create-agdf 0.30.0 → 0.32.0

package/runtime/core/lib/control-inspect/contract.js

@@ -11,6 +11,7 @@ import {
 import { normalizeTaskTargetSource, TASK_TARGET_SOURCES } from "../task-target-resolution.js";
 import { SKILL_DISPATCH_MAX_OUTPUT_BYTES, SkillDispatchInputError, emptySkillDispatchTiming } from "../skill-dispatch/contract.js";
 import { ARTIFACT_READINESS_GATES, ALL_ACTIVE_OPERATIONS, VARIANT_OPERATION, MODULE_OPERATION, CONTROL_INSPECT_OPERATIONS, GATE_CHECK_VARIANTS, ReadSelectionError, validateReadSelection } from "./selection.js";
+import { CLOSEOUT_AUTHORING_SCOPE } from './selection.js';
 
 export const CONTROL_INSPECT_SCHEMA_VERSION = "1";
 export const CONTROL_INSPECT_CONTRACT_VERSION = 1;
@@ -29,6 +30,7 @@ function deepFreeze(value) {
 export const PRESENTATION_OPERATIONS = Object.freeze(['presentation-document', 'presentation-preview']);
 export const BOUND_INSPECT_OPERATIONS = Object.freeze(['artifact-readiness', 'authoring-inputs', 'operation-contract', 'operation-status', 'native-qualification', ...PRESENTATION_OPERATIONS, 'runtime-generations']);
 export const PRESENTATION_CATALOG_MODULE = 'agdf_prepare/presentation.prepare';
+const CLI_MODULE_HINTS = Object.freeze({ 'agdf_approve/run-approve': 'agdf_approve/approval.record' });
 const uuidSchema = { type: 'string', pattern: REVISION_ID_PATTERN.source };
 const cursorSchema = { type: 'string', maxLength: 80, pattern: '^[0-9a-f]{64}:(?:0|[1-9][0-9]{0,6})$' };
 const fieldModel = {
@@ -43,36 +45,46 @@ const fieldModel = {
   expected_revision_id: { help: 'Bound inspections use current gate-check revision. Document/preview reads preserve the original selected catalog or conversation revision.', schema: { $ref: '#/$defs/i' }, description: 'gate-check revision; original for reads.', operations: BOUND_INSPECT_OPERATIONS },
   presentation_id: { help: 'Exact prepared ID from validated catalog or conversation. Never guess, select by timestamp, or prepare a replacement to read.', schema: { $ref: '#/$defs/i' }, description: 'ID from catalog/conversation.', operations: PRESENTATION_OPERATIONS },
   target_id: { help: 'Optional confirmed target hash on target-bound reads; when supplied it must match. Required for presentation reads; never grants authority.', schema: { type: 'string', pattern: '^sha256:[0-9a-f]{64}$' }, description: 'Optional verified target hash.' },
+  bundle: { help: 'authoring-inputs only: bounded multi-document pages with exact source bytes.', schema: { type: 'boolean' }, operations: ['authoring-inputs'] },
+  authoring_scope: { help: 'Bundled authoring-inputs for a completed structured Run: read only its current OR and QA.', schema: { type: 'string', const: CLOSEOUT_AUTHORING_SCOPE }, operations: ['authoring-inputs'] },
   cursor: { help: 'Omit initially; copy next_cursor. doctor requires all_active; catalog requires its declared module. Never exchange cursor types.', schema: cursorSchema, description: 'Copy next_cursor.', operations: [...PRESENTATION_OPERATIONS, 'operation-contract', 'authoring-inputs', 'doctor'] },
   variant: { help: 'gate-check view only; never records approval.', schema: { enum: [...GATE_CHECK_VARIANTS] }, description: 'gate-check view.', operations: [VARIANT_OPERATION] },
   module: { help: 'contract: advertised module; operation-contract: group/kind; operation-status: original operation UUID from saved receipt, never a new UUID. Setup uses project.initialize/ORIGINAL_UUID without Run/revision; Run operations require Run/revision.', schema: { type: 'string', minLength: 1, maxLength: 64 }, description: 'Contract, group/kind or receipt UUID.', operations: [MODULE_OPERATION, 'operation-contract', 'operation-status'] },
   all_active: { help: 'true: doctor/delivery-map only; false: selected Run.', schema: { type: 'boolean' }, description: 'doctor/delivery-map only.' },
 };
-const selectorKeys = { gate: 'gate', expected_revision_id: 'expectedRevisionId', presentation_id: 'presentationId', target_id: 'targetId', cursor: 'cursor', variant: 'variant', module: 'contractModule', planning: 'planning' };
+const selectorKeys = { gate: 'gate', expected_revision_id: 'expectedRevisionId', presentation_id: 'presentationId', target_id: 'targetId', cursor: 'cursor', variant: 'variant', module: 'contractModule', planning: 'planning', bundle: 'bundle', authoring_scope: 'authoringScope' };
 const moduleOperations = [MODULE_OPERATION, 'operation-contract', 'operation-status'];
 const inputSchema = {
   type: 'object', additionalProperties: false,
   required: ['operation', 'presentation_language', 'working_directory'],
-  $defs: { i: uuidSchema, b: { not: { enum: CONTROL_INSPECT_OPERATIONS.filter(op => !BOUND_INSPECT_OPERATIONS.includes(op)) } }, d: { enum: PRESENTATION_OPERATIONS }, m: { enum: ['operation-contract', 'operation-status'] } },
+  $defs: {
+    i: uuidSchema,
+    b: { not: { enum: CONTROL_INSPECT_OPERATIONS.filter(op => !BOUND_INSPECT_OPERATIONS.includes(op)) } },
+    d: { enum: PRESENTATION_OPERATIONS },
+    m: { enum: ['operation-contract', 'operation-status'] },
+    u: { not: { anyOf: [{ required: ['run_id'] }, { required: ['expected_revision_id'] }] } },
+  },
   properties: Object.fromEntries(Object.entries(fieldModel).map(([name, field]) => [name, { ...field.schema, description: field.description }])),
   dependentRequired: { target_source: ['primary_target'], primary_target: ['target_source'], target_id: ['primary_target', 'target_source'] },
   dependentSchemas: Object.fromEntries(Object.entries(fieldModel).filter(([, f]) => f.operations).map(([name, field]) => [name,
-    name === 'cursor' ? { anyOf: [ { properties: { operation: { enum: [...PRESENTATION_OPERATIONS, 'authoring-inputs'] } } },
+    // Bundle selects authoring-inputs, whose Run binding requires an expected revision.
+    name === 'authoring_scope' ? { properties: { bundle: { const: true } }, required: ['bundle', 'run_id'] }
+      : name === 'cursor' ? { anyOf: [ { properties: { operation: { enum: [...PRESENTATION_OPERATIONS, 'authoring-inputs'] } } },
       { properties: { operation: { const: 'doctor' }, all_active: { const: true } }, required: ['all_active'] },
       { properties: { operation: { const: 'operation-contract' }, module: { const: PRESENTATION_CATALOG_MODULE } } } ] }
       : { properties: { operation: field.operations === BOUND_INSPECT_OPERATIONS ? { $ref: '#/$defs/b' }
         : field.operations === PRESENTATION_OPERATIONS ? { $ref: '#/$defs/d' } : name === 'module' ? { enum: moduleOperations } : { enum: field.operations } } },
   ])),
   allOf: [
-    { if: { properties: { operation: { enum: ['project-state', 'planned-inventory', 'planned-entry'] } } }, then: { required: ['target_source', 'primary_target'], not: { anyOf: [{ required: ['run_id'] }, { required: ['expected_revision_id'] }] } } },
+    { if: { properties: { operation: { enum: ['project-state', 'planned-inventory', 'planned-entry'] } } }, then: { required: ['target_source', 'primary_target'], $ref: '#/$defs/u' } },
     { if: { properties: { operation: { const: 'planned-entry' } } }, then: { required: ['planning'] } },
-    { if: { required: ['planning'] }, then: { required: ['target_source', 'primary_target'], not: { anyOf: [{ required: ['run_id'] }, { required: ['expected_revision_id'] }] } } },
+    { if: { required: ['planning'] }, then: { required: ['target_source', 'primary_target'], $ref: '#/$defs/u' } },
     { not: { properties: { all_active: { const: true } }, required: ['all_active', 'run_id'] } },
     { anyOf: [{ properties: { all_active: { const: false } } }, { properties: { operation: { enum: [...ALL_ACTIVE_OPERATIONS] } } }] },
     { if: { properties: { operation: { $ref: '#/$defs/m' } } }, then: { required: ['module'] } },
     { if: { properties: { operation: { $ref: '#/$defs/b' } } }, then: { required: ['target_source'], anyOf: [
       { required: ['run_id', 'expected_revision_id'] },
-      { not: { anyOf: [{ required: ['run_id'] }, { required: ['expected_revision_id'] }] }, oneOf: [
+      { $ref: '#/$defs/u', oneOf: [
         { properties: { operation: { const: 'operation-status' } } },
         { properties: { operation: { const: 'operation-contract' }, module: { anyOf: [{ enum: ['agdf_run/run.create', 'agdf_project/project.initialize'] }, { pattern: '/(?:planned_|run\\.create_from_planned)' }] } }, required: ['module'] },
         { properties: { operation: { const: 'authoring-inputs' } }, required: ['planning'] },
@@ -85,21 +97,17 @@ const inputSchema = {
 
