qlogicagent 2.20.6 → 2.20.7

package/dist/types/host-contract/index.d.ts

@@ -12,12 +12,14 @@
  * 其字段以 freeze 正文/recon 注释为据;实现 lane 负责与现状 store 形状做映射。
  */
 import { type ModelPurpose } from "@xiaozhiclaw/module-sdk/model-access";
+import type { AcpContentBlock } from "./acp-content.js";
 import type { NativeTranscript } from "../host-session-collection-contract.js";
 export { MODEL_PURPOSES, type ModelPurpose } from "@xiaozhiclaw/module-sdk/model-access";
 export type { HostSessionCollectionDelta, HostSessionCollectionScope, HostSessionCollectionSnapshot, HostSessionLifecycle, HostSessionProviderDiagnostic, HostSessionSummary, HostSessionTitleSource, NativeTranscript, NativeTranscriptMessage, } from "../host-session-collection-contract.js";
 export { isHostSessionCollectionDelta, isHostSessionCollectionSnapshot, isNativeTranscript, } from "../host-session-collection-contract.js";
 export * from "./provider-profile.js";
 export * from "./memory-category.js";
+export type { AcpContentBlock, AcpResourceContents } from "./acp-content.js";
 /** agent 逻辑身份(小智自身也是一个 agentId="qlogicagent")。自身 vs 第三方仅由此值决定(F2)。 */
 export type AgentId = string;
 /** 确定性派生的项目主键(freeze §11.4#2,抄 VSCode getWorkspaceId)。绝不随机、绝不裸路径。 */
@@ -97,32 +99,8 @@ export interface AgentSpec {
     /** 仅非密的运行覆盖(如 solo 自身分支 QLOGICAGENT_WORKTREE_WORKDIR/SOLO_LEAN) */
     envOverrides?: Record<string, string>;
 }
-/**
- * 回合输入内容块(多模态)。**精确镜像 `AcpContentBlock`**(acp-protocol.ts:249)——
- * 覆盖 text/image/video/audio/file 全五类;评审纠正:早期 text/image/resource 偏窄漏了 video/audio/file。
- * 随 ACP block union 演进则同步扩(单一事实源=acp-protocol.ts)。
- */
-export type ContentBlock = {
-    type: "text";
-    text: string;
-} | {
-    type: "image";
-    url: string;
-    mimeType?: string;
-} | {
-    type: "video";
-    url: string;
-    mimeType?: string;
-} | {
-    type: "audio";
-    url: string;
-    mimeType?: string;
-} | {
-    type: "file";
-    fileId: string;
-    mimeType?: string;
-    size?: number;
-};
+/** 回合输入内容块直接引用官方 ACP wire 单一事实源。 */
+export type ContentBlock = AcpContentBlock;
 /**
  * 每回合上下文(2026-07-09 S3 综合补遗 A1;权威形状 = agent 侧 buildSessionMeta + turnId)。
  * 现瘦 sendTurn(prompt:string) 收不下这些(executeTurn:632 实证)→ 富签名。
@@ -152,7 +130,7 @@ export interface TurnInput {
  * - F2 自身/第三方唯一由 agentId 决定;调用点不得再各自决定进程形态。
  * - F3 结构隔离(§11.4#4):host 与 agent 引导入口物理不同、互不派生;删除运行时"拒 qlogicagent"闸。
  * - F4 判活单轨(§5.1):仅 ACK 响应性,无 agent 心跳、无方法名豁免清单;unresponsive 是状态非杀。
- * - F5 leader 硬约束(§11.4#6):kind∈{product-leader,goal-leader} 时 agentId 必须 ="qlogicagent",接口层硬校验拒第三方。
+ * - F5 leader 约束(§11.4#6):product-leader 固定 qlogicagent；goal-leader 取 Gateway canonical session owner。
  * - F6 判活地板 = "任意协议消息计活"(§6.3);我方 agent 可另加 ping 作补充、不作地板。
  */
 export interface AgentSupervisor {
@@ -291,7 +269,7 @@ export interface SessionProjectService {
     replayStateTo(handle: MemberHandle, sessionId: CanonicalSessionId): Promise<void>;
 }
 export interface CapabilityEndpoint {
-    /** 唯一规范名(astraclaw_capabilities;不再双别名,C1) */
+    /** 唯一规范名(astraclaw;不再双别名,C1) */
     serverName: string;
     transport: "stdio" | "ipc";
     /** 网关稳定 endpoint */
@@ -560,22 +538,51 @@ export interface GatewayDelegateRelay {
         signal?: AbortSignal;
         granularity?: "full" | "coarse";
         systemPrompt?: string;
+        modelId?: string;
     }): Promise<TurnResult>;
     subscribe(handle: MemberHandle, sink: SupervisorEventSink, opts?: {
         granularity?: "full" | "coarse";
     }): () => void;
 }
 export type RunId = string;
-/** [S1 补定] 运行事件(由 relay/supervisor 生命周期喂)。 */
-export interface RunEvent {
-    /** ISO 时间戳 */
+/**
+ * Host-wide durable activity protocol.
+ *
+ * Thread is the durable conversation/session, Turn is one bounded unit of work, and Item is the
+ * only append-only fact carried by persistence and live delivery. Domain-specific projections
+ * (chat, Solo, Product, Goal, workflow) must derive from this envelope instead of defining another
+ * event transport.
+ */
+export declare const THREAD_ITEM_PROTOCOL_VERSION: 1;
