sortie-dogs 0.10.19 → 0.10.20

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2";
+export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";

package/dist/core/operator-proposal.d.ts

@@ -8,6 +8,7 @@ export declare const OPERATOR_PROPOSAL_BUDGET_CAPS: Readonly<{
     max_reads: 192;
     max_submissions: 24;
 }>;
+export declare const OPERATOR_PROPOSAL_REVISION_CONTRACT: string;
 export declare const OPERATOR_APPROVAL_CONTRACT: string;
 export interface OperatorIntentRequirement {
     readonly id: string;
@@ -90,6 +91,23 @@ export interface OperatorProposalState {
     proposal_hash: string | null;
     proposal: OperatorProposalPacket | null;
     approval_rationale: string | null;
+    /** Preparation may publish execution controls before approval commits; never revise that pinned plan. */
+    approval_started?: boolean;
+    root_revisions?: OperatorProposalRevision[];
+}
+interface OperatorProposalIdentity {
+    readonly proposal_id: string;
+    readonly revision: number;
+    readonly content_hash: string;
+}
+export interface OperatorProposalRevision {
+    readonly actor: string;
+    readonly at: string;
+    readonly rationale: string;
+    readonly from: OperatorProposalIdentity;
+    readonly to: OperatorProposalIdentity;
+    readonly patch_hash: string;
+    readonly paths: readonly string[];
 }
 export interface OperatorProposalBudgetDiagnostic {
     readonly status: "proposal-budget-exhausted";
@@ -112,9 +130,9 @@ export declare class OperatorProposalBudgetError extends Error {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export declare class OperatorProposalRuntime {
     readonly profile: RuntimeProfile;
-    private readonly states;
     private readonly pending;
     private serial;
+    private locked;
     readonly projectRoot: string;
     constructor(projectRoot: string, profile: RuntimeProfile);
     private file;
@@ -148,6 +166,11 @@ export declare class OperatorProposalRuntime {
     submit(root: string, actor: string, raw: unknown): Promise<OperatorProposalState>;
     submitJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
     private submitUnlocked;
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    reviseJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
+    private patchedPacket;
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    pinApproval(root: string, raw: unknown): Promise<void>;
     approve(root: string, raw: unknown, commit?: boolean): Promise<OperatorProposalState>;
     private approveUnlocked;
     /**
@@ -161,3 +184,4 @@ export declare class OperatorProposalRuntime {
     private requiredUnlocked;
     packet(state: OperatorProposalState): unknown;
 }
+export {};

