@dharma-ai-labs/agent-fabric 0.1.27 → 0.2.1

package/dist/index.js

@@ -8,15 +8,15 @@ import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { canonicalize, sha256, validateContract, verifyCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
-import { buildTrajectoryCapsule, redactValue, referencesExcludedPath } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
+import { buildTrajectoryCapsule, redactValue, referencesExcludedPath, trajectoryCapsuleHash } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
 import { assertPolicy, loadOrganizationPolicy, verifyServerAuthorizedPolicy } from '@dharma-ai-labs/agent-fabric-policy';
 import { agyAdapter, claudeAdapter, codexAdapter, providerAdapters } from '@dharma-ai-labs/agent-fabric-provider-adapters';
-import { AgentFabricClient, beginEnrollment, loadOrCreateDeviceIdentity, normalizeHqUrl, pollEnrollment, saveDeviceConfig, } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { AgentFabricClient, beginEnrollment, loadOrCreateDeviceIdentity, normalizeHqUrl, pollEnrollment, deleteActiveSkillAuthorizationAnchor, loadActiveSkillAuthorizationAnchor, loadDeviceEnrollmentAnchor, saveActiveSkillAuthorizationAnchor, isDefinitiveAgentFabricRejection, saveDeviceConfig, saveDeviceEnrollmentAnchor, } from '@dharma-ai-labs/agent-fabric-relay-client';
 import { AgentFabricClient as AgentFabricApiClient } from '@dharma-ai-labs/agent-fabric-sdk';
-import { getActiveSkillBundleId, installSkillBundle, verifySkillBundle } from '@dharma-ai-labs/agent-fabric-skill-manager';
+import { getActiveSkillBundleAuthorization, getExpiredSkillBundleAuthorizationForReplacement, getLegacySkillBundleIdForUpgrade, installSkillBundle, rollbackUnconfirmedSkillBundle, verifySkillBundle } from '@dharma-ai-labs/agent-fabric-skill-manager';
 import { executeTask, FileTaskReceiptStore } from '@dharma-ai-labs/agent-fabric-task-runner';
 import { CLI_USAGE } from './usage.js';
-const VERSION = '0.1.27';
+const VERSION = '0.2.1';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 export function parseCliOptions(args) {
@@ -133,6 +133,21 @@ function evidenceLedgerForPolicyActivation(value, day) {
         throw new Error('Evidence upload ledger is invalid.');
     return newEvidenceUploadLedger(day);
 }
+export async function pathExistsOrThrow(path, check = access) {
+    try {
+        await check(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+export async function canonicalFilesystemPath(path) {
+    return realpath(path);
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 async function pathExists(path) {
     try {
         await access(path);
@@ -223,7 +238,11 @@ async function refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspa
         if (!item)
             throw new Error('Content transmission workspace is not registered locally.');
         const canonicalPolicyPath = resolve(item.path, '.dharma', 'approved-policy.json');
-        if (resolve(policyPath) !== canonicalPolicyPath) {
+        const [providedIdentity, registeredIdentity] = await Promise.all([
+            canonicalFilesystemPath(resolve(policyPath)),
+            canonicalFilesystemPath(canonicalPolicyPath),
+        ]);
+        if (providedIdentity !== registeredIdentity) {
             throw new Error('Content transmission requires the canonical registered workspace policy path.');
         }
         const current = await loadOrganizationPolicy(policyPath);
@@ -236,11 +255,21 @@ async function refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspa
 }
 export function assertCapsuleIntegrity(capsule) {
     const capsuleHash = String(capsule.capsuleHash || '');
-    const { capsuleHash: _capsuleHash, ...unsigned } = capsule;
-    if (!/^sha256:[a-f0-9]{64}$/.test(capsuleHash) || sha256(canonicalize(unsigned)) !== capsuleHash) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(capsuleHash) || trajectoryCapsuleHash(capsule) !== capsuleHash) {
         throw new Error('Trajectory capsule integrity check failed.');
     }
 }
+function trajectoryCapsuleSchemaId(capsule) {
+    const schema = capsule && typeof capsule === 'object' && !Array.isArray(capsule)
+        ? capsule.schema : null;
+    if (schema === 'dharma.trajectory-capsule/v1')
+        return 'https://schemas.dharma-ai.io/trajectory-capsule/v1';
+    if (schema === 'dharma.trajectory-capsule/v2')
+        return 'https://schemas.dharma-ai.io/trajectory-capsule/v2';
+    if (schema === 'dharma.trajectory-capsule/v3')
+        return 'https://schemas.dharma-ai.io/trajectory-capsule/v3';
+    throw new Error('Trajectory capsule schema is unsupported.');
+}
 export function assertCapsuleAuthorizedByCurrentPolicy(capsule, policy) {
     assertPolicy(policy);
     const mode = capsule.automaticDisclosureMode;
@@ -256,6 +285,10 @@ export function assertCapsuleAuthorizedByCurrentPolicy(capsule, policy) {
     const events = Array.isArray(capsule.events) ? capsule.events : [];
     if (mode !== 'customer_authorized_content') {
         const provider = String(capsule.provider || '');
+        const capsuleSchema = String(capsule.schema || '');
+        const captureProvenance = capsule.captureProvenance && typeof capsule.captureProvenance === 'object'
+            && !Array.isArray(capsule.captureProvenance)
+            ? capsule.captureProvenance : {};
         const fixedEventKinds = new Set([
             'user_message', 'agent_message', 'tool_call', 'tool_result', 'command', 'file_read', 'file_write',
             'git', 'validation', 'permission', 'subagent', 'error', 'retry', 'session_state', 'metadata', 'collapsed_output',
@@ -282,9 +315,19 @@ export function assertCapsuleAuthorizedByCurrentPolicy(capsule, policy) {
         const coverage = capsule.coverage && typeof capsule.coverage === 'object' && !Array.isArray(capsule.coverage)
             ? capsule.coverage : {};
         const missingFields = Array.isArray(coverage.missingFields) ? coverage.missingFields : null;
+        const signedTaskCapture = capsuleSchema === 'dharma.trajectory-capsule/v3'
+            && captureProvenance.sourceClass === 'signed_task_execution';
+        const signedTaskBundleIds = [...new Set(events.map((event) => (event && typeof event === 'object' && !Array.isArray(event)
+                ? String(event.skillBundleId || '') : '')).filter(Boolean))];
         if (!['codex', 'claude', 'agy'].includes(provider)
             || !digest.test(String(capsule.sessionId || ''))
-            || capsule.taskId !== null
+            || (signedTaskCapture
+                ? !uuid.test(String(capsule.taskId || ''))
+                    || !digest.test(String(captureProvenance.taskReceiptHash || ''))
+                    || !Number.isFinite(Date.parse(String(captureProvenance.collectedAt || '')))
+                    || signedTaskBundleIds.length !== 1
+                    || !uuid.test(signedTaskBundleIds[0] || '')
+                : capsule.taskId !== null || capsuleSchema === 'dharma.trajectory-capsule/v3')
             || !uuid.test(String(capsule.deviceId || ''))
             || capsule.redactionReceipt === null
             || receipt.policyRevision !== policy.revision
@@ -358,7 +401,8 @@ export function assertCapsuleAuthorizedByCurrentPolicy(capsule, policy) {
                 || !Array.isArray(eventRecord.contentRefs) || eventRecord.contentRefs.length !== 0
                 || source.nativeEventId !== null || source.localLocatorId !== null || source.sourceKind !== eventKind
                 || record.nativeKind !== eventKind
