agent-lifecycle-kit 2.14.0__tar.gz → 2.15.0__tar.gz

{agent_lifecycle_kit-2.14.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-2.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.14.0
+Version: 2.15.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -43,7 +43,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.14.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.15.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.14.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.15.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "2.14.0"
+version = "2.15.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "2.14.0"
+__version__ = "2.15.0"

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/adapter_sessions/external_jobs.py

@@ -313,7 +313,7 @@ def request_external_job_cancel(
     job_root: Path | None = None,
     now: Clock | None = None,
 ) -> dict[str, Any]:
-    """Create an idempotent, source-bound cancellation request for a running attempt."""
+    """Acknowledge cancellation-request publication, not process termination."""
 
     require_external_job_pass(validate_external_job_request(request), "request")
     attempt_root = external_job_attempt_path(request, job_root=job_root)
@@ -345,8 +345,7 @@ def request_external_job_cancel(
     except FileExistsError:
         existing = _load_private_json(path, "external job cancel request")
         return _cancel_receipt(request, latest, requested_at=existing.get("requestedAt"), idempotent=True)
-    if completion_path.exists():
-        return _cancel_receipt(request, latest, requested_at=requested_at, idempotent=True, terminal=True)
+    # Completion after publication cannot turn this creator into a no-op retry.
     return _cancel_receipt(request, latest, requested_at=requested_at, idempotent=False)
 
 

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/adapter_sessions/lifecycle_control.py

@@ -69,10 +69,9 @@ def pre_action_gate(
         policy=policy,
         next_action=next_action,
         task_id=task_id,
-        expected_state_revision=(
-            expected_state_revision if expected_state_revision is not None else 0
-        ),
+        expected_state_revision=(expected_state_revision if expected_state_revision is not None else 0),
         package_integrity=package_integrity,
+        repository_root=repository_root,
     )
 
 
@@ -92,6 +91,7 @@ def post_action_gate(
     actual_status: str = "PASS",
     event: dict[str, Any] | None = None,
     policy_path: Path | None = None,
+    repository_root: Path | None = None,
 ) -> dict[str, Any]:
     """Validate host output and changed paths after an authorized action."""
 
@@ -99,6 +99,7 @@ def post_action_gate(
     policy = load_lifecycle_control_policy(policy_path) if policy_path else None
     return evaluate_post_action_gate(
         pre_action=pre_action,
+        repository_root=repository_root,
         manifest=manifest,
         actual_changed_paths=actual_changed_paths,
         outcome=outcome,

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/audit/implementation.py

@@ -7,6 +7,7 @@ from typing import Any
 
 from agent_lifecycle.audit.ownership import build_ownership_report, report_has_category
 from agent_lifecycle.contracts import LifecycleError, canonical_digest, read_json_object
+from agent_lifecycle.contracts.authority_text import require_review_text
 from agent_lifecycle.contracts.paths import normalize_repo_path
 from agent_lifecycle.contracts.review_verdict import (
     BLOCKING_REVIEW_SEVERITIES,
@@ -218,6 +219,7 @@ def validate_implementation_audit_report(
 ) -> dict[str, Any]:
     blockers: list[dict[str, Any]] = []
     compatibility_validation: dict[str, Any] | None = None
+    require_review_text(report)
     if report.get("schemaVersion") != IMPLEMENTATION_AUDIT_SCHEMA:
         blockers.append(
             {"code": "implementation-audit-schema", "message": "unsupported implementation audit schemaVersion"}
@@ -389,6 +391,7 @@ def build_final_implementation_audit(
 def validate_final_implementation_audit(
     audit: dict[str, Any], *, state: dict[str, Any] | None = None
 ) -> dict[str, Any]:
+    require_review_text(audit)
     blockers: list[dict[str, Any]] = []
     if audit.get("schemaVersion") != FINAL_IMPLEMENTATION_AUDIT_SCHEMA:
         blockers.append(

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/audit/ownership.py

@@ -6,8 +6,13 @@ from collections import Counter
 from pathlib import Path
 from typing import Any
 
-from agent_lifecycle.contracts import read_json_object
-from agent_lifecycle.contracts.ownership_paths import is_under_authority_path, normalize_authority_path
+from agent_lifecycle.contracts import LifecycleError, read_json_object
+from agent_lifecycle.contracts.ownership_paths import (
+    is_under_authority_path,
+    normalize_authority_path,
+    observed_authority_paths,
+    require_manifest_authority_paths,
+)
 from agent_lifecycle.contracts.paths import normalize_repo_path
 
