chat-objective-continuity

Chat Objective Continuity

Use one explicitly configured logical-chat ledger to keep the current source, objective contract, open outcomes, pending or unknown effects, and next eligible work available without creating a second user-visible task.

Required behavior

1. Bind the ledger to an explicit namespace and logical chat ID. Use scripts/ledger_input.py owner-view to resolve the canonical ledger and inherited host binding before adopting an objective path. REFERENCE_ONLY permits reference reading, not source-update apply. Do not copy another task’s objective into cwd or create a project-local replacement. The primary owner updates its own ledger; a prohibition on editing another task is not a prohibition on its own update. In the common hook route, use the exact host session_id as a new chat's default logical ID; use an explicit binding only for a reviewed same-chat migration or exclusion. Do not derive identity from chat title, model, working directory, repository, or prompt text.
2. Create a chat ledger and objective.txt on its first effective prompt, then verify and reuse the journal-derived projection for the same logical ID. On every actual user update, first compare the latest message and pending exact sources with the existing contract, classify or explicitly dispose them, and reread the updated projection before choosing new material work. Reading the old card is only retrieval for reconciliation; it never makes old advice outrank the latest user message. Do not postpone this update until after work or edit the generated text directly. Preserve existing open outcomes, constraints and pending effects. SessionStart, resume, and compact before the first prompt create nothing. After resume/compaction the same pending-source reconciliation comes before relying on task advice. Pre/PostCompact remain structural readback routes.
3. Capture a host prompt as an immutable source reference with origin HOST_USER_PROMPT_SESSION_BOUND_UNVERIFIED_ACTOR and state UNCLASSIFIED. Because ordinary hook events expose the parent session ID to subagents without an actor ID, capture is not semantic authority. The root owner classifies the actual current user source as INITIAL / ADD / CLARIFY / CORRECT / REPLACE / WITHDRAW. Never infer semantics from keywords or let an internal continuation create user authority. Dispose an owner-reviewed internal, child, irrelevant, non-user, or already-incorporated duplicate capture through the non-authority event; preserve its raw bytes and review links without changing the contract.
4. Change objective semantics only with classify-source. Bind every clause to an exact source event/ref/hash. On ADD / CLARIFY / CORRECT, inherit every omitted supported normative field; a changed field requires an explicit same-disposition transition bound to clauses from the current source. Never blindly inherit on REPLACE / WITHDRAW. A progress event binds the exact current contract and may update existing outcome state, merge evidence, blockers, and next work, but it must not introduce, retire, reopen, or rewrite objective semantics. Every contract transition disposes prior contract-bound next-work advice. Source-backed retirement/reopen/correction uses explicit transition and lineage fields; a corrected meaning gets a new semantic ID.
5. After source reconciliation, record a new material action before execution and record one immutable SUCCEEDED / FAILED / CANCELLED / UNKNOWN_EFFECT result afterward with explicit effect state. The runtime rejects a new action-start while an unclassified source or dependent source-recovery frontier remains. Source reads, classification/disposal/recovery and existing action outcomes/reconciliation remain available; this is not interception of every tool or a reason to lose in-flight effects. A retry gets a new linked action ID and never clears the first attempt's unknown effect. Reconcile unknown effects only through distinct evidence-linked reconciliation events that preserve first-fault history.
6. Before a finalized action, use the ledger preflight only for the exact configured tool class and explicit dependency IDs. Hold a configured mutation for a known unclassified user source or its named pending/unknown dependency. Allow independent read-only work. Treat mixed and unknown tools as outside this control's protection rather than blanket-blocking them.
7. The owner alone makes semantic, progress, and action-state writes. SessionStart/compact/Stop are readback routes. A separately identified configured subagent session writes nothing; a child sharing the parent session may be indistinguishable, so even a prompt capture stays unclassified and cannot corrupt the current objective contract. Preserve that trust gap and do not claim parent-only host enforcement.
8. Keep the journal authoritative. Under the same identity-bound lock, replay current state and validate the complete proposed transition before appending it; a rejection leaves the semantic journal/head unchanged and receives separate bounded evidence. Publish complete lock-owner bytes atomically. Preserve event/head/effect identity through lock cleanup; if cleanup also fails, retain the initiating append/projection fault and the separate cleanup fault. Recover a lock only with its exact hash and conservative proof that the owner is dead; never evict live or unknown ownership. On read, validate sequence and hash lineage, preserve an incomplete final line separately before truncating it, and atomically rebuild the current projection.
9. Reopen every dependent source/ref/hash before source or contract consumption. Missing or modified source bytes leave the dependent claim unproven and hold only the dependent mutation; unrelated read-only work remains available. Keep identity-bound capture gaps in the same recovery/projection frontier until source recovery matches the recorded exact SHA-256 and byte count, or an explicit owner disposition closes it; revalidate source recovery on replay and never attach an unbound gap by inference. Before a projection exists, compact context points first to the real durable gap location; afterward it points first to objective.txt. Keep hook/CLI JSON output lossless ASCII, exact sources UTF-8, and compact recovery context within its configured bound.
10. Use the human projection for current policy, constraints, prohibitions, unresolved outcomes/effects, gaps and current-contract next work. Follow its pointers to current.json and journal.jsonl for complete machine/history state; do not reintroduce the whole machine snapshot into the repeatedly read human file.
11. When source-wide implementation applies, bind the existing progress evidence and next eligible work to its one current work-definition scope/state reference and name remaining whole-scope implementation/connections and phase. Reuse this reference after prompts, completed work items, resume and compaction; do not copy the entire matrix or accumulate a second scope history in the human projection. A child's completed artifact must not mark the parent scope complete. The ledger's projection is not the phase selector and cannot certify semantic coverage; the owner consumes the shared selector through the existing lifecycle/control/transition route.