@brainervirus/workit-pi 8.13.0 → 8.14.0

package/dist/worker.js

@@ -8537,6 +8537,8 @@ var workspaceConfigSchema = object({
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
   trailers: boolean2().optional(),
+  liveSessionGuard: boolean2().optional(),
+  fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -8581,6 +8583,17 @@ var mainCheckouts = new Map;
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
+var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
+var TIER_HOSTS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
 
 // packages/workit-core/src/core/release-tracks.ts
 var KNOWN_FIELDS = new Set([
@@ -8616,6 +8629,23 @@ var NETWORK_FS_TYPES = new Set([
   198183888
 ]);
 var TAIL_BYTES = 64 * 1024;
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
 var OBSERVED_ONLY = new Set([
   "check",
   "merge.unverified",

package/dist/workit.js

@@ -9597,7 +9597,7 @@ function acquireFileLockSync(targetPath, options) {
   }
 }
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import fs5 from "node:fs";
 import path5 from "node:path";
 
@@ -9969,9 +9969,10 @@ function hostSessionFromEnv(env) {
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
 var ISSUED_PER_LEAD = 64;
-var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
+var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
 var hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32);
 var userIssuedRoot = () => path5.join(resolveStateDir(), "issued");
+var userTokenRoot = () => path5.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
   if (cwd === undefined)
     return;
@@ -9994,7 +9995,12 @@ function migrateRepoIssued(cwd) {
       const to = path5.join(userIssuedRoot(), lead);
       fs5.mkdirSync(to, { recursive: true, mode: 448 });
       for (const id of fs5.readdirSync(from)) {
-        fs5.copyFileSync(path5.join(from, id), path5.join(to, id));
+        try {
+          fs5.copyFileSync(path5.join(from, id), path5.join(to, id), fs5.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
         fs5.rmSync(path5.join(from, id), { force: true });
       }
       removeIfEmpty(from);
@@ -10014,21 +10020,71 @@ var removeIfEmpty = (dir) => {
     fs5.rmdirSync(dir);
   } catch {}
 };
+var tokenHash = (token) => createHash3("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
+  const token = randomBytes2(18).toString("base64url");
   try {
     migrateRepoIssued(cwd);
+    const own = hash(issued);
+    const tokens = path5.join(userTokenRoot(), hash(lead));
+    fs5.mkdirSync(tokens, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path5.join(tokens, own), `${tokenHash(token)}
+`, { mode: 384, flag: "wx" });
     const dir = path5.join(userIssuedRoot(), hash(lead));
     fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-    const own = hash(issued);
-    fs5.writeFileSync(path5.join(dir, own), ISSUED_SESSIONS_MARKER);
+    fs5.writeFileSync(path5.join(dir, own), `${ISSUED_SESSIONS_MARKER}
+`, { mode: 384 });
+    pruneIssued(dir, own, tokens);
+    return token;
+  } catch {
+    return null;
+  }
+}
+function pruneIssued(dir, own, tokens) {
+  try {
     const entries = fs5.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD)
       return;
     const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs5.statSync(path5.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
-    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD)) {
       fs5.rmSync(path5.join(dir, name), { force: true });
+      fs5.rmSync(path5.join(tokens, name), { force: true });
+    }
   } catch {}
 }
+var issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
+  migrateRepoIssued(cwd);
+  try {
+    return fs5.readFileSync(path5.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+  } catch {
+    return null;
+  }
+};
+var TOKEN_HASH = /^([0-9a-f]{64})$/mu;
+var issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path5.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs5.readFileSync(path5.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
+};
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
 var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 var SESSION_UNSAFE = /[^A-Za-z0-9_.:@/+-]/g;
 function childSessionId(lead, child) {
@@ -10070,8 +10126,10 @@ var metadataLockSchema = object({
 var FOREIGN_LOCK_TTL_MS = 10 * 60000;
 var UNREADABLE_LOCK_TTL_MS = 30000;
 var RECLAIM_GUARD_TTL_MS = 30000;
-var defaultLockTimeoutMs = 250;
+var IN_PROCESS_LOCK_TIMEOUT_MS = 250;
+var defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
 var defaultLockTimeout = () => defaultLockTimeoutMs;
+var hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS;
 var parseMetadataLock = (raw) => {
   let value;
   try {
@@ -12740,7 +12798,7 @@ import path15 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
 import path14 from "node:path";
 
