@gajae-code/coding-agent 0.12.5 → 0.12.6

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [0.12.6] - 2026-07-31
+### Added
+
+- Added the bundled `lunamaxxing` OpenAI Codex profile, mapping every role to GPT-5.6 Luna with medium default reasoning, xhigh executor reasoning, and maximum planner/critic/architect reasoning.
+
+### Fixed
+
+- Settings now requests a repaint after asynchronous GJC bundle and plugin views rebuild, so loaded content and mutation results appear without an extra keypress (#3643).
+- Deferred `agent_end` publication again settles public session readiness before slow extension handlers finish, while retaining exact cancellation leases through queued extension delivery and draining that delivery before session shutdown.
+- Ultragoal validation-batch hydration now fails closed unless deferred and final-close evidence exactly matches a complete authoritative cumulative Git/CI inventory and durable batch tuple. Explicit malformed, partial, unknown, reordered, or stale receipt data is rejected; Git path capture is byte-safe, NUL-delimited, and includes untracked files; incomplete capture conservatively requires computer-control QA; shared settings and tool registries cannot use partial diffs to bypass that suite; validate/checkpoint replacement hydration is identical; and current/replacement receipts are byte-bound to ledger payloads (#3541).
+- Fixture quality gates that complete intermediate Ultragoal stories now write file-backed adversarial artifact proof; skill-state hooks and computer red-team fixtures match the unconditional adversarial path check so #3543 CI stays fail-closed without weakening hydration exactness (#3543).
+- Runtime settings reconciliation now validates every `web_search.fallback` entry against the declared provider enum instead of accepting unsupported or non-string array items (#3601).
+- Ultragoal critic-gate, dogfood, review, durable-completion, and runtime test suites now pin `CI_DEV_CHANGED_PATHS` hermetically in their setup/teardown. Their temp checkpoints live inside the enclosing git work tree, so the CI planner's changed paths (which include computer control surface paths on branches that touch them) previously leaked into the computed change set and falsely triggered the mandatory computer red-team suite (`COMPUTER_REDTEAM_CASE_MISSING: … must include kill-switch-bypass`). The production kill-switch-bypass gate is unchanged; only the test fixtures now isolate their own contract from the host branch's diff (#3533).
+- Ultragoal critic-gate, dogfood, review, durable-completion, and runtime test suites now relocate temp dirs to `os.tmpdir()` (outside the enclosing git work tree) and pin `CI_DEV_CHANGED_PATHS` to a non-computer test path. The prior in-repo temp dirs caused `computeCheckpointChangeSet` to return `captureIncomplete=true` under parallel shard load (git command timeouts), which unconditionally triggered the mandatory computer red-team suite even when no computer surface was touched. The production kill-switch-bypass gate is unchanged; the `.tmp-*` gitignore entry prevents in-repo test artifacts from polluting untracked-file inventory (#3533).
+- Telegram topic delete settlement is now fence-epoch bound, two-phase, and durably route-atomic. `TopicRegistry.settleDelete` requires the caller's dispatched authority epoch to still equal both the record's own epoch and the session's current epoch, so a held earlier delete can no longer settle a newer scan/close-started fence for the same session and topic and release its quarantine; it now removes the record but deliberately *retains* the topic-id quarantine and returns a settlement token instead of publishing routes, so no colliding survivor becomes routable and no settled id becomes adoptable while the clear is still only in memory. `commitSettledDelete` publishes the rebuilt inbound routes and releases the quarantine only after the durable topic-state persist resolves, and `rollbackSettledDelete` undoes a failed persist as a compare-and-set that applies only while the post-settlement state is still exactly current, so a stale rollback can no longer resurrect a deleted record over a newer fence. A refused settlement returns no token and is therefore structurally incapable of being rolled back. Authority-epoch advancement is routed through a single saturating helper capped at `Number.MAX_SAFE_INTEGER`, and settlement fails closed (keeping the fence) on a non-safe-integer, negative, or already-saturated epoch instead of settling against an unsound comparison. Telegram's first create-compensation path now marks compensation complete only after that durable clear commits, so a failed persist leaves the fence supervised rather than stranding a cleared memory state against a `delete_pending` disk state.
+- The Telegram notification self-heal reaper now reclaims abandoned publication staging files in the agent `notifications/` directory. `writeJsonAtomic` stages a sibling `<name>.<pid>.<epoch-ms>.<suffix>.tmp` and renames it over the destination; if the staging write or the rename fails, or the process dies between the two, that temp is never published and never read again. No prefix in the reaper's leak-artifact list claimed `.tmp`, so one unreachable file accumulated per failed attempt — permanently, across the roots registry, daemon state, callback aliases, seen-update ids, and the topic registry snapshot. This is most visible where a rename-blocking condition persists (a Windows `EPERM` from an antivirus or indexer holding a handle, `EACCES`, `EIO`, `ENOSPC`). Reaping is shape-matched and still bounded by the existing five-minute mtime grace window, so a temp that an in-flight publication is still staging is never removed, and reclaiming it here also recovers temps orphaned by a crash, which no writer-side unwind can reach.
+- The Telegram notification self-heal reaper now reclaims abandoned publication staging files in the agent `notifications/` directory. `writeJsonAtomic` stages a sibling `<name>.<pid>.<epoch-ms>.<suffix>.tmp` and renames it over the destination; if the staging write or the rename fails, or the process dies between the two, that temp is never published and never read again. No prefix in the reaper's leak-artifact list claimed `.tmp`, so one unreachable file accumulated per failed attempt — permanently, across the roots registry, daemon state, callback aliases, seen-update ids, and the topic registry snapshot. This is most visible where a rename-blocking condition persists (a Windows `EPERM` from an antivirus or indexer holding a handle, `EACCES`, `EIO`, `ENOSPC`). Reclaiming it here also recovers temps orphaned by a crash, which no writer-side unwind can reach. Removal is fenced rather than age-only: the reaper parses the publisher PID out of the temp's own name and removes it only when that publisher is *provably dead*, so a live or slow publication keeps its staged temp however old it is, and an indeterminate liveness probe or an unparseable claim retains the file. A proven-dead temp is still bounded by the existing five-minute mtime grace window, and the deletion itself is bound to a no-follow identity capture (`dev`+`ino`+`size`+`mtime`+content digest, single-link regular files only) executed through the exact-unlink native, so a symlink is never followed and a temp replaced between capture and delete is refused instead of destroying the successor.
