sortie-dogs 0.12.10 → 0.12.12

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.10-mission-continuity-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.12-mission-lineage-external-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.10-mission-continuity-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.12-mission-lineage-external-v1";

package/dist/core/goal-bound.d.ts

@@ -38,7 +38,7 @@ export interface GoalEvidence {
         readonly source_paths: readonly string[];
         readonly candidate_paths: readonly string[];
         /** Missing on legacy evidence: retain its original all-paths snapshot recipe. */
-        readonly source_policy?: "project-files-v1";
+        readonly source_policy?: "project-files-v1" | "declared-paths-v1";
     };
     readonly execution: {
         readonly command: readonly string[];

package/dist/core/goal-bound.js

@@ -62,7 +62,8 @@ export function validGoalEvidence(value, state) {
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
         protectedBinding.candidate_paths.every(text) &&
-        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1");
+        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1" ||
+            protectedBinding.source_policy === "declared-paths-v1");
     const matches = criteria.length > 0 && criteria.length === value.measurement.criterion_ids.length &&
         criteria.every((criterion) => criterion.target === value.measurement.target &&
             criterion.entrypoint === value.measurement.entrypoint && criterion.workload === value.measurement.workload &&

package/dist/core/operator-mission.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { normalizeRelativePath } from "./path.js";
+import { normalizeExecutionScope } from "./path.js";
 import { parseOperatorPlan } from "./operator-runtime.js";
 import { profileAgent } from "./runtime-profile.js";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
@@ -286,7 +286,7 @@ export function missionPlan(mission, raw) {
             const entries = value[field] ?? [];
             if (!Array.isArray(entries) || !entries.every(item => typeof item === "string"))
                 throw new Error(`mission-unit-${index + 1}: ${field} must be paths`);
-            return [...new Set(entries.map(item => normalizeRelativePath(item)))];
+            return [...new Set(entries.map(item => normalizeExecutionScope(item)))];
         };
         const ids = value.requirement_ids ?? mission.requirements.map(item => item.id);
         if (!Array.isArray(ids) || ids.length === 0 || !ids.every(id => mission.requirements.some(item => item.id === id))) {
@@ -328,7 +328,7 @@ export function missionPlan(mission, raw) {
             // Keep all detailed instructions in the handoff, not in a 512-character wire label.
             criteria: units.map(unit => ({ criterion_id: unit.id, target: unit.title.slice(0, 512),
                 entrypoint: (unit.write[0] ?? unit.read[0] ?? unit.id).slice(0, 512), validation_command: unit.validation.at(-1) })) },
-        units });
+        units }, "execution");
 }
 export function missionPacket(mission, run) {
     const currentReview = mission.review !== undefined && mission.review.runID === (run?.runID ?? mission.runID);
@@ -336,6 +336,12 @@ export function missionPacket(mission, run) {
     return { mission_id: mission.id, phase: mission.phase, coordinator_session_id: mission.coordinator,
         requirements: mission.requirements, original_request_refs: mission.requests.map(item => `user:${item.id}`),
         submission: mission.submission, progress: mission.progress,
+        execution_summary: { completed_units: run?.units.filter(unit => unit.status === "succeeded").length ?? 0,
+            running_units: run?.units.filter(unit => unit.status === "running").map(unit => ({ id: unit.unit.id, title: unit.unit.title, child_session_id: unit.childSessionID })) ?? [],
+            pending_units: run?.units.filter(unit => unit.status === "pending").length ?? 0,
+            failed_units: run?.units.filter(unit => unit.status === "failed").length ?? 0,
+            historical_failed_attempts: mission.progress.filter(unit => unit.status === "failed").length,
+            accepted: mission.phase === "completed" },
         review: mission.review ? { risk_tags: mission.review.risk, verdict: mission.review.verdict,
             run_id: mission.review.runID, current_run: currentReview,
             source_fingerprint: mission.review.source, reviewer_session_id: mission.review.child ?? null,
@@ -344,11 +350,14 @@ export function missionPacket(mission, run) {
             passed: currentReview && mission.review.verdict === "PASS", permits_submission: reviewAccepted } : null,
         ...(run ? { run_id: run.runID, status: run.phase, decision: run.decision,
             units: run.units.map(unit => ({ id: unit.unit.id, title: unit.unit.title, status: unit.status,
-                child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence })) } : {}),
+                child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence,
+                ...(unit.dispatchDenial ? { dispatch_denial: unit.dispatchDenial } : {}) })) } : {}),
         next_action: mission.phase === "completed" ? "Mission completed. Report the accepted result and retained review gaps; no further dispatch or completion call is needed."
             : mission.phase === "submitted" && mission.submission?.status === "ready"
                 ? "Operator: compare the submitted candidate with the original requirements and actual evidence, then complete_mission if satisfied. Report remaining evidence gaps; they are not a review PASS."
-                : run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
+                : run?.phase === "awaiting-decision" ? (run.units.some(unit => unit.dispatchDenial)
+                    ? "Coordinator: inspect units[].dispatch_denial before changing the plan. Correct only its diagnosed cause; do not repeat an unchanged refused Task or replan for a host-state mismatch. Report an unresolved runtime mismatch with the loaded runtime identity; preserve requirements and cumulative spend."
+                    : "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative.")
                     : run?.phase === "awaiting-acceptance" ? (currentReview && mission.review?.verdict === "evidence-gaps" && !reviewAccepted
                         ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
                         : reviewAccepted

package/dist/core/operator-runtime.d.ts

@@ -115,6 +115,7 @@ interface UnitState {
     childSessionID: string | null;
     evidence: readonly GoalEvidence[];
     resultClass: string | null;
+    dispatchDenial?: string;
     repairValidationAttempts: number;
     repairValidation: {
         readonly repair_fingerprint: string;
@@ -210,7 +211,7 @@ export interface OperatorState {
 /** A later mission may replace an unexecuted cancellation, but must retain settled work's acceptance. */
 export declare function cancelledMissionRetainsAcceptance(state: OperatorState): boolean;
 export declare function operatorGitPathAuthorized(path: string, scopes: readonly string[], platform?: NodeJS.Platform): boolean;
-export declare function parseOperatorPlan(value: unknown): OperatorPlan;
+export declare function parseOperatorPlan(value: unknown, scopeFormat?: "repository" | "execution"): OperatorPlan;
 /** Root-owned durable queue. It never executes code, changes acceptance, or accepts a candidate. */
 export declare class OperatorRuntime {
     readonly profile: RuntimeProfile;
@@ -284,7 +285,7 @@ export declare class OperatorRuntime {
     private nextOnce;
     admitWorker(root: string, actor: string, callID: string, args: unknown): Promise<OperatorTask>;
     private admitWorkerOnce;
-    rejectedAdmission(root: string, callID: string): Promise<void>;
+    rejectedAdmission(root: string, callID: string, reason?: string): Promise<void>;
     rejectDispatch(root: string, callID: string, decision?: string): Promise<void>;
     private rejectDispatchOnce;
     private repairPathProtected;

