sortie-dogs 0.13.4 → 0.13.5

package/README.md

@@ -35,10 +35,10 @@ implementation, validation, review, and model routing.
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) ·
 [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md)
 
-**Current release: [v0.13.4](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.4)**
-([release notes](docs/release-v0.13.4.md)). The default Mission runtime retains the `v010`
+**Current release: [v0.13.5](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.5)**
+([release notes](docs/release-v0.13.5.md)). The default Mission runtime retains the `v010`
 profile, command and configuration names for compatibility; these names do not mean v0.10 is installed.
-The current asset marker is `0.13.4-reviewer-continuous-v1`.
+The current asset marker is `0.13.5-live-state-v1`.
 
 ## SWE-bench Lite: 170/300 (56.67%)
 
@@ -48,7 +48,7 @@ The fixed **Sortie-dogs v0.12.24** harness resolved **170 of 300 SWE-bench Lite
 
 The single official 300-instance report and frozen predictions are hash-bound in the report. Confirmed inference expense was **$162.99**; a separate **$34.60** of usage has unknown pricing and is held against the campaign cap, **not** counted as known expense. Leaderboard registration and maintainer acceptance are separate from this official local evaluation.
 
-Historical scores below belong to their fixed candidates, not v0.13.4. SWE-bench is a separate,
+Historical scores below belong to their fixed candidates, not v0.13.5. SWE-bench is a separate,
 optional measurement rather than a mandatory release gate.
 
 > **Beta:** v0.13.x is still stabilizing. Runtime behavior,
@@ -93,7 +93,23 @@ existing local bridge loads enforcement and model routing. OpenCode can reload w
 but replacing an installed dependency may require a full restart. A new chat session alone does not
 prove the newly installed plugin is loaded.
 
-## v0.13.4 runtime updates
+## v0.13.5 runtime updates
+
+PR #154 preserves stable model instructions and appends changed host state at native history
+boundaries, with complete current-state reconstruction after compaction. Genuine Reviewer tools
+have deterministic read-only-first ordering; the real correction-permission transition still remains.
+The final candidate restores v3 behavioral review and combined assignment/findings while retaining
+exact instruction discovery, inherited Reviewer formal-command delivery, literal local shell-file
+scope reconciliation and explicit repository-root read/write scope support. New whole-project
+captures avoid bookkeeping-only invalidation; legacy evidence and real source/artifact freshness remain.
+
+The final pre-release cycle 11 Anko sample passed official local score 1 and selected public probes 9/9
+in 26m1.866s at estimated $1.41968316. It was faster but 15.762% costlier than the earlier v3 sample,
+not combined cost-preserving optimization or a general quality/speed guarantee. Release receipts:
+`_testenv/releases/0.13.5/`. See [release notes](docs/release-v0.13.5.md) and
+[candidate tradeoffs/failures](docs/cache-prefix-loop-20261003.md). Native Worker startup is not completion.
+
+## v0.13.4 runtime updates (retained)
 
 PR #152 restores same-session Coordinator/Operator implementation and formal validation through
 `plan_units(executor="self")`, `start_direct_unit` and `finish_direct_unit`. Known single-unit work can
@@ -397,7 +413,7 @@ register stable and `v010` from the same package installation path in one host.
 Project-local installation is recommended. To expose the current Mission assets globally:
 
 ```sh
-npm install --global sortie-dogs@0.13.4
+npm install --global sortie-dogs@0.13.5
 sortie-dogs init --global --profile v010
 ```
 
@@ -409,7 +425,7 @@ can resolve a **separate dependency** under that config root. Updating npm-globa
 it. For that layout, also install the same release at the actual config root, then rerun global init:
 
 ```sh
-npm install --prefix "$HOME/.config/opencode" sortie-dogs@0.13.4
+npm install --prefix "$HOME/.config/opencode" sortie-dogs@0.13.5
 sortie-dogs init --global --profile v010
 ```
 
@@ -432,7 +448,7 @@ version, preserves user configuration, and stops safely on unknown ownership or
 conflicting files.
 
 Align any exact version pin or separate bridge dependency with the intended release too. An installed
-marker of `0.13.4-reviewer-continuous-v1` identifies the assets; it does not prove an already-running
+marker of `0.13.5-live-state-v1` identifies the assets; it does not prove an already-running
 OpenCode process has reloaded the plugin.
 
 There is no supported uninstall command. Remove the npm dependency separately,

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.13.4-reviewer-continuous-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.13.5-live-state-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.13.4-reviewer-continuous-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.13.5-live-state-v1";

package/dist/core/goal-bound.d.ts

@@ -39,6 +39,9 @@ export interface GoalEvidence {
         readonly candidate_paths: readonly string[];
         /** Missing on legacy evidence: retain its original all-paths snapshot recipe. */
         readonly source_policy?: "project-files-v1" | "declared-paths-v1";
+        /** New captures distinguish a whole-project output grant from explicitly named control-like artifacts.
+         * Missing on old evidence: keep its original candidate recipe, including bookkeeping bytes. */
+        readonly candidate_policy?: "project-root-artifacts-v1";
         /** Fixed when validation starts. Full manifest_hash still identifies the historical execution contract. */
         readonly freshness?: {
             readonly contract_hash: string;

package/dist/core/goal-bound.js

@@ -65,6 +65,7 @@ export function validGoalEvidence(value, state) {
         protectedBinding.candidate_paths.every(text) &&
         (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1" ||
             protectedBinding.source_policy === "declared-paths-v1") &&
+        (protectedBinding.candidate_policy === undefined || protectedBinding.candidate_policy === "project-root-artifacts-v1") &&
         (protectedBinding.freshness === undefined || (protectedBinding.freshness !== null && typeof protectedBinding.freshness === "object" &&
             HASH.test(protectedBinding.freshness.contract_hash) &&
             Array.isArray(protectedBinding.freshness.scratch_paths) && protectedBinding.freshness.scratch_paths.every(text) &&