+- The Telegram notification self-heal reaper now handles abandoned publication staging files in the agent `notifications/` directory. `writeJsonAtomic` stages a sibling `<name>.<pid>.<epoch-ms>.<suffix>.tmp` and renames it over the destination; a failed staging write or rename, or a process death between those steps, can leave an unreachable file. The reaper parses the publisher PID from the temp name and acts only when that publisher is provably dead and the existing five-minute mtime grace window has elapsed. Deletion is bound to a no-follow identity capture (`dev`+`ino`+`size`+`mtime`+content digest, single-link regular files only) through the exact-unlink native, so symlinks and same-name replacements are retained. A terminal native removal is reported as reclaimed; a typed `cleanup_pending` result is instead reported as skipped, leaves the bytes visible under a recognized exact-unlink placeholder, and later scans preserve that placeholder without pathname churn rather than claiming false removal.
+
+### Fixed
+
+- Canonical wrapped first-event timeouts now continue the same clean turn through bounded retries and configured fallback rotation, while preserving replay-safety, cancellation, provider-terminal policies, exact attempt diagnostics, and task/subagent retry-status truth (#3553).
+- Runtime skill discovery now preserves a candidate when its exact skill name appears as a query token, so additional task-specific terms no longer discard an explicitly named skill.
+
+## [0.12.5] - 2026-07-30
+### Fixed
+
+- ACP and SDK broker session deletion no longer promotes a non-empty retained artifact quarantine to transcript deletion. `cleanup_pending` keeps transcript and exact quarantine authority across retries and restarts while payload bytes survive; root-only transcript preauthorization remains replay-bound and is revalidated after ledger persistence immediately before mutation, while ordinary completion still requires an empty identity-bound root or `artifacts_removed`.
+
 ## [0.12.5] - 2026-07-30
 
 ## [0.12.4] - 2026-07-30
@@ -39,6 +68,7 @@
 - The interactive `Working…` indicator now remains visible and explicitly labels owner-scoped detached background work across foreground completion, provider errors, pending-submission aborts, and job completion, without resurrecting after TUI disposal (#3479).
 - Activity-indicator suspension now detaches and restores the exact owned loader instead of stopping foreign transition UI; optimistic pre-init prompts still show and clear their spinner, context clear retains its eager teardown contract, and resume cancellation preserves transient state until session mutation actually begins.
 - Activity-indicator stop and suspension helpers now fail safely for lightweight controller contexts with absent or partial status rails, while full interactive contexts retain exact loader detach/restore ownership.
+- Bash now uses bounded core-to-native and N-API callback backpressure plus a 64 KiB terminal tail after the core 8 MiB stream budget, emits at most one typed aggregate loss marker, carries source-loss evidence through merged and raw stream cancellation/error paths, bounds ACP terminal lifecycle/output RPC settlement, cleans settled native sessions, labels every combined omission honestly through inline backstops and failure paths, omits false source ranges, and rejects malformed artifact IDs/counts.
 
 ## [0.12.1] - 2026-07-29
 
@@ -48,10 +78,12 @@
 - Team Linux worker memory-guard replacement no longer holds the team task-mutation fence across the successor startup-ack wait, so concurrent `worker-startup-ack` can publish and selector-replacement no longer hangs under CI contention.
 - Kitty/Ghostty inline images no longer remain visually pinned when transcript, pinned, or overlay rows are replaced, removed, scrolled, resized, or fully repainted. The TUI now parses only bounded named placements, soft-deletes overwritten placements from the previously committed physical frame, retains transmitted pixels, and restores placements from application scrollback without retransmitting image data.
 - Reviewer `report_finding` evidence is no longer injected into caller-owned strict JTD completion data; full findings are published separately through a bounded artifact reference, and failed evidence publication now fails the task closed (#2893).
+- Bash output-tail initialization now tolerates constrained `ToolSession` settings adapters that expose `get()` without `has()`, preserving the 1 KiB default and explicit head/tail overrides instead of crashing restricted and interceptor Bash execution.
 - Managed-session startup failures now include their bounded preparation classification (and path-free native durability diagnostic when available), so Windows launch crashes no longer collapse to an unactionable generic error while filesystem paths and raw OS messages remain redacted (#3383).
 - Single-model sessions now rotate immediately to another stored provider credential after a content-free quota or rate-limit failure, without requiring a synthetic model fallback chain. Credential rotation is replay-safe for content-free failures regardless of extension lifecycle participation, and traverses the full credential pool independent of `retry.maxRetries` (#3491).
 - External credential discovery now follows `CLAUDE_CONFIG_DIR` and `CODEX_HOME` instead of always reading `~/.claude` and `~/.codex`, so importing from an account switcher (or any relocated Claude Code / Codex CLI config root) picks up the account the launching shell selected. Both variables resolve through the credential env trust boundary and must be absolute; redacted summaries name the variable, never the resolved path.
 - The `acp_conformance` CI job runs again. The pinned upstream `acpx` checkout resolves its own imports (`@agentclientprotocol/sdk`, `zod`) from its own tree, but its dependencies were never installed, so the corpus runner aborted with `Cannot find module 'zod/v4'` before executing a single case. The checkout is now installed after provenance verification, and the reused warm cache still skips the reinstall.