+export type ThreadItemDomain = "chat" | "solo" | "product" | "goal" | "workflow" | "system";
+export type ThreadItemType = "message" | "state" | "plan" | "task" | "checklist" | "budget" | "input_request" | "summary" | "tool_call" | "tool_result" | "artifact" | "receipt";
+export type ThreadItemRole = "user" | "assistant" | "system" | "tool";
+export type ThreadItemState = "pending" | "in_progress" | "completed" | "failed" | "blocked" | "cancelled";
+export interface ThreadItem {
+    /** Stable id used for live/cold replay de-duplication. */
+    id: string;
+    /** Cross-domain rendering category. */
+    type: ThreadItemType;
+    /** Namespaced semantic discriminator, for example `goal.phase_assessed`. */
+    kind: string;
+    domain: ThreadItemDomain;
+    role: ThreadItemRole;
+    state: ThreadItemState;
+    /** Optional user-visible text. Structured domain data remains in data. */
+    text?: string;
+    data: Record<string, unknown>;
+}
+export interface ThreadItemEvent {
+    schemaVersion: typeof THREAD_ITEM_PROTOCOL_VERSION;
     at: string;
-    type: string;
-    /** Optional domain event sequence (Goal event-sourcing recovery). */
+    /** Assigned by the producer and checked against Host append order by projections. */
     sequence?: number;
-    member?: MemberHandle;
-    payload?: unknown;
+    threadId: string;
+    turnId: string;
+    item: ThreadItem;
 }
+/** The RunState journal stores the same canonical envelope delivered live. */
+export type RunEvent = ThreadItemEvent;
 /** [S1 补定] 运行状态(UI 权威读)。 */
 export interface RunState {
     runId: RunId;
@@ -658,6 +665,7 @@ export interface SupervisorEventSink {
     onToolCall(e: EvBase & {
         callId: string;
         name: string;
+        displayName?: string;
         arguments?: string;
         inputSummary?: string;
         startedAt?: string;
@@ -669,6 +677,7 @@ export interface SupervisorEventSink {
     onToolResult(e: EvBase & {
         callId: string;
         name: string;
+        displayName?: string;
         ok: boolean;
         error?: string;
         outputPreview?: string;
@@ -693,14 +702,17 @@ export interface SupervisorEventSink {
         }>;
     }): void;
     /**
-     * media:统一 {mediaType,url,model,provider}(非 imageUrls[])。⚠R3:external agent 今天不发此事件
-     * Provider media must arrive as a first-class lifecycle event, never only as a generic tool call.
+     * Provider media and Host-sent attachments arrive as first-class lifecycle events, never only as
+     * generic tool output or a path embedded in assistant text.
      */
     onMedia(e: EvBase & {
         mediaType: string;
         url: string;
         model?: string;
         provider?: string;
+        filename?: string;
+        mimeType?: string;
+        size?: number;
     }): void;
     /**
      * 通用透传(S3 综合补遗 A3):承接今天 mapSessionUpdate 的 x_relay→relay 分支
@@ -744,7 +756,7 @@ export type DelegationId = string;
 /** `x/delegate` 请求参数(agent→host,起一个 worker 回合,resolve TurnResult,隐式订阅该 delegation)。 */
 export interface DelegateRequestParams {
     delegationId: DelegationId;
-    /** F5 leader 硬校验在 gateway 侧,不信任此处传入(T4) */
+    /** Product leader 硬约束由 Gateway 校验；Goal leader 身份由 canonical session owner 预先解析。 */
     to: {
         handle: MemberHandle;
         agentId: AgentId;
@@ -756,6 +768,7 @@ export interface DelegateRequestParams {
     opts?: {
         timeoutMs?: number;
         granularity?: "full" | "coarse";
+        modelId?: string;
     };
 }
 /** 回流事件种类(与 §4 SupervisorEventSink 方法 1:1,T10 无损镜像)。 */
@@ -828,7 +841,7 @@ export interface HostPendingMemoryExtractionTurn extends HostMemoryExtractionTur
  * [X7] qlogicagent 大脑经 x/host.request 可调用的 memory proxy 精确方法面。
  * gateway 白名单与 qla HostMemoryProvider 都必须直接消费此常量，禁止两仓手抄后漂移。
  */
