omnius 1.0.772 → 1.0.774

package/docs/work-orders/runtime-health-remediation/WO-56-evidence-driven-objective-loop.md

@@ -0,0 +1,770 @@
+# WO-56: Evidence-driven objective loop and nonblocking execution
+
+**Status:** repository implementation complete; live Telegram acceptance remains an external gate
+**Priority:** P0
+**Incident:** September 27, 2026, Telegram SSH-over-Cloudflare task spiral and TUI freeze
+**Owner:** Omnius orchestration, execution, and Telegram runtime
+**Depends on:** WO-05, WO-21, WO-27, WO-41, WO-44, WO-49, WO-54, WO-55
+**Completion rule:** A checkbox may be marked complete only when its code,
+named deterministic tests, and evidence entry in this document all exist.
+
+## Objective
+
+Implement one host-owned control loop that continuously reconciles the original
+user request with typed runtime evidence. The loop must determine whether to
+continue, verify, deliver, ask for input, report a real external blocker, or
+offer another bounded work cycle. It must prevent an agent from repeating an
+already successful external effect merely because an invalid or out-of-scope
+verifier failed.
+
+The same repair must remove synchronous privilege-elevation work from the Node
+event loop. A remote SSH authentication failure must never be interpreted as a
+local privilege request or freeze the TUI.
+
+This work order is host-neutral at the orchestration layer. Telegram is the
+first required integration because it exposed the incident, but objective
+reconciliation, progress accounting, effect receipts, and suspension state
+must remain reusable by the CLI, daemon, and future surfaces.
+
+## Incident outcome that the controller must produce
+
+For the observed request to create a new SSH-over-Cloudflare endpoint and
+return it:
+
+1. A Cloudflare registration URL is evidence that an endpoint was created.
+2. Reaching the remote SSH service through that endpoint is transport
+   verification.
+3. A later SSH credential rejection is downstream account authentication. It
+   is not evidence that the tunnel failed.
+4. If interactive account login was not part of the admitted request, the
+   objective is ready for delivery after steps 1 and 2.
+5. Creating another tunnel is inadmissible unless evidence establishes that
+   the first endpoint is absent or unusable, or a new user instruction
+   explicitly requests replacement.
+6. The user receives the verified endpoint or one precise clarification
+   question. The user never receives a fabricated or canned incomplete report.
+
+## Confirmed current-code gaps
+
+- `ExpectedOutcomeContractV1` records only coarse effects:
+  `visible_response`, `observation`, `mutation`, `verification`, and
+  `delivery`. It cannot represent request-specific acceptance criteria,
+  exclusions, or semantic effect identity.
+- Completion evidence is recorded throughout a run, but request-specific
+  claims are normally created only when the model attempts `task_complete`.
+  During execution the ledger is therefore an evidence collection, not a live
+  request-satisfaction frontier.
+- Trajectory stall detection fingerprints rendered checkpoint state and resets
+  on file mutation. Runtime effects such as tunnel creation are not file
+  mutations, while superficial new output can change the checkpoint and evade
+  the stall detector.
+- The problem-frame validator is optional, model-based, and fire-and-forget.
+  It can advise a later turn but cannot authoritatively stop the next duplicate
+  effect.
+- Telegram treats tool calls, tool results, and generated tokens as meaningful
+  activity. A busy loop therefore never becomes quiet enough for its stale-run
+  monitor.
+- Telegram action runs use `maxTurns: 0`, and terminal continuation can requeue
+  without a cross-cycle acceptance-progress boundary.
+- A non-`task_complete` tool call can clear the current visible reply
+  candidate. The surviving candidate is not durably bound to the evidence
+  receipts that made it valid.
+- Telegram URL delivery recognizes WebFetch evidence but not a provider
+  creation receipt combined with protocol-specific verification. A valid
+  tunnel URL can consequently be stripped at the final boundary.
+- Generic duplicate suppression focuses on identical failed calls. Successful
+  external effects, or semantically equivalent calls with different command
+  text, can repeat.
+- Shell permission classification matches arbitrary output text including
+  `Permission denied` and `authentication failure`, then automatically invokes
+  local elevation.
+- `runElevated()` is declared asynchronous, but its platform implementations
+  use synchronous child-process APIs and can block the TUI event loop.
+
+## Research and standards basis
+
+The required architecture is supported by the following evidence. These
+sources establish the principles; they do not prescribe Omnius's exact schema
+names or numeric thresholds.
+
+- Observation-grounded replanning: ReAct interleaves reasoning, actions, and
+  external observations; AgentRx checks trajectory steps against task and tool
+  constraints and retains evidence-backed violations.
+  - <https://arxiv.org/abs/2210.03629>
+  - <https://arxiv.org/abs/2602.02475>
+- Progress must be measured below binary final success. AgentBoard exposes
+  intermediate subgoal progress, while the OOPSLA process-centric study finds
+  repetition, backtracking, and prolonged same-phase stagnation concentrated
+  in unresolved trajectories and reports gains from online intervention.
