devlyn-cli 3.1.2 → 3.2.0

package/config/skills/devlyn:resolve/references/state-schema.md

@@ -54,7 +54,7 @@ Single authoritative verdict source for `/devlyn:resolve`. The orchestrator bran
 - **engine** — any engine name with a shipped adapter (`_shared/adapters/<name>.md`); `"claude"` and `"codex"` today. A required unavailable engine stops the run with `BLOCKED:<engine>-unavailable`.
 - **engine_source** — `"flag" | "engines.json" | "default"` — provenance of the resolved executor engine (`_shared/engine-preflight.md#role-resolution`). Optional on archived pre-iter-0038 runs; absent means `default`.
 - **source** — downstream contract provenance. Spec/verify-only set `type: "spec"`, `spec_path`, and `spec_sha256`. Free-form sets `type: "generated"`, `goal_path: ".devlyn/goal.raw.txt"` + exact-byte `goal_sha256`, and `criteria_path: ".devlyn/criteria.generated.md"` + raw-byte `criteria_sha256`. VERIFY re-checks its contract hash.
-- **`.devlyn/external-diff.patch` artifact** — verify-only input; the verifier consumes it only when `mode` is `"verify-only"` and fails closed if it exists in any other mode.
+- **`.devlyn/external-diff.patch` artifact** — verify-only Git patch with `a/` and `b/` path prefixes (`git diff --binary --src-prefix=a/ --dst-prefix=b/`). A zero-byte file means no changes; file-path checks reject malformed or other-prefix input. File exclusions cover both names in rename/copy headers. The verifier fails closed if the artifact exists outside `"verify-only"` mode.
 - **risk_profile** — PHASE 0 routing state. `high_risk` controls automatic risk probes; `risk_probes_enabled` / `risk_probes_explicit` preserve their current semantics; `pair_default_enabled` is false only for explicit `--no-pair`. `risk_profile` must remain an object with boolean `high_risk`, `risk_probes_enabled`, `risk_probes_explicit`, and `pair_default_enabled` fields when present, plus `reasons` as a string list. Malformed state blocks VERIFY because it can hide required routes.
 - **risk_probes_digest** — top-level sha256 written by PHASE 1.5 after probe validation; BUILD_GATE/VERIFY replay semantics live in `phases/build-gate.md` step 4.
 - **process_evidence** — absent or JSON null for legacy runs and new runs with no captured obligation; otherwise an append-only array of `{phase, round, manifest: {path, sha256}, streams: [{id, stdout: {path, sha256}, stderr: {path, sha256}}]}` carriers. Paths are worktree-relative and live under `.devlyn/process-evidence/<run_id>/<phase>/round-<round>/`. A successful IMPLEMENT completion/transition validates every sibling `spec.expected.json.process_evidence[]` item declared for `phase: "implement"`, rehashes both raw streams (including zero-byte files), and appends the carrier before accepting the checkpoint. Missing, altered, escaping, duplicate-id, or expectation-mismatched evidence blocks without a state mutation. Later phases reuse the same carrier shape; no schema-major bump is required because readers must accept absent/null legacy state.
@@ -92,13 +92,14 @@ Each entry under `phases.<name>` (for `plan`, `probe_derive`, `implement`, `surf
 }
 ```
 
-`history` is absent until a phase is re-entered. Immediately before re-entry overwrites the live lifecycle, `state-phase-write.py` appends those prior values as one object to `history[]`, creating the append-only array on first re-entry. Codex worker history also retains its state-bound `invocation_receipt`; PLAN history retains the complete prompt/output receipt.
+`history` is absent until a phase is re-entered. Immediately before re-entry overwrites the live lifecycle, `state-phase-write.py` appends those prior values as one object to `history[]`, creating the append-only array on first re-entry. Codex worker history also retains its state-bound `invocation_receipt`; PLAN history retains the complete prompt/output receipt. Owner phase history preserves output/checkpoint digests, its round and present execution kind/worker provenance; historical absence of the kind remains absent.
 
 - `verdict` — `"PASS" | "PASS_WITH_ISSUES" | "FAIL" | "NEEDS_WORK" | "BLOCKED"`. PHASE 6 (FINAL_REPORT) writes its own verdict per the terminal-verdict precedence.