package/dist/core/operator-runtime.js

@@ -5,7 +5,7 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { acceptanceContinuityFingerprint, inspectAcceptanceContinuity, normalizeAcceptanceCriteria, ACCEPTANCE_CONTINUITY_EXTENSION, MAX_ACCEPTANCE_CONTINUITY_BYTES, MAX_ACCEPTANCE_CRITERIA } from "./acceptance-continuity.js";
 import { expandGoalDeclaration, goalDeclarationDefaults, goalDeclarationFieldDiagnostics, hasGoalCommandAliasConflict } from "./goal-declaration-format.js";
-import { normalizeManifestPath, normalizeRelativePath } from "./path.js";
+import { normalizeExecutionScope, normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "./path.js";
 import { CONTRACT_TEXT_LIMITS, validateHandoffSchema, validateOperationManifestSchema } from "./validate-schema.js";
 import { validateManifest } from "./validate-manifest.js";
 import { profileAgent, RUNTIME_PROFILES } from "./runtime-profile.js";
@@ -44,7 +44,10 @@ const text = (value) => typeof value === "string" && value.trim().length > 0 &&
 export function operatorGitPathAuthorized(path, scopes, platform = process.platform) {
     const key = (value) => platform === "win32" ? value.toLowerCase() : value;
     const candidate = key(path);
-    return scopes.some(scope => candidate === key(scope) || candidate.startsWith(`${key(scope)}/`));
+    return scopes.some(scope => {
+        const base = key(normalizeManifestScope(scope).path);
+        return candidate === base || candidate.startsWith(`${base}/`);
+    });
 }
 const contractError = (diagnostic) => { throw new OperatorContractError([diagnostic]); };
 const planError = (pointer, code, rule, repair_kind = "repair-field") => contractError({ document: "plan", pointer, code, rule, repair_kind });
@@ -80,7 +83,7 @@ function scopePaths(value, limit) {
     };
     return paths.every(normalized) && new Set(paths).size === paths.length;
 }
-export function parseOperatorPlan(value) {
+export function parseOperatorPlan(value, scopeFormat = "repository") {
     if (!record(value) || !exactKeys(value, ["schema_version", "acceptance", "acceptance_proof", "source_refs", "goal_declaration", "units", "git_lifecycle"])) {
         return planError("/", "operator-plan-invalid", "operator-plan-fields");
     }
@@ -204,11 +207,11 @@ export function parseOperatorPlan(value) {
             for (const [pathIndex, name] of unit[field].entries()) {
                 let valid = false;
                 try {
-                    valid = normalizeRelativePath(name) === name;
+                    valid = (scopeFormat === "execution" ? normalizeExecutionScope(name) : normalizeRelativePath(name)) === name;
                 }
                 catch { /* Return only a typed pointer, never the path value. */ }
                 if (!valid)
-                    return planError(`/units/${unitIndex}/${field}/${pathIndex}`, "operator-scope-invalid", "repository-relative-scope");
+                    return planError(`/units/${unitIndex}/${field}/${pathIndex}`, "operator-scope-invalid", scopeFormat === "execution" ? "normalized-execution-scope" : "repository-relative-scope");
             }
         }
         for (const name of unit.write) {
@@ -713,7 +716,7 @@ export class OperatorRuntime {
             }
             immutableReplacement = { ...immutableReplacement, goal_declaration: declaration };
         }
-        const plan = parseOperatorPlan(immutableReplacement);
+        const plan = parseOperatorPlan(immutableReplacement, mission ? "execution" : "repository");
         const validatedPlanHash = hash(JSON.stringify(plan));
         const replanning = mission?.replaceRunID !== undefined;
         if (replanning) {
@@ -834,6 +837,13 @@ export class OperatorRuntime {
         const units = [];
         const controls = [{ path: declarationPath, content: declaration }];
         for (const [index, unit] of plan.units.entries()) {
+            for (const name of unit.write) {
+                const scoped = relative(this.projectRoot, resolve(this.projectRoot, normalizeManifestScope(name).path)).replaceAll("\\", "/");
+                if ([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]
+                    .some(directory => scoped === directory || scoped.startsWith(`${directory}/`))) {
+                    return planError(`/units/${index}/write`, "operator-control-write-forbidden", "control-write-forbidden");
+                }
+            }
             const taskID = `${runID}-${index + 1}`;
             const manifestPath = join(directory, `${taskID}.operation-manifest.json`);
             const manifestRelative = `${this.profile.stateDirectory}/contracts/${taskID}.operation-manifest.json`;
@@ -1229,19 +1239,21 @@ export class OperatorRuntime {
         await this.save(state);
         return admitted;
     }
-    async rejectedAdmission(root, callID) {
-        await this.rejectDispatch(root, callID, "dispatch-admission-rejected");
+    async rejectedAdmission(root, callID, reason) {
+        await this.serial(root, () => this.rejectDispatchOnce(root, callID, "dispatch-admission-rejected", reason));
     }
     rejectDispatch(root, callID, decision = "native-task-rejected") {
         return this.serial(root, () => this.rejectDispatchOnce(root, callID, decision));
     }
-    async rejectDispatchOnce(root, callID, decision) {
+    async rejectDispatchOnce(root, callID, decision, reason) {
         const state = await this.required(root);
         const unit = state.units.find(item => item.callID === callID && item.status === "running");
         if (!unit)
             return;
         unit.status = "failed";
         unit.resultClass = "process-defect";
+        if (reason)
+            unit.dispatchDenial = reason.slice(0, 4000);
         state.phase = "awaiting-decision";
         state.decision = decision;
         await this.save(state);

package/dist/core/path.d.ts

@@ -21,3 +21,12 @@ export declare function normalizeRelativePath(input: string): string;
  * error instead of being resolved away.
  */
 export declare function normalizeManifestPath(input: string): ManifestPath;
+/** A trailing /** (or slash) declares a directory, including one not created yet.
+ * Tool destinations still use normalizeManifestPath: this notation belongs to declarations only.
+ */
+export declare function normalizeManifestScope(input: string): ManifestPath & {
+    readonly directory: boolean;
+};
+export declare function normalizeRelativeScope(input: string): string;
+/** Execution scopes may name native absolute destinations (for example global installs). */
+export declare function normalizeExecutionScope(input: string): string;

package/dist/core/path.js

@@ -52,3 +52,23 @@ export function normalizeManifestPath(input) {
     }
     return { kind: "relative", path: normalizeRelativePath(input) };
 }
+/** A trailing /** (or slash) declares a directory, including one not created yet.
+ * Tool destinations still use normalizeManifestPath: this notation belongs to declarations only.
+ */
+export function normalizeManifestScope(input) {
+    const unified = input.replaceAll("\\", "/");
+    const directory = unified.endsWith("/**") || unified.endsWith("/");
+    const path = unified.endsWith("/**") ? unified.slice(0, -3) : unified;
+    return { ...normalizeManifestPath(path), directory };
+}
+export function normalizeRelativeScope(input) {
+    const scope = normalizeManifestScope(input);
+    if (scope.kind !== "relative")
+        throw new RelativePathError("absolute");
+    return scope.path + (scope.directory ? "/**" : "");
+}
+/** Execution scopes may name native absolute destinations (for example global installs). */
+export function normalizeExecutionScope(input) {
+    const scope = normalizeManifestScope(input);
+    return scope.path + (scope.directory ? "/**" : "");
+}

