sortie-dogs 0.12.11 → 0.12.12

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.11-operation-recovery-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.12-mission-lineage-external-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.11-operation-recovery-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.12-mission-lineage-external-v1";

package/dist/core/goal-bound.d.ts

@@ -38,7 +38,7 @@ export interface GoalEvidence {
         readonly source_paths: readonly string[];
         readonly candidate_paths: readonly string[];
         /** Missing on legacy evidence: retain its original all-paths snapshot recipe. */
-        readonly source_policy?: "project-files-v1";
+        readonly source_policy?: "project-files-v1" | "declared-paths-v1";
     };
     readonly execution: {
         readonly command: readonly string[];

package/dist/core/goal-bound.js

@@ -62,7 +62,8 @@ export function validGoalEvidence(value, state) {
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
         protectedBinding.candidate_paths.every(text) &&
-        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1");
+        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1" ||
+            protectedBinding.source_policy === "declared-paths-v1");
     const matches = criteria.length > 0 && criteria.length === value.measurement.criterion_ids.length &&
         criteria.every((criterion) => criterion.target === value.measurement.target &&
             criterion.entrypoint === value.measurement.entrypoint && criterion.workload === value.measurement.workload &&

package/dist/core/operator-mission.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { normalizeRelativeScope } from "./path.js";
+import { normalizeExecutionScope } from "./path.js";
 import { parseOperatorPlan } from "./operator-runtime.js";
 import { profileAgent } from "./runtime-profile.js";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
@@ -286,7 +286,7 @@ export function missionPlan(mission, raw) {
             const entries = value[field] ?? [];
             if (!Array.isArray(entries) || !entries.every(item => typeof item === "string"))
                 throw new Error(`mission-unit-${index + 1}: ${field} must be paths`);
-            return [...new Set(entries.map(item => normalizeRelativeScope(item)))];
+            return [...new Set(entries.map(item => normalizeExecutionScope(item)))];
         };
         const ids = value.requirement_ids ?? mission.requirements.map(item => item.id);
         if (!Array.isArray(ids) || ids.length === 0 || !ids.every(id => mission.requirements.some(item => item.id === id))) {
@@ -328,7 +328,7 @@ export function missionPlan(mission, raw) {
             // Keep all detailed instructions in the handoff, not in a 512-character wire label.
             criteria: units.map(unit => ({ criterion_id: unit.id, target: unit.title.slice(0, 512),
                 entrypoint: (unit.write[0] ?? unit.read[0] ?? unit.id).slice(0, 512), validation_command: unit.validation.at(-1) })) },
-        units });
+        units }, "execution");
 }
 export function missionPacket(mission, run) {
     const currentReview = mission.review !== undefined && mission.review.runID === (run?.runID ?? mission.runID);
@@ -350,11 +350,14 @@ export function missionPacket(mission, run) {
             passed: currentReview && mission.review.verdict === "PASS", permits_submission: reviewAccepted } : null,
         ...(run ? { run_id: run.runID, status: run.phase, decision: run.decision,
             units: run.units.map(unit => ({ id: unit.unit.id, title: unit.unit.title, status: unit.status,
-                child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence })) } : {}),
+                child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence,
+                ...(unit.dispatchDenial ? { dispatch_denial: unit.dispatchDenial } : {}) })) } : {}),
         next_action: mission.phase === "completed" ? "Mission completed. Report the accepted result and retained review gaps; no further dispatch or completion call is needed."
             : mission.phase === "submitted" && mission.submission?.status === "ready"
                 ? "Operator: compare the submitted candidate with the original requirements and actual evidence, then complete_mission if satisfied. Report remaining evidence gaps; they are not a review PASS."
-                : run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
+                : run?.phase === "awaiting-decision" ? (run.units.some(unit => unit.dispatchDenial)
+                    ? "Coordinator: inspect units[].dispatch_denial before changing the plan. Correct only its diagnosed cause; do not repeat an unchanged refused Task or replan for a host-state mismatch. Report an unresolved runtime mismatch with the loaded runtime identity; preserve requirements and cumulative spend."
+                    : "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative.")
                     : run?.phase === "awaiting-acceptance" ? (currentReview && mission.review?.verdict === "evidence-gaps" && !reviewAccepted
                         ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
                         : reviewAccepted

