specrails-core 6.4.0 → 6.6.0

package/dist/agent-runtime/graph/convergence.js

@@ -1,3 +1,10 @@
+// Correction rounds must converge. A fixer round that leaves the change as it
+// was, the same failure surviving round after round, or a review correction
+// that brings back a failure an earlier round had fixed, are loops: repeating
+// the checks cannot change their outcome. The host stops and says why instead
+// of spending another round (observed: verify ↔ fixer ↔ review cycling on a
+// credential problem until the requester cancelled the run).
+import { describeModifiedFiles } from '../../pipeline/pipeline-state.js';
 import { fingerprint } from '../durable-store.js';
 /** Verify visits since the latest explicit resume: a human continuing a blocked run grants a fresh budget, as for attempts. */
 export function outcomesSinceResume(history, checkpoint) {
@@ -23,6 +30,10 @@ export function describeFailure(receipt, roots, finding) {
     if (finding)
         return { signature: fingerprint({ finding: normalized(finding, roots) }), summary: finding.slice(0, 300) };
     const failed = receipt.commands.find(command => command.exitCode !== 0);
+    // A green run that rewrote its own candidate: the same files again is the same failure, whatever their content.
+    if (!failed && receipt.selfMutation?.files.length)
+        return { signature: fingerprint({ selfMutation: receipt.selfMutation.files.map(file => file.repositoryId + ':' + file.path).sort() }),
+            summary: `verification commands modified ${describeModifiedFiles(receipt.selfMutation)}`.slice(0, 400) };
     if (!failed)
         return { signature: fingerprint({ reason: receipt.reason ?? 'verification failed' }), summary: receipt.reason ?? 'verification failed' };
     const name = failed.label ?? [failed.command, ...failed.args].join(' ');

package/dist/agent-runtime/graph/nodes.js

@@ -3,12 +3,12 @@ import { verificationFailureSummary } from '../verification-diagnostics.js';
 import { addDeveloperChecks, bindPlan, expandedPlanCommands, initializeVerificationPlan, readVerificationPlan, validateProposedChecks } from '../verification-plan.js';
 import path from 'node:path';
 import { OpenSpecTools } from '../openspec.js';
-import { candidateManifest, fingerprintCandidate, frozenAcceptanceCriteria, inspectPipeline, recordAcceptance, transitionPipeline, validateAcceptanceReport, verifyPipeline, } from '../../pipeline/pipeline-state.js';
+import { candidateManifest, describeModifiedFiles, fingerprintCandidate, frozenAcceptanceCriteria, inspectPipeline, recordAcceptance, transitionPipeline, validateAcceptanceReport, verifyPipeline, } from '../../pipeline/pipeline-state.js';
 import { ARCHITECT_OUTPUT_SCHEMA, DEVELOPER_OUTPUT_SCHEMA, REVIEW_OUTPUT_SCHEMA, correctionInstructions, deepenInstructions, roleInstructions } from '../prompts.js';
 import { archive, child, journal, object, parseArchitecture, proposedVerification, write, writeDesignConfidence } from './artifacts.js';
 import { evaluateReview } from './review-policy.js';
-import { isEnvironmentFailure } from '../compact/environment.js';
-import { hostPreconditionMessage, preconditionBlock, repairEnvironment } from '../verification-repair.js';
+import { describeDrift } from '../compact/environment.js';
+import { adoptedOutputNote, environmentFailure, hostPreconditionMessage, nondeterministicOutputBlocker, preconditionBlock, repairEnvironment, selfMutationOnly } from '../verification-repair.js';
 import { unreachedTestFiles, unreachedTestsReason } from '../compact/test-reachability.js';
 import { exitCodeContradiction, exitHonestyReason } from '../compact/exit-code-honesty.js';
 import { boundedReviewManifest, reviewChanges } from '../review-context.js';
@@ -351,7 +351,11 @@ function verifyNode(deps) {
             // the model's — for every developer: a fresh worktree has no
             // node_modules whatever wrote the code. Install once where the failing
             // command runs and re-verify; only a second failure becomes feedback.
-            if (!receipt.valid && guardrailEnabled(config.guardrails, 'environment-repair') && receipt.commands.some(command => isEnvironmentFailure(command.exitCode, command.output))) {
+            const environment = !receipt.valid && guardrailEnabled(config.guardrails, 'environment-repair') ? environmentFailure(context, receipt) : undefined;
+            if (environment) {
+                const drift = environment.drift.flatMap(item => item.drift);
+                if (drift.length)
+                    note('developer', `Installed dependencies do not satisfy their declared ranges (${describeDrift(drift)}); the host reinstalls them before judging the failure.`);
                 const repair = repairEnvironment(context, receipt, config.guardrails, text => note('developer', text));
                 if (repair.refused)
                     return hostBlocked(blockerMessage(repair.refused));
@@ -363,9 +367,36 @@ function verifyNode(deps) {
                         return hostBlocked(blockerMessage(precondition));
                 }
             }
+            // Verification that rewrote candidate files itself is not a code failure
+            // for the fixer: reverting a regenerated file only makes the next run
+            // regenerate it. Same rule as the engine `verify` piece: adopt and verify
+            // once more, or stop with the typed blocker when the output keeps moving.
+            let adopted = [];
+            if (selfMutationOnly(receipt) && !step.signal?.aborted) {
+                const nondeterministic = (adoption) => {
+                    const blocker = nondeterministicOutputBlocker(context, receipt, adoption);
+                    note('fixer', 'Verification keeps modifying candidate files itself; stopping for the host instead of starting a correction round.');
+                    return { status: 'blocked', error: `Verification output is not deterministic: ${blocker.reason}. ${blocker.requiredAction} (verification_nondeterministic_output)`, usage: NO_SPEND };
+                };
+                if (!guardrailEnabled(config.guardrails, 'verification-output-adoption'))
+                    return nondeterministic(false);
+                const first = receipt.selfMutation;
+                note('developer', `Verification commands modified ${describeModifiedFiles(first)}; keeping them in the candidate and verifying once more.`);
+                receipt = await run();
+                if (receipt.valid) {
+                    adopted = first.files;
+                    note('developer', adoptedOutputNote(first));
+                }
+                else if (selfMutationOnly(receipt))
+                    return nondeterministic(true);
+                else if ((precondition = preconditionBlock(context, receipt)))
+                    return hostBlocked(blockerMessage(precondition));
+            }
+            const adoptedOutputs = [...new Map([...(state.verifyResult?.adoptedOutputs ?? []), ...adopted].map(file => [file.repositoryId + '\0' + file.path, file])).values()].slice(0, 200);
             const evidence = {
                 valid: receipt.valid, ...(receipt.reason ? { reason: receipt.reason } : {}), receiptId: receipt.id, unverifiedRepositories: uncovered,
                 commands: receipt.commands.map(command => ({ ...(command.evidenceId ? { evidenceId: command.evidenceId } : {}), repositoryId: command.repositoryId, command: command.command, args: command.args, cwd: command.cwd, exitCode: command.exitCode, failureSummary: verificationFailureSummary(command), output: command.output.slice(-2000) })),
+                ...(receipt.selfMutation ? { selfMutation: receipt.selfMutation } : {}), ...(adoptedOutputs.length ? { adoptedOutputs } : {}),
             };
             const outcome = (passed, finding) => ({ at: new Date().toISOString(), candidateHash: receipt.candidateHash, planHash: effective.planHash, passed, ...(passed ? {} : describeFailure(receipt, roots, finding)) });
             /** Hands a failure to the fixer unless the correction loop has stopped converging. */