 inputSchema.dependentSchemas.operation = { allOf: inputSchema.allOf };
 delete inputSchema.allOf;
-const conciseHelp = { target_source: 'Pair primary_target; explicit=named; continued=confirmed; current=unambiguous repo.', primary_target: 'Confirmed root; pair target_source.',
-  module: 'contract:index; operation-contract:group/kind; status:UUID.',
-  run_id: 'Not for inventory/project/planned.',
-  expected_revision_id: 'Bound reads only; not gate-check.',
-  planning: 'Planning reads only.',
-  target_id: 'Required for docs; gate-check.',
-  gate: 'Not for gate-check.' };
-for (const [key, field] of Object.entries(inputSchema.properties)) {
-  delete field.description;
-  if (conciseHelp[key]) field.description = conciseHelp[key];
-}
+// Full selector help is available on demand; discovery keeps the exact guards.
+for (const field of Object.values(inputSchema.properties)) delete field.description;
+Object.assign(inputSchema.properties.target_source, { description: 'Pair primary_target.' });
+Object.assign(inputSchema.properties.primary_target, { description: 'Confirmed target.' });
+Object.assign(inputSchema.properties.module, { description: 'Contract, group/kind or receipt UUID.' });
+Object.assign(inputSchema.properties.gate, { description: 'Not for gate-check.' });
+Object.assign(inputSchema.properties.target_id, { description: 'Required for docs; gate-check.' });
 
 const inspectContract = {
   name: "agdf_inspect",
-  description: 'Read-only. Ex:{"operation":"operation-contract","module":"agdf_run/run.create","working_directory":"/r","target_source":"explicit_target","primary_target":"/r"}. navigation.next_calls sequentially; read all pages; never dispatch. Setup status: project.initialize/UUID, no Run/revision. Run status: original UUID+run_id+expected_revision_id.',
+  description: 'Read only. Use next_action.call. Raw bound reads need working_directory,presentation_language,primary_target,target_source. Run status needs run_id+expected_revision_id. Setup omits both.',
   annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   inputSchema: projectMcpInputSchema(inputSchema),
   outputSchema: {
@@ -175,14 +183,42 @@ export function inspectContractHelp() {
   });
 }
 
