opencode-swarm 7.177.1 → 7.178.1

package/dist/mcp/adapters/knowledge-add.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Explicitly-authorized MCP knowledge_add adapter (#2500).
+ *
+ * This adapter owns only the MCP idempotency boundary. Validation,
+ * actionability, deduplication, reinforcement, quarantine, and the atomic
+ * knowledge transaction remain in the registered production knowledge_add
+ * tool. The adapter passes a fixed server root and never accepts a
+ * working-directory override.
+ */
+import { type KnowledgeAddAdapterRuntime, knowledgeAddInput } from '../write-receipts.js';
+export interface McpKnowledgeAddWriteAdapter {
+    name: 'knowledge_add';
+    kind: 'write';
+    pathFields: string[];
+    inputSchema: typeof knowledgeAddInput;
+    execute(rawArgs: unknown, root: string, runtime?: KnowledgeAddAdapterRuntime): Promise<unknown>;
+}
+export declare function executeKnowledgeAdd(rawArgs: unknown, root: string, runtime?: KnowledgeAddAdapterRuntime): Promise<unknown>;
+export declare const knowledgeAddAdapter: McpKnowledgeAddWriteAdapter;

package/dist/mcp/adapters/receipt-status.d.ts

@@ -0,0 +1,3 @@
+/** Read-only MCP status probe for explicitly-authorized knowledge writes. */
+import type { McpReadTool } from '../registry.js';
+export declare const receiptStatusAdapter: McpReadTool;

package/dist/mcp/adapters/scope-validation.d.ts

@@ -0,0 +1,3 @@
+/** Read-only MCP adapter for the inline shell-write scope advisory (#2500). */
+import type { McpReadTool } from '../registry.js';
+export declare const scopeValidationAdapter: McpReadTool;

package/dist/mcp/registry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Tool registry for the read-only MCP verification surface (#2499).
+ * Tool registry for the MCP verification surface (#2499, #2500).
  *
  * `buildMcpToolRegistry` composes the read-only tool set for ONE configured
  * project root. Descriptions are sourced from `TOOL_METADATA` — the same
@@ -7,21 +7,20 @@
  * registered tool names with exact description parity (frozen by
  * repro/check-mcp-registry-capability-coverage.sh, C2).
  *
- * The write boundary is fail-closed (frozen by
- * repro/check-mcp-readonly-default-no-writes.sh, C6): every tool name is
- * validated against a write-capable denylist and a match THROWS — with or
- * without `allowWrite`. Phase 1 ships zero write tools; `allowWrite` is the
- * documented forward-compat seam for the #2500 write surface and adds
- * nothing today.
+ * The write boundary is fail-closed: a write is present only when the caller
+ * supplies both the startup capability flag and an exact reviewed tool name.
+ * The positive allowlist below is checked again here (rather than trusting the
+ * CLI) so direct programmatic callers cannot widen the MCP surface.
  */
 import type { z } from 'zod';
+import type { KnowledgeAddAdapterRuntime } from './write-receipts.js';
 /** Write-capable tool-name shapes. Mirrors the frozen C6 denylist. */
 export declare const WRITE_TOOL_NAME_PATTERN: RegExp;
 export interface McpReadTool {
     /** Registered plugin tool name (a TOOL_METADATA key). */
     name: string;
     /** Exact TOOL_METADATA description (parity assigned at build time). */
-    description: string;
+    description?: string;
     kind: 'read';
     /** Argument field names carrying file-path values (containment-checked). */
     pathFields: string[];
@@ -29,19 +28,32 @@ export interface McpReadTool {
     inputSchema: z.ZodObject<z.ZodRawShape>;
     execute(args: Record<string, unknown>, root: string): Promise<unknown>;
 }
+export interface McpWriteTool {
+    /** Registered plugin tool name (a TOOL_METADATA key). */
+    name: string;
+    /** Exact TOOL_METADATA description (parity assigned at build time). */
+    description?: string;
+    kind: 'write';
+    /** Argument field names carrying file-path values (containment-checked). */
+    pathFields: string[];
+    /** MCP input schema (mirrors the reviewed tool's zod args). */
+    inputSchema: z.ZodObject<z.ZodRawShape>;
+    execute(args: Record<string, unknown>, root: string, runtime?: KnowledgeAddAdapterRuntime): Promise<unknown>;
+}
+export type McpTool = McpReadTool | McpWriteTool;
 export interface McpToolRegistry {
-    tools: McpReadTool[];
+    tools: McpTool[];
 }
 export interface BuildMcpToolRegistryOptions {
     /** The single configured project root (one server = one root). */
     root: string;
     /** Alias for `root` (accepted for harness compatibility). */
     directory?: string;
-    /**
-     * Forward-compat seam for the #2500 explicitly-authorized write surface.
-     * Phase 1 has no write tools, so this flag never adds anything; the
-     * write-name denylist stays fail-closed either way.
-     */
+    /** Startup capability gate. This flag alone never registers a write. */
     allowWrite?: boolean;
+    /** Exact reviewed write names authorized for this server instance. */
+    writeTools?: string[];
 }
+/** The only MCP write adapter reviewed and shipped by #2500. */
+export declare const REVIEWED_MCP_WRITE_TOOLS: readonly ["knowledge_add"];
 export declare function buildMcpToolRegistry(options: BuildMcpToolRegistryOptions): McpToolRegistry;

