npm - gestalt-mobile - Versions diffs - 0.28.0 → 0.30.0 - Mend

gestalt-mobile 0.28.0 → 0.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (22) hide show

package/dist/client/index.html CHANGED Viewed

@@ -16,8 +16,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     <link rel="icon" href="/icons/gestalt-mobile-192.png" />
     <link rel="apple-touch-icon" href="/icons/gestalt-mobile-180.png" />
     <title>Gestalt Mobile</title>
-    <script type="module" crossorigin src="/assets/index-Bz23puhw.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-B7x1bL59.css">
+    <script type="module" crossorigin src="/assets/index-mKzhyiTl.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C79AKZvE.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/server/server/composition.js CHANGED Viewed

@@ -35,7 +35,9 @@ import { mapWithConcurrency } from './platform/runtime/concurrency.js';
 import { RelaySession, } from './features/sessions/model/relay-session.js';
 import { AgentActivityRegistry } from './features/agent-activity/registry.js';
 import { decodeAgentActivityFacts } from './platform/codex/activity-facts.js';
-import { resolvedServerRequestId, toPendingInteraction } from './platform/codex/server-request.js';
+import { isAutopilotWaitLeaseCall, resolvedServerRequestId, toPendingInteraction, } from './platform/codex/server-request.js';
+import { parseOrgPlanCheckpoint, toOrgPlanCheckpointToolResponse, } from '../shared/contracts/org-plan-checkpoint.js';
+import { validOrgPlanCheckpoint } from './features/org-plan-checkpoint/application/validate.js';
 import { isValidInteractionResponse, isValidQuizInteractionResponse, } from './features/sessions/interaction/response-validator.js';
 import { promoteRecentThread } from './features/sessions/promote-recent-thread/use-case.js';
 import { FilesystemSkillProfileStore } from './platform/skills/filesystem-skill-profile-store.js';
@@ -49,9 +51,10 @@ import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-com
 import { PlanMeasurementRefresh } from './platform/plans/plan-measurement-refresh.js';
 import { SqliteAutopilotStore } from './platform/persistence/sqlite-autopilot-store.js';
 import { AutopilotCoordinator } from './features/autopilot/application/service.js';
-import { AUTOPILOT_CONTINUATION_PROMPT, AUTOPILOT_EXECUTOR_CONTINUATION_PROMPT, defaultAutopilotPolicy, } from './features/autopilot/application/policy.js';
+import { AUTOPILOT_CONTINUATION_PROMPT, AUTOPILOT_EXECUTOR_CONTINUATION_PROMPT, autopilotExecutorLaunchPrompt, defaultAutopilotPolicy, } from './features/autopilot/application/policy.js';
 import { createRelyingPartyConfig } from './config.js';
 import { parseOrgPlanAttention } from '../shared/contracts/org-plan-attention.js';
+import { autopilotWaitLeaseToolResponse, } from '../shared/contracts/autopilot-wait-lease.js';
 const generatedProtocolVersion = 'codex-cli 0.144.3';
 export async function composeRelayApp(options) {
     const passkeyAuthEnabled = options.passkeyAuthEnabled ?? true;
@@ -217,7 +220,7 @@ export async function composeRelayApp(options) {
                     throw new Error('AUTOPILOT_START_UNAVAILABLE');
                 await options.autopilotBeforeTurnAccepted?.({ sessionId, controlId });
                 const continuationPrompt = launchIdentity
-                    ? `${AUTOPILOT_CONTINUATION_PROMPT} Launch task_name ${launchIdentity.taskName} for canonical ${launchIdentity.canonicalPosition}; retain the canonical label in status and review output.`
+                    ? autopilotExecutorLaunchPrompt(launchIdentity)
                     : AUTOPILOT_CONTINUATION_PROMPT;
                 const started = await runtime.startTurn(writer.session, continuationPrompt, controlId, new Date().toISOString());
                 if (!started.activeTurnId)
@@ -333,6 +336,7 @@ export async function composeRelayApp(options) {
         events.publish(journal.append(sessionId, 'interaction.resolved', { requestId, turnId: interaction?.turnId ?? null, resolvedAt: occurredAt, outcome }, occurredAt));
         if (interaction?.kind === 'orgPlanAttention')
             events.publish(journal.append(sessionId, 'org-plan.attention-resolved', { requestId, turnId: interaction.turnId ?? null, resolvedAt: occurredAt, outcome }, occurredAt));
+        autopilot.semanticEvent(sessionId, 'interactionChanged');
     };
     const publishAttentionSettlement = (sessionId, requestId, occurredAt, outcome) => {
         const remaining = interactions.list(sessionId);
@@ -379,7 +383,7 @@ export async function composeRelayApp(options) {
         autopilot.planStatusChanged(sessionId);