package/dist/core/operator-mission.js

@@ -443,10 +443,11 @@ export function missionPlan(mission, raw, projectRoot) {
             if (!Array.isArray(entries) || !entries.every(item => typeof item === "string"))
                 throw new Error(`mission-unit-${index + 1}: ${field} must be paths`);
             return [...new Set(entries.map(item => {
-                    // A model's repository-root read means the current project, not an invalid empty path.
-                    // Resolve only this read shorthand at the host boundary; saved plans and write scopes stay exact.
-                    const rootRead = field === "read" && [".", "./", ".\\", "./**", ".\\**"].includes(item);
-                    return normalizeExecutionScope(rootRead && projectRoot ? `${resolve(projectRoot).replaceAll("\\", "/")}/**` : item);
+                    // An explicit repository-root scope means this project for both reads and writes.
+                    // Resolve this shorthand only at the host boundary; saved plans, prohibitions and
+                    // native permissions still use the exact directory scope, never an inferred grant.
+                    const rootScope = [".", "./", ".\\", "./**", ".\\**"].includes(item);
+                    return normalizeExecutionScope(rootScope && projectRoot ? `${resolve(projectRoot).replaceAll("\\", "/")}/**` : item);
                 }))];
         };
         // A sole unit owns the whole request. This schedules work; it does not prove acceptance.

package/dist/plugin/index.js

@@ -7487,7 +7487,8 @@ export const SortieDogsPlugin = async (input, options) => {
                     if (extracted.paths.length)
                         await input.runtimeBridge?.assertMissionWrite?.(toolInput.sessionID, extracted.paths);
                     const nativeFile = /^(?:write|edit)(?:$|[_-])/iu.test(toolInput.tool) || /patch/iu.test(toolInput.tool);
-                    if (nativeFile && !extracted.ambiguous && extracted.paths.length) {
+                    const nativeShell = ["bash", "shell"].includes(toolInput.tool) && authorization.writeScopes.length > 0;
+                    if ((nativeFile && !extracted.ambiguous || nativeShell && !extracted.gitAmbiguous) && extracted.paths.length) {
                         const missing = [];
                         for (const path of extracted.paths) {
                             const actual = nativeFile ? resolve(input.directory, path) : path;
@@ -7498,6 +7499,17 @@ export const SortieDogsPlugin = async (input, options) => {
                                 if (!(error instanceof WriteDeniedError) || !["manifest-scope", "project-boundary"].includes(error.reason))
                                     throw error;
                                 const local = relative(authorization.projectRoot, resolve(input.directory, actual)).replaceAll("\\", "/");
+                                if (nativeShell) {
+                                    // Reconcile known local file destinations, not expansions, directory trees or
+                                    // opaque program internals. Unknown executables may accompany a literal rm/redirect.
+                                    if (/[$*?\[\]{}()~`]/u.test(path) || local === ".." || local.startsWith("../") || isAbsolute(local))
+                                        continue;
+                                    if (extracted.createdDirectories?.length || extracted.requiredDirectories?.some(directory => resolve(input.directory, isRecord(output.args) && typeof output.args.workdir === "string" ? output.args.workdir : ".", directory) ===
+                                        resolve(input.directory, actual)))
+                                        continue;
+                                    if (await stat(resolve(input.directory, actual)).then(value => value.isDirectory()).catch(() => false))
+                                        continue;
+                                }
                                 missing.push(local === ".." || local.startsWith("../") || isAbsolute(local) ? resolve(input.directory, actual) : local);
                             }
                         }

package/dist/plugin/model-live-state.d.ts

@@ -0,0 +1,15 @@
+export interface ModelLiveStateHistory {
+    version: 1;
+    native: string[];
+    blocks: Record<string, string[]>;
+    updates: {
+        after: number;
+        text: string[];
+    }[];
+}
+/** Reinsert already sent state at native boundaries; append changed blocks, never persist fake native messages. */
+export declare function modelLiveState(system: readonly string[], messages?: readonly unknown[], saved?: unknown): {
+    system: string[];
+    messages?: unknown[];
+    history?: ModelLiveStateHistory;
+};

