@gajae-code/coding-agent 0.12.2 → 0.12.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [0.12.5] - 2026-07-30
+
+## [0.12.4] - 2026-07-30
+
+## [0.12.3] - 2026-07-30
+
+### Fixed
+
+- The release cut no longer deletes previously released changelog headings whose body is empty. `releasedChangelogContent` ran `removeEmptyVersionEntries` before transforming `## [Unreleased]`, so cutting a release replaced the prior empty semver heading instead of inserting the new one above it — v0.12.2 dropped the `## [0.12.1] - 2026-07-29` heading from four package changelogs. Released sections are now immutable history and are always preserved.
+
 ## [0.12.2] - 2026-07-30
 
 ### Added
@@ -15,12 +25,14 @@
 ### Fixed
 
 - Terminal input now normalizes Option/Meta navigation and psmux modified-Enter encodings through the native key parser, keeping legacy, Kitty CSI-u, and modifyOtherKeys behavior consistent.
-- Ultragoal CLI replay evidence now accepts any argv `command` instead of a small conservative executable allowlist. Proving a CLI-surface change with the project's own test runner (e.g. `bun test <file>`) was impossible: the allowlist only permitted `--version` probes, `bun/node -e "console.log(...)"` literals, read-only `git`, and `gjc read|status`, so real verification commands were rejected and forced agents into `replayExempt` metadata that additionally demanded a screenshot/automation/PTY fallback artifact. `replaySafe: true` is now the gating attestation, backed by the existing sandbox (subprocess isolation with explicit argv and no shell, timeout kill, 1 MiB output cap, env scrubbing). Every other rail is unchanged and still fails closed: shell-string commands, `replaySafe` not true, dangerous env vars, stdout/`recordedStdout` mismatch, and unexpected exit codes are all still rejected (#3533).
-- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Such a row short-circuited as an *inline* replay record, so its `path` was never read and validation failed with a confusing `schemaVersion must be 1` diagnostic pointing at the ref instead of the file — forcing an undocumented workaround of renaming the ref's `kind`. A row is now treated as inline only when it actually carries replay fields (#3533).
+- Ultragoal CLI replay no longer executes model-authored test source or trusts `replaySafe: true` as arbitrary command authority. Runtime replay is limited to the pinned Bun runtime for `--version` and literal `-e "console.log(...)"`; shells, interpreter code strings, path-qualified executables, tests, install/publish/network/git mutation commands, and arbitrary argv are rejected. Replay cwd/artifact files are realpath-confined, ambiguous rows fail closed, stdout and stderr are checked, and POSIX timeout cleanup signals the process group. Structured test-report fallback remains deliberately unsupported pending a separate trusted-provenance design (#3533).
+- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Inline, nested, and file-backed replay forms are disambiguated explicitly; mixed or malformed rows fail closed (#3533).
+
 - Broker artifact cleanup no longer promotes a non-empty `cleanup_pending` quarantine to transcript-phase completion. The broker advances only when the retained quarantine is root-only/empty or when the lower layer returns `artifacts_removed`, so artifact bytes cannot vanish behind a success receipt (#3489).
 - `gjc --worktree` / `gjc -w` launch no longer crashes with a raw uncaught `EEXIST` when the worktree bucket directory (`<repo>.gajae-code-worktrees`) is a broken symbolic link to unmounted or offloaded cold storage. The launch distinguishes dangling links and non-directory entries from valid directory symlinks or Windows junctions, reclassifies mkdir races, avoids disclosing raw link targets or unsafe shell commands, and never deletes or replaces an obstructing entry.
 - POSIX parent identity reproof/fsync is now centralized before every promotable artifact-phase result, preventing a crash-window where a rename is lost after durable retirement is recorded (#3489).
 - Artifact retirement, planned paths, retained authority, and transcript retry in both managed reconciliation and deletion now bind to the newest published `pendingEvidence` attempt, preventing stranded detached transcripts at paths absent from the newest receipt after a crash (#3489).
+- Provider retry classification prefers the typed `stream_first_event_timeout` transport fact when present, falling back to error-message regex for message-only callers (#3496).
 - Detached task receipts for in-memory parent sessions no longer advertise dead `agent://` output URIs. TaskTool allocates a session-lifetime durable artifact root under the process temp directory, persists child outputs there, authorizes parent and same-session descendants for scoped resolution, and omits the URI entirely when durable allocation fails (#3471).
 - Managed-session replacement and cleanup now bind Windows destination mutation to exact native identity, keep lock acquisition/release retryable without reviving lost ownership, and report retained artifact payloads as `cleanup_pending` until only the verified root remains.
 - Resuming a session no longer crashes with an unhandled rejection when another session transition is already running. The session picker dispatches resume through a void-returning callback, and `handleResumeSession` had no re-entrancy guard, so a second selection (or a resume issued while compaction, handoff, or a fork was in flight) reached `switchSession` and the `{ code: "busy" }` transition error rejected a promise nobody awaited. Resume now ignores an overlapping request with a status message, reports a busy transition as status, and still propagates every other failure. The progress lease is released on all paths.
@@ -44,6 +56,7 @@
 ### Added
 