-- `model_requested` / `model_effective` — `model_requested` is supplied by the orchestrator through `--model`; schema-v3 completion cannot replace the spawn engine or requested model. Schema-v3 Codex PLAN/mutation/BUILD_GATE phases validate requested dispatch using the canonical `.devlyn/<phase>.invocation.<round>.json`; state rehashes the receipt, round-scoped prompt and worker session and cross-checks model, sandbox, prompt, run, phase, round and exit. A structured native model-reroute event or malformed JSONL blocks completion, even at exit0. The receipt proves argv delivery, so `model_effective` remains null; absence of a reroute is not positive model attestation. Arbitrary paths and plaintext `model:` headers are not evidence. Claude JSON output accepts a singleton `modelUsage` key or, for multiple entries, the sole key whose token counters exactly match top-level usage. Missing/malformed evidence and requested/effective mismatch fail closed: the phase verdict becomes `BLOCKED` and completion fails.
+- `execution_kind` — owner PLAN uses `"orchestrator_context"`; owner BUILD_GATE/CLEANUP use `"orchestrator_commands"`, null engine/model fields and no worker prompt, receipt or role identity. Worker claims and current-round worker artifacts are rejected. Already-open absent-kind spans retain historical receipt validation; unknown or null kinds fail closed.
+- `model_requested` / `model_effective` — `model_requested` is supplied by the orchestrator through `--model`; schema-v3 completion cannot replace the spawn engine or requested model. Schema-v3 Codex IMPLEMENT and historical worker PLAN/CLEANUP/BUILD_GATE phases validate requested dispatch using the canonical `.devlyn/<phase>.invocation.<round>.json`; state rehashes the receipt, round-scoped prompt and worker session and cross-checks model, sandbox, prompt, run, phase, round and exit. A structured native model-reroute event or malformed JSONL blocks completion, even at exit0. The receipt proves argv delivery, so `model_effective` remains null; absence of a reroute is not positive model attestation. Arbitrary paths and plaintext `model:` headers are not evidence. Claude JSON output accepts a singleton `modelUsage` key or, for multiple entries, the sole key whose token counters exactly match top-level usage. Missing/malformed evidence and requested/effective mismatch fail closed: the phase verdict becomes `BLOCKED` and completion fails.
 - `output_sha256` — on schema-v3 PLAN completion, SHA-256 of exact `.devlyn/plan.md` bytes. Only caller-verdict BLOCKED with a lexically absent, never-bound plan records null; receipt/session attestation still applies. This terminal null permits only FINAL_REPORT lifecycle operations while the path remains lexically absent. Bound bytes are rehashed on later spawn/completion/transition, including BLOCKED; legal PLAN re-entry replaces the digest only at the new PLAN completion. FINAL_REPORT completion binds exact `.devlyn/final-report.md` bytes here and its canonical path in `artifacts.log_file`.
-- `invocation_receipt` — state-bound `{path, sha256, sandbox, sandbox_network_access, argv_sha256, exit_code}` for schema-v3 Codex PLAN/IMPLEMENT/BUILD_GATE/CLEANUP. Receipt schema 2.0 makes `sandbox` exactly `workspace-write`; `sandbox_network_access` is exactly `true` for BUILD_GATE and `false` for the other mutation phases. A missing CI capability or wider phase authority blocks before launch. Pre-2.0 receipts are intentionally rejected rather than migrated because they did not attest this capability; do not rewrite in-flight evidence. Continue through the owning session or start in a distinct worktree; restarting via explicit manual archive requires the operator to establish that prior writers stopped, never automatic archival to defeat admission refusal. A completed final report does not prove all interactive writers exited. The receipt is retained in history and rehashed before archive.
-- `triggered_by` — null on first run; one of `"build_gate" | "verify"` when the phase is a fix-loop respawn.
+- `invocation_receipt` — state-bound `{path, sha256, sandbox, sandbox_network_access, argv_sha256, exit_code}` for schema-v3 Codex IMPLEMENT and historical worker PLAN/CLEANUP/BUILD_GATE. Receipt schema 2.0 makes `sandbox` exactly `workspace-write`; `sandbox_network_access` is exactly `true` for BUILD_GATE and `false` for the other mutation phases. A missing CI capability or wider phase authority blocks before launch. Pre-2.0 receipts are intentionally rejected rather than migrated because they did not attest this capability; do not rewrite in-flight evidence. Continue through the owning session or start in a distinct worktree; restarting via explicit manual archive requires the operator to establish that prior writers stopped, never automatic archival to defeat admission refusal. A completed final report does not prove all interactive writers exited. The receipt is retained in history and rehashed before archive.