+- ACP prompt terminalization now binds each accepted execution handle to one immutable cancellation domain, reserves producer ownership before terminal publication, and quarantines only the exact run when settlement cannot be proven. The fixed 10-second fail-closed external error remains unchanged while internal diagnostics report only bounded resource kinds, hashed labels, clamped ages, and omitted counts.
 
 ### Added
 

package/README.md

@@ -33,7 +33,6 @@ gjc config set completion.notifyCommand 'powershell.exe -NoProfile -Command "[Co
 ```
 
 `cmux notify` returning successfully means GJC handed the completion event to cmux. cmux may still suppress the native desktop banner when the app/window is focused, the emitting workspace is active, or the notification panel is open. In those cases, check cmux's notification panel or unread workspace state instead of treating the missing banner as a GJC delivery failure.
-
 Recommended external mapping:
 
 | Notification | Public event | Status guidance |
@@ -87,6 +86,10 @@ export default function lifecycleNotifier(pi: ExtensionAPI) {
 
 This is the supported repo-native lifecycle notification path. It is not Claude Code hook compatibility, and it remains disabled unless the user configures an extension/hook handler and private delivery target.
 
+## Windows psmux authority boundary
+
+On native Windows, GJC-managed psmux sessions persist a per-owner `ProviderAuthority`: the exact resolved executable identity and an isolated tmux-compatible `-L` namespace. `GJC_TMUX_COMMAND` is an executable path/name only, never `psmux -L …`. Recover managed sessions through GJC so it reuses and re-proves that authority; do not fall back to ambient `tmux`/`psmux` or manually recreate a namespace. An unavailable, changed, or ambiguous authority fails closed.
+
 ## Memory backends
 
 The agent supports three mutually-exclusive memory backends, selected via the `memory.backend` setting (Settings → Memory tab, or `~/.gjc/agent/config.yml`):

package/dist/types/eval/backend.d.ts

@@ -10,8 +10,8 @@ export interface ExecutorBackendExecOptions {
     session: ToolSession;
     deadlineMs: number;
     reset: boolean;
-    artifactPath: string | undefined;
-    artifactId: string | undefined;
+    artifactPath?: string;
+    artifactId?: string;
     onChunk: (chunk: string) => void;
 }
 /** Result returned by a backend's execute(). */

package/dist/types/exec/bash-executor.d.ts

@@ -6,7 +6,7 @@ export interface BashArtifactSaveSummary {
     complete: boolean;
     omittedBytes?: number;
 }
-export type BashMinimizedSaveReturn = BashArtifactSaveResult | BashArtifactSaveSummary | string | undefined;
+export type BashMinimizedSaveReturn = BashArtifactSaveResult | BashArtifactSaveSummary | undefined;
 export type BashArtifactSaveResult = {
     status: "saved";
     artifactId: string;
@@ -23,7 +23,7 @@ export type BashArtifactSaveResult = {
     status: "failed";
     diagnostic: string;
 };
-export declare function normalizeMinimizedSaveResultForTests(value: BashMinimizedSaveReturn, originalText: string): BashArtifactSaveResult;
+export declare function normalizeMinimizedSaveResultForTests(value: unknown, _originalText?: string): BashArtifactSaveResult;
 export interface BashExecutorOptions {
     /**
      * Invoked when the native minimizer rewrote the command's output, giving
@@ -80,16 +80,18 @@ export interface BashResult {
     outputBytes: number;
     artifactId?: string;
     artifactTruncatedBytes?: number;
+    /** Bytes dropped before the Bash executor received the native output stream. */
+    sourceTruncatedBytes?: number;
+    /** Exact source capture completeness could not be proven. */
+    sourceCaptureIncomplete?: boolean;
     artifactFailureDiagnostic?: string;
 }
-/** Number of persistent shell sessions currently retained (owner gauge). */
+/** Number of persistent and retiring shell sessions currently retained (owner gauge). */
 export declare function getShellSessionCount(): number;
 /**
- * Dispose all persistent shell sessions: abort in-flight work and drop the
- * strong references so the native shells can be finalized. Healthy persistent
- * sessions are otherwise retained for the whole process lifetime (MEM-7). This
- * is registered as a postmortem cleanup so shutdown/signals release native
- * shell resources, and is also callable directly (e.g. on owner teardown).
+ * Dispose all persistent shell sessions without waiting forever on a native
+ * abort that failed to settle. Quarantine entries are owner-scoped so a late
+ * finalizer cannot erase a successor shell's quarantine.
  */
 export declare function disposeAllShellSessions(): Promise<void>;
 /** Translate `ShellMinimizerSettings` into native `MinimizerOptions`, or `undefined` when disabled. */

package/dist/types/extensibility/extensions/runner.d.ts

@@ -2,9 +2,10 @@
  * Extension runner - executes extensions and manages their lifecycle.
