agent-lifecycle-kit 2.29.0__tar.gz → 2.31.0__tar.gz

{agent_lifecycle_kit-2.29.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-2.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.29.0
+Version: 2.31.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -35,14 +35,14 @@ Dynamic: license-file
 
 The provider-neutral workflow works with Codex, Claude Code, Qwen Code, Goose, OpenInterpreter, Pi, Grok Build, or another CLI. Provider commands, model choice and secret handling stay in adapters or host-local profiles.
 
-ALK provides a verifiable finish for external-agent work with proportionate control. It adds only the checks and evidence needed for the task; most of the time remains for research, implementation and product verification.
+ALK provides a verifiable finish for external-agent work with proportionate control. It adds only the checks and evidence needed for the task; most of the time remains for research, implementation and product verification. Release 2.31 strengthens supported-text secret checks, enforces global branch and critical-file coverage floors, and gives a bounded structural refusal for malformed legacy state. See [the 2.31 check boundaries](docs/reference/cli.md#release-231-bounded-quality-checks). See [workflow history and recovery](docs/reference/workflow-state-storage.md) for the earlier storage and renewal features. Install the Python package as well as the plugin for the new CLI commands.
 
 Release 2.28 adds [bounded lifecycle and accounting baselines](docs/reference/performance-and-resource-budgets.md#release-228-lifecycle-and-accounting-baselines). Repository tools measure real read-only operations and separate fixture preparation from operation and subprocess time. The Windows fixture comparison observed a 13.08% median reduction in one six-sample experiment; it is not a universal speed promise. All security and platform checks remain required.
 
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md). Release 2.23 adds [compact S0/S1 authoring](docs/reference/tier-proportional-plan-packages.md) with explicit checklist completion and unchanged approval gates. Release 2.22 adds [conservative plan-review reuse](docs/reference/conservative-delta-review.md) with independent current applicability and no automatic full reruns. Release 2.21 adds [command accounting, bounded preparation and response recovery](docs/reference/source-native-workflow-accounting.md). Release 2.20 adds [target-bound initialization](docs/reference/cli.md#release-220-composed-initialization-and-digest-display), [bounded local continuation](docs/reference/workflow-continuation.md) and batched Git snapshots. Release 2.19 adds [safe artifact authoring and planning preflight](docs/reference/safe-artifact-authoring.md), [bounded review handoff](docs/reference/review-mesh.md#bounded-review-handoff) and thin skills with complete references. Release 2.18 bounds process/Git diagnostics, hardens signing and distinguishes OpenCode 1.x/2.x compatibility ([adapter notes](docs/adapters/opencode.md)); 2.17 strengthens [workflow validation and recovery](docs/reference/workflow-completeness.md). Release 2.16 introduced cumulative accounting within verified host capabilities; see [retention maintenance](docs/operations/retention-maintenance.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.29.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
+It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.31.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/README.md

@@ -12,14 +12,14 @@
 
 The provider-neutral workflow works with Codex, Claude Code, Qwen Code, Goose, OpenInterpreter, Pi, Grok Build, or another CLI. Provider commands, model choice and secret handling stay in adapters or host-local profiles.
 
-ALK provides a verifiable finish for external-agent work with proportionate control. It adds only the checks and evidence needed for the task; most of the time remains for research, implementation and product verification.
+ALK provides a verifiable finish for external-agent work with proportionate control. It adds only the checks and evidence needed for the task; most of the time remains for research, implementation and product verification. Release 2.31 strengthens supported-text secret checks, enforces global branch and critical-file coverage floors, and gives a bounded structural refusal for malformed legacy state. See [the 2.31 check boundaries](docs/reference/cli.md#release-231-bounded-quality-checks). See [workflow history and recovery](docs/reference/workflow-state-storage.md) for the earlier storage and renewal features. Install the Python package as well as the plugin for the new CLI commands.
 
 Release 2.28 adds [bounded lifecycle and accounting baselines](docs/reference/performance-and-resource-budgets.md#release-228-lifecycle-and-accounting-baselines). Repository tools measure real read-only operations and separate fixture preparation from operation and subprocess time. The Windows fixture comparison observed a 13.08% median reduction in one six-sample experiment; it is not a universal speed promise. All security and platform checks remain required.
 