package/dist/core/operator-runtime.d.ts

@@ -115,6 +115,7 @@ interface UnitState {
     childSessionID: string | null;
     evidence: readonly GoalEvidence[];
     resultClass: string | null;
+    dispatchDenial?: string;
     repairValidationAttempts: number;
     repairValidation: {
         readonly repair_fingerprint: string;
@@ -210,7 +211,7 @@ export interface OperatorState {
 /** A later mission may replace an unexecuted cancellation, but must retain settled work's acceptance. */
 export declare function cancelledMissionRetainsAcceptance(state: OperatorState): boolean;
 export declare function operatorGitPathAuthorized(path: string, scopes: readonly string[], platform?: NodeJS.Platform): boolean;
-export declare function parseOperatorPlan(value: unknown): OperatorPlan;
+export declare function parseOperatorPlan(value: unknown, scopeFormat?: "repository" | "execution"): OperatorPlan;
 /** Root-owned durable queue. It never executes code, changes acceptance, or accepts a candidate. */
 export declare class OperatorRuntime {
     readonly profile: RuntimeProfile;
@@ -284,7 +285,7 @@ export declare class OperatorRuntime {
     private nextOnce;
     admitWorker(root: string, actor: string, callID: string, args: unknown): Promise<OperatorTask>;
     private admitWorkerOnce;
-    rejectedAdmission(root: string, callID: string): Promise<void>;
+    rejectedAdmission(root: string, callID: string, reason?: string): Promise<void>;
     rejectDispatch(root: string, callID: string, decision?: string): Promise<void>;
     private rejectDispatchOnce;
     private repairPathProtected;

package/dist/core/operator-runtime.js

@@ -5,7 +5,7 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { acceptanceContinuityFingerprint, inspectAcceptanceContinuity, normalizeAcceptanceCriteria, ACCEPTANCE_CONTINUITY_EXTENSION, MAX_ACCEPTANCE_CONTINUITY_BYTES, MAX_ACCEPTANCE_CRITERIA } from "./acceptance-continuity.js";
 import { expandGoalDeclaration, goalDeclarationDefaults, goalDeclarationFieldDiagnostics, hasGoalCommandAliasConflict } from "./goal-declaration-format.js";
-import { normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "./path.js";
+import { normalizeExecutionScope, normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "./path.js";
 import { CONTRACT_TEXT_LIMITS, validateHandoffSchema, validateOperationManifestSchema } from "./validate-schema.js";
 import { validateManifest } from "./validate-manifest.js";
 import { profileAgent, RUNTIME_PROFILES } from "./runtime-profile.js";
@@ -83,7 +83,7 @@ function scopePaths(value, limit) {
     };
     return paths.every(normalized) && new Set(paths).size === paths.length;
 }
-export function parseOperatorPlan(value) {
+export function parseOperatorPlan(value, scopeFormat = "repository") {
     if (!record(value) || !exactKeys(value, ["schema_version", "acceptance", "acceptance_proof", "source_refs", "goal_declaration", "units", "git_lifecycle"])) {
         return planError("/", "operator-plan-invalid", "operator-plan-fields");
     }
@@ -207,11 +207,11 @@ export function parseOperatorPlan(value) {
             for (const [pathIndex, name] of unit[field].entries()) {
                 let valid = false;
                 try {
-                    valid = normalizeRelativePath(name) === name;
+                    valid = (scopeFormat === "execution" ? normalizeExecutionScope(name) : normalizeRelativePath(name)) === name;
                 }
                 catch { /* Return only a typed pointer, never the path value. */ }
                 if (!valid)
-                    return planError(`/units/${unitIndex}/${field}/${pathIndex}`, "operator-scope-invalid", "repository-relative-scope");
+                    return planError(`/units/${unitIndex}/${field}/${pathIndex}`, "operator-scope-invalid", scopeFormat === "execution" ? "normalized-execution-scope" : "repository-relative-scope");
             }
         }
         for (const name of unit.write) {
@@ -716,7 +716,7 @@ export class OperatorRuntime {
             }
             immutableReplacement = { ...immutableReplacement, goal_declaration: declaration };
         }
-        const plan = parseOperatorPlan(immutableReplacement);
+        const plan = parseOperatorPlan(immutableReplacement, mission ? "execution" : "repository");
         const validatedPlanHash = hash(JSON.stringify(plan));
         const replanning = mission?.replaceRunID !== undefined;
         if (replanning) {
@@ -837,6 +837,13 @@ export class OperatorRuntime {
         const units = [];
         const controls = [{ path: declarationPath, content: declaration }];
         for (const [index, unit] of plan.units.entries()) {
+            for (const name of unit.write) {
+                const scoped = relative(this.projectRoot, resolve(this.projectRoot, normalizeManifestScope(name).path)).replaceAll("\\", "/");
+                if ([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]
+                    .some(directory => scoped === directory || scoped.startsWith(`${directory}/`))) {
+                    return planError(`/units/${index}/write`, "operator-control-write-forbidden", "control-write-forbidden");
+                }
+            }
             const taskID = `${runID}-${index + 1}`;
             const manifestPath = join(directory, `${taskID}.operation-manifest.json`);
             const manifestRelative = `${this.profile.stateDirectory}/contracts/${taskID}.operation-manifest.json`;
@@ -1232,19 +1239,21 @@ export class OperatorRuntime {
         await this.save(state);
         return admitted;
     }
-    async rejectedAdmission(root, callID) {
-        await this.rejectDispatch(root, callID, "dispatch-admission-rejected");
+    async rejectedAdmission(root, callID, reason) {
+        await this.serial(root, () => this.rejectDispatchOnce(root, callID, "dispatch-admission-rejected", reason));
     }
     rejectDispatch(root, callID, decision = "native-task-rejected") {
         return this.serial(root, () => this.rejectDispatchOnce(root, callID, decision));
     }
-    async rejectDispatchOnce(root, callID, decision) {
+    async rejectDispatchOnce(root, callID, decision, reason) {
         const state = await this.required(root);
         const unit = state.units.find(item => item.callID === callID && item.status === "running");
         if (!unit)
             return;
         unit.status = "failed";
         unit.resultClass = "process-defect";
+        if (reason)
+            unit.dispatchDenial = reason.slice(0, 4000);
         state.phase = "awaiting-decision";
         state.decision = decision;
         await this.save(state);