 - User-created Telegram forum topics can now start a GJC session by selecting the home folder, choosing a verified recent work folder, or entering an explicit folder path. The selected topic is adopted by the new session without creating or deleting a separate Telegram topic.
+- The interactive terminal’s responsive IRC/todo work-lane contract now covers exact narrow/wide geometry, requested versus effective IRC visibility, direct-root pin ordering, todo lane bounds, remapped IRC toggles, and live composer shortcut hints.
 
 ### Fixed
 

package/dist/types/async/job-manager.d.ts

@@ -134,6 +134,8 @@ export interface SubagentRecord {
     effectiveModel?: string;
     /** True when the requested model lacked credentials and the subagent fell back to the parent model. */
     modelFellBack?: boolean;
+    /** True when the effective subagent provider is in fast mode. */
+    fastMode?: boolean;
 }
 /** Lightweight, manager-owned resume payload. The async layer treats `data` as opaque. */
 export interface ResumeDescriptor {
@@ -251,11 +253,17 @@ export declare class AsyncJobManager {
     };
     /** Register or replace the canonical record for a subagent. */
     registerSubagentRecord(record: SubagentRecord): void;
-    /** Patch model metadata onto an existing subagent record (best-effort; no-op if unknown). */
+    /**
+     * Patch model/runtime metadata onto an existing subagent record (best-effort; no-op if
+     * unknown). Every field is optional and omitting one preserves its current value, so a
+     * narrow patch like `{ fastMode: true }` cannot erase model identity recorded earlier.
+     * A field therefore cannot be cleared back to `undefined` through this method.
+     */
     updateSubagentModel(subagentId: string, model: {
         requestedModel?: string;
         effectiveModel?: string;
         modelFellBack?: boolean;
+        fastMode?: boolean;
     }): void;
     getSubagentRecord(subagentId: string, filter?: AsyncJobFilter): SubagentRecord | undefined;
     getSubagentRecords(filter?: AsyncJobFilter): SubagentRecord[];

package/dist/types/gjc-runtime/ultragoal-evidence.d.ts

@@ -17,12 +17,16 @@ export declare function validateStructuralArtifact(cwd: string, row: JsonObject,
     live: boolean;
 }): Promise<boolean>;
 export declare function isAllowedGitReplayCommand(args: readonly string[]): boolean;
+export declare function resolveCliReplayCommand(command: string[], options?: {
+    compiled?: boolean;
+}): string[];
 export declare function readCliReplayRecord(cwd: string, row: JsonObject, fieldName: string): Promise<JsonObject | null>;
 export interface ReplayProcessHandle {
     readonly exited: Promise<number>;
+    readonly pid?: number;
     kill(signal?: number | NodeJS.Signals): void;
 }
-export declare function waitForReplayProcessWithTimeout(process: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
+export declare function waitForReplayProcessWithTimeout(handle: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
 export declare function validateReplayExemptFallback(cwd: string, record: JsonObject, fieldName: string, artifactRefs: Map<string, JsonObject>, options: {
     surfaceFamily: SurfaceFamily;
     live: boolean;