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md). Release 2.23 adds [compact S0/S1 authoring](docs/reference/tier-proportional-plan-packages.md) with explicit checklist completion and unchanged approval gates. Release 2.22 adds [conservative plan-review reuse](docs/reference/conservative-delta-review.md) with independent current applicability and no automatic full reruns. Release 2.21 adds [command accounting, bounded preparation and response recovery](docs/reference/source-native-workflow-accounting.md). Release 2.20 adds [target-bound initialization](docs/reference/cli.md#release-220-composed-initialization-and-digest-display), [bounded local continuation](docs/reference/workflow-continuation.md) and batched Git snapshots. Release 2.19 adds [safe artifact authoring and planning preflight](docs/reference/safe-artifact-authoring.md), [bounded review handoff](docs/reference/review-mesh.md#bounded-review-handoff) and thin skills with complete references. Release 2.18 bounds process/Git diagnostics, hardens signing and distinguishes OpenCode 1.x/2.x compatibility ([adapter notes](docs/adapters/opencode.md)); 2.17 strengthens [workflow validation and recovery](docs/reference/workflow-completeness.md). Release 2.16 introduced cumulative accounting within verified host capabilities; see [retention maintenance](docs/operations/retention-maintenance.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.29.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
+It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.31.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "2.29.0"
+version = "2.31.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.16"

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "2.29.0"
+__version__ = "2.31.0"

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/accounting/workflow_authority_store.py

@@ -20,13 +20,18 @@ from agent_lifecycle.contracts.workflow_authority import (
     verify_signed_authority_snapshot,
 )
 from agent_lifecycle.contracts.workflow_authority_schemas import validate_bootstrap_pin, validate_run_output_anchor
+from agent_lifecycle.contracts.workflow_state_authority import (
+    decode_workflow_authority,
+    validate_workflow_authority,
+)
 from agent_lifecycle.contracts.workflow_state_schemas import (
-    WORKFLOW_STATE_V4,
+    has_current_workflow_semantics,
     validate_adoption_input,
     validate_adoption_selection,
     validate_runtime_binding,
     validate_workflow_state,
 )
+from agent_lifecycle.contracts.workflow_storage_context import StorageOperation
 
 from .contracts import JournalUnavailable, canonical, digest
 
@@ -357,10 +362,17 @@ def _validate_v6_storage_receipt(db: sqlite3.Connection) -> None:
         raise JournalUnavailable("V6 schema differs from migration receipt")
 