package/dist/plugin/model-live-state.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+// Only Sortie's own generated elements are classified here, not the native system
+// prompt or retrieved/user/tool text. Keep policy and role instructions in front;
+// counters, findings and lifecycle changes should not invalidate all prior reads.
+const headings = new Set([
+    "SORTIE_GOAL_BOUND_STATE", "SORTIE_ACCEPTANCE_CONTINUITY_STATE", "SORTIE_PARALLEL_DISPATCH_STATE",
+    // Recognize the former split findings block so restored histories can explicitly retire it.
+    "SORTIE_REVIEWER_CONTINUOUS_CONTEXT", "SORTIE_REVIEWER_RETAINED_FINDINGS", "SORTIE_WORKER_CONTEXT", "SORTIE_FAST_LANE_TERMINAL",
+]);
+const prefixes = ["Native tools actually available in this request: ",
+    "Confirmed launch conditions (fixed caps, not remaining Worker/campaign budget): "];
+const blockName = (text) => {
+    const heading = text.split("\n", 1)[0];
+    return headings.has(heading) ? heading : prefixes.find(prefix => text.startsWith(prefix));
+};
+const projected = new WeakSet();
+function retained(value) {
+    return object(value) && value.version === 1 && Array.isArray(value.native) && value.native.every(hash => typeof hash === "string") &&
+        object(value.blocks) && Object.values(value.blocks).every(texts => Array.isArray(texts) && texts.every(text => typeof text === "string")) &&
+        Array.isArray(value.updates) && value.updates.every((update, index, updates) => object(update) &&
+        Number.isSafeInteger(update.after) && Number(update.after) >= 0 && Number(update.after) <= value.native.length &&
+        (index === 0 || Number(update.after) >= Number(updates[index - 1].after)) &&
+        Array.isArray(update.text) && update.text.every(text => typeof text === "string"));
+}
+/** Reinsert already sent state at native boundaries; append changed blocks, never persist fake native messages. */
+export function modelLiveState(system, messages, saved) {
+    // Compatibility callers with no transcript still receive every state field.
+    if (messages === undefined)
+        return { system: [...system] };
+    const stable = [], blocks = {};
+    for (const text of system) {
+        const name = blockName(text);
+        if (name === undefined)
+            stable.push(text);
+        else
+            (blocks[name] ??= []).push(text);
+    }
+    const native = messages.filter(message => !object(message) || !projected.has(message));
+    const hashes = native.map(message => createHash("sha256").update(JSON.stringify(message) ?? "undefined").digest("hex"));
+    // Compaction, edited native history or a missing/malformed ledger starts from
+    // complete CURRENT durable host state. Old projection is not review/test proof.
+    const prior = retained(saved) && saved.native.length <= hashes.length &&
+        saved.native.every((hash, index) => hashes[index] === hash) ? saved : { version: 1, native: [], blocks: {}, updates: [] };
+    const changed = Object.entries(blocks).filter(([name, text]) => JSON.stringify(prior.blocks[name]) !== JSON.stringify(text)).flatMap(([, text]) => text);
+    const withdrawn = Object.keys(prior.blocks).filter(name => !Object.hasOwn(blocks, name));
+    if (withdrawn.length)
+        changed.push(`SORTIE_LIVE_STATE_WITHDRAWN\n${JSON.stringify(withdrawn)}`);
+    const history = { version: 1, native: hashes, blocks,
+        updates: [...prior.updates, ...(changed.length ? [{ after: native.length, text: changed }] : [])] };
+    const output = [];
+    let cursor = 0;
+    for (let index = 0; index <= native.length; index++) {
+        while (history.updates[cursor]?.after === index) {
+            // V2 lowers role=system to chronological developer input, not absolute instructions.
+            const update = { role: "system", content: history.updates[cursor++].text.map(text => ({ type: "text", text })),
+                metadata: { "sortie-dogs/live-state": "request-only" } };
+            projected.add(update);
+            output.push(update);
+        }
+        if (index < native.length)
+            output.push(native[index]);
+    }
+    return { system: stable, messages: output, history };
+}

