sortie-dogs 0.10.19 → 0.10.22

package/README.md

@@ -198,7 +198,7 @@ not invent, probe, or translate variant names.
 - `freeTierFallbackModels`: ordered global last-resort model IDs. Default:
   `opencode/deepseek-v4-flash-free`; `[]` disables this fallback.
 - `dedicatedWorkerModel`: canonical stable serial target, default
-  `openai/gpt-5.6-sol` / `medium`. The v0.10 profile also supplies its explicit
+  `openai/gpt-6-sol` / `medium`. The v0.10 profile also supplies its explicit
   role routes below; do not infer the v0.10 worker route from this stable setting.
 - `consultation.strategy`: fixed advisor identity, optional `required`, and
   positive `maxCallsPerCandidate`; default one call and not required.
@@ -237,13 +237,13 @@ reuse the same evidence instead of spending the validation budget again.
 
 ### Default v0.10 routes
 
-- `dog-operator`: `openai/gpt-5.6-luna-fast` / `max`
-- `dogs-coordinator`: `openai/gpt-5.6-terra` / `xhigh`
-- `dog-worker-v010`: `openai/gpt-5.6-luna-fast` / `max`
-- `dog-scout-v010`: `openai/gpt-5.6-luna-fast` / `xhigh`
-- `dog-reviewer-v010`: `openai/gpt-5.6-terra` / `xhigh`
+- `dog-operator`: `openai/gpt-6-luna` / `max`
+- `dogs-coordinator`: `openai/gpt-6-sol` / `xhigh`
+- `dog-worker-v010`: `openai/gpt-6-luna` / `max`
+- `dog-scout-v010`: `openai/gpt-6-luna` / `xhigh`
+- `dog-reviewer-v010`: `openai/gpt-6-sol` / `xhigh`
 - `dog-advisor-v010`: preferred declared `anthropic/claude-opus-5`, otherwise
-  `openai/gpt-5.6-sol` / `xhigh`
+  `openai/gpt-6-sol` / `xhigh`
 
 An explicit model and variant selected in OpenCode remains authoritative for that
 session. Child role defaults fill absent native settings and may be overridden by

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2";
+export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";

package/dist/core/operator-proposal.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeProfile } from "./runtime-profile.js";
-import { type OperatorPlan, type OperatorTask } from "./operator-runtime.js";
+import { type OperatorPlan, type OperatorState, type OperatorTask } from "./operator-runtime.js";
 export declare const DEFAULT_OPERATOR_PROPOSAL_BUDGET: Readonly<{
     max_reads: 45;
     max_submissions: 9;
@@ -8,6 +8,7 @@ export declare const OPERATOR_PROPOSAL_BUDGET_CAPS: Readonly<{
     max_reads: 192;
     max_submissions: 24;
 }>;
+export declare const OPERATOR_PROPOSAL_REVISION_CONTRACT: string;
 export declare const OPERATOR_APPROVAL_CONTRACT: string;
 export interface OperatorIntentRequirement {
     readonly id: string;
@@ -90,6 +91,31 @@ export interface OperatorProposalState {
     proposal_hash: string | null;
     proposal: OperatorProposalPacket | null;
     approval_rationale: string | null;
+    /** Preparation may publish execution controls before approval commits; never revise that pinned plan. */
+    approval_started?: boolean;
+    root_revisions?: OperatorProposalRevision[];
+    /** Immutable archive identities of earlier approved contracts on this root. */
+    approved_history?: readonly {
+        readonly archive_hash: string;
+        readonly intent_id: string;
+        readonly proposal_id: string;
+        readonly run_id: string;
+        readonly disposition: "completed" | "incomplete";
+    }[];
+}
+interface OperatorProposalIdentity {
+    readonly proposal_id: string;
+    readonly revision: number;
+    readonly content_hash: string;
+}
+export interface OperatorProposalRevision {
+    readonly actor: string;
+    readonly at: string;
+    readonly rationale: string;
+    readonly from: OperatorProposalIdentity;
+    readonly to: OperatorProposalIdentity;
+    readonly patch_hash: string;
+    readonly paths: readonly string[];
 }
 export interface OperatorProposalBudgetDiagnostic {
     readonly status: "proposal-budget-exhausted";
@@ -112,12 +138,13 @@ export declare class OperatorProposalBudgetError extends Error {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export declare class OperatorProposalRuntime {
     readonly profile: RuntimeProfile;
-    private readonly states;
     private readonly pending;
     private serial;
+    private locked;
     readonly projectRoot: string;
     constructor(projectRoot: string, profile: RuntimeProfile);
     private file;
+    private approvedArchiveFile;
     private spendFile;
     private readSpend;
     private saveSpend;
@@ -135,6 +162,8 @@ export declare class OperatorProposalRuntime {
     private resolveTask;
     begin(root: string, raw: unknown): Promise<OperatorProposalState>;
     private beginUnlocked;
+    /** Explicit root-only transition after an approved contract's execution lane has ended. */
+    reviseApproved(root: string, actor: string, raw: unknown, readRun: () => Promise<OperatorState | undefined>, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
     bindGoal(root: string, binding: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
     private bindGoalUnlocked;
     admit(root: string, callID: string, args: unknown, reserveBudget?: () => Promise<void>): Promise<OperatorTask>;
@@ -148,6 +177,11 @@ export declare class OperatorProposalRuntime {
     submit(root: string, actor: string, raw: unknown): Promise<OperatorProposalState>;
     submitJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
     private submitUnlocked;
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    reviseJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
+    private patchedPacket;
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    pinApproval(root: string, raw: unknown): Promise<void>;
     approve(root: string, raw: unknown, commit?: boolean): Promise<OperatorProposalState>;
     private approveUnlocked;
     /**
@@ -161,3 +195,4 @@ export declare class OperatorProposalRuntime {
     private requiredUnlocked;
     packet(state: OperatorProposalState): unknown;
 }
+export {};