 
@@ -16,9 +21,16 @@ def build_ownership_report(
     paths: list[str],
     *,
     base: str | None = None,
+    repository_root: Path | None = None,
 ) -> dict[str, Any]:
     manifest = read_json_object(manifest_path, label="plan manifest")
-    return build_ownership_report_from_manifest(manifest, paths, manifest_path=manifest_path, base=base)
+    return build_ownership_report_from_manifest(
+        manifest,
+        paths,
+        manifest_path=manifest_path,
+        base=base,
+        repository_root=repository_root if repository_root is not None else Path.cwd(),
+    )
 
 
 def build_ownership_report_from_manifest(
@@ -27,11 +39,16 @@ def build_ownership_report_from_manifest(
     *,
     manifest_path: Path | None = None,
     base: str | None = None,
+    repository_root: Path | None = None,
 ) -> dict[str, Any]:
     """Classify changed paths against an already loaded frozen manifest."""
 
-    classifiers = _classifiers(manifest, manifest_path)
-    entries = [_classify_path(path, classifiers) for path in sorted(set(paths))]
+    require_manifest_authority_paths(manifest, operation_root=repository_root)
+    classifiers = _classifiers(manifest, manifest_path, repository_root=repository_root)
+    entries = [
+        _classify_path(path, classifiers, repository_root=repository_root)
+        for path in observed_authority_paths(paths, operation_root=repository_root)
+    ]
     categories = Counter(entry["category"] for entry in entries)
     owners = Counter(owner for entry in entries for owner in entry.get("owners", []))
     return {
@@ -57,15 +74,13 @@ def declared_ownership_paths(manifest: dict[str, Any]) -> list[str]:
     """Return literal workstream ownership paths for read-only projections."""
 
     classifiers = _classifiers(manifest, None)
-    paths = {
-        path
-        for roots in classifiers["workstreams"].values()
-        for path in roots
-    }
+    paths = {path for roots in classifiers["workstreams"].values() for path in roots}
     return sorted(paths)
 
 
-def _classifiers(manifest: dict[str, Any], manifest_path: Path | None) -> dict[str, Any]:
+def _classifiers(
+    manifest: dict[str, Any], manifest_path: Path | None, *, repository_root: Path | None = None
+) -> dict[str, Any]:
     package_value = manifest.get("package")
     package = package_value if isinstance(package_value, dict) else {}
     plan_root = package.get("planArtifactRoot")
@@ -97,7 +112,7 @@ def _classifiers(manifest: dict[str, Any], manifest_path: Path | None) -> dict[s
         ],
     }
     return {
-        "manifestPath": _repo_relative(manifest_path),
+        "manifestPath": _repo_relative(manifest_path, repository_root=repository_root),
         "planArtifactRoot": normalize_authority_path(plan_root, label="planArtifactRoot")
         if isinstance(plan_root, str)
         else None,
@@ -134,28 +149,48 @@ def _classifiers(manifest: dict[str, Any], manifest_path: Path | None) -> dict[s
     }
 