-                || eventRecord.skillBundleId !== null || eventRecord.providerModel !== null) {
+                || eventRecord.skillBundleId !== (signedTaskCapture ? signedTaskBundleIds[0] : null)
+                || eventRecord.providerModel !== null) {
                 throw new Error('Reduced trajectory capsule contains unauthorized event descriptors.');
             }
         }
@@ -694,6 +738,13 @@ export async function withWorkspacePolicyRefreshLock(workspaceId, operation) {
         throw new Error('Content transmission requires a registered workspace ID.');
     return withFileLock(`${workspaceAuthorizationStatePath(workspaceId)}.refresh.lock`, operation, 'Timed out waiting for the workspace policy refresh lock.');
 }
+export async function withWorkspaceSkillActivationLock(workspaceId, provider, operation) {
+    if (!workspaceId || !['codex', 'claude', 'agy'].includes(provider)) {
+        throw new Error('Skill activation lock requires a registered workspace and supported provider.');
+    }
+    const key = createHash('sha256').update(`${workspaceId}:${provider}`).digest('hex');
+    return withFileLock(resolve(dharmaHome(), 'registry', 'skill-activation-locks', `${key}.lock`), operation, 'Timed out waiting for the workspace skill activation lock.');
+}
 async function assertWorkspaceAuthorizationCurrent(workspaceId, authorization, requireExisting = true) {
     const statePath = workspaceAuthorizationStatePath(workspaceId);
     let previous = null;
@@ -1097,16 +1148,36 @@ async function runOrganizationCommand(command, subcommand, flags) {
     if (command === 'remediations' && subcommand === 'list')
         return api.listRemediations();
     if (command === 'remediations' && subcommand === 'act') {
-        requireExplicitConfirmation(flags, 'Changing a repository remediation release');
         const targetId = required(flags, 'target-id');
         const body = await commandJsonBody(flags);
         const action = String(flags.get('action') || body.action || '');
-        if (!['run_backtest', 'link_backtest', 'approve', 'merge_pr', 'release', 'expand', 'rollback'].includes(action)) {
-            throw new Error('Remediation action must be run_backtest, link_backtest, approve, merge_pr, release, expand, or rollback.');
+        if (!['stage_evaluation', 'run_backtest', 'link_backtest', 'approve', 'merge_pr', 'release', 'expand', 'rollback'].includes(action)) {
+            throw new Error('Remediation action must be stage_evaluation, run_backtest, link_backtest, approve, merge_pr, release, expand, or rollback.');
         }
+        if (action === 'stage_evaluation') {
+            const endpointId = String(flags.get('endpoint-id') || body.endpointId || '');
+            if (!UUID_PATTERN.test(endpointId))
+                throw new Error('stage_evaluation requires --endpoint-id with an exact endpoint UUID.');
+            if (flags.get('dry-run') === true) {
+                return {
+                    ok: true,
+                    planned: true,
+                    serverMutation: false,
+                    targetId,
+                    transition: { action, endpointId },
+                };
+            }
+            requireExplicitConfirmation(flags, 'Staging a repository remediation evaluation');
+            return api.transitionRemediationTarget(targetId, { action, endpointId });
+        }
+        requireExplicitConfirmation(flags, 'Changing a repository remediation release');
         return api.transitionRemediationTarget(targetId, {
-            ...body,
             action: action,
+            ...(Array.isArray(body.trajectoryIds) ? { trajectoryIds: body.trajectoryIds.map(String) } : {}),
+            ...(typeof body.campaignId === 'string' ? { campaignId: body.campaignId } : {}),
+            ...(typeof body.establishAutoUpdatePolicy === 'boolean'
+                ? { establishAutoUpdatePolicy: body.establishAutoUpdatePolicy }
+                : {}),
         });
     }
     if (command === 'skills' && subcommand === 'list')
@@ -1198,6 +1269,7 @@ async function login(flags) {
                 serverPublicKeyEd25519: result.serverPublicKeyEd25519, relayUrl: result.relayUrl, enrolledAt: new Date().toISOString(),
             };
             await saveDeviceConfig(configPath(), config);
+            await saveDeviceEnrollmentAnchor({ config });
             await rm(pendingEnrollmentPath(), { force: true });
             return { ok: true, status: 'approved', deviceId: config.deviceId, organizationId: pending.organizationId, relayUrl: config.relayUrl };
         }
@@ -1244,6 +1316,11 @@ async function capture(flags, batch = false) {
     const registered = (await registry()).find((item) => item.path === workspace);
     if (!registered)
         throw new Error('Workspace is not registered locally. Run dharma workspace add.');
+    const captureProvenance = (collectedAt) => ({
+        sourceClass: (typeof root === 'string' ? 'explicit_import' : 'provider_discovery'),
+        collectedAt,
+        taskReceiptHash: null,
+    });
     let policy = await loadVerifiedWorkspacePolicy(policyPath, registered.workspaceId);
     const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
     const fabric = flags.has('sync') ? await client() : null;
@@ -1265,6 +1342,7 @@ async function capture(flags, batch = false) {
             const firstRevision = buildTrajectoryCapsule({
                 organizationId: device.organizationId, deviceId: device.deviceId, workspaceId: registered.workspaceId,
                 session: selected, policy, rawContentId, rawBytes: rawTurn.byteLength, rawKind: 'raw-provider-turn',
+                captureProvenance: captureProvenance(selected.endedAt),
             });
             const latestMetadata = vault.getLatestCapsuleMetadata(firstRevision.trajectoryId);
             const latestCapsule = latestMetadata
@@ -1281,9 +1359,10 @@ async function capture(flags, batch = false) {
                         organizationId: device.organizationId, deviceId: device.deviceId, workspaceId: registered.workspaceId,
                         session: selected, policy, rawContentId, rawBytes: rawTurn.byteLength, rawKind: 'raw-provider-turn',
                         revision: latestMetadata.revision + 1, previousRevisionHash: latestMetadata.capsuleHash,
+                        captureProvenance: captureProvenance(selected.endedAt),
                     })
                     : firstRevision;
-            const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/trajectory-capsule/v1', capsule);
+            const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), trajectoryCapsuleSchemaId(capsule), capsule);
             if (!validation.ok)
                 throw new Error(`Trajectory capsule failed schema validation: ${JSON.stringify(validation.errors)}`);
             if (!latestCapsule || latestCapsule.capsuleHash !== capsule.capsuleHash) {
@@ -1371,6 +1450,11 @@ async function evidencePreview(flags) {
         if (!registered)
             throw new Error('Workspace is not registered locally. Run dharma workspace add.');
         const policy = await loadVerifiedWorkspacePolicy(policyPath, registered?.workspaceId);
+        const captureProvenance = (collectedAt) => ({
+            sourceClass: (typeof root === 'string' ? 'explicit_import' : 'provider_discovery'),
+            collectedAt,
+            taskReceiptHash: null,
+        });
         const capsules = sessions.map((session) => {
             const rawTurn = Buffer.from(`${session.records.map((record) => JSON.stringify(record.native)).join('\n')}\n`);
