@agentguard-run/burn 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,32 @@
+## 0.2.3 (2026-09-15)
+
+- Replay evidence refreshed from this machine: 4 STOP, 3 WARN, 431 clean across
+  438 sessions and 616 spawns. Hero: 32%, 32.58B observed, 10.27B after STOP,
+  $4,639 API-list scenario. Fan-out sessions have 59, 190 and 226 spawns;
+  the sustained-burn session has 9.15B tokens and 26 spawns. These are a dated
+  snapshot and an upper bound, without a false-positive classification.
+- Account concurrency warnings and optional active-window token WARN/STOP
+  budgets read both hook and gateway session files. Shadow never blocks.
+- Claude hook decisions now write the same content-free, chained Ed25519
+  receipts as gateway decisions, with host/action on ledger rows. Old rows and
+  receipts remain readable. Session refresh and receipt chaining share the lock.
+- Add an opt-in 240-hook-process stress test at cap 40. Staggered lock retries
+  reduce contention while preserving the existing fail-closed deadline.
+- Correct the license package/file enumeration, use synthetic Codex fixture
+  identifiers, and stop labelling every omitted replay session as clean.
+- Tests: 47 passing by default, one stress test skipped unless AGENTGUARD_STRESS=1.
+
 # Changelog
 
+## 0.2.2 (2026-09-03)
+
+- Codex: `status` and `init codex --write` now say, every time, that the
+  hook must be trusted once with `/hooks` inside Codex. Verified that an
+  untrusted hook stalls `codex exec` with no output the first time a spawn
+  would be gated, from `hooks.json` and from `config.toml` alike.
+- Verified the installed Claude Code hook end to end from the global
+  install: 0.2s on a 1.95B-token transcript, decision recorded.
+
 ## 0.2.1 (2026-09-03)
 
 Finishing the product so it can be used, and a live Codex canary.
@@ -66,7 +93,7 @@ The cross-tool layer. One policy, one lock, one receipt across hosts.
   contention). Under 240 concurrent hook processes this admitted 41 to 46
   spawns against a cap of 40. Lock instances now carry a nonce; reclaims
   are verified against the instance judged; writes are fenced on the
-  holder's nonce. 192 runs at 240 concurrent processes admit exactly 40.
+  holder's nonce. See 0.2.3 for the reproducible 240-process audit result.
 - A lock owner record could be read half-written and parsed as "held since
   1970". The record is now written atomically and malformed records are
   never trusted.
@@ -83,7 +110,8 @@ The cross-tool layer. One policy, one lock, one receipt across hosts.
 
 ### Unchanged
 - The Claude Code hook, transcript reader, detectors and thresholds. The
-  existing 24 tests pass as they were.
+  original tests remain covered; 0.2.2 has 40 passing tests, and 0.2.3 has
+  47 default passing tests plus one opt-in stress test.
 
 ## 0.1.1 (2026-09-03)
 - The artifact: block-digit hero, per-session sparklines with the STOP marked,

package/LICENSE

@@ -2,13 +2,12 @@ AgentGuard(R) Burn - Alpha License
 Copyright (c) 2026 Dunecrest Ventures Inc.
 
 1. SCOPE.
-This software is the npm package @agentguard-run/spend, comprising every file
+This software is the npm package @agentguard-run/burn, comprising every file
 present in an installed copy of that package. That includes the TypeScript
-sources under src/, the compiled output under dist/, the command-line entry
-point under bin/, the documentation under docs/, the fixtures under tests/, and
-the root files README.md, README.es-419.md, README.pt-BR.md, CHANGELOG.md,
-PATENTS.md and package.json. Any file the package ships that Section 3 does not
-expressly name is licensed under this Section 1; the enumeration above is
+type definitions and compiled output under dist/src/, the command-line entry
+point dist/src/cli.js, the fixtures under fixtures/, and the root files
+README.md, CHANGELOG.md, LICENSE and package.json. Any file the package ships
+that Section 3 does not expressly name is licensed under this Section 1; the enumeration above is
 illustrative, and adding a file to the package does not place it outside these
 terms.
 
@@ -40,8 +39,8 @@ Licensor. All patent rights are expressly reserved.
 The following assets, and ONLY these assets, are released under the BSD
 2-Clause License, reproduced in full below:
 
-  - The documentation files README.md, README.es-419.md and README.pt-BR.md
-  - The test fixture under tests/
+  - The documentation file README.md
+  - The test fixtures under fixtures/
 
   Copyright (c) 2026 Dunecrest Ventures Inc.
 
@@ -74,8 +73,8 @@ consistent with Section 2 above. The BSD 2-Clause License is used for these
 assets precisely because it is silent as to patents.
 
 Nothing else the package ships is included in the grant above. The code under
-src/, dist/ and bin/, the documentation under docs/, and the root files
-CHANGELOG.md and PATENTS.md remain licensed only under the alpha evaluation
+dist/src/, and the root files CHANGELOG.md, LICENSE and package.json remain
+licensed only under the alpha evaluation
 terms of Section 1. The TypeScript type definitions, policy engine, decision
 log, store implementation, cost table, and wrapper code are in that group.
 

package/README.md

@@ -9,17 +9,22 @@ to do about it. Nothing leaves the machine.
 