-export declare const HOST_MEMORY_PROXY_METHODS: readonly ["search", "addText", "embedText", "ingestExtracted", "proposeExtracted", "consumePendingProposals", "feedback", "findRelatedEvents", "synthesizeTimeline", "getActivitySummary", "getAllProfiles", "setProfile", "getAtlas", "setMemoryArchived", "triggerDecay", "resolveConflicts", "readProcedureUsage", "writeProcedureUsage", "readDistillCandidates", "writeDistillCandidates", "readPromotionProposals", "writePromotionProposals", "listActiveMemoriesByTag", "readDistilledProcedure", "promoteDistilledProcedure", "demoteDistilledProcedure", "recordInjectedAccess", "recordRecallOutcome", "enqueueExtractionTurn", "claimPendingExtractionTurns", "completeExtractionTurn", "releaseExtractionTurn", "recordExtractionTurnFailure"];
+export declare const HOST_MEMORY_PROXY_METHODS: readonly ["search", "embedText", "ingestExtracted", "proposeExtracted", "consumePendingProposals", "feedback", "findRelatedEvents", "synthesizeTimeline", "getActivitySummary", "getAllProfiles", "setProfile", "getAtlas", "setMemoryArchived", "triggerDecay", "resolveConflicts", "readProcedureUsage", "writeProcedureUsage", "readDistillCandidates", "writeDistillCandidates", "readPromotionProposals", "writePromotionProposals", "listActiveMemoriesByTag", "readDistilledProcedure", "promoteDistilledProcedure", "demoteDistilledProcedure", "recordInjectedAccess", "recordRecallOutcome", "enqueueExtractionTurn", "claimPendingExtractionTurns", "completeExtractionTurn", "releaseExtractionTurn", "recordExtractionTurnFailure"];
 export type HostMemoryProxyMethod = (typeof HOST_MEMORY_PROXY_METHODS)[number];
 /** Host-computed proof that a distilled procedure is a repeatable capability.
  * Source executions prove how it was learned; helped use rows prove that the
@@ -1101,6 +1114,8 @@ export interface HostSkillLifecycleRecord {
     sourceTier?: "official" | "community";
     riskTier?: "R0" | "R1" | "R2" | "R3";
     artifactDigest?: string;
+    /** Deterministic digest of the installed file tree, used to prove it was not edited locally. */
+    contentTreeDigest?: string;
     registryResourceId?: string;
     registryVersion?: string;
     registrySourceTier?: "official" | "community";
@@ -1163,7 +1178,7 @@ export declare const HOST_SKILL_FILE_MAX_BYTES: number;
 /** [X7-P] 单一 agent→host 一元请求通道的服务域。 */
 export type HostRequestService = "memory" | "projectMemory" | "profile" | "preview" | "capability" | "session" | "feedback" | "project" | "runState" | "provider" | "community" | "cloudAuth";
 /** Host-owned authenticated Hub reads. The Agent never receives or refreshes the desktop session. */
-export declare const HOST_COMMUNITY_PROXY_METHODS: readonly ["resolveInstall", "listResourceVersions", "resolveRuntime"];
+export declare const HOST_COMMUNITY_PROXY_METHODS: readonly ["resolveInstall", "listResourceVersions"];
 export type HostCommunityProxyMethod = typeof HOST_COMMUNITY_PROXY_METHODS[number];
 export type HostCommunityRequestParams = {
     service: "community";
@@ -1178,13 +1193,6 @@ export type HostCommunityRequestParams = {
     params: {
         resourceId: string;
     };
-} | {
-    service: "community";
-    method: "resolveRuntime";
-    params: {
-        id: string;
-        platform: string;
-    };
 };
 /** Narrow account-session probe for supervised runtimes; no credential material crosses the wire. */
 export declare const HOST_CLOUD_AUTH_PROXY_METHODS: readonly ["probeSession"];
@@ -1505,7 +1513,7 @@ export type HostRunStateRequestParams = {
     method: "recordEvent";
     params: {
         runId: RunId;
-        event: Omit<RunEvent, "member">;
+        event: RunEvent;
         sessionId: CanonicalSessionId;
     };
 } | {
@@ -1694,12 +1702,15 @@ export interface HostApplyCuratorPlanResult {
     transitioned: HostCuratorTransition[];
 }
 export type HostSkillInstallRiskTier = "R0" | "R1" | "R2" | "R3";
+export type HostSkillReplacementPolicy = "managed-unmodified" | "user-confirmed";
 export interface HostPrepareSkillInstallParams {
     name: string;
     version: string;
     checksum: string;
     sizeBytes: number;
     allowReplace: boolean;
+    /** Required whenever allowReplace=true; automated callers must use managed-unmodified. */
+    replacementPolicy?: HostSkillReplacementPolicy;
     provenance: {
         sourceTier: "official" | "community";
         resourceRiskTier: HostSkillInstallRiskTier;