package/dist/mcp/server.d.ts

@@ -8,6 +8,7 @@
  * the response pipeline before it leaves the server.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { KnowledgeAddAdapterRuntime } from './write-receipts.js';
 /** Containment rejection carried as a tool-level error result. */
 export declare class McpContainmentError extends Error {
     readonly field: string;
@@ -20,6 +21,10 @@ export declare function validatePathField(field: string, value: unknown, root: s
 export interface RunMcpServerOptions {
     root: string;
     allowWrite?: boolean;
+    /** Exact reviewed write names authorized for this server instance. */
+    writeTools?: string[];
+    /** Test-only receipt fault and clock hooks. */
+    writeHooks?: KnowledgeAddAdapterRuntime['hooks'];
     /** Test seam: inject transports instead of stdio (InMemoryTransport pair). */
     transport?: {
         connect(server: unknown): Promise<void>;

package/dist/mcp/write-receipts.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Durable settlement receipts for explicitly-authorized MCP writes (#2500).
+ *
+ * The receipt journal is deliberately a separate durability domain from the
+ * knowledge store. Its lock is held only while looking up or appending a
+ * receipt. A production mutation is always made after PREPARED is durable and
+ * outside that lock, so the journal cannot be nested with the knowledge-store
+ * transaction lock.
+ */
+import { z } from 'zod';
+export declare const MCP_WRITE_RECEIPTS_RELATIVE_PATH: string;
+/**
+ * Terminal receipt history is moved here when the active journal reaches its
+ * bounded record count. Unresolved records remain active; if an active rewrite
+ * fails after archive rotation, a best-effort recovery shadow is written so a
+ * newly prepared attempt cannot disappear before mutation.
+ */
+export declare const MCP_WRITE_RECEIPTS_ARCHIVE_RELATIVE_PATH: string;
+export declare const PREPARED_LEASE_MS = 30000;
+export declare const MAX_RECEIPT_RECORDS = 500;
+export declare const MAX_RECEIPT_ARCHIVE_RECORDS = 10000;
+export declare const MAX_RECEIPT_LINE_BYTES = 16384;
+export declare const MAX_RECEIPT_JOURNAL_BYTES: number;
+export declare const MAX_RECEIPT_ARCHIVE_BYTES: number;
+export declare const MAX_RECEIPT_RESPONSE_BYTES: number;
+/** Immutable receipt identity version for the reviewed knowledge_add policy. */
+export declare const KNOWLEDGE_ADD_POLICY_VERSION = "knowledge_add:v1";
+export declare const writeReceiptStatusInput: z.ZodObject<{
+    idempotency_key: z.ZodString;
+}, z.core.$strip>;
+export declare const WRITE_RECEIPT_STATES: readonly ["PREPARED", "COMMITTED", "FAILED_NO_EFFECT", "IN_DOUBT"];
+export type WriteReceiptState = (typeof WRITE_RECEIPT_STATES)[number];
+export interface WriteReceiptRecord {
+    version: 1;
+    receipt_id: string;
+    attempt_id: string;
+    tool: string;
+    root_hash: string;
+    idempotency_hash: string;
+    arguments_digest: string;
+    policy_digest: string;
+    state: WriteReceiptState;
+    prepared_at: number;
+    updated_at: number;
+    lease_expires_at: number;
+    response?: string;
+    error?: string;
+}
+export interface WriteReceiptHooks {
+    /**
+     * Test-only fault seam. It is invoked before each durable transition. The
+     * supplied record is already sanitized and contains no raw request fields.
+     */
+    persistReceipt?: (receipt: WriteReceiptRecord) => Promise<void>;
+    /**
+     * Test-only fault/order seam. It is invoked immediately before each
+     * physical archive or active-journal rewrite. The records are sanitized
+     * receipt records and the callback may throw to model an I/O failure.
+     */
+    persistStorage?: (kind: 'archive' | 'active', records: readonly WriteReceiptRecord[]) => Promise<void>;
+    /** Test-only interruption seam after PREPARED is durable. */
+    afterPrepare?: (receipt: WriteReceiptRecord) => Promise<void>;
+    /** Test-only interruption seam after the production call returns. */
+    afterMutation?: (receipt: WriteReceiptRecord) => Promise<void>;
+    /** Test-only clock seam. Production uses Date.now. */
+    now?: () => number;
+}
+export interface WriteReceiptRequest {
+    root: string;
+    tool: string;
+    idempotencyKey: string;
+    arguments: unknown;
+    policy?: string;
+}
+export type PrepareReceiptResult = {
+    kind: 'prepared';