  */
 import type { AgentMessage } from "@gajae-code/agent-core";
-import type { CredentialDisabledEvent, ImageContent, Model, ProviderResponseMetadata } from "@gajae-code/ai";
+import type { AttemptScopeRef, CredentialDisabledEvent, ImageContent, Model, ProviderResponseMetadata } from "@gajae-code/ai";
 import type { KeyId } from "@gajae-code/tui";
 import type { ModelRegistry } from "../../config/model-registry";
+import type { AttemptRecordStore } from "../../session/attempt-record-store";
 import { type SessionManager } from "../../session/session-manager";
 import type { AfterProviderResponseEvent, BeforeAgentStartEvent, BeforeAgentStartEventResult, BeforeProviderRequestEvent, BeforeProviderRequestEventResult, ContextEvent, Extension, ExtensionActions, ExtensionCommandContext, ExtensionCommandContextActions, ExtensionContext, ExtensionContextActions, ExtensionError, ExtensionEvent, ExtensionFlag, ExtensionRuntime, ExtensionShortcut, ExtensionUIContext, InputEvent, InputEventResult, MessageRenderer, RegisteredCommand, RegisteredTool, ResourcesDiscoverEvent, SessionBeforeBranchResult, SessionBeforeCompactResult, SessionBeforeSwitchResult, SessionBeforeTreeResult, SessionCompactingResult, ToolCallEvent, ToolCallEventResult, ToolResultEvent, ToolResultEventResult, UserBashEvent, UserBashEventResult, UserPythonEvent, UserPythonEventResult } from "./types";
 /** Combined result from all before_agent_start handlers */
@@ -91,6 +92,7 @@ export declare class ExtensionRunner {
     onError(listener: ExtensionErrorListener): () => void;
     emitError(error: ExtensionError): void;
     hasHandlers(eventType: string): boolean;
+    setAttemptRecordStore(store: AttemptRecordStore): void;
     getMessageRenderer(customType: string): MessageRenderer | undefined;
     getRegisteredCommands(reserved?: Set<string>): RegisteredCommand[];
     getCommandDiagnostics(): Array<{
@@ -105,9 +107,9 @@ export declare class ExtensionRunner {
      */
     shutdown(): void;
     createCommandContext(): ExtensionCommandContext;
-    emit<TEvent extends RunnerEmitEvent>(event: TEvent, continueWhile?: () => boolean): Promise<RunnerEmitResult<TEvent>>;
-    emitToolResult(event: ToolResultEvent): Promise<ToolResultEventResult | undefined>;
-    emitToolCall(event: ToolCallEvent): Promise<ToolCallEventResult | undefined>;
+    emit<TEvent extends RunnerEmitEvent>(event: TEvent, continueWhile?: () => boolean, scope?: AttemptScopeRef): Promise<RunnerEmitResult<TEvent>>;
+    emitToolResult(event: ToolResultEvent, scope?: AttemptScopeRef): Promise<ToolResultEventResult | undefined>;
+    emitToolCall(event: ToolCallEvent, scope?: AttemptScopeRef): Promise<ToolCallEventResult | undefined>;
     emitUserBash(event: UserBashEvent): Promise<UserBashEventResult | undefined>;
     emitUserPython(event: UserPythonEvent): Promise<UserPythonEventResult | undefined>;
     private emitUserEvent;
@@ -127,9 +129,9 @@ export declare class ExtensionRunner {
     }>;
     /** Emit input event. Transforms chain, "handled" short-circuits. */
     emitInput(text: string, images: ImageContent[] | undefined, source: "interactive" | "sdk" | "extension"): Promise<InputEventResult>;
-    emitContext(messages: AgentMessage[]): Promise<AgentMessage[]>;
-    emitBeforeProviderRequest(payload: unknown): Promise<BeforeProviderRequestEventResult>;
-    emitAfterProviderResponse(response: ProviderResponseMetadata, _model?: Model): Promise<void>;
+    emitContext(messages: AgentMessage[], scope?: AttemptScopeRef): Promise<AgentMessage[]>;
+    emitBeforeProviderRequest(payload: unknown, scope?: AttemptScopeRef): Promise<BeforeProviderRequestEventResult>;
+    emitAfterProviderResponse(response: ProviderResponseMetadata, _model?: Model, scope?: AttemptScopeRef): Promise<void>;
     emitBeforeAgentStart(prompt: string, images: ImageContent[] | undefined, systemPrompt: string[]): Promise<BeforeAgentStartCombinedResult | undefined>;
 }
 export {};

package/dist/types/gjc-runtime/launch-tmux.d.ts

@@ -1,6 +1,6 @@
 import type { Args } from "../cli/args";
-import { buildGjcTmuxExactSessionTarget, buildGjcTmuxProfileCommands, GJC_DEFAULT_TMUX_SESSION, GJC_TMUX_COMMAND_ENV, GJC_TMUX_MOUSE_ENV, GJC_TMUX_PROFILE_ENV, GJC_TMUX_SESSION_PREFIX, type GjcTmuxProfileCommand } from "./tmux-common";
-import { type OwnerIsolationProbeSync } from "./tmux-owner-isolation";
+import { buildGjcTmuxExactSessionTarget, buildGjcTmuxProfileCommands, GJC_DEFAULT_TMUX_SESSION, GJC_TMUX_COMMAND_ENV, GJC_TMUX_MOUSE_ENV, GJC_TMUX_PROFILE_ENV, GJC_TMUX_SESSION_PREFIX, type GjcTmuxProfileCommand, type ProviderAuthority } from "./tmux-common";
+import { type OwnerGenerationBaseline, type OwnerIsolationProbeSync } from "./tmux-owner-isolation";
 import { buildWindowsPowerShellInnerCommand, GJC_TMUX_LAUNCHED_ENV, type WindowsPowerShellInnerCommandOptions } from "./windows-powershell-command";
 export type { WindowsPowerShellInnerCommandOptions };
 export { buildGjcTmuxExactSessionTarget, buildGjcTmuxProfileCommands, buildWindowsPowerShellInnerCommand, GJC_DEFAULT_TMUX_SESSION, GJC_TMUX_COMMAND_ENV, GJC_TMUX_LAUNCHED_ENV, GJC_TMUX_MOUSE_ENV, GJC_TMUX_PROFILE_ENV, GJC_TMUX_SESSION_PREFIX, };
@@ -22,6 +22,23 @@ export interface TmuxLaunchContext {
     platform?: NodeJS.Platform;
     tty?: TtyState;
     spawnSync?: TmuxSpawnSync;
+    /**
+     * Provider authority boundaries. Production resolves, persists, and asserts
+     * the durable psmux authority; tests may inject deterministic equivalents.
