: 'acceptance-proof',
+            workflowGeneration: input.workflowGeneration,
+            bootId: this.dependencies.bootId,
+        });
         const artifactRoot = resolve(worktreePath, config.proof.artifactDir);
+        const snapshotRoot = dirname(attempt.sourceSkillPath ?? attempt.operationPath);
+        const iosLeaseRoot = join(resolve(this.dependencies.orchestratorHome), 'v2', sha256(canonicalRepository), 'leases');
+        const iosLeaseArtifact = join(artifactRoot, input.proofId, 'ios-lease.json');
+        const iosTooling = await discoverIosTooling(this.dependencies.processExecutor, this.dependencies.iosXcrunPath);
         const before = await artifactInventory(artifactRoot, config.proof.artifactDir);
-        if (!input.invocationState)
-            return { kind: 'internal-error' };
-        if (input.repairOnly && await input.invocationState.read() === undefined
-            && !artifactInventoryMatches(before, input.repairArtifactSha256)) {
-            return { kind: 'internal-error', code: 'proof-report-repair-artifact-drift' };
-        }
-        const result = await this.dependencies.operation.run({
-            operation: 'acceptance-proof', runId: input.runId, worktreePath,
-            workflowGeneration: input.workflowGeneration, signal: input.signal, invocationState: input.invocationState,
-            beforeLaunch: input.beforeLaunch,
-            promptFacts: [
-                `Proof ID: ${input.proofId}. Issue: ${canonicalJson(input.issue)}.`,
-                `Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}.`,
-                `Checked change: ${input.checkedChangeSha256}; files: ${canonicalJson(input.changedFiles)}; checks: ${canonicalJson(input.checks)}.`,
-                `Runner artifacts: ${canonicalJson(input.runnerPreparedArtifactPaths)}; hashes: ${canonicalJson(input.runnerPreparedArtifactSha256)}; warnings: ${canonicalJson(input.runnerPreparationWarnings)}.`,
-                `Runner-owned immutable iOS proof inputs: ${canonicalJson(input.iosProofInputs)}.`,
-                ...(input.iosProofInputs.runtimeId === null || input.iosProofInputs.deviceTypeId === null
-                    ? ['iOS Simulator tooling discovery is unavailable; return a typed tool blocker for an iOS surface.'] : []),
-                `Report repair: ${canonicalJson({ repairOnly: input.repairOnly, findings: input.repairFindings })}.`,
-                ...(input.repairOnly ? [`Immutable pre-repair artifact inventory: ${canonicalJson(input.repairArtifactSha256)}.`] : []),
-            ],
-        });
-        if (result.status === 'cancelled')
-            return { kind: 'cancelled' };
-        if (result.status !== 'completed') {
-            if (input.repairOnly && await input.invocationState.read() === undefined
-                && !artifactInventoryMatches(await artifactInventory(artifactRoot, config.proof.artifactDir), input.repairArtifactSha256)) {
-                return { kind: 'internal-error', code: 'proof-report-repair-artifact-drift' };
+        try {
+            try {
+                const recoveredReport = await readRegularFile(attempt.reportPath);
+                const recoveredInventory = await artifactInventory(artifactRoot, config.proof.artifactDir);
+                const runnerPrepared = new Set(input.runnerPreparedArtifactPaths);
+                return {
+                    kind: 'report',
+                    report: decodeAgentReportForValidation(recoveredReport, ['visualEvidence', 'blocker']),
+                    proofPhaseChangedFiles: [...recoveredInventory.keys()].filter((path) => !runnerPrepared.has(path)).sort(),
+                };
+            }
+            catch (error) {
+                if (!isErrorCode(error, 'ENOENT'))
+                    throw error;
+            }
+            if (input.recoverOnly)
+                return { kind: 'internal-error' };
+            const result = await (this.dependencies.process ?? new CodexProcess()).run({
+                codexPath: config.codex.command,
+                cwd: worktreePath,
+                schemaPath: attempt.schemaPath,
+                reportPath: attempt.reportPath,
+                toolHome: attempt.toolHome,
+                tmpDir: attempt.tmpDir,
+                safePath: this.dependencies.safePath,
+                parentCodexHome: this.dependencies.parentCodexHome,
+                parentEnv: process.env,
+                prompt: [
+                    `Package profile instructions: ${attempt.profile.developerInstructions}`,
+                    `Follow the exact operation at ${attempt.operationPath}.`,
+                    `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
+                    `Independently prove issue #${input.issue.number}.`,
+                    `Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`,
+                    `Checked change digest: ${input.checkedChangeSha256}.`,
+                    `Checked changed files: ${canonicalJson(input.changedFiles)}.`,
+                    `Configured check receipts: ${canonicalJson(input.checks)}.`,
+                    `Write evidence only below ${config.proof.artifactDir}.`,
+                    'When a frozen criterion has a browser surface, follow references/browser.md from the exact acceptance-proof skill snapshot.',
+                    'When a frozen criterion has an Android surface, follow references/android.md from the exact acceptance-proof skill snapshot.',
+                    ...(config.proof.android ? [
+                        `Runner-owned Android artifact paths: ${canonicalJson(input.runnerPreparedArtifactPaths)}.`,
+                        `Runner-owned Android preparation warnings: ${canonicalJson(input.runnerPreparationWarnings)}.`,
+                        'The trusted Runner owns emulator, build, adb, lease, capture, and cleanup actions. Do not invoke adb, emulator, Flutter run, or an Android lease helper.',
+                        'Inspect Runner artifacts when present. If preparation warnings are present, continue with all available non-visual evidence and preserve the warning as a residual risk; Android infrastructure failure alone must not block delivery.',
+                    ] : [