package/dist/core/path.d.ts

@@ -28,3 +28,5 @@ export declare function normalizeManifestScope(input: string): ManifestPath & {
     readonly directory: boolean;
 };
 export declare function normalizeRelativeScope(input: string): string;
+/** Execution scopes may name native absolute destinations (for example global installs). */
+export declare function normalizeExecutionScope(input: string): string;

package/dist/core/path.js

@@ -67,3 +67,8 @@ export function normalizeRelativeScope(input) {
         throw new RelativePathError("absolute");
     return scope.path + (scope.directory ? "/**" : "");
 }
+/** Execution scopes may name native absolute destinations (for example global installs). */
+export function normalizeExecutionScope(input) {
+    const scope = normalizeManifestScope(input);
+    return scope.path + (scope.directory ? "/**" : "");
+}

package/dist/plugin/declared-artifacts.d.ts

@@ -0,0 +1,8 @@
+/** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
+ * previews are bounded independently. Follow package links only inside a declared physical root.
+ */
+export declare function declaredArtifacts(paths: readonly string[], previewLimit?: number): Promise<{
+    entries: (readonly [string, string, (string | undefined)?])[];
+    excerpt: string;
+    truncated: boolean;
+}>;

package/dist/plugin/declared-artifacts.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { lstat, readdir, readlink, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const within = (root, path) => {
+    const rest = relative(root, path);
+    return rest === "" || (rest !== ".." && !rest.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && !isAbsolute(rest));
+};
+/** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
+ * previews are bounded independently. Follow package links only inside a declared physical root.
+ */
+export async function declaredArtifacts(paths, previewLimit = 0) {
+    const roots = [...new Set(paths.map(path => resolve(path)))].sort();
+    const physical = await Promise.all(roots.map(path => realpath(path).catch((error) => {
+        if (error.code === "ENOENT")
+            return path;
+        throw error;
+    })));
+    const entries = [];
+    const excerpts = [];
+    let remaining = previewLimit, truncated = false;
+    const visited = new Set();
+    const visit = async (path, ancestors) => {
+        if (visited.has(path))
+            return;
+        visited.add(path);
+        const label = path.replaceAll("\\", "/");
+        const metadata = await lstat(path).catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (!metadata) {
+            entries.push([label, "missing"]);
+            return;
+        }
+        const canonical = await realpath(path);
+        if (metadata.isSymbolicLink()) {
+            entries.push([label, `symlink:${await readlink(path)}`, canonical]);
+            if (!physical.some(root => within(root, canonical)))
+                throw new Error("declared-artifact-link-outside-scope");
+            if (ancestors.has(canonical))
+                return; // The link identity is recorded; do not traverse cycles.
+            await visit(canonical, ancestors);
+            return;
+        }
+        if (metadata.isDirectory()) {
+            entries.push([label, "directory", canonical]);
+            const next = new Set([...ancestors, canonical]);
+            for (const child of (await readdir(path)).sort())
+                await visit(join(path, child), next);
+            return;
+        }
+        if (!metadata.isFile())
+            throw new Error("declared-artifact-not-file-or-directory");
+        const hash = createHash("sha256");
+        const room = remaining;
+        let preview = Buffer.alloc(0);
+        for await (const part of createReadStream(path)) {
+            const bytes = Buffer.isBuffer(part) ? part : Buffer.from(part);
+            hash.update(bytes);
+            if (preview.length < room)
+                preview = Buffer.concat([preview, bytes.subarray(0, room - preview.length)]);
+        }
+        entries.push([label, `file:${metadata.mode}`, hash.digest("hex")]);
+        if (previewLimit > 0) {
+            if (room) {
+                const excerpt = `\n--- external file: ${label} ---\n${preview.includes(0) ? "[binary artifact: bytes fingerprinted]" : preview.toString("utf8")}`;
+                const bounded = Buffer.from(excerpt).subarray(0, remaining);
+                excerpts.push(bounded.toString("utf8"));
+                remaining -= bounded.length;
+            }
+            if (metadata.size > room || remaining === 0)
+                truncated = true;
+        }
+    };
+    for (const path of roots)
+        await visit(path, new Set());
+    return { entries, excerpt: excerpts.join(""), truncated };
+}