package/dist/types/orchestration/agent-instance.d.ts

@@ -19,6 +19,21 @@ import type { ProductLeaderCoordinator } from "./product-run-coordinator.js";
 import { type HostRunStateAuthority } from "./run-state-host-authority.js";
 import type { DelegateBridge } from "./delegate-bridge.js";
 export type { ProductLeaderCoordinator } from "./product-run-coordinator.js";
+export interface ProductFailureAssigneeSelection {
+    productId: string;
+    taskId: string;
+    taskPrompt: string;
+    error: string;
+    current: {
+        name: string;
+        agentId: string;
+    };
+    candidates: Array<{
+        name: string;
+        agentId: string;
+    }>;
+}
+export type ProductFailureAssigneeSelector = (input: ProductFailureAssigneeSelection) => Promise<string | undefined>;
 export interface ProductCallbacks {
     log?: {
         info(msg: string): void;
@@ -36,6 +51,8 @@ export interface ProductCallbacks {
         attempt: number;
         terminalState: "failed" | "cancelled";
     }) => void;
+    /** Explicit receipt for the one automatic abnormal-worker handoff. */
+    onTaskHandoff?: (productId: string, taskId: string, from: string, to: string, reason: string, attempt: number) => void;
     onCheckpointed?: (productId: string, timestamp: string) => void;
     onBudgetWarning?: (productId: string, usedTokens: number, maxTotalTokens: number, percentage: number) => void;
     /** Budget hard limit hit → the run auto-paused. The 100% counterpart of onBudgetWarning (80%): the
@@ -101,6 +118,7 @@ export declare class ProductOrchestrator {
      */
     create(params: ProductCreateParams, options?: {
         authority?: HostRunStateAuthority;
+        failureAssigneeSelector?: ProductFailureAssigneeSelector;
     }): Promise<string>;
     /** Resume a product from persisted state. */
     resume(productId: string, opts?: {
@@ -111,6 +129,7 @@ export declare class ProductOrchestrator {
         authority?: HostRunStateAuthority;
         projectId?: string;
         cwd?: string;
+        failureAssigneeSelector?: ProductFailureAssigneeSelector;
     }): Promise<void>;
     /**
      * Pause a running product — the SINGLE pause path (I9).
@@ -133,7 +152,7 @@ export declare class ProductOrchestrator {
     private waitForInFlightSettle;
     /** Manual checkpoint. */
     checkpoint(productId: string): Promise<void>;
-    applyDagMutations(productId: string, mutations: readonly DagMutation[]): Promise<void>;
+    applyDagMutations(productId: string, mutations: readonly DagMutation[]): Promise<import("./product-dag-mutation-applier.js").ProductDagMutationApplyResult>;
     /** Delete a product session, including a persisted execution run after process restart. */
     delete(productId: string, options?: {
         authority?: HostRunStateAuthority;
@@ -170,6 +189,7 @@ export declare class ProductOrchestrator {
     private publishUnassignedTaskFailure;
     private runTask;
     private consultLeaderAfterFailure;
+    private tryAutomaticAgentHandoff;
     private applyDagMutationsToSession;
     private finishProduct;
     /**