 
-def validate_legacy_adoption_history(state: dict, events: list[dict]) -> dict:
+def validate_legacy_adoption_history(
+    state: dict,
+    events: list[dict],
+    *,
+    root: Path | None = None,
+    state_path: Path | None = None,
+    operation: StorageOperation | None = None,
+) -> dict:
     """Refuse split or incomplete legacy history before any Journal adoption write."""
-    validate_workflow_state(state)
-    if state["schemaVersion"] != WORKFLOW_STATE_V4:
+    validate_workflow_authority(state, root=root, state_path=state_path, operation=operation)
+    if not has_current_workflow_semantics(state):
         raise LifecycleError("workflow-adoption-invalid", "Legacy state must complete explicit v4 migration")
     if type(events) is not list:
         raise LifecycleError("workflow-adoption-invalid", "Complete ordered event history is required")
@@ -369,48 +381,9 @@ def validate_legacy_adoption_history(state: dict, events: list[dict]) -> dict:
     if len(events) != revision - 1 or len(ledger) != len(events):
         raise LifecycleError("workflow-adoption-invalid", "Event and operation history are incomplete")
     seen: set[str] = set()
-    fields = {
-        "schemaVersion",
-        "runId",
-        "packageId",
-        "stateRevision",
-        "operationId",
-        "eventType",
-        "payload",
-        "recordedAt",
-    }
     for expected_revision, event in enumerate(events, start=2):
-        if type(event) is not dict or set(event) != fields:
-            raise LifecycleError("workflow-adoption-invalid", "Legacy event has missing or unknown fields")
-        operation_id = event["operationId"]
-        if (
-            event["schemaVersion"] != "agent-workflow-event.v1"
-            or event["runId"] != state["runId"]
-            or event["packageId"] != state["packageId"]
-            or type(event["stateRevision"]) is not int
-            or event["stateRevision"] != expected_revision
-            or type(operation_id) is not str
-            or not 1 <= len(operation_id) <= 256
-            or operation_id in seen
-            or type(event["eventType"]) is not str
-            or not event["eventType"]
-            or type(event["payload"]) is not dict
-            or type(event["recordedAt"]) is not str
-            or not event["recordedAt"]
-        ):
-            raise LifecycleError("workflow-adoption-invalid", "Legacy event identity or order differs")
-        entry = ledger.get(operation_id)
-        if (
-            type(entry) is not dict
-            or set(entry) != {"stateRevision", "eventType", "recordedAt"}
-            or type(entry["stateRevision"]) is not int
-            or entry["stateRevision"] != expected_revision
-            or entry["eventType"] != event["eventType"]
-            or type(entry["recordedAt"]) is not str
-            or not entry["recordedAt"]
-            or entry["recordedAt"] != event["recordedAt"]
-        ):
-            raise LifecycleError("workflow-adoption-invalid", "Operation ledger differs from event history")
+        operation_id = _require_legacy_event_identity(event, state, expected_revision, seen)
+        _require_legacy_ledger_entry(ledger.get(operation_id), event, expected_revision)
         seen.add(operation_id)
     return {
         "schemaVersion": "agent-workflow-legacy-history-check.v1",
@@ -425,6 +398,53 @@ def validate_legacy_adoption_history(state: dict, events: list[dict]) -> dict:
     }
 
