@gethmy/agent 1.32.0 → 1.34.0

package/dist/cli.js

@@ -841,6 +841,31 @@ function findRemovedConfigKeys(rawConfig) {
   }
   return found;
 }
+function sandboxConfigIssues(args) {
+  const out = [];
+  if (args.image && !/^[A-Za-z0-9]/.test(args.image)) {
+    out.push(`${args.imagePath}: must start with a letter or digit (got "${args.image}") — a leading "-" is read by docker as a flag, not an image`);
+  }
+  if (args.timeoutPath !== undefined) {
+    const ms = args.timeoutMs;
+    if (typeof ms !== "number" || !Number.isInteger(ms) || ms < 1) {
+      out.push(`${args.timeoutPath}: must be an integer >= 1 (got ${ms})`);
+    }
+  }
+  return out;
+}
+function validateVerificationConfig(config) {
+  const v = config.verification;
+  const issues = sandboxConfigIssues({
+    image: v.sandboxImage,
+    imagePath: "verification.sandboxImage"
+  });
+  if (issues.length > 0) {
+    throw new ConfigValidationError(`Invalid verification config:
+  - ${issues.join(`
+  - `)}`, issues);
+  }
+}
 function validateAutoMergeConfig(config) {
   const autoMerge = config.review.autoMerge;
   const issues = [];
@@ -869,18 +894,18 @@ function validateAutoMergeConfig(config) {
     if (!autoMerge.reReviewOnBranchChange) {
       issues.push("review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.reReviewOnBranchChange — without it a machine-authored repair could merge with nothing having reviewed its diff");
     }
-    if (patch.sandboxImage && !/^[A-Za-z0-9]/.test(patch.sandboxImage)) {
-      issues.push(`review.autoMerge.ciRepair.patch.sandboxImage: must start with a letter or digit (got "${patch.sandboxImage}") — a leading "-" is read by docker as a flag, not an image`);
-    }
+    issues.push(...sandboxConfigIssues({
+      image: patch.sandboxImage,
+      timeoutMs: patch.sandboxTimeoutMs,
+      imagePath: "review.autoMerge.ciRepair.patch.sandboxImage",
+      timeoutPath: "review.autoMerge.ciRepair.patch.sandboxTimeoutMs"
+    }));
     if (!Number.isInteger(patch.maxTurns) || patch.maxTurns < 1) {
       issues.push(`review.autoMerge.ciRepair.patch.maxTurns: must be an integer >= 1 (got ${patch.maxTurns})`);
     }
     if (!(patch.maxBudgetUsd > 0)) {
       issues.push(`review.autoMerge.ciRepair.patch.maxBudgetUsd: must be greater than 0 (got ${patch.maxBudgetUsd})`);
     }
-    if (!Number.isInteger(patch.sandboxTimeoutMs) || patch.sandboxTimeoutMs < 1) {
-      issues.push(`review.autoMerge.ciRepair.patch.sandboxTimeoutMs: must be an integer >= 1 (got ${patch.sandboxTimeoutMs})`);
-    }
   }
   const independent = autoMerge.independentReview;
   if (typeof independent?.enabled !== "boolean") {
@@ -1106,14 +1131,13 @@ function isDaemonAuthoredComment(comment, identity) {
   return true;
 }
 // ../harmony-shared/dist/agentStaleness.js
-var AGENT_HEARTBEAT_LIVENESS_MS, AGENT_MILESTONE_LIVENESS_MS, AGENT_SWEEP_DAEMON_MS, AGENT_SWEEP_INTERACTIVE_MS, AGENT_SWEEP_PAUSED_MS, SWEPT_SESSION_WRITE_GRACE_MS, ACTIVE_STATUSES, NOTICE_DRIVER = "notice";
+var AGENT_HEARTBEAT_LIVENESS_MS, AGENT_MILESTONE_LIVENESS_MS, AGENT_SWEEP_DAEMON_MS, AGENT_SWEEP_INTERACTIVE_MS, AGENT_SWEEP_PAUSED_MS, ACTIVE_STATUSES, NOTICE_DRIVER = "notice";
 var init_agentStaleness = __esm(() => {
   AGENT_HEARTBEAT_LIVENESS_MS = 5 * 60 * 1000;
   AGENT_MILESTONE_LIVENESS_MS = 30 * 60 * 1000;
   AGENT_SWEEP_DAEMON_MS = 30 * 60 * 1000;
   AGENT_SWEEP_INTERACTIVE_MS = 2 * 60 * 60 * 1000;
   AGENT_SWEEP_PAUSED_MS = 4 * 60 * 60 * 1000;
-  SWEPT_SESSION_WRITE_GRACE_MS = 60 * 60 * 1000;
   ACTIVE_STATUSES = new Set(["working", "blocked", "waiting"]);
 });
 // ../harmony-shared/dist/branchRef.js
@@ -2750,6 +2774,7 @@ var init_types2 = __esm(() => {
       devServerBasePort: 4200,
       timeout: 120000,
       testTimeout: 600000,
+      sandboxImage: "",
       failColumn: "To Do"
     },
     review: {
@@ -4692,6 +4717,9 @@ function formatBudgetComment(i) {
     if (i.lastAction)
       lines.push(`Last action: ${i.lastAction}.`);
   }
+  if (i.hasCommits === false) {
+    lines.push("No commits yet — nothing on the branch past where this run started.");
+  }
   lines.push(i.branchName ? `The work is parked, not lost: branch \`${i.branchName}\`, worktree kept.` : "The work is parked, not lost.");
   lines.push(i.trigger === "account_limit" ? "Raise the limit, then run `harmony-agent resume` — that releases every card parked on it, this one included." : i.trigger === "max_attempts" ? `Continue to start a fresh attempt, or stop and I'll hand the card back.` : `Continue to pick up from where I stopped with a fresh turn budget, or stop and I'll hand the card back.`);
   const cap = i.cardTurnCap;
@@ -5233,7 +5261,8 @@ import {
   reportFindings,
   runFormatFix,
   runVerification,
-  teardownWorktree
+  teardownWorktree,
+  verificationSandbox
 } from "@gethmy/harness";
 function formatTokenCount(tokens) {
   if (tokens >= 1e6)
@@ -5275,7 +5304,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
     revertWarnings: []
   };
   if (config.verification.enabled && config.verification.lint) {
-    runFormatFix(worktreePath, config.verification.timeout, workerId);
+    await runFormatFix(worktreePath, config.verification.timeout, workerId, verificationSandbox(config));
   }
   commitUncommittedChanges(worktreePath, card);
   const hasCommits = checkHasCommits(worktreePath, config.worktree.baseBranch, runBaselineSha);
@@ -5296,7 +5325,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
       } else {
         await endRunSession({ client, tag: TAG15 }, card, { status: "completed" }, buildTokenPayload(sessionStats), "throw");
       }
-      await teardownWorktree(client, card.id, worktreePath, branchName);
+      await teardownWorktree(client, card.id, worktreePath, branchName, agentSessionId);
       return true;
     }
     log16.warn(TAG15, `No commits on branch ${branchName} — ${failureSummary}; counting as a failed attempt`);
@@ -5313,7 +5342,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
       failureSummary,
       ...buildTokenPayload(sessionStats)
     });
-    await teardownWorktree(client, card.id, worktreePath, branchName);
+    await teardownWorktree(client, card.id, worktreePath, branchName, agentSessionId);
     return false;
   }
   log16.info(TAG15, `Pushing branch ${branchName} (pre-verify)...`);
@@ -5408,7 +5437,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
         recoveryBranch: branchName,
         ...buildTokenPayload(sessionStats)
       });
-      await teardownWorktree(client, card.id, worktreePath, branchName);
+      await teardownWorktree(client, card.id, worktreePath, branchName, agentSessionId);
       return false;