package/dist/core/validate-manifest.js

@@ -31,7 +31,7 @@ function collectManifestPaths(paths, pointer, diagnostics) {
     paths.forEach((path, index) => {
         let normalized;
         try {
-            normalized = pathUtils.normalizeManifestPath(path);
+            normalized = pathUtils.normalizeManifestScope(path);
         }
         catch (error) {
             if (!(error instanceof pathUtils.RelativePathError))
@@ -48,7 +48,7 @@ function collectManifestPaths(paths, pointer, diagnostics) {
         else if (normalized.kind === "relative") {
             // Absolute manifest targets authorize tools only. Handoff scope/source and Git paths remain
             // repository-relative and therefore never compare equal to an external target.
-            normalizedPaths.add(normalized.path);
+            normalizedPaths.add(normalized.path + (normalized.directory ? "/**" : ""));
         }
     });
     return normalizedPaths;
@@ -79,7 +79,7 @@ function addPathDiagnostics(diagnostics, paths, allowed, code, pointer) {
     const reported = new Set();
     paths.forEach((path, index) => {
         const normalized = normalizePath(path);
-        if (normalized !== undefined && (allowed.has(normalized) || reported.has(normalized)))
+        if (normalized !== undefined && (scopeAllows(allowed, normalized) || reported.has(normalized)))
             return;
         if (normalized !== undefined)
             reported.add(normalized);
@@ -91,6 +91,10 @@ function addPathDiagnostics(diagnostics, paths, allowed, code, pointer) {
         });
     });
 }
+function scopeAllows(scopes, path) {
+    return scopes.has(path) || [...scopes].some(scope => scope.endsWith("/**") &&
+        (path === scope.slice(0, -3) || path.startsWith(scope.slice(0, -2))));
+}
 /** Compare one schema-valid handoff with one schema-valid operation manifest. */
 export function validateManifest(handoff, manifest, changedPaths, changedPathsProvided, options = {}) {
     const diagnostics = [];
@@ -105,7 +109,7 @@ export function validateManifest(handoff, manifest, changedPaths, changedPathsPr
     handoff.sources?.forEach((source, index) => {
         const normalized = normalizePath(source.path);
         if (normalized !== undefined &&
-            (readableOrWritable.has(normalized) || reportedSources.has(normalized)))
+            (scopeAllows(readableOrWritable, normalized) || reportedSources.has(normalized)))
             return;
         if (normalized !== undefined)
             reportedSources.add(normalized);

package/dist/plugin/declared-artifacts.d.ts

@@ -0,0 +1,8 @@
+/** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
+ * previews are bounded independently. Follow package links only inside a declared physical root.
+ */
+export declare function declaredArtifacts(paths: readonly string[], previewLimit?: number): Promise<{
+    entries: (readonly [string, string, (string | undefined)?])[];
+    excerpt: string;
+    truncated: boolean;
+}>;

package/dist/plugin/declared-artifacts.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { lstat, readdir, readlink, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const within = (root, path) => {
+    const rest = relative(root, path);
+    return rest === "" || (rest !== ".." && !rest.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && !isAbsolute(rest));
+};
+/** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
+ * previews are bounded independently. Follow package links only inside a declared physical root.
+ */
+export async function declaredArtifacts(paths, previewLimit = 0) {
+    const roots = [...new Set(paths.map(path => resolve(path)))].sort();
+    const physical = await Promise.all(roots.map(path => realpath(path).catch((error) => {
+        if (error.code === "ENOENT")
+            return path;
+        throw error;
+    })));
+    const entries = [];
+    const excerpts = [];
+    let remaining = previewLimit, truncated = false;
+    const visited = new Set();
+    const visit = async (path, ancestors) => {
+        if (visited.has(path))
+            return;
+        visited.add(path);
+        const label = path.replaceAll("\\", "/");
+        const metadata = await lstat(path).catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (!metadata) {
+            entries.push([label, "missing"]);
+            return;
+        }
+        const canonical = await realpath(path);
+        if (metadata.isSymbolicLink()) {
+            entries.push([label, `symlink:${await readlink(path)}`, canonical]);
+            if (!physical.some(root => within(root, canonical)))
+                throw new Error("declared-artifact-link-outside-scope");
+            if (ancestors.has(canonical))
+                return; // The link identity is recorded; do not traverse cycles.
+            await visit(canonical, ancestors);
+            return;
+        }
+        if (metadata.isDirectory()) {
+            entries.push([label, "directory", canonical]);
+            const next = new Set([...ancestors, canonical]);
+            for (const child of (await readdir(path)).sort())
+                await visit(join(path, child), next);
+            return;
+        }
+        if (!metadata.isFile())
+            throw new Error("declared-artifact-not-file-or-directory");
+        const hash = createHash("sha256");
+        const room = remaining;
+        let preview = Buffer.alloc(0);
+        for await (const part of createReadStream(path)) {
+            const bytes = Buffer.isBuffer(part) ? part : Buffer.from(part);
+            hash.update(bytes);
+            if (preview.length < room)
+                preview = Buffer.concat([preview, bytes.subarray(0, room - preview.length)]);
+        }
+        entries.push([label, `file:${metadata.mode}`, hash.digest("hex")]);
+        if (previewLimit > 0) {
+            if (room) {
+                const excerpt = `\n--- external file: ${label} ---\n${preview.includes(0) ? "[binary artifact: bytes fingerprinted]" : preview.toString("utf8")}`;
+                const bounded = Buffer.from(excerpt).subarray(0, remaining);
+                excerpts.push(bounded.toString("utf8"));
+                remaining -= bounded.length;
+            }
+            if (metadata.size > room || remaining === 0)
+                truncated = true;
+        }
+    };
+    for (const path of roots)
+        await visit(path, new Set());
+    return { entries, excerpt: excerpts.join(""), truncated };
+}