+  - <https://arxiv.org/abs/2401.13178>
+  - <https://doi.org/10.1145/3798271>
+- External feedback can improve correction, but intrinsic model
+  self-correction can degrade reasoning. Verifiers must therefore be
+  condition-specific and evidence-bound; a second model opinion is advisory,
+  not independent truth.
+  - <https://arxiv.org/abs/2305.11738>
+  - <https://arxiv.org/abs/2310.01798>
+  - <https://aclanthology.org/2024.emnlp-main.714/>
+- Machine-readable failure types must not be reconstructed from human-readable
+  detail strings.
+  - <https://www.rfc-editor.org/rfc/rfc9457.html>
+  - <https://grpc.io/docs/guides/status-codes/>
+- Non-idempotent effects must not be blindly retried. A retry requires proof
+  that the first attempt did not apply, a stable idempotency mechanism, or
+  state reconciliation showing that repetition is safe.
+  - <https://datatracker.ietf.org/doc/html/rfc9110#section-9.2.2>
+  - <https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/>
+- Clarification is a first-class action when a genuinely missing user fact
+  blocks the next criterion. The run must pause durably and resume rather than
+  fail or replay completed work.
+  - <https://arxiv.org/abs/2411.00927>
+  - <https://arxiv.org/abs/2307.01928>
+  - <https://openai.github.io/openai-agents-python/human_in_the_loop/>
+- Production agent runtimes provide finite turn, time, token, functional, and
+  handoff termination. Bounds are safety backstops, not evidence of success or
+  failure.
+  - <https://openai.github.io/openai-agents-python/running_agents/>
+  - <https://microsoft.github.io/autogen/dev/user-guide/agentchat-user-guide/tutorial/termination.html>
+- Node documents that `spawnSync`, `execSync`, and `execFileSync` block the
+  event loop until the child exits.
+  - <https://nodejs.org/api/child_process.html>
+  - <https://nodejs.org/en/learn/asynchronous-work/dont-block-the-event-loop>
+
+## Architectural decisions
+
+1. **One immutable objective contract per task epoch.** Later clarification is
+   a versioned amendment. Model summaries and todo text cannot weaken it.
+2. **One deterministic objective reconciler.** Every admitted tool result is
+   reduced against the current criteria before another action is admitted.
+3. **Typed receipts are authority.** Human-readable output is presentation and
+   diagnostic context, never the primary retry, privilege, or completion key.
+4. **Verifier scope is explicit.** A verifier can contradict an artifact only
+   when it is valid for the same criterion and artifact revision.
+5. **Progress is an acceptance-frontier delta.** Activity, new prose, another
+   URL, or an unrelated mutation is not progress.
+6. **External effects have semantic identities.** Exact command fingerprints
+   are insufficient for idempotency.
+7. **Clarification is suspension, not failure.** Waiting state is durable,
+   scoped, resumable, and single-writer.
+8. **Hard bounds never author semantic output.** A depleted budget selects a
+   bounded review or continuation question; it cannot manufacture an
+   incomplete report.
+9. **Model grounding is advisory.** It may explain or rank evidence, but it
+   cannot grant completion, retry a mutation, or override typed receipts.
+10. **The TUI event loop does no blocking process work.** Elevation is async,
+    abortable, and unavailable to public/group Telegram execution.
+
+## Target state machine
+
+```text
+tool result
+    |
+    v
+normalize typed evidence/effect/verifier receipt
+    |
+    v
+reconcile immutable objective criteria
+    |
+    +--> deliver_due ---------> bounded final synthesis -> send -> completed
+    |
+    +--> verify_due ----------> one criterion-compatible verifier
+    |
+    +--> continue ------------> one action that can change an open criterion
+    |
+    +--> needs_input ---------> persist question -> suspend -> resume same epoch
+    |
+    +--> externally_blocked --> evidence-backed blocker -> terminal report
+    |
+    +--> no_delta ------------> scrutinize -> alternate action -> bounded
+                                 continue offer or needs_input
+```
+
+## Intended types
+
+Names may change during implementation, but the responsibilities may not be
+collapsed back into prose fields.