package/dist/plugin/gate.js

@@ -1175,7 +1175,7 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             const absolute = resolve(manifestPath.path);
             if (await project.contains(absolute)) {
                 const normalized = await project.toRelativePath(absolute);
-                if (!await isWritable(normalized))
+                if (!await isWritable(normalized) && !await isExternalWritable(absolute))
                     throw new WriteDeniedError("manifest-scope", normalized);
                 return;
             }

package/dist/plugin/index.js

@@ -6830,58 +6830,64 @@ export const SortieDogsPlugin = async (input, options) => {
                                     output.args.prompt = canonical;
                                     prompt = canonical;
                                 }
-                                const previous = rootAcceptanceContinuity.get(toolInput.sessionID);
-                                if (previous === undefined) {
-                                    if (ledger.parent_fingerprint !== "none" &&
-                                        !await recoverAcceptanceParent(toolInput.sessionID, ledger, reservedParallelDescriptor)) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
-                                    }
-                                }
-                                else if (previous.task_id === ledger.task_id && previous.fingerprint === ledger.fingerprint) {
-                                    if (ledger.parent_fingerprint !== previous.parent_fingerprint) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
+                                // Mission admission already binds the exact generated Task to its durable run and
+                                // ordered requirements. The legacy session-wide chain is a second, incompatible
+                                // authority across cancelled missions and cold reloads (including later units).
+                                const missionDispatch = await input.runtimeBridge?.ownsMissionDispatch?.(toolInput.sessionID, toolInput.callID, ledger.task_id) === true;
+                                if (!missionDispatch) {
+                                    const previous = rootAcceptanceContinuity.get(toolInput.sessionID);
+                                    if (previous === undefined) {
+                                        if (ledger.parent_fingerprint !== "none" &&
+                                            !await recoverAcceptanceParent(toolInput.sessionID, ledger, reservedParallelDescriptor)) {
+                                            throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                            });
+                                        }
                                     }
-                                }
-                                else {
-                                    const exactCarryForward = ledger.criteria.length === previous.criteria.length &&
-                                        previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
-                                    const strictAppend = ledger.criteria.length > previous.criteria.length &&
-                                        previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
-                                    // Serial parent identity is controller-owned. Repair only an omitted link on
-                                    // an otherwise exact carry-forward/append; explicit conflicting links still fail.
-                                    // Persist it so the worker's Read and later recovery see the same contract.
-                                    if (reservedParallelDescriptor === undefined && ledger.parent_fingerprint === "none" &&
-                                        (exactCarryForward || strictAppend)) {
-                                        const source = await readFile(handoffPaths[0], "utf8");
-                                        const handoff = JSON.parse(source);
-                                        const validated = validateHandoffSchema(handoff);
-                                        const current = validated.ok ? inspectAcceptanceContinuity(validated.value).ledger : undefined;
-                                        if (current === undefined || JSON.stringify(current) !== JSON.stringify(ledger)) {
+                                    else if (previous.task_id === ledger.task_id && previous.fingerprint === ledger.fingerprint) {
+                                        if (ledger.parent_fingerprint !== previous.parent_fingerprint) {
                                             throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
                                                 defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
                                             });
                                         }
-                                        ledger = { ...ledger, parent_fingerprint: previous.fingerprint };
-                                        handoff.ext[ACCEPTANCE_CONTINUITY_EXTENSION] = ledger;
-                                        const repaired = `${JSON.stringify(handoff, null, 2)}\n`;
-                                        await writeFile(handoffPaths[0], repaired);
-                                        try {
-                                            await input.runtimeBridge?.onHostHandoffRepaired?.(toolInput.sessionID, ledger.task_id, handoffPaths[0], source, repaired);
+                                    }
+                                    else {
+                                        const exactCarryForward = ledger.criteria.length === previous.criteria.length &&
+                                            previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
+                                        const strictAppend = ledger.criteria.length > previous.criteria.length &&
+                                            previous.criteria.every((criterion, index) => criterion === ledger.criteria[index]);
+                                        // Serial parent identity is controller-owned. Repair only an omitted link on
+                                        // an otherwise exact carry-forward/append; explicit conflicting links still fail.
+                                        // Persist it so the worker's Read and later recovery see the same contract.
+                                        if (reservedParallelDescriptor === undefined && ledger.parent_fingerprint === "none" &&
+                                            (exactCarryForward || strictAppend)) {
+                                            const source = await readFile(handoffPaths[0], "utf8");
+                                            const handoff = JSON.parse(source);
+                                            const validated = validateHandoffSchema(handoff);
+                                            const current = validated.ok ? inspectAcceptanceContinuity(validated.value).ledger : undefined;
+                                            if (current === undefined || JSON.stringify(current) !== JSON.stringify(ledger)) {
+                                                throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                    defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                                });
+                                            }
+                                            ledger = { ...ledger, parent_fingerprint: previous.fingerprint };
+                                            handoff.ext[ACCEPTANCE_CONTINUITY_EXTENSION] = ledger;
+                                            const repaired = `${JSON.stringify(handoff, null, 2)}\n`;
+                                            await writeFile(handoffPaths[0], repaired);
+                                            try {
+                                                await input.runtimeBridge?.onHostHandoffRepaired?.(toolInput.sessionID, ledger.task_id, handoffPaths[0], source, repaired);
+                                            }
+                                            catch (error) {
+                                                await writeFile(handoffPaths[0], source);
+                                                throw error;
+                                            }
+                                            await inspect(handoffPaths[0], undefined, { report: true });
                                         }
-                                        catch (error) {
-                                            await writeFile(handoffPaths[0], source);
-                                            throw error;
+                                        if (ledger.parent_fingerprint !== previous.fingerprint || (!exactCarryForward && !strictAppend)) {
+                                            throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
+                                                defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
+                                            });
                                         }
-                                        await inspect(handoffPaths[0], undefined, { report: true });
-                                    }
-                                    if (ledger.parent_fingerprint !== previous.fingerprint || (!exactCarryForward && !strictAppend)) {
-                                        throw new HandoffDeniedError("contract-invalid", handoffPaths[0], {
-                                            defects: [contractDefect("handoff", "/ext/sortie-dogs~1acceptance-continuity", "acceptance_parent_continuity_mismatch")],
-                                        });
                                     }
                                 }
                                 validatedRootAcceptance = ledger;