     }
     log16.info(TAG15, `Verification passed for #${card.short_id}`);
@@ -5455,7 +5484,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
       agentSessionId: agentSessionId ?? null
     });
   }
-  await teardownWorktree(client, card.id, worktreePath, branchName);
+  await teardownWorktree(client, card.id, worktreePath, branchName, agentSessionId);
   log16.info(TAG15, `Completion done for #${card.short_id}${prUrl ? ` — PR: ${prUrl}` : ""}`);
   return true;
 }
@@ -5521,7 +5550,7 @@ function commitUncommittedChanges(worktreePath, card) {
     return false;
   }
 }
-function checkHasCommits(worktreePath, baseBranch, baselineSha, gitImpl = (args, cwd) => execFileSync5("git", [...GIT_NO_HOOKS6, ...args], {
+function measureRunCommits(worktreePath, baseBranch, baselineSha, gitImpl = (args, cwd) => execFileSync5("git", [...GIT_NO_HOOKS6, ...args], {
   cwd,
   encoding: "utf-8"
 })) {
@@ -5529,16 +5558,22 @@ function checkHasCommits(worktreePath, baseBranch, baselineSha, gitImpl = (args,
     try {
       gitImpl(["merge-base", "--is-ancestor", baselineSha, "HEAD"], worktreePath);
     } catch {
-      return false;
+      return "unknown";
     }
   }
   const range = baselineSha ? `${baselineSha}..HEAD` : `origin/${baseBranch}..HEAD`;
+  let count;
   try {
-    const count = gitImpl(["rev-list", "--count", range], worktreePath).trim();
-    return parseInt(count, 10) > 0;
+    count = parseInt(gitImpl(["rev-list", "--count", range], worktreePath).trim(), 10);
   } catch {
-    return false;
+    return "unknown";
   }
+  if (!Number.isFinite(count))
+    return "unknown";
+  return count > 0 ? "committed" : "none";
+}
+function checkHasCommits(worktreePath, baseBranch, baselineSha, gitImpl) {
+  return measureRunCommits(worktreePath, baseBranch, baselineSha, gitImpl) === "committed";
 }
 function stripDaemonBlocks(description) {
   const indices = [SUMMARY_MARKER, BRANCH_PROVENANCE_MARKER].map((marker) => description.indexOf(marker)).filter((index) => index >= 0);
@@ -6437,9 +6472,12 @@ function stripReviewSummary(description) {
     return description;
   return description.slice(0, idx).trimEnd();
 }
-async function postReviewComment(client, card, commentType, body) {
+async function postReviewComment(client, card, commentType, body, agentSessionId) {
   try {
-    await client.addComment(card.id, body, { commentType });
+    await client.addComment(card.id, body, {
+      commentType,
+      agentSessionId: agentSessionId ?? undefined
+    });
   } catch (err) {
     log19.error(TAG18, `Failed to post review comment to #${card.short_id}: ${err instanceof Error ? err.message : err}`);
   }
@@ -6505,7 +6543,7 @@ ${runLogTail}
       ].filter(Boolean).join(`
 
 `);
-      await postReviewComment(client, card, "blocker", body);
+      await postReviewComment(client, card, "blocker", body, agentSessionId);
     }
     await client.endAgentSession(card.id, {
       status: "paused",
@@ -6584,7 +6622,7 @@ ${runLogTail}
       ].filter(Boolean).join(`
 
 `);
-      await postReviewComment(client, card, "decision", body);
+      await postReviewComment(client, card, "decision", body, agentSessionId);
     }
     await client.endAgentSession(card.id, {
       status: "completed",
@@ -6612,7 +6650,7 @@ ${runLogTail}
       ].filter(Boolean).join(`
 
 `);
-      await postReviewComment(client, card, "blocker", body);
+      await postReviewComment(client, card, "blocker", body, agentSessionId);
       await client.endAgentSession(card.id, {
         status: "completed",
         ...buildTokenPayload(sessionStats)
@@ -6648,7 +6686,7 @@ ${runLogTail}
       }));
       if (linkedFindings.length > 0) {
         for (const body2 of buildFindingComments(linkedFindings)) {
-          await postReviewComment(client, card, "finding", body2);
+          await postReviewComment(client, card, "finding", body2, agentSessionId);
         }
       }
       await Promise.all((handbackVerdict.proceed ? minorFindings : []).map(async (finding) => {
@@ -6677,7 +6715,7 @@ ${runLogTail}
       ].filter(Boolean).join(`
 
 `);
-      await postReviewComment(client, card, "summary", body);
+      await postReviewComment(client, card, "summary", body, agentSessionId);
     }
     if (handbackVerdict.proceed && config.planning.enabled && card.plan_id) {
       try {
@@ -7700,19 +7738,20 @@ import {
   buildGateCollectorRegistry,
   cleanupWorktree as cleanupWorktree4,
   collectGateEvidence,
-  containedEnv as containedEnv2,
   DevServerReadinessError,
+  devServerLaunch,
   formatDiffSummary,
   GIT_NO_HOOKS as GIT_NO_HOOKS7,
   implementRunContainmentCliArgs,
   log as log24,
   probeDevServer,
+  removeSandboxContainer,
   resolveStageGate,
   secretEnvKeysToStrip,
   signalGroup,
   spawnInGroup as spawnInGroup2,
-  spawnRunArgs,
   terminateGroup,
+  verificationSandbox as verificationSandbox2,
   waitForDevServer
 } from "@gethmy/harness";
 
@@ -7731,6 +7770,7 @@ class ReviewWorker {
   startedAt = null;
   process = null;
   devServerProcess = null;
+  devServerContainer = null;
   timeoutTimer = null;
   heartbeatTimer = null;
   progressTracker = null;
@@ -7841,7 +7881,10 @@ class ReviewWorker {
         if (crossedTurnCap(before, after, cap)) {
           log24.warn(TAG22, `#${this.stateStore.getRun(this.runId ?? "")?.cardShortId ?? cardId} reached its per-card turn cap on a review leg — ${after} of ${cap} turns. The implement pipeline will not pick it up again until it is reassigned or the cap is raised.`);
           const legs = this.stateStore.getRun(this.runId ?? "")?.legs?.length || 1;
-          await this.client.addComment(cardId, buildTurnCapComment(after, cap, legs), { commentType: "blocker" });
+          await this.client.addComment(cardId, buildTurnCapComment(after, cap, legs), {
+            commentType: "blocker",
+            agentSessionId: this.sessionId ?? undefined
+          });
         }
       } catch {}
     }
@@ -7952,11 +7995,19 @@ class ReviewWorker {
       const port = this.reviewPort;
       const cwd = this.worktreePath;
       log24.info(this.tag, `Starting dev server on port ${port}...`);
-      const [devCmd, devArgs] = spawnRunArgs("dev", "--port", String(port));
-      this.devServerProcess = spawnInGroup2(devCmd, devArgs, {
+      const launch = devServerLaunch({
+        worktreePath: cwd,
+        port,
+        sandbox: verificationSandbox2(this.config)
+      });
+      this.devServerContainer = launch.containerName ?? null;
+      if (launch.containerName) {
+        await removeSandboxContainer(launch.containerName);
+      }
+      this.devServerProcess = spawnInGroup2(launch.cmd, launch.args, {