+                        'Runner-owned Android proof is not configured for this repository. Do not invoke adb, emulator, Flutter run, or an Android lease helper; return a typed tool blocker for Android criteria.',
+                    ]),
+                    'When a frozen criterion has an iOS surface, follow references/ios.md from the exact acceptance-proof skill snapshot.',
+                    `iOS lease helper: ${join(snapshotRoot, 'tools', 'ios-lease.mjs')}.`,
+                    `iOS lease root: ${iosLeaseRoot}.`,
+                    `iOS lease artifact: ${iosLeaseArtifact}.`,
+                    `iOS lease proof ID: ${input.proofId}.`,
+                    `iOS lease owner PID: ${process.pid}.`,
+                    `iOS xcrun path: ${this.dependencies.iosXcrunPath}.`,
+                    ...(iosTooling ? [
+                        `iOS runtime ID: ${iosTooling.runtimeId}.`,
+                        `iOS device type ID: ${iosTooling.deviceTypeId}.`,
+                    ] : ['iOS Simulator tooling discovery is unavailable; return a typed tool blocker for an iOS surface.']),
+                    ...(input.repairOnly ? [`Proof Report repair only: ${canonicalJson(input.repairFindings)} Do not modify product or evidence files.`] : []),
+                    'Do not modify product files, commit, push, publish, or print credentials or local auth paths.',
+                ].join('\n'),
+                timeoutMs: config.codex.timeoutMs,
+                idleTimeoutMs: config.codex.idleTimeoutMs,
+                operationPolicy: attempt.policy,
+                executionProfile: attempt.profile,
+                onSpawned: async ({ pid, processGroupId }) => input.onLaunched?.({
+                    pid, processGroupId, launchedAt: new Date().toISOString(),
+                }),
+            }, input.signal);
+            if (result.kind === 'cancelled')
+                return { kind: 'cancelled' };
+            if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout', 'launch-gate-failed'].includes(result.kind)) {
+                return { kind: 'transport-failed', resumable: true };
             }
-            return { kind: 'deferred', code: result.code };
+            if (result.kind !== 'completed' || result.report.kind !== 'available')
+                return { kind: 'internal-error' };
+            const after = await artifactInventory(artifactRoot, config.proof.artifactDir);
+            return {
+                kind: 'report',
+                report: decodeAgentReportForValidation(result.report.bytes, ['visualEvidence', 'blocker']),
+                proofPhaseChangedFiles: changedArtifactPaths(before, after),
+            };
         }
-        const after = await artifactInventory(artifactRoot, config.proof.artifactDir);
-        const runnerPrepared = new Set(input.runnerPreparedArtifactPaths);
-        const changed = before.size === 0
-            ? [...after.keys()].filter((path) => !runnerPrepared.has(path)).sort()
-            : changedArtifactPaths(before, after);
-        return {
-            kind: 'report', report: decodeAgentReportForValidation(result.reportBytes, ['visualEvidence', 'blocker']),
-            proofPhaseChangedFiles: changed, proofPhaseArtifactSha256: Object.fromEntries([...after.entries()].sort()),
-        };
+        catch (error) {
+            return error instanceof ProcessQuiescenceError ? { kind: 'safe-halt' } : { kind: 'internal-error' };
+        }
+    }
+}
+export async function observeAttemptReadViewCleanup(input) {
+    const runtimeRoot = join(resolve(input.orchestratorHome), 'v2', sha256(input.canonicalRepository));
+    const attemptRoot = join(runtimeRoot, 'runs', input.identity.runId, 'attempts', input.identity.attemptId);
+    const expectedResultPath = join(attemptRoot, 'report.json');
+    if (input.identity.resultPath !== expectedResultPath)
+        return 'pending';
+    let canonicalRuntimeRoot;
+    let canonicalAttemptRoot;
+    try {
+        canonicalRuntimeRoot = await realpath(runtimeRoot);
+    }
+    catch (error) {
+        return isErrorCode(error, 'ENOENT') ? 'confirmed' : 'pending';
+    }
+    try {
+        canonicalAttemptRoot = await realpath(attemptRoot);
     }
+    catch (error) {
+        return isErrorCode(error, 'ENOENT') ? 'confirmed' : 'pending';
+    }
+    const expectedRelative = relative(runtimeRoot, attemptRoot);
+    if (!isPathWithin(canonicalRuntimeRoot, canonicalAttemptRoot)
+        || relative(canonicalRuntimeRoot, canonicalAttemptRoot) !== expectedRelative)
+        return 'pending';
+    await rm(join(attemptRoot, 'read-view'), { recursive: true, force: true });
+    return 'confirmed';
+}
+export function selectedConfiguredCheckPolicySha256(selectedChecks, configuredAuthority) {
+    const selected = {};
+    for (const check of selectedChecks) {
+        if (Object.prototype.hasOwnProperty.call(selected, check.id)
+            || configuredAuthority[check.id] !== check.command) {
+            throw new CandidateProofInspectionError('selected check no longer matches current configured authority');
+        }
+        selected[check.id] = check.command;
+    }
+    return sha256(canonicalJson(selected));
 }
 export async function resolveCodexExecutable(command, safePath) {
     if (command.length === 0 || safePath.length === 0)
@@ -1006,6 +1075,13 @@ export function createV2Runtime(input) {
         git,
         now,
     });
+    const proofAgent = input.proofAgent ?? new ContainedProofAgent({
+        ...containedDependencies(),
+        targetRoot,
+        androidAdbPath,
+        iosXcrunPath,
+        processExecutor: commandExecutor,
+    });
     const androidProofController = new RunnerAndroidProofController({
         adbPath: androidAdbPath,
         emulatorPath: androidEmulatorPath,
@@ -1013,10 +1089,6 @@ export function createV2Runtime(input) {
         now: () => new Date(now()),
     });
     const reportOperation = new InjectedContainedReportOperation({
-        host: hostname(),
-        bootId: input.bootId,
-        now,
-        createAttemptId: input.createAttemptId ?? randomUUID,
         prepare: async ({ operation, attemptId, runId, workflowGeneration }) => ({