package/dist/plugin/gate.js

@@ -2,7 +2,7 @@ import { execFile } from "node:child_process";
 import { lstat, realpath } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve, win32 } from "node:path";
 import { promisify } from "node:util";
-import { RelativePathError, normalizeManifestPath, normalizeRelativePath } from "../core/path.js";
+import { RelativePathError, normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "../core/path.js";
 import { validateOperationManifestSchema } from "../core/validate-schema.js";
 export class WriteDeniedError extends Error {
     reason;
@@ -144,6 +144,13 @@ function curlOutput(tokens) {
                 return undefined;
             continue;
         }
+        if (token === "-w" || token === "--write-out" || token.startsWith("--write-out=")) {
+            const format = token.startsWith("--write-out=") ? token.slice(12) : tokens[++index];
+            // curl write-out can open additional files or read a format file. Only stdout metadata is pathless.
+            if (format === undefined || format.startsWith("@") || /%output\{/u.test(format))
+                return undefined;
+            continue;
+        }
         if (token === "-o" || token === "--output") {
             const candidate = tokens[++index];
             if (candidate === undefined || candidate.startsWith("-") || output !== undefined)
@@ -259,8 +266,40 @@ function isRemoteGitHubMutation(tokens) {
 function isReadOnlyGitCommand(tokens) {
     const command = tokens[1]?.toLowerCase() ?? "";
     return READ_ONLY_GIT_COMMANDS.has(command) ||
+        (command === "tag" && tokens.length >= 3 && ["--points-at", "--contains", "--list", "-l"].includes(tokens[2]) &&
+            tokens.slice(3).every(token => !token.startsWith("-"))) ||
         (command === "branch" && tokens.length === 3 && tokens[2] === "--show-current");
 }
+function gitArchiveOutput(tokens) {
+    let output, tree = false, paths = false;
+    for (let index = 2; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (token === "--" && tree) {
+            paths = true;
+            continue;
+        }
+        if (paths || !token.startsWith("-")) {
+            tree = true;
+            continue;
+        }
+        if (token === "-o" || token === "--output") {
+            const value = tokens[++index];
+            if (!value || value.startsWith("-") || output !== undefined)
+                return undefined;
+            output = value;
+        }
+        else if (token.startsWith("--output=")) {
+            if (output !== undefined || !token.slice(9))
+                return undefined;
+            output = token.slice(9);
+        }
+        else if (/^--(?:format|prefix)=.+$/u.test(token) || /^-[0-9]$/u.test(token))
+            continue;
+        else
+            return undefined;
+    }
+    return tree ? { output } : undefined;
+}
 function exactGitAddPaths(tokens) {
     if (tokens.length < 4 || tokens[2] !== "--")
         return undefined;
@@ -632,6 +671,18 @@ function shellPaths(command, powershell, depth = 0) {
             else
                 ambiguous = true;
         }
+        else if (executable === "git" && tokens[1] === "archive") {
+            const archive = gitArchiveOutput(tokens);
+            if (archive === undefined) {
+                applies = true;
+                ambiguous = true;
+                issue ??= commandIssue(source, "unsupported-git-archive-form", "use git archive --format=tar --output=<scoped-file> <local-ref>");
+            }
+            else if (archive.output !== undefined) {
+                applies = true;
+                paths.push(archive.output);
+            }
+        }
         else if (executable === "git" && isReadOnlyGitCommand(tokens)) {
             // Explicitly read-only git subcommands.
         }
@@ -677,8 +728,10 @@ function shellPaths(command, powershell, depth = 0) {
         ...(issue ? { issue } : {}),
     };
 }
-function issuePath(issue) {
-    return `segment=${issue.segment}; cause=${issue.cause}; hint=${issue.hint}; retry=false; action=return-denial-to-coordinator`;
+function issuePath(issue, formatCorrection = false) {
+    return `segment=${issue.segment}; cause=${issue.cause}; hint=${issue.hint}; ` + (formatCorrection
+        ? "retry=after-format-correction; action=correct-format-within-current-manifest; preserve operation and destinations; otherwise return exact required correction to Coordinator"
+        : "retry=false; action=return-denial-to-coordinator");
 }
 export function describeUnclassifiedCommand(tool, args) {
     const extracted = extractWritePaths(tool, args);
@@ -925,7 +978,7 @@ function isWithin(root, target) {
 }
 async function canonicalManifestScopes(project, entries) {
     const scopes = await Promise.all(entries.map(async (entry) => {
-        const normalized = normalizeManifestPath(entry);
+        const normalized = normalizeManifestScope(entry);
         const absolute = normalized.kind === "relative"
             ? project.absolute(normalized.path)
             : resolve(normalized.path);
@@ -987,10 +1040,13 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
         }
     }
     const writable = new Set();
+    const explicitDirectories = new Set();
     const externalEntries = [];
     try {
         for (const entry of manifest.write) {
-            const normalized = normalizeManifestPath(entry);
+            const normalized = normalizeManifestScope(entry);
+            if (normalized.directory)
+                explicitDirectories.add(normalized.path);
             if (normalized.kind === "relative")
                 writable.add(normalized.path);
             else {
@@ -1015,7 +1071,7 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             }
         }
         catch (error) {
-            if ((declaredDirectories.has(path) || inferredDirectories.has(path)) &&
+            if ((explicitDirectories.has(path) || declaredDirectories.has(path) || inferredDirectories.has(path)) &&
                 isRecord(error) && error.code === "ENOENT") {
                 writableDirectories.push({ path, realPath: await nearestExistingRealPath(project.absolute(path)) });
             }
@@ -1059,7 +1115,11 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             if (!isRecord(error) || error.code !== "ENOENT") {
                 throw new WriteDeniedError("manifest-unavailable", "<unknown>", { cause: error });
             }
-            externalFiles.push({ path, anchorRealPath: await nearestExistingRealPath(resolve(path, "..")) });
+            if (explicitDirectories.has(path.replaceAll("\\", "/"))) {
+                externalDirectories.push({ path, realPath: await nearestExistingRealPath(path) });
+            }
+            else
+                externalFiles.push({ path, anchorRealPath: await nearestExistingRealPath(resolve(path, "..")) });
         }
     }
     const matchingExternalScopes = (absolute) => ({
@@ -1115,7 +1175,7 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             const absolute = resolve(manifestPath.path);
             if (await project.contains(absolute)) {
                 const normalized = await project.toRelativePath(absolute);
-                if (!await isWritable(normalized))
+                if (!await isWritable(normalized) && !await isExternalWritable(absolute))
                     throw new WriteDeniedError("manifest-scope", normalized);
                 return;
             }
@@ -1192,7 +1252,9 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
                 return;
             if (extracted.ambiguous || (extracted.paths.length === 0 && !extracted.gitCommit)) {
                 if (extracted.issue !== undefined) {
-                    throw new WriteDeniedError("unclassified-command", issuePath(extracted.issue));
+                    const formatCorrection = options?.investigativeShell === true &&
+                        ["unsupported-curl-form", "unsupported-git-archive-form", "unsupported-webrequest-form"].includes(extracted.issue.cause);
+                    throw new WriteDeniedError("unclassified-command", issuePath(extracted.issue, formatCorrection));
                 }
                 throw new WriteDeniedError("path-required", "<missing-path>");
             }
@@ -1208,7 +1270,15 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
                         throw new WriteDeniedError("project-boundary", path, { cause: error });
                     }
                 }
-                await checkPath(nativeFileTool ? resolve(toolDirectory, path) : path);
+                try {
+                    await checkPath(nativeFileTool ? resolve(toolDirectory, path) : path);
+                }
+                catch (error) {
+                    if (options?.investigativeShell && error instanceof WriteDeniedError && error.reason === "manifest-scope") {
+                        error.message += " Coordinator: expand_unit with the exact missing output directory as dir/**, preserving settled units and cumulative spend; then dispatch the returned Task. No user approval is needed for an in-request correction.";
+                    }
+                    throw error;
+                }
             }
             if (extracted.gitCommit)
                 await checkCachedSet();

