thinkpool-pair 0.7.361 → 0.7.362

package/bridge.mjs

@@ -77,7 +77,7 @@ import { explicitKeepAwakeChoice, keepAwakeEnabled, saveKeepAwakePreference, sta
 
 const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
-import { legacyBuilderCompletionAllowed, normalizeBaselineEvidence, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
+import { legacyBuilderCompletionAllowed, normalizeBaselineEvidence, normalizePlanOutput, validatePlanForRuntime, validateTaskContractSeal, validReviewTargetShape } from './flow-task-graph.mjs'
 import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, resolveHermesOpenModel, assertRuntimeModelCompatible } from './flow-models.mjs'
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
 // the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
@@ -97,6 +97,7 @@ function stopFlowPreviews (flowId, laneId = null) {
   }
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
+import { createFlowReviewReceipt, createFlowReviewSingleFlight, isFlowReviewReceipt } from './flow-receipt.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
 import { IMMUTABLE_REVIEW_READ_TOOL_EXTRAS, UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
@@ -966,11 +967,13 @@ const MIN_TURN_MS = Number(process.env.TP_NOTIFY_MIN_TURN_MS) > 0
   ? Number(process.env.TP_NOTIFY_MIN_TURN_MS) : DEFAULT_MIN_TURN_MS
 function persistAgentEvent (payload) {
   if (AGENT_NOTIFY_OFF || !codeAuthToken || !myServeUid || !room) return
+  const { eventId, ...eventPayload } = payload || {}
+  const stableId = typeof eventId === 'string' && /^[A-Za-z0-9_-]{1,120}$/.test(eventId) ? eventId : randomUUID()
   const row = {
-    id: `ae:${randomUUID()}`,
+    id: `ae:${stableId}`,
     session_code: room,
     author_id: myServeUid,
-    payload: { __agent: true, ts: Date.now(), ...payload },
+    payload: { __agent: true, ts: Date.now(), ...eventPayload },
   }
   fetch(`${SUPABASE_URL}/rest/v1/code_messages`, {
     method: 'POST',
@@ -2533,7 +2536,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, carryCheckpoint, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
+function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, carryCheckpoint, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
   if (sessions.has(id)) return
   runtime = structuredRuntimeMetadata(runtime) ? runtime : 'claude'
   // Fail closed before exposing a native lane if its bridge semantic contract
@@ -2606,6 +2609,9 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     flowReviewTargets: Array.isArray(flowReviewTargets) && flowReviewTargets.length ? flowReviewTargets.filter(Boolean) : (flowReviewTarget ? [flowReviewTarget] : []),
     flowReviewSnapshots: Array.isArray(flowReviewSnapshots) ? flowReviewSnapshots.filter((item) => item?.taskKey && item?.sha && item?.cwd) : [],
     flowReviewRound: Number.isInteger(flowReviewRound) && flowReviewRound >= 0 ? flowReviewRound : 0,
+    flowReviewConclusion: flowReviewConclusion?.taskKey && ['pass', 'reject', 'surface'].includes(flowReviewConclusion?.action) && isFlowReviewReceipt(flowReviewConclusion?.receipt)
+      ? { taskKey: flowReviewConclusion.taskKey, action: flowReviewConclusion.action, round: flowReviewConclusion.round, receipt: flowReviewConclusion.receipt }
+      : null,
     dispatchBaseSha: dispatchBaseSha || null,
     revertTarget: revertTarget || null,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
@@ -2719,7 +2725,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // review gate was dead code: reviewers had no working emit path, so a failing slice was
   // never reverted). On FAIL → broadcast flow-revert for the reviewed slice (the client flips
   // it to pending → the next wave rebuilds it). Either way the review lane itself is done.
-  const onReviewVerdict = async (raw) => {
+  const processReviewVerdict = async (raw) => {
     if (!entry.flowSessionId || !entry.flowTaskKey || entry.flowRole !== 'reviewer') return { ok: false, message: 'Not a Flow review lane.' }
     let v, target = null
     try {
@@ -2737,6 +2743,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         ? `Review verdict REJECTED: ${e?.message || e}. Re-call submit_flow_review with a valid authorized taskKey.`
         : `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
     }
+    if (entry.flowReviewConclusion) return { ok: true, message: `Review already concluded for ${entry.flowReviewConclusion.taskKey}; receipt ${entry.flowReviewConclusion.receipt.cid || 'recorded'}.` }
     // E1 A1/A2 — the BOUNDED reviewer loop, live side. Each FLOW_REVIEW.json write is ONE
     // hunt round; the governor decides continue-vs-stop from the round count + the lane's
     // REAL budget (flowBudgets ledger). A bare pass:true (happy path held, not yet exhausted)
@@ -2778,15 +2785,51 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     } else {
       process.stderr.write(`\n  ${A.cyan}◆ review ${decision.action.toUpperCase()} (round ${round}) — ${target || entry.flowTaskKey}${A.rst}\n`)