package/dist/core/operator-proposal.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { normalizeRelativePath } from "./path.js";
 import { OperatorContractError, parseOperatorPlan } from "./operator-runtime.js";
@@ -10,6 +10,18 @@ const ORIGINAL_REQUEST_MAX_CHARACTERS = 128 * 1024;
 const ORIGINAL_REQUEST_MAX_BYTES = 128 * 1024;
 export const DEFAULT_OPERATOR_PROPOSAL_BUDGET = Object.freeze({ max_reads: 45, max_submissions: 9 });
 export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 192, max_submissions: 24 });
+export const OPERATOR_PROPOSAL_REVISION_CONTRACT = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,rationale:nonblank single-line string,patches:array}. " +
+    "Pin the current submitted identity from operator_status. patches contains 1..32 {op,path,value} objects. " +
+    "replace is allowed only at /coverage, /existing_surface, /uncovered, /negative_handling, /read_scope, /plan/units, /plan/acceptance_proof, " +
+    "/plan/units/<index>/{title,objective,read,validation,acceptance_indices}; add or replace is also allowed at " +
+    "/plan/goal_declaration/criteria/<index>/{validation_command,goal_validation_command}. No duplicate or overlapping paths. " +
+    "Read spellings may normalize separators and dot segments without traversal; read authority can only shrink. " +
+    "The exact write union, ordered acceptance, source_refs, intent, authoritative_refs, goal binding, goal defaults, criterion identities, git_lifecycle and budgets are immutable. " +
+    "Unit count cannot increase. The host derives the next revision, hash and budget_estimate, validates the complete packet, and records root-patch provenance atomically. " +
+    "Each authorized attempt, including malformed input or rejected patches, consumes one remaining submission; foreign/stale calls do not spend the live grant. No reads or execution units are granted or restored. " +
+    "Approval preparation or approval closes this revision lane. Revision never restarts a child, prepares a run, or approves anything. " +
+    "Compare every original requirement again before explicit approval with the new identity. Use only already observed evidence. " +
+    "Keep root-owned push/global apply and user-only acceptance pending until separately evidenced; worker tests never prove those obligations. Unrepresentable or unobserved requirements stay uncovered.";
 const OPERATOR_APPROVAL_IDENTITY_FIELDS = ["proposal_id", "revision", "content_hash", "compared_requirement_ids", "decision"];
 const OPERATOR_APPROVAL_RATIONALE_FIELDS = ["rationale", "comparison_rationale"];
 export const OPERATOR_APPROVAL_CONTRACT = "approval_json must encode one JSON object using exactly one six-field shape. " +
@@ -287,10 +299,9 @@ function parsePacket(value, state) {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export class OperatorProposalRuntime {
     profile;
-    states = new Map();
     pending = new Map();
     async serial(root, action) {
-        const result = (this.pending.get(root) ?? Promise.resolve()).then(action);
+        const result = (this.pending.get(root) ?? Promise.resolve()).then(() => this.locked(root, action));
         const tail = result.then(() => undefined, () => undefined);
         this.pending.set(root, tail);
         try {
@@ -301,6 +312,31 @@ export class OperatorProposalRuntime {
                 this.pending.delete(root);
         }
     }
+    async locked(root, action) {
+        await mkdir(join(this.projectRoot, this.profile.stateDirectory, "operator-proposals"), { recursive: true });
+        const lock = `${this.file(root)}.lock`;
+        let handle;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                handle = await open(lock, "wx", 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        if (!handle)
+            throw new Error("operator-proposal-state-busy");
+        try {
+            return await action();
+        }
+        finally {
+            await handle.close();
+            await rm(lock, { force: true });
+        }
+    }
     projectRoot;
     constructor(projectRoot, profile) {
         this.profile = profile;
@@ -362,9 +398,6 @@ export class OperatorProposalRuntime {
         return this.serial(root, () => this.readUnlocked(root));
     }
     async readUnlocked(root) {
-        const cached = this.states.get(root);
-        if (cached)
-            return structuredClone(cached);
         let source;
         try {
             source = await readFile(this.file(root), "utf8");
@@ -396,8 +429,7 @@ export class OperatorProposalRuntime {
         else {
             throw new Error("operator-proposal-state-invalid");
         }
-        this.states.set(root, state);
-        return structuredClone(state);
+        return state;
     }
     async save(state) {
         const directory = join(this.projectRoot, this.profile.stateDirectory, "operator-proposals");
@@ -410,7 +442,6 @@ export class OperatorProposalRuntime {
         finally {
             await rm(temporary, { force: true }).catch(() => undefined);
         }
-        this.states.set(state.root_session_id, structuredClone(state));
     }
     assertBudgetAvailable(state) {
         const remainingReads = state.intent.proposal_budget.max_reads - state.read_count;
@@ -638,6 +669,132 @@ export class OperatorProposalRuntime {
         await this.save(state);
         return state;
     }
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    async reviseJSON(root, actor, source) {
+        return this.serial(root, async () => {
+            if (root !== actor)
+                throw new Error("operator-proposal-revision-root-required");
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || state.approval_started)
+                throw new Error("operator-proposal-not-revisable");
+            if (state.submission_count >= state.intent.proposal_budget.max_submissions)
+                throw new Error("operator-proposal-submission-budget-exhausted");
+            let request, candidate;
+            try {
+                if (Buffer.byteLength(source) > 128 * 1024)
+                    proposalError("/", "operator-proposal-revision-too-large", "maxBytes");
+                let raw;
+                try {
+                    raw = JSON.parse(source);
+                }
+                catch {
+                    proposalError("/", "operator-proposal-revision-json-invalid", "json");
+                }
+                if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "patches"]) ||
+                    !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                    !text(raw.rationale) || raw.rationale.length > 2000 || !Array.isArray(raw.patches) ||
+                    raw.patches.length < 1 || raw.patches.length > 32) {
+                    return proposalError("/", "operator-proposal-revision-invalid", "exact-identity-rationale-bounded-patches");
+                }
+                request = raw;
+                if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision || raw.content_hash !== state.proposal_hash) {