 ## Two safety planes
 
-Fitted against 412 real Claude Code sessions, which showed two independent
+Originally fitted against 412 real Claude Code sessions, then replayed on
+2026-09-15 against 438 sessions. The history shows two independent
 failure shapes that one detector cannot cover:
 
 | Plane | Catches | Rule | Validated on |
 |---|---|---|---|
-| Structural | fan-out storms: many agents re-sending context | WARN 24 spawns, STOP before spawn 41, no agents-spawning-agents past depth 2 | 174- and 226-spawn sessions; STOP would have intercepted 91% of the runaway |
+| Structural | fan-out storms: many agents re-sending context | WARN 24 spawns, STOP before spawn 41, no agents-spawning-agents past depth 2 | 59-, 190- and 226-spawn sessions; the 190-spawn session has a 4.35B post-STOP tail (92%) |
 | Economic | slow grinds: few agents, enormous total | WARN 3.5B, STOP 5B tokens per session | the 9.15B / 26-spawn session the spawn cap could not see |
 
-Across all 412 sessions: 3 STOP, 2 WARN, 407 clean. Zero false STOPs.
+The 2026-09-15 replay snapshot: **4 STOP, 3 WARN, 431 clean across 438
+sessions and 616 spawns**. Replay hero: **32%** — **10.27B** of **32.58B**
+observed tokens came after a STOP boundary; API-list scenario **$4,639**.
+This is an upper bound assuming no override or restart. Replay does not label
+false positives. Active histories can change the next replay result.
 
-Cache-read ratio was 98% on every session, healthy and pathological alike. It
+Cache-read ratio was about 98% in the original calibration, healthy and pathological alike. It
 is shown as an explanation and never used to decide.
 
 ## Start with replay, not with the hook
@@ -155,8 +160,15 @@ spawn through with the reason on the ledger. Two things the docs got wrong
 and the wire settled: the tool arrives as `spawn_agent` (the docs say it
 "matches as Agent"; the matcher covers both), and project-local hooks only
 load when the project is trusted. The captured payloads are in
-`fixtures/codex-0.151.0-pretooluse.json` and drive a test. After
-`init codex --write`, trust the hook once with `/hooks` inside Codex.
+`fixtures/codex-0.151.0-pretooluse.json` and drive a test.
+
+One step Codex makes you do by hand: after `init codex --write`, open
+`codex`, run `/hooks`, and trust the AgentGuard hook. Codex requires this
+once per hook source, and there is no CLI for it. Until it is done,
+`codex exec` stalls the first time a spawn would be gated (verified: it
+hangs with no output; the same with hooks defined in `config.toml`).
+`status` repeats this under the codex line because it cannot see whether
+trust was granted.
 
 **Cursor** is verified against the documented schema (`permission`,
 `user_message`, `agent_message`; `~/.cursor/hooks.json` with `failClosed`),
@@ -178,20 +190,41 @@ Ten parallel `Agent` calls launch ten hook processes that all read the same
 transcript and all see the same count. A naive cap is cosmetic during exactly
 the burst it exists for. Spawns are admitted through an atomic, cross-process
 reservation under a machine-wide lock; the test suite launches 60 real OS
-processes against a cap of 40 and asserts exactly 40 are admitted, through
-the Claude hook and again through the Cursor hook.
+reservation processes against a cap of 40 and asserts exactly 40 are admitted,
+and separately exercises 60 Cursor hook processes. The opt-in stress test runs
+240 actual Claude hook processes against cap 40:
+
+```sh
+npm run build
+AGENTGUARD_STRESS=1 node --test dist/tests/stress.test.js
+```
+
+It checks exactly 40 admitted and 200 denied, verifies the receipt chain for
+coordinated decisions, and reports lock failures separately. Infrastructure
+failures deny in enforce mode before a receipt can be chained, as in the gateway.
 
 0.2.0 fixed the lock itself. Under 240 concurrent hook processes the 0.1
 lock could tear down a live sibling's lock (a waiter judged "owner is dead"
 about an instance that had already been released and replaced) and admit
 41 to 46. Lock instances now carry a nonce; a reclaim only counts if it
 grabbed the instance it judged, and every write is fenced on the holder's
-own nonce still being on the path. 192 runs at 240 concurrent processes:
-exactly 40, every time.
+own nonce still being on the path. In 0.2.3, bounded, staggered retries prevent
+lock waiters from starving the holder. The Sep 15 audit includes one successful
+240-process run after that fix; it does not establish a 192-run guarantee.
 
 Single-machine by design. Two laptops on one account do not share state, and
 that is stated rather than hidden.
 