package/dist/plugin/profiled.js

@@ -1,5 +1,5 @@
 import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
-import { MISSION_BEHAVIOR_REVIEW, MISSION_GIT_SCOPE } from "../runtime-mission-assets.js";
+import { MISSION_BEHAVIOR_REVIEW, MISSION_GIT_SCOPE, REVIEWER_VALIDATION_WORKFLOW } from "../runtime-mission-assets.js";
 import { cancelledMissionRetainsAcceptance, operatorGitPathAuthorized, OperatorContractError, OperatorRuntime } from "../core/operator-runtime.js";
 import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OPERATOR_PROPOSAL_REVISION_CONTRACT, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
 import { CANONICAL_AGENT_ROLES, canonicalAgent, profileAgent, profileTool, V010_RUNTIME_PROFILE } from "../core/runtime-profile.js";
@@ -2450,7 +2450,7 @@ export function createProfiledPlugin(profile, assetVersion) {
             await activateDirect(author);
             return JSON.stringify({ status: "correction-running", execution: "same-native-task",
                 findings: correction.findings, validation: unit.unit.validation, write: unit.unit.write,
-                next_action: `Correct all retained defects here using your existing context and public test harness; no handoff read or new Task. Run inherited formal commands in order, retain requested commit/clean delivery, then ${finishDirectUnit} and your explicit SELF_RECHECKED native terminal. Additional investigation may widen when useful; no reduced effort or acceptance of unresolved Medium.` });
+                next_action: `Correct all retained defects here using your existing context and public test harness; no handoff read or new Task. ${REVIEWER_VALIDATION_WORKFLOW} Retain requested commit/clean delivery, then ${finishDirectUnit} and your explicit SELF_RECHECKED native terminal. Additional investigation may widen when useful; no reduced effort or acceptance of unresolved Medium.` });
         }
         tools[repairReview] = { description: "Reviewer: record your concrete Major/Medium findings and continue correction, inherited formal checks, commit and self-recheck HERE without ending this native Task. Controller: recover the ORIGINAL correction owner after a terminated review/correction. Host prepares/binds the existing authorized write scope and validation; no findings transcription, new approval or Worker rediscovery. Author self-recheck is not independent PASS. Operation and read-only reviews do not use this route.",
             args: { findings: optionalStringSchema }, execute: async (args, context) => {
@@ -2526,7 +2526,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                         throw new Error("mission-review-correction-budget-unavailable");
                     const reviewIdentity = missionReviewIdentity(mission);
                     const plan = missionPlan(mission, [{ title: `Correct ${run.units[0].unit.title}`,
-                            objective: 'Correct all retained concrete Major/Medium findings in this SAME native conversation; preserve every original requirement. Exact findings are at correction_context.findings in the handoff; retained_findings_ref is optional lineage, not an instruction to reread/print the entire Mission or previous review prompt. Relevant search and focused diagnostics may widen normally; do not rediscover unchanged work. Run all unchanged declared formal validation in order and retain the requested commit/clean boundary. THEN explicitly self-recheck the original requirements, ALL retained findings, correction and relevant impact in this Task. Correct known defects and revalidate affected checks before finishing. First line SELF_RECHECKED. Next line self_recheck: {"candidate":"current-validated","unresolved_findings":[],"residual_major":null}. The HOST binds current-validated to actual current source and fresh successful native checks after this exact prompt; never copy a pre-edit hash. Explain the actual comparison below. List unresolved concrete Major/Medium defects in unresolved_findings (no acceptance). Only concrete reachable residual Major risk uses residual_major:{"reachable_path":"...","consequence":"serious consequence"} and requires a different Reviewer. Tags/hashes/Medium/prose gaps alone never trigger it. This is author self-recheck, NOT independent PASS. Legacy CORRECTION_READY without self-recheck only permits a same-author read-only fallback Task, never acceptance.',
+                            objective: `Correct all retained concrete Major/Medium findings in this SAME native conversation; preserve every original requirement. Exact findings are at correction_context.findings in the handoff; retained_findings_ref is optional lineage, not an instruction to reread/print the entire Mission or previous review prompt. Relevant search and focused diagnostics may widen normally; do not rediscover unchanged work. ${REVIEWER_VALIDATION_WORKFLOW} Retain the requested commit/clean boundary. THEN explicitly self-recheck the original requirements, ALL retained findings, correction and relevant impact in this Task. Correct known defects and revalidate affected checks before finishing. First line SELF_RECHECKED. Next line self_recheck: {"candidate":"current-validated","unresolved_findings":[],"residual_major":null}. The HOST binds current-validated to actual current source and fresh successful native checks after this exact prompt; never copy a pre-edit hash. Explain the actual comparison below. List unresolved concrete Major/Medium defects in unresolved_findings (no acceptance). Only concrete reachable residual Major risk uses residual_major:{"reachable_path":"...","consequence":"serious consequence"} and requires a different Reviewer. Tags/hashes/Medium/prose gaps alone never trigger it. This is author self-recheck, NOT independent PASS. Legacy CORRECTION_READY without self-recheck only permits a same-author read-only fallback Task, never acceptance.`,
                             read: [...new Set([...(mission.reviewScope?.read ?? []), ...run.units.flatMap(unit => unit.unit.read)])],
                             write: [...new Set([...(mission.reviewScope?.write ?? []), ...run.units.flatMap(unit => unit.unit.write)])],
                             validation: run.units.flatMap(unit => unit.unit.validation) }], input.directory);
@@ -3783,6 +3783,10 @@ export function createProfiledPlugin(profile, assetVersion) {
                 (output.system ??= []).push(`SORTIE_RUNTIME_PROFILE ${profile.id}; marker ${assetVersion}. ` +
                     `Shared MkII protocol role names are logical: ${protocolMap}. Use only ${profile.toolPrefix} tools for this profile. ` +
                     "Never rewrite user acceptance or evidence to rename protocol roles. Final acceptance belongs only to the root coordinator.");
+                output.system.push("SORTIE_LIVE_STATE_POLICY\nCurrent host state may follow the conversation as a request-only system update. " +
+                    "Use the latest update of each named state block for current findings, assignment, counters, acceptance continuity and receipt. " +
+                    "SORTIE_LIVE_STATE_WITHDRAWN retires the listed blocks; earlier scope, tool lists and receipts are historical, not current authority. " +
+                    "It does not replace original requirements, native tool outcomes or formal evidence; author self-recheck is not independent approval.");
                 const mission = await missions.read(root), run = await operators.read(root);
                 const inline = mission?.corrections?.find(item => item.runID === run?.runID && item.author === request.sessionID &&
                     item.inlineReview && ["running", "ready"].includes(item.status) && !item.selfRecheck);

