sortie-dogs 0.13.6 → 0.13.8

package/README.md

@@ -35,10 +35,10 @@ implementation, validation, review, and model routing.
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) ·
 [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md)
 
-**Current release: [v0.13.6](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.6)**
-([release notes](docs/release-v0.13.6.md)). The default Mission runtime retains the `v010`
+**Current release: [v0.13.8](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.8)**
+([release notes](docs/release-v0.13.8.md)). The default Mission runtime retains the `v010`
 profile, command and configuration names for compatibility; these names do not mean v0.10 is installed.
-The current asset marker is `0.13.6-acceptance-reuse-v1`.
+The current asset marker is `0.13.8-native-binding-v1`.
 
 ## SWE-bench Lite: 170/300 (56.67%)
 
@@ -48,7 +48,7 @@ The fixed **Sortie-dogs v0.12.24** harness resolved **170 of 300 SWE-bench Lite
 
 The single official 300-instance report and frozen predictions are hash-bound in the report. Confirmed inference expense was **$162.99**; a separate **$34.60** of usage has unknown pricing and is held against the campaign cap, **not** counted as known expense. Leaderboard registration and maintainer acceptance are separate from this official local evaluation.
 
-Historical scores below belong to their fixed candidates, not v0.13.6. SWE-bench is a separate,
+Historical scores below belong to their fixed candidates, not v0.13.8. SWE-bench is a separate,
 optional measurement rather than a mandatory release gate.
 
 > **Beta:** v0.13.x is still stabilizing. Runtime behavior,
@@ -93,7 +93,31 @@ existing local bridge loads enforcement and model routing. OpenCode can reload w
 but replacing an installed dependency may require a full restart. A new chat session alone does not
 prove the newly installed plugin is loaded.
 
-## v0.13.6 runtime updates
+## v0.13.8 runtime updates
+
+PR #161 captures native validation bindings through the readable resolved target of a Windows
+directory junction instead of enumerating its failing logical alias. Logical evidence labels,
+link identity and complete target bytes remain bound; unchanged readable junctions retain their
+evidence identity. External-link/cycle handling, actual source/output freshness and Review remain
+unchanged. No new approval, permissions or model changes. The PR's isolated native Windows fixture
+reached independent Review PASS and accepted completion after resuming the same Mission, without
+rerunning its successful check; this does not claim original product recovery or uninterrupted
+single-turn completion. Release receipts: `_testenv/releases/0.13.8/`;
+see [release notes](docs/release-v0.13.8.md).
+
+## v0.13.7 runtime updates (retained)
+
+PRs #158/#159 prevent late write-only reports from falsely invalidating bound non-generating
+native checks, while preserving actual source/output freshness, failed checks and legacy recipes.
+Whole-root grants without a concrete inventory keep full-candidate freshness. Non-Git Mission roots
+can prepare independent Review from declared nested repositories/worktrees/plain outputs, including
+committed content; corrupt Git/HEAD errors remain visible. Operator performs authorized local recovery
+in the same turn without another approval, changed requirements or reset spending. Ubuntu's Git
+filesystem-boundary diagnostic is recognized alongside the standard non-repository error.
+The PR native observation reached Reviewer startup, not final acceptance. Release receipts:
+`_testenv/releases/0.13.7/`; see [release notes](docs/release-v0.13.7.md).
+
+## v0.13.6 runtime updates (retained)
 
 PR #156 references recorded formal PASS evidence in acceptance summaries instead of fetching
 the same successful unit's native history again for display. Missing/failed proof retains history
@@ -424,7 +448,7 @@ register stable and `v010` from the same package installation path in one host.
 Project-local installation is recommended. To expose the current Mission assets globally:
 
 ```sh
-npm install --global sortie-dogs@0.13.6
+npm install --global sortie-dogs@0.13.8
 sortie-dogs init --global --profile v010
 ```
 
@@ -436,7 +460,7 @@ can resolve a **separate dependency** under that config root. Updating npm-globa
 it. For that layout, also install the same release at the actual config root, then rerun global init:
 
 ```sh
-npm install --prefix "$HOME/.config/opencode" sortie-dogs@0.13.6
+npm install --prefix "$HOME/.config/opencode" sortie-dogs@0.13.8
 sortie-dogs init --global --profile v010
 ```
 
@@ -459,7 +483,7 @@ version, preserves user configuration, and stops safely on unknown ownership or
 conflicting files.
 