             return buildTrajectoryCapsule({
@@ -1382,6 +1466,7 @@ async function evidencePreview(flags) {
                 rawContentId: sha256(rawTurn),
                 rawBytes: rawTurn.byteLength,
                 rawKind: 'raw-provider-turn',
+                captureProvenance: captureProvenance(session.endedAt),
             });
         });
         automaticDisclosure = {
@@ -1692,6 +1777,73 @@ async function readDeviceConfig() {
         return null;
     }
 }
+async function activeSkillAuthorization(provider, workspaceId, organizationAgentId, config) {
+    const root = nativeSkillDirectory(provider);
+    const pointer = resolve(root, '.dharma-managed', 'workspaces', workspaceId, 'ACTIVE_BUNDLE');
+    if (!await pathExistsOrThrow(pointer))
+        return null;
+    if (!organizationAgentId)
+        throw new Error('Workspace is not bound to a repository agent. Run dharma workspace sync.');
+    const [identity, enrollment, active] = await Promise.all([
+        loadOrCreateDeviceIdentity({ hqUrl: config.hqUrl, organizationId: config.organizationId }),
+        loadDeviceEnrollmentAnchor({ config }),
+        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider }),
+    ]);
+    if (!active)
+        throw new Error('Active skill state is not anchored in secure storage. Run dharma skill sync again.');
+    if (identity.publicKeyEd25519 !== enrollment.devicePublicKeyEd25519) {
+        throw new Error('Active skill device identity does not match secure enrollment state.');
+    }
+    return getActiveSkillBundleAuthorization({
+        nativeSkillDirectory: root,
+        workspaceId,
+        provider,
+        organizationId: config.organizationId,
+        organizationAgentId,
+        deviceId: config.deviceId,
+        serverPublicKey: createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: enrollment.serverPublicKeyEd25519 },
+            format: 'jwk',
+        }),
+        devicePublicKey: createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: identity.publicKeyEd25519 },
+            format: 'jwk',
+        }),
+        expectedReceiptHash: active.receiptHash,
+    });
+}
+async function expiredSkillAuthorizationForReplacement(provider, workspaceId, organizationAgentId, config) {
+    const root = nativeSkillDirectory(provider);
+    if (!organizationAgentId)
+        throw new Error('Workspace is not bound to a repository agent. Run dharma workspace sync.');
+    const [identity, enrollment, active] = await Promise.all([
+        loadOrCreateDeviceIdentity({ hqUrl: config.hqUrl, organizationId: config.organizationId }),
+        loadDeviceEnrollmentAnchor({ config }),
+        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider }),
+    ]);
+    if (!active)
+        throw new Error('Active skill state is not anchored in secure storage. Run dharma skill sync again.');
+    if (identity.publicKeyEd25519 !== enrollment.devicePublicKeyEd25519) {
+        throw new Error('Active skill device identity does not match secure enrollment state.');
+    }
+    return getExpiredSkillBundleAuthorizationForReplacement({
+        nativeSkillDirectory: root,
+        workspaceId,
+        provider,
+        organizationId: config.organizationId,
+        organizationAgentId,
+        deviceId: config.deviceId,
+        serverPublicKey: createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: enrollment.serverPublicKeyEd25519 },
+            format: 'jwk',
+        }),
+        devicePublicKey: createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: identity.publicKeyEd25519 },
+            format: 'jwk',
+        }),
+        expectedReceiptHash: active.receiptHash,
+    });
+}
 async function loadVerifiedWorkspacePolicy(path, workspaceId) {
     const policy = await loadOrganizationPolicy(path);
     if (policy.evidence.automaticDisclosure?.mode !== 'customer_authorized_content')
@@ -1910,7 +2062,7 @@ async function onboard(flags) {
 async function evidenceSync(flags) {
     const capsule = JSON.parse(await readFile(resolve(required(flags, 'file')), 'utf8'));
     const workspaceId = typeof flags.get('workspace-id') === 'string' ? String(flags.get('workspace-id')) : String(capsule.workspaceId || '');
-    const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/trajectory-capsule/v1', capsule);
+    const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), trajectoryCapsuleSchemaId(capsule), capsule);
     if (!validation.ok)
         throw new Error(`Trajectory capsule failed schema validation: ${JSON.stringify(validation.errors)}`);
     assertCapsuleIntegrity(capsule);
@@ -2125,7 +2277,279 @@ async function runOneEvidenceRequest(flags) {
     const policy = await refreshVerifiedWorkspacePolicyForTransmission(required(flags, 'policy'), workspaceId, fabric);
     return processEvidenceRequest(fabric, policy, workspaceId);
 }
-async function executeOneTask(fabric, policy, leaseSeconds) {
+export function taskReceiptSession(task, receipt, workspace) {
+    return {
+        provider: task.target.provider,
+        sessionId: `dharma-task-${task.taskId}`,
+        sourcePath: 'dharma-task-receipt',
+        workspace,
+        coverage: 'observed',
+        startedAt: receipt.startedAt,
+        endedAt: receipt.completedAt,
+        records: receipt.commandResults.map((result, index) => ({
+            native: {
+                taskId: task.taskId,
+                commandId: result.commandId,
+                exitCode: result.exitCode,
+                signal: result.signal,
+                timedOut: result.timedOut,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                stdoutSha256: result.stdoutSha256,
+                stderrSha256: result.stderrSha256,
+            },
+            sourcePath: 'dharma-task-receipt',
+            line: index + 1,
+            workspace,
+            timestamp: receipt.completedAt,
+            kind: result.commandId.startsWith('provider.') ? 'agent_message' : 'validation',
+            coverage: 'observed',
+        })),
+    };
+}
+function prepareSignedTaskTrajectory(input) {
+    if (!input.activeSkill || input.task.skillBundle?.bundleId !== input.activeSkill.bundleId) {
+        throw new Error('Signed task trajectory requires the active task-pinned skill bundle.');
+    }
+    const session = taskReceiptSession(input.task, input.receipt, input.workspace.path);
+    const rawTurn = Buffer.from(`${session.records.map((record) => JSON.stringify(record.native)).join('\n')}\n`);
+    const rawContentId = sha256(rawTurn);
+    const capsule = buildTrajectoryCapsule({
+        organizationId: input.device.organizationId,
+        deviceId: input.device.deviceId,
+        workspaceId: input.workspace.workspaceId,
+        session,
+        policy: input.policy,
+        rawContentId,
+        rawBytes: rawTurn.byteLength,
+        rawKind: 'raw-provider-turn',
+        taskId: input.task.taskId,
+        captureProvenance: {
+            sourceClass: 'signed_task_execution',
+            collectedAt: input.collectedAt,
+            taskReceiptHash: input.taskReceiptHash,
+        },
+        activeSkillBundleId: input.activeSkill.bundleId,
+        activeSkillBundleActivatedAt: input.activeSkill.activatedAt,
+        activeSkillBundleExpiresAt: input.activeSkill.expiresAt,
+        activeSkillBundleVerifiedAt: input.activeSkillVerifiedAt,
+    });
+    return { capsule, rawTurn, rawContentId, session };
+}
+async function syncSignedTaskTrajectory(input) {
+    const { capsule, rawTurn, rawContentId, session } = input.prepared;