+## Account thresholds
+
+`account.warnConcurrentSessions` warns when more than that many sessions have
+been active on this machine in the last 30 minutes, matching `status` liveness.
+Optional `account.warnTokens` and `account.stopTokens` sum the last
+`account.windowActiveMinutes` of token buckets from each active session.
+Both token limits default to `null`. Closed gateway sessions are excluded;
+hook and gateway session files are both read. WARN never blocks. STOP records
+a would-block decision in shadow and blocks new work only in enforce mode.
+
 ## What it never does
 
 No prompts, responses, file contents, or tool inputs are persisted or rendered.

package/dist/src/cli.js

@@ -163,7 +163,7 @@ async function main(argv) {
                 process.stderr.write(`init: host must be claude, cursor or codex\n`);
                 return 64;
             }
-            const label = { claude: '', cursor: 'Cursor support is BETA: verified against the documented hook schema, not yet against every installed build. "failClosed": true means a crashed hook denies the subagent.', codex: 'Codex support is BETA: a live deny, allow and override canary passed on codex-cli 0.151.0; transcript usage is best-effort and marked estimated. Trust the hook once with /hooks inside Codex.' }[target];
+            const label = { claude: '', cursor: 'Cursor support is BETA: verified against the documented hook schema, not yet against every installed build. "failClosed": true means a crashed hook denies the subagent.', codex: 'Codex support is BETA: a live deny, allow and override canary passed on codex-cli 0.151.0; transcript usage is best-effort and marked estimated.\nONE MORE STEP: open codex, run /hooks, and trust the AgentGuard hook. Codex requires this once per hook source; until then `codex exec` stalls the first time a spawn would be gated.' }[target];
             const tail = `Installed in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n`;
             if (has('--write')) {
                 let result;

package/dist/src/conformance.js

@@ -37,7 +37,9 @@ const GRIND_WARN_CALL = Math.floor(defaults_1.DEFAULT_THRESHOLDS.sustained.warnT
 const GRIND_STOP_CALL = Math.floor(defaults_1.DEFAULT_THRESHOLDS.sustained.stopTokens / CALL_TOKENS) + 1; // 21
 function freshHome() {
     const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agb-conf-'));
-    const policy = { mode: 'enforce', thresholds: defaults_1.DEFAULT_THRESHOLDS };
+    // These fixtures share a home to inspect all receipts. Test only the
+    // session boundaries here; account concurrency has its own integration tests.
+    const policy = { mode: 'enforce', thresholds: { ...defaults_1.DEFAULT_THRESHOLDS, account: { ...defaults_1.DEFAULT_THRESHOLDS.account, warnConcurrentSessions: Number.MAX_SAFE_INTEGER } } };
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(home, 'burn-policy.json'), JSON.stringify(policy));
     return home;
 }

package/dist/src/defaults.d.ts

@@ -2,14 +2,13 @@ import type { Policy, Thresholds } from './types';
 /**
  * Shipped thresholds.
  *
- * These are not intuition. They were fitted against 412 real Claude Code
- * sessions on the author's machine on 2026-09-03:
- *
- *   fan-out 24/40  : on the 172-spawn runaway, STOP at spawn 40 would have
- *                    prevented 91% of that session's tokens.
- *   sustained 3.5B/5B : across all 412 sessions this produced exactly 1 STOP,
- *                    the 9.15B slow grind the fan-out cap missed, 2 WARNs, and
- *                    409 clean sessions. Zero false STOPs.
+ * Originally fitted against 412 real Claude Code sessions. Replayed on the
+ * author's machine on 2026-09-15: 438 sessions, 616 spawns, 32.58B tokens;
+ * 4 STOP, 3 WARN, 431 clean. The observed post-STOP tail is 10.27B (32%).
+ * Fan-out 24/40 stops before spawn 41 on the 59-, 190- and 226-spawn
+ * sessions; sustained 3.5B/5B catches the 9.15B / 26-spawn slow grind.
+ * This is a dated replay snapshot and an upper bound, not labelled evidence
+ * of false-positive rates or guaranteed savings.
  *
  * A previous draft shipped a 50M session budget. Routine sessions on the same
  * machine run 1.4B to 3.5B, so that default would have fired within minutes on

package/dist/src/defaults.js

@@ -4,14 +4,13 @@ exports.SHADOW_MIN_DAYS = exports.SHADOW_MIN_DECISIONS = exports.ACTIVE_GAP_CAP_
 /**
  * Shipped thresholds.
  *
- * These are not intuition. They were fitted against 412 real Claude Code
- * sessions on the author's machine on 2026-09-03:
- *
- *   fan-out 24/40  : on the 172-spawn runaway, STOP at spawn 40 would have
- *                    prevented 91% of that session's tokens.
- *   sustained 3.5B/5B : across all 412 sessions this produced exactly 1 STOP,
- *                    the 9.15B slow grind the fan-out cap missed, 2 WARNs, and
- *                    409 clean sessions. Zero false STOPs.
+ * Originally fitted against 412 real Claude Code sessions. Replayed on the
+ * author's machine on 2026-09-15: 438 sessions, 616 spawns, 32.58B tokens;
+ * 4 STOP, 3 WARN, 431 clean. The observed post-STOP tail is 10.27B (32%).
+ * Fan-out 24/40 stops before spawn 41 on the 59-, 190- and 226-spawn
+ * sessions; sustained 3.5B/5B catches the 9.15B / 26-spawn slow grind.
+ * This is a dated replay snapshot and an upper bound, not labelled evidence
+ * of false-positive rates or guaranteed savings.
  *
  * A previous draft shipped a 50M session budget. Routine sessions on the same
  * machine run 1.4B to 3.5B, so that default would have fired within minutes on

