sortie-dogs 0.3.15 → 0.3.17

package/README.md

@@ -12,7 +12,7 @@
 ![Sortie-dogs coordinating a bounded implementation workflow](https://raw.githubusercontent.com/zufall-upon/Sortie-dogs/main/docs/assets/sortie-workflow.gif)
 
 Sortie-dogs is an opt-in OpenCode orchestration plugin. It turns a task into a
-scoped plan, parallel investigation, dedicated implementation, canonical
+scoped plan, parallel investigation, bounded independent implementation, canonical
 validation, and evidence-backed completion—while preserving standard OpenCode
 agents and settings.
 
@@ -20,7 +20,7 @@ Requirements: Node.js 22.6 or newer, npm, and OpenCode.
 
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) · [CLI testing](docs/cli-testing.md)
 
-Release: [v0.3.15](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.3.15)
+Release: [v0.3.17](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.3.17)
 
 ## Quick start
 
@@ -148,7 +148,7 @@ Optional settings in `.opencode/sortie-dogs.json`:
   "handoffPaths": ["handoff.json"],
   "readOnlyTools": ["my_mcp_search"],
   "dedicatedWorkerModel": { "model": "provider/model", "variant": "deep" },
-  "continuation": { "enabled": true, "maxAutoContinues": 2 },
+  "continuation": { "enabled": true, "maxAutoContinues": 10 },
   "reflection": {
     "enabled": false,
     "layers": { "run": true, "project": true, "global": false }
@@ -182,8 +182,8 @@ global file for durable global settings.
   and resumes the same root session on the next independent unit. Only a root
   `dog-coordinator` session is ever resumed: a child session is never promoted and
   another coordinator is never adopted. Set `enabled` to `false` to keep every
-  batch manual, raise or lower `maxAutoContinues` (default `2`, maximum `10`) to
-  change the ceiling, and set `summarizeModel` to override the latest coordinator
+  batch manual, lower `maxAutoContinues` (default and maximum `10`) to change the
+  ceiling, and set `summarizeModel` to override the latest coordinator
   model used for compaction. Normal OpenCode auto-compaction keeps the
   host's auto-continue behavior; Sortie suppresses it only while its own
   explicitly queued rollover owns the resume.
@@ -207,8 +207,10 @@ global file for durable global settings.
   exactly three bounded scouts before implementation begins.
 - **Writes stay inside the assignment.** Exact source or operation manifests
   gate edits and handoffs.
-- **One accountable implementation path.** One dedicated worker handles
-  implementation, remediation, and blocker resolution.
+- **Safe implementation fan-out.** Independent units may use two or three workers
+  with non-overlapping write manifests; dependent or same-path work stays on one worker.
+- **Runtime overlap protection.** Active equal or ancestor write scopes are rejected
+  before mutation, and full validation waits until every parallel unit joins.
 - **Evidence before completion.** Canonical validation, risk-based review, and
   terminal evidence gate coordinator-owned completion and commits.
 - **Long work can recover.** Restart recovery and bounded compaction continue

package/dist/asset-version.d.ts

@@ -2,5 +2,5 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export declare const RUNTIME_ASSET_VERSION = "0.3.4-card37";
+export declare const RUNTIME_ASSET_VERSION = "0.3.4-card39";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -2,4 +2,4 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export const RUNTIME_ASSET_VERSION = "0.3.4-card37";
+export const RUNTIME_ASSET_VERSION = "0.3.4-card39";

package/dist/plugin/continuation.d.ts

@@ -23,7 +23,7 @@ export declare const AUTO_CONTINUE_PREFIX = "SORTIE_AUTO_CONTINUE";
 export declare const STEP_CONTINUE_PREFIX = "SORTIE_STEP_CONTINUE";
 /** First line the rollover summary must emit, mirroring the batch target of three attempts. */
 export declare const ROLLOVER_TOKEN = "SORTIE_ROLLOVER_COMPACTED";
-export declare const DEFAULT_MAX_AUTO_CONTINUES = 2;
+export declare const DEFAULT_MAX_AUTO_CONTINUES = 10;
 /**
  * A coordinator that exhausted its step budget reports remaining work instead of continuing. That
  * report is a continuation request in every respect except the marker, so it is treated as one.