     }
-    // Durable room-visible verdict. `persistAgentEvent` below is intentionally
-    // filtered from the transcript (push/unread transport only), while this control
-    // row is archived with the reviewer lane and broadcast to both room members.
-    // In particular, a held review must show its exact findings instead of leaving
-    // the red task state unexplained after the ephemeral Flow broadcast is gone.
-    const visibleReview = {
-      kind: 'control',
-      text: `Flow review ${decision.action.toUpperCase()} — ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}`,
+    // Durable room-visible verdict. Bind a conclusive pass to the exact immutable
+    // builder snapshot plus the acceptance digest inherited at approval time. A
+    // missing/malformed proof can never look like a verified pass: it becomes a
+    // held receipt and assembly stays blocked for pair adjudication.
+    const reviewedTaskKey = target || entry.flowTaskKey
+    const targetSnapshot = entry.flowReviewSnapshots.find((item) => item.taskKey === reviewedTaskKey) || null
+    const acceptanceDigest = entry.flowTaskContract?.digest || null
+    let terminalAction = decision.action
+    let receiptReasons = v.reasons.length ? v.reasons : [decision.reason]
+    let visibleReview
+    try {
+      visibleReview = createFlowReviewReceipt({
+        taskKey: reviewedTaskKey,
+        outcome: terminalAction === 'surface' ? 'held' : terminalAction,
+        rounds: round,
+        candidateSha: targetSnapshot?.sha,
+        acceptanceDigest,
+        reasons: receiptReasons,
+      })
+    } catch (error) {
+      if (terminalAction !== 'pass') {
+        return { ok: false, message: `Review verdict REJECTED: ${error?.message || error}.` }
+      }
+      terminalAction = 'surface'
+      receiptReasons = [...receiptReasons, 'Exact candidate or sealed acceptance proof is missing; pass was held.']
+      visibleReview = createFlowReviewReceipt({
+        taskKey: reviewedTaskKey,
+        outcome: 'held',
+        rounds: round,
+        candidateSha: targetSnapshot?.sha,
+        acceptanceDigest,
+        reasons: receiptReasons,
+      })
+    }
+    visibleReview.cid = randomUUID()
+    entry.flowReviewConclusion = {
+      taskKey: reviewedTaskKey,
+      action: terminalAction,
+      round,
+      receipt: visibleReview,
     }
+    // Persist the conclusion before emitting side effects. A retry or restart
+    // can reconstruct a missing transcript row from this safe receipt, but can
+    // never conclude the same review twice.
+    entry.flush?.()
     pushLog(entry, visibleReview)
     bcast('code-event', { term: id, evt: visibleReview })
     entry.flush?.()
@@ -2796,45 +2839,53 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // broadcast, does NOT change the revert/gate flow.
     bcast('flow-review-verdict', {
       term: id, flowId: entry.flowSessionId,
-      taskKey: target || entry.flowTaskKey,
-      pass: v.pass,
-      reasons: v.reasons,
-      action: decision.action,
+      taskKey: reviewedTaskKey,
+      pass: terminalAction === 'pass',
+      reasons: receiptReasons,
+      action: terminalAction,
       rounds: round,
-      surfaceToPair: decision.surfaceToPair,
+      surfaceToPair: terminalAction === 'surface' || decision.surfaceToPair,
       prompt: pairAdjudicationPrompt({
-        action: decision.action,
-        reason: decision.reason,
-        taskKey: target || entry.flowTaskKey,
-        findings: v.reasons,
+        action: terminalAction,
+        reason: terminalAction === decision.action ? decision.reason : receiptReasons.at(-1),
+        taskKey: reviewedTaskKey,
+        findings: receiptReasons,
       }),
     }, flowChannel)
     let doneMsg = ''
-    if (decision.action === 'pass') {
+    if (terminalAction === 'pass') {
       doneMsg = await markFlowDone({ reviewPass: true })
     } else {
-      if (decision.action === 'surface') {
-        bcast('flow-review-held', { term: id, flowId: entry.flowSessionId, reviewTaskKey: entry.flowTaskKey, taskKey: target, reasons: v.reasons }, flowChannel)
-        persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review held ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}` })
+      if (terminalAction === 'surface') {
+        bcast('flow-review-held', { term: id, flowId: entry.flowSessionId, reviewTaskKey: entry.flowTaskKey, taskKey: target, reasons: receiptReasons }, flowChannel)
+        persistAgentEvent({ eventId: visibleReview.cid, kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review held ${reviewedTaskKey}: ${receiptReasons.join('; ') || decision.reason}` })
       }
       // A reject must rebuild the target and then run a fresh reviewer. Retire that
       // reviewer now. A surfaced inconclusive review is different: keep its lane