+
+```ts
+interface TaskObjectiveContractV1 {
+  schema: "omnius.task-objective-contract.v1";
+  taskEpoch: number;
+  originalRequestRef: string;
+  originalRequestHash: string;
+  goal: string;
+  criteria: TaskObjectiveCriterionV1[];
+  exclusions: string[];
+  unknowns: string[];
+  deliveryTarget?: ObjectiveDeliveryTargetV1;
+  revision: number;
+}
+
+interface TaskObjectiveCriterionV1 {
+  id: string;
+  description: string;
+  requiredEvidenceKinds: ObjectiveEvidenceKindV1[];
+  status: "open" | "satisfied" | "blocked";
+}
+
+interface ExternalEffectReceiptV1 {
+  schema: "omnius.external-effect-receipt.v1";
+  effectKind: string;
+  semanticTarget: string;
+  idempotencyKey: string;
+  effectState: "pending" | "applied" | "absent" | "unknown";
+  artifactRevision?: string;
+  evidenceId: string;
+}
+
+interface VerificationReceiptV1 {
+  schema: "omnius.verification-receipt.v1";
+  criterionId: string;
+  artifactEvidenceId: string;
+  artifactRevision?: string;
+  verifierMethod: string;
+  outcome:
+    | "passed"
+    | "artifact_failed"
+    | "verifier_invalid"
+    | "downstream_auth_required"
+    | "inconclusive";
+  evidenceIds: string[];
+}
+
+type ObjectiveFrontierDecision =
+  | "continue"
+  | "verify_due"
+  | "deliver_due"
+  | "needs_input"
+  | "externally_blocked";
+
+interface NeedsInputContractV1 {
+  schema: "omnius.needs-input-contract.v1";
+  runId: string;
+  taskEpoch: number;
+  question: string;
+  missingCriterionIds: string[];
+  evidenceIds: string[];
+  resumeToken: string;
+}
+```
+
+## End-to-end implementation checklist
+
+### Phase 0: baseline, fixtures, and ownership
+
+- [ ] Record implementation-start Git head, tracked branch, and dirty files in
+      the evidence log below. Preserve unrelated `docs/DISCOVERY.*` and
+      `publish/*` changes.
+- [ ] Capture a sanitized deterministic fixture for the tunnel sequence:
+      successful Cloudflare URL, successful transport reachability, downstream
+      SSH authentication rejection, and attempted duplicate creation.
+- [ ] Capture a deterministic event-loop heartbeat fixture that reproduces a
+      pending elevation operation without opening a real OS prompt.
+- [ ] Map every existing objective, completion, convergence, Telegram
+      metacognition, interruption, effect, and delivery type before adding a
+      new one. Reuse authority where semantics already match.
+- [ ] Confirm that all new tests are hermetic and perform no live Telegram,
+      Cloudflare, SSH, Ollama, or privilege-elevation operation.
+
+### Phase 1: immutable task objective contract
+
+Primary seams:
+
+- `packages/orchestrator/src/expectedOutcomeContract.ts`
+- `packages/orchestrator/src/completionContract.ts`
+- `packages/orchestrator/src/completionLedger.ts`
+- `packages/orchestrator/src/agenticRunner.ts`
+- `packages/cli/src/tui/telegram-bridge.ts`
+
+- [ ] Add and validate `TaskObjectiveContractV1` or an equivalently separate
+      typed authority. Do not overload coarse expected-outcome effects with
+      request-specific prose.
+- [ ] Bind the contract to `taskEpoch`, the immutable original-request evidence
+      reference/hash, and the host-authorized delivery target.
+- [ ] Represent request-specific criteria, exclusions, unresolved unknowns,
+      and evidence requirements with stable IDs.
+- [ ] Create the contract once at task-scope installation, before the first
+      action turn.
+- [ ] Persist the contract or its immutable reference in the completion ledger
+      and finalization record.
+- [ ] Replace it only at an explicit task-scope boundary. Represent
+      clarification as a versioned amendment with provenance.
+- [ ] Render a bounded criterion frontier beside the current user goal in the
+      runner context without duplicating the raw request body.
+- [ ] Prove that todo edits, completion summaries, model grounding, and
+      intermediate assistant prose cannot weaken or delete criteria.
+- [ ] Prove that short external-action requests receive a useful objective
+      contract even when the generic code-repair workboard is not created.
+
+### Phase 2: continuous objective reconciliation
+
+Primary seams:
+
+- `_recordCompletionToolEvidenceFromResult()` in `agenticRunner.ts`
+- `reconcileClaimsWithEvidence()` in `completionLedger.ts`
+- `_refreshTrajectoryCheckpoint()` in `agenticRunner.ts`
+
+- [ ] Implement a pure `reconcileTaskObjective()` reducer over the immutable
+      contract, typed evidence, workboard/todo authority, and current receipts.
+- [ ] Return criterion states, missing evidence, contradictions, and exactly
+      one frontier decision.
+- [ ] Invoke reconciliation after every admitted tool result and before the
+      next action can be dispatched.
+- [ ] Persist the current criterion state and frontier fingerprint.
+- [ ] Feed the reconciled frontier into the trajectory checkpoint. Do not make
+      the checkpoint infer objective state from rendered prose.
+- [ ] Make `deliver_due` prevent a further action that cannot advance an open
+      criterion.
+- [ ] Make `verify_due` name the exact criterion, artifact revision, acceptable
+      verifier class, and evidence expected.
+- [ ] Make `needs_input` legal only when the missing criterion truly requires
+      user information or authority.
