@bivy/bivy 0.10.1-staging.347 → 0.10.1-staging.348

package/bin/acp-shim.mjs

@@ -49,6 +49,20 @@ if (!agentCmd) {
   process.exit(2);
 }
 
+// MCP servers to advertise to the ACP agent on session/new and session/load.
+// Bivy passes its configured servers as a JSON array of ACP mcpServer objects
+// (see acpMcpServersFromConfig in src/runtime/index.ts). Forwarding them lets an
+// ACP agent reach the user's MCP tools — previously hardcoded to [] so ACP
+// agents were cut off from MCP entirely. Defaults to none; a malformed value is
+// ignored rather than crashing the shim.
+let mcpServers = [];
+if (process.env.BIVY_ACP_MCP_SERVERS) {
+  try {
+    const parsed = JSON.parse(process.env.BIVY_ACP_MCP_SERVERS);
+    if (Array.isArray(parsed)) mcpServers = parsed;
+  } catch { /* malformed → none */ }
+}
+
 // --- bivy-agent-protocol output (our stdout) --------------------------------
 function bivy(obj) {
   process.stdout.write(`${JSON.stringify(obj)}\n`);
@@ -427,7 +441,7 @@ async function onBivyCommand(msg) {
       case "session.create": {
         await ensureInitialized();
         cwd = String(msg.cwd || msg.workspace || cwd);
-        const res = await agentRequest("session/new", { cwd, mcpServers: [] });
+        const res = await agentRequest("session/new", { cwd, mcpServers });
         sessionId = res?.sessionId ?? res?.session?.id ?? null;
         publishModels(res);
         await applyPendingModel();
@@ -445,13 +459,13 @@ async function onBivyCommand(msg) {
           // hanging the reopen with no watchdog to recover it (resume isn't a
           // "working" turn). On timeout/failure we fall back to a fresh session so
           // the chat still opens instead of spinning on "Fetching transcript…".
-          const res = await agentRequest("session/load", { sessionId: ref, cwd, mcpServers: [] }, { timeoutMs: 30_000 });
+          const res = await agentRequest("session/load", { sessionId: ref, cwd, mcpServers }, { timeoutMs: 30_000 });
           sessionId = res?.sessionId ?? ref;
           publishModels(res);
         } catch {
           // Agent doesn't support session/load (or it timed out) — start fresh so
           // the chat still opens.
-          const res = await agentRequest("session/new", { cwd, mcpServers: [] });
+          const res = await agentRequest("session/new", { cwd, mcpServers });
           sessionId = res?.sessionId ?? null;
           publishModels(res);
         }

package/bin/bivy.mjs

@@ -30,7 +30,7 @@ import path from "node:path";
 import readline from "node:readline";
 import { StringDecoder } from "node:string_decoder";
 import { spawn, spawnSync } from "node:child_process";
-import { randomBytes, createCipheriv, createDecipheriv, randomUUID } from "node:crypto";
+import { randomBytes, createCipheriv, createDecipheriv, randomUUID, createHash, verify as cryptoVerify } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import vm from "node:vm";
 import { selectStaleSessions, sessionActivityMs } from "./prune-sessions.mjs";
@@ -4310,10 +4310,11 @@ async function runUpdate(args = []) {
 // be running. Decisions + metadata only; never tool payloads.
 function cmdAudit(args = []) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log("Usage: bivy audit [--session <id>] [--kind <kind>] [--limit <n>] [--json]\n\nShow the node's governance audit trail (tool-call decisions, …).");
+    console.log("Usage: bivy audit [--session <id>] [--kind <kind>] [--limit <n>] [--json] [--verify]\n\nShow the node's governance audit trail (tool-call decisions, …).\n  --verify  recompute the tamper-evidence hash chain and check signatures.");
     return;
   }
   const file = path.join(appDir, "audit", "audit.jsonl");
+  if (args.includes("--verify")) { cmdAuditVerify(file, args.includes("--json")); return; }
   let raw;
   try { raw = fs.readFileSync(file, "utf8"); }
   catch { console.log("No audit events recorded yet."); return; }
@@ -4336,6 +4337,62 @@ function cmdAudit(args = []) {
   }
 }
 