@@ -13109,6 +13167,8 @@ var workspaceConfigSchema = object({
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
   trailers: boolean2().optional(),
+  liveSessionGuard: boolean2().optional(),
+  fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -13426,24 +13486,39 @@ var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
-var workspaceTrailers = (cwd, dir) => {
+var inheritedSetting = (cwd, dir, has) => {
   let matched;
   try {
     matched = matchRuntimeWorkspace(cwd, dir);
   } catch {
-    return { enabled: true, workspace: null, from: null };
+    return null;
   }
   if (!matched)
-    return { enabled: true, workspace: null, from: null };
+    return null;
   const { selected, matches } = matched;
   const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+};
+var workspaceTrailers = (cwd, dir) => {
+  const found = inheritedSetting(cwd, dir, (entry) => typeof entry.trailers === "boolean");
   return {
-    enabled: source?.trailers !== false,
-    workspace: selected.name,
-    from: source?.name ?? null
+    enabled: found?.source?.trailers !== false,
+    workspace: found?.workspace ?? null,
+    from: found?.source?.name ?? null
   };
 };
+var workspaceLiveSessionGuard = (cwd, dir) => inheritedSetting(cwd, dir, (entry) => typeof entry.liveSessionGuard === "boolean")?.source?.liveSessionGuard !== false;
+var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
+var TIER_HOSTS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
 var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -14289,7 +14364,7 @@ function ledgerPath(cwd) {
   const root = storeRoot(cwd);
   return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
-var newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`;
+var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
   26985,
   20859,
@@ -14339,14 +14414,14 @@ var ledgerLock = {
         return null;
       throw error;
     }
-    const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+    const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
     fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
     if (lockToken(lock) !== token)
       return false;
-    const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
     try {
       fs12.renameSync(lock, tomb);
     } catch {
@@ -14363,7 +14438,7 @@ var ledgerLock = {
   },
   token: lockToken,
   reap(lock, observed) {
-    const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
     try {
       fs12.renameSync(lock, tomb);
     } catch {
@@ -14381,7 +14456,7 @@ var ledgerLock = {
     return false;
   }
 };
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -14439,10 +14514,18 @@ var lastLine = (fd, size) => {
   }
   return null;
 };
+var tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
+};
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs12.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+", 384);
     try {
+      if (process.platform !== "win32")
+        tighten(fd);
       const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
@@ -14537,7 +14620,9 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
+    stat = fs12.statSync(file.value);
     text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
@@ -14557,6 +14642,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -14590,6 +14676,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -14613,7 +14703,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -14641,18 +14732,48 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 function verdictBasis(verdict, current) {
   if (verdict.head && verdict.head === current.head)
     return "fresh";
@@ -14660,7 +14781,7 @@ function verdictBasis(verdict, current) {
     return "carried";
   return "stale";
 }
-var isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded;
+var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 function trailerSessions(cwd, base, head) {
   if (!base || !head || !safeRef(base) || !safeRef(head))
     return [];
@@ -14741,6 +14862,56 @@ var authoredBy = (authors, session) => {
       return true;
   return false;
 };
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
@@ -14751,15 +14922,17 @@ var independenceReasons = (row, authors) => {
     reasons.push("self");
   return reasons;
 };
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -14773,7 +14946,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -14789,7 +14962,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -14819,21 +14993,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -14850,23 +15050,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -21612,27 +21820,231 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
 };
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync6 } from "node:fs";
+import os7 from "node:os";
+import path27 from "node:path";
+
+// packages/workit-core/src/core/live-session.ts
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { createHash as createHash15 } from "node:crypto";
+import fs19 from "node:fs";
+import os6 from "node:os";
 import path26 from "node:path";
+var LIVE_SESSION_TTL_MS = 15 * 60000;
+var HEARTBEAT_EVERY_MS = 30000;
+var liveProbe = {
+  platform: process.platform,
+  run: (args) => spawnSync17("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+  start: (pid) => processStartOf(pid)
+};
+var leadOf = (session) => session.split(":")[0].replace(/-w-.*$/su, "") || session;
+var familyOf = (host) => host.replace(/_(?:cli|desktop)$/u, "");
+var processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var processInfo = (pid) => {
+  try {
+    if (liveProbe.platform === "linux") {