+function correctedOperationModule(module) {
+  if (typeof module !== 'string' || module.length > 64 || OPERATION_CONTRACT_MODULES.includes(module)) return null;
+  const exact = CLI_MODULE_HINTS[module];
+  if (exact && OPERATION_CONTRACT_MODULES.includes(exact)) return exact;
+  const kind = module.split('/').at(-1);
+  const matches = OPERATION_CONTRACT_MODULES.filter(value => value.split('/').at(-1) === kind);
+  return matches.length === 1 ? matches[0] : null;
+}
+
+// A new read-only schema lookup for one unambiguous registered owner. This
+// preserves explicit bindings; it never executes or repairs the invalid request.
+export function inspectModuleRecoveryCall(input) {
+  if (!input || input.operation !== 'operation-contract') return null;
+  const module = correctedOperationModule(input.module);
+  const allowed = new Set(['operation', 'module', 'working_directory', 'primary_target', 'target_source',
+    'presentation_language', 'run_id', 'expected_revision_id', 'gate', 'target_id']);
+  if (!module || Object.keys(input).some(key => !allowed.has(key))) return null;
+  for (const key of ['working_directory', 'primary_target', 'target_source', 'run_id'])
+    if (!Object.hasOwn(input, key) || schemaDiagnostics(input[key], fieldModel[key].schema).length) return null;
+  if (!isAbsolute(input.working_directory) || !isAbsolute(input.primary_target)
+    || typeof input.expected_revision_id !== 'string' || !REVISION_ID_PATTERN.test(input.expected_revision_id)
+    || input.presentation_language !== undefined && schemaDiagnostics(input.presentation_language, fieldModel.presentation_language.schema).length
+    || input.gate !== undefined && !APPROVAL_GATES.includes(input.gate)
+    || input.target_id !== undefined && (typeof input.target_id !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(input.target_id))) return null;
+  return { tool: 'agdf_inspect', arguments: { ...input, module } };
+}
+
 export function inspectInputValidationHint(input) {
   if (!input || typeof input !== 'object' || !CONTROL_INSPECT_OPERATIONS.includes(input.operation)) return '';
   const operation = input.operation, messages = [];
+  let diagnosedModule = input.module;
   if (operation === 'operation-contract' && typeof input.module === 'string' && input.module.length <= 64
     && !OPERATION_CONTRACT_MODULES.includes(input.module)) {
-    const kind = input.module.split('/').at(-1);
-    const matches = OPERATION_CONTRACT_MODULES.filter(module => module.split('/').at(-1) === kind);
-    messages.push(matches.length === 1 ? `Use module ${matches[0]}; this is the registered owner of ${kind}.`
+    const correction = correctedOperationModule(input.module);
+    if (correction) diagnosedModule = correction; // Help only; the original invalid request remains rejected.
+    messages.push(correction ? `Use module ${correction}; the original module is invalid and was not executed.`
       : 'Read contract without module for the registered operation_modules; do not guess a group/kind.');
   }
   for (const [name, field] of Object.entries(fieldModel)) {
@@ -194,8 +230,8 @@ export function inspectInputValidationHint(input) {
   // Diagnose the selected operation, rather than making the model interpret
   // errors from every alternative of the discovery schema's oneOf branches.
   const unboundContract = operation === 'operation-contract' &&
-    (['agdf_run/run.create', 'agdf_project/project.initialize'].includes(input.module)
-      || OPERATION_CONTRACT_MODULES.includes(input.module) && /\/(?:planned_|run\.create_from_planned)/u.test(input.module));
+    (['agdf_run/run.create', 'agdf_project/project.initialize'].includes(diagnosedModule)
+      || OPERATION_CONTRACT_MODULES.includes(diagnosedModule) && /\/(?:planned_|run\.create_from_planned)/u.test(diagnosedModule));
   const bound = BOUND_INSPECT_OPERATIONS.includes(operation) && !unboundContract
     && !(operation === 'operation-status' && !input.run_id && !input.expected_revision_id)
     && !(operation === 'authoring-inputs' && input.planning);
@@ -254,6 +290,7 @@ export function parseControlInspectFunctionArguments(argumentsValue, trustedCont
 