     };
     runtime = options.startAppServers
-        ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification) => {
+        ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification, origin) => {
             const occurredAt = new Date().toISOString();
             for (const activityFact of decodeAgentActivityFacts(sessionId, occurredAt, notification))
                 activity.observe(activityFact);
@@ -395,7 +399,18 @@ export async function composeRelayApp(options) {
                 }
             }
             const currentSession = sessions.find(sessionId);
-            const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, currentSession?.workspacePath, currentSession?.activeTurnId);
+            const completionTurnId = notification.method === 'turn/completed' &&
+                notification.params &&
+                typeof notification.params === 'object' &&
+                typeof notification.params.turn?.id === 'string'
+                ? notification.params.turn.id
+                : undefined;
+            // A completion with no thread identity is only root-owned when it exactly
+            // matches the durable active root turn; unknown child turns never fall back.
+            const resolvedOrigin = origin.kind === 'unknown' && completionTurnId === currentSession?.activeTurnId
+                ? { ...origin, kind: 'root' }
+                : origin;
+            const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, currentSession?.workspacePath, currentSession?.activeTurnId, resolvedOrigin);
             if (!normalized)
                 return;
             let completedSession;
@@ -412,11 +427,60 @@ export async function composeRelayApp(options) {
             events.publish(journal.append(sessionId, normalized.type, normalized.payload, normalized.occurredAt));
             if (completedSession)
                 events.publish(journal.append(sessionId, 'session.updated', completedSession, occurredAt));
-        }, (sessionId, request) => {
+        }, (sessionId, request, origin) => {
             const rawInteraction = toPendingInteraction(request);
             const session = withPendingInteractions(sessions.find(sessionId));
-            if (!rawInteraction || !session)
+            if (!session)
+                return false;
+            if (!rawInteraction && isAutopilotWaitLeaseCall(request)) {
+                const rootOwned = origin.kind === 'root' && origin.physicalTurnId === session.activeTurnId;
+                if (rootOwned)
+                    autopilot.rejectProbe(sessionId);
+                return (runtime?.resolveServerRequest(sessionId, String(request.id), autopilotWaitLeaseToolResponse()) === true);
+            }
+            if (!rawInteraction)
                 return false;
+            if (rawInteraction.kind === 'autopilotWaitLease') {
+                const lease = rawInteraction.payload;
+                const rootOwned = origin.kind === 'root' && origin.physicalTurnId === session.activeTurnId;
+                const accepted = rootOwned &&
+                    autopilot.reportProbe(sessionId, {
+                        id: lease.reportId,
+                        kind: 'wait',
+                        leaseId: lease.leaseId,
+                        wakeConditions: lease.wakeConditions,
+                    });
+                if (!accepted) {
+                    if (rootOwned)
+                        autopilot.rejectProbe(sessionId);
+                    return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, autopilotWaitLeaseToolResponse()) === true);
+                }
+                return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, autopilotWaitLeaseToolResponse()) === true);
+            }
+            if (rawInteraction.kind === 'orgPlanCheckpoint') {
+                const checkpoint = parseOrgPlanCheckpoint(rawInteraction.payload);
+                const retained = supervisedPlans.find(sessionId);
+                const identity = supervisedPlans.identity(sessionId);
+                const rootOwned = origin.kind === 'root' && origin.physicalTurnId === session.activeTurnId;
+                if (!checkpoint ||
+                    !retained ||
+                    !identity ||
+                    checkpoint.planIdentity !== identity ||
+                    !rootOwned)
+                    return false;
+                const valid = validOrgPlanCheckpoint({
+                    checkpoint,
+                    plan: retained,
+                    planIdentity: identity,
+                    rootOwned,