+// Verify the audit trail's tamper-evidence chain (moat #1, phase 2A). Mirrors
+// src/audit/integrity.ts (canonicalize / chainHash / verifyAuditChain) so the
+// check runs with no daemon and no TS toolchain — integrity.ts stays the source
+// of truth; keep the two in sync.
+function auditCanonicalize(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map((v) => auditCanonicalize(v)).join(",")}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${auditCanonicalize(value[k])}`).join(",")}}`;
+}
+function auditChainHash(prev, entry) {
+  return createHash("sha256").update(`${prev}\n${auditCanonicalize(entry)}`).digest("hex");
+}
+function cmdAuditVerify(file, asJson) {
+  let raw;
+  try { raw = fs.readFileSync(file, "utf8"); }
+  catch { console.log("No audit events recorded yet."); return; }
+  let pub;
+  try { pub = fs.readFileSync(path.join(path.dirname(file), "audit-key.pub.pem"), "utf8"); } catch { pub = undefined; }
+  const lines = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+  let prev = "", expectedSeq, started = false;
+  let unprotectedPrefix = 0, verified = 0, signaturesVerified = 0;
+  let brokenAt, reason;
+  for (let i = 0; i < lines.length && brokenAt === undefined; i++) {
+    let parsed;
+    try { parsed = JSON.parse(lines[i]); } catch { brokenAt = i + 1; reason = "unparseable line"; break; }
+    const { prev: linePrev, hash, sig, ...entry } = parsed;
+    if (hash === undefined) {
+      if (started) { brokenAt = i + 1; reason = "unchained line inside chained region"; break; }
+      unprotectedPrefix++; continue;
+    }
+    started = true;
+    if (linePrev !== prev) { brokenAt = i + 1; reason = "prev-hash linkage broken (reordered or deleted entry)"; break; }
+    if (auditChainHash(prev, entry) !== hash) { brokenAt = i + 1; reason = "hash mismatch (entry was edited)"; break; }
+    if (expectedSeq !== undefined && entry.seq !== expectedSeq) { brokenAt = i + 1; reason = "seq gap (entry inserted or removed)"; break; }
+    expectedSeq = (entry.seq ?? 0) + 1;
+    if (sig !== undefined && pub) {
+      const good = cryptoVerify(null, Buffer.from(hash, "hex"), pub, Buffer.from(sig, "base64"));
+      if (!good) { brokenAt = i + 1; reason = "signature invalid (forged entry)"; break; }
+      signaturesVerified++;
+    }
+    prev = hash; verified++;
+  }
+  const ok = brokenAt === undefined;
+  const result = { ok, total: lines.length, unprotectedPrefix, verified, signaturesVerified, ...(ok ? {} : { brokenAt, reason }) };
+  if (asJson) { console.log(JSON.stringify(result, null, 2)); process.exitCode = ok ? 0 : 1; return; }
+  if (ok) {
+    const noun = verified === 1 ? "entry" : "entries";
+    console.log(c.green(`✓ audit trail intact — ${verified} chained ${noun} verified${pub ? `, ${signaturesVerified} signed` : " (unsigned: no public key found)"}.`));
+    if (unprotectedPrefix) console.log(c.dim(`  (${unprotectedPrefix} legacy pre-chain line(s) at the start are unprotected.)`));
+  } else {
+    console.log(c.red(`✗ audit trail FAILED verification at line ${brokenAt}: ${reason}`));
+    process.exitCode = 1;
+  }
+}
+
 // Print the update log (default: the tail; `-f`/`--follow` streams new output).
 // After a `bivy update` detaches and this terminal reconnects, this is how you
 // confirm the background update succeeded.

package/dist/approval.js

@@ -22,6 +22,12 @@ export class ApprovalManager {
     list() {
         return [...this.history, ...[...this.pending.values()].map((p) => p.request)];
     }
+    /** Unanswered approvals for a session. Carried into a fork bundle so a move
+     *  DISCLOSES them (they belong to the source runtime's turn and can't replay
+     *  across a fork) rather than silently dropping the pending decision. */
+    pendingFor(sessionId) {
+        return [...this.pending.values()].map((p) => p.request).filter((r) => r.sessionId === sessionId);
+    }
     async request(input) {
         const request = {
             id: randomUUID(),

package/dist/audit/index.js

@@ -16,10 +16,17 @@
 //
 // Pure fs leaf: imports nothing from the kernel; the daemon constructs one
 // AuditLog and hands `record` to the guardian / egress / approval seams.
+//
+// TAMPER-EVIDENCE (phase 2A): when built with a signer, every appended line is
+// hash-chained and signed (see ./integrity.ts), so truncation, reordering, and
+// edits become detectable via `verifyAuditChain`. The chain is stamped as extra
+// fields (`seq`/`prev`/`hash`/`sig`), which readers below ignore, so it is fully
+// backward-compatible with pre-chain audit files.
 import fs from "node:fs";
 import path from "node:path";
+import { chainEntry, readChainState } from "./integrity.js";
 /** Build the node's audit log under `<dir>/audit.jsonl` (dir created lazily). */
-export function createAuditLog(dir) {
+export function createAuditLog(dir, opts = {}) {
     const file = path.join(dir, "audit.jsonl");
     let ensured = false;
     let successfulWrites = 0;
@@ -27,6 +34,9 @@ export function createAuditLog(dir) {
     let cachedSignature = "";
     let cachedStorage = "missing";
     let cachedCorruptLines = 0;
+    // Resume the hash chain from the file's tail so a daemon restart continues it
+    // rather than forking a fresh chain (which would read as a truncation).
+    const chain = readChainState(file);
     return {
         file,
         record(event) {
@@ -35,7 +45,8 @@ export function createAuditLog(dir) {
                     fs.mkdirSync(dir, { recursive: true });
                     ensured = true;
                 }
-                fs.appendFileSync(file, `${JSON.stringify({ ts: Date.now(), ...event })}\n`);
+                const line = chainEntry(chain, { ts: Date.now(), ...event }, opts.signer);
+                fs.appendFileSync(file, `${JSON.stringify(line)}\n`);
                 successfulWrites += 1;
                 cachedSignature = "";
             }