 
-def _classify_path(path: str, classifiers: dict[str, Any]) -> dict[str, Any]:
+def _classify_path(path: str, classifiers: dict[str, Any], *, repository_root: Path | None = None) -> dict[str, Any]:
     normalized = normalize_repo_path(path)
     manifest_path = classifiers["manifestPath"]
-    if isinstance(manifest_path, str) and normalized == manifest_path:
+    if (
+        isinstance(manifest_path, str)
+        and normalized.count("/") == manifest_path.count("/")
+        and is_under_authority_path(normalized, manifest_path, operation_root=repository_root)
+    ):
         return _entry(normalized, "plan-authority", ["controller"])
     plan_root = classifiers["planArtifactRoot"]
-    if isinstance(plan_root, str) and is_under_authority_path(normalized, plan_root):
+    if isinstance(plan_root, str) and is_under_authority_path(normalized, plan_root, operation_root=repository_root):
         return _entry(normalized, "plan-authority", ["controller"])
-    lead = [root for root in classifiers["leadOwned"] if is_under_authority_path(normalized, root)]
+    lead = [
+        root
+        for root in classifiers["leadOwned"]
+        if is_under_authority_path(normalized, root, operation_root=repository_root)
+    ]
     if lead:
         return _entry(normalized, "lead-owned", ["controller"], matched=lead)
-    forbidden = [root for root in classifiers["forbiddenWrites"] if is_under_authority_path(normalized, root)]
+    forbidden = [
+        root
+        for root in classifiers["forbiddenWrites"]
+        if is_under_authority_path(normalized, root, operation_root=repository_root)
+    ]
     if forbidden:
         return _entry(normalized, "forbidden", [], matched=forbidden)
-    read_only = [root for root in classifiers["readOnly"] if is_under_authority_path(normalized, root)]
+    read_only = [
+        root
+        for root in classifiers["readOnly"]
+        if is_under_authority_path(normalized, root, operation_root=repository_root)
+    ]
     if read_only:
         return _entry(normalized, "read-only", [], matched=read_only)
-    owners = [
-        owner
-        for owner, roots in classifiers["workstreams"].items()
-        if any(is_under_authority_path(normalized, root) for root in roots)
-    ]
+    owners = []
+    for owner, roots in classifiers["workstreams"].items():
+        for root in roots:
+            if not is_under_authority_path(normalized, root, operation_root=repository_root):
+                continue
+            if repository_root is not None and not is_under_authority_path(normalized, root):
+                raise LifecycleError("ambiguous-authority-path", "filesystem alias would broaden a write grant")
+            if owner not in owners:
+                owners.append(owner)
     if owners:
         return _entry(normalized, "workstream-owned", owners)
     return _entry(normalized, "unowned", [])
@@ -174,11 +209,12 @@ def _entry(
     return value
 
 
-def _repo_relative(path: Path | None) -> str | None:
+def _repo_relative(path: Path | None, *, repository_root: Path | None = None) -> str | None:
     if path is None:
         return None
     try:
-        return normalize_repo_path(str(path.resolve().relative_to(Path.cwd().resolve())))
+        root = repository_root if repository_root is not None else Path.cwd()
+        return normalize_repo_path(path.absolute().relative_to(root.absolute()).as_posix())
     except ValueError:
         return None
 

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/audit/package.py

@@ -13,6 +13,8 @@ from agent_lifecycle.audit.implementation import (
 from agent_lifecycle.audit.ownership import build_ownership_report, report_has_category
 from agent_lifecycle.changesets import changed_files
 from agent_lifecycle.contracts import LifecycleError, canonical_digest, read_json_object
+from agent_lifecycle.contracts.authority_text import require_review_text
+from agent_lifecycle.contracts.ownership_paths import require_manifest_authority_paths
 from agent_lifecycle.contracts.paths import normalize_repo_path
 from agent_lifecycle.freeze import plan_integrity_required, verify_plan_lock, verify_plan_package_integrity
 from agent_lifecycle.planning import (
@@ -79,9 +81,16 @@ def build_package_audit(
     package_files = _package_file_check(package_dir, manifest=manifest, repository_root=repository_root)
     _capture_check_failure("package-files", package_files, findings, blockers)
 
+    authority_check = _run_check(
+        lambda: require_manifest_authority_paths(manifest, operation_root=repository_root)
+    )
+    _capture_check_failure("authority-paths", authority_check, findings, blockers)
+
     profile = _load_profile(completeness_profile_path)
     manifest_check = _run_check(lambda: validate_plan_manifest(manifest))
-    completeness_check = _run_check(lambda: validate_plan_completeness(manifest, profile=profile))
+    completeness_check = _run_check(
+        lambda: validate_plan_completeness(manifest, profile=profile, operation_root=repository_root)
+    )
     _capture_check_failure("manifest", manifest_check, findings, blockers)
     _capture_check_failure("completeness", completeness_check, findings, blockers)
 
@@ -121,6 +130,7 @@ def build_package_audit(
             "packageFiles": package_files,
             "manifest": manifest_check,
             "completeness": completeness_check,
+            "authorityPaths": authority_check,
             "lock": lock_check,
             "acceptance": acceptance_check,
             "references": references_check,
@@ -170,6 +180,7 @@ def build_package_audit(
                 "packageFiles": package_files,
                 "manifest": manifest_check,
                 "completeness": completeness_check,
+            "authorityPaths": authority_check,
                 "lock": lock_check,
                 "acceptance": acceptance_check,
                 "references": references_check,
@@ -219,6 +230,7 @@ def build_finding_check_adoption_audit(
 def validate_package_audit(audit: dict[str, Any]) -> dict[str, Any]:
     """Validate the integrity and top-level semantics of a package receipt."""
 