package/dist/plugin/continuation.js

@@ -25,7 +25,7 @@ const TOOL_REQUESTED_REPORT = "Tool-requested Sortie rollover. Preserve task ide
     "batch counters, blocker state, and the exact next action from the latest messages.";
 /** First line the rollover summary must emit, mirroring the batch target of three attempts. */
 export const ROLLOVER_TOKEN = "SORTIE_ROLLOVER_COMPACTED";
-export const DEFAULT_MAX_AUTO_CONTINUES = 2;
+export const DEFAULT_MAX_AUTO_CONTINUES = 10;
 /**
  * A coordinator that exhausted its step budget reports remaining work instead of continuing. That
  * report is a continuation request in every respect except the marker, so it is treated as one.
@@ -117,6 +117,39 @@ const ROLLOVER_PROMPT = [
     "## 次action",
     "- <次に着手する1手順>",
 ].join("\n");
+const RECOVERY_ROLLOVER_PROMPT = ROLLOVER_PROMPT
+    .replace("The coordinator final report immediately before compaction is the newest source of truth. Its outcomes and next action override older context.", "The recovery report overrides only terminal outcomes and batch counters. Preserve unmet user requirements, ordered scope, no-stop constraints, and the exact next unit from the conversation.")
+    .replace("Preserve task identity, every accepted fact, both manifests, ordered validation history, batchTarget, batchAttempted, batchCommitted, batchReconciled, blocker state, and the exact next action. If a value is absent, write なし; never guess one.", "Preserve task identity, every accepted fact, both manifests, ordered validation history, batchTarget, batchAttempted, batchCommitted, batchReconciled, blocker state, unmet ordered scope, and the exact next unit. If a value is absent, write なし; never guess one.");
+const ROLLOVER_HEADINGS = [
+    "## 未達のユーザー要求",
+    "## task identity と制約",
+    "## manifest",
+    "## validation履歴",
+    "## batch counters",
+    "## 未解決blocker",
+    "## 次action",
+];
+function validRecoveryCompactionSummary(text) {
+    const lines = text.trim().split(/\r?\n/u);
+    if (lines[0] !== ROLLOVER_TOKEN)
+        return false;
+    let previous = 0;
+    const indices = [];
+    for (const heading of ROLLOVER_HEADINGS) {
+        const index = lines.indexOf(heading, previous + 1);
+        if (index < 0)
+            return false;
+        indices.push(index);
+        previous = index;
+    }
+    for (const headingIndex of [0, ROLLOVER_HEADINGS.length - 1]) {
+        const start = indices[headingIndex] + 1;
+        const end = indices[headingIndex + 1] ?? lines.length;
+        if (!lines.slice(start, end).some((line) => line.startsWith("- ") && line !== "- なし"))
+            return false;
+    }
+    return true;
+}
 function unrefTimer(timer) {
     if (typeof timer?.unref === "function") {
         timer.unref();
@@ -187,6 +220,8 @@ export function createContinuationHooks(client, directory, policySource, timings
         const created = {
             attempts: 0,
             pendingRollover: false,
+            preserveCompactionScope: false,
+            recoverySummaryValidated: false,
             resetAttemptsAfterCompaction: false,
             limitCompacted: false,
             active: false,
@@ -253,7 +288,7 @@ export function createContinuationHooks(client, directory, policySource, timings
             return false;
         return true;
     }
-    async function issueResume(sessionID, report) {
+    async function issueResume(sessionID, report, preserveCompactionScope) {
         const resume = client?.session?.promptAsync;
         if (resume === undefined)
             throw new Error("resume capability unavailable");
@@ -265,21 +300,53 @@ export function createContinuationHooks(client, directory, policySource, timings
                 parts: [{
                         type: "text",
                         synthetic: true,
-                        text: `${AUTO_CONTINUE_PREFIX}\n直前のcompaction summaryは破棄する。矛盾時だけでなく全面的に参照禁止。\n` +
-                            `以下の直前最終報告だけをpost-compaction状態の正本として再構築する:\n${report}\n` +
-                            "batchAttempted/batchCommitted/batchReconciledを保持し、terminal unitを再実行せず次の独立unitから同rootで継続。",
+                        text: preserveCompactionScope
