sortie-dogs 0.12.6 → 0.12.8

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.3-v2-zod-schema-compaction-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.8-mission-lineage-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.3-v2-zod-schema-compaction-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.8-mission-lineage-v1";

package/dist/cli/main.js

@@ -258,6 +258,14 @@ export async function run(argv) {
             if (initialized.preservedLegacyPaths.length > 0) {
                 process.stdout.write(`Preserved legacy runtime files: ${initialized.preservedLegacyPaths.join(", ")}.\n`);
             }
+            const override = profile === "v010"
+                ? await initializer.coordinatorModelOverride(global ? target : resolve(initArgs[0] ?? process.cwd()), global).catch(() => undefined)
+                : undefined;
+            if (override) {
+                process.stderr.write(`Warning: ${override.path} routes dogs-coordinator to ${override.model}. ` +
+                    `Sortie-dogs expects ${initializer.V010_COORDINATOR_MODEL}; a gpt-6-luna-fast Coordinator was measured to repeat plans and reviews until timeout. ` +
+                    "Remove the override unless it is intentional.\n");
+            }
             return 0;
         }
         catch (error) {

package/dist/core/initialize.d.ts

@@ -11,6 +11,15 @@ export declare class ProjectInitializationError extends Error {
     readonly code: ProjectInitializationErrorCode;
     constructor(code: ProjectInitializationErrorCode, message: string, options?: ErrorOptions);
 }
+export declare const V010_COORDINATOR_MODEL = "openai/gpt-6-sol#xhigh";
+/**
+ * Report a user config that routes the v0.10 Coordinator away from its packaged model. Measured Luna
+ * Coordinators repeated plans and review dispatches until timeout, so init surfaces it without editing it.
+ */
+export declare function coordinatorModelOverride(root: string, global: boolean): Promise<{
+    path: string;
+    model: string;
+} | undefined>;
 /** Resolves the OpenCode global configuration directory without platform-specific paths. */
 export declare function resolveGlobalConfigRoot(env?: NodeJS.ProcessEnv, home?: string): Promise<string>;
 export declare function initializeProject(projectRoot?: string, profile?: RuntimeProfileId): Promise<InitializeProjectResult>;

package/dist/core/initialize.js

@@ -536,6 +536,34 @@ async function initializeRoot(requestedRoot, layout, installAssets = runtimeAsse
         preservedLegacyPaths,
     };
 }
+export const V010_COORDINATOR_MODEL = "openai/gpt-6-sol#xhigh";
+/**
+ * Report a user config that routes the v0.10 Coordinator away from its packaged model. Measured Luna
+ * Coordinators repeated plans and review dispatches until timeout, so init surfaces it without editing it.
+ */
+export async function coordinatorModelOverride(root, global) {
+    const prefix = global ? "" : `${OPEN_CODE_DIRECTORY}/`;
+    for (const relativePath of [`${prefix}opencode.jsonc`, `${prefix}opencode.json`]) {
+        let content;
+        try {
+            content = await readFile(resolve(root, relativePath), "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        const config = parse(content, [], { allowTrailingComma: true });
+        for (const key of ["agents", "agent"]) {
+            const agents = config?.[key];
+            const coordinator = agents !== null && typeof agents === "object" ? agents["dogs-coordinator"] : undefined;
+            const model = coordinator !== null && typeof coordinator === "object" ? coordinator.model : undefined;
+            if (typeof model === "string" && model !== V010_COORDINATOR_MODEL)
+                return { path: resolve(root, relativePath), model };
+        }
+    }
+    return undefined;
+}
 /** Resolves the OpenCode global configuration directory without platform-specific paths. */
 export async function resolveGlobalConfigRoot(env = process.env, home = homedir()) {
     if (env.OPENCODE_CONFIG_DIR)

package/dist/core/operator-mission.d.ts

@@ -40,11 +40,22 @@ export interface OperatorMission {
         risk: string[];
         source: string;
         task: OperatorTask | null;
-        verdict: "pending" | "PASS" | "findings" | "skipped-low-risk";
+        verdict: "pending" | "PASS" | "findings" | "evidence-gaps" | "skipped-low-risk";
         result?: string;
         child?: string;
+        /** Reviews on this mission that found only missing evidence; bounded by MISSION_EVIDENCE_GAP_REVIEW_LIMIT. */
+        evidenceGapReviews?: number;
     };
 }
+/**
+ * Evidence-only findings do not establish a defect. Each extra round costs a full Reviewer pass and often a
+ * Worker unit, so after this many evidence-only reviews the candidate may be submitted with the gaps listed.
+ */
+export declare const MISSION_EVIDENCE_GAP_REVIEW_LIMIT = 2;
+/** Classify an independent Reviewer's first line. Anything else is a finding. */
+export declare function missionReviewVerdict(text: string): "PASS" | "evidence-gaps" | "findings";
+/** Whether the recorded review permits submission and acceptance of the current candidate. */
+export declare function missionReviewAccepted(review: NonNullable<OperatorMission["review"]>): boolean;
 /** Durable user intent and dispatch ownership. Execution/evidence still belong to the v0.10 engine. */
 export declare class OperatorMissionRuntime {
     readonly projectRoot: string;
@@ -64,6 +75,8 @@ export declare class OperatorMissionRuntime {
     capture(root: string, request: MissionRequest): Promise<void>;
     start(root: string, requirements: unknown): Promise<OperatorMission>;
     update(root: string, change: (state: OperatorMission) => void): Promise<OperatorMission>;
+    /** Keep a cancelled same-turn run's host-accepted criteria ahead of new mission text. */
+    carryForward(root: string, missionID: string, acceptance: readonly string[]): Promise<OperatorMission>;
     task(state: OperatorMission): OperatorTask;
     admit(root: string, callID: string, args: Record<string, unknown>): Promise<OperatorMission>;
     /** Reopen only the exact dispatch whose native Task has a terminal record after a server restart. */