+    const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), trajectoryCapsuleSchemaId(capsule), capsule);
+    if (!validation.ok)
+        throw new Error(`Signed task capsule failed schema validation: ${JSON.stringify(validation.errors)}`);
+    assertCapsuleAuthorizedByCurrentPolicy(capsule, input.policy);
+    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+    const vault = await LocalVault.open({
+        root: resolve(dharmaHome(), 'vault'),
+        masterKey: await loadOrCreateVaultMasterKey(),
+        rawLocalDays: rawLocalRetentionDays(input.policy),
+    });
+    try {
+        const existing = vault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
+        if (!existing) {
+            await vault.commitCapture({
+                raw: { plaintext: rawTurn, kind: 'raw-provider-turn', expectedContentId: rawContentId },
+                capsule: {
+                    plaintext: Buffer.from(JSON.stringify(capsule)), trajectoryId: capsule.trajectoryId,
+                    revision: capsule.revision, capsuleHash: capsule.capsuleHash,
+                },
+                session: {
+                    sessionId: session.sessionId, provider: session.provider, workspaceId: input.workspace.workspaceId,
+                    sourceLocator: session.sourcePath, status: session.coverage, observedAt: session.endedAt,
+                },
+            });
+        }
+        else if (existing.capsuleHash !== capsule.capsuleHash) {
+            throw new Error('Signed task evidence already exists with different immutable content.');
+        }
+        vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
+        await reserveDailyContentUpload(capsule, input.policy);
+        const synced = await input.fabric.syncTrajectory(capsule);
+        vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
+        return synced;
+    }
+    finally {
+        vault.close();
+    }
+}
+export function assertRecoveredTaskWorkspacePolicy(input) {
+    if (input.workspace.workspaceId !== input.recoveryWorkspaceId) {
+        throw new Error('Recovered task completion does not match its registered workspace.');
+    }
+    if (input.policy.organizationId !== input.workspace.organizationId
+        || (input.policy.serverAuthorization
+            && input.policy.serverAuthorization.workspaceId !== input.workspace.workspaceId)) {
+        throw new Error('Recovered task completion policy does not authorize its workspace.');
+    }
+}
+export function recoveredTaskPolicyWasSuperseded(capsule, currentPolicy) {
+    return capsule.redactionReceipt?.policyRevision !== currentPolicy.revision;
+}
+export function assertTaskWorkspacePolicy(input) {
+    if (input.task.workspaceId !== input.workspace.workspaceId
+        || input.task.organizationId !== input.workspace.organizationId
+        || input.policy.organizationId !== input.workspace.organizationId
+        || (input.policy.serverAuthorization
+            && input.policy.serverAuthorization.workspaceId !== input.workspace.workspaceId)) {
+        throw new Error('Task workspace policy does not match the signed task and local registration.');
+    }
+}
+async function stageSignedTaskTrajectoryRecovery(taskId, workspaceId, policy, prepared) {
+    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+    const vault = await LocalVault.open({
+        root: resolve(dharmaHome(), 'vault'),
+        masterKey: await loadOrCreateVaultMasterKey(),
+        rawLocalDays: rawLocalRetentionDays(policy),
+    });
+    try {
+        const recovery = {
+            schema: 'dharma.signed-task-trajectory-recovery/v1', taskId, workspaceId,
+            prepared: {
+                capsule: prepared.capsule,
+                rawTurnBase64: prepared.rawTurn.toString('base64'),
+                rawContentId: prepared.rawContentId,
+                session: prepared.session,
+            },
+        };
+        await vault.stageTaskCompletionRecovery(taskId, Buffer.from(JSON.stringify(recovery)));
+    }
+    finally {
+        vault.close();
+    }
+}
+async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, onlyTaskId) {
+    const completions = fabric.listRecoveredTaskCompletions()
+        .filter((item) => !onlyTaskId || item.taskId === onlyTaskId);
+    const finalized = [];
+    for (const completion of completions) {
+        const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+        const vault = await LocalVault.open({
+            root: resolve(dharmaHome(), 'vault'),
+            masterKey: await loadOrCreateVaultMasterKey(),
+            rawLocalDays: rawLocalRetentionDays(vaultPolicy),
+        });
+        let recovery;
+        try {
+            recovery = await vault.getTaskCompletionRecovery(completion.taskId);
+        }
+        finally {
+            vault.close();
+        }
+        if (!recovery || recovery.schema !== 'dharma.signed-task-trajectory-recovery/v1'
+            || recovery.taskId !== completion.taskId) {
+            throw new Error(`Recovered task completion ${completion.taskId} is missing its encrypted local evidence.`);
+        }
+        const workspace = (await registry()).find((item) => item.workspaceId === recovery.workspaceId);
+        if (!workspace)
+            throw new Error(`Recovered task completion ${completion.taskId} has no registered workspace.`);
+        const recoveryPolicy = await refreshVerifiedWorkspacePolicyForTransmission(resolve(workspace.path, '.dharma', 'approved-policy.json'), recovery.workspaceId, fabric);
+        assertRecoveredTaskWorkspacePolicy({
+            recoveryWorkspaceId: recovery.workspaceId,
+            workspace,
+            policy: recoveryPolicy,
+        });
+        const rawTurn = Buffer.from(recovery.prepared.rawTurnBase64, 'base64');
+        if (recovery.prepared.capsule.taskId !== completion.taskId
+            || recovery.prepared.capsule.workspaceId !== recovery.workspaceId
+            || recovery.prepared.capsule.capsuleHash !== completion.trajectoryCapsuleHash
+            || sha256(rawTurn) !== recovery.prepared.rawContentId) {
+            throw new Error(`Recovered task completion ${completion.taskId} does not match its trajectory capsule.`);
+        }
+        const capsule = {
+            ...recovery.prepared.capsule,
+            captureProvenance: {
+                ...recovery.prepared.capsule.captureProvenance,
+                taskReceiptHash: completion.receiptHash,
+            },
+        };
+        assertCapsuleIntegrity(capsule);
+        if (recoveredTaskPolicyWasSuperseded(capsule, recoveryPolicy)) {
+            const supersededVault = await LocalVault.open({
+                root: resolve(dharmaHome(), 'vault'),
+                masterKey: await loadOrCreateVaultMasterKey(),
+                rawLocalDays: rawLocalRetentionDays(vaultPolicy),
+            });
+            try {
+                const existing = supersededVault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
+                if (!existing) {
+                    await supersededVault.commitCapture({
+                        raw: { plaintext: rawTurn, kind: 'raw-provider-turn', expectedContentId: recovery.prepared.rawContentId },
+                        capsule: {
+                            plaintext: Buffer.from(JSON.stringify(capsule)), trajectoryId: capsule.trajectoryId,
+                            revision: capsule.revision, capsuleHash: capsule.capsuleHash,
+                        },
+                        session: {