+                            ? `${AUTO_CONTINUE_PREFIX}\n直前compaction summaryの未達user要求・ordered scope・no-stop制約を保持する。\n` +
+                                `以下の回復reportはterminal outcomeとbatch counterだけを上書きする:\n${report}\n` +
+                                "terminal unitを再実行せず、summaryが保持した順序の次の独立unitから同rootで継続。"
+                            : `${AUTO_CONTINUE_PREFIX}\n直前のcompaction summaryは破棄する。矛盾時だけでなく全面的に参照禁止。\n` +
+                                `以下の直前最終報告だけをpost-compaction状態の正本として再構築する:\n${report}\n` +
+                                "batchAttempted/batchCommitted/batchReconciledを保持し、terminal unitを再実行せず次の独立unitから同rootで継続。",
                     }],
             },
         });
         if (!promptCallSucceeded(resumed))
             throw new Error("resume request rejected");
     }
+    function terminalCheckpoint(text) {
+        return /\bstatus:\s*(?:DONE|BLOCKED|NEED_DECISION)\b/iu.test(text);
+    }
+    function latestProgressLine(text) {
+        return text.split(/\r?\n/u).filter((line) => line.includes("📊")).at(-1);
+    }
+    function latestProgressPercent(text) {
+        const value = Number(/📊[^\n]*?(\d{1,3})\s*%/u.exec(latestProgressLine(text) ?? "")?.[1]);
+        return Number.isInteger(value) && value >= 0 && value <= 100 ? value : undefined;
+    }
+    function batchHasIndependentRemainder(text) {
+        const latest = /\battempted\s+(\d+)\s*\/\s*(\d+)/iu.exec(latestProgressLine(text) ?? "");
+        if (latest === null)
+            return false;
+        const attempted = Number(latest[1]);
+        const target = Number(latest[2]);
+        return Number.isInteger(attempted) && Number.isInteger(target) && attempted >= 0 && attempted < target;
+    }
+    function batchCheckpointNeedsContinuation(text) {
+        const line = latestProgressLine(text) ?? "";
+        const explicit = /\bcontinuation\s*:\s*(required|none)\b/iu.exec(line)?.[1]?.toLowerCase();
+        const legacy = explicit === undefined && /\(\s*Project checkpoint\s*\)/iu.test(line);
+        return !terminalCheckpoint(text) && latestProgressPercent(text) === 100 &&
+            batchHasIndependentRemainder(text) && (explicit === "required" || legacy);
+    }
     function nonTerminalProgress(text) {
         if (text.startsWith(STEP_CONTINUE_PREFIX) || text.startsWith(AUTO_CONTINUE_PREFIX))
             return false;
-        if (/\bstatus:\s*(?:DONE|BLOCKED|NEED_DECISION)\b/iu.test(text))
+        if (terminalCheckpoint(text))
             return false;
-        return /➡️\s*(?:次action|next_action)\s*:\s*\S/iu.test(text);
+        if (/➡️\s*(?:次action|next_action)\s*:\s*\S/iu.test(text))
+            return true;
+        const percent = latestProgressPercent(text);
+        return percent !== undefined && (percent < 100 || batchHasIndependentRemainder(text));
     }
     async function issueStepContinue(sessionID, state, report, agent) {
         const resume = client?.session?.promptAsync;
@@ -299,7 +366,7 @@ export function createContinuationHooks(client, directory, policySource, timings
                     parts: [{
                             type: "text",
                             synthetic: true,
-                            text: `${STEP_CONTINUE_PREFIX}\n直前出力は非terminal進捗。繰り返さず、同じcandidateのnext_actionを今すぐtoolで実行する。\n${report}`,
+                            text: `${STEP_CONTINUE_PREFIX}\n直前出力は非terminal進捗。進捗報告を繰り返さず、明示next_actionが欠落していれば最新の未達user要求とbatch counterから次の必要toolを特定して同じturnで実行する。\n${report}`,
                         }],
                 },
             });
@@ -322,6 +389,8 @@ export function createContinuationHooks(client, directory, policySource, timings
     async function arbitrateResume(sessionID, state) {
         if (!state.pendingRollover || !state.active || state.continueReport === undefined)
             return false;
+        if (state.preserveCompactionScope && !state.recoverySummaryValidated)
+            return false;
         const epoch = state.rolloverEpoch;
         if (state.resumeIssuedEpoch === epoch)
             return true;
@@ -333,7 +402,7 @@ export function createContinuationHooks(client, directory, policySource, timings