+- `triggered_by` — null on first run; one of `"build_gate" | "cleanup" | "verify"` when the phase is a fix-loop respawn.
 - `pre_sha` — captured before SURFACE_CLOSE or CLEANUP. It bounds that phase's post-spawn diff and rollback.
 - `post_sha` — captured when SURFACE_CLOSE or CLEANUP completes; finish-gate subtracts CLEANUP's `pre_sha..post_sha` window.
 - `sub_verdicts` — only populated for VERIFY: `{ "mechanical": "PASS|FAIL", "judge": "PASS|...", "pair_judge": "PASS|..." | "TIMEOUT" | null }`. Values are normalized by `verify-merge-findings.py`; model prose verdicts cannot upgrade or downgrade the deterministic findings-derived verdict. `sub_verdicts.pair_judge` is `"TIMEOUT"` when a pair judge exceeded its wall budget and a valid `.devlyn/verify.pair.timeout.json` marker was read — semantics in `references/phases/verify.md` (pair budget section).
@@ -111,9 +112,9 @@ Each entry under `phases.<name>` (for `plan`, `probe_derive`, `implement`, `surf
 
 Phase lifecycle (`started_at`/`completed_at`/`duration_ms`/`round`/`triggered_by`/`verdict`) is written by a deterministic script, never hand-edited JSON — a prior hand-edited fix-loop respawn left `started_at` stale, corrupting cross-phase ordering because `completed_at`/`round`/`triggered_by` advanced to the new round while `started_at` didn't. Phase workers report their verdict and artifact paths in their reply; they never edit `pipeline.state.json` themselves.
 
-1. **Spawn**: `state-phase-write.py --devlyn-dir .devlyn --phase <name> spawn --round <N> [--triggered-by build_gate|verify] [--pre-sha <sha>] [--engine <e>] [--model <requested-model>] [--prompt-sha256 <hex>]`. Re-entry preserves lifecycle/receipts in `history[]`, resets owned fields, and leaves fields such as `phases.implement.exec`; VERIFY also clears prior-round files. Schema-v3 Codex IMPLEMENT/BUILD_GATE/CLEANUP requires the requested model and prompt digest; an inherited top-level Codex engine is persisted into the phase rather than becoming an unattested null route. SURFACE_CLOSE inherits native Claude model settings when `--model` is omitted and rejects explicit blank models; it additionally requires `--input-patch-sha256 <hex> --prompt-sha256 <hex> --untracked-before-json <array>`; use `surface-check --authorized-surface-json <array>`, `surface-adjudication-recover --authorized-surface-json <array>` only after its adjudication-malformed result, `surface-rollback` for other failures, or `surface-skip` only for automatic Claude unavailability.
+1. **Spawn**: `state-phase-write.py --devlyn-dir .devlyn --phase <name> spawn --round <N> [--triggered-by build_gate|cleanup|verify] [--pre-sha <sha>] [--engine <e>] [--model <requested-model>] [--prompt-sha256 <hex>]`. Re-entry preserves lifecycle/receipts in `history[]`, resets owned fields, and leaves fields such as `phases.implement.exec`; VERIFY also clears prior-round files. Owner PLAN/BUILD_GATE/CLEANUP spans omit engine/model/prompt arguments. Metadata-bearing PLAN/CLEANUP calls retain the legacy worker API; owner spans cannot be relabeled as workers. Successful owner CLEANUP requires pre/post SHA equality, unchanged HEAD/tracked source and no new untracked files versus the baseline; failure closure preserves the observed delta; code/doc cleanup belongs to the selected IMPLEMENT invocation. Schema-v3 Codex IMPLEMENT and historical worker CLEANUP requires the requested model and prompt digest; an inherited top-level Codex engine is persisted into the phase rather than becoming an unattested null route. SURFACE_CLOSE inherits native Claude model settings when `--model` is omitted and rejects explicit blank models; it additionally requires `--input-patch-sha256 <hex> --prompt-sha256 <hex> --untracked-before-json <array>`; use `surface-check --authorized-surface-json <array>`, `surface-adjudication-recover --authorized-surface-json <array>` only after its adjudication-malformed result, `surface-rollback` for other failures, or `surface-skip` only for automatic Claude unavailability.