+     */
+    providerAuthorityResolver?: (input: {
+        platform: NodeJS.Platform;
+        env: NodeJS.ProcessEnv;
+        command: string;
+        stateDir: string;
+        sessionId: string;
+        generation: string;
+    }) => ProviderAuthority;
+    providerAuthorityPersist?: (authority: ProviderAuthority) => void;
+    /** Re-proves an immutable staged authority before generation publication. */
+    providerAuthorityStagedAssert?: (authority: ProviderAuthority) => void;
+    /** Re-proves a current authority after generation publication. */
+    providerAuthorityAssert?: (authority: ProviderAuthority) => void;
     tmuxAvailable?: boolean;
     tmuxStatusLines?: number;
     worktreeBranch?: string | null;
@@ -80,7 +97,7 @@ export interface TmuxLaunchPlan {
     ownerRunId?: string;
     ownerIncarnation?: string;
     /** Generation state captured before owner-isolation planning; required for publication CAS. */
-    ownerGenerationBaseline?: import("./tmux-owner-isolation").OwnerGenerationBaseline;
+    ownerGenerationBaseline?: OwnerGenerationBaseline;
     /** Native tmux session identity emitted atomically by `new-session -P -F`. */
     createdSessionId?: string;
     /** Safe server identity proven immediately after creation. */
@@ -90,6 +107,7 @@ export interface TmuxLaunchPlan {
         pidProven?: boolean;
     };
     isPsmux: boolean;
+    authority?: ProviderAuthority;
     platform: NodeJS.Platform;
 }
 export interface GjcTmuxProfileResult {
@@ -114,6 +132,7 @@ export interface GjcTmuxProfileContext {
     ownerGeneration?: string | null;
     ownerServerKey?: string | null;
     version?: string | null;
+    psmuxIncarnation?: string | null;
 }
 export declare function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProfileResult;
 export declare function buildGjcTmuxWindowTitle(cwd: string, branch: string | null | undefined): string;

package/dist/types/gjc-runtime/psmux-detect.d.ts

@@ -40,6 +40,9 @@ export type ExecutableIdentityResolver = (path: string) => string | null;
 /** @internal Test-only seam; production code never calls this. */
 export declare function __setExecutableIdentityResolverForTests(resolver: ExecutableIdentityResolver | null): void;
 export declare function envDisabled(value: string | undefined): boolean;
+/** Resolve through the same identity-aware seams used by Windows alias detection. */
+export declare function resolveGjcTmuxExecutablePath(command: string): string | null;
+export declare function resolveGjcTmuxExecutableIdentity(executablePath: string): string | null;
 /**
  * Decide whether command resolves to a psmux binary by probing its version
  * output. The result is cached per process unless force is set or

package/dist/types/gjc-runtime/team-launch.d.ts

@@ -1,4 +1,5 @@
 import type { GjcTeamConfig, GjcTeamSnapshot, GjcTeamStartOptions, GjcTeamTask, GjcTeamWorker, GjcTeamWorkerCli, GjcTeamWorkerLifecycle, GjcTeamWorktreeMode } from "./team-runtime";
+import { type ProviderAuthority } from "./tmux-provider-context";
 /** Launch-specific option wiring kept separate from runtime dispatch. */
 export declare function withTeamLaunchTransport(options: GjcTeamStartOptions, mailboxDeliveryTransport: GjcTeamStartOptions["mailboxDeliveryTransport"]): GjcTeamStartOptions;
 /** @internal Exported for unit tests. */
@@ -6,6 +7,7 @@ export declare function buildWorkerCommand(config: GjcTeamConfig, worker: GjcTea
 interface GjcTmuxBinary {
     command: string;
     isPsmux: boolean;
+    viaExplicitOverride: boolean;
 }
 interface GjcTmuxLeaderContext {
     sessionName: string;
@@ -25,7 +27,7 @@ export interface GjcTeamLaunchRuntime {
         env: NodeJS.ProcessEnv;
         platform: NodeJS.Platform;
     }): GjcTmuxBinary;
-    readTmuxLeaderContext(tmuxCommand: string, env: NodeJS.ProcessEnv): GjcTmuxLeaderContext;
+    readTmuxLeaderContext(tmuxCommand: string, env: NodeJS.ProcessEnv, authority: ProviderAuthority): GjcTmuxLeaderContext;
     buildWorkers(workerCount: number, agentType: string, stateRoot: string): GjcTeamWorker[];
     buildInitialTasks(task: string, workers: GjcTeamWorker[]): GjcTeamTask[];
     ensureWorkerWorktree(cwd: string, dir: string, teamName: string, worker: GjcTeamWorker, mode: GjcTeamWorktreeMode, platform: NodeJS.Platform, isPsmux: boolean): Promise<GjcTeamWorker>;

package/dist/types/gjc-runtime/team-runtime.d.ts

@@ -44,6 +44,12 @@ export type GjcTeamWorktreeMode = {
     name: string;
 };
 export interface GjcTeamConfig {
+    /**
+     * Launch-time platform. Persisted so the monitor path resolves the same
+     * provider context the launch did instead of re-reading `process.platform`,
+     * which makes Windows-authority branches unreachable off Windows.