package/dist/src/detectors/evaluate.d.ts

@@ -4,7 +4,7 @@
  * Two independent safety planes, because the data showed two independent
  * failure modes:
  *
- *   structural  - fan-out. Many agents, each re-sending context. The 172-spawn
+ *   structural  - fan-out. Many agents, each re-sending context. The 190-spawn
  *                 session. Caught by an absolute spawn cap.
  *   economic    - sustained burn. Few agents, long session, enormous total. The
  *                 9.15B session with only 26 spawns, which a spawn cap cannot
@@ -21,5 +21,8 @@ import type { BurnReport, SessionState, Thresholds } from '../types';
  * would have if the pending spawn were allowed; the decision must be about the
  * proposal, not about a violation the transcript has already recorded.
  */
-export declare function evaluate(state: SessionState, thresholds: Thresholds, proposedSpawnDepth?: number | null): BurnReport;
+export declare function evaluate(state: SessionState, thresholds: Thresholds, proposedSpawnDepth?: number | null, account?: {
+    sessions: SessionState[];
+    now: number;
+}): BurnReport;
 export declare function fmt(n: number): string;

package/dist/src/detectors/evaluate.js

@@ -5,7 +5,7 @@
  * Two independent safety planes, because the data showed two independent
  * failure modes:
  *
- *   structural  - fan-out. Many agents, each re-sending context. The 172-spawn
+ *   structural  - fan-out. Many agents, each re-sending context. The 190-spawn
  *                 session. Caught by an absolute spawn cap.
  *   economic    - sustained burn. Few agents, long session, enormous total. The
  *                 9.15B session with only 26 spawns, which a spawn cap cannot
@@ -19,6 +19,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluate = evaluate;
 exports.fmt = fmt;
+const account_1 = require("../state/account");
 const session_1 = require("../state/session");
 const RANK = { OK: 0, WARN: 1, STOP: 2 };
 function worst(a, b) {
@@ -29,7 +30,7 @@ function worst(a, b) {
  * would have if the pending spawn were allowed; the decision must be about the
  * proposal, not about a violation the transcript has already recorded.
  */
-function evaluate(state, thresholds, proposedSpawnDepth = null) {
+function evaluate(state, thresholds, proposedSpawnDepth = null, account) {
     const findings = [];
     let verdict = 'OK';
     // ---- structural plane: fan-out --------------------------------------
@@ -132,6 +133,27 @@ function evaluate(state, thresholds, proposedSpawnDepth = null) {
         });
         verdict = worst(verdict, 'WARN');
     }
+    // Machine activity uses status's 30-minute liveness window. Token budgets
+    // sum each live session's last configured number of active-minute buckets.
+    if (account && thresholds.account) {
+        const t = thresholds.account;
+        const live = account.sessions.filter((s) => account.now - s.lastEventAt <= account_1.ACTIVE_SESSION_WINDOW_MS);
+        if (live.length > t.warnConcurrentSessions) {
+            findings.push({ detector: 'account', verdict: 'WARN',
+                summary: `${live.length} concurrent active sessions on this machine; warning threshold is ${t.warnConcurrentSessions}.`,
+                observed: live.length, threshold: t.warnConcurrentSessions });
+            verdict = worst(verdict, 'WARN');
+        }
+        const tokens = live.reduce((sum, s) => sum + (0, session_1.windowSum)(s.tokensByActiveMinute, s.activeMinutes, t.windowActiveMinutes), 0);
+        const severity = t.stopTokens != null && tokens >= t.stopTokens ? 'STOP'
+            : t.warnTokens != null && tokens >= t.warnTokens ? 'WARN' : null;
+        if (severity) {
+            findings.push({ detector: 'account', verdict: severity,
+                summary: `Active sessions consumed ${fmt(tokens)} tokens over their last ${t.windowActiveMinutes} active minutes.`,
+                observed: tokens, threshold: (severity === 'STOP' ? t.stopTokens : t.warnTokens) });
+            verdict = worst(verdict, severity);
+        }
+    }
     // ---- advisory: duplicate work --------------------------------------
     let duplicated = 0;
     let worstSurfaceReaders = 0;
@@ -192,6 +214,8 @@ function prescribe(state, findings, t) {
     if (has('burn_debt')) {
         out.push('Burn is sustained above your own baseline. Narrow the task or split it into a new session.');
     }
+    if (has('account'))
+        out.push('Pause new work across active sessions on this machine until the account window clears.');
     if (has('duplicate_work')) {
         out.push('Assign one reader per file and pass a short digest down, instead of letting every agent re-read it.');
     }