 Align any exact version pin or separate bridge dependency with the intended release too. An installed
-marker of `0.13.6-acceptance-reuse-v1` identifies the assets; it does not prove an already-running
+marker of `0.13.8-native-binding-v1` identifies the assets; it does not prove an already-running
 OpenCode process has reloaded the plugin.
 
 There is no supported uninstall command. Remove the npm dependency separately,

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.13.6-acceptance-reuse-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.13.8-native-binding-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.13.6-acceptance-reuse-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.13.8-native-binding-v1";

package/dist/core/goal-bound.d.ts

@@ -42,6 +42,9 @@ export interface GoalEvidence {
         /** New captures distinguish a whole-project output grant from explicitly named control-like artifacts.
          * Missing on old evidence: keep its original candidate recipe, including bookkeeping bytes. */
         readonly candidate_policy?: "project-root-artifacts-v1";
+        /** Non-generating native validation pins inputs/concrete outputs, not write-only directory bookkeeping.
+         * Missing on old evidence: retain its full source/output recipe. */
+        readonly validation_policy?: "inputs-and-concrete-outputs-v1";
         /** Fixed when validation starts. Full manifest_hash still identifies the historical execution contract. */
         readonly freshness?: {
             readonly contract_hash: string;

package/dist/core/goal-bound.js

@@ -66,6 +66,7 @@ export function validGoalEvidence(value, state) {
         (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1" ||
             protectedBinding.source_policy === "declared-paths-v1") &&
         (protectedBinding.candidate_policy === undefined || protectedBinding.candidate_policy === "project-root-artifacts-v1") &&
+        (protectedBinding.validation_policy === undefined || protectedBinding.validation_policy === "inputs-and-concrete-outputs-v1") &&
         (protectedBinding.freshness === undefined || (protectedBinding.freshness !== null && typeof protectedBinding.freshness === "object" &&
             HASH.test(protectedBinding.freshness.contract_hash) &&
             Array.isArray(protectedBinding.freshness.scratch_paths) && protectedBinding.freshness.scratch_paths.every(text) &&

