@gajae-code/coding-agent 0.11.6 → 0.11.8

package/src/gjc-runtime/repository-binding.ts

@@ -0,0 +1,267 @@
+/**
+ * Authoritative repository/worktree binding for plans and delegated tasks (#2901).
+ *
+ * Multi-repo parent directories must not let QA/review lanes infer a sibling repo
+ * from prose. Bindings carry a validated worktree root + git common-dir identity
+ * so spawn/handoff can fail closed on mismatch.
+ */
+import * as fssync from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { type GitRepository, head, repo } from "../utils/git";
+
+export const REPOSITORY_BINDING_SCHEMA = "gjc.repository_binding.v1" as const;
+
+export interface RepositoryBinding {
+	schema: typeof REPOSITORY_BINDING_SCHEMA;
+	/** Canonical realpath of the git worktree root (or resolved cwd root). */
+	worktreeRoot: string;
+	/** Git common dir realpath when available; null outside a git checkout. */
+	commonDir: string | null;
+	/** Optional repo-relative subdirectory the lane should operate under. */
+	relativeSubdir?: string;
+	/** Optional display path (may be non-canonical); never used for authority. */
+	displayPath?: string;
+	/** Optional baseline HEAD at capture time. */
+	head?: string;
+	/** Optional branch name at capture time (when not detached). */
+	branch?: string;
+}
+
+export type RepositoryBindingErrorCode =
+	| "not_a_repository"
+	| "identity_mismatch"
+	| "path_outside_root"
+	| "invalid_binding";
+
+export class RepositoryBindingError extends Error {
+	readonly code: RepositoryBindingErrorCode;
+
+	constructor(code: RepositoryBindingErrorCode, message: string) {
+		super(message);
+		this.name = "RepositoryBindingError";
+		this.code = code;
+	}
+}
+
+async function realpathOrResolve(target: string): Promise<string> {
+	try {
+		return await fs.realpath(target);
+	} catch {
+		return path.resolve(target);
+	}
+}
+
+/** Sync realpath for path-under-root checks (handles macOS /var → /private/var). */
+function realpathSyncOrResolve(target: string): string {
+	try {
+		return fssync.realpathSync(target);
+	} catch {
+		return path.resolve(target);
+	}
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
+}
+
+/** Capture a durable binding from the active cwd/worktree. */
+export async function captureRepositoryBinding(
+	cwd: string,
+	options: { relativeSubdir?: string; displayPath?: string } = {},
+): Promise<RepositoryBinding> {
+	const resolvedCwd = await realpathOrResolve(cwd);
+	const repository = await repo.resolve(resolvedCwd);
+	const worktreeRoot = repository ? await realpathOrResolve(repository.repoRoot) : resolvedCwd;
+	const commonDir = repository ? await realpathOrResolve(repository.commonDir) : null;
+
+	let headSha: string | undefined;
+	let branch: string | undefined;
+	if (repository) {
+		const headState = await head.resolve(resolvedCwd);
+		if (headState) {
+			headSha = headState.commit || undefined;
+			branch = headState.kind === "ref" ? headState.branchName || undefined : undefined;
+		}
+	}
+
+	const binding: RepositoryBinding = {
+		schema: REPOSITORY_BINDING_SCHEMA,
+		worktreeRoot,
+		commonDir,
+		...(options.relativeSubdir ? { relativeSubdir: normalizeRelativeSubdir(options.relativeSubdir) } : {}),
+		...(options.displayPath ? { displayPath: options.displayPath } : {}),
+		...(headSha ? { head: headSha } : {}),
+		...(branch ? { branch } : {}),
+	};
+	return binding;
+}
+
+function normalizeRelativeSubdir(relative: string): string {
+	const normalized = relative
+		.replaceAll("\\", "/")
