sortie-dogs 0.12.8 → 0.12.10

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.8-mission-lineage-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.10-mission-continuity-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.8-mission-lineage-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.10-mission-continuity-v1";

package/dist/core/goal-bound.d.ts

@@ -37,6 +37,8 @@ export interface GoalEvidence {
         readonly manifest_path: string;
         readonly source_paths: readonly string[];
         readonly candidate_paths: readonly string[];
+        /** Missing on legacy evidence: retain its original all-paths snapshot recipe. */
+        readonly source_policy?: "project-files-v1";
     };
     readonly execution: {
         readonly command: readonly string[];

package/dist/core/goal-bound.js

@@ -61,7 +61,8 @@ export function validGoalEvidence(value, state) {
     const protectedBindingValid = protectedBinding !== undefined && HASH.test(protectedBinding.manifest_hash) &&
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
-        protectedBinding.candidate_paths.every(text);
+        protectedBinding.candidate_paths.every(text) &&
+        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1");
     const matches = criteria.length > 0 && criteria.length === value.measurement.criterion_ids.length &&
         criteria.every((criterion) => criterion.target === value.measurement.target &&
             criterion.entrypoint === value.measurement.entrypoint && criterion.workload === value.measurement.workload &&

package/dist/core/initialize.js

@@ -379,8 +379,14 @@ async function v010Config(root, global) {
     }
     const options = { formattingOptions: { insertSpaces: true, tabSize: 2 } };
     const update = (path, value) => { content = applyEdits(content, modify(content, path, value, options)); };
-    if (!plugins?.some(item => item === "sortie-dogs" ||
-        (item !== null && typeof item === "object" && item.package === "sortie-dogs"))) {
+    const wrapper = `${prefix}plugins/sortie-dogs/index.js`;
+    const wrapperSource = await readFile(resolve(root, wrapper), "utf8").catch(() => "");
+    const localV2Wrapper = /^\s*export\s*\{\s*default\s*\}\s*from\s*["']sortie-dogs\/server["'];?\s*$/u.test(wrapperSource);
+    const registered = plugins?.some(item => {
+        const name = typeof item === "string" ? item : item !== null && typeof item === "object" ? item.package : undefined;
+        return typeof name === "string" && /^sortie-dogs(?:@[^/]+)?$/u.test(name);
+    });
+    if (!localV2Wrapper && !registered) {
         update(["plugins"], [...(plugins ?? []), "sortie-dogs"]);
     }
     if (depth === undefined || depth < 2)

package/dist/core/operator-mission.d.ts

@@ -40,6 +40,7 @@ export interface OperatorMission {
         risk: string[];
         source: string;
         task: OperatorTask | null;
+        requestFingerprint?: string;
         verdict: "pending" | "PASS" | "findings" | "evidence-gaps" | "skipped-low-risk";
         result?: string;
         child?: string;
@@ -75,8 +76,8 @@ export declare class OperatorMissionRuntime {
     capture(root: string, request: MissionRequest): Promise<void>;
     start(root: string, requirements: unknown): Promise<OperatorMission>;
     update(root: string, change: (state: OperatorMission) => void): Promise<OperatorMission>;
-    /** Keep a cancelled same-turn run's host-accepted criteria ahead of new mission text. */
-    carryForward(root: string, missionID: string, acceptance: readonly string[]): Promise<OperatorMission>;
+    /** Keep host-accepted criteria ahead of new text, including an exactly linked settled predecessor. */
+    carryForward(root: string, missionID: string, acceptance: readonly string[], supersededRunID?: string): Promise<OperatorMission>;
     task(state: OperatorMission): OperatorTask;
     admit(root: string, callID: string, args: Record<string, unknown>): Promise<OperatorMission>;
     /** Reopen only the exact dispatch whose native Task has a terminal record after a server restart. */