package/dist/types/orchestration/agent-roster.d.ts

@@ -1,33 +1,32 @@
 import type { HostAgentProviderListResult } from "../host-contract/index.js";
 import type { AgentRosterEntry } from "../protocol/wire/acp-agent-management.js";
+interface AgentRosterOptions {
+    injectLeader?: boolean;
+    leaderAgentId: string;
+}
 /** Build the team roster the leader sees during planning: every ready agent with a coarse
  *  strengths hint + its backing model. Leader-only soft hints — NOT a capability contract.
  *
  *  `allowedAgents` is PRESENCE-based (an explicit `[]` is meaningful, NOT the same as omitted):
  *   - `undefined` / omitted → ALL ready agents. The allow-set is `null` and the catalog filter applies
  *     no constraint.
- *   - `[]` (explicit empty array) → ONLY the leader 小智 (qlogicagent): the allow-set is an empty Set, so
- *     the catalog filter drops every non-leader entry; the leader is force-included below → roster = just
- *     小智. This is the user deliberately deselecting every worker.
- *   - `[ids]` → those ready ids PLUS the leader 小智 (always included). A picked-but-unready id is dropped.
+ *   - `[]` (explicit empty array) → ONLY the selected session leader: the allow-set is empty, so the
+ *     catalog filter drops every non-leader entry. This is the user deliberately deselecting workers.
+ *   - `[ids]` → those ready ids PLUS the selected leader. A picked-but-unready id is dropped.
  *
- *  The leader `qlogicagent` (小智) is ALWAYS present (universal coordinator / fallback executor) — appended
- *  if not already in the roster, so the leader always has ≥1 valid assignee even when the user's picks turn
- *  out unready (or when the pool is empty). */
-export declare function buildAgentRoster(snapshot: Readonly<HostAgentProviderListResult>, allowedAgents?: string[], options?: {
-    injectLeader?: boolean;
-}): AgentRosterEntry[];
+ *  The caller supplies the authoritative leader id from the session binding. There is no implicit
+ *  leader: Product callers pass their Product leader; Goal callers pass the session owner. */
+export declare function buildAgentRoster(snapshot: Readonly<HostAgentProviderListResult>, allowedAgents: string[] | undefined, options: AgentRosterOptions): AgentRosterEntry[];
 /**
  * User-PICKED worker ids that did NOT make it into the roster (unready: not installed / not logged in
  * / not in the catalog). Excludes the leader (always force-included). Empty when nothing was dropped
  * or when the pool was omitted. Callers surface this so a picked worker doesn't vanish silently and
- * collapse the team to just 小智 (honesty over silence — goal used to degrade with no notice).
+ * collapse the team to just its leader (honesty over silence).
  */
-export declare function computeUnavailablePicks(allowedAgents: string[] | undefined, rosterIds: readonly string[]): string[];
+export declare function computeUnavailablePicks(allowedAgents: string[] | undefined, rosterIds: readonly string[], leaderAgentId: string): string[];
 /** buildAgentRoster + the diagnostics of which picked workers were dropped as unavailable. */
-export declare function buildAgentRosterWithDiagnostics(snapshot: Readonly<HostAgentProviderListResult>, allowedAgents?: string[], options?: {
-    injectLeader?: boolean;
-}): {
+export declare function buildAgentRosterWithDiagnostics(snapshot: Readonly<HostAgentProviderListResult>, allowedAgents: string[] | undefined, options: AgentRosterOptions): {
     roster: AgentRosterEntry[];
     unavailablePicks: string[];
 };
+export {};

package/dist/types/orchestration/dag-scheduler.d.ts

@@ -122,6 +122,10 @@ export declare class DagScheduler {
      * Removes all edges incident to this node.
      */
     removeNode(id: string): void;
+    /** Add one dependency edge atomically. Only work that has not started may gain prerequisites. */
+    addDependency(from: string, to: string): void;
+    /** Remove one dependency edge. Completed/running work remains immutable. */
+    removeDependency(from: string, to: string): void;
     /**
      * Reset a failed node to pending. Optionally patches params (e.g. revised prompt).
      */

package/dist/types/orchestration/goal-context-envelope.d.ts

@@ -0,0 +1,7 @@
+import type { ContextEnvelope } from "../protocol/wire/chat-types.js";
+import type { PersistedGoalRunState, PhaseSpec } from "./goal-run-types.js";
+/**
+ * Project the Host-owned Goal checkpoint into bounded Agent-local compaction facts.
+ * The envelope is regenerated for every leader/worker turn; it never becomes a second Goal owner.
+ */
+export declare function buildGoalContextEnvelope(state: PersistedGoalRunState, operation: string, spec?: PhaseSpec): ContextEnvelope;

