nccgs 2.0.0-rc.2 → 2.0.0

package/.claude/nccgs/tools/orchestration.mjs

@@ -1,12 +1,18 @@
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { artifact, atomicJson, contained, hash, json, loadPipeline, resolveExecution, verifyArtifact } from "./policy.mjs";
 import { snapshot, taskPath, check } from "./gates.mjs";
 import { acquireLock } from "./process-lock.mjs";
 import { deliveryBudget, requireDeliveryRoom, dispatchPurpose, requireEarlyCheckpoint } from "./delivery-budget.mjs";
 import { pinRepairPacket, verifyRepairPacket, repairPrompt, repairToolScope } from "./repair-packet.mjs";
 import { requireDesignReady } from "./design-readiness.mjs";
+import { handoffTemplate } from "./review-handoff.mjs";
+import { activeSessionBudget } from "./session-budget.mjs";
+import { plannedDispatchBudget } from "./review-budget.mjs";
+import { captureUnityRepairScope, verifyUnityRepairScope, unityEditorInvocation, blockedUnityScene } from "./unity-repair.mjs";
+import { validateSlicePlan, readSlicePlan, validateSliceRevision, sliceProgress, bindSlice, slicePromptContext, nextSliceRequest, sliceHash, sameSlice } from "./task-slices.mjs";
 
 const ledgerPath = ".nccgs/orchestration.json";
 const ledgerMarker = ".nccgs/orchestration.initialized.json";
@@ -36,6 +42,15 @@ function load(project) {
   need(reserved.length === Object.keys(ledger.dispatches).length && new Set(reserved.map(e => e.dispatchId)).size === reserved.length, "Corrupt ledger reservation history");
   for (const event of ledger.events) if (event.dispatchId) need(ledger.dispatches[event.dispatchId], "Corrupt ledger: event refers to missing dispatch");
   for (const event of reserved) need(ledger.dispatches[event.dispatchId]?.taskId === event.taskId, "Corrupt ledger reservation identity");
+  const plans = new Map();
+  for (const event of ledger.events.filter(e => e.action === "slice-plan")) {
+    need(ledger.tasks[event.taskId] && event.planId && event.requestHash && event.reference?.path?.startsWith(".nccgs/evidence/slices/"), "Corrupt slice-plan history");
+    verifyArtifact(project, event.reference); plans.set(event.taskId, event);
+  }
+  for (const [id, entry] of Object.entries(ledger.tasks)) {
+    const latest = plans.get(id);
+    need(Boolean(entry.slicePlan) === Boolean(latest) && (!latest || same(entry.slicePlan, { planId: latest.planId, requestHash: latest.requestHash, reference: latest.reference })), "Slice-plan history missing or detached; restore it, never reset planned work");
+  }
   return ledger;
 }
 function transaction(project, action) {
@@ -108,6 +123,87 @@ function validPaths(project, paths) {
   }
   return [...new Set(paths)].sort();
 }
+
+function sliceCapacity(project, ledger, ancestors) {
+  return ancestors.map(ancestor => {
+    const entry = ledger.tasks[ancestor], items = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, ancestor));
+    let pending = 0, minimumReviews = 0;
+    for (const [id] of Object.entries(ledger.tasks).filter(([id, e]) => e.slicePlan && belongs(ledger, id, ancestor))) {
+      const task = taskRecord(project, id), progress = sliceProgress(project, task, ledger);
+      pending += progress.minimumRemainingDispatches;
+      const own = items.filter(d => d.taskId === id), reviews = own.filter(d => d.kind === "review");
+      const consumed = new Set([...Object.values(task.stages ?? {}), ...(task.history ?? []).flatMap(h => Object.values(h.stages ?? {}))].map(s => s.dispatchId).filter(Boolean));
+      const lastWork = own.filter(d => d.kind === "implementation" && d.status === "completed").at(-1);
+      const reviewed = progress.slices.every(s => s.state === "DELIVERED") && lastWork && task.stages.review?.verdict === "PASS"
+        && task.stages.implementation?.dispatchId === lastWork.id && task.stages.review.contractHash === task.contractHash
+        && task.stages.review.snapshot === lastWork.completedSnapshot && Date.parse(task.stages.review.recordedAt) >= Date.parse(lastWork.finishedAt);
+      const awaiting = progress.slices.every(s => s.state === "DELIVERED") && reviews.some(d => active(d) || (d.status === "completed"
+        && d.completedSnapshot === lastWork?.completedSnapshot && Date.parse(d.finishedAt) >= Date.parse(lastWork.finishedAt) && !consumed.has(d.id)));
+      if (!reviewed && !awaiting) {
+        const used = Math.max(0, task.reviewBudget.used - reviews.filter(d => consumed.has(d.id)).length) + reviews.length;
+        need(used < task.reviewBudget.limit, `Task slices: independent-review budget exhausted for ${id}; splitting cannot create new review rounds`);
+        minimumReviews++;
+      }
+    }
+    const protectedBudget = deliveryBudget(entry, items);
+    const protectedSlots = (protectedBudget?.protectedSlots ?? 0) + Math.max(0, minimumReviews - (protectedBudget?.remaining.review ?? 0));
+    need(items.length + pending + protectedSlots <= entry.limits.maxDispatches,
+      `Task slices: aggregate budget for ${ancestor} cannot fit ${pending} remaining delivery slices plus ${protectedSlots} protected slots; preserve spent attempts and replan unattempted work or use an externally authorized extension`);
+    return { taskId: ancestor, limits: entry.limits, spentDispatches: items.length, minimumRemainingSlices: pending, minimumIndependentReviews: minimumReviews, protectedSlots,
+      spareDispatches: entry.limits.maxDispatches - items.length - pending - protectedSlots };
+  });
+}
+
+export function planTaskSlices(project, id, relative, commit = false) {
+  const prepare = ledger => {
+    const task = taskRecord(project, id);
+    need(task.mode === "implement" && !task.closed, "Task slices require an open implementation task");
+    const state = check(project, task, "implementation"); need(state.allowed, state.message);
+    need(typeof relative === "string" && relative.startsWith(".nccgs/evidence/slice-plans/") && relative.endsWith(".json"), "Slice plan draft must be JSON under .nccgs/evidence/slice-plans/");
+    const input = artifact(project, relative);
+    need(fs.statSync(verifyArtifact(project, input)).size <= 65536, "Slice plan exceeds 64 KiB; narrow the assignments");
+    const plan = json(verifyArtifact(project, input)), requestHash = sliceHash(plan);
+    validateSlicePlan(project, task, plan);
+    const existing = ledger.events.find(e => e.action === "slice-plan" && e.taskId === id && e.planId === plan.planId);
+    if (existing) {
+      need(existing.requestHash === requestHash, "Slice planId reused with different content");
+      return { status: ledger.tasks[id].slicePlan.planId === plan.planId ? "ALREADY_REGISTERED" : "SUPERSEDED", reference: existing.reference,
+        scope: "Original plan retained; no reactivation, attempt, budget or task change." };
+    }
+    need(plan.sourceSnapshot === state.snapshot, "Slice plan source snapshot is stale");
+    need(!Object.values(ledger.dispatches).some(d => belongs(ledger, d.taskId, id) && active(d)), "Settle active task/descendant attempts before registering another plan");
+    const ancestors = chain(project, id, ledger);
+    const old = ledger.tasks[id].slicePlan;
+    const previous = old ? { plan: json(verifyArtifact(project, old.reference)), reference: old.reference } : null;
+    validateSliceRevision(previous, plan, Object.values(ledger.dispatches).filter(d => d.taskId === id));
+    // Preview mutates only this in-memory ledger. No task/contract/approval is
+    // rewritten and no dispatch is reserved. Commit pins the normal budget once.
