space-architect 6.0.0 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa2517580f1eefb1906810b2a2d1e2500814e9042a812c5aa8a6ccc7474f0067
-  data.tar.gz: 66259d63c107e8fe76dc8036766015170ce2d1a0c4ac4d0e617d2b4fed5811fd
+  metadata.gz: 1d521b0afec00484bfba5b35e26e9f0a603807fb75f3569fa61b0a0b5ff9b3ab
+  data.tar.gz: d21ecd2d8dd8458b0ec2e89d4cc2ee45a5a70eafc53955b8d2b3c365b55efe3b
 SHA512:
-  metadata.gz: d2ca2365a338b78284e80573a137ddb0b79fdd10147d03c59f2b01aad7a8e8482899630545673f72f86d3abab075fb8fb9e76eeabf23ebe019f12c0bce1a6aaa
-  data.tar.gz: 2e1df0a9c9ea9b9ba162420120872d4671e031a712fb08d9995caa4a6e49fd3d50526ec8cc7cd8fc5acf463bb8b454632c99a6dfa51440182cadc24a27a26e87
+  metadata.gz: e27a4154359d6f41370287eb86eeb2881d415dd0ce7e5d6c3c3f241ff338f168a7393456d63faa5e3970e3a72eb927ae4db13d4f407e50e320d90ed54c79dc7e
+  data.tar.gz: 024047dcd39a0de008284fc256c3f7fb08ea8585e0cd0cae53f0e990b70f9e47341325cf92668ef632bf76ef2e34e5d082ccd98eba94af52c4f659c251afd9f8

data/CHANGELOG.md

@@ -5,6 +5,89 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.0.0] - 2026-08-14
+
+Three iterations of the Architect Loop run against this repo's own tooling, each
+frozen before dispatch and judged by a separate session against criteria written
+before results existed. Major because three destructive verbs gain a refusal they
+did not have, and `provision`'s per-lane return changes shape — see the
+**BREAKING** items under Changed.
+
+Every defect closed here is the same animal: a **confident, wrong artifact**. An
+operation that destroys a completed builder run and exits 0 reporting success. A
+value the tool resolves correctly and then declines to use. A lane denied the tool
+it needed, which does not crash and instead files a well-formatted, dataless
+report. The through-line is that none of them announced itself — which is why the
+fixes are as much about making the resolved value *visible* as about resolving it.
+Suite: 1297 → 1344 runs, 5148 → 5373 assertions, green throughout.
+
+### Added
+
+- **`--allowed-tools` / `--append-allowed-tools` on `architect dispatch`, and
+  `allowed_tools:` / `append_allowed_tools:` on the frozen lane declaration
+  (#89).** `ClaudeCodeHarness::ALLOWED_TOOLS` was a defaulted keyword that
+  `Harness.for` never accepted and no caller could pass, so no dispatched lane
+  could be granted an MCP tool. Because `claude -p` **denies** an unlisted tool
+  rather than prompting, the lane did not fail — it reasoned its way to "I was
+  unable to query the datasource" and wrote a plausible empty report. Replace and
+  append compose as one rule regardless of which surface supplied them
+  (`ClaudeCodeHarness.resolve_tools`); the CLI flag wins over the lane key **on
+  the same axis**, so a lane's `allowed_tools:` still supplies the base a
+  `--append-allowed-tools` flag appends to. The yaml half lives in the frozen lane
+  declaration so a grant is reviewable and judged like every other lane boundary
+  rather than buried in a shell invocation, and it survives worktree
+  re-materialization by the same mechanism `touch_set` already uses.
+- **The resolved grant is recorded and surfaced.** Stamped onto the lane beside
+  `harness`/`model`/`effort`, printed at dispatch with its provenance (which
+  surface won), and shown in `architect status`'s lane line when it diverges from
+  the default. A denial now traces back to a grant a human can read. An MCP
+  *reachability* probe is deliberately not in this release: there is no MCP
+  modelling anywhere in the codebase, and a prober is a subsystem, not a rider on
+  a plumbing fix.
+
+### Changed
+
+- **BREAKING — `architect worktree remove`, `architect integrate --teardown`, and
+  `architect provision --base` refuse to discard a lane worktree's uncommitted
+  work.** The existing safety checks asked whether work had been *committed*, in a
+  system whose hard rule 7 guarantees lane work is **never** committed — so all
+  three destroyed completed builder runs and exited 0 reporting success. One
+  predicate (`dirty_file_count`, untracked files included) now guards all three
+  sites. `--force` overrides and discards, restoring the old behavior exactly. A
+  script that tore down dirty lanes will now exit non-zero.
+- **BREAKING — the multi-lane verbs decide their refusal before mutating
+  anything.** `integrate --teardown` and `provision --base` pre-flight the whole
+  declared lane set (`refuse_teardown_if_dirty!`, `refuse_repoint_if_dirty!`), so a
+  dirty lane discovered late no longer leaves earlier lanes already destroyed. The
+  refusal names every offending lane at once instead of failing on the first.
+- **BREAKING — `provision`'s per-lane return is now `outcome:`**
+  (`:created` / `:unchanged` / `:repointed`) plus `discarded:`, replacing the
+  boolean `created:`. The boolean could not express the re-point path that #88's
+  fix introduces.
+- **`worktree add`, `worktree list`, and `worktree remove` accept an optional
+  trailing `SPACE` argument**, like every other space-scoped verb. `worktree
+  remove` previously had no way to name its space and resolved from `$PWD` — a
+  destructive verb that could fire against the wrong space entirely.
+- **Long-running lane guidance in `skill/architect/dispatch.md` (#85).** The lane
+  template's no-busy-wait clause beat every attempt to hold a 30–70 minute detached
+  process open, killing exactly the lanes it was least safe to kill.
+
+### Fixed
+
+- **`architect provision --base` was resolved and then discarded on the re-attach
+  path (#88).** `worktree_add` computed `base_sha` from `--base`, ignored it when
+  the lane branch already existed, and recorded it anyway — so `space.yaml` claimed
+  a base the worktree was never pointed at. An operator-supplied `--base` is now
+  enforced (re-point, or refuse when that would discard work); an internal
+  re-materialization still reattaches at whatever is there, never refusing and never
+  moving a branch nobody asked to move.
+- **`architect rehearse` refused every cross-repo iteration (#90).** It resolved one
+  repo for the whole iteration and raised when the drafted lanes named more than
+  one, even though `execute_gates` could already resolve a run dir per gate. Gates
+  carrying their own `cwd` now rehearse in their own declared directory regardless
+  of how many repos the iteration spans; the refusal survives only for gates that
+  genuinely need a default, and it names them.
+
 ## [6.0.0] - 2026-08-03
 
 Twelve iterations of the Architect Loop run against this repo's own tooling, each

data/lib/space_architect/architect_project.rb

@@ -241,6 +241,13 @@ module Space::Architect
           lanes = s["lanes"] || []
           declared.each do |d|
             fields = { "name" => d["name"], "repo" => d["repo"], "touch_set" => Array(d["touch"]) }
+            # #89/AC3-AC4: the frozen lane's own tool grant, reviewable like every other
+            # boundary. Declared-only, like touch_set — worktree_add never touches these
+            # keys, so a re-materialize preserves them without threading them through
+            # recorded_lane_fields (unlike harness/model, which worktree_add resolves and
+            # overwrites on every call).
+            fields["allowed_tools"]        = d["allowed_tools"]        if d["allowed_tools"]
+            fields["append_allowed_tools"] = d["append_allowed_tools"] if d["append_allowed_tools"]
             existing = lanes.find { |l| l["name"] == d["name"] }
             existing ? existing.merge!(fields) : lanes << fields
           end
@@ -510,9 +517,10 @@ module Space::Architect
     # here, by pathspec, so which lanes merged survives independently of whether a
     # Verdict follows (I13/A3). Always attempted, success or raise, so a conflict that
     # stops the loop midway doesn't lose the lanes already merged.
-    def integrate!(iteration, lanes: nil, teardown: false, message: nil, commit_mode: nil, into: nil, accept_bounds_reason: nil)
+    def integrate!(iteration, lanes: nil, teardown: false, message: nil, commit_mode: nil, into: nil,
+                   accept_bounds_reason: nil, force: false)
       lanes = Array(lanes)
-      return teardown_lanes!(iteration, slice_entry(iteration)["lanes"] || []) if lanes.empty? && teardown
+      return teardown_lanes!(iteration, slice_entry(iteration)["lanes"] || [], force: force) if lanes.empty? && teardown
       raise Space::Core::Error, "No lanes given to integrate" if lanes.empty?
 
