@coreplane/switchboard 1.267.1 → 1.267.3

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -95,6 +95,7 @@ import {
   SEED_MARKER,
   SEED_RESTORE_MAX_MS,
   SEED_ABANDONED_RESTORE_WAIT_MS,
+  seedDoorRemote,
   seedFixupScript,
   seedMarkerText,
   type RestorePhases,
@@ -451,12 +452,25 @@ export class SwitchboardSandbox extends Sandbox<Env> {
         detail: `presigned R2 transfer needs ${transfer.missing.join(", ")}`,
       };
     }
+    let doorRemote: string;
+    try {
+      doorRemote = seedDoorRemote(envVars.GIT_DOOR_ORIGIN ?? "", seed.slug);
+    } catch {
+      return { seeded: false, reason: "seed-failed", detail: "Git door origin unavailable", step: "fixup" };
+    }
     // The marker names the seed this container carries — the handle and the
     // ref and head checked out: the same seed again is the run's second
     // request (a retry, a re-attach), and a restore over the live tree would
     // destroy the run's work; a seed naming another ref is a new seed.
     const marker = await this.runRoot(["cat", SEED_MARKER], 30_000);
     if (marker.exitCode === 0 && marker.stdout.trim() === seedMarkerText(seed)) {
+      const origin = await this.runRoot(
+        ["git", "-C", SEED_CHECKOUT_DIR, "remote", "set-url", "origin", doorRemote],
+        30_000,
+        envVars,
+      );
+      if (origin.exitCode !== 0)
+        return { seeded: false, reason: "seed-failed", detail: "seed origin refresh failed", step: "fixup" };
       const head = await this.runRoot(["git", "-C", SEED_CHECKOUT_DIR, "rev-parse", "HEAD"], 30_000);
       return {
         seeded: true,
@@ -490,14 +504,15 @@ export class SwitchboardSandbox extends Sandbox<Env> {
       t = systemClock();
       const script = seedFixupScript({
         slug: seed.slug,
+        doorOrigin: envVars.GIT_DOOR_ORIGIN ?? "",
         ref: seed.ref,
         ...(seed.fetchRef ? { fetchRef: seed.fetchRef } : {}),
         ...(seed.fetchSha ? { fetchSha: seed.fetchSha } : {}),
         checkoutDir: SEED_CHECKOUT_DIR,
         ...(seed.depsBackupId ? { depsDir: SEED_DEPS_STAGING_DIR } : {}),
       });
-      // The fix-up's fetch authenticates through the image's credential helper
-      // with the exec env's GH_TOKEN — the same channel every command uses.
+      // The fix-up's fetch authenticates through the door-scoped helper using
+      // the run bearer in the command environment.
       const fix = await this.runRoot(["bash", "-c", script], SEED_FIXUP_TIMEOUT_MS, envVars);
       if (fix.exitCode !== 0) throw new Error(`fix-up exited ${fix.exitCode}: ${tail(fix.stderr || fix.stdout)}`);
       steps.fixup = systemClock() - t;

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.267.1",
+  "version": "1.267.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.267.1",
+      "version": "1.267.3",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21023,7 +21023,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.267.1",
+      "version": "1.267.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",
@@ -21053,7 +21053,7 @@
       "dependencies": {
         "@nuxt/ui": "^4.11.0",
         "@pierre/diffs": "1.4.2",
-        "@vueuse/core": "^14.4.0",
+        "@vueuse/core": "^15.0.0",
         "vue": "^3.5.42",
         "vue-router": "^5.3.1"
       },
@@ -21076,6 +21076,53 @@
       "engines": {
         "node": ">=22"
       }
+    },
+    "web/node_modules/@vueuse/core": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-15.0.0.tgz",
+      "integrity": "sha512-Zv67h5mrk7YHDJsRObx+DXaCBz6RKBUpxqLesJ+3xZNPG6yuQs7ja7kg3veFrrouYLWAqydQ7CwGEbLVxB43Ng==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/web-bluetooth": "^0.0.21",
+        "@vueuse/metadata": "15.0.0",
+        "@vueuse/shared": "15.0.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "vue": "^3.5.0"
+      }
+    },
+    "web/node_modules/@vueuse/core/node_modules/@vueuse/shared": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-15.0.0.tgz",
+      "integrity": "sha512-vbNXhGrbV53xPOMSyOzMHQRvhMgZf7oNDw2RChUetVxwTIEkInQ1joZ9JbT0G3z2n2AJNjvmCWeM9ySYrnvogA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "vue": "^3.5.0"
+      }
+    },
+    "web/node_modules/@vueuse/metadata": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-15.0.0.tgz",
+      "integrity": "sha512-sfWE5LADAKJ0KnjtGliMdSN8Ij/L7uP6rXIZlgPloAI4zvvefbw6H5Lt7KJA6RqQOYgVqWF5Guj50HHMIzygBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
     }
   }
 }