+    ledger.tasks[id].slicePlan = { planId: plan.planId, requestHash, reference: input };
+    const budgets = sliceCapacity(project, ledger, ancestors);
+    verifyArtifact(project, input);
+    let reference = input;
+    if (commit) {
+      const output = `.nccgs/evidence/slices/${crypto.randomUUID()}.json`;
+      atomicJson(contained(project, output), plan); reference = artifact(project, output);
+      ledger.tasks[id].slicePlan.reference = reference;
+      ledger.events.push({ action: "slice-plan", at: now(), taskId: id, planId: plan.planId, requestHash, reference,
+        supersedes: old?.reference ?? null, reason: plan.reason });
+    }
+    return { status: commit ? "REGISTERED" : "PREVIEW", taskId: id, planId: plan.planId, reference, budgets,
+      scope: "Same task, original criteria and shared budgets. Capacity is a dispatch lower bound, not a duration/cost estimate or approval." };
+  };
+  return commit ? transaction(project, prepare) : prepare(load(project));
+}
+
+export function taskSliceStatus(project, id) {
+  const task = taskRecord(project, id), ledger = load(project), stored = readSlicePlan(project, task, ledger);
+  if (!stored) return { taskId: id, status: "UNPLANNED", next: null };
+  const progress = sliceProgress(project, task, ledger, stored);
+  let budgets = null, capacityError = null;
+  try { budgets = sliceCapacity(project, ledger, chain(project, id, ledger)); } catch (error) { capacityError = error.message; }
+  return { taskId: id, ...progress, budgets, capacityError, next: capacityError ? null : nextSliceRequest(task, ledger, stored, progress),
+    history: ledger.events.filter(e => e.action === "slice-plan" && e.taskId === id) };
+}
 export function reserve(project, id, request) {
   return transaction(project, ledger => {
     const task = taskRecord(project, id), policy = resolveExecution(project);
@@ -127,6 +223,9 @@ export function reserve(project, id, request) {
     const handoffPaths = request.handoffPaths ?? [];
     need(Array.isArray(handoffPaths) && handoffPaths.every(p => typeof p === "string" && p.startsWith(".nccgs/evidence/analysis/")), "Handoff paths must be explicit analysis artifact paths");
     for (const p of handoffPaths) contained(project, p);
+    need(request.handoffTransport === undefined || ["file", "native-result"].includes(request.handoffTransport), "Unknown handoff transport");
+    if (request.handoffTransport === "native-result")
+      need(request.kind !== "implementation" && handoffPaths.length === 1, "Native result handoff requires one declared read-only artifact");
     if (request.kind !== "implementation") for (const p of handoffPaths)
       need(task.contract.analysisArtifacts?.includes(p), "Read-only handoff must be a declared analysis artifact");
     need(request.kind === "implementation" || writePaths.length === 0, "Review/analysis dispatch is read-only");
@@ -138,11 +237,18 @@ export function reserve(project, id, request) {
     if (previous) { need(previous.requestHash === requestHash, "requestKey reused for different dispatch"); return previous; }
     for (const p of handoffPaths) need(!fs.existsSync(contained(project, p)), "Handoff artifact must be fresh for this dispatch");
     const ancestors = chain(project, id, ledger, request);
-    const snap = snapshot(project, task).sha256;
+    const protectedAllocation = plannedDispatchBudget(project, id, request);
+    const source = snapshot(project, task, { includeFiles: Boolean(request.workPacket) }), snap = source.sha256;
     const repair = Object.values(ledger.dispatches).filter(d => d.taskId === id && d.purpose === "repair" && d.status === "completed" && d.contractHash === task.contractHash).at(-1);
     const { purpose, feedback } = dispatchPurpose(project, task, { ...request, repairFeedback: repair?.feedback ?? null }, snap);
+    const slice = bindSlice(project, task, ledger, { ...request, writePaths }, purpose);
+    if (ledger.tasks[id].slicePlan) {
+      const state = check(project, task, "implementation"); need(state.allowed, state.message);
+      if (slice) need(!Object.values(ledger.dispatches).some(d => belongs(ledger, d.taskId, id) && active(d)), "Planned slices use sequential foreground dispatch; finish existing task/descendant work first");
+    }
     const workPacket = purpose === "repair" ? pinRepairPacket(project, task, { ...request, writePaths }, snap) : null;
     need(purpose === "repair" || request.workPacket === undefined, "workPacket is only supported for repair dispatches");
+    const budgetEvidence = [];
     for (const ancestor of ancestors) {
       const items = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, ancestor)), limits = ledger.tasks[ancestor].limits;
       need(items.length < limits.maxDispatches, `Aggregate dispatch budget exhausted for ${ancestor}; cancellation/reclassification never refunds attempts`);
@@ -151,11 +257,17 @@ export function reserve(project, id, request) {
       const measured = telemetryFrom(ledger, ancestor, project);
       for (const [limit, field] of [["maxDurationMs", "durationMs"], ["maxCostUsd", "costUsd"]]) if (limits[limit] !== null) {
         const data = measured.metrics[field];
+        if (field === "costUsd" && (data.expected !== data.measured || process.env.NCCGS_SUPERVISED_RUN)) {
+          budgetEvidence.push(activeSessionBudget(project, ancestor, items, limits[limit]));
+          continue;
+        }
         need(data.expected === data.measured, `Cannot enforce ${limit}: missing ${field} telemetry; reconcile measurements or stop`);
         need(data.knownSubtotal < limits[limit], `${limit} budget exhausted for ${ancestor}`);
       }
     }
     const records = Object.values(ledger.dispatches), live = records.filter(active);
+    need(!live.some(d => d.workPacket?.schemaVersion === 2), "Typed Unity repair owns the project until completion or external reconciliation");
+    if (workPacket?.schemaVersion === 2) need(live.length === 0, "Typed Unity repair requires exclusive project ownership");
     if (request.kind === "review") {