package/dist/types/orchestration/goal-loop-coordinator.d.ts

@@ -1,12 +1,24 @@
 import { type HostRunStateAuthority } from "./run-state-host-authority.js";
-import { type AcceptanceChecklist, type AcceptanceCriterion, type AcceptanceDelta, type GoalQueuedMessage, type PersistedGoalRunState, type PhaseSpec } from "./goal-run-types.js";
+import type { ContextEnvelope } from "../protocol/wire/chat-types.js";
+import type { ProductFailureAssigneeSelection } from "./agent-instance.js";
+import { type AcceptanceChecklist, type AcceptanceDelta, type GoalInstructionKind, type GoalMilestone, type GoalQueuedMessage, type GoalTaskProjection, type GoalSpec, type GoalTurnContext, type PersistedGoalRunState, type PhaseSpec } from "./goal-run-types.js";
 export interface LeaderPort {
-    deriveChecklist(goal: string): Promise<AcceptanceCriterion[]>;
-    planPhase(goal: string, summary: string, drained: GoalQueuedMessage[], checklist: AcceptanceChecklist, agentPool: string[]): Promise<PhaseSpec>;
-    critiquePlan(spec: PhaseSpec, goal: string, checklist: AcceptanceChecklist, agentPool: string[]): Promise<PhaseSpec>;
-    assess(productId: string, checklist: AcceptanceChecklist): Promise<{
+    /** Reapply the durable user turn policy before any leader call, including crash recovery. */
+    setTurnContext?(context: GoalTurnContext | undefined): void;
+    /** Re-ground the native leader's own compaction state in canonical Host Goal facts. */
+    setContextEnvelope?(context: ContextEnvelope | undefined): void;
+    selectHandoffCandidate(input: ProductFailureAssigneeSelection): Promise<string | undefined>;
+    draftGoalSpec(goal: string, revisionFeedback: GoalQueuedMessage[], revision: number): Promise<GoalSpec>;
+    planPhase(goalSpec: GoalSpec, summary: string, drained: GoalQueuedMessage[], checklist: AcceptanceChecklist, agentPool: string[]): Promise<PhaseSpec>;
+    critiquePlan(spec: PhaseSpec, goalSpec: GoalSpec, checklist: AcceptanceChecklist, agentPool: string[]): Promise<PhaseSpec>;
+    assess(productId: string, goalSpec: GoalSpec, checklist: AcceptanceChecklist, milestones?: GoalMilestone[], agentPool?: string[]): Promise<{
         deltas: AcceptanceDelta[];
         producedFiles: boolean;
+        tasks?: GoalTaskProjection[];
+        usage?: {
+            inputTokens: number;
+            outputTokens: number;
+        };
     }>;
     compact(prevSummary: string, deltas: AcceptanceDelta[]): Promise<string>;
 }
@@ -14,6 +26,12 @@ export interface PhaseRunnerPort {
     startBoundedProductPhase(spec: PhaseSpec, agentPool: string[], cwd: string, opts: {
         signal: AbortSignal;
         onProductId: (productId: string) => void;
+        budget?: {
+            maxTotalTokens?: number;
+            maxDuration?: number;
+        };
+        turnContext?: GoalTurnContext;
+        contextEnvelope?: ContextEnvelope;
     }): Promise<{
         productId: string;
         result: string;
@@ -25,6 +43,8 @@ export interface PhaseRunnerPort {
     }): Promise<{
         result: string;
     }>;
+    /** Interrupt a persisted in-flight Product when the control RPC cannot see the original AbortController. */
+    pausePhase?(productId: string): Promise<void>;
 }
 export type GoalNotifier = (method: string, payload: Record<string, unknown>) => void;
 export interface GoalLoopCoordinatorDeps {
@@ -33,6 +53,7 @@ export interface GoalLoopCoordinatorDeps {
     cwd: string;
     projectId: string;
     canonicalSessionId: string;
+    leaderAgentId: string;
     runStateAuthority?: HostRunStateAuthority;
     notify?: GoalNotifier;
     log?: {
@@ -50,14 +71,25 @@ export declare class GoalLoopCoordinator {
     private notify;
     private append;
     private persist;
+    private transitionStage;
     /** Durably reserve a goal-run without entering the leader lane. Returns the goalRunId immediately. */
-    start(goal: string, agentPool: string[]): Promise<string>;
+    start(goal: string, agentPool: string[], budget?: {
+        maxTotalTokens?: number;
+        maxDurationMs?: number;
+    }, turnContext?: GoalTurnContext): Promise<string>;
     private startImpl;
+    private goalSpecConfirmationMessage;