       merged = []
@@ -524,7 +532,7 @@ module Space::Architect
         raise Space::Core::Error, "Integrated #{done.empty? ? "(none)" : done} then stopped at '#{lane}': #{e.message}"
       end
 
-      teardown_lanes!(iteration, merged) if teardown
+      teardown_lanes!(iteration, merged, force: force) if teardown
       merged
     ensure
       commit_metadata_mutation!(iteration, message: message)
@@ -591,12 +599,12 @@ module Space::Architect
         if gates.empty?
           [nil, nil, [], nil]
         else
-          r   = resolve_rehearsal_repo(iteration, text)
-          dir = space.path.join("repos", r)
-          raise Space::Core::Error, "directory does not exist: #{dir}" unless dir.exist?
+          r   = resolve_rehearsal_repo(iteration, text, gates)
+          dir = r ? space.path.join("repos", r) : nil
+          raise Space::Core::Error, "directory does not exist: #{dir}" if dir && !dir.exist?
           results = execute_gates(gates, base_dir: dir, lane: nil, repo_root: nil)
                     .map { |g| g.merge(rehearsal: classify_rehearsal(g)) }
-          [r, dir, results, scope_asymmetry_report(gates, text, dir)]
+          [r, dir, results, scope_asymmetry_report(results, text)]
         end
 
       digest = gates_digest(text)
@@ -688,8 +696,15 @@ module Space::Architect
       repos.map { |r| sync_one_repo(r["name"]) }
     end
 
-    def worktree_add(repo, iteration, lane, base: nil, harness: nil, model: nil, variant: false,
-                     effort: nil, touch: nil, force: false, err: $stderr)
+    # base_explicit distinguishes an operator-given --base (enforce it — refuse or
+    # re-point per #88's three cases) from an auto-materializing call (just attach
+    # whatever's there, never refuse, never move a branch nobody asked to move).
+    # Defaults from whether base: itself was given, which is exactly right for a
+    # direct `worktree_add`/CLI `worktree add --base` call; ensure_lane_materialized
+    # always resolves SOME base internally (it has to, to create a lane from
+    # scratch), so it overrides this explicitly to false.
+    def worktree_add(repo, iteration, lane, base: nil, base_explicit: !base.nil?, harness: nil, model: nil,
+                     variant: false, effort: nil, touch: nil, force: false, err: $stderr)
       model, suffix_level = Harness.parse_model_suffix(model)
       harness, model = resolve_harness_model(harness, model)
       resolved_level = effort || suffix_level || project_defaults["effort"]
@@ -712,6 +727,7 @@ module Space::Architect
       base_sha = base_sha.strip
 
       branch = "lane/#{id}-#{lane}"
+      recorded_base = (entry["lanes"] || []).find { |l| l["name"] == lane }&.dig("base_sha")
 
       # Guard: an existing directory that is not a registered worktree is ambiguous.
       if wt_path.exist? && !worktree_registered?(repo_path, wt_path)
@@ -724,16 +740,8 @@ module Space::Architect
         end
       end
 
-      # Skip git worktree add when the branch and worktree already exist (idempotent re-run).
-      unless branch_exists?(repo_path, branch) && worktree_registered?(repo_path, wt_path)
-        if branch_exists?(repo_path, branch)
-          # The worktree was removed but its lane branch survived — re-attach the branch
-          # (carrying its own tip) instead of `-b`, which would fail "branch already exists".
-          git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
-        else
-          git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, "-b", branch, base_sha)
-        end
-      end
+      outcome, base_sha, discarded = attach_lane_branch!(repo_path, wt_path, branch, base_ref, base_sha, recorded_base,
+                                              base_explicit: base_explicit, force: force)
 
       new_fields = {
         "name" => lane,
@@ -763,7 +771,7 @@ module Space::Architect
         b
       end
 
-      { worktree: wt_path, base_sha: base_sha }
+      { worktree: wt_path, base_sha: base_sha, outcome: outcome, discarded: discarded }
     end
 
     # Declare a variant set for an iteration: one competing lane per (harness, model) pair,
@@ -842,7 +850,13 @@ module Space::Architect
       }
     end
 
-    def worktree_remove(iteration, lane)
+    # #88 (smaller, same area): a removed worktree does not touch its lane branch —
+    # remove-then-provision re-points that surviving branch (or refuses if it has
+    # its own commits), it is not a reset. Names it in the return so a human
+    # reading `worktree remove`'s output isn't misled into thinking it is.
+    # Never deletes the branch itself: that would discard lane work with no
+    # confirmation.
+    def worktree_remove(iteration, lane, force: false)
       entry = slice_entry(iteration)
       lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
       raise Space::Core::Error, "No lane '#{lane}' recorded for iteration '#{iteration}'" unless lane_entry
@@ -855,6 +869,16 @@ module Space::Architect
         space.path.join("build", "#{iteration_id(entry)}-#{lane}", "wt")
       end
 
+      branch = worktree_branch(repo_path, wt_path) || "lane/#{iteration_id(entry)}-#{lane}"
+
+      dirty = dirty_file_count(repo_path, wt_path)
+      if dirty && !force
+        raise Space::Core::Error,
+          "Refusing to remove lane '#{lane}' worktree — #{dirty} uncommitted change(s) (untracked files " \
+          "included) would be discarded. Integrate the lane first, or re-run with --force to discard them " \
+          "and remove it."
+      end
+
       git_run("-C", repo_path.to_s, "worktree", "remove", "--force", wt_path.to_s)
       git_run("-C", repo_path.to_s, "worktree", "prune")
 
@@ -865,6 +889,8 @@ module Space::Architect
         end
         b
       end
+
+      { lane: lane, branch: branch, branch_survives: branch_exists?(repo_path, branch), discarded: dirty }
     end
 
     def worktree_list
@@ -875,9 +901,13 @@ module Space::Architect
 
     # Materialize the iteration's declared lanes: for each lane (or the one named via
     # `lane:`), create its worktree + lane/<id>-<lane> branch from the resolved base and
-    # record worktree/base_sha/integration_branch. Idempotent — an already-materialized
-    # lane is skipped, not re-created. Refuses until the iteration is frozen, because
-    # declarations are not authoritative until then.
+    # record worktree/base_sha/integration_branch. Idempotent — a bare re-run (no
+    # explicit --base) over an already-materialized lane changes nothing. An explicit
+    # --base is always enforced, even against an already-materialized lane (#88's
+    # "blind spot" — a short-circuit that trusted the recorded state without checking
+    # it against what was actually asked for). Refuses until the iteration is frozen,
+    # because declarations are not authoritative until then. outcome on each result is
+    # :created / :unchanged / :repointed (#88/AC4 — tellable apart by a human reader).
     def provision(iteration, base: nil, lane: nil, force: false)
       entry = slice_entry(iteration)
       raise Space::Core::Error,
@@ -888,17 +918,15 @@ module Space::Architect
       lanes = lanes.select { |l| l["name"] == lane } if lane
       raise Space::Core::Error, "No lane '#{lane}' declared for iteration '#{iteration}'" if lane && lanes.empty?
 
+      base_explicit = !base.nil?
+      refuse_repoint_if_dirty!(iteration, lanes, base, iteration_id(entry)) if base_explicit && !force
+
       lanes.map do |l|
         name = l["name"]
-        repo_path = space.path.join("repos", l["repo"])
-        wt_path = space.path.join(l["worktree"] || "build/#{iteration_id(entry)}-#{name}/wt")
-        if wt_path.exist? && worktree_registered?(repo_path, wt_path)
-          { lane: name, worktree: wt_path, base_sha: l["base_sha"], created: false }
-        else
-          result = worktree_add(l["repo"], iteration, name, base: resolve_lane_base(l["repo"], base),
-                                force: force, **recorded_lane_fields(l))
-          { lane: name, worktree: result[:worktree], base_sha: result[:base_sha], created: true }
-        end
+        result = worktree_add(l["repo"], iteration, name, base: resolve_lane_base(l["repo"], base),
+                              base_explicit: base_explicit, force: force, **recorded_lane_fields(l))
+        { lane: name, worktree: result[:worktree], base_sha: result[:base_sha], outcome: result[:outcome],
+          discarded: result[:discarded] }
       end
     end
 