+     */
+    platform?: NodeJS.Platform;
     team_name: string;
     display_name: string;
     requested_name: string;
@@ -59,6 +65,9 @@ export interface GjcTeamConfig {
     tmux_session: string;
     tmux_session_name: string;
     tmux_target: string;
+    tmux_provider_generation?: string;
+    tmux_provider_state_dir?: string;
+    tmux_provider_session_id?: string;
     workspace_mode: "direct" | "worktree";
     dry_run: boolean;
     leader: GjcTeamLeader;
@@ -200,7 +209,7 @@ export interface GjcWorkerIntegrationAttemptRequestResult {
 export interface GjcWorkerIntegrationAttemptOptions {
     signal?: AbortSignal;
 }
-export declare const GJC_TEAM_API_OPERATIONS: readonly ["send-message", "broadcast", "mailbox-list", "mailbox-mark-delivered", "mailbox-mark-notified", "notification-list", "notification-read", "notification-replay", "notification-mark-pane-attempt", "worker-startup-ack", "create-task", "read-task", "list-tasks", "update-task", "claim-task", "transition-task-status", "transition-task", "release-task-claim", "read-config", "read-manifest", "read-worker-status", "update-worker-status", "read-worker-heartbeat", "recover-stale-claims", "update-worker-heartbeat", "read-worker-memory-guard", "update-worker-memory-guard", "apply-worker-memory-guard", "write-worker-inbox", "write-worker-identity", "append-event", "read-events", "read-traces", "await-event", "write-shutdown-request", "read-shutdown-ack", "read-monitor-snapshot", "write-monitor-snapshot", "read-task-approval", "write-task-approval"];
+export declare const GJC_TEAM_API_OPERATIONS: readonly ["send-message", "broadcast", "mailbox-list", "mailbox-mark-delivered", "mailbox-mark-notified", "notification-list", "notification-read", "notification-replay", "notification-mark-pane-attempt", "worker-startup-ack", "worker-continuation-ack", "create-task", "read-task", "list-tasks", "update-task", "claim-task", "transition-task-status", "transition-task", "release-task-claim", "read-config", "read-manifest", "read-worker-status", "update-worker-status", "read-worker-heartbeat", "recover-stale-claims", "update-worker-heartbeat", "read-worker-memory-guard", "update-worker-memory-guard", "apply-worker-memory-guard", "write-worker-inbox", "write-worker-identity", "append-event", "read-events", "read-traces", "await-event", "write-shutdown-request", "read-shutdown-ack", "read-monitor-snapshot", "write-monitor-snapshot", "read-task-approval", "write-task-approval"];
 export type GjcTeamApiOperation = (typeof GJC_TEAM_API_OPERATIONS)[number];
 export declare class UnknownGjcTeamApiOperationError extends Error {
     readonly code = "unknown_team_api_operation";
@@ -212,8 +221,11 @@ export interface GjcTeamRuntimeTestSeams {
     nowMs?: () => number;
     continuationTmuxDispatch?: (command: string, args: readonly string[]) => {
         exitCode?: number;
-    };
+    } | Promise<{
+        exitCode?: number;
+    }>;
     continuationBeforeDispatch?: () => Promise<void>;
+    continuationAckPoll?: () => Promise<void>;
 }
 /** @internal Test-only seam; production code leaves the real clock and tmux dispatch intact. */
 export declare function __setGjcTeamRuntimeTestSeamsForTests(seams: GjcTeamRuntimeTestSeams | undefined): void;

package/dist/types/gjc-runtime/team-store.d.ts

@@ -129,10 +129,6 @@ type EventAppender = (event: {
 /** The sole strict schema gate for persisted task and claim authority records. */
 export declare function isCanonicalPersistedGjcTeamTaskClaim(value: unknown): value is GjcTeamTaskClaim;
 export declare function isCanonicalPersistedGjcTeamTask(value: unknown, fileId?: string): value is GjcTeamTask;
-/**
- * Serializes mutable team facts across processes. Callers must not re-enter this
- * fence; use unlocked helpers when composing operations under one transaction.
- */
 export declare function withGjcTeamMutationFence<T>(dir: string, fn: () => Promise<T>): Promise<T>;
 export declare function taskMetadataFromInput(input: Record<string, unknown>, includeOwner?: boolean): GjcTeamTaskMetadataInput;
 export declare function normalizeGjcTeamTask(raw: GjcTeamTask): GjcTeamTask;

package/dist/types/gjc-runtime/team-workers.d.ts

@@ -15,6 +15,7 @@ export interface GjcTeamWorkerRuntime {
     workerDir(dir: string, worker: string): string;
     readJson<T>(filePath: string): Promise<T | null>;
     writeJson(filePath: string, value: unknown): Promise<void>;
+    withTaskMutation<T>(dir: string, fn: (capability: GjcTeamTaskMutationCapability) => Promise<T>): Promise<T>;
     appendEvent(dir: string, event: {
         type: string;
         worker?: string;
@@ -67,9 +68,13 @@ export declare function updateGjcWorkerStatus(runtime: GjcTeamWorkerRuntime, tea
 export declare function readGjcWorkerHeartbeat(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<WorkerHeartbeatFile | null>;
 export declare function updateGjcWorkerHeartbeat(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, heartbeat: WorkerHeartbeatFile, cwd?: string, env?: NodeJS.ProcessEnv): Promise<WorkerHeartbeatFile>;
 export declare function writeGjcWorkerStartupAck(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, cwd: string, env: NodeJS.ProcessEnv, input: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare const GJC_TEAM_CONTINUATION_ACK_POLL_MS = 50;
+export declare function isValidGjcContinuationAck(value: unknown, reservation: Record<string, unknown>, incident: string, attempt: number): value is Record<string, unknown>;
+export declare function writeGjcWorkerContinuationAck(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, cwd: string, env: NodeJS.ProcessEnv, input: Record<string, unknown>): Promise<Record<string, unknown>>;