             operation,
             generationHash: workflowGeneration.generationHash,
@@ -1030,44 +1102,38 @@ export function createV2Runtime(input) {
                 bootId: input.bootId,
             }),
         }),
-        snapshot: (worktreePath, operation) => operation === 'acceptance-proof' && proofFreshnessGit.snapshotIgnoringUntrackedRoot
-            ? proofFreshnessGit.snapshotIgnoringUntrackedRoot(worktreePath, requireConfig(currentConfig).proof.artifactDir)
-            : git.snapshot(worktreePath),
-        readReport: async (path) => readRegularFile(path).then((bytes) => ({ status: 'available', bytes }))
-            .catch((error) => isErrorCode(error, 'ENOENT') ? { status: 'absent' } : { status: 'unknown' }),
-        settleAttempt: async (attempt) => attempt.tmpDir
-            ? rm(join(dirname(attempt.tmpDir), 'read-view'), { recursive: true, force: true })
-            : Promise.reject(new Error('report operation attempt temporary directory is missing')),
-        processStartIdentity: readProcessStartIdentity,
-        inspectProcess: inspectReportProcess,
-        launch: async ({ operation, attempt, worktreePath, promptFacts, signal, onSpawned }) => {
+        snapshot: (worktreePath) => git.snapshot(worktreePath),
+        launch: async ({ attempt, worktreePath, promptFacts, signal, onLaunched }) => {
             const config = requireConfig(currentConfig);
             if (!attempt.schemaPath || !attempt.reportPath || !attempt.toolHome || !attempt.tmpDir
                 || !attempt.profile || !attempt.operationPath || !attempt.workflowRoot) {
                 return { status: 'blocked', kind: 'safety', code: 'report-operation-attempt-incomplete' };
             }
-            let readView;
-            if (operation !== 'spec-author' && operation !== 'acceptance-proof') {
-                try {
-                    readView = await materializeReportReadView({
-                        worktreePath,
-                        destination: join(dirname(attempt.tmpDir), 'read-view'),
-                        deniedPaths: config.deny.readPaths,
-                    });
-                }
-                catch {
-                    return { status: 'blocked', kind: 'safety', code: 'report-operation-read-view-failed' };
+            try {
+                return { status: 'completed', reportBytes: await readRegularFile(attempt.reportPath) };
+            }
+            catch (error) {
+                if (!isErrorCode(error, 'ENOENT')) {
+                    return { status: 'blocked', kind: 'safety', code: 'report-operation-result-read-failed' };
                 }
             }
-            const revisionPath = operation === 'spec-author'
-                ? join(dirname(attempt.reportPath), `revision-${promptFacts[0]}.md`)
-                : undefined;
+            let readView;
+            try {
+                readView = await materializeReportReadView({
+                    worktreePath,
+                    destination: join(dirname(attempt.tmpDir), 'read-view'),
+                    deniedPaths: config.deny.readPaths,
+                });
+            }
+            catch {
+                return { status: 'blocked', kind: 'safety', code: 'report-operation-read-view-failed' };
+            }
             let result;
             let cleanupAfterSafeHalt = false;
             try {
                 result = await containedProcess.run({
                     codexPath: config.codex.command,
-                    cwd: operation === 'spec-author' ? dirname(attempt.reportPath) : operation === 'acceptance-proof' ? worktreePath : readView,
+                    cwd: readView,
                     schemaPath: attempt.schemaPath,
                     reportPath: attempt.reportPath,
                     toolHome: attempt.toolHome,
@@ -1075,25 +1141,12 @@ export function createV2Runtime(input) {
                     safePath: requireRuntimeString(input.safePath, 'safePath'),
                     parentCodexHome: requireRuntimeString(input.parentCodexHome, 'parentCodexHome'),
                     parentEnv: process.env,
-                    prompt: operation === 'spec-author' ? [
-                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                        `Follow the exact operation at ${attempt.operationPath}.`,
-                        `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
-                        `Runner-provided facts: ${canonicalJson(promptFacts)}`,
-                        `Write the complete new immutable revision only to ${revisionPath}. Return that exact absolute path and its SHA-256 in the report.`,
-                        'Do not modify the product worktree, prior revisions, external state, or any .env file.',
-                    ].join('\n') : operation === 'acceptance-proof' ? [
-                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                        `Follow the exact operation at ${attempt.operationPath}.`,
-                        `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
-                        `Runner-provided proof facts:\n${promptFacts.join('\n')}`,
-                        `Write evidence only below ${config.proof.artifactDir}. CheckedChange is the sole authority for completed checks.`,
-                        'Do not modify product files, commit, push, publish, use network or MCP tools, or print credentials or local auth paths.',
-                    ].join('\n') : [
+                    prompt: [
                         `Package profile instructions: ${attempt.profile.developerInstructions}`,
                         `Follow the exact operation at ${attempt.operationPath}.`,
                         `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
                         `Runner-provided facts: ${canonicalJson(promptFacts)}`,
+                        `Available reviewer roles: ${canonicalJson(attempt.reviewers ?? [])}`,
                         'This is a read-only, report-only operation. Do not edit files or external state, use network or MCP tools, or request additional authority.',
                         'Do not read .env or any .env* file. The runner has removed repository credential paths from this read view.',