+		.replace(/^\.\/+/u, "")
+		.replace(/\/+$/u, "");
+	if (normalized === "" || normalized === ".") {
+		throw new RepositoryBindingError("invalid_binding", "relativeSubdir must be a non-empty relative path");
+	}
+	if (path.isAbsolute(normalized) || normalized.split("/").includes("..")) {
+		throw new RepositoryBindingError("invalid_binding", "relativeSubdir must be repo-relative without '..' segments");
+	}
+	return normalized;
+}
+
+/** Parse a binding from JSON/plan payload; fail closed on malformed shapes. */
+export function parseRepositoryBinding(value: unknown): RepositoryBinding {
+	if (!isObject(value)) {
+		throw new RepositoryBindingError("invalid_binding", "repository binding must be an object");
+	}
+	const schema = nonEmptyString(value.schema);
+	if (schema !== REPOSITORY_BINDING_SCHEMA) {
+		throw new RepositoryBindingError(
+			"invalid_binding",
+			`repository binding schema must be ${REPOSITORY_BINDING_SCHEMA}`,
+		);
+	}
+	const worktreeRoot = nonEmptyString(value.worktreeRoot ?? value.worktree_root);
+	if (!worktreeRoot) {
+		throw new RepositoryBindingError("invalid_binding", "repository binding requires worktreeRoot");
+	}
+	const commonDirRaw = value.commonDir ?? value.common_dir;
+	const commonDir =
+		commonDirRaw === null || commonDirRaw === undefined
+			? null
+			: (nonEmptyString(commonDirRaw) ??
+				(() => {
+					throw new RepositoryBindingError("invalid_binding", "commonDir must be a string or null");
+				})());
+	const relativeSubdirRaw = value.relativeSubdir ?? value.relative_subdir;
+	const relativeSubdir =
+		relativeSubdirRaw === undefined ? undefined : normalizeRelativeSubdir(String(relativeSubdirRaw));
+	const displayPath = nonEmptyString(value.displayPath ?? value.display_path);
+	const head = nonEmptyString(value.head);
+	const branch = nonEmptyString(value.branch);
+	return {
+		schema: REPOSITORY_BINDING_SCHEMA,
+		worktreeRoot: path.resolve(worktreeRoot),
+		commonDir: commonDir === null ? null : path.resolve(commonDir),
+		...(relativeSubdir ? { relativeSubdir } : {}),
+		...(displayPath ? { displayPath } : {}),
+		...(head ? { head } : {}),
+		...(branch ? { branch } : {}),
+	};
+}
+
+/** True when two bindings refer to the same repository identity (linked worktrees ok). */
+export function repositoryBindingsMatch(left: RepositoryBinding, right: RepositoryBinding): boolean {
+	if (left.commonDir && right.commonDir) {
+		return path.resolve(left.commonDir) === path.resolve(right.commonDir);
+	}
+	// Non-git workspaces: require exact worktree root match.
+	return path.resolve(left.worktreeRoot) === path.resolve(right.worktreeRoot);
+}
+
+/**
+ * Ensure `cwd` is inside the bound repository (or the same linked worktree family).
+ * Fails closed on sibling-repo drift.
+ */
+export async function assertCwdMatchesRepositoryBinding(
+	cwd: string,
+	binding: RepositoryBinding,
+): Promise<RepositoryBinding> {
+	const active = await captureRepositoryBinding(cwd);
+	if (!repositoryBindingsMatch(active, binding)) {
+		throw new RepositoryBindingError(
+			"identity_mismatch",
+			`Active worktree does not match plan/task repository binding. active=${active.worktreeRoot} (commonDir=${active.commonDir ?? "none"}) bound=${binding.worktreeRoot} (commonDir=${binding.commonDir ?? "none"}).`,
+		);
+	}
+	return active;
+}
+
+/** Ensure a declared target path resolves under the bound worktree root. */
+export function assertPathUnderRepositoryBinding(binding: RepositoryBinding, targetPath: string): string {