 // Shared language, target and read-selection rules; errors carry the invalid field.
 export function normalizeControlInspectInput(input) {
+  if (input.bundle !== undefined && typeof input.bundle !== 'boolean') throw new SkillDispatchInputError('bundle', 'bundle must be boolean');
   const operation = requireText(input.operation, "operation", 64);
   if (!CONTROL_INSPECT_OPERATIONS.includes(operation)) throw new SkillDispatchInputError("operation", `Unsupported inspect operation: ${operation}`);
   let requestedPresentationLanguage;
@@ -276,6 +313,9 @@ export function normalizeControlInspectInput(input) {
     throw new SkillDispatchInputError('target_id', 'A valid target hash requires a confirmed target');
   const runId = input.runId || null;
   const planning = input.planning;
+  if (input.authoringScope !== undefined && (input.authoringScope !== CLOSEOUT_AUTHORING_SCOPE
+    || input.bundle !== true || !runId || planning !== undefined))
+    throw new SkillDispatchInputError('authoring_scope', 'Closeout scope requires a bundled Run read');
   if (planning !== undefined && (schemaDiagnostics(planning, PLANNING_SCOPE_SCHEMA).length || runId || input.expectedRevisionId !== undefined || input.gate !== undefined
     || !primaryTarget || !fieldModel.planning.operations.includes(operation))) throw new SkillDispatchInputError('planning', 'Planning requires one exact pre-Run source scope and confirmed target; no Run/revision/gate');
   if (operation === 'operation-status' && Boolean(planning) !== /^(?:planned_ur\.|run\.create_from_planned\/)/u.test(input.contractModule ?? ''))
@@ -336,7 +376,7 @@ export function normalizeControlInspectInput(input) {
     target_source: targetSource,
     primary_target: primaryTarget,
     run_id: runId,
-    planning,
+    planning, bundle: input.bundle, authoring_scope: input.authoringScope,
     gate: input.gate,
     expected_revision_id: input.expectedRevisionId,
     presentation_id: input.presentationId, target_id: input.targetId, cursor: input.cursor,

package/runtime/core/lib/control-inspect/material-recording-calls.js

@@ -0,0 +1,54 @@
+import { resolveTaskTarget } from '../task-target-resolution.js';
+import { preparedCommandCall } from '../control-state/prepared-control-calls.js';
+import { inspectUxIntentDecision, UX_DECISION_FORMAT } from '../control-evaluation/definition-sources.js';
+import { validateRunCommand } from '../control-state/run-command-schema.js';
+import { inspectAuthoringInputs } from './authoring-inputs.js';
+
+// Mirrors an explicit author declaration; never chooses a judgement or review.
+export function withUxSourceDecision(form, content) {
+  const observed = inspectUxIntentDecision(content);
+  const source_validation = { ...observed, format: UX_DECISION_FORMAT, authorizes: false };
+  if (!observed.well_formed || !observed.supported || observed.decision === 'not_applicable') return {
+    source_validation: { ...source_validation, recordable: false,
+      reason: !observed.well_formed ? 'ux_decision_malformed' : 'ux_decision_not_supported_for_required_analysis',
+      instruction: 'Correct the explicit - decision: field in the authored report, then stage the corrected bytes with the new material_call. No canonical record was attempted; choose ready or blocked from actual analysis, never from this diagnostic.' } };
+  const filled = structuredClone(form);
+  filled.call.arguments.command.payload.decision = observed.decision;
+  filled.required_inputs = filled.required_inputs.filter(p => p !== '/command/payload/decision');
+  filled.state = validateRunCommand(filled.call.tool, filled.call.arguments).length ? 'requires_author_input' : 'ready';
+  return { form: filled, source_validation: { ...source_validation, recordable: true,
+    decision_origin: 'exact explicit author declaration in staged source; not generated judgement' } };
+}
+
+// Reuse the canonical author/source selection, including analytical prerequisites
+// at an outer gate. Transport itself cannot choose a future/protected writer.
+export function withMaterialRecordingCalls(input, result) {
+  if (result.outcome !== 'accepted' || input.planning || !['put', 'seal'].includes(input.command.payload.action)) return result;
+  try {
+    const target = resolveTaskTarget({ workingDirectory: input.working_directory, primaryTarget: input.primary_target, targetSource: input.target_source });
+    if (target.resolution_state !== 'resolved') return result;
+    const authoring = inspectAuthoringInputs(target.governance_target, input);
+    if (!authoring.available || authoring.revision_id !== input.expected_revision_id) return result;
+    const slot = authoring.material_call?.call.arguments.command.payload.files[0].slot;
+    const files = (result.family_result.files ?? []).filter(file => file.reference && file.slot === slot);
+    if (files.length !== 1 || !authoring.formats?.available) return result;
+    const { group, kind } = authoring.formats;
+    if (kind === 'closeout.record') {
+      if (!['structured_delivery', 'structured_slice'].includes(authoring.mode)
+          || authoring.next_operation?.type !== 'record_closeout' || authoring.authoring_owner !== 'OR' || slot !== 'OR') return result;
+    } else if (!['step.record', 'artefact.record', 'ur_draft.replace'].includes(kind)) return result;
+    const form = preparedCommandCall(group, kind, input,
+      { gate: authoring.authoring_owner, material: files[0].reference, recording: authoring.recording });
+    if (kind === 'closeout.record' && form?.state !== 'ready') return result;
+    if (form && authoring.authoring_owner === 'UX Intent Definition' && input.command.payload.action === 'put') {
+      const text = input.command.payload.files.find(file => file.slot === slot)?.content;
+      if (typeof text === 'string') {
+        const checked = withUxSourceDecision(form, text);
+        return { ...result, source_validation: checked.source_validation,
+          ...(checked.form ? { recording_calls: [{ slot, ...checked.form }] }
+            : { recording_calls: [], material_call: authoring.material_call }) };
+      }
+    }
+    return form && !form.required_inputs.includes('/command/payload') ? { ...result, recording_calls: [{ slot, ...form }] } : result;
+  } catch { return result; } // Guidance cannot conceal an accepted private transfer.
+}