+- [ ] Make `externally_blocked` require typed external-blocker evidence.
+- [ ] Prove the reducer is deterministic for identical contract/evidence
+      inputs and cannot invoke a model or perform I/O.
+
+### Phase 3: typed effect and verification receipts
+
+Primary seams:
+
+- `packages/orchestrator/src/completionLedger.ts`
+- `packages/orchestrator/src/postActionVerifier.ts`
+- tool-result normalization in `packages/orchestrator/src/agenticRunner.ts`
+- command/process tools in `packages/execution/src`
+
+- [ ] Add typed external-effect identity and state to tool evidence.
+- [ ] Add typed verifier target, artifact revision, verifier method, and outcome.
+- [ ] Preserve raw stdout/stderr as bounded diagnostic evidence, not authority.
+- [ ] Permit contradiction only from `artifact_failed` evidence produced by a
+      valid verifier for the same criterion and artifact revision.
+- [ ] Treat `verifier_invalid` as a request for a corrected verifier, not an
+      artifact failure.
+- [ ] Treat `downstream_auth_required` as outside a transport criterion unless
+      the admitted objective explicitly requires authenticated login.
+- [ ] Treat `inconclusive` as unresolved evidence and prevent blind mutation
+      replay.
+- [ ] Add or adapt a typed receipt for a Cloudflare endpoint registration URL.
+- [ ] Add or adapt a protocol receipt that distinguishes reaching SSH from
+      authenticating an SSH account.
+- [ ] Prove that receipt serialization, restoration, compaction, and context
+      projection preserve identity and revision fields.
+
+### Phase 4: semantic idempotency and duplicate-effect prevention
+
+Primary seams:
+
+- tool preflight/dispatch in `packages/orchestrator/src/agenticRunner.ts`
+- interruption effect fencing in `agenticRunner.ts`
+- existing Telegram delivery idempotency ledger
+
+- [ ] Add a durable run-scoped external-effect ledger with semantic effect
+      identity, not only exact command fingerprints.
+- [ ] Record `pending` before dispatch and reconcile `applied`, `absent`, or
+      `unknown` afterward.
+- [ ] Require a stable idempotency key when a tool/provider supports one.
+- [ ] Before repeating a non-idempotent effect, require proof that the earlier
+      effect is absent/failed or a new user-authorized replacement objective.
+- [ ] Block a second semantically equivalent tunnel creation once a usable
+      endpoint receipt exists, even if the command text or generated hostname
+      differs.
+- [ ] Preserve `unknown` across interruption/restart and require state
+      reconciliation before retry.
+- [ ] Ensure duplicate-effect rejection becomes typed controller evidence and
+      does not create a new failure spiral.
+- [ ] Retain the existing exact-payload Telegram send ledger as the delivery
+      authority; do not create a competing send-idempotency implementation.
+
+### Phase 5: criterion-delta convergence controller
+
+Primary seams:
+
+- `packages/orchestrator/src/convergence-progress.ts`
+- `packages/orchestrator/src/trajectory-checkpoint.ts`
+- convergence/stagnation handling in `agenticRunner.ts`
+- Telegram sub-agent progress event handling
+
+- [ ] Add a persistent `RunConvergenceState` keyed by the objective-frontier
+      fingerprint.
+- [ ] Count progress only when a criterion state, required-evidence set,
+      accepted artifact revision, or delivery state materially changes.
+- [ ] Track action family, targeted criterion, artifact revision, and outcome.
+- [ ] Do not reset convergence because of new prose, another randomized URL,
+      unrelated file mutation, token output, or repeated observation.
+- [ ] First same-frontier repetition: require verifier scrutiny.
+- [ ] Next same-frontier repetition: require an alternate verifier or action
+      family that can change an open criterion.
+- [ ] After a bounded plateau: select `needs_input`, an evidence-backed external
+      blocker, or a natural offer to run another bounded cycle.
+- [ ] Keep turn/time/token limits as independent emergency bounds.
+- [ ] Remove `maxTurns: 0` as the sole Telegram termination policy. Use a
+      documented finite emergency bound high enough for valid research work.
+- [ ] Ensure exhaustion never writes a canned incomplete response.
+- [ ] Convert `trajectory_checkpoint assessment=blocked` into a safe-boundary
+      controller event rather than prompt text alone.
+- [ ] Make the existing problem-frame/model grounding pass advisory to this
+      state; it may not reset progress or authorize another effect.
+- [ ] Replace Telegram's activity timestamp with an acceptance-progress
+      timestamp for stall review while retaining a separate liveness signal.
+- [ ] Bound cross-cycle Telegram continuation by frontier delta, not by a raw
+      cycle count and not by silence alone.
+
+Threshold policy:
+
+- [ ] Choose initial no-delta thresholds from deterministic tests and record
+      the rationale here.
+- [ ] Expose telemetry for threshold calibration without message bodies.