@@ -911,7 +939,8 @@ module Space::Architect
     end
 
     def dispatch(iteration, lane, model: nil, max_turns: 200,
-                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil, force: false, quiet: false,
+                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil,
+                 allowed_tools: nil, append_allowed_tools: nil, force: false, quiet: false,
                  detach: false, push_url: nil, push_token: nil, push_host: nil, run_creator: nil,
                  push_client: nil, timeout: nil, prompt: nil, now: Time.now)
       raise Space::Core::Error, "Specify --push-host or --push-url, not both" if push_host && push_url
@@ -928,6 +957,9 @@ module Space::Architect
 
       resolved_harness, resolved_model, resolved_effort =
         resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
+      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
+        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
+      err.puts(tools_provenance) if replace_tools || append_tools
 
       raise Space::Core::Error, "--push-host is only supported with the claude-code harness" \
         if push_host && resolved_harness != "claude-code"
@@ -947,22 +979,29 @@ module Space::Architect
 
       bin = resolved_harness == "claude-code" ? claude_bin : opencode_bin
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns, bin: bin,
-                                                  config_dir: build_dir, effort: resolved_effort, force: force, err: err)
-
-      # Stamp launch time and the resolved harness/model/effort onto the lane entry:
-      # after every preflight validation has passed (a dispatch that raises above
-      # records nothing) and before the blocking run or a detached dispatch returns.
-      # A re-dispatch overwrites the prior values, so `architect status` always reads
-      # what actually ran on the last dispatch.
+                                                  config_dir: build_dir, effort: resolved_effort,
+                                                  allowed_tools: resolved_allowed_tools, force: force, err: err)
+
+      # Stamp launch time and the resolved harness/model/effort/allowed_tools onto the
+      # lane entry: after every preflight validation has passed (a dispatch that raises
+      # above records nothing) and before the blocking run or a detached dispatch
+      # returns. A re-dispatch overwrites the prior values, so `architect status`
+      # always reads what actually ran on the last dispatch. #89/AC8: the resolved
+      # tool grant is recorded the same way, so a denial traces back to a grant a
+      # human can read — replace_tools/append_tools are the pre-composition components
+      # (not the harness's expanded ClaudeCodeHarness.resolve_tools result), so a later
+      # bare re-dispatch re-resolves from the same components instead of compounding.
       update_architect_block do |b|
         (b["iterations"] || []).each do |s|
           next unless s["name"] == iteration
           (s["lanes"] || []).each do |l|
             next unless l["name"] == lane
-            l["dispatched_at"] = now.iso8601
-            l["harness"]       = resolved_harness
-            l["model"]         = resolved_model
-            l["effort"]        = resolved_effort if resolved_effort
+            l["dispatched_at"]         = now.iso8601
+            l["harness"]               = resolved_harness
+            l["model"]                 = resolved_model
+            l["effort"]                = resolved_effort if resolved_effort
+            l["allowed_tools"]         = replace_tools    if replace_tools
+            l["append_allowed_tools"]  = append_tools     if append_tools
           end
         end
         b
@@ -1011,7 +1050,8 @@ module Space::Architect
     # transcript lives server-side. jobs_client: is the injectable seam (mirrors
     # dispatch's run_creator:).
     def dispatch_as_job(iteration, lane, host:, token:, backend_url:, model: nil, harness: nil,
-                        max_turns: 200, effort: nil, force: false, quiet: false,
+                        max_turns: 200, effort: nil, allowed_tools: nil, append_allowed_tools: nil,
+                        force: false, quiet: false,
                         job_model: nil, api_key_ref: nil, prompt: nil, jobs_client: nil, now: Time.now)
       err = quiet ? File.open(File::NULL, "w") : $stderr
 
@@ -1026,6 +1066,12 @@ module Space::Architect
         unless resolved_harness == "claude-code"
       raise Space::Core::Error, "--job-model is required with --as-job" unless job_model
 
+      # #89: same replace/append resolution as the local dispatch path — the sandboxed
+      # executor still runs `claude -p` with harness_args server-side.
+      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
+        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
+      err.puts(tools_provenance) if replace_tools || append_tools
+
       id = iteration_id(entry)
       wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
       raise Space::Core::Error, "Worktree directory does not exist: #{wt_path}" unless wt_path.exist?
@@ -1036,7 +1082,8 @@ module Space::Architect
 
       repo_path   = space.path.join("repos", lane_entry["repo"])
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns,
-                                                  effort: resolved_effort, force: force, err: err)
+                                                  effort: resolved_effort, allowed_tools: resolved_allowed_tools,
+                                                  force: force, err: err)
 
       spec = job_spec(iteration: iteration, lane: lane, wt_path: wt_path, build_dir: build_dir,
         repo_path: repo_path, prompt_content: prompt_path.read, backend_url: backend_url,
@@ -1101,16 +1148,43 @@ module Space::Architect
     # Remove each lane's worktree and safe-delete (`-d`) its lane branch. Accepts
     # either merge_lane! results (symbol keys) or recorded lane entries (string
     # keys) — both carry a lane name and a repo.
-    def teardown_lanes!(iteration, lane_entries)
+    def teardown_lanes!(iteration, lane_entries, force: false)
       id = iteration_id(slice_entry(iteration))
+      refuse_teardown_if_dirty!(iteration, lane_entries, id) unless force
+
       lane_entries.map do |l|
         lane = l[:lane] || l["name"]
         repo = l[:repo] || l["repo"]
-        worktree_remove(iteration, lane)
+        removal = worktree_remove(iteration, lane, force: true)
         lane_branch = "lane/#{id}-#{lane}"
         git_capture("-C", space.path.join("repos", repo).to_s, "branch", "-d", lane_branch)
-        { lane: lane, repo: repo, lane_branch: lane_branch }
+        { lane: lane, repo: repo, lane_branch: lane_branch, discarded: removal[:discarded] }
+      end
+    end
+
+    # Every lane a teardown-only call would touch is checked for
+    # uncommitted work BEFORE any lane is removed — a dirty lane discovered late
+    # in the recorded set can never leave an earlier lane already torn down.
+    # Lanes reached via a merge-then-teardown call are always clean here
+    # (merge_lane! commits the worktree first), so this never fires on the
+    # normal integrate-then-teardown rhythm.
+    def refuse_teardown_if_dirty!(iteration, lane_entries, id)
+      entry = slice_entry(iteration)
+      dirty = lane_entries.filter_map do |l|
+        lane = l[:lane] || l["name"]
+        repo = l[:repo] || l["repo"]
+        recorded = (entry["lanes"] || []).find { |le| le["name"] == lane }
+        wt_path = space.path.join(recorded&.dig("worktree") || "build/#{id}-#{lane}/wt")
+        count = dirty_file_count(space.path.join("repos", repo), wt_path)
+        count ? [lane, count] : nil
       end
+      return if dirty.empty?
+
+      names = dirty.map { |n, c| "#{n} (#{c})" }.join(", ")
+      raise Space::Core::Error,
+        "Refusing to tear down '#{iteration}' — lane(s) #{names} hold uncommitted work (untracked files " \
+        "included) that would be discarded (worktree removed, branch deleted). Integrate them first, or " \
+        "re-run with --force to discard it."
     end
 
     # Resolve the in-flight iteration file for ground output.
@@ -1212,10 +1286,18 @@ module Space::Architect
       end
     end
 
-    # I09/AC4: resolve rehearsal's run repo from the DRAFTED ```lanes``` block —
-    # one repo, unambiguously declared or inferable, else a message naming what
-    # to do. Never from space.yaml (no lanes are recorded there pre-freeze).
-    def resolve_rehearsal_repo(iteration, text)
+    # I09/AC4, #90/AC5-AC6: resolve the repo to default for gates that declare no
+    # `cwd` of their own — only those gates need one, and only they are ambiguous
+    # when the drafted ```lanes``` block names more than one repo. A gate with its
+    # own `cwd` rehearses in its own declared directory regardless of how many
+    # repos are declared, so an iteration whose gates all declare `cwd` never
+    # needs a default and never reaches this method's refusals. Never resolves
+    # from space.yaml (no lanes are recorded there pre-freeze).
+    def resolve_rehearsal_repo(iteration, text, gates)
+      needing_default = gates.reject { |g| g.transform_keys(&:to_s)["cwd"] }
+      return nil if needing_default.empty?
+
+      ids = needing_default.map { |g| g.transform_keys(&:to_s)["id"] }
       declared = parse_lanes(text).filter_map { |l| l["repo"] }.uniq
       return declared.first if declared.size == 1
 