package/dist/agent-runtime/graph/review-policy.d.ts

@@ -1,6 +1,6 @@
 import type { RuntimeConfig } from '../executor-types.js';
 import type { ReviewRecord } from './state.js';
-export declare const REVIEW_ASPECTS: readonly ["type_correctness", "pattern_adherence", "test_coverage", "security", "architectural_alignment"];
+export declare const REVIEW_ASPECTS: readonly ['type_correctness', 'pattern_adherence', 'test_coverage', 'security', 'architectural_alignment'];
 export type ReviewAspect = typeof REVIEW_ASPECTS[number];
 export interface ReviewPolicy {
     /** Minimum overall score for approval, 0–100. */

package/dist/agent-runtime/graph/state.d.ts

@@ -48,6 +48,10 @@ export interface VerificationRecord {
         failureSummary?: string[];
         output: string;
     }>;
+    /** Candidate files the verification commands modified in this run (receipt `selfMutation`). */
+    selfMutation?: import('../../pipeline/pipeline-state.js').VerificationSelfMutation;
+    /** Files verification regenerated that the host kept in the candidate; roles must not revert them. Sticky for the run. */
+    adoptedOutputs?: import('../../pipeline/pipeline-state.js').CandidateFileChange[];
 }
 export interface ReviewRecord {
     sessionId?: string;
@@ -74,8 +78,8 @@ export declare const CoreState: import("@langchain/langgraph").AnnotationRoot<{
     unverifiedRepositories: import("@langchain/langgraph").BaseChannel<string[], string[] | import("@langchain/langgraph").OverwriteValue<string[]>, unknown>;
     architecture: import("@langchain/langgraph").BaseChannel<ArchitectureRecord | null, ArchitectureRecord | import("@langchain/langgraph").OverwriteValue<ArchitectureRecord | null> | null, unknown>;
     development: import("@langchain/langgraph").BaseChannel<DeveloperRecord | null, DeveloperRecord | import("@langchain/langgraph").OverwriteValue<DeveloperRecord | null> | null, unknown>;
-    verifyResult: import("@langchain/langgraph").BaseChannel<VerificationRecord | null, VerificationRecord | import("@langchain/langgraph").OverwriteValue<VerificationRecord | null> | null, unknown>;
-    review: import("@langchain/langgraph").BaseChannel<ReviewRecord | null, ReviewRecord | import("@langchain/langgraph").OverwriteValue<ReviewRecord | null> | null, unknown>;
+    verifyResult: import("@langchain/langgraph").BaseChannel<VerificationRecord | null, import("@langchain/langgraph").OverwriteValue<VerificationRecord | null> | VerificationRecord | null, unknown>;
+    review: import("@langchain/langgraph").BaseChannel<ReviewRecord | null, import("@langchain/langgraph").OverwriteValue<ReviewRecord | null> | ReviewRecord | null, unknown>;
     /** Answers the requester gave to architect questions, oldest first. */
     answers: import("@langchain/langgraph").BaseChannel<string[], string[] | import("@langchain/langgraph").OverwriteValue<string[]>, unknown>;
     /** Autonomous investigation passes the architect already spent on a low-confidence design. */