         state.resumeIssuingEpoch = epoch;
         state.resumeAttempts += 1;
         try {
-            await issueResume(sessionID, report);
+            await issueResume(sessionID, report, state.preserveCompactionScope);
             if (sessions.get(sessionID) !== state || state.rolloverEpoch !== epoch)
                 return false;
             state.resumeIssuedEpoch = epoch;
@@ -342,6 +411,8 @@ export function createContinuationHooks(client, directory, policySource, timings
             state.compactedRollover = false;
             state.promptPending = false;
             state.continueReport = undefined;
+            state.preserveCompactionScope = false;
+            state.recoverySummaryValidated = false;
             // The accepted prompt now belongs to the host loop, not this rollover request.
             state.active = false;
             return true;
@@ -431,6 +502,8 @@ export function createContinuationHooks(client, directory, policySource, timings
                 state.pendingRollover = false;
                 state.compactedRollover = false;
                 state.ownsHostContinuation = false;
+                state.preserveCompactionScope = false;
+                state.recoverySummaryValidated = false;
                 if (state.resetAttemptsAfterCompaction)
                     state.attempts = 0;
                 state.limitCompacted = !state.resetAttemptsAfterCompaction;
@@ -480,11 +553,13 @@ export function createContinuationHooks(client, directory, policySource, timings
                 state.continueReport = undefined;
                 state.latestReport = undefined;
                 state.ownsHostContinuation = false;
+                state.preserveCompactionScope = false;
+                state.recoverySummaryValidated = false;
                 warnRollover(sessionID, "retries-exhausted");
             }
         }, timings.scheduleMilliseconds * (attempt + 1)));
     }
-    function queueRollover(sessionID, report, resume, resetAttemptsAfterCompaction = false) {
+    function queueRollover(sessionID, report, resume, resetAttemptsAfterCompaction = false, preserveCompactionScope = false) {
         const state = stateFor(sessionID);
         state.pendingRollover = true;
         state.compactedRollover = false;
@@ -496,6 +571,8 @@ export function createContinuationHooks(client, directory, policySource, timings
         state.compactingEpoch = undefined;
         state.latestReport = report;
         state.continueReport = resume ? report : undefined;
+        state.preserveCompactionScope = preserveCompactionScope;
+        state.recoverySummaryValidated = false;
         state.resetAttemptsAfterCompaction = resetAttemptsAfterCompaction;
         state.latestCoordinatorReport = undefined;
         if (resume)
@@ -514,7 +591,7 @@ export function createContinuationHooks(client, directory, policySource, timings
             }
         }, 0);
     }
-    async function requestContinuation(sessionID, identity, report) {
+    async function requestContinuation(sessionID, identity, report, preserveCompactionScope = false) {
         const state = stateFor(sessionID);
         const active = policy();
         const resolution = resolveContinuation({
@@ -530,8 +607,9 @@ export function createContinuationHooks(client, directory, policySource, timings
         if (resolution.reason === "limit-reached" && state.limitCompacted) {
             return reject("limit-reached");
         }
-        if (resolution.compact)
-            queueRollover(sessionID, report, resolution.continue);
+        if (resolution.compact) {
+            queueRollover(sessionID, report, resolution.continue, false, preserveCompactionScope);
+        }
         return resolution;
     }
     function forgetSession(sessionID) {
@@ -597,8 +675,22 @@ export function createContinuationHooks(client, directory, policySource, timings
                     (state.active || state.pendingRollover);
                 if (ownedCompactionSummary)
                     state.compactingEpoch = undefined;
-                if (ownedCompactionSummary && !trimmed.startsWith(ROLLOVER_TOKEN)) {