+                    hasActiveL1Writer: (position) => hasActiveL1Writer(activity.snapshot(sessionId, new Date().toISOString()), position),
+                });
+                if (!valid)
+                    return false;
+                if (!autopilot.checkpointAccepted(sessionId, checkpoint, session.activeTurnId, new Date().toISOString()))
+                    return false;
+                return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, toOrgPlanCheckpointToolResponse()) === true);
+            }
             const interaction = {
                 ...rawInteraction,
                 turnId: session.activeTurnId,
@@ -431,6 +495,7 @@ export async function composeRelayApp(options) {
                     ? { attentionReason: interaction.payload.reason }
                     : {}),
             });
+            autopilot.semanticEvent(sessionId, 'interactionChanged');
             const updated = RelaySession.rehydrate(session).requestInteraction(interaction, new Date().toISOString()).snapshot;
             sessions.save(updated);
             events.publish(journal.append(sessionId, 'interaction.requested', interaction, updated.updatedAt));
@@ -959,3 +1024,7 @@ function resolveStateDatabasePath(root, stateHome) {
     const legacyPath = legacyRelayStatePath(root, stateHome);
     return existsSync(legacyPath) ? legacyPath : currentPath;
 }
+function hasActiveL1Writer(snapshot, position) {
+    return snapshot.subagents.some((child) => child.canonicalPosition === position &&
+        ['working', 'awaitingAgent', 'awaitingHuman'].includes(child.state));
+}

package/dist/server/server/features/autopilot/application/policy.js CHANGED Viewed

@@ -3,9 +3,16 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-export const AUTOPILOT_PROMPT_VERSION = 'v3';
-export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. For a subagent dedicated to that position, use the collaboration-safe task_name l<a> or l<a>_<b> and refer to it by its canonical L label. Invoke gestalt_org_plan_attention only for a decision-table blocker; otherwise immediately perform the next legal lifecycle action. Do not send a status-only response.';
+export const AUTOPILOT_PROMPT_VERSION = 'v5';
+export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. For a subagent dedicated to that position, use the collaboration-safe task_name l<a> or l<a>_<b> and refer to it by its canonical L label. Invoke gestalt_org_plan_attention only for a decision-table blocker. When the Autopilot probe is active, register gestalt_autopilot_wait_lease with an observable wake condition, declare genuine attention, or immediately do actionable work; never acknowledge waiting in prose. Do not send a status-only response.';
 export const AUTOPILOT_EXECUTOR_CONTINUATION_PROMPT = 'Continue the same assigned Org L1 from its durable state. A prior turn ending did not complete the objective. Consume any supplied process result, take the next legal L2 action, and report only at the L1 review boundary or through structured attention.';
+/** Builds a physical launch instruction while keeping durable L1 identity canonical. */
+export function autopilotExecutorLaunchPrompt(identity) {
+    const launch = `Launch task_name ${identity.taskName} for canonical ${identity.canonicalPosition}; retain the canonical label in status and review output.`;
+    if (identity.generation === 1)
+        return `${AUTOPILOT_CONTINUATION_PROMPT} ${launch}`;
+    return `${AUTOPILOT_CONTINUATION_PROMPT} ${launch} This is replacement generation ${identity.generation}: the durable ${identity.canonicalTaskName} slot may remain reserved. Do not reuse that task_name or attempt to change an existing agent's model in place. Interrupt the previous physical executor if it is still running, then spawn ${identity.taskName} with agent_type worker and an explicit model selected by the supervisor. Transfer sole ${identity.canonicalPosition} ownership and continue from its durable Org Plan and worktree state.`;
+}
 export const defaultAutopilotPolicy = Object.freeze({
     quiescenceMs: 1_000,
     staleAfterMs: 30_000,
@@ -59,12 +66,23 @@ export function decideAutopilot(input) {
         return { kind: 'disable', reason: 'manualDisabled' };
     if (!plan)
         return { kind: 'disable', reason: 'planRequired' };
-    if (executionComplete(plan))
+    if (executionComplete(plan)) {
+        // Checkpoint-aware sessions deliberately reserve a later root turn for
+        // terminal whole-branch review.  The Org projection remains authoritative:
+        // this only controls whether a completed L1 may end the current report turn.