package/dist/core/operator-proposal.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { normalizeRelativePath } from "./path.js";
 import { OperatorContractError, parseOperatorPlan } from "./operator-runtime.js";
@@ -10,6 +10,18 @@ const ORIGINAL_REQUEST_MAX_CHARACTERS = 128 * 1024;
 const ORIGINAL_REQUEST_MAX_BYTES = 128 * 1024;
 export const DEFAULT_OPERATOR_PROPOSAL_BUDGET = Object.freeze({ max_reads: 45, max_submissions: 9 });
 export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 192, max_submissions: 24 });
+export const OPERATOR_PROPOSAL_REVISION_CONTRACT = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,rationale:nonblank single-line string,patches:array}. " +
+    "Pin the current submitted identity from operator_status. patches contains 1..32 {op,path,value} objects. " +
+    "replace is allowed only at /coverage, /existing_surface, /uncovered, /negative_handling, /read_scope, /plan/units, /plan/acceptance_proof, " +
+    "/plan/units/<index>/{title,objective,read,validation,acceptance_indices}; add or replace is also allowed at " +
+    "/plan/goal_declaration/criteria/<index>/{validation_command,goal_validation_command}. No duplicate or overlapping paths. " +
+    "Read spellings may normalize separators and dot segments without traversal; read authority can only shrink. " +
+    "The exact write union, ordered acceptance, source_refs, intent, authoritative_refs, goal binding, goal defaults, criterion identities, git_lifecycle and budgets are immutable. " +
+    "Unit count cannot increase. The host derives the next revision, hash and budget_estimate, validates the complete packet, and records root-patch provenance atomically. " +
+    "Each authorized attempt, including malformed input or rejected patches, consumes one remaining submission; foreign/stale calls do not spend the live grant. No reads or execution units are granted or restored. " +
+    "Approval preparation or approval closes this revision lane. Revision never restarts a child, prepares a run, or approves anything. " +
+    "Compare every original requirement again before explicit approval with the new identity. Use only already observed evidence. " +
+    "Keep root-owned push/global apply and user-only acceptance pending until separately evidenced; worker tests never prove those obligations. Unrepresentable or unobserved requirements stay uncovered.";
 const OPERATOR_APPROVAL_IDENTITY_FIELDS = ["proposal_id", "revision", "content_hash", "compared_requirement_ids", "decision"];
 const OPERATOR_APPROVAL_RATIONALE_FIELDS = ["rationale", "comparison_rationale"];
 export const OPERATOR_APPROVAL_CONTRACT = "approval_json must encode one JSON object using exactly one six-field shape. " +
@@ -287,10 +299,9 @@ function parsePacket(value, state) {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export class OperatorProposalRuntime {
     profile;
-    states = new Map();
     pending = new Map();
     async serial(root, action) {
-        const result = (this.pending.get(root) ?? Promise.resolve()).then(action);
+        const result = (this.pending.get(root) ?? Promise.resolve()).then(() => this.locked(root, action));
         const tail = result.then(() => undefined, () => undefined);
         this.pending.set(root, tail);
         try {
@@ -301,12 +312,40 @@ export class OperatorProposalRuntime {
                 this.pending.delete(root);
         }
     }
+    async locked(root, action) {
+        await mkdir(join(this.projectRoot, this.profile.stateDirectory, "operator-proposals"), { recursive: true });
+        const lock = `${this.file(root)}.lock`;
+        let handle;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                handle = await open(lock, "wx", 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        if (!handle)
+            throw new Error("operator-proposal-state-busy");
+        try {
+            return await action();
+        }
+        finally {
+            await handle.close();
+            await rm(lock, { force: true });
+        }
+    }
     projectRoot;
     constructor(projectRoot, profile) {
         this.profile = profile;
         this.projectRoot = resolve(projectRoot);
     }
     file(root) { return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.json`); }
+    approvedArchiveFile(root, intentID, proposalHash, runID) {
+        return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.${intentID}.${proposalHash}.${hash(runID).slice(0, 16)}.approved.json`);
+    }
     spendFile(root) { return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.spend.json`); }
     async readSpend(root) {
         let source;
@@ -331,6 +370,12 @@ export class OperatorProposalRuntime {
             !/^sha256:[a-f0-9]{64}$/u.test(spend.retry.goal_binding.acceptance_fingerprint))) {
             throw new Error("operator-proposal-spend-invalid");
         }
+        if (spend.approved_history !== undefined && (!Array.isArray(spend.approved_history) ||
+            spend.approved_history.some(item => !record(item) || !/^[a-f0-9]{64}$/u.test(String(item.archive_hash)) ||
+                !identifier(item.intent_id) || !identifier(item.proposal_id) || !text(item.run_id) ||
+                !["completed", "incomplete"].includes(String(item.disposition))))) {
+            throw new Error("operator-proposal-spend-invalid");
+        }
         return spend;
     }
     async saveSpend(spend) {
@@ -362,9 +407,6 @@ export class OperatorProposalRuntime {
         return this.serial(root, () => this.readUnlocked(root));
     }
     async readUnlocked(root) {
-        const cached = this.states.get(root);
-        if (cached)
-            return structuredClone(cached);
         let source;
         try {
             source = await readFile(this.file(root), "utf8");
@@ -396,8 +438,7 @@ export class OperatorProposalRuntime {
         else {
             throw new Error("operator-proposal-state-invalid");
         }
-        this.states.set(root, state);
-        return structuredClone(state);
+        return state;
     }
     async save(state) {
         const directory = join(this.projectRoot, this.profile.stateDirectory, "operator-proposals");
@@ -410,7 +451,6 @@ export class OperatorProposalRuntime {
         finally {
             await rm(temporary, { force: true }).catch(() => undefined);
         }
-        this.states.set(state.root_session_id, structuredClone(state));
     }
     assertBudgetAvailable(state) {
         const remainingReads = state.intent.proposal_budget.max_reads - state.read_count;
@@ -512,11 +552,85 @@ export class OperatorProposalRuntime {
             goal_binding: spend.retry?.intent_hash === intentHash ? structuredClone(spend.retry.goal_binding) : null,
             proposal_call_id: null, proposal_session_id: null, read_count: spend.reads, read_paths: [], submission_count: spend.submissions, proposal_id: null,
             ...(spend.reads > 0 || spend.submissions > 0 ? { prior_spend: { reads: spend.reads, submissions: spend.submissions } } : {}),
-            proposal_revision: null, proposal_hash: null, proposal: null, approval_rationale: null };
+            proposal_revision: null, proposal_hash: null, proposal: null, approval_rationale: null,
+            ...(spend.approved_history ? { approved_history: structuredClone(spend.approved_history) } : {}) };
         this.assertBudgetAvailable(state);
         await this.save(state);
         return state;
     }
+    /** Explicit root-only transition after an approved contract's execution lane has ended. */