       const reviewAttempts = records.filter(d => d.taskId === id && d.kind === "review");
       const consumed = new Set([...Object.values(task.stages ?? {}), ...(task.history ?? []).flatMap(h => Object.values(h.stages ?? {}))].map(s => s.dispatchId).filter(Boolean));
@@ -172,10 +284,16 @@ export function reserve(project, id, request) {
       for (const item of live) need(!item.writePaths.some(a => writePaths.some(b => overlap(a, b))), "Write ownership conflicts with another active dispatch");
     } else need(!live.some(d => d.kind === "implementation"), "Cannot review/analyze a snapshot while implementation is active");
     const reservation = { id: crypto.randomUUID(), taskId: id, kind: request.kind, agent: request.agent, reason: request.reason.trim(),
-      requestKey: request.requestKey, requestHash, writePaths, handoffPaths, handoffProtocol: 1, purpose, feedback, status: "reserved", createdAt: now(),
+      requestKey: request.requestKey, requestHash, writePaths, handoffPaths, handoffProtocol: 1,
+      ...(request.handoffTransport ? { handoffTransport: request.handoffTransport } : {}), purpose, feedback, status: "reserved", createdAt: now(),
       snapshot: snap, contractHash: task.contractHash, sessionId: null, toolUseId: null, agentId: null, telemetry: null,
+      ...(budgetEvidence.length ? { budgetEvidence } : {}),
+      ...(protectedAllocation ? { protectedAllocation } : {}),
+      ...(slice ? { slice } : {}), ...(ledger.tasks[id].slicePlan ? { slicePlan: ledger.tasks[id].slicePlan.reference } : {}),
       ...(workPacket ? { workPacket, toolBudget: { work: 0, read: 0, handoff: 0, admissions: [] } } : {}) };
+    captureUnityRepairScope(project, reservation, source);
     ledger.dispatches[reservation.id] = reservation;
+    sliceCapacity(project, ledger, ancestors);
     ledger.events.push({ action: "reserve", at: reservation.createdAt, dispatchId: reservation.id, taskId: id });
     return reservation;
   });
@@ -183,6 +301,8 @@ export function reserve(project, id, request) {
 export function claim(project, dispatchId, identity) {
   return transaction(project, ledger => {
     const d = ledger.dispatches[dispatchId]; need(d, "Unknown dispatch reservation");
+    for (const coverage of d.budgetEvidence ?? []) need(coverage.currentSessionId === identity.sessionId, "Dispatch must use the supervised session that owns its budget allowance");
+    if (d.protectedAllocation) need(d.protectedAllocation.sessionId === identity.sessionId, "Dispatch must use the session that owns its protected budget allocation");
     need(identity.sessionId && identity.toolUseId && identity.agent === d.agent, "Dispatch identity/role mismatch");
     if (d.status === "running") { need(d.sessionId === identity.sessionId && d.toolUseId === identity.toolUseId, "Dispatch already claimed by another invocation"); return d; }
     need(d.status === "reserved", "Dispatch is not available to claim");
@@ -191,6 +311,10 @@ export function claim(project, dispatchId, identity) {
     need(task.contractHash === d.contractHash, "Dispatch contract stale");
     need(snapshot(project, task).sha256 === d.snapshot, "Dispatch source snapshot stale; cancel/reconcile and reserve a fresh attempt");
     if (d.workPacket) verifyRepairPacket(project, d);
+    if (d.slice) {
+      const current = bindSlice(project, task, ledger, { ...d, sliceId: d.slice.id }, d.purpose);
+      need(current.definitionHash === d.slice.definitionHash && sameSlice(current.dependencies, d.slice.dependencies), "Slice dependency handoffs changed after reservation");
+    }
     need(!Object.values(ledger.dispatches).some(item => item.id !== d.id && item.sessionId === identity.sessionId && item.toolUseId === identity.toolUseId), "Tool invocation already belongs to another reservation");
     Object.assign(d, { status: "running", sessionId: identity.sessionId, toolUseId: identity.toolUseId, startedAt: now() });
     ledger.events.push({ action: "claim", at: d.startedAt, dispatchId }); return d;
@@ -204,21 +328,53 @@ export function attachAgent(project, dispatchId, agentId) {
     d.agentId = agentId; return d;
   });
 }
+export function getDispatch(project, id, dispatchId) {
+  taskRecord(project, id);
+  const d = load(project).dispatches[dispatchId];
+  need(d?.taskId === id, "Dispatch does not belong to this task");
+  return d;
+}
 export function dispatchPrompt(project, id, dispatchId) {
-  const task = taskRecord(project, id), d = load(project).dispatches[dispatchId];
-  need(d?.taskId === id && d.workPacket, "A bounded repair dispatch is required for dispatch-prompt");
-  need(d.contractHash === task.contractHash, "Repair contract stale");
-  verifyRepairPacket(project, d);
-  return { dispatchId, prompt: repairPrompt(task, d) };
+  const task = taskRecord(project, id), d = getDispatch(project, id, dispatchId);
+  need(d.contractHash === task.contractHash, "Dispatch contract stale");
+  if (d.workPacket) {
+    verifyRepairPacket(project, d);
+    return { dispatchId, prompt: repairPrompt(task, d) };
+  }
+  need(["reserved", "running"].includes(d.status), "Prompt requires a reserved or running dispatch");
+  const state = check(project, task, d.kind === "review" ? "review" : task.mode === "implement" ? "implementation" : "analysis");
+  need(state.allowed, state.message);
+  if (d.status === "reserved" || d.kind !== "implementation") need(state.snapshot === d.snapshot, "Dispatch source snapshot stale");
+  const route = d.kind === "review" ? task.execution.profile.models.review : task.implementationRoute;
+  const handoffs = (d.handoffPaths ?? []).map(file => ({ path: file, content: handoffTemplate(task, d) }));
+  const prompt = `[NCCGS-DISPATCH:${dispatchId}]\nTask ${id}, ${d.kind}, ${task.risk}: ${task.contract.objective}\n` +
+    `Assignment: ${d.reason}\nTask record: .nccgs/tasks/${id}.json\nIntake: ${task.intake.path}\n` +
+    `Contract: ${task.contractHash}\nStarting source: ${d.snapshot}\nRequested route: ${route.model}/${route.effort ?? "unspecified"}; not observed execution.\n` +