                     ].join('\n'),
@@ -1101,24 +1154,30 @@ export function createV2Runtime(input) {
                     idleTimeoutMs: config.codex.idleTimeoutMs,
                     operationPolicy: attempt.policy,
                     executionProfile: attempt.profile,
-                    onSpawned,
+                    agentProfilePaths: attempt.reviewerProfiles,
+                    onSpawned: async ({ pid, processGroupId }) => onLaunched?.({ pid, processGroupId }),
                 }, signal);
             }
             catch (error) {
                 if (error instanceof ProcessQuiescenceError) {
                     cleanupAfterSafeHalt = true;
-                    return { status: 'safe-halt' };
+                    return {
+                        status: 'safe-halt',
+                        pid: error.pid,
+                        processGroupId: error.processGroupId,
+                        startedAt: now(),
+                    };
                 }
                 throw error;
             }
             finally {
-                if (readView && !cleanupAfterSafeHalt)
+                if (!cleanupAfterSafeHalt)
                     await rm(readView, { recursive: true, force: true });
             }
             if (result.kind === 'cancelled')
                 return { status: 'cancelled' };
             if (result.kind === 'launch-gate-failed') {
-                return { status: 'blocked', kind: 'safety', code: 'review-operation-launch-persistence-failed' };
+                return { status: 'retryable', code: 'review-operation-launch-gate-failed' };
             }
             if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind)) {
                 return { status: 'retryable', code: `report-operation-${result.kind}` };
@@ -1129,104 +1188,9 @@ export function createV2Runtime(input) {
             return { status: 'completed', reportBytes: result.report.bytes };
         },
     });
-    const proofAgent = input.proofAgent ?? new ContainedProofAgent({
-        config: () => requireConfig(currentConfig), targetRoot, operation: reportOperation,
-    });
     const implementationReviewer = new ContainedImplementationReviewer({
         operation: reportOperation,
     });
-    const specOperation = {
-        author: async ({ context, state, mode, authorSessionId: sessionId, signal, invocationState }) => {
-            let completedAttemptId;
-            try {
-                const result = await reportOperation.run({
-                    operation: 'spec-author', runId: context.runId, worktreePath: context.worktreePath,
-                    workflowGeneration: context.workflowGeneration, signal, invocationState,
-                    promptFacts: [
-                        String(state.revisions.length + 1),
-                        `Author session ID: ${sessionId}. Author mode: ${mode}.`,
-                        `Issue authority and frozen criteria: ${canonicalJson({ issue: context.issue, frozenCriteria: context.frozenCriteria })}.`,
-                        `Prior revisions and review state: ${canonicalJson({ revisions: state.revisions, review: state.review })}.`,
-                    ],
-                });
-                if (result.status === 'cancelled')
-                    return { status: 'cancelled' };
-                if (result.status === 'retryable' || result.status === 'safe-halt')
-                    return { status: 'retryable', code: result.code };
-                if (result.status === 'blocked')
-                    return { status: 'blocked', kind: result.kind, code: result.code };
-                completedAttemptId = result.attemptId;
-                const invocation = await invocationState.read();
-                if (!invocation || invocation.operation !== 'spec-author' || invocation.attemptId !== result.attemptId) {
-                    return { status: 'blocked', kind: 'safety', code: 'spec-author-invocation-correlation-missing' };
-                }
-                const revisionPath = join(dirname(invocation.reportPath), `revision-${state.revisions.length + 1}.md`);
-                const report = decodeAgentReportForValidation(result.reportBytes);
-                if (report.status !== 'ready' || report.specPath !== revisionPath || report.specSha256 === null) {
-                    return { status: 'invalid', code: 'spec-author-report-invalid', attemptId: result.attemptId };
-                }
-                const content = await readRegularFile(revisionPath);
-                if (report.specSha256 !== sha256(content))
-                    return { status: 'invalid', code: 'spec-author-report-invalid', attemptId: result.attemptId };
-                const previous = state.revisions.at(-1) ?? null;
-                return { status: 'completed', value: createSpecRevision({
-                        revision: state.revisions.length + 1, path: revisionPath, content: content.toString('utf8'),
-                        evidence: [{ path: context.issue.url, sha256: sha256(canonicalJson(context.issue)), description: 'Frozen issue authority' }],
-                        author: { attemptId: result.attemptId, sessionId }, previousRevision: previous,
-                    }) };
-            }
-            catch (error) {
-                return completedAttemptId
-                    ? { status: 'invalid', code: 'spec-author-report-invalid', attemptId: completedAttemptId }
-                    : { status: 'retryable', code: 'spec-author-report-invalid' };
-            }
-        },
-        review: async ({ context, state, mode, reviewerSessionId: sessionId, signal, invocationState }) => {
-            let completedAttemptId;
-            try {
-                const result = await reportOperation.run({
-                    operation: 'spec-review', runId: context.runId, worktreePath: context.worktreePath,
-                    workflowGeneration: context.workflowGeneration, signal, invocationState,
-                    forbiddenAttemptIds: state.revisions.map((revision) => revision.author.attemptId),
-                    promptFacts: [
-                        `Reviewer session ID: ${sessionId}. Review mode: ${mode}.`,