+- [ ] Keep thresholds configurable but bounded; invalid values fail closed to
+      tested defaults.
+- [ ] Do not describe any chosen numeric threshold as a universal research
+      result.
+
+### Phase 6: durable clarification, pause, and resume
+
+Primary seams:
+
+- `AgenticResult` and terminal status types in `agenticRunner.ts`
+- `completionReadiness.ts`
+- `completionFinalization.ts`
+- runner pause/resume and interruption lifecycle
+- Telegram open-task/metacognitive continuation state
+
+- [ ] Add `awaiting_input` as a distinct suspended lifecycle state. Do not map
+      it to `incomplete` or `incomplete_verification`.
+- [ ] Add and persist `NeedsInputContractV1` with one exact question, missing
+      criterion IDs, evidence IDs, task epoch, and a single-use resume token.
+- [ ] Generate natural question wording from the structured blocker without a
+      fixed canned reply.
+- [ ] Suspend only at a safe boundary after in-flight effects are reconciled or
+      fenced as unknown.
+- [ ] Keep the waiting task durable without holding an inference, queue, typing,
+      or process lease.
+- [ ] Match the next user answer to the same chat/scope/task epoch and resume
+      exactly once.
+- [ ] Apply the answer as a versioned objective amendment or criterion evidence;
+      do not start an unrelated replacement run.
+- [ ] Reject concurrent or stale resume attempts and preserve single-writer
+      ownership.
+- [ ] If useful autonomous work remains, continue silently rather than asking
+      merely because a turn threshold fired.
+- [ ] If work is viable but costly after a plateau, ask whether to run another
+      bounded cycle and state what remains unknown.
+- [ ] Prove restart persistence between suspension and resume.
+
+### Phase 7: verified reply retention and Telegram delivery
+
+Primary seams:
+
+- `retainTelegramVisibleReplyDraft()` in `telegram-bridge.ts`
+- `selectTelegramFinalResponse()` in `telegram-bridge.ts`
+- terminal metacognitive/open-task persistence
+- `packages/cli/src/tui/telegram-safe-delivery.ts`
+
+- [ ] Add a durable `TelegramVerifiedReplyCandidate` containing exact text,
+      run/task epoch, satisfied criterion IDs, evidence IDs, URL receipts, and
+      capture turn.
+- [ ] Update the candidate only at a safe evidence boundary.
+- [ ] Do not clear a still-valid candidate merely because a later tool call
+      started.
+- [ ] Invalidate it on task replacement, reply-authority loss, contradictory
+      same-revision evidence, or explicit user supersession.
+- [ ] When the frontier becomes `deliver_due`, perform one bounded no-tools
+      final synthesis or use the current verified candidate.
+- [ ] Keep the existing rule that `task_complete.summary` is never silently
+      substituted for a user-facing answer.
+- [ ] Add `ExternalDestinationReceipt` or equivalent typed URL authority for a
+      provider-created endpoint plus compatible protocol verification.
+- [ ] Continue denying arbitrary, unreceipted, dead, redirected-to-unverified,
+      or model-invented URLs.
+- [ ] Bind the delivered tunnel URL to the exact receipt; truncated TUI display
+      must not alter the click target or Telegram payload.
+- [ ] Preserve group reply authority, current input ownership, chat/topic scope,
+      and one-reply semantics.
+- [ ] On incomplete/aborted public or group runs, remain silent unless an
+      authorized natural clarification question or verified terminal answer is
+      available.
+- [ ] Keep operator diagnostics available in admin surfaces without leaking
+      engineering reports into public replies.
+
+### Phase 8: typed permission handling and nonblocking system authentication
+
+Primary seams:
+
+- `packages/execution/src/tools/shell.ts`
+- `packages/execution/src/system-auth.ts`
+- runner privilege/password recovery handling
+
+- [ ] Remove broad local-privilege inference from arbitrary command output.
+- [ ] Classify local privilege need only from structured local execution
+      provenance, such as an actual spawn/filesystem `EACCES` or `EPERM`, plus
+      explicit command authority.
+- [ ] Prove that remote `ssh`, `scp`, `curl`, and nested-shell text containing
+      `Permission denied`, `authentication failure`, or similar wording never
+      triggers local elevation.
+- [ ] Replace every `execSync`, `spawnSync`, and equivalent blocking elevation
+      path with asynchronous `spawn`/`execFile` handling.
+- [ ] Add timeout, abort, signal, stdout/stderr bounds, and child cleanup.
+- [ ] Ensure timeout cannot remain blocked when a child ignores `SIGTERM`;
+      implement bounded escalation/cleanup appropriate to each platform.
+- [ ] Make exactly one layer own elevation prompting. Remove duplicate runner
+      password-wait behavior where the tool owns native elevation.
+- [ ] For Telegram public/group execution, disable elevation and return a typed
+      `needs_privilege` blocker.