+                            sessionId: recovery.prepared.session.sessionId,
+                            provider: recovery.prepared.session.provider,
+                            workspaceId: recovery.workspaceId,
+                            sourceLocator: recovery.prepared.session.sourcePath,
+                            status: recovery.prepared.session.coverage,
+                            observedAt: recovery.prepared.session.endedAt,
+                        },
+                    });
+                }
+                else if (existing.capsuleHash !== capsule.capsuleHash) {
+                    throw new Error('Recovered task evidence already exists with different immutable content.');
+                }
+                supersededVault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'policy_revision_superseded');
+            }
+            finally {
+                supersededVault.close();
+            }
+            await fabric.acknowledgeRecoveredTaskCompletion(completion.taskId, completion.receiptHash);
+            const acknowledgedVault = await LocalVault.open({
+                root: resolve(dharmaHome(), 'vault'),
+                masterKey: await loadOrCreateVaultMasterKey(),
+                rawLocalDays: rawLocalRetentionDays(vaultPolicy),
+            });
+            try {
+                await acknowledgedVault.clearTaskCompletionRecovery(completion.taskId);
+            }
+            finally {
+                acknowledgedVault.close();
+            }
+            finalized.push({
+                taskId: completion.taskId,
+                trajectory: {
+                    ok: false,
+                    status: 'withheld',
+                    reason: 'policy_revision_superseded',
+                    trajectoryId: capsule.trajectoryId,
+                    revision: capsule.revision,
+                },
+            });
+            continue;
+        }
+        const trajectory = await syncSignedTaskTrajectory({
+            fabric, policy: recoveryPolicy, workspace,
+            prepared: {
+                capsule,
+                rawTurn,
+                rawContentId: recovery.prepared.rawContentId,
+                session: recovery.prepared.session,
+            },
+        });
+        await fabric.acknowledgeRecoveredTaskCompletion(completion.taskId, completion.receiptHash);
+        const cleanupVault = await LocalVault.open({
+            root: resolve(dharmaHome(), 'vault'),
+            masterKey: await loadOrCreateVaultMasterKey(),
+            rawLocalDays: rawLocalRetentionDays(vaultPolicy),
+        });
+        try {
+            await cleanupVault.clearTaskCompletionRecovery(completion.taskId);
+        }
+        finally {
+            cleanupVault.close();
+        }
+        finalized.push({ taskId: completion.taskId, trajectory });
+    }
+    return finalized;
+}
+async function executeOneTask(fabric, leaseSeconds) {
     const polled = await fabric.pollTask(leaseSeconds);
     const taskRow = polled.task;
     if (!taskRow?.envelope)
@@ -2134,54 +2558,113 @@ async function executeOneTask(fabric, policy, leaseSeconds) {
     const workspace = (await registry()).find((item) => item.workspaceId === task.workspaceId);
     if (!workspace)
         throw new Error('Task workspace is not registered on this device.');
+    const taskPolicy = await refreshVerifiedWorkspacePolicyForTransmission(resolve(workspace.path, '.dharma', 'approved-policy.json'), workspace.workspaceId, fabric);
+    assertTaskWorkspacePolicy({ task, workspace, policy: taskPolicy });
     const config = JSON.parse(await readFile(configPath(), 'utf8'));
-    if (task.target.deviceId !== config.deviceId)
-        throw new Error('Task target does not match this enrolled device.');
-    const serverPublicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' });
-    const activeBundleId = await getActiveSkillBundleId(nativeSkillDirectory(task.target.provider), task.workspaceId);
+    const waitingHeartbeats = [];
+    const waitingHeartbeat = setInterval(() => {
+        waitingHeartbeats.push(fabric.postTaskEvent(task.taskId, 'lease_extended', {
+            taskId: task.taskId,
+            phase: 'waiting_for_skill_activation_lock',
+        }).catch(() => undefined));
+    }, Math.max(5_000, Math.floor(leaseSeconds * 500)));
     try {
-        assertTaskSkillPin(task.skillBundle, activeBundleId);
+        return await withWorkspaceSkillActivationLock(task.workspaceId, task.target.provider, async () => {
+            if (task.target.deviceId !== config.deviceId)
+                throw new Error('Task target does not match this enrolled device.');
+            const serverPublicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' });
+            const activeSkill = await activeSkillAuthorization(task.target.provider, task.workspaceId, String(workspace.repositoryAgentId || ''), config);
+            const activeBundleId = activeSkill?.bundleId ?? null;
+            try {
+                assertTaskSkillPin(task.skillBundle, activeBundleId);
+            }
+            catch (error) {
+                await fabric.postTaskEvent(task.taskId, 'failed', {
+                    phase: 'preflight',
+                    code: taskSkillPinFailureCode(error),
+                    taskBundleId: task.skillBundle?.bundleId || null,
+                    localBundleId: activeBundleId,
+                }).catch(() => undefined);
+                throw error;
+            }
+            await fabric.postTaskEvent(task.taskId, 'started', {
+                bundleId: task.skillBundle?.bundleId || null,
+                bundleHash: task.skillBundle?.bundleHash || null,
+            });
+            const heartbeats = [];
+            const heartbeat = setInterval(() => {
+                heartbeats.push(fabric.postTaskEvent(task.taskId, 'lease_extended', { taskId: task.taskId }).catch(() => undefined));
+            }, Math.max(15_000, Math.floor(leaseSeconds * 500)));
+            let receipt;
+            try {
+                receipt = await executeTask({
+                    task, policy: taskPolicy, workspace: workspace.path, relayStateDirectory: resolve(dharmaHome(), 'relay'), serverPublicKey,
+                    receiptStore: new FileTaskReceiptStore(resolve(dharmaHome(), 'relay', 'receipts')),
+                });
+            }
+            finally {
+                clearInterval(heartbeat);
+                await Promise.allSettled(heartbeats);
+            }
+            const summary = {
+                status: receipt.status, branch: receipt.branch,
+                response: taskResponsePreview(receipt),
+                commandResults: receipt.commandResults.map(({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 }) => ({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 })),
+                startedAt: receipt.startedAt, completedAt: receipt.completedAt,
+            };
+            const collectedAt = receipt.completedAt;
+            const prepared = receipt.status === 'completed' && task.skillBundle
+                ? prepareSignedTaskTrajectory({
+                    policy: taskPolicy, task, receipt, taskReceiptHash: `sha256:${'0'.repeat(64)}`, collectedAt,
+                    workspace, device: config, activeSkill,
+                    // The receipt is durable and retry-idempotent. Its start time is after
+                    // the first successful local bundle verification, so it is also the
+                    // stable verification timestamp for a recovered trajectory.