package/dist/plugin/index.js

@@ -51,7 +51,7 @@ import { collectRunMetrics, createSortieResult, createGoalReport, insertRunMetri
 import { STABLE_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { evidenceFromObservedExecution } from "../core/observed-goal-evidence.js";
 import { receiptBoundTerminalText } from "./receipt-presentation.js";
-import { operationInputSnapshot, protectedSnapshot, refreshProtectedSnapshot, validationInputSnapshot } from "./protected-snapshot.js";
+import { operationInputSnapshot, protectedSnapshot, refreshProtectedSnapshot, validatedSourceSnapshot, validationInputSnapshot } from "./protected-snapshot.js";
 import { settledUnitUsage } from "./unit-usage.js";
 import { goalCompletionReadiness } from "./goal-completion.js";
 const INPUT_LIMITS = { config: 64 * 1024, manifest: 512 * 1024, handoff: 2 * 1024 * 1024, parallel: 512 * 1024 };
@@ -1517,12 +1517,15 @@ export const SortieDogsPlugin = async (input, options) => {
             ? await operationInputSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
         const validationInputs = (validation !== undefined || correction !== undefined) && operationInputs === undefined
             ? await validationInputSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
+        const validationSource = correction && validationInputs !== undefined
+            ? await validatedSourceSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
         hostGoalExecutions.set(toolInput.callID, { root, projectRoot: authorization.projectRoot,
             sessionID: toolInput.sessionID,
             callID: toolInput.callID, tool: toolInput.tool, command: [rawCommand], startedAt: new Date().toISOString(),
             binding: snapshot.binding, source: snapshot.source, candidate: snapshot.candidate,
             ...(operationInputs === undefined ? {} : { operationInputs }),
             ...(validationInputs === undefined ? {} : { validationInputs }),
+            ...(validationSource === undefined ? {} : { validationSource }),
             owner: validation?.request.owner ?? "worker", validation,
             ...(correction ? { correction } : {}),
             ...(reusedEvidence === undefined ? {} : { reusedEvidence }) });
@@ -1562,19 +1565,28 @@ export const SortieDogsPlugin = async (input, options) => {
             child_session_id: execution.sessionID, call_id: execution.callID, command: execution.command,
             started_at: observedStartedAt, ended_at: endedAt, exit_code: exitCode ?? null, outcome,
             source: execution.source, candidate: execution.candidate });
+        const generated = execution.validationInputs !== undefined && refreshed &&
+            (refreshed.source !== execution.source || refreshed.candidate !== execution.candidate);
+        // Capture this narrower recipe only from an actual non-generating native check.
+        // Legacy records never gain new exclusions when refreshed or recovered later.
+        const validationBinding = execution.correction && fresh && !generated && execution.validationSource !== undefined
+            ? { ...execution.binding, validation_policy: "inputs-and-concrete-outputs-v1" } : undefined;
+        const validatedSource = validationBinding && await validatedSourceSnapshot(execution.projectRoot, validationBinding).catch(() => undefined);
+        const proofFresh = fresh && (!validationBinding || validatedSource === execution.validationSource);
+        const observed = proofFresh && validatedSource && validationBinding
+            ? { binding: validationBinding, source: validatedSource, candidate: validatedSource } : refreshed;
         hostGoalExecutions.set(execution.callID, { ...execution,
-            ...(refreshed === undefined ? {} : { source: refreshed.source, candidate: refreshed.candidate }),
+            ...observed,
             startedAt: observedStartedAt, endedAt, exitCode: exitCode ?? null,
-            ...(outcome === undefined ? {} : { outcome }), ...(immutableRef === undefined ? {} : { immutableRef }), fresh });
+            ...(outcome === undefined ? {} : { outcome }), ...(immutableRef === undefined ? {} : { immutableRef }), fresh: proofFresh });
         if (execution.correction) {
             await input.runtimeBridge?.recordReviewerCorrectionCheck?.(execution.root, execution.correction.taskID, {
                 dispatchCallID: execution.correction.dispatchCallID, childSessionID: execution.sessionID, callID: execution.callID,
                 command: execution.correction.commands, startedAt: observedStartedAt, endedAt, exitCode: exitCode ?? null,
-                binding: execution.binding, source: refreshed?.source ?? execution.source, candidate: refreshed?.candidate ?? execution.candidate,
-                fresh: fresh && outcome === "pass",
-                ...(execution.validationInputs !== undefined && refreshed &&
-                    (refreshed.source !== execution.source || refreshed.candidate !== execution.candidate)
-                    ? { generatedInputs: execution.validationInputs } : {}),
+                binding: proofFresh && validationBinding && validatedSource ? validationBinding : execution.binding,
+                source: observed?.source ?? execution.source, candidate: observed?.candidate ?? execution.candidate,
+                fresh: proofFresh && outcome === "pass",
+                ...(generated ? { generatedInputs: execution.validationInputs } : {}),
             });
         }
     }