 
+def _require_legacy_event_identity(event: dict, state: dict, expected_revision: int, seen: set[str]) -> str:
+    fields = {
+        "schemaVersion",
+        "runId",
+        "packageId",
+        "stateRevision",
+        "operationId",
+        "eventType",
+        "payload",
+        "recordedAt",
+    }
+    if type(event) is not dict or set(event) != fields:
+        raise LifecycleError("workflow-adoption-invalid", "Legacy event has missing or unknown fields")
+    operation_id = event["operationId"]
+    if (
+        event["schemaVersion"] != "agent-workflow-event.v1"
+        or event["runId"] != state["runId"]
+        or event["packageId"] != state["packageId"]
+        or type(event["stateRevision"]) is not int
+        or event["stateRevision"] != expected_revision
+        or type(operation_id) is not str
+        or not 1 <= len(operation_id) <= 256
+        or operation_id in seen
+        or type(event["eventType"]) is not str
+        or not event["eventType"]
+        or type(event["payload"]) is not dict
+        or type(event["recordedAt"]) is not str
+        or not event["recordedAt"]
+    ):
+        raise LifecycleError("workflow-adoption-invalid", "Legacy event identity or order differs")
+    return operation_id
+
+
+def _require_legacy_ledger_entry(entry: object, event: dict, expected_revision: int) -> None:
+    if (
+        type(entry) is not dict
+        or set(entry) != {"stateRevision", "eventType", "recordedAt"}
+        or type(entry["stateRevision"]) is not int
+        or entry["stateRevision"] != expected_revision
+        or entry["eventType"] != event["eventType"]
+        or type(entry["recordedAt"]) is not str
+        or not entry["recordedAt"]
+        or entry["recordedAt"] != event["recordedAt"]
+    ):
+        raise LifecycleError("workflow-adoption-invalid", "Operation ledger differs from event history")
+
+
 def _adoption_artifact(root: Path, ref: dict) -> bytes:
     relative = normalize_repo_path(ref["path"], label="adoption artifact")
     raw = read_authority_bytes(root / relative, max_bytes=8_388_608, root=root)
@@ -459,10 +479,11 @@ def prepare_legacy_adoption_candidate(
         binding["canonicalStatePath"], label="bound state"
     ):
         raise LifecycleError("workflow-adoption-invalid", "Legacy state path differs from binding")
-    state = load_json_object(_adoption_artifact(root, state_ref), label="legacy workflow state")
+    state_raw = _adoption_artifact(root, state_ref)
+    state = load_json_object(state_raw, label="legacy workflow state")
     validate_workflow_state(state)
     if (
-        state["schemaVersion"] != WORKFLOW_STATE_V4
+        not has_current_workflow_semantics(state)
         or state["runId"] != binding["runId"]
         or state["packageId"] != binding["packageId"]
         or state.get("planDigest") != binding["planDigest"]
@@ -471,31 +492,12 @@ def prepare_legacy_adoption_candidate(
         raise LifecycleError("workflow-adoption-invalid", "Legacy state identity differs from binding")
     state_path = root / state_ref["path"]
     anchor = resolve_authority_anchor(state_path, state.get("packageRoot", "."), root=root)
-    event_path = anchor / normalize_repo_path(state["eventLog"], label="legacy event log")
-    try:
-        event_relative = event_path.relative_to(root).as_posix()
-    except ValueError:
-        raise LifecycleError("workflow-adoption-invalid", "Legacy event log escapes selected root") from None
-    event_ref = adoption_input["legacyEventLogRef"]
-    if event_ref is None:
-        if state["stateRevision"] != 1 or state["operationLedger"]:
-            raise LifecycleError("workflow-adoption-invalid", "Missing legacy event prefix")
-        try:
-            read_authority_bytes(root / event_relative, max_bytes=8_388_608, root=root)
-        except FileNotFoundError:
-            event_raw = b""
-        else:
-            raise LifecycleError("workflow-adoption-invalid", "Existing event log requires an exact ref")
-    else:
-        if normalize_repo_path(event_ref["path"], label="event ref") != event_relative:
-            raise LifecycleError("workflow-adoption-invalid", "Legacy event path differs from state")
-        event_raw = _adoption_artifact(root, event_ref)
-    events = []
-    for line in event_raw.splitlines():
-        if not line.strip():
-            raise LifecycleError("workflow-adoption-invalid", "Blank legacy event line")
-        events.append(load_json_object(line, label="legacy event"))
-    history = validate_legacy_adoption_history(state, events)
+    events = _read_adoption_events(root, anchor, state, adoption_input)
+    with StorageOperation(anchor, state_path=state_path, run_id=state["runId"]) as operation:
+        state = decode_workflow_authority(state_raw, root=anchor, state_path=state_path, operation=operation)
+        history = validate_legacy_adoption_history(
+            state, events, root=anchor, state_path=state_path, operation=operation
+        )
     snapshot_raw = _adoption_artifact(root, adoption_input["initialSnapshotRef"])
     if len(snapshot_raw) > 1_048_576:
         raise LifecycleError("workflow-adoption-invalid", "Initial snapshot exceeds authority byte limit")
@@ -541,6 +543,34 @@ def prepare_legacy_adoption_candidate(
     }
 
 
+def _read_adoption_events(root: Path, anchor: Path, state: dict, adoption_input: dict) -> list[dict]:
+    event_path = anchor / normalize_repo_path(state["eventLog"], label="legacy event log")
+    try:
+        event_relative = event_path.relative_to(root).as_posix()
+    except ValueError:
+        raise LifecycleError("workflow-adoption-invalid", "Legacy event log escapes selected root") from None
+    event_ref = adoption_input["legacyEventLogRef"]
+    if event_ref is None:
+        if state["stateRevision"] != 1 or state["operationLedger"]:
+            raise LifecycleError("workflow-adoption-invalid", "Missing legacy event prefix")
+        try:
+            read_authority_bytes(root / event_relative, max_bytes=8_388_608, root=root)
+        except FileNotFoundError:
+            event_raw = b""
+        else:
+            raise LifecycleError("workflow-adoption-invalid", "Existing event log requires an exact ref")
+    else:
+        if normalize_repo_path(event_ref["path"], label="event ref") != event_relative:
+            raise LifecycleError("workflow-adoption-invalid", "Legacy event path differs from state")
+        event_raw = _adoption_artifact(root, event_ref)
+    events = []
+    for line in event_raw.splitlines():
+        if not line.strip():
+            raise LifecycleError("workflow-adoption-invalid", "Blank legacy event line")
+        events.append(load_json_object(line, label="legacy event"))
+    return events
+
+
 def _loaded_root(db: sqlite3.Connection, binding: dict, binding_digest: str) -> dict:
     """A missing qualified bootstrap is unavailable, never a new self-selected root."""
     row = db.execute(