+	const root = realpathSyncOrResolve(binding.worktreeRoot);
+	const base = binding.relativeSubdir ? realpathSyncOrResolve(path.resolve(root, binding.relativeSubdir)) : root;
+	const candidate = path.isAbsolute(targetPath) ? path.resolve(targetPath) : path.resolve(base, targetPath);
+	// Prefer realpath when the path exists so macOS /var ↔ /private/var aliases match.
+	const resolved = realpathSyncOrResolve(candidate);
+	const relative = path.relative(root, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) {
+		throw new RepositoryBindingError(
+			"path_outside_root",
+			`Path escapes bound repository root: ${targetPath} (root=${root})`,
+		);
+	}
+	return resolved;
+}
+
+/**
+ * Public identity snapshot for receipts/handoffs (no display-only fields required).
+ * Always includes the schema + durable roots so downstream lanes can re-verify.
+ */
+export function publicRepositoryBinding(binding: RepositoryBinding): RepositoryBinding {
+	return {
+		schema: REPOSITORY_BINDING_SCHEMA,
+		worktreeRoot: path.resolve(binding.worktreeRoot),
+		commonDir: binding.commonDir === null ? null : path.resolve(binding.commonDir),
+		...(binding.relativeSubdir ? { relativeSubdir: binding.relativeSubdir } : {}),
+		...(binding.displayPath ? { displayPath: binding.displayPath } : {}),
+		...(binding.head ? { head: binding.head } : {}),
+		...(binding.branch ? { branch: binding.branch } : {}),
+	};
+}
+
+/**
+ * Resolve the authoritative binding for a delegated task before discovery/spawn.
+ *
+ * - Missing declaration → stamp from session cwd (never leave authority implicit).
+ * - Declared binding → parse + fail closed unless it matches the active session worktree.
+ * - relativeSubdir (when present) must resolve under the bound root.
+ */
+export async function resolveTaskRepositoryBinding(
+	sessionCwd: string,
+	declared: unknown | undefined,
+): Promise<RepositoryBinding> {
+	const sessionBinding = await captureRepositoryBinding(sessionCwd, { displayPath: sessionCwd });
+	if (declared === undefined || declared === null) {
+		return publicRepositoryBinding(sessionBinding);
+	}
+	const taskBinding = parseRepositoryBinding(declared);
+	await assertCwdMatchesRepositoryBinding(sessionCwd, taskBinding);
+	if (taskBinding.relativeSubdir) {
+		assertPathUnderRepositoryBinding(taskBinding, ".");
+	}
+	return publicRepositoryBinding(taskBinding);
+}
+
+/**
+ * Ensure an execution/isolation root (cwd or worktree) still matches the bound identity.
+ * Used after isolation workspace creation so linked worktrees keep the source repository.
+ */
+export async function assertExecutionRootMatchesRepositoryBinding(
+	executionRoot: string,
+	binding: RepositoryBinding,
+): Promise<RepositoryBinding> {
+	return await assertCwdMatchesRepositoryBinding(executionRoot, binding);
+}
+
+/** Optional helper for tests and diagnostics. */
+export function bindingFromGitRepository(
+	repository: GitRepository,
+	options: { relativeSubdir?: string; displayPath?: string; head?: string; branch?: string } = {},
+): RepositoryBinding {
+	return {
+		schema: REPOSITORY_BINDING_SCHEMA,
+		worktreeRoot: path.resolve(repository.repoRoot),
+		commonDir: path.resolve(repository.commonDir),
+		...(options.relativeSubdir ? { relativeSubdir: normalizeRelativeSubdir(options.relativeSubdir) } : {}),
+		...(options.displayPath ? { displayPath: options.displayPath } : {}),
+		...(options.head ? { head: options.head } : {}),
+		...(options.branch ? { branch: options.branch } : {}),
+	};
+}