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.267.1",
+  "version": "1.267.3",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.267.1",
-  "commit": "6382de7f03c465e18b040fd93103afb1dc44d543",
-  "builtAt": "2026-09-28T23:55:40.901Z"
+  "version": "1.267.3",
+  "commit": "deb60c5f49012fb663a5797168b9e02d2ba394a7",
+  "builtAt": "2026-09-29T04:50:34.175Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -306,7 +306,7 @@ SCOPE FIRST — a hard rule, at most 5 tool calls: identify the target repositor
 - Use \`gh search code\` / \`gh api\` for cross-repo lookups; clone at most ONE repo per task.
 
 Workflow for shipping a PR:
-1. Clone the repo into the workspace if it's not already there (use gh or git; both are authenticated on this host). Orient with a few BATCHED commands (tree + the relevant files in one call), not file-by-file exploration.
+1. Clone the repo into the workspace if it is not already there: \`gh repo clone <owner/name>\` or \`git clone "$GIT_DOOR_REMOTE"\` for the bound repository. A private \`github.com\` clone URL cannot use the run bearer. Orient with a few BATCHED commands (tree + the relevant files in one call), not file-by-file exploration.
 2. Create a branch with a descriptive name.
 3. Implement the change. Match the surrounding code's style and conventions.
 4. Prove the change with the cheapest checks that can (CHECKS BY COST below): the linter and the tests nearest the files you touched, the documentation checks for a documentation change.
@@ -628,7 +628,7 @@ You cannot run commands, clone repositories, edit code, or review pull requests,
 // preset, not a directive.
 const EXPLORE_SYSTEM = `You are Switchboard's explore agent: a long, read-only investigation of a repository, answering a request from Slack.
 
-You work in a fresh sandbox with a shell (bash), read_file, and a read-scoped GitHub credential: git and gh are authenticated for reads, so clone the target repository into your workspace first (\`gh repo clone <owner/name>\` or \`git clone\`; check out the ref the request names), install what you need and run whatever the investigation calls for — builds, test suites, benchmarks, \`act\`. ${SANDBOX_TOOLCHAIN} You cannot push. Your other tools: \`web_search\` and \`web_fetch\` (sources and pages), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repos at any ref), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — and \`list_skills\` / \`use_skill\`.
+You work in a fresh sandbox with a shell (bash), read_file, and a read-scoped GitHub credential: clone the bound repository first with \`gh repo clone <owner/name>\` or \`git clone "$GIT_DOOR_REMOTE"\`, then check out the ref the request names. A private \`github.com\` clone URL cannot use the run bearer. Install what you need and run whatever the investigation calls for — builds, test suites, benchmarks, \`act\`. ${SANDBOX_TOOLCHAIN} You cannot push. Your other tools: \`web_search\` and \`web_fetch\` (sources and pages), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repos at any ref), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — and \`list_skills\` / \`use_skill\`.
 