+                const malformedRecoverySummary = ownedCompactionSummary && state.preserveCompactionScope &&
+                    !validRecoveryCompactionSummary(trimmed);
+                if (ownedCompactionSummary && (!trimmed.startsWith(ROLLOVER_TOKEN) || malformedRecoverySummary)) {
                     warnRollover(input.sessionID, "compaction-summary-malformed");
+                    if (state.preserveCompactionScope) {
+                        state.pendingRollover = false;
+                        state.promptPending = false;
+                        state.continueReport = undefined;
+                        state.ownsHostContinuation = false;
+                        state.preserveCompactionScope = false;
+                        state.recoverySummaryValidated = false;
+                        return;
+                    }
+                }
+                if (ownedCompactionSummary && state.preserveCompactionScope) {
+                    state.recoverySummaryValidated = true;
                 }
                 /*
                  * One-shot CLI hosts can exit as soon as the compaction assistant finishes, before the
@@ -681,13 +773,19 @@ export function createContinuationHooks(client, directory, policySource, timings
             if (state !== undefined)
                 state.promptPending = false;
             const report = state?.latestReport;
+            const recovery = state?.preserveCompactionScope === true;
             const authority = report === undefined
                 ? "Sortie rollover policy is authoritative. Preserve only facts supported by the latest coordinator final report."
-                : "Sortie authoritative latest coordinator final report follows. It overrides all older context; copy its terminal outcomes, counters, and next action exactly:\n" + report;
+                : state?.preserveCompactionScope === true
+                    ? "Preserve unmet user requirements, ordered scope, and no-stop constraints from the conversation. The recovery report overrides only terminal outcomes and counters:\n" + report
+                    : "Sortie authoritative latest coordinator final report follows. It overrides all older context; copy its terminal outcomes, counters, and next action exactly:\n" + report;
             output.context = [...(output.context ?? []), authority];
+            const rolloverPrompt = recovery ? RECOVERY_ROLLOVER_PROMPT : ROLLOVER_PROMPT;
             output.prompt = report === undefined
-                ? ROLLOVER_PROMPT
-                : `${ROLLOVER_PROMPT}\n\nExact latest coordinator final report (authoritative):\n${report}`;
+                ? rolloverPrompt
+                : recovery
+                    ? `${rolloverPrompt}\n\nRecovery report (terminal outcomes and counters only):\n${report}`
+                    : `${rolloverPrompt}\n\nExact latest coordinator final report (authoritative):\n${report}`;
         },
         async sessionCompacted(sessionID) {
             const state = sessions.get(sessionID);
@@ -760,8 +858,17 @@ export function createContinuationHooks(client, directory, policySource, timings
             const identity = await readIdentity(sessionID);
             const active = policy();
             if (active.enabled && identity !== undefined && identity.agent === active.agent && !nonEmpty(identity.parentID) &&
-                state.turnRevision === revision && state.latestCoordinatorReport === report)
-                await issueStepContinue(sessionID, state, report, active.agent);
+                state.turnRevision === revision && state.latestCoordinatorReport === report) {
+                if (batchCheckpointNeedsContinuation(report)) {
+                    const recoveredReport = /➡️\s*(?:次action|next_action)\s*:\s*\S/iu.test(report)
+                        ? report
+                        : `${report}\n➡️ 次action: 未達user要求の次の独立candidateへ進む`;
+                    await requestContinuation(sessionID, identity, recoveredReport, true);
+                }
+                else {
+                    await issueStepContinue(sessionID, state, report, active.agent);
+                }
+            }
         }
     }
 }