package/src/gjc-runtime/session-state-sidecar.ts

@@ -911,15 +911,11 @@ async function operatorDispatchIdForOwner(
 	}
 }
 
-async function persistCoordinatorRuntimeStateFromOwnerTerminalPostmortem(
+async function observeOwnerTerminalPostmortem(
 	reason: postmortem.Reason,
-	context: RuntimeStateContext,
-	stateFile: string,
+	owner: OwnerTerminalContext,
 	sessionId: string,
-	previous: Record<string, unknown>,
-): Promise<void> {
-	const owner = context.ownerTerminal;
-	if (!owner) return;
+): Promise<OwnerVerdict | null> {
 	try {
 		const now = new Date().toISOString();
 		const observation: Omit<ObserveTerminalRequest, "operator_dispatch_id"> = {
@@ -937,10 +933,27 @@ async function persistCoordinatorRuntimeStateFromOwnerTerminalPostmortem(
 			reason: "process_postmortem",
 		};
 		const operatorDispatchId = await operatorDispatchIdForOwner(owner, observation);
-		const verdict = await observeOwnerTerminal({
+		return await observeOwnerTerminal({
 			...observation,
 			...(operatorDispatchId ? { operator_dispatch_id: operatorDispatchId } : {}),
 		});
+	} catch {
+		return null;
+	}
+}
+
+async function persistCoordinatorRuntimeStateFromOwnerTerminalPostmortem(
+	context: RuntimeStateContext,
+	stateFile: string,
+	sessionId: string,
+	previous: Record<string, unknown>,
+	verdict: OwnerVerdict | null,
+): Promise<void> {
+	const owner = context.ownerTerminal;
+	if (!owner) return;
+	try {
+		if (!verdict) throw new Error("owner terminal verdict unavailable");
+		const now = new Date().toISOString();
 		const expected = verdict.classification === "expected_operator_shutdown";
 		const state: RuntimeState = expected ? "completed" : "errored";
 		const payload = {
@@ -1009,6 +1022,9 @@ export async function persistCoordinatorRuntimeStateFromPostmortem(
 	const stateFile = runtimeStateFileForContext(context);
 	if (!stateFile) return;
 	const identity = normalizedIdentity(context);
+	const ownerTerminalVerdict = context.ownerTerminal
+		? await observeOwnerTerminalPostmortem(reason, context.ownerTerminal, identity.sessionId)
+		: null;
 	await serializeStateFileWrite(
 		stateFile,
 		async () =>
@@ -1033,11 +1049,11 @@ export async function persistCoordinatorRuntimeStateFromPostmortem(
 						}
 						if (context.ownerTerminal) {
 							await persistCoordinatorRuntimeStateFromOwnerTerminalPostmortem(
-								reason,
 								context,
 								stateFile,
 								identity.sessionId,
 								previous,
+								ownerTerminalVerdict,
 							);
 							return;
 						}

package/src/gjc-runtime/tmux-owner-isolation.ts

@@ -1646,7 +1646,8 @@ export function isValidOwnerIntent(intent: unknown, request?: ObserveTerminalReq
 		intent.generation === request.owner_generation &&
 		intent.session_id === request.session_id &&
 		intent.server_key === request.socket_key &&
-		(request.operator_dispatch_id === undefined || intent.dispatch_id === request.operator_dispatch_id) &&
+		request.operator_dispatch_id !== undefined &&
+		intent.dispatch_id === request.operator_dispatch_id &&
 		request.signal === "SIGTERM"
 	);
 }

package/src/gjc-runtime/tmux-sessions.ts

@@ -3,6 +3,7 @@ import * as crypto from "node:crypto";
 import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { Process } from "@gajae-code/natives";
 import { readLinuxProcStartTime, readLinuxProcStartTimeSync } from "./linux-proc";
 import { resolveGjcTmuxBinary } from "./psmux-detect";
 import { tmuxRuntimeSessionPath } from "./session-layout";
@@ -43,6 +44,7 @@ import {
 	lifecyclePaths,
 	type OwnerIsolationProbeSync,
 	type OwnerVerdict,
+	observeOwnerTerminal,
 	type PlanResponse,
 	planTmuxOwnerIsolationSync,
 	replaceOwnerGenerationSync,
@@ -963,6 +965,14 @@ async function readProcessStartTime(pid: number): Promise<string | null> {
 	return readLinuxProcStartTime(pid);
 }
 