package/dist/plugin/mission-review.js

@@ -12,8 +12,26 @@ import { taskChildSessionID } from "./task-result-repair.js";
 import { normalizeManifestScope } from "../core/path.js";
 import { declaredArtifacts } from "./declared-artifacts.js";
 import { canonicalDeclaredValidationMembers, normalizeCommand } from "./gate.js";
-import { currentSnapshotProtection, refreshProtectedSnapshot, snapshotScratchExclusion, validationInputSnapshot } from "./protected-snapshot.js";
+import { currentSnapshotProtection, isRuntimeControlPath, refreshProtectedSnapshot, snapshotScratchExclusion, validationInputSnapshot } from "./protected-snapshot.js";
 const exec = promisify(execFile);
+const notRepository = (error) => /fatal: not a git repository \(or (?:any of the parent directories|any parent up to mount point [^\r\n)]+)\)(?:: \.git)?/u
+    .test(String(error.stderr ?? ""));
+async function currentGitDiff(git, paths) {
+    try {
+        return await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...paths]);
+    }
+    catch (error) {
+        try {
+            await git(["rev-parse", "--verify", "HEAD"]);
+        }
+        catch (headError) {
+            if (!/fatal: Needed a single revision/u.test(String(headError.stderr ?? "")))
+                throw headError;
+            return git(["diff", "--no-ext-diff", "--no-textconv", "--", ...paths]); // Unborn HEAD only.
+        }
+        throw error; // A real HEAD with missing/corrupt objects needs repair, not an empty diff.
+    }
+}
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const validationDirectoryMatches = (input, directory) => directory === undefined || typeof input.workdir !== "string" || resolve(directory, input.workdir) === resolve(directory);
 /** Reviewer-facing evidence preserves execution/coverage; the host retains the full snapshot recipe. */
@@ -124,15 +142,23 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
     }
     const matched = [];
     let complete;
-    let previousEnd = notBefore, failed;
+    let previousEnd = notBefore, overlap = false, failed;
     for (const attempt of attempts.sort((a, b) => a.started - b.started || a.completed - b.completed)) {
-        if (attempt.started < editedAt)
+        // Bound native checks are compared with their actual input bytes below. A later
+        // report/cache write is not itself a source change. Unbound history stays conservative.
+        if (!checks && attempt.started < editedAt)
             continue;
         const commands = canonicalDeclaredValidationMembers(attempt.command, declared, matched.length % declared.length);
         if (!commands)
             continue; // Focused diagnostics are not formal proof.
-        if (attempt.started < previousEnd)
-            return { ready: false, reason: "mission-review-correction-validation-order:overlap" };
+        if (attempt.started < previousEnd) {
+            complete = undefined;
+            matched.length = 0;
+            failed = undefined;
+            overlap = true;
+            previousEnd = Math.max(previousEnd, attempt.completed);
+            continue; // A later complete ordered retry can recover in this same admission.
+        }
         previousEnd = attempt.completed;
         if (commands[0] !== declared[matched.length] || matched.length === declared.length)
             matched.length = 0;
@@ -151,12 +177,16 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
                     continue;
             }
             matched.push({ callID: attempt.callID, member, occurrence: matched.length });
-            if (matched.length === declared.length)
+            if (matched.length === declared.length) {
                 complete = [...matched];
+                overlap = false;
+            }
         }
     }
     if (failed)
         return { ready: false, reason: `mission-review-correction-validation-failed:${failed.command.join(" && ")}`, failure: failed, nextOccurrence: 0 };
+    if (overlap && !matched.length)
+        return { ready: false, reason: "mission-review-correction-validation-order:overlap", nextOccurrence: 0 };
     if (!complete)
         return { ready: false, reason: `mission-review-correction-validation-missing:${declared[matched.length]}`, nextOccurrence: matched.length };
     for (const item of complete) {
@@ -465,18 +495,87 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
     const toolInput = scope.read.some(path => normalizeManifestScope(path).path.startsWith(TOOL_ENVIRONMENT));
     const scopes = [...local, ...(toolInput ? [] : [`:(exclude)${TOOL_ENVIRONMENT}`])];
     const git = async (args) => (await exec("git", args, { cwd: directory, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    const names = local.length ? await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]) : "";
-    const untracked = new Set((local.length ? await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes]) : "").split("\0").filter(Boolean));
+    let names = "", ignored = "", repository = true, scopedDiff = "";
+    const untracked = new Set(), currentFiles = new Set();
+    try {
+        if (local.length) {
+            names = await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]);
+            for (const path of (await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes])).split("\0").filter(Boolean))
+                untracked.add(path);
+            ignored = await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]);