package/dist/agent-runtime/guardrails.d.ts

@@ -1,4 +1,4 @@
-export declare const GUARDRAIL_IDS: readonly ["plan-validation", "genuine-blocking-question", "plan-language-hint", "frozen-plan-writes", "primary-language", "duplicate-sibling", "one-test-per-module", "empty-write", "evidence-gated-ticking", "inventory-retry", "synthetic-corrections", "silent-group-closure", "verify-per-group", "test-reachability", "exit-code-honesty", "environment-repair", "lockfile-repair", "verify-idle-timeout"];
+export declare const GUARDRAIL_IDS: readonly ['plan-validation', 'genuine-blocking-question', 'plan-language-hint', 'frozen-plan-writes', 'primary-language', 'duplicate-sibling', 'one-test-per-module', 'empty-write', 'evidence-gated-ticking', 'inventory-retry', 'synthetic-corrections', 'silent-group-closure', 'verify-per-group', 'test-reachability', 'exit-code-honesty', 'environment-repair', 'lockfile-repair', 'verify-idle-timeout', 'verification-output-adoption'];
 export type GuardrailId = (typeof GUARDRAIL_IDS)[number];
 type GuardrailPhase = 'architect' | 'developer' | 'host';
 interface GuardrailDescriptor {

package/dist/agent-runtime/guardrails.js

@@ -5,7 +5,8 @@
 // artifacts, one test file per module, evidence before a task is ticked, an
 // environment repaired by the host instead of the model, a hanging test
 // stopped by silence, a test file the verify command never runs, a runner
-// that prints failures but exits 0. All are ON by default; a project may switch one off in
+// that prints failures but exits 0, a file the verify commands regenerate
+// themselves adopted into the candidate instead of reverted. All are ON by default; a project may switch one off in
 // its runtime configuration (`guardrails: { <id>: false }`) to tune the
 // process. Pure bug fixes (candidate fingerprint, correction counter, argument
 // repair) are deliberately NOT here: they are correctness, not tuning.
@@ -30,6 +31,7 @@ export const GUARDRAIL_IDS = [
     'environment-repair',
     'lockfile-repair',
     'verify-idle-timeout',
+    'verification-output-adoption',
 ];
 /** Stable catalog (phase order = pipeline order); labels/descriptions live in the host UI so they can be localized. */
 export const GUARDRAIL_CATALOG = [
@@ -51,6 +53,7 @@ export const GUARDRAIL_CATALOG = [
     { id: 'environment-repair', phase: 'host' },
     { id: 'lockfile-repair', phase: 'host' },
     { id: 'verify-idle-timeout', phase: 'host' },
+    { id: 'verification-output-adoption', phase: 'host' },
 ];
 function isGuardrailId(value) {
     return typeof value === 'string' && GUARDRAIL_IDS.includes(value);

package/dist/agent-runtime/index.d.ts

@@ -14,8 +14,9 @@ export { DEFAULT_REVIEW_POLICY, REVIEW_ASPECTS, evaluateReview, resolveReviewPol
 export { createRoleInvoker, type Accept, type InvokeOptions, type InvokeOutcome, type RoleInvoker, type RoleInvokerDeps } from './graph/roles.js';
 export { parseAgentObject } from './graph/artifacts.js';
 export { FileCheckpointSaver, type GraphStoreIO, type SerializedGraphStore } from './graph-checkpointer.js';
-export { ARCHITECT_OUTPUT_SCHEMA, DEVELOPER_OUTPUT_SCHEMA, REVIEW_OUTPUT_SCHEMA, ROLE_INSTRUCTIONS_VERSION, rolePromptDefaults, correctionInstructions, deepenInstructions, repairInstructions, roleInstructions, type FrozenCriterion, type RoleFeedback, type RoleInstructionOptions, } from './prompts.js';
+export { ARCHITECT_OUTPUT_SCHEMA, DEVELOPER_OUTPUT_SCHEMA, REVIEW_OUTPUT_SCHEMA, ROLE_INSTRUCTIONS_VERSION, rolePromptDefaults, correctionInstructions, deepenInstructions, repairInstructions, roleInstructions, type AdoptedOutput, type FrozenCriterion, type RoleFeedback, type RoleInstructionOptions, } from './prompts.js';
 export { OPENSPEC_VERSION, ROLE_SKILLS, type OpenSpecRoleContext } from './openspec.js';
 export * from './efficiency-summary.js';
-export { readVerificationEvidence, type VerificationEvidenceQuery } from '../pipeline/pipeline-state.js';
+export { readVerificationEvidence, type CandidateFileChange, type VerificationEvidenceQuery, type VerificationSelfMutation } from '../pipeline/pipeline-state.js';
+export { NONDETERMINISTIC_OUTPUT_CODE } from './verification-repair.js';
 export { runRecovery, recoveryRequestSchema, type RecoveryRequest } from './recovery.js';

package/dist/agent-runtime/index.js

@@ -18,4 +18,5 @@ export { ARCHITECT_OUTPUT_SCHEMA, DEVELOPER_OUTPUT_SCHEMA, REVIEW_OUTPUT_SCHEMA,
 export { OPENSPEC_VERSION, ROLE_SKILLS } from './openspec.js';
 export * from './efficiency-summary.js';
 export { readVerificationEvidence } from '../pipeline/pipeline-state.js';
+export { NONDETERMINISTIC_OUTPUT_CODE } from './verification-repair.js';
 export { runRecovery, recoveryRequestSchema } from './recovery.js';

package/dist/agent-runtime/openai-executor.d.ts

@@ -15,25 +15,25 @@ export declare class OpenAICompatibleExecutor implements AgentExecutor {
     private readonly options;
     constructor(provider: ApiProvider, options?: OpenAICompatibleOptions);
     capabilities(): {
-        agentLoop: "compact" | "free";
-        contextWindowTokens: number;
-        effortSupport: "supported";
-        supportedEfforts: ("high" | "medium" | "low")[];
-        continuation: "unsupported";
         transport: string;
         resumeRequiresFullContext?: boolean;
         observedModel: boolean;
         observedEffort: boolean;
-    } | {
+        continuation: 'unsupported';
+        effortSupport: 'supported';
+        supportedEfforts: ("high" | "low" | "medium")[];
         agentLoop: "compact" | "free";
         contextWindowTokens: number;
-        effortSupport: "unsupported";
-        supportedEfforts: never[];
-        continuation: "unsupported";
+    } | {
         transport: string;
         resumeRequiresFullContext?: boolean;
         observedModel: boolean;
         observedEffort: boolean;
+        continuation: 'unsupported';
+        effortSupport: 'unsupported';
+        supportedEfforts: never[];
+        agentLoop: "compact" | "free";
+        contextWindowTokens: number;
     };
     validateLimits(limits: AgentLimits): void;
     execute(request: AgentRequest): Promise<AgentResult>;