package/dist/src/gateway.js

@@ -41,6 +41,7 @@ const pre_tool_use_1 = require("./hook/pre-tool-use");
 const override_1 = require("./override");
 const receipt_1 = require("./receipt");
 const reservations_1 = require("./state/reservations");
+const account_1 = require("./state/account");
 const session_1 = require("./state/session");
 const MAX_SEEN_EVENTS = 4000;
 const FILE_PREFIX = 'gw-';
@@ -214,7 +215,7 @@ class Gateway {
                 }
                 const live = new Map(meta.liveSpawns);
                 const proposedDepth = event.proposedDepth ?? (event.issuerId !== undefined && live.has(event.issuerId) ? live.get(event.issuerId) + 1 : 1);
-                const report = (0, evaluate_1.evaluate)(state, policy.thresholds, proposedDepth);
+                const report = (0, evaluate_1.evaluate)(state, policy.thresholds, proposedDepth, { sessions: (0, account_1.readAccountSessions)(this.home, state, event.at), now: event.at });
                 const reservation = tx.reserve({
                     sessionId: event.sessionId,
                     toolUseId: event.spawnId,
@@ -264,13 +265,13 @@ class Gateway {
                     this.applyUsage(event.callId, event.estimatedTokens, 0, event.at, state, calls);
                 }
                 meta.calls = [...calls];
-                const session = (0, evaluate_1.evaluate)(state, policy.thresholds, null);
+                const session = (0, evaluate_1.evaluate)(state, policy.thresholds, null, { sessions: (0, account_1.readAccountSessions)(this.home, state, event.at), now: event.at });
                 const local = (0, local_compute_1.evaluateLocalCompute)(compute, policy.thresholds);
                 const report = merge(session, local.findings);
                 const wouldBlock = report.verdict === 'STOP';
                 // A low-confidence session (proxy without a session header) can be
                 // stopped only on machine-scope grounds. Its session count is a guess.
-                const machineStop = local.verdict === 'STOP';
+                const machineStop = local.verdict === 'STOP' || session.findings.some((f) => f.detector === 'account' && f.verdict === 'STOP');
                 const due = wouldBlock && policy.mode === 'enforce' && (event.attribution === 'high' || machineStop);
                 const override = due ? (0, override_1.consumeOverride)(this.home, event.at) : null;
                 const blocked = due && !override;

package/dist/src/hook/pre-tool-use.d.ts

@@ -49,6 +49,8 @@ export interface PersistedSession {
     };
     /** Signature of the last finding set the user was told about. */
     notified?: string;
+    /** Additive chain head; old session files begin at genesis. */
+    lastReceipt?: string | null;
 }
 /** Inflate a persisted Claude Code session. Shared with status. */
 export declare function inflateHookSession(raw: PersistedSession): SessionState;