@@ -1225,13 +1307,13 @@ module Space::Architect
         raise Space::Core::Error,
           "Cannot resolve a repo to rehearse '#{iteration}' against — no lane declares a repo and the space " \
           "tracks #{tracked.size} repos (#{tracked.join(', ')}). Declare a ```lanes``` block in the " \
-          "Specification, naming the repo to rehearse against."
+          "Specification naming the repo, or give gate(s) #{ids.join(', ')} an explicit `cwd`."
       end
 
       raise Space::Core::Error,
-        "Cannot resolve a single repo to rehearse '#{iteration}' against — the drafted lanes block names " \
-        "multiple repos (#{declared.join(', ')}). Rehearsal runs once, against one repo checkout; narrow the " \
-        "```lanes``` block before rehearsing."
+        "Cannot default a repo for gate(s) #{ids.join(', ')} — the drafted lanes block names multiple repos " \
+        "(#{declared.join(', ')}) and #{ids.size == 1 ? "it declares" : "they declare"} no `cwd`. Give " \
+        "#{ids.size == 1 ? "it" : "them"} an explicit `cwd`, or narrow the ```lanes``` block to one repo."
     end
 
     # I09/AC5: RED (clean non-zero — discriminates) vs GREEN (passes on base) vs
@@ -1287,24 +1369,28 @@ module Space::Architect
     # union; parse_lanes returns [] with no ```lanes``` block, which still
     # yields the outside-every-lane half of the report. Reports only: never
     # touches rehearse's exit code, RED/GREEN/BROKEN, or the rehearsal stamp.
-    def scope_asymmetry_report(gates, text, base_dir)
+    #
+    # #90/AC7: takes the already-EXECUTED gate results, not a single base_dir —
+    # each gate's own resolved `dir` (execute_gates already computed it, per gate)
+    # is what the re-run replays against, so a cross-repo iteration is covered
+    # gate-by-gate in its own repo, and each finding names the repo it came from.
+    def scope_asymmetry_report(gate_results, text)
       touch_globs = parse_lanes(text).flat_map { |l| l["touch"] || [] }
       findings = []
       not_analyzable = []
 
-      gates.each do |gate|
-        g = gate.transform_keys(&:to_s)
-        grep_invocations(g["cmd"].to_s).each do |inv|
+      gate_results.each do |g|
+        grep_invocations(g[:cmd].to_s).each do |inv|
           if inv[:status] != :recognized
-            not_analyzable << { id: g["id"], reason: inv[:reason] }
+            not_analyzable << { id: g[:id], reason: inv[:reason] }
             next
           end
 
-          finding = scope_finding(inv, base_dir, touch_globs)
+          finding = scope_finding(inv, g[:dir], touch_globs)
           if finding
-            findings << finding.merge(id: g["id"])
+            findings << finding.merge(id: g[:id], repo: repo_name_for(g[:dir]))
           else
-            not_analyzable << { id: g["id"], reason: "whole-repo re-run failed" }
+            not_analyzable << { id: g[:id], reason: "whole-repo re-run failed" }
           end
         end
       end
@@ -1312,6 +1398,15 @@ module Space::Architect
       { findings: findings, not_analyzable: not_analyzable }
     end
 
+    # Best-effort label for a scope-asymmetry finding: the repos/<name> a gate's
+    # resolved dir sits under, or nil for a `cwd` outside repos/ entirely (legal —
+    # #test_run_gates_honors_cwd_outside_repo — just not attributable to one repo).
+    def repo_name_for(dir)
+      repos_root = space.path.join("repos")
+      return nil unless dir.to_s.start_with?("#{repos_root}/")
+      dir.relative_path_from(repos_root).to_s.split("/").first
+    end
+
     # Re-runs a recognized invocation's own pattern across the whole repo and
     # splits what it finds into: the gate's own declared scope (expected —
     # that's what the gate already searches, so it's not reported), elsewhere
@@ -1493,6 +1588,10 @@ module Space::Architect
     # identically to `provision` (same base resolution, same worktree_add primitive)
     # so no dispatch/integrate/gate path dead-ends on a missing worktree. Returns the
     # (possibly refreshed) lane entry; a no-op when already materialized or undeclared.
+    # base_explicit: false — this call never had an operator-given --base to honor, so
+    # a surviving lane branch (e.g. dispatched work, worktree since removed) is always
+    # just reattached at its own tip, never refused or re-pointed (#88 is about an
+    # explicit ask being dropped; this path never has one to drop).
     def ensure_lane_materialized(iteration, lane)
       entry = slice_entry(iteration)
       lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
@@ -1504,7 +1603,7 @@ module Space::Architect
       return lane_entry if wt_path.exist? && worktree_registered?(repo_path, wt_path)
 
       worktree_add(lane_entry["repo"], iteration, lane, base: resolve_lane_base(lane_entry["repo"], nil),
-                   **recorded_lane_fields(lane_entry))
+                   base_explicit: false, **recorded_lane_fields(lane_entry))
       (slice_entry(iteration)["lanes"] || []).find { |l| l["name"] == lane }
     end
 
@@ -1570,6 +1669,35 @@ module Space::Architect
       [resolved_harness, resolved_model, resolved_effort]
     end
 
+    # #89/AC1-AC5: resolve the claude-code --allowedTools grant for a dispatch (local or
+    # --as-job), shared so both paths resolve precedence identically. The CLI flag beats
+    # the lane's recorded allowed_tools:/append_allowed_tools: (frozen-declaration or a
+    # prior dispatch's stamp) — resolved independently for replace vs. append, so a flag
+    # on one axis and a lane value on the other both apply (Objective A). Meaningless for
+    # opencode/pi (no equivalent grant mechanism) — still resolved/recorded for visibility,
+    # but Harness.for only wires it into the claude-code branch's argv.
+    def resolve_allowed_tools(lane_entry, allowed_tools:, append_allowed_tools:)
+      replace, replace_from =
+        if allowed_tools
+          [allowed_tools, "--allowed-tools flag"]
+        elsif lane_entry["allowed_tools"]
+          [lane_entry["allowed_tools"], "lane's allowed_tools:"]
+        else
+          [nil, "default"]
+        end
+
+      append, append_from =
+        if append_allowed_tools
+          [append_allowed_tools, "--append-allowed-tools flag"]
+        elsif lane_entry["append_allowed_tools"]
+          [lane_entry["append_allowed_tools"], "lane's append_allowed_tools:"]
+        end
+
+      final = Harness::ClaudeCodeHarness.resolve_tools(replace: replace, append: append)
+      provenance = "allowed-tools: #{replace_from}#{append_from ? " + #{append_from}" : ""} → #{final}"
+      [final, replace, append, provenance]
+    end
+
     # Compose a dispatch --as-job spec per the space-server's job contract: prompt +
     # workspace.dir (the lane worktree) + environment (deps/network/mounts/env or
     # secrets) + harness (claude/backend/args) + provenance. mounts are src:dst with
@@ -2010,10 +2138,145 @@ module Space::Architect
       st.success?
     end
 