package/dist/audit/integrity.js

@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Audit-trail INTEGRITY (governance moat, phase 2A). Turns the append-only
+// JSONL audit stream from "append-only by convention" into a tamper-EVIDENT
+// record, so a receipt can move from "observation report" toward "attestation".
+//
+// Two layers, each independently useful:
+//   1. Hash chain (always on). Every entry carries `seq` (monotonic) and `prev`
+//      (the previous entry's hash), and its own `hash` binds them together:
+//      hash = sha256(prev + "\n" + canonical(entry-without-prev/hash/sig)).
+//      This makes truncation, reordering, and in-place edits DETECTABLE by
+//      recomputation — no key required. On its own it does NOT stop an attacker
+//      with filesystem access who simply recomputes the whole chain.
+//   2. Signature (when a signer is configured). Each entry's hash is signed with
+//      the node's Ed25519 audit key. Recomputing the chain now requires the
+//      private key, so a privileged tamper is EVIDENT to anyone holding the
+//      public key. This is the piece that makes the chain unforgeable.
+//
+// This module stays a pure leaf: it imports only node:crypto/fs, exactly like
+// audit/index.ts, so the audit writer can chain without pulling in the kernel.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+/** Deterministic JSON: object keys sorted recursively, so the hash of an entry
+ *  is independent of key insertion order (the verifier re-serializes from a
+ *  parsed line and must land on the exact same bytes the writer hashed). */
+export function canonicalize(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map((v) => canonicalize(v)).join(",")}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`).join(",")}}`;
+}
+/** The three chain fields the writer stamps onto every entry; they are excluded
+ *  from the hashed content (the hash is OVER the event, and BINDS `prev`). */
+export const CHAIN_FIELDS = ["prev", "hash", "sig"];
+/** Compute an entry's chain hash. `entry` is the full event object WITHOUT the
+ *  chain fields (ts + seq + the governance fields). */
+export function chainHash(prev, entry) {
+    return crypto.createHash("sha256").update(`${prev}\n${canonicalize(entry)}`).digest("hex");
+}
+/** Split a persisted line's parsed object into (event, chain). */
+function splitChain(parsed) {
+    const entry = {};
+    let prev;
+    let hash;
+    let sig;
+    for (const [k, v] of Object.entries(parsed)) {
+        if (k === "prev")
+            prev = typeof v === "string" ? v : undefined;
+        else if (k === "hash")
+            hash = typeof v === "string" ? v : undefined;
+        else if (k === "sig")
+            sig = typeof v === "string" ? v : undefined;
+        else
+            entry[k] = v;
+    }
+    return { entry, prev, hash, sig };
+}
+/** Recover the chain head from an existing audit file so a daemon restart
+ *  CONTINUES the chain instead of forking a fresh one (which would look like a
+ *  truncation to the verifier). Best-effort: an empty/absent/legacy file yields
+ *  a genesis state (`seq: 0, prev: ""`). */
+export function readChainState(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return { seq: 0, prev: "" };
+    }
+    const lines = raw.split("\n").filter((l) => l.trim());
+    if (!lines.length)
+        return { seq: 0, prev: "" };
+    const last = lines[lines.length - 1];
+    try {
+        const parsed = JSON.parse(last);
+        const seq = typeof parsed.seq === "number" ? parsed.seq : lines.length - 1;
+        const hash = typeof parsed.hash === "string" ? parsed.hash : "";
+        return { seq: seq + 1, prev: hash };
+    }
+    catch {
+        // Corrupt tail: continue by position, unchained (verifier flags the gap).
+        return { seq: lines.length, prev: "" };
+    }
+}
+/** Stamp `event` with chain (and optional signature) fields, advancing `state`
+ *  in place. Returns the object to serialize as one JSONL line. */
+export function chainEntry(state, event, signer) {
+    // `keyId` is bound INTO the hashed entry (not appended after) so it is covered
+    // by the chain — a key substitution is then a hash mismatch. Only prev/hash/sig
+    // stay outside the hash (see CHAIN_FIELDS / the verifier's splitChain).
+    const entry = { ...event, seq: state.seq, ...(signer ? { keyId: signer.keyId } : {}) };
+    const hash = chainHash(state.prev, entry);
+    const line = { ...entry, prev: state.prev, hash };
+    if (signer)
+        line.sig = signer.sign(hash);
+    state.prev = hash;
+    state.seq += 1;
+    return line;
+}
+/** Recompute the chain over a persisted audit file and report the first break.
+ *  Detects: edited fields (hash mismatch), reordering / deleted middle lines
+ *  (prev linkage break), truncation from the end (only if an external anchor is
+ *  known — see note), and forged entries when signing is in use (bad `sig`). */
+export function verifyAuditChain(file, opts = {}) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return { ok: true, total: 0, unprotectedPrefix: 0, verified: 0, signaturesVerified: 0 };
+    }
+    const lines = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+    let unprotectedPrefix = 0;
+    let verified = 0;
+    let signaturesVerified = 0;
+    let prev = "";
+    let expectedSeq;
+    let started = false;
+    for (let i = 0; i < lines.length; i++) {
+        let parsed;
+        try {
+            parsed = JSON.parse(lines[i]);
+        }
+        catch {
+            return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "unparseable line" };
+        }
+        const { entry, prev: linePrev, hash, sig } = splitChain(parsed);
+        if (hash === undefined) {
+            if (started) {
+                // A chained region can't sprout an unchained hole in the middle.
+                return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "unchained line inside chained region" };
+            }
+            unprotectedPrefix += 1;
+            continue;
+        }
+        started = true;
+        if (linePrev !== prev) {
+            return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "prev-hash linkage broken (reordered or deleted entry)" };
+        }
+        const recomputed = chainHash(prev, entry);
+        if (recomputed !== hash) {
+            return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "hash mismatch (entry was edited)" };
+        }
+        const seq = typeof entry.seq === "number" ? entry.seq : undefined;
+        if (expectedSeq !== undefined && seq !== expectedSeq) {
+            return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "seq gap (entry inserted or removed)" };
+        }
+        expectedSeq = (seq ?? 0) + 1;
+        if (sig !== undefined) {
+            const keyId = typeof entry.keyId === "string" ? entry.keyId : undefined;
+            const pub = keyId ? opts.publicKeys?.[keyId] : undefined;
+            if (pub) {
+                const good = crypto.verify(null, Buffer.from(hash, "hex"), pub, Buffer.from(sig, "base64"));
+                if (!good) {
+                    return { ok: false, total: lines.length, unprotectedPrefix, verified, signaturesVerified, brokenAt: i + 1, reason: "signature invalid (forged entry)" };
+                }
+                signaturesVerified += 1;
+            }
+        }
+        prev = hash;
+        verified += 1;
+    }
+    return { ok: true, total: lines.length, unprotectedPrefix, verified, signaturesVerified };
+}
+function fingerprint(publicKeyPem) {
+    return crypto.createHash("sha256").update(publicKeyPem).digest("hex").slice(0, 16);
+}
+/** Load (or mint, first run) the node's Ed25519 audit key under `dir`. The
+ *  private key is written 0600; the public key + id are returned for anchoring
+ *  in receipts and for the verifier's `publicKeys` map. */
+export function loadOrCreateAuditKey(dir) {
+    const privPath = path.join(dir, "audit-key.pem");
+    const pubPath = path.join(dir, "audit-key.pub.pem");
+    let privateKeyPem;
+    let publicKeyPem;
+    try {
+        privateKeyPem = fs.readFileSync(privPath, "utf8");
+        publicKeyPem = fs.readFileSync(pubPath, "utf8");
+    }
+    catch {
+        const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+        privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+        publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(privPath, privateKeyPem, { mode: 0o600 });
+        fs.writeFileSync(pubPath, publicKeyPem, { mode: 0o644 });
+    }
+    const keyId = fingerprint(publicKeyPem);
+    const privateKey = crypto.createPrivateKey(privateKeyPem);
+    return {
+        keyId,
+        publicKeyPem,
+        signer: {
+            keyId,
+            sign(hashHex) {
+                return crypto.sign(null, Buffer.from(hashHex, "hex"), privateKey).toString("base64");
+            },
+        },
+    };
+}