package/dist/plugin/protected-snapshot.js

@@ -88,11 +88,11 @@ export function isRuntimeControlPath(path) {
     const first = path.replaceAll("\\", "/").split("/")[0];
     return controlRoots.has(process.platform === "win32" ? first.toLowerCase() : first);
 }
-async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePolicy, excluded = [], binding) {
+async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePolicy, excluded = [], binding, candidatePolicy) {
     const entries = [];
     const canonicalRoot = await realpath(projectRoot);
     const scratchExcluded = binding ? snapshotScratchExclusion(binding) : () => false;
-    const visit = async (absolute, ancestors = new Set()) => {
+    const visit = async (absolute, ancestors = new Set(), projectArtifacts = false) => {
         if (excluded.some(root => !outside(root, absolute)))
             return true;
         if (scratchExcluded(absolute))
@@ -100,7 +100,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
         const scoped = relative(projectRoot, absolute).replaceAll("\\", "/");
         if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
             return false;
-        if (sourcePolicy === "project-files-v1" && isRuntimeControlPath(scoped))
+        if ((sourcePolicy === "project-files-v1" || projectArtifacts) && isRuntimeControlPath(scoped))
             return true;
         const metadata = await lstat(absolute).catch((error) => {
             if (error.code === "ENOENT")
@@ -126,7 +126,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
                 entries.push([scoped, `symlink:${link}`]);
                 const next = new Set([...ancestors, target]);
                 for (const child of (await readdir(absolute)).sort())
-                    if (!await visit(join(absolute, child), next))
+                    if (!await visit(join(absolute, child), next, projectArtifacts))
                         return false;
                 return true;
             }
@@ -142,7 +142,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             entries.push([scoped, "directory"]);
             const next = new Set([...ancestors, real]);
             for (const child of (await readdir(absolute)).sort())
-                if (!await visit(join(absolute, child), next))
+                if (!await visit(join(absolute, child), next, projectArtifacts))
                     return false;
             return true;
         }
@@ -151,19 +151,23 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
         entries.push([scoped, "file", createHash("sha256").update(await readFile(absolute)).digest("hex")]);
         return true;
     };
-    for (const path of [...new Set(paths)].sort())
-        if (!await visit(path))
+    for (const path of [...new Set(paths)].sort()) {
+        // Only a whole-project grant excludes incidental host bookkeeping. A separately
+        // declared control-like output still traverses and pins its exact bytes.
+        const projectArtifacts = candidatePolicy === "project-root-artifacts-v1" && resolve(path) === resolve(projectRoot);
+        if (!await visit(path, new Set(), projectArtifacts))
             return undefined;
+    }
     return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
 }
 function outside(projectRoot, path) {
     const scoped = relative(projectRoot, path).replaceAll("\\", "/");
     return scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped);
 }
-async function declaredScopeDigest(projectRoot, paths, manifestHash, source, excluded = [], binding) {
+async function declaredScopeDigest(projectRoot, paths, manifestHash, source, excluded = [], binding, candidatePolicy) {
     const local = paths.filter(path => !outside(projectRoot, path));
     const external = paths.filter(path => outside(projectRoot, path));
-    const project = await protectedScopeDigest(projectRoot, local, manifestHash, source ? "project-files-v1" : undefined, excluded, binding);
+    const project = await protectedScopeDigest(projectRoot, local, manifestHash, source ? "project-files-v1" : undefined, excluded, binding, candidatePolicy);
     if (project === undefined)
         return undefined;
     const artifacts = await declaredArtifacts(external).catch(() => undefined);
@@ -226,6 +230,7 @@ export async function protectedSnapshot(authorization, options = {}) {
         const tracked = await exec("git", ["ls-files", "-z"], { cwd: authorization.projectRoot, maxBuffer: 16 * 1024 * 1024 }).then(value => value.stdout.split("\0").filter(Boolean)).catch(() => []);
         const binding = { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
             manifest_path: relativePath, source_policy: external ? "declared-paths-v1" : "project-files-v1",
+            candidate_policy: "project-root-artifacts-v1",
             source_paths: sourcePaths.map(evidencePath),
             candidate_paths: candidatePaths.map(evidencePath),
             freshness: { contract_hash: validationContractHash(manifest), scratch_paths: validationScratchPaths(authorization.projectRoot, manifest.validation, process.env),
@@ -270,13 +275,13 @@ export async function refreshProtectedSnapshot(projectRoot, binding) {
     }
     if (binding.source_policy === "declared-paths-v1") {
         const source = await declaredScopeDigest(projectRoot, sourcePaths, manifestHash, true, [], binding);
-        const candidate = await declaredScopeDigest(projectRoot, candidatePaths, manifestHash, false, [], binding);
+        const candidate = await declaredScopeDigest(projectRoot, candidatePaths, manifestHash, false, [], binding, binding.candidate_policy);
         return source === undefined || candidate === undefined ? undefined : { source, candidate };
     }
     // Legacy evidence retains its original recipe; a new policy cannot relabel stale proof as fresh.
     if (binding.source_policy !== undefined && binding.source_policy !== "project-files-v1")
         return undefined;
     const source = await protectedScopeDigest(projectRoot, sourcePaths, manifestHash, binding.source_policy, [], binding);
-    const candidate = await protectedScopeDigest(projectRoot, candidatePaths, manifestHash, undefined, [], binding);
+    const candidate = await protectedScopeDigest(projectRoot, candidatePaths, manifestHash, undefined, [], binding, binding.candidate_policy);
     return source === undefined || candidate === undefined ? undefined : { source, candidate };
 }