+    `Check the installed role's maxTurns and native session overrides before launch; prompt text cannot increase capacity.\n` +
+    `Source write ownership: ${JSON.stringify(d.writePaths)}\nCanonical sources: ${JSON.stringify(task.contract.sources ?? [])}\n` +
+    `Read the pinned task contract for acceptance, checks, manual gates and design references; preserve all of them.\n` +
+    slicePromptContext(project, task, d) +
+    `Use foreground execution. Do not delegate or change task records. The coordinator owns verification and stage recording.\n` +
+    (d.kind === "review" ? "Review independently; follow .claude/nccgs/protocols/review-handoff.md. Keep negative findings and pending conditions.\n" : "Follow .claude/nccgs/protocols/agent-contract.md for this bounded assignment.\n") +
+    (d.handoffTransport === "native-result"
+      ? "Return the entire assigned Markdown handoff as your sole final text response, without an outer code fence. Do not write a file or run handoff validation. The correlated native hook copies your exact text to the pinned path; all existing completion and review gates still apply.\n"
+      : handoffs.length ? "Write the assigned draft early. Fill it with actual findings; mark COMPLETE only when your assignment has finished.\n" : "No handoff path was reserved; report this to the coordinator if an artifact is required.\n") +
+    handoffs.map(h => `Handoff file: ${h.path}\nInitial draft (not evidence):\n${h.content}\n` +
+      (/^[\w./ -]+$/.test(h.path)
+        ? (d.handoffTransport === "native-result" ? "Return this completed document as text; retain negative findings and pending conditions.\n" : `Before returning, validate structure with one plain command:\nnode .claude/nccgs/tools/task.mjs handoff-validate --id ${id} --dispatch ${dispatchId} --file "${h.path}"\n`)
+        : "Ask the coordinator to validate this handoff with the fixed handoff-validate command; its path needs shell-specific quoting.\n")).join("\n");
+  return { dispatchId, agent: d.agent, prompt, handoffs, scope: "Preparation only; does not launch, write artifacts, approve work or spend another attempt." };
 }
 export function pinnedRepairEvidence(project, relative) {
   return Object.values(load(project).dispatches).some(d => d.workPacket &&
-    [d.workPacket.reference, ...d.workPacket.context].some(ref => ref.path.toLowerCase() === relative.toLowerCase()));
+    [d.workPacket.reference, ...d.workPacket.context, d.workPacket.scope, d.workPacket.unity?.capabilities].filter(Boolean).some(ref => ref.path.toLowerCase() === relative.toLowerCase()));
 }
 export function admitRepairTool(project, dispatchId, input) {
   const result = transaction(project, ledger => {
     const d = ledger.dispatches[dispatchId];
-    need(d?.workPacket && d.status === "running" && input.agent_id && input.agent_id === d.agentId && input.session_id === d.sessionId, "Repair tool requires the running, correlated worker");
+    const uncertainHandoff = d?.workPacket?.schemaVersion === 2 && d.status === "uncertain" &&
+      ["Write", "Edit", "MultiEdit"].includes(input.tool_name) && d.handoffPaths.includes(path.relative(project, path.resolve(project, input.tool_input?.file_path ?? ".")).split(path.sep).join("/"));
+    need(d?.workPacket && (d.status === "running" || uncertainHandoff) && input.agent_id && input.agent_id === d.agentId && input.session_id === d.sessionId, "Repair tool requires the running, correlated worker");
     need(typeof input.tool_use_id === "string" && input.tool_use_id.length > 0, "Repair tool-use identity missing");
     const budget = d.toolBudget, limits = d.workPacket.budget;
     need(budget && Array.isArray(budget.admissions) && [budget.work, budget.read, budget.handoff].every(n => Number.isSafeInteger(n) && n >= 0), "Repair tool budget missing/corrupt; restore history, never reset it");
@@ -236,6 +392,7 @@ export function admitRepairTool(project, dispatchId, input) {
       if (previous.allowed && previous.bucket !== "handoff") {
         verifyRepairPacket(project, d);
         need(taskRecord(project, d.taskId).contractHash === d.contractHash, "Repair contract stale");
+        need(!(d.editorSteps ?? []).some(s => s.status !== "completed"), "Editor operation failed or remains uncertain; retain the attempt and return PARTIAL");
       }
       return previous;
     }
@@ -254,16 +411,72 @@ export function admitRepairTool(project, dispatchId, input) {
         need(Date.now() - Date.parse(d.startedAt) <= limits.durationMs, "Repair work deadline reached");
         need(taskRecord(project, d.taskId).contractHash === d.contractHash, "Repair contract stale");
         verifyRepairPacket(project, d);
+        need(!(d.editorSteps ?? []).some(s => s.status !== "completed"), "Editor operation failed or remains uncertain; retain the attempt and return PARTIAL");
       }
     } catch (error) { reason = error.message; }
     const remaining = { work: Math.max(0, limits.workCalls - budget.work), read: Math.max(0, limits.readCalls - budget.read), handoff: Math.max(0, limits.handoffCalls - budget.handoff) };
-    const entry = { toolUseId: input.tool_use_id, fingerprint, bucket: scope.bucket, read: scope.read, allowed: !reason, reason, at: now(), remaining };
+    const entry = { toolUseId: input.tool_use_id, fingerprint, bucket: scope.bucket, read: scope.read, allowed: !reason, reason, at: now(), remaining,
+      ...(scope.editorStep ? { editorStep: scope.editorStep } : {}) };
     budget.admissions.push(entry);
     return entry;
   });
   need(result.allowed, `${result.reason}. Write the assigned PARTIAL handoff and return; remaining handoff calls: ${result.remaining.handoff}`);
   return { additionalContext: `NCCGS repair tool allowance remaining: ${result.remaining.work} work, ${result.remaining.read} reads, ${result.remaining.handoff} handoff writes. Verification belongs to the coordinator. Return the assigned handoff before native turn exhaustion.` };
 }
+
+// Called only by the fixed worker CLI after its tool admission. A step is pinned
+// before launch and never replayed automatically, including after an interruption.