package/dist/audit/receipt-attest.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Node EVIDENCE attestation (governance moat, phase 2A). A Receipt is projected
+// downstream (web/control-plane) from the payload-free governance evidence the
+// NODE authored (`receiptEvidenceForRun`). This signs that node-authored evidence
+// with the node's audit key — the same key that signs the audit trail — and
+// anchors it to the audit chain head it summarises. Verification proves the node
+// observed exactly these facts and they were not altered in transit, turning the
+// downstream receipt from "observation report" into an attested claim.
+//
+// Deliberately node-only and @bivy/core-free (the daemon never imports the
+// browser-shared core): it signs a canonical serialization of the evidence plus
+// a small header, so any verifier — including a future WebCrypto one in the PWA —
+// can re-derive the exact signed bytes.
+import crypto from "node:crypto";
+import { canonicalize } from "./integrity.js";
+/** The exact bytes that get signed: a canonical serialization of the header
+ *  fields plus the evidence, so sign + verify never drift. */
+function digestOf(header, evidence) {
+    const content = {
+        createdAt: header.createdAt,
+        ...(header.runId ? { runId: header.runId } : {}),
+        ...(header.machineId ? { machineId: header.machineId } : {}),
+        ...(header.auditChainHead ? { auditChainHead: header.auditChainHead } : {}),
+        evidence,
+    };
+    return crypto.createHash("sha256").update(canonicalize(content)).digest("hex");
+}
+/** Sign node-authored governance evidence. */
+export function attestEvidence(evidence, signer, header) {
+    const hash = digestOf(header, evidence);
+    return {
+        evidence,
+        attestation: {
+            alg: "sha256-ed25519",
+            keyId: signer.keyId,
+            hash,
+            sig: signer.sign(hash),
+            createdAt: header.createdAt,
+            ...(header.runId ? { runId: header.runId } : {}),
+            ...(header.machineId ? { machineId: header.machineId } : {}),
+            ...(header.auditChainHead ? { auditChainHead: header.auditChainHead } : {}),
+        },
+    };
+}
+/** Verify attested evidence: re-derive the digest from the evidence + header and
+ *  check the signature against the named public key. Detects any edit to the
+ *  evidence or header (digest mismatch) and a forged/unknown-key signature. */
+export function verifyEvidenceAttestation(attested, publicKeys) {
+    const { evidence, attestation } = attested;
+    if (attestation.alg !== "sha256-ed25519")
+        return { ok: false, reason: `unsupported alg ${attestation.alg}` };
+    const pub = publicKeys[attestation.keyId];
+    if (!pub)
+        return { ok: false, reason: `no public key for keyId ${attestation.keyId}` };
+    const recomputed = digestOf(attestation, evidence);
+    if (recomputed !== attestation.hash)
+        return { ok: false, reason: "digest mismatch (evidence or header was edited)" };
+    const good = crypto.verify(null, Buffer.from(attestation.hash, "hex"), pub, Buffer.from(attestation.sig, "base64"));
+    return good ? { ok: true } : { ok: false, reason: "signature invalid" };
+}

package/dist/audit/receipt-evidence.js

@@ -53,7 +53,7 @@ export function receiptEvidenceForRun(events, storageReadable, context) {
             profile: context.profile,
             controller: context.controller,
             ...(context.agentVersion ? { agentVersion: context.agentVersion } : {}),
-            modelVersionStatus: "unknown",
+            modelVersionStatus: context.modelVersion ? "available" : "unknown",
         },
         protection: {
             effective: {

package/dist/repo-workspace.js

@@ -215,6 +215,29 @@ export async function resolveAdoptBaseRef(repoDir, branch) {
         return resolveDefaultBaseRef(repoDir);
     }
 }
+/**
+ * Whether the source branch is actually present on the remote this node cloned
+ * from — i.e. whether a cross-node ADOPT can carry the source's committed work.
+ * When false, adopting would silently base off the destination's DEFAULT branch
+ * and drop every source commit (see resolveAdoptBaseRef's fallback), so fork
+ * stand-up uses this to refuse rather than lose work. Fetches first so a branch
+ * pushed after the clone is still seen.
+ */
+export async function originBranchPresent(repoDir, branch) {
+    // A transient fetch failure shouldn't crash the fork; fall back to whatever
+    // remote-tracking refs the clone already has.
+    try {
+        await fetchOrigin(repoDir);
+    }
+    catch { /* offline / no remote — check local refs */ }
+    try {
+        await exec("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `origin/${branch}`], { cwd: repoDir });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Resolve the best base for a same-node fork without assuming the source branch
  * ref still exists. Prefer the live source checkout because it preserves its