+    async reviseApproved(root, actor, raw, readRun, currentGoal) {
+        if (actor !== root)
+            throw new Error("operator-proposal-approved-revision-root-required");
+        return this.serial(root, async () => {
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "operator_run_id", "rationale", "intent"]) ||
+                typeof raw.proposal_id !== "string" || !Number.isSafeInteger(raw.revision) || typeof raw.content_hash !== "string" ||
+                typeof raw.operator_run_id !== "string" || !text(raw.rationale)) {
+                throw new Error("operator-proposal-approved-revision-invalid");
+            }
+            const previous = await this.requiredUnlocked(root);
+            if (previous.phase !== "approved" || !previous.proposal || !previous.goal_binding) {
+                throw new Error("operator-proposal-approved-revision-not-approved");
+            }
+            if (raw.proposal_id !== previous.proposal_id || raw.revision !== previous.proposal_revision ||
+                raw.content_hash !== previous.proposal_hash)
+                throw new Error("operator-proposal-approved-revision-identity-mismatch");
+            const run = await readRun();
+            if (!run || !["cancelled", "completed"].includes(run.phase) || run.rootSessionID !== root ||
+                run.runID !== raw.operator_run_id || run.planHash !== hash(JSON.stringify(previous.proposal.plan)) ||
+                JSON.stringify(run.acceptance) !== JSON.stringify(previous.proposal.plan.acceptance)) {
+                throw new Error("operator-proposal-approved-revision-terminal-run-required");
+            }
+            if (!text(currentGoal.goal_id) || !Number.isSafeInteger(currentGoal.revision) || currentGoal.revision < 1 ||
+                !Number.isSafeInteger(currentGoal.scope_epoch) || currentGoal.scope_epoch < 1 ||
+                !/^sha256:[a-f0-9]{64}$/u.test(currentGoal.acceptance_fingerprint)) {
+                throw new Error("operator-proposal-goal-binding-invalid");
+            }
+            if (JSON.stringify(currentGoal) === JSON.stringify(previous.goal_binding)) {
+                throw new Error("operator-proposal-approved-revision-goal-revision-required");
+            }
+            const intent = parseIntent(raw.intent), intentHash = hash(JSON.stringify(intent));
+            if (intentHash === previous.intent_hash)
+                throw new Error("operator-proposal-approved-revision-intent-unchanged");
+            if (currentGoal.goal_id === previous.goal_binding.goal_id &&
+                JSON.stringify(intent.requirements.slice(0, previous.intent.requirements.length)) !== JSON.stringify(previous.intent.requirements)) {
+                throw new Error("operator-proposal-approved-revision-acceptance-continuity-required");
+            }
+            const remainingReads = intent.proposal_budget.max_reads - previous.read_count;
+            const remainingSubmissions = intent.proposal_budget.max_submissions - previous.submission_count;
+            if (remainingReads <= 0 || remainingSubmissions <= 0) {
+                throw new OperatorProposalBudgetError({ status: "proposal-budget-exhausted",
+                    code: remainingReads <= 0 ? "operator-proposal-read-budget-exhausted" : "operator-proposal-submission-budget-exhausted",
+                    reads: previous.read_count, max_reads: intent.proposal_budget.max_reads, remaining_reads: Math.max(0, remainingReads),
+                    submissions: previous.submission_count, max_submissions: intent.proposal_budget.max_submissions,
+                    remaining_submissions: Math.max(0, remainingSubmissions),
+                    required_minimum_budget: { max_reads: previous.read_count + 1, max_submissions: previous.submission_count + 1 } });
+            }
+            const archive = JSON.stringify({ approved_proposal: previous, terminal_run: {
+                    run_id: run.runID, plan_hash: run.planHash, acceptance: run.acceptance, acceptance_fingerprint: run.acceptanceFingerprint,
+                    phase: run.phase, decision: run.decision, receipt: run.receipt, generation: run.generation
+                } });
+            const archivePath = this.approvedArchiveFile(root, previous.intent_id, previous.proposal_hash, run.runID);
+            try {
+                await writeFile(archivePath, archive, { flag: "wx", mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" || hash(await readFile(archivePath, "utf8")) !== hash(archive))
+                    throw error;
+            }
+            const state = { schema_version: "0.1", profile: this.profile.id, root_session_id: root,
+                intent_id: `intent-${intentHash.slice(0, 24)}`, intent_hash: intentHash, intent, created_at: new Date().toISOString(),
+                phase: "investigating", goal_binding: structuredClone(currentGoal),
+                prior_spend: { reads: previous.read_count, submissions: previous.submission_count },
+                proposal_call_id: null, proposal_session_id: null, read_count: previous.read_count, read_paths: [],
+                submission_count: previous.submission_count, proposal_id: null, proposal_revision: null, proposal_hash: null,
+                proposal: null, approval_rationale: null,
+                approved_history: [...(previous.approved_history ?? []), { archive_hash: hash(archive), intent_id: previous.intent_id,
+                        proposal_id: previous.proposal_id, run_id: run.runID, disposition: run.phase === "completed" ? "completed" : "incomplete" }] };
+            await this.save(state);
+            return state;
+        });
+    }
     async bindGoal(root, binding) {
         return this.serial(root, () => this.bindGoalUnlocked(root, binding));
     }
@@ -638,6 +752,132 @@ export class OperatorProposalRuntime {
         await this.save(state);
         return state;
     }
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    async reviseJSON(root, actor, source) {
+        return this.serial(root, async () => {
+            if (root !== actor)
+                throw new Error("operator-proposal-revision-root-required");
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || state.approval_started)
+                throw new Error("operator-proposal-not-revisable");
+            if (state.submission_count >= state.intent.proposal_budget.max_submissions)
+                throw new Error("operator-proposal-submission-budget-exhausted");
+            let request, candidate;
+            try {
+                if (Buffer.byteLength(source) > 128 * 1024)
+                    proposalError("/", "operator-proposal-revision-too-large", "maxBytes");
+                let raw;
+                try {
+                    raw = JSON.parse(source);
+                }
+                catch {
+                    proposalError("/", "operator-proposal-revision-json-invalid", "json");
+                }
+                if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "patches"]) ||
+                    !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                    !text(raw.rationale) || raw.rationale.length > 2000 || !Array.isArray(raw.patches) ||
+                    raw.patches.length < 1 || raw.patches.length > 32) {
+                    return proposalError("/", "operator-proposal-revision-invalid", "exact-identity-rationale-bounded-patches");
+                }
+                request = raw;