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -315,9 +315,9 @@ export declare function isSubstantiveEvidence(value: unknown): boolean;
 export declare function hasTypedVerifiedReceipt(value: unknown): boolean;
 export declare function hasExistingNonEmptyArtifact(cwd: string, value: unknown): Promise<boolean>;
 export declare function readArtifactBytes(cwd: string, row: JsonObject, fieldName: string): Promise<Buffer | null>;
-import { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
+import { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
 export type { ReplayProcessHandle } from "./ultragoal-evidence";
-export { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
+export { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
 export declare function validateExecutorQaRedTeamEvidenceForReview(cwd: string, executorQa: Record<string, unknown>, options?: {
     mode?: "review";
     changeSet?: UltragoalChangeSet;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -19,8 +19,10 @@ export type ChatDaemonAction = "stop" | "reload";
  * chat daemons after notification configuration parsing changes. Generation 15
  * applies the current notification configuration directly when starting chat
  * daemon transports. Generation 16 applies Telegram sound-policy configuration
- * through shared notification parsing. Generation 17 binds managed-session
- * replacement to exact native filesystem authority.
+ * through shared notification parsing. Generation 17 bound managed-session
+ * replacement to exact native filesystem authority; generation 18 retires that
+ * binding (revert of #3489, which stalled POSIX artifact cleanup) while keeping
+ * the lifecycle contract moving strictly forward.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -44,10 +44,12 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * 33 adds action-bound multi-select state rendering and replay-safe option
  * snapshots. Generation 34 converts non-photo image formats (including WebP)
  * into Telegram-compatible photo uploads when possible. Generation 35 adds
- * user-created topic adoption (forum-topic folder picker). Generation 36 binds
- * managed-session replacement to exact native filesystem authority.
+ * user-created topic adoption (forum-topic folder picker). Generation 36 bound
+ * managed-session replacement to exact native filesystem authority; generation
+ * 37 retires that binding (revert of #3489, which stalled POSIX artifact
+ * cleanup) while keeping the lifecycle contract moving strictly forward.
  */
-export declare const DAEMON_GENERATION = 36;
+export declare const DAEMON_GENERATION = 37;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
  * all builds published before this field existed; epoch 2 covered generation 29;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -7,7 +7,6 @@ export declare const MANAGED_ARTIFACT_MAX_TOTAL_BYTES: number;
 export declare const MANAGED_ARTIFACT_COPY_BATCH_SIZE = 256;
 export declare class ManagedPublishError extends Error {
     readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "io_error" | "durability_failed";
-    readonly code: ManagedPublishError["classification"];
     readonly diagnostic: string;
     constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);
 }
@@ -21,12 +20,6 @@ export interface ManagedStorageLock {
     assertOwned(): void;
     release(): Promise<void>;
 }
-export interface ManagedStorageLockSync {
-    path: string;
-    attemptId: string;
-    assertOwned(): void;
-    release(): void;
-}
 export interface ManagedFileSnapshot {
     bytes: Buffer;
     identity: {
@@ -38,13 +31,6 @@ export interface ManagedFileSnapshot {
         sha256: string;
     };
 }
-export declare const MANAGED_SESSION_SECURITY_CODES: readonly ["acl_denied", "acl_io_error", "acl_present", "acl_malformed", "acl_unknown", "acl_unavailable", "acl_apply_failed", "acl_verify_failed", "not_found", "not_directory", "network_unsupported", "reparse_point", "identity_unavailable", "identity_mismatch", "owner_mismatch", "mode_mismatch", "io_error"];
-export type ManagedSessionSecurityCode = (typeof MANAGED_SESSION_SECURITY_CODES)[number];
-export declare class ManagedSessionSecurityError extends Error {
-    readonly code: ManagedSessionSecurityCode;
-    constructor(code: ManagedSessionSecurityCode);
-}
-export declare function managedSessionSecurityCode(error: unknown): ManagedSessionSecurityCode | undefined;
 export declare function validateNativeSecurityResult(value: unknown, operation: "apply" | "verify", kind: "directory" | "file"): NativeOwnerOnlySecurityResult;
 /** Captured configured-root authority for managed paths only. */
 export interface ManagedDirectoryRoot {
@@ -119,18 +105,13 @@ export declare function captureManagedFileNoFollow(pathname: string): ManagedFil
 /** Atomically publishes bytes without replacing an existing destination. */
 export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
-/**
- * Atomically replace a managed file only when the destination is still the
- * exact captured object. Unlike `replaceManagedFileSync`, this never performs
- * an unconditional pathname rename.
- */
-export declare function replaceManagedFileExactSync(destination: string, bytes: Uint8Array, expected: Pick<ManagedFileSnapshot, "identity">, root: ManagedDirectoryRoot): void;
+/** Replace one managed regular file while retaining the secured staging fd through publication. */
+export declare function replaceManagedFileSync(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
+export declare function replaceManagedFile(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 /** Copy the exact bytes captured from one no-follow source descriptor. */
 export declare function copyManagedFileNoReplace(source: string, destination: string, snapshot?: ManagedFileSnapshot, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 /** Acquire a lease lock with bounded wait, heartbeats, conservative stale reclaim, and fencing. */
 export declare function acquireManagedLock(locksDirectory: string, name: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<ManagedStorageLock>;
-/** Acquire a synchronous lease lock for a short cross-process critical section. */
-export declare function acquireManagedLockSync(locksDirectory: string, name: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): ManagedStorageLockSync;
 export interface ManagedArtifactTreeLimits {
     maxFiles?: number;
     maxTotalBytes?: number;

package/dist/types/session/session-manager.d.ts

@@ -986,7 +986,7 @@ export declare class SessionManager {
      * @param sessionDir Optional session directory for /new or /branch. If omitted, derives from file's parent.
      */
     static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
-    static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage): Promise<SessionManager>;
+    static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, cwdOverride?: string): Promise<SessionManager>;
     /**
      * List default-managed sessions for the resume picker without recovery or other
      * maintenance writes. This is the only picker inventory that includes legacy