 2. **Transition** (normal direct handoff): `state-phase-write.py ... --phase <current> transition` takes the same completion/attestation arguments plus caller-specified `--next-phase`, `--next-round`, `--next-triggered-by`, `--next-engine`, `--next-model`, and next-phase metadata. It validates a fixed legal edge, applies complete plus spawn to a detached candidate, and replaces state once; either both lifecycle writes land or neither. A passing IMPLEMENT edge first validates and binds all declared process evidence through `_shared/process-evidence.py`. The verb returns JSON paths/digests/state facts only and never chooses a phase, engine, branch, prompt, or agent.
-3. **Complete** (after the orchestrator reads the phase's reply and determines the verdict, when no next phase opens): `python3 "$DEVLYN_SHARED_DIR/state-phase-write.py" --devlyn-dir .devlyn --phase <name> complete --verdict <V> [--post-sha <sha>] [--findings-file <path>] [--log-file <path>] [--engine-session-log <path>]`. Pass only the phase/round canonical worker session. SURFACE_CLOSE requires `.devlyn/surface-close.output.json` even for inherited model selection (`model_requested=null`); native JSON supplies `model_effective`, and missing/malformed evidence or an explicit model mismatch blocks completion; schema-v3 Codex PLAN/IMPLEMENT/BUILD_GATE/CLEANUP passes the wrapper-captured `.devlyn/<phase>.worker-session.<round>.jsonl` and requires its sibling invocation receipt plus `.devlyn/<phase>.prompt.<round>`. Never scan an engine-global session directory or synthesize a model header. `duration_ms` is derived from the phase's own `started_at`. `--verdict` is required except VERIFY, whose verdict remains owned by `verify-merge-findings.py --write-state`.
+3. **Complete** (after the orchestrator reads the phase's reply and determines the verdict, when no next phase opens): `python3 "$DEVLYN_SHARED_DIR/state-phase-write.py" --devlyn-dir .devlyn --phase <name> complete --verdict <V> [--post-sha <sha>] [--findings-file <path>] [--log-file <path>] [--engine-session-log <path>]`. Pass only the phase/round canonical worker session. SURFACE_CLOSE requires `.devlyn/surface-close.output.json` even for inherited model selection (`model_requested=null`); native JSON supplies `model_effective`, and missing/malformed evidence or an explicit model mismatch blocks completion; schema-v3 Codex IMPLEMENT and historical worker PLAN/BUILD_GATE/CLEANUP pass the wrapper-captured `.devlyn/<phase>.worker-session.<round>.jsonl` and requires its sibling invocation receipt plus `.devlyn/<phase>.prompt.<round>`. Never scan an engine-global session directory or synthesize a model header. `duration_ms` is derived from the phase's own `started_at`. `--verdict` is required except VERIFY, whose verdict remains owned by `verify-merge-findings.py --write-state`.
 4. **Before archive** (PHASE 6 step 5): write `.devlyn/final-report.md` with exactly one first-line `<!-- devlyn:final-report run_id=<current state.run_id> -->` and a non-whitespace body, then complete FINAL_REPORT with `--log-file .devlyn/final-report.md`. Missing, unsafe, empty or mismatched report input fails before completion; the marker proves run identity, not semantic completeness. This also applies to BLOCKED missing-PLAN-output closure. Archive rehashes a present FINAL_REPORT `output_sha256` binding before any move; missing/altered files or malformed/null bindings fail without moving artifacts. Historical states with that field absent retain existing archive behavior. Archive prune skips runs whose final_report verdict is null (treated as in-flight).
 
 ## Terminal verdict (PHASE 6)
@@ -130,7 +131,7 @@ Precedence:
 
 Header: `run_id | engine | mode | complexity | verdict | wall_time_s`.
 
-Per-phase summary table: `phase | verdict | duration_ms | round | triggered_by | findings_count`; include SURFACE_CLOSE when run or skipped.
+Per-phase summary table: `phase | verdict | duration_ms | round | triggered_by | findings_count`; include SURFACE_CLOSE when run or skipped and identify new BUILD_GATE as orchestrator commands with no separate model.