       // alive with the durable control row above so either room member can open the
       // held review, read the exact findings, and continue/adjudicate after reload.
       // Neither outcome emits task-done or permits assembly.
-      if (decision.action === 'reject') {
+      if (terminalAction === 'reject') {
         entry.flowDone = true
         entry.flush?.()
         setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
       }
     }
-    const label = decision.action === 'reject'
-      ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 140)})`
-      : decision.action === 'surface'
-        ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${decision.reason}`
+    const label = terminalAction === 'reject'
+      ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${receiptReasons.join('; ').slice(0, 140)})`
+      : terminalAction === 'surface'
+        ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${receiptReasons.at(-1) || decision.reason}`
         : `PASS (round ${round})`
     return { ok: true, message: `Review verdict recorded: ${label}.${doneMsg ? ` ${doneMsg}` : ''}` }
   }
+  const runFlowReviewVerdict = createFlowReviewSingleFlight()
+  const onReviewVerdict = async (raw) => {
+    if (entry.flowReviewConclusion) return { ok: true, message: `Review already concluded for ${entry.flowReviewConclusion.taskKey}; receipt ${entry.flowReviewConclusion.receipt.cid || 'recorded'}.` }
+    // One terminal verdict is one transaction. In particular, reject awaits the
+    // host revert before it can persist its conclusion; without this single-flight
+    // fence two simultaneous submissions can both cross that await and revert/emit.
+    return runFlowReviewVerdict(() => processReviewVerdict(raw))
+  }
   // Identity for the durable archive — pushLog appends every new transcript event to
   // <room>/<id>.events.jsonl keyed off these. Seed the archive once from the restored
   // (≤2000) log so the retained window is immediately pageable; no-op if it already
@@ -2891,13 +2942,19 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, carryCheckpoint: entry.pendingCheckpoint || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, flowReviewConclusion: entry.flowReviewConclusion, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, carryCheckpoint: entry.pendingCheckpoint || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
   // 1.5s saveSession debounce window) and on shutdown (so events since the last
   // debounced write aren't lost). Contract #2: restart resumes, no lost messages.
   entry.flush = () => flushSession(room, id, sessionData())
+  if (entry.flowReviewConclusion?.receipt && !entry.log.some((event) => event?.cid === entry.flowReviewConclusion.receipt.cid)) {
+    const restoredReceipt = { ...entry.flowReviewConclusion.receipt }
+    pushLog(entry, restoredReceipt)
+    bcast('code-event', { term: id, evt: restoredReceipt })
+    entry.flush()
+  }
   if (entry.scheduleOutcomeRecorded && entry.scheduleAdmissionLease) {
     void releaseScheduledAdmissionForEntry(entry).then((released) => {
       if (released) entry.flush?.()
@@ -3753,7 +3810,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               provider: entry.provider, log: entry.log, commands: entry.commands, mode: entry.mode,
               spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth, cascadeRole: entry.cascadeRole, hop: entry.hop, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId,
               flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole, flowReviewTarget: entry.flowReviewTarget,
-              flowReviewTargets: entry.flowReviewTargets, flowReviewSnapshots: entry.flowReviewSnapshots, flowReviewRound: entry.flowReviewRound,
+              flowReviewTargets: entry.flowReviewTargets, flowReviewSnapshots: entry.flowReviewSnapshots, flowReviewRound: entry.flowReviewRound, flowReviewConclusion: entry.flowReviewConclusion,
               dispatchBaseSha: entry.dispatchBaseSha, revertTarget: entry.revertTarget, cwd: entry.cwd,
               managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt,
               reviewSliceRoots: entry.reviewSliceRoots, openedAt: entry.openedAt,
@@ -4280,7 +4337,7 @@ function respawnStructured(id, provider) {
   // openStructured seed from the TARGET provider's configured model, which is the
   // only model this lane was ever asked for. A same-env model change never reaches
   // here — that path is an in-place setModel (see provider-switch).
-  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, pendingCheckpoint } = s
+  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, pendingCheckpoint } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -4299,7 +4356,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap, carryCheckpoint: pendingCheckpoint })
+  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap, carryCheckpoint: pendingCheckpoint })
   return true
 }
 