package/dist/core/operator-mission.js

@@ -201,10 +201,10 @@ export class OperatorMissionRuntime {
             return state;
         });
     }
-    /** Keep a cancelled same-turn run's host-accepted criteria ahead of new mission text. */
-    carryForward(root, missionID, acceptance) {
+    /** Keep host-accepted criteria ahead of new text, including an exactly linked settled predecessor. */
+    carryForward(root, missionID, acceptance, supersededRunID) {
         return this.update(root, state => {
-            if (state.id !== missionID || state.supersededRunID !== undefined || state.runID !== null ||
+            if (state.id !== missionID || state.supersededRunID !== supersededRunID || state.runID !== null ||
                 !["open", "running"].includes(state.phase) || (state.dispatchOpen && state.coordinator === null) ||
                 acceptance.length === 0 || acceptance.some(text => typeof text !== "string" || !text.trim())) {
                 throw new Error("mission-acceptance-carry-forward-unavailable");
@@ -229,7 +229,11 @@ export class OperatorMissionRuntime {
             const resume = state.coordinator !== null && args.task_id === state.coordinator && typeof args.prompt === "string" && args.prompt.trim();
             if (["cancelled", "completed"].includes(state.phase) || state.dispatchOpen || args.subagent_type !== expected.subagent_type ||
                 (!resume && (args.prompt !== expected.prompt || args.description !== expected.description || args.task_id))) {
-                throw new Error("mission-dispatch-not-authorized");
+                const reason = ["cancelled", "completed"].includes(state.phase) ? `mission is ${state.phase}`
+                    : state.dispatchOpen ? "Coordinator Task is still admitted; read operator_status to reconcile its native completion"
+                        : args.task_id && args.task_id !== state.coordinator ? `this location owns Coordinator ${state.coordinator ?? "not yet claimed"}, not ${String(args.task_id)}`
+                            : "use the exact Coordinator task returned by operator_status in this mission's project_root";
+                throw new Error(`mission-dispatch-not-authorized: ${reason}`);
             }
             state.phase = "running";
             state.callID = callID;
@@ -327,21 +331,30 @@ export function missionPlan(mission, raw) {
         units });
 }
 export function missionPacket(mission, run) {
+    const currentReview = mission.review !== undefined && mission.review.runID === (run?.runID ?? mission.runID);
+    const reviewAccepted = currentReview && missionReviewAccepted(mission.review);
     return { mission_id: mission.id, phase: mission.phase, coordinator_session_id: mission.coordinator,
         requirements: mission.requirements, original_request_refs: mission.requests.map(item => `user:${item.id}`),
         submission: mission.submission, progress: mission.progress,
         review: mission.review ? { risk_tags: mission.review.risk, verdict: mission.review.verdict,
+            run_id: mission.review.runID, current_run: currentReview,
             source_fingerprint: mission.review.source, reviewer_session_id: mission.review.child ?? null,
             result: mission.review.result ?? null, evidence_gap_reviews: mission.review.evidenceGapReviews ?? 0,
-            evidence_gap_review_limit: MISSION_EVIDENCE_GAP_REVIEW_LIMIT, accepted: missionReviewAccepted(mission.review) } : null,
+            evidence_gap_review_limit: MISSION_EVIDENCE_GAP_REVIEW_LIMIT, accepted: reviewAccepted,
+            passed: currentReview && mission.review.verdict === "PASS", permits_submission: reviewAccepted } : null,
         ...(run ? { run_id: run.runID, status: run.phase, decision: run.decision,
             units: run.units.map(unit => ({ id: unit.unit.id, title: unit.unit.title, status: unit.status,
                 child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence })) } : {}),
-        next_action: run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
-            : run?.phase === "awaiting-acceptance" ? (mission.review?.verdict === "evidence-gaps" && !missionReviewAccepted(mission.review)
-                ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
-                : "Coordinator: obtain required independent review, then submit_mission. Operator: compare all requirements with source/evidence before complete_mission.")
-                : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
+        next_action: mission.phase === "completed" ? "Mission completed. Report the accepted result and retained review gaps; no further dispatch or completion call is needed."
+            : mission.phase === "submitted" && mission.submission?.status === "ready"
+                ? "Operator: compare the submitted candidate with the original requirements and actual evidence, then complete_mission if satisfied. Report remaining evidence gaps; they are not a review PASS."
+                : run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
+                    : run?.phase === "awaiting-acceptance" ? (currentReview && mission.review?.verdict === "evidence-gaps" && !reviewAccepted
+                        ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
+                        : reviewAccepted
+                            ? "Coordinator: review permits submission. Submit the candidate with any remaining gaps; do not repeat passed validation or review. Operator performs final acceptance."
+                            : "Coordinator: address recorded findings or obtain the required independent review, then submit_mission. Operator compares all requirements with source/evidence before complete_mission.")
+                        : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
 }
 /** Models forward a short capability, never recopy the host's evidence hashes and source packet. */
 export function missionReviewTask(mission) {

package/dist/core/operator-runtime.d.ts

@@ -207,6 +207,8 @@ export interface OperatorState {
     decision: string | null;
     receipt: GoalTerminalReceipt | null;
 }
+/** A later mission may replace an unexecuted cancellation, but must retain settled work's acceptance. */
+export declare function cancelledMissionRetainsAcceptance(state: OperatorState): boolean;
 export declare function operatorGitPathAuthorized(path: string, scopes: readonly string[], platform?: NodeJS.Platform): boolean;
 export declare function parseOperatorPlan(value: unknown): OperatorPlan;
 /** Root-owned durable queue. It never executes code, changes acceptance, or accepts a candidate. */
@@ -246,7 +248,11 @@ export declare class OperatorRuntime {
         sessionID: string;
         callID: string;
     }, supersededRunID?: string, terminalChildren?: readonly string[]): Promise<OperatorState>;
-    retireMissionRun(root: string): Promise<void>;
+    /** Stage a settled mission's replacement; rejected preparation never cancels the usable run. */
+    replanMission(root: string, runID: string, raw: unknown, dispatcher?: {
+        sessionID: string;
+        callID: string;
+    }): Promise<OperatorState>;
     private prepareOnce;
     operatorTask(state: OperatorState): OperatorTask;
     /** Root-visible handle for the bounded operations delegate; its contract stays host-internal. */