package/dist/plugin/index.js

@@ -6830,58 +6830,64 @@ export const SortieDogsPlugin = async (input, options) => {
                                     output.args.prompt = canonical;
                                     prompt = canonical;
                                 }
-                                const previous = rootAcceptanceContinuity.get(toolInput.sessionID);
-                                if (previous === undefined) {
-                                    if (ledger.parent_fingerprint !== "none" &&
-                                        !await recoverAcceptanceParent(toolInput.sessionID, ledger, reservedParallelDescriptor)) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
-                                    }
-                                }
-                                else if (previous.task_id === ledger.task_id && previous.fingerprint === ledger.fingerprint) {
-                                    if (ledger.parent_fingerprint !== previous.parent_fingerprint) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
+                                // Mission admission already binds the exact generated Task to its durable run and
+                                // ordered requirements. The legacy session-wide chain is a second, incompatible
+                                // authority across cancelled missions and cold reloads (including later units).
+                                const missionDispatch = await input.runtimeBridge?.ownsMissionDispatch?.(toolInput.sessionID, toolInput.callID, ledger.task_id) === true;
+                                if (!missionDispatch) {
+                                    const previous = rootAcceptanceContinuity.get(toolInput.sessionID);
+                                    if (previous === undefined) {
+                                        if (ledger.parent_fingerprint !== "none" &&
+                                            !await recoverAcceptanceParent(toolInput.sessionID, ledger, reservedParallelDescriptor)) {
+                                            throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                            });
+                                        }
                                     }
-                                }
-                                else {
-                                    const exactCarryForward = ledger.criteria.length === previous.criteria.length &&
-                                        previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
-                                    const strictAppend = ledger.criteria.length > previous.criteria.length &&
-                                        previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
-                                    // Serial parent identity is controller-owned. Repair only an omitted link on
-                                    // an otherwise exact carry-forward/append; explicit conflicting links still fail.
-                                    // Persist it so the worker's Read and later recovery see the same contract.
-                                    if (reservedParallelDescriptor === undefined && ledger.parent_fingerprint === "none" &&
-                                        (exactCarryForward || strictAppend)) {
-                                        const source = await readFile(handoffPaths[0], "utf8");
-                                        const handoff = JSON.parse(source);
-                                        const validated = validateHandoffSchema(handoff);
-                                        const current = validated.ok ? inspectAcceptanceContinuity(validated.value).ledger : undefined;
-                                        if (current === undefined || JSON.stringify(current) !== JSON.stringify(ledger)) {
+                                    else if (previous.task_id === ledger.task_id && previous.fingerprint === ledger.fingerprint) {
+                                        if (ledger.parent_fingerprint !== previous.parent_fingerprint) {
                                             throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
                                                 defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
                                             });
                                         }
-                                        ledger = { ...ledger, parent_fingerprint: previous.fingerprint };
-                                        handoff.ext[ACCEPTANCE_CONTINUITY_EXTENSION] = ledger;
-                                        const repaired = `${JSON.stringify(handoff, null, 2)}\n`;
-                                        await writeFile(handoffPaths[0], repaired);
-                                        try {
-                                            await input.runtimeBridge?.onHostHandoffRepaired?.(toolInput.sessionID, ledger.task_id, handoffPaths[0], source, repaired);
+                                    }
+                                    else {
+                                        const exactCarryForward = ledger.criteria.length === previous.criteria.length &&
+                                            previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
+                                        const strictAppend = ledger.criteria.length > previous.criteria.length &&
+                                            previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
+                                        // Serial parent identity is controller-owned. Repair only an omitted link on
+                                        // an otherwise exact carry-forward/append; explicit conflicting links still fail.
+                                        // Persist it so the worker's Read and later recovery see the same contract.
+                                        if (reservedParallelDescriptor === undefined && ledger.parent_fingerprint === "none" &&
+                                            (exactCarryForward || strictAppend)) {
+                                            const source = await readFile(handoffPaths[0], "utf8");
+                                            const handoff = JSON.parse(source);
+                                            const validated = validateHandoffSchema(handoff);
+                                            const current = validated.ok ? inspectAcceptanceContinuity(validated.value).ledger : undefined;
+                                            if (current === undefined || JSON.stringify(current) !== JSON.stringify(ledger)) {
+                                                throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                    defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                                });
+                                            }
+                                            ledger = { ...ledger, parent_fingerprint: previous.fingerprint };
+                                            handoff.ext[ACCEPTANCE_CONTINUITY_EXTENSION] = ledger;
+                                            const repaired = `${JSON.stringify(handoff, null, 2)}\n`;
+                                            await writeFile(handoffPaths[0], repaired);
+                                            try {
+                                                await input.runtimeBridge?.onHostHandoffRepaired?.(toolInput.sessionID, ledger.task_id, handoffPaths[0], source, repaired);
+                                            }
+                                            catch (error) {
+                                                await writeFile(handoffPaths[0], source);
+                                                throw error;
+                                            }
+                                            await inspect(handoffPaths[0], undefined, { report: true });
                                         }
-                                        catch (error) {
-                                            await writeFile(handoffPaths[0], source);
-                                            throw error;
+                                        if (ledger.parent_fingerprint !== previous.fingerprint || (!exactCarryForward && !strictAppend)) {
+                                            throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                            });
                                         }
-                                        await inspect(handoffPaths[0], undefined, { report: true });
-                                    }
-                                    if (ledger.parent_fingerprint !== previous.fingerprint || (!exactCarryForward && !strictAppend)) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
                                     }
                                 }
                                 validatedRootAcceptance = ledger;
@@ -7760,7 +7766,10 @@ export const SortieDogsPlugin = async (input, options) => {
                 return null;
             const reserved = state.outstanding_reservations.length;
             return { max_units: state.budget.max_units, consumed_units: state.consumed_units,
-                reserved_units: reserved, remaining_units: Math.max(0, state.budget.max_units - state.consumed_units - reserved) };
+                reserved_units: reserved, remaining_units: Math.max(0, state.budget.max_units - state.consumed_units - reserved),
+                settled_cost_usd: state.consumed_cost_usd, cost_limit_usd: state.budget.cost_usd,
+                cost_status: state.consumed_cost_usd === null ? "unknown-usage" : reserved > 0 ? "in-flight-not-final" : "settled",
+                cost_note: "Goal Worker ledger only; excludes unfinalized native requests, orchestration/review and external campaign spend. Zero settled cost does not mean free execution." };
         },
         registerGoalDeclaration: async (root, prompt, missionRevision) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))