package/dist/plugin/mission-review.js

@@ -2,13 +2,14 @@ import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { lstat, readlink } from "node:fs/promises";
-import { resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import { TOOL_ENVIRONMENT } from "../runtime-mission-assets.js";
 import { MISSION_REVIEW_REFERENCE } from "../core/operator-mission.js";
 import { canonicalAgent } from "../core/runtime-profile.js";
 import { taskChildSessionID } from "./task-result-repair.js";
 import { normalizeManifestScope } from "../core/path.js";
+import { declaredArtifacts } from "./declared-artifacts.js";
 const exec = promisify(execFile);
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 /** Recover from native completion records, never from the pending review's inherited child ID. */
@@ -81,16 +82,24 @@ export async function missionReviewSource(directory, run) {
         return { fingerprint: `sha256:${hash.digest("hex")}`,
             excerpt: "[Read-only units: no declared output files. Review the supplied observations, traces and validation evidence.]" };
     // The shared dependency environment is local tooling, never reviewed or pinned source.
-    const scopes = [...writes, `:(exclude)${TOOL_ENVIRONMENT}`];
+    const external = [], local = [];
+    for (const path of writes) {
+        const scoped = relative(directory, resolve(directory, path)).replaceAll("\\", "/");
+        if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
+            external.push(resolve(path));
+        else
+            local.push(scoped || ".");
+    }
+    const scopes = [...local, `:(exclude)${TOOL_ENVIRONMENT}`];
     const git = async (args) => (await exec("git", args, { cwd: directory, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    const names = await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]);
-    const untracked = new Set((await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes])).split("\0").filter(Boolean));
+    const names = local.length ? await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]) : "";
+    const untracked = new Set((local.length ? await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes]) : "").split("\0").filter(Boolean));
     // Explicitly declared outputs are review evidence even when gitignored (for example a probe
     // JSON in _testenv). Their bytes must participate in staleness checks as well as the excerpt.
-    const ignored = await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]);
+    const ignored = local.length ? await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]) : "";
     for (const path of ignored.split("\0").filter(Boolean))
         untracked.add(path);
-    let excerpt = await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...scopes]).catch(() => git(["diff", "--no-ext-diff", "--no-textconv", "--", ...scopes]));
+    let excerpt = local.length ? await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...scopes]).catch(() => git(["diff", "--no-ext-diff", "--no-textconv", "--", ...scopes])) : "";
     const unchanged = excerpt.length === 0;
     const paths = [...new Set([...names.split("\0"), ...ignored.split("\0")].filter(Boolean))].sort();
     const omitted = [];
@@ -129,6 +138,13 @@ export async function missionReviewSource(directory, run) {
             hash.update("deleted");
         }
     }
+    if (external.length) {
+        const artifacts = await declaredArtifacts(external, Math.max(1, 24_000 - Buffer.byteLength(excerpt)));
+        hash.update(JSON.stringify(artifacts.entries));
+        excerpt += artifacts.excerpt;
+        if (artifacts.truncated)
+            omitted.push("external artifacts");
+    }
     const bytes = Buffer.from(excerpt);
     return { fingerprint: `sha256:${hash.digest("hex")}`, excerpt: (bytes.length > 24_000 ? bytes.subarray(0, 24_000).toString("utf8") : excerpt) +
             (bytes.length > 24_000 || omitted.length ? `\n[EXCERPT TRUNCATED: ${omitted.slice(0, 20).join(", ")}; supply focused traces for missing sections, not another implementation unit]` : "") };