@@ -5273,7 +5330,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowTaskContract: rec.flowTaskContract, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap, carryCheckpoint: rec.carryCheckpoint,
+            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowTaskContract: rec.flowTaskContract, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, flowReviewConclusion: rec.flowReviewConclusion, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap, carryCheckpoint: rec.carryCheckpoint,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).
@@ -5496,6 +5553,13 @@ flowChannel
         // Step 4 — a `review` slice gets the adversarial reviewer prompt (try-to-break),
         // every other slice gets the builder prompt.
         const isReview = t.slice_type === 'review'
+        try {
+          validateTaskContractSeal(t, { legacy: t.contract == null })
+        } catch (error) {
+          process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — ${t.task_key || 'task'} failed its sealed acceptance contract: ${error?.message || error}${A.rst}\n`)
+          bcast('flow-dispatch-held', { term: 'flow', flowId: payload.flowId, taskKey: t.task_key || null, reason: 'sealed acceptance contract mismatch' }, flowChannel)
+          continue
+        }
         if (!validReviewTargetShape(t, flowRuntime)) {
           process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — ${flowRuntime === 'hermes' ? 'Hermes' : 'Codex'} review ${t.task_key} must target exactly one dependency.${A.rst}\n`)
           continue
@@ -5545,6 +5609,7 @@ flowChannel
           ? (isReview ? FLOW_CODEX_REVIEWER_PROMPT : FLOW_CODEX_LANE_PROMPT)
           : (isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT)
         const laneRolePrompt = buildLanePrompt({ base: laneBase })
+        const sealedReviewAcceptance = t.contract?.acceptancePack?.task?.acceptance
         // Model tiers (2026-07-03-flow-lane-model-tiers): pick the lane's brain by slice_type
         // (scaffold→sonnet, feature/fix/review→opus; env can blanket-override or `inherit` to
         // restore today's exact behavior). undefined → no model key passed (openStructured default).
@@ -5571,7 +5636,7 @@ flowChannel
                   ? `Reviewed slice worktree(s) — check out + RUN each yourself:\n` +
                     t.deps.map((dep) => { const ws = worktreeSpec({ flowId: payload.flowId, taskKey: dep }); return `  - ${dep}: dir ${ws.dir} (branch ${ws.branch})` }).join('\n') + '\n'
                   : '') +
-                `ACCEPTANCE to INDEPENDENTLY verify: ${t.acceptance || t.title}\n` +
+                `ACCEPTANCE to INDEPENDENTLY verify: ${sealedReviewAcceptance || t.acceptance || t.title}\n` +
                 `INHERITED NON-GOALS (must remain untouched): ${(t.contract?.nonGoals || []).join(' | ') || '(legacy task: none recorded)'}\n` +
                 `INHERITED BASELINE GATE: ${t.contract?.baseline?.gate || '(legacy task: none recorded)'}\n` +
                 `BUILDER BASELINE EVIDENCE (verify; never invent another baseline): ${t.contract?.baseline?.evidence || '(missing — reject unless this is a legacy task)'}\n` +