+        if (state.checkpoints?.protocolVersion === 1 && !state.checkpoints.terminalReviewAccepted)
+            return {
+                kind: 'scheduleContinuation',
+                at: new Date(Date.parse(now) + policy.backoffMs(state.consecutiveNoProgress)).toISOString(),
+            };
         return { kind: 'complete' };
+    }
     // Quiz, approval, and other held requests are ordinary session work. Only a
     // validated Org attention record may turn an incomplete plan into a human stop.
     if (hasPendingInteraction)
         return { kind: 'observe' };
+    if ((input.automaticActionCount ?? 0) > policy.actionLimit)
+        return { kind: 'safetyPause', reason: 'actionRateExceeded' };
     if (!activity || activity.confidence !== 'fresh')
         return { kind: 'reconcile' };
     if (Date.parse(now) - Date.parse(activity.root.lastActivityAt) > policy.staleAfterMs)

package/dist/server/server/features/autopilot/application/service.js CHANGED Viewed

@@ -3,15 +3,19 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+import { createHash } from 'node:crypto';
 import { autopilotSnapshot, disabledAutopilot, } from '../domain/autopilot-session.js';
 import { classifyExecutorOutcome, decideSupervisedLifecycle, executorIdentity, validStructuredBlock, } from '../domain/supervised-lifecycle.js';
 import { classifyAgentActivity, decideAutopilot, executionComplete, } from './policy.js';
+import { consumeObservableWake, recordAutomaticContinuation, recoverSafetyPause, reportProbe, semanticProgressKey, startSupervisionProtocol, } from '../domain/supervision-protocol.js';
 export class AutopilotCoordinator {
     deps;
     timers = new Map();
     completionTimers = new Map();
     executorTimers = new Map();
     publishedSnapshots = new Map();
+    planEventKeys = new Map();
+    activityEventKeys = new Map();
     /** Serializes asynchronous watchdog and timer work per relay session. */
     operations = new Map();
     constructor(deps) {
@@ -35,7 +39,7 @@ export class AutopilotCoordinator {
             !session ||
             !session.threadId ||
             !state.requestedEnabled ||
-            ['disabled', 'attentionRequired', 'completed'].includes(state.state))
+            ['disabled', 'attentionRequired', 'completed', 'safetyPaused'].includes(state.state))
             return;
         // A relay restart deliberately drops its writer before rehydrating the
         // coordinator. The plan-status watcher is authoritative and asynchronous,
@@ -77,6 +81,88 @@ export class AutopilotCoordinator {
     }
     dispose(sessionId) {
         this.cancelTimer(sessionId);
+        this.planEventKeys.delete(sessionId);
+        this.activityEventKeys.delete(sessionId);
+    }
+    /** Accepts a session-owned structured probe response; no transcript text is inspected. */
+    reportProbe(sessionId, report) {
+        const state = this.deps.store.find(sessionId);
+        if (!state?.requestedEnabled)
+            return false;
+        const nextProtocol = reportProbe(state.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), report);
+        if (nextProtocol === state.supervision)
+            return false;
+        const now = this.deps.now();
+        this.persist({
+            ...state,
+            supervision: nextProtocol,
+            ...(nextProtocol.outcome === 'attentionRequired'
+                ? {
+                    state: 'attentionRequired',
+                    requestedEnabled: false,
+                    stopReason: 'attentionRequired',
+                }
+                : {}),
+            updatedAt: now,
+        });
+        if (nextProtocol.outcome === 'parked' || nextProtocol.outcome === 'attentionRequired')
+            this.cancelTimer(sessionId);
+        return true;
+    }
+    /** Fails closed only for the currently active bounded probe. */
+    rejectProbe(sessionId) {
+        const state = this.deps.store.find(sessionId);
+        if (!state?.requestedEnabled || state.supervision?.outcome !== 'probeRequired')
+            return false;
+        const now = this.deps.now();
+        const cancelled = this.cancelScheduledControl(state, now);
+        this.cancelTimer(sessionId);
+        this.persist({
+            ...state,
+            state: 'safetyPaused',
+            requestedEnabled: false,