package/dist/types/task/executor.d.ts

@@ -107,7 +107,7 @@ export interface ExecutorOptions {
 export declare class ManagedTaskPersistence {
     #private;
     constructor(artifacts: ArtifactManager, taskId: string);
-    openSession(): Promise<SessionManager>;
+    openSession(cwd: string): Promise<SessionManager>;
     publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void>;
 }
 export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence;

package/dist/types/task/index.d.ts

@@ -5,8 +5,9 @@ import { type SubagentRunOutcome } from "../async";
 import type { Theme } from "../modes/theme/theme";
 import { type SingleResult, type TaskToolDetails, type TaskToolSchemaInstance } from "./types";
 import "../tools/review";
+import { type TaskResultReceipt } from "./receipt";
 import { renderResult, renderCall as renderTaskCall } from "./render";
-export declare function subagentRunOutcomeFromSingleResult(finalText: string, singleResult: Pick<SingleResult, "aborted" | "exitCode" | "paused" | "setupFailure"> | undefined): string | SubagentRunOutcome;
+export declare function subagentRunOutcomeFromSingleResult(finalText: string, singleResult: (Pick<SingleResult, "aborted" | "exitCode" | "paused" | "setupFailure"> & Partial<Pick<TaskResultReceipt, "status">>) | undefined): string | SubagentRunOutcome;
 export { loadBundledAgents as BUNDLED_AGENTS } from "./agents";
 export { discoverCommands, expandCommand, getCommand } from "./commands";
 export { discoverAgents, getAgent } from "./discovery";

package/dist/types/task/receipt.d.ts

@@ -34,6 +34,7 @@ export interface TaskResultReceipt {
     cost?: number;
     usageCostBreakdownComplete?: true;
     branchName?: string;
+    persistence?: SingleResult["persistence"];
     retryFailure?: {
         attempt: number;
         errorSummary: string;

package/dist/types/task/types.d.ts

@@ -495,6 +495,18 @@ export interface SetupFailureSummary {
 }
 /** Create a bounded diagnostic that preserves a setup failure's cause without exposing credentials or local paths. */
 export declare function createSetupFailureSummary(error: unknown): SetupFailureSummary;
+export interface TaskRecoveryArtifactRef {
+    uri: string;
+    sizeBytes: number;
+    sha256: string;
+    /** Recovery artifacts remain readable for the parent session lifetime. */
+    durability: "session";
+}
+export interface TaskPersistenceResult {
+    outcome: "applied" | "no_changes" | "recovery_available";
+    ownerWorktreeApplied: boolean;
+    recoveryRef?: TaskRecoveryArtifactRef;
+}
 /** Result from a single agent execution */
 export interface SingleResult {
     index: number;
@@ -540,6 +552,10 @@ export interface SingleResult {
     nestedPatches?: NestedRepoPatch[];
     /** Whether isolated execution produced a non-empty root or nested patch. */
     producedChanges?: boolean;
+    /** Receipt-safe owner-worktree persistence result for isolated execution. */
+    persistence?: TaskPersistenceResult;
+    /** Identity-bound patch artifact captured before isolation cleanup. */
+    recoveryRef?: TaskRecoveryArtifactRef;
     /** Data extracted by registered subprocess tool handlers (keyed by tool name) */
     extractedToolData?: Record<string, unknown[]>;
     /** Full wrapper-owned review evidence, kept separate from caller completion data. */

package/dist/types/task/worktree.d.ts

@@ -22,6 +22,8 @@ export interface WorktreeBaseline {
 export declare function getRepoRoot(cwd: string): Promise<string>;
 export declare function getGitNoIndexNullPath(): string;
 export declare function captureBaseline(repoRoot: string): Promise<WorktreeBaseline>;
+/** Confirm that applying patches to the captured owner baseline exactly matches the current owner worktree. */
+export declare function verifyRootPatchesApplied(repoRoot: string, baseline: WorktreeBaseline, patches: readonly string[]): Promise<boolean>;
 export interface NestedRepoPatch {
     relativePath: string;
     patch: string;
@@ -29,14 +31,19 @@ export interface NestedRepoPatch {
 export interface DeltaPatchResult {
     rootPatch: string;
     nestedPatches: NestedRepoPatch[];
+    captureErrors?: string[];
 }
+export interface RecoveryPatchBundle {
+    version: 1;
+    rootPatch: string;
+    nestedPatches: NestedRepoPatch[];
+    captureErrors?: string[];
+}
+export declare function serializeRecoveryPatchBundle(delta: DeltaPatchResult): string;
+export declare function verifyNestedPatchesApplied(repoRoot: string, baseline: WorktreeBaseline, patches: readonly NestedRepoPatch[]): Promise<boolean>;
 export declare function captureDeltaPatch(isolationDir: string, baseline: WorktreeBaseline): Promise<DeltaPatchResult>;
-/**
- * Apply nested repo patches directly to their working directories after parent merge.
- * @param commitMessage Optional async function to generate a commit message from the combined diff.
- *                      If omitted or returns null, falls back to a generic message.
- */
-export declare function applyNestedPatches(repoRoot: string, patches: NestedRepoPatch[], commitMessage?: (diff: string) => Promise<string | null>): Promise<void>;
+/** Preflight every nested delta, then roll back earlier repositories if a later apply fails. */
+export declare function applyNestedPatches(repoRoot: string, patches: NestedRepoPatch[]): Promise<void>;
 /**
  * User-facing isolation mode names exposed by the `task.isolation.mode`
  * setting. Mapped to a backend-kind hint via {@link parseIsolationMode};