+    receipt: WriteReceiptRecord;
+} | {
+    kind: 'replay';
+    receipt: WriteReceiptRecord;
+    response: unknown;
+} | {
+    kind: 'in_progress' | 'in_doubt';
+    receipt: WriteReceiptRecord;
+} | {
+    kind: 'conflict';
+    receipt: WriteReceiptRecord;
+    response: unknown;
+};
+export declare class WriteReceiptError extends Error {
+    readonly code: 'INVALID_REQUEST' | 'JOURNAL_UNAVAILABLE' | 'JOURNAL_CORRUPT' | 'JOURNAL_CAPACITY' | 'TRANSITION_REJECTED';
+    constructor(code: WriteReceiptError['code'], message: string);
+}
+export declare function getWriteReceiptPath(root: string): string;
+export declare function getWriteReceiptArchivePath(root: string): string;
+export declare function canonicalArguments(value: unknown): string;
+export declare function computeWriteReceiptIdentity(request: WriteReceiptRequest): Pick<WriteReceiptRecord, 'root_hash' | 'idempotency_hash' | 'arguments_digest' | 'policy_digest'>;
+export interface WriteReceiptStatus {
+    found: boolean;
+    status: WriteReceiptState | 'NOT_FOUND';
+    tool?: string;
+    receipt_id?: string;
+    attempt_id?: string;
+    updated_at?: number;
+    lease_expires_at?: number;
+    archived?: boolean;
+    /** A missing receipt is safe to submit; every recorded state is not. */
+    retryable: boolean;
+}
+export declare function sanitizeReceiptResponse(value: unknown, request?: Pick<WriteReceiptRequest, 'root' | 'idempotencyKey' | 'arguments'>): string;
+export declare function parseReceiptResponse(response: string): unknown;
+/**
+ * Read the latest status for one knowledge_add idempotency key without
+ * creating a lock or any other project state. Response/error payloads are
+ * intentionally omitted: this surface is only an uncertainty/replay probe.
+ */
+export declare function readWriteReceiptStatus(root: string, idempotencyKey: string): Promise<WriteReceiptStatus>;
+/**
+ * Add fixed receipt metadata to a bounded stored response. The production
+ * result remains intact, including success:false; no receipt IDs or request
+ * fields are exposed to the MCP client.
+ */
+export declare function addReplayMarker(value: unknown): unknown;
+/**
+ * Look up or durably prepare one write attempt. The returned PREPARED record
+ * owns the attempt. Callers MUST release the receipt transition lock before
+ * invoking production code, then call commitReceipt or markInDoubt.
+ */
+export declare function prepareReceipt(request: WriteReceiptRequest, hooks?: WriteReceiptHooks): Promise<PrepareReceiptResult>;
+export declare function commitReceipt(request: WriteReceiptRequest, attempt: WriteReceiptRecord, response: unknown, hooks?: WriteReceiptHooks): Promise<WriteReceiptRecord>;
+export declare function markInDoubt(request: WriteReceiptRequest, attempt: WriteReceiptRecord, error: string, hooks?: WriteReceiptHooks): Promise<WriteReceiptRecord>;
+/**
+ * Adapter-facing execution helper. It owns the prepare/call/settle sequence
+ * but accepts the production operation as a callback so the registry can
+ * provide knowledge_add without duplicating its logic.
+ */
+export declare function executeWithReceipt<T>(request: WriteReceiptRequest, operation: () => Promise<T>, hooks?: WriteReceiptHooks): Promise<unknown>;
+export declare const knowledgeAddInput: z.ZodObject<{
+    idempotency_key: z.ZodString;
+    lesson: z.ZodString;
+    category: z.ZodEnum<{
+        security: "security";
+        other: "other";
+        process: "process";
+        architecture: "architecture";
+        tooling: "tooling";
+        testing: "testing";
+        debugging: "debugging";
+        performance: "performance";
+        integration: "integration";
+        todo: "todo";
+    }>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodString>;
+    applies_to_agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    applies_to_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    forbidden_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    verification_checks: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export interface KnowledgeAddAdapterRuntime {
+    hooks?: WriteReceiptHooks;
+    policy?: string;
+}
+export declare function buildKnowledgeAddRequest(root: string, rawArgs: unknown, runtime?: KnowledgeAddAdapterRuntime): {
+    request: WriteReceiptRequest;
+    productionArgs: Record<string, unknown>;
+};