         cwd,
         stdio: ["ignore", "pipe", "pipe"],
-        env: containedEnv2()
+        stripEnvKeys: secretEnvKeysToStrip()
       });
       let devServerSpawnError = null;
       this.devServerProcess.once("error", (err) => {
@@ -7970,7 +8021,7 @@ class ReviewWorker {
         progressPercent: 10
       });
       if (devServerSpawnError) {
-        throw new DevServerReadinessError(`dev server failed to start (${devCmd}): ${devServerSpawnError.message}`);
+        throw new DevServerReadinessError(`dev server failed to start (${launch.cmd}): ${devServerSpawnError.message}`);
       }
       await waitForDevServer(this.devServerProcess, 30000);
       await probeDevServer(port);
@@ -8230,7 +8281,8 @@ ${userPrompt}`;
     let commentId = null;
     try {
       const res = await this.client.addComment(card.id, body, {
-        commentType: "blocker"
+        commentType: "blocker",
+        agentSessionId: this.sessionId ?? undefined
       });
       commentId = res?.comment?.id ?? null;
     } catch (err) {
@@ -8355,7 +8407,8 @@ ${userPrompt}`;
         ...implementRunContainmentCliArgs({
           worktree: this.worktreePath,
           readOnly: true,
-          extraDisallowedTools: reviewDenylist ? reviewDenylist.split(",").map((t) => t.trim()).filter(Boolean) : undefined
+          extraDisallowedTools: reviewDenylist ? reviewDenylist.split(",").map((t) => t.trim()).filter(Boolean) : undefined,
+          run: this.cardId && this.sessionId ? { cardId: this.cardId, agentSessionId: this.sessionId } : undefined
         }),
         "--",
         prompt
@@ -8473,6 +8526,11 @@ ${userPrompt}`;
       this.devServerProcess = null;
       log24.debug(this.tag, "Killed dev server group");
     }
+    if (this.devServerContainer) {
+      const name = this.devServerContainer;
+      this.devServerContainer = null;
+      removeSandboxContainer(name);
+    }
   }
   cleanup() {
     if (this.timeoutTimer) {
@@ -9078,7 +9136,10 @@ async function dispatchWave(parent, stage, plan, items, deps) {
     created += 1;
   }
   if (created > 0 && plan.truncated > 0) {
-    await deps.client.addComment(parent.id, `Fan-out stage "${stage.name}" capped this batch at ${plan.items.length} of ${plan.total} items (max_iterations). ${plan.truncated} item${plan.truncated === 1 ? " was" : "s were"} not dispatched. Raise the loop's max iterations to cover the rest.`, { commentType: "finding" }).catch(() => {});
+    await deps.client.addComment(parent.id, `Fan-out stage "${stage.name}" capped this batch at ${plan.items.length} of ${plan.total} items (max_iterations). ${plan.truncated} item${plan.truncated === 1 ? " was" : "s were"} not dispatched. Raise the loop's max iterations to cover the rest.`, {
+      commentType: "finding",
+      agentSessionId: deps.agentSessionId ?? undefined
+    }).catch(() => {});
   }
   return created;
 }
@@ -9161,14 +9222,17 @@ function runMotorStage(args, deps) {
     args.repoPath,
     "--session",
     args.sessionId,
-    ...args.metricsPath ? ["--metrics", args.metricsPath] : []
+    ...args.metricsPath ? ["--metrics", args.metricsPath] : [],
+    ...args.sandboxImage?.trim() ? ["--sandbox-image", args.sandboxImage.trim()] : []
   ];
   return new Promise((resolve2) => {
     const child = spawnFn("node", argv, {
       env: {
         ...process.env,
         HARMONY_API_URL: motorApiBase(deps.env.apiUrl),
-        HARMONY_API_KEY: deps.env.apiKey
+        HARMONY_API_KEY: deps.env.apiKey,
+        HARMONY_AGENT_CARD_ID: args.cardId,
+        HARMONY_AGENT_SESSION_ID: args.sessionId
       },
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -9293,6 +9357,26 @@ function runMotorStage(args, deps) {
 var ABORT_SIGINT_GRACE_MS = 12000, ABORT_SIGTERM_GRACE_MS = 6000;
 var init_motor_driver = () => {};
 
+// src/no-commit-notice.ts
+function noCommitNoticeThreshold(turnBudget, fraction = NO_COMMIT_NOTICE_FRACTION) {
+  if (!Number.isFinite(turnBudget) || turnBudget <= 0)
+    return null;
+  if (!Number.isFinite(fraction) || fraction <= 0)
+    return null;
+  return Math.ceil(turnBudget * fraction);
+}
+function shouldCheckForCommits(gate) {
+  if (gate.settled)
+    return false;
+  if (!gate.expectsCommits)
+    return false;
+  const threshold = noCommitNoticeThreshold(gate.turnBudget, gate.fraction);
+  if (threshold === null)
+    return false;
+  return gate.toolCalls >= threshold;
+}
+var NO_COMMIT_NOTICE_FRACTION = 0.75;
+
 // src/stage-advance.ts
 import { gateConfigErrorReason, log as log29 } from "@gethmy/harness";
 function endDispositionFor(outcome) {
@@ -9363,7 +9447,7 @@ async function holdGateMisconfigured(card, stage, detail, deps) {
       currentTask: reason
     });
   } catch {}
-  const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore);
+  const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { agentSessionId: deps.agentSessionId });
   log29.info(TAG27, `#${card.short_id} GateMisconfigured: ${reason}`);
   return { kind: "held_misconfigured", reason, endDisposition };
 }
@@ -9434,7 +9518,12 @@ async function advanceConvergeLoop(card, stage, stageIndex, def, evaluation, loo
         currentTask: reason
       });
     } catch {}
-    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { keepAttempts: true, endStatus: "blocked", blockers: [reason] });
+    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, {
+      keepAttempts: true,
+      endStatus: "blocked",
+      blockers: [reason],
+      agentSessionId: deps.agentSessionId
+    });
     log29.info(TAG27, `#${card.short_id} LoopExhausted: ${reason}`);
     return { kind: "held_gate_unmet", reason, endDisposition };
   }
@@ -9450,7 +9539,10 @@ async function advanceConvergeLoop(card, stage, stageIndex, def, evaluation, loo
   await writeIterationHandoff(card, stage, iteration, maxIterations, evaluation, deps);
   const toColumn = await resolveStageColumnName(deps.client, card, stage) ?? deps.fallbackColumn;
   try {
-    await deps.client.addComment(card.id, `Converge loop — ${summary}. Re-running "${stage.name}".`, { commentType: "progress" });
+    await deps.client.addComment(card.id, `Converge loop — ${summary}. Re-running "${stage.name}".`, {
+      commentType: "progress",
+      agentSessionId: deps.agentSessionId ?? undefined
+    });
   } catch {}
   await runTransition(deps.client, guard.card, {
     move: { columnName: toColumn },
@@ -9474,7 +9566,10 @@ ${findings.map((f) => `- [${f.level}] ${f.message}`).join(`
       decisions: [],
       nextStageNeeds: "Address the findings above on the same branch and re-run; this stage repeats until its exit gate passes."