package/dist/runtime/acp-mcp.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Translate Bivy's MCP config (a name->spec MAP, the shape Claude/Gemini/generic
+// hosts use) into the ARRAY of ACP mcpServer objects that ACP's session/new and
+// session/load expect (phase 3A). The ACP shim (bin/acp-shim.mjs) reads the
+// serialized result from BIVY_ACP_MCP_SERVERS and forwards it — previously it
+// hardcoded `[]`, cutting ACP agents off from MCP (including Bivy's own tools
+// server). Pure + unit-tested so the mapping can't silently regress.
+function envToAcp(env) {
+    if (!env)
+        return undefined;
+    const entries = Object.entries(env).map(([name, value]) => ({ name, value: String(value) }));
+    return entries.length ? entries : undefined;
+}
+/** Convert one Bivy server spec to ACP shape. Remote (url) servers pass through
+ *  as an http/sse entry; stdio servers as command/args/env. Returns null for a
+ *  spec that is neither (nothing runnable to advertise). */
+export function acpMcpServer(name, spec) {
+    if (spec.url) {
+        return { name, url: spec.url, type: typeof spec.type === "string" ? spec.type : "http" };
+    }
+    if (spec.command) {
+        const env = envToAcp(spec.env);
+        return { name, command: spec.command, args: spec.args ?? [], ...(env ? { env } : {}) };
+    }
+    return null;
+}
+/** Translate a full Bivy MCP config into the ACP server array. */
+export function acpMcpServersFromConfig(config) {
+    const servers = config?.mcpServers ?? {};
+    const out = [];
+    for (const [name, spec] of Object.entries(servers)) {
+        const mapped = acpMcpServer(name, spec);
+        if (mapped)
+            out.push(mapped);
+    }
+    return out;
+}
+/** Serialize a config to the BIVY_ACP_MCP_SERVERS env value, or undefined when
+ *  there is nothing to advertise (so the shim keeps its empty default). */
+export function serializeAcpMcpEnv(config) {
+    const servers = acpMcpServersFromConfig(config);
+    return servers.length ? JSON.stringify(servers) : undefined;
+}

package/dist/runtime/index.js

@@ -48,6 +48,7 @@ import { grokCredentialPreflight } from "./grok-preflight.js";
 import { ensureGrokAuth } from "./grok-auth.js";
 import { parserFactoryFor } from "./cli-parsers.js";
 import { sandboxTier, sandboxArgsFor } from "../harness/sandbox.js";
+import { serializeAcpMcpEnv } from "./acp-mcp.js";
 import { ProtocolRuntime, protocolRuntimeFromEnv, protocolCommandsFromEnv } from "./protocol.js";
 import { codexSlashCommands, opencodeSlashCommands } from "./slash-commands.js";
 import { withExactCapabilitySurface } from "./types.js";
@@ -646,6 +647,10 @@ function acpShimPath() {
 function acpRuntimeOptions(opts) {
     const slashBehavior = opts.behaviors?.slashCommands;
     const slashCommands = slashBehavior ? SLASH_COMMAND_BEHAVIORS[slashBehavior]() : undefined;
+    // Forward Bivy's configured MCP servers to the ACP agent (3A): the shim reads
+    // BIVY_ACP_MCP_SERVERS and advertises them on session/new — previously it sent
+    // [], so ACP agents couldn't reach MCP (including Bivy's own tools server).
+    const acpMcpEnv = serializeAcpMcpEnv(opts.mcpConfig);
     return {
         id: opts.id,
         displayName: opts.displayName,
@@ -655,6 +660,7 @@ function acpRuntimeOptions(opts) {
         // the FIRST session (before the shim's hello lands); the hello confirms them.
         capabilities: { toolInterception: true, resume: true },
         resumable: true,
+        ...(acpMcpEnv ? { env: { BIVY_ACP_MCP_SERVERS: acpMcpEnv } } : {}),
         // An ACP-promoted opencode still surfaces/expands its on-disk commands (the
         // ACP handshake doesn't carry them); a bare ACP agent has none.
         ...(slashCommands ? { slashCommands } : {}),