+            generation: state.generation + 1,
+            nextEvaluationAt: null,
+            ...(cancelled ? { lastControlId: null } : {}),
+            stopReason: 'safetyPaused',
+            supervision: {
+                ...state.supervision,
+                outcome: 'safetyPaused',
+                safetyPauseReason: 'invalidProbeReport',
+            },
+            updatedAt: now,
+        }, cancelled, [
+            {
+                sessionId,
+                type: 'autopilot.safety-paused',
+                payload: { reason: 'invalidProbeReport' },
+                occurredAt: now,
+            },
+        ]);
+        return true;
+    }
+    /** A durable matching wake grants the one retry and schedules no work by itself. */
+    observableWake(sessionId, wake) {
+        const state = this.deps.store.find(sessionId);
+        if (!state?.requestedEnabled || !state.supervision)
+            return false;
+        const nextProtocol = consumeObservableWake(state.supervision, wake);
+        if (nextProtocol === state.supervision)
+            return false;
+        this.persist({ ...state, supervision: nextProtocol, updatedAt: this.deps.now() });
+        this.evaluate(sessionId);
+        return true;
+    }
+    /** Wakes a parked lease only when this semantic event was explicitly requested. */
+    semanticEvent(sessionId, condition) {
+        const lease = this.deps.store.find(sessionId)?.supervision?.waitLease;
+        if (!lease || !lease.wakeConditions.includes(condition))
+            return false;
+        return this.observableWake(sessionId, {
+            leaseId: lease.id,
+            condition,
+            progressKey: this.progressKey(sessionId),
+        });
     }
     enable(sessionId) {
         const session = this.deps.session(sessionId);
@@ -106,6 +192,7 @@ export class AutopilotCoordinator {
             stopReason: null,
             executor: undefined,
             blocking: undefined,
+            supervision: recoverSafetyPause(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         };
         this.persist(next);
@@ -136,6 +223,7 @@ export class AutopilotCoordinator {
             ...(cancelled ? { lastControlId: null } : {}),
             stopReason: 'manualDisabled',
             blocking: undefined,
+            supervision: recoverSafetyPause(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         };
         this.persist(next, cancelled);
@@ -259,6 +347,17 @@ export class AutopilotCoordinator {
                     updatedAt: now,
                 };
                 break;
+            case 'safetyPause':
+                next = {
+                    ...prior,
+                    state: 'safetyPaused',
+                    requestedEnabled: false,
+                    generation: prior.generation + 1,
+                    nextEvaluationAt: null,
+                    stopReason: 'safetyPaused',
+                    updatedAt: now,
+                };
+                break;
             case 'disable':
                 next = {
                     ...prior,
@@ -274,12 +373,14 @@ export class AutopilotCoordinator {
         }
         if (decision.kind === 'requestAttention' ||
             decision.kind === 'complete' ||
-            decision.kind === 'disable')
+            decision.kind === 'disable' ||
+            decision.kind === 'safetyPause')
             this.cancelTimer(sessionId);
         if (next !== prior) {
             const cancelled = decision.kind === 'requestAttention' ||
                 decision.kind === 'complete' ||
-                decision.kind === 'disable'
+                decision.kind === 'disable' ||
+                decision.kind === 'safetyPause'
                 ? this.cancelScheduledControl(prior, now)
                 : undefined;
             this.persist(cancelled ? { ...next, lastControlId: null } : next, cancelled);
@@ -294,11 +395,31 @@ export class AutopilotCoordinator {
             state?.stopReason === 'planRemoved' ||
             state?.stopReason === 'planReplaced' ||
             state?.stopReason === 'sessionEnded';
+        const checkpointBoundary = Boolean(state?.checkpoints?.pendingTurnId &&
+            state.checkpoints.planIdentity === this.deps.plan(sessionId)?.identity);
         const finalAllowed = !state ||