+export function runRepairEditor(project, id, dispatchId, stepId, execute = spawnSync) {
+  const prepared = transaction(project, ledger => {
+    const d = ledger.dispatches[dispatchId];
+    need(d?.taskId === id && d.status === "running" && d.workPacket?.schemaVersion === 2, "Editor step needs a running typed Unity repair");
+    const task = taskRecord(project, id);
+    need(task.contractHash === d.contractHash, "Repair contract stale");
+    requireDesignReady(project, task);
+    const readiness = check(project, task, "implementation"); need(readiness.allowed, readiness.message);
+    verifyRepairPacket(project, d); verifyUnityRepairScope(project, d);
+    const steps = d.workPacket.unity.steps, step = steps.find(s => s.id === stepId);
+    need(step, "Unknown pinned Editor step");
+    d.editorSteps ??= [];
+    need(!d.editorSteps.some(s => s.id === stepId), "Editor step already attempted; inspect its original receipt, never replay");
+    need(steps.slice(0, steps.indexOf(step)).every(s => d.editorSteps.some(e => e.id === s.id && e.status === "completed")), "Editor steps must finish in packet order");
+    need(Date.now() - Date.parse(d.startedAt) + step.timeoutMs + 1000 <= d.workPacket.budget.durationMs, "Repair deadline cannot fit this Editor step");
+    const admission = d.toolBudget.admissions.find(a => a.allowed && a.editorStep === stepId && !d.editorSteps.some(s => s.toolUseId === a.toolUseId));
+    need(admission, "Editor step requires its correlated worker tool admission");
+    const invocation = unityEditorInvocation(project, step, d.workPacket.sceneSafety ?? null);
+    d.editorSteps.push({ id: stepId, status: "running", startedAt: now(), toolUseId: admission.toolUseId });
+    ledger.events.push({ action: "repair-editor-start", at: now(), dispatchId, stepId });
+    return { step, invocation };
+  });
+  let result;
+  try { result = execute(prepared.invocation.executable, prepared.invocation.arguments, { cwd: project, shell: false, windowsHide: true,
+    encoding: "utf8", timeout: prepared.step.timeoutMs + 1000, maxBuffer: 4 * 1024 * 1024 }); }
+  catch (error) { result = { error, status: null, stdout: "", stderr: "" }; }
+  return transaction(project, ledger => {
+    const d = ledger.dispatches[dispatchId], step = d.editorSteps.find(s => s.id === stepId);
+    need(step?.status === "running", "Editor operation state changed; inspect before any continuation");
+    const notStarted = ["ENOENT", "EACCES"].includes(result.error?.code);
+    let status = result.status === 0 && !result.error && !result.signal ? "completed" : notStarted ? "failed" : "uncertain";
+    const blockedScene = blockedUnityScene(prepared.invocation, result);
+    if (blockedScene !== null) status = "failed"; // Known precondition refusal: packet body never ran.
+    let scopeError = null;
+    try { verifyRepairPacket(project, d); verifyUnityRepairScope(project, d); }
+    catch (error) { scopeError = error.message; if (status === "completed") status = "failed"; }
+    const relative = `.nccgs/evidence/repair-operations/${dispatchId}-${stepId}.json`;
+    atomicJson(contained(project, relative), { schemaVersion: 1, origin: "unity-repair-operation", taskId: id, dispatchId, stepId,
+      contractHash: d.contractHash, startedAt: step.startedAt, finishedAt: now(), status, ...prepared.invocation,
+      exitCode: result.status ?? null, signal: result.signal ?? null, error: result.error?.message ?? null, scopeError, blockedScene,
+      stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""),
+      note: "Editor operation receipt only; not verification, acceptance or provider execution evidence." });
+    Object.assign(step, { status, finishedAt: now(), evidence: artifact(project, relative) });
+    if (status === "uncertain") { d.status = "uncertain"; d.uncertainty = "Unity Editor operation may still be active; external reconciliation required before releasing ownership"; }
+    ledger.events.push({ action: "repair-editor-finish", at: step.finishedAt, dispatchId, stepId, status, evidence: step.evidence });
+    return { status: status === "completed" ? "EXECUTED" : "FAIL", operationStatus: status, evidence: step.evidence,
+      message: status === "completed" ? "Inspect the Editor result; finish the handoff. Required verification and independent review remain pending."
+        : blockedScene !== null ? `Unsaved scene blocked the operation: ${blockedScene}. Nothing was saved or discarded. Return PARTIAL and preserve this attempt; the owner must resolve unsaved work before a new authorized packet.`
+        : "Return PARTIAL. Preserve this attempt; do not retry or release an uncertain Editor operation without external reconciliation." };
+  });
+}
 // Called only by the launch guard before a native invocation is admitted. A
 // claimed/uncertain worker can never be released through this recovery path.