+    # Uncommitted work in a lane worktree — untracked files
+    # included. Hard rule 7 forbids builder commits, so this is the only
+    # signal an in-flight or completed-but-unintegrated lane's output ever
+    # leaves behind; "no commits on the branch" is the EXPECTED state, not
+    # evidence the worktree is empty. nil when the worktree doesn't exist,
+    # isn't a registered git worktree, or is clean; otherwise the number of
+    # changed/untracked entries `git status --porcelain` reports (a count is
+    # enough — callers never dump the whole status).
+    def dirty_file_count(repo_path, wt_path)
+      return nil unless wt_path.exist? && worktree_registered?(repo_path, wt_path)
+      out, _, st = git_capture("-C", wt_path.to_s, "status", "--porcelain")
+      return nil unless st.success?
+      count = out.each_line.count { |l| !l.strip.empty? }
+      count.zero? ? nil : count
+    end
+
+    # Would re-pointing `branch`'s worktree to base_sha actually run `git
+    # reset --hard` over uncommitted work? nil when there's nothing to lose
+    # (branch absent, worktree unregistered, already at base_sha, or clean);
+    # otherwise the #dirty_file_count that would be discarded. Read-only —
+    # used by provision's multi-lane preflight (#refuse_repoint_if_dirty!),
+    # never by the mutating path itself (attach_lane_branch! already has
+    # tip_sha in scope and calls #dirty_file_count directly).
+    def repoint_dirty_count(repo_path, wt_path, branch, base_sha)
+      return nil unless branch_exists?(repo_path, branch) && worktree_registered?(repo_path, wt_path)
+      tip_out, _, tip_st = git_capture("-C", repo_path.to_s, "rev-parse", branch)
+      tip_sha = tip_st.success? ? tip_out.strip : nil
+      return nil if tip_sha == base_sha
+      dirty_file_count(repo_path, wt_path)
+    end
+
+    # Multi-lane atomicity for provision's re-point path — every
+    # declared lane is checked for uncommitted work BEFORE any lane's
+    # worktree_add runs, so a dirty lane discovered late in the set can never
+    # leave an earlier lane already re-pointed.
+    def refuse_repoint_if_dirty!(iteration, lanes, base, id)
+      dirty = lanes.filter_map do |l|
+        repo_path = space.path.join("repos", l["repo"])
+        wt_path = space.path.join(l["worktree"] || "build/#{id}-#{l["name"]}/wt")
+        branch = "lane/#{id}-#{l["name"]}"
+        resolved, _, st = git_capture("-C", repo_path.to_s, "rev-parse", resolve_lane_base(l["repo"], base))
+        next nil unless st.success?
+        count = repoint_dirty_count(repo_path, wt_path, branch, resolved.strip)
+        count ? [l["name"], count] : nil
+      end
+      return if dirty.empty?
+
+      names = dirty.map { |n, c| "#{n} (#{c})" }.join(", ")
+      raise Space::Core::Error,
+        "Refusing to provision '#{iteration}' — re-pointing to the requested base would discard uncommitted " \
+        "work (untracked files included) in: #{names}. Dispatch or integrate the lane(s) first, or re-run " \
+        "with --force to discard it and re-point."
+    end
+
     def worktree_registered?(repo_path, wt_path)
       out, _, _ = git_capture("-C", repo_path.to_s, "worktree", "list", "--porcelain")
       real = File.exist?(wt_path.to_s) ? File.realpath(wt_path.to_s) : wt_path.to_s
       out.lines.any? { |l| l.start_with?("worktree ") && l.chomp.delete_prefix("worktree ") == real }
     end
+
+    # The branch checked out at wt_path, per `git worktree list --porcelain`
+    # (read before removal, since the entry disappears once the worktree is
+    # gone) — nil if wt_path isn't a registered worktree of repo_path at all.
+    def worktree_branch(repo_path, wt_path)
+      out, _, _ = git_capture("-C", repo_path.to_s, "worktree", "list", "--porcelain")
+      real = File.exist?(wt_path.to_s) ? File.realpath(wt_path.to_s) : wt_path.to_s
+      entry = out.split("\n\n").find { |e| e.lines.any? { |l| l.chomp == "worktree #{real}" } }
+      entry&.lines&.find { |l| l.start_with?("branch ") }&.chomp&.delete_prefix("branch refs/heads/")
+    end
+
+    # #88: attach `branch` at wt_path, choosing among the three lane-branch states
+    # the issue distinguishes — absent (create), present with no commits beyond the
+    # base it was recorded from (safe to re-point — the fast-follow case), or
+    # present with commits of its own (refuse unless force). Returns [outcome,
+    # base_sha], where base_sha is the commit the worktree actually ends up on —
+    # never the freshly-resolved one when nothing about the tree moved (the
+    # provenance half of the bug).
+    #
+    # base_explicit: false short-circuits to "just attach whatever's there" —
+    # never refuses, never re-points, and preserves the previously recorded
+    # base_sha instead of overwriting it with a base nobody asked for (see
+    # ensure_lane_materialized).
+    def attach_lane_branch!(repo_path, wt_path, branch, base_ref, base_sha, recorded_base, base_explicit:, force:)
+      unless branch_exists?(repo_path, branch)
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, "-b", branch, base_sha)
+        return [:created, base_sha, nil]
+      end
+
+      registered = worktree_registered?(repo_path, wt_path)
+      tip_out, _, tip_st = git_capture("-C", repo_path.to_s, "rev-parse", branch)
+      tip_sha = tip_st.success? ? tip_out.strip : nil
+
+      unless base_explicit
+        return [:unchanged, recorded_base || base_sha, nil] if registered
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
+        return [:created, recorded_base || tip_sha, nil]
+      end
+
+      if tip_sha == base_sha
+        return [:unchanged, base_sha, nil] if registered
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
+        return [:created, base_sha, nil]
+      end
+
+      # Hard rule 7 forbids builder commits, so an in-flight lane's
+      # entire output is uncommitted working-tree state — carries_own_commits?
+      # below can't see it (no commits to count). Checked first: it's the more
+      # common loss (partial — reset --hard spares untracked files) and the one
+      # this iteration exists to close.
+      dirty = dirty_file_count(repo_path, wt_path)
+      if dirty && !force
+        raise Space::Core::Error,
+          "Lane branch '#{branch}' worktree has #{dirty} uncommitted change(s) (untracked files included) — " \
+          "re-pointing to '#{base_ref}' (#{base_sha[0, 8]}) would run `git reset --hard` and discard them. " \
+          "Dispatch or integrate it first, or re-run with --force to discard them and re-point."
+      end
+
+      if !force && carries_own_commits?(repo_path, recorded_base, tip_sha)
+        raise Space::Core::Error,
+          "Lane branch '#{branch}' carries commits of its own — it is at #{tip_sha ? tip_sha[0, 8] : "?"}, but " \
+          "base '#{base_ref}' (#{base_sha[0, 8]}) was requested. Re-pointing would discard its commits — " \
+          "dispatch or integrate it first, or re-run with --force to discard them and re-point onto the new base."
+      end
+
+      if registered
+        git_run("-C", wt_path.to_s, "reset", "--hard", base_sha)
+      else
+        git_run("-C", repo_path.to_s, "worktree", "add", "-B", branch, wt_path.to_s, base_sha)
+      end
+      [:repointed, base_sha, dirty]
+    end
+
+    # #88/AC2-AC3: does the branch carry commits beyond the base it was recorded
+    # from? Unrecorded provenance can't be proven safe, so it counts as "carries
+    # its own" — conservative by design, not merely by omission.
+    def carries_own_commits?(repo_path, recorded_base, tip_sha)
+      return true if recorded_base.nil? || tip_sha.nil?
+      out, _, st = git_capture("-C", repo_path.to_s, "rev-list", "--count", "#{recorded_base}..#{tip_sha}")
+      !(st.success? && out.strip.to_i.zero?)
+    end
   end
 end

data/lib/space_architect/cli/architect.rb

@@ -181,7 +181,15 @@ module Space::Architect
                     h = l["harness"] || "claude-code"
                     m = l["model"]   || Harness.default_model_for(h)
                     eff = l["effort"] ? "·#{l['effort']}" : ""
-                    "#{l['name']}(#{l['repo']}·#{h}·#{m}#{eff})"
+                    # #89/AC8: the resolved tool grant, visible next to the other resolved
+                    # values — only when it diverges from the harness default, to keep the
+                    # common case (no lane touches it) uncluttered. Meaningless outside
+                    # claude-code (no equivalent grant mechanism), so shown only there.
+                    tools = if h == "claude-code"
+                      resolved = Harness::ClaudeCodeHarness.resolve_tools(replace: l["allowed_tools"], append: l["append_allowed_tools"])
+                      resolved == Harness::ClaudeCodeHarness::ALLOWED_TOOLS ? "" : "·tools:#{resolved}"
+                    end
+                    "#{l['name']}(#{l['repo']}·#{h}·#{m}#{eff}#{tools})"
                   end.join(", ")
                   lanes = lane_list.any? { |l| l["variant"] } ? "variant: #{lanes_str}" : lanes_str
                   lanes = "#{lanes} → winner: #{s['winner']}" if s["winner"]
@@ -259,7 +267,7 @@ module Space::Architect
             reason = result[:placeholder] ? "the scaffold placeholder '#{ArchitectProject::AC1_PLACEHOLDER}' with no active gate" : "no gates drafted yet"
             terminal.say "EMPTY — #{reason}. Nothing to rehearse; the pre-freeze look is still stamped."
           else
-            terminal.say "Rehearsing #{result[:iteration]} against #{terminal.path(result[:base_dir])} (repo: #{result[:repo]})"
+            terminal.say rehearsal_header(result)
             result[:gates].each { |g| render_gate(g) }
             render_scope_asymmetry(result[:scope_asymmetry])
           end
@@ -267,6 +275,17 @@ module Space::Architect
           terminal.say "Discrimination report only — this runs and reports; it never judges whether these gates are good, bad, or ready."
         end
 