     });
-    await deps.client.addComment(card.id, body, { commentType: "decision" });
+    await deps.client.addComment(card.id, body, {
+      commentType: "decision",
+      agentSessionId: deps.agentSessionId ?? undefined
+    });
   } catch (err) {
     log29.warn(TAG27, `iteration-handoff write failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
   }
@@ -9509,13 +9604,13 @@ async function advanceStageOnGate(card, stage, stageIndex, def, evaluation, deps
   }
   if (next.kind === "out_of_range") {
     const reason = `Stage advancement aborted: stage index ${stageIndex} is out of range for the pinned playbook version — holding for a human.`;
-    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore);
+    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { agentSessionId: deps.agentSessionId });
     return { kind: "held_misconfigured", reason, endDisposition };
   }
   const toColumn = await resolveStageColumnName(deps.client, card, next.stage);
   if (!toColumn) {
     const reason = `Stage "${stage.name}" passed but the next stage "${next.stage.name}" has no resolvable board column — holding for a human (never moving to an undefined column).`;
-    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore);
+    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { agentSessionId: deps.agentSessionId });
     return { kind: "held_misconfigured", reason, endDisposition };
   }
   await persistStagePointer(deps.client, card, {
@@ -9539,7 +9634,12 @@ async function advanceStageOnGate(card, stage, stageIndex, def, evaluation, deps
   log29.info(TAG27, `#${card.short_id} advanced "${stage.name}" → "${next.stage.name}" (column "${toColumn}")`);
   if (next.stage.owner === "human") {
     const reason = `Stage "${next.stage.name}" is yours: ${handoffText(next.stage)}`;
-    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { keepAttempts: true, endStatus: "blocked", blockers: [reason] });
+    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, {
+      keepAttempts: true,
+      endStatus: "blocked",
+      blockers: [reason],
+      agentSessionId: deps.agentSessionId
+    });
     return {
       kind: "advanced",
       toStageId: next.stage.id,
@@ -9562,7 +9662,12 @@ async function handleGateUnmet(card, stage, summary, deps) {
         currentTask: reason
       });
     } catch {}
-    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, { keepAttempts: true, endStatus: "blocked", blockers: [reason] });
+    const endDisposition = await holdForHuman(deps.client, card, reason, deps.runId, deps.stateStore, {
+      keepAttempts: true,
+      endStatus: "blocked",
+      blockers: [reason],
+      agentSessionId: deps.agentSessionId
+    });
     log29.info(TAG27, `#${card.short_id} GateUnmetExhausted: ${reason}`);
     return { kind: "held_gate_unmet", reason, endDisposition };
   }
@@ -9576,7 +9681,10 @@ async function handleGateUnmet(card, stage, summary, deps) {
   }
   const toColumn = await resolveStageColumnName(deps.client, card, stage) ?? deps.fallbackColumn;
   try {
-    await deps.client.addComment(card.id, `Stage gate unmet — re-running "${stage.name}". ${summary}.`, { commentType: "progress" });
+    await deps.client.addComment(card.id, `Stage gate unmet — re-running "${stage.name}". ${summary}.`, {
+      commentType: "progress",
+      agentSessionId: deps.agentSessionId ?? undefined
+    });
   } catch {}
   await runTransition(deps.client, guard.card, {
     move: { columnName: toColumn },
@@ -9614,7 +9722,10 @@ async function guardStageReclaim(card, what, deps) {
   }
   log29.info(TAG27, `#${card.short_id} ${what} refused — ${detail} (${reason})${released ? "; released the daemon's claim so the stage router stops here" : ""}`);
   try {
-    await deps.client.addComment(card.id, `Stopped the ${what} — ${detail}. The card is not the daemon's to reclaim, so this stage will not re-run until it is assigned back.`, { commentType: "decision" });
+    await deps.client.addComment(card.id, `Stopped the ${what} — ${detail}. The card is not the daemon's to reclaim, so this stage will not re-run until it is assigned back.`, {
+      commentType: "decision",
+      agentSessionId: deps.agentSessionId ?? undefined
+    });
   } catch {}
   return { proceed: false, reason, released };
 }
@@ -9623,7 +9734,10 @@ async function holdForHuman(client, card, reason, runId, stateStore, opts = {})
     await stateStore.decrementAttempt(card.id).catch(() => {});
   }
   try {
-    await client.addComment(card.id, reason, { commentType: "blocker" });
+    await client.addComment(card.id, reason, {
+      commentType: "blocker",
+      agentSessionId: opts.agentSessionId ?? undefined
+    });
   } catch {}
   try {
     await runTransition(client, card, { removeLabels: [AGENT_LABEL] }, { store: stateStore, runId });
@@ -9674,6 +9788,7 @@ import {
   spawnInGroup as spawnInGroup4,
   teardownWorktree as teardownWorktree2,
   terminateGroup as terminateGroup3,
+  verificationSandbox as verificationSandbox3,
   WorktreeBaseError
 } from "@gethmy/harness";
 function sdkDraftLogLine(ev) {
@@ -9790,6 +9905,9 @@ class Worker {
   runTurns = 0;
   chargedCents = 0;
   chargedTurns = 0;
+  runToolCalls = 0;
+  noCommitNoticeSettled = false;
+  runExpectsCommits = true;
   runLegIndex = 0;
   lastRunText = "";
   constructor(id, config, client, identity, onDone, workspaceId, projectId, stateStore, onCardCompleted, onApiError) {
@@ -9893,7 +10011,7 @@ class Worker {
     log30.warn(TAG28, `#${shortId ?? cardId} reached its per-card turn cap — ${after} of ${cap} turns. It will not be picked up again until it is reassigned or the cap is raised.`);
     try {
       const legs = this.stateStore.getRun(this.runId ?? "")?.legs?.length || 1;
-      await this.client.addComment(cardId, buildTurnCapComment(after, cap, legs), { commentType: "blocker" });
+      await this.client.addComment(cardId, buildTurnCapComment(after, cap, legs), { commentType: "blocker", agentSessionId: this.sessionId ?? undefined });
     } catch (err) {
       log30.warn(TAG28, `Could not post the turn-cap notice for ${cardId}: ${err instanceof Error ? err.message : err}`);
     }
@@ -9911,6 +10029,9 @@ class Worker {
     this.runTurns = 0;
     this.chargedCents = 0;
     this.chargedTurns = 0;
+    this.runToolCalls = 0;
+    this.noCommitNoticeSettled = false;
+    this.runExpectsCommits = true;
     this.runLegIndex = 0;
     this.lastRunText = "";
     this.cliSessionId = null;
@@ -10121,10 +10242,12 @@ class Worker {
         this.cancel("timeout");
       }, this.config.maxTimeout);
       this.activeRunSpawnOpts = computeRunSpawnGating(stageCtx.kind === "run" ? stageCtx.allowedTools : null);
+      this.runExpectsCommits = stageCtx.kind === "run" ? stageRunExpectsCommit(stageCtx.stage, stageCtx.allowedTools) : true;
       await this.spawnClaude(prompt, card, subtasks, {
         model: implementModel,
         maxTurns: this.grantedTurns ?? undefined,
         resumeSessionId: this.cliSessionId ?? undefined,
+        noCommitNotice: true,
         ...this.activeRunSpawnOpts ?? {}
       });
       if (this.aborted)
@@ -10157,7 +10280,7 @@ class Worker {
       const onBeforeWorktreeCleanup = stageRun ? async (worktreePath) => {
         stageGateEvaluation = await this.collectStageGateEvidence(card, stageRun.stage, worktreePath, subtasks);
       } : undefined;
-      const completed = await runCompletion(this.client, card, this.branchName, this.worktreePath, this.config, this.id, this.sessionIdentifier, this.identity.agentId, this.lastSessionStats, this.workspaceId, this.sessionId, this.stateStore, this.onCardCompleted, onBeforeWorktreeCleanup, this.runBaselineSha, this.effectiveMaxTurns, stageRun ? stageRunExpectsCommit(stageRun.stage, stageRun.allowedTools) : true);
+      const completed = await runCompletion(this.client, card, this.branchName, this.worktreePath, this.config, this.id, this.sessionIdentifier, this.identity.agentId, this.lastSessionStats, this.workspaceId, this.sessionId, this.stateStore, this.onCardCompleted, onBeforeWorktreeCleanup, this.runBaselineSha, this.effectiveMaxTurns, this.runExpectsCommits);
       if (completed === "park") {
         await this.parkForDecision(card, "max_turns");
         return;
@@ -10234,7 +10357,7 @@ class Worker {
       }
       if (this.worktreePath) {
         try {
-          await teardownWorktree2(this.client, card.id, this.worktreePath, this.branchName ?? undefined);
+          await teardownWorktree2(this.client, card.id, this.worktreePath, this.branchName ?? undefined, this.sessionId);
         } catch {
           log30.warn(this.tag, "Failed to cleanup worktree before requeue");
         }
@@ -10295,7 +10418,7 @@ class Worker {
       } else if (this.runId && this.timedOut) {
         if (this.worktreePath) {
           try {
-            await teardownWorktree2(this.client, card.id, this.worktreePath, this.branchName ?? undefined);
+            await teardownWorktree2(this.client, card.id, this.worktreePath, this.branchName ?? undefined, this.sessionId);
           } catch {
             log30.warn(this.tag, "Failed to cleanup worktree before requeue");
           }
@@ -10543,7 +10666,8 @@ class Worker {
           agentId: this.identity.agentId
         },