 THE DELIVERABLE IS A CLAIM TABLE. Turn the request into the claims it makes or asks about — explicit ones ("the suite runs in 4 minutes") and the implicit ones a careful engineer would check — and verify each one by running it, not by reading about it. One row per claim: the claim, the exact command you ran to check it, the number or output it produced, and a verdict (holds / does not hold / could not check — and why). Numbers over adjectives: measure a duration, count the failures, quote the version. Say what you did not get to.
 

package/dist/assets/src/core/budgets.ts

@@ -21,6 +21,8 @@ export const SECOND_MS = 1_000;
 export const secondsToMs = (seconds: number): number => seconds * SECOND_MS;
 
 export const MINUTE_MS = 60_000;
+/** Allow the run's ending to release its resident workspace after its budget ends. */
+export const RUN_REGISTRATION_GRACE_MS = MINUTE_MS;
 
 /** Minutes → milliseconds, for a duration a request names in minutes (a drain's
  *  length): the multiplication lives here so no other file holds it. */

package/dist/assets/src/core/publicationPush.ts

@@ -15,14 +15,19 @@ const refName = (s: string): boolean =>
   /^[a-zA-Z0-9_/-]+(?:\.[a-zA-Z0-9_/-]+)*$/.test(s) && !s.includes("..") && !s.startsWith("-");
 const shortRef = (s: string): string => s.replace(/^refs\/heads\//, "");
 
+/** Broad enough to count competing Git config pushes; leasedPushCommand
+ * separately proves whether one selected call is authorized evidence. */
+export const mentionsGitPush = (command: string): boolean => /\bgit(?:\s+-c\s+\S+)*\s+push\b/.test(command);
+
 /** Deliberately not a shell interpreter. Only a standalone literal push can
  * attest its result: pipelines, scripts, substitutions and compound commands
  * cannot prove which operation produced stdout or the successful exit. */
 export function leasedPushCommand(command: string): { ref: string; expectedHeadSha: string } | undefined {
   if (command.length >= COMMAND_CAP) return;
   const literal = command.replace(/[ \t]+2>&1[ \t]*$/, "");
-  if (!/^git push\s/.test(literal) || /[\n\r'"`$;|<>\\&]/.test(literal)) return;
-  const words = literal.trim().split(/\s+/).slice(2);
+  const prefix = /^git(?: -c http\.postBuffer=[0-9]+)? push\s/.exec(literal);
+  if (!prefix || /[\n\r'"`$;|<>\\&]/.test(literal)) return;
+  const words = literal.slice(prefix[0].length).trim().split(/\s+/);
   const leases = words.filter((w) => w.startsWith("--force-with-lease="));
   if (leases.length !== 1) return;
   const lease = /^--force-with-lease=refs\/heads\/([^:]+):([a-f0-9]{40})$/.exec(leases[0]!);
@@ -42,13 +47,14 @@ export function pairedPublicationPush(
   binding: ExistingPrPublicationBinding,
   head: string,
   callId?: string,
+  gitDoorBaseUrl?: string,
 ): PushEvent | undefined {
   if (!fullSha(head) || !fullSha(binding.expectedHeadSha) || head === binding.expectedHeadSha) return;
   const calls = events.filter(
     (e): e is Extract<RunEvent, { type: "tool_call" }> =>
       e.type === "tool_call" &&
       e.tool === "bash" &&
-      (callId === undefined ? /\bgit\s+push\b/.test(e.command ?? e.summary) : e.callId === callId),
+      (callId === undefined ? mentionsGitPush(e.command ?? e.summary) : e.callId === callId),
   );
   if (calls.length !== 1) return;
   const call = calls[0]!;
@@ -76,20 +82,36 @@ export function pairedPublicationPush(
   )
     return;
   let lines = result.output.trim().split(/\r?\n/);
-  const tracking = `branch '${binding.publicationRef}' set up to track 'origin/${binding.publicationRef}'.`;
+  const tracking = [
+    `branch '${binding.publicationRef}' set up to track 'origin/${binding.publicationRef}'.`,
+    `Branch '${binding.publicationRef}' set up to track remote branch '${binding.publicationRef}' from 'origin'.`,
+  ];
   if (
     /(?:^|\s)(?:-u|--set-upstream)(?:\s|$)/.test(call.command) &&
-    lines.filter((line) => line === tracking).length === 1
+    lines.filter((line) => tracking.includes(line)).length === 1
   )
-    lines = lines.filter((line) => line !== tracking);
+    lines = lines.filter((line) => !tracking.includes(line));
   if (lines.length !== 2) return;
-  const remote = /^To (?:https:\/\/github\.com\/|git@github\.com:|github\.com:)([^\s]+?)(?:\.git)?$/.exec(lines[0]!);
+  const githubRemote = /^To (?:https:\/\/github\.com\/|git@github\.com:|github\.com:)([^\s]+?)(?:\.git)?$/.exec(
+    lines[0]!,
+  );
+  let doorRemote: string | undefined;
+  if (gitDoorBaseUrl !== undefined) {
+    try {
+      doorRemote = `${new URL(gitDoorBaseUrl).origin}/git/${binding.repo}`;
+    } catch {
+      return;
+    }
+  }
+  const remoteMatches =
+    doorRemote === undefined
+      ? githubRemote?.[1]?.toLowerCase() === binding.repo.toLowerCase()
+      : lines[0] === `To ${doorRemote}` || lines[0] === `To ${doorRemote}.git`;
   const update = /^\s*\+?\s*([a-f0-9]{7,40})(\.{2,3})([a-f0-9]{7,40})\s+(\S+) -> (\S+)( \(forced update\))?$/.exec(
     lines[1]!,
   );
   if (
-    !remote ||
-    remote[1]!.toLowerCase() !== binding.repo.toLowerCase() ||
+    !remoteMatches ||
     !update ||
     !binding.expectedHeadSha.startsWith(update[1]!) ||
     !head.startsWith(update[3]!) ||