package/dist/plugin/v2.js

@@ -8,6 +8,7 @@ import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { NativeBackgroundLifecycle } from "./native-background.js";
 import { isSessionNotFoundError } from "@opencode/client";
 import { completionReportModelMessages } from "./receipt-presentation.js";
+import { modelLiveState } from "./model-live-state.js";
 // Capture once when this module evaluates. A later package replacement must not make an old
 // process report the replacement's bytes as its loaded adapter.
 const loadedAdapter = Object.freeze({ adapter_url: import.meta.url,
@@ -16,10 +17,11 @@ const loadedAdapter = Object.freeze({ adapter_url: import.meta.url,
     // Named module snapshots, not a claim to identify every transitive dependency. Retain these
     // bytes across package replacement so an unchanged adapter cannot conceal an old implementation.
     implementation_sha256: Object.freeze(Object.fromEntries([
-        "index", "profiled", "gate", "protected-snapshot", "declared-artifacts", "native-contract-read", "native-background",
+        "index", "profiled", "gate", "protected-snapshot", "declared-artifacts", "native-contract-read", "native-background", "model-live-state",
     ].map(name => [`${name}.js`, createHash("sha256").update(readFileSync(new URL(`./${name}.${import.meta.url.endsWith(".ts") ? "ts" : "js"}`, import.meta.url))).digest("hex")]))),
     loaded_at: new Date().toISOString(), pid: process.pid });
 const childSelectionKey = (id) => `v2-child-model-selection:${id}`;
+const liveStateKey = (id) => `v2-model-live-state:${id}`;
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -330,6 +332,13 @@ export function createV2ReturnReportFinalizer(context, hooks) {
     };
 }
 const correctionAgent = (agent) => typeof agent === "string" && /^dog-reviewer-correction-v010-[a-f0-9]{16}$/u.test(agent);
+const reviewerCorrectionOnlyTools = new Set(["edit", "write", "patch", "shell", "sortie_v010_bind_write_gate",
+    "sortie_v010_release_write_gate", "sortie_v010_operator_status", "sortie_v010_finish_direct_unit"]);
+// Order only the genuine, already-filtered native definitions. Initial read-only
+// tools remain a deterministic prefix when correction admits additional tools;
+// object identities, schemas, executors and native authority are unchanged.
+const reviewerModelToolOrder = (tools) => Object.fromEntries(Object.entries(tools).sort(([left], [right]) => Number(reviewerCorrectionOnlyTools.has(left)) - Number(reviewerCorrectionOnlyTools.has(right)) ||
+    (left < right ? -1 : left > right ? 1 : 0)));
 const correctionAgentID = (sessionID) => `dog-reviewer-correction-v010-${createHash("sha256").update(sessionID).digest("hex").slice(0, 16)}`;
 const correctionStoragePrefix = "v2-reviewer-correction-permissions:";
 // OpenCode 2.0.18 util/wildcard.ts + permission.evaluate ordering.
@@ -473,7 +482,7 @@ async function syncReviewerCorrectionPermissionsOnce(context, hooks, sessionID,
     if (info.agent !== selected)
         await context.session.switchAgent({ sessionID, agent: selected });
 }
-async function registerV2Hooks(context, hooks, background) {
+async function registerV2Hooks(context, hooks, background, liveState) {
     const explicitlySelectedChildren = new Set();
     const selectedChildModels = new Set();
     const selectionKey = (parent, role, prompt) => `${parent}\0${role}\0${prompt}`;
@@ -736,8 +745,6 @@ async function registerV2Hooks(context, hooks, background) {
             const output = { system: [] };
             await hooks["experimental.chat.system.transform"]({ sessionID: String(event.sessionID ?? "") }, output);
             await reconcileCorrectionPermissions(String(event.sessionID));
-            if (Array.isArray(event.system))
-                event.system.push(...output.system.map(text => ({ type: "text", text })));
             if (record(event.tools)) {
                 const visible = {
                     "dog-operator": ["start_mission", "plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "operator_next", "operator_status", "expand_unit", "review_mission", "repair_review", "complete_mission", "cancel_operator", "reflection"],
@@ -759,10 +766,28 @@ async function registerV2Hooks(context, hooks, background) {
                     if (!allowed || !key.startsWith("sortie_v010_") || !allowed.includes(key.slice("sortie_v010_".length)))
                         delete event.tools[key];
                 }
-                if ((event.agent === "dog-reviewer-v010" || correctionAgent(event.agent)) && Array.isArray(event.system)) {
-                    event.system.push({ type: "text", text: `Native tools actually available in this request: ${Object.keys(event.tools).sort().join(", ")}. Use these tools directly; do not infer missing tools or ask the root to transcribe source.` });
+                if (event.agent === "dog-reviewer-v010" || correctionAgent(event.agent)) {
+                    const tools = reviewerModelToolOrder(event.tools);
+                    event.tools = tools;
+                    output.system.push(`Native tools actually available in this request: ${Object.keys(tools).sort().join(", ")}. Use these tools directly; do not infer missing tools or ask the root to transcribe source.`);
                 }
             }
+            const id = String(event.sessionID ?? "");
+            const previous = liveState.get(id) ?? await context.storage?.get(liveStateKey(id)).catch(() => {
+                console.warn("[sortie-dogs-v010] Live-state projection restore unavailable; rebuilding current host state");
+                return undefined;
+            });
+            const projection = modelLiveState(output.system, Array.isArray(event.messages) ? event.messages : undefined, previous);
+            if (projection.history) {
+                liveState.set(id, projection.history);
+                await context.storage?.set(liveStateKey(id), projection.history).catch(() => {
+                    console.warn("[sortie-dogs-v010] Live-state projection persistence unavailable; current instance retains continuity");
+                });
+            }
+            if (Array.isArray(event.system))
+                event.system.push(...projection.system.map(text => ({ type: "text", text })));
+            if (projection.messages)
+                event.messages = projection.messages;
         });
     if (hooks["experimental.session.compacting"])
         await context.session.hook("compaction", async (event) => {
@@ -796,6 +821,7 @@ export function createSortieDogsV2Plugin(legacyFactory = SortieDogsV010Plugin) {
         id: "sortie-dogs.v010",
         async setup(context) {
             let hooks;
+            const liveState = new Map();
             const background = new NativeBackgroundLifecycle(context, async (dispatch, text) => {
                 if (dispatch.owner)
                     hooks.backgroundOwner?.(dispatch.callID, dispatch.owner);
@@ -808,7 +834,7 @@ export function createSortieDogsV2Plugin(legacyFactory = SortieDogsV010Plugin) {
             hooks = await legacyFactory({ directory: context.location.directory, client: legacyClient(context),
                 nativeBackground: background, returnReportTransport: "tool-result",
                 reviewerCorrectionPermissions: !!context.agent && !!context.storage && !!context.session.switchAgent }, context.options ?? {});
-            await registerV2Hooks(context, hooks, background);
+            await registerV2Hooks(context, hooks, background, liveState);
             // Recreate exact durable correction profiles at plugin setup, before resumed native Steps
             // resolve their agent/tool snapshots. Storage.scan is part of Plugin 2.0.18's public domain.
             if (context.storage?.scan) {
@@ -836,6 +862,8 @@ export function createSortieDogsV2Plugin(legacyFactory = SortieDogsV010Plugin) {
                     await background.event(event);
                 if (event.type === "session.deleted") {
                     await context.storage?.remove?.(childSelectionKey(id));
+                    liveState.delete(id);
+                    await context.storage?.remove?.(liveStateKey(id));
                     // This native event is definite deletion, unlike a transient session.get failure.
                     await disposeCorrectionPermissions(context, id);
                 }