+    require_review_text(audit)
     blockers: list[dict[str, Any]] = []
     if audit.get("schemaVersion") != PACKAGE_AUDIT_SCHEMA:
         blockers.append({"code": "package-audit-schema", "message": "unsupported package audit schemaVersion"})

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/changesets/git.py

@@ -24,6 +24,7 @@ def changed_files(cwd: Path, *, base: str | None = None) -> list[str]:
                     "diff",
                     "--no-ext-diff",
                     "--no-textconv",
+                    "--no-renames",
                     "--name-only",
                     "-z",
                     "--end-of-options",
@@ -36,13 +37,23 @@ def changed_files(cwd: Path, *, base: str | None = None) -> list[str]:
         paths.update(
             _git_paths(
                 cwd,
-                ["git", "diff", "--no-ext-diff", "--no-textconv", "--name-only", "-z", "--"],
+                ["git", "diff", "--no-ext-diff", "--no-textconv", "--no-renames", "--name-only", "-z", "--"],
             )
         )
         paths.update(
             _git_paths(
                 cwd,
-                ["git", "diff", "--no-ext-diff", "--no-textconv", "--name-only", "-z", "--cached", "--"],
+                [
+                    "git",
+                    "diff",
+                    "--no-ext-diff",
+                    "--no-textconv",
+                    "--no-renames",
+                    "--name-only",
+                    "-z",
+                    "--cached",
+                    "--",
+                ],
             )
         )
     paths.update(_git_paths(cwd, ["git", "ls-files", "--others", "--exclude-standard", "-z"]))

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/changesets/snapshot.py

@@ -11,7 +11,11 @@ from typing import Any
 
 from agent_lifecycle.changesets.git import GIT_TIMEOUT_SECONDS, changed_files, resolve_revision
 from agent_lifecycle.contracts import LifecycleError, canonical_digest
-from agent_lifecycle.contracts.ownership_paths import is_under_authority_path, normalize_authority_path
+from agent_lifecycle.contracts.ownership_paths import (
+    is_under_authority_path,
+    normalize_authority_path,
+    observed_authority_paths,
+)
 from agent_lifecycle.contracts.paths import normalize_repo_path, read_stable_repository_file
 
 MAX_CHANGED_FILES = 10_000
@@ -38,7 +42,12 @@ def capture_task_change_set(
             "changed file count exceeds the task snapshot limit",
             {"count": len(all_changed), "maxFiles": MAX_CHANGED_FILES},
         )
-    scoped = [path for path in all_changed if any(is_under_authority_path(path, prefix) for prefix in authority)]
+    all_changed = observed_authority_paths(all_changed, operation_root=root)
+    scoped = [
+        path
+        for path in all_changed
+        if any(is_under_authority_path(path, prefix, operation_root=root) for prefix in authority)
+    ]
     transitions: list[dict[str, Any]] = []
     current_entries: list[dict[str, Any]] = []
     total_bytes = 0

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/compiler/small_model_packets.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import Any
 
 from agent_lifecycle.compiler.output_contract import build_output_contract, validate_output_contract
-from agent_lifecycle.compiler.task_packets import compile_task_packets
+from agent_lifecycle.compiler.task_packets import _write_idempotent, compile_task_packets
 from agent_lifecycle.context import render_context
 from agent_lifecycle.context.profiles import small_model_windows
 from agent_lifecycle.contracts import (
@@ -16,6 +16,11 @@ from agent_lifecycle.contracts import (
     is_under_repo_path,
     read_json_object,
 )
+from agent_lifecycle.contracts.ownership_paths import (
+    compiler_output_paths,
+    repository_authority_name,
+    require_output_footprint,
+)
 from agent_lifecycle.policy.adaptive_lifecycle import small_model_packet_eligibility
 from agent_lifecycle.resources import builtin_profile_path
 
@@ -50,9 +55,12 @@ def compile_small_model_packets(
     adaptive_decision: dict[str, Any] | None = None,
     write: bool = False,
     execution_strategy: dict[str, Any] | None = None,
+    repository_root: Path | None = None,
 ) -> dict[str, Any]:
     """Compile frozen task packets into bounded small-model packets."""
 