package/code-event-contract.mjs

@@ -64,6 +64,7 @@ export const CODE_EVENT_REGISTRY = Object.freeze({
   'needs-resolved': E,
   continuation: E,
   'turn-done': E,
+  'flow-review-receipt': E,
 })
 
 export const CODE_EVENT_KINDS = Object.freeze(Object.keys(CODE_EVENT_REGISTRY))

package/flow-receipt.mjs

@@ -0,0 +1,115 @@
+// Flow review receipts are deliberately smaller than a review verdict. They cross
+// from a private reviewer lane into a shared transcript, so this module only
+// admits the evidence a pair can act on. Prompts, environment, paths, logs, and
+// hidden reasoning never have a field in the public shape.
+
+export const FLOW_REVIEW_RECEIPT_KIND = 'flow-review-receipt'
+
+const MAX_TASK_KEY = 120
+const MAX_LINE = 180
+const MAX_LINES = 4
+const OUTCOMES = new Set(['pass', 'reject', 'held'])
+const DIGEST = /^[a-f0-9]{64}$/
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|sbp_[a-z0-9_-]{20,}|sb_secret_[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|hooks\.slack\.com\/services\/[a-z0-9/_-]{8,})/i
+const SECRET_OR_PRIVATE = /(?:api[_ -]?key|access[_ -]?token|\btoken\s*[=:]|auth(?:orization)?|bearer\s+|secret|password|private[_ -]?key|system\s+prompt|raw\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\benv(?:ironment)?\b|\.env\b)/i
+const HOST_PATH = /(?:^~[\\/]|^\.?[\\/]|(?:^|\s)\/[\w.-]+|[A-Za-z]:\\|\\\\|(?:^|[\\/])(?:Users|home|var|tmp|private|workspace)(?:[\\/]|$)|\.thinkpool[\\/])/i
+const PATH_TRAVERSAL = /(?:^|[^a-z0-9.])\.\.(?:[\\/]|$)/i
+
+function cleanText(value, max) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > max) return null
+  if (/\r|\n/.test(value) || SECRET_VALUE.test(value) || SECRET_OR_PRIVATE.test(value) || HOST_PATH.test(value) || PATH_TRAVERSAL.test(value)) return null
+  const text = value.replace(/\s+/g, ' ').trim()
+  return text && text.length <= max ? text : null
+}
+
+function cleanLines(value) {
+  if (!Array.isArray(value)) return []
+  const out = []
+  for (const line of value) {
+    const safe = cleanText(line, MAX_LINE)
+    if (safe && !out.includes(safe)) out.push(safe)
+    if (out.length === MAX_LINES) break
+  }
+  return out
+}
+
+function cleanTaskKey(value) {
+  const taskKey = cleanText(value, MAX_TASK_KEY)
+  if (!taskKey || !/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(taskKey) || taskKey.includes('..')) return null
+  return taskKey
+}
+
+function cleanSha(value) {
+  if (typeof value !== 'string') return null
+  const sha = value.trim().toLowerCase()
+  return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha) ? sha : null
+}
+
+function cleanRounds(value) {
+  return Number.isInteger(value) && value >= 1 && value <= 99 ? value : null
+}
+
+function cleanDigest(value) {
+  if (typeof value !== 'string') return null
+  const digest = value.trim().toLowerCase()
+  return DIGEST.test(digest) ? digest : null
+}
+
+// Build the only wire shape the renderer accepts. Optional fields are omitted
+// rather than represented as null, making absence honest (notably deployment).
+export function createFlowReviewReceipt(input = {}) {
+  const taskKey = cleanTaskKey(input.taskKey)
+  const outcome = typeof input.outcome === 'string' ? input.outcome.toLowerCase() : ''
+  const rounds = cleanRounds(input.rounds)
+  if (!taskKey || !OUTCOMES.has(outcome) || rounds == null) {
+    throw new TypeError('Invalid flow review receipt identity')
+  }
+
+  const receipt = {
+    kind: FLOW_REVIEW_RECEIPT_KIND,
+    taskKey,
+    outcome,
+    rounds,
+    checks: cleanLines(input.checks),
+    reasons: cleanLines(input.reasons),
+  }
+  const candidateSha = cleanSha(input.candidateSha)
+  const acceptanceDigest = cleanDigest(input.acceptanceDigest)
+  // Presence, not truthiness, is intentional: deployments are never inferred
+  // from a pass/reject outcome or from a candidate SHA.
+  const deployment = Object.hasOwn(input, 'deployment') ? cleanText(input.deployment, MAX_LINE) : null
+  if (candidateSha) receipt.candidateSha = candidateSha
+  if (acceptanceDigest) receipt.acceptanceDigest = acceptanceDigest
+  receipt.verified = Boolean(candidateSha && acceptanceDigest)
+  if (outcome === 'pass' && !receipt.verified) {
+    throw new TypeError('Passing flow review receipt requires an exact candidate and acceptance digest')
+  }
+  if (deployment) receipt.deployment = deployment
+  return receipt
+}
+
+export function isFlowReviewReceipt(value) {
+  try {
+    const receipt = createFlowReviewReceipt(value)
+    return receipt.kind === value?.kind
+  } catch {
+    return false
+  }
+}
+
+// A review lane may receive the same terminal submission twice (tool retry,
+// double click, or concurrent provider delivery). Serialize the whole verdict
+// transaction—not just receipt emission—so an awaited revert cannot run twice.
+export function createFlowReviewSingleFlight() {
+  let pending = null
+  return async function runFlowReviewVerdict(operation) {
+    if (pending) return pending
+    const current = (async () => operation())()
+    pending = current
+    try {
+      return await current
+    } finally {
+      if (pending === current) pending = null
+    }
+  }
+}