 export function rejectUnclaimed(project, dispatchId, rejection) {
@@ -280,8 +493,9 @@ export function rejectUnclaimed(project, dispatchId, rejection) {
 export function complete(project, dispatchId, input) {
   return transaction(project, ledger => {
     const d = ledger.dispatches[dispatchId]; need(d, "Unknown dispatch");
-    if (["completed", "failed"].includes(d.status) && d.runtime) { need(same(d.runtime, input.runtime), "Dispatch already completed with different evidence"); return d; }
+    if ((["completed", "failed"].includes(d.status) || d.workStatus === "incomplete-editor") && d.runtime) { need(same(d.runtime, input.runtime), "Dispatch already completed with different evidence"); return d; }
     need(["running", "uncertain"].includes(d.status), "Only a claimed dispatch can complete");
+    const editorUncertain = (d.editorSteps ?? []).some(s => ["running", "uncertain"].includes(s.status));
     need(input.runtime?.path?.startsWith(".nccgs/evidence/runtime/observations/"), "Completion needs durable runtime observation");
     const trace = json(verifyArtifact(project, input.runtime)), raw = json(verifyArtifact(project, trace.observationSource));
     need(trace.observationSource?.path?.startsWith(".nccgs/evidence/runtime/sources/"), "Completion requires durable raw runtime source");
@@ -296,6 +510,16 @@ export function complete(project, dispatchId, input) {
     need(Date.parse(trace.capturedAt) >= Date.parse(d.startedAt) && Date.parse(trace.capturedAt) <= Date.now(), "Completion time is invalid");
     const task = taskRecord(project, d.taskId), finalSnapshot = snapshot(project, task).sha256;
     need(task.contractHash === d.contractHash && trace.snapshot === finalSnapshot, "Completion covers stale contract/snapshot");
+    let returnedHandoffFailure = null;
+    if (d.handoffTransport === "native-result") {
+      need(same(trace.returnedHandoff ?? null, raw.returnedHandoff ?? null), "Returned handoff differs from raw source");
+      const captured = raw.returnedHandoff;
+      if (captured?.status !== "captured") returnedHandoffFailure = captured?.reason ?? "missing-native-result";
+      else {
+        need(d.handoffPaths.length === 1 && captured.evidence?.path === d.handoffPaths[0], "Returned handoff path mismatch");
+        verifyArtifact(project, captured.evidence);
+      }
+    }
     const mutatedReadOnly = d.kind !== "implementation" && d.snapshot !== finalSnapshot;
     const metrics = Object.fromEntries(["durationMs", "toolUseCount", "totalTokens", "costUsd"].map(key => {
       const value = raw[key] ?? null;
@@ -321,11 +545,26 @@ export function complete(project, dispatchId, input) {
       d.status = "failed";
       d.failure = missing.length ? "Required handoff artifacts are missing; reserve a new bounded attempt" : "Handoff is partial or missing its COMPLETE marker; reserve a new bounded attempt";
     }
+    if (returnedHandoffFailure) { d.status = "failed"; d.failure = `Returned handoff rejected: ${returnedHandoffFailure}`; }
     if (d.workPacket) {
-      try { verifyRepairPacket(project, d); }
+      try {
+        verifyRepairPacket(project, d);
+        verifyUnityRepairScope(project, d, true);
+        if (d.workPacket.schemaVersion === 2) {
+          need(d.workPacket.unity.steps.every(s => d.editorSteps?.some(e => e.id === s.id && e.status === "completed")), "Required Editor operations did not complete");
+          for (const s of d.editorSteps ?? []) verifyArtifact(project, s.evidence);
+        }
+      }
       catch (error) { d.status = "failed"; d.failure = `Repair context changed: ${error.message}`; }
     }
-    d.workStatus = d.status === "completed" ? "completed" : "incomplete";
+    // The native worker can finish while a resident Editor operation remains
+    // uncertain. Keep its observed usage and original handoff without releasing
+    // ownership or converting that observation into completed repair work.
+    if (editorUncertain) {
+      d.status = "uncertain";
+      d.uncertainty = "Native worker finished but Editor operation is still running or uncertain; external reconciliation required";
+    }
+    d.workStatus = editorUncertain ? "incomplete-editor" : d.status === "completed" ? "completed" : "incomplete";
     ledger.events.push({ action: "complete", at: d.finishedAt, dispatchId, status: d.status }); return d;
   });
 }
@@ -400,15 +639,26 @@ export function correlateAgentStart(project, input) {
   return items.length === 1 ? attachAgent(project, items[0].id, input.agent_id) : null;
 }
 export function validateStageDispatch(project, task, input, trace, kind) {
-  const d = load(project).dispatches[input.dispatchId];
+  const ledger = load(project), d = ledger.dispatches[input.dispatchId];
   need(d?.handoff?.status !== "missing", `${kind}: invocation ended but required handoff artifacts are missing; reserve a new attempt`);
   need(!d?.handoff?.partial?.length, `${kind}: handoff is partial; reserve a new bounded attempt`);
   need(d && d.taskId === task.id && d.kind === kind && d.status === "completed", `${kind}: completed managed dispatch required`);
   need(d.handoff?.status !== "missing", `${kind}: invocation ended but required handoff artifacts are missing; reserve a new attempt`);
   for (const ref of d.handoff?.artifacts ?? []) verifyArtifact(project, ref);
   if (d.workPacket) verifyRepairPacket(project, d);
+  for (const step of d.editorSteps ?? []) verifyArtifact(project, step.evidence);
   need(d.contractHash === task.contractHash && d.completedSnapshot === input.snapshot && same(d.runtime, input.runtime), "Stage dispatch covers different snapshot/contract/evidence");
   need(d.sessionId === trace.sessionId && d.agentId === trace.agentId && d.toolUseId === trace.toolUseId, "Stage dispatch/runtime identity mismatch");
+  const stored = readSlicePlan(project, task, ledger);
+  if (stored) {
+    const progress = sliceProgress(project, task, ledger, stored);
+    need(progress.slices.every(s => s.state === "DELIVERED"), "All planned slices need complete current native handoffs before integrated verification/review");
+    const integration = ledger.dispatches[progress.slices.find(s => s.id === stored.plan.integration).dispatchId];
+    if (kind === "implementation") need(d.id === integration.id || (d.purpose === "repair" && d.slicePlan && Date.parse(d.createdAt) >= Date.parse(integration.finishedAt)),
+      "Record the final integration dispatch (or subsequent repair), never promote an intermediate slice to whole-task completion");
+    if (kind === "review") need(!Object.values(ledger.dispatches).some(other => belongs(ledger, other.taskId, task.id) && other.kind === "implementation"
+      && other.sessionId === trace.sessionId && other.agentId === trace.agentId), "Review must be independent of every implementation contributor, including earlier slices and failed repairs");
+  }
   // Recording rejects consumed IDs; read-only inspection must accept an already
   // recorded stage without treating it as a new attempt.