+      const stat = fs19.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+      const command = fs19.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
+    }
+    if (liveProbe.platform === "win32")
+      return null;
+    const match = /^\s*(\d+)\s+(.*)$/su.exec(liveProbe.run(["-o", "ppid=,command=", "-p", String(pid)]));
+    return match ? { ppid: Number(match[1]), command: match[2].trim() } : null;
+  } catch {
+    return null;
+  }
+};
+var WRAPPER = /^(?:\S*\/)?(?:sh|bash|dash|zsh|ash|ksh|fish|env|timeout|npx|npm|bunx|cmd\.exe|pwsh|powershell)(?:\s|$)|launch\.mjs|npx-cli\.js/u;
+var PIDS = new Map;
+var hostPid = (transport) => {
+  if (transport !== "hook-process")
+    return process.pid;
+  const key = `${liveProbe.platform}\x00${process.ppid}`;
+  if (PIDS.has(key))
+    return PIDS.get(key) ?? null;
+  if (liveProbe.platform === "win32") {
+    PIDS.set(key, null);
+    return null;
+  }
+  let pid = process.ppid;
+  for (let hop = 0;hop < 4; hop++) {
+    const info = processInfo(pid);
+    if (!info || !WRAPPER.test(info.command) || info.ppid <= 1)
+      break;
+    pid = info.ppid;
+  }
+  PIDS.set(key, pid);
+  return pid;
+};
+var sessionSafe = (value) => value.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-");
+var liveOwner = (input, transport, env = process.env) => {
+  const session = input.session.id?.trim();
+  if (!session)
+    return null;
+  const leads = new Set([leadOf(sessionSafe(session))]);
+  if (input.session.parentId)
+    leads.add(leadOf(sessionSafe(input.session.parentId)));
+  if (env.WORKIT_PI_WORKER_SESSION && env.WORKIT_SESSION_ID)
+    leads.add(leadOf(sessionSafe(env.WORKIT_SESSION_ID)));
+  return {
+    host: input.host,
+    session: sessionSafe(session),
+    leads: [...leads],
+    pid: () => hostPid(transport)
+  };
+};
+var checkoutOf = (target) => {
+  let dir = path26.resolve(target);
+  while (!fs19.existsSync(dir) && path26.dirname(dir) !== dir)
+    dir = path26.dirname(dir);
+  if (fs19.existsSync(dir) && !fs19.statSync(dir).isDirectory())
+    dir = path26.dirname(dir);
+  const parts = dir.split(path26.sep);
+  const dotGit = parts.lastIndexOf(".git");
+  if (dotGit > 0)
+    dir = parts.slice(0, dotGit).join(path26.sep) || path26.sep;
+  const location = resolveStore(dir);
+  if (location instanceof Error || !location.shared || !location.top)
+    return null;
+  let top = location.top;
+  try {
+    top = fs19.realpathSync.native(top);
+  } catch {}
+  return top;
+};
+var markerFile2 = (top) => path26.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var checkoutKey = (top, platform = process.platform) => {
+  let key = path26.resolve(top);
+  try {
+    key = fs19.realpathSync.native(key);
+  } catch {}
+  return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
+};
+var readMarker = (file) => {
+  try {
+    const value = JSON.parse(fs19.readFileSync(file, "utf8"));
+    if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
+      return null;
+    return {
+      version: 1,
+      session: value.session,
+      leads: Array.isArray(value.leads) ? value.leads.filter((item) => typeof item === "string") : [],
+      host: value.host,
+      pid: typeof value.pid === "number" ? value.pid : null,
+      pidStart: typeof value.pidStart === "string" ? value.pidStart : null,
+      machine: typeof value.machine === "string" ? value.machine : "",
+      checkout: typeof value.checkout === "string" ? value.checkout : "",
+      heartbeatAt: value.heartbeatAt
+    };
+  } catch {
+    return null;
+  }
+};
+var ageOf2 = (marker, now) => now.getTime() - Date.parse(marker.heartbeatAt);
+var isLive = (marker, deps) => {
+  const age = ageOf2(marker, deps.now ?? new Date);
+  if (age > (deps.ttlMs ?? LIVE_SESSION_TTL_MS))
+    return false;
+  if (marker.machine !== (deps.machine ?? os6.hostname()) || marker.pid === null)
+    return true;
+  if (!(deps.alive ?? processAlive)(marker.pid))
+    return false;
+  if (marker.pidStart === null)
+    return true;
+  const start = liveProbe.start(marker.pid);
+  return start === null || start === marker.pidStart;
+};
+var sameLead = (marker, owner) => marker.session === owner.session || owner.leads.some((lead) => lead === marker.session || marker.leads.includes(lead));
+var sameOwner = (marker, owner, machine) => {
+  if (sameLead(marker, owner))
+    return true;
+  if (marker.machine !== machine)
+    return false;
+  const pid = owner.pid();
+  if (pid === null || marker.pid === null || marker.pidStart === null)
+    return familyOf(marker.host) === familyOf(owner.host);
+  return marker.pid === pid;
+};
+var liveConflict = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return null;
+    const file = markerFile2(checkout);
+    const marker = readMarker(file);
+    if (!marker || sameLead(marker, owner) || !isLive(marker, deps))
+      return null;
+    if (sameOwner(marker, owner, deps.machine ?? os6.hostname()))
+      return null;
+    return { marker, file, ageMs: ageOf2(marker, deps.now ?? new Date), checkout };
+  } catch {
+    return null;
+  }
+};
+var claimLiveSession = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return;
+    const file = markerFile2(checkout);
+    const now = deps.now ?? new Date;
+    const machine = deps.machine ?? os6.hostname();
+    const current = readMarker(file);
+    if (current) {
+      const age = ageOf2(current, now);
+      if (sameLead(current, owner) && age >= 0 && age < HEARTBEAT_EVERY_MS)
+        return;
+      if (!sameLead(current, owner) && isLive(current, deps) && !sameOwner(current, owner, machine))
+        return;
+    }
+    const pid = owner.pid();
+    const marker = {
+      version: 1,
+      session: owner.session,
+      leads: owner.leads,