 
 Findings table: each emitted finding's `severity | rule_id | file:line | message | confidence`.
 
@@ -144,6 +145,6 @@ PHASE 6 step 4 moves `PER_RUN_PATTERNS` plus every state-bound process manifest/
 
 PHASE0 `state-phase-write.py --freeze-roles --default-engine <orchestrator-default>` freezes `role_resolution` (legacy engine/source, three role entries, input paths/digests, snapshot digest). `role_config_input` holds only the validated per-run roles object and provenance; `role_no_pair` records that flag. No config reread after freezing. Missing legacy snapshots are compatible; present null/malformed snapshots fail. The helper does not launch models.
 
-`state.engine` remains the legacy executor for unchanged PLAN/BUILD/probe routing. IMPLEMENT/CLEANUP spawn enforce frozen worker engine/model. VERIFY spawn explicitly records the primary in `phases.verify.engine`; merge, timeout and OTHER exclusion use it, falling back only when absent. Requested settings are distinct from native-observed fields. Explicit Codex worker effort binds `role_argv` against the existing invocation argv digest; effort remains dispatch evidence, not provider-internal attestation.
+`state.engine` remains the legacy executor; PLAN stays orchestrator-fixed, BUILD runs orchestrator commands, and probe routing is unchanged. IMPLEMENT (including code/doc cleanup) and historical worker CLEANUP enforce frozen worker engine/model. Owner CLEANUP does not claim that identity. VERIFY spawn explicitly records the primary in `phases.verify.engine`; merge, timeout and OTHER exclusion use it, falling back only when absent. Requested settings are distinct from native-observed fields. Explicit Codex worker effort binds `role_argv` against the existing invocation argv digest; effort remains dispatch evidence, not provider-internal attestation.
 
 Successful explicit judges retain `<engine>-judge.r<round>.*` raw/prompt/argv/derived/evidence files; `verify.role_evidence` binds their hashes, observed model/nullable effort and named evidence basis. VERIFY history preserves those bindings. Merge alone binds successful evidence; archive rehashes every bound artifact. Canonical `<engine>-judge.stdout` is the current collector input and is never substituted for the immutable round raw. Failed raw remains diagnostic and cannot become a successful binding.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "3.1.2",
+  "version": "3.2.0",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — take intent to shipped, engineer-quality software hands-free with phase-gated pipelines and agent orchestration",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {
@@ -76,6 +76,7 @@
     "scripts/lint-fixtures.sh",
     "scripts/lint-shadow-fixtures.sh",
     "scripts/lint-skills.sh",
+    "scripts/test-owner-phases.py",
     "CLAUDE.md",
     "AGENTS.md"
   ],

package/scripts/lint-skills.sh

@@ -356,7 +356,7 @@ PY
 
   incomplete="$tmp_install_marker/incomplete"
   mkdir -p "$incomplete/package" "$incomplete/home/.codex/skills" "$incomplete/claude/.claude/skills" "$incomplete/codex"
-  cp -R bin config package.json "$incomplete/package/"
+  cp -R bin config package.json AGENTS.md CLAUDE.md "$incomplete/package/"
   rm -rf "$incomplete/package/config/skills/devlyn:queue"
   printf '{"version":"stale"}\n' > "$incomplete/home/.codex/skills/.devlyn-install.json"
   printf '{"version":"stale"}\n' > "$incomplete/claude/.claude/skills/.devlyn-install.json"
@@ -569,6 +569,13 @@ if ! grep -Fq 'SAFE_RUN_ID_RE' config/skills/_shared/archive_run.py \