package/dist/plugin/mission-review.js

@@ -2,12 +2,14 @@ import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { lstat, readlink } from "node:fs/promises";
-import { resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import { TOOL_ENVIRONMENT } from "../runtime-mission-assets.js";
 import { MISSION_REVIEW_REFERENCE } from "../core/operator-mission.js";
 import { canonicalAgent } from "../core/runtime-profile.js";
 import { taskChildSessionID } from "./task-result-repair.js";
+import { normalizeManifestScope } from "../core/path.js";
+import { declaredArtifacts } from "./declared-artifacts.js";
 const exec = promisify(execFile);
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 /** Recover from native completion records, never from the pending review's inherited child ID. */
@@ -75,21 +77,29 @@ export async function completedMissionReviewPrompts(mission, profile, root, requ
 /** Pin all scoped tracked/untracked source bytes, including deletions; display a bounded excerpt only. */
 export async function missionReviewSource(directory, run) {
     const hash = createHash("sha256").update(JSON.stringify(run.units.map(unit => ({ unit: unit.unit, hashes: unit.hashes }))));
-    const writes = [...new Set(run.units.flatMap(unit => unit.unit.write))];
+    const writes = [...new Set(run.units.flatMap(unit => unit.unit.write).map(path => path === "." ? path : normalizeManifestScope(path).path))];
     if (writes.length === 0)
         return { fingerprint: `sha256:${hash.digest("hex")}`,
             excerpt: "[Read-only units: no declared output files. Review the supplied observations, traces and validation evidence.]" };
     // The shared dependency environment is local tooling, never reviewed or pinned source.
-    const scopes = [...writes, `:(exclude)${TOOL_ENVIRONMENT}`];
+    const external = [], local = [];
+    for (const path of writes) {
+        const scoped = relative(directory, resolve(directory, path)).replaceAll("\\", "/");
+        if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
+            external.push(resolve(path));
+        else
+            local.push(scoped || ".");
+    }
+    const scopes = [...local, `:(exclude)${TOOL_ENVIRONMENT}`];
     const git = async (args) => (await exec("git", args, { cwd: directory, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    const names = await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]);
-    const untracked = new Set((await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes])).split("\0").filter(Boolean));
+    const names = local.length ? await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]) : "";
+    const untracked = new Set((local.length ? await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes]) : "").split("\0").filter(Boolean));
     // Explicitly declared outputs are review evidence even when gitignored (for example a probe
     // JSON in _testenv). Their bytes must participate in staleness checks as well as the excerpt.
-    const ignored = await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]);
+    const ignored = local.length ? await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]) : "";
     for (const path of ignored.split("\0").filter(Boolean))
         untracked.add(path);
-    let excerpt = await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...scopes]).catch(() => git(["diff", "--no-ext-diff", "--no-textconv", "--", ...scopes]));
+    let excerpt = local.length ? await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...scopes]).catch(() => git(["diff", "--no-ext-diff", "--no-textconv", "--", ...scopes])) : "";
     const unchanged = excerpt.length === 0;
     const paths = [...new Set([...names.split("\0"), ...ignored.split("\0")].filter(Boolean))].sort();
     const omitted = [];
@@ -128,6 +138,13 @@ export async function missionReviewSource(directory, run) {
             hash.update("deleted");
         }
     }
+    if (external.length) {
+        const artifacts = await declaredArtifacts(external, Math.max(1, 24_000 - Buffer.byteLength(excerpt)));
+        hash.update(JSON.stringify(artifacts.entries));
+        excerpt += artifacts.excerpt;
+        if (artifacts.truncated)
+            omitted.push("external artifacts");
+    }
     const bytes = Buffer.from(excerpt);
     return { fingerprint: `sha256:${hash.digest("hex")}`, excerpt: (bytes.length > 24_000 ? bytes.subarray(0, 24_000).toString("utf8") : excerpt) +
             (bytes.length > 24_000 || omitted.length ? `\n[EXCERPT TRUNCATED: ${omitted.slice(0, 20).join(", ")}; supply focused traces for missing sections, not another implementation unit]` : "") };

package/dist/plugin/profiled.js

@@ -323,10 +323,11 @@ export function createProfiledPlugin(profile, assetVersion) {
             continuationCheckpoint: async (root) => {
                 const mission = await missions.read(root);
                 const run = await operators.read(root);
-                // Cancellation after settled work remains an unfinished accepted goal. Keep its spend and
-                // evidence bound through a real user restart; the cancelled packet grants no dispatch itself.
+                // Cancellation never refunds admitted work. Keep the ledger even when the last Worker
+                // was interrupted before validation; acceptance supersession is decided by mission planning,
+                // not by resetting the goal budget. This checkpoint grants no dispatch itself.
                 if (mission && (!["completed", "cancelled"].includes(mission.phase) ||
-                    (mission.phase === "cancelled" && run && cancelledMissionRetainsAcceptance(run)))) {
+                    (mission.phase === "cancelled" && run))) {
                     return JSON.stringify(missionPacket(mission, run));
                 }
                 return await operators.continuationCheckpoint(root) ?? await proposals.continuationCheckpoint(root);
@@ -351,6 +352,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                 return active && unit.childSessionID === child &&
                     unit.unit.validation.some(candidate => normalizeCommand(candidate) === command);
             },
+            ownsMissionDispatch: async (root, callID, taskID) => {
+                const owner = taskOwners.get(callID);
+                if (owner?.root !== root || owner.operator)
+                    return false;
+                const mission = await missions.read(root), state = await operators.read(root);
+                return mission !== undefined && state !== undefined && mission.runID === state.runID &&
+                    mission.phase === "running" && state.phase === "running" &&
+                    state.units.some(unit => unit.status === "running" && unit.callID === callID &&
+                        /^task_id: (.+)$/m.exec(unit.task.prompt)?.[1] === taskID);
+            },
             allowsInvestigativeShell: async (child) => {
                 const root = await rootFor(child);
                 if (!root)
@@ -466,7 +477,8 @@ export function createProfiledPlugin(profile, assetVersion) {
             if (!mission.dispatchOpen && (["open", "running"].includes(mission.phase) ||
                 (mission.phase === "submitted" && mission.submission?.status !== "ready"))) {
                 return { ...packet, task: missions.task(mission),
-                    next_action: "The previous Coordinator Task is finished. Dispatch this exact Task to continue the same mission and Coordinator session; keep the original requirements and cumulative budget." };
+                    next_action: (run?.units.some(unit => unit.dispatchDenial) ? `${packet.next_action}\n` : "") +
+                        "The previous Coordinator Task is finished. Dispatch this exact Task to continue the same mission and Coordinator session; keep the original requirements and cumulative budget." };
             }
             return packet;
         }
@@ -1264,7 +1276,6 @@ export function createProfiledPlugin(profile, assetVersion) {
             const dispatcher = actor === root ? undefined : { sessionID: actor, callID: mission.callID };
             const state = replanning ? await operators.replanMission(root, previous.runID, plan, dispatcher)
                 : await operators.prepareMission(root, plan, dispatcher, mission.supersededRunID, terminalChildren);
-            await restorePriorAcceptance(root, state);
             await control.registerGoalDeclaration(root, state.units[0].task.prompt, true);
             control.enableUnits(root, state.units.filter(unit => unit.status === "pending").length);
             await missions.update(root, item => {
@@ -1277,7 +1288,7 @@ export function createProfiledPlugin(profile, assetVersion) {
             });
             return JSON.stringify(await operators.next(root, actor));
         }
-        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Use write: [] for read-only verification; do not invent a write path. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here. Rejected budget, contract or control-storage preparation preserves the existing run so you can correct the plan directly.",
+        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Use write: [] for read-only verification; use dir/** for directory outputs including not-yet-created trees. Native absolute paths support global installs and external outputs under host permissions; include their actual paths in read/write for evidence. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here. Rejected budget, contract or control-storage preparation preserves the existing run so you can correct the plan directly.",
             args: { units: { type: "array", minItems: 1, maxItems: 32, items: { type: "object", additionalProperties: false,
                         properties: { title: { type: "string" }, objective: { type: "string" }, read: stringList, write: stringList,
                             validation: stringList, requirement_ids: stringList }, required: ["title", "objective", "write", "validation"] } },
@@ -1780,7 +1791,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                 if (delegated) {
                     if (!mission || mission.runID !== state.runID)
                         await proposals.assertExecutionApproved(root, state.planHash);
-                    await restorePriorAcceptance(root, state);
+                    if (!mission || mission.runID !== state.runID)
+                        await restorePriorAcceptance(root, state);
                     expandedWorker = await operators.admitWorker(root, request.sessionID, request.callID, args);
                     taskOwners.set(request.callID, { root, actor: request.sessionID, operator: false });
                 }
@@ -1847,7 +1859,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 catch (error) {
                     if (delegated) {
                         taskOwners.delete(request.callID);
-                        await operators.rejectedAdmission(root, request.callID);
+                        await operators.rejectedAdmission(root, request.callID, error instanceof Error ? error.message : String(error));
                     }
                     throw error;
                 }