+      host: owner.host,
+      pid,
+      pidStart: pid === null ? null : liveProbe.start(pid),
+      machine,
+      checkout,
+      heartbeatAt: now.toISOString()
+    };
+    fs19.mkdirSync(path26.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    fs19.writeFileSync(temp, JSON.stringify(marker));
+    fs19.renameSync(temp, file);
+  } catch {}
+};
+
+// packages/workit-core/src/hooks/write-gate.ts
 var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path26.resolve(file);; dir = path26.dirname(dir)) {
+  for (let dir = path27.resolve(file);; dir = path27.dirname(dir)) {
     try {
-      return path26.join(realpathSync6(dir), rest);
+      return path27.join(realpathSync6(dir), rest);
     } catch {
-      if (path26.dirname(dir) === dir)
-        return path26.resolve(file);
-      rest = rest ? path26.join(path26.basename(dir), rest) : path26.basename(dir);
+      if (path27.dirname(dir) === dir)
+        return path27.resolve(file);
+      rest = rest ? path27.join(path27.basename(dir), rest) : path27.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path26.relative(fold(canonical2(root)), fold(canonical2(path26.resolve(cwd, file))));
-  if (relative.startsWith("..") || path26.isAbsolute(relative))
+  const relative = path27.relative(fold(canonical2(root)), fold(canonical2(path27.resolve(cwd, file))));
+  if (relative.startsWith("..") || path27.isAbsolute(relative))
     return true;
-  const posix = relative.split(path26.sep).join("/");
+  const posix = relative.split(path27.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -21730,7 +22142,7 @@ var shellWrites = (command) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path26.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path27.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -21768,7 +22180,218 @@ var gateFor = (cwd) => {
     cache2.delete(cache2.keys().next().value);
   return gate;
 };
-function writeGate(cwd, paths) {
+var MUTATING_GIT = new Set([
+  "add",
+  "am",
+  "apply",
+  "checkout",
+  "cherry-pick",
+  "clean",
+  "commit",
+  "merge",
+  "mv",
+  "pull",
+  "rebase",
+  "reset",
+  "restore",
+  "revert",
+  "rm",
+  "stash",
+  "switch"
+]);
+var DRY_N = new Set(["add", "clean", "rm", "mv"]);
+var MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
+var DIR_TARGET = ".workit-live-target";
+var OVERRIDE = "WORKIT_LIVE_SESSION=override";
+var inert = (args, sub) => args.some((arg) => arg === "--help" || arg === "-h" || arg === "--dry-run" || DRY_N.has(sub) && /^-[a-zA-Z]*n[a-zA-Z]*$/.test(arg) && !arg.startsWith("--"));
+var gitMutationDirs = (cwd, command, dialect) => {
+  let invocations;
+  try {
+    invocations = rawInvocations(command, dialect);
+  } catch {
+    return [];
+  }
+  return invocations.flatMap((invocation) => {
+    if (invocation.tool !== "git" || invocation.dir === undefined)
+      return [];
+    const at = invocation.args.findIndex((arg) => !arg.startsWith("-"));
+    const sub = invocation.args[at] ?? "";
+    const rest = invocation.args.slice(at + 1);
+    if (!MUTATING_GIT.has(sub) || inert(rest, sub))
+      return [];
+    if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
+      return [];
+    return [path27.resolve(cwd, invocation.dir ?? ".")];
+  });
+};
+var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
+var PUSHD2 = new Set(["pushd", "push-location"]);
+var POPD2 = new Set(["popd", "pop-location"]);
+var cdInto = (dir, words) => {
+  const target = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
+  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
+    return;
+  return target === undefined ? os7.homedir() : path27.resolve(dir, target);
+};
+var quoteWord = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
+var segmentTargets = (cwd, command, dialect) => {
+  const targets = [];
+  let dir = cwd;
+  let stack = [];
+  const groups = [];
+  const at = (file) => path27.isAbsolute(file) ? file : dir === undefined ? null : path27.resolve(dir, file);
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.group === "open") {
+      groups.push({ dir, stack: [...stack] });
+      continue;
+    }
+    if (segment.group === "close") {
+      const saved = groups.pop();
+      if (saved)
+        ({ dir, stack } = saved);
+      continue;
+    }
+    const lead = segment.words.findIndex((word) => !/^\w+=/.test(word));
+    const words = lead < 0 ? [] : segment.words.slice(lead);
+    const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+    if (CD2.has(name)) {
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (PUSHD2.has(name)) {
+      stack.push(dir);
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (POPD2.has(name)) {
+      dir = stack.length ? stack.pop() : undefined;
+      continue;
+    }
+    for (const file of segment.redirects)
+      if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    const edits = editsOf(segment.words);
+    if (edits === null) {
+      if (dir !== undefined)
+        targets.push(path27.join(dir, DIR_TARGET));
+    } else
+      for (const file of edits) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
+      targets.push(path27.join(dir, DIR_TARGET));
+  }
+  return targets;
+};
+var overridden = (command, dialect) => {
+  const segments = segmentsOf(command, dialect);
+  if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
+    return false;
+  const words = segments[0].words;
+  const lead = words.findIndex((word) => !/^\w+=/.test(word));
+  return lead > 0 && words.slice(0, lead).includes(OVERRIDE);
+};
+var HOST_LABELS = {
+  claude_code: "Claude Code",
+  opencode: "OpenCode",
+  codex_cli: "Codex CLI",
+  codex_desktop: "Codex Desktop",