package/dist/agent-runtime/openspec.d.ts

@@ -2,9 +2,9 @@ import { type AgentRole, type CliProvider, type RoleDescriptor, type AgentAccess
 import { z } from 'zod';
 export declare const OPENSPEC_VERSION = "1.4.1";
 export declare const ROLE_SKILLS: {
-    readonly architect: "openspec-ff-change";
-    readonly developer: "openspec-apply-change";
-    readonly reviewer: "openspec-verify-change";
+    readonly architect: 'openspec-ff-change';
+    readonly developer: 'openspec-apply-change';
+    readonly reviewer: 'openspec-verify-change';
 };
 export interface OpenSpecRoleContext {
     evidenceScope?: {
@@ -112,7 +112,7 @@ export declare class OpenSpecTools {
     assertParticipation(after?: number): void;
     assertReady(): Promise<OpenSpecApply>;
 }
-export declare const OPENSPEC_TOOL_ACTIONS: readonly ["load_skill", "new", "status", "instructions", "validate", "write_artifact", "read_progress", "write_progress"];
+export declare const OPENSPEC_TOOL_ACTIONS: readonly ['load_skill', 'new', 'status', 'instructions', 'validate', 'write_artifact', 'read_progress', 'write_progress'];
 export declare const OPENSPEC_TOOL_DEFINITION: {
     type: string;
     function: {

package/dist/agent-runtime/prompts.d.ts

@@ -35,6 +35,12 @@ export interface RoleInstructionOptions {
     planning?: 'full' | 'proportional';
     /** The change so far, measured by Core from git against the run's base (rendered lines). */
     changeSet?: string[];
+    /** Files the host verification regenerated and kept in the candidate; merged with `feedback.verification.adoptedOutputs`. */
+    adoptedOutputs?: AdoptedOutput[];
+}
+export interface AdoptedOutput {
+    repositoryId?: string;
+    path: string;
 }
 export declare const ARCHITECT_OUTPUT_SCHEMA: Record<string, unknown>;
 export declare const DEVELOPER_OUTPUT_SCHEMA: Record<string, unknown>;