package/dist/plugin/profiled.js

@@ -323,10 +323,11 @@ export function createProfiledPlugin(profile, assetVersion) {
             continuationCheckpoint: async (root) => {
                 const mission = await missions.read(root);
                 const run = await operators.read(root);
-                // Cancellation after settled work remains an unfinished accepted goal. Keep its spend and
-                // evidence bound through a real user restart; the cancelled packet grants no dispatch itself.
+                // Cancellation never refunds admitted work. Keep the ledger even when the last Worker
+                // was interrupted before validation; acceptance supersession is decided by mission planning,
+                // not by resetting the goal budget. This checkpoint grants no dispatch itself.
                 if (mission && (!["completed", "cancelled"].includes(mission.phase) ||
-                    (mission.phase === "cancelled" && run && cancelledMissionRetainsAcceptance(run)))) {
+                    (mission.phase === "cancelled" && run))) {
                     return JSON.stringify(missionPacket(mission, run));
                 }
                 return await operators.continuationCheckpoint(root) ?? await proposals.continuationCheckpoint(root);
@@ -351,6 +352,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                 return active && unit.childSessionID === child &&
                     unit.unit.validation.some(candidate => normalizeCommand(candidate) === command);
             },
+            ownsMissionDispatch: async (root, callID, taskID) => {
+                const owner = taskOwners.get(callID);
+                if (owner?.root !== root || owner.operator)
+                    return false;
+                const mission = await missions.read(root), state = await operators.read(root);
+                return mission !== undefined && state !== undefined && mission.runID === state.runID &&
+                    mission.phase === "running" && state.phase === "running" &&
+                    state.units.some(unit => unit.status === "running" && unit.callID === callID &&
+                        /^task_id: (.+)$/m.exec(unit.task.prompt)?.[1] === taskID);
+            },
             allowsInvestigativeShell: async (child) => {
                 const root = await rootFor(child);
                 if (!root)
@@ -466,7 +477,8 @@ export function createProfiledPlugin(profile, assetVersion) {
             if (!mission.dispatchOpen && (["open", "running"].includes(mission.phase) ||
                 (mission.phase === "submitted" && mission.submission?.status !== "ready"))) {
                 return { ...packet, task: missions.task(mission),
-                    next_action: "The previous Coordinator Task is finished. Dispatch this exact Task to continue the same mission and Coordinator session; keep the original requirements and cumulative budget." };
+                    next_action: (run?.units.some(unit => unit.dispatchDenial) ? `${packet.next_action}\n` : "") +
+                        "The previous Coordinator Task is finished. Dispatch this exact Task to continue the same mission and Coordinator session; keep the original requirements and cumulative budget." };
             }
             return packet;
         }
@@ -1264,7 +1276,6 @@ export function createProfiledPlugin(profile, assetVersion) {
             const dispatcher = actor === root ? undefined : { sessionID: actor, callID: mission.callID };
             const state = replanning ? await operators.replanMission(root, previous.runID, plan, dispatcher)
                 : await operators.prepareMission(root, plan, dispatcher, mission.supersededRunID, terminalChildren);
-            await restorePriorAcceptance(root, state);
             await control.registerGoalDeclaration(root, state.units[0].task.prompt, true);
             control.enableUnits(root, state.units.filter(unit => unit.status === "pending").length);
             await missions.update(root, item => {
@@ -1277,7 +1288,7 @@ export function createProfiledPlugin(profile, assetVersion) {
             });
             return JSON.stringify(await operators.next(root, actor));
         }
-        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Use write: [] for read-only verification; use dir/** for directory outputs including not-yet-created trees. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here. Rejected budget, contract or control-storage preparation preserves the existing run so you can correct the plan directly.",
+        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Use write: [] for read-only verification; use dir/** for directory outputs including not-yet-created trees. Native absolute paths support global installs and external outputs under host permissions; include their actual paths in read/write for evidence. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here. Rejected budget, contract or control-storage preparation preserves the existing run so you can correct the plan directly.",
             args: { units: { type: "array", minItems: 1, maxItems: 32, items: { type: "object", additionalProperties: false,
                         properties: { title: { type: "string" }, objective: { type: "string" }, read: stringList, write: stringList,
                             validation: stringList, requirement_ids: stringList }, required: ["title", "objective", "write", "validation"] } },
@@ -1780,7 +1791,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                 if (delegated) {
                     if (!mission || mission.runID !== state.runID)
                         await proposals.assertExecutionApproved(root, state.planHash);
-                    await restorePriorAcceptance(root, state);
+                    if (!mission || mission.runID !== state.runID)
+                        await restorePriorAcceptance(root, state);
                     expandedWorker = await operators.admitWorker(root, request.sessionID, request.callID, args);
                     taskOwners.set(request.callID, { root, actor: request.sessionID, operator: false });
                 }
@@ -1847,7 +1859,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 catch (error) {
                     if (delegated) {
                         taskOwners.delete(request.callID);
-                        await operators.rejectedAdmission(root, request.callID);
+                        await operators.rejectedAdmission(root, request.callID, error instanceof Error ? error.message : String(error));
                     }
                     throw error;
                 }