+        # #90/AC7: with a single defaultable repo, name it as before; a cross-repo
+        # run (or one where every gate declares its own `cwd`) has no one repo to
+        # name — each gate's own "dir:" line (below) already says where it ran.
+        def rehearsal_header(result)
+          if result[:repo]
+            "Rehearsing #{result[:iteration]} against #{terminal.path(result[:base_dir])} (repo: #{result[:repo]})"
+          else
+            "Rehearsing #{result[:iteration]} — #{result[:gates].size} gate(s), each in its own declared cwd"
+          end
+        end
+
         def render_gate(g)
           terminal.say ""
           terminal.say "── #{g[:ac].empty? ? "(gate)" : g[:ac]}: #{g[:cmd]}  (exit #{g[:exit_code].inspect})  [#{g[:rehearsal].to_s.upcase}]"
@@ -291,7 +310,7 @@ module Space::Architect
           terminal.say ""
           terminal.say "Scope-asymmetry check (grep-family gates only):"
           report[:findings].each do |f|
-            terminal.say "── #{f[:id]}: pattern #{f[:pattern].inspect} searched #{f[:paths].join(', ')}"
+            terminal.say "── #{f[:id]} (#{f[:repo]}): pattern #{f[:pattern].inspect} searched #{f[:paths].join(', ')}"
             if f[:outside_lanes].any?
               terminal.say "   OUTSIDE ANY LANE'S TOUCH SET — no lane may legally fix these:"
               f[:outside_lanes].each { |file| terminal.say "     #{file}" }
@@ -311,9 +330,10 @@ module Space::Architect
 
           by  = result[:gates].group_by { |g| g[:rehearsal] }
           ids = ->(sym) { (by[sym] || []).map { |g| g[:id] }.join(", ") }
+          ran_against = result[:repo] ? "against `#{result[:repo]}`" : "each in its own declared `cwd`"
           [
             "> **Dry-run at rehearsal time, recorded for transparency.** All #{result[:gates].size} gate command(s) " \
-              "were executed as written against `#{result[:repo]}` under `/bin/sh` — the shell `architect gate` uses.",
+              "were executed as written #{ran_against} under `/bin/sh` — the shell `architect gate` uses.",
             ">",
             "> - **RED (#{(by[:red] || []).size} — discriminate):** #{ids.call(:red).empty? ? "(none)" : ids.call(:red)}",
             "> - **GREEN (#{(by[:green] || []).size} — regression guard or non-discriminating):** #{ids.call(:green).empty? ? "(none)" : ids.call(:green)}",
@@ -420,6 +440,8 @@ module Space::Architect
         option   :model,     default: nil,    desc: "Builder model to pin (default: the lane's stored model, else space.yaml project.model, else the per-harness sensible default). Any provider/tier; pin a full id, not a floating alias"
         option   :max_turns, default: "200",  desc: "Max turns for the builder"
         option   :harness,   default: nil,    desc: "Harness override (claude-code, opencode, pi)"
+        option   :allowed_tools,        default: nil, desc: "Comma-separated tool list — replaces the claude-code --allowedTools grant for this dispatch (default: Read,Edit,Write,Grep,Glob,Bash,WebSearch,WebFetch). The lane's frozen allowed_tools: does the same with no flag; this flag wins over that key. Meaningless for opencode/pi"
+        option   :append_allowed_tools, default: nil, desc: "Comma-separated tool list — appends to the claude-code --allowedTools grant for this dispatch (to the flag/lane replace value, or the default). The lane's frozen append_allowed_tools: does the same with no flag; this flag wins over that key. Meaningless for opencode/pi"
         option   :effort,    default: nil,    desc: "Thinking/reasoning effort level — alias for --thinking/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
         option   :thinking,  default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
         option   :reasoning, default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--thinking (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
@@ -441,6 +463,7 @@ module Space::Architect
 
         def call(iteration:, lane:, space: nil, prompt: nil, model: nil,
                  max_turns: "200", harness: nil, effort: nil, thinking: nil, reasoning: nil,
+                 allowed_tools: nil, append_allowed_tools: nil,
                  force_effort: nil, force_thinking: nil, force_reasoning: nil, quiet: false, detach: false,
                  timeout: "14400", push_url: nil, push_token: nil, push_host: nil,
                  as_job: false, host: nil, token: nil, backend_url: nil, job_model: nil, api_key_ref: nil, **opts)
@@ -467,6 +490,8 @@ module Space::Architect
                 kwargs[:model]       = model           if model
                 kwargs[:harness]     = harness         if harness
                 kwargs[:effort]      = forced_level || level if forced_level || level
+                kwargs[:allowed_tools]        = allowed_tools        if allowed_tools
+                kwargs[:append_allowed_tools] = append_allowed_tools if append_allowed_tools
                 kwargs[:force]       = true            if forced_level
                 kwargs[:quiet]       = true             if quiet
                 kwargs[:job_model]   = job_model       if job_model
@@ -482,6 +507,8 @@ module Space::Architect
                 kwargs[:model]      = model           if model
                 kwargs[:harness]    = harness         if harness
                 kwargs[:effort]     = forced_level || level if forced_level || level
+                kwargs[:allowed_tools]        = allowed_tools        if allowed_tools
+                kwargs[:append_allowed_tools] = append_allowed_tools if append_allowed_tools
                 kwargs[:force]      = true            if forced_level
                 kwargs[:quiet]      = true             if quiet
                 kwargs[:timeout]    = timeout.to_i    unless detach
@@ -536,8 +563,14 @@ module Space::Architect
                 terminal.say "No declared lanes to provision for '#{iteration}'"
               else
                 results.each do |r|
-                  state = r[:created] ? "created" : "already present"
-                  terminal.say "#{r[:lane]}: #{terminal.path(r[:worktree])} (#{state})"
+                  state = case r[:outcome]
+                  when :created   then "created"
+                  when :repointed then "re-pointed"
+                  else                 "already present"
+                  end
+                  line = "#{r[:lane]}: #{terminal.path(r[:worktree])} (#{state})"
+                  line += " — discarded #{r[:discarded]} uncommitted change(s), --force was given" if r[:discarded]
+                  terminal.say line
                 end
               end
               CLI.record_outcome(Outcome.new(exit_code: 0))
@@ -668,9 +701,10 @@ module Space::Architect
         option   :commit_mode, default: nil,    desc: "Commit mode override (strict|conductor); overrides space.yaml commit_mode for this run"
         option   :into,        required: false, desc: "Merge into this branch instead of the slug-derived project/<slug> default"
         option   :accept_bounds, default: nil,  desc: "Escape valve: override the in-bounds check for these lanes when the frozen touch-set glob is itself the defect, recording REASON in space.yaml (never overrides the no-builder-commits check)"
+        option   :force, type: :boolean, default: false, desc: "Teardown-only: discard uncommitted work in a lane worktree instead of refusing (never overrides the mechanical merge checks)"
         commit_message_options
 
-        def call(iteration:, space: nil, lanes: nil, teardown: false, message: nil, message_from: nil, commit_mode: nil, into: nil, accept_bounds: nil, **opts)
+        def call(iteration:, space: nil, lanes: nil, teardown: false, message: nil, message_from: nil, commit_mode: nil, into: nil, accept_bounds: nil, force: false, **opts)
           setup_terminal(**opts.slice(:color, :colors))
           handle_errors do
             lane_names = lanes.to_s.split(",").map(&:strip).reject(&:empty?)
@@ -681,13 +715,15 @@ module Space::Architect
               project = ArchitectProject.new(space: sp)
               results = project.integrate!(iteration, lanes: lane_names, teardown: teardown,
                 message: read_commit_message(message: message, message_from: message_from),
-                commit_mode: commit_mode, into: into, accept_bounds_reason: accept_bounds)
+                commit_mode: commit_mode, into: into, accept_bounds_reason: accept_bounds, force: force)
               if lane_names.empty?
                 if results.empty?
                   terminal.say "Nothing to tear down for #{iteration}"
                 else
                   results.each do |r|
-                    terminal.say "Tore down #{r[:lane]} (removed worktree, deleted #{r[:lane_branch]})"
+                    line = "Tore down #{r[:lane]} (removed worktree, deleted #{r[:lane_branch]})"
+                    line += " — discarded #{r[:discarded]} uncommitted change(s), --force was given" if r[:discarded]
+                    terminal.say line
                   end
                 end
               else
@@ -792,6 +828,7 @@ module Space::Architect
           argument :repo,      required: true, desc: "Repo name (under repos/)"
           argument :iteration, required: true, desc: "Iteration name"
           argument :lane,      required: true, desc: "Lane name"
+          argument :space,     required: false, desc: "Space identifier (default: $PWD)"
           option   :base,      default: nil,          desc: "Base ref (default: HEAD of repo)"
           option   :harness,   default: nil,          desc: "Harness (claude-code, opencode, pi; default: space.yaml project.harness, else claude-code)"
           option   :model,     default: nil,           desc: "Model; a trailing :<level> suffix (e.g. foo:high) is parsed into --effort (default: space.yaml project.model, else the per-harness sensible default)"
@@ -802,12 +839,12 @@ module Space::Architect
           option   :touch,     default: nil,           desc: "Comma-separated file globs the lane may touch (records its touch_set for in-bounds + merge checks)"
           option   :force,     type: :boolean, default: false, desc: "Clear and re-create a stale (unregistered) worktree directory"
 