package/dist/core/operator-runtime.js

@@ -32,6 +32,11 @@ const REPAIR_VALIDATION_STALE_PROOF_DECISION = "operator-contract-repair-validat
 const PROCESS_REPLACEMENT_DECISION = "operator-process-remediation-replacement-required";
 const ACCEPTANCE_REMEDIATION_DECISION = "operator-acceptance-remediation-required";
 const REVIEW_REMEDIATION_DECISION = "operator-review-remediation-required";
+/** A later mission may replace an unexecuted cancellation, but must retain settled work's acceptance. */
+export function cancelledMissionRetainsAcceptance(state) {
+    return state.phase === "cancelled" && (state.decision === "agent-changed" || state.priorAcceptedUnits.length > 0 ||
+        state.units.some(unit => ["succeeded", "failed"].includes(unit.status) || unit.evidence.length > 0));
+}
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const hash = (value) => createHash("sha256").update(value).digest("hex");
 const identifier = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);
@@ -170,7 +175,7 @@ export function parseOperatorPlan(value) {
     for (const [unitIndex, unit] of value.units.entries()) {
         if (!record(unit) || !exactKeys(unit, ["id", "title", "objective", "read", "write", "validation", "acceptance_indices"]) ||
             !identifier(unit.id) || ids.has(unit.id) || !text(unit.title) || !text(unit.objective) ||
-            !strings(unit.read) || !strings(unit.write, true) || !strings(unit.validation, true))
+            !strings(unit.read) || !strings(unit.write) || !strings(unit.validation, true))
             return planError(`/units/${unitIndex}`, "operator-unit-invalid", "operator-unit-shape");
         unit.validation.forEach((command, index) => rejectValidationAnnotation(command, `/units/${unitIndex}/validation/${index}`));
         ids.add(unit.id);
@@ -681,19 +686,9 @@ export class OperatorRuntime {
     prepareMission(root, raw, dispatcher, supersededRunID, terminalChildren = []) {
         return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, supersededRunID, terminalChildren }));
     }
-    retireMissionRun(root) {
-        return this.serial(root, async () => {
-            const state = await this.required(root);
-            if (state.units.some(unit => unit.status === "running") || state.gitLifecycle !== null)
-                throw new Error("mission-replan-worker-still-active");
-            if (["cancelled", "completed"].includes(state.phase))
-                return;
-            // Keep the old run and proof for inspection. Replanning does not erase failed checks or spend.
-            await writeFile(`${this.file(root)}.${state.runID}.archive`, JSON.stringify(state), { flag: "wx", mode: 0o600 });
-            state.phase = "cancelled";
-            state.decision = "mission-replan";
-            await this.save(state);
-        });
+    /** Stage a settled mission's replacement; rejected preparation never cancels the usable run. */
+    replanMission(root, runID, raw, dispatcher) {
+        return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, replaceRunID: runID }));
     }
     async prepareOnce(root, raw, scopeApprovalTurnID, mission) {
         const previous = await this.read(root);
@@ -720,6 +715,16 @@ export class OperatorRuntime {
         }
         const plan = parseOperatorPlan(immutableReplacement);
         const validatedPlanHash = hash(JSON.stringify(plan));
+        const replanning = mission?.replaceRunID !== undefined;
+        if (replanning) {
+            if (!previous || previous.runID !== mission.replaceRunID || ["cancelled", "completed"].includes(previous.phase)) {
+                throw new Error("mission-replan-run-mismatch");
+            }
+            if (previous.units.some(unit => unit.status === "running") || previous.gitLifecycle !== null)
+                throw new Error("mission-replan-worker-still-active");
+            if (previous.planHash === validatedPlanHash)
+                return previous;
+        }
         if (mission?.supersededRunID !== undefined && previous?.supersededRunID === mission.supersededRunID &&
             previous.planHash === validatedPlanHash && previous.phase !== "cancelled")
             return previous;
@@ -728,29 +733,36 @@ export class OperatorRuntime {
         if (mission?.supersededRunID !== undefined && !superseding)
             throw new Error("mission-superseded-run-mismatch");
         const terminalChildren = mission?.terminalChildren ?? [];
-        const cancelledChildren = previous?.units.flatMap(unit => unit.status === "cancelled" && unit.childSessionID !== null
+        const retainAcceptance = previous !== undefined && cancelledMissionRetainsAcceptance(previous);
+        const predecessorChildren = previous?.units.flatMap(unit => unit.childSessionID !== null
             ? [unit.childSessionID] : []) ?? [];