package/dist/memory/index.d.ts

@@ -10,6 +10,7 @@ export { createMemoryLifecycleHooks, type MemoryLifecycleHookOptions, type Memor
 export { backupLegacyJsonl, getLegacyJsonlFileStatus, getLegacyOutcomeJsonlSignature, type JsonlBackupResult, type JsonlImportPayload, type JsonlInvalidRow, type JsonlMigrationReport, LEGACY_JSONL_MIGRATION_NAME, LEGACY_JSONL_MIGRATION_VERSION, LEGACY_JSONL_OUTCOME_META_KEY, readLegacyJsonl, readMigrationReport, resolveMemoryStorageDir, resolveSqliteDatabasePath, writeJsonlExport, writeMigrationReport, } from './jsonl-migration';
 export { LocalJsonlMemoryProvider } from './local-jsonl-provider';
 export { buildMemoryMaintenanceReport, type MemoryMaintenanceReport, type MemoryMaintenanceReportOptions, type MemoryRecallUsageByMemory, type MemoryRecallUsageByRole, type MemorySupersededChain, shouldCompactMemory, } from './maintenance';
+export { MemoryMigrationLockError } from './memory-family-migration';
 export { invalidateMemoryStoreDirCache, isMemoryLinked, MEMORY_LINK_POINTER_FILENAME, type MemoryLinkPointer, readMemoryLinkPointer, removeMemoryLinkPointer, resolveMemoryStoreDir, writeMemoryLinkPointer, } from './memory-link';
 export type { MemoryOutcomeEvent } from './outcome-events';
 export { computePiiScore, createPiiDetector, type PiiDetector, type PiiFinding, type PiiType, RegexPiiDetector, summarizePiiFindings, } from './pii';

package/dist/memory/memory-family-migration.d.ts

@@ -18,15 +18,46 @@
  * (`handleMemoryLinkCommand`), so a mid-migration failure leaves the worktree
  * in its prior link state and a retry is idempotent.
  *
- * Lock discipline: `proper-lockfile` on the destination cohort dir with a
- * bumped `stale` (30s) for the migration critical section — reused from the
- * knowledge family so there is one source of truth for the lock config.
+ * Lock discipline: `proper-lockfile` on the destination storage dir (cohort
+ * OR local — both directions) with a bumped `stale` (30s) for the migration
+ * critical section — reused from the knowledge family so there is one source
+ * of truth for the lock config. `realpath: false` keeps the lock identity on
+ * the literal path so it is the SAME lock the local JSONL provider takes on
+ * this directory (PRR-U1): symlinked roots (e.g. macOS /var → /private/var)
+ * must not split the exclusion into two identities.
+ * Admission is fail-closed (#2577): if the destination lock cannot be
+ * acquired (a legitimate concurrent writer holds it, or acquisition fails for
+ * a storage reason), the migration throws a typed
+ * {@link MemoryMigrationLockError} and never runs unlocked.
  *
  * No writes happen here on the plugin-init path (invariant 1). Called only
  * from the `/swarm memory link` / `/swarm memory unlink` command handlers.
  */
 import { type MemoryOutcomeEvent } from './outcome-events.js';
 import type { VettedMemoryRoot } from './storage-root.js';
+/**
+ * Minimal typing for the async `proper-lockfile` API this engine uses,
+ * exposed through {@link _internals} so tests can classify acquisition
+ * failures deterministically (same DI pattern as `src/full-auto/state.ts`).
+ */
+type MigrationLockFile = {
+    lock: typeof import('proper-lockfile')['lock'];
+};
+/** Failure category for destination-lock admission (#2577, #2575 contract). */
+export type MemoryMigrationLockErrorCategory = 'contention' | 'storage';
+/**
+ * Typed failure for acquiring the destination migration lock. Thrown BEFORE
+ * the merge loop opens, so no destination or source write ever happens on a
+ * failed admission. Mirrors `FullAutoStateLockError` in
+ * `src/full-auto/state.ts` (#2575): stable category + code, cause preserved
+ * for diagnostics, and messages that never echo absolute host paths.
+ */
+export declare class MemoryMigrationLockError extends Error {
+    readonly category: MemoryMigrationLockErrorCategory;
+    readonly cause: unknown;
+    readonly code: `MEMORY_MIGRATION_LOCK_${Uppercase<MemoryMigrationLockErrorCategory>}`;
+    constructor(category: MemoryMigrationLockErrorCategory, message: string, cause?: unknown);
+}
 export interface MemoryFamilyMigrationCounts {
     readonly perMember: ReadonlyArray<{
         filename: string;
@@ -102,5 +133,6 @@ export declare const _internals: {
     stageSqliteDb: typeof stageSqliteDb;
     mergeStagedSqlite: typeof mergeStagedSqlite;
     countRowsSafe: typeof countRowsSafe;
+    lockfile: MigrationLockFile;
 };
 export {};