+- [ ] For authorized local/admin interaction, keep OS-native credential entry
+      outside Omnius process memory and expose cancellable progress.
+- [ ] Prove TUI keyboard, hover, render, timers, and Stop remain responsive
+      while an elevation child is pending.
+- [ ] Audit adjacent startup, restore/new, Git status, and update/daemon-stop
+      code for synchronous child-process calls on the interactive event loop;
+      move any discovered blocking operation behind async boundaries and add
+      focused tests before checking this item.
+
+### Phase 9: compatibility, migration, and observability
+
+- [ ] Read legacy completion ledgers without an objective contract and create a
+      conservative new-task contract only at a new run/task epoch.
+- [ ] Never reinterpret a historical completed run by retroactively inventing
+      criteria.
+- [ ] Version all new persisted schemas and validate on read.
+- [ ] Fail closed on malformed receipt identity, revision, or resume ownership.
+- [ ] Add bounded telemetry for criterion transitions, no-delta streaks,
+      verifier classifications, duplicate-effect blocks, suspension/resume,
+      and delivery disposition.
+- [ ] Exclude raw message bodies, credentials, tokens, SSH material, and full
+      private URLs from telemetry.
+- [ ] Ensure context compaction preserves current objective/frontier authority
+      exactly once and does not duplicate raw evidence.
+- [ ] Ensure CLI and daemon callers can supply/consume the host-neutral
+      objective and suspended-state interfaces without importing Telegram code.
+- [ ] Document any intentionally deferred CLI presentation work as a separate
+      linked work order; do not weaken the shared controller to avoid it.
+
+### Phase 10: deterministic regression matrix
+
+Orchestrator:
+
+- [ ] Extend `packages/orchestrator/tests/completionLedger.test.ts` for
+      pre-seeded request criteria and continuous reconciliation.
+- [ ] Prove a wrong-method or invalid verifier does not contradict a valid
+      artifact receipt.
+- [ ] Prove a valid same-target/same-revision artifact failure does contradict.
+- [ ] Prove downstream SSH authentication does not invalidate transport.
+- [ ] Extend `trajectory-checkpoint.test.ts` so superficial output changes and
+      unrelated mutations do not reset criterion stagnation.
+- [ ] Extend `task-convergence-progress.test.ts` so repeated successful probes
+      without frontier delta are not progress.
+- [ ] Add runner coverage for receipt -> `deliver_due` -> duplicate mutation
+      rejection -> verified completion.
+- [ ] Add runner coverage for plateau -> natural `awaiting_input`/continue
+      offer, never canned incomplete.
+- [ ] Add completion-readiness/finalization coverage for suspended state,
+      persistence, and exactly-once resume.
+- [ ] Add restart coverage for pending/unknown external effects.
+
+Execution:
+
+- [ ] Add a remote SSH authentication regression proving zero elevation calls.
+- [ ] Add controls for genuine local `EACCES`/`EPERM` with explicit elevation
+      eligibility.
+- [ ] Add platform-fake tests for async pkexec, sudo/askpass, osascript, and
+      PowerShell success, failure, timeout, abort, and cleanup.
+- [ ] Add an event-loop heartbeat test that remains responsive for the entire
+      pending-auth interval.
+- [ ] Add a Stop/cancel test that terminates the pending child without leaking
+      listeners, timers, or processes.
+
+Telegram/CLI:
+
+- [ ] Extend `telegram-terminal-metacognition.test.ts` for typed no-delta
+      disposition, natural wait question, and same-task resume.
+- [ ] Extend `telegram-steering-finalization.test.ts` for objective amendments,
+      task replacement, and stalled safe-boundary review.
+- [ ] Extend `telegram-bot-api-10.test.ts` for durable verified reply retention
+      across later tool activity.
+- [ ] Extend `telegram-safe-delivery.test.ts` for provider-created tunnel URL
+      receipts plus SSH transport verification.
+- [ ] Prove arbitrary shell-emitted URLs remain denied.
+- [ ] Prove public/group incomplete runs remain silent rather than exposing an
+      engineering report.
+- [ ] Prove current reply ownership and one-reply semantics across
+      suspend/resume, replacement, cancellation, and restart.
+- [ ] Add a TUI integration heartbeat covering typing, hover/click dispatch,
+      input cursor stability, timers, and Stop while async child work is
+      pending.
+
+### Phase 11: build, review, delivery, and live acceptance
+
+- [ ] Run focused tests after each phase and record commands/results below.
+- [ ] Build every changed workspace package.
+- [ ] Run the complete test suites for every changed package after focused
+      tests pass.
+- [ ] Review the final diff for model-authored completion authority, keyword
+      heuristics, unbounded retries, duplicate effects, stale task ownership,
+      URL bypasses, blocking I/O, and private-data telemetry.
+- [ ] Run a source scan proving no synchronous child-process API remains on the
+      interactive elevation/startup/update paths addressed by this order.