+                if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision || raw.content_hash !== state.proposal_hash) {
+                    throw new Error("operator-proposal-revision-identity-mismatch");
+                }
+                candidate = this.patchedPacket(state, raw.patches);
+            }
+            catch (error) {
+                if (error instanceof Error && error.message === "operator-proposal-revision-identity-mismatch")
+                    throw error;
+                // Rejections retain the old body/identity; only the same finite attempt counter advances.
+                state.submission_count++;
+                await this.save(state);
+                throw error;
+            }
+            const from = { proposal_id: state.proposal_id, revision: state.proposal_revision, content_hash: state.proposal_hash };
+            state.submission_count++;
+            state.proposal = candidate;
+            state.proposal_revision = candidate.revision;
+            state.proposal_hash = hash(JSON.stringify(candidate));
+            state.proposal_id = proposalID(state.intent_id, candidate.revision, state.proposal_hash);
+            (state.root_revisions ??= []).push({ actor, at: new Date().toISOString(), rationale: request.rationale,
+                from, to: { proposal_id: state.proposal_id, revision: candidate.revision, content_hash: state.proposal_hash },
+                patch_hash: hash(JSON.stringify(request.patches)), paths: request.patches.map(patch => patch.path) });
+            await this.save(state);
+            return state;
+        });
+    }
+    patchedPacket(state, patches) {
+        const before = state.proposal;
+        const draft = structuredClone(before);
+        const paths = [];
+        for (const [index, patch] of patches.entries()) {
+            const pointer = `/patches/${index}`;
+            if (!record(patch) || !exactSet(patch, ["op", "path", "value"]) || typeof patch.path !== "string") {
+                proposalError(pointer, "operator-proposal-revision-patch-invalid", "exact-op-path-value");
+            }
+            const entry = patch;
+            const command = /^\/plan\/goal_declaration\/criteria\/(0|[1-9][0-9]*)\/(validation_command|goal_validation_command)$/u.test(entry.path);
+            const replace = /^\/(coverage|existing_surface|uncovered|negative_handling|read_scope|plan\/(units|acceptance_proof))$/u.test(entry.path) ||
+                /^\/plan\/units\/(0|[1-9][0-9]*)\/(title|objective|read|validation|acceptance_indices)$/u.test(entry.path);
+            if (!(command && (entry.op === "add" || entry.op === "replace") || replace && entry.op === "replace") ||
+                paths.some(path => path === entry.path || path.startsWith(`${entry.path}/`) || entry.path.startsWith(`${path}/`))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-denied", "nonoverlapping-allowlisted-field");
+            }
+            paths.push(entry.path);
+            const tokens = entry.path.slice(1).split("/");
+            let owner = draft;
+            for (const token of tokens.slice(0, -1)) {
+                if (owner === null || typeof owner !== "object" || !Object.hasOwn(owner, token)) {
+                    proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "existing-parent");
+                }
+                owner = owner[token];
+            }
+            const key = tokens.at(-1);
+            if (owner === null || typeof owner !== "object" || (entry.op === "replace" && !Object.hasOwn(owner, key)) ||
+                (entry.op === "add" && Object.hasOwn(owner, key))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "replace-existing-or-add-absent-field");
+            }
+            owner[key] = structuredClone(entry.value);
+        }
+        const normalizeReads = (value) => Array.isArray(value) ? value.map(path => {
+            if (typeof path !== "string")
+                return path;
+            try {
+                return normalizeRelativePath(path);
+            }
+            catch {
+                return proposalError("/read_scope", "operator-proposal-revision-read-invalid", "safe-relative-spelling");
+            }
+        }) : value;
+        draft.read_scope = normalizeReads(draft.read_scope);
+        if (Array.isArray(draft.plan.units))
+            for (const unit of draft.plan.units)
+                if (record(unit))
+                    unit.read = normalizeReads(unit.read);
+        draft.revision = before.revision + 1;
+        draft.budget_estimate = { proposal_reads: state.read_count, execution_units: draft.plan.units?.length };
+        const candidate = parsePacket(draft, state);
+        const within = (path, scopes) => scopes.some(scope => path === scope || path.startsWith(`${scope}/`));
+        if (candidate.read_scope.some(path => !within(path, before.read_scope)) ||
+            candidate.plan.units.flatMap(unit => unit.read).some(path => !within(path, before.plan.units.flatMap(unit => unit.read)))) {
+            proposalError("/read_scope", "operator-proposal-revision-read-expanded", "read-authority-only-shrinks");
+        }
+        if (candidate.plan.units.length > before.plan.units.length) {
+            proposalError("/plan/units", "operator-proposal-revision-units-expanded", "execution-unit-count-cannot-increase");
+        }
+        if (JSON.stringify({ ...candidate, revision: before.revision }) === JSON.stringify(before)) {
+            proposalError("/patches", "operator-proposal-revision-no-change", "substantive-correction-required");
+        }
+        return candidate;
+    }
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    async pinApproval(root, raw) {
+        return this.serial(root, async () => {
+            const state = await this.approveUnlocked(root, raw, false);
+            state.approval_started = true;
+            await this.save(state);
+        });
+    }
     async approve(root, raw, commit = true) {
         return this.serial(root, () => this.approveUnlocked(root, raw, commit));
     }
@@ -669,9 +909,9 @@ export class OperatorProposalRuntime {
                 return undefined;
             await this.saveSpend({ schema_version: "0.1", profile: this.profile.id, root_session_id: root,
                 reads: state.read_count, submissions: state.submission_count,
+                ...(state.approved_history ? { approved_history: state.approved_history } : {}),
                 ...(state.goal_binding === null ? {} : { retry: { intent_hash: state.intent_hash, goal_binding: state.goal_binding } }) });
             await rm(this.file(root), { force: true });
-            this.states.delete(root);
             return state;
         });
     }
@@ -693,6 +933,7 @@ export class OperatorProposalRuntime {
             remaining_reads: state.intent.proposal_budget.max_reads - state.read_count, submissions: state.submission_count,
             remaining_submissions: state.intent.proposal_budget.max_submissions - state.submission_count,
             task_admitted: state.proposal_call_id !== null, uncovered: state.proposal?.uncovered ?? [], proposal: state.proposal,
-            approval_rationale: state.approval_rationale };
+            approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [], approved_history: state.approved_history ?? [],
+            revision_available: state.phase === "submitted" && !state.approval_started && state.submission_count < state.intent.proposal_budget.max_submissions };
     }
 }