package/dist/plugin/protected-snapshot.js

@@ -2,8 +2,9 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { goalFingerprint } from "../core/goal-bound.js";
-import { normalizeManifestPath } from "../core/path.js";
+import { normalizeManifestScope } from "../core/path.js";
 import { RUNTIME_PROFILES } from "../core/runtime-profile.js";
+import { declaredArtifacts } from "./declared-artifacts.js";
 const controlRoots = new Set([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]);
 /** Live orchestration/Git bookkeeping is readable context, not the source being validated. */
 export function isRuntimeControlPath(path) {
@@ -57,6 +58,19 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             return undefined;
     return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
 }
+function outside(projectRoot, path) {
+    const scoped = relative(projectRoot, path).replaceAll("\\", "/");
+    return scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped);
+}
+async function declaredScopeDigest(projectRoot, paths, manifestHash, source) {
+    const local = paths.filter(path => !outside(projectRoot, path));
+    const external = paths.filter(path => outside(projectRoot, path));
+    const project = await protectedScopeDigest(projectRoot, local, manifestHash, source ? "project-files-v1" : undefined);
+    if (project === undefined)
+        return undefined;
+    const artifacts = await declaredArtifacts(external).catch(() => undefined);
+    return artifacts && goalFingerprint({ project, external: artifacts.entries });
+}
 export async function protectedSnapshot(authorization) {
     const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
     if (manifestSource === undefined)
@@ -67,20 +81,23 @@ export async function protectedSnapshot(authorization) {
     const relativePath = relative(authorization.projectRoot, authorization.manifestPath).replaceAll("\\", "/");
     const manifest = JSON.parse(manifestSource.toString("utf8"));
     const actualPaths = (entries) => entries.map((entry) => {
-        const path = normalizeManifestPath(entry);
+        const path = normalizeManifestScope(entry);
         return path.kind === "relative" ? resolve(authorization.projectRoot, path.path) : resolve(path.path);
     });
     const candidatePaths = actualPaths(manifest.write);
     const sourcePaths = [...new Set([...actualPaths(manifest.read), ...candidatePaths])];
-    const source = await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, "project-files-v1");
+    const external = sourcePaths.some(path => outside(authorization.projectRoot, path));
+    const source = external ? await declaredScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, true)
+        : await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, "project-files-v1");
     // Explicit outputs and the exact operation manifest remain pinned, including control-like paths.
-    const candidate = await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
+    const candidate = external ? await declaredScopeDigest(authorization.projectRoot, candidatePaths, manifestHash, false)
+        : await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
     if (source === undefined || candidate === undefined || relativePath.startsWith("../") || isAbsolute(relativePath))
         return undefined;
     return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
-            manifest_path: relativePath, source_policy: "project-files-v1",
-            source_paths: sourcePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")),
-            candidate_paths: candidatePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")) }, source, candidate };
+            manifest_path: relativePath, source_policy: external ? "declared-paths-v1" : "project-files-v1",
+            source_paths: sourcePaths.map(path => (outside(authorization.projectRoot, path) ? path : relative(authorization.projectRoot, path)).replaceAll("\\", "/")),
+            candidate_paths: candidatePaths.map(path => (outside(authorization.projectRoot, path) ? path : relative(authorization.projectRoot, path)).replaceAll("\\", "/")) }, source, candidate };
 }
 export async function refreshProtectedSnapshot(projectRoot, binding) {
     const manifestSource = await readFile(resolve(projectRoot, binding.manifest_path)).catch(() => undefined);
@@ -89,6 +106,11 @@ export async function refreshProtectedSnapshot(projectRoot, binding) {
     const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
     if (`sha256:${manifestHash}` !== binding.manifest_hash)
         return undefined;
+    if (binding.source_policy === "declared-paths-v1") {
+        const source = await declaredScopeDigest(projectRoot, binding.source_paths.map(path => resolve(projectRoot, path)), manifestHash, true);
+        const candidate = await declaredScopeDigest(projectRoot, binding.candidate_paths.map(path => resolve(projectRoot, path)), manifestHash, false);
+        return source === undefined || candidate === undefined ? undefined : { source, candidate };
+    }
     // Legacy evidence retains its original recipe; a new policy cannot relabel stale proof as fresh.
     if (binding.source_policy !== undefined && binding.source_policy !== "project-files-v1")
         return undefined;