package/dist/types/tools/subagent.d.ts

@@ -57,6 +57,8 @@ export interface SubagentSnapshot {
     requestedModel?: string;
     /** True when the requested model lacked credentials and fell back to the parent model. */
     modelFellBack?: boolean;
+    /** True when the effective subagent provider is in fast mode. */
+    fastMode?: boolean;
 }
 export type SubagentAwaitOutcome = "completed" | "timed_out" | "interrupted";
 export interface SubagentToolDetails {

package/dist/types/utils/git.d.ts

@@ -72,6 +72,7 @@ export interface PushOptions {
 export interface PatchOptions {
     readonly cached?: boolean;
     readonly check?: boolean;
+    readonly reverse?: boolean;
     readonly env?: Record<string, string | undefined>;
     readonly signal?: AbortSignal;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.2",
+	"version": "0.12.5",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.2",
-		"@gajae-code/agent-core": "0.12.2",
-		"@gajae-code/ai": "0.12.2",
-		"@gajae-code/bridge-client": "0.12.2",
-		"@gajae-code/natives": "0.12.2",
-		"@gajae-code/tui": "0.12.2",
-		"@gajae-code/utils": "0.12.2",
+		"@gajae-code/stats": "0.12.5",
+		"@gajae-code/agent-core": "0.12.5",
+		"@gajae-code/ai": "0.12.5",
+		"@gajae-code/bridge-client": "0.12.5",
+		"@gajae-code/natives": "0.12.5",
+		"@gajae-code/tui": "0.12.5",
+		"@gajae-code/utils": "0.12.5",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/async/job-manager.ts

@@ -164,6 +164,8 @@ export interface SubagentRecord {
 	effectiveModel?: string;
 	/** True when the requested model lacked credentials and the subagent fell back to the parent model. */
 	modelFellBack?: boolean;
+	/** True when the effective subagent provider is in fast mode. */
+	fastMode?: boolean;
 }
 
 /** Lightweight, manager-owned resume payload. The async layer treats `data` as opaque. */
@@ -702,16 +704,22 @@ export class AsyncJobManager {
 		this.#notifyChange();
 	}
 
-	/** Patch model metadata onto an existing subagent record (best-effort; no-op if unknown). */
+	/**
+	 * Patch model/runtime metadata onto an existing subagent record (best-effort; no-op if
+	 * unknown). Every field is optional and omitting one preserves its current value, so a
+	 * narrow patch like `{ fastMode: true }` cannot erase model identity recorded earlier.
+	 * A field therefore cannot be cleared back to `undefined` through this method.
+	 */
 	updateSubagentModel(
 		subagentId: string,
-		model: { requestedModel?: string; effectiveModel?: string; modelFellBack?: boolean },
+		model: { requestedModel?: string; effectiveModel?: string; modelFellBack?: boolean; fastMode?: boolean },
 	): void {
 		const record = this.#subagentRecords.get(subagentId);
 		if (!record) return;
-		record.requestedModel = model.requestedModel;
-		record.effectiveModel = model.effectiveModel;
-		record.modelFellBack = model.modelFellBack;
+		record.requestedModel = model.requestedModel ?? record.requestedModel;
+		record.effectiveModel = model.effectiveModel ?? record.effectiveModel;
+		record.modelFellBack = model.modelFellBack ?? record.modelFellBack;
+		record.fastMode = model.fastMode ?? record.fastMode;
 	}
 
 	#recordFromResumeDescriptor(subagentId: string, filter?: AsyncJobFilter): SubagentRecord | undefined {

package/src/config/provider-ranking.ts

@@ -53,6 +53,7 @@ export const FAMOUS_PROVIDER_ORDER: readonly string[] = [
 	"xiaomi-token-plan-cn",
 	"opengateway",
 	"bizrouter",
+	"mara",
 	"github-copilot",
 	"cursor",
 ];

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -230,9 +230,22 @@ Team remains explicit and separate: Team is not auto-launched, not a hidden pipe
 
 Heavyweight review runs **once per boundary**, not once per story. In aggregate mode the whole required-goal set is one implicit boundary by default: every checkpoint before the run's final required goal may present the lightweight `deferredToBatch` gate, and only the final goal carries the full strict gate. Nothing needs to be declared to get this — it is the default.
 