package/dist/plugin/adaptive-remediation-host.d.ts

@@ -23,7 +23,7 @@ export interface AdaptiveReviewProvider {
         readonly fingerprint: string;
     }>;
 }
-export declare const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-5.6-sol";
+export declare const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-6-sol";
 export interface AdaptiveRemediationSessionClient extends OpenCodeModelAvailabilityClient {
     session: {
         create(input: {

package/dist/plugin/adaptive-remediation-host.js

@@ -10,7 +10,7 @@ import { produceWorktreeCommitArtifact, runContainedValidation } from "../core/w
 import { openCodeModel } from "./model-routing-hook.js";
 const SHA = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
 const HASH = /^[a-f0-9]{64}$/u;
-export const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-5.6-sol";
+export const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-6-sol";
 const responseData = (value) => {
     if (value === null || typeof value !== "object")
         return {};

package/dist/plugin/model-cost.d.ts

@@ -1,9 +1,9 @@
 export declare const MODEL_COST_PRICING_SNAPSHOT: {
-    readonly checkedAt: "2026-09-14";
+    readonly checkedAt: "2026-09-23";
     readonly currency: "USD";
     readonly unit: "1M tokens";
-    readonly sources: readonly ["https://developers.openai.com/api/docs/pricing", "https://developers.openai.com/api/docs/models/gpt-6-astra", "https://developers.openai.com/api/docs/models/gpt-5.6-sol", "https://developers.openai.com/api/docs/models/gpt-5.6-terra", "https://developers.openai.com/api/docs/models/gpt-5.6-luna", "https://platform.claude.com/docs/en/about-claude/pricing"];
-    readonly assumptions: readonly ["OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.", "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.", "variant and serviceTier are separate; model variants do not alter the selected Standard token price.", "gpt-5.6-luna-fast has no published model page; its rates are the resolved host model catalog entry for openai/gpt-5.6-luna-fast, exactly twice the Luna Standard schedule. That entry declares no separate long-context band, so the shared OpenAI band above is applied rather than a second assumed schedule."];
+    readonly sources: readonly ["https://developers.openai.com/api/docs/pricing", "https://developers.openai.com/api/docs/models/gpt-6-astra", "https://developers.openai.com/api/docs/models/gpt-6-sol", "https://developers.openai.com/api/docs/models/gpt-6-luna", "https://developers.openai.com/api/docs/models/gpt-5.6-sol", "https://developers.openai.com/api/docs/models/gpt-5.6-terra", "https://developers.openai.com/api/docs/models/gpt-5.6-luna", "https://platform.claude.com/docs/en/about-claude/pricing"];
+    readonly assumptions: readonly ["OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.", "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.", "variant and serviceTier are separate; model variants do not alter the selected Standard token price.", "GPT-6 Sol and GPT-6 Luna use their official Standard schedules; Fast mode is a service tier priced separately and does not create a second model ID.", "gpt-5.6-luna-fast is retained only as a compatibility price for historical host catalog entries; it has no published model page and is exactly twice the GPT-5.6 Luna Standard schedule."];
 };
 export interface ModelCostUsage {
     readonly providerID: string | undefined;

package/dist/plugin/model-cost.js

@@ -1,10 +1,12 @@
 export const MODEL_COST_PRICING_SNAPSHOT = {
-    checkedAt: "2026-09-14",
+    checkedAt: "2026-09-23",
     currency: "USD",
     unit: "1M tokens",
     sources: [
         "https://developers.openai.com/api/docs/pricing",
         "https://developers.openai.com/api/docs/models/gpt-6-astra",
+        "https://developers.openai.com/api/docs/models/gpt-6-sol",
+        "https://developers.openai.com/api/docs/models/gpt-6-luna",
         "https://developers.openai.com/api/docs/models/gpt-5.6-sol",
         "https://developers.openai.com/api/docs/models/gpt-5.6-terra",
         "https://developers.openai.com/api/docs/models/gpt-5.6-luna",
@@ -14,11 +16,14 @@ export const MODEL_COST_PRICING_SNAPSHOT = {
         "OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.",
         "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.",
         "variant and serviceTier are separate; model variants do not alter the selected Standard token price.",
-        "gpt-5.6-luna-fast has no published model page; its rates are the resolved host model catalog entry for openai/gpt-5.6-luna-fast, exactly twice the Luna Standard schedule. That entry declares no separate long-context band, so the shared OpenAI band above is applied rather than a second assumed schedule.",
+        "GPT-6 Sol and GPT-6 Luna use their official Standard schedules; Fast mode is a service tier priced separately and does not create a second model ID.",
+        "gpt-5.6-luna-fast is retained only as a compatibility price for historical host catalog entries; it has no published model page and is exactly twice the GPT-5.6 Luna Standard schedule.",
     ],
 };
 const OPENAI = {
     "gpt-6-astra": { input: 10, cacheRead: 1, cacheWrite: 12.5, output: 50 },
+    "gpt-6-sol": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 10 },
+    "gpt-6-luna": { input: 0.1, cacheRead: 0.01, cacheWrite: 0.125, output: 0.5 },
     "gpt-5.6-sol": { input: 4, cacheRead: 0.4, cacheWrite: 5, output: 20 },
     "gpt-5.6": { input: 4, cacheRead: 0.4, cacheWrite: 5, output: 20 },
     "gpt-5.6-terra": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 12 },

package/dist/plugin/model-routing.d.ts

@@ -8,17 +8,17 @@ export interface RoleModelRoute {
 }
 export type ModelRoutingConfig = Readonly<Record<string, RoleModelRoute>>;
 /** The stable serial implementation route stays on Sol when Luna fan-out is unsafe or unavailable. */
-export declare const DEDICATED_WORKER_MODEL = "openai/gpt-5.6-sol";
+export declare const DEDICATED_WORKER_MODEL = "openai/gpt-6-sol";
 export declare const DEDICATED_WORKER_VARIANT = "medium";
 /** Luna executes only units admitted to the fabric; it is not the serial worker's fallback target. */
-export declare const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-5.6-luna";
+export declare const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-6-luna";
 export declare const LUNA_FABRIC_WORKER_VARIANT = "max";
 export declare const LUNA_FABRIC_WORKER_ROLE = "dog-luna-worker";
-/** The coordinator uses Terra High so routing and progress decisions do not bottleneck the workflow. */
-export declare const DEFAULT_COORDINATOR_MODEL = "openai/gpt-5.6-terra";
+/** The coordinator uses Sol 6 High so routing and progress decisions do not bottleneck the workflow. */
+export declare const DEFAULT_COORDINATOR_MODEL = "openai/gpt-6-sol";
 export declare const DEFAULT_COORDINATOR_VARIANT = "high";
 /** Compatibility names retained for the pre-v0.8 explicit Sol target. */
-export declare const ESCALATION_WORKER_MODEL = "openai/gpt-5.6-sol";
+export declare const ESCALATION_WORKER_MODEL = "openai/gpt-6-sol";
 export declare const ESCALATION_WORKER_VARIANT = "medium";
 export declare const DEDICATED_WORKER_ROLES: readonly ["implementation", "remediation", "blocker-resolution", "sol-worker-mk2a2", "dog-worker"];
 /** Ordered last-resort targets used only when the host proves a policy target unavailable. */
@@ -37,8 +37,8 @@ export declare const LUNA_FABRIC_WORKER_TARGET: ModelTarget;
 export declare const LUNA_FABRIC_WORKER_ROUTING: ModelRoutingConfig;
 export declare function fixedWorkerRouting(dedicatedTarget?: ModelTarget): ModelRoutingConfig;
 export declare const FIXED_MODEL_ROUTING: ModelRoutingConfig;
-export declare const RECOMMENDED_LUNA_MODEL = "openai/gpt-5.6-luna";
-/** Coordinator state and routing use Terra High; bounded evidence retrieval uses Luna High. */
+export declare const RECOMMENDED_LUNA_MODEL = "openai/gpt-6-luna";
+/** Coordinator state and routing use Sol 6 High; bounded evidence retrieval uses Luna High. */
 export declare const DEFAULT_COORDINATOR_ROUTING: ModelRoutingConfig;
 /** Evidence gathering is retrieval rather than reasoning, so the scout stays one effort tier lower. */
 export declare const RECOMMENDED_SCOUT_VARIANT = "high";