package/runtime/core/lib/control-inspect/project-state.js

@@ -37,7 +37,8 @@ export function inspectProjectState(root, input, gitObservation) {
       ? projectOperationStatusCall({ ...input, operation_id: original }) : null;
     const report = { available: true, target_id, repository, plan: inspectCanonicalInitializationPlan(), ...state,
       setup: { tool: 'agdf_project', kind: 'project.initialize', binding: { schema_version: '1', assurance: 'cooperative_local', ...common, target_id },
-        required_agent_fields: ['operation_id'], requires_explicit_intent: true }, next_calls: [...(next ? [next] : []), ...(statusCall ? [statusCall] : [])],
+        required_agent_fields: ['operation_id'], requires_explicit_intent: true }, next_calls: next ? [next] : [],
+      ...(statusCall ? { recovery_only: { status_call: statusCall, authorizes: false } } : {}),
       ...(input.operation === 'operation-status' ? { operation_id: input.operation_id, status: state.operation_status, current_setup: state.status } : {}),
       ...(state.status === 'pending' ? { recovery: { action: 'replay_original', operation_id: state.operation.operation_id,
         request_digest: state.operation.request_digest, instruction: 'Replay only the saved original project.initialize UUID/payload. Owned stage, target, plan and producer are revalidated before any effect.', authorizes: false } } : {}),

package/runtime/core/lib/control-inspect/run-classification.js

@@ -0,0 +1,31 @@
+// Read-only run classification shared by the Codex cockpit and the companion run view (companion core
+// SDD-001, SDD-003). It lives apart from the cockpit so every runtime profile carries it, Copilot
+// included, whose projection leaves the private cockpit out. Nothing here evaluates a gate rule.
+import { ENDED_LIFECYCLES } from '../control-state/run-operations.js';
+
+// The read-failure codes passed through unchanged, and every code `boundedCode` can return.
+const READ_FAILURE_CODES = Object.freeze(['resource_denied', 'source_changed', 'timeout', 'resource_limit', 'read_failed']);
+export const BOUNDED_READ_CODES = Object.freeze(['control_layout_unsupported', 'run_version_unsupported', 'control_invalid', ...READ_FAILURE_CODES]);
+
+// Bounded reason code of a read failure.
+export function boundedCode(error) {
+  const code = error.code ?? error.message;
+  if (code === 'AGDF_CONTROL_LAYOUT_UNSUPPORTED' || code === 'control_layout_unsupported') return 'control_layout_unsupported';
+  if (code === 'AGDF_RUN_VERSION_UNSUPPORTED') return 'run_version_unsupported';
+  // The configuration owner's codes (resources/configuration.js configurationError).
+  if (code === 'AGDF_CONTROL_LAYOUT_INVALID' || code === 'configuration_invalid') return 'control_invalid';
+  return READ_FAILURE_CODES.includes(error.code) ? error.code : 'read_failed';
+}
+
+// Read-only projection of the evaluated decision, never a second gate evaluator.
+// Doctor warnings are already considered by evaluateGateCheck; they are not a UI veto.
+export function projectCockpitAssessment(report, lifecycle) {
+  const state = ENDED_LIFECYCLES.includes(lifecycle) ? 'ended'
+    : lifecycle === 'completed' ? report.completion?.fulfilled === true ? 'completed' : 'unconfirmed'
+    : lifecycle !== 'active' ? 'unconfirmed'
+    : report.status === 'blocked' || (report.blocking_reason && report.blocking_reason !== 'none')
+      || (report.missing_approval && report.missing_approval !== 'none') ? 'blocked'
+    : report.status === 'open' && report.blocking_reason === 'none' && report.missing_approval === 'none' ? 'open'
+    : 'unconfirmed';
+  return { state, authorizes: false };
+}

package/runtime/core/lib/control-inspect/selection.js

@@ -2,6 +2,12 @@
 
 export const ARTIFACT_READINESS_GATES = Object.freeze(['UR', 'PRD', 'SD', 'TP']);
 export const CONTROL_INSPECT_OPERATIONS = Object.freeze(["doctor", "gate-check", "delivery-map", "contract", "artifact-readiness", "authoring-inputs", "operation-contract", "operation-status", "native-qualification", "presentation-document", "presentation-preview", "runtime-generations", "project-state", "inventory", "planned-inventory", "planned-entry"]);
+export const CLOSEOUT_AUTHORING_SCOPE = 'delivery-closeout';
+
+export function isCompletedStructuredCloseout(control, mode) {
+  return control.current_gate === 'OR' && control.completion?.fulfilled === true
+    && ['structured_delivery', 'structured_slice'].includes(mode);
+}
 export const ALL_ACTIVE_OPERATIONS = Object.freeze(["doctor", "delivery-map"]);
 export const VARIANT_OPERATION = "gate-check";
 export const MODULE_OPERATION = "contract";