package/flow-task-graph.mjs

@@ -54,6 +54,18 @@ export const FLOW_CONTRACT_LIMITS = Object.freeze({
 })
 
 const BASELINE_NEGATIVE_SIGNAL = /\b(fail(?:s|ed|ing)?|absent|missing|not\s+(?:present|implemented|available|found)|does\s+not|404|empty)\b/i
+const CONTRACT_DIGEST = /^[a-f0-9]{64}$/
+const SHA256_K = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]
+const rotateRight = (value, bits) => (value >>> bits) | (value << (32 - bits))
 const hasDisallowedControl = (value) => {
   for (const char of value) {
     const code = char.charCodeAt(0)
@@ -82,6 +94,80 @@ export function normalizeBaselineEvidence (value) {
   return boundedLine(value, 'baseline evidence receipt', FLOW_CONTRACT_LIMITS.maxBaselineEvidenceChars, { required: true })
 }
 
+// This is deliberately a small synchronous SHA-256 implementation instead of a
+// Node crypto import or WebCrypto: the task graph must stay byte-identical and run
+// in both the bridge's Node runtime and the browser bundle.
+function sha256Hex (message) {
+  const source = new TextEncoder().encode(message)
+  const totalLength = Math.ceil((source.length + 9) / 64) * 64
+  const bytes = new Uint8Array(totalLength)
+  bytes.set(source)
+  bytes[source.length] = 0x80
+  let bitLength = BigInt(source.length) * 8n
+  for (let index = totalLength - 1; index >= totalLength - 8; index--) {
+    bytes[index] = Number(bitLength & 0xffn)
+    bitLength >>= 8n
+  }
+
+  const hash = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]
+  const words = new Uint32Array(64)
+  for (let offset = 0; offset < bytes.length; offset += 64) {
+    for (let index = 0; index < 16; index++) {
+      const start = offset + (index * 4)
+      words[index] = ((bytes[start] << 24) | (bytes[start + 1] << 16) | (bytes[start + 2] << 8) | bytes[start + 3]) >>> 0
+    }
+    for (let index = 16; index < 64; index++) {
+      const low = rotateRight(words[index - 15], 7) ^ rotateRight(words[index - 15], 18) ^ (words[index - 15] >>> 3)
+      const high = rotateRight(words[index - 2], 17) ^ rotateRight(words[index - 2], 19) ^ (words[index - 2] >>> 10)
+      words[index] = (words[index - 16] + low + words[index - 7] + high) >>> 0
+    }
+
+    let [a, b, c, d, e, f, g, h] = hash
+    for (let index = 0; index < 64; index++) {
+      const sigma1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
+      const choose = (e & f) ^ (~e & g)
+      const temp1 = (h + sigma1 + choose + SHA256_K[index] + words[index]) >>> 0
+      const sigma0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
+      const majority = (a & b) ^ (a & c) ^ (b & c)
+      const temp2 = (sigma0 + majority) >>> 0
+      h = g
+      g = f
+      f = e
+      e = (d + temp1) >>> 0
+      d = c
+      c = b
+      b = a
+      a = (temp1 + temp2) >>> 0
+    }
+    hash[0] = (hash[0] + a) >>> 0
+    hash[1] = (hash[1] + b) >>> 0
+    hash[2] = (hash[2] + c) >>> 0
+    hash[3] = (hash[3] + d) >>> 0
+    hash[4] = (hash[4] + e) >>> 0
+    hash[5] = (hash[5] + f) >>> 0
+    hash[6] = (hash[6] + g) >>> 0
+    hash[7] = (hash[7] + h) >>> 0
+  }
+  return hash.map((word) => word.toString(16).padStart(8, '0')).join('')
+}
+
+// The acceptance pack belongs to the builder target. A review task copies that
+// target's digest, so its inherited target is bound without re-hashing reviewer
+// prose or later baseline evidence receipts.
+function acceptancePack ({ key, title, scope, acceptance, sliceType, nonGoals, baselineGate, inheritedReviewerTarget = key }) {
+  return {
+    version: 1,
+    task: { key, title, scope, acceptance, sliceType },
+    nonGoals: [...nonGoals].sort(),
+    baselineGate,
+    inheritedReviewerTarget,
+  }
+}
+
+export function acceptancePackDigest (input) {
+  return sha256Hex(JSON.stringify(acceptancePack(input)))
+}
+
 function contractSource (task) {
   const source = task?.contract && typeof task.contract === 'object' && !Array.isArray(task.contract)
     ? { ...task.contract }
@@ -91,12 +177,30 @@ function contractSource (task) {
   return source
 }
 