package/dist/plugin/gate.d.ts

@@ -1,3 +1,4 @@
+import type { OperationManifest } from "../core/types.js";
 export interface ToolExecuteBeforeInput {
     tool: string;
     sessionID: string;
@@ -6,7 +7,7 @@ export interface ToolExecuteBeforeInput {
 export interface ToolExecuteBeforeOutput {
     args: unknown;
 }
-export type WriteDenialReason = "manifest-unavailable" | "session-expired" | "unclassified-command" | "path-required" | "project-boundary" | "manifest-scope" | "repeated-denial";
+export type WriteDenialReason = "manifest-unavailable" | "session-expired" | "unclassified-command" | "path-required" | "project-boundary" | "manifest-scope" | "parallel-git-mutation" | "parallel-remote-mutation" | "parallel-validation" | "session-released" | "repeated-denial";
 export declare class WriteDeniedError extends Error {
     readonly reason: WriteDenialReason;
     constructor(reason: WriteDenialReason, path: string, options?: ErrorOptions);
@@ -27,6 +28,8 @@ interface Extraction {
     ambiguous: boolean;
     paths: string[];
     gitCommit?: boolean;
+    gitMutation?: boolean;
+    remoteMutation?: boolean;
     issue?: CommandIssue;
 }
 interface CommandIssue {
@@ -42,6 +45,8 @@ export declare function resolveProjectRoot(input: {
 export declare function describeUnclassifiedCommand(tool: string, args: unknown): string | undefined;
 /** Extract known write destinations; unknown shell executables fail closed as ambiguous. */
 export declare function extractWritePaths(tool: string, args: unknown): Extraction;
+export declare function isGitMutation(tool: string, args: unknown): boolean;
+export declare function isRemoteMutation(tool: string, args: unknown): boolean;
 /**
  * Quoted segments keep their contents; every unquoted whitespace run collapses to one space so the
  * same command written with different spacing compares equal.
@@ -49,6 +54,10 @@ export declare function extractWritePaths(tool: string, args: unknown): Extracti
 export declare function normalizeCommand(command: string): string;
 /** Unbound sessions may invoke only tools whose complete input is known to be read-only. */
 export declare function isKnownReadOnlyTool(tool: string, args: unknown, additionalReadOnlyTools?: ReadonlySet<string>): boolean;
+/** Canonical scopes let sibling worker bindings reject equal or ancestor ownership. */
+export declare function canonicalManifestWriteScopes(project: ProjectPaths, manifest: OperationManifest): Promise<readonly string[]>;
+export declare function canonicalManifestReadScopes(project: ProjectPaths, manifest: OperationManifest): Promise<readonly string[]>;
+export declare function writeScopesOverlap(left: readonly string[], right: readonly string[]): boolean;
 export declare function createProjectPaths(rootCandidate: string): Promise<ProjectPaths>;
 export declare function createWriteGate(project: ProjectPaths, value: unknown): Promise<WriteGate>;
 export {};