+  cursor: "Cursor",
+  pi: "Pi"
+};
+var ageText = (ms) => {
+  const seconds = Math.max(0, Math.round(ms / 1000));
+  return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)} min`;
+};
+var liveDeny = ({ marker, checkout, ageMs, file }) => {
+  const unblock = `Work in your own worktree (\`git worktree add <path> -b <branch>\`, or \`workit fanout worktree create <slice>\`). Only if the user confirms that session is finished: release it with \`rm '${file}'\`, or prefix one command with ${OVERRIDE}.`;
+  return {
+    kind: "deny",
+    reason: `workit live-session guard: ${checkout} belongs to another live agent session, ${HOST_LABELS[marker.host] ?? marker.host} session ${marker.session}${marker.pid === null ? "" : ` (pid ${marker.pid})`}, last active ${ageText(ageMs)} ago. Do not edit a checkout another session is working in; read-only commands stay allowed. ${unblock}`,
+    unblock
+  };
+};
+var guarded = (targets) => {
+  const seen = new Set;
+  return targets.filter((target) => {
+    const dir = path27.dirname(target);
+    if (seen.has(dir))
+      return false;
+    seen.add(dir);
+    return true;
+  });
+};
+var liveGate = (owner, targets, deps) => {
+  try {
+    for (const target of guarded(targets)) {
+      const conflict = liveConflict(target, owner, deps);
+      if (conflict && workspaceLiveSessionGuard(conflict.checkout))
+        return liveDeny(conflict);
+    }
+  } catch {}
+  return NONE3;
+};
+var claimAll = (owner, targets, deps) => {
+  for (const target of guarded(targets))
+    claimLiveSession(target, owner, deps);
+};
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path27.resolve(cwd, file)) : [path27.join(cwd, DIR_TARGET)];
+function writeGate(cwd, paths, owner, deps) {
+  if (!owner)
+    return beforeWriteGate(cwd, paths);
+  const targets = liveTargets(cwd, paths);
+  const live = liveGate(owner, targets, deps);
+  if (live.kind !== "none")
+    return live;
+  const decision = beforeWriteGate(cwd, paths);
+  if (decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+function shellGate(cwd, command, owner, dialect = "posix", deps) {
+  const writes = shellWrites(command);
+  let targets = [];
+  if (owner) {
+    try {
+      targets = [
+        ...segmentTargets(cwd, command, dialect),
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path27.join(dir, DIR_TARGET))
+      ];
+    } catch {
+      targets = [];
+    }
+  }
+  if (owner && targets.length) {
+    const live = liveGate(owner, targets, deps);
+    if (live.kind !== "none") {
+      if (!overridden(command, dialect))
+        return live;
+      noteOverride(cwd, owner, command);
+    }
+  }
+  const decision = writes.writes ? beforeWriteGate(cwd, writes.targets) : NONE3;
+  if (owner && targets.length && decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+var noteOverride = (cwd, owner, command) => {
+  try {
+    if (!inWorkitWorkspace(cwd))
+      return;
+    appendHookObserved(cwd, {
+      type: "live_session.override",
+      actor: { host: owner.host, session: owner.session, agentId: null },
+      session: owner.session,
+      command: command.slice(0, 200)
+    });
+  } catch {}
+};
+function beforeWriteGate(cwd, paths) {
   try {
     const gate = gateFor(cwd);
     if (!gate || gate.blockers.length === 0)
@@ -21786,7 +22409,7 @@ function writeGate(cwd, paths) {
   }
 }
 // packages/workit-core/src/hooks/stop.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 var NONE4 = { kind: "none" };
 var QUESTION = /[?？؟](?=[\s*_`"')\]>]*(?:\s|$))|¿/;
 var OFFER = /\b(?:let me know|want me to|should I|shall I|would you like|do you want|if you(?:'d| would) like|may I|can I go ahead)\b/i;
@@ -21807,7 +22430,7 @@ var asksUser = (message) => {
 };
 var short = (sha) => (sha ?? "?").slice(0, 12);
 var gitList = (cwd, args) => {
-  const run = spawnSync17("git", args, {
+  const run = spawnSync18("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -21898,10 +22521,10 @@ function stopObligation(input, descriptor) {
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch))
       return null;
-    const ledger = readLedger(input.cwd);
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok)
       return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(mine.filter((row) => row.type === "commit.recorded").map((row) => typeof row.sha === "string" ? row.sha : row.head).filter((sha) => typeof sha === "string"));
@@ -22240,9 +22863,9 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  if (session)
-    recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;
@@ -22284,8 +22907,7 @@ function handleHook(input, deps) {
       const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE5;
       if (raw.kind === "deny")
         return raw;
-      const writes = usable2(descriptor.events["write.pre"].support) ? shellWrites(event.command) : { writes: false, targets: null };
-      const gate = writes.writes ? writeGate(input.cwd, writes.targets) : NONE5;
+      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
       if (gate.kind === "deny")
         return gate;
       noteRawCommit(input, event.command, postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND);
@@ -22298,7 +22920,7 @@ function handleHook(input, deps) {
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
       return NONE5;
     case "write.pre":
-      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths) : NONE5;
+      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
     case "subagent.start":
       return {
         kind: "context",
@@ -22602,13 +23224,13 @@ var skillPromptNudge = (prompt, ctx) => process.env.WORKIT_PI_WORKER_SESSION ? n
 