package/dist/plugin/protected-snapshot.js

@@ -4,6 +4,7 @@ import { isAbsolute, join, relative, resolve } from "node:path";
 import { goalFingerprint } from "../core/goal-bound.js";
 import { normalizeManifestScope } from "../core/path.js";
 import { RUNTIME_PROFILES } from "../core/runtime-profile.js";
+import { declaredArtifacts } from "./declared-artifacts.js";
 const controlRoots = new Set([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]);
 /** Live orchestration/Git bookkeeping is readable context, not the source being validated. */
 export function isRuntimeControlPath(path) {
@@ -57,6 +58,19 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             return undefined;
     return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
 }
+function outside(projectRoot, path) {
+    const scoped = relative(projectRoot, path).replaceAll("\\", "/");
+    return scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped);
+}
+async function declaredScopeDigest(projectRoot, paths, manifestHash, source) {
+    const local = paths.filter(path => !outside(projectRoot, path));
+    const external = paths.filter(path => outside(projectRoot, path));
+    const project = await protectedScopeDigest(projectRoot, local, manifestHash, source ? "project-files-v1" : undefined);
+    if (project === undefined)
+        return undefined;
+    const artifacts = await declaredArtifacts(external).catch(() => undefined);
+    return artifacts && goalFingerprint({ project, external: artifacts.entries });
+}
 export async function protectedSnapshot(authorization) {
     const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
     if (manifestSource === undefined)
@@ -72,15 +86,18 @@ export async function protectedSnapshot(authorization) {
     });
     const candidatePaths = actualPaths(manifest.write);
     const sourcePaths = [...new Set([...actualPaths(manifest.read), ...candidatePaths])];
-    const source = await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, "project-files-v1");
+    const external = sourcePaths.some(path => outside(authorization.projectRoot, path));
+    const source = external ? await declaredScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, true)
+        : await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, "project-files-v1");
     // Explicit outputs and the exact operation manifest remain pinned, including control-like paths.
-    const candidate = await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
+    const candidate = external ? await declaredScopeDigest(authorization.projectRoot, candidatePaths, manifestHash, false)
+        : await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
     if (source === undefined || candidate === undefined || relativePath.startsWith("../") || isAbsolute(relativePath))
         return undefined;
     return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
-            manifest_path: relativePath, source_policy: "project-files-v1",
-            source_paths: sourcePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")),
-            candidate_paths: candidatePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")) }, source, candidate };
+            manifest_path: relativePath, source_policy: external ? "declared-paths-v1" : "project-files-v1",
+            source_paths: sourcePaths.map(path => (outside(authorization.projectRoot, path) ? path : relative(authorization.projectRoot, path)).replaceAll("\\", "/")),
+            candidate_paths: candidatePaths.map(path => (outside(authorization.projectRoot, path) ? path : relative(authorization.projectRoot, path)).replaceAll("\\", "/")) }, source, candidate };
 }
 export async function refreshProtectedSnapshot(projectRoot, binding) {
     const manifestSource = await readFile(resolve(projectRoot, binding.manifest_path)).catch(() => undefined);
@@ -89,6 +106,11 @@ export async function refreshProtectedSnapshot(projectRoot, binding) {
     const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
     if (`sha256:${manifestHash}` !== binding.manifest_hash)
         return undefined;
+    if (binding.source_policy === "declared-paths-v1") {
+        const source = await declaredScopeDigest(projectRoot, binding.source_paths.map(path => resolve(projectRoot, path)), manifestHash, true);
+        const candidate = await declaredScopeDigest(projectRoot, binding.candidate_paths.map(path => resolve(projectRoot, path)), manifestHash, false);
+        return source === undefined || candidate === undefined ? undefined : { source, candidate };
+    }
     // Legacy evidence retains its original recipe; a new policy cannot relabel stale proof as fresh.
     if (binding.source_policy !== undefined && binding.source_policy !== "project-files-v1")
         return undefined;