-        if (superseding && previous && (previous.decision !== "explicit-cancellation" || previous.gitLifecycle !== null ||
-            previous.repairResidualPaths.length > 0 || previous.priorAcceptedUnits.length > 0 ||
-            terminalChildren.length !== cancelledChildren.length || new Set(terminalChildren).size !== terminalChildren.length ||
-            cancelledChildren.some(id => !terminalChildren.includes(id)) || previous.units.some(unit => !["pending", "cancelled"].includes(unit.status) || unit.evidence.length > 0 || unit.resultClass !== null ||
-            unit.repairValidation !== null || (unit.status === "pending" && (unit.callID !== null || unit.childSessionID !== null)) ||
+        if (superseding && previous && (!["explicit-cancellation", "agent-changed"].includes(previous.decision ?? "") || previous.gitLifecycle !== null ||
+            previous.repairResidualPaths.length > 0 || previous.contractRepair !== null ||
+            terminalChildren.length !== predecessorChildren.length || new Set(terminalChildren).size !== terminalChildren.length ||
+            predecessorChildren.some(id => !terminalChildren.includes(id)) || previous.units.some(unit => !(retainAcceptance ? ["pending", "cancelled", "succeeded", "failed"] : ["pending", "cancelled"]).includes(unit.status) ||
+            (!retainAcceptance && (unit.evidence.length > 0 || unit.resultClass !== null)) ||
+            unit.repairValidation !== null || (unit.status === "pending" && (unit.callID !== null || unit.childSessionID !== null ||
+            unit.evidence.length > 0 || unit.resultClass !== null)) ||
+            (unit.status === "succeeded" && (unit.childSessionID === null || unit.callID === null || unit.evidence.length === 0 || unit.resultClass !== "acceptance")) ||
             (unit.status === "cancelled" && (unit.childSessionID === null || unit.callID === null))))) {
             throw new Error("mission-superseded-run-has-work: reconcile prior workers and evidence before changing acceptance");
         }
         if (plan.git_lifecycle !== undefined) {
             await ensureGitManagedStateExcluded(this.projectRoot, this.profile, this.gitPath);
         }
-        if (previous && !["completed", "cancelled"].includes(previous.phase)) {
+        if (previous && !replanning && !["completed", "cancelled"].includes(previous.phase)) {
             if (previous.planHash === validatedPlanHash)
                 return previous;
             throw new Error("operator-active-contract-immutable");
         }
         // Cancellation stops execution, not the accepted user order. A replacement
         // plan must carry the original ordered criteria; only a completed root clears them.
-        const parent = !superseding && previous?.phase === "cancelled" ? previous : undefined;
-        if (parent?.decision === "explicit-cancellation") {
-            const cancelled = parent.units.flatMap(unit => unit.status === "cancelled" && unit.childSessionID !== null
+        // Treat the predecessor as retired only in this staged replacement. Its durable state remains
+        // intact through schema checks, control writes and archive creation, until save atomically switches it.
+        const parent = replanning ? { ...previous, phase: "cancelled", decision: "mission-replan" }
+            : (!superseding || retainAcceptance) && previous?.phase === "cancelled" ? previous : undefined;
+        if (parent && ["explicit-cancellation", "agent-changed"].includes(parent.decision ?? "")) {
+            const cancelled = parent.units.flatMap(unit => (parent.decision === "agent-changed" || unit.status === "cancelled") && unit.childSessionID !== null
                 ? [unit.childSessionID] : []);
             if (cancelled.length > 0 && (new Set(terminalChildren).size !== terminalChildren.length ||
                 cancelled.some(id => !terminalChildren.includes(id)))) {
@@ -888,13 +900,15 @@ export class OperatorRuntime {
             const contents = [JSON.stringify(handoff), JSON.stringify(manifest)];
             controls.push({ path: handoffPath, content: contents[0] }, { path: manifestPath, content: contents[1] });
             const prompt = ["role: implementation", `task_id: ${taskID}`, `project_root: ${this.projectRoot}`,
-                `source_manifest: ${unit.write.join(", ")}`, `operation_manifest: ${manifestRelative}`, `handoff_path: ${handoffPath}`,
+                `source_manifest: ${(unit.write.length ? unit.write : unit.read).join(", ") || "none"}`, `operation_manifest: ${manifestRelative}`, `handoff_path: ${handoffPath}`,
                 `goal_declaration_path: ${declarationPath}`, "acceptance:", ...plan.acceptance.map(value => `  - ${value}`),
                 "validation:", ...unit.validation.map(value => `  - ${value}`),