   return d;

package/.claude/nccgs/tools/repair-packet.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { artifact, contained, json, verifyArtifact } from "./policy.mjs";
+import { validateUnityRepair, unityEditorToolScope, repairEditorCommand, unityCodePath, unitySceneSafety } from "./unity-repair.mjs";
 
 const need = (ok, message) => { if (!ok) throw new Error(message); };
 export const repairLimits = Object.freeze({ workCalls: 12, readCalls: 6, handoffCalls: 3, durationMs: 600000 });
@@ -12,20 +13,24 @@ const keys = (value, allowed) => value && typeof value === "object" && !Array.is
 export function pinRepairPacket(project, task, request, snapshot) {
   need(typeof request.workPacket === "string" && request.workPacket.startsWith(".nccgs/evidence/work-packets/") && request.workPacket.endsWith(".json"), "Repair requires a workPacket JSON under .nccgs/evidence/work-packets/");
   const reference = artifact(project, request.workPacket);
-  need(fs.statSync(contained(project, reference.path)).size <= 16384, "Repair packet exceeds 16 KiB; narrow the work before dispatch");
+  need(fs.statSync(contained(project, reference.path)).size <= 32768, "Repair packet exceeds 32 KiB; narrow the work before dispatch");
   const packet = json(verifyArtifact(project, reference));
-  need(keys(packet, ["schemaVersion", "taskId", "contractHash", "sourceSnapshot", "problem", "solution", "changes", "context", "verification", "budget"]) && packet.schemaVersion === 1, "Invalid repair packet schema");
+  const unity = packet.schemaVersion === 2;
+  need(keys(packet, ["schemaVersion", "taskId", "contractHash", "sourceSnapshot", "problem", "solution", "changes", "context", "verification", "budget", ...(unity ? ["repairType", "unity"] : [])]) && [1, 2].includes(packet.schemaVersion), "Invalid repair packet schema");
+  if (!unity) need(fs.statSync(contained(project, reference.path)).size <= 16384, "Repair packet exceeds 16 KiB; narrow the work before dispatch");
   need(packet.taskId === task.id && packet.contractHash === task.contractHash && packet.sourceSnapshot === snapshot, "Repair packet task/contract/source snapshot is stale or mismatched");
   need(text(packet.problem, 800) && text(packet.solution, 1600), "Repair packet needs a concise problem and chosen solution");
-  need(Array.isArray(packet.changes) && packet.changes.length >= 1 && packet.changes.length <= 4, "Repair packet must specify 1-4 exact existing source files");
+  need(Array.isArray(packet.changes) && packet.changes.length >= 1 && packet.changes.length <= (unity ? 8 : 4), "Repair packet must specify 1-4 exact existing source files (up to 8 in a typed Unity packet)");
   for (const change of packet.changes) {
-    need(keys(change, ["path", "instruction"]) && text(change.instruction, 1600), "Each repair change needs an exact path and bounded instruction");
+    need(keys(change, ["path", "instruction", ...(unity ? ["operation"] : [])]) && text(change.instruction, 1600), "Each repair change needs an exact path and bounded instruction");
     const file = contained(project, change.path);
-    need(!/^\.(?:nccgs|claude|git)(?:\/|$)/i.test(change.path) && fs.statSync(file).isFile(), "Repair changes must be existing source files, not governance or evidence");
+    if (!unity) need(!/^\.(?:nccgs|claude|git)(?:\/|$)/i.test(change.path) && fs.statSync(file).isFile(), "Repair changes must be existing source files, not governance or evidence");
   }
+  const limits = unity ? validateUnityRepair(project, packet) : repairLimits;
   const paths = packet.changes.map(c => c.path).sort();
   need(new Set(paths.map(p => p.toLowerCase())).size === paths.length && JSON.stringify(paths) === JSON.stringify([...request.writePaths].sort()), "Repair writePaths must exactly match packet files; directory ownership is not allowed");
   need(request.handoffPaths?.length === 1, "Repair requires exactly one fresh handoff path");
+  if (unity) need(!request.handoffPaths.includes(packet.unity.capabilities?.path), "Unity capability evidence cannot be its handoff");
   need(Array.isArray(packet.context) && packet.context.length <= 4, "Repair context must contain at most four pinned evidence references");
   for (const ref of packet.context) {
     need(ref?.path?.startsWith(".nccgs/evidence/") && !ref.path.startsWith(".nccgs/evidence/work-packets/") && !request.handoffPaths.includes(ref.path), "Repair context must reference existing evidence, not the packet or its handoff");
@@ -34,15 +39,19 @@ export function pinRepairPacket(project, task, request, snapshot) {
   need(Array.isArray(packet.verification) && packet.verification.length > 0 && new Set(packet.verification).size === packet.verification.length &&
     packet.verification.every(name => task.contract.requiredChecks.includes(name)) && task.contract.requiredChecks.every(name => packet.verification.includes(name)), "Repair verification must list the task's required checks for the coordinator");
   need(packet.budget === undefined || keys(packet.budget, Object.keys(repairLimits)), "Unknown repair budget field");
-  const budget = { ...repairLimits, ...packet.budget };
-  for (const [name, value] of Object.entries(budget)) need(Number.isSafeInteger(value) && value >= 1 && value <= repairLimits[name], `Repair ${name} must be between 1 and ${repairLimits[name]}`);
+  const budget = { ...limits, ...packet.budget };
+  for (const [name, value] of Object.entries(budget)) need(Number.isSafeInteger(value) && value >= 1 && value <= limits[name], `Repair ${name} must be between 1 and ${limits[name]}`);
   need(budget.readCalls <= budget.workCalls, "Repair readCalls cannot exceed workCalls");
-  return { ...packet, reference, budget };
+  return { ...packet, reference, budget, ...(unity ? { sceneSafety: unitySceneSafety } : {}) };
 }
 
 export function verifyRepairPacket(project, dispatch) {
   verifyArtifact(project, dispatch.workPacket.reference);
   for (const ref of dispatch.workPacket.context) verifyArtifact(project, ref);
+  if (dispatch.workPacket.schemaVersion === 2) {
+    if (dispatch.workPacket.unity.capabilities) verifyArtifact(project, dispatch.workPacket.unity.capabilities);
+    verifyArtifact(project, dispatch.workPacket.scope);
+  }
 }
 
 export function repairPrompt(task, dispatch) {
@@ -50,10 +59,17 @@ export function repairPrompt(task, dispatch) {