+function exactManagedOwnerSupervisor(supervisorPid: number, supervisorStartTime: string): Process {
+	const supervisor = Process.fromPid(supervisorPid);
+	if (!supervisor) throw new Error("managed_owner_supervisor_unverifiable");
+	if (process.platform === "linux" && supervisor.incarnation !== `linux:${supervisorStartTime}`)
+		throw new Error("managed_owner_supervisor_incarnation_mismatch");
+	return supervisor;
+}
+
 async function readCurrentGeneration(stateDir: string, sessionId: string): Promise<string | null> {
 	try {
 		const value: unknown = JSON.parse(
@@ -1016,12 +1026,12 @@ async function requireUnchangedOwnerForCompatibilityCleanup(
 	initialServer: { pid: number; startTime: string },
 	listPanePids: (sessionName: string, env: NodeJS.ProcessEnv) => number[],
 	readStartTime: (pid: number) => Promise<string | null>,
-): Promise<void> {
+): Promise<boolean> {
 	try {
 		const currentNativeSessionId = readNativeTmuxSessionId(nativeSessionId, env);
 		if (!currentNativeSessionId) {
 			if (readNativeTmuxSessionId(sessionName, env)) throw new Error(`gjc_tmux_owner_changed:${sessionName}`);
-			return;
+			return false;
 		}
 		const currentServer = requireSafeTmuxServerForMutation(resolveGjcTmuxCommand(env), env);
 		const panePids = listPanePids(nativeSessionId, env);
@@ -1054,10 +1064,11 @@ async function requireUnchangedOwnerForCompatibilityCleanup(
 				: null,
 		].filter((value): value is string => value !== null);
 		if (mismatches.length > 0) throw new Error(`gjc_tmux_owner_changed:${sessionName}:${mismatches.join(",")}`);
+		return true;
 	} catch (error) {
 		if (!readNativeTmuxSessionId(nativeSessionId, env)) {
 			if (readNativeTmuxSessionId(sessionName, env)) throw new Error(`gjc_tmux_owner_changed:${sessionName}`);
-			return;
+			return false;
 		}
 		if (error instanceof Error && error.message.startsWith(`gjc_tmux_owner_changed:${sessionName}`))
 			throw new Error(`gjc_tmux_owner_changed:${sessionName}`);
@@ -1152,6 +1163,7 @@ export async function forceCloseGjcTmuxSession(
 	const now = deps.now ?? (() => new Date());
 	const sleep = deps.sleep ?? (ms => Bun.sleep(ms));
 	const dispatchId = crypto.randomUUID();
+	let operatorVerdict: Promise<OwnerVerdict> | null = null;
 	await closeExactTmuxOwner(
 		{
 			stateDir: identity.stateDir,
@@ -1169,12 +1181,37 @@ export async function forceCloseGjcTmuxSession(
 			sendSigterm: async pid => {
 				if ((await (deps.readProcessStartTime ?? readProcessStartTime)(pid)) !== identity.startTime)
 					throw new Error("owner_pid_identity_mismatch");
-				(deps.signalTerm ?? (target => process.kill(target, "SIGTERM")))(pid);
+				if (deps.signalTerm) {
+					deps.signalTerm(pid);
+				} else {
+					const supervisor = exactManagedOwnerSupervisor(pid, identity.startTime);
+					if (!supervisor.signalRoot(15)) throw new Error("managed_owner_supervisor_signal_failed");
+					operatorVerdict = supervisor
+						.waitForExit({ timeoutMs: FORCE_CLOSE_VERDICT_TIMEOUT_MS - 500 })
+						.then(async exited => {
+							if (!exited) throw new Error("managed_owner_supervisor_exit_timeout");
+							return await observeOwnerTerminal({
+								schema_version: 1,
+								op: "observe_terminal",
+								session_id: identity.sessionId,
+								owner_generation: identity.generation,
+								state_dir: identity.stateDir,
+								socket_key: identity.socketKey,
+								observer: "raw_monitor",
+								observed_at: now().toISOString(),
+								signal: "SIGTERM",
+								exit_code: null,
+								exit_kind: "exact_owner_exit_observed",
+								reason: "operator_observed_owner_exit",
+								operator_dispatch_id: dispatchId,
+							});
+						});
+				}
 			},
 
-			waitForVerdict: () => waitForExpectedVerdict(identity, sleep, now),
+			waitForVerdict: () => operatorVerdict ?? waitForExpectedVerdict(identity, sleep, now),
 			cleanupSession: async () => {
-				await requireUnchangedOwnerForCompatibilityCleanup(
+				const cleanupRequired = await requireUnchangedOwnerForCompatibilityCleanup(
 					session.name,
 					nativeSessionId,
 					env,
@@ -1184,6 +1221,7 @@ export async function forceCloseGjcTmuxSession(
 					deps.listPanePids ?? readExactSessionPanePids,
 					deps.readProcessStartTime ?? readProcessStartTime,
 				);
+				if (!cleanupRequired) return;
 				if (deps.cleanupSession) deps.cleanupSession(nativeSessionId, env);
 				else
 					runGuardedTmuxSessionCommand(
@@ -1192,6 +1230,7 @@ export async function forceCloseGjcTmuxSession(
 						initialServer.pid,
 						env,
 						`kill-session -t '${nativeSessionId}'`,
+						identity.generation,
 					);
 			},
 		},