+    root = repository_root if repository_root is not None else Path.cwd()
+    manifest_path = root / repository_authority_name(root / manifest_path, root)
     manifest = read_json_object(manifest_path, label="plan manifest")
     profile = read_json_object(
         context_profile_path or builtin_profile_path("small-context-profile.v1.json"),
@@ -68,8 +76,17 @@ def compile_small_model_packets(
         manifest_path,
         write=False,
         execution_strategy=execution_strategy,
+        repository_root=root,
     )
+    if canonical_digest(manifest) != compiled["index"]["manifestDigest"]:
+        raise LifecycleError("authority-input-changed", "plan manifest changed during compilation")
     output_dir = out_dir or _default_output_dir(manifest)
+    require_output_footprint(
+        manifest,
+        compiler_output_paths(manifest, output_dir=output_dir, small=True),
+        repository_root=root,
+        manifest_path=manifest_path,
+    )
     eligibility = (
         small_model_packet_eligibility(adaptive_decision) if adaptive_decision is not None else _default_eligibility()
     )
@@ -119,7 +136,7 @@ def compile_small_model_packets(
     }
     index = {**index_body, "indexDigest": canonical_digest(index_body)}
     if write:
-        _write_packets(output_dir, packets, index)
+        _write_packets(output_dir, packets, index, repository_root=root)
     body = {
         "schemaVersion": SMALL_MODEL_COMPILE_RESULT_SCHEMA,
         "status": index["status"],
@@ -312,20 +329,14 @@ def _default_output_dir(manifest: dict[str, Any]) -> Path:
     return Path(artifact_root) / "workflow/small-model-packets"
 
 
-def _write_packets(output_dir: Path, packets: list[dict[str, Any]], index: dict[str, Any]) -> None:
+def _write_packets(
+    output_dir: Path, packets: list[dict[str, Any]], index: dict[str, Any], *, repository_root: Path
+) -> None:
     for packet in packets:
-        _write_idempotent(output_dir / f"{packet['task']['id']}.small-model-packet.json", packet)
-    _write_idempotent(output_dir / "index.json", index)
-
-
-def _write_idempotent(path: Path, payload: dict[str, Any]) -> None:
-    data = canonical_bytes(payload) + b"\n"
-    if path.exists():
-        if path.read_bytes() != data:
-            raise LifecycleError("output-conflict", f"output exists with different content: {path}")
-        return
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_bytes(data)
+        _write_idempotent(
+            output_dir / f"{packet['task']['id']}.small-model-packet.json", packet, repository_root=repository_root
+        )
+    _write_idempotent(output_dir / "index.json", index, repository_root=repository_root)
 
 
 def _string_list(value: Any) -> list[str]:

{agent_lifecycle_kit-2.14.0 → agent_lifecycle_kit-2.15.0}/src/agent_lifecycle/compiler/task_packets.py

@@ -11,6 +11,14 @@ from agent_lifecycle.contracts import (
     canonical_digest,
     read_json_object,
 )
+from agent_lifecycle.contracts.authority_io import create_authority_bytes, read_authority_bytes
+from agent_lifecycle.contracts.authority_text import require_manifest_text
+from agent_lifecycle.contracts.ownership_paths import (
+    compiler_output_paths,
+    repository_authority_name,
+    require_manifest_authority_paths,
+    require_output_footprint,
+)
 from agent_lifecycle.freeze import verify_plan_package_integrity
 from agent_lifecycle.policy.execution_strategy import validate_execution_strategy
 
@@ -21,12 +29,22 @@ def compile_task_packets(
     out_dir: Path | None = None,
     write: bool = False,
     execution_strategy: dict[str, Any] | None = None,
+    repository_root: Path | None = None,
 ) -> dict[str, Any]:
-    root = Path.cwd()
+    root = repository_root if repository_root is not None else Path.cwd()
+    manifest_path = root / repository_authority_name(root / manifest_path, root)
     manifest = read_json_object(manifest_path, label="plan manifest")
+    require_manifest_text(manifest)
+    require_manifest_authority_paths(manifest, operation_root=root)
     plan_digest = _verify_manifest(root, manifest)
     _verify_execution_strategy(execution_strategy, plan_digest=plan_digest)
-    output_dir = out_dir or _default_output_dir(root, manifest)
+    output_dir = out_dir or _default_output_dir(manifest)
+    require_output_footprint(
+        manifest,
+        compiler_output_paths(manifest, output_dir=output_dir),
+        repository_root=root,
+        manifest_path=manifest_path,
+    )
     packets = [
         _packet(manifest, plan_digest, workstream, execution_strategy=execution_strategy)
         for workstream in _workstreams(manifest)
@@ -34,7 +52,7 @@ def compile_task_packets(
     packet_records = [_packet_record(output_dir, packet) for packet in packets]
     index = _index(manifest, plan_digest, output_dir, packet_records)
     if write:
-        _write_packets(output_dir, packets, index)
+        _write_packets(output_dir, packets, index, repository_root=root)
     return {"index": index, "packets": packets}
 