package/dist/server.js

@@ -16,6 +16,8 @@ import { SessionRerouteController } from "./policy/session-reroute.js";
 import { activeRulesetFor } from "./runtime/ruleset-store.js";
 import { createRulesetController } from "./controllers/rulesets.js";
 import { createAuditLog, readAuditEvents } from "./audit/index.js";
+import { loadOrCreateAuditKey, readChainState } from "./audit/integrity.js";
+import { attestEvidence } from "./audit/receipt-attest.js";
 import { receiptEvidenceForRun } from "./audit/receipt-evidence.js";
 import { createWorkspaceController } from "./controllers/workspaces.js";
 import { createModelController } from "./controllers/models.js";
@@ -83,7 +85,7 @@ import { checkDiskAdmission } from "./harness/disk-admission.js";
 import { sandboxTier, setConfiguredSandboxTier, normalizeSandboxTier } from "./harness/sandbox.js";
 import { setConfiguredAutoAttachToolImages } from "./harness/tool-image-attachments.js";
 import { injectMcpProxyForSession, injectBivyToolsForSession } from "./harness/mcp-inject.js";
-import { parseRepo, isGitHubSlugPart, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, ghCliInstalled, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, resolveAdoptBaseRef, resolveForkBaseRef, fetchOrigin } from "./repo-workspace.js";
+import { parseRepo, isGitHubSlugPart, inferGitHubRepoFromWorkspace, isSharedCloneRoot, resolveGitHubToken, ghCliInstalled, cloneOrUpdateRepo, resolveDefaultBaseRef, resolveBranchBaseRef, resolveAdoptBaseRef, resolveForkBaseRef, originBranchPresent, fetchOrigin } from "./repo-workspace.js";
 import { configureGitAuth, writeGitCredentialEndpoint } from "./git-auth.js";
 import { GitHubTaskPoller, resolveGitHubTaskConfig, buildTaskPrompt, buildResumePrompt, buildInteractiveResumePrompt, DEFAULT_ISSUE_INSTRUCTIONS, parseBivyDirectives, commitAll, pushBranch, mergeBaseIntoBranch, completeMerge, abortMerge, findOpenPullRequestForBranch, findPullRequestsForBranch, findMergedPullRequestForBranch, issueBranchName, getPullRequest, commentIssueOnce, listOpenLabelledIssues, selectActionableIssues, getIssue, getIssueCommentBody, addLabel, removeLabel, announcePickup, } from "./github-tasks.js";
 import { buildLinearTaskPrompt, getLinearIssue, linearBranchName } from "./linear-tasks.js";
@@ -340,7 +342,11 @@ const approvals = new ApprovalManager();
 // governance events Bivy already intercepts — tool-call decisions today,
 // network/approval events next — attributed per session + agent, queryable via
 // `bivy audit`. Distinct from the per-session transcript (session/event-log.ts).
-const auditLog = createAuditLog(path.join(appDir, "audit"));
+// Every entry is hash-chained and signed with the node's Ed25519 audit key
+// (loaded/minted under <appDir>/audit) so the trail is tamper-evident and
+// `bivy audit --verify` can prove it — the basis of an attested Receipt (2A).
+const auditKey = loadOrCreateAuditKey(path.join(appDir, "audit"));
+const auditLog = createAuditLog(path.join(appDir, "audit"), { signer: auditKey.signer });
 // Bivy owns the AskUserQuestion → question-card feature at the guardian layer,
 // runtime-agnostically (see src/question.ts). The manager holds every pending
 // clarifying question across sessions; the guardian interceptor below raises
@@ -3072,7 +3078,7 @@ const RELAY_COMMANDS = {
             // When the client has already picked a target agent, pass it so the
             // bundle omits the native payload for a cross-runtime fork (it could
             // never be replayed there — see buildForkBundle). Unset => keep it.
-            const bundle = buildForkBundle({ runtime: getRuntime(rec.runtimeId), sessionFile: rec.sessionFile, record: forkRecord, dirtyPatch, targetRuntimeId: agentFrom(msg), liveMessages: rec.session.getMessages() });
+            const bundle = buildForkBundle({ runtime: getRuntime(rec.runtimeId), sessionFile: rec.sessionFile, record: forkRecord, dirtyPatch, targetRuntimeId: agentFrom(msg), liveMessages: rec.session.getMessages(), state: forkInFlightState(rec) });
             relay?.sendEvent({ type: "session.fork.bundle", requestId, bundle });
         }
         catch (error) {
@@ -3148,7 +3154,7 @@ const RELAY_COMMANDS = {
                 catch { /* best effort */ }
             }
             // Same runtime → the bundle carries the native payload → full fidelity.
-            const bundle = buildForkBundle({ runtime, sessionFile: rec.sessionFile, record: forkRecord, dirtyPatch, targetRuntimeId: rec.runtimeId, liveMessages: rec.session.getMessages() });
+            const bundle = buildForkBundle({ runtime, sessionFile: rec.sessionFile, record: forkRecord, dirtyPatch, targetRuntimeId: rec.runtimeId, liveMessages: rec.session.getMessages(), state: forkInFlightState(rec) });
             // Cut a fresh fork branch (the source still holds its own); skip prereq
             // detection (same node + same runtime ⇒ agent and repo are present).
             const outcome = await forkStandUp.standUpFork({
@@ -4369,6 +4375,29 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
                         : stage === "no_changes" ? "Run completed with no file changes."
                             : stage === "checks_failed" ? "Deterministic validation checks failed."
                                 : "Execution failed. Detailed diagnostics remain on the node.";
+            // On a terminal event, attest the node-authored governance evidence with
+            // the audit key and anchor it to the current audit chain head — so the
+            // downstream Receipt carries a verifiable node signature (2A), not just an
+            // unsigned projection. Emitted alongside the raw evidence (non-breaking).
+            const receiptEvidence = terminal
+                ? receiptEvidenceForRun(auditEvents, fs.existsSync(auditLog.file), {
+                    profile: record.ephemeral ? "isolated_customer_cloud" : "trusted_workstation",
+                    controller: record.ephemeral ? "bivy_hosted_provisioning" : "customer",
+                    sandboxTier: record.sandbox,
+                    approvalMode: record.approvalMode,
+                    runtimeEnforcement: runtimeInfo?.protectionLevel,
+                    toolInterception: runtimeInfo?.capabilities?.toolInterception === true,
+                    correlation: overrides.correlation,
+                })
+                : undefined;
+            const receiptAttestation = receiptEvidence
+                ? attestEvidence(receiptEvidence, auditKey.signer, {
+                    createdAt: new Date().toISOString(),
+                    runId: overrides.correlation?.runId,
+                    machineId: overrides.correlation?.machineId,
+                    auditChainHead: readChainState(auditLog.file).prev || undefined,
+                }).attestation
+                : undefined;
             void overrides.onEvidence?.({
                 output: { sessionId: record.id, branch, prUrl: typeof extra.prUrl === "string" ? extra.prUrl : undefined },
                 events: [{
@@ -4379,15 +4408,8 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
                         url: typeof extra.prUrl === "string" ? extra.prUrl : undefined,
                         ...(stage === "checks_failed" || stage === "failed" ? { status: "failed" } : {}),
                     }],
-                ...(terminal ? { receiptEvidence: receiptEvidenceForRun(auditEvents, fs.existsSync(auditLog.file), {
-                        profile: record.ephemeral ? "isolated_customer_cloud" : "trusted_workstation",
-                        controller: record.ephemeral ? "bivy_hosted_provisioning" : "customer",
-                        sandboxTier: record.sandbox,
-                        approvalMode: record.approvalMode,
-                        runtimeEnforcement: runtimeInfo?.protectionLevel,
-                        toolInterception: runtimeInfo?.capabilities?.toolInterception === true,
-                        correlation: overrides.correlation,
-                    }) } : {}),
+                ...(receiptEvidence ? { receiptEvidence } : {}),
+                ...(receiptAttestation ? { receiptAttestation, auditPublicKey: { keyId: auditKey.keyId, publicKeyPem: auditKey.publicKeyPem } } : {}),
             });
         }
     };
@@ -6062,6 +6084,18 @@ function forkRecordFor(rec) {
         sandbox: rec.sandbox,
     };
 }
+/** Snapshot the source's in-flight turn/approval state for the fork bundle, so a
+ *  fork/move DISCLOSES a mid-turn session or a pending approval instead of
+ *  silently dropping it (1A). Undefined when there is nothing in flight. */
+function forkInFlightState(rec) {
+    const pendingApprovals = approvals.pendingFor(rec.id).map((r) => ({ toolName: r.toolName, requestId: r.id }));
+    if (!rec.isWorking && pendingApprovals.length === 0)
+        return undefined;
+    return {
+        ...(rec.isWorking ? { working: true } : {}),
+        ...(pendingApprovals.length ? { pendingApprovals } : {}),
+    };
+}
 /** Build the `session.fork.done` event both fork paths emit from a stood-up session. */
 function forkDoneEvent(requestId, record, plan, missing) {
     return {
@@ -8571,6 +8605,7 @@ const forkStandUp = createForkStandUp({
     resolveDefaultBaseRef,
     resolveAdoptBaseRef,
     resolveForkBaseRef,
+    originBranchPresent,
     applyDirtyPatch,
     gitRepoRoot,
     materializeFork,