package/dist/plugin/gate.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { lstat, realpath } from "node:fs/promises";
-import { isAbsolute, relative, resolve } from "node:path";
+import { basename, isAbsolute, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import { RelativePathError, normalizeManifestPath, normalizeRelativePath } from "../core/path.js";
 import { validateOperationManifestSchema } from "../core/validate-schema.js";
@@ -14,6 +14,10 @@ export class WriteDeniedError extends Error {
             "path-required": "write path must be explicit.",
             "project-boundary": "project-root-relative path required.",
             "manifest-scope": "operation manifest write scope.",
+            "parallel-git-mutation": "parallel implementation workers cannot mutate shared Git state.",
+            "parallel-remote-mutation": "parallel implementation workers cannot mutate shared remote state.",
+            "parallel-validation": "parallel implementation validation must run after the worker join.",
+            "session-released": "released session must re-read only its handoff and bind before further work.",
             "repeated-denial": "same command and denial reason already denied in this session; retry blocked.",
         };
         super(`Write denied for "${safePath(path)}": ${messages[reason]}`, options);
@@ -131,6 +135,14 @@ function isRemoteOnlyGitHubCommand(tokens) {
     const command = tokens[1]?.toLowerCase();
     return command === "project" || (command === "api" && tokens[2]?.toLowerCase() === "graphql");
 }
+function isRemoteGitHubMutation(tokens) {
+    const command = tokens[1]?.toLowerCase();
+    if (command === "project") {
+        return !new Set(["field-list", "item-list", "list", "view"]).has(tokens[2]?.toLowerCase() ?? "");
+    }
+    // GraphQL transport can hide mutations in variables, files, or stdin; parallel workers fail closed.
+    return command === "api" && tokens[2]?.toLowerCase() === "graphql";
+}
 function isReadOnlyGitCommand(tokens) {
     const command = tokens[1]?.toLowerCase() ?? "";
     return READ_ONLY_GIT_COMMANDS.has(command) ||
@@ -226,9 +238,14 @@ function shellSegments(command, dialect) {
     for (let index = 0; index < masked.length; index += 1) {
         const character = masked[index];
         const pair = masked.slice(index, index + 2);
+        const segmentBefore = masked.slice(start, index).trim();
+        const hasCommandBefore = segmentBefore.length > 0;
+        const powershellCallOperator = dialect === "powershell" &&
+            (segmentBefore.length === 0 || segmentBefore.endsWith("="));
         const separator = pair === "&&" || pair === "||" ? 2
             : character === ";" || character === "\n" || character === "\r" ||
-                (character === "|" && command[index - 1] !== ">") ? 1 : 0;
+                (character === "|" && command[index - 1] !== ">") ||
+                (character === "&" && hasCommandBefore && command[index - 1] !== ">" && !powershellCallOperator) ? 1 : 0;
         if (separator === 0)
             continue;
         segments.push(command.slice(start, index));
@@ -252,6 +269,8 @@ function shellPaths(command, powershell, depth = 0) {
     let applies = false;
     let ambiguous = false;
     let gitCommit = false;
+    let gitMutation = false;
+    let remoteMutation = false;
     let issue;
     const redirection = /(?<![<>=!])(?:&|\d*)?(?:>>|>\||>)(?![=])/gu;
     const redirectionTarget = /^\s*("(?:\\.|[^"])*"|'[^']*'|&?\d+|[^\s;&|]+)/u;
@@ -344,6 +363,7 @@ function shellPaths(command, powershell, depth = 0) {
         }
         else if (executable === "git" && tokens[1]?.toLowerCase() === "add") {
             applies = true;
+            gitMutation = true;
             const selected = exactGitAddPaths(tokens);
             if (selected === undefined)
                 ambiguous = true;
@@ -352,6 +372,7 @@ function shellPaths(command, powershell, depth = 0) {
         }
         else if (executable === "git" && tokens[1]?.toLowerCase() === "commit") {
             applies = true;
+            gitMutation = true;
             if (isSafeGitCommit(tokens))
                 gitCommit = true;
             else
@@ -361,7 +382,8 @@ function shellPaths(command, powershell, depth = 0) {
             // Explicitly read-only git subcommands.
         }
         else if (/^gh(?:\.exe)?$/u.test(executable) && isRemoteOnlyGitHubCommand(tokens)) {
-            // GitHub Project commands mutate remote state, not project files. Redirections remain gated above.
+            // Remote operations are pathless, but parallel workers must distinguish reads from mutations.
+            remoteMutation ||= isRemoteGitHubMutation(tokens);
         }
         else if (depth === 0 && /^(?:pwsh|powershell)(?:\.exe)?$/u.test(executable)) {
             const literal = depthOnePowerShellLiteral(source);
@@ -376,6 +398,8 @@ function shellPaths(command, powershell, depth = 0) {
                 ambiguous ||= nested.ambiguous;
                 paths.push(...nested.paths);
                 gitCommit ||= nested.gitCommit === true;
+                gitMutation ||= nested.gitMutation === true;
+                remoteMutation ||= nested.remoteMutation === true;
                 issue ??= nested.issue;