package/dist/agent-runtime/prompts.js

@@ -178,7 +178,7 @@ function architectSection(verification, definition) {
     ];
 }
 /** The FIXER stance: the developer role on a correction round — repair the exact failure, never re-implement. Shares the developer's verification tail and output contract. */
-function fixerSection(verification, definition) {
+function fixerSection(verification, definition, adopted = false) {
     const lines = definition === undefined ? [
         '## Your task: correction',
         '',
@@ -187,7 +187,7 @@ function fixerSection(verification, definition) {
         '',
         '1. Read the host failure facts first: command, cwd, original exit code, failureSummary, expected assertion and application file/line. If the excerpt is truncated, use read_verification_evidence with the command\'s evidenceId for complete stdout/stderr and source. Read the failing test and the implementation it exercises.',
         '2. Reproduce the failure with the narrowest test command. Compare the assertion, intended behavior, current implementation and actual diff. An unchanged file or a pre-existing test does not prove the failure is unrelated: changes can break existing tests indirectly. Classify the cause as an implementation defect, a test compatibility assumption, or an external/scope blocker. A claim that the failure existed before this change needs baseline or historical evidence; otherwise state that it is unconfirmed.',
-        '3. Patch exactly the files and lines the failure names; touch neighbouring code only when the failure cannot be fixed otherwise. Rewrite a file only when a patch cannot express the change. A correction never grows the blast radius: no new files, dependencies, renames, reformatting or clean-ups; after your turn the diff must be the previous change plus the minimal repair.',
+        '3. Patch exactly the files and lines the failure names; touch neighbouring code only when the failure cannot be fixed otherwise. Rewrite a file only when a patch cannot express the change. A correction never grows the blast radius: no new files, dependencies, renames, reformatting or clean-ups; after your turn the diff must be the previous change plus the minimal repair.' + (adopted ? ' Never revert the host-adopted verification output listed below.' : ''),
         '4. Fix the cause, not the symptom: a repair that satisfies the assertion while leaving the defect, or that special-cases the test input, is not a fix. Fix incorrect implementation behavior. A failing mandatory host test inside the admitted repository/workspace may also receive a minimal compatibility repair when you prove that its expected behavior is unchanged. For example, a source assertion broken only by formatting may tolerate whitespace while retaining every required operand and guard. This applies even to a pre-existing test outside the current changed-file list. Explain the original expectation and why the repair still rejects the prohibited behavior. Never weaken an assertion, delete or skip a test, hardcode success, change acceptance criteria, add dependencies or widen the repair beyond the diagnosed failure.',
         '5. A test file the host reports as never executed must be wired into the repository\'s test command (the test script or runner configuration) and then made to pass.',
         '6. Confirm the repair with the focused test command and a negative case for any repaired assertion: removing a required safety guard or returning the wrong value must still fail. Preserve the original test exit status; never pipe test execution through grep/head or another command that masks it. Capture stdout/stderr in a temporary log and inspect that log separately. Core runs the complete verification plan after your turn.',
@@ -196,7 +196,7 @@ function fixerSection(verification, definition) {
     ] : [definition, ''];
     return [...lines, ...developerTail(verification)];
 }
-function developerSection(verification, corrections, definition) {
+function developerSection(verification, corrections, definition, adopted = false) {
     const lines = definition === undefined ? [
         '## Your task: implementation',
         '',
@@ -209,7 +209,7 @@ function developerSection(verification, corrections, definition) {
         '2. Work task by task in order. Use test-driven development: write or extend the test first, make it pass with the smallest correct change, then tidy up. Run only focused tests that cover what you touched while iterating. Core owns the complete verification plan and runs it after your turn; do not duplicate that full run. Fix the precise failures Core returns on a correction pass.',
         '3. Immediately after completing each task, mark it `- [x]` in `tasks.md`; do not postpone all progress updates until the end of the phase. Only mark tasks whose code and tests are complete. Change nothing else in `tasks.md`, and never edit `proposal.md`, `design.md` or the specs: those documents are frozen, and editing them invalidates the run. If a task cannot be completed, leave it `- [ ]` and list it under `incomplete` with the reason.',
         '4. Keep the implementation consistent with the repository: naming, error handling, import style, formatting and existing utilities. Do not add dependencies unless the design requires them. Change only what the tasks require: the diff should contain the requested change and its tests, nothing else. Never validate with a temporary configuration, alternate runner or local browser the host verification plan does not use, and never delete such a file to hide it: the host runs the plan as-is. When a required tool is missing, install it through the project\'s documented command or report it as a blocker.',
-        'Blast radius: the files design.md and tasks.md name are your boundary. Touch a file outside it only when a task cannot be completed otherwise; keep that edit to the strict need and explain it in summary. Inside a file, change only the lines the task needs: no reformatting, import reordering, renames, type widening, comment rewrites or "while I am here" fixes. Leave an unrelated problem alone and mention it in summary. Keep public signatures, exported contracts, schemas and persisted formats as the design states. Never delete or rewrite a test a task does not name, and never regenerate lockfiles, snapshots or generated files unless the task\'s own change requires it.',
+        'Blast radius: the files design.md and tasks.md name are your boundary. Touch a file outside it only when a task cannot be completed otherwise; keep that edit to the strict need and explain it in summary. Inside a file, change only the lines the task needs: no reformatting, import reordering, renames, type widening, comment rewrites or "while I am here" fixes. Leave an unrelated problem alone and mention it in summary. Keep public signatures, exported contracts, schemas and persisted formats as the design states. Never delete or rewrite a test a task does not name, and never regenerate lockfiles, snapshots or generated files unless the task\'s own change requires it' + (adopted ? ' (the host-adopted verification output listed below is exempt: never revert it).' : '.'),
         'Quality bar: write code a senior maintainer would merge unchanged. Intention-revealing names from the domain vocabulary; small functions that do one thing at one level of abstraction; guard clauses over nested conditionals; no boolean flag parameters, magic values or hidden side effects; immutability by default and explicit types at module boundaries; parse and validate at the boundary, trust typed values inside; every error path handled the way neighbouring code handles it (fail fast at the boundary, never swallow, errors carry context); domain logic out of adapters and dependencies pointing inward as the repository already does; comments explain why, never what; no dead code, commented-out code, debug output, TODO placeholders or speculative options.',
         'Engineering judgement: understand before you change and never program by coincidence (if you cannot explain why it works, you are not done); never delete or bypass a guard, branch or workaround you cannot explain. Handle what tests rarely reach: empty, huge and malformed inputs, boundary values, time zones and Unicode, partial failures, retries with idempotency, races, cancellation, timeouts and resource cleanup (handles, listeners, subscriptions, temp files). Security hygiene is non-negotiable: parameterized queries, escaped output, no secrets or personal data in code or logs, least privilege, authorization where the repository enforces it. Logs and metrics follow the repository\'s conventions; migrations and persisted-format changes stay additive and backward compatible. Verify every API, signature and option against the source or installed types, never from memory. Do the simplest thing that fully works, then refactor only inside the blast radius. Tests are the specification: one behavior per test (arrange, act, assert) covering inputs, outputs, side effects and errors; no logic in tests; mock only at real boundaries; deterministic; failing without the change; in the repository\'s existing style. A task is done only when its code, tests and every artifact it makes stale (localized strings in every shipped locale, documentation, schemas, configuration examples) are updated and its focused checks pass.',
         'Investigation budget: consult the local reference patterns in design.md and equivalent application tests before framework internals or node_modules. After three unsuccessful experiments on the same failure, stop repeating commands: state the hypothesis, evidence and next discriminating experiment, then change approach. If three further experiments add no evidence, report the specific blocker under incomplete rather than consuming the remaining turn budget. Never weaken assertions or change acceptance criteria to make a test pass.',
@@ -234,7 +234,7 @@ function developerTail(verification) {