                 mission ? "Read-only investigation commands are unrestricted. Use shell to reproduce and diagnose without asking for command registration. Keep all writes, including generated/transient outputs and cleanup, inside unit.write. Run formal validation exactly as listed, in order and in separate calls, so the host records its real result. If a write scope or formal check must change, return the precise change to your Coordinator; it can extend/redeclare immediately within the original requirements. Diagnostic success is not formal acceptance evidence."
                     : "Execute validation in its declared order. Earlier entries may be approved generator, build, formatter, or exact cleanup commands required before canonical criterion tests. Every persistent or transient generator output must be declared in unit.write. Cleanup may remove only declared unit.write outputs and must be an explicit ordered command after generation and before post-commit or canonical validation; never add an ignore rule or remove an undeclared path. If any necessary command, input, output, or cleanup is missing, do not run an undeclared command or variant and do not use resume evidence tooling to invent permission; return a contract-repair decision.",
                 "Preserve existing public API success and error return semantics unless acceptance explicitly changes them, and cover those compatibility boundaries in the declared validation.",
-                "Do not spawn nested subagents for consultation. Required consultations belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If required consultation results or user decisions are missing, return the exact contract gap to the parent instead of attempting a deeper Task, inventing consent, or asking the user to repeat an already recorded decision.",
+                mission
+                    ? "Do not spawn nested subagents for consultation. Required technical or user decisions that must precede implementation belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If a required prior decision is missing, return the exact contract gap to the parent instead of implementing dependent changes, inventing consent, or asking the user to repeat an already recorded decision. Independent SourceReview is a separate post-implementation and post-validation review: do not require it before implementation or formal validation, and do not stop this Task solely because it has not yet occurred. Complete the assigned implementation and all listed formal validation commands, then return the real evidence so the Coordinator can dispatch the independent review_mission with applicable risk_tags (for example, public-logic). Do not conduct or delegate that independent review yourself. Reflect supplied prior Reviewer FINDINGS within this unit's scope."
+                    : "Do not spawn nested subagents for consultation. Required consultations belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If required consultation results or user decisions are missing, return the exact contract gap to the parent instead of attempting a deeper Task, inventing consent, or asking the user to repeat an already recorded decision.",
                 ...(plan.git_lifecycle !== undefined && index === plan.units.length - 1 ? [
                     `git_post_commit_validation: ${JSON.stringify(plan.git_lifecycle.post_commit_validation)}`,
                     "Complete every source write before invoking any git_post_commit_validation command. Its first exact invocation is the host commit boundary; after it, source mutation and undeclared shell commands are denied. Run every listed command and return its real evidence.",
@@ -935,10 +949,19 @@ export class OperatorRuntime {
                     await handle.close();
                 }
             }
-            if (superseding && previous) {
-                const archive = `${this.file(root)}.${previous.runID}.archive`;
+            if ((superseding || replanning) && previous) {
+                // A crash before the state switch may leave a checkpoint while the old run later advances.
+                // Sequence-qualified replan snapshots keep that history without blocking a subsequent correction.
+                const archive = `${this.file(root)}.${previous.runID}${replanning ? `.${previous.sequence}` : ""}.archive`;
                 try {
-                    await writeFile(archive, JSON.stringify(previous), { flag: "wx", mode: 0o600 });
+                    const handle = await open(archive, "wx", 0o600);
+                    created.push(archive);
+                    try {
+                        await handle.writeFile(JSON.stringify(previous));
+                    }
+                    finally {
+                        await handle.close();
+                    }
                 }
                 catch (error) {
                     if (error.code !== "EEXIST" ||