package/runtime/core/lib/control-inspect/service.js

@@ -1,5 +1,6 @@
 import { baseResult, bindHostAction } from "./result.js";
 import { inspectArtefactRecordingMode } from '../control-state/run-artefact-recording.js';
+import { preparedCommandCall } from '../control-state/prepared-control-calls.js';
 import { inspectProjectState } from './project-state.js';
 import process from "node:process";
 import { DISPATCH_RECOVERY } from "../interaction-catalog.js";
@@ -10,8 +11,9 @@ import { readRuntimeContract, runtimeContractModules } from "../resources/contra
 import { renderSkillDispatchInputRecovery, renderSkillDispatchRecovery, renderTaskTargetOrientation, renderActiveRunInventory, renderRunInventory } from "../interaction-presentation.js";
 import { resolveTaskTarget, TaskTargetInputError } from "../task-target-resolution.js";
 import { SKILL_DISPATCH_PRESENTATION_LANGUAGE_RECOVERY, SkillDispatchInputError, emptySkillDispatchTiming } from "../skill-dispatch/contract.js";
-import { CONTROL_INSPECT_CONTRACT_VERSION, CONTROL_INSPECT_SCHEMA_VERSION, ReadSelectionError, normalizeControlInspectInput, inspectContractHelp, OPERATION_CONTRACT_MODULES, PRESENTATION_CATALOG_MODULE } from "./contract.js";
+import { CONTROL_INSPECT_CONTRACT_VERSION, CONTROL_INSPECT_SCHEMA_VERSION, ReadSelectionError, normalizeControlInspectInput, inspectContractHelp, inspectModuleRecoveryCall, OPERATION_CONTRACT_MODULES, PRESENTATION_CATALOG_MODULE } from "./contract.js";
 import { RUN_COMMAND_DESCRIPTORS, operationContract } from '../control-state/run-command-contract.js';
+import { PROPOSAL_COMMAND_KINDS, PROPOSAL_MATERIAL_SLOT } from '../control-state/run-command-schema.js';
 import { inspectRunOperation } from '../control-state/run-operation-status.js';
 import { resolveControlCommandTarget } from '../control-state/approval-command-contract.js';
 import { readRunState } from '../control-evaluation/run-state.js';
@@ -132,6 +134,19 @@ export function createControlInspectService(dependencies = {}) {
       result.diagnostics = [{ code: "inspect_input_invalid", field,
         ...(inputError?.allowedValues?.length ? { allowed_values: [...inputError.allowedValues] } : {}),
       }];
+      if (field === 'module') {
+        const supplied = { operation: rawInput.operation,
+          ...Object.fromEntries([['module', 'contractModule'], ['working_directory', 'workingDirectory'],
+            ['primary_target', 'primaryTarget'], ['target_source', 'targetSource'], ['presentation_language', 'presentationLanguage'],
+            ['run_id', 'runId'], ['expected_revision_id', 'expectedRevisionId'], ['gate', 'gate'], ['target_id', 'targetId']]
+            .filter(([, key]) => rawInput[key] !== undefined).map(([field, key]) => [field, rawInput[key]])) };
+        // Preserve unsupported selectors too, so they prevent a misleading
+        // executable suggestion rather than disappearing from the new lookup.
+        for (const [field, key] of [['presentation_id', 'presentationId'], ['cursor', 'cursor'], ['planning', 'planning'], ['all_active', 'allActive']])
+          if (rawInput[key] !== undefined) supplied[field] = rawInput[key];
+        const next = inspectModuleRecoveryCall(supplied);
+        if (next) result.recovery.next_calls = [next];
+      }
       return bindHostAction(result);
     }
     timing.input_ms = round(milliseconds(started, now()));
@@ -208,7 +223,7 @@ export function createControlInspectService(dependencies = {}) {
             if (!valid) return { report: { available: false, reason: 'operation_binding_stale_or_invalid', authorizes: false }, presentation: null };
             if (input.operation === 'runtime-generations') return { report: dependencies.runtimeControl?.status()
               ?? { available: false, reason: 'connection_control_unavailable', authorizes: false }, presentation: null };
-            const decision = gateCheck(target.governance_target, { runId: input.run_id, presentationLanguage: input.presentationLanguage });
+            const decision = gateCheck(target.governance_target, { runId: input.run_id, presentationLanguage: input.presentation_language });
             return { report: { available: true, run_id: input.run_id, revision_id: state.meta.revision_id,
               ui_rendering_support: 'unknown', action_qualification: { qualified: false, reason: 'host_context_unavailable', authorizes: false },
               business_readiness: { current_gate: decision.current_gate, status: decision.status,
@@ -221,15 +236,27 @@ export function createControlInspectService(dependencies = {}) {
                 next_calls: [{ tool: input.group, kind: input.kind, instruction: contract.planning_capture?.instructions
                   ?? 'Use the confirmed planning scope and original UUID; no Run/revision. Planning never approves a gate. Start a Run only from a deliberately selected complete source.' }] }, presentation: null };
             }
-            if (['agdf_run', 'agdf_project'].includes(input.group) && !input.run_id) return { report: { ...operationContract(input.group, input.kind),
+            if (['agdf_run', 'agdf_project'].includes(input.group) && !input.run_id) {
+              const prepared = preparedCommandCall(input.group, input.kind, { ...input, presentation_language: input.presentation_language,
+                target_id: resolveControlCommandTarget(target.governance_target).target_id });
+              return { report: { ...operationContract(input.group, input.kind),
               binding: { target_id: resolveControlCommandTarget(target.governance_target).target_id },
-              next_calls: [{ tool: input.group, kind: input.kind, instruction: input.group === 'agdf_project' ? 'Explicit fixed setup only. Use the confirmed existing Git root and one original UUID. No Run/revision, force, repair, install or approval.' : 'Use a new original operation UUID and confirmed title; there is no prior Run/revision.' }] }, presentation: null };
+              prepared_call: prepared, next_calls: prepared?.state === 'ready' ? [prepared.call] : [],
+              next_action: input.group === 'agdf_project' ? 'Explicit fixed setup only. No Run, repair, installation or approval.'
+                : 'Fill the prepared title from the authorized original request, preserving its UUID and target. No prior Run/revision.' }, presentation: null };
+            }
             const state = readRunState(target.governance_target, { runId: input.run_id });
             const targetId = resolveControlCommandTarget(target.governance_target).target_id;
             const valid = parseRunState(state.content, input.run_id).valid && state.meta?.revision_id === input.expected_revision_id
               && runSealState(target.governance_target, state.content).status === 'valid';
             return { report: valid ? { ...operationContract(input.group, input.kind, { gate: input.gate ?? state.current_gate }),
+              prepared_call: preparedCommandCall(input.group, input.kind, { ...input, presentation_language: input.presentation_language, target_id: targetId },
+                { gate: input.gate ?? state.current_gate, recording: inspectArtefactRecordingMode(state, input.gate ?? state.current_gate) }),
               ...(input.kind === 'artefact.record' ? { recording: inspectArtefactRecordingMode(state, input.gate ?? state.current_gate) } : {}),
+              // Revision proposals are staged in their own slot. Offer that staging form with the
+              // revision commands and beside a material.stage form, whose prepared_call uses the gate's slot.
+              ...(PROPOSAL_COMMAND_KINDS.includes(input.kind) || input.kind === 'material.stage' ? { material_call: preparedCommandCall('agdf_record', 'material.stage',
+                { ...input, presentation_language: input.presentation_language, target_id: targetId }, { gate: PROPOSAL_MATERIAL_SLOT }) } : {}),
               ...(input.contract_module === PRESENTATION_CATALOG_MODULE ? {
                 inspect_contract: inspectContractHelp(),
                 presentation_catalog: readPresentationCatalog(target.governance_target, { runId: input.run_id,
@@ -243,7 +270,7 @@ export function createControlInspectService(dependencies = {}) {
                 quality_records: sourceRevisionQualityFacts(state, path => { try { return readHistoryBytes(target.governance_target, path).toString('utf8'); } catch { return undefined; } }),
               } } : {}),
               binding: { target_id: targetId, run_id: input.run_id, expected_revision_id: input.expected_revision_id },
-              current: (() => { const decision = gateCheck(target.governance_target, { runId: input.run_id, presentationLanguage: input.presentationLanguage });
+              current: (() => { const decision = gateCheck(target.governance_target, { runId: input.run_id, presentationLanguage: input.presentation_language });
                 return { current_gate: decision.current_gate, lifecycle: state.meta.lifecycle, status: decision.status, missing_approval: decision.missing_approval,
                   next_operation: decision.next_operation, completion: decision.completion,
                   artefacts: [...state.artefacts].filter(([type]) => ['UR', 'PRD', 'SD', 'TP', 'Brownfield Review', 'UX Intent Definition', 'Brownfield Analysis', 'CD+Tests', 'TP Review', 'Clean Implementation Review', 'CR', 'QA', 'OR'].includes(type))