-                        `Issue authority and frozen criteria: ${canonicalJson({ issue: context.issue, frozenCriteria: context.frozenCriteria })}.`,
-                        `Immutable spec delivery state: ${canonicalJson(state)}.`,
-                    ],
-                });
-                if (result.status === 'cancelled')
-                    return { status: 'cancelled' };
-                if (result.status === 'retryable' || result.status === 'safe-halt')
-                    return { status: 'retryable', code: result.code };
-                if (result.status === 'blocked')
-                    return { status: 'blocked', kind: result.kind, code: result.code };
-                completedAttemptId = result.attemptId;
-                const raw = decodeAgentReportForValidation(result.reportBytes);
-                if (raw.mode !== mode || raw.reviewerSessionId !== sessionId || !Array.isArray(raw.coverage) || !Array.isArray(raw.defects)
-                    || !Array.isArray(raw.affectedDefectIds) || !Array.isArray(raw.affectedContracts) || !Array.isArray(raw.acceptedRisks)
-                    || typeof raw.coverageInvalidated !== 'boolean'
-                    || !['approved', 'needs-work', 'rejected'].includes(raw.verdict))
-                    return { status: 'invalid', code: 'spec-review-report-invalid', attemptId: result.attemptId };
-                const target = state.revisions.at(-1);
-                const defects = validateCodeReviewDefects(raw.defects, target.revision);
-                const report = {
-                    version: 1, targetRevision: target.revision, targetSha256: target.revisionSha256, mode,
-                    verdict: raw.verdict, reviewer: { attemptId: result.attemptId, sessionId },
-                    coverage: raw.coverage, defects,
-                    affectedDefectIds: raw.affectedDefectIds,
-                    affectedContracts: raw.affectedContracts,
-                    closureRequestSha256: mode === 'closure' ? state.review.closureRequestSha256 : null,
-                    acceptedRisks: [], coverageInvalidated: raw.coverageInvalidated,
-                };
-                return { status: 'completed', value: report, reportSha256: result.reportSha256 };
-            }
-            catch {
-                return completedAttemptId
-                    ? { status: 'invalid', code: 'spec-review-report-invalid', attemptId: completedAttemptId }
-                    : { status: 'retryable', code: 'spec-review-report-invalid' };
-            }
-        },
-    };
     const readConfig = async (requestedRoot) => {
         if (resolve(requestedRoot) !== targetRoot)
             throw new Error('runtime target root mismatch');
@@ -1237,31 +1201,17 @@ export function createV2Runtime(input) {
             codex: { ...parsed.codex, command: await resolveRuntimeCodex(parsed.codex.command) },
         };
         const path = join(targetRoot, config.runner.stateDir, 'v2', 'run-state.json');
-        if (!runRecords) {
-            const processStartIdentity = await readProcessStartIdentity(process.pid);
-            if (!processStartIdentity)
-                throw new Error('run-store owner process identity is unavailable');
-            runRecords = new FileRunRecordWriter(path, {
-                host: hostname(), bootId: input.bootId, pid: process.pid, processStartIdentity,
-                inspectProcessIdentity: async (pid) => {
-                    const identity = await readProcessStartIdentity(pid);
-                    if (identity)
-                        return { processStartIdentity: identity };
-                    try {
-                        process.kill(pid, 0);
-                        return 'unknown';
-                    }
-                    catch (error) {
-                        return isErrorCode(error, 'ESRCH') ? 'absent' : 'unknown';
-                    }
-                },
-                exclusiveRepositoryOwnership: true,
-            });
-        }
+        if (!runRecords)
+            runRecords = new FileRunRecordWriter(path);
         currentConfig = config;
         return { bytes, config };
     };
     const records = {
+        inspect: async () => {
+            if (!runRecords)
+                throw new Error('run store used before config');
+            return runRecords.inspect();
+        },
         read: async () => {
             if (!runRecords)
                 throw new Error('run store used before config');
@@ -1272,11 +1222,6 @@ export function createV2Runtime(input) {
                 throw new Error('run store used before config');
             return runRecords.compareAndSwap(generation, next);
         },
-        markPublicationEffectPossible: async () => {
-            if (!runRecords?.markPublicationEffectPossible)
-                return;
-            await runRecords.markPublicationEffectPossible();
-        },
     };
     const capabilities = createCheckedChangeCapabilities();
     const proof = {
@@ -1284,27 +1229,8 @@ export function createV2Runtime(input) {
             const config = requireConfig(currentConfig);
             const checked = capabilities.verifyAndRead(proofInput.checkedChange);
             const repoKey = sha256(checked.payload.canonicalRepository);
-            const ownerProcessIdentity = await readProcessStartIdentity(process.pid);
-            if (!ownerProcessIdentity)
-                throw new Error('proof-store owner process identity is unavailable');
-            const proofRecords = new FileProofRecordWriter(join(orchestratorHome, 'v2', repoKey, 'proofs'), {
-                host: hostname(), bootId: input.bootId, pid: process.pid, processStartIdentity: ownerProcessIdentity,
-                inspectProcessIdentity: async (pid) => {
-                    const identity = await readProcessStartIdentity(pid);
-                    if (identity)
-                        return { processStartIdentity: identity };
-                    try {
-                        process.kill(pid, 0);
-                        return 'unknown';
-                    }
-                    catch (error) {
-                        return isErrorCode(error, 'ESRCH') ? 'absent' : 'unknown';