         sink: this.cliRunner,
-        isGivenUp: (cardId) => (this.stateStore.getCard(cardId)?.attempts ?? 0) >= this.config.budget.maxAttemptsPerCard
+        isGivenUp: (cardId) => (this.stateStore.getCard(cardId)?.attempts ?? 0) >= this.config.budget.maxAttemptsPerCard,
+        agentSessionId: this.sessionId
       });
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
@@ -10607,7 +10731,10 @@ class Worker {
     log30.info(this.tag, `Holding #${card.short_id}: ${reason}`);
     await this.stateStore.decrementAttempt(card.id);
     try {
-      await this.client.addComment(card.id, reason, { commentType: "blocker" });
+      await this.client.addComment(card.id, reason, {
+        commentType: "blocker",
+        agentSessionId: this.sessionId ?? undefined
+      });
     } catch {}
     try {
       await runTransition(this.client, card, {
@@ -10673,9 +10800,16 @@ class Worker {
     const waitHours = this.config.budget.pause.waitHours;
     const until = computeDecisionDeadline(waitHours);
     log30.warn(this.tag, `#${card.short_id} parked (${trigger}) — awaiting a human decision for ${waitHours}h`);
+    const measured = this.worktreePath && this.runExpectsCommits ? measureRunCommits(this.worktreePath, this.config.worktree.baseBranch, this.runBaselineSha) : "unknown";
+    const hasCommits = measured === "unknown" ? undefined : measured === "committed";
+    if (hasCommits === false && !this.noCommitNoticeSettled) {
+      this.noCommitNoticeSettled = true;
+      this.recordNoCommitsYet("park", stats?.cost?.numTurns ?? 0);
+    }
     const body = formatBudgetComment({
       trigger,
       numTurns: stats?.cost?.numTurns ?? 0,
+      hasCommits,
       maxTurns: this.effectiveMaxTurns,
       toolCalls: stats?.toolCalls ?? 0,
       durationMs: stats?.cost?.durationMs ?? 0,
@@ -10689,7 +10823,8 @@ class Worker {
     let commentId = null;
     try {
       const res = await this.client.addComment(card.id, body, {
-        commentType: "blocker"
+        commentType: "blocker",
+        agentSessionId: this.sessionId ?? undefined
       });
       commentId = res?.comment?.id ?? null;
     } catch (err) {
@@ -10798,7 +10933,8 @@ class Worker {
         workspaceId: this.workspaceId,
         repoPath: worktreePath,
         sessionId,
-        metricsPath
+        metricsPath,
+        sandboxImage: this.config.verification.sandboxImage
       }, {
         env: {
           apiUrl: this.client.getApiUrl(),
@@ -10897,7 +11033,7 @@ class Worker {
     if (!worktreePath)
       return;
     try {
-      await teardownWorktree2(this.client, card.id, worktreePath, this.branchName ?? undefined);
+      await teardownWorktree2(this.client, card.id, worktreePath, this.branchName ?? undefined, this.sessionId);
     } catch {
       log30.warn(this.tag, "Failed to cleanup worktree after the motor stage run");
     }
@@ -10972,7 +11108,10 @@ ${prompt}`;
         decisions: [],
         nextStageNeeds: "Pick up from the produced artifact above; treat the recorded decisions as settled."
       });
-      await this.client.addComment(card.id, body, { commentType: "decision" });
+      await this.client.addComment(card.id, body, {
+        commentType: "decision",
+        agentSessionId: this.sessionId ?? undefined
+      });
       log30.info(this.tag, `Wrote stage handoff for #${card.short_id} (stage "${stage.name}")`);
     } catch (err) {
       log30.warn(this.tag, `stage-handoff write failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
@@ -10998,7 +11137,8 @@ ${prompt}`;
         build: {
           worktreePath,
           buildTimeout: this.config.verification.timeout,
-          lintTimeout: this.config.verification.timeout
+          lintTimeout: this.config.verification.timeout,
+          sandbox: verificationSandbox3(this.config)
         },
         artifact: {
           worktreePath,
@@ -11038,7 +11178,8 @@ ${prompt}`;
         maxAttempts: this.config.budget.maxAttemptsPerCard,
         fallbackColumn: this.config.pickupColumns[0] ?? "To Do",
         sink: this.cliRunner,
-        runId: this.runId ?? undefined
+        runId: this.runId ?? undefined,
+        agentSessionId: this.sessionId
       });
     } catch (err) {
       log30.warn(this.tag, `stage advancement failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
@@ -11100,6 +11241,44 @@ ${prompt}`;
       }
     });
   }
+  countToolCallForNoCommitNotice() {
+    this.runToolCalls++;
+    if (!shouldCheckForCommits({
+      toolCalls: this.runToolCalls,
+      turnBudget: this.effectiveMaxTurns,
+      expectsCommits: this.runExpectsCommits,
+      settled: this.noCommitNoticeSettled
+    })) {
+      return;
+    }
+    this.noCommitNoticeSettled = true;
+    if (!this.worktreePath)
+      return;
+    const measured = measureRunCommits(this.worktreePath, this.config.worktree.baseBranch, this.runBaselineSha);
+    if (measured !== "none") {
+      if (measured === "unknown") {
+        log30.debug(this.tag, `no-commit check could not attribute this run's commits — staying quiet on ${this.branchName ?? "this branch"}`);
+      }
+      return;
+    }
+    this.recordNoCommitsYet("turn_budget");
+  }
+  recordNoCommitsYet(trigger, numTurns) {
+    const turnBudget = this.effectiveMaxTurns;
+    log30.warn(this.tag, `No commits yet on ${this.branchName ?? "this run's branch"} — ${this.runToolCalls} tool calls into a ${turnBudget}-turn budget (${trigger})`);
+    this.cliRunner?.record({
+      kind: "no_commits_yet",
+      source: "system",
+      payload: {
+        trigger,
+        toolCalls: this.runToolCalls,
+        turnBudget,
+        thresholdFraction: NO_COMMIT_NOTICE_FRACTION,
+        elapsedMs: this.startedAt ? Date.now() - this.startedAt : 0,
+        ...numTurns !== undefined ? { numTurns } : {}
+      }
+    });
+  }
   recordRunSized() {
     if (!this.modelChoice)
       return;
@@ -11132,7 +11311,8 @@ ${prompt}`;
           try {
             const body = buildGaveUpComment(max, this.stateStore.getRecentFailures(cardId, 3), this.config.budget.pause.enabled);
             const res = await this.client.addComment(cardId, body, {
-              commentType: "blocker"
+              commentType: "blocker",
+              agentSessionId: this.sessionId ?? undefined
             });
             giveUpCommentId = res?.comment?.id ?? null;
             log30.warn(this.tag, `gave up on ${cardId} after ${attempts} attempts`);
@@ -11447,6 +11627,7 @@ ${prompt}`;
           model: this.selectImplementModel(card),
           maxTurns: STEERING_MAX_TURNS,
           resumeSessionId: this.cliSessionId,
+          noCommitNotice: true,
           ...this.activeRunSpawnOpts ?? {}
         });
       } catch (err) {
@@ -11479,7 +11660,8 @@ ${prompt}`;
         ...this.config.claude.additionalArgs,
         ...implementRunContainmentCliArgs2({
           worktree: this.worktreePath,
-          extraDisallowedTools: opts.disallowedTools ? opts.disallowedTools.split(",").map((t) => t.trim()).filter(Boolean) : undefined
+          extraDisallowedTools: opts.disallowedTools ? opts.disallowedTools.split(",").map((t) => t.trim()).filter(Boolean) : undefined,
+          run: this.sessionId ? { cardId: card.id, agentSessionId: this.sessionId } : undefined
         }),
         "--",
         prompt
@@ -11518,6 +11700,11 @@ ${prompt}`;
         this.lastRunText += content;
         this.captureCliSessionId(parser.sessionId);
       });
+      if (opts.noCommitNotice) {
+        parser.on("tool_start", () => {
+          this.countToolCallForNoCommitNotice();
+        });
+      }
       parser.on("parse_error", (msg) => {
         log30.debug(this.tag, `Stream parse error (non-fatal): ${msg}`);
         runLog?.stream.write(`
@@ -11607,7 +11794,8 @@ ${prompt}`;
       maxBudgetUsd: sdkCfg?.maxBudgetUsd,
       ...implementRunContainment({
         worktree: this.worktreePath,
-        extraDisallowedTools: disallowedTools
+        extraDisallowedTools: disallowedTools,
+        run: this.sessionId ? { cardId: card.id, agentSessionId: this.sessionId } : undefined
       }),
       onSpawn: (child) => {
         this.process = child;
@@ -11628,6 +11816,9 @@ ${prompt}`;
     try {
       for await (const ev of stream) {
         this.progressTracker?.ingest(ev);
+        if (opts.noCommitNotice && ev.kind === "tool_started") {
+          this.countToolCallForNoCommitNotice();
+        }
         if (ev.kind === "assistant_text") {
           this.lastRunText += `${ev.payload.text}
 `;
@@ -11711,7 +11902,7 @@ ${prompt}`;
     }
     if (this.worktreePath && this.state !== "parked" && (this.state === "error" || this.timedOut || this.aborted)) {
       try {
-        await teardownWorktree2(this.client, this.cardId, this.worktreePath, this.branchName ?? undefined);
+        await teardownWorktree2(this.client, this.cardId, this.worktreePath, this.branchName ?? undefined, this.sessionId);
       } catch {
         log30.warn(this.tag, "Failed to cleanup worktree");
       }
@@ -12227,7 +12418,10 @@ class Pool {
       try {
         await this.client.addComment(run.cardId, `**That Continue cannot be granted.** ${turns.detail}, which is this card's ceiling (\`budget.maxTurnsPerCard\`), so the implement pipeline would refuse it again the moment it was dispatched.