+                    throw new Error("operator-proposal-revision-identity-mismatch");
+                }
+                candidate = this.patchedPacket(state, raw.patches);
+            }
+            catch (error) {
+                if (error instanceof Error && error.message === "operator-proposal-revision-identity-mismatch")
+                    throw error;
+                // Rejections retain the old body/identity; only the same finite attempt counter advances.
+                state.submission_count++;
+                await this.save(state);
+                throw error;
+            }
+            const from = { proposal_id: state.proposal_id, revision: state.proposal_revision, content_hash: state.proposal_hash };
+            state.submission_count++;
+            state.proposal = candidate;
+            state.proposal_revision = candidate.revision;
+            state.proposal_hash = hash(JSON.stringify(candidate));
+            state.proposal_id = proposalID(state.intent_id, candidate.revision, state.proposal_hash);
+            (state.root_revisions ??= []).push({ actor, at: new Date().toISOString(), rationale: request.rationale,
+                from, to: { proposal_id: state.proposal_id, revision: candidate.revision, content_hash: state.proposal_hash },
+                patch_hash: hash(JSON.stringify(request.patches)), paths: request.patches.map(patch => patch.path) });
+            await this.save(state);
+            return state;
+        });
+    }
+    patchedPacket(state, patches) {
+        const before = state.proposal;
+        const draft = structuredClone(before);
+        const paths = [];
+        for (const [index, patch] of patches.entries()) {
+            const pointer = `/patches/${index}`;
+            if (!record(patch) || !exactSet(patch, ["op", "path", "value"]) || typeof patch.path !== "string") {
+                proposalError(pointer, "operator-proposal-revision-patch-invalid", "exact-op-path-value");
+            }
+            const entry = patch;
+            const command = /^\/plan\/goal_declaration\/criteria\/(0|[1-9][0-9]*)\/(validation_command|goal_validation_command)$/u.test(entry.path);
+            const replace = /^\/(coverage|existing_surface|uncovered|negative_handling|read_scope|plan\/(units|acceptance_proof))$/u.test(entry.path) ||
+                /^\/plan\/units\/(0|[1-9][0-9]*)\/(title|objective|read|validation|acceptance_indices)$/u.test(entry.path);
+            if (!(command && (entry.op === "add" || entry.op === "replace") || replace && entry.op === "replace") ||
+                paths.some(path => path === entry.path || path.startsWith(`${entry.path}/`) || entry.path.startsWith(`${path}/`))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-denied", "nonoverlapping-allowlisted-field");
+            }
+            paths.push(entry.path);
+            const tokens = entry.path.slice(1).split("/");
+            let owner = draft;
+            for (const token of tokens.slice(0, -1)) {
+                if (owner === null || typeof owner !== "object" || !Object.hasOwn(owner, token)) {
+                    proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "existing-parent");
+                }
+                owner = owner[token];
+            }
+            const key = tokens.at(-1);
+            if (owner === null || typeof owner !== "object" || (entry.op === "replace" && !Object.hasOwn(owner, key)) ||
+                (entry.op === "add" && Object.hasOwn(owner, key))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "replace-existing-or-add-absent-field");
+            }
+            owner[key] = structuredClone(entry.value);
+        }
+        const normalizeReads = (value) => Array.isArray(value) ? value.map(path => {
+            if (typeof path !== "string")
+                return path;
+            try {
+                return normalizeRelativePath(path);
+            }
+            catch {
+                return proposalError("/read_scope", "operator-proposal-revision-read-invalid", "safe-relative-spelling");
+            }
+        }) : value;
+        draft.read_scope = normalizeReads(draft.read_scope);
+        if (Array.isArray(draft.plan.units))
+            for (const unit of draft.plan.units)
+                if (record(unit))
+                    unit.read = normalizeReads(unit.read);
+        draft.revision = before.revision + 1;
+        draft.budget_estimate = { proposal_reads: state.read_count, execution_units: draft.plan.units?.length };
+        const candidate = parsePacket(draft, state);
+        const within = (path, scopes) => scopes.some(scope => path === scope || path.startsWith(`${scope}/`));
+        if (candidate.read_scope.some(path => !within(path, before.read_scope)) ||
+            candidate.plan.units.flatMap(unit => unit.read).some(path => !within(path, before.plan.units.flatMap(unit => unit.read)))) {
+            proposalError("/read_scope", "operator-proposal-revision-read-expanded", "read-authority-only-shrinks");
+        }
+        if (candidate.plan.units.length > before.plan.units.length) {
+            proposalError("/plan/units", "operator-proposal-revision-units-expanded", "execution-unit-count-cannot-increase");
+        }
+        if (JSON.stringify({ ...candidate, revision: before.revision }) === JSON.stringify(before)) {
+            proposalError("/patches", "operator-proposal-revision-no-change", "substantive-correction-required");
+        }
+        return candidate;
+    }
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    async pinApproval(root, raw) {
+        return this.serial(root, async () => {
+            const state = await this.approveUnlocked(root, raw, false);
+            state.approval_started = true;
+            await this.save(state);
+        });
+    }
     async approve(root, raw, commit = true) {
         return this.serial(root, () => this.approveUnlocked(root, raw, commit));
     }
@@ -671,7 +828,6 @@ export class OperatorProposalRuntime {
                 reads: state.read_count, submissions: state.submission_count,
                 ...(state.goal_binding === null ? {} : { retry: { intent_hash: state.intent_hash, goal_binding: state.goal_binding } }) });
             await rm(this.file(root), { force: true });
-            this.states.delete(root);
             return state;
         });
     }
@@ -693,6 +849,7 @@ export class OperatorProposalRuntime {
             remaining_reads: state.intent.proposal_budget.max_reads - state.read_count, submissions: state.submission_count,
             remaining_submissions: state.intent.proposal_budget.max_submissions - state.submission_count,
             task_admitted: state.proposal_call_id !== null, uncovered: state.proposal?.uncovered ?? [], proposal: state.proposal,
-            approval_rationale: state.approval_rationale };
+            approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [],
+            revision_available: state.phase === "submitted" && !state.approval_started && state.submission_count < state.intent.proposal_budget.max_submissions };
     }
 }