   bad "archive_run.py must safely archive pair/risk-probe evidence and reject unsafe run ids"
 fi
 
+section "Check 6c1: Owner phase lifecycle and scope boundaries"
+if python3 scripts/test-owner-phases.py; then
+  ok "owner phase CLI and Git regression tests passed"
+else
+  bad "owner phase CLI and Git regression tests failed"
+fi
+
 section "Check 6c2: SURFACE_CLOSE v6 dispatch is complete and mirrored"
 surface_close_missing=0
 if python3 config/skills/_shared/state-phase-write.py --self-test >/dev/null 2>&1; then
@@ -632,7 +639,7 @@ for tree in config/skills .agents/skills; do
     || ! grep -Fq -- '--tools "Read,Grep,Glob,Edit,Write" --dangerously-skip-permissions --output-format json --strict-mcp-config --mcp-config '\''{"mcpServers":{}}'\''' "$skill" \
     || ! grep -Fq '.devlyn/surface-close.output.json' "$skill" \
     || ! grep -Fq '**Common post-fix checkpoint (BUILD_GATE and VERIFY):**' "$skill" \
-    || ! grep -Fq 'durability-enforce --round <n> --origin-phase <build_gate|verify>' "$skill" \
+    || ! grep -Fq 'durability-enforce --round <n> --origin-phase <build_gate|cleanup|verify>' "$skill" \
     || ! grep -Fq '`surface-rollback`' "$skill" \
     || grep -Fq 'Supplied digests' "$phase" \
     || grep -Fq 'Hash both artifacts first' "$phase" \
@@ -1298,7 +1305,7 @@ done
 for pattern in \
   'def stage_from_expected' \
   'stage_from_expected(' \
-  'expected_found, expected_staged, expected_error, expected_path' \
+  'contract_found, _staged, expected_error, expected_path' \
   'def expected_contract_findings' \
   'correctness.forbidden-pattern' \
   'scope.max-deps-added-exceeded' \
@@ -1346,7 +1353,10 @@ for file in \
   config/skills/devlyn:resolve/SKILL.md \
   .agents/skills/devlyn:resolve/SKILL.md
 do
-  if ! grep -Fq 'resolved BUILD_GATE engine through the fresh-worker route' "$file" \
+  if ! grep -Fq 'orchestrator commands with no separate model' "$file" \
+    || ! grep -Fq 'execution_kind: "orchestrator_commands"' "$file" \
+    || grep -Fq 'resolved BUILD_GATE engine through the fresh-worker route' "$file" \
+    || grep -Fq 'Codex-routed IMPLEMENT, BUILD_GATE, or CLEANUP spawn' "$file" \
     || ! grep -Fq 'BLOCKED:build-env-underprovisioned' "$file" \
     || ! grep -Fq '.devlyn/<primary-engine>-judge.stdout' "$file" \
     || ! grep -Fq '.devlyn/<other-engine>-judge.stdout' "$file" \

package/scripts/test-owner-phases.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""Exercise the candidate's owner phases through the real CLI and Git boundary."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import runpy
+import subprocess
+import sys
+import tempfile
+import unittest
+
+SHARED = Path(__file__).resolve().parents[1] / "config/skills/_shared"
+ENV = {k: v for k, v in os.environ.items() if not k.startswith("DEVLYN_INVOCATION_")}
+ENV["PYTHONDONTWRITEBYTECODE"] = "1"
+
+
+class OwnerPhases(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.work = Path(self.temp.name).resolve()
+        self.devlyn = self.work / ".devlyn"
+        self.devlyn.mkdir()
+        self.state_path = self.devlyn / "pipeline.state.json"
+        (self.devlyn / "untracked.baseline").write_text("")
+        self.git("init", "-q")
+        self.git("config", "user.name", "Owner phase test")
+        self.git("config", "user.email", "owner@example.invalid")
+        (self.work / ".gitignore").write_text(".devlyn/\n")
+        (self.work / "source.txt").write_text("original\n")
+        self.git("add", ".")