 export declare function writeGjcShutdownRequest(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, requestedBy: string, cwd: string | undefined, env: NodeJS.ProcessEnv | undefined, requestId: string, mode?: GjcTeamShutdownMode, requestedAt?: string): Promise<Record<string, unknown>>;
 export declare function readGjcShutdownAck(runtime: GjcTeamWorkerRuntime, teamName: string, worker: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<Record<string, unknown> | null>;
 export declare const GJC_TEAM_CONTINUATION_PROMPT = "Continue only your current claimed GJC team task. Re-read current GJC team state; do not replay prior output; report status.";
+export declare function buildGjcContinuationPrompt(reservation: Record<string, unknown>): string;
 export declare function gjcContinuationReservationDigest(reservation: Record<string, unknown>): string;
 export declare function isValidGjcContinuationReservation(value: unknown, incident: string, attempt: number, config: GjcTeamConfig, worker: string, task: GjcTeamTask, claim: GjcTeamTaskClaim, heartbeatAt: string, paneId: string): value is Record<string, unknown>;
 export declare function isValidGjcContinuationOutcome(value: unknown, reservation: Record<string, unknown>, incident: string, attempt: number): value is Record<string, unknown>;

package/dist/types/gjc-runtime/tmux-common.d.ts

@@ -1,4 +1,5 @@
 import type { ResolvedTmuxBinary } from "./psmux-detect";
+export { assertGjcTmuxMutationAuthoritySync, bindGjcTmuxProviderAuthority, buildTmuxProviderCommand, hasGjcTmuxProviderAuthoritySync, type ProviderAuthority, type ProviderContext, persistGjcTmuxProviderAuthoritySync, readGjcTmuxProviderAuthoritySync, resolveGjcTmuxProviderContext, type TmuxProviderKind, } from "./tmux-provider-context";
 export declare const GJC_DEFAULT_TMUX_SESSION = "gajae_code";
 export declare const GJC_TMUX_SESSION_PREFIX = "gajae_code_";
 export declare const GJC_TMUX_COMMAND_ENV = "GJC_TMUX_COMMAND";

package/dist/types/gjc-runtime/tmux-provider-context.d.ts

@@ -0,0 +1,57 @@
+import { type PsmuxSpawnRunner, type ResolvedTmuxBinary } from "./psmux-detect";
+/** @internal Test-only seam for hermetic Windows authority storage tests. */
+/**
+ * The platform that governs psmux authority decisions, honoring the test
+ * override. Every authority gate must read this rather than `process.platform`,
+ * or a pinned test platform is silently ignored on non-Windows hosts.
+ */
+export declare function gjcTmuxAuthorityPlatform(): NodeJS.Platform;
+export declare function __setTmuxProviderAuthorityPlatformForTests(platform: NodeJS.Platform | null): void;
+export type TmuxProviderKind = "native-tmux" | "windows-psmux";
+/** A structured tmux provider. Native tmux intentionally has no prefix. */
+export interface ProviderContext {
+    readonly kind: TmuxProviderKind;
+    readonly command: string;
+    readonly commandPrefix: readonly string[];
+    readonly namespace: string | null;
+    readonly executableIdentity: string | null;
+    readonly binary: ResolvedTmuxBinary;
+    readonly platform: NodeJS.Platform;
+}
+/** Durable authority binding for one owner generation. */
+export interface ProviderAuthority extends ProviderContext {
+    readonly stateDir: string;
+    readonly sessionId: string;
+    readonly generation: string;
+}
+/** Resolve a structured provider. Native tmux remains byte-for-byte argv compatible. */
+export declare function resolveGjcTmuxProviderContext(options?: {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    runner?: PsmuxSpawnRunner;
+    binary?: ResolvedTmuxBinary;
+}): ProviderContext;
+export declare function buildTmuxProviderCommand(context: ProviderContext, command: string, args?: readonly string[]): string[];
+/** Returns whether an owner generation has a persisted Windows psmux authority. */
+export declare function hasGjcTmuxProviderAuthoritySync(input: {
+    stateDir: string;
+    sessionId: string;
+    generation: string;
+}): boolean;
+export declare function bindGjcTmuxProviderAuthority(context: ProviderContext, input: {
+    stateDir: string;
+    sessionId: string;
+    generation: string;
+}): ProviderAuthority;
+export declare function persistGjcTmuxProviderAuthoritySync(authority: ProviderAuthority): void;
+export declare function readGjcTmuxProviderAuthoritySync(input: {
+    stateDir: string;
+    sessionId: string;
+    generation: string;
+}): ProviderAuthority;
+/** Enumerates owner-secured, executable-validated psmux authorities in one durable state root. */
+export declare function listGjcTmuxProviderAuthoritiesSync(stateDirInput: string): ProviderAuthority[];
+/** Re-proves the staged immutable record and executable identity before generation publication. */
+export declare function assertGjcTmuxStagedMutationAuthoritySync(authority: ProviderAuthority): void;
+/** Re-proves the current pointer, exact executable identity, and native root before mutation. */
+export declare function assertGjcTmuxMutationAuthoritySync(authority: ProviderAuthority): void;

package/dist/types/gjc-runtime/tmux-sessions.d.ts

@@ -1,3 +1,4 @@
+import { type ProviderAuthority } from "./tmux-common";
 import { type OwnerIsolationProbeSync, type PlanResponse, type TmuxOwnerIsolationExecutionDependencies, type TmuxOwnerIsolationExecutionResult } from "./tmux-owner-isolation";
 export interface GjcTmuxSessionStatus {
     name: string;
@@ -14,6 +15,9 @@ export interface GjcTmuxSessionStatus {
     version?: string;
     ownerGeneration?: string;
     nativeSessionId?: string;
+    psmuxIncarnation?: string;