 // packages/workit-pi/src/launches.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import os6 from "node:os";
-import path27 from "node:path";
+import os8 from "node:os";
+import path28 from "node:path";
 var launchDir = (root) => {
   const location = resolveStore(root);
-  return location instanceof Error ? null : path27.join(location.dir, "pi-launches");
+  return location instanceof Error ? null : path28.join(location.dir, "pi-launches");
 };
-var fileFor = (dir, workerId) => path27.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
+var fileFor = (dir, workerId) => path28.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
 var recordLaunch = (root, attempt) => {
   const dir = launchDir(root);
   if (!dir)
@@ -22618,7 +23240,7 @@ var recordLaunch = (root, attempt) => {
     writeFileSync3(fileFor(dir, attempt.workerId), JSON.stringify({
       ...attempt,
       pid: process.pid,
-      host: os6.hostname(),
+      host: os8.hostname(),
       at: new Date().toISOString()
     }), { flag: "wx" });
     return true;
@@ -22632,7 +23254,7 @@ var clearLaunch = (root, workerId) => {
     rmSync2(fileFor(dir, workerId), { force: true });
 };
 var alive = (attempt) => {
-  if (attempt.host !== os6.hostname())
+  if (attempt.host !== os8.hostname())
     return true;
   try {
     process.kill(attempt.pid, 0);
@@ -22654,7 +23276,7 @@ var abandonedLaunches = (root) => {
   const found = [];
   for (const name of names) {
     try {
-      const attempt = JSON.parse(readFileSync6(path27.join(dir, name), "utf8"));
+      const attempt = JSON.parse(readFileSync6(path28.join(dir, name), "utf8"));
       if (typeof attempt.workerId === "string" && typeof attempt.session === "string") {
         if (!alive(attempt))
           found.push(attempt);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "8.13.0",
+  "version": "8.14.0",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",

