Manager types a goal. Returns risk lane + proposed criteria for confirmation. May escalate immediately (too risky / can't define done).

Manager confirms the criteria, optionally REPLACING them with the project's real checks, then returns the kickoff prompt.

If edited_criteria is given it becomes the authoritative final list. Each item is {id?, text, oracle_type, oracle} where oracle_type is "command" (a shell command that exits 0 on success), "browser" (a flow the agent proves), or "manual". An item whose id matches a proposed criterion patches it (and re-arms it for checking); any other item is added new. This is how you point a criterion at YOUR stack — e.g. {"text":"build passes","oracle_type":"command", "oracle":"cargo build"}. Returns {error, details} if a criterion is malformed.

Agent calls this each turn. Enforces pacing + caps. Returns the goal and what still fails (NOT a prescribed step), or STOP / ESCALATE / DONE.

Agent reports what it did. Runs the verifier. Returns FAIL+failing (with the re-injected standing order) or DONE. proof maps criterion_id -> artifact path for browser/manual criteria.

Explicit verifier call. Same authority as report_result's check — DONE only comes from here. When it goes green on a git project, a merge gate is raised.

Agent asks permission for an irreversible action (deploy/migrate/delete/send). Sets a pending gate the manager approves on the dashboard.