             !plan ||
             explicitlyStopped ||
-            executionComplete(plan) ||
+            checkpointBoundary ||
+            (!state.checkpoints && executionComplete(plan)) ||
             validStructuredBlock(state.blocking);
+        if (checkpointBoundary && state?.checkpoints) {
+            const occurredAt = this.deps.now();
+            this.persist({
+                ...state,
+                checkpoints: { ...state.checkpoints, pendingTurnId: null },
+                updatedAt: occurredAt,
+            }, undefined, [
+                {
+                    sessionId,
+                    type: state.checkpoints.terminalReviewAccepted
+                        ? 'org-plan.terminal-review-reported'
+                        : 'org-plan.milestone-reported',
+                    payload: { turnId: state.checkpoints.pendingTurnId },
+                    occurredAt,
+                },
+            ]);
+        }
         if (!finalAllowed) {
             const occurredAt = this.deps.now();
             this.commit({
@@ -316,6 +437,47 @@ export class AutopilotCoordinator {
         this.activitySettled(sessionId, 'rootFinalAttempt');
         return finalAllowed;
     }
+    /** Records an already validated root-only checkpoint; it never changes Org state. */
+    checkpointAccepted(sessionId, checkpoint, turnId, occurredAt) {
+        const prior = this.deps.store.find(sessionId);
+        const retained = this.deps.plan(sessionId);
+        if (!prior || !retained || !turnId || checkpoint.planIdentity !== retained.identity)
+            return false;
+        const previous = prior.checkpoints;
+        if (previous && previous.planIdentity !== retained.identity)
+            return false;
+        const reported = previous?.reportedL1Ids ?? [];
+        const key = createHash('sha256').update(JSON.stringify(checkpoint)).digest('hex');
+        const acceptedKeys = previous?.acceptedKeys ?? [];
+        if (acceptedKeys.includes(key))
+            return true;
+        if (checkpoint.kind === 'l1Accepted' && reported.includes(checkpoint.l1Id))
+            return false;
+        if (checkpoint.kind === 'terminalReviewAccepted' && previous?.terminalReviewAccepted)
+            return false;
+        const checkpoints = {
+            protocolVersion: 1,
+            planIdentity: retained.identity,
+            reportedL1Ids: checkpoint.kind === 'l1Accepted' ? [...reported, checkpoint.l1Id] : reported,
+            acceptedKeys: [...acceptedKeys, key],
+            pendingTurnId: turnId,
+            terminalReviewAccepted: checkpoint.kind === 'terminalReviewAccepted' || previous?.terminalReviewAccepted === true,
+        };
+        this.persist({ ...prior, checkpoints, updatedAt: occurredAt }, undefined, [
+            {
+                sessionId,
+                type: checkpoint.kind === 'l1Accepted'
+                    ? 'org-plan.milestone-checkpointed'
+                    : 'org-plan.terminal-review-checkpointed',
+                payload: checkpoint.kind === 'l1Accepted'
+                    ? { l1Id: checkpoint.l1Id, position: checkpoint.position, turnId }
+                    : { turnId },
+                occurredAt,
+            },
+        ]);
+        this.semanticEvent(sessionId, 'checkpointChanged');
+        return true;
+    }
     /** Handles only plan lifecycle safety; ordinary plan mutations are ignored. */
     planStatusChanged(sessionId) {
         const prior = this.deps.store.find(sessionId);
@@ -330,8 +492,16 @@ export class AutopilotCoordinator {
             this.cancel(sessionId, 'planReplaced');
             return;
         }
-        if (executionComplete(plan.plan))
+        if (this.semanticEvent(sessionId, 'planChanged') ||
+            this.semanticEvent(sessionId, 'reviewChanged'))
+            return;
+        if (executionComplete(plan.plan)) {
+            const eventKey = `plan:${fingerprint(plan.plan)}`;
+            if (this.planEventKeys.get(sessionId) === eventKey)
+                return;
+            this.planEventKeys.set(sessionId, eventKey);
             this.evaluate(sessionId);
+        }
     }
     /**
      * Records a validated, session-private supervision request.  It intentionally
@@ -386,6 +556,25 @@ export class AutopilotCoordinator {
         const activity = this.deps.activity(sessionId);