+        }
+    }
+    catch (error) {
+        if (!notRepository(error))
+            throw error;
+        repository = false;
+        // Mission storage can be outside Git while its declared outputs are repositories,
+        // worktrees or plain files. Inventory those outputs in place, not the storage root.
+        const collected = new Set(), walked = new Set();
+        const collect = async (path) => {
+            if (walked.has(path) || excluded(path))
+                return;
+            walked.add(path);
+            if (local.includes(".") && isRuntimeControlPath(path) && !local.some(scope => scope !== "." &&
+                (path === scope || path.startsWith(`${scope}/`))))
+                return;
+            if (!toolInput && (path === TOOL_ENVIRONMENT || path.startsWith(`${TOOL_ENVIRONMENT}/`)))
+                return;
+            const absolute = resolve(directory, path);
+            const stat = await lstat(absolute).catch((error) => {
+                if (error.code !== "ENOENT")
+                    throw error;
+                return undefined;
+            });
+            if (!stat?.isDirectory()) {
+                collected.add(path);
+                untracked.add(path);
+                return;
+            }
+            const scopedGit = async (args) => (await exec("git", args, { cwd: absolute, maxBuffer: 8 * 1024 * 1024 })).stdout;
+            const pathspec = ["."]; // Shared tooling is rooted at the Mission, not each output repository.
+            let tracked;
+            try {
+                tracked = await scopedGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...pathspec]);
+            }
+            catch (error) {
+                if (!notRepository(error))
+                    throw error;
+                for (const child of (await readdir(absolute)).filter(name => name !== ".git").sort()) {
+                    await collect(join(path, child).replaceAll("\\", "/"));
+                }
+                return;
+            }
+            const prefix = (name) => join(path, name).replaceAll("\\", "/");
+            for (const name of tracked.split("\0").filter(Boolean)) {
+                collected.add(prefix(name));
+                currentFiles.add(prefix(name));
+            }
+            for (const name of (await scopedGit(["ls-files", "-z", "--others", "--exclude-standard", "--", ...pathspec])).split("\0").filter(Boolean))
+                untracked.add(prefix(name));
+            for (const name of (await scopedGit(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...pathspec])).split("\0").filter(Boolean)) {
+                collected.add(prefix(name));
+                untracked.add(prefix(name));
+            }
+            // The mission's baseline belongs to its root, not to these different repositories.
+            // With no baseline here, committed outputs still appear as current file content.
+            const delta = await currentGitDiff(scopedGit, pathspec);
+            if (delta)
+                scopedDiff += `\n--- repository output: ${path} ---\n${delta}`;
+        };
+        for (const path of local)
+            await collect(path);
+        names = [...collected].sort().join("\0");
+    }
     // Go's ignored in-project caches may be writable during validation but are not candidate
     // output. Keep every other ignored declared output visible and fingerprinted, including
     // directories of generated artifacts; focused references can still pin a cache file.
-    const ignored = local.length ? await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]) : "";
     for (const path of ignored.split("\0").filter(Boolean))
         untracked.add(path);
     const omitted = [];
     const unreadable = [];
-    let diff = "";
-    if (local.length && displayBaseline) {
+    let diff = scopedDiff;
+    if (repository && local.length && displayBaseline) {
         // HEAD-only diffs are empty once the author commits. Display the original mission delta
         // or the focused correction delta without changing the full fingerprint basis.
         const changed = (await git(["diff", "--name-only", "-z", "--no-ext-diff", displayBaseline, "--", ...scopes]))
@@ -501,9 +600,8 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
         }
         omitted.push(...changed.slice(shown.length));
     }
-    else if (local.length) {
-        diff = await git(["diff", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...scopes])
-            .catch(() => git(["diff", "--no-ext-diff", "--no-textconv", "--", ...scopes]));
+    else if (repository && local.length) {
+        diff = await currentGitDiff(git, scopes);
     }
     const unchanged = diff.length === 0;
     let excerpt = selected + diff;
@@ -519,7 +617,7 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
         try {
             const absolute = resolve(directory, path), stat = await lstat(absolute);
             sourceUpdate(String(stat.mode));
-            const include = includedByParent || untracked.has(path) || unchanged;
+            const include = includedByParent || untracked.has(path) || currentFiles.has(path) || unchanged;
             const heading = `\n--- ${includedByParent || untracked.has(path) ? "new file" : "current file"}: ${path} ---\n`;
             const room = include ? Math.max(0, 24_000 - Buffer.byteLength(excerpt) - Buffer.byteLength(heading)) : 0;
             let preview = Buffer.alloc(0);