package/dist/assets/src/core/runEvents.ts

@@ -1142,7 +1142,15 @@ export type RunEvent =
        *  `model` is the ref the run uses, resolved from a model the person
        *  named in plain words (the plain-words model unit) — applied at
        *  directive precedence. Additive: unknown → no model. */
-      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; repo?: string; confirmed?: true }>;
+      binds?: ReadonlyArray<{
+        line: string;
+        reason: string;
+        model?: string;
+        repo?: string;
+        /** The admissible fact behind the model's typed repo choice. */
+        repoSource?: "request" | "attachment" | "thread" | "channel";
+        confirmed?: true;
+      }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */
@@ -1160,6 +1168,14 @@ export type RunEvent =
        * boundary. Its refusal text is always the cause-owned renderer. */
       providerFailure?: ProviderFailureCause;
       attempts?: ReadonlyArray<{ outcome: "accepted" | "violation"; violation?: string }>;
+      /** Snapshot of the factual repository context the operator received. */
+      repoContext?: {
+        organization: string;
+        threadRepo?: string;
+        channelRepo?: string;
+        candidateStatus: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+        candidateCount: number;
+      };
       intake?: { verdict: string; reason: string };
       latencyMs?: number;
       outputTokens?: number;

package/dist/assets/src/core/runRecord.ts

@@ -484,7 +484,14 @@ export interface RunOperatorDecision {
   mode: "shadow" | "on";
   outcome: "binds" | "question" | "refusal" | "non_decision";
   reason: string;
-  binds?: { line: string; reason: string; model?: string; repo?: string; confirmed?: true }[];
+  binds?: {
+    line: string;
+    reason: string;
+    model?: string;
+    repo?: string;
+    repoSource?: "request" | "attachment" | "thread" | "channel";
+    confirmed?: true;
+  }[];
   question?: string;
   /** A question's proposed line — what the next turn's "yes" binds. */
   proposal?: string;
@@ -497,6 +504,13 @@ export interface RunOperatorDecision {
   /** The structured seam's attempts (record 0067): what each answer violated,
    *  or that it was accepted. */
   attempts?: { outcome: "accepted" | "violation"; violation?: string }[];
+  repoContext?: {
+    organization: string;
+    threadRepo?: string;
+    channelRepo?: string;
+    candidateStatus: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+    candidateCount: number;
+  };
   intake?: { verdict: string; reason: string };
   latencyMs?: number;
   outputTokens?: number;
@@ -520,6 +534,7 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
             reason: b.reason,
             ...(b.model !== undefined ? { model: b.model } : {}),
             ...(b.repo !== undefined ? { repo: b.repo } : {}),
+            ...(b.repoSource !== undefined ? { repoSource: b.repoSource } : {}),
             ...(b.confirmed ? { confirmed: true as const } : {}),
           })),
         }
@@ -538,6 +553,7 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
           })),
         }
       : {}),
+    ...(e.repoContext ? { repoContext: { ...e.repoContext } } : {}),
     ...(e.intake ? { intake: { verdict: e.intake.verdict, reason: e.intake.reason } } : {}),
     ...(e.latencyMs !== undefined ? { latencyMs: e.latencyMs } : {}),
     ...(e.outputTokens !== undefined ? { outputTokens: e.outputTokens } : {}),