 
-I am handing the card back rather than holding it parked. Reassign it — that clears the count and starts it fresh — or raise the cap in the daemon config if this card genuinely needs the room. The branch is pushed, so nothing committed is lost.`, { commentType: "blocker" });
+I am handing the card back rather than holding it parked. Reassign it — that clears the count and starts it fresh — or raise the cap in the daemon config if this card genuinely needs the room. The branch is pushed, so nothing committed is lost.`, {
+          commentType: "blocker",
+          agentSessionId: run.sessionId ?? undefined
+        });
       } catch (err) {
         log31.warn(TAG29, `Could not explain the refused Continue on ${run.cardId}: ${err instanceof Error ? err.message : err}`);
       }
@@ -13214,8 +13408,139 @@ var init_sweep = __esm(() => {
   init_unblock();
 });
 
+// src/sweep-guard.ts
+import { log as log37 } from "@gethmy/harness";
+
+class SweepGuard {
+  config;
+  store;
+  checkDailyBudget;
+  constructor(config, store, checkDailyBudget) {
+    this.config = config;
+    this.store = store;
+    this.checkDailyBudget = checkDailyBudget;
+  }
+  check() {
+    const sweep = this.store.getSweep();
+    if (sweep.haltReason) {
+      return {
+        claiming: false,
+        reason: sweep.haltReason,
+        detail: this.describeStop(sweep.haltReason),
+        latched: true
+      };
+    }
+    const cap = this.config.maxCardsPerSweep;
+    if (cap >= 0 && sweep.claimed >= cap) {
+      return {
+        claiming: false,
+        reason: "card_cap",
+        detail: this.describeStop("card_cap"),
+        latched: true
+      };
+    }
+    const daily = this.checkDailyBudget?.();
+    if (daily && !daily.allow) {
+      return {
+        claiming: false,
+        latched: false,
+        reason: "daily_budget",
+        detail: this.describeStop("daily_budget", daily.detail)
+      };
+    }
+    return { claiming: true };
+  }
+  async recordClaim(cardId) {
+    await this.store.recordSweepClaim(cardId);
+    const verdict = this.check();
+    if (!verdict.claiming && verdict.latched)
+      await this.halt(verdict.reason);
+    return verdict;
+  }
+  lastClaimedCardId() {
+    return this.store.getSweep().lastClaimedCardId ?? null;
+  }
+  async halt(reason) {
+    const already = this.store.getSweep().haltReason === reason;
+    await this.store.haltSweep(reason);
+    if (!already) {
+      const claimed = this.store.getSweep().claimed;
+      log37.info(TAG35, `claiming stopped (${reason}) after ${claimed} claimed`);
+    }
+    return this.snapshot();
+  }
+  async resume() {
+    const before = this.store.getSweep();
+    const was = before.haltReason ? this.describeStop(before.haltReason) : null;
+    await this.store.resumeSweep();
+    if (was)
+      log37.info(TAG35, `claiming resumed by the operator — was stopped: ${was}`);
+    return this.snapshot();
+  }
+  snapshot() {
+    const sweep = this.store.getSweep();
+    const cap = this.config.maxCardsPerSweep;
+    const verdict = this.check();
+    return {
+      enabled: this.config.enabled,
+      claiming: verdict.claiming,
+      haltReason: verdict.claiming ? null : verdict.reason,
+      haltedAt: sweep.haltedAt,
+      claimed: sweep.claimed,
+      maxCardsPerSweep: cap < 0 ? null : cap,
+      totalClaimed: sweep.totalClaimed,
+      detail: verdict.claiming ? null : verdict.detail
+    };
+  }
+  describeStop(reason, budgetDetail) {
+    const claimed = this.store.getSweep().claimed;
+    const cards = `${claimed} card${claimed === 1 ? "" : "s"}`;
+    const resume = "Resume with `harmony-agent sweep resume`.";
+    switch (reason) {
+      case "card_cap":
+        return `card cap reached — ${cards} claimed this sweep, cap is ${this.config.maxCardsPerSweep}. ${resume}`;
+      case "operator":
+        return `stopped by the operator after ${cards}. ${resume}`;
+      case "daily_budget":
+        return `daily spend cap reached${budgetDetail ? ` (${budgetDetail})` : ""} after ${cards} — claiming starts again on its own when the UTC day rolls over.`;
+    }
+  }
+}
+function toSweepPresence(snapshot) {
+  if (!snapshot?.enabled)
+    return null;
+  return {
+    claiming: snapshot.claiming,
+    reason: snapshot.haltReason,
+    detail: snapshot.detail,
+    claimed: snapshot.claimed,
+    cap: snapshot.maxCardsPerSweep,
+    haltedAt: snapshot.haltedAt
+  };
+}
+function sameSweepPresence(a, b) {
+  if (a === b)
+    return true;
+  if (!a || !b)
+    return false;
+  return a.claiming === b.claiming && a.reason === b.reason && a.detail === b.detail && a.claimed === b.claimed && a.cap === b.cap && a.haltedAt === b.haltedAt;
+}
+function describeCaps(sweep, dailyBudgetCents) {
+  const cards = sweep.maxCardsPerSweep < 0 ? "no cap" : String(sweep.maxCardsPerSweep);
+  return `cards/sweep ${cards} · spend/day ${formatDailyCap(dailyBudgetCents)}`;
+}
+function sweepBannerLine(config) {
+  const sweep = config.sweep;
+  const scope = sweep.requireLabel ? `cards labelled "${sweep.requireLabel}"` : "unassigned cards";
+  const extra = sweep.trustedAuthors.length;
+  const authors = extra ? `you + ${extra} trusted author${extra === 1 ? "" : "s"}` : "you only";
+  return `Sweep ON — claims ${scope} in ${config.pickupColumns.join(", ")}, ` + `authored by ${authors}; caps: ${describeCaps(sweep, config.budget.dailyBudgetCents)}; ` + `${sweep.maxProbesPerTick} probes/tick`;
+}
+var TAG35 = "sweep";
+var init_sweep_guard = () => {};
+
 // src/reconcile.ts
-import { detectGitProvider as detectGitProvider5, log as log37 } from "@gethmy/harness";
+import { detectGitProvider as detectGitProvider5, log as log38 } from "@gethmy/harness";
 function daemonProcessLabels(approvedLabel) {
   const names = ["agent", "agent-recovered", NEED_REVIEW_LABEL, approvedLabel];
   return new Set(names.filter(Boolean).map((n) => n.toLowerCase()));
@@ -13245,6 +13570,7 @@ class Reconciler {
   gitProvider = null;
   repoDirectories = null;
   lastSweepStopReported = null;
+  publishSweep = () => {};
   get lastTick() {
     return this.lastTickAt;
   }
@@ -13274,7 +13600,7 @@ class Reconciler {
       clearInterval(this.timer);
       this.timer = null;
     }
-    log37.info(TAG35, "Heartbeat stopped");
+    log38.info(TAG36, "Heartbeat stopped");
   }
   async recoverStaleRuns() {
     if (!this.stateStore || !this.agentConfig)
@@ -13285,7 +13611,7 @@ class Reconciler {
     const pool = this.pool;
     for (const run of active) {
       if (isBudgetHeldRun(run)) {
-        log37.info(TAG35, `run ${run.runId} (#${run.cardShortId}) is held for a human budget decision — leaving it`);
+        log38.info(TAG36, `run ${run.runId} (#${run.cardShortId}) is held for a human budget decision — leaving it`);
         continue;
       }
       const foreignDaemon = run.daemonPid !== process.pid;
@@ -13295,7 +13621,7 @@ class Reconciler {
       if (!daemonDead && !(heartbeatStale && ourZombie))