+    /** Exact durable provider binding used to discover this psmux session. */
+    providerAuthority?: ProviderAuthority;
     panePids: number[];
     profile?: string;
 }
@@ -27,6 +31,7 @@ export interface GjcTmuxSessionTagsForGc {
     version?: string;
     ownerGeneration?: string;
     nativeSessionId?: string;
+    psmuxIncarnation?: string;
     createdAt?: string;
     attached?: boolean;
     panePids?: number[];
@@ -39,6 +44,7 @@ export interface ProvenTmuxSessionIdentity {
     nativeSessionId: string;
     serverPid: number;
     serverStartTime: string;
+    psmuxIncarnation?: string;
 }
 export interface ExpectedGjcTmuxSessionIdentity {
     nativeSessionId: string;
@@ -47,6 +53,7 @@ export interface ExpectedGjcTmuxSessionIdentity {
     sessionStateFile: string;
     project: string;
     createdAt: string;
+    psmuxIncarnation?: string;
 }
 export interface ExactOwnerIdentity {
     sessionId: string;
@@ -85,7 +92,7 @@ export declare function findGjcTmuxSessionByScope(project: string, branch: strin
 export declare function statusGjcTmuxSession(sessionName: string, env?: NodeJS.ProcessEnv): GjcTmuxSessionStatus;
 export declare function createGjcTmuxSession(env?: NodeJS.ProcessEnv, options?: CreateGjcTmuxSessionOptions): GjcTmuxSessionStatus;
 /** Proves a managed reusable name still resolves to one immutable session on one server. */
-export declare function proveGjcTmuxSessionMutationTarget(sessionName: string, env?: NodeJS.ProcessEnv): ProvenTmuxSessionIdentity;
+export declare function proveGjcTmuxSessionMutationTarget(sessionName: string, env?: NodeJS.ProcessEnv, provisionalAuthority?: ProviderAuthority): ProvenTmuxSessionIdentity;
 /** @internal */
 export declare function readTmuxSessionTagsForGc(sessionName: string, env?: NodeJS.ProcessEnv): GjcTmuxSessionTagsForGc;
 export declare function removeGjcTmuxSession(sessionName: string, env?: NodeJS.ProcessEnv, expectedIdentity?: ExpectedGjcTmuxSessionIdentity): GjcTmuxSessionStatus;

package/dist/types/gjc-runtime/ultragoal-change-set.d.ts

@@ -9,5 +9,8 @@ export declare function spawnText(command: string[], options: {
 }>;
 export declare function resolveGitBase(cwd: string, branch?: string): Promise<string>;
 export declare function parseGitNameStatus(output: string): UltragoalChangeSetPath[];
+export declare function parseGitUntrackedPaths(output: string): UltragoalChangeSetPath[];
+export declare function ciDevChangedPathRows(): UltragoalChangeSetPath[];
+export declare function mergeChangeSetPaths(groups: UltragoalChangeSetPath[][]): UltragoalChangeSetPath[];
 export declare function computeCheckpointChangeSet(cwd: string): Promise<UltragoalChangeSet | undefined>;
 export declare function parseUnifiedDiffPaths(diff: string): UltragoalChangeSetPath[];

package/dist/types/gjc-runtime/ultragoal-review-source.d.ts

@@ -0,0 +1,83 @@
+import type { RepositoryBinding } from "./repository-binding";
+export declare const REVIEW_SOURCE_COHORT_SCHEMA: "gjc.review_source_cohort.v1";
+export type ReviewSourceWorkflow = "ultragoal" | "ralplan";
+export type ReviewSourceLane = "cleaner" | "architect" | "qa" | "critic";
+export type ReviewDeliveryDisposition = "current" | "stale_review_delivery" | "invalid_provenance";
+export interface ReviewSourceDispatch {
+    schema: "gjc.review_source_dispatch.v1";
+    cohortId: string;
+    generation: number;
+    dispatchId: string;
+    taskId: string;
+    lane: ReviewSourceLane;
+    snapshotId: string;
+    repositoryBindingDigest: string;
+    stateRevision: number;
+    rerunCommand: string;
+    createdAt: string;
+}
+export interface ReviewSourceDelivery {
+    deliveryId: string;
+    taskId: string;
+    lane: ReviewSourceLane;
+    snapshotId: string;
+    disposition: ReviewDeliveryDisposition;
+    receivedAt: string;
+    rerunCommand?: string;
+    cohortId: string;
+    dispatchId: string;
+}
+export interface ReviewSourceCohort {
+    schema: typeof REVIEW_SOURCE_COHORT_SCHEMA;
+    cohortId: string;
+    workflow: ReviewSourceWorkflow;
+    generation: number;
+    snapshotId: string;
+    repositoryBindingDigest: string;
+    stateRevision: number;
+    createdAt: string;
+    status: "active" | "superseded";
+    supersededBy?: string;
+    dispatches: ReviewSourceDispatch[];
+    deliveries: ReviewSourceDelivery[];
+}
+interface CapturedReviewSource {
+    snapshotId: string;
+    repositoryBindingDigest: string;
+}
+export declare function captureReviewSourceSnapshot(cwd: string, repositoryBinding: RepositoryBinding): Promise<CapturedReviewSource>;
+export declare function createReviewSourceCohort(input: {
+    workflow: ReviewSourceWorkflow;
+    generation: number;
+    snapshotId: string;
+    repositoryBindingDigest: string;
+    stateRevision: number;
+    now?: string;
+}): ReviewSourceCohort;
+export declare function createReviewSourceDispatch(input: {
+    cohort: ReviewSourceCohort;
+    taskId: string;
+    lane: ReviewSourceLane;
+    rerunCommand: string;
+    now?: string;
+}): ReviewSourceDispatch;
+export declare function normalizeReviewSourceCohorts(value: unknown): ReviewSourceCohort[];
+export declare function reconcileReviewSourceDelivery(input: {
+    cwd: string;
+    repositoryBinding: RepositoryBinding;
+    reviewSource: {
+        schema: "gjc.review_source_dispatch.v1";
+        cohortId: string;
+        generation: number;
+        lane: ReviewSourceLane;
+        snapshotId: string;
+        repositoryBindingDigest: string;
+        stateRevision: number;
+        dispatchId: string;
+        rerunCommand: string;
+    };
+}): Promise<{
+    disposition: ReviewDeliveryDisposition;
+    currentSnapshotId?: string;
+}>;
+export {};