+        self.git("commit", "-qm", "fixture")
+        self.head = self.git("rev-parse", "HEAD")
+        self.save({"version": "3.0", "run_id": "rs-owner-test", "engine": "codex",
+                   "phases": {}})
+
+    def git(self, *args):
+        return subprocess.check_output(["git", *args], cwd=self.work, text=True).strip()
+
+    def state(self):
+        return json.loads(self.state_path.read_text())
+
+    def save(self, value):
+        self.state_path.write_text(json.dumps(value))
+
+    def cli(self, phase, *args, error=None):
+        before = self.state_path.read_bytes()
+        result = subprocess.run(
+            [sys.executable, str(SHARED / "state-phase-write.py"), "--devlyn-dir", ".devlyn",
+             "--phase", phase, *args], cwd=self.work, env=ENV, capture_output=True, text=True,
+        )
+        if error:
+            self.assertNotEqual(result.returncode, 0, result.stdout)
+            self.assertIn(error, result.stderr)
+            self.assertEqual(self.state_path.read_bytes(), before)
+        else:
+            self.assertEqual(result.returncode, 0, result.stderr)
+        return result
+
+    def assert_owner(self, phase):
+        entry = self.state()["phases"][phase]
+        self.assertEqual(entry["execution_kind"],
+                         "orchestrator_context" if phase == "plan" else "orchestrator_commands")
+        for name in ("engine", "model_requested", "model_effective"):
+            self.assertIsNone(entry[name])
+        self.assertFalse({"prompt_sha256", "invocation_receipt", "role_argv"} & entry.keys())
+        return entry
+
+    def plan(self):
+        self.cli("plan", "spawn", "--round", "0")
+        self.assert_owner("plan")
+        (self.devlyn / "plan.md").write_text(
+            '<!-- devlyn:authorized-surface -->\n# Files\n```json\n'
+            '{"authorized_surface":["source.txt"]}\n```\n# Acceptance\nPreserve scope.\n')
+
+    def test_plan_digest_and_atomic_handoff(self):
+        self.plan()
+        self.cli("plan", "transition", "--verdict", "PASS", "--next-phase", "implement",
+                 "--next-round", "0", "--next-engine", "claude")
+        entry = self.assert_owner("plan")
+        self.assertEqual(entry["output_sha256"],
+                         hashlib.sha256((self.devlyn / "plan.md").read_bytes()).hexdigest())
+        self.cli("plan", "spawn", "--round", "1", "--triggered-by", "plan",
+                 error="plan-already-in-use")
+        (self.devlyn / "plan.md").write_text("widened scope")
+        self.cli("implement", "complete", "--verdict", "PASS", error="plan-integrity-mismatch")
+
+    def test_owner_identity_and_current_round_artifacts(self):
+        for phase in ("plan", "cleanup"):
+            self.save({"version": "3.0", "run_id": "rs-owner-test", "engine": "codex", "phases": {}})
+            spawn = ("spawn", "--round", "0") + (("--pre-sha", self.head) if phase == "cleanup" else ())
+            self.cli(phase, *spawn)
+            opened = self.state()
+            for flag in ("--engine", "--model", "--engine-session-log"):
+                self.cli(phase, "complete", "--verdict", "BLOCKED", flag, "false-worker",
+                         error="cannot claim worker")
+            for suffix in ("prompt.0", "worker-session.0.jsonl", "invocation.0.json", "argv.0.json"):
+                proof = self.devlyn / f"{phase}.{suffix}"
+                proof.symlink_to(self.devlyn / "missing")
+                self.cli(phase, "complete", "--verdict", "BLOCKED", error="worker evidence")
+                proof.unlink()
+            for key, value in (("engine", "codex"), ("prompt_sha256", None),
+                               ("execution_kind", False), ("execution_kind", {})):
+                bad = json.loads(json.dumps(opened))
+                bad["phases"][phase][key] = value
+                self.save(bad)
+                self.cli(phase, "complete", "--verdict", "BLOCKED", error="error:")
+            self.save(opened)
+
+    def test_owner_plan_history_is_bound_and_round_limited(self):
+        self.plan()
+        self.cli("plan", "complete", "--verdict", "NEEDS_WORK")
+        old = self.assert_owner("plan")
+        self.cli("plan", "spawn", "--round", "1", "--triggered-by", "plan")
+        self.assertEqual(self.state()["phases"]["plan"]["history"][0]["output_sha256"], old["output_sha256"])
+        self.cli("plan", "complete", "--verdict", "BLOCKED")
+        self.cli("plan", "spawn", "--round", "2", "--triggered-by", "plan", error="plan-respawn-exhausted")
+
+    def test_cleanup_checks_source_and_preserves_atomicity(self):
+        self.cli("cleanup", "spawn", "--round", "0", "--pre-sha", self.head)
+        self.assert_owner("cleanup")
+        args = ("transition", "--verdict", "PASS", "--post-sha", self.head,
+                "--next-phase", "verify", "--next-round", "0", "--next-engine", "claude")
+        (self.work / "source.txt").write_text("unverified change\n")
+        self.cli("cleanup", *args, error="owner-cleanup-source-changed")
+        self.git("add", "source.txt")
+        self.cli("cleanup", *args, error="owner-cleanup-source-changed")
+        self.git("commit", "-qm", "unverified")
+        self.cli("cleanup", *args, error="owner-cleanup-source-changed")
+        # All mutations are in this disposable test fixture.