-                    }
-                },
-                exclusiveRepositoryOwnership: true,
-            });
             const issueWorktreePath = resolve(targetRoot, config.runner.workspaceRoot, `issue-${checked.payload.issueNumber}`);
-            const worktreePath = proofInput.executionLease?.path ?? issueWorktreePath;
+            const worktreePath = proofInput.materialization?.path ?? issueWorktreePath;
             const androidLease = new FileAndroidLeaseVerifier({
                 leaseRoot: join(orchestratorHome, 'v2', repoKey, 'leases'),
                 worktreeRoot: worktreePath,
@@ -1323,10 +1249,9 @@ export function createV2Runtime(input) {
             });
             const acceptanceProof = new AcceptanceProof({
                 checkedChangeReader: capabilities,
-                proofRecords,
                 proofAgent,
-                inspectFreshness: async (payload, executionLease) => {
-                    const checkPolicySha256 = sha256(canonicalJson(resolveIssueCheckPolicy(proofInput.issue.body, config.checks).checks));
+                inspectFreshness: async (payload, materialization) => {
+                    const checkPolicySha256 = selectedConfiguredCheckPolicySha256(payload.checks, resolveIssueCheckPolicy(proofInput.issue.body, config.checks).checks);
                     if (payload.version === 1)
                         return {
                             ...await (proofFreshnessGit.snapshotIgnoringUntrackedRoot
@@ -1334,11 +1259,11 @@ export function createV2Runtime(input) {
                                 : git.snapshot(worktreePath)),
                             checkPolicySha256,
                         };
-                    if (!executionLease || !git.candidateV2)
+                    if (!materialization || !git.candidateV2)
                         throw new CandidateProofInspectionError('candidate-git-v2-required');
-                    const inspection = await git.candidateV2.inspectExecution({
+                    const inspection = await git.candidateV2.inspectMaterialization({
                         binding: payload.binding,
-                        lease: executionLease,
+                        materialization,
                         artifactDir: config.proof.artifactDir,
                     });
                     if (inspection.kind === 'failed')
@@ -1352,7 +1277,6 @@ export function createV2Runtime(input) {
                 androidLease,
                 iosLease,
                 proofArtifactDir: config.proof.artifactDir,
-                now,
                 signal: controller.signal,
             });
             const androidRelevant = !!config.proof.android && isAndroidProofRelevant(proofInput.issue, proofInput.frozenCriteria, checked.payload.changedFiles);
@@ -1360,22 +1284,11 @@ export function createV2Runtime(input) {
             const runnerPreparedArtifactSha256 = {};
             const runnerPreparationWarnings = [];
             let preparationAttempted = false;
-            if (!proofInput.workflowGeneration)
-                throw new Error('proof workflow generation is required');
-            const iosTooling = await discoverIosTooling(commandExecutor, iosXcrunPath);
-            const iosProofInputs = {
-                helperPath: join(proofInput.workflowGeneration.generationRoot, 'skills', 'acceptance-proof', 'tools', 'ios-lease.mjs'),
-                leaseRoot: join(orchestratorHome, 'v2', repoKey, 'leases'),
-                leaseArtifactPath: resolve(worktreePath, config.proof.artifactDir, proofInput.proofId, 'ios-lease.json'),
-                proofId: proofInput.proofId, ownerPid: process.pid, xcrunPath: iosXcrunPath,
-                runtimeId: iosTooling?.runtimeId ?? null, deviceTypeId: iosTooling?.deviceTypeId ?? null,
-            };
             const result = await acceptanceProof.proveChange({
                 ...proofInput,
                 runnerPreparedArtifactPaths,
                 runnerPreparedArtifactSha256,
                 runnerPreparationWarnings,
-                iosProofInputs,
                 beforeAgentLaunch: async () => {
                     await proofInput.beforeAgentLaunch?.();
                     if (!androidRelevant || preparationAttempted)
@@ -1401,10 +1314,10 @@ export function createV2Runtime(input) {
                     }
                 },
             });
-            if (checked.payload.version === 2 && proofInput.executionLease && git.candidateV2 && result.status === 'passed') {
+            if (checked.payload.version === 2 && proofInput.materialization && git.candidateV2 && result.status === 'passed') {
                 const artifacts = result.receipt.publishableEvidence.map((artifact) => ({ relativePath: artifact.ref, sha256: artifact.sha256 }));
                 const copied = await git.candidateV2.copyProofArtifacts({
-                    lease: proofInput.executionLease,
+                    materialization: proofInput.materialization,
                     issueWorktreePath,
                     artifactDir: config.proof.artifactDir,
                     proofId: proofInput.proofId,
@@ -1449,6 +1362,8 @@ export function createV2Runtime(input) {
                         id: comment.id,
                         body: comment.body,
                         authorAssociation: comment.authorAssociation,
+                        author: comment.author.login,
+                        authorId: comment.author.id,
                         createdAt: comment.createdAt,
                         updatedAt: comment.updatedAt,
                     })),
@@ -1461,9 +1376,10 @@ export function createV2Runtime(input) {
                     removeLabels: current.filter((label) => !labels.includes(label)),
                 });
             },
+            getRepositoryPermission: (login, expectedUserId) => input.issues.getRepositoryPermission(login, expectedUserId),
             transitionToBlocked: async (issueNumber, labels) => {
                 const current = await input.issues.getLabels(issueNumber);
-                if (current.includes(labels.review) || current.includes(labels.waitingHuman))
+                if (current.includes(labels.review))