+                    activeSkillVerifiedAt: receipt.startedAt,
+                })
+                : null;
+            if (prepared)
+                await stageSignedTaskTrajectoryRecovery(task.taskId, workspace.workspaceId, taskPolicy, prepared);
+            await fabric.postTaskEvent(task.taskId, receipt.status, {
+                ...summary,
+                ...(prepared ? { trajectoryCapsuleHash: prepared.capsule.capsuleHash } : {}),
+            });
+            let trajectory = null;
+            if (receipt.status === 'completed' && task.skillBundle) {
+                const finalized = await finalizeRecoveredSignedTaskTrajectories(fabric, taskPolicy, task.taskId);
+                trajectory = finalized[0]?.trajectory || null;
+                if (!trajectory)
+                    throw new Error('Task completion did not return a recoverable server receipt.');
+            }
+            return { ok: true, taskId: task.taskId, receipt: summary, trajectory };
+        });
     }
     catch (error) {
-        await fabric.postTaskEvent(task.taskId, 'failed', {
-            phase: 'preflight',
-            code: taskSkillPinFailureCode(error),
-            taskBundleId: task.skillBundle?.bundleId || null,
-            localBundleId: activeBundleId,
-        }).catch(() => undefined);
+        if (error instanceof Error && error.message === 'Timed out waiting for the workspace skill activation lock.') {
+            await fabric.postTaskEvent(task.taskId, 'failed', {
+                phase: 'coordination',
+                code: 'skill_activation_lock_timeout',
+            }).catch(() => undefined);
+        }
         throw error;
     }
-    await fabric.postTaskEvent(task.taskId, 'started', {
-        bundleId: task.skillBundle?.bundleId || null,
-        bundleHash: task.skillBundle?.bundleHash || null,
-    });
-    const heartbeats = [];
-    const heartbeat = setInterval(() => {
-        heartbeats.push(fabric.postTaskEvent(task.taskId, 'lease_extended', { taskId: task.taskId }).catch(() => undefined));
-    }, Math.max(15_000, Math.floor(leaseSeconds * 500)));
-    let receipt;
-    try {
-        receipt = await executeTask({
-            task, policy, workspace: workspace.path, relayStateDirectory: resolve(dharmaHome(), 'relay'), serverPublicKey,
-            receiptStore: new FileTaskReceiptStore(resolve(dharmaHome(), 'relay', 'receipts')),
-        });
-    }
     finally {
-        clearInterval(heartbeat);
-        await Promise.allSettled(heartbeats);
-    }
-    const summary = {
-        status: receipt.status, branch: receipt.branch,
-        response: taskResponsePreview(receipt),
-        commandResults: receipt.commandResults.map(({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 }) => ({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 })),
-        startedAt: receipt.startedAt, completedAt: receipt.completedAt,
-    };
-    await fabric.postTaskEvent(task.taskId, receipt.status, summary);
-    return { ok: true, taskId: task.taskId, receipt: summary };
+        clearInterval(waitingHeartbeat);
+        await Promise.allSettled(waitingHeartbeats);
+    }
 }
 async function runOneTask(flags) {
-    const policy = await loadVerifiedWorkspacePolicy(required(flags, 'policy'), typeof flags.get('workspace-id') === 'string' ? String(flags.get('workspace-id')) : undefined);
-    return executeOneTask(await client(), policy, Number(flags.get('lease-seconds') || 120));
+    const policyPath = resolve(required(flags, 'policy'));
+    const requestedWorkspaceId = typeof flags.get('workspace-id') === 'string' ? String(flags.get('workspace-id')) : undefined;
+    const selectedWorkspace = (await registry()).find((item) => (resolve(item.path, '.dharma', 'approved-policy.json') === policyPath
+        && (!requestedWorkspaceId || item.workspaceId === requestedWorkspaceId)));
+    if (!selectedWorkspace)
+        throw new Error('Task policy must be the canonical policy of one registered workspace.');
+    const policy = await loadVerifiedWorkspacePolicy(policyPath, selectedWorkspace.workspaceId);
+    const fabric = await client();
+    const recoveredTaskTrajectories = await finalizeRecoveredSignedTaskTrajectories(fabric, policy);
+    const result = await executeOneTask(fabric, Number(flags.get('lease-seconds') || 120));
+    return recoveredTaskTrajectories.length ? { ...result, recoveredTaskTrajectories } : result;
 }
 export function nativeSkillDirectory(provider, env = process.env, home = homedir()) {
     if (provider === 'codex')
@@ -2272,12 +2755,19 @@ export async function verifyAgentFabricSkillInstallation(input) {
     const repositoryInstalled = await pathExists(repositorySkillPath) && await pathExists(connectionPath);
     const nativeInstalled = await pathExists(nativeSkillPath) && await pathExists(nativeMarkerPath);
     let workspaceId;
+    let organizationAgentId;
     try {
         const connection = JSON.parse(await readFile(connectionPath, 'utf8'));
-        if (typeof connection.workspaceId === 'string')
+        if (typeof connection.workspaceId === 'string') {
             workspaceId = connection.workspaceId;
+            organizationAgentId = (await registry()).find((item) => item.workspaceId === workspaceId)?.repositoryAgentId || undefined;
+        }
     }
     catch { }
+    const config = await readDeviceConfig();
+    const activeBundleId = workspaceId && organizationAgentId && config
+        ? (await activeSkillAuthorization(input.provider, workspaceId, organizationAgentId, config))?.bundleId ?? null
+        : null;
     return {
         provider: input.provider,
         ready: repositoryInstalled && nativeInstalled,
@@ -2287,7 +2777,7 @@ export async function verifyAgentFabricSkillInstallation(input) {
         connectionPath,
         nativeSkillPath,
         workspaceId: workspaceId || null,
-        activeBundleId: workspaceId ? await getActiveSkillBundleId(nativeRoot, workspaceId) : null,
+        activeBundleId,
         activation: 'next_session',
         nextAction: repositoryInstalled && nativeInstalled
             ? `Start a new ${input.provider} session from ${workspace} and invoke the dharma-agent-fabric skill.`
@@ -2359,79 +2849,181 @@ export async function materializeInlineSkillFiles(bundle, sourceRoot) {
     }
     return true;
 }
+export async function recoverLegacySkillBundleIdAfterAuthorizationFailure(input) {
+    const legacyBundleId = await getLegacySkillBundleIdForUpgrade({
+        nativeSkillDirectory: input.nativeSkillDirectory,
+        workspaceId: input.workspaceId,
+    });
+    if (!legacyBundleId)
+        throw input.authorizationError;
+    return legacyBundleId;
+}
+export async function installedBundleIdForSkillPollAfterAuthorizationFailure(input) {
+    await recoverLegacySkillBundleIdAfterAuthorizationFailure(input);
+    return null;
+}
 async function skillSync(flags) {
     const workspaceId = required(flags, 'workspace-id');
     const providerValue = required(flags, 'provider');
     if (!['codex', 'claude', 'agy'].includes(providerValue))
         throw new Error('Skill provider must be codex, claude, or agy.');
     const provider = providerValue;
-    const workspace = (await registry()).find((item) => item.workspaceId === workspaceId);
-    if (!workspace)
-        throw new Error('Skill workspace is not registered locally.');
-    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
-    const destination = nativeSkillDirectory(provider);
-    const fabric = await client();
-    const response = await fabric.pollSkill({