+        self.git("reset", "--hard", self.head)
+        self.cli("cleanup", *args)
+        self.assertIsNotNone(self.state()["phases"]["verify"]["started_at"])
+
+    def test_cleanup_repair_reenters_build_with_durability(self):
+        self.cli("cleanup", "spawn", "--round", "0", "--pre-sha", self.head)
+        (self.devlyn / "cleanup.findings.jsonl").write_text("")
+        self.cli("cleanup", "transition", "--verdict", "FAIL", "--post-sha", self.head,
+                 "--next-phase", "implement", "--next-round", "1", "--next-triggered-by", "cleanup",
+                 "--next-engine", "claude")
+        self.cli("implement", "transition", "--verdict", "PASS", "--next-phase", "build_gate",
+                 "--next-round", "1", error="closure-durability")
+        self.git("commit", "--allow-empty", "-qm", "chore(pipeline): implement fix round 1")
+        self.cli("implement", "durability-enforce", "--round", "1", "--origin-phase", "cleanup")
+        self.cli("implement", "transition", "--verdict", "PASS", "--next-phase", "build_gate", "--next-round", "1")
+        self.assert_owner("build_gate")
+
+    def test_dirty_cleanup_can_fail_honestly_but_cannot_verify(self):
+        self.cli("cleanup", "spawn", "--round", "0", "--pre-sha", self.head)
+        opened = self.state_path.read_bytes()
+        (self.work / "source.txt").write_text("BUILD left a tracked change\n")
+        self.cli("cleanup", "transition", "--verdict", "FAIL", "--post-sha", self.head,
+                 "--next-phase", "verify", "--next-round", "0", error="repair before VERIFY")
+        self.cli("cleanup", "complete", "--verdict", "BLOCKED", "--post-sha", self.head)
+        self.assertEqual(self.state()["phases"]["cleanup"]["verdict"], "BLOCKED")
+        self.state_path.write_bytes(opened)
+        self.cli("cleanup", "transition", "--verdict", "FAIL", "--post-sha", self.head,
+                 "--next-phase", "implement", "--next-round", "1", "--next-triggered-by", "cleanup",
+                 "--next-engine", "claude")
+        self.assertEqual((self.work / "source.txt").read_text(), "BUILD left a tracked change\n")
+
+    def test_final_untracked_delta_cannot_bypass_scope(self):
+        (self.work / "user-existing.txt").write_text("preserve")
+        (self.devlyn / "untracked.baseline").write_text("user-existing.txt\n")
+        self.cli("cleanup", "spawn", "--round", "0", "--pre-sha", self.head)
+        (self.work / "outside-plan.txt").write_text("leak")
+        self.cli("cleanup", "complete", "--verdict", "PASS", "--post-sha", self.head,
+                 error="owner-cleanup-untracked")
+        (self.work / "outside-plan.txt").unlink()
+        (self.devlyn / "untracked.baseline").unlink()
+        self.cli("cleanup", "complete", "--verdict", "PASS", "--post-sha", self.head,
+                 error="owner-cleanup-untracked")
+        (self.devlyn / "untracked.baseline").write_text("user-existing.txt\n")
+        self.cli("cleanup", "complete", "--verdict", "PASS", "--post-sha", self.head)
+        self.assertEqual((self.work / "user-existing.txt").read_text(), "preserve")
+
+    def test_owner_cleanup_does_not_replace_selected_worker(self):
+        helper = runpy.run_path(str(SHARED / "state-phase-write.py"))
+        (self.devlyn / "engines.json").write_text(json.dumps({"roles": {
+            "worker": {"engine": "codex", "model": "gpt-6-astra", "effort": "high"}}}))
+        state = self.state()
+        frozen = helper["freeze_roles"](state, self.work, "codex")
+        self.save(state)
+        self.cli("cleanup", "spawn", "--round", "0", "--pre-sha", self.head)
+        self.assert_owner("cleanup")
+        self.assertEqual(self.state()["role_resolution"], frozen)
+        self.cli("implement", "spawn", "--round", "0", "--engine", "claude",
+                 error="role-selection-mismatch")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)