package/dist/plan/ledger.d.ts

@@ -163,6 +163,20 @@ export declare function computePlanLedgerHash(plan: Plan): string;
  * any structural change (description, acceptance, dependencies, files, added
  * or removed tasks/phases) always must.
  *
+ * DELIBERATE exception, recorded with #2532 (PLAN-4): `current_phase` — the
+ * execution cursor — IS included in this hash (and in
+ * {@link computePlanLedgerHash}). Unlike task/phase statuses, a cursor
+ * advance therefore DOES change the baseline hash: bindings and approved
+ * snapshots declared against the pre-advance plan stop matching, exactly as
+ * they already do for any save_plan revision. This is intentional — the
+ * hash bytes are persisted on every live binding (`planStructureHash`,
+ * verified with strict equality) and every critic-approved snapshot
+ * (`payload_hash`), so changing the normalization would silently invalidate
+ * all pre-existing state at upgrade. The bounded safety property: only a
+ * phase-boundary advancement moves the cursor (task-status churn inside a
+ * phase is hash-excluded), so mid-phase parallel siblings keep their
+ * bindings across ordinary task completion.
+ *
  * This mirrors {@link computePlanLedgerHash}'s normalization byte-for-byte
  * EXCEPT it omits the two status fields from the hashed payload. The two
  * functions are deliberately distinct: {@link computePlanLedgerHash} is

package/dist/plan/manager.d.ts

@@ -44,7 +44,6 @@ import { getWorktreeMergeFailure } from '../hooks/delegation-gate/worktree-merge
 import { recordTaskAttempt } from '../services/run-memory.js';
 import { isEpicModeActiveForProject } from '../turbo/epic/state.js';
 import { commitTaskCompletion } from '../turbo/epic/task-commit.js';
-import { readTaskScopes } from '../turbo/lean/conflicts.js';
 import { type LedgerEvent, type LedgerEventInput, ledgerExists, loadLastApprovedPlan, readLedgerEventsWithIntegrity, replayFromLedger, takeSnapshotWithRetry } from './ledger';
 /** Reset the startup ledger check flag. For testing only. */
 export declare function resetStartupLedgerCheck(): void;
@@ -69,7 +68,6 @@ export declare const _internals: {
     regeneratePlanMarkdown: typeof regeneratePlanMarkdown;
     isGitRepo: typeof isGitRepo;
     isEpicModeActiveForProject: typeof isEpicModeActiveForProject;
-    readTaskScopes: typeof readTaskScopes;
     commitTaskCompletion: typeof commitTaskCompletion;
     getWorktreeMergeFailure: typeof getWorktreeMergeFailure;
     recordTaskAttempt: typeof recordTaskAttempt;