package/dist/src/hook/pre-tool-use.js

@@ -22,6 +22,10 @@ exports.loadPolicy = loadPolicy;
 exports.refreshSession = refreshSession;
 exports.handlePreToolUse = handlePreToolUse;
 exports.settingsSnippet = settingsSnippet;
+const node_crypto_1 = require("node:crypto");
+const events_1 = require("../events");
+const receipt_1 = require("../receipt");
+const account_1 = require("../state/account");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const evaluate_1 = require("../detectors/evaluate");
@@ -48,13 +52,13 @@ function loadSession(home, sessionId, firstEventAt) {
     try {
         const raw = JSON.parse((0, node_fs_1.readFileSync)(sessionFile(home, sessionId), 'utf8'));
         const cursor = { ...raw.cursor, depthByUuid: new Map(raw.cursor.depthByUuid) };
-        return { cursor, state: inflateHookSession(raw), notified: raw.notified ?? '' };
+        return { cursor, state: inflateHookSession(raw), notified: raw.notified ?? '', lastReceipt: raw.lastReceipt ?? null };
     }
     catch {
-        return { cursor: (0, claude_transcript_1.newCursor)(), state: (0, session_1.newSessionState)(sessionId, firstEventAt), notified: '' };
+        return { cursor: (0, claude_transcript_1.newCursor)(), state: (0, session_1.newSessionState)(sessionId, firstEventAt), notified: '', lastReceipt: null };
     }
 }
-function saveSession(home, cursor, state, notified) {
+function saveSession(home, cursor, state, notified, lastReceipt) {
     (0, node_fs_1.mkdirSync)((0, node_path_1.join)(home, 'sessions'), { recursive: true, mode: 0o700 });
     const persisted = {
         cursor: { offset: cursor.offset, size: cursor.size, malformedLines: cursor.malformedLines, depthByUuid: [...cursor.depthByUuid] },
@@ -65,6 +69,7 @@ function saveSession(home, cursor, state, notified) {
             surfaceReaders: [...state.surfaceReaders].map(([k, v]) => [k, [...v]]),
         },
         notified,
+        lastReceipt,
     };
     const file = sessionFile(home, state.sessionId);
     (0, node_fs_1.writeFileSync)(`${file}.tmp`, JSON.stringify(persisted), { mode: 0o600 });
@@ -99,14 +104,14 @@ function recordDecision(home, entry) {
 }
 /** Refresh session state from the transcript. Cheap: only new bytes are read. */
 function refreshSession(home, sessionId, transcriptPath) {
-    const { cursor, state, notified } = loadSession(home, sessionId, Date.now());
+    const { cursor, state, notified, lastReceipt } = loadSession(home, sessionId, Date.now());
     const before = state.spawnCount;
     const events = (0, claude_transcript_1.readIncremental)(transcriptPath, cursor);
     for (const event of events)
         (0, session_1.applyEvent)(state, event);
     if (events.length > 0 && state.startedAt > events[0].at)
         state.startedAt = events[0].at;
-    saveSession(home, cursor, state, notified);
+    saveSession(home, cursor, state, notified, lastReceipt);
     return { cursor, state, newSpawns: state.spawnCount - before, notified };
 }
 function rememberNotified(home, sessionId, signature) {
@@ -128,71 +133,88 @@ function handlePreToolUse(input, home, now = Date.now()) {
     }
     const policy = loadPolicy(home);
     const store = new reservations_1.ReservationStore(home);
-    let report;
-    let reservation;
-    let notified = '';
     try {
-        const refreshed = refreshSession(home, input.session_id, input.transcript_path);
-        const { state, newSpawns } = refreshed;
-        notified = refreshed.notified;
-        if (newSpawns > 0)
-            store.reconcile(input.session_id, state.spawnCount, state.spawnCount - newSpawns);
-        // Depth of the proposed child: the issuing agent's depth plus one. A hook
-        // fired inside a subagent carries agent_id; treat that as depth 1 issuer.
-        const proposedDepth = input.agent_id ? 2 : 1;
-        report = (0, evaluate_1.evaluate)(state, policy.thresholds, proposedDepth);
-        reservation = store.reserve({
-            sessionId: input.session_id,
-            toolUseId: input.tool_use_id ?? `${input.session_id}:${now}`,
-            observedSpawns: state.spawnCount,
-            ceiling: policy.thresholds.fanout.stop,
-            now,
+        const signer = receipt_1.ReceiptSigner.loadOrCreate(home);
+        return store.withLock((tx) => {
+            const refreshed = refreshSession(home, input.session_id, input.transcript_path);
+            const { state, newSpawns } = refreshed;
+            const notified = refreshed.notified;
+            if (newSpawns > 0)
+                tx.reconcile(input.session_id, state.spawnCount, state.spawnCount - newSpawns);
+            // Depth of the proposed child: the issuing agent's depth plus one. A hook
+            // fired inside a subagent carries agent_id; treat that as depth 1 issuer.
+            const proposedDepth = input.agent_id ? 2 : 1;
+            const report = (0, evaluate_1.evaluate)(state, policy.thresholds, proposedDepth, { sessions: (0, account_1.readAccountSessions)(home, state, now), now });
+            const reservation = tx.reserve({
+                sessionId: input.session_id,
+                toolUseId: input.tool_use_id ?? `${input.session_id}:${now}`,
+                observedSpawns: state.spawnCount,
+                ceiling: policy.thresholds.fanout.stop,
+                now,
+            });
+            const shouldDeny = report.verdict === 'STOP' || !reservation.allowed;
+            const reason = shouldDeny ? buildDenyReason(report, reservation) : '';
+            // The audited override: only consulted when a block is about to happen.
+            const override = shouldDeny && policy.mode === 'enforce' ? (0, override_1.consumeOverride)(home, now) : null;
+            const blocked = policy.mode === 'enforce' && shouldDeny && !override;
+            const verdict = shouldDeny ? 'STOP' : report.verdict;
+            const raw = JSON.parse((0, node_fs_1.readFileSync)(sessionFile(home, input.session_id), 'utf8'));
+            const receipt = signer.sign({
+                schema: 'agentguard.burn.decision.v1', decisionId: (0, node_crypto_1.randomUUID)(), at: now,
+                host: 'claude-code', action: 'spawn', sessionDigest: (0, receipt_1.sha256)(input.session_id),
+                policy: { mode: policy.mode, digest: (0, receipt_1.sha256)((0, receipt_1.canonical)(policy)) },
+                measured: { sessionTokens: state.totalTokens, sessionSpawns: reservation.effectiveSpawns,
+                    proposedDepth, inFlight: 0, occupiedMs: 0 },
+                coverage: events_1.CAPABILITIES['claude-code'], verdict, blocked,
+                reasons: [...report.findings.map((f) => `${f.detector}:${f.verdict}`), ...(!reservation.allowed ? ['fanout:STOP'] : [])],
+                previous: raw.lastReceipt ?? null,
+            });
+            store.assertHeld();
+            (0, node_fs_1.appendFileSync)((0, node_path_1.join)(home, 'receipts.ndjson'), `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+            saveSession(home, refreshed.cursor, state, notified, (0, receipt_1.receiptDigest)(receipt));
+            recordDecision(home, {
+                host: 'claude-code', action: 'spawn',
+                at: now,
+                sessionId: input.session_id,
+                toolUseId: input.tool_use_id ?? null,
+                verdict,
+                wouldDeny: shouldDeny,
+                enforced: policy.mode === 'enforce' && shouldDeny && !override,
+                overridden: override ? { once: override.once, reason: override.reason } : undefined,
+                mode: policy.mode,
+                findings: report.findings.map((f) => ({ detector: f.detector, verdict: f.verdict, observed: f.observed, threshold: f.threshold })),
+                effectiveSpawns: reservation.effectiveSpawns,
+                totals: report.totals,
+            });
+            if (shouldDeny && policy.mode === 'enforce') {
+                if (!override)
+                    return deny(reason);
+                return {
+                    continue: true,
+                    systemMessage: `AgentGuard STOP overridden${override.once ? ' once' : ''} ("${override.reason}"): ${report.findings[0]?.summary ?? ''}`,
+                };
+            }
+            if (report.verdict !== 'OK') {
+                const signature = findingSignature(report);
+                if (signature === notified)
+                    return { continue: true, suppressOutput: true };
+                rememberNotified(home, input.session_id, signature);
+                return {
+                    continue: true,
+                    systemMessage: `AgentGuard ${report.verdict}${policy.mode === 'shadow' && shouldDeny ? ' (shadow: would have blocked)' : ''}: ${report.findings[0]?.summary ?? ''}`,
+                };
+            }
+            if (notified)
+                rememberNotified(home, input.session_id, '');
+            return { continue: true, suppressOutput: true };
         });
     }
     catch (error) {
         // Could not coordinate. Deny the spawn; never let a burst through blind.
         const reason = `AgentGuard failed closed: ${error instanceof Error ? error.message : 'unknown error'}`;
-        recordDecision(home, { at: now, sessionId: input.session_id, verdict: 'STOP', enforced: policy.mode === 'enforce', reason, failClosed: true });
+        recordDecision(home, { host: 'claude-code', action: 'spawn', at: now, sessionId: input.session_id, verdict: 'STOP', enforced: policy.mode === 'enforce', reason, failClosed: true });
         return policy.mode === 'enforce' ? deny(reason) : { continue: true, suppressOutput: true };
     }
-    const shouldDeny = report.verdict === 'STOP' || !reservation.allowed;
-    const reason = shouldDeny ? buildDenyReason(report, reservation) : '';
-    // The audited override: only consulted when a block is about to happen.
-    const override = shouldDeny && policy.mode === 'enforce' ? (0, override_1.consumeOverride)(home, now) : null;
-    recordDecision(home, {
-        at: now,
-        sessionId: input.session_id,
-        toolUseId: input.tool_use_id ?? null,
-        verdict: report.verdict,
-        wouldDeny: shouldDeny,
-        enforced: policy.mode === 'enforce' && shouldDeny && !override,
-        overridden: override ? { once: override.once, reason: override.reason } : undefined,
-        mode: policy.mode,
-        findings: report.findings.map((f) => ({ detector: f.detector, verdict: f.verdict, observed: f.observed, threshold: f.threshold })),
-        effectiveSpawns: reservation.effectiveSpawns,
-        totals: report.totals,
-    });
-    if (shouldDeny && policy.mode === 'enforce') {
-        if (!override)
-            return deny(reason);
-        return {
-            continue: true,
-            systemMessage: `AgentGuard STOP overridden${override.once ? ' once' : ''} ("${override.reason}"): ${report.findings[0]?.summary ?? ''}`,
-        };
-    }
-    if (report.verdict !== 'OK') {
-        const signature = findingSignature(report);
-        if (signature === notified)
-            return { continue: true, suppressOutput: true };
-        rememberNotified(home, input.session_id, signature);
-        return {
-            continue: true,
-            systemMessage: `AgentGuard ${report.verdict}${policy.mode === 'shadow' && shouldDeny ? ' (shadow: would have blocked)' : ''}: ${report.findings[0]?.summary ?? ''}`,
-        };
-    }
-    if (notified)
-        rememberNotified(home, input.session_id, '');
-    return { continue: true, suppressOutput: true };
 }
 function buildDenyReason(report, _reservation) {
     // Claude Code shows this reason to the user. A box reads as an alarm; a