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/dispatch_lifecycle.py

@@ -38,6 +38,7 @@ from agent_lifecycle.workflow import (
     next_action,
     pause_for_budget_decision,
     pause_for_external_action,
+    renew_execution_authorization,
     resolve_blocker,
     resume_external_action,
     rework_task,
@@ -47,9 +48,11 @@ from agent_lifecycle.workflow import (
     status,
     validate_budget_exceeded_policy,
 )
-from agent_lifecycle.workflow.artifacts import build_current_task_change_set
+from agent_lifecycle.workflow.artifacts import build_current_task_change_set, package_root
 from agent_lifecycle.workflow.closing_window import operator_claim_refusal
 from agent_lifecycle.workflow.initialization import initialize_compiled_workflow, project_workflow_initialization
+from agent_lifecycle.workflow.state import load_state
+from agent_lifecycle.workflow.storage import task_evidence
 
 
 def dispatch_lifecycle(args: argparse.Namespace) -> dict[str, Any]:
@@ -61,6 +64,34 @@ def dispatch_lifecycle(args: argparse.Namespace) -> dict[str, Any]:
     raise LifecycleError("command-not-implemented", "lifecycle command is not implemented")
 
 
+def _dispatch_workflow_query(args: argparse.Namespace, state_path: Path) -> dict[str, Any]:
+    if args.workflow_command == "next":
+        return next_action(status(state_path, full=True)["state"])
+    payload = status(state_path, full=args.full)
+    prefix = getattr(args, "digest_prefix_length", None)
+    return build_digest_display_view(payload, minimum_length=prefix) if prefix is not None else payload
+
+
+def _dispatch_execution_grant(args: argparse.Namespace, state_path: Path) -> dict[str, Any]:
+    if args.workflow_command == "run-start":
+        return start_execution(
+            state_path,
+            operation_id=args.operation_id,
+            expected_revision=args.expected_revision,
+            source_revision=args.source_revision,
+            reason=args.reason,
+        )
+    authorize = {"authorize": authorize_execution, "authorization-renew": renew_execution_authorization}
+    return authorize[args.workflow_command](
+        state_path,
+        operation_id=args.operation_id,
+        expected_revision=args.expected_revision,
+        source_revision=args.source_revision,
+        receipt_path=args.receipt,
+        reason=args.reason,
+    )
+
+
 def _dispatch_workflow_initialization(args: argparse.Namespace) -> dict[str, Any]:
     if args.workflow_command == "init":
         if getattr(args, "manifest", None) is not None:
@@ -83,6 +114,7 @@ def _dispatch_workflow_initialization(args: argparse.Namespace) -> dict[str, Any
             operation_id=args.operation_id,
             expected_revision=args.expected_revision,
             source_revision=args.source_revision,
+            target_schema=args.target_schema,
         )
     if args.workflow_command == "migrate-runner-artifact":
         from agent_lifecycle.migration.legacy_runner import convert_legacy_runner_artifact
@@ -121,12 +153,8 @@ def _dispatch_workflow(args: argparse.Namespace) -> dict[str, Any]:
     if args.workflow_command in {"init", "state-migrate", "migrate-runner-artifact"}:
         return _dispatch_workflow_initialization(args)
     state_path = Path(args.state)
-    if args.workflow_command == "status":
-        payload = status(state_path, full=args.full)
-        prefix = getattr(args, "digest_prefix_length", None)
-        return build_digest_display_view(payload, minimum_length=prefix) if prefix is not None else payload
-    if args.workflow_command == "next":
-        return next_action(status(state_path, full=True)["state"])
+    if args.workflow_command in {"status", "next"}:
+        return _dispatch_workflow_query(args, state_path)
     if args.workflow_command == "validation-select":
         return _dispatch_validation_select(args, state_path)
     if args.workflow_command == "run":
@@ -158,23 +186,8 @@ def _dispatch_workflow(args: argparse.Namespace) -> dict[str, Any]:
             start_mode=args.start_mode,
             authorized_by=args.authorized_by,
         )
-    if args.workflow_command == "run-start":
-        return start_execution(
-            state_path,
-            operation_id=args.operation_id,
-            expected_revision=args.expected_revision,
-            source_revision=args.source_revision,
-            reason=args.reason,
-        )
-    if args.workflow_command == "authorize":
-        return authorize_execution(
-            state_path,
-            operation_id=args.operation_id,
-            expected_revision=args.expected_revision,
-            source_revision=args.source_revision,
-            receipt_path=args.receipt,
-            reason=args.reason,
-        )
+    if args.workflow_command in {"run-start", "authorize", "authorization-renew"}:
+        return _dispatch_execution_grant(args, state_path)
     if args.workflow_command in {"external-pause", "pause-external"}:
         return pause_for_external_action(
             state_path,
@@ -369,11 +382,11 @@ def _dispatch_task_snapshot(args: argparse.Namespace, state_path: Path) -> dict[
             "phase-packet-required-fact-missing",
             "task snapshot phase packet requires --manifest, --lock, --phase-packet-purpose and --phase-packet-out",
         )
-    state = read_json_object(state_path, label="workflow state") if packet_requested else None
+    state = load_state(state_path) if packet_requested else None
     task = _state_task(state, args.task) if isinstance(state, dict) else None
     if args.phase_packet_purpose == "TASK_AUDIT" and isinstance(task, dict) and task.get("status") == "VERIFYING":
         assert state is not None
-        payload = _result_bound_task_change_set(state, task)
+        payload = _result_bound_task_change_set(state, task, package_root(state_path, state))
     else:
         payload = build_current_task_change_set(state_path, task_id=args.task)
     if args.out:
@@ -395,8 +408,8 @@ def _dispatch_task_snapshot(args: argparse.Namespace, state_path: Path) -> dict[
     return payload
 