+function normalizeProvidedContractDigest (source) {
+  if (source.digest === undefined) return null
+  if (typeof source.digest !== 'string' || !CONTRACT_DIGEST.test(source.digest)) {
+    throw new Error('contract digest must be a lowercase SHA-256 hex string')
+  }
+  return source.digest
+}
+
+function normalizeProvidedAcceptancePack (source) {
+  if (source.acceptancePack === undefined) return null
+  if (!source.acceptancePack || typeof source.acceptancePack !== 'object' || Array.isArray(source.acceptancePack)) {
+    throw new Error('contract acceptance pack must be an object')
+  }
+  return source.acceptancePack
+}
+
 // Strict for new terminal submissions. `legacy:true` is restore-only: old persisted
 // plans predate this contract and must remain runnable, but they can never be used to
 // submit a new incomplete plan.
 export function normalizeTaskContract (task, { sliceType, legacy = false } = {}) {
   const source = contractSource(task)
-  if (sliceType === SLICE_TYPE.review) return null
+  const digest = normalizeProvidedContractDigest(source)
+  const sealedPack = normalizeProvidedAcceptancePack(source)
+  if (sliceType === SLICE_TYPE.review) return legacy ? null : { digest, acceptancePack: sealedPack }
   const required = !legacy
   const rawNonGoals = source.nonGoals
   const values = rawNonGoals == null ? [] : (Array.isArray(rawNonGoals) ? rawNonGoals : [rawNonGoals])
@@ -112,7 +216,91 @@ export function normalizeTaskContract (task, { sliceType, legacy = false } = {})
   const evidence = baselineObject?.evidence == null || baselineObject?.evidence === ''
     ? ''
     : normalizeBaselineEvidence(baselineObject.evidence)
-  return { nonGoals, baseline: gate ? { gate, evidence } : null }
+  return { nonGoals, baseline: gate ? { gate, evidence } : null, digest, acceptancePack: sealedPack }
+}
+
+function bindContractDigest (task) {
+  const sealedPack = acceptancePack({
+    key: task.key,
+    title: task.title,
+    scope: task.scope,
+    acceptance: task.acceptance,
+    sliceType: task.sliceType,
+    nonGoals: task.contract.nonGoals,
+    baselineGate: task.contract.baseline?.gate || '',
+    inheritedReviewerTarget: task.key,
+  })
+  const digest = sha256Hex(JSON.stringify(sealedPack))
+  if (task.contract.digest && task.contract.digest !== digest) throw new Error(`task "${task.key}" contract digest does not match its acceptance pack`)
+  if (task.contract.acceptancePack && JSON.stringify(task.contract.acceptancePack) !== JSON.stringify(sealedPack)) {
+    throw new Error(`task "${task.key}" sealed acceptance pack does not match its task fields`)
+  }
+  task.contract.digest = digest
+  task.contract.acceptancePack = sealedPack
+}
+
+// The browser persists normalized task rows before approval, then later sends a
+// ready row back to the bridge for dispatch. Recompute the seal at that final
+// boundary so changed acceptance/scope/non-goals can never ride beside an old hash.
+export function validateTaskContractSeal (task, { legacy = false } = {}) {
+  const contract = task?.contract
+  if (!contract?.digest && legacy) return true
+  if (!contract || typeof contract !== 'object' || !contract.digest || !contract.acceptancePack) {
+    throw new Error('task is missing its sealed acceptance contract')
+  }
+  const pack = contract.acceptancePack
+  const packTask = pack?.task
+  if (!packTask || typeof packTask !== 'object' || !Array.isArray(pack.nonGoals)) {
+    throw new Error('task sealed acceptance pack is malformed')
+  }
+  const canonicalPack = acceptancePack({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+  })
+  if (JSON.stringify(pack) !== JSON.stringify(canonicalPack)) throw new Error('task sealed acceptance pack is not canonical')
+  if (acceptancePackDigest({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+  }) !== contract.digest) throw new Error('task acceptance digest does not match its sealed pack')
+
+  const sliceType = task.sliceType ?? task.slice_type
+  const key = task.key ?? task.task_key
+  const deps = Array.isArray(task.deps) ? task.deps : []
+  if (sliceType === SLICE_TYPE.review) {
+    if (contract.inheritedFrom !== packTask.key || deps.length !== 1 || deps[0] !== packTask.key) {
+      throw new Error('review task no longer targets its sealed builder')
+    }
+    if (pack.inheritedReviewerTarget !== packTask.key || task.acceptance !== packTask.acceptance) {
+      throw new Error(`review task "${key}" changed after its builder acceptance pack was sealed`)
+    }
+    return true
+  }
+  const livePack = acceptancePack({
+    key,
+    title: task.title,
+    scope: task.scope ?? '',
+    acceptance: task.acceptance ?? '',
+    sliceType,
+    nonGoals: contract.nonGoals || [],
+    baselineGate: contract.baseline?.gate || '',
+    inheritedReviewerTarget: key,
+  })
+  if (JSON.stringify(livePack) !== JSON.stringify(canonicalPack)) {
+    throw new Error(`task "${key}" changed after its acceptance pack was sealed`)
+  }
+  return true
 }
 