package/dist/plugin/profiled.js

@@ -1,6 +1,6 @@
 import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { OperatorContractError, OperatorRuntime } from "../core/operator-runtime.js";
-import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
+import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OPERATOR_PROPOSAL_REVISION_CONTRACT, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
 import { CANONICAL_AGENT_ROLES, canonicalAgent, profileAgent, profileTool, V010_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { SortieDogsPlugin as canonicalPlugin } from "./index.js";
 import { taskChildSessionID } from "./task-result-repair.js";
@@ -395,6 +395,9 @@ export function createProfiledPlugin(profile, assetVersion) {
         const approvalSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(OPERATOR_APPROVAL_CONTRACT)
             : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_APPROVAL_CONTRACT };
+        const revisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(OPERATOR_PROPOSAL_REVISION_CONTRACT)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_PROPOSAL_REVISION_CONTRACT };
         const planContract = "plan_json must encode the exact operator plan object: schema_version, acceptance, acceptance_proof, source_refs, " +
             "goal_declaration, units, and optional git_lifecycle only. git_lifecycle exact shape is " +
             '{branch_create:{branch:string,start_ref:string},commit:{message:string},post_commit_validation:string[],remediation_reserve?:string[],remediation_scope_expansion?:string[]}. Its presence is root authorization for only a clean, non-overwriting ' +
@@ -420,6 +423,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         const beginProposal = profileTool(profile, "sortie_begin_operator_proposal");
         const submitProposal = profileTool(profile, "sortie_submit_operator_proposal");
         const approveProposal = profileTool(profile, "sortie_approve_operator_proposal");
+        const reviseProposal = profileTool(profile, "sortie_revise_operator_proposal");
         async function stop(root, reason, retireRoot = true) {
             if (retireRoot)
                 retired.add(root);
@@ -559,7 +563,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                             ? "proposal submission budget exhausted; do not call operator_next; report the bounded proposal failure"
                             : "proposal is not submitted; do not call operator_next; complete or repair the bounded proposal submission"
                     : proposal?.phase === "submitted"
-                        ? "compare and approve the exact proposal; do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation."
+                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
                         : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
                 return JSON.stringify(state ? { ...await operatorPacket(state), ...(draft ? { pending_draft: draft } : {}),
                     ...(proposal ? { proposal: proposalIdentity(proposal) } : {}) }
@@ -823,6 +827,26 @@ export function createProfiledPlugin(profile, assetVersion) {
                         ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
                 }
             } };
+        tools[reviseProposal] = { description: "Root-only: revise an unapproved submitted proposal using a hash-pinned field patch and the remaining submission allowance. " + OPERATOR_PROPOSAL_REVISION_CONTRACT,
+            args: { revision_json: revisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const revised = await proposals.reviseJSON(context.sessionID, context.sessionID, args.revision_json);
+                        return JSON.stringify({ ...proposals.packet(revised),
+                            next_action: "Compare all original ordered requirements again. Explicitly approve only this new identity if every obligation is genuinely covered; no execution or approval was granted by revision." });
+                    }
+                    catch (error) {
+                        const contract = error instanceof OperatorContractError;
+                        if (!contract && (!(error instanceof Error) || !error.message.startsWith("operator-proposal-")))
+                            throw error;
+                        const state = await proposals.read(context.sessionID);
+                        return JSON.stringify({ status: "invalid-revision", code: error.message,
+                            ...(state ? { proposal: proposalIdentity(state) } : {}),
+                            ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
+                    }
+                });
+            } };
         tools[approveProposal] = { description: "Root-only: record semantic comparison of the exact proposal revision/hash, then connect its immutable plan to the existing execution lane. " + OPERATOR_APPROVAL_CONTRACT,
             args: { approval_json: approvalSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
@@ -852,6 +876,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     if (approved.goal_binding === null)
                         throw new Error("operator-proposal-goal-binding-missing");
                     await control.assertProposalExecutionBudget(context.sessionID, approved.goal_binding, proposal.plan.units.length);
+                    await proposals.pinApproval(context.sessionID, approval);
                     const prepared = await operators.propose(context.sessionID, proposal.plan);
                     if (prepared.status !== "prepared")
                         throw new Error("operator-proposal-approved-plan-invalid");
@@ -861,7 +886,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 });
             } };
         const ownTools = new Set([prepare, repair, next, status, cancel, complete, resume, resolveContractRepair,
-            beginProposal, submitProposal, approveProposal]);
+            beginProposal, submitProposal, approveProposal, reviseProposal]);
         const protocolMap = CANONICAL_AGENT_ROLES.map(role => `${role}=${profileAgent(profile, role)}`).join(", ");
         function rememberRendered(key, text) {
             renderedParts.set(key, goalFingerprint(text));