+- [ ] Make scoped commits by coherent repair. Never stage unrelated dirty
+      files and never use blanket add.
+- [ ] Fetch the tracked branch before push, resolve only owned-file conflicts,
+      and push without rewriting shared history.
+- [ ] Record commit hashes, remote branch, tests, builds, and known limitations
+      in this document and the master tracker.
+- [ ] Do not publish npm merely because repository acceptance passes. Follow
+      the repository publish SOP only when publication is explicitly part of
+      the active delivery request.
+- [ ] Before any live token-generating canary, satisfy the repository GPU gate:
+      exact endpoint/model, `docker gpu discover`, active lease review, and
+      actual runner placement verified with `nvidia-smi`.
+- [ ] Run one authorized live Telegram canary for the sanitized tunnel-shaped
+      workflow without exposing credentials or creating uncontrolled effects.
+- [ ] Confirm the canary creates at most one semantic endpoint effect, returns
+      the exact verified result, never asks for an unrelated password, and
+      leaves the TUI responsive.
+- [ ] Record the Telegram message IDs, redacted receipt IDs, timings, and final
+      disposition without copying private chat content into the repository.
+- [ ] Mark this work order and the tracker complete only after repository
+      acceptance and the explicitly authorized live gate are both recorded, or
+      record live acceptance as a named external/user-owned remaining gate.
+
+## Required acceptance scenarios
+
+The implementation is not complete until all scenarios have deterministic
+coverage:
+
+1. One successful external effect followed by a compatible verifier leads to
+   `deliver_due`.
+2. Downstream authentication failure does not negate transport success.
+3. An invalid verifier leads to verifier repair, not effect replay.
+4. A semantically duplicate successful mutation is blocked despite different
+   command text.
+5. An unrelated mutation does not count as request progress.
+6. Repeated output/token activity without frontier delta becomes a stall.
+7. A genuine missing user fact produces one natural question and durable
+   suspension.
+8. A response resumes the exact task once without repeating applied effects.
+9. A hard resource bound produces a bounded review/continue offer, not a canned
+   failure report.
+10. A verified reply candidate survives later nonterminal tool work.
+11. A provider-created, protocol-verified URL passes final safe delivery; an
+    arbitrary shell URL does not.
+12. Public/group incomplete work remains silent unless a reply is authorized.
+13. Remote SSH `Permission denied` never requests local elevation.
+14. Pending elevation never freezes TUI input, hover/click handling, rendering,
+    timers, or Stop.
+15. Restart preserves objective, effect, stall, suspended-input, and delivery
+    ownership without duplication.
+
+## Evidence log
+
+Update this section during implementation. Do not mark checklist items from
+memory or from an earlier build.
+
+### Implementation start
+
+- Git head: `16c65cd3d0436c8860d1bfd014321495205ed941`
+- Tracked branch: `main` -> `origin/main`
+- Preserved dirty files: `docs/DISCOVERY.json`, `docs/DISCOVERY.md`,
+  `publish/npm-shrinkwrap.json`, and `publish/package.json`
+- Feature flags/migration mode: strict objective enforcement is the default;
+  Telegram uses `verified_external_effect` while its coarse router outcome
+  contracts migrate, and activates the hard delivery guard only after an exact
+  provider destination is joined to compatible transport evidence.
+
+### Scoped commits
+
+- Objective contract/reconciler: `329cefd2`
+- Typed verifier/effect receipts: `d405c734`, `329cefd2`
+- Convergence and suspension: `329cefd2`
+- Telegram verified delivery and continuation receipt persistence: `30cf56c6`
+- Async privilege execution: `d405c734`
+- Async startup restore: `d58ec7c4`
+- Regression-guard reconciliation: `c1447f76`, `bbbceacf`
+- Final objective/async integration: `f907996a`
+- Final Case Theory/Telegram lifecycle repair: `48ed529d`
+- Verification evidence update: `15dc2f14` plus the delivery-record follow-up
+  containing this line.
+
+### Focused verification
+
+- Live Case Theory forensic fixture: message 476 owned the active eDiscovery
+  task; a different actor's directly addressed message 477 was incorrectly
+  admitted as `context_only` while visible-reply ownership moved. Message 479
+  then exposed a completion-summary claim ("My reply already landed") without
+  an accepted visible answer. The deterministic regressions now require
+  `continuity=new|replace` to fence the old runner and start a new task epoch,
+  and require zero public sends when no current-input model reply was accepted.
+
+- Orchestrator command/result:
+  `pnpm --filter @omnius/orchestrator exec vitest run tests/task-objective.test.ts tests/agenticRunner-objective-control.test.ts tests/agenticRunner.test.ts -t 'objective|retains an honestly declared incomplete task_complete outcome' --reporter=dot`
+  -> 11 passed, 179 unrelated cases skipped by the name filter.