     lines.push('', '## Durable implementation progress', '', 'When loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.', 'After each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly.', '', '## Output contract', '', 'Finish with exactly one JSON object and nothing after it: no prose after the object, no Markdown fence.', '', '```', '{"summary":"What you implemented and how","files":["src/feature.ts"],"tests":["src/feature.test.ts"],"verification":"npm test passed (12 tests)","incomplete":[{"task":"3. …","reason":"why it could not be completed"}],"blocker":{"kind":"toolchain","command":"npx playwright test","cwd":".","evidence":"exact error","requiredAction":"Run npx playwright install chromium"}}', '```', '', '- `files` and `tests`: repository-relative paths you created or modified (test files appear in `tests`, other files in `files`).', '- `verification`: the commands you ran and their outcome, or `none` when no shell was available.', '- `incomplete`: every task still `- [ ]` in `tasks.md`, with its reason; an empty array when everything is done.', '- `blocker`: only when the cause lies outside the change; omit otherwise. The host ends the run with your `requiredAction` instead of starting another correction round.', '- Do not paste full test logs; the reviewer reads the real verification evidence separately.', '');
     return lines;
 }
-function reviewerSection(policy, criteria, definition) {
+function reviewerSection(policy, criteria, definition, adopted = false) {
     const aspects = REVIEW_ASPECTS.map(name => `\`${name}\` ≥ ${policy.aspects[name]}`).join(', ');
     const lines = definition === undefined ? [
         '## Your task: review',
@@ -246,7 +246,7 @@ function reviewerSection(policy, criteria, definition) {
         '1. Spec completeness: every requirement in the change specs and every acceptance criterion is implemented. Cross-reference each one against the code.',
         '2. Task completion: every task in `tasks.md` is `- [x]` and is backed by real code and tests, not just a ticked box.',
         '3. Test quality: new behavior has tests that assert on behavior, cover error paths, and would fail without the change. Missing tests for production code, tests without assertions and tests that restate the implementation are blocking issues.',
-        '4. Blast radius: compare the change set below with the files design.md and tasks.md name. A file the plan did not name, a hunk no task explains (reformatting, import reordering, renames, comment rewrites, type widening, deleted or rewritten tests outside the tasks, regenerated lockfiles, snapshots or generated files, new dependencies, widened public signatures) or an edit to a shared module without a stated reason is an issue to REVERT, not to polish: name the file and the hunk. Trace every criterion to the narrowest code that satisfies it; code beyond that is suspect. Unjustified blast radius lowers `architectural_alignment` and `pattern_adherence`.',
+        '4. Blast radius: compare the change set below with the files design.md and tasks.md name. A file the plan did not name, a hunk no task explains (reformatting, import reordering, renames, comment rewrites, type widening, deleted or rewritten tests outside the tasks, regenerated lockfiles, snapshots or generated files' + (adopted ? ' other than the host-adopted verification output listed below' : '') + ', new dependencies, widened public signatures) or an edit to a shared module without a stated reason is an issue to REVERT, not to polish: name the file and the hunk. Trace every criterion to the narrowest code that satisfies it; code beyond that is suspect. Unjustified blast radius lowers `architectural_alignment` and `pattern_adherence`.',
         '5. Correctness and conventions: types and signatures fit the codebase, patterns match the repository, imports and error handling are consistent, no dead code, debug output or placeholders. Architecture: the change respects the dependency direction and boundaries the repository already follows; domain logic placed in an adapter, an adapter imported from the domain, a bypassed existing port or helper, a duplicated utility that already exists, or a new abstraction with one implementation and no variation point is an issue when it breaks a convention the code enforces and a finding otherwise. Platform correctness as far as the change touches it: web state, accessibility, loading and error states; mobile lifecycle, offline and permissions; backend transactions, idempotency and validation at the boundary.',
         '6. Security: no secrets, injection, path traversal, unsafe deserialization, missing authorization or new attack surface. Scale scrutiny to what the change touches.',
         '7. Performance: no obvious N+1, unbounded loops or blocking work on hot paths introduced by the change.',
@@ -298,6 +298,28 @@ function discardedSection(developer) {
         return [];
     return ['## Edits Core undid', '', 'The previous turn edited files outside the repository scope; Core restored them because they are not part of this change. Do not redo them:', ...developer.discarded.slice(0, 50).map(file => `- \`${file}\``), ''];
 }
+/** Host-adopted verification output from the options and the verification feedback, deduplicated and bounded. */
+function adoptedOutputs(feedback, extra) {
+    const raw = record(feedback?.verification)?.adoptedOutputs;
+    const listed = [...(extra ?? []), ...(Array.isArray(raw) ? raw : [])].map(record).filter((item) => typeof item?.path === 'string' && item.path.length > 0);
+    return [...new Map(listed.map(item => [String(item.repositoryId ?? '') + '\0' + String(item.path), { ...(typeof item.repositoryId === 'string' ? { repositoryId: item.repositoryId } : {}), path: String(item.path).slice(0, 512) }])).values()].slice(0, 50);
+}
+/** Files the verification commands regenerated themselves: reverting them only makes the next verification regenerate them. */
+function adoptedOutputSection(role, adopted) {
+    if (!adopted.length || (role !== 'reviewer' && role !== 'developer'))
+        return [];
+    return [
+        '## Host-adopted verification output',
+        '',
+        'The host verification commands regenerated these files themselves; the host kept them in the candidate and verified it again, so they belong to the change. They are exempt from the blast-radius rule on regenerated generated files:',
+        ...adopted.map(file => `- ${file.repositoryId ? '`' + file.repositoryId + '`: ' : ''}\`${file.path}\``),
+        '',
+        role === 'reviewer'
+            ? 'Never ask for one of them to be reverted to the base version. You may still raise an issue when an adopted file\'s content is wrong for this change.'
+            : 'Never revert them to the base version (no checkout, restore or deletion): the next verification would regenerate them. Edit one only when a reported failure lies in its content.',
+        '',
+    ];
+}
 function feedbackSection(feedback, focused = false) {
     const lines = [];
     const verification = record(feedback?.verification);
@@ -399,8 +421,9 @@ export function roleInstructions(roleOrDescriptor, context, change, options = {}
     }
     const feedback = feedbackSection(options.feedback);
     const corrections = role === 'developer' && feedback.length > 0;
+    const adopted = role === 'architect' ? [] : adoptedOutputs(options.feedback, options.adoptedOutputs);
     const sections = [
-        ...(role === 'architect' ? architectSection(options.verification, options.definition) : role === 'developer' ? (options.stance === 'fixer' ? fixerSection(options.verification, options.definition) : developerSection(options.verification, corrections, options.definition)) : reviewerSection(options.policy ?? DEFAULT_REVIEW_POLICY, options.criteria, options.definition)),
+        ...(role === 'architect' ? architectSection(options.verification, options.definition) : role === 'developer' ? (options.stance === 'fixer' ? fixerSection(options.verification, options.definition, adopted.length > 0) : developerSection(options.verification, corrections, options.definition, adopted.length > 0)) : reviewerSection(options.policy ?? DEFAULT_REVIEW_POLICY, options.criteria, options.definition, adopted.length > 0)),
         ...boundarySection(role),
         ...conventionsSection(),
         ...scopeSection(context, change),
@@ -410,6 +433,7 @@ export function roleInstructions(roleOrDescriptor, context, change, options = {}
         ...changeSetSection(role, options.stance, options.changeSet),
         ...(role === 'developer' ? discardedSection(options.developer) : []),
         ...(role === 'reviewer' ? reReviewSection(options.reReview) : []),
+        ...adoptedOutputSection(role, adopted),
         ...feedback,
     ];
     return sections.join('\n').trimEnd() + '\n';
@@ -421,7 +445,7 @@ export function correctionInstructions(role, feedback, extra = {}) {
     const instruction = extra.focusedEvidence
         ? `Continue the ${role} role with unchanged permissions and obligations. Fix the feedback, preserve correct work, finish all tasks and mark them \`- [x]\`. Return only the same JSON summary (summary, files, tests, verification, incomplete).`
         : 'Continue the same ' + role + ' role in this session. Address the feedback below precisely, keep the already-correct work, finish every remaining task, mark completed tasks `- [x]` in `tasks.md`, and finish with the same JSON summary object as before (summary, files, tests, verification, incomplete), with nothing after it.';
-    const lines = [instruction, '', ...(role === 'developer' ? [...changeSetSection(role, undefined, extra.changeSet), ...discardedSection(extra.developer)] : []), ...feedbackSection(feedback, extra.focusedEvidence)];
+    const lines = [instruction, '', ...(role === 'developer' ? [...changeSetSection(role, undefined, extra.changeSet), ...discardedSection(extra.developer)] : []), ...adoptedOutputSection(role, adoptedOutputs(feedback, undefined)), ...feedbackSection(feedback, extra.focusedEvidence)];
     return lines.join('\n').trimEnd() + '\n';
 }
 /** Asks the architect, still in its session, to resolve a low-confidence design by investigating instead of guessing. */