package/dist/plugin/model-routing.js

@@ -1,13 +1,13 @@
 import { CONSULTATION_ROLE_POLICY } from "../core/consultation.js";
 /** The stable serial implementation route stays on Sol when Luna fan-out is unsafe or unavailable. */
-export const DEDICATED_WORKER_MODEL = "openai/gpt-5.6-sol";
+export const DEDICATED_WORKER_MODEL = "openai/gpt-6-sol";
 export const DEDICATED_WORKER_VARIANT = "medium";
 /** Luna executes only units admitted to the fabric; it is not the serial worker's fallback target. */
-export const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-5.6-luna";
+export const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-6-luna";
 export const LUNA_FABRIC_WORKER_VARIANT = "max";
 export const LUNA_FABRIC_WORKER_ROLE = "dog-luna-worker";
-/** The coordinator uses Terra High so routing and progress decisions do not bottleneck the workflow. */
-export const DEFAULT_COORDINATOR_MODEL = "openai/gpt-5.6-terra";
+/** The coordinator uses Sol 6 High so routing and progress decisions do not bottleneck the workflow. */
+export const DEFAULT_COORDINATOR_MODEL = "openai/gpt-6-sol";
 export const DEFAULT_COORDINATOR_VARIANT = "high";
 /** Compatibility names retained for the pre-v0.8 explicit Sol target. */
 export const ESCALATION_WORKER_MODEL = DEDICATED_WORKER_MODEL;
@@ -64,7 +64,7 @@ export function fixedWorkerRouting(dedicatedTarget = DEFAULT_DEDICATED_WORKER_TA
 export const FIXED_MODEL_ROUTING = fixedWorkerRouting();
 const fixedModelRoleSet = new Set(Object.keys(FIXED_MODEL_ROUTING));
 export const RECOMMENDED_LUNA_MODEL = LUNA_FABRIC_WORKER_MODEL;
-/** Coordinator state and routing use Terra High; bounded evidence retrieval uses Luna High. */
+/** Coordinator state and routing use Sol 6 High; bounded evidence retrieval uses Luna High. */
 export const DEFAULT_COORDINATOR_ROUTING = Object.freeze({
     "dog-coordinator": Object.freeze({
         preferred: Object.freeze({