package/dist/plugin/goal-completion.d.ts

@@ -0,0 +1,17 @@
+import { type GoalEvidence, type GoalFlightState } from "../core/goal-bound.js";
+export interface CompletionBlocker {
+    readonly reason: "active-reservations" | "missing-contract" | "missing-evidence" | "missing-binding" | "snapshot-unavailable" | "source-changed" | "candidate-changed";
+    readonly criterion_id?: string;
+    readonly source_paths?: readonly string[];
+    readonly candidate_paths?: readonly string[];
+    readonly expected?: string;
+    readonly actual?: string;
+    readonly legacy_control_snapshot?: boolean;
+    readonly next_action: string;
+}
+export interface CompletionReadiness {
+    readonly ready: boolean;
+    readonly blockers: readonly CompletionBlocker[];
+}
+/** The same read-only decision drives completion and public status, without settling or rerunning work. */
+export declare function goalCompletionReadiness(state: GoalFlightState, evidence: readonly GoalEvidence[]): Promise<CompletionReadiness>;

package/dist/plugin/goal-completion.js

@@ -0,0 +1,55 @@
+import { validGoalEvidence } from "../core/goal-bound.js";
+import { isRuntimeControlPath, refreshProtectedSnapshot } from "./protected-snapshot.js";
+/** The same read-only decision drives completion and public status, without settling or rerunning work. */
+export async function goalCompletionReadiness(state, evidence) {
+    const blockers = [];
+    if (state.outstanding_reservations.length)
+        blockers.push({ reason: "active-reservations",
+            next_action: "Reconcile the outstanding native tasks before acceptance; do not repeat completion while work is reserved." });
+    if (!state.goal_id || !state.acceptance_fingerprint || !state.acceptance_contract?.criteria.length) {
+        blockers.push({ reason: "missing-contract", next_action: "Restore the current run's registered goal and unchanged requirements before completion." });
+    }
+    const snapshots = new Map();
+    for (const criterion of state.acceptance_contract?.criteria ?? []) {
+        const proof = [...evidence].reverse().find(entry => entry.measurement.criterion_ids.includes(criterion.criterion_id) && validGoalEvidence(entry, state));
+        if (!state.satisfied_criteria.includes(criterion.criterion_id) || !proof) {
+            blockers.push({ reason: "missing-evidence", criterion_id: criterion.criterion_id,
+                next_action: "Coordinator: obtain the missing criterion evidence within the existing requirements and cumulative budget; retain already valid checks." });
+            continue;
+        }
+        if (criterion.source_binding !== "current-protected" && criterion.candidate_binding !== "current-protected")
+            continue;
+        const binding = proof.protected_binding;
+        if (!binding) {
+            blockers.push({ reason: "missing-binding", criterion_id: criterion.criterion_id,
+                next_action: "Coordinator: obtain host-observed validation bound to this criterion; prose cannot replace a missing snapshot." });
+            continue;
+        }
+        const key = JSON.stringify(binding);
+        let pending = snapshots.get(key);
+        if (!pending) {
+            pending = refreshProtectedSnapshot(binding.project_root, binding).catch(() => undefined);
+            snapshots.set(key, pending);
+        }
+        const current = await pending;
+        const scope = { criterion_id: criterion.criterion_id, source_paths: binding.source_paths, candidate_paths: binding.candidate_paths };
+        if (!current) {
+            blockers.push({ ...scope, reason: "snapshot-unavailable",
+                next_action: "Inspect the pinned manifest and declared paths for missing, changed or unreadable files. Correct the identified cause before validation or completion; do not retry unchanged." });
+            continue;
+        }
+        if (criterion.source_binding === "current-protected" && current.source !== proof.identity.source) {
+            const legacy = !binding.source_policy && binding.source_paths.some(path => path === "" || path === "." || isRuntimeControlPath(path));
+            blockers.push({ ...scope, reason: "source-changed", expected: proof.identity.source, actual: current.source,
+                ...(legacy ? { legacy_control_snapshot: true } : {}),
+                next_action: legacy
+                    ? "Legacy evidence includes mutable runtime/Git records. Coordinator: obtain fresh evidence with the current snapshot policy in the same mission and cumulative budget. Do not edit the ledger, reset requirements, or repeat completion unchanged."
+                    : "Coordinator: inspect the changed source scopes and validate only the affected criterion after the candidate is settled; do not repeat unrelated passed checks or completion unchanged." });
+        }
+        if (criterion.candidate_binding === "current-protected" && current.candidate !== proof.identity.candidate) {
+            blockers.push({ ...scope, reason: "candidate-changed", expected: proof.identity.candidate, actual: current.candidate,
+                next_action: "Coordinator: the declared output changed after validation. Validate the intended current candidate and update its review before final acceptance; do not repeat completion unchanged." });
+        }
+    }
+    return { ready: blockers.length === 0, blockers };
+}