package/dist/src/replay/render.js

@@ -160,7 +160,7 @@ function renderReplay(summary, opts = {}) {
         out.push(row(paint(on, C.dim, `${s.sessionId.slice(0, 8)}  ${(0, evaluate_1.fmt)(s.totalTokens).padStart(6)} · ${String(s.spawns).padStart(3)} spawns   ${detail}`)));
     }
     if (summary.sessions.length > top) {
-        out.push(row(paint(on, C.dim, `… ${summary.sessions.length - top} more, all clean`)));
+        out.push(row(paint(on, C.dim, `… ${summary.sessions.length - top} more sessions (included in totals)`)));
     }
     out.push(MID);
     out.push(row(paint(on, C.dim, 'Upper bound; assumes no override or restart. Nothing left this machine.')));

package/dist/src/state/account.d.ts

@@ -0,0 +1,3 @@
+import type { SessionState } from '../types';
+export declare const ACTIVE_SESSION_WINDOW_MS: number;
+export declare function readAccountSessions(home: string, current: SessionState, now: number): SessionState[];

package/dist/src/state/account.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTIVE_SESSION_WINDOW_MS = void 0;
+exports.readAccountSessions = readAccountSessions;
+/** Read the same hook and gateway session files used by machine status. */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.ACTIVE_SESSION_WINDOW_MS = 30 * 60 * 1000;
+function readAccountSessions(home, current, now) {
+    const sessions = new Map();
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)((0, node_path_1.join)(home, 'sessions'));
+    }
+    catch {
+        names = [];
+    }
+    for (const name of names) {
+        if (!name.endsWith('.json'))
+            continue;
+        try {
+            const raw = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(home, 'sessions', name), 'utf8'));
+            if (!raw.state || (raw.closedAt !== undefined && raw.closedAt !== null))
+                continue;
+            const state = raw.state;
+            if (typeof state.sessionId !== 'string' || !Number.isFinite(state.lastEventAt))
+                continue;
+            const prior = sessions.get(state.sessionId);
+            if (!prior || state.lastEventAt > prior.lastEventAt) {
+                sessions.set(state.sessionId, { ...state, tokensByActiveMinute: new Map(state.tokensByActiveMinute) });
+            }
+        }
+        catch { /* Ignore malformed or foreign session files, as status does. */ }
+    }
+    // Include this admission, even when its transcript has no new usage yet.
+    // Replacing by ID prevents double counting the caller's persisted snapshot.
+    sessions.set(current.sessionId, { ...current, lastEventAt: now });
+    return [...sessions.values()];
+}

