ultra-builder-pro-cli 0.23.0 → 0.24.0

package/orchestrator/daemon.cjs

@@ -14,6 +14,7 @@
 const ops = require('../mcp-server/lib/state-ops.cjs');
 const runtimeState = require('../mcp-server/lib/runtime-state.cjs');
 const projector = require('../mcp-server/lib/projector.cjs');
+const workerPackets = require('../mcp-server/lib/worker-packet.cjs');
 const runner = require('./session-runner.cjs');
 const recovery = require('./recovery.cjs');
 const { evaluate, DEFAULT_RULES } = require('./dispatch-rules.cjs');
@@ -184,14 +185,10 @@ function runDaemon({
       if (task.stale) continue;
       if (!taskDependenciesReady(db, task)) continue;
       if (hasActiveFileConflict(db, task)) continue;
-      try {
-        runner.assertSessionTaskReady(db, repoRoot, task.id);
-      } catch (error) {
-        // A normal workflow gate is a durable pending state, not a daemon
-        // failure and not an error to repeat on every poll.
-        if (!runner.isExpectedExecutionGate(error) && onError) onError(error);
-        continue;
-      }
+      // v0.24 workers are always bound to an active Change and receive one
+      // immutable Worker Packet. Legacy unbound tasks remain readable but are
+      // never dispatched by the daemon.
+      if (!task.change_id) continue;
       // admissionCheck catches both live-session conflicts and tripped breakers.
       let verdict;
       try { verdict = ops.admissionCheck(db, task.id); }
@@ -201,7 +198,21 @@ function runDaemon({
       const runtime = routeTask(task, runtimes);
       if (!runtime) continue;
 
+      let packet = null;
       try {
+        packet = workerPackets.createWorkerPacket(db, {
+          role: 'implement',
+          task_id: task.id,
+          runtime,
+          output_path: `.ultra/changes/active/${task.change_id}/delivery/${task.id}-outcome.json`,
+          output_schema: {
+            type: 'object',
+            required: ['packet_digest'],
+            properties: {
+              packet_digest: { type: 'string', pattern: '^[0-9a-f]{64}$' },
+            },
+          },
+        }, { rootDir: repoRoot });
         const handle = runner.spawnSession({
           db, repoRoot,
           task_id: task.id,
@@ -209,12 +220,19 @@ function runDaemon({
           command,
           args: commandArgs,
           mark_task_started: true,
+          kernel_mode: true,
+          packet_digest: packet.packet_digest,
         });
         handle.task_id = task.id;
+        handle.packet = packet;
+        workerPackets.markWorkerPacketAssigned(db, packet.id);
         settleExecution(handle, task);
         children.push(handle);
       } catch (err) {
-        if (onError) onError(err);
+        if (packet?.id) {
+          workerPackets.abandonWorkerPacket(db, packet.id, err.code || err.message);
+        }
+        if (!runner.isExpectedExecutionGate(err) && onError) onError(err);
         // Don't throw — one bad task shouldn't stop the loop.
       }
     }

package/orchestrator/parallel-orchestrator.cjs

@@ -2,13 +2,13 @@
 
 // Phase 8B.2 — Parallel orchestrator.
 //
-// Consumes the current Change-scoped plan.json (built by the plan workflow) and
+// Consumes the current Change-scoped plan.json (published by a Plan checkpoint) and
 // drives resumable per-wave session spawning. Each wave is either parallel
 // (batch Promise.all on proc exit) or serial (await per task) based on the
 // file-overlap detection already done by plan-builder.
 //
 // Responsibilities:
-//   • resolve the canonical Change plan (or an explicit legacy object/path)
+//   • resolve the canonical accepted Change plan
 //   • for each ready wave: evaluate dispatch-rules per task → spawn sessions
 //     via session-runner → wait for transport exit → preserve task-gate state
 //   • stop at the first non-converged wave and resume safely on the next call
@@ -25,43 +25,47 @@ const path = require('node:path');
 const { isDeepStrictEqual } = require('node:util');
 
