Least-privilege tools per task plus an LLM-as-judge inside the executor is a strong pairing, you bound what each step can touch and score its output before it counts as done. The recovery detail, resetting IN_PROGRESS to PENDING on restart, is what people skip until a crash mid-task wedges the whole plan. For the judge, is it scoring each task against the plan's stated intent, and can a failed score reopen the task or does it only flag for the human A/M/R loop?