package/runtime/core/lib/control-inspect/work-situation.js

@@ -0,0 +1,25 @@
+// Presentation of one canonical control assessment. This module never evaluates or authorizes work.
+export function projectWorkSituation({ assessment, gate, blockingReason, missingApproval, closureOutcome, persistedGate, persistedNext, nextAllowedAction } = {}) {
+  if (persistedGate !== undefined && (persistedGate !== gate || !(assessment === 'ended' && closureOutcome) && persistedNext !== nextAllowedAction)) assessment = 'unconfirmed';
+  let kind = 'unconfirmed';
+  if (assessment === 'open') kind = gate === 'CD+Tests' ? 'in_progress' : 'open';
+  else if (assessment === 'blocked') {
+    kind = blockingReason === 'presentation_version_decided' ? 'revision_required'
+      : blockingReason === 'none' && missingApproval === `Approval: ${gate}` ? 'approval_required'
+      : gate === 'UR' && blockingReason === 'AGDF_UR_REQUIREMENTS_INCOMPLETE' ? 'clarification_required' : 'blocked';
+  } else if (assessment === 'completed') kind = 'completed';
+  else if (assessment === 'ended' && closureOutcome) kind = 'ended';
+  const values = {
+    revision_required: ['clarification_required', 'Revision required', 'Überarbeitung nötig'],
+    approval_required: ['decision_required', 'Approval required', 'Freigabe erforderlich'],
+    clarification_required: ['clarification_required', 'Clarification required', 'Klärung erforderlich'],
+    in_progress: ['in_progress', 'In implementation', 'In Umsetzung'],
+    open: ['in_progress', 'Work may continue', 'Weiterarbeit offen'],
+    blocked: ['blocked', 'Blocked', 'Blockiert'],
+    completed: ['none', 'Completed', 'Vorhaben abgeschlossen'],
+    ended: ['none', 'Ended', 'Vorhaben beendet'],
+    unconfirmed: ['unclear', 'Current conditions unconfirmed', 'Aktuelle Voraussetzungen nicht bestätigt'],
+  };
+  const [code, en, de] = values[kind];
+  return { kind, code, en, de };
+}

package/runtime/core/lib/control-read/cockpit-worker.js

@@ -18,6 +18,7 @@ parentPort.on('message', ({ id, operation, selector, snapshot, input }) => {
       : operation === 'planned' ? reader.planned(selector, snapshot)
       : operation === 'artifact_readiness' ? reader.artifactReadiness(input.run_id, snapshot, input.gate, input.expected_revision_id)
       : operation === 'document' ? reader.document(selector, snapshot, input?.run_id)
+      : operation === 'preview' ? reader.preview(selector, snapshot, input?.run_id)
       : operation === 'freshness' ? reader.freshness(snapshot)
       : operation === 'context' ? reader.context(selector, snapshot)
       : operation === 'prepare_context' ? reader.prepareContext(input)