 const planStore = require('../mcp-server/lib/plan-store.cjs');
-const contextSpine = require('../mcp-server/lib/context-spine.cjs');
 const ops = require('../mcp-server/lib/state-ops.cjs');
-const workflows = require('../mcp-server/lib/workflow-state.cjs');
+const checkpoints = require('../mcp-server/lib/stage-checkpoints.cjs');
+const workerPackets = require('../mcp-server/lib/worker-packet.cjs');
 const runner = require('./session-runner.cjs');
 const dispatchRules = require('./dispatch-rules.cjs');
 
 const TERMINAL_TASK_STATUSES = new Set(['completed', 'expanded']);
 
 function resolvePlan({ db, plan, planPath, repoRoot, changeId = null }) {
-  if (plan) return plan;
-  if (planPath) {
-    const legacy = JSON.parse(fs.readFileSync(planPath, 'utf8'));
-    if (legacy?.change_id) {
+  if (plan) {
+    if (!plan.change_id) {
       throw planError(
         'PLAN_CHANGE_SCOPED_REQUIRED',
-        'change-bound plans must be resolved from their canonical Change artifact root',
+        'orchestrator execution requires an accepted Change-scoped Plan checkpoint',
       );
     }
-    return legacy;
+    return plan;
+  }
+  if (planPath) {
+    throw planError(
+      'PLAN_LEGACY_RETIRED',
+      'explicit planPath execution is retired; migrate the project and use its accepted Change Plan',
+    );
   }
   let candidates;
   if (changeId) {
     candidates = db.prepare(
       `SELECT id, artifact_root, status
        FROM changes
-       WHERE id = ? AND status IN ('active', 'blocked')`,
+       WHERE id = ? AND status = 'active'`,
     ).all(changeId);
   } else {
     candidates = db.prepare(
-      `SELECT c.id, c.artifact_root, c.status, MAX(w.completed_at) AS planned_at
-       FROM changes c
-       JOIN workflow_runs w ON w.change_id = c.id
-       WHERE c.status IN ('active', 'blocked')
-         AND w.kind = 'plan' AND w.status = 'completed'
-       GROUP BY c.id, c.artifact_root, c.status
-       ORDER BY planned_at DESC, c.id ASC`,
-    ).all();
+      `SELECT id, artifact_root, status
+       FROM changes WHERE status = 'active' ORDER BY updated_at DESC, id ASC`,
+    ).all().filter((candidate) => checkpoints.currentCheckpoint(
+      db,
+      'plan',
+      { change_id: candidate.id },
+      { includeDraft: false },
+    ));
   }
   if (candidates.length > 1) {
     throw planError(
@@ -78,7 +82,7 @@ function resolvePlan({ db, plan, planPath, repoRoot, changeId = null }) {
     const err = new Error(
       changeId
         ? `runPlan: no current scoped plan found for change ${changeId}`
-        : 'runPlan: no current Change-scoped plan found; pass an explicit legacy planPath only for migration compatibility',
+        : 'runPlan: no current accepted Change-scoped Plan found',
     );
     err.code = 'PLAN_NOT_FOUND';
     throw err;
@@ -159,13 +163,10 @@ function assertPlanAuthority(db, repoRoot, plan) {
   const taskChangeIds = new Set(taskRows.map((task) => task.change_id).filter(Boolean));
 
   if (!plan.change_id) {
-    if (taskChangeIds.size > 0) {
-      throw planError(
-        'PLAN_NOT_COMPLETED',
-        'change-owned tasks require a change-bound, completed current execution plan',
-      );
-    }
-    return { mode: 'legacy-unbound', workflow_id: null };
+    throw planError(
+      'PLAN_CHANGE_SCOPED_REQUIRED',
+      'orchestrator execution requires an accepted Change-scoped Plan checkpoint',
+    );
   }
   if (taskChangeIds.size > 1 || (taskChangeIds.size === 1 && !taskChangeIds.has(plan.change_id))) {
     throw planError(
@@ -175,74 +176,89 @@ function assertPlanAuthority(db, repoRoot, plan) {
     );
   }
 