             }
         }
@@ -385,7 +409,15 @@ function shellPaths(command, powershell, depth = 0) {
             issue ??= commandIssue(source, "executable-not-allowlisted", "use a direct allowlisted read-only command");
         }
     }
-    return { applies, ambiguous, paths, ...(gitCommit ? { gitCommit: true } : {}), ...(issue ? { issue } : {}) };
+    return {
+        applies,
+        ambiguous,
+        paths,
+        ...(gitCommit ? { gitCommit: true } : {}),
+        ...(gitMutation ? { gitMutation: true } : {}),
+        ...(remoteMutation ? { remoteMutation: true } : {}),
+        ...(issue ? { issue } : {}),
+    };
 }
 function issuePath(issue) {
     return `segment=${issue.segment}; cause=${issue.cause}; hint=${issue.hint}; retry=false; action=return-denial-to-coordinator`;
@@ -426,11 +458,19 @@ export function extractWritePaths(tool, args) {
             ambiguous: extracted.ambiguous,
             paths: [...paths, ...extracted.paths],
             ...(extracted.gitCommit ? { gitCommit: true } : {}),
+            ...(extracted.gitMutation ? { gitMutation: true } : {}),
+            ...(extracted.remoteMutation ? { remoteMutation: true } : {}),
             ...(extracted.issue ? { issue: extracted.issue } : {}),
         };
     }
     return { applies: false, ambiguous: false, paths: [] };
 }
+export function isGitMutation(tool, args) {
+    return extractWritePaths(tool, args).gitMutation === true;
+}
+export function isRemoteMutation(tool, args) {
+    return extractWritePaths(tool, args).remoteMutation === true;
+}
 /**
  * Quoted segments keep their contents; every unquoted whitespace run collapses to one space so the
  * same command written with different spacing compares equal.
@@ -492,6 +532,63 @@ async function nearestExistingRealPath(path) {
         return await realpath(candidate);
     }
 }
+function toggledCaseProbe(path) {
+    let candidate = resolve(path);
+    while (true) {
+        const name = basename(candidate);
+        const index = [...name].findIndex((character) => /[A-Za-z]/u.test(character));
+        if (index >= 0) {
+            const characters = [...name];
+            const character = characters[index];
+            characters[index] = character === character.toLowerCase()
+                ? character.toUpperCase()
+                : character.toLowerCase();
+            return {
+                original: candidate,
+                alternate: resolve(candidate, "..", characters.join("")),
+            };
+        }
+        const parent = resolve(candidate, "..");
+        if (parent === candidate)
+            return undefined;
+        candidate = parent;
+    }
+}
+async function isCaseInsensitivePath(path) {
+    if (process.platform === "win32")
+        return true;
+    const probe = toggledCaseProbe(path);
+    if (probe === undefined || probe.alternate === probe.original)
+        return false;
+    try {
+        return resolve(await realpath(probe.alternate)) === resolve(await realpath(probe.original));
+    }
+    catch {
+        return false;
+    }
+}
+async function canonicalPotentialPath(path) {
+    let candidate = resolve(path);
+    const missing = [];
+    while (true) {
+        try {
+            const realCandidate = await realpath(candidate);
+            const canonical = resolve(realCandidate, ...missing);
+            return await isCaseInsensitivePath(candidate)
+                ? canonical.toLowerCase()
+                : canonical;
+        }
+        catch (error) {
+            if (!isRecord(error) || error.code !== "ENOENT")
+                throw error;
+            const parent = resolve(candidate, "..");
+            if (parent === candidate)
+                throw error;
+            missing.unshift(basename(candidate));
+            candidate = parent;
+        }
+    }
+}
 async function isSymbolicLink(path) {
     try {
         return (await lstat(path)).isSymbolicLink();
@@ -506,6 +603,26 @@ function isWithin(root, target) {
     const path = relative(root, target);
     return path === "" || (!path.startsWith("..") && !isAbsolute(path));
 }
+async function canonicalManifestScopes(project, entries) {
+    const scopes = await Promise.all(entries.map(async (entry) => {
+        const normalized = normalizeManifestPath(entry);
+        const absolute = normalized.kind === "relative"
+            ? project.absolute(normalized.path)
+            : resolve(normalized.path);
+        return await canonicalPotentialPath(absolute);
+    }));
+    return [...new Set(scopes)];
+}
+/** Canonical scopes let sibling worker bindings reject equal or ancestor ownership. */
+export async function canonicalManifestWriteScopes(project, manifest) {
+    return await canonicalManifestScopes(project, manifest.write);
+}
+export async function canonicalManifestReadScopes(project, manifest) {
+    return await canonicalManifestScopes(project, manifest.read);
+}
+export function writeScopesOverlap(left, right) {
+    return left.some((leftPath) => right.some((rightPath) => isWithin(leftPath, rightPath) || isWithin(rightPath, leftPath)));
+}
 export async function createProjectPaths(rootCandidate) {
     const root = resolve(rootCandidate);
     const realRoot = await realpath(root);