package/dist/assets/src/core/ship/coordinator.ts

@@ -3883,9 +3883,19 @@ function renderUnitReportWithWake(
   const rounds = `${e.reviewRounds} review round${e.reviewRounds === 1 ? "" : "s"}`;
   const prUrl = s.pr?.url;
   const prLine = prUrl ? ` PR: ${prUrl}` : "";
+  const spentCapAction = (): string | undefined => {
+    const cap = s.input.grant?.costCapUsd;
+    if (cap === undefined || s.spendUsd === null || s.spendUsd < cap) return undefined;
+    const next = prUrl
+      ? `If the pull request (${prUrl}) is still open, continue it only under separate authorization, then request review of its exact head. If it has merged, no recovery is needed.`
+      : "If work remains on the saved branch, continue it only under separate authorization, then request review of its exact head.";
+    return `Next action: $${s.spendUsd.toFixed(2)} spent against the original $${cap.toFixed(2)} cost cap; this unit cannot start another child. ${next}`;
+  };
   const nextAction = (checkpoint?: { branch: string; sha: string }): string => {
     if (durableWake)
       return `The unit remains live; a reply in this thread is recorded as its continuation action${prUrl ? ` from the open pull request (${prUrl})` : " from the saved branch state"}.`;
+    const cappedAction = spentCapAction();
+    if (cappedAction !== undefined) return cappedAction;
     const reconcile = checkpoint
       ? `verify \`${checkpoint.sha.slice(0, 7)}\` is on \`${checkpoint.branch}\`, then reconcile the remote branch and pull request if needed`
       : prUrl
@@ -4167,7 +4177,10 @@ function renderUnitReportWithWake(
       ]);
     case "no_verdict":
       if (!shows(verbosity, "verbose"))
-        return `⚠️ No verdict from review round ${e.round.index} — aborted after ${rounds}.${prLine}`;
+        return join([
+          `⚠️ No verdict from review round ${e.round.index} — aborted after ${rounds}.${prLine}`,
+          spentCapAction(),
+        ]);
       return join([
         `⚠️ Review round ${e.round.index} ended without a submitted verdict (budget, refusal, or stop) — ship never converts that into a request for changes, so no findings step ran.`,
         writeUpPointer(s, e.round.kind, s.reviewRunByRound[e.round.index]),

package/dist/assets/src/core/trace/attrs.ts

@@ -45,6 +45,16 @@ export interface AttrDomain {
   refusal: string;
   /** The refusal's cause, from the one code→cause table in src/core/refusal.ts. */
   cause: "request" | "policy" | "system";
+  /** The operator's decision, separate from the request's final outcome. */
+  operatorOutcome: "binds" | "question" | "refusal" | "non_decision";
+  /** Provenance of an accepted typed repository; the slug stays on the run event. */
+  operatorRepoSource: "request" | "attachment" | "thread" | "channel";
+  operatorAttempts: number;
+  operatorRepoCatalog: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+  operatorRepoCandidates: number;
+  /** Final target resolution, separate from the operator's proposed repo. */
+  repoResolution: "skipped" | "resolved" | "rejected" | "unverified" | "conflict" | "unresolved";
+  repoTargetRelation: "not_proposed" | "matched" | "overridden" | "unresolved";
   count: number;
   backend: Backend;
   // run.command
@@ -146,6 +156,11 @@ const IDENTIFIER_KEYS: ReadonlySet<SpanAttrKey> = new Set<SpanAttrKey>([
   "outcome",
   "refusal",
   "cause",
+  "operatorOutcome",
+  "operatorRepoSource",
+  "operatorRepoCatalog",
+  "repoResolution",
+  "repoTargetRelation",
   "command",
   "route",
   "host",
@@ -204,6 +219,13 @@ const ATTR_TYPE: Record<SpanAttrKey, "string" | "number" | "boolean"> = {
   outcome: "string",
   refusal: "string",
   cause: "string",
+  operatorOutcome: "string",
+  operatorRepoSource: "string",
+  operatorAttempts: "number",
+  operatorRepoCatalog: "string",
+  operatorRepoCandidates: "number",
+  repoResolution: "string",
+  repoTargetRelation: "string",
   count: "number",
   backend: "string",
   command: "string",