-  const completedRuns = workflows.listWorkflows(
+  const currentPlan = checkpoints.currentCheckpoint(
     db,
-    { kind: 'plan', status: 'completed', change_id: plan.change_id, limit: 100 },
-    { rootDir: repoRoot },
+    'plan',
+    { change_id: plan.change_id },
+    { includeDraft: false },
   );
-  if (completedRuns.length === 0) {
+  if (!currentPlan || checkpoints.checkpointDigest(currentPlan) !== currentPlan.digest) {
     throw planError(
       'PLAN_NOT_COMPLETED',
-      `change ${plan.change_id} has no completed plan workflow`,
+      `change ${plan.change_id} has no current accepted Plan checkpoint`,
     );
   }
-
-  let currentPlan;
+  const context = currentPlan.context_envelope_id
+    ? db.prepare('SELECT * FROM context_envelopes WHERE id = ?')
+      .get(currentPlan.context_envelope_id)
+    : null;
+  if (!context || context.stage !== 'plan' || context.scope_type !== 'change'
+      || context.scope_id !== plan.change_id) {
+    throw planError(
+      'PLAN_STALE',
+      `execution plan for ${plan.change_id} is not bound to its Context Envelope`,
+      { authority_code: 'PLAN_CONTEXT_MISMATCH' },
+    );
+  }
+  let contextPayload;
   try {
-    currentPlan = workflows.assertCurrentPlan(db, plan.change_id, repoRoot);
-  } catch (error) {
+    contextPayload = JSON.parse(context.payload_json);
+  } catch {
     throw planError(
-      error.code === 'WORKFLOW_PLAN_NOT_COMPLETED' ? 'PLAN_NOT_COMPLETED' : 'PLAN_STALE',
-      error.message,
-      { authority_code: error.code || null },
+      'PLAN_STALE',
+      `execution plan for ${plan.change_id} has a corrupt Context Envelope`,
+      { authority_code: 'PLAN_CONTEXT_INVALID' },
     );
   }
-  const currentContext = contextSpine.validateContextSnapshot(db, {
-    change_id: plan.change_id,
-    task_id: null,
-    role: 'plan',
-    gate: 'planning',
-  }, {
-    rootDir: repoRoot,
-    require_current_checkout: true,
-  });
-  if (!currentContext.snapshot
-    || currentContext.snapshot.id !== currentPlan.plan.summary.plan_context_snapshot_id) {
+  const baseline = db.prepare(
+    `SELECT scope_json FROM baselines
+     WHERE status <> 'superseded' ORDER BY updated_at DESC, rowid DESC LIMIT 1`,
+  ).get();
+  const scope = baseline
+    ? JSON.parse(baseline.scope_json || '["."]')
+    : ['.'];
+  const currentCheckout = require('../mcp-server/lib/baseline-workflow.cjs')
+    .gitWorktreeSnapshot(repoRoot, scope);
+  const plannedWorktreeDigest = contextPayload.git?.scoped_worktree_digest
+    || contextPayload.git?.worktree_digest
+    || null;
+  if (plannedWorktreeDigest && currentCheckout.digest !== plannedWorktreeDigest) {
     throw planError(
       'PLAN_STALE',
-      `execution plan for ${plan.change_id} was superseded by another planning context`,
-      { authority_code: 'WORKFLOW_PLAN_CONTEXT_MISMATCH' },
+      `execution plan for ${plan.change_id} no longer matches the scoped checkout`,
+      {
+        authority_code: 'PLAN_CONTEXT_STALE',
+        blockers: ['CONTEXT_WORKTREE_STALE'],
+      },
     );
   }
-  if (currentContext.blockers.length > 0) {
+  const staleTasks = taskRows.filter((task) => task.stale);
+  if (staleTasks.length > 0) {
     throw planError(
       'PLAN_STALE',
-      `execution plan for ${plan.change_id} has stale planning context`,
+      `execution plan for ${plan.change_id} contains stale task contracts`,
       {
-        authority_code: 'WORKFLOW_PLAN_CONTEXT_STALE',
-        blockers: currentContext.blockers,
+        authority_code: 'PLAN_TASK_CONTRACT_STALE',
+        task_ids: staleTasks.map((task) => task.id),
       },
     );
   }
-  const expected = planStore.buildPlan(
-    currentPlan.tasks,
-    { changeId: plan.change_id },
-  );
-  const { context, ...planCore } = plan;
+  const expected = planStore.buildPlan(taskRows, { changeId: plan.change_id });
+  const { context: planContext, ...planCore } = plan;
   if (!isDeepStrictEqual(planCore, expected)) {
     throw planError(
       'PLAN_STALE',
       `execution plan for ${plan.change_id} does not match the current DB task graph`,
     );
   }
-  if (!context
-    || context.snapshot_id !== currentPlan.plan.summary.plan_context_snapshot_id
-    || context.manifest_path !== currentPlan.plan.summary.plan_context_path
-    || context.manifest_digest !== currentPlan.plan.summary.plan_context_digest) {
+  if (!planContext
+    || planContext.snapshot_id !== context.id
+    || planContext.manifest_path !== context.artifact_path
+    || planContext.manifest_digest !== context.digest) {
     throw planError(
       'PLAN_STALE',
       `execution plan for ${plan.change_id} does not match its planning context`,
-      { authority_code: 'WORKFLOW_PLAN_CONTEXT_MISMATCH' },
+      { authority_code: 'PLAN_CONTEXT_MISMATCH' },
     );
   }
   const change = db.prepare(
@@ -251,14 +267,6 @@ function assertPlanAuthority(db, repoRoot, plan) {
   const canonicalPaths = planStore.changePlanPaths(repoRoot, change);
   const expectedPlanPath = path.relative(repoRoot, canonicalPaths.json);
   const expectedPlanMdPath = path.relative(repoRoot, canonicalPaths.md);
-  if (currentPlan.plan.summary.plan_path !== expectedPlanPath
-    || currentPlan.plan.summary.plan_md_path !== expectedPlanMdPath) {
-    throw planError(
-      'PLAN_STALE',
-      `completed plan workflow for ${plan.change_id} is not bound to its canonical artifacts`,
-      { authority_code: 'WORKFLOW_PLAN_ARTIFACT_INVALID' },
-    );
-  }
   const canonicalPlan = planStore.loadChangePlanArtifact(
     repoRoot,
     change,
@@ -270,7 +278,7 @@ function assertPlanAuthority(db, repoRoot, plan) {
       `execution plan for ${plan.change_id} differs from its canonical Change artifact`,
     );
   }
-  return { mode: 'current-change', workflow_id: currentPlan.plan.id };
+  return { mode: 'current-change', checkpoint_id: currentPlan.id };
 }
 