package/dist/runtime-mission-assets.d.ts

@@ -6,6 +6,8 @@ export declare const MISSION_GIT_SCOPE = "Requested git add <paths> (with option
 export declare const VALIDATION_WORKFLOW = "## Time-aware validation workflow\n\nOperator/Coordinator: put the known meaningful formal check from the user, project or task context in validation,\nnot another objective copy. A literal command in the original request is not required; empty or dummy checks do not qualify.\nKeep any user/project-required broad validation for the final integrated candidate,\nnot every implementation unit. Do not add a full suite merely as a precaution or create a testing agent.\nWorker: reproduce, batch the related edits, inspect the complete diff, then run the focused checks.\nFix failures with the smallest exercising check before starting a costly suite. Do not execute the entire\nformal validation list after each patch; run it in declared order when the unit candidate is stable.\nIf broad validation is already declared, defer it until focused checks pass and known edits are finished;\ndo not remove it, substitute a tiny check for it, or claim an unrun requirement passed.\nAfter a late fix, select checks for the affected inputs; repeat broad validation when the requested\ncontract or host evidence freshness requires it, not solely because any file or Worker changed.\nDocumentation-only changes do not automatically invalidate unrelated runtime/test results; retain the\nchecked candidate and show why reuse is valid under project and host rules. Never promote stale proof.\nBefore a costly check, state its purpose and known duration (unknown if unmeasured). In the concise return,\nreport command, scope, actual exit/elapsed time and any rerun reason; never invent savings or timings.\nReview evidence gaps need original excerpts, not another patch or full test. Keep autonomous correction,\nrequired review, accepted criteria and cumulative budget intact; this workflow adds no approval or denial.\n";
 /** Worker-only projection; planning/review authorities retain the complete shared workflow. */
 export declare const WORKER_VALIDATION_WORKFLOW = "Batch edits, reconcile requirements/diff, run focused tests, then every registered formal check exactly in order:\nseparate foreground native shell calls, no extra tee, redirect or wrapper. Diagnostics are not formal evidence.\nRerun affected checks and required broad checks when contract/freshness requires; never drop required validation or claim stale/unrun proof.\n";
+/** Correction uses the inherited command identities; diagnostics do not acquire formal evidence. */
+export declare const REVIEWER_VALIDATION_WORKFLOW = "Run inherited formal commands in order as exact separate foreground native shell calls.\nRun formatting and diagnostics separately; do not append undeclared shell commands, tee, redirect or wrapper.";
 export declare function missionOperatorContent(profile: RuntimeProfile, version: string): string;
 /** Shared by the installed Reviewer and its host-generated mission prompt. */
 export declare const MISSION_BEHAVIOR_REVIEW = "Establish the test oracle independently of the patch: tests added with the implementation are claims to\nreview, not established API behavior. For a changed failure path, compare a pre-existing analogous public\ntest and its shared assertion helper, including default expected outputs, with the new case. A new test\nthat asserts the implementation's current result can encode the defect rather than catch it. Preserve\nthe pre-change contract unless the request changes it; do not invent a universal failure-result convention.\nTrace a concrete rejected input through the changed code back to the public caller, checking result,\nerror and observable state together, including earlier results that can survive failure. Missing assertions\nalone are not defects; a concrete contradiction with the established contract is a finding even if tests pass.\nDuring correction, reuse the established public test harness where applicable and exercise the smallest\nregression exposing the defect before the fix and passing afterward. Do not change expected values or\nhelper defaults merely to agree with the implementation; derive them from the original contract.\nPrefer existing suites/subtests for regressions. New test entry/helper names should be distinctive\nand compose with other same-package test files, not create generic package-level collisions.\n\nFor a requested per-call mode/option, trace where the setting is chosen and where changed code uses\nretained objects or closures. Distinguish the current caller's setting from a captured creation-time\nsetting; use the requested contract to decide which governs. If actual source crosses that boundary\nand existing tests do not cover it, exercise its smallest public case, including the disabled behavior.\nDo not invent a lifecycle matrix or infer that an opt-in feature is correct from only its enabled path.\n\nFor a changed failure handler, inspect the operation it calls and the public inputs reaching it,\nincluding failures not listed in the new handler. Use the supplied source/tests and established API behavior\nto identify a concrete input that could still violate the requested contract. A passing normal input does\nnot settle a different failure outcome of that same operation. A demonstrable material defect is FINDINGS; ask for\nan excerpt or result only when a specific material outcome cannot be settled. Do not invent new behavior,\nrequire an exhaustive exception inventory, or recommend catching every exception.\n\nReport FINDINGS only for concrete major or medium defects with a material impact on the original requirements,\npublic behavior, correctness or required validation. Name the consequence and smallest necessary fix.\nDo not turn minor style, wording, optional improvements or speculative edge cases into FINDINGS or EVIDENCE_GAPS.\nUse read/search to settle missing context in the current review. If a consequential uncertainty remains,\nrecord EVIDENCE_GAPS as an advisory limitation, not a demand for another evidence packet. Missing narration,\nrequirement mappings, hashes or clipped excerpts alone never justify a blocking finding.\n\nAssess behavioral requirements against actual source, tests and observed results. A required check known to\nhave failed or not run is a concrete finding; missing documentation of a check is not proof it did not run.\nFor incidental workflow constraints such as cache settings or command-path spelling, use existing host observations;\nabsence of a separate settings dump or historical log is not itself an evidence gap. Flag observed material\ncontradictions. The Operator owns final comparison with the original request. If a missing check genuinely\naffects correctness or a requested deliverable, name that consequence and the smallest useful next check.\nOn verification, compare the correction and its affected public outcomes with the original contract, not\nonly the wording of previous findings. Reuse unchanged evidence; do not expand into optional improvements\nor an exhaustive input matrix. PASS means no material finding, not exhaustive proof of every path.";