-Per-subgoal verification is **agent-chosen**. The runtime does not dictate which lanes an intermediate story runs; it enforces only that the declaration matches the evidence. List the lanes you actually ran in `deferredToBatch.ranLanes` (`targetedVerification`, and optionally `aiSlopCleaner` / `iteration`). A declared lane with no evidence is rejected, submitted evidence for an undeclared lane is rejected, and `ranLanes` can never claim `architectReview` or `executorQa` — a deferred gate structurally cannot carry review evidence, so those lanes always belong to the boundary. `targetedVerification` remains mandatory; the ai-slop-cleaner pass and a full verification rerun are boundary duties, not per-subgoal duties.
+A deferred gate is just the proof the runtime cannot know: that targeted verification ran. Everything mechanical — `kind`, the batch tuple, `deferredLanes`, and the whole `changeSet` block (`paths`, `changeSetHash`) — is auto-filled from durable state and the computed cumulative git diff. Never hand-compute a hash. The minimal valid gate:
 
-Deferring never manufactures approvals: a `deferredToBatch` gate still cannot contain `architectReview`, `executorQa`, or `validationBatchClose`, and the boundary gate keeps every existing fail-closed rule.
+```json
+{
+  "deferredToBatch": {
+    "ranLanes": ["targetedVerification"],
+    "targetedVerification": {
+      "status": "passed",
+      "commands": ["bun test <targeted suite>"],
+      "evidence": "what was verified and how it passed"
+    }
+  }
+}
+```
+
+`deferredToBatch.ranLanes` lists the lanes you actually ran (`targetedVerification`, plus optionally `aiSlopCleaner` / `iteration`); declaration and evidence must match in both directions. `ranLanes` can never claim `architectReview` or `executorQa`, and a deferred gate can never contain `architectReview`, `executorQa`, or `validationBatchClose` — review always belongs to the boundary, and deferring never manufactures approvals. Any optional field you do supply must match reality; a wrong value fails closed. Check with `gjc ultragoal quality-gate validate` before checkpointing.
 
 ### Validation batches (explicit phase/module boundaries)
 
@@ -247,7 +260,7 @@ gjc ultragoal create-goals --brief-file <path> --validation-batch-json '[{"schem
 Checkpoint contract summary — the full contract lives in the `validation-batch-contracts` fragment (`skill-fragments/ultragoal/validation-batch-contracts.md`); load it before checkpointing any batch member:
 
 - **Non-final members** checkpoint `complete` with a single top-level `deferredToBatch` quality gate (kind `validation-batch-deferred`) proving targeted verification, a declaration-matched lane set, and a cumulative-since-base change set — never `architectReview`, `executorQa`, or `validationBatchClose`; deferring never manufactures fake review approvals.
-- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof covering all members; out-of-order close is rejected, close state is append-only proof on the final member only, and batch invalidation is fail-closed.
+- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof covering all members; out-of-order close is rejected, close state is append-only proof on the final member only, and batch invalidation is fail-closed. Like the deferred gate, every close field except `coverageEvidence` is auto-filled from durable receipts and the computed diff — the minimal close is `{"validationBatchClose":{"coverageEvidence":"..."}}` alongside the strict gate.
 