package/dist/core/operator-mission.js

@@ -18,6 +18,20 @@ export function missionValidationCommand(command) {
     const expression = `exec(${JSON.stringify(heredoc[4])})`;
     return `${heredoc[1]} -c '${expression.replaceAll("'", "'\\''")}'`;
 }
+/**
+ * Evidence-only findings do not establish a defect. Each extra round costs a full Reviewer pass and often a
+ * Worker unit, so after this many evidence-only reviews the candidate may be submitted with the gaps listed.
+ */
+export const MISSION_EVIDENCE_GAP_REVIEW_LIMIT = 2;
+/** Classify an independent Reviewer's first line. Anything else is a finding. */
+export function missionReviewVerdict(text) {
+    return /^\s*PASS(?:\s|$)/u.test(text) ? "PASS" : /^\s*EVIDENCE_GAPS(?:\s|$)/u.test(text) ? "evidence-gaps" : "findings";
+}
+/** Whether the recorded review permits submission and acceptance of the current candidate. */
+export function missionReviewAccepted(review) {
+    return review.verdict === "PASS" || review.verdict === "skipped-low-risk" ||
+        (review.verdict === "evidence-gaps" && (review.evidenceGapReviews ?? 0) >= MISSION_EVIDENCE_GAP_REVIEW_LIMIT);
+}
 /** Durable user intent and dispatch ownership. Execution/evidence still belong to the v0.10 engine. */
 export class OperatorMissionRuntime {
     projectRoot;
@@ -44,7 +58,7 @@ export class OperatorMissionRuntime {
     async loadMission(root) {
         const state = await this.load(this.file(root));
         if (!state || state.supersededRunID !== undefined || state.runID !== null ||
-            !["open", "running", "submitted"].includes(state.phase) || state.requests.length === 0)
+            !["open", "running", "submitted", "cancelled"].includes(state.phase) || state.requests.length === 0)
             return state;
         const directory = join(this.projectRoot, this.profile.stateDirectory, "missions");
         let entries;
@@ -61,13 +75,18 @@ export class OperatorMissionRuntime {
         const matches = [];
         for (const name of candidates) {
             const previous = await this.load(join(directory, name));
-            if (previous?.root === root && previous.phase === "cancelled" && previous.runID !== null &&
-                previous.requests[0]?.id !== state.requests[0].id &&
+            if (previous?.root === root && previous.phase === "cancelled" &&
+                (previous.runID !== null || previous.supersededRunID !== undefined) &&
+                (previous.runID === null || previous.requests[0]?.id !== state.requests[0].id) &&
                 previous.requests.some(request => request.id === state.requests[0].id))
                 matches.push(previous);
         }
-        if (matches.length === 1)
-            state.supersededRunID = matches[0].runID;
+        if (matches.length === 1) {
+            const predecessor = matches[0].runID ?? matches[0].supersededRunID;
+            if (predecessor && (matches[0].runID !== null || await this.archivedRun(root, predecessor))) {
+                state.supersededRunID = predecessor;
+            }
+        }
         return state;
     }
     /** Find exactly one archived cancelled mission that owned this run; ambiguity never grants recovery. */
@@ -164,8 +183,10 @@ export class OperatorMissionRuntime {
             const state = { version: "0.12", id: `mission-${randomUUID()}`, root, requests: [request],
                 requirements: requirements.map((text, index) => ({ id: `R${index + 1}`, text })), phase: "open",
                 coordinator: null, callID: null, dispatchOpen: false, runID: null, plans: 0, progress: [], submission: null,
-                ...(previous?.phase === "cancelled" && previous.runID !== null && request.id !== previous.requests[0]?.id
-                    ? { supersededRunID: previous.runID } : {}) };
+                ...(previous?.phase === "cancelled" &&
+                    (previous.runID === null || request.id !== previous.requests[0]?.id) &&
+                    (previous.runID ?? previous.supersededRunID)
+                    ? { supersededRunID: (previous.runID ?? previous.supersededRunID) } : {}) };
             await this.save(this.file(root), state);
             return state;
         });
@@ -180,6 +201,23 @@ export class OperatorMissionRuntime {
             return state;
         });
     }
+    /** Keep a cancelled same-turn run's host-accepted criteria ahead of new mission text. */
+    carryForward(root, missionID, acceptance) {
+        return this.update(root, state => {
+            if (state.id !== missionID || state.supersededRunID !== undefined || state.runID !== null ||
+                !["open", "running"].includes(state.phase) || (state.dispatchOpen && state.coordinator === null) ||
+                acceptance.length === 0 || acceptance.some(text => typeof text !== "string" || !text.trim())) {
+                throw new Error("mission-acceptance-carry-forward-unavailable");
+            }
+            const existing = state.requirements.map(item => item.text);
+            if (acceptance.every((text, index) => existing[index] === text))
+                return;
+            const additions = existing.filter(text => !acceptance.includes(text));
+            if (acceptance.length + additions.length > 64)
+                throw new Error("mission-requirements-limit: carried acceptance and additions exceed 64");
+            state.requirements = [...acceptance, ...additions].map((text, index) => ({ id: `R${index + 1}`, text }));
+        });
+    }
     task(state) {
         return { subagent_type: profileAgent(this.profile, "dog-operator"), description: state.requirements[0].text.slice(0, 100),
             prompt: `${MISSION_REFERENCE}${JSON.stringify({ r: state.root, m: state.id, h: digest(JSON.stringify(state.requirements)) })}`,
@@ -294,12 +332,15 @@ export function missionPacket(mission, run) {
         submission: mission.submission, progress: mission.progress,
         review: mission.review ? { risk_tags: mission.review.risk, verdict: mission.review.verdict,
             source_fingerprint: mission.review.source, reviewer_session_id: mission.review.child ?? null,
-            result: mission.review.result ?? null } : null,
+            result: mission.review.result ?? null, evidence_gap_reviews: mission.review.evidenceGapReviews ?? 0,
+            evidence_gap_review_limit: MISSION_EVIDENCE_GAP_REVIEW_LIMIT, accepted: missionReviewAccepted(mission.review) } : null,
         ...(run ? { run_id: run.runID, status: run.phase, decision: run.decision,
             units: run.units.map(unit => ({ id: unit.unit.id, title: unit.unit.title, status: unit.status,
                 child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence })) } : {}),
         next_action: run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
-            : run?.phase === "awaiting-acceptance" ? "Coordinator: obtain required independent review, then submit_mission. Operator: compare all requirements with source/evidence before complete_mission."
+            : run?.phase === "awaiting-acceptance" ? (mission.review?.verdict === "evidence-gaps" && !missionReviewAccepted(mission.review)
+                ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
+                : "Coordinator: obtain required independent review, then submit_mission. Operator: compare all requirements with source/evidence before complete_mission.")
                 : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
 }
 /** Models forward a short capability, never recopy the host's evidence hashes and source packet. */