-        workspaceId,
-        provider,
-        installedBundleId: await getActiveSkillBundleId(destination, workspaceId),
-    });
-    const rollout = response.rollout;
-    if (!rollout)
-        return { ok: true, rollout: null, changed: false };
-    if (typeof rollout.id !== 'string' || !rollout.bundle || typeof rollout.bundle !== 'object')
-        throw new Error('Skill rollout response is invalid.');
-    const bundle = rollout.bundle;
-    if (bundle.organizationId !== policy.organizationId || !Array.isArray(bundle.skills)
-        || (bundle.operation === 'install' && bundle.skills.length === 0)
-        || (bundle.operation === 'clear' && bundle.skills.length !== 0)) {
-        throw new Error('Skill bundle does not match local organization policy.');
-    }
-    const commits = [...new Set(bundle.skills.map((skill) => skill.commit))];
-    const repositories = [...new Set(bundle.skills.map((skill) => skill.repository))];
-    if (bundle.operation === 'install') {
-        if (commits.length !== 1 || !/^[a-f0-9]{40,64}$/i.test(commits[0]))
-            throw new Error('Skill bundle must pin one full Git commit.');
-        if (repositories.length !== 1 || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?$/.test(repositories[0])) {
-            throw new Error('Skill bundle must pin one credential-free GitHub repository.');
-        }
-    }
-    const sourceRoot = resolve(dharmaHome(), 'relay', 'skill-sources', bundle.bundleId);
-    const config = JSON.parse(await readFile(configPath(), 'utf8'));
-    verifySkillBundle(bundle, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }));
-    await mkdir(resolve(dharmaHome(), 'relay', 'skill-sources'), { recursive: true, mode: 0o700 });
-    await rm(sourceRoot, { recursive: true, force: true });
-    await mkdir(sourceRoot, { recursive: true, mode: 0o700 });
-    const materializedInline = await materializeInlineSkillFiles(bundle, sourceRoot);
-    if (bundle.operation === 'install' && !materializedInline) {
-        await rm(sourceRoot, { recursive: true, force: true });
-        await execFileAsync('git', ['clone', '--filter=blob:none', '--no-checkout', repositories[0], sourceRoot], { timeout: 120_000 });
-        await execFileAsync('git', ['-C', sourceRoot, 'fetch', '--no-tags', '--depth=1', 'origin', commits[0]], { timeout: 120_000 });
-        await execFileAsync('git', ['-C', sourceRoot, 'checkout', '--detach', commits[0]], { timeout: 30_000 });
-    }
-    try {
-        const identity = await loadOrCreateDeviceIdentity({ hqUrl: config.hqUrl, organizationId: config.organizationId });
-        const receipt = await installSkillBundle({
-            bundle,
-            sourceDirectory: sourceRoot,
-            nativeSkillDirectory: destination,
-            policy,
-            serverPublicKey: createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }),
-            devicePrivateKey: createPrivateKey({ key: identity.privateJwk, format: 'jwk' }),
-            deviceId: config.deviceId,
+    return withWorkspaceSkillActivationLock(workspaceId, provider, async () => {
+        const workspace = (await registry()).find((item) => item.workspaceId === workspaceId);
+        if (!workspace)
+            throw new Error('Skill workspace is not registered locally.');
+        const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+        const destination = nativeSkillDirectory(provider);
+        const fabric = await client();
+        const config = JSON.parse(await readFile(configPath(), 'utf8'));
+        let activeBundleId;
+        try {
+            activeBundleId = (await activeSkillAuthorization(provider, workspaceId, String(workspace.repositoryAgentId || ''), config))?.bundleId ?? null;
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === 'Skill bundle has expired.') {
+                activeBundleId = (await expiredSkillAuthorizationForReplacement(provider, workspaceId, String(workspace.repositoryAgentId || ''), config))?.bundleId ?? null;
+            }
+            else {
+                activeBundleId = await installedBundleIdForSkillPollAfterAuthorizationFailure({
+                    nativeSkillDirectory: destination,
+                    workspaceId,
+                    authorizationError: error,
+                });
+            }
+        }
+        const response = await fabric.pollSkill({
             workspaceId,
             provider,
-            smokeCommandId: typeof flags.get('smoke-command') === 'string' ? String(flags.get('smoke-command')) : undefined,
-            organizationApprovalId: typeof flags.get('approval-id') === 'string' ? String(flags.get('approval-id')) : undefined,
+            installedBundleId: activeBundleId,
         });
-        if (provider === 'agy' && receipt.status === 'active')
-            await activateAgyPlugin();
-        await fabric.postInstallReceipt(bundle.bundleId, rollout.id, receipt);
-        return { ok: true, rolloutId: rollout.id, bundleId: bundle.bundleId, status: receipt.status, changed: true };
-    }
-    finally {
+        const rollout = response.rollout;
+        if (!rollout)
+            return { ok: true, rollout: null, changed: false };
+        if (typeof rollout.id !== 'string' || !rollout.bundle || typeof rollout.bundle !== 'object')
+            throw new Error('Skill rollout response is invalid.');
+        const bundle = rollout.bundle;
+        if (bundle.organizationId !== policy.organizationId || !Array.isArray(bundle.skills)
+            || (bundle.operation === 'install' && bundle.skills.length === 0)
+            || (bundle.operation === 'clear' && bundle.skills.length !== 0)) {
+            throw new Error('Skill bundle does not match local organization policy.');
+        }
+        const commits = [...new Set(bundle.skills.map((skill) => skill.commit))];
+        const repositories = [...new Set(bundle.skills.map((skill) => skill.repository))];
+        if (bundle.operation === 'install') {
+            if (commits.length !== 1 || !/^[a-f0-9]{40,64}$/i.test(commits[0]))
+                throw new Error('Skill bundle must pin one full Git commit.');
+            if (repositories.length !== 1 || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?$/.test(repositories[0])) {
+                throw new Error('Skill bundle must pin one credential-free GitHub repository.');
+            }
+        }
+        const sourceRoot = resolve(dharmaHome(), 'relay', 'skill-sources', bundle.bundleId);
+        verifySkillBundle(bundle, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }));
+        await mkdir(resolve(dharmaHome(), 'relay', 'skill-sources'), { recursive: true, mode: 0o700 });
         await rm(sourceRoot, { recursive: true, force: true });
-    }
+        await mkdir(sourceRoot, { recursive: true, mode: 0o700 });
+        const materializedInline = await materializeInlineSkillFiles(bundle, sourceRoot);
+        if (bundle.operation === 'install' && !materializedInline) {
+            await rm(sourceRoot, { recursive: true, force: true });
+            await execFileAsync('git', ['clone', '--filter=blob:none', '--no-checkout', repositories[0], sourceRoot], { timeout: 120_000 });
+            await execFileAsync('git', ['-C', sourceRoot, 'fetch', '--no-tags', '--depth=1', 'origin', commits[0]], { timeout: 120_000 });
+            await execFileAsync('git', ['-C', sourceRoot, 'checkout', '--detach', commits[0]], { timeout: 30_000 });
+        }
+        try {
+            const previousAnchor = await loadActiveSkillAuthorizationAnchor({
+                config,
+                workspaceId,