package/dist/plugin/runtime-bridge.d.ts

@@ -29,6 +29,8 @@ export interface RuntimeBridge {
     completedReviewPrompts?(rootSessionID: string, requestedPrompt: string): Promise<readonly string[]>;
     requiresExplicitAcceptance?(rootSessionID: string): Promise<boolean>;
     ownsCanonicalValidation?(rootSessionID: string, unitID: string, childSessionID: string, command: string): Promise<boolean>;
+    /** A mission's hash-pinned Task has already passed durable run/acceptance admission. */
+    ownsMissionDispatch?(rootSessionID: string, callID: string, taskID: string): Promise<boolean>;
     onHostHandoffRepaired?(rootSessionID: string, taskID: string, handoffPath: string, original: string, repaired: string): Promise<void>;
     allowsInvestigativeShell?(sessionID: string): Promise<boolean>;
     onSerialSettlement?(settlement: SerialDispatchSettlement): Promise<void>;

package/dist/plugin/v2.js

@@ -3,10 +3,17 @@ import { bindMissionProgress } from "./mission-progress.js";
 import { owningServiceSessionList } from "./v2-session-history.js";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 // Capture once when this module evaluates. A later package replacement must not make an old
 // process report the replacement's bytes as its loaded adapter.
 const loadedAdapter = Object.freeze({ adapter_url: import.meta.url,
     adapter_sha256: createHash("sha256").update(readFileSync(new URL(import.meta.url))).digest("hex"),
+    runtime_asset_version: V010_RUNTIME_ASSET_VERSION,
+    // Named module snapshots, not a claim to identify every transitive dependency. Retain these
+    // bytes across package replacement so an unchanged adapter cannot conceal an old implementation.
+    implementation_sha256: Object.freeze(Object.fromEntries([
+        "index", "profiled", "gate", "protected-snapshot", "declared-artifacts",
+    ].map(name => [`${name}.js`, createHash("sha256").update(readFileSync(new URL(`./${name}.${import.meta.url.endsWith(".ts") ? "ts" : "js"}`, import.meta.url))).digest("hex")]))),
     loaded_at: new Date().toISOString(), pid: process.pid });
 const childSelectionKey = (id) => `v2-child-model-selection:${id}`;
 function record(value) {

package/dist/runtime-mission-assets.js

@@ -3,6 +3,17 @@ import { STRATEGY_TRIGGERS, SOURCE_REVIEW_RISK_TAGS } from "./core/consultation.
 import { SCOUT_EVIDENCE_CODES } from "./core/scout-contract.js";
 /** Repository-local dependency environment shared by all units; excluded from reviewed and captured source. */
 export const TOOL_ENVIRONMENT = ".sortie-env";
+const OPERATION_GUIDE = `## Practical operation guide
+
+Use file paths for exact outputs and dir/** for a directory tree, including a directory that does not
+exist yet. The host interprets dir/** consistently for writes, validation fingerprints and review.
+Create the directory with mkdir -p dir; do not add parent directories merely to make child writes work.
+For local source snapshots use git archive --format=tar --output=dir/source.tar <local-ref>.
+For tag observation use git tag --points-at <commit>. For HTTPS downloads use curl -fLsS -o dir/file <url>;
+--write-out '%{http_code} %{size_download}\\n' may print metadata to stdout. Declare all actual outputs.
+Reuse pinned artifacts and successful checks when the request permits and the inputs are unchanged.
+Do not repeat candidate discovery, dependency setup or validation merely because a Worker changed.
+`;
 function controls(profile, names) {
     return names.map(name => `  ${profile.toolPrefix}${name}: true`).join("\n");
 }
@@ -62,6 +73,10 @@ Ordinary defects return to Coordinator, not the user. Ask through question only
 an extension beyond the original requirements, or a cumulative budget increase. Resume the same work after
 the answer. Do not reset spend, silently shrink acceptance, or create substitute goals.
 
+When bounded process reflections are injected, pass the relevant prevention in Coordinator feedback while
+preserving the original requirements. After a resolved repeated process failure, record its verified cause/prevention
+through reflection if enabled; retain concrete evidence and prefer a durable fix for recurring causes.
+
 Retain 🐾 Sortie presentation and measured return panels. Append complete_mission's return_report verbatim
 once. Do not invent scores, medals, costs, savings, models or successful checks. Release/publish requires the
 existing user authorization and project gates; npm publication remains manual.
@@ -99,6 +114,10 @@ Investigate only enough to start the first useful Worker. Prefer a targeted read
 inventory or speculative full design. Call ${profile.toolPrefix}plan_units with concise units:
 title, objective, read/write file or directory scopes, validation commands, optionally requirement_ids.
 For read-only verification, use write: []; do not invent an output file or request write access to inputs.
+Use absolute native paths for requested global installations or other external outputs; dir/** declares
+a directory including a not-yet-created tree. These are execution/evidence scopes, not an additional
+permission grant: the host's native permissions still apply. Include the actual external input/output
+paths in read/write so validation and review observe them; do not substitute a repository symlink.
 Keep all original requirements covered; omitted requirement_ids means all. Last validation command proves
 that unit. If your quick check shows repository-declared dependencies or the test runner are missing, keep
 setup inside the first unit: declare its checks through the repository-local tool environment ${TOOL_ENVIRONMENT}/
@@ -114,10 +133,14 @@ check or reviewer finding, call plan_units with the corrected units and a short
 preserves every requirement, failed-check history and cumulative budget. Never replace an active Worker.
 Rejected budget/contract checks or control-storage preparation leave the old run available. Correct the
 reported cause and call plan_units again; a local plan repair needs no cancellation or user approval.
+On a returned denial, correct the exact command form or output scope before redispatch; reuse established
+candidate identity, setup and evidence in the next objective instead of requesting the entire investigation again.
 Workers freely investigate within their unit and execute exact formal checks for host recording. Do not
 require them to predeclare exploratory commands. Require meaningful evidence, not extra testing for its
 own sake. Do not repeat passed checks unless source changes or unresolved concerns justify it.
 
+${OPERATION_GUIDE}
+
 Scout is optional for one precise missing fact. Its prompt includes missing_evidence_code:
 ${SCOUT_EVIDENCE_CODES.join(" | ")}, an exact project_root and at most four known_paths.
 Advisor is optional for one material decision; include strategy_trigger: ${STRATEGY_TRIGGERS.join(" | ")}.
@@ -183,7 +206,13 @@ are complete. Never fabricate logs, costs or exits. Do not stage outside declare
 publish, or take over Coordinator decisions. The parent releases your write binding after return.
 
 A local tool/permission/handoff defect returns PROCESS_DEFECT: local: <condition> and its exact diagnostic
-once to Coordinator. Do not repeat the same refused operation. Only a proven external dependency or
+once to Coordinator when its remedy requires a changed contract. If the host explicitly returns
+action=correct-format-within-current-manifest, correct the supported command form in this same Task,
+preserving the operation, inputs and destinations, then continue. An unchanged denied request is not a correction.
+If correcting the form changes the intended operation or requires another output, return the exact required
+correction to Coordinator. Do not repeat the same refused operation. Only a proven external dependency or
 user-only choice uses TRUE_BLOCKER: external: <condition> or TRUE_BLOCKER: user-decision: <condition>.
+
+${OPERATION_GUIDE}
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.10",
+  "version": "0.12.12",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",