 
-def _result_bound_task_change_set(state: dict[str, Any], task: dict[str, Any]) -> dict[str, Any]:
-    evidence = task.get("resultChangeSetEvidence")
+def _result_bound_task_change_set(state: dict[str, Any], task: dict[str, Any], root: Path) -> dict[str, Any]:
+    evidence = task_evidence(root, state, task, "resultChangeSetEvidence")
     if not isinstance(evidence, dict):
         raise LifecycleError("phase-packet-required-fact-missing", "task audit result change-set evidence is missing")
     required = ("provider", "baselineSha", "fileSetHash", "diffHash", "snapshotHash")
@@ -424,7 +437,7 @@ def _result_bound_task_change_set(state: dict[str, Any], task: dict[str, Any]) -
 
 
 def _dispatch_validation_select(args: argparse.Namespace, state_path: Path) -> dict[str, Any]:
-    state = read_json_object(state_path, label="workflow state")
+    state = load_state(state_path)
     task = _state_task(state, args.task)
     snapshot = read_json_object(Path(args.snapshot), label="task snapshot")
     if snapshot.get("taskId") != task.get("id"):

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/dispatch_observability.py

@@ -99,6 +99,7 @@ from agent_lifecycle.reporting import (
     render_usage_export_json,
     render_usage_export_table,
 )
+from agent_lifecycle.workflow.state import load_state
 