+    private ensureGoalSpecImpl;
     private ensureChecklistInitializedImpl;
+    private hydrate;
     /** Load the run; seed `seq` so a fresh instance (post-crash) keeps appending monotonically. */
     private load;
-    enqueueMessage(goalRunId: string, text: string): Promise<void>;
+    enqueueMessage(goalRunId: string, text: string, kind?: GoalInstructionKind): Promise<void>;
     private enqueueMessageImpl;
+    /** Resolve a structured blocker and resume in one serialized mutation. A UI or IM client must not
+     * coordinate message + resume as two RPCs because a transport failure between them duplicates the
+     * answer or leaves the blocker visible after execution has continued. */
+    answerBlocker(goalRunId: string, text: string): Promise<PersistedGoalRunState>;
     /** Run exactly one phase. Returns the updated state. */
     runOnePhase(goalRunId: string): Promise<PersistedGoalRunState>;
     private runOnePhaseImpl;
@@ -66,15 +98,18 @@ export declare class GoalLoopCoordinator {
      *  in-flight breadcrumb, then run the terminal checks. Called by BOTH the normal path and crash-recovery
      *  so neither duplicates this logic. Assess throwing propagates to the caller's failure handling. */
     private finishPhase;
+    private planPhaseWithRetry;
+    private recordPhasePlan;
+    private block;
     /** B (crash-resume): re-attach to a Product that started before a crash. Restore its Host RunState
      *  checkpoint and re-drive it to terminal (runner.resumePhase), then run the SAME phase tail
      *  (finishPhase). Honest-fail ONLY if resume itself throws — a started phase is recovered, never lost,
      *  but progress is never fabricated. Bounded by an abort handle so pause() can still drain it. */
     private recoverCrashedPhase;
     /** #4: classify how an in-flight phase's throw should land. A user pause aborts the signal (whatever
-     *  error then surfaces → "user_pause"); the adapter's GOAL_DRAIN_TIMEOUT_MS wall throws an AbortError
-     *  WITHOUT the signal being aborted, tagged pauseReason="drain_timeout" (untagged AbortErrors from
-     *  simpler runner ports default to drain_timeout — the only engine-side AbortError source). Anything
+     *  error then surfaces → "user_pause"); the adapter's phase wall throws an AbortError
+     *  WITHOUT the signal being aborted, tagged pauseReason="phase_timeout" (untagged AbortErrors from
+     *  simpler runner ports default to phase_timeout — the only engine-side AbortError source). Anything
      *  else is a real failure → undefined (the caller honest-FAILs). */
     private pauseReasonOf;
     /** I3: true when the loaded state shows a phase that started (currentProductId set) but never reached
@@ -95,14 +130,22 @@ export declare class GoalLoopCoordinator {
      *  no-ops on the already-paused state. */
     pause(goalRunId: string): Promise<PersistedGoalRunState>;
     private pauseImpl;
-    /** Edit the goal (valid only while paused) — derives a new immutable checklist version. */
+    /** Edit the goal while paused and invalidate the prior Spec; execution requires fresh confirmation. */
     updateGoal(goalRunId: string, newGoal: string): Promise<PersistedGoalRunState>;
     private updateGoalImpl;
     /** Resume a paused run; an optional newGoal applies a goal-edit first (reusing updateGoalImpl). */
-    resume(goalRunId: string, newGoal?: string): Promise<PersistedGoalRunState>;
+    resume(goalRunId: string, newGoal?: string, additionalBudget?: {
+        maxTotalTokens?: number;
+        maxDurationMs?: number;
+    }): Promise<PersistedGoalRunState>;
     private resumeImpl;
     /** User stop — ends the run as stopped. The caller stops driving the detached loop. */
     stop(goalRunId: string): Promise<PersistedGoalRunState>;
     private stopImpl;
     private end;
+    private finishTerminal;
+    /** Re-attach a fresh Agent process to a durable active run without changing a user pause. */
+    recover(goalRunId: string): Promise<PersistedGoalRunState>;
+    /** Clear a terminal Goal from the thread-native current-goal projection without deleting its audit log. */
+    dismiss(goalRunId: string): Promise<PersistedGoalRunState>;
 }