package/skills/workit-fanout/SKILL.md

@@ -25,9 +25,9 @@ ceremony; do it yourself. Workit never spawns agents; you do.
    it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
-   each one finishes. Pick the model from TIER (`references/orchestration.md`).
-   Claude Code: the `implementer` agent; elsewhere first `workit fanout
-   worktree create <slice>`.
+   each one finishes. Model: the brief's `model:` line, else TIER
+   (`references/orchestration.md`). Claude Code: the `implementer` agent;
+   elsewhere first `workit fanout worktree create <slice>`.
 5. **Judge liveness by side effects only:** `workit fanout status` (head age,
    PR, CI, verdict, landed; STUCK past the TIMEBOX). Stop a stuck worker and
    observe that it exited (a timeout is not proof). Removing a worktree drops
@@ -53,7 +53,7 @@ ceremony; do it yourself. Workit never spawns agents; you do.
    status` order, release the worktrees you made, and `workit ledger standing
    clear`. Only you touch topology: workers never rebase, retarget or merge,
    except the integration-tip merge in integration mode. Then ship
-   (read the `workit-ship` skill's SKILL.md and follow it).
+   (read the `workit-ship` skill's SKILL.md and follow it) up to `defaultEndpoint` from `workit grant show`.
 
 ## Example
 

package/skills/workit-fanout/references/orchestration.md

@@ -5,8 +5,10 @@ and fans in. Workit records and checks; the host's own subagents run the work.
 
 ## TIER to model
 
-TIER is a field of each slice and of its brief. Map it where the host lets you
-pick a model per spawn; nothing in the workspace config routes it.
+TIER is a field of each slice and of its brief. When the workspace sets
+`fanout.tierModels`, the brief has a `model:` line under TIER and `workit
+fanout status` names the model next to each spawnable slice: use that model.
+Without one, map TIER where the host lets you pick a model per spawn:
 
 | TIER | Claude Code (`model` on the Agent call) | Hosts without a per-spawn model |
 | --- | --- | --- |
@@ -72,11 +74,12 @@ Which session id a verdict carries, per host:
 
 - Claude Code: subagents inherit your `WORKIT_SESSION_ID`, so the
   SubagentStart hook names each `verifier` and `reviewer` its own session
-  (`<lead>:<agent id>`), passed exactly as `--session`: the hook records the
-  ids it issues, and only those are accepted. An `implementer` is issued
+  (`<lead>:<agent id>`) and a token only that subagent sees, passed exactly as
+  `--session` and `--token`: the hook records the ids it issues, and only
+  those, with their token, are accepted. An `implementer` is issued
   none: it keeps your id in its env for its workit commands and commits.
 - Codex: the `workit-verifier` and `workit-reviewer` agents get the same
-  issued `--session` from SubagentStart; any other verifier passes
+  issued `--session` and `--token` from SubagentStart; any other verifier passes
   `--as verifier`.
 - OpenCode: a child session's shell already has
   `WORKIT_SESSION_ID=<lead>:<child>`; Pi: a supervised worker's shell has

package/skills/workit-review/SKILL.md

@@ -8,7 +8,7 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent with its own host-derived session: Claude Code and
-Codex, the `reviewer` or `verifier` agent (`--session` from SubagentStart);
+Codex, the `reviewer` or `verifier` agent (`--session` and `--token` from SubagentStart);
 OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
 as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as