         continue;
       const reason = daemonDead ? `foreign daemon ${run.daemonPid} is dead` : `our worker lost card ${run.cardId} with ${Math.round((now - run.lastHeartbeatAt) / 1000)}s stale heartbeat`;
-      log37.warn(TAG35, `zombie run ${run.runId} (#${run.cardShortId}): ${reason} — recovering`);
+      log38.warn(TAG36, `zombie run ${run.runId} (#${run.cardShortId}): ${reason} — recovering`);
       await recoverRun(run, this.stateStore, this.client, this.agentConfig, {
         runId: run.runId,
         cardId: run.cardId,
@@ -13322,11 +13648,11 @@ class Reconciler {
       const stalledAt = Date.parse(card.updated_at ?? "");
       if (!Number.isFinite(stalledAt) || now - stalledAt < graceMs)
         continue;
-      log37.warn(TAG35, `#${card.short_id} stranded in "${inProgressCol.name}" (no live run) — requeueing to "${pickupCol.name}"`);
+      log38.warn(TAG36, `#${card.short_id} stranded in "${inProgressCol.name}" (no live run) — requeueing to "${pickupCol.name}"`);
       try {
         await this.client.moveCard(card.id, pickupCol.id);
       } catch (err) {
-        log37.error(TAG35, `stranded requeue failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
+        log38.error(TAG36, `stranded requeue failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
       }
     }
   }
@@ -13358,7 +13684,7 @@ class Reconciler {
           return;
         const cardLabels = resolveCardLabels(card, labelMap);
         const subtasks = card.subtasks ?? [];
-        log37.info(TAG35, `Enqueuing claimed review card #${card.short_id} (agent-agnostic pickup)`);
+        log38.info(TAG36, `Enqueuing claimed review card #${card.short_id} (agent-agnostic pickup)`);
         await this.pool.enqueue(card, column, cardLabels, subtasks, "review");
       }
     });
@@ -13382,11 +13708,11 @@ class Reconciler {
       const parkedAt = Date.parse(card.updated_at ?? "");
       if (!Number.isFinite(parkedAt) || now - parkedAt < ttlMs)
         continue;
-      log37.warn(TAG35, `#${card.short_id} parked for approval > ${planning.approvalTtlHours}h — auto-releasing to "${pickupCol.name}"`);
+      log38.warn(TAG36, `#${card.short_id} parked for approval > ${planning.approvalTtlHours}h — auto-releasing to "${pickupCol.name}"`);
       try {
         await this.client.moveCard(card.id, pickupCol.id);
       } catch (err) {
-        log37.error(TAG35, `auto-release failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
+        log38.error(TAG36, `auto-release failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
       }
     }
   }
@@ -13414,13 +13740,14 @@ class Reconciler {
       now: Date.now()
     };
     const verdict = this.sweepGuard?.check() ?? { claiming: true };
+    this.publishSweepState();
     if (!verdict.claiming) {
       this.reportSweepStopped(verdict.reason, verdict.detail);
       return;
     }
     this.lastSweepStopReported = null;
     if (!this.pool.hasFreeImplementSlot()) {
-      log37.debug(TAG35, "sweep skipped — no free implement slot");
+      log38.debug(TAG36, "sweep skipped — no free implement slot");
       return;
     }
     const { claimed } = await sweepForCard({
@@ -13433,25 +13760,32 @@ class Reconciler {
     if (!claimed)
       return;
     await this.sweepGuard?.recordClaim(claimed.card.id);
+    this.publishSweepState();
     await this.pool.enqueue(claimed.card, claimed.column, claimed.labels, claimed.card.subtasks ?? [], "implement");
   }
   reportSweepStopped(reason, detail) {
     const line = `sweep stopped claiming — ${detail}`;
     if (this.lastSweepStopReported === reason)
-      log37.debug(TAG35, line);
+      log38.debug(TAG36, line);
     else
-      log37.warn(TAG35, line);
+      log38.warn(TAG36, line);
     this.lastSweepStopReported = reason;
   }
+  setSweepPresenceSink(sink) {
+    this.publishSweep = sink;
+  }
+  publishSweepState() {
+    this.publishSweep(toSweepPresence(this.sweepGuard?.snapshot()));
+  }
   resolveRepoDirectories() {
     if (this.repoDirectories)
       return this.repoDirectories;
     const dirs = readRepoDirectories(process.cwd());
     this.repoDirectories = dirs;
     if (dirs.size === 0) {
-      log37.warn(TAG35, `Could not read top-level directories of ${process.cwd()} — sweep cohesion runs without its path signal`);
+      log38.warn(TAG36, `Could not read top-level directories of ${process.cwd()} — sweep cohesion runs without its path signal`);
     } else {
-      log37.debug(TAG35, `Path signal allows ${dirs.size} top-level directories`);
+      log38.debug(TAG36, `Path signal allows ${dirs.size} top-level directories`);
     }
     return dirs;
   }
@@ -13495,21 +13829,21 @@ class Reconciler {
           const subtasks = card.subtasks ?? [];
           const mode = route.mode;
           if (route.stage) {
-            log37.info(TAG35, `Stage card #${card.short_id} (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement) regardless of column`);
+            log38.info(TAG36, `Stage card #${card.short_id} (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement) regardless of column`);
           }
           if (mode === "review" && this.approvedLabel && hasLabel(cardLabels, this.approvedLabel)) {
-            log37.debug(TAG35, `Skipping #${card.short_id} — already has "${this.approvedLabel}" label`);
+            log38.debug(TAG36, `Skipping #${card.short_id} — already has "${this.approvedLabel}" label`);
             continue;
           }
           if (mode === "review" && hasLabel(cardLabels, NEED_REVIEW_LABEL)) {
-            log37.debug(TAG35, `Skipping #${card.short_id} — has "${NEED_REVIEW_LABEL}" label (needs human)`);
+            log38.debug(TAG36, `Skipping #${card.short_id} — has "${NEED_REVIEW_LABEL}" label (needs human)`);
             continue;
           }
           if (mode === "review" && !qualifiesForAutoReview(card.description)) {
-            log37.debug(TAG35, `Skipping #${card.short_id} — no branch or PR reference (not qualified for auto-review)`);
+            log38.debug(TAG36, `Skipping #${card.short_id} — no branch or PR reference (not qualified for auto-review)`);
             continue;
           }
-          log37.info(TAG35, `Missed assignment: #${card.short_id} "${card.title}" (${mode}) — enqueueing`);
+          log38.info(TAG36, `Missed assignment: #${card.short_id} "${card.title}" (${mode}) — enqueueing`);
           await this.pool.enqueue(card, column, cardLabels, subtasks, mode);
         }
       }
@@ -13519,13 +13853,13 @@ class Reconciler {
       try {
         await this.pool.drainBudgetDecisions();
       } catch (err) {
-        log37.error(TAG35, `budget decisions were not drained this tick: ${err instanceof Error ? err.message : err}`);
+        log38.error(TAG36, `budget decisions were not drained this tick: ${err instanceof Error ? err.message : err}`);
       }
       await this.recoverStrandedInProgress(cards, columns, knownCardIds);