package/dist/plugin/profiled.js

@@ -1,6 +1,6 @@
 import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { OperatorContractError, OperatorRuntime } from "../core/operator-runtime.js";
-import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
+import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OPERATOR_PROPOSAL_REVISION_CONTRACT, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
 import { CANONICAL_AGENT_ROLES, canonicalAgent, profileAgent, profileTool, V010_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { SortieDogsPlugin as canonicalPlugin } from "./index.js";
 import { taskChildSessionID } from "./task-result-repair.js";
@@ -22,17 +22,17 @@ const SERIAL_OPTIONAL_ARGUMENTS = new Map([
             "scope", "trigger", "cause", "prevention", "evidence", "evidenceRef", "id", "promotedRef", "confirmation",
         ])],
 ]);
-const PREVIEW_WORKER_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "max" });
-const PREVIEW_SCOUT_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "xhigh" });
+const PREVIEW_WORKER_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "max" });
+const PREVIEW_SCOUT_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "xhigh" });
 /**
  * Contract authorship, not throughput. Qualification observed a cheaper operations model emit
  * structurally valid but under-scoped contracts: a write union narrower than the remediation the
  * review it also schedules demands, which strands an otherwise complete run on NEED_DECISION.
  */
-const PREVIEW_OPERATIONS_ROUTE = Object.freeze({ model: "openai/gpt-5.6-terra", variant: "xhigh" });
-const PREVIEW_PRIMARY_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "max" });
+const PREVIEW_OPERATIONS_ROUTE = Object.freeze({ model: "openai/gpt-6-sol", variant: "xhigh" });
+const PREVIEW_PRIMARY_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "max" });
 /** Review must be able to reject the worker's output, so it never shares the worker's model family. */
-const PREVIEW_REVIEW_ROUTE = Object.freeze({ model: "openai/gpt-5.6-terra", variant: "xhigh" });
+const PREVIEW_REVIEW_ROUTE = Object.freeze({ model: "openai/gpt-6-sol", variant: "xhigh" });
 /** Every preview route the profile can bind a role to. Catalog declaration reads this one list. */
 const PREVIEW_ROUTES = Object.freeze([
     PREVIEW_PRIMARY_ROUTE, PREVIEW_WORKER_ROUTE, PREVIEW_SCOUT_ROUTE, PREVIEW_OPERATIONS_ROUTE,
@@ -55,9 +55,16 @@ export function processRemediationReplacementPacket(code, packet, cancelTool, pr
  */
 export function previewModelCatalog(routes = PREVIEW_ROUTES, base = BUILT_IN_MODEL_CATALOG.global ?? []) {
     const variantsOf = (model) => [...new Set(routes.filter(route => route.model === model).map(route => route.variant))];
-    const listed = new Set(base.map(entry => entry.model));
+    const mergedBase = new Map();
+    for (const entry of base) {
+        const prior = mergedBase.get(entry.model);
+        mergedBase.set(entry.model, prior === undefined
+            ? entry
+            : { model: entry.model, variants: [...new Set([...(prior.variants ?? []), ...(entry.variants ?? [])])] });
+    }
+    const listed = new Set(mergedBase.keys());
     return [
-        ...base.map(entry => {
+        ...[...mergedBase.values()].map(entry => {
             const variants = variantsOf(entry.model);
             return variants.length === 0
                 ? entry
@@ -395,6 +402,16 @@ export function createProfiledPlugin(profile, assetVersion) {
         const approvalSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(OPERATOR_APPROVAL_CONTRACT)
             : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_APPROVAL_CONTRACT };
+        const revisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(OPERATOR_PROPOSAL_REVISION_CONTRACT)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_PROPOSAL_REVISION_CONTRACT };
+        const approvedRevisionContract = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,operator_run_id:string,rationale:nonblank single-line string,intent:object}. " +
+            "The intent has the exact begin_operator_proposal intent_json shape and a cumulative proposal_budget with room above all retained reads/submissions. " +
+            "Pin the approved proposal identity and the cancelled/completed run ID from operator_status. For the same goal, the new requirements must begin with every old ordered requirement byte-for-byte. Only a root acting for a newly authorized active goal may revise; active/prepared runs, stale identity or unchanged goal binding are denied. " +
+            "Old acceptance, terminal status and proposal accounting remain durable. This returns an investigation Task, not implementation or acceptance.";
+        const approvedRevisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(approvedRevisionContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: approvedRevisionContract };
         const planContract = "plan_json must encode the exact operator plan object: schema_version, acceptance, acceptance_proof, source_refs, " +
             "goal_declaration, units, and optional git_lifecycle only. git_lifecycle exact shape is " +
             '{branch_create:{branch:string,start_ref:string},commit:{message:string},post_commit_validation:string[],remediation_reserve?:string[],remediation_scope_expansion?:string[]}. Its presence is root authorization for only a clean, non-overwriting ' +
@@ -420,6 +437,8 @@ export function createProfiledPlugin(profile, assetVersion) {
         const beginProposal = profileTool(profile, "sortie_begin_operator_proposal");
         const submitProposal = profileTool(profile, "sortie_submit_operator_proposal");
         const approveProposal = profileTool(profile, "sortie_approve_operator_proposal");
+        const reviseProposal = profileTool(profile, "sortie_revise_operator_proposal");
+        const reviseApprovedIntent = profileTool(profile, "sortie_revise_approved_operator_intent");
         async function stop(root, reason, retireRoot = true) {
             if (retireRoot)
                 retired.add(root);
@@ -559,7 +578,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                             ? "proposal submission budget exhausted; do not call operator_next; report the bounded proposal failure"
                             : "proposal is not submitted; do not call operator_next; complete or repair the bounded proposal submission"
                     : proposal?.phase === "submitted"
-                        ? "compare and approve the exact proposal; do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation."
+                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
                         : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
                 return JSON.stringify(state ? { ...await operatorPacket(state), ...(draft ? { pending_draft: draft } : {}),
                     ...(proposal ? { proposal: proposalIdentity(proposal) } : {}) }
@@ -801,6 +820,33 @@ export function createProfiledPlugin(profile, assetVersion) {
                 return JSON.stringify({ ...proposals.packet(state), task: proposals.referenceTask(state),
                     dispatch_instruction: "Pass this short Task reference verbatim; do not append or paraphrase it." });
             } };
+        tools[reviseApprovedIntent] = { description: `Root-only: after a terminal cancelled/completed run, explicitly replace its approved proposal with a new user-authorized intent. Supply revision_json with exactly {proposal_id,revision,content_hash,operator_run_id,rationale,intent}; pin the approved identity and terminal run from operator_status. The intent has the exact ${beginProposal} intent_json shape and a cumulative proposal_budget strictly above retained reads/submissions. A current active goal with a changed binding and no outstanding reservations is required. The prior approved contract, ordered acceptance, terminal disposition and cumulative proposal spend are archived; the old run is never accepted, revived or overwritten. Active/prepared runs and stale identities are rejected. This grants one new investigation Task, not approval or execution.`,
+            args: { revision_json: approvedRevisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    let request;
+                    try {
+                        request = JSON.parse(args.revision_json);
+                    }
+                    catch {
+                        return JSON.stringify({ status: "invalid-approved-revision", code: "operator-proposal-approved-revision-json-invalid" });
+                    }
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        await control.assertActiveGoal(context.sessionID, binding.acceptance_fingerprint);
+                        const revised = await proposals.reviseApproved(context.sessionID, context.sessionID, request, () => new OperatorRuntime(input.directory, profile).read(context.sessionID), binding);
+                        return JSON.stringify({ ...proposals.packet(revised), task: proposals.referenceTask(revised),
+                            dispatch_instruction: "Dispatch this new exact Task reference once; do not reuse the prior approved contract or its child." });
+                    }
+                    catch (error) {
+                        if (error instanceof OperatorProposalBudgetError)
+                            return JSON.stringify(error.diagnostic);
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-approved-revision", code: error.message });
+                    }
+                });
+            } };
         tools[submitProposal] = { description: "Proposal-child-only: submit a requirement-mapped contract proposal without editing source or starting workers. " + proposalContract + " Omit plan.acceptance; the host derives its exact ordered text from durable intent.requirements. A legacy explicit plan.acceptance is accepted only when byte-exact in content and order; null, subsets, reorder, normalization, and acceptance_ids aliases are rejected.",
             args: { proposal_json: proposalSchema }, execute: async (args, context) => {
                 const root = await rootFor(context.sessionID);
@@ -823,6 +869,26 @@ export function createProfiledPlugin(profile, assetVersion) {
                         ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
                 }
             } };
+        tools[reviseProposal] = { description: "Root-only: revise an unapproved submitted proposal using a hash-pinned field patch and the remaining submission allowance. " + OPERATOR_PROPOSAL_REVISION_CONTRACT,
+            args: { revision_json: revisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const revised = await proposals.reviseJSON(context.sessionID, context.sessionID, args.revision_json);
+                        return JSON.stringify({ ...proposals.packet(revised),
+                            next_action: "Compare all original ordered requirements again. Explicitly approve only this new identity if every obligation is genuinely covered; no execution or approval was granted by revision." });
+                    }
+                    catch (error) {
+                        const contract = error instanceof OperatorContractError;
+                        if (!contract && (!(error instanceof Error) || !error.message.startsWith("operator-proposal-")))
+                            throw error;
+                        const state = await proposals.read(context.sessionID);
+                        return JSON.stringify({ status: "invalid-revision", code: error.message,
+                            ...(state ? { proposal: proposalIdentity(state) } : {}),
+                            ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
+                    }
+                });
+            } };
         tools[approveProposal] = { description: "Root-only: record semantic comparison of the exact proposal revision/hash, then connect its immutable plan to the existing execution lane. " + OPERATOR_APPROVAL_CONTRACT,
             args: { approval_json: approvalSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
@@ -852,6 +918,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     if (approved.goal_binding === null)
                         throw new Error("operator-proposal-goal-binding-missing");
                     await control.assertProposalExecutionBudget(context.sessionID, approved.goal_binding, proposal.plan.units.length);
+                    await proposals.pinApproval(context.sessionID, approval);
                     const prepared = await operators.propose(context.sessionID, proposal.plan);
                     if (prepared.status !== "prepared")
                         throw new Error("operator-proposal-approved-plan-invalid");
@@ -861,7 +928,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 });
             } };
         const ownTools = new Set([prepare, repair, next, status, cancel, complete, resume, resolveContractRepair,
-            beginProposal, submitProposal, approveProposal]);
+            beginProposal, submitProposal, approveProposal, reviseProposal, reviseApprovedIntent]);
         const protocolMap = CANONICAL_AGENT_ROLES.map(role => `${role}=${profileAgent(profile, role)}`).join(", ");
         function rememberRendered(key, text) {
             renderedParts.set(key, goalFingerprint(text));