package/dist/src/state/reservations.js

@@ -69,6 +69,7 @@ class ReservationStore {
     /** Acquire the lock or throw. Callers must fail closed on throw. */
     acquire() {
         const deadline = Date.now() + LOCK_WAIT_MS;
+        let attempt = 0;
         for (;;) {
             try {
                 (0, node_fs_1.mkdirSync)(this.lockDir, { mode: 0o700 });
@@ -90,7 +91,10 @@ class ReservationStore {
                 if (Date.now() > deadline) {
                     throw new Error('AgentGuard could not acquire the reservation lock; failing closed.');
                 }
-                sleepSync(LOCK_SPIN_MS);
+                // Hundreds of waiters polling together can starve the holder. Spread
+                // retries with bounded backoff while retaining the existing deadline.
+                const backoff = Math.min(250, LOCK_SPIN_MS * 2 ** Math.min(attempt++, 4));
+                sleepSync(Math.min(Math.max(1, deadline - Date.now()), backoff * (0.5 + Math.random() / 2)));
             }
         }
     }

package/dist/src/status.js

@@ -68,6 +68,12 @@ function renderHostHealth(hosts) {
         else
             state = `installed, hook command ok  (${h.file.replace(process.env.HOME ?? '', '~')})`;
         lines.push(`  ${name.padEnd(13)} ${state}`);
+        if (h.host === 'codex' && h.installed && h.commandExists) {
+            // Codex requires a one-time trust of each hook source. We cannot see
+            // whether it has been granted, and an untrusted hook stalls codex exec
+            // the first time it would fire, so say it every time.
+            lines.push(`  ${''.padEnd(13)} trust it once: open codex, run /hooks, trust the AgentGuard hook. Until then codex exec stalls when a spawn would be gated.`);
+        }
     }
     return lines.join('\n');
 }

package/fixtures/codex-0.151.0-pretooluse.json

@@ -1,9 +1,9 @@
 {
-  "captured_from": "codex-cli 0.151.0, 2026-09-03, codex exec with -c hooks.PreToolUse inline; --dangerously-bypass-hook-trust",
+  "captured_from": "Synthetic identifiers; payload shape based on codex-cli 0.151.0 PreToolUse, 2026-09-03",
   "payloads": [
     {
-      "session_id": "01a069d3-5fc8-7470-8c95-1b42e7206746",
-      "turn_id": "01a069d3-6018-7523-a26e-eea10123676c",
+      "session_id": "00000000-0000-7000-8000-000000000001",
+      "turn_id": "00000000-0000-7000-8000-000000000011",
       "transcript_path": "/Users/example/.codex/sessions/2026/09/03/rollout-example.jsonl",
       "cwd": "/Users/example/project",
       "hook_event_name": "PreToolUse",
@@ -13,11 +13,11 @@
       "tool_input": {
         "command": "echo CANARY_OK"
       },
-      "tool_use_id": "call_NmxrZob0I2KFC8ChNe2PduGX"
+      "tool_use_id": "call_SYNTHETIC000000000000001"
     },
     {
-      "session_id": "01a069d4-d356-73b3-9440-1c4440319de8",
-      "turn_id": "01a069d4-d3b2-7593-85ec-8a0281f51bf1",
+      "session_id": "00000000-0000-7000-8000-000000000002",
+      "turn_id": "00000000-0000-7000-8000-000000000012",
       "transcript_path": "/Users/example/.codex/sessions/2026/09/03/rollout-example.jsonl",
       "cwd": "/Users/example/project",
       "hook_event_name": "PreToolUse",
@@ -28,11 +28,11 @@
         "message": "<redacted>",
         "fork_context": "<redacted>"
       },
-      "tool_use_id": "call_oktUPQ5jcosNPOcGnEaWqRcv"
+      "tool_use_id": "call_SYNTHETIC000000000000002"
     },
     {
-      "session_id": "01a069d4-d356-73b3-9440-1c4440319de8",
-      "turn_id": "01a069d4-d3b2-7593-85ec-8a0281f51bf1",
+      "session_id": "00000000-0000-7000-8000-000000000002",
+      "turn_id": "00000000-0000-7000-8000-000000000012",
       "transcript_path": "/Users/example/.codex/sessions/2026/09/03/rollout-example.jsonl",
       "cwd": "/Users/example/project",
       "hook_event_name": "PreToolUse",
@@ -43,7 +43,7 @@
         "targets": "<redacted>",
         "timeout_ms": "<redacted>"
       },
-      "tool_use_id": "call_RK95A6i4UUhTigIGXF24gMMO"
+      "tool_use_id": "call_SYNTHETIC000000000000003"
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentguard-run/burn",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Local runaway-agent circuit breaker for AI coding agents and local model runtimes. One policy across Claude Code, Cursor, Codex, Ollama, vLLM, LM Studio and raw orchestrators: detects fan-out storms and sustained token burn, blocks the next spawn, and proves what happened with content-free signed receipts. Nothing leaves the machine.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",