package/dist/session/fork-matrix.js

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Fork-fidelity CONFORMANCE matrix (phase 1E). The exact fidelity a fork of one
+// agent into another achieves is determined by two capability flags — this
+// derives, for every (source -> destination) pair, the tier the fork will land
+// at, so the runtime support matrix can be GENERATED and regression-tested
+// instead of hand-maintained (and silently drifting from the code).
+//
+// The tier logic here MUST mirror resolveForkFidelity in ./fork.ts — a test
+// (test/fork-matrix.test.ts) drives representative pairs through the real
+// resolveForkFidelity and asserts they agree, so this can't drift from the
+// production decision path.
+/**
+ * Tier a fork of `source` into `dest` achieves:
+ *   - "full"     same runtime, both ends speak native transport (byte-exact);
+ *   - "replayed" the destination can import portable history (true cross-agent
+ *                fork onto a copy of the transcript);
+ *   - "seeded"   otherwise (a continuation prompt).
+ * Mirrors resolveForkFidelity: a native payload is only captured when the SOURCE
+ * has forkTransport and is only importable by the SAME runtime, so "full" ⇔
+ * same id AND both forkTransport.
+ */
+export function forkTier(source, dest) {
+    if (source.id === dest.id && source.forkTransport && dest.forkTransport)
+        return "full";
+    if (dest.forkHistoryImport)
+        return "replayed";
+    return "seeded";
+}
+/** Every ordered (source, dest) pair and its tier. */
+export function forkMatrix(agents) {
+    const cells = [];
+    for (const source of agents) {
+        for (const dest of agents) {
+            cells.push({ source: source.id, dest: dest.id, tier: forkTier(source, dest) });
+        }
+    }
+    return cells;
+}
+const TIER_MARK = { full: "●", replayed: "◑", seeded: "○" };
+/** Render the matrix as a GitHub-flavored markdown table (rows = source,
+ *  columns = destination), with a legend. */
+export function renderForkMatrixMarkdown(agents) {
+    const name = (a) => a.displayName ?? a.id;
+    const header = ["source ↓ / dest →", ...agents.map(name)].join(" | ");
+    const sep = ["---", ...agents.map(() => ":-:")].join(" | ");
+    const rows = agents.map((source) => {
+        const cells = agents.map((dest) => TIER_MARK[forkTier(source, dest)]);
+        return [name(source), ...cells].join(" | ");
+    });
+    return [
+        "<!-- GENERATED by scripts/gen-fork-matrix.ts — do not edit by hand. -->",
+        "# Fork fidelity matrix",
+        "",
+        "Legend: ● full (byte-exact, same runtime) · ◑ replayed (portable history) · ○ seeded (continuation prompt).",
+        "",
+        `| ${header} |`,
+        `| ${sep} |`,
+        ...rows.map((r) => `| ${r} |`),
+        "",
+    ].join("\n");
+}