package/dist/core/operator-runtime.d.ts

@@ -109,7 +109,7 @@ interface UnitState {
     readonly task: OperatorTask;
     readonly handoffPath: string;
     readonly manifestPath: string;
-    readonly hashes: readonly string[];
+    hashes: readonly string[];
     status: "pending" | "running" | "succeeded" | "failed" | "cancelled";
     callID: string | null;
     childSessionID: string | null;
@@ -245,7 +245,7 @@ export declare class OperatorRuntime {
     prepareMission(root: string, raw: unknown, dispatcher?: {
         sessionID: string;
         callID: string;
-    }, supersededRunID?: string): Promise<OperatorState>;
+    }, supersededRunID?: string, terminalChildren?: readonly string[]): Promise<OperatorState>;
     retireMissionRun(root: string): Promise<void>;
     private prepareOnce;
     operatorTask(state: OperatorState): OperatorTask;
@@ -332,6 +332,8 @@ export declare class OperatorRuntime {
     packet(state: OperatorState): unknown;
     continuationCheckpoint(root: string): Promise<string | undefined>;
     private verifyControls;
+    /** Follow only the host's authorized parent-link repair; keep the durable control pin in sync. */
+    acknowledgeHostHandoffRepair(root: string, taskID: string, path: string, original: string, repaired: string): Promise<void>;
     private gitPaths;
     private pathAuthorized;
     /**

package/dist/core/operator-runtime.js

@@ -678,8 +678,8 @@ export class OperatorRuntime {
         }
     }
     /** Mission authority is supplied only by the owning profile, never by a model-authored plan. */
-    prepareMission(root, raw, dispatcher, supersededRunID) {
-        return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, supersededRunID }));
+    prepareMission(root, raw, dispatcher, supersededRunID, terminalChildren = []) {
+        return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, supersededRunID, terminalChildren }));
     }
     retireMissionRun(root) {
         return this.serial(root, async () => {
@@ -727,9 +727,15 @@ export class OperatorRuntime {
             previous.phase === "cancelled";
         if (mission?.supersededRunID !== undefined && !superseding)
             throw new Error("mission-superseded-run-mismatch");
+        const terminalChildren = mission?.terminalChildren ?? [];
+        const cancelledChildren = previous?.units.flatMap(unit => unit.status === "cancelled" && unit.childSessionID !== null
+            ? [unit.childSessionID] : []) ?? [];
         if (superseding && previous && (previous.decision !== "explicit-cancellation" || previous.gitLifecycle !== null ||
             previous.repairResidualPaths.length > 0 || previous.priorAcceptedUnits.length > 0 ||
-            previous.units.some(unit => unit.childSessionID !== null || unit.status === "succeeded"))) {
+            terminalChildren.length !== cancelledChildren.length || new Set(terminalChildren).size !== terminalChildren.length ||
+            cancelledChildren.some(id => !terminalChildren.includes(id)) || previous.units.some(unit => !["pending", "cancelled"].includes(unit.status) || unit.evidence.length > 0 || unit.resultClass !== null ||
+            unit.repairValidation !== null || (unit.status === "pending" && (unit.callID !== null || unit.childSessionID !== null)) ||
+            (unit.status === "cancelled" && (unit.childSessionID === null || unit.callID === null))))) {
             throw new Error("mission-superseded-run-has-work: reconcile prior workers and evidence before changing acceptance");
         }
         if (plan.git_lifecycle !== undefined) {
@@ -743,6 +749,14 @@ export class OperatorRuntime {
         // Cancellation stops execution, not the accepted user order. A replacement
         // plan must carry the original ordered criteria; only a completed root clears them.
         const parent = !superseding && previous?.phase === "cancelled" ? previous : undefined;
+        if (parent?.decision === "explicit-cancellation") {
+            const cancelled = parent.units.flatMap(unit => unit.status === "cancelled" && unit.childSessionID !== null
+                ? [unit.childSessionID] : []);
+            if (cancelled.length > 0 && (new Set(terminalChildren).size !== terminalChildren.length ||
+                cancelled.some(id => !terminalChildren.includes(id)))) {
+                throw new Error("mission-cancelled-run-worker-not-terminal");
+            }
+        }
         if (parent?.decision === "operator-contract-repair-unavailable-after-cancel") {
             // The diagnosed transients, not the cancellation itself, block a replacement. Once they are
             // gone the same accepted order may proceed; while they remain the refusal names them exactly.
@@ -1893,6 +1907,30 @@ export class OperatorRuntime {
         if (contents.some((value, index) => hash(value) !== unit.hashes[index]))
             throw new Error("operator-contract-changed");
     }
+    /** Follow only the host's authorized parent-link repair; keep the durable control pin in sync. */
+    acknowledgeHostHandoffRepair(root, taskID, path, original, repaired) {
+        return this.serial(root, async () => {
+            const state = await this.read(root);
+            const unit = state?.units.find(candidate => candidate.status === "running" && candidate.handoffPath === path &&
+                /^task_id: (.+)$/m.exec(candidate.task.prompt)?.[1] === taskID);
+            if (!unit)
+                return; // The same host repair also serves non-Operator handoffs.
+            if (hash(original) !== unit.hashes[0] || await readFile(path, "utf8") !== repaired) {
+                throw new Error("operator-host-handoff-repair-unpinned");
+            }
+            const before = JSON.parse(original), after = JSON.parse(repaired);
+            const oldLink = inspectAcceptanceContinuity(before).ledger;
+            const newLink = inspectAcceptanceContinuity(after).ledger;
+            if (!oldLink || !newLink || oldLink.task_id !== taskID || oldLink.parent_fingerprint !== "none" ||
+                newLink.task_id !== taskID || newLink.fingerprint !== oldLink.fingerprint ||
+                newLink.parent_fingerprint === "none" ||
+                JSON.stringify({ ...before, ext: { ...before.ext, [ACCEPTANCE_CONTINUITY_EXTENSION]: { ...oldLink, parent_fingerprint: newLink.parent_fingerprint } } }, null, 2) + "\n" !== repaired) {
+                throw new Error("operator-host-handoff-repair-invalid");
+            }
+            unit.hashes = [hash(repaired), ...unit.hashes.slice(1)];
+            await this.save(state);
+        });
+    }
     gitPaths(output) {
         return output.split("\0").filter(Boolean).map(path => normalizeRelativePath(path.replaceAll("\\", "/")));
     }