package/dist/plugin/index.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { GOAL_DECLARATION_FORMAT, GOAL_DELIVERY_INTENTS, GOAL_DELIVERY_MODES, GOAL_CRITERION_ENUMS, expandGoalDeclaration } from "../core/goal-declaration-format.js";
@@ -18,7 +18,7 @@ import { admitLunaFabric } from "../core/luna-fabric-contract.js";
 import { summarizeExperienceEvidence } from "../core/experience-evidence-summary.js";
 import { selectExperienceRoute } from "../core/experience-route-policy.js";
 import { resolveExperienceRouting } from "../core/experience-routing-runtime.js";
-import { normalizeManifestPath, normalizeRelativePath, RelativePathError } from "../core/path.js";
+import { normalizeRelativePath, RelativePathError } from "../core/path.js";
 import { ScopeLeaseError, ScopeLeaseRegistry } from "../core/scope-lease-registry.js";
 import { produceWorktreeCommitArtifact, recoverWorktreeCommitArtifact, resolveValidationExecutable, WorktreeCommitArtifactError, } from "../core/worktree-commit-artifact.js";
 import { normalizeWorktreeScope } from "../core/worktree-scope.js";
@@ -51,6 +51,8 @@ import { collectRunMetrics, createSortieResult, createGoalReport, insertRunMetri
 import { STABLE_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { evidenceFromObservedExecution } from "../core/observed-goal-evidence.js";
 import { receiptBoundTerminalText } from "./receipt-presentation.js";
+import { protectedSnapshot, refreshProtectedSnapshot } from "./protected-snapshot.js";
+import { goalCompletionReadiness } from "./goal-completion.js";
 const INPUT_LIMITS = { config: 64 * 1024, manifest: 512 * 1024, handoff: 2 * 1024 * 1024, parallel: 512 * 1024 };
 const INSPECTION_CACHE = { maximum: 256, ttlMilliseconds: 30 * 60 * 1000 };
 const ACTIVE_SESSION_CACHE = { maximum: 256, ttlMilliseconds: 30 * 60 * 1000 };
@@ -233,94 +235,6 @@ async function durableScopeRoot(projectRoot) {
         return undefined;
     }
 }
-async function protectedScopeDigest(projectRoot, paths, manifestHash) {
-    const entries = [];
-    const canonicalRoot = await realpath(projectRoot);
-    const visit = async (absolute) => {
-        const scoped = relative(projectRoot, absolute).replaceAll("\\", "/");
-        if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
-            return false;
-        const metadata = await lstat(absolute).catch((error) => {
-            if (isRecord(error) && error.code === "ENOENT")
-                return undefined;
-            throw error;
-        });
-        if (metadata === undefined) {
-            entries.push([scoped, "missing"]);
-            return true;
-        }
-        if (metadata.isSymbolicLink()) {
-            // Package managers place executable links under node_modules/.bin. Record
-            // both the link and its target bytes, but never follow a link out of the
-            // project or recurse through a linked directory (which may form a cycle).
-            const target = await realpath(absolute).catch(() => undefined);
-            if (target === undefined)
-                return false;
-            const relativeTarget = relative(canonicalRoot, target);
-            if (relativeTarget === ".." || relativeTarget.startsWith("../") || isAbsolute(relativeTarget) ||
-                !(await stat(target)).isFile())
-                return false;
-            const link = await readlink(absolute);
-            const contents = await readFile(target);
-            entries.push([scoped, `symlink:${link}`, createHash("sha256").update(contents).digest("hex")]);
-            return true;
-        }
-        if (metadata.isDirectory()) {
-            entries.push([scoped, "directory"]);
-            const children = await readdir(absolute);
-            for (const child of children.sort())
-                if (!await visit(join(absolute, child)))
-                    return false;
-            return true;
-        }
-        if (!metadata.isFile())
-            return false;
-        entries.push([scoped, "file", createHash("sha256").update(await readFile(absolute)).digest("hex")]);
-        return true;
-    };
-    for (const path of [...new Set(paths)].sort())
-        if (!await visit(path))
-            return undefined;
-    return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
-}
-async function protectedSnapshot(authorization) {
-    const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
-    if (manifestSource === undefined)
-        return undefined;
-    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
-    if (manifestHash !== authorization.manifestHash)
-        return undefined;
-    const relativePath = relative(authorization.projectRoot, authorization.manifestPath).replaceAll("\\", "/");
-    const manifest = JSON.parse(manifestSource.toString("utf8"));
-    const actualPaths = (entries) => entries.map((entry) => {
-        const path = normalizeManifestPath(entry);
-        return path.kind === "relative" ? resolve(authorization.projectRoot, path.path) : resolve(path.path);
-    });
-    // Ownership keys may be case-folded even on POSIX (for example DrvFS). Hash the actual manifest paths.
-    const candidatePaths = actualPaths(manifest.write);
-    const sourcePaths = [...new Set([...actualPaths(manifest.read), ...candidatePaths])];
-    const source = await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash);
-    const candidate = await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
-    if (source === undefined || candidate === undefined || relativePath.startsWith("../") || isAbsolute(relativePath))
-        return undefined;
-    return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
-            manifest_path: relativePath,
-            source_paths: sourcePaths.map((path) => relative(authorization.projectRoot, path).replaceAll("\\", "/")),
-            candidate_paths: candidatePaths.map((path) => relative(authorization.projectRoot, path).replaceAll("\\", "/")) },
-        source, candidate };
-}
-async function refreshProtectedSnapshot(projectRoot, binding) {
-    const manifestPath = resolve(projectRoot, binding.manifest_path);
-    const manifestSource = await readFile(manifestPath).catch(() => undefined);