 function awaitExit(proc) {
@@ -451,7 +459,27 @@ function reservePreparedTask(db, repoRoot, prepared, ctx) {
   } = prepared;
   const { onError } = ctx;
   let handle;
+  let packet = null;
   try {
+    if (!task.change_id) {
+      throw planError(
+        'TASK_CHANGE_REQUIRED',
+        `orchestrator task ${task.id} must belong to the accepted Change`,
+      );
+    }
+    packet = workerPackets.createWorkerPacket(db, {
+      role: 'implement',
+      task_id: task.id,
+      runtime: decision.runtime,
+      output_path: `.ultra/changes/active/${task.change_id}/delivery/${task.id}-outcome.json`,
+      output_schema: {
+        type: 'object',
+        required: ['packet_digest'],
+        properties: {
+          packet_digest: { type: 'string', pattern: '^[0-9a-f]{64}$' },
+        },
+      },
+    }, { rootDir: repoRoot });
     handle = runner.spawnSession({
       db, repoRoot,
       task_id: task.id,
@@ -459,9 +487,16 @@ function reservePreparedTask(db, repoRoot, prepared, ctx) {
       command: ctx.deferStart ? null : command,
       args: ctx.deferStart ? [] : args,
       mark_task_started: true,
+      kernel_mode: true,
+      packet_digest: packet.packet_digest,
     });
     handle.task_id = task.id;
+    workerPackets.markWorkerPacketAssigned(db, packet.id);
+    handle.packet = packet;
   } catch (err) {
+    if (packet?.id) {
+      workerPackets.abandonWorkerPacket(db, packet.id, err.code || err.message);
+    }
     const authorityBlocked = authorityBlockedResult(err, task.id, {
       reservationFailed: true,
     });
@@ -755,7 +790,7 @@ async function runPlan({
     waves: resolved.waves.length,
     waves_completed: completedWaves,
     paused_wave_id: pausedWave?.id || null,
-    plan_workflow_id: planAuthority.workflow_id,
+    plan_checkpoint_id: planAuthority.checkpoint_id || null,
     awaiting_workflow_gates: awaitingWorkflowGates,
     results: allResults,
   };