package/src/gjc-runtime/ultragoal-guard.ts

@@ -2,6 +2,10 @@ import * as fs from "node:fs/promises";
 import { DEFAULT_ULTRAGOAL_OBJECTIVE } from "./goal-mode-request";
 import { resolveGjcSessionForRead, SessionResolutionError } from "./session-resolution";
 import {
+	findCleanPauseCriticVerdict,
+	findLedgerReceiptEvent,
+	terminalCriticCeilingReached,
+	terminalCriticGateOverridden,
 	validateDeferredMemberReceiptFresh,
 	validateReceiptFreshBase,
 	validateSupersededFinalAggregateReceipt,
@@ -32,6 +36,7 @@ export type UltragoalGuardState =
 	| "active_dirty_quality_gate"
 	| "active_review_blocked_unrecorded"
 	| "active_review_blocked_recorded"
+	| "active_missing_critic_verdict"
 	| "unreadable_fail_closed";
 
 export interface UltragoalGuardDiagnostic {
@@ -71,12 +76,12 @@ function objectiveMatches(currentGoal: CurrentGoalLike, plan: UltragoalPlan, ses
 	return plan.goals.some(goal => goal.objective === normalized);
 }
 
-function isKnownUltragoalObjective(currentObjective: string): boolean {
+export function isKnownUltragoalObjective(currentObjective: string): boolean {
 	const normalized = currentObjective.trim();
-	return (
-		normalized === DEFAULT_ULTRAGOAL_OBJECTIVE ||
-		(normalized.includes(".gjc/ultragoal/goals.json") && normalized.includes(".gjc/ultragoal/ledger.jsonl"))
-	);
+	// Exact default aggregate objective only. Substring path sniffing previously
+	// treated arbitrary objectives that merely mentioned goals.json/ledger paths
+	// as Ultragoal-owned, which could mis-arm guards. Prefer fail-closed.
+	return normalized === DEFAULT_ULTRAGOAL_OBJECTIVE;
 }
 
 async function ultragoalReadPaths(
@@ -256,6 +261,31 @@ export function validateCompletionReceipt(input: {
 			goalId: input.goal.id,
 		};
 	}
+	if (input.receiptKind === "final-aggregate") {
+		const checkpointEvent = findLedgerReceiptEvent(input.ledger, receipt);
+		if (checkpointEvent) {
+			const qualityGate =
+				typeof checkpointEvent.qualityGateJson === "object" &&
+				checkpointEvent.qualityGateJson !== null &&
+				!Array.isArray(checkpointEvent.qualityGateJson)
+					? (checkpointEvent.qualityGateJson as Record<string, unknown>)
+					: undefined;
+			const criticReview =
+				qualityGate &&
+				typeof qualityGate.criticReview === "object" &&
+				qualityGate.criticReview !== null &&
+				!Array.isArray(qualityGate.criticReview)
+					? (qualityGate.criticReview as Record<string, unknown>)
+					: undefined;
+			if (criticReview?.verdict !== "OKAY") {
+				return {
+					state: "active_missing_critic_verdict",
+					message: `Ultragoal ${input.goal.id} final aggregate receipt checkpoint requires criticReview with verdict OKAY.`,
+					goalId: input.goal.id,
+				};
+			}
+		}
+	}
 	if (receipt.validationBatch?.role === "deferred-member") {
 		return validateDeferredMemberReceiptFresh({
 			plan: input.plan,
@@ -274,6 +304,15 @@ export function validateCompletionReceipt(input: {
 		receiptKind: input.receiptKind,
 	});
 	if (baseDiagnostic) return baseDiagnostic;
+	if (input.receiptKind === "final-aggregate") {
+		if (terminalCriticCeilingReached(input.ledger) && !terminalCriticGateOverridden(input.ledger)) {
+			return {
+				state: "active_stale_receipt",
+				message: `Ultragoal ${input.goal.id} final aggregate receipt is stale because the terminal-critic ceiling is currently reached.`,
+				goalId: input.goal.id,
+			};
+		}
+	}
 	if (receipt.validationBatch?.role === "batch-close") {
 		for (const memberId of receipt.validationBatch.memberIds) {
 			const member = input.plan.goals.find(goal => goal.id === memberId);
@@ -856,10 +895,10 @@ export interface UltragoalPauseBlockDiagnostic {
 