         if (!activity || activity.confidence !== 'fresh')
             return;
+        const eventKey = JSON.stringify({
+            root: [activity.root.state, activity.root.reason],
+            children: activity.subagents.map((child) => [
+                child.id,
+                child.state,
+                child.reason,
+                child.continuationGeneration ?? 0,
+                (child.ownedProcesses ?? []).map((process) => [
+                    process.processId,
+                    process.state,
+                    process.ownership,
+                ]),
+            ]),
+        });
+        if (this.activityEventKeys.get(sessionId) === eventKey)
+            return;
+        this.activityEventKeys.set(sessionId, eventKey);
+        if (this.semanticEvent(sessionId, 'agentActivityChanged'))
+            return;
         const disposition = classifyAgentActivity(activity);
         if (disposition === 'attention') {
             this.evaluate(sessionId);
@@ -528,6 +717,39 @@ export class AutopilotCoordinator {
             await this.enforceSupervisedLifecycle(sessionId, 'stateChanged');
             return;
         }
+        const protocol = recordAutomaticContinuation(current.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId));
+        if (protocol.outcome === 'probeRequired') {
+            this.persist({ ...current, supervision: protocol, updatedAt: this.deps.now() }, undefined, [
+                {
+                    sessionId,
+                    type: 'autopilot.probe-required',
+                    payload: { progressKey: protocol.progressKey },
+                    occurredAt: this.deps.now(),
+                },
+            ]);
+        }
+        if (protocol.outcome === 'safetyPaused') {
+            const now = this.deps.now();
+            const cancelled = this.cancelScheduledControl(current, now);
+            this.persist({
+                ...current,
+                state: 'safetyPaused',
+                requestedEnabled: false,
+                stopReason: 'safetyPaused',
+                ...(cancelled ? { generation: current.generation + 1, lastControlId: null } : {}),
+                nextEvaluationAt: null,
+                supervision: protocol,
+                updatedAt: now,
+            }, cancelled, [
+                {
+                    sessionId,
+                    type: 'autopilot.safety-paused',
+                    payload: { progressKey: protocol.progressKey },
+                    occurredAt: now,
+                },
+            ]);
+            return;
+        }
         const id = current.lastControlId;
         if (!id)
             return;
@@ -585,8 +807,9 @@ export class AutopilotCoordinator {
             this.deps.pendingInteraction(sessionId))
             return false;
         const executor = this.currentExecutor(sessionId, retained.plan, state.consecutiveNoProgress, state.executor);
-        if (executor)
-            this.persistExecutor(sessionId, executor);
+        const executorChanged = executor ? this.persistExecutor(sessionId, executor) : false;
+        if (executorChanged && this.wakeForExecutorChange(sessionId, executor))
+            return true;
         const decision = decideSupervisedLifecycle({
             plan: retained.plan,
             event,
@@ -611,7 +834,11 @@ export class AutopilotCoordinator {
                 return true;
             case 'monitorProcess': {
                 const processId = decision.action.process.processId;
-                controller.transferProcess(sessionId, decision.action.process.ownerThreadId, processId);
+                const alreadyMonitoring = executor?.ownedProcesses.some((process) => process.processId === processId &&
+                    process.ownership === 'supervisor' &&
+                    process.state === 'detached-active');
+                if (!alreadyMonitoring)
+                    controller.transferProcess(sessionId, decision.action.process.ownerThreadId, processId);
                 if (executor)
                     this.persistExecutor(sessionId, {
                         ...executor,
@@ -619,10 +846,11 @@ export class AutopilotCoordinator {
                             ? { ...process, ownership: 'supervisor', state: 'detached-active' }
                             : process),