package/orchestrator/session-runner.cjs

@@ -15,12 +15,22 @@ const { spawn, execFileSync } = require('node:child_process');
 const { randomUUID } = require('node:crypto');
 
 const ops = require('../mcp-server/lib/state-ops.cjs');
-const workflows = require('../mcp-server/lib/workflow-state.cjs');
-const contextSpine = require('../mcp-server/lib/context-spine.cjs');
+const checkpoints = require('../mcp-server/lib/stage-checkpoints.cjs');
+const workerPackets = require('../mcp-server/lib/worker-packet.cjs');
 const runtimePaths = require('../mcp-server/lib/runtime-paths.cjs');
 const gitBootstrap = require('../mcp-server/lib/git-bootstrap.cjs');
 const closeJournal = require('./session-close-journal.cjs');
 
+function legacyContextSpine() {
+  return module.require(path.join(
+    __dirname,
+    '..',
+    'mcp-server',
+    'lib',
+    'context-spine.cjs',
+  ));
+}
+
 const EXPECTED_EXECUTION_GATE_CODES = new Set([
   'TASK_EXECUTION_CONTRACT_INCOMPLETE',
   'WORKFLOW_TASK_NOT_EXECUTABLE',
@@ -31,6 +41,15 @@ const EXPECTED_EXECUTION_GATE_CODES = new Set([
   'WORKFLOW_PLAN_CONTEXT_STALE',
   'WORKFLOW_IMPLEMENTATION_CONTEXT_REQUIRED',
   'WORKFLOW_IMPLEMENTATION_CONTEXT_STALE',
+  'TASK_NOT_EXECUTABLE',
+  'PLAN_CHECKPOINT_REQUIRED',
+  'PLAN_TASK_CONTRACT_MISSING',
+  'PLAN_TASK_CONTRACT_STALE',
+  'IMPLEMENTATION_CONTEXT_REQUIRED',
+  'IMPLEMENTATION_CONTEXT_STALE',
+  'PLAN_CONTEXT_STALE',
+  'WORKER_PACKET_REQUIRED',
+  'CONTEXT_REQUIRED_REF_STALE',
   'ADMISSION_DENIED',
   'ACTIVE_SESSION_LEASE_CONFLICT',
   'SESSION_CLOSE_PENDING',
@@ -47,11 +66,12 @@ const EXPECTED_EXECUTION_GATE_CODES = new Set([
 ]);
 
 class SessionRunnerError extends Error {
-  constructor(code, message, { cause } = {}) {
+  constructor(code, message, { cause, details } = {}) {
     super(message);
     this.name = 'SessionRunnerError';
     this.code = code;
     if (cause) this.cause = cause;
+    if (details !== undefined) this.details = details;
   }
 }
 