package/dist/runtime-assets-v010.js

@@ -168,7 +168,19 @@ report that specific limitation for a scope/design decision instead of inventing
 The proposal must map every original requirement ID to approach and validation, explicitly list uncovered IDs, preserve
 negative-condition handling, and include exact read/write/unit/GoalDeclaration plans and budget estimates. Its summary is
 not the source of truth and proposal reads are not acceptance evidence. Compare the submitted proposal directly with the
-original request. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
+original request. For a known defect in a submitted, unapproved proposal, the root may call
+${profile.toolPrefix}revise_operator_proposal with revision_json containing the current proposal_id, revision, content_hash,
+a substantive rationale, and 1..32 allowlisted {op,path,value} patches. Follow its exact schema; do not resend the full packet.
+Correct coverage/uncovered, observed surface claims, negative handling, unit/milestone/proof mapping, or shrink/normalize reads
+using only the completed investigation's evidence. Ordered requirements/acceptance, references, goal binding, budgets,
+criterion identities/defaults, Git authority and the exact write union stay fixed; execution unit count cannot increase.
+Successful and invalid patch attempts share the remaining submission allowance. Revision grants no new read, child or worker
+and requires no live proposal child. The host atomically records provenance and derives the next revision/hash.
+Approval preparation closes revision even if preparation later fails. Preserve that pinned plan for approval recovery.
+Never claim worker tests prove root-owned push/global apply or user-only acceptance; keep those obligations explicitly pending
+until their actual evidence exists. If existing contracts cannot express a required obligation, keep it uncovered and report
+the exact limitation instead of substituting a passing test. A root patch is not acceptance or automatic approval.
+Compare every original requirement again after revision. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
 revision, content_hash, ordered compared_requirement_ids, decision=approve, and a substantive comparison rationale.
 Uncovered requirements, stale hashes/revisions, another root, widened scope, rewritten acceptance, or reset proposal
 accounting must be rejected. Hash matching records identity; it never replaces this semantic root decision. Approval alone

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.10.19",
+  "version": "0.10.20",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",