   return `[NCCGS-DISPATCH:${dispatch.id}]\nBounded repair for task ${task.id}: ${task.contract.objective ?? task.objective ?? dispatch.reason}\n` +
     `Packet: ${p.reference.path} sha256=${p.reference.sha256}\nContract: ${dispatch.contractHash}\nStarting source: ${dispatch.snapshot}\n` +
     `Problem: ${p.problem}\nChosen solution: ${p.solution}\n` +
-    p.changes.map(c => `Edit ${c.path}: ${c.instruction}`).join("\n") +
+    p.changes.map(c => `${c.operation ?? "Edit"} ${c.path}: ${c.instruction}`).join("\n") +
     `\nContext references: ${JSON.stringify(p.context)}\n` +
     `Limits: ${p.budget.workCalls} work tool calls, including at most ${p.budget.readCalls} reads/searches; ${p.budget.durationMs} ms from claim. Separate ${p.budget.handoffCalls} handoff writes. Native turns are separate and are not guaranteed by these counters.\n` +
-    `Read/Grep/Glob within this project; Write/Edit/MultiEdit only the listed files. No shell, MCP, web, nested agents, or parameter sweeps.\n` +
+    (p.schemaVersion === 2
+      ? `Repair profile: ${p.repairType}. Read/Grep/Glob within this project. ${p.repairType === "unity-code" ? "Write/Edit/MultiEdit only the listed source files." : "Write/Edit/MultiEdit only the listed code files. Change serialized assets only through pinned Editor steps; no raw asset or metadata edits."} Never hand-write .meta files. No general shell, MCP, web, nested agents or parameter sweeps.\n` +
+        (p.sceneSafety ? "Every Editor step first checks all loaded scenes in the same eval. If any scene is dirty, the operation is blocked without saving/discarding it. Return PARTIAL; preserve the attempt and let the owner resolve unsaved work.\n" : "") +
+        (p.unity.steps.length ? `Pinned Unity capabilities: ${JSON.stringify(p.unity.capabilities)}\nRun these foreground Bash tool inputs once, in order; stop and return PARTIAL on a failed or uncertain step:\n`
+          : "No Editor steps are reserved; apply only the existing-file code correction.\n") +
+        p.unity.steps.map(s => JSON.stringify({ command: repairEditorCommand(dispatch, s), timeout: s.timeoutMs + 5000 }) + `\nEditor operation: ${s.command} ${JSON.stringify(s.arguments)}\n`).join("") +
+        "Finish saving/importing all exact files and their Unity-generated metadata before returning; new paths, deleted files or changed existing GUIDs fail completion. Editor return/exit zero is not verification evidence.\n"
+      : `Read/Grep/Glob within this project; Write/Edit/MultiEdit only the listed files. No shell, MCP, web, nested agents, or parameter sweeps.\n`) +
     `Handoff: ${dispatch.handoffPaths[0]}. Write NCCGS-HANDOFF: PARTIAL early, then replace with NCCGS-HANDOFF: COMPLETE only when these edits are finished. Include changed files, rationale, unverified checks, risks and next owner. Return PARTIAL if the chosen solution needs more investigation.\n` +
     `Coordinator runs required checks after return: ${p.verification.join(", ")}. COMPLETE is edit handoff, not acceptance PASS. Do not run or invent verification.\n`;
 }
@@ -69,9 +85,12 @@ function toolPath(project, value, rootAllowed = false) {
 // Classifies the request before admission; never executes a tool or command.
 export function repairToolScope(project, dispatch, input) {
   const tool = input.tool_input ?? {}, name = input.tool_name;
+  const editor = unityEditorToolScope(dispatch, input);
+  if (editor) return editor;
   if (["Write", "Edit", "MultiEdit"].includes(name)) {
     const relative = toolPath(project, tool.file_path);
     if (dispatch.handoffPaths.includes(relative)) return { bucket: "handoff", read: false };
+    need(dispatch.workPacket.repairType !== "unity-editor" || unityCodePath(relative), "Unity assets must be changed through pinned Editor steps, never raw file edits");
     need(dispatch.writePaths.includes(relative), "Repair write is outside the packet's exact files");
     return { bucket: "work", read: false };
   }

package/.claude/nccgs/tools/returned-handoff.mjs

@@ -0,0 +1,38 @@
+import fs from "node:fs";
+import path from "node:path";
+import { artifact, contained } from "./policy.mjs";
+
+// Opt-in transport for read-only workers whose native client returns reports as
+// text. Copy the sole model text block verbatim; never synthesize a verdict,
+// COMPLETE marker, identity, missing content or a replacement for an old attempt.
+export function captureReturnedHandoff(project, dispatch, input, completion, currentSnapshot) {
+  if (dispatch?.handoffTransport !== "native-result") return null;
+  const reject = reason => ({ transport: "native-result", status: "rejected", reason });
+  const response = input.tool_response;
+  if (input.hook_event_name !== "PostToolUse" || !["Agent", "Task"].includes(input.tool_name)
+      || dispatch.status !== "running" || !["analysis", "review"].includes(dispatch.kind)
+      || dispatch.sessionId !== input.session_id || dispatch.toolUseId !== input.tool_use_id
+      || !dispatch.agentId || dispatch.agentId !== response?.agentId
+      || dispatch.agent !== input.tool_input?.subagent_type || dispatch.snapshot !== currentSnapshot)
+    return reject("identity-or-snapshot-mismatch");
+  if (completion?.status !== "completed" || completion.reason || response?.harnessNoteCount || response?.harnessTailCount)
+    return reject("native-incomplete");
+  const blocks = response?.content;
+  if (!Array.isArray(blocks) || blocks.length !== 1 || blocks[0]?.type !== "text"
+      || typeof blocks[0].text !== "string" || !blocks[0].text.trim()
+      || Buffer.byteLength(blocks[0].text, "utf8") > 262144)
+    return reject("expected-one-bounded-text-block");
+  if (dispatch.handoffPaths?.length !== 1) return reject("expected-one-pinned-handoff");
+  const relative = dispatch.handoffPaths[0];
+  try {
+    const file = contained(project, relative);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // Revalidate newly created parents and refuse symlinks, existing drafts or
+    // concurrent writes. Existing file transport retains its original behavior.
+    contained(project, relative);
+    fs.writeFileSync(file, blocks[0].text, { flag: "wx" });
+    return { transport: "native-result", status: "captured", evidence: artifact(project, relative) };
+  } catch (error) {
+    return reject(error.code === "EEXIST" ? "handoff-already-exists" : "handoff-publication-failed");
+  }
+}