 
 def dispatch_observability(args: argparse.Namespace) -> dict[str, Any] | str:
@@ -335,7 +336,7 @@ def _dispatch_context(args: argparse.Namespace) -> dict[str, Any]:
     if args.context_command == "checkpoint":
         return _dispatch_context_checkpoint(args)
     if args.context_command == "restore":
-        state = read_json_object(Path(args.state), label="workflow state")
+        state = load_state(Path(args.state))
         payload = restore_context_checkpoint(
             Path(args.checkpoint),
             state=state,
@@ -355,7 +356,7 @@ def _dispatch_context(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _dispatch_context_checkpoint(args: argparse.Namespace) -> dict[str, Any]:
-    state = read_json_object(Path(args.state), label="workflow state")
+    state = load_state(Path(args.state))
     manifest = read_json_object(Path(args.plan), label="context checkpoint plan")
     input_payload = read_json_object(Path(args.input), label="context checkpoint input")
     reason = str(args.reason)
@@ -407,10 +408,10 @@ def _require_checkpoint_output_root(root: Path) -> None:
 def _dispatch_goal(args: argparse.Namespace) -> dict[str, Any] | str:
     record = read_json_object(Path(args.record), label="goal record")
     if args.goal_command == "check":
-        state = read_json_object(Path(args.state), label="workflow state") if args.state else None
+        state = load_state(Path(args.state)) if args.state else None
         return validate_goal_record(record, state=state, require_current=args.current)
     if args.goal_command == "summarize":
-        state = read_json_object(Path(args.state), label="workflow state")
+        state = load_state(Path(args.state))
         profile = read_json_object(Path(args.profile), label="context profile") if args.profile else None
         return build_objective_snapshot(record, state, profile=profile, window=args.target_window)
     if args.goal_command == "view":
@@ -427,7 +428,7 @@ def _dispatch_goal(args: argparse.Namespace) -> dict[str, Any] | str:
             return render_goal_view_terminal(payload)
         return payload
     if args.goal_command == "update":
-        state = read_json_object(Path(args.state), label="workflow state")
+        state = load_state(Path(args.state))
         updated = update_goal_record(
             record,
             state,

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/dispatch_planning.py

@@ -56,6 +56,7 @@ from agent_lifecycle.workflow.artifact_builders import (
     inspect_artifact,
 )
 from agent_lifecycle.workflow.artifacts import build_finding_check_evidence_artifact
+from agent_lifecycle.workflow.state import load_state
 
 
 def dispatch_planning(args: argparse.Namespace) -> dict[str, Any]:
@@ -83,7 +84,7 @@ def _dispatch_specification(args: argparse.Namespace) -> dict[str, Any]:
     if args.specification_command == "completion-gate":
         gate_input = read_json_object(Path(args.input), label="completion gate input") if args.input else {}
         payload = build_completion_gate_receipt(
-            state=read_json_object(Path(args.state), label="workflow state"),
+            state=load_state(Path(args.state)),
             final_audit=read_json_object(Path(args.final_audit), label="final audit") if args.final_audit else None,
             follow_up_register=(
                 read_json_object(Path(args.follow_up_register), label="follow-up register")

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/followup.py

@@ -15,6 +15,7 @@ from agent_lifecycle.followup import (
     validate_followup_register,
     write_followup_register,
 )
+from agent_lifecycle.workflow.state import load_state
 
 
 def add_followup_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
@@ -49,7 +50,7 @@ def dispatch_followup(args: argparse.Namespace) -> dict[str, Any]:
     register_path = Path(args.register)
     register = load_followup_register(register_path)
     if args.followup_command == "check":
-        state = read_json_object(Path(args.state), label="workflow state") if args.state else None
+        state = load_state(Path(args.state)) if args.state else None
         validation = validate_followup_register(register, state=state, root=Path(args.root))
         if args.fail_on_finalization_blockers and validation["finalizationBlockers"]:
             raise LifecycleError(
@@ -83,7 +84,7 @@ def dispatch_followup(args: argparse.Namespace) -> dict[str, Any]:
             "registerDigest": validation["registerDigest"],
         }
     if args.followup_command == "sweep":
-        state = read_json_object(Path(args.state), label="workflow state") if args.state else None
+        state = load_state(Path(args.state)) if args.state else None
         profile = read_json_object(Path(args.profile), label="context profile") if args.profile else None
         return build_followup_summary(register, state=state, profile=profile, window=args.target_window)
     raise LifecycleError("command-not-implemented", "followup command is not implemented")