       await this.recoverStrandedReview(cards, columns, labelMap, knownCardIds);
       for (const knownId of knownCardIds) {
         if (!allAgentCardIds.has(knownId)) {
-          log37.info(TAG35, `Missed unassign: ${knownId} — removing`);
+          log38.info(TAG36, `Missed unassign: ${knownId} — removing`);
           await this.pool.removeCard(knownId);
         }
       }
@@ -13533,15 +13867,15 @@ class Reconciler {
       try {
         await this.sweepForWork(cards, columns, labelMap, pickupConfig);
       } catch (err) {
-        log37.error(TAG35, `sweep failed this tick: ${err instanceof Error ? err.message : err}`);
+        log38.error(TAG36, `sweep failed this tick: ${err instanceof Error ? err.message : err}`);
       }
-      log37.debug(TAG35, `Reconciled: ${assignedCards.length} assigned, ${knownCardIds.size} known`);
+      log38.debug(TAG36, `Reconciled: ${assignedCards.length} assigned, ${knownCardIds.size} known`);
     } catch (err) {
-      log37.error(TAG35, `Heartbeat failed: ${err instanceof Error ? err.message : err}`);
+      log38.error(TAG36, `Heartbeat failed: ${err instanceof Error ? err.message : err}`);
     }
   }
 }
-var TAG35 = "reconcile";
+var TAG36 = "reconcile";
 var init_reconcile = __esm(() => {
   init_board_helpers();
   init_recovery();
@@ -13550,6 +13884,7 @@ var init_reconcile = __esm(() => {
   init_state_store();
   init_strand_recovery();
   init_sweep();
+  init_sweep_guard();
   init_types2();
 });
 
@@ -13558,7 +13893,7 @@ var exports_startup_banner = {};
 __export(exports_startup_banner, {
   createStartupBanner: () => createStartupBanner
 });
-import { isPretty, log as log38 } from "@gethmy/harness";
+import { isPretty, log as log39 } from "@gethmy/harness";
 function createStartupBanner(config, version) {
   return isPretty() ? prettyBanner(config, version) : jsonBanner(config, version);
 }
@@ -13583,7 +13918,7 @@ function prettyBanner(config, version) {
       checks.push({ kind: "ok", message });
     },
     warn(message) {
-      log38.warn(TAG36, message);
+      log39.warn(TAG37, message);
       checks.push({ kind: "warn", message: message.split(`
 `, 1)[0] });
     },
@@ -13608,25 +13943,25 @@ function prettyBanner(config, version) {
   };
 }
 function jsonBanner(config, version) {
-  log38.info(TAG36, `Harmony Agent Daemon v${version} starting...`);
-  log38.info(TAG36, `Project: ${config.projectId} | Pool: ${config.agent.poolSize} | Model: ${config.agent.claude.model} | Runner: ${config.agent.runner} | Pickup: ${config.agent.pickupColumns.join(", ")}`);
+  log39.info(TAG37, `Harmony Agent Daemon v${version} starting...`);
+  log39.info(TAG37, `Project: ${config.projectId} | Pool: ${config.agent.poolSize} | Model: ${config.agent.claude.model} | Runner: ${config.agent.runner} | Pickup: ${config.agent.pickupColumns.join(", ")}`);
   if (config.agent.review.enabled) {
-    log38.info(TAG36, `Review: enabled | Columns: ${config.agent.review.pickupColumns.join(", ")} | → ${config.agent.review.moveToColumn} / ${config.agent.review.failColumn}`);
+    log39.info(TAG37, `Review: enabled | Columns: ${config.agent.review.pickupColumns.join(", ")} | → ${config.agent.review.moveToColumn} / ${config.agent.review.failColumn}`);
   }
   let failed = false;
   return {
     setProjectName(_name) {},
     setGitProvider(provider) {
-      log38.info(TAG36, `Git provider: ${provider}`);
+      log39.info(TAG37, `Git provider: ${provider}`);
     },
     setHttpPort(port) {
-      log38.info(TAG36, `HTTP server on port ${port}`);
+      log39.info(TAG37, `HTTP server on port ${port}`);
     },
     check(message) {
-      log38.info(TAG36, message);
+      log39.info(TAG37, message);
     },
     warn(message) {
-      log38.warn(TAG36, message);
+      log39.warn(TAG37, message);
     },
     fail() {
       failed = true;
@@ -13634,7 +13969,7 @@ function jsonBanner(config, version) {
     async ready(message) {
       if (failed)
         return;
-      log38.info(TAG36, message);
+      log39.info(TAG37, message);
     }
   };
 }
@@ -13715,7 +14050,7 @@ function cyan(s) {
 function yellow(s) {
   return `${ANSI.yellow}${s}${ANSI.reset}`;
 }
-var TAG36 = "daemon", RULE_WIDTH = 70, ANSI;
+var TAG37 = "daemon", RULE_WIDTH = 70, ANSI;
 var init_startup_banner = __esm(() => {
   ANSI = {
     reset: "\x1B[0m",
@@ -13816,133 +14151,27 @@ var init_stream_parser_selftest = __esm(() => {
   init_stream_parser();
 });
 
-// src/sweep-guard.ts
-import { log as log39 } from "@gethmy/harness";
-
-class SweepGuard {
-  config;
-  store;
-  checkDailyBudget;
-  constructor(config, store, checkDailyBudget) {
-    this.config = config;
-    this.store = store;
-    this.checkDailyBudget = checkDailyBudget;
-  }
-  check() {
-    const sweep = this.store.getSweep();
-    if (sweep.haltReason) {
-      return {
-        claiming: false,
-        reason: sweep.haltReason,
-        detail: this.describeStop(sweep.haltReason),
-        latched: true
-      };
-    }
-    const cap = this.config.maxCardsPerSweep;
-    if (cap >= 0 && sweep.claimed >= cap) {
-      return {
-        claiming: false,
-        reason: "card_cap",
-        detail: this.describeStop("card_cap"),
-        latched: true
-      };
-    }
-    const daily = this.checkDailyBudget?.();
-    if (daily && !daily.allow) {
-      return {
-        claiming: false,
-        latched: false,
-        reason: "daily_budget",
-        detail: this.describeStop("daily_budget", daily.detail)
-      };
-    }
-    return { claiming: true };
-  }
-  async recordClaim(cardId) {
-    await this.store.recordSweepClaim(cardId);
-    const verdict = this.check();
-    if (!verdict.claiming && verdict.latched)
-      await this.halt(verdict.reason);
-    return verdict;
-  }
-  lastClaimedCardId() {
-    return this.store.getSweep().lastClaimedCardId ?? null;
-  }
-  async halt(reason) {
-    const already = this.store.getSweep().haltReason === reason;
-    await this.store.haltSweep(reason);
-    if (!already) {
-      const claimed = this.store.getSweep().claimed;
-      log39.info(TAG37, `claiming stopped (${reason}) after ${claimed} claimed`);
-    }
-    return this.snapshot();
-  }
-  async resume() {
-    const before = this.store.getSweep();
-    const was = before.haltReason ? this.describeStop(before.haltReason) : null;
-    await this.store.resumeSweep();
-    if (was)
-      log39.info(TAG37, `claiming resumed by the operator — was stopped: ${was}`);
-    return this.snapshot();
-  }
-  snapshot() {
-    const sweep = this.store.getSweep();
-    const cap = this.config.maxCardsPerSweep;
-    const verdict = this.check();
-    return {
-      enabled: this.config.enabled,
-      claiming: verdict.claiming,
-      haltReason: verdict.claiming ? null : verdict.reason,
-      haltedAt: sweep.haltedAt,
-      claimed: sweep.claimed,
-      maxCardsPerSweep: cap < 0 ? null : cap,
-      totalClaimed: sweep.totalClaimed,
-      detail: verdict.claiming ? null : verdict.detail
-