-          def call(repo:, iteration:, lane:, base: nil, harness: nil, model: nil,
+          def call(repo:, iteration:, lane:, space: nil, base: nil, harness: nil, model: nil,
                    effort: nil, thinking: nil, reasoning: nil, quiet: false, touch: nil, force: false, **opts)
             setup_terminal(**opts.slice(:color, :colors))
             handle_errors do
               level = resolve_thinking_alias(effort: effort, thinking: thinking, reasoning: reasoning)
-              render(store.find) do |sp|
+              render(store.find(space)) do |sp|
                 project = ArchitectProject.new(space: sp)
                 touch_set = touch ? touch.split(",").map(&:strip).reject(&:empty?) : nil
                 err = quiet ? File.open(File::NULL, "w") : $stderr
@@ -815,6 +852,7 @@ module Space::Architect
                                              effort: level, touch: touch_set, force: force, err: err)
                 terminal.say "Worktree: #{terminal.path(result[:worktree])}"
                 terminal.say "Base SHA: #{result[:base_sha]}"
+                terminal.say "Discarded #{result[:discarded]} uncommitted change(s), --force was given" if result[:discarded]
                 CLI.record_outcome(Outcome.new(exit_code: 0))
               end
             end
@@ -825,14 +863,23 @@ module Space::Architect
           desc "Remove a lane worktree"
           argument :iteration, required: true, desc: "Iteration name"
           argument :lane,      required: true, desc: "Lane name"
+          argument :space,     required: false, desc: "Space identifier (default: $PWD)"
+          option   :force,     type: :boolean, default: false, desc: "Discard uncommitted work in the worktree (untracked files included) instead of refusing"
 
-          def call(iteration:, lane:, **opts)
+          def call(iteration:, lane:, space: nil, force: false, **opts)
             setup_terminal(**opts.slice(:color, :colors))
             handle_errors do
-              render(store.find) do |sp|
+              render(store.find(space)) do |sp|
                 project = ArchitectProject.new(space: sp)
-                project.worktree_remove(iteration, lane)
+                result = project.worktree_remove(iteration, lane, force: force)
                 terminal.say "Removed worktree for #{iteration}/#{lane}"
+                if result[:discarded]
+                  terminal.say "Discarded #{result[:discarded]} uncommitted change(s), --force was given"
+                end
+                if result[:branch_survives]
+                  terminal.say "Lane branch '#{result[:branch]}' survives — this is not a reset; " \
+                    "re-provisioning re-points or refuses it, it does not start it over."
+                end
                 CLI.record_outcome(Outcome.new(exit_code: 0))
               end
             end
@@ -841,11 +888,12 @@ module Space::Architect
 
         class List < BaseCommand
           desc "List active architect worktrees"
+          argument :space, required: false, desc: "Space identifier (default: $PWD)"
 
-          def call(**opts)
+          def call(space: nil, **opts)
             setup_terminal(**opts.slice(:color, :colors))
             handle_errors do
-              render(store.find) do |sp|
+              render(store.find(space)) do |sp|
                 project = ArchitectProject.new(space: sp)
                 worktrees = project.worktree_list
                 if worktrees.empty?

data/lib/space_architect/harness.rb

@@ -62,13 +62,16 @@ module Space::Architect
     # (default $stderr; thread a null writer to suppress) when it clamps/strips.
     # With force: true, the literal `effort` value is passed through unmodified.
     # For opencode: config_dir is required (build/<id>-<lane> dir outside the worktree).
-    def self.for(name, model:, max_turns:, bin: nil, config_dir: nil, effort: nil, force: false, err: $stderr)
+    def self.for(name, model:, max_turns:, bin: nil, config_dir: nil, effort: nil, allowed_tools: nil,
+                 force: false, err: $stderr)
       translated, inform = translate_thinking(name, effort, force: force)
       err.puts(inform) if inform
 
       case name.to_s
       when "claude-code"
-        ClaudeCodeHarness.new(model: model, max_turns: max_turns, bin: bin, effort: translated)
+        kwargs = { model: model, max_turns: max_turns, bin: bin, effort: translated }
+        kwargs[:allowed_tools] = allowed_tools if allowed_tools
+        ClaudeCodeHarness.new(**kwargs)
       when "opencode"
         raise Space::Core::Error, "config_dir is required for opencode harness" unless config_dir
         OpenCodeHarness.new(model: model, max_turns: max_turns, bin: bin, config_dir: config_dir, effort: translated)
@@ -93,6 +96,15 @@ module Space::Architect
       ACCEPTED_LEVELS = %w[low medium high xhigh max].freeze
       CLAMP_MAP = { "minimal" => "low" }.freeze
 
+      # #89: compose the --allowedTools value from an optional replace + append pair —
+      # resolved once here regardless of which surface (--allowed-tools/--append-allowed-tools
+      # flag, or the lane's frozen allowed_tools:/append_allowed_tools: declaration) supplied
+      # them, since replace/append combine identically either way.
+      def self.resolve_tools(replace: nil, append: nil)
+        base = replace || ALLOWED_TOOLS
+        append ? "#{base},#{append}" : base
+      end
+
       def self.translate_thinking(level, force: false)
         return [nil, nil] if level.nil?
         return [level, "thinking: force --effort=#{level} (unmodified, may be rejected)"] if force

data/lib/space_core/version.rb

@@ -2,6 +2,6 @@
 
 module Space
   module Core
-    VERSION = "6.0.0"
+    VERSION = "7.0.0"
   end
 end

data/skill/architect/SKILL.md

@@ -277,7 +277,9 @@ contract, self-contained:
   its **target repo + file-touch set, checked for overlap**: name the repo
   (`repos/<repo>`) and every file each lane may touch. The machine-readable
   declaration lives in a fenced ` ```lanes ` block in the Specification — one
-  entry per lane (`name`, `repo`, `touch` globs) — the single frozen source of
+  entry per lane (`name`, `repo`, `touch` globs; optionally `allowed_tools`/
+  `append_allowed_tools` to replace/extend the lane's builder tool grant — see
+  `dispatch.md`) — the single frozen source of
   truth `architect freeze` records into `space.yaml` and `architect provision`
   materializes. The same boundary is stated twice more — the lane-prompt's
   may-touch list, and the scope gate that checks the lane's diff at judge
@@ -298,12 +300,15 @@ contract, self-contained:
   overlap run as one. Each lane gets its own objective, output format, and
   boundaries. Most
   iterations are one lane — fan out only when the work is genuinely parallel (a
-  cross-repo project often is). Two first-class patterns — runnable recipes in `dispatch.md`: **parallel +
+  cross-repo project often is). Three first-class patterns — runnable recipes in `dispatch.md`: **parallel +
   fast-follow** (disjoint lanes integrate first; a fast-follow lane off
-  `project/<slug>` carries the seam — see `### Parallel + fast-follow`) and
+  `project/<slug>` carries the seam — see `### Parallel + fast-follow`),
   **serial deferred judgment** (iterations run to gates-green with `architect
   verdict` withheld; one later batch session judges each against its own frozen
-  AC — see `### Serial deferred judgment`).
+  AC — see `### Serial deferred judgment`), and **long-running sweep** (a lane
+  launches its own long detached process, ends its session at a sanctioned
+  pending status, and a later session in the same worktree audits it once it
+  exits — see `### Long-running sweep` in `dispatch.md`).
 - **Effort call** — thinking budget set per dispatch with `architect dispatch
   --effort <level>`, translated and clamped to the lane's harness (the
   escalation keywords `think hard` … `ultrathink` still work in-prompt);
@@ -402,7 +407,8 @@ Per the mechanics in `dispatch.md`. The lane lifecycle is **declare → rehearse
 there is no dispatch-in-the-checkout path:
 