package/dist/assets/src/core/trace/tracer.ts

@@ -99,6 +99,7 @@ interface SpanInit {
   sinks: SpanSink[];
   startedAt: number | undefined;
   attrs: SpanAttrs | undefined;
+  rootIdentity?: { name: string; runId?: string };
 }
 
 class SpanImpl implements Span {
@@ -109,6 +110,8 @@ class SpanImpl implements Span {
   ended = false;
   private readonly sinks: SpanSink[];
   private readonly rec: SpanRecord;
+  private readonly rootIdentity: { name: string; runId?: string };
+  private readonly isLocalRoot: boolean;
 
   constructor(
     private readonly shared: Shared,
@@ -118,6 +121,8 @@ class SpanImpl implements Span {
     this.parentId = init.parentId;
     this.name = sanitizeSpanName(init.name);
     this.sinks = init.sinks;
+    this.isLocalRoot = init.rootIdentity === undefined;
+    this.rootIdentity = init.rootIdentity ?? { name: this.name, runId: init.attrs?.runId };
     this.rec = {
       traceId: this.traceId,
       spanId: this.id,
@@ -164,6 +169,7 @@ class SpanImpl implements Span {
       sinks: this.sinks,
       startedAt: opts?.startedAt,
       attrs: opts?.attrs,
+      rootIdentity: this.rootIdentity,
     });
     child.emitStart();
     return child;
@@ -177,6 +183,7 @@ class SpanImpl implements Span {
       sinks: this.sinks,
       startedAt: opts.startedAt,
       attrs: opts.attrs,
+      rootIdentity: this.rootIdentity,
     });
     child.emitStart();
     child.endAt(Math.max(opts.startedAt, opts.endedAt), opts.status ?? "ok", opts.errorKind, opts.errorCode);
@@ -196,7 +203,7 @@ class SpanImpl implements Span {
     }
     for (const s of this.sinks) {
       try {
-        s.onEnd(this.record());
+        s.onEnd(this.record(), this.rootIdentity);
       } catch (err) {
         this.shared.warn(
           `[trace] sink onEnd threw for ${this.name}: ${err instanceof Error ? err.message : String(err)}`,
@@ -215,7 +222,7 @@ class SpanImpl implements Span {
     this.rec.status = status ?? this.rec.status ?? "ok";
     for (const s of this.sinks) {
       try {
-        s.onEnd(this.record());
+        s.onEnd(this.record(), this.rootIdentity);
       } catch (err) {
         this.shared.warn(
           `[trace] sink onEnd threw for ${this.name}: ${err instanceof Error ? err.message : String(err)}`,
@@ -239,6 +246,7 @@ class SpanImpl implements Span {
 
   setAttrs(attrs: SpanAttrs): void {
     (this.rec as { attrs: SpanAttrs }).attrs = { ...this.rec.attrs, ...attrs };
+    if (this.isLocalRoot) this.rootIdentity.runId = this.rec.attrs.runId;
   }
 
   record(): SpanRecord {

package/dist/assets/src/core/trace/types.ts

@@ -40,12 +40,23 @@ export interface SpanRecord {
   attrs: SpanAttrs;
 }
 
+/** A live, read-only view of the local root's run identity. Shared by its
+ *  descendants, including late children; changing the root's runId updates
+ *  the view without changing any span record. No span, sink or payload is
+ *  retained here, so a bounded sink can keep it after the root ends. */
+export interface SpanRootIdentity {
+  readonly name: string;
+  readonly runId?: string;
+}
+
 /** Observer of span starts and ends (Observer). Sinks are attached to a root
  *  and inherited by its whole subtree; a throwing sink never reaches traced
  *  code. */
 export interface SpanSink {
   onStart?(span: SpanRecord): void;
-  onEnd(span: SpanRecord): void;
+  /** The tracer supplies root identity separately from the record snapshot;
+   *  synthetic records supplied directly by a caller may omit it. */
+  onEnd(span: SpanRecord, root?: SpanRootIdentity): void;
 }
 