-    if (manifestSource === undefined)
-        return undefined;
-    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
-    if (`sha256:${manifestHash}` !== binding.manifest_hash)
-        return undefined;
-    const source = await protectedScopeDigest(projectRoot, binding.source_paths.map((path) => resolve(projectRoot, path)), manifestHash);
-    const candidate = await protectedScopeDigest(projectRoot, binding.candidate_paths.map((path) => resolve(projectRoot, path)), manifestHash);
-    return source === undefined || candidate === undefined ? undefined : { source, candidate };
-}
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1919,34 +1833,23 @@ export const SortieDogsPlugin = async (input, options) => {
                     origin_user_message_id: ticket.origin_user_message_id,
                 } } };
     }
-    async function terminalGoal(sessionID, stopReason, status, explicitAcceptance = false) {
+    async function terminalGoal(sessionID, stopReason, status, explicitAcceptance = false, onReadiness) {
         const ledger = await goalLedger(sessionID);
-        const state = (await ledger.readGoal()).state;
-        if (state.goal_id === null || state.receipt !== null || state.outstanding_reservations.length > 0 || state.acceptance_fingerprint === null)
-            return state.receipt ?? undefined;
+        const { state, records } = await ledger.readGoal();
+        if (state.receipt !== null)
+            return state.receipt;
         if (status === "succeeded" && !explicitAcceptance &&
             await input.runtimeBridge?.requiresExplicitAcceptance?.(sessionID) === true)
             return undefined;
-        const records = (await ledger.readGoal()).records;
         const settledEvidence = records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : []);
-        if (status === "succeeded" && (state.acceptance_contract === null ||
-            state.acceptance_contract.criteria.length === 0 ||
-            !state.acceptance_contract.criteria.every(({ criterion_id }) => state.satisfied_criteria.includes(criterion_id))))
-            return undefined;
-        if (status === "succeeded" && state.acceptance_contract !== null) {
-            for (const criterion of state.acceptance_contract.criteria) {
-                if (criterion.source_binding !== "current-protected" && criterion.candidate_binding !== "current-protected")
-                    continue;
-                const evidence = [...settledEvidence].reverse().find((entry) => entry.measurement.criterion_ids.includes(criterion.criterion_id) && validGoalEvidence(entry, state));
-                if (evidence?.protected_binding === undefined)
-                    return undefined;
-                const current = await refreshProtectedSnapshot(evidence.protected_binding.project_root, evidence.protected_binding).catch(() => undefined);
-                if (current === undefined ||
-                    (criterion.source_binding === "current-protected" && current.source !== evidence.identity.source) ||
-                    (criterion.candidate_binding === "current-protected" && current.candidate !== evidence.identity.candidate))
-                    return undefined;
-            }
+        if (status === "succeeded") {
+            const readiness = await goalCompletionReadiness(state, settledEvidence);
+            onReadiness?.(readiness);
+            if (!readiness.ready)
+                return undefined;
         }
+        if (state.goal_id === null || state.outstanding_reservations.length > 0 || state.acceptance_fingerprint === null)
+            return undefined;
         const started = [...records].reverse().find(({ event }) => event.kind === "goal.accepted")?.event.at ?? new Date().toISOString();
         const ended = new Date().toISOString();
         const startTime = Date.parse(started);
@@ -7052,6 +6955,7 @@ export const SortieDogsPlugin = async (input, options) => {
                                     prompts.push(part.state.input.prompt);
                             }
                         }
+                    prompts.push(...await input.runtimeBridge?.completedReviewPrompts?.(toolInput.sessionID, output.args.prompt) ?? []);
                     fastLane.restoreReviewLineage(toolInput.sessionID, output.args.prompt, prompts);
                 }
                 const resumedWorkerSessionID = fastLane.beforeTool(toolInput.sessionID, toolInput.tool, output.args, {
@@ -8005,6 +7909,10 @@ export const SortieDogsPlugin = async (input, options) => {
             return !snapshot.records.some(({ event }) => event.kind === "dispatch.reserved" && event.reservation_id === expected);
         },
         recoverUnitEvidence,
+        completionReadiness: async (root) => {
+            const { state, records } = await (await goalLedger(root)).readGoal();
+            return goalCompletionReadiness(state, records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : []));
+        },
         completeRoot: async (sessionID, acceptanceFingerprint) => {
             if (!isCoordinatorSession(sessionID) && !await recoverCoordinatorRoot(sessionID))
                 throw new Error("operator-coordinator-required");
@@ -8016,9 +7924,10 @@ export const SortieDogsPlugin = async (input, options) => {
                 throw new Error("operator-goal-stopped");
             // Same proof/freshness/reservation gate used by terminal text, requested
             // explicitly by the root instead of inferred from a model's wording.
-            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded", true);
+            let completion;
+            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded", true, result => { completion = result; });
             if (receipt?.status !== "succeeded")
-                return { status: "awaiting-evidence" };
+                return { status: "awaiting-evidence", completion };
             // Acceptance must return its receipt to the active tool call. Revoking
             // continuation timers is not a user-requested session cancellation.
             await continuation.stopAutomaticRecovery(sessionID, false, true);