@@ -478,29 +498,28 @@ function changeTaskIntegrationBlocker(db, task, worktreePath) {
       message: `task ${task.id} completion commit does not match worktree HEAD`,
     };
   }
-  const dev = workflows.listWorkflows(
+  const dev = checkpoints.currentCheckpoint(
     db,
-    {
-      kind: 'dev',
-      status: 'ready',
-      change_id: task.change_id,
-      task_id: task.id,
-      limit: 1,
-    },
-    { rootDir: worktreePath },
-  )[0];
-  if (!dev || dev.artifact_health.status !== 'pass') {
+    'dev',
+    { task_id: task.id },
+    { includeDraft: false },
+  );
+  if (!dev || checkpoints.checkpointDigest(dev) !== dev.digest) {
     return {
-      code: 'DEV_WORKFLOW_NOT_READY',
-      message: `task ${task.id} has no current ready dev workflow`,
+      code: 'DEV_CHECKPOINT_NOT_ACCEPTED',
+      message: `task ${task.id} has no current accepted Dev checkpoint`,
     };
   }
-  try {
-    workflows.assertApprovedReview(db, task.change_id, task.id, worktreePath);
-  } catch (error) {
+  const review = checkpoints.currentCheckpoint(
+    db,
+    'review',
+    { task_id: task.id },
+    { includeDraft: false },
+  );
+  if (!review || checkpoints.checkpointDigest(review) !== review.digest) {
     return {
-      code: error.code || 'TASK_REVIEW_NOT_CURRENT',
-      message: error.message,
+      code: 'REVIEW_CHECKPOINT_NOT_ACCEPTED',
+      message: `task ${task.id} has no current accepted Review checkpoint`,
     };
   }
   return null;
@@ -545,8 +564,8 @@ function assertSessionTaskReady(db, repoRoot, taskId) {
   if (!task.change_id) return task;
   ops.assertTaskExecutionContract(task);
   if (!['pending', 'in_progress', 'blocked'].includes(task.status) || task.stale) {
-    throw new workflows.WorkflowStateError(
-      'WORKFLOW_TASK_NOT_EXECUTABLE',
+    throw new SessionRunnerError(
+      'TASK_NOT_EXECUTABLE',
       `task ${task.id} is not executable from status ${task.status}${task.stale ? ' (stale)' : ''}`,
     );
   }
@@ -555,13 +574,24 @@ function assertSessionTaskReady(db, repoRoot, taskId) {
     return !dependency || !['completed', 'expanded'].includes(dependency.status);
   });
   if (incompleteDependencies.length > 0) {
-    throw new workflows.WorkflowStateError(
+    throw new SessionRunnerError(
       'TASK_DEPENDENCIES_INCOMPLETE',
       `task ${task.id} has incomplete dependencies: ${incompleteDependencies.join(', ')}`,
     );
   }
-  workflows.assertCurrentPlan(db, task.change_id, repoRoot);
-  const implementationContext = contextSpine.validateContextSnapshot(db, {
+  const plan = checkpoints.currentCheckpoint(
+    db,
+    'plan',
+    { change_id: task.change_id },
+    { includeDraft: false },
+  );
+  if (!plan || checkpoints.checkpointDigest(plan) !== plan.digest) {
+    throw new SessionRunnerError(
+      'PLAN_CHECKPOINT_REQUIRED',
+      `task ${task.id} requires an accepted Plan checkpoint`,
+    );
+  }
+  const implementationContext = legacyContextSpine().validateContextSnapshot(db, {
     change_id: task.change_id,
     task_id: task.id,
     role: 'implement',
@@ -571,20 +601,20 @@ function assertSessionTaskReady(db, repoRoot, taskId) {
     require_current_checkout: true,
   });
   if (!implementationContext.snapshot) {
-    throw new workflows.WorkflowStateError(
-      'WORKFLOW_IMPLEMENTATION_CONTEXT_REQUIRED',
+    throw new SessionRunnerError(
+      'IMPLEMENTATION_CONTEXT_REQUIRED',
       `task ${task.id} requires a ready implementation Context before session admission`,
       { blockers: implementationContext.blockers },
     );
   }
   if (implementationContext.blockers.length > 0) {
-    throw new workflows.WorkflowStateError(
-      'WORKFLOW_IMPLEMENTATION_CONTEXT_STALE',
+    throw new SessionRunnerError(
+      'IMPLEMENTATION_CONTEXT_STALE',
       `task ${task.id} implementation Context is stale`,
       { blockers: implementationContext.blockers },
     );
   }
-  const planningContext = contextSpine.validateContextSnapshot(db, {
+  const planningContext = legacyContextSpine().validateContextSnapshot(db, {
     change_id: task.change_id,
     task_id: null,
     role: 'plan',
@@ -594,8 +624,8 @@ function assertSessionTaskReady(db, repoRoot, taskId) {
     require_current_checkout: true,
   });
   if (!planningContext.snapshot || planningContext.blockers.length > 0) {
-    throw new workflows.WorkflowStateError(
-      'WORKFLOW_PLAN_CONTEXT_STALE',
+    throw new SessionRunnerError(
+      'PLAN_CONTEXT_STALE',
       `change ${task.change_id} planning Context is stale at session admission`,
       { blockers: planningContext.blockers },
     );
@@ -603,6 +633,73 @@ function assertSessionTaskReady(db, repoRoot, taskId) {
   return task;
 }
 