package/dist/runtime-mission-assets.js

@@ -34,6 +34,9 @@ export const WORKER_VALIDATION_WORKFLOW = `Batch edits, reconcile requirements/d
 separate foreground native shell calls, no extra tee, redirect or wrapper. Diagnostics are not formal evidence.
 Rerun affected checks and required broad checks when contract/freshness requires; never drop required validation or claim stale/unrun proof.
 `;
+/** Correction uses the inherited command identities; diagnostics do not acquire formal evidence. */
+export const REVIEWER_VALIDATION_WORKFLOW = `Run inherited formal commands in order as exact separate foreground native shell calls.
+Run formatting and diagnostics separately; do not append undeclared shell commands, tee, redirect or wrapper.`;
 const OPERATION_GUIDE = `## Practical operation guide
 
 Use file paths for exact outputs and dir/** for a directory tree, including a directory that does not
@@ -310,7 +313,8 @@ binds the existing scope/checks and lets you correct HERE, without another promp
 round trip. Reuse the known project test harness and the reasoning/source already in this conversation.
 If correction exposes another concrete Major/Medium defect, retain it through ${profile.toolPrefix}repair_review
 here before fixing it; the host accumulates known findings without another Task, scope or check contract.
-Run inherited formal commands in order, retain the requested commit/clean boundary, then
+${REVIEWER_VALIDATION_WORKFLOW}
+After current formal checks, retain the requested commit/clean boundary, then
 ${profile.toolPrefix}finish_direct_unit. Explicitly self-recheck and end this same native Task with
 SELF_RECHECKED; only its actual successful terminal binds the current validated source. This is author
 self-recheck, never independent approval of your own edits. No unresolved Medium may pass.
@@ -525,31 +529,30 @@ mode: subagent
 ---
 # ${profileAgent(profile, "dog-worker")}
 
-Implement, test and requested commit in this Task. Follow AGENTS.md.
-Read handoff_path in full first: task.objective, verbatim original_requests/unit_instruction, mission-context constraints,
-unit-coverage indices. Preserve user scope and ordering; prove assigned criteria, not Mission completion.
-Host ready: implement. Denied: reason/remedy. No routine manifest/goal/status/bind.
-Legacy/recovery: ${profile.toolPrefix}bind_write_gate with exact project_root and manifest_path=operation_manifest.
+Implement, test and requested commit in this Task.
+Reuse supplied AGENTS.md; for gaps prefer exact ancestor files/affected subtrees over parent globs.
+Read handoff_path in full first: task.objective, verbatim original_requests/unit_instruction, Mission constraints,
+coverage indices. Preserve user scope and ordering; prove assigned criteria, not Mission completion.
+Ready: implement. Denied: reason/remedy. No routine manifest/goal/status/bind.
+Recovery: ${profile.toolPrefix}bind_write_gate with exact project_root and manifest_path=operation_manifest.
 Treat cwd/project_root and paths as opaque; never shorten or normalize segments.
-After compaction recover handoff; inspect diff/results before repeating work.
-
-Read/search: existing permissions. Fix unit.write estimates/outputs/checks
+After compaction recover handoff; inspect diff/results before repeats.
+Read/search: existing permissions. Fix unit.write/outputs/checks
 here via ${profile.toolPrefix}expand_unit/contract updates and host repair diagnostics;
-no extra approval, restart or delegation. Keep prohibitions, host Git lifecycle and cumulative budget.
+no extra approval, restart or delegation. Keep prohibitions, host Git lifecycle, cumulative budget.
 Requested add/commit needs source paths, not .git/** scope.
-
 Use pre-change test helpers as oracles, not new implementation/tests. Check
 result/error/state together, without a hypothetical exhaustive matrix. Keep reproduction entrypoint/input/layout; rerun or report why unverified.
 Missing tooling: one documented bounded setup in ${TOOL_ENVIRONMENT}/; reuse, never delete.
 Per-call modes: check retained creation/use for captured vs current settings.
 Tests: existing suites/subtests or distinctive regression entry names.
 ${WORKER_VALIDATION_WORKFLOW}
-Done: behavior, ordered checks/commit; never fabricate completion.
+Done: behavior/ordered checks/commit; never fabricate completion.
 Parent: independent Review after return, not before execution; no review-before-commit gate.
-Do not spawn nested subagents, amend, push or publish. Return changes, command/exit/elapsed,
-rerun reasons, unresolved/untested behavior; no proof document.
-No unchanged denial retries. Only unrecoverable PROCESS_DEFECT: local: plus diagnostic or proven
-TRUE_BLOCKER: external: / TRUE_BLOCKER: user-decision: returns early.
-Use the user's latest instruction language (previous if unclear); keep protocol/code/quotes verbatim.
+Do not spawn nested subagents, amend, push/publish. Return changes, command/exit/elapsed,
+rerun reasons, unresolved/untested behavior; no proof doc.
+No unchanged denial retry. Early: unrecoverable PROCESS_DEFECT: local: + diagnostic or proven
+TRUE_BLOCKER: external: / TRUE_BLOCKER: user-decision:.
+Prose: user's latest instruction language (previous if unclear); protocol/code/quotes verbatim.
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",