package/dist/types/orchestration/goal-mode-adapters.d.ts

@@ -1,7 +1,7 @@
 import type { HostAgentProviderDirectory } from "../runtime/infra/host-agent-provider-directory.js";
 import type { DelegateBridge } from "./delegate-bridge.js";
 import { type PlannerMemoryContext } from "./planner-memory-brief.js";
-import type { ProductOrchestrator } from "./agent-instance.js";
+import type { ProductFailureAssigneeSelector, ProductOrchestrator } from "./agent-instance.js";
 import type { HostRunStateAuthority } from "./run-state-host-authority.js";
 import type { LeaderPort, PhaseRunnerPort } from "./goal-loop-coordinator.js";
 import { type AcceptanceCriterion, type AcceptanceDelta, type PhaseSpec } from "./goal-run-types.js";
@@ -17,6 +17,7 @@ export type GoalVerifyCommandValidation = {
  * runVerifyDeltas repeats the check for old snapshots and defense in depth.
  */
 export declare function validateGoalVerifyCommand(command: string): GoalVerifyCommandValidation;
+export declare function validateGoalVerifyCommandInWorkspace(command: string, cwd: string): GoalVerifyCommandValidation;
 /**
  * #2 verify 输出的头尾截断:测试/构建命令的失败摘要通常在输出**末尾**(框架的 summary 行),裸
  * slice(0,N) 保头丢尾会把真正的失败原因截掉,判官只能看到无关的开头。超限时保留头尾各半,并在
@@ -89,6 +90,7 @@ export interface PhaseRunnerAdapterDeps {
     orchestrator: ProductOrchestrator;
     projectId: string;
     runStateAuthority: HostRunStateAuthority;
+    failureAssigneeSelector: ProductFailureAssigneeSelector;
     /** Optional per-phase budget passed through to ProductOrchestrator.create. */
     budget?: {
         maxTotalTokens?: number;
@@ -126,6 +128,14 @@ export declare function validateAssessDeltas(rawDeltas: AcceptanceDelta[], chang
     criteria?: AcceptanceCriterion[];
     outputTexts?: string[];
     assignmentReceiptLines?: string[];
+    requiredAssignmentAgentIds?: string[];
+}): AcceptanceDelta[];
+/**
+ * A Host assignment criterion accepts the Goal's selected worker pool, not merely one authentic
+ * receipt. Re-check coverage every phase so a prematurely persisted pass regresses after recovery.
+ */
+export declare function runAssignmentEvidenceCoverageDeltas(criteria: AcceptanceCriterion[], assignmentReceiptLines: string[], requiredAgentIds: string[], log?: {
+    warn(msg: string): void;
 }): AcceptanceDelta[];
 /**
  * #1②: the judge-prompt view of this phase's project changed files. The PROMPT is windowed to stay
@@ -138,3 +148,5 @@ export declare function buildProjectFilesBlock(allFiles: string[], window?: numb
 /** Build the evidence block for the judge from a live Product status (task outputs + changed files).
  *  Exported for the #3 regression test: the >ASSESS_MAX_TASKS window note must never silently vanish. */
 export declare function buildEvidenceBlock(status: ReturnType<ProductOrchestrator["getStatus"]>): string;
+export declare const ASSESS_ASSIGNMENT_HISTORY_WINDOW = 60;
+export declare function buildGoalAssignmentHistoryBlock(allLines: string[], window?: number): string;

package/dist/types/orchestration/goal-run-persistence.d.ts

@@ -1,14 +1,21 @@
 import type { GoalRunEvent, PersistedGoalRunState } from "./goal-run-types.js";
 import type { HostRunStateAuthority } from "./run-state-host-authority.js";
+import { type ThreadItemEvent } from "../host-contract/index.js";
 export interface GoalPersistenceContext {
     projectId: string;
     canonicalSessionId: string;
     authority: HostRunStateAuthority;
 }
-/** Append one event to the Gateway-owned durable RunState event log. */
-export declare function appendGoalRunEvent(goalRunId: string, event: GoalRunEvent, context: GoalPersistenceContext): Promise<void>;
+/** Build the sole live-and-durable representation of a Goal fact. */
+export declare function toGoalThreadItemEvent(goalRunId: string, event: GoalRunEvent, context: GoalPersistenceContext): ThreadItemEvent;
+/** Append one canonical item to the Gateway-owned durable RunState event log. */
+export declare function appendGoalRunEvent(goalRunId: string, event: GoalRunEvent, context: GoalPersistenceContext): Promise<ThreadItemEvent>;
 export declare function readGoalRunEvents(goalRunId: string, context: GoalPersistenceContext): Promise<GoalRunEvent[]>;
 export declare function saveGoalRunSnapshot(state: PersistedGoalRunState, context: GoalPersistenceContext): Promise<void>;
 export declare function loadGoalRunSnapshot(goalRunId: string, context: GoalPersistenceContext): Promise<PersistedGoalRunState | undefined>;
+/** Apply events newer than the checkpoint cursor. This closes the append→checkpoint crash window
+ * without introducing a second journal or compatibility reader: Host events.jsonl remains the single
+ * durable fact stream, and the checkpoint remains its replaceable projection. */
+export declare function replayGoalRunEvents(state: PersistedGoalRunState, events: GoalRunEvent[]): PersistedGoalRunState;
 /** Replay the Host event log into a snapshot. Returns undefined before goal_started. */
 export declare function rebuildSnapshotFromEvents(goalRunId: string, context: GoalPersistenceContext): Promise<PersistedGoalRunState | undefined>;