package/dist/plugin/index.js

@@ -6953,7 +6953,8 @@ export const SortieDogsPlugin = async (input, options) => {
                                     // Persist it so the worker's Read and later recovery see the same contract.
                                     if (reservedParallelDescriptor === undefined && ledger.parent_fingerprint === "none" &&
                                         (exactCarryForward || strictAppend)) {
-                                        const handoff = JSON.parse(await readFile(handoffPaths[0], "utf8"));
+                                        const source = await readFile(handoffPaths[0], "utf8");
+                                        const handoff = JSON.parse(source);
                                         const validated = validateHandoffSchema(handoff);
                                         const current = validated.ok ? inspectAcceptanceContinuity(validated.value).ledger : undefined;
                                         if (current === undefined || JSON.stringify(current) !== JSON.stringify(ledger)) {
@@ -6963,7 +6964,15 @@ export const SortieDogsPlugin = async (input, options) => {
                                         }
                                         ledger = { ...ledger, parent_fingerprint: previous.fingerprint };
                                         handoff.ext[ACCEPTANCE_CONTINUITY_EXTENSION] = ledger;
-                                        await writeFile(handoffPaths[0], `${JSON.stringify(handoff, null, 2)}\n`);
+                                        const repaired = `${JSON.stringify(handoff, null, 2)}\n`;
+                                        await writeFile(handoffPaths[0], repaired);
+                                        try {
+                                            await input.runtimeBridge?.onHostHandoffRepaired?.(toolInput.sessionID, ledger.task_id, handoffPaths[0], source, repaired);
+                                        }
+                                        catch (error) {
+                                            await writeFile(handoffPaths[0], source);
+                                            throw error;
+                                        }
                                         await inspect(handoffPaths[0], undefined, { report: true });
                                     }
                                     if (ledger.parent_fingerprint !== previous.fingerprint || (!exactCarryForward && !strictAppend)) {

package/dist/plugin/mission-review.js

@@ -3,10 +3,12 @@ import { execFile } from "node:child_process";
 import { lstat, readFile, readlink } from "node:fs/promises";
 import { resolve } from "node:path";
 import { promisify } from "node:util";
+import { TOOL_ENVIRONMENT } from "../runtime-mission-assets.js";
 const exec = promisify(execFile);
 /** Pin all scoped tracked/untracked source bytes, including deletions; display a bounded excerpt only. */
 export async function missionReviewSource(directory, run) {
-    const scopes = [...new Set(run.units.flatMap(unit => unit.unit.write))];
+    // The shared dependency environment is local tooling, never reviewed or pinned source.
+    const scopes = [...new Set(run.units.flatMap(unit => unit.unit.write)), `:(exclude)${TOOL_ENVIRONMENT}`];
     const git = async (args) => (await exec("git", args, { cwd: directory, maxBuffer: 8 * 1024 * 1024 })).stdout;
     const names = await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]);
     const untracked = new Set((await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes])).split("\0").filter(Boolean));

package/dist/plugin/profiled.d.ts

@@ -1,3 +1,4 @@
+import { type OperatorState } from "../core/operator-runtime.js";
 import { type RuntimeProfile } from "../core/runtime-profile.js";
 import { type OpenCodePlugin } from "./index.js";
 import { type CatalogModel } from "./model-routing.js";
@@ -20,6 +21,13 @@ export declare function previewModelCatalog(routes?: readonly {
     readonly model: string;
     readonly variant: string;
 }[], base?: readonly CatalogModel[]): readonly CatalogModel[];
+/** Native V2 termination and lineage are required before a cancelled Worker loses its old acceptance. */
+export declare function terminalCancelledMissionChildren(profile: RuntimeProfile, root: string, previous: OperatorState, budget: {
+    reserved_units: number;
+} | null, host: {
+    get(id: string): Promise<unknown>;
+    children(id: string): Promise<unknown>;
+}): Promise<string[]>;
 /** One transport namespace around the existing MkII engine; no second write gate or acceptance engine. */
 export declare function createProfiledPlugin(profile: RuntimeProfile, assetVersion: string): OpenCodePlugin;
 export declare const SortieDogsV010Plugin: OpenCodePlugin;