package/dist/agent-runtime/recovery.d.ts

@@ -9,37 +9,37 @@ export declare const recoveryRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject
     path: z.ZodString;
     action: z.ZodLiteral<"list_files">;
 }, z.core.$strict>, z.ZodObject<{
-    startLine: z.ZodOptional<z.ZodNumber>;
-    endLine: z.ZodOptional<z.ZodNumber>;
     repositoryId: z.ZodString;
     path: z.ZodString;
     action: z.ZodLiteral<"read_file">;
+    startLine: z.ZodOptional<z.ZodNumber>;
+    endLine: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>, z.ZodObject<{
     repositoryId: z.ZodString;
     path: z.ZodString;
     action: z.ZodLiteral<"diff">;
 }, z.core.$strict>, z.ZodObject<{
-    expectedHash: z.ZodString;
-    oldText: z.ZodString;
-    newText: z.ZodString;
+    repositoryId: z.ZodString;
+    path: z.ZodString;
     operationId: z.ZodString;
     reason: z.ZodString;
     acknowledgeInterrupted: z.ZodOptional<z.ZodBoolean>;
     changedPrecondition: z.ZodOptional<z.ZodString>;
-    repositoryId: z.ZodString;
-    path: z.ZodString;
     action: z.ZodLiteral<"patch">;
+    expectedHash: z.ZodString;
+    oldText: z.ZodString;
+    newText: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodEnum<{
-        verification: "verification";
-        openspec: "openspec";
-    }>;
-    checkId: z.ZodOptional<z.ZodString>;
     operationId: z.ZodString;
     reason: z.ZodString;
     acknowledgeInterrupted: z.ZodOptional<z.ZodBoolean>;
     changedPrecondition: z.ZodOptional<z.ZodString>;
     action: z.ZodLiteral<"check">;
+    kind: z.ZodEnum<{
+        openspec: "openspec";
+        verification: "verification";
+    }>;
+    checkId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>], "action">;
 export type RecoveryRequest = z.infer<typeof recoveryRequestSchema>;
 /** Uses the SAME cross-process lease as resume. No provider calls or checkpoint editing. */