package/dist/plugin/protected-snapshot.d.ts

@@ -16,6 +16,10 @@ export declare function operationInputSnapshot(projectRoot: string, binding: Bin
 /** A validation may populate write-only caches. Keep its declared read inputs stable
  * while binding the resulting candidate (including those outputs) after the command. */
 export declare function validationInputSnapshot(projectRoot: string, binding: Binding): Promise<string | undefined>;
+/** Pin a non-generating check's inputs and concrete source outputs, not incidental
+ * files created later under a directory execution grant (for example result reports).
+ * Exact outputs and tracked source remain protected even when omitted from read. */
+export declare function validatedSourceSnapshot(projectRoot: string, binding: Binding): Promise<string | undefined>;
 export declare function protectedSnapshot(authorization: {
     manifestPath: string;
     manifestHash: string;

package/dist/plugin/protected-snapshot.js

@@ -92,7 +92,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
     const entries = [];
     const canonicalRoot = await realpath(projectRoot);
     const scratchExcluded = binding ? snapshotScratchExclusion(binding) : () => false;
-    const visit = async (absolute, ancestors = new Set(), projectArtifacts = false) => {
+    const visit = async (absolute, ancestors = new Set(), projectArtifacts = false, physical = absolute) => {
         if (excluded.some(root => !outside(root, absolute)))
             return true;
         if (scratchExcluded(absolute))
@@ -102,7 +102,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             return false;
         if ((sourcePolicy === "project-files-v1" || projectArtifacts) && isRuntimeControlPath(scoped))
             return true;
-        const metadata = await lstat(absolute).catch((error) => {
+        const metadata = await lstat(physical).catch((error) => {
             if (error.code === "ENOENT")
                 return undefined;
             throw error;
@@ -112,7 +112,7 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             return true;
         }
         if (metadata.isSymbolicLink()) {
-            const target = await realpath(absolute).catch(() => undefined);
+            const target = await realpath(physical).catch(() => undefined);
             if (target === undefined)
                 return false;
             const relativeTarget = relative(canonicalRoot, target);
@@ -120,13 +120,16 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
                 ancestors.has(target))
                 return false;
             const targetMetadata = await stat(target);
-            const link = await readlink(absolute);
+            const link = await readlink(physical);
             if (targetMetadata.isDirectory()) {
                 // Keep the logical scope path and link target in the digest; do not follow external links or cycles.
                 entries.push([scoped, `symlink:${link}`]);
                 const next = new Set([...ancestors, target]);
-                for (const child of (await readdir(absolute)).sort())
-                    if (!await visit(join(absolute, child), next, projectArtifacts))
+                // Windows compatibility junctions can deny enumeration through the alias while
+                // their resolved directory remains readable. Traverse the already resolved target.
+                // Retain logical entry labels so unchanged existing evidence keeps its identity.
+                for (const child of (await readdir(target)).sort())
+                    if (!await visit(join(absolute, child), next, projectArtifacts, join(target, child)))
                         return false;
                 return true;
             }
@@ -136,19 +139,19 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePoli
             return true;
         }
         if (metadata.isDirectory()) {
-            const real = await realpath(absolute);
+            const real = await realpath(physical);
             if (ancestors.has(real))
                 return false;
             entries.push([scoped, "directory"]);
             const next = new Set([...ancestors, real]);
-            for (const child of (await readdir(absolute)).sort())
-                if (!await visit(join(absolute, child), next, projectArtifacts))