package/dist/plugin/profiled.js

@@ -12,7 +12,7 @@ import { decoratePreviewHeadings, returnReportPanel } from "./receipt-presentati
 import { sanitizeTerminalReport, terminalRunOutcome } from "./run-metrics.js";
 import { extractWritePaths, normalizeCommand } from "./gate.js";
 import { normalizeRelativePath } from "../core/path.js";
-import { OperatorMissionRuntime, missionPacket, missionPlan, missionReviewTask, missionReviewTraces } from "../core/operator-mission.js";
+import { MISSION_EVIDENCE_GAP_REVIEW_LIMIT, OperatorMissionRuntime, missionPacket, missionPlan, missionReviewAccepted, missionReviewTask, missionReviewTraces, missionReviewVerdict } from "../core/operator-mission.js";
 import { publishMissionProgress } from "./mission-progress.js";
 import { missionReviewSource } from "./mission-review.js";
 import { SOURCE_REVIEW_RISK_TAGS } from "../core/consultation.js";
@@ -82,6 +82,34 @@ export function previewModelCatalog(routes = PREVIEW_ROUTES, base = BUILT_IN_MOD
 }
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const payload = (value) => record(value) && "data" in value ? value.data : value;
+/** Native V2 termination and lineage are required before a cancelled Worker loses its old acceptance. */
+export async function terminalCancelledMissionChildren(profile, root, previous, budget, host) {
+    if (!budget || budget.reserved_units !== 0)
+        throw new Error("mission-superseded-run-reservations-pending");
+    const oldWorkers = previous.units.flatMap(unit => unit.childSessionID === null ? [] : [unit.childSessionID]);
+    if (oldWorkers.length === 0)
+        return [];
+    const coordinatorID = previous.operatorSessionID;
+    const coordinator = coordinatorID && await host.get(coordinatorID);
+    if (coordinatorID === null || !record(coordinator) || coordinator.parentID !== root ||
+        canonicalAgent(profile, coordinator.agent) !== "dog-operator" || coordinator.outcome !== "interrupted") {
+        throw new Error("mission-superseded-coordinator-not-terminal");
+    }
+    const children = await host.children(coordinatorID);
+    if (!Array.isArray(children) || children.length !== oldWorkers.length ||
+        children.some(child => !record(child) || !oldWorkers.includes(child.id))) {
+        throw new Error("mission-superseded-worker-lineage-unproven");
+    }
+    for (const id of oldWorkers) {
+        const worker = await host.get(id), descendants = await host.children(id);
+        if (!record(worker) || worker.parentID !== coordinatorID ||
+            !["dog-worker", "dog-luna-worker"].includes(canonicalAgent(profile, worker.agent) ?? "") ||
+            worker.outcome !== "interrupted" || !Array.isArray(descendants) || descendants.length !== 0) {
+            throw new Error("mission-superseded-worker-not-terminal");
+        }
+    }
+    return oldWorkers;
+}
 const RUNTIME_PROFILE_SESSION_INACTIVE = "runtime-profile-session-inactive: non-profile agents retain native read, edit, patch, shell, and task tools; continue directly without Sortie profile tools";
 const fallbackOptionalSchema = (schema) => record(schema) && schema.type === "string" && typeof schema.optional !== "function"
     ? { ...schema, "x-sortie-optional": true }
@@ -284,6 +312,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         });
         const runtimeBridge = {
             profile, assetVersion,
+            onHostHandoffRepaired: (root, taskID, path, original, repaired) => operators.acknowledgeHostHandoffRepair(root, taskID, path, original, repaired),
             continuationCheckpoint: async (root) => {
                 const mission = await missions.read(root);
                 if (mission && !["completed", "cancelled"].includes(mission.phase))
@@ -405,6 +434,19 @@ export function createProfiledPlugin(profile, assetVersion) {
             }
             return packet;
         }
+        async function retainCancelledMissionAcceptance(root, mission, prior) {
+            const previous = prior ?? await operators.read(root);
+            if (previous?.phase !== "cancelled" || mission.supersededRunID !== undefined || mission.runID !== null)
+                return mission;
+            // A different original user request needs the explicit, host-proven supersession path.
+            // Only the same source can retain a cancelled run's acceptance as a prefix.
+            if (previous.sourceRefs[0] !== `user:${mission.requests[0]?.id}` ||
+                !previous.sourceRefs.every(ref => mission.requests.some(request => ref === `user:${request.id}`))) {
+                throw new Error("mission-cancelled-source-unproven");
+            }
+            return previous.acceptance.every((text, index) => mission.requirements[index]?.text === text)
+                ? mission : missions.carryForward(root, mission.id, previous.acceptance);
+        }
         async function restorePriorAcceptance(root, state) {
             const succeeded = [...state.units].reverse().find(unit => unit.status === "succeeded");
             const current = succeeded === undefined ? undefined : {
@@ -1114,21 +1156,24 @@ export function createProfiledPlugin(profile, assetVersion) {
             } };
         const startMission = `${profile.toolPrefix}start_mission`, planUnits = `${profile.toolPrefix}plan_units`, reviewMission = `${profile.toolPrefix}review_mission`, submitMission = `${profile.toolPrefix}submit_mission`, completeMission = `${profile.toolPrefix}complete_mission`, expandUnit = `${profile.toolPrefix}expand_unit`;
         const stringList = { type: "array", items: { type: "string" } };
-        tools[startMission] = { description: "Operator: save a few one-line requirements/negative constraints. The original user message, IDs and ownership are captured automatically. Dispatch the returned Coordinator task immediately, or use plan_units for a simple single-unit Fast-lane task.",
+        tools[startMission] = { description: "Operator: save a few one-line requirements/negative constraints. The original user message, IDs and ownership are captured automatically. A cancelled same-turn run's accepted criteria are restored from host state in their exact order before dispatch. Dispatch the returned Coordinator task immediately, or use plan_units for a simple single-unit Fast-lane task.",
             args: { requirements: { ...stringList, minItems: 1, maxItems: 64 } }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
-                await reconcileMissionDispatch(context.sessionID);
-                const mission = await missions.start(context.sessionID, args.requirements);
-                return JSON.stringify(mission.dispatchOpen
-                    ? missionDispatchPacket(mission, await operators.read(context.sessionID))
-                    : { mission_id: mission.id, requirements: mission.requirements, task: missions.task(mission),
-                        next_action: "Nontrivial: dispatch task now. Simple single-unit work with known scope/check: call plan_units directly. Do not create a proposal or ask for plan approval." });
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    await reconcileMissionDispatch(context.sessionID);
+                    const mission = await retainCancelledMissionAcceptance(context.sessionID, await missions.start(context.sessionID, args.requirements));
+                    return JSON.stringify(mission.dispatchOpen
+                        ? missionDispatchPacket(mission, await operators.read(context.sessionID))
+                        : { mission_id: mission.id, requirements: mission.requirements, task: missions.task(mission),
+                            next_action: "Nontrivial: dispatch task now. Simple single-unit work with known scope/check: call plan_units directly. Do not create a proposal or ask for plan approval." });
+                });
             } };
         async function declareMissionUnits(root, actor, mission, raw, reason) {
+            const previous = await operators.read(root);
+            mission = await retainCancelledMissionAcceptance(root, mission, previous);
             const plan = missionPlan(mission, raw);
             if (actor === root && (mission.coordinator !== null || plan.units.length !== 1))
                 throw new Error("mission-coordinator-required: dispatch the returned Coordinator task");
-            const previous = await operators.read(root);
             const same = previous?.planHash === createHash("sha256").update(JSON.stringify(plan)).digest("hex");
             if (previous && !["completed", "cancelled"].includes(previous.phase) && !same) {
                 if (!reason?.trim())
@@ -1138,8 +1183,19 @@ export function createProfiledPlugin(profile, assetVersion) {
             const budget = await control.currentBudget(root);
             if (budget && budget.remaining_units < plan.units.length && !same)