package/runtime/core/lib/control-state/authoring-text-handoff.js

@@ -0,0 +1,3 @@
+// Shared guidance for passing authored bytes; never an additional file reader,
+// an authoring result or authority to record an artefact.
+export const AUTHORING_TEXT_HANDOFF = 'Pass Markdown as UTF-8 string data, never executable code. Prefer structured tool input. If the host uses JavaScript, author with its file-editing tool and pass a UTF-8 file read as content; never embed the document in backtick literals.';

package/runtime/core/lib/control-state/input-resolution.js

@@ -2,7 +2,7 @@ import { CURRENT_LAYOUT } from './run-identity.js';
 // Shared representation, not a file owner or replay ledger. Existing operation
 // families alone validate, persist and recover their versioned records.
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { isAbsolute } from 'node:path';
+import { isAbsolute, posix, win32 } from 'node:path';
 import { canonicalJson, exactObject, DIGEST_PATTERN } from './approval-command-contract.js';
 import { runCommandRequestDigest } from './run-command-schema.js';
 import { canonicalizeLanguageTag } from '../interaction-presentation.js';
@@ -28,7 +28,9 @@ export function createInputResolution(original, effective, configuration) {
     operation_id: original.operation_id ?? null, kind: original.command?.kind ?? null,
     fields: Object.fromEntries(paths.filter(path => get(original, path) === undefined && get(effective, path) !== undefined).map(path => [path, get(effective, path)])), configuration };
 }
-export function validInputResolution(value) {
+export function validInputResolution(value, { persisted = false } = {}) {
+  // Stored paths describe the writer's host. Live requests still use the serving host's paths.
+  const absolutePath = persisted ? path => posix.isAbsolute(path) || win32.isAbsolute(path) : isAbsolute;
   if (!exactObject(value, ['schema_version', 'logical_digest', 'effective_digest', 'operation_id', 'kind', 'fields', 'configuration']) || value.schema_version !== 1
     || !(value.operation_id === null || typeof value.operation_id === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u.test(value.operation_id))
     || !(value.kind === null || typeof value.kind === 'string' && /^[a-z_]+\.[a-z_]+$/u.test(value.kind) && value.kind.length <= 64)
@@ -36,14 +38,14 @@ export function validInputResolution(value) {
     || Buffer.byteLength(canonicalJson(value)) > 8192 || Object.keys(value.fields).some(key => !paths.includes(key))) return false;
   const f = value.fields, c = value.configuration;
   if (Object.hasOwn(f, 'presentation_language') && !tag(f.presentation_language)
-    || Object.hasOwn(f, 'working_directory') && (typeof f.working_directory !== 'string' || !isAbsolute(f.working_directory) || f.working_directory.length > 4096)
+    || Object.hasOwn(f, 'working_directory') && (typeof f.working_directory !== 'string' || !absolutePath(f.working_directory) || f.working_directory.length > 4096)
     || Object.hasOwn(f, 'schema_version') && f.schema_version !== '1'
     || Object.hasOwn(f, 'assurance') && f.assurance !== 'cooperative_local'
     || Object.hasOwn(f, 'variant') && !['status-card', 'approval-envelope'].includes(f.variant)
     || Object.hasOwn(f, 'command.payload.route') && !['markdown', 'automatic', 'fallback'].includes(f['command.payload.route'])) return false;
   if (!exactObject(c, ['root', 'control', 'config_digest', 'values', 'sources', 'defaults_digest', 'control_layout'])
     || (c.control === 'active' ? c.control_layout !== CURRENT_LAYOUT : c.control_layout !== null)
-    || !(c.root === null || typeof c.root === 'string' && isAbsolute(c.root) && c.root.length <= 4096) || !['inactive', 'active'].includes(c.control)
+    || !(c.root === null || typeof c.root === 'string' && absolutePath(c.root) && c.root.length <= 4096) || !['inactive', 'active'].includes(c.control)
     || !(c.config_digest === null || hash(c.config_digest)) || !hash(c.defaults_digest)
     || !exactObject(c.values, preferenceKeys) || !exactObject(c.sources, preferenceKeys)
     || !tag(c.values.chat_language) || !tag(c.values.artifact_language)
@@ -82,7 +84,7 @@ export function resolutionRecord(record) {
   const { input_resolution: extension, ...body } = record;
   if (!plain(extension)) return null;
   const { record_version, ...resolution } = extension;
-  if (!['string', 'number'].includes(typeof record_version) || !validInputResolution(resolution)) return null;
+  if (!['string', 'number'].includes(typeof record_version) || !validInputResolution(resolution, { persisted: true })) return null;
   // Pending journals retain the owning family's digest (approval/revision have
   // their own domain digest). The committed receipt binds the full command and
   // journal recovery cross-checks both retained resolutions below that owner.

package/runtime/core/lib/control-state/material-limits.js

@@ -0,0 +1,4 @@
+// Private transfer limits; direct text is bounded independently from a multipart piece.
+// The existing 64 KiB canonical command budget additionally bounds every JSON request.
+export const MATERIAL_LIMITS = Object.freeze({ inline: 49152, part: 16384, file: 131072, set: 524288, sets: 4, total: 2097152,
+  lifetime: 600000, idle: 120000 });