 - **Declare** — at spec time, each lane is one entry in the Specification's
-  fenced ` ```lanes ` block (§4): `name`, `repo`, `touch` globs.
+  fenced ` ```lanes ` block (§4): `name`, `repo`, `touch` globs, and optionally
+  `allowed_tools`/`append_allowed_tools`.
 - **Rehearse** — `architect rehearse <iteration>` dry-runs the drafted gates
   from the working tree (§4's pre-freeze check), resolving its run dir from the
   drafted ` ```lanes ` block, and stamps `space.yaml`; `freeze` refuses without
@@ -488,7 +494,10 @@ only the per-lane `lane/<iteration>-<lane>` branches and worktrees, never the
 project branch. Update the iteration index in `architecture/ARCHITECT.md`
 (recording the `project/<slug>` branch), remove the provisioned worktrees
 (`architect integrate … --teardown`, or `architect worktree remove <iteration>
-<lane>`), and commit the space.
+<lane>`), and commit the space. Both refuse per lane when its worktree still
+holds uncommitted work — untracked files included; `--force` overrides and
+discards it. The `--lanes` integration path itself is unaffected, since
+`integrate` commits each lane's work before teardown.
 
 **Run the frozen gates cold** — `architect gate <iteration>` runs the frozen
 gate commands against the integration tree and streams raw output (a runner, not

data/skill/architect/dispatch.md

@@ -145,7 +145,12 @@ spec defect: kill the conflicting lane and re-spec; don't hand-resolve builder
 conflicts. It runs **no gates and makes no verdict** — `architect gate` streams
 the raw gate output for you to judge. `--teardown` deletes only the per-lane
 `lane/<iteration>-<lane>` branches and worktrees; it never deletes the
-`project/<slug>` branch.
+`project/<slug>` branch. Every destructive lane operation — `worktree remove`,
+`integrate --teardown`, and the re-point path of `provision --base` — refuses
+per lane when that lane's worktree still holds uncommitted work, untracked
+files included, because that's what a dispatched lane always holds; `--force`
+overrides and discards it. The `--lanes <passing-set>` integration path itself
+is unaffected — `integrate` commits each lane's work before tearing it down.
 
 Under the hood / manual fallback (one lane shown):
 
@@ -261,6 +266,66 @@ rests on a foundation that a later KILL at N would revert. Accept this coupling
 only consciously, and always judge oldest-first so a KILL stops you before you
 compound it.
 
+### Long-running sweep (detached, two-phase)
+
+Use when a lane's own work *is* a long-running detached process — a 30–70
+minute sweep, migration, or batch run the lane must launch, let run
+unattended, and then audit once it exits. A metered builder session paying
+tokens to sit in a poll loop is the wrong instrument for that wait: split the
+lane across two builder sessions instead, one before the process runs and one
+after.
+
+**Recipe:**
+
+1. **Phase A — launch, prove liveness, stop deliberately.** The lane-prompt's
+   PHASE 2 tells the builder to launch the process detached (backgrounded and
+   redirected to a log file, survives the builder's own process exit), capture
+   its pid, prove it's alive with one command result (e.g. `ps -p <pid>` plus a
+   growing log tail — not an assertion), pre-structure the report with the
+   sections phase B will fill in, and end the session there — not mid-poll —
+   at:
+   ```
+   STATUS: SWEEP_RUNNING (pid <pid>, run dir <path>)
+   ```
+   `SWEEP_RUNNING` is the fixed token spec authors and architects grep for;
+   the pid and run dir ride in the same line because nothing else in the loop
+   captures them.
+
+2. **The wait belongs to the architect's harness, not the builder session.**
+   Between phase A and B, a process-exit monitor on the architect's side —
+   notification-driven, not a poll loop — watches for the pid to exit. A
+   builder session spends tokens to sit idle in a wait; the harness doesn't.
+   Do not dispatch a phase-B session, or resume one, until the process has
+   actually exited.
+
+3. **Phase B — resume and audit.** Once the process has exited, resume the
+   same lane worktree with `--continue` — the one sanctioned use of
+   `--continue` beyond same-lane follow-ups (see `## Operating guidance`
+   below) — and hand it the post-run audit as the new instruction:
+   ```bash
+   ( cd build/<id>-<lane>/wt && \
+     echo "The sweep at <run dir> (pid <pid>) has exited. Audit its output
+   against the spec's acceptance criteria, finish the report you
+   pre-structured in phase A, and end at STATUS: COMPLETE." \
+     | claude -p --continue --model <builder-model> \
+       --permission-mode acceptEdits \
+       --allowedTools 'Read,Edit,Write,Grep,Glob,Bash,WebSearch,WebFetch' \
+       --disallowedTools 'Bash(git commit:*),Bash(git push:*),Bash(git reset:*),Bash(git merge:*),Bash(git rebase:*),Bash(git checkout:*),Bash(git branch:*)' \
+       --output-format stream-json --verbose \
+       > build/<id>-<lane>/run-b.jsonl 2>&1 )
+   ```
+   Phase B runs the post-run audits the spec asked for, then finishes the
+   report at `STATUS: COMPLETE` (or `COMPLETE_WITH_CONCERNS`/`BLOCKED`, per the
+   template) exactly as any other lane would.
+
+**Invariant:** phase A never ends mid-poll or at a pending status of its own
+invention — it ends at `SWEEP_RUNNING` with the pid and run dir recorded, or
+it's indistinguishable from a lane that gave up. Spec authors: an in-lane
+"poll until it finishes" / "never end the session while it runs" instruction
+loses to the template's no-busy-wait clause below every time a builder holds
+both — write this two-phase shape into the lane spec instead of a poll
+instruction.
+
 ## Operating guidance
 
 - Background each lane as its own harness task and let the **per-lane
@@ -282,6 +347,19 @@ compound it.
   `ultrathink`) and the `MAX_THINKING_TOKENS` env var still raise depth from
   inside the block. Default unattended builder work to a high budget; downgrade
   a routine, tightly-specified lane (record which and why in the spec).
+- **Tool grant.** The default `--allowedTools` list is overridable per dispatch:
+  `--allowed-tools <list>` replaces it, `--append-allowed-tools <list>` appends
+  to it. The same is settable in the frozen lane declaration's ` ```lanes ` block
+  — `allowed_tools:` (replaces) / `append_allowed_tools:` (appends) — so a lane
+  that needs an MCP or other non-default tool is granted it reviewably, judged
+  like every other lane boundary, rather than buried in a shell invocation. The
+  CLI flag wins over the lane's yaml key when both are given, and dispatch
+  reports which source resolved. This exists because `claude -p` **denies** a
+  tool not on the allow list rather than prompting for it — a lane missing a
+  needed grant doesn't error, it silently can't use the tool and files a
+  confident, dataless report instead. `--disallowedTools`/`DISALLOWED_TOOLS`
+  (the builder-never-commits deny rules above) has no override route, by design
+  — hard rule 7 depends on it staying fixed.
 - **Builders never commit, and the architect verifies it.** Claude Code has no
   sandbox to make `.git` read-only, so this is enforced by the deny rules at
   dispatch *and* checked after the run: before integrating a lane, confirm
@@ -400,7 +478,11 @@ backgrounded work is SIGTERMed and its output lost while the run still exits
 potentially long command an explicit timeout; if a
 runtime will not start unattended (interactive prompt, server with no timeout),
 record the exact failure in your report and route around it — never busy-wait
-or retry in a loop. When done, write your report to the scratch file given to
+or retry in a loop. The one sanctioned exception is a deliberate wait on a
+detached process this lane itself launched: end that phase at
+`STATUS: SWEEP_RUNNING` (pid + run dir) per `### Long-running sweep` in
+dispatch.md, instead of polling for it to finish — this clause still forbids
+retry loops and sitting on an unattended runtime with no timeout. When done, write your report to the scratch file given to
 you, build/<id>-<lane>/report.md (an absolute path outside your worktree),
 with RAW results only — tables, numbers, command output — no interpretation, no
 "promising". Every status claim must be backed by a command result from this

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: space-architect
 version: !ruby/object:Gem::Version
-  version: 6.0.0
+  version: 7.0.0
 platform: ruby
 authors:
 - Eric Jacobs