 
@@ -51,7 +69,7 @@ def _verify_manifest(root: Path, manifest: dict[str, Any]) -> str:
     return digest
 
 
-def _default_output_dir(root: Path, manifest: dict[str, Any]) -> Path:
+def _default_output_dir(manifest: dict[str, Any]) -> Path:
     artifact_root = manifest.get("package", {}).get("artifactRoot")
     if not isinstance(artifact_root, str) or not artifact_root:
         raise LifecycleError("invalid-plan-manifest", "package.artifactRoot is required")
@@ -99,7 +117,8 @@ def _verify_execution_strategy(strategy: dict[str, Any] | None, *, plan_digest:
     validation = validate_execution_strategy(strategy)
     if validation["status"] != "PASS":
         raise LifecycleError("task-strategy-invalid", "execution strategy is invalid", {"validation": validation})
-    lineage = strategy.get("lineage") if isinstance(strategy.get("lineage"), dict) else {}
+    lineage_value = strategy.get("lineage")
+    lineage = lineage_value if isinstance(lineage_value, dict) else {}
     if lineage.get("planDigest") != plan_digest:
         raise LifecycleError("task-strategy-plan-mismatch", "execution strategy plan digest mismatch")
 
@@ -107,15 +126,22 @@ def _verify_execution_strategy(strategy: dict[str, Any] | None, *, plan_digest:
 def _strategy_projection(strategy: dict[str, Any] | None, *, task_id: str) -> dict[str, Any] | None:
     if strategy is None:
         return None
-    lineage = strategy.get("lineage") if isinstance(strategy.get("lineage"), dict) else {}
+    lineage_value = strategy.get("lineage")
+    lineage = lineage_value if isinstance(lineage_value, dict) else {}
     if lineage.get("taskId") != task_id:
         return None
     implementation = next(
-        (item for item in strategy.get("phaseRoutes", []) if isinstance(item, dict) and item.get("phase") == "task-implementation"),
+        (
+            item
+            for item in strategy.get("phaseRoutes", [])
+            if isinstance(item, dict) and item.get("phase") == "task-implementation"
+        ),
         {},
     )
-    packet = strategy.get("packet") if isinstance(strategy.get("packet"), dict) else {}
-    quality = strategy.get("quality") if isinstance(strategy.get("quality"), dict) else {}
+    packet_value = strategy.get("packet")
+    packet = packet_value if isinstance(packet_value, dict) else {}
+    quality_value = strategy.get("quality")
+    quality = quality_value if isinstance(quality_value, dict) else {}
     projection = {
         "schemaVersion": strategy.get("schemaVersion"),
         "strategyDigest": strategy.get("strategyDigest"),
@@ -264,17 +290,22 @@ def _write_packets(
     output_dir: Path,
     packets: list[dict[str, Any]],
     index: dict[str, Any],
+    *,
+    repository_root: Path,
 ) -> None:
     for packet in packets:
-        _write_idempotent(output_dir / f"{packet['task']['id']}.task-packet.json", packet)
-    _write_idempotent(output_dir / "index.json", index)
+        _write_idempotent(
+            output_dir / f"{packet['task']['id']}.task-packet.json", packet, repository_root=repository_root
+        )
+    _write_idempotent(output_dir / "index.json", index, repository_root=repository_root)
 
 
-def _write_idempotent(path: Path, payload: dict[str, Any]) -> None:
+def _write_idempotent(path: Path, payload: dict[str, Any], *, repository_root: Path | None = None) -> None:
     data = canonical_bytes(payload) + b"\n"
-    if path.exists():
-        if path.read_bytes() != data:
-            raise LifecycleError("output-conflict", f"output exists with different content: {path}")
-        return
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_bytes(data)
+    root = repository_root if repository_root is not None else Path.cwd()
+    path = root / repository_authority_name(root / path, root)
+    try:
+        create_authority_bytes(path, data, root=root)
+    except FileExistsError:
+        if read_authority_bytes(path, root=root, max_bytes=len(data)) != data:
+            raise LifecycleError("output-conflict", "output exists with different content") from None