+- Execution command/result:
+  `pnpm --filter @omnius/execution exec vitest run tests/shell-objective-evidence.test.ts tests/shell-permission-boundary.test.ts tests/system-auth.test.ts --reporter=dot`
+  -> 30 passed.
+- Telegram/CLI command/result:
+  `pnpm --filter omnius exec vitest run tests/telegram-safe-delivery.test.ts tests/telegram-bot-api-10.test.ts tests/telegram-terminal-metacognition.test.ts tests/telegram-steering-finalization.test.ts tests/telegram-terminal-delivery.test.ts tests/telegram-lifecycle-leak.test.ts tests/session-diary.test.ts --reporter=dot`
+  -> 283 passed.
+- TUI responsiveness command/result: `system-auth.test.ts` covers heartbeat,
+  abort, timeout, forced cleanup, and child-leak behavior for the async native
+  authentication boundary; 22 cases passed. `session-diary.test.ts` covers the
+  asynchronous startup restore snapshot and passed in the Telegram/CLI group.
+- Final Case Theory/Telegram acceptance command/result:
+  `pnpm --dir packages/cli exec vitest run tests/telegram-bot-api-10.test.ts tests/telegram-terminal-metacognition.test.ts tests/telegram-steering-intake.test.ts tests/telegram-safe-delivery.test.ts tests/telegram-causal-consolidation.test.ts tests/telegram-steering-finalization.test.ts tests/telegram-terminal-delivery.test.ts tests/telegram-objective-resume.test.ts tests/telegram-turn-continuity.test.ts --reporter=dot`
+  -> 9 files, 242 passed.
+- Final objective-loop focused result: 13 orchestrator files, 171 passed,
+  covering deterministic frontier reconciliation, pending-effect fencing,
+  durable `awaiting_input`, exact-once fresh-run resume, accepted visible reply
+  authority, and completion persistence.
+- Restored async/auth/update focused results: execution 10 files / 108 passed;
+  CLI 9 files / 62 passed. The targeted source scan found no synchronous child
+  process calls or `Atomics.wait` in the addressed GPS, SDR, Meshtastic, audio,
+  updater, update-service, tray, or Voicebox paths.
+
+### Aggregate verification
+
+- Changed-package builds: execution, orchestrator, and CLI TypeScript builds passed.
+- Changed-package full suites: CLI 2,930/2,933 passed on the first aggregate
+  run; the three failures were stale source-shape guards for previously shipped
+  transparent branding, consolidated live-media header control, and corrected
+  editable cursor row, and all seven cases in those files passed after their
+  assertions were reconciled. Execution passed 1,921/1,922; the sole failure is
+  the pre-existing `audio-generate.test.ts:77` device-selection expectation and
+  is outside WO-56. Orchestrator passed 2,969/3,010 in the aggregate run; the
+  task-owned legacy `needs_input` and source-marker failures were fixed and pass
+  focused verification, while the remaining aggregate-only failures are being
+  recorded separately below rather than hidden.
+- Workspace build: all 11 buildable workspace projects passed `pnpm -r build`;
+  execution, orchestrator, and CLI also passed their post-integration builds.
+- Independent diff review: `git diff --check` passed; receipt authority,
+  same-artifact verification, pending-before-dispatch, public silence, safe URL
+  delivery, and legacy-host compatibility were reviewed at their call sites.
+- Sync-child source scan: no `execSync`, `spawnSync`, or `execFileSync` remains
+  in the addressed TUI startup/restore, status/header, shell, or native-auth
+  paths. This does not claim that every compatibility filesystem API elsewhere
+  in the large TUI module has been converted.
+
+### Delivery
+
+- Fetch result: `git fetch origin main` completed; local branch was six commits
+  ahead and zero behind before the documentation commit.
+- Remote branch: `origin/main`
+- Push result: `16c65cd3..15dc2f14 main -> main` completed without history
+  rewrite; this delivery-record follow-up is pushed as the final documentation
+  commit.
+- Repository acceptance: deterministic implementation, focused acceptance,
+  scoped commit delivery, and remote push are complete.
+- npm publication: not authorized by this work order alone
+- Live canary: not run; this remains the named external/user-owned gate and is
+  subject to the repository GPU preflight plus authorization for real Telegram,
+  Cloudflare, and SSH effects.
+
+## Explicit non-goals
+
+- Do not introduce keyword rules that decide whether the user deserves a reply.
+- Do not use a second LLM call as deterministic completion authority.
+- Do not infer local privilege need from arbitrary stderr/stdout prose.
+- Do not make all external operations generally retryable.
+- Do not weaken Telegram URL evidence requirements for arbitrary links.
+- Do not require SSH passwords or store credentials in Omnius.
+- Do not equate a configured timeout, turn cap, or stall threshold with proof
+  that the user's request succeeded or failed.
+- Do not run live inference, publish npm, restart shared services, or create
+  external tunnel effects merely to satisfy repository tests.