package/dist/plan/parallel-verdict.d.ts

@@ -1,7 +1,7 @@
 /**
  * Plan-time parallel-execution verdict helper (#1656 / #1674 v8 flagship).
  *
- * Pure, synchronous, side-effect-free pairwise conflict analysis for N proposed
+ * Pure, side-effect-free pairwise conflict analysis for N proposed
  * parallel task groups. Used by BOTH:
  *   - the `plan_conflict_check` tool (architect-facing advisory — see
  *     `src/tools/plan-conflict-check.ts`), and
@@ -14,23 +14,30 @@
  * means.
  *
  * Design notes:
- *  - Sync by design: it reads only `.swarm/scopes/scope-<taskId>.json` via
- *    the hardened persisted-scope reader (sync + fail-closed). The gate runs in
- *    `toolBefore` on every tool call and must stay bounded; an async/gitten
- *    helper would violate the bounded-gate spirit.
+ *  - Sync by design: it reads only the authoritative v2 scope-binding store
+ *    (the same authority `declare_scope` writes) via the hardened
+ *    fail-closed readers. The gate runs in `toolBefore` on every tool call
+ *    and must stay bounded; an async helper would violate the bounded-gate
+ *    spirit. One binding-set scan is hoisted per verdict, never per task.
+ *  - #2532 (PARALLEL-4): scope resolution deliberately does NOT consult the
+ *    legacy v1 `.swarm/scopes/scope-<taskId>.json` projection — no production
+ *    code writes it in the project root (its one writer targets lane
+ *    worktrees), so v2-declared disjoint scopes used to be reported as
+ *    `unknown_scopes` and parallel-first could never engage.
  *  - The helper itself NEVER calls `getCoChangePairs` (async + `git log`).
  *    Co-change signal is opt-in and supplied by the caller (the tool) via
  *    `options.cochangePairs`. The gate never supplies it, keeping the
  *    enforcement path git-free and fast.
- *  - Fail-closed: a missing/malformed scope → `unknown_scope`, which conflicts
- *    with everything, so `verdict` can never be `all_disjoint` while any task
- *    lacks a declared scope. This is the v8 safety guarantee.
+ *  - Fail-closed: a task with no single live exact-plan v2 binding →
+ *    `unknown`, which conflicts with everything, so `verdict` can never be
+ *    `all_disjoint` while any task lacks a declared scope. This is the v8
+ *    safety guarantee.
  *  - Writes nothing. Honors issue #1656's "read-only (writes nothing)" tool
  *    acceptance criterion.
  */
+import { type Plan } from '../config/plan-schema.js';
 import type { CoChangeEntry } from '../tools/co-change-analyzer.js';
 import { type CoChangeThreshold } from '../turbo/epic/cochange-conflict.js';
-import { normalizePath, pathsConflict, readTaskScopes } from '../turbo/lean/conflicts.js';
 /**
  * Per-pair conflict classification. Mirrors `EpicPairVerdict`'s signal
  * decomposition but flattens `none` into `disjoint` for the plan-level view.
@@ -70,14 +77,22 @@ export interface ComputeParallelVerdictOptions {
     cochangePairs?: CoChangeEntry[];
     /** Override the co-change threshold. Defaults to `DEFAULT_PARALLEL_COCHANGE_THRESHOLD`. */
     cochangeThreshold?: CoChangeThreshold;
+    /**
+     * The plan the verdict is computed against (issue #2532). Bindings must
+     * match its exact identity (`planId` + `planStructureHash`). When omitted,
+     * the helper synchronously reads `<directory>/.swarm/plan.json`; a missing
+     * or unparseable plan resolves every task to `unknown` (fail-closed).
+     */
+    plan?: Plan;
 }
 /**
  * Compute a pairwise conflict verdict for the given task ids.
  *
- * Pure + synchronous. Reads only `.swarm/scopes/`. Writes nothing. Fail-closed
- * on any read/parse error (treats the task as `unknown`).
+ * Pure + synchronous. Reads only the authoritative v2 binding store (plus a
+ * bounded plan.json read when `options.plan` is omitted). Writes nothing.
+ * Fail-closed on any read/parse error (treats the task as `unknown`).
  *
- * @param directory  Project root (for `.swarm/scopes/` reads).
+ * @param directory  Project root (for the binding store and plan.json reads).
  * @param taskIds    Task ids to analyze. Caller is responsible for min-length
  *                   validation (the tool requires ≥2; the gate only calls this
  *                   with ≥2 pending tasks).
@@ -90,5 +105,4 @@ export declare function computeParallelVerdict(directory: string, taskIds: strin
  * Equivalent to `computeParallelVerdict(...).verdict === 'all_disjoint'` but
  * exposed as a named predicate so the gate reads as intent.
  */
-export declare function isProvablyDisjoint(directory: string, taskIds: string[]): boolean;
-export { normalizePath, pathsConflict, readTaskScopes };
+export declare function isProvablyDisjoint(directory: string, taskIds: string[], options?: ComputeParallelVerdictOptions): boolean;