 // A FlowTask slice. Each is RUNNABLE — a lane can build + run + self-correct it in
@@ -244,6 +432,9 @@ export function normalizePlanOutput (raw, { legacy = false } = {}) {
     })
   })
   validateDag(tasks)
+  for (const task of tasks) {
+    if (task.sliceType !== SLICE_TYPE.review) bindContractDigest(task)
+  }
   for (const task of tasks) {
     if (task.sliceType !== SLICE_TYPE.review) continue
     // New review tasks verify exactly one builder contract. Legacy persisted reviews
@@ -252,11 +443,20 @@ export function normalizePlanOutput (raw, { legacy = false } = {}) {
     if (task.deps.length !== 1) throw new Error(`review task "${task.key}" must depend on exactly one builder task to inherit its contract`)
     const target = tasks.find((candidate) => candidate.key === task.deps[0])
     if (!target || target.sliceType === SLICE_TYPE.review) throw new Error(`review task "${task.key}" must target a builder/fix/scaffold task`)
+    if (task.contract.digest && task.contract.digest !== target.contract.digest) {
+      throw new Error(`review task "${task.key}" contract digest does not match target "${target.key}"`)
+    }
     task.contract = {
       nonGoals: [...(target.contract?.nonGoals || [])],
       baseline: target.contract?.baseline ? { ...target.contract.baseline } : null,
       inheritedFrom: target.key,
+      digest: target.contract.digest,
+      acceptancePack: target.contract.acceptancePack,
     }
+    // Reviewer-authored prose is not an authority boundary. Normalize the live
+    // review row to the builder's sealed acceptance so dispatch and the prompt
+    // cannot silently substitute a weaker criterion.
+    task.acceptance = target.contract.acceptancePack.task.acceptance
   }
   return { summary, tasks }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.361",
+  "version": "0.7.362",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -93,6 +93,7 @@
     "design-edit.mjs",
     "design-source-contract.mjs",
     "flow-review.mjs",
+    "flow-receipt.mjs",
     "review-check.mjs",
     "flow-review-gate.mjs",
     "flow-review-reflect.mjs",

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 21,
+  "bundleVersion": 22,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,25 +130,28 @@
     },
     {
       "id": "flow-completion",
-      "version": 3,
+      "version": 4,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, and a real pre-edit failure/absence gate; completion supplies the observed baseline evidence and the exact dependent reviewer inherits it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, and a real pre-edit failure/absence gate. Approval seals that acceptance pack with a stable digest; completion supplies observed baseline evidence without changing the digest, and the exact dependent reviewer inherits it. A conclusive pass binds one bounded terminal receipt to the exact reviewed candidate SHA and acceptance digest; missing proof holds the Flow instead of completing it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [
         {"path": "bridge/bridge.mjs", "diffPattern": "submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check"},
         {"path": "bridge/flow-review.mjs"},
+        {"path": "bridge/flow-receipt.mjs"},
         {"path": "bridge/flow-review-gate.mjs"},
         {"path": "bridge/flow-task-graph.mjs"}
       ],
       "evidence": [
         {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_plan'"},
         {"path": "bridge/bridge.mjs", "pattern": "'mark_flow_done'"},
-        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"}
+        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"},
+        {"path": "bridge/flow-task-graph.mjs", "pattern": "acceptancePackDigest"},
+        {"path": "bridge/flow-receipt.mjs", "pattern": "Passing flow review receipt requires an exact candidate and acceptance digest"}
       ]
     },
     {