package/dist/runtime-assets-v010.js

@@ -89,7 +89,7 @@ permission rejection shows a different project root, do not repeat that path; re
 const coordinatorContent = `---
 description: Sortie-dogs ${V010_RUNTIME_ASSET_VERSION} primary dog-operator — strategic authority with a bounded operations delegate.
 mode: primary
-model: openai/gpt-5.6-luna-fast
+model: openai/gpt-6-luna
 variant: max
 permission:
   question: allow
@@ -153,6 +153,14 @@ Every requirement entry must include kind="requirement" | "negative" | "quality"
 Use only authoritative_refs and allow_read for begin intent scope. project_root, source_refs, max_read_prefixes,
 authoritative_references, and other aliases are invalid. Do not guess a smaller contract after rejection: use this exact
 shape, preserving all ordered requirements, and omit proposal_budget only when the deterministic host default is intended.
+If the root already has an approved proposal, first finish or cancel its operator run. After a genuinely new user-authorized
+goal is active, use ${profile.toolPrefix}revise_approved_operator_intent with revision_json containing exactly the old
+proposal_id, revision, content_hash, terminal operator_run_id, a single-line rationale, and the complete new intent object.
+Pin the identity from operator_status. The host refuses active/prepared runs, stale identities, unchanged goal bindings,
+and budgets without room above cumulative proposal spend. It archives the old approved intent, ordered acceptance and
+terminal result before granting one new investigation Task. Within the same goal, retain the old ordered requirements
+byte-for-byte as a prefix of the new intent; a separate user-authorized goal may have a different order. No child, unit,
+acceptance or budget is revived or reset.
 Freeze product requirements from the original request, not extra implementation criteria invented from workflow
 bookkeeping. Keep proposal read/submission allowances in proposal_budget and host counters; do not turn spent
 budgets or your own reporting obligations into worker validation commands. Preserve any explicit user requirement.
@@ -168,7 +176,19 @@ report that specific limitation for a scope/design decision instead of inventing
 The proposal must map every original requirement ID to approach and validation, explicitly list uncovered IDs, preserve
 negative-condition handling, and include exact read/write/unit/GoalDeclaration plans and budget estimates. Its summary is
 not the source of truth and proposal reads are not acceptance evidence. Compare the submitted proposal directly with the
-original request. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
+original request. For a known defect in a submitted, unapproved proposal, the root may call
+${profile.toolPrefix}revise_operator_proposal with revision_json containing the current proposal_id, revision, content_hash,
+a substantive rationale, and 1..32 allowlisted {op,path,value} patches. Follow its exact schema; do not resend the full packet.
+Correct coverage/uncovered, observed surface claims, negative handling, unit/milestone/proof mapping, or shrink/normalize reads
+using only the completed investigation's evidence. Ordered requirements/acceptance, references, goal binding, budgets,
+criterion identities/defaults, Git authority and the exact write union stay fixed; execution unit count cannot increase.
+Successful and invalid patch attempts share the remaining submission allowance. Revision grants no new read, child or worker
+and requires no live proposal child. The host atomically records provenance and derives the next revision/hash.
+Approval preparation closes revision even if preparation later fails. Preserve that pinned plan for approval recovery.
+Never claim worker tests prove root-owned push/global apply or user-only acceptance; keep those obligations explicitly pending
+until their actual evidence exists. If existing contracts cannot express a required obligation, keep it uncovered and report
+the exact limitation instead of substituting a passing test. A root patch is not acceptance or automatic approval.
+Compare every original requirement again after revision. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
 revision, content_hash, ordered compared_requirement_ids, decision=approve, and a substantive comparison rationale.
 Uncovered requirements, stale hashes/revisions, another root, widened scope, rewritten acceptance, or reset proposal
 accounting must be rejected. Hash matching records identity; it never replaces this semantic root decision. Approval alone

package/dist/runtime-assets.d.ts

@@ -12,7 +12,7 @@ export declare const runtimeAssets: readonly [{
     readonly content: `---
 description: Canonical MkII coordinator packaged by Sortie-dogs
 mode: primary
-model: openai/gpt-5.6-terra
+model: openai/gpt-6-sol
 variant: high
 permission:
   question: allow
@@ -414,7 +414,7 @@ uses the run's shared time/cost limits. Use the existing compiled plan and Luna
 Call sortie_prepare_failure_swarm. Dispatch only its returned ready descriptors with
 dog-luna-worker and one failure_swarm_descriptor JSON line. The plugin binds source scope,
 read-only authority, distinct causes, cumulative budget, and the shared cancellable lifecycle.
-No diagnosis child may write or select a remedy. After findings finish, the coordinator (Terra by
+No diagnosis child may write or select a remedy. After findings finish, the coordinator (Sol 6 by
 default, or the user's explicitly selected coordinator) calls sortie_select_failure_diagnosis
 with swarm_id and one selection_json containing diagnosis_id, capsule_id, recovery_kind,
 proposal, and budget_request. Preserve its immutable scope/acceptance/validation contract and

package/dist/runtime-assets.js

@@ -241,7 +241,7 @@ export const runtimeAssets = [
         content: `---
 description: Canonical MkII coordinator packaged by Sortie-dogs
 mode: primary
-model: openai/gpt-5.6-terra
+model: openai/gpt-6-sol
 variant: high
 permission:
   question: allow
@@ -643,7 +643,7 @@ uses the run's shared time/cost limits. Use the existing compiled plan and Luna
 Call sortie_prepare_failure_swarm. Dispatch only its returned ready descriptors with
 dog-luna-worker and one failure_swarm_descriptor JSON line. The plugin binds source scope,
 read-only authority, distinct causes, cumulative budget, and the shared cancellable lifecycle.
-No diagnosis child may write or select a remedy. After findings finish, the coordinator (Terra by
+No diagnosis child may write or select a remedy. After findings finish, the coordinator (Sol 6 by
 default, or the user's explicitly selected coordinator) calls sortie_select_failure_diagnosis
 with swarm_id and one selection_json containing diagnosis_id, capsule_id, recovery_kind,
 proposal, and budget_request. Preserve its immutable scope/acceptance/validation contract and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.10.19",
+  "version": "0.10.22",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",