 ### Intra-goal validation-lane parallelism
 
@@ -291,7 +304,7 @@ One generation freezes the change set and reviews it exactly once:
 5. Delegate an `executor` QA/red-team lane with typed `executionMode: "ultragoal-red-team"` (preferred) — or assignment text that explicitly labels Ultragoal completion QA/red-team — to build and run the e2e/red-teaming QA suite appropriate for the story. A bare `executorQa` field-name mention is not enough to activate the mode. This lane must try to break the change, not just confirm the happy path. It must start from the approved plan/spec/acceptance criteria, then user-facing contracts, and only then implementation code as supporting evidence. Plan/code mismatches are blockers, not items to paper over with implementation intent.
 6. The executor QA/red-team lane must prove evidence by the real surface under test:
    - GUI/web surfaces require a valid automation transcript plus a non-uniform screenshot. Bare `inlineEvidence` text or typed receipts never prove live GUI/web execution.
-   - CLI surfaces require runtime argv replay: `schemaVersion: 1`, `kind: "cli-replay"`, `replaySafe: true`, an argv `command` (any executable — no command allowlist), and replayed output validation. The complete field-by-field replay schema, safe `env` constraints, and `replayExempt` audit contract are specified once in the "For CLI replay artifacts" paragraph below the quality-gate JSON; follow it exactly.
+   - CLI surfaces require a safe runtime argv replay (`schemaVersion: 1`, `kind: "cli-replay"`, `replaySafe: true`) or the existing audited `replayExempt` path with a screenshot, automation, or PTY structural fallback. Runtime replay is limited to the pinned Bun runtime for `bun --version` or literal `bun -e "console.log(...)"`; the gate never executes model-authored test files. Shells, interpreters with code strings, path-qualified executables, package/git/network mutation commands, `bun test`, and arbitrary argv are rejected. Structured `test-report` fallback remains unsupported pending a separately reviewed provenance design.
    - Native/desktop/tui surfaces require a structurally valid screenshot, PTY capture with terminal control codes, or app-automation transcript.
    - API/package surfaces require a real artifact file or typed receipt whose artifact `kind` contains one of `api`, `package`, `consumer`, `black-box`, or `test-report`; examples: `api-package-test-report`, `package-consumer-report`, `black-box-api-receipt`. Algorithm/math surfaces require a real artifact file or typed receipt whose artifact `kind` contains one of `property`, `boundary`, `edge`, `adversarial`, `failure`, `math`, `algorithm`, or `test-report`; examples: `property-test-report`, `algorithm-boundary-report`. Bare `inlineEvidence` text alone is not sufficient for any surface.
    - The mandatory **computer-use** red-team suite (`kill-switch-bypass`, `suspended-enforcement`, `permission-revoked`, …) is conditional, not universal: require it only when computer/desktop control is genuinely part of the product surface being dogfooded. For every other product type, prove the change through the matching live surface instead — browser-use automation for web/GUI, bash/CLI live invocation or argv replay for CLI, and real artifacts or typed receipts for API/package/algorithm/math. Editing docs, prompts, or skills that merely mention computer-use does not by itself make the computer-use suite applicable; pick the red-team surface that matches what the change actually ships.
@@ -364,7 +377,11 @@ Validate before you checkpoint. `gjc ultragoal quality-gate validate --quality-g
 
 Provide one `artifactRefs` entry per live surface actually exercised, using the surface-appropriate `kind` and evidence rules from steps 6–7 above; the CLI rejects missing or shallow gates. `status: "not_applicable"` rows are allowed only in `contractCoverage` and `surfaceEvidence` and each requires `contractRef` plus `reason`.
 
-For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"cwd":".","env":{"LC_ALL":"C"},"timeoutMs":30000,"expectedExitCode":0,"recordedStdout":"ultragoal-cli-ok\n","recordedStderr":"","invariants":[{"type":"substring","value":"ultragoal-cli-ok"},{"type":"not-substring","value":"error"}]}`. Accepted replay fields are `command` (string array — any executable is allowed; there is no command allowlist), optional `cwd`, safe `env`, `timeoutMs`, `expectedExitCode`, `recordedStdout`, `recordedStderr`, `normalization`, and `invariants`. The replay sandbox already isolates the command as a subprocess with a timeout, 1 MiB output cap, and env scrubbing, so `replaySafe: true` is the gating attestation rather than an executable allowlist. `env` must contain only safe deterministic variables (`LANG`, `LC_ALL`, `LC_CTYPE`, `TZ`), never credentials or machine/user-specific secrets. `normalization` is optional and, when provided, must be exactly the string `"default"` (the built-in normalizer already strips ANSI codes, normalizes line endings, scrubs paths, and trims trailing whitespace); object-shaped normalization is rejected. Invariants may be substring, regex, or not-substring checks; when present, they replace exact `recordedStdout` equality — without `invariants`, replayed normalized stdout must match `recordedStdout` exactly. Commands that cannot be replayed deterministically (non-zero side effects, require credentials, require network, interactive, platform-unavailable, destructive) may instead use audited `replayExempt` metadata with exact fields `reasonCode`, `reason`, `approvedBy`, and `fallbackArtifactRefs` plus a structurally valid same-surface fallback artifact. `reason` must be substantive and audited, and `approvedBy` must identify the verifier. Allowed `reasonCode` values are exactly `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
+For safe CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"cwd":".","env":{"LC_ALL":"C"},"timeoutMs":30000,"expectedExitCode":0,"recordedStdout":"ultragoal-cli-ok\n","recordedStderr":"","invariants":[{"type":"substring","value":"ultragoal-cli-ok"},{"type":"not_substring","value":"error"}]}`. `replaySafe: true` is required but is never authority by itself: executable replay is limited to the pinned Bun runtime for `bun --version` or deterministic literal `bun -e "console.log(...)"`. Shells, nested interpreters, path-qualified executables, test source, install/publish commands, git mutation, network clients, and every other argv are rejected. The declared cwd and artifact files are realpath-confined beneath the repository, but the safe probe itself runs from a fresh empty temporary cwd/home so repository `bunfig.toml` preloads and user configuration cannot execute. Mixed inline/nested/file-backed rows fail closed, POSIX timeout cleanup signals the replay process group, stdout and stderr are validated after normalization, output is capped at 1 MiB, and the child environment is scrubbed to `CI`, `NO_COLOR`, `GJC_ULTRAGOAL_REPLAY`, trusted temporary `HOME`/`TMPDIR`, plus optional `LANG`, `LC_ALL`, `LC_CTYPE`, and `TZ`.
+
+Compiled GJC binaries fail executable replay closed because their `process.execPath` launches GJC rather than a Bun CLI. Those runs must use the existing audited `replayExempt` structural fallback; the validator never resolves an untrusted `bun` from `PATH`.
+
+Focused `bun test` execution is blocked because repository test source is still arbitrary host code without an operating-system sandbox. The current `replayExempt` contract continues to require an existing screenshot, automation transcript, or PTY structural fallback; a `test-report` or `bun-test-report` JSON file is intentionally not accepted yet. Keep that design work open until test-result provenance, output binding, and consumer authority can be made fail-closed. Allowed `reasonCode` values remain `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
 