+            for (const child of (await readdir(physical)).sort())
+                if (!await visit(join(absolute, child), next, projectArtifacts, join(physical, child)))
                     return false;
             return true;
         }
         if (!metadata.isFile())
             return false;
-        entries.push([scoped, "file", createHash("sha256").update(await readFile(absolute)).digest("hex")]);
+        entries.push([scoped, "file", createHash("sha256").update(await readFile(physical)).digest("hex")]);
         return true;
     };
     for (const path of [...new Set(paths)].sort()) {
@@ -210,6 +213,40 @@ export async function validationInputSnapshot(projectRoot, binding) {
         ? declaredScopeDigest(projectRoot, paths, hash, true, [], binding)
         : protectedScopeDigest(projectRoot, paths, hash, binding.source_policy, [], binding);
 }
+/** Pin a non-generating check's inputs and concrete source outputs, not incidental
+ * files created later under a directory execution grant (for example result reports).
+ * Exact outputs and tracked source remain protected even when omitted from read. */
+export async function validatedSourceSnapshot(projectRoot, binding) {
+    const current = await snapshotManifest(projectRoot, binding);
+    if (!current?.manifest.read.length)
+        return undefined; // An absent input set retains the full-source recipe.
+    const scopes = [...binding.source_paths.map(path => resolve(projectRoot, path)),
+        ...current.manifest.write.map(path => resolve(projectRoot, normalizeManifestScope(path).path))];
+    const protection = [...new Set([...(binding.freshness?.protected_paths ?? []),
+            ...await currentSnapshotProtection(projectRoot, current.manifest)])];
+    const reads = current.manifest.read.map(entry => resolve(projectRoot, normalizeManifestScope(entry).path));
+    const currentBinding = binding.freshness ? { ...binding, freshness: { ...binding.freshness, protected_paths: protection } } : binding;
+    // A populated directory grant without a concrete output/input inventory cannot safely
+    // acquire the report-only recipe. Keep the original full-candidate freshness instead.
+    for (const entry of binding.validation_policy === undefined ? current.manifest.write : []) {
+        const output = resolve(projectRoot, normalizeManifestScope(entry).path);
+        if (reads.some(input => !outside(input, output)) || snapshotScratchExcluded(currentBinding, output) ||
+            protection.some(path => path !== output && !outside(output, path) && !reads.includes(path)))
+            continue;
+        const stat = await lstat(output).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+            return undefined;
+        });
+        if (stat?.isDirectory() && (await readdir(output)).length)
+            return undefined;
+    }
+    const paths = [...new Set([...reads,
+            ...protection.filter(path => scopes.some(scope => !outside(scope, path)))])];
+    return binding.source_policy === "declared-paths-v1"
+        ? declaredScopeDigest(projectRoot, paths, current.hash, true, [], currentBinding)
+        : protectedScopeDigest(projectRoot, paths, current.hash, binding.source_policy, [], currentBinding);
+}
 export async function protectedSnapshot(authorization, options = {}) {
     const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
     if (manifestSource === undefined)
@@ -262,6 +299,10 @@ export async function refreshProtectedSnapshot(projectRoot, binding) {
     const current = await snapshotManifest(projectRoot, binding);
     if (!current)
         return undefined;
+    if (binding.validation_policy === "inputs-and-concrete-outputs-v1") {
+        const source = await validatedSourceSnapshot(projectRoot, binding);
+        return source === undefined ? undefined : { source, candidate: source };
+    }
     const manifestHash = current.hash;
     const sourcePaths = binding.source_paths.map(path => resolve(projectRoot, path));
     const candidatePaths = binding.candidate_paths.map(path => resolve(projectRoot, path));

package/dist/runtime-assets-v010.js

@@ -45,9 +45,9 @@ The status token, its icon, TRUE_INTERRUPTION and TRUE_BLOCKER are protocol toke
 even when the surrounding conclusion is translated. Translate only the display labels and keep their order.
 