 /** The seam the no-gaps test enters through (Strategy): production is the

package/dist/assets/src/core/trace/workerTrace.ts

@@ -82,9 +82,9 @@ export function refusalFilter(sink: SpanSink): SpanSink {
   const refused = (status: unknown) => status === 401 || status === 403;
   return {
     ...(sink.onStart ? { onStart: (rec) => sink.onStart!(rec) } : {}),
-    onEnd: (rec) => {
+    onEnd: (rec, root) => {
       if (refused(rec.attrs.httpStatus)) return;
-      sink.onEnd(rec);
+      sink.onEnd(rec, root);
     },
   };
 }

package/dist/assets/src/execution/seedPlan.ts

@@ -106,7 +106,7 @@ export type SeedAnswer =
 /** A backup id as the SDK mints it (a UUID: hex and hyphens) — it becomes a
  *  path and a glob on the container, so nothing else may. */
 const BACKUP_ID_RE = /^(?=.*[0-9a-fA-F])[0-9a-fA-F-]{8,64}$/;
-const SLUG_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SLUG_RE = /^(?!\.{1,2}\/)[A-Za-z0-9_.-]+\/(?!\.{1,2}$)[A-Za-z0-9_.-]+$/;
 const SHA_RE = /^[0-9a-f]{40}$/;
 /** A branch name git accepts (`check-ref-format --branch`, in the shape a
  *  Slack thread binds): printable, no leading `-`/`/`/`.`, no `..`, no
@@ -148,8 +148,8 @@ export function parseSeed(v: unknown): { ok: true; seed: SandboxSeed } | { ok: f
  *   1. the tree becomes root's — the archive came from the resident's build
  *      user, and a sandbox runs everything as root, so git would otherwise
  *      refuse the "dubious ownership" and every write would need a chown;
- *   2. origin points at GitHub — the resident's checkout fetched from its
- *      local mirror;
+ *   2. origin points at this run's exact repository on the Git door — the
+ *      resident's checkout fetched from its local mirror;
  *   3. the deps view, when one was restored, replaces whatever `node_modules`
  *      the checkout carries (older snapshots still hold one);
  *   4. the thread's ref is fetched from origin (the credential is the exec
@@ -158,8 +158,17 @@ export function parseSeed(v: unknown): { ok: true; seed: SandboxSeed } | { ok: f
  *      fetch holds it, else at the fetched tip; without a thread ref the
  *      checkout stays on the snapshot's branch;
  *   5. the head is printed last: the answer's `sha`. */
+export function seedDoorRemote(baseUrl: string, slug: string): string {
+  if (!SLUG_RE.test(slug)) throw new Error("seed door remote needs owner/name");
+  const base = new URL(baseUrl);
+  if ((base.protocol !== "https:" && base.protocol !== "http:") || base.username || base.password)
+    throw new Error("seed door remote needs an HTTP origin");
+  return `${base.origin}/git/${slug}.git`;
+}
+
 export function seedFixupScript(input: {
   slug: string;
+  doorOrigin: string;
   ref: string;
   fetchRef?: string;
   fetchSha?: string;
@@ -170,7 +179,7 @@ export function seedFixupScript(input: {
     "set -e",
     `cd ${shellQuote(input.checkoutDir)}`,
     "chown -R 0:0 .",
-    `git remote set-url origin ${shellQuote(`https://github.com/${input.slug}.git`)}`,
+    `git remote set-url origin ${shellQuote(seedDoorRemote(input.doorOrigin, input.slug))}`,
   ];
   if (input.depsDir) {
     lines.push("rm -rf node_modules", `mv ${shellQuote(input.depsDir)} node_modules`);