+function assertKernelSessionTaskReady(db, repoRoot, taskId, packetDigest) {
+  const task = ops.readTask(db, taskId);
+  if (!task) {
+    throw new SessionRunnerError('TASK_NOT_FOUND', `task ${taskId} not found`);
+  }
+  ops.assertTaskExecutionContract(task);
+  if (!['pending', 'in_progress', 'blocked'].includes(task.status) || task.stale) {
+    throw new SessionRunnerError(
+      'TASK_NOT_EXECUTABLE',
+      `task ${task.id} is not executable from status ${task.status}${task.stale ? ' (stale)' : ''}`,
+    );
+  }
+  const incompleteDependencies = (task.deps || []).filter((id) => {
+    const dependency = ops.readTask(db, id);
+    return !dependency || !['completed', 'expanded'].includes(dependency.status);
+  });
+  if (incompleteDependencies.length > 0) {
+    throw new SessionRunnerError(
+      'TASK_DEPENDENCIES_INCOMPLETE',
+      `task ${task.id} has incomplete dependencies: ${incompleteDependencies.join(', ')}`,
+    );
+  }
+  if (task.change_id) {
+    const plan = checkpoints.currentCheckpoint(
+      db,
+      'plan',
+      { change_id: task.change_id },
+      { includeDraft: false },
+    );
+    if (!plan) {
+      throw new SessionRunnerError(
+        'PLAN_CHECKPOINT_REQUIRED',
+        `task ${task.id} requires an accepted Plan checkpoint`,
+      );
+    }
+    const plannedDigest = plan.payload?.plan?.task_contract_digests?.[task.id];
+    if (!plannedDigest) {
+      throw new SessionRunnerError(
+        'PLAN_TASK_CONTRACT_MISSING',
+        `accepted Plan checkpoint does not bind task ${task.id}`,
+      );
+    }
+    const packet = packetDigest
+      ? db.prepare(
+        `SELECT id, task_digest FROM worker_packets
+         WHERE packet_digest = ? AND scope_type = 'task' AND scope_id = ?
+           AND status IN ('pending', 'assigned')`,
+      ).get(packetDigest, task.id)
+      : null;
+    if (!packet) {
+      throw new SessionRunnerError(
+        'WORKER_PACKET_REQUIRED',
+        `task ${task.id} requires the exact Worker Packet prepared for this session`,
+      );
+    }
+    workerPackets.readWorkerPacket(db, packet.id, { rootDir: repoRoot });
+    if (packet.task_digest !== plannedDigest) {
+      throw new SessionRunnerError(
+        'PLAN_TASK_CONTRACT_STALE',
+        `task ${task.id} no longer matches its accepted Plan checkpoint`,
+      );
+    }
+    return task;
+  }
+  return task;
+}
+
 function admissionCheck(db, repoRoot, taskId, options = {}) {
   assertSessionTaskReady(db, repoRoot, taskId);
   const pendingClose = closeJournal.findForTask(repoRoot, taskId);
@@ -697,6 +794,8 @@ function spawnSession({
   mark_task_started = false,
   takeover_timeout_ms = 5000,
   takeover_poll_ms = 25,
+  kernel_mode = false,
+  packet_digest = null,
 }) {
   if (!db) throw new SessionRunnerError('VALIDATION_ERROR', 'db handle required');
   if (!repoRoot) throw new SessionRunnerError('VALIDATION_ERROR', 'repoRoot required');
@@ -717,7 +816,8 @@ function spawnSession({
   }
   // Validate workflow authority before takeover can terminate the prior worker
   // or any filesystem mutation creates a new worktree.
-  assertSessionTaskReady(db, repoRoot, task_id);
+  if (kernel_mode) assertKernelSessionTaskReady(db, repoRoot, task_id, packet_digest);
+  else assertSessionTaskReady(db, repoRoot, task_id);
   let authority;
   try {
     authority = runtimePaths.ensureRuntimeState(repoRoot, {
@@ -1140,6 +1240,7 @@ module.exports = {
   attachHeartbeat,
   admissionCheck,
   assertSessionTaskReady,
+  assertKernelSessionTaskReady,
   // exposed for tests
   _internal: {
     gitWorktreeAdd,