package/dist/scope/scope-persistence.d.ts

@@ -117,6 +117,47 @@ export declare function readScopeBindingFromDisk(input: {
     requireDispatchCorrelation?: boolean;
     requireDeclaration?: boolean;
 }): ScopeBinding | null;
+/**
+ * Resolve the currently-declared scope FILES for a task from the authoritative
+ * v2 binding store (issue #2532 / PARALLEL-4).
+ *
+ * Scheduling/conflict consumers (the v8 parallel verdict, Rule-2 auto-commit)
+ * must resolve task scopes from the same authority `declare_scope` writes —
+ * never from the legacy v1 `scope-<taskId>.json` projection, which no
+ * production code writes in the project root. This is a scheduling read, NOT
+ * write authorization: it deliberately does not require owner-session or
+ * dispatch correlation, but it DOES require an exact `planStructureHash`
+ * match so a declaration made against an older plan revision cannot certify
+ * disjointness for the current one.
+ *
+ * Fail-closed: zero live candidates (undeclared or store failure), live
+ * candidates that DISAGREE on the file set, or an empty file list all return
+ * `null`, which callers treat as "unknown scope" → serial. Multiple live
+ * candidates that AGREE on the exact same file set are NOT ambiguous: the
+ * delegation gate mints a dispatch-correlated binding (activation 'active',
+ * child owner) alongside the architect's declaration binding for the same
+ * task with the same files, and the scheduling question — "what is this
+ * task's currently-declared scope?" — has one answer whenever they agree.
+ *
+ * `bindingSet` lets a multi-task caller hoist ONE
+ * `readAllAuthoritativeScopeBindings` scan for the whole verdict (pass the
+ * result of {@link readAuthoritativeScopeBindingSet}); omit it for a
+ * single-task read.
+ */
+export declare function readDeclaredScopeFilesFromBindings(input: {
+    directory: string;
+    taskId: string;
+    plan: Plan;
+    bindingSet?: ScopeBinding[] | null;
+}): string[] | null;
+/**
+ * Hoisted single read of the authoritative v2 binding set for multi-task
+ * scheduling consumers (issue #2532): one bounded scan shared by every
+ * per-task {@link readDeclaredScopeFilesFromBindings} call in a verdict.
+ * Returns `null` when the store is unreadable/overloaded so callers fail
+ * closed to "unknown scope" per task.
+ */
+export declare function readAuthoritativeScopeBindingSet(directory: string): ScopeBinding[] | null;
 export declare function resolveScopeBindingFromDisk(input: {
     directory: string;
     taskId: string;

package/dist/summaries/index.d.ts

@@ -1,2 +1,2 @@
-export { cleanupSummaries, listSummaries, loadFullOutput, storeSummary, } from './manager';
+export { allocateSummaryId, cleanupSummaries, listSummaries, loadFullOutput, SummaryIdCollisionError, storeSummary, } from './manager';
 export { createSummary, detectContentType, HYSTERESIS_FACTOR, shouldSummarize, } from './summarizer';

package/dist/summaries/manager.d.ts

@@ -5,9 +5,20 @@
  * @throws Error with descriptive message on failure
  */
 export declare function sanitizeSummaryId(id: string): string;
+/**
+ * Typed collision signal for the no-overwrite store contract (issue #2576):
+ * the destination summary entry already exists and must never be replaced.
+ * Callers distinguish this from storage errors by `instanceof` (or `name`).
+ */
+export declare class SummaryIdCollisionError extends Error {
+    readonly summaryId: string;
+    constructor(summaryId: string);
+}
 /**
  * Store a summary entry to .swarm/summaries/{id}.json.
- * Performs atomic write via temp file + rename.
+ * Performs an atomic, no-overwrite install: temp file + exclusive
+ * hard-link install. Throws {@link SummaryIdCollisionError} if an entry
+ * with this ID already exists (it is never replaced — issue #2576).
  * @throws Error if summary ID is invalid or size limit would be exceeded
  */
 export declare function storeSummary(directory: string, id: string, fullOutput: string, summaryText: string, maxStoredBytes: number): Promise<void>;
@@ -26,6 +37,21 @@ export declare function loadFullOutput(directory: string, id: string): Promise<s
  * directory directly so stale files beyond the newest N are still pruned.
  */
 export declare const MAX_SUMMARIES_LISTED = 500;
+/**
+ * Durable summary ID allocation (issue #2576): returns the next free numeric
+ * ID (`S<max+1>`) derived from the entries that actually exist on disk, so a
+ * restarted process continues after persisted IDs instead of reusing `S1`.
+ *
+ * The scan uses the strict write-side grammar (`^S\d+`) via
+ * {@link enumerateSummaryIds} — large timestamp-suffixed IDs (e.g. Stage A's
+ * `S<ms><random>`) match and are included; filenames outside the grammar are
+ * ignored. The max is computed with BigInt so 16-digit IDs stay exact past
+ * 2^53 (a float max could alias two distinct large IDs and hand the retry
+ * loop an already-occupied slot); `max + 1n` always stringifies back to a
+ * valid `^S\d+$` ID, and leading-zero legacy entries (`S007`) normalize
+ * numerically so allocation never regresses.
+ */
+export declare function allocateSummaryId(directory: string): string;
 /**
  * List summary IDs that have summary entries, newest-first (mtime
  * descending, code-unit filename tie-break), capped at

