Plan: decision-safe context and resumable agent execution #1357

Outcome

Make project management = context management operationally testable: an agent receives the smallest authorized, current, evidence-complete working set, makes the right next decision, and resumes interrupted work without repeating effects.

This is a planning umbrella. No implementation or new defect reproduction is claimed. Public SDK primitives own semantics; CLI, MCP and package adapters stay thin.

Existing foundations to reuse

• Adaptive context engine pm-4k6b, context evaluation pm-atfm, and caller-carried output sessions pm-hid9g1
• Complete-result and omission contracts in feat(sdk): unify context reads and remediation governance #947 and SDK context safety, recovery contracts, and assurance providers #1035; exact delivery feedback and source fingerprints in feat: substantive context signals and exact delivery feedback #1176
• Temporal replay/domain exemplar in feat(sdk): temporal digital-twin context engine #656; existing schema/custom fields, evidence, history and typed supersedes relationships
• Existing claims, Plans, handoff/context and durable MCP task mechanisms; concurrency pm-dj98 and fleet outcome pm-z1kr34
• SDK output token accounting and tokens-per-task release gates #863 already delivers tokens-per-completed-task accounting. Extend its decision coverage rather than building a second meter
• Agent UX: a claim held by an agent that has died blocks everyone until --force; the refusal hides the claim's age and there is no stale takeover #1336 remains an open report with canonical stale-claim owner pm-szv11n. Agent safety: an unsupported --dry-run makes the recovery bundle suggest the real mutation (close, update, claim) #1337 is still open, but merged Fix duplicate identity scoring and agent recovery contracts #1341 already fixes stripped preview retries; preserve that fix and do not refile it as a current reproduced bug

Delivery workstreams

1. SDK: reconcile typed temporal knowledge and invalidate dependent context #1358 — Typed temporal knowledge reconciliation and dependency invalidation
2. SDK: compile context with semantic coverage and coherent snapshot receipts #1361 — Cross-provider semantic context coverage and coherent read receipts
3. SDK: resume execution checkpoints under fenced claim generations #1359 — Durable execution checkpoints with claim-generation fencing
4. SDK: separate context identity, visibility and authority across selection and recovery #1360 — Separate knowledge identity, visibility and action authority; scope-before-ranking and effect-preserving recovery
5. Eval: gate downstream decisions, abstention and task success per token #1362 — Decision-level scenario evaluation and success-per-token gates

Lightweight-default design constraint

All workstreams must follow #1363: keep the generic core lightweight, make advanced capabilities opt-in, and expose additional information through truthful progressive discovery. Required constraints, blockers, authority boundaries and insufficient-context outcomes must remain visible at the decision point. Git, coding, tests, claims and richer context/execution contracts must not become unconditional prerequisites for a simple task.

#1363 documents the capability-policy and migration plan, capability-aware guidance/help, and a six-task × two-approach × three-run total-agent-effort comparison extending #1362 and existing token accounting. Its reproduced baseline observations are distinguished from proposed implementation. The five children above remain planning work.

Implementation sequence

1. Inventory the actual SDK exports, provider contracts and canonical PM owners at implementation time. Reuse existing owners for shipped/overlapping slices; only assign residual acceptance work.
2. Agree versioned knowledge, coverage, checkpoint and policy contracts together. Names suggested in children are illustrative, not promised APIs.
3. Implement pure deterministic SDK kernels, then storage/provider integration and thin CLI/MCP adapters. Capture dependency fingerprints before optimizing incremental reads.
4. Define scenario fixtures and negative controls at the outset. Wire each workstream's executable acceptance into the existing eval/assurance pipeline.
5. Verify packed Node/Bun SDK consumers and CLI/MCP parity; document migration, recovery and explicit consistency limits.

Cross-cutting acceptance

• All five workstreams have named residual scope, linked existing ownership, tests and implementation documentation
• Existing schemas remain readable; no silent promotion of old prose to verified truth, granted authority, or completed execution
• Mandatory context omissions produce an explicit insufficient-context outcome; token savings cannot conceal lost decision evidence
• Authorization precedes provider access/ranking; identity, visibility and action permission remain independent
• Resume either verifies prior effects or returns an explicit unknown/blocked state; stale owners cannot commit after takeover
• Decision correctness, abstention, effect safety, actual delivered token cost and latency are measured together
• Existing quality/security/coverage/token ratchets remain intact; new gates include executable negative controls and non-vacuous denominators

Non-goals

No replacement project-management database, parallel session-budget ledger, separate retrieval harness, new identity provider, mandatory central server, automatic truth resolution from recency alone, or promise of exactly-once external effects.

Deduplication evidence

Reviewed open and closed GitHub issue/PR search results and public canonical PM records on 2026-09-30. Existing umbrella programs cover broad goals; these children are bounded implementation slices for the additional contracts and their acceptance evidence. If implementation-time inventory proves a slice already complete, attach exact evidence and narrow or close that slice rather than implementing it again.