                     });
-                this.audit(sessionId, 'autopilot.process-monitoring', {
-                    threadId: decision.action.process.ownerThreadId,
-                    processId,
-                });
+                if (!alreadyMonitoring)
+                    this.audit(sessionId, 'autopilot.process-monitoring', {
+                        threadId: decision.action.process.ownerThreadId,
+                        processId,
+                    });
                 this.armExecutorRefresh(sessionId, decision.action.pollAfterMs);
                 return true;
             }
@@ -724,8 +952,22 @@ export class AutopilotCoordinator {
     persistExecutor(sessionId, executor) {
         const current = this.deps.store.find(sessionId);
         if (!current || JSON.stringify(current.executor) === JSON.stringify(executor))
-            return;
+            return false;
         this.persist({ ...current, executor, updatedAt: this.deps.now() });
+        return true;
+    }
+    wakeForExecutorChange(sessionId, executor) {
+        const processes = executor.ownedProcesses;
+        const conditions = [
+            ...(processes.some((process) => process.state === 'exited-awaiting-result')
+                ? ['processExited', 'processResultAvailable']
+                : []),
+            ...(processes.some((process) => process.state === 'terminated-for-budget')
+                ? ['processLimitBreached']
+                : []),
+            'executorChanged',
+        ];
+        return conditions.some((condition) => this.semanticEvent(sessionId, condition));
     }
     freshExecutorIdentity(sessionId) {
         const plan = this.deps.plan(sessionId)?.plan;
@@ -900,6 +1142,8 @@ export class AutopilotCoordinator {
         return 'unknown';
     }
     decision(sessionId, state) {
+        if (state.supervision?.outcome === 'parked')
+            return { kind: 'observe' };
         const plan = this.deps.plan(sessionId);
         const now = this.deps.now();
         return decideAutopilot({
@@ -914,6 +1158,48 @@ export class AutopilotCoordinator {
             policy: this.deps.policy,
         });
     }
+    progressKey(sessionId) {
+        const retained = this.deps.plan(sessionId);
+        const activity = this.deps.activity(sessionId);
+        const interactions = this.deps.pendingInteraction(sessionId)
+            ? [{ id: 'pending', kind: 'session', state: 'pending' }]
+            : [];
+        return semanticProgressKey({
+            plan: {
+                identity: retained?.identity ?? 'none',
+                fingerprint: retained ? fingerprint(retained.plan) : 'none',
+                currentPosition: retained?.plan.currentStepId ?? null,
+            },
+            review: { status: null },
+            checkpoint: {
+                pendingTurnId: this.deps.store.find(sessionId)?.checkpoints?.pendingTurnId ?? null,
+                terminalReviewAccepted: this.deps.store.find(sessionId)?.checkpoints?.terminalReviewAccepted ?? false,
+            },
+            pendingInteractions: interactions,
+            executor: {
+                generation: this.deps.store.find(sessionId)?.executor?.continuationGeneration ?? 0,
+                state: this.deps.store.find(sessionId)?.executor?.outcome ?? null,
+            },
+            ownedProcesses: (this.deps.store.find(sessionId)?.executor?.ownedProcesses ?? []).map((process) => ({
+                id: process.processId,
+                state: process.state,
+                ownerGeneration: this.deps.store.find(sessionId)?.executor?.continuationGeneration ?? 0,
+            })),
+            agentActivity: [
+                ...(activity
+                    ? [
+                        {
+                            agentId: 'root',
+                            // Activity time is liveness-only; semantic progress uses the
+                            // sequenced state projection, never the observation clock.
+                            sequence: 0,
+                            state: activity.root.state,
+                        },
+                    ]
+                    : []),
+            ],
+        });
+    }
     async reconcile(sessionId, generation) {
         try {
             const result = await this.deps.reconcile(sessionId);