package/dist/tools/index.d.ts

@@ -42,6 +42,7 @@ export { knowledge_archive } from './knowledge-archive';
 export { knowledge_query } from './knowledge-query';
 export { knowledge_recall } from './knowledge-recall';
 export { knowledge_receipt } from './knowledge-receipt';
+export { knowledge_receipt_status } from './knowledge-receipt-status';
 export { knowledge_remove } from './knowledge-remove';
 export { lint } from './lint';
 export { osv_scan } from './osv-scan';
@@ -68,6 +69,7 @@ export type { SavePlanArgs, SavePlanResult } from './save-plan';
 export { save_plan } from './save-plan';
 export { type SbomGenerateInput, type SbomGenerateResult, sbom_generate, } from './sbom-generate';
 export { schema_drift } from './schema-drift';
+export { evaluateScopeValidate, type ScopeValidateArgs, type ScopeValidateResult, ScopeValidationError, scope_validate, } from './scope-validate';
 export { search } from './search';
 export { type SecretFinding, type SecretscanResult, secretscan, } from './secretscan';
 export { set_qa_gates } from './set-qa-gates';

package/dist/tools/knowledge-receipt-status.d.ts

@@ -0,0 +1,8 @@
+/** Read-only status for an explicitly-authorized MCP knowledge write receipt. */
+import { createSwarmTool } from './create-tool.js';
+export declare const knowledge_receipt_status: ReturnType<typeof createSwarmTool>;
+export declare const _test_exports: {
+    writeReceiptStatusInput: import("zod").ZodObject<{
+        idempotency_key: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+};

package/dist/tools/manifest.d.ts

@@ -90,6 +90,7 @@ export declare const TOOL_MANIFEST: {
     write_hallucination_evidence: () => ToolDefinition;
     write_mutation_evidence: () => ToolDefinition;
     declare_scope: () => ToolDefinition;
+    scope_validate: () => ToolDefinition;
     knowledge_query: () => ToolDefinition;
     doc_scan: () => ToolDefinition;
     doc_extract: () => ToolDefinition;
@@ -127,6 +128,7 @@ export declare const TOOL_MANIFEST: {
     skill_improve: () => ToolDefinition;
     spec_write: () => ToolDefinition;
     knowledge_receipt: () => ToolDefinition;
+    knowledge_receipt_status: () => ToolDefinition;
     knowledge_archive: () => ToolDefinition;
     swarm_memory_recall: () => ToolDefinition;
     swarm_memory_propose: () => ToolDefinition;

package/dist/tools/plan-conflict-check.d.ts

@@ -7,10 +7,10 @@
  *
  * READ-ONLY CONTRACT (issue #1656 acceptance): this tool writes NOTHING — not
  * to `.swarm/`, not to the source tree. It calls no other tools. The only I/O
- * is reading `.swarm/plan.json` (via `loadPlanJsonOnly`) and
- * `.swarm/scopes/scope-<taskId>.json` (via `readTaskScopes` inside
- * `computeParallelVerdict`), plus an optional `git log` (only when the caller
- * opts in via `use_cochange: true`).
+ * is reading `.swarm/plan.json` (via `loadPlanJsonOnly`) and the
+ * authoritative v2 scope-binding store (via `readDeclaredScopeFilesFromBindings`
+ * inside `computeParallelVerdict`, #2532), plus an optional `git log` (only
+ * when the caller opts in via `use_cochange: true`).
  *
  * Why this tool exists alongside the gate: the gate (`delegation-gate.ts`)
  * independently recomputes the verdict INLINE at coder-dispatch time via the
@@ -50,8 +50,9 @@ export interface PlanConflictCheckResult {
 /**
  * Pure executor (no createSwarmTool wrapper) so it is directly unit-testable.
  *
- * Reads `.swarm/plan.json` (to confirm the task ids exist) and
- * `.swarm/scopes/scope-*.json` (via `computeParallelVerdict`). Writes nothing.
+ * Reads `.swarm/plan.json` (to confirm the task ids exist) and the
+ * authoritative v2 scope-binding store (via `computeParallelVerdict`,
+ * #2532). Writes nothing.
  */
 export declare function executePlanConflictCheck(args: {
     task_ids: string[];