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/lifecycle_parsers.py

@@ -261,6 +261,11 @@ def _add_workflow_state_parsers(
     workflow_migrate.add_argument("--operation-id", required=True)
     workflow_migrate.add_argument("--expected-revision", required=True, type=int)
     workflow_migrate.add_argument("--source-revision", required=True)
+    workflow_migrate.add_argument(
+        "--target-schema",
+        choices=["agent-workflow-state.v4", "agent-workflow-state.v5"],
+        default="agent-workflow-state.v4",
+    )
     workflow_legacy = workflow_sub.add_parser(
         "migrate-runner-artifact",
         help="convert one legacy runner artifact into a non-authoritative archival record",
@@ -319,6 +324,13 @@ def _add_workflow_control_parsers(
     workflow_authorize.add_argument("--source-revision", required=True)
     workflow_authorize.add_argument("--receipt", required=True)
     workflow_authorize.add_argument("--reason", required=True)
+    workflow_renew = workflow_sub.add_parser("authorization-renew")
+    workflow_renew.add_argument("--state", required=True)
+    workflow_renew.add_argument("--operation-id", required=True)
+    workflow_renew.add_argument("--expected-revision", required=True, type=int)
+    workflow_renew.add_argument("--source-revision", required=True)
+    workflow_renew.add_argument("--receipt", required=True)
+    workflow_renew.add_argument("--reason", required=True)
     workflow_external_pause = workflow_sub.add_parser("external-pause", aliases=["pause-external"])
     workflow_external_pause.add_argument("--state", required=True)
     workflow_external_pause.add_argument("--operation-id", required=True)

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/strategy.py

@@ -12,6 +12,7 @@ from agent_lifecycle.contracts import LifecycleError, read_json_object, write_js
 from agent_lifecycle.policy.execution_strategy import resolve_execution_strategy
 from agent_lifecycle.workflow.artifacts import package_root
 from agent_lifecycle.workflow.selectors import find_task
+from agent_lifecycle.workflow.state import load_state
 
 
 def dispatch_strategy(args: argparse.Namespace) -> dict[str, Any]:
@@ -21,7 +22,7 @@ def dispatch_strategy(args: argparse.Namespace) -> dict[str, Any]:
         args.adapter,
         Path(args.descriptor) if args.descriptor else None,
     )
-    state = read_json_object(Path(args.state), label="workflow state")
+    state = load_state(Path(args.state))
     manifest = read_json_object(Path(args.manifest), label="frozen plan manifest")
     root = package_root(Path(args.state), state)
     payload = resolve_execution_strategy(

{agent_lifecycle_kit-2.29.0 → agent_lifecycle_kit-2.31.0}/src/agent_lifecycle/cli/worktree.py

@@ -7,6 +7,7 @@ from pathlib import Path
 from typing import Any
 
 from agent_lifecycle.contracts import read_json_object, write_json_create
+from agent_lifecycle.workflow.state import load_state
 from agent_lifecycle.worktree import (
     build_attempt_isolation_receipt,
     validate_attempt_isolation_receipt,
@@ -43,7 +44,7 @@ def dispatch_worktree(args: argparse.Namespace) -> dict[str, Any]:
     if args.worktree_command == "policy-check":
         return validate_worktree_policy(read_json_object(Path(args.policy), label="worktree policy"))
     if args.worktree_command == "receipt":
-        state = read_json_object(Path(args.state), label="workflow state")
+        state = load_state(Path(args.state))
         policy = read_json_object(Path(args.policy), label="worktree policy")
         authorization = (
             read_json_object(Path(args.operator_authorization), label="operator authorization")
@@ -68,7 +69,7 @@ def dispatch_worktree(args: argparse.Namespace) -> dict[str, Any]:
         return receipt
     if args.worktree_command == "check":
         receipt = read_json_object(Path(args.receipt), label="worktree receipt")
-        checked_state = read_json_object(Path(args.state), label="workflow state") if args.state else None
+        checked_state = load_state(Path(args.state)) if args.state else None
         checked_policy = read_json_object(Path(args.policy), label="worktree policy") if args.policy else None
         return validate_attempt_isolation_receipt(receipt, workflow_state=checked_state, policy=checked_policy)
     raise AssertionError("unreachable worktree command")