 /**
  * While an Ultragoal run is active, `goal({"op":"pause"})` is only allowed when the
- * current durable Ultragoal state is readable and the latest durable ledger event
- * classifies the current blocker as `human_blocked`. Resolvable blockers must be
- * worked, not parked. Reads fail closed so unreadable durable state or ledger data
- * blocks pause rather than silently allowing a give-up.
+ * current durable Ultragoal state is readable, the latest `blocker_classified`
+ * event is `human_blocked`, and a later fresh clean pause terminal critic verdict is bound to
+ * that exact classification. Reads fail closed so unreadable durable state or
+ * ledger data blocks pause rather than silently allowing a give-up.
  */
 export async function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPauseBlockDiagnostic> {
 	if (!cwd) return { blocked: false, reason: "No cwd to resolve durable Ultragoal state." };
@@ -880,14 +919,53 @@ export async function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPau
 			reason: `Unable to read durable Ultragoal ledger: ${error instanceof Error ? error.message : String(error)}`,
 		};
 	}
-	const latest = ledger.at(-1);
-	if (latest?.event === "blocker_classified" && latest.classification === "human_blocked") {
-		return { blocked: false, reason: "Latest Ultragoal ledger event classifies the blocker as human_blocked." };
+	if (terminalCriticCeilingReached(ledger) && !terminalCriticGateOverridden(ledger)) {
+		return {
+			blocked: true,
+			reason:
+				"The Ultragoal run hit the terminal-critic ceiling; requires human/leader `gjc ultragoal record-critic-gate-override` before further terminal attempts.",
+		};
+	}
+
+	const classification = [...ledger].reverse().find(event => event.event === "blocker_classified");
+	if (classification?.classification !== "human_blocked") {
+		return {
+			blocked: true,
+			reason:
+				"An Ultragoal run is active. Pausing requires the latest blocker_classified event to be human_blocked, followed by a bound clean pause terminal critic verdict.",
+		};
+	}
+	if (typeof classification.eventId !== "string" || !classification.eventId.trim()) {
+		return {
+			blocked: true,
+			reason:
+				"Pausing requires a later fresh clean pause terminal critic OKAY verdict bound to the latest human_blocked blocker_classified event; a REJECT/ITERATE/stale/missing verdict blocks the pause and the run must keep executing.",
+		};
+	}
+	let plan: UltragoalPlan | null;
+	try {
+		plan = await readUltragoalPlan(cwd);
+	} catch (error) {
+		return {
+			blocked: true,
+			reason: `Unable to read durable Ultragoal plan for pause critic verdict: ${error instanceof Error ? error.message : String(error)}`,
+		};
+	}
+	if (!plan) {
+		return { blocked: true, reason: "Unable to read durable Ultragoal plan for pause critic verdict." };
+	}
+	const criticVerdict = findCleanPauseCriticVerdict(plan, ledger, classification.eventId);
+	if (!criticVerdict) {
+		return {
+			blocked: true,
+			reason:
+				"Pausing requires a later fresh clean pause terminal critic OKAY verdict bound to the latest human_blocked blocker_classified event; a REJECT/ITERATE/stale/missing verdict blocks the pause and the run must keep executing.",
+		};
 	}
 	return {
-		blocked: true,
+		blocked: false,
 		reason:
-			"An Ultragoal run is active. Pausing requires the current blocker to be classified human_blocked as the latest ledger event.",
+			"Latest blocker_classified event is human_blocked with a later fresh clean bound pause terminal critic verdict.",
 	};
 }
 
@@ -902,7 +980,7 @@ export async function assertUltragoalPauseAllowed(cwd: string): Promise<void> {
 		[
 			diagnostic.reason,
 			"Resolvable blockers must be worked, not paused: investigate, `gjc ultragoal steer --kind add_subgoal`, delegate an executor, or `gjc ultragoal record-review-blockers`.",
-			'If the blocker is genuinely human-only, record `gjc ultragoal classify-blocker --classification human_blocked --evidence "<human-only dependency>"` immediately before pausing.',
+			'If the blocker is genuinely human-only, record `gjc ultragoal classify-blocker --classification human_blocked --evidence "<human-only dependency>"`, then record a clean bound `gjc ultragoal record-critic-verdict --terminus pause --classification-event-id <eventId> --verdict OKAY --evidence "<critic evidence>"` before pausing.',
 		].join("\n"),
 	);
 }