                 throw new Error("mission-budget-exhausted: report the required cumulative extension to Operator");
+            // Cancellation marks the durable units before interrupting their native sessions. A cancelled
+            // status alone therefore cannot prove the old Worker stopped or its reservation settled.
+            const cancelledPredecessor = previous?.phase === "cancelled" &&
+                (mission.supersededRunID === previous.runID ||
+                    (mission.supersededRunID === undefined && previous.decision === "explicit-cancellation" &&
+                        previous.units.some(unit => unit.status === "cancelled" && unit.childSessionID !== null)));
+            const terminalChildren = cancelledPredecessor
+                ? await terminalCancelledMissionChildren(profile, root, previous, budget, {
+                    get: async (id) => payload(await session("get", { path: { id }, query: { directory: input.directory } })),
+                    children: async (id) => payload(await session("children", { path: { id }, query: { directory: input.directory } })),
+                }) : [];
             const state = await operators.prepareMission(root, plan, actor === root ? undefined
-                : { sessionID: actor, callID: mission.callID }, mission.supersededRunID);
+                : { sessionID: actor, callID: mission.callID }, mission.supersededRunID, terminalChildren);
             await restorePriorAcceptance(root, state);
             await control.registerGoalDeclaration(root, state.units[0].task.prompt, true);
             control.enableUnits(root, state.units.filter(unit => unit.status === "pending").length);
@@ -1193,7 +1249,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                 const task = risk.length === 0 ? null : { subagent_type: profileAgent(profile, "dog-reviewer"),
                     description: `🔎 ${run.units[0].unit.title}`, prompt: [
                         `candidate_id: ${mission.id}`, `review_phase: ${phase}`, "canonical_validation_exit: 0", `risk_tags: [${risk.join(", ")}]`,
-                        "Review this candidate independently. Use the language of the requirements/traces. Invoke no tools. First line: exactly PASS or FINDINGS.",
+                        "Review this candidate independently. Use the language of the requirements/traces. Invoke no tools. First line: exactly PASS, FINDINGS or EVIDENCE_GAPS.",
+                        "Use EVIDENCE_GAPS only when no finding establishes a source/test defect and every finding is proof the supplied artifact cannot settle, including process history later established on the base. Any concrete defect uses FINDINGS.",
                         `acceptance: ${JSON.stringify(run.acceptance)}`, `changedLogicSummary: ${JSON.stringify(traces)}`,
                         ...run.acceptance.map((_, i) => `acceptance[${i}] -> changedLogicSummary[${i}]`),
                         `manifest: ${JSON.stringify(run.units.map(unit => unit.unit))}`, `sourceFingerprint: ${source.fingerprint}`,
@@ -1202,13 +1259,14 @@ export function createProfiledPlugin(profile, assetVersion) {
                     ].join("\n") };
                 const reviewed = await missions.update(root, item => {
                     item.review = { runID: run.runID, risk: risk, source: source.fingerprint,
-                        task, verdict: task ? "pending" : "skipped-low-risk", ...(mission.review?.child ? { child: mission.review.child } : {}) };
+                        task, verdict: task ? "pending" : "skipped-low-risk", ...(mission.review?.child ? { child: mission.review.child } : {}),
+                        ...(mission.review?.evidenceGapReviews ? { evidenceGapReviews: mission.review.evidenceGapReviews } : {}) };
                 });
                 return JSON.stringify(task ? { status: "review-required", task: missionReviewTask(reviewed) } : { status: "skipped-low-risk" });
             } };
         async function assertMissionReview(root, mission) {
             const run = await operators.required(root), review = mission.review;
-            if (!review || review.runID !== run.runID || !["PASS", "skipped-low-risk"].includes(review.verdict) ||
+            if (!review || review.runID !== run.runID || !missionReviewAccepted(review) ||
                 review.source !== (await missionReviewSource(input.directory, run)).fingerprint)
                 throw new Error("mission-review-required-or-stale");
         }
@@ -1736,13 +1794,23 @@ export function createProfiledPlugin(profile, assetVersion) {
                         const history = child ? await messages(child) : [];
                         const last = [...history].reverse().find(message => (record(message.info) ? message.info.role : message.role) === "assistant");
                         const text = Array.isArray(last?.parts) ? last.parts.filter(record).filter(part => part.type === "text").map(part => part.text).join("\n") : String(raw);
-                        await missions.update(ownership.root, mission => {
+                        const independent = who?.role === "dog-reviewer" && who.parent === ownership.actor;
+                        const reviewed = await missions.update(ownership.root, mission => {
                             if (mission.review) {
                                 mission.review.result = text.slice(0, 16_000);
-                                mission.review.verdict = /^\s*PASS(?:\s|$)/u.test(text) && who?.role === "dog-reviewer" && who.parent === ownership.actor ? "PASS" : "findings";
+                                const verdict = missionReviewVerdict(text);
+                                mission.review.verdict = independent ? verdict : "findings";
+                                if (mission.review.verdict === "evidence-gaps")
+                                    mission.review.evidenceGapReviews = (mission.review.evidenceGapReviews ?? 0) + 1;
                                 mission.review.child = child;
                             }
                         });
+                        if (reviewed.review?.verdict === "evidence-gaps" && typeof output.output === "string") {
+                            const count = reviewed.review.evidenceGapReviews ?? 0;
+                            output.output += missionReviewAccepted(reviewed.review)
+                                ? `\n\nHOST: evidence-gap review ${count}/${MISSION_EVIDENCE_GAP_REVIEW_LIMIT} reached the limit. No defect was found; submit_mission ready is permitted. List the remaining evidence gaps in the summary.`
+                                : `\n\nHOST: evidence-gap review ${count}/${MISSION_EVIDENCE_GAP_REVIEW_LIMIT}. No defect was found; supply the requested evidence through review_mission traces (or at most one evidence-only unit) and re-review. Do not re-implement.`;
+                        }
                     }
                     taskOwners.delete(request.callID);
                     return;
@@ -1847,8 +1915,20 @@ export function createProfiledPlugin(profile, assetVersion) {
             },
             "experimental.chat.system.transform": async (request, output) => {
                 const root = await rootFor(request.sessionID) ?? await proposalPromptRoot(request.sessionID);
-                if (!root)
+                if (!root) {
+                    const who = await identity(request.sessionID);
+                    if (who.parent === undefined && who.role === undefined &&
+                        (await missions.read(request.sessionID))?.phase === "cancelled") {
+                        // OpenCode retains the same conversation when the user switches agents. A prior
+                        // INTERRUPTED report describes only its Sortie run; it cannot revoke Build's
+                        // native tools or turn a new independent request into a cancelled mission.
+                        (output.system ??= []).push("SORTIE_PROFILE_INACTIVE: This is a non-Sortie agent. " +
+                            "Any earlier INTERRUPTED mission or cancelled operator run in this session is historical state of the Sortie profile, " +
+                            "not a restriction on this agent's current user request. Use the current agent's native tools for independent work. " +
+                            "Do not revive, overwrite or claim completion of that historical Sortie run.");
+                    }
                     return;
+                }
                 await core["experimental.chat.system.transform"]?.(request, output);
                 (output.system ??= []).push(`SORTIE_RUNTIME_PROFILE ${profile.id}; marker ${assetVersion}. ` +
                     `Shared MkII protocol role names are logical: ${protocolMap}. Use only ${profile.toolPrefix} tools for this profile. ` +