package/dist/session/fork-prereqs.js

@@ -5,6 +5,9 @@
  * The engine reports what the destination is missing to continue the forked
  * session so the UI can guide the user instead of failing opaquely:
  *   - agent — the target runtime must be installed/available (a HARD blocker).
+ *   - commits — for a cross-node adopt, the source branch must be present on the
+ *     remote, or its committed work can't travel (a HARD blocker: proceeding
+ *     would silently base off the destination default and drop every commit).
  *   - model — the model's provider should have auth on this node (soft: the
  *     runtime can fall back, or the model-auth vault can supply it).
  *   - repo  — the source repo should be reachable (soft: it may be public, or
@@ -25,6 +28,20 @@ export function evaluateForkPrereqs(input) {
         blocking: !input.agent.available,
         ...(input.agent.available ? {} : { fix: "runtime.install" }),
     });
+    if (input.commits) {
+        out.push({
+            kind: "commits",
+            ok: input.commits.present,
+            label: input.commits.branch,
+            detail: input.commits.present
+                ? `Branch "${input.commits.branch}" is on the remote; its commits will travel.`
+                : `Branch "${input.commits.branch}" isn't on the remote, so its commits can't reach this node — push it from the source, then retry (proceeding would drop that work).`,
+            // HARD blocker: silently basing off the destination default would drop the
+            // source's committed work — the exact silent-loss this gate prevents.
+            blocking: !input.commits.present,
+            ...(input.commits.present ? {} : { fix: "source.push" }),
+        });
+    }
     if (input.model) {
         out.push({
             kind: "model",

package/dist/session/fork-standup.js

@@ -19,6 +19,26 @@ import { randomBytes } from "node:crypto";
 import { normalizeSandboxTier } from "../harness/sandbox.js";
 import { parseRepo } from "../repo-workspace.js";
 import { evaluateForkPrereqs, blockingForkPrereqs, missingForkPrereqs } from "../session/fork-prereqs.js";
+/**
+ * A one-line, user-facing disclosure of the source's in-flight state, or
+ * undefined when there is nothing to disclose. Pure so it is unit-testable.
+ */
+export function describeInFlightState(state) {
+    if (!state)
+        return undefined;
+    const pending = state.pendingApprovals?.length ?? 0;
+    const parts = [];
+    if (pending > 0) {
+        const names = (state.pendingApprovals ?? []).map((a) => a.toolName).filter(Boolean).slice(0, 3);
+        const detail = names.length ? ` (${names.join(", ")}${pending > names.length ? ", …" : ""})` : "";
+        parts.push(`${pending} pending tool approval${pending === 1 ? "" : "s"}${detail}`);
+    }
+    if (state.working)
+        parts.push("an unfinished turn");
+    if (!parts.length)
+        return undefined;
+    return `The source session had ${parts.join(" and ")} that couldn't carry into the fork — re-issue the request here if you still need it.`;
+}
 export function createForkStandUp(deps) {
     async function standUpFork(opts) {
         const { bundle, targetRuntimeId } = opts;
@@ -73,6 +93,23 @@ export function createForkStandUp(deps) {
             repoReachable = Boolean(token);
             const repoDir = await deps.cloneOrUpdateRepo({ owner: parsed.owner, repo: parsed.repo, token, root: deps.reposRoot });
             const srcBranch = bundle.record.branch;
+            // Silent-loss gate (1A): a cross-node ADOPT of a branch that never reached
+            // the remote would fall back to the destination's default branch and DROP
+            // every source commit (resolveAdoptBaseRef's degrade path). Detect it and
+            // refuse with an actionable checklist item instead of losing committed work.
+            // Skipped for a same-node fork ("fresh"), which bases off the live source
+            // tip and can't lose commits this way.
+            if (opts.worktree === "adopt" && srcBranch && opts.detectPrereqs) {
+                const branchPresent = await deps.originBranchPresent(repoDir, srcBranch);
+                if (!branchPresent) {
+                    const prereqs = evaluateForkPrereqs({ ...prereqInput, commits: { branch: srcBranch, present: false } });
+                    return {
+                        ok: false,
+                        error: `The source branch "${srcBranch}" isn't on the remote yet, so its commits can't travel to this node. Push it from the source, then retry.`,
+                        missing: missingForkPrereqs(prereqs),
+                    };
+                }
+            }
             // Serialize clone-adjacent worktree ops on this repo so concurrent forks /
             // pickups don't race on `git worktree add` or clobber each other's trees.
             const wt = await deps.withRepoLock(repoDir, async () => {
@@ -146,6 +183,12 @@ export function createForkStandUp(deps) {
         // cleanly, so the fork isn't silently missing work-in-progress.
         if (dirtyWarning)
             deps.broadcast({ type: "session.notice", sessionId: record.id, message: dirtyWarning });
+        // Disclose in-flight state the source had (a mid-turn session, pending tool
+        // approvals) — it belongs to the source runtime's live turn and can't replay
+        // into the fork, so we tell the user rather than silently dropping it (1A).
+        const stateNotice = describeInFlightState(bundle.state);
+        if (stateNotice)
+            deps.broadcast({ type: "session.notice", sessionId: record.id, message: stateNotice });
         await deps.applyRequestedModel(record, targetModel);
         deps.persistSessionMetadata(record);
         deps.scheduleAdvertise();

package/dist/session/fork.js

@@ -41,7 +41,7 @@ export function buildForkBundle(opts) {
             // transcript below still supports replay or a seeded continuation.
         }
     }
-    return { record, normalized, ...(native ? { native } : {}), ...(opts.dirtyPatch ? { dirtyPatch: opts.dirtyPatch } : {}) };
+    return { record, normalized, ...(native ? { native } : {}), ...(opts.dirtyPatch ? { dirtyPatch: opts.dirtyPatch } : {}), ...(opts.state ? { state: opts.state } : {}) };
 }
 /**
  * Decide the best fidelity a fork of `bundle` into `targetRuntime` can achieve:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.347",
+  "version": "0.10.1-staging.348",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",