+                organizationAgentId: String(workspace.repositoryAgentId || ''),
+                provider,
+            });
+            const identity = await loadOrCreateDeviceIdentity({ hqUrl: config.hqUrl, organizationId: config.organizationId });
+            const receipt = await installSkillBundle({
+                bundle,
+                sourceDirectory: sourceRoot,
+                nativeSkillDirectory: destination,
+                policy,
+                serverPublicKey: createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }),
+                devicePrivateKey: createPrivateKey({ key: identity.privateJwk, format: 'jwk' }),
+                deviceId: config.deviceId,
+                organizationAgentId: String(workspace.repositoryAgentId || ''),
+                workspaceId,
+                provider,
+                smokeCommandId: typeof flags.get('smoke-command') === 'string' ? String(flags.get('smoke-command')) : undefined,
+                organizationApprovalId: typeof flags.get('approval-id') === 'string' ? String(flags.get('approval-id')) : undefined,
+            });
+            const restoreAnchor = async () => {
+                if (previousAnchor) {
+                    await saveActiveSkillAuthorizationAnchor({
+                        config,
+                        workspaceId,
+                        organizationAgentId: previousAnchor.organizationAgentId,
+                        provider,
+                        bundleId: previousAnchor.bundleId,
+                        receiptHash: previousAnchor.receiptHash,
+                        activatedAt: previousAnchor.activatedAt,
+                        expiresAt: previousAnchor.expiresAt,
+                    });
+                }
+                else {
+                    await deleteActiveSkillAuthorizationAnchor({ config, workspaceId, provider });
+                }
+            };
+            const recoverLocalInstallation = async (error) => {
+                const recoveryErrors = [];
+                try {
+                    await rollbackUnconfirmedSkillBundle({
+                        nativeSkillDirectory: destination,
+                        workspaceId,
+                        receipt,
+                    });
+                }
+                catch (rollbackError) {
+                    recoveryErrors.push(rollbackError);
+                }
+                try {
+                    await restoreAnchor();
+                }
+                catch (anchorError) {
+                    recoveryErrors.push(anchorError);
+                }
+                if (recoveryErrors.length) {
+                    throw new AggregateError([error, ...recoveryErrors], 'Skill installation failed and local recovery was incomplete.');
+                }
+                throw error;
+            };
+            try {
+                if (receipt.status === 'active') {
+                    await saveActiveSkillAuthorizationAnchor({
+                        config,
+                        workspaceId,
+                        organizationAgentId: String(workspace.repositoryAgentId || ''),
+                        provider,
+                        bundleId: receipt.bundleId,
+                        receiptHash: receipt.receiptHash,
+                        activatedAt: receipt.completedAt,
+                        expiresAt: bundle.expiresAt ?? null,
+                    });
+                    if (provider === 'agy')
+                        await activateAgyPlugin();
+                }
+            }
+            catch (error) {
+                await recoverLocalInstallation(error);
+            }
+            try {
+                await fabric.postInstallReceipt(bundle.bundleId, rollout.id, receipt);
+            }
+            catch (error) {
+                if (isDefinitiveAgentFabricRejection(error))
+                    await recoverLocalInstallation(error);
+                throw error;
+            }
+            return { ok: true, rolloutId: rollout.id, bundleId: bundle.bundleId, status: receipt.status, changed: true };
+        }
+        finally {
+            await rm(sourceRoot, { recursive: true, force: true });
+        }
+    });
 }
 async function relayStart(flags) {
     const policyPath = resolve(required(flags, 'policy'));
@@ -2450,10 +3042,19 @@ async function relayStart(flags) {
     process.once('SIGINT', stop);
     process.once('SIGTERM', stop);
     let tasksCompleted = 0;
+    let taskTrajectoriesRecovered = 0;
     let evidenceResponsesCompleted = 0;
+    let trajectorySyncsCompleted = 0;
     let nextPolicyRefreshAt = 0;
     let evidencePolicyFresh = false;
+    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+    const vault = await LocalVault.open({
+        root: resolve(dharmaHome(), 'vault'),
+        masterKey: await loadOrCreateVaultMasterKey(),
+        rawLocalDays: rawLocalRetentionDays(policy),
+    });
     try {
+        taskTrajectoriesRecovered += (await finalizeRecoveredSignedTaskTrajectories(fabric, policy)).length;
         do {
             if (Date.now() >= nextPolicyRefreshAt) {
                 try {
@@ -2468,12 +3069,13 @@ async function relayStart(flags) {
             }
             let evidenceRequestId;
             if (evidencePolicyFresh) {
+                trajectorySyncsCompleted += await syncPendingRetentionCapsules(vault, fabric, policy, canonicalWorkspace.workspaceId);
                 const evidence = await processEvidenceRequest(fabric, policy, canonicalWorkspace.workspaceId);
                 evidenceRequestId = typeof evidence.requestId === 'string' ? evidence.requestId : undefined;
                 if (evidenceRequestId)
                     evidenceResponsesCompleted += 1;
             }
-            const result = await executeOneTask(fabric, policy, leaseSeconds);
+            const result = await executeOneTask(fabric, leaseSeconds);
             if (result.taskId)
                 tasksCompleted += 1;
             if (flags.has('once'))
@@ -2483,11 +3085,15 @@ async function relayStart(flags) {
         } while (!stopping);
     }
     finally {
+        vault.close();
         process.removeListener('SIGINT', stop);
         process.removeListener('SIGTERM', stop);
         await rm(pidPath, { force: true });
     }
-    return { ok: true, stopped: true, tasksCompleted, evidenceResponsesCompleted };
+    return {
+        ok: true, stopped: true, tasksCompleted, taskTrajectoriesRecovered,
+        evidenceResponsesCompleted, trajectorySyncsCompleted,
+    };
 }
 export async function run(argv) {
     const { positional, flags, repeated } = parseCliOptions(argv);
@@ -2569,10 +3175,14 @@ export async function run(argv) {
             throw new Error('Skill provider must be codex, claude, or agy.');
         const root = nativeSkillDirectory(providerValue);
         const workspaceId = required(flags, 'workspace-id');
+        const config = JSON.parse(await readFile(configPath(), 'utf8'));
+        const workspace = (await registry()).find((item) => item.workspaceId === workspaceId);
+        if (!workspace)
+            throw new Error('Skill workspace is not registered locally.');
         return {
             provider: providerValue,
             workspaceId,
-            activeBundleId: await getActiveSkillBundleId(root, workspaceId),
+            activeBundleId: (await activeSkillAuthorization(providerValue, workspaceId, String(workspace.repositoryAgentId || ''), config))?.bundleId ?? null,
             nativeSkillDirectory: root,
         };
     }