package/dist/plugin/runtime-bridge.d.ts

@@ -27,6 +27,7 @@ export interface RuntimeBridge {
     continuationCheckpoint?(rootSessionID: string): Promise<string | undefined>;
     requiresExplicitAcceptance?(rootSessionID: string): Promise<boolean>;
     ownsCanonicalValidation?(rootSessionID: string, unitID: string, childSessionID: string, command: string): Promise<boolean>;
+    onHostHandoffRepaired?(rootSessionID: string, taskID: string, handoffPath: string, original: string, repaired: string): Promise<void>;
     allowsInvestigativeShell?(sessionID: string): Promise<boolean>;
     onSerialSettlement?(settlement: SerialDispatchSettlement): Promise<void>;
     onRootTerminal?(rootSessionID: string, receipt: GoalTerminalReceipt): Promise<void>;

package/dist/plugin/v2.js

@@ -63,13 +63,14 @@ function legacyMessage(value, session, agent) {
     if (!record(value) || typeof value.id !== "string" || typeof value.type !== "string")
         return undefined;
     const id = value.id;
+    const originalAgent = record(value.metadata) ? string(value.metadata.agent) ?? agent : agent;
     if (value.type === "user") {
-        return { info: { id, sessionID: session, role: "user", agent, time: value.time },
+        return { info: { id, sessionID: session, role: "user", agent: originalAgent, time: value.time },
             parts: [{ id: `${id}-text`, sessionID: session, messageID: id, type: "text", text: String(value.text ?? "") }] };
     }
     if (value.type !== "assistant") {
         if (value.type === "synthetic")
-            return { info: { id, sessionID: session, role: "user", agent, time: value.time },
+            return { info: { id, sessionID: session, role: "user", agent: originalAgent, time: value.time },
                 parts: [{ id: `${id}-text`, sessionID: session, messageID: id, type: "text", text: String(value.text ?? ""), synthetic: true }] };
         return undefined;
     }

package/dist/runtime-assets-v010.js

@@ -432,13 +432,20 @@ routes separately from mutation routes; an enumeration justified only by the req
 covers mutation routes while leaving creation routes unlisted, is incomplete. Require the value representations
 that reach the rule to be listed too, and require each trace to exercise the form with the new rule active; a
 trace whose case leaves the new rule inactive evidences only the pre-existing behavior. A missing enumeration, an
-excluded form without a reason, or an enumerated form without a trace is a concrete finding, never PASS.
-Report it as an evidence gap when the supplied excerpts cannot settle the form.
+excluded form without a reason, or an enumerated form without a trace is never PASS. When the supplied
+excerpts cannot settle the form and no defect is established, it is an evidence gap, not a FINDINGS defect.
 
 Reject a matrix that lists independent syntax or dispatch dimensions but traces them only in isolation. Require
 the material combinations that can select different branches, including cardinality with optional-clause
 presence, scope, and value representation where applicable. For a multi-target route, require evidence for every
 target; proving only the first target is a concrete asymmetry finding.
+
+## Mission review verdict
+
+Start with exactly one of PASS, FINDINGS or EVIDENCE_GAPS. Use FINDINGS when any finding establishes a
+source/test defect or an observed behavior contradicting an acceptance item. Use EVIDENCE_GAPS when every finding
+is proof the artifact cannot settle: a missing excerpt, trace, enumeration, or process history later established
+on the base. List all gaps you see in one response rather than one per round; the host bounds evidence rounds.
 `;
 export const runtimeAssets = Object.freeze([
     ...canonicalAssets.map((asset) => {