 DONE requires a succeeded ${profile.toolPrefix}complete_operator receipt only when a current active operator contract
-owns the turn; the host renders the measured return report from that receipt. Without it, return INTERRUPTED, BLOCKED, or NEED_DECISION naming
-the exact unresolved condition. An exhausted budget, an unapproved or failed proposal, a terminated child, a refused
-contract operation, or an unreachable acceptance is an INTERRUPTED return, never a silent stop. A cancelled or completed
+owns the turn; the host renders the measured return report from that receipt. Without it, continue authorized recovery;
+only a real stop, exhausted budget, unrecoverable internal failure or user-only decision permits a terminal return.
+Failed proposals, child failures and refused control calls need local repair first. A cancelled or completed
 historical operator run does not gate a later ordinary turn, but an explicit cancel in the same turn still requires
 INTERRUPTED. A later ordinary turn with no active operator contract or accepted execution criteria may use DONE
 without that receipt; the host verifies that exact uncontracted turn boundary before preserving it.
@@ -57,8 +57,10 @@ A genuine interruption also requires the canonical machine line \`TRUE_INTERRUPT
 A refused control operation is a local process defect, not a terminal blocker. Read the returned status and
 next_action, apply that one correction, and continue in the same turn. Never reissue an unchanged refused
 request: an active contract returns ${profile.toolPrefix}operator_status and the existing next Task, and an
-unavailable contract-repair validation resume returns the preserved run state and its decision. When the same
-refusal repeats with unchanged state, stop retrying and return one INTERRUPTED checkpoint naming that refusal.
+unavailable contract-repair validation resume returns the preserved run state and its decision. Stop repeating an
+unchanged refused request, not the work: if Operator can Fix within existing permissions, requirements and budget,
+repair or use another supported route in the same turn. Reuse fresh successful checks; show cause, correction and result.
+Only when no authorized recovery remains, stop retrying and return one INTERRUPTED checkpoint naming that refusal.
 
 ${canonicalFixture("TERMINAL_STATUS_SEMANTICS_FIXTURE")}
 

package/dist/runtime-mission-assets.js

@@ -206,8 +206,9 @@ Coordinator's internal Worker/Reviewer/Scout/Advisor tasks stay foreground. Unit
 New unrelated chat does not cancel, restart, replace, or extend an active Mission. Adopt steering only
 through start_mission intent=continue; frozen Worker contract changes use intent=replace/cancellation.
 Do not poll or re-run successful checks. Inspect operator_status only to recover missing durable state.
-Ordinary defects return to Coordinator, not the user. Ask through question only for a user-only choice,
-an extension beyond the original requirements, or a cumulative budget increase. Resume the same work after
+Operator fixes ordinary path, environment, registration and Review-preparation defects directly when authorized;
+otherwise resume the same author with concrete feedback, not a user turn. Retain mission, evidence and cumulative spend.
+Ask through question only for a user-only choice, an extension beyond the original requirements, or a cumulative budget increase. Resume the same work after
 the answer. For an approved Mission Worker-unit increase, root calls ${profile.toolPrefix}extend_mission_budget
 with operator_status.mission_id and the new cumulative max_units (not the increment), then resumes the same
 Coordinator. This does not change a separate campaign dollar cap or dispatch a Worker. Do not reset spend,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.13.6",
+  "version": "0.13.8",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",