package/dist/plugin/runtime-bridge.d.ts

@@ -29,6 +29,8 @@ export interface RuntimeBridge {
     completedReviewPrompts?(rootSessionID: string, requestedPrompt: string): Promise<readonly string[]>;
     requiresExplicitAcceptance?(rootSessionID: string): Promise<boolean>;
     ownsCanonicalValidation?(rootSessionID: string, unitID: string, childSessionID: string, command: string): Promise<boolean>;
+    /** A mission's hash-pinned Task has already passed durable run/acceptance admission. */
+    ownsMissionDispatch?(rootSessionID: string, callID: string, taskID: string): Promise<boolean>;
     onHostHandoffRepaired?(rootSessionID: string, taskID: string, handoffPath: string, original: string, repaired: string): Promise<void>;
     allowsInvestigativeShell?(sessionID: string): Promise<boolean>;
     onSerialSettlement?(settlement: SerialDispatchSettlement): Promise<void>;

package/dist/plugin/v2.js

@@ -3,10 +3,17 @@ import { bindMissionProgress } from "./mission-progress.js";
 import { owningServiceSessionList } from "./v2-session-history.js";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 // Capture once when this module evaluates. A later package replacement must not make an old
 // process report the replacement's bytes as its loaded adapter.
 const loadedAdapter = Object.freeze({ adapter_url: import.meta.url,
     adapter_sha256: createHash("sha256").update(readFileSync(new URL(import.meta.url))).digest("hex"),
+    runtime_asset_version: V010_RUNTIME_ASSET_VERSION,
+    // Named module snapshots, not a claim to identify every transitive dependency. Retain these
+    // bytes across package replacement so an unchanged adapter cannot conceal an old implementation.
+    implementation_sha256: Object.freeze(Object.fromEntries([
+        "index", "profiled", "gate", "protected-snapshot", "declared-artifacts",
+    ].map(name => [`${name}.js`, createHash("sha256").update(readFileSync(new URL(`./${name}.${import.meta.url.endsWith(".ts") ? "ts" : "js"}`, import.meta.url))).digest("hex")]))),
     loaded_at: new Date().toISOString(), pid: process.pid });
 const childSelectionKey = (id) => `v2-child-model-selection:${id}`;
 function record(value) {

package/dist/runtime-mission-assets.js

@@ -114,6 +114,10 @@ Investigate only enough to start the first useful Worker. Prefer a targeted read
 inventory or speculative full design. Call ${profile.toolPrefix}plan_units with concise units:
 title, objective, read/write file or directory scopes, validation commands, optionally requirement_ids.
 For read-only verification, use write: []; do not invent an output file or request write access to inputs.
+Use absolute native paths for requested global installations or other external outputs; dir/** declares
+a directory including a not-yet-created tree. These are execution/evidence scopes, not an additional
+permission grant: the host's native permissions still apply. Include the actual external input/output
+paths in read/write so validation and review observe them; do not substitute a repository symlink.
 Keep all original requirements covered; omitted requirement_ids means all. Last validation command proves
 that unit. If your quick check shows repository-declared dependencies or the test runner are missing, keep
 setup inside the first unit: declare its checks through the repository-local tool environment ${TOOL_ENVIRONMENT}/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.11",
+  "version": "0.12.12",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",