 ## Terminal critic gate
 

package/src/defaults/gjc/skills/ultragoal/validation-batch-contracts.md

@@ -6,7 +6,8 @@ Internal Ultragoal sub-skill fragment (`kind: "skill-fragment"`, parent skill `u
 
 - **Non-final members** checkpoint `complete` with a single top-level `deferredToBatch` quality gate (kind `validation-batch-deferred`): a passing `targetedVerification` lane plus a cumulative-since-base change set. An ai-slop-cleaner pass and a full verification rerun are boundary duties and are optional here; when either is supplied it must pass and be blocker-free. A `deferredToBatch` gate must NOT contain `architectReview`, `executorQa`, or `validationBatchClose` — deferring never manufactures fake review approvals.
 - **Lane declaration is fail-closed.** `deferredToBatch.ranLanes` declares which lanes actually ran. A declared lane whose evidence is missing is rejected, evidence for an undeclared lane is rejected, `targetedVerification` must always be declared when `ranLanes` is present, and `ranLanes` can never declare `architectReview` or `executorQa`. Omitting `ranLanes` is allowed only for a gate that carries the mandatory targeted lane alone.
-- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof that covers all member IDs, member metadata hashes, member receipt/checkpoint-ledger-event IDs, per-member change-set hashes, and union change-set coverage. The final close only starts once every non-final member is already `complete` with a structurally fresh deferred receipt (out-of-order close is rejected).
+- **Derivable fields are auto-filled — never hand-compute a hash.** When omitted, the runtime fills `kind`, the batch tuple, `deferredLanes`, and the whole `changeSet` block (`memberGoalId`, `cumulativeFromBase`, `paths` from the computed cumulative diff, `changeSetHash`); the minimal deferred gate is `{"deferredToBatch":{"targetedVerification":{"status":"passed","commands":["..."],"evidence":"..."}}}`. A supplied value must still match reality; `changeSet.paths` rows may be plain path strings or `{path, status}` objects.
+- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof that covers all member IDs, member metadata hashes, member receipt/checkpoint-ledger-event IDs, per-member change-set hashes, and union change-set coverage. Every close field except `coverageEvidence` is auto-filled from durable receipts and the computed cumulative diff when omitted — the minimal close is `{"validationBatchClose":{"coverageEvidence":"..."}}` alongside the strict gate, and a supplied value must still match durable state. The final close only starts once every non-final member is already `complete` with a structurally fresh deferred receipt (out-of-order close is rejected).
 - Close state is append-only proof: it lives in the final member's checkpoint receipt and matching `goal_checkpointed` ledger row only. Never stamp `closedReceiptId`/`closedAt` or any close-state field onto member goals, and never append a separate close ledger event.
 - Change sets are cumulative-since-base: each member's `changeSet.paths` is the whole-worktree diff vs base (`cumulativeFromBase: true`), `memberGoalId` is a label not a per-path attribution, and `unionChangeSet.paths` carries no per-goal attribution.
 - Batch invalidation is fail-closed: steering mutations that would invalidate a batch are rejected while any member holds a fresh deferred receipt.