                     return;
                 const hasRunnerStatus = current.some((label) => (label === labels.auto || label === labels.running || label === labels.blocked));
                 if (!hasRunnerStatus)
@@ -1480,16 +1396,17 @@ export function createV2Runtime(input) {
                 const matches = (await input.pullRequests.listAllByHeadBranch(headBranch))
                     .filter((pullRequest) => pullRequest.state === 'OPEN' && pullRequest.baseRefName === baseBranch);
                 if (matches.length > 1)
-                    throw new Error('multiple open pull requests match publication intent');
+                    throw new Error('multiple open pull requests match publication pendingEffect');
                 const match = matches[0];
                 if (!match)
                     return undefined;
+                const reviewTarget = await input.pullRequests.getReviewTarget(match.number);
                 return {
                     url: match.url,
                     body: match.body,
                     number: match.number,
                     nodeId: match.nodeId,
-                    ...(match.headSha ? { headSha: match.headSha } : {}),
+                    ...(reviewTarget ? { headSha: reviewTarget.headRefOid } : {}),
                 };
             },
             createDraft: async ({ title, body, headBranch, baseBranch }) => input.pullRequests.createDraftPullRequest({ title, body, headBranch, baseBranch }),
@@ -1500,54 +1417,10 @@ export function createV2Runtime(input) {
                 return { id: comment.id, body: comment.body };
             },
         },
-        reviewFeedback: new ReviewFeedbackCoordinator({ pullRequests: input.pullRequests, issues: input.issues, now }),
+        reviewFeedback: new ReviewFeedbackObserver({ pullRequests: input.pullRequests, issues: input.issues, now }),
         git,
-        routeCoordinator: {
-            run: ({ state, ...routeInput }) => new RouteCoordinator({
-                state,
-                operation: reportOperation,
-                now,
-                createReceipt: ({ artifact, triage, review, decidedAt }) => {
-                    if (artifact.status === 'blocked')
-                        throw new Error('blocked triage cannot create a route receipt');
-                    const receipt = {
-                        version: 1,
-                        route: artifact.status,
-                        triage,
-                        review,
-                        artifact,
-                        decisionSha256: '',
-                        decidedAt,
-                        assumptions: [...artifact.assumptions],
-                    };
-                    receipt.decisionSha256 = hashRouteDecision(receipt);
-                    return validateRouteReceipt(receipt, triage.generationHash);
-                },
-            }).run(routeInput),
-        },
-        routeContinuations: {
-            direct: async () => ({ status: 'completed' }),
-            specRequired: (context, state, signal) => new SpecCoordinator({
-                state, operation: specOperation, createAuthorSessionId: randomUUID, createReviewerSessionId: randomUUID,
-            }).run(context, signal),
-            awaitingUser: async (context, state, signal) => {
-                const config = requireConfig(currentConfig);
-                return new WaitingHumanCoordinator({
-                    issues: input.issues,
-                    labels: {
-                        auto: config.github.labels.auto.name,
-                        running: config.github.labels.running.name,
-                        blocked: config.github.labels.blocked.name,
-                        review: config.github.labels.review.name,
-                        waitingHuman: config.github.labels.waitingHuman.name,
-                    },
-                    now,
-                }).run(context, state, signal);
-            },
-        },
         implementationAgent,
         implementationReviewer,
-        waitForReviewProcessAbsence: waitForProcessGroupAbsent,
         checks: {
             supportsLaunchOwnership: true,
             run: async ({ source, command, cwd, signal, onLaunched }) => {
@@ -1566,12 +1439,56 @@ export function createV2Runtime(input) {
             await writeDurableAtomicFile(resolve(targetRoot, relativePath), `${canonicalJson({ version: 1, runId, code, summary, recordedAt: now() })}\n`);
             return { id: `evidence:${runId}:${code}`, path: relativePath };
         },
+        outcomeEvidencePath: (runId, code, summarySha256) => `${requireConfig(currentConfig).runner.stateDir}/v2/evidence/${runId}/${sha256(code)}-${summarySha256}.json`,
+        inspectOutcomeEvidence: async (path) => {
+            try {
+                return { sha256: sha256(await readRegularFile(resolve(targetRoot, path))) };
+            }
+            catch (error) {
+                if (isErrorCode(error, 'ENOENT'))
+                    return undefined;
+                throw error;
+            }
+        },
+        writeOutcomeEvidence: ({ path, bytes, sha256: expectedSha256 }) => writeExactDurableBytes(resolve(targetRoot, path), bytes, expectedSha256),
         packageVersion: input.packageVersion,
         createWorkflowGeneration: input.createWorkflowGeneration,
         verifyWorkflowGeneration,
         createRunId: input.createRunId ?? randomUUID,
         createProofId: input.createProofId ?? randomUUID,
         createReviewSessionId: input.createAttemptId ?? randomUUID,
+        processIdentity: {
+            host: hostname(),
+            bootId: input.bootId,
+            capture: async (pid, processGroupId) => {
+                const captured = await captureProcessStartIdentity({ platform: process.platform, pid, processGroupId });
+                return captured.status === 'available' ? captured.identity : undefined;
+            },
+            observe: async (identity) => ({
+                leader: await observeProcessIdentity({ platform: process.platform, ...identity }),
+                group: observeProcessGroup(identity.processGroupId),
+            }),
+        },
+        inspectAttemptResult: async (path) => {