package/dist/agent-runtime/session/application/active-session.d.ts

@@ -0,0 +1,176 @@
+import type { SessionEventEnvelope, ToolActivity } from '../domain/events.js';
+import { type SessionSnapshot } from '../domain/snapshot.js';
+import { type SessionPolicy, type SubagentPhase, type Usage } from '../domain/types.js';
+import { type RateCard } from '../domain/usage.js';
+import type { Clock, CloseReason, DriverFactory, DriverInput, Ids, SessionJournal } from '../ports.js';
+import { type OutputLimits } from './output-buffer.js';
+export interface ActiveSessionDeps {
+    journal: SessionJournal;
+    factory: DriverFactory;
+    clock: Clock;
+    ids: Ids;
+    rateCard: (driver: string, model: string) => RateCard | null;
+    publish: (envelopes: SessionEventEnvelope[]) => void;
+    /** Called whenever the session's process liveness or recency changes (LRU bookkeeping). */
+    touched: (session: ActiveSession) => void;
+    outputLimits?: OutputLimits;
+    /** How long `interrupt` waits for the provider before ending the process. */
+    interruptGraceMs?: number;
+    /** Delay before buffered deltas are flushed. */
+    flushMs?: number;
+}
+export interface SessionConfig {
+    cwd: string;
+    model: string;
+    effort: string | null;
+    systemPrompt: string | null;
+    policy: SessionPolicy;
+}
+/** How work that was running ends when the process goes away. */
+interface Teardown {
+    turnStatus: 'stopped' | 'interrupted' | 'failed';
+    subagentPhase: SubagentPhase;
+    reason: string;
+    error?: string;
+}
+/**
+ * Coordinates one session: turns driver facts into journaled events, owns the
+ * provider process lifecycle, phases, settlement, limits and teardown.
+ * All mutation goes through `commit`, which folds before appending, so the
+ * journal never holds an event the domain would reject.
+ */
+export declare class ActiveSession {
+    readonly sessionId: string;
+    private config;
+    private readonly deps;
+    state: SessionSnapshot;
+    private driver;
+    private opening;
+    private generation;
+    /** Generation whose events are accepted (the live or opening process); null when none. */
+    private liveGeneration;
+    private closing;
+    private baseline;
+    private readonly timers;
+    private readonly output;
+    private readonly descriptor;
+    /** Inputs held back for drivers without a native input queue. */
+    private readonly heldInputs;
+    /** Inputs the application wrote on its own (policy-driven turns). */
+    private readonly systemInputIds;
+    private pendingDeferred;
+    private roster;
+    private handoffs;
+    private finishedSinceLastTurn;
+    /** Finished delegated sub-agents whose results the agent has not received yet. */
+    private readonly delegatedResults;
+    private lastUserTurnAt;
+    lastUsedAt: number;
+    constructor(sessionId: string, snapshot: SessionSnapshot, config: SessionConfig, deps: ActiveSessionDeps);
+    get processAlive(): boolean;
+    get isBusy(): boolean;
+    get policy(): SessionPolicy;
+    send(input: {
+        inputId: string;
+        text: string;
+        attachments?: DriverInput['attachments'];
+        delivery: 'queue' | 'steer';
+    }): Promise<{
+        inputId: string;
+        state: string;
+    }>;
+    interrupt(): Promise<string | null>;
+    stopSubagents(ids?: string[]): Promise<string[]>;
+    /**
+     * Policy says no sub-agents, yet the provider started one (a provider switch
+     * can be ignored by a model or CLI version). Stop it and say so: the policy
+     * holds whatever the provider's own switch does.
+     */
+    private blockSubagent;
+    /** Apply now when nothing is running; otherwise defer to the next idle point. */
+    update(changes: {
+        model?: string;
+        effort?: string;
+        systemPrompt?: string;
+        policy?: SessionPolicy;
+    }): Promise<'applied' | 'deferred'>;
+    close(reason: string): Promise<void>;
+    /**
+     * Record work a previous host left running as interrupted. Nothing is
+     * restarted: the next user input carries the interruption notice instead.
+     */
+    recoverAfterHostLoss(reason: 'restart' | 'host_lost'): void;
+    /** Retire the provider process; running work ends as described by `teardown`. */
+    retire(reason: CloseReason, teardown: Teardown): Promise<void>;
+    private deliver;
+    private ensureDriver;
+    private onDriverEvent;
+    private handleDriverEvent;
+    private startTurn;
+    private completeTurn;
+    /**
+     * Inputs whose receipts never reported completion are completed with their
+     * turn: the ones that opened it and the ones steered into it.
+     */
+    private completeTurnInputs;
+    private settlePhaseAfterTurn;
+    private afterSubagentChange;
+    private onSettled;
+    /** Live = running in our tree and, when the provider reports a roster, still on it. */
+    private liveCount;
+    private maybeResumeAgent;
+    /** Give the agent the results of delegated sub-agents it has not seen. */
+    private maybeDeliverDelegatedResults;
+    /** Running sub-agents Core launched for this session. */
+    delegatedLive(): string[];
+    delegatedStarted(child: {
+        subagentId: string;
+        description: string;
+        agentType: string;
+        prompt: string;
+        driver: string;
+        model: string;
+    }): void;
+    delegatedOutput(subagentId: string, event: {
+        channel: 'text';
+        delta: string;
+    } | {
+        channel: 'tool';
+        tool: ToolActivity;
+    }): void;
+    /**
+     * A delegated child ended. Its usage is its own provider's spend (billed
+     * separately); unless a host already collected the result, the agent gets it
+     * when the session next settles.
+     */
+    delegatedFinished(subagentId: string, outcome: {
+        status: 'completed' | 'failed' | 'stopped' | 'interrupted';
+        text: string;
+        usage: Usage | null;
+        reason?: string;
+        collected: boolean;
+    }): void;
+    /** A host received these results through a wait; never inject them again. */
+    collectDelegated(subagentIds: readonly string[]): void;
+    private enterIdle;
+    private enterBackground;
+    private idleTeardown;
+    private armTurnInactivity;
+    private markActivity;
+    private applyChanges;
+    private releaseHeldInput;
+    /** End whatever was running; used by retire and unexpected exits. */
+    private endRunningWork;
+    private turnUsage;
+    private subagentUsage;
+    private commitBuffered;
+    /**
+     * Validate (fold) then append atomically, then publish. Buffered deltas are
+     * flushed first so ordering is preserved.
+     */
+    private commit;
+    private requireTurn;
+    private assertOpen;
+    private touch;
+}
+export {};