package/dist/runtime-mission-assets.d.ts

@@ -1,4 +1,6 @@
 import { type RuntimeProfile } from "./core/runtime-profile.ts";
+/** Repository-local dependency environment shared by all units; excluded from reviewed and captured source. */
+export declare const TOOL_ENVIRONMENT = ".sortie-env";
 export declare function missionOperatorContent(profile: RuntimeProfile, version: string): string;
 export declare function missionCoordinatorContent(profile: RuntimeProfile, version: string): string;
 export declare function missionWorkerContent(profile: RuntimeProfile): string;

package/dist/runtime-mission-assets.js

@@ -1,6 +1,8 @@
 import { profileAgent } from "./core/runtime-profile.js";
 import { STRATEGY_TRIGGERS, SOURCE_REVIEW_RISK_TAGS } from "./core/consultation.js";
 import { SCOUT_EVIDENCE_CODES } from "./core/scout-contract.js";
+/** Repository-local dependency environment shared by all units; excluded from reviewed and captured source. */
+export const TOOL_ENVIRONMENT = ".sortie-env";
 function controls(profile, names) {
     return names.map(name => `  ${profile.toolPrefix}${name}: true`).join("\n");
 }
@@ -36,8 +38,9 @@ quality threshold and explicit model/budget choice. Follow AGENTS.md and use the
    unit boundaries, Worker/Scout/Advisor/independent Reviewer calls, write-scope extensions and corrections
    within the original request and cumulative budget. Do not investigate or approve each unit at the root.
 3. Compare the returned completion candidate against the original request, real source and observed evidence.
-   If incomplete, resume the SAME Coordinator with concrete feedback. If complete and required review passed,
-   call ${profile.toolPrefix}complete_mission. Only its succeeded receipt authorizes DONE.
+   If incomplete, resume the SAME Coordinator with concrete feedback. If complete and required review passed
+   (or the host accepted it at the evidence-gap limit, with the gaps reported), call
+   ${profile.toolPrefix}complete_mission. Only its succeeded receipt authorizes DONE.
 
 Fast-lane exception: simple, low-risk, single-unit work with known files and validation may use
 ${profile.toolPrefix}plan_units directly after start_mission, then dispatch its exact Worker task.
@@ -91,7 +94,10 @@ Investigate only enough to start the first useful Worker. Prefer a targeted read
 inventory or speculative full design. Call ${profile.toolPrefix}plan_units with concise units:
 title, objective, read/write file or directory scopes, validation commands, optionally requirement_ids.
 Keep all original requirements covered; omitted requirement_ids means all. Last validation command proves
-that unit. Host generates IDs, proof mapping, handoff, manifest and Task references. Dispatch the returned
+that unit. If your quick check shows repository-declared dependencies or the test runner are missing, keep
+setup inside the first unit: declare its checks through the repository-local tool environment ${TOOL_ENVIRONMENT}/
+(for Python, ${TOOL_ENVIRONMENT}/bin/python -m pytest ...) and let that Worker create it. Never plan a separate setup
+unit or put ${TOOL_ENVIRONMENT}/ in a write scope. Host generates IDs, proof mapping, handoff, manifest and Task references. Dispatch the returned
 ${profileAgent(profile, "dog-worker")} task verbatim, in foreground. V2 maps subagent_type to agent and
 task_id to sessionID. Do not insert model overrides unless the user explicitly selected them.
 
@@ -114,8 +120,10 @@ After formal validation, call review_mission with risk_tags and one concise impl
 requirement. Recognized tags: ${SOURCE_REVIEW_RISK_TAGS.join(", ")}.
 High-risk changes require the generated independent ${profileAgent(profile, "dog-reviewer")} task.
 Low risk uses [] and the host records the skip. The host supplies source excerpts, manifest, requirement
-mapping and validation evidence; do not handwrite that envelope. Fix concrete findings yourself through
-Worker and rerun affected validation/review. A missing excerpt calls for evidence, not an invented source bug.
+mapping and validation evidence; do not handwrite that envelope. Fix concrete FINDINGS defects yourself
+through Worker and rerun affected validation/review. EVIDENCE_GAPS means missing proof, not a defect: answer
+it with sharper traces in the next review_mission, or at most one evidence-only unit, never a re-implementation.
+The host caps evidence-only reviews; at its limit, submit ready and list the remaining gaps.
 Preserve candidate lineage and independence; your own opinion or Worker PASS is not independent review.
 
 Call submit_mission only for: ready (complete candidate with evidence/review), needs-decision (only the user
@@ -140,7 +148,8 @@ The binding remains valid throughout this Task until return or a control/source
 
 Read/search and read-only investigation commands are unrestricted. Use targeted reproduction/diagnosis
 without registering every exploratory command. All writes, generated/transient files and cleanup stay
-inside the unit's file/directory scopes. Do not write outside them through scripts or tools. If scope must
+inside the unit's file/directory scopes, except the tool environment below. Do not write outside them through
+scripts or tools. If scope must
 expand or a formal check must change, return the exact paths/command and reason to Coordinator; it can
 approve an in-request extension immediately. Do not ask the user or delegate to another agent.
 
@@ -150,6 +159,12 @@ and separate shell calls; the host records actual command, source and exit. Diag
 formal acceptance evidence. Do not repeat a failed command without a concrete source/setup correction or
 repeat passed checks on unchanged source. Add meaningful tests only when needed by the change/request.
 
+Missing repository-declared dependencies or test runner are setup, not a result. Make one bounded,
+repository-documented setup attempt in the repository-local tool environment ${TOOL_ENVIRONMENT}/ (for Python:
+python -m venv ${TOOL_ENVIRONMENT}, then install the declared dependencies with its pip), then run the checks.
+Reuse an existing ${TOOL_ENVIRONMENT}/ and never delete it; it is local tooling, not a change, and needs no write
+scope. Return to Coordinator for setup only when it is externally blocked or a formal command must change.
+
 Return changed paths and concise criterion-level implementation/test/input evidence with the real check
 results. Respect negative constraints and API success/error compatibility. A broad suite PASS does not
 alone prove every requirement; leave unproven items explicit. Never claim other units or the whole mission

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.6",
+  "version": "0.12.8",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",