+            try {
+                const bytes = await readRegularFile(path);
+                return { bytes, sha256: sha256(bytes) };
+            }
+            catch (error) {
+                if (isErrorCode(error, 'ENOENT'))
+                    return undefined;
+                throw error;
+            }
+        },
+        observeAttemptCleanup: async (attempt) => {
+            return observeAttemptReadViewCleanup({
+                orchestratorHome,
+                canonicalRepository: requireCanonicalRepository(currentConfig),
+                identity: attempt,
+            });
+        },
+        writeAttemptResult: ({ path, bytes, sha256: expectedSha256 }) => writeExactDurableBytes(path, bytes, expectedSha256),
+        attemptResultPath: ({ canonicalRepository, runId, attemptId }) => join(resolve(orchestratorHome), 'v2', sha256(canonicalRepository), 'runs', runId, 'attempts', attemptId, 'report.json'),
         now,
         signal: controller.signal,
     });
@@ -1624,6 +1541,24 @@ async function readRegularFile(path) {
         await handle.close();
     }
 }
+async function writeExactDurableBytes(path, bytes, expectedSha256) {
+    if (sha256(bytes) !== expectedSha256)
+        throw new Error('durable result bytes do not match expected SHA-256');
+    try {
+        const existing = await readRegularFile(path);
+        if (sha256(existing) !== expectedSha256)
+            throw new Error('durable result path already contains different bytes');
+        return;
+    }
+    catch (error) {
+        if (!isErrorCode(error, 'ENOENT'))
+            throw error;
+    }
+    await writeDurableAtomicFile(path, bytes, 0o600);
+    const observed = await readRegularFile(path);
+    if (sha256(observed) !== expectedSha256)
+        throw new Error('durable result write postcondition failed');
+}
 async function inspectRegularFile(path) {
     const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
@@ -1735,6 +1670,10 @@ async function runSpawnCheck(file, args, cwd, signal, timeoutMs, onLaunched) {
                     status: code === 0 ? 'passed' : 'failed',
                     output: Buffer.concat(chunks),
                     outputSha256: outputHash.digest('hex'),
+                    observation: {
+                        leader: 'absent',
+                        group: child.pid ? observeProcessGroup(child.pid) : 'unknown',
+                    },
                 });
             })().catch(rejectCheck);
         });
@@ -1845,8 +1784,7 @@ async function prepareContainedAttempt(input) {
         operation: input.operationId,
         bootId: input.bootId,
     });
-    const reportOnly = input.operationId === 'triage' || input.operationId === 'ambiguity-review'
-        || input.operationId === 'code-review' || input.operationId === 'spec-review';
+    const reportOnly = input.operationId === 'code-review';
     if ((reportOnly
         ? snapshot.policy.sandboxMode !== 'read-only'
             || snapshot.policy.worktreeAccess !== 'read-only'
@@ -1882,6 +1820,8 @@ async function prepareContainedAttempt(input) {
         tmpDir,
         policy: structuredClone(snapshot.policy),
         profile,
+        reviewers: Object.keys(snapshot.reviewerProfiles).sort(),
+        reviewerProfiles: structuredClone(snapshot.reviewerProfiles),
     };
 }
 async function artifactInventory(root, logicalRoot) {
@@ -1921,9 +1861,6 @@ function changedArtifactPaths(before, after) {
         .filter((path) => before.get(path) !== after.get(path))
         .sort();
 }
-function artifactInventoryMatches(actual, expected) {
-    return canonicalJson(Object.fromEntries([...actual.entries()].sort())) === canonicalJson(expected ?? null);
-}
 async function fingerprintRepositoryPath(root, relativePath) {
     const segments = relativePath.split('/');
     let current = root;
@@ -1960,63 +1897,6 @@ async function fingerprintDeniedEntry(path, existingInfo) {
     }
     return { kind: 'directory', entries };
 }
-async function waitForProcessGroupAbsent(processGroupId) {
-    while (true) {
-        try {
-            process.kill(-processGroupId, 0);
-        }
-        catch (error) {
-            if (isErrorCode(error, 'ESRCH'))
-                return;
-            if (!isErrorCode(error, 'EPERM'))
-                throw error;
-        }
-        await new Promise((resolveWait) => setTimeout(resolveWait, 1_000));
-    }
-}
-async function readProcessStartIdentity(pid) {
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return undefined;
-    if (platform() === 'linux') {
-        try {
-            const text = await readFile(`/proc/${pid}/stat`, 'utf8');
-            const close = text.lastIndexOf(') ');
-            const fields = close < 0 ? [] : text.slice(close + 2).trim().split(/\s+/u);
-            return fields[19] ? `linux:${fields[19]}` : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    return await new Promise((resolveIdentity) => {
-        execFile('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' }, (error, stdout) => {
-            const value = error ? '' : stdout.trim().replace(/\s+/gu, ' ');
-            resolveIdentity(value ? `${platform()}:${value}` : undefined);
-        });
-    });
-}
-async function inspectReportProcess(invocation) {
-    const processStartIdentity = await readProcessStartIdentity(invocation.pid);
-    let processGroupAlive;
-    try {
-        process.kill(-invocation.processGroupId, 0);
-        processGroupAlive = true;
-    }
-    catch (error) {
-        if (isErrorCode(error, 'ESRCH'))
-            processGroupAlive = false;
-        else if (isErrorCode(error, 'EPERM'))
-            processGroupAlive = true;
-        else
-            processGroupAlive = 'unknown';
-    }
-    if (!processStartIdentity) {
-        return processGroupAlive === false
-            ? { status: 'absent', processGroupAlive: false }
-            : { status: 'unknown' };
-    }
-    return { status: 'present', processStartIdentity, processGroupAlive };
-}
 export async function materializeReportReadView(input) {
     await assertDisjointReadViewPaths(input.worktreePath, input.destination);
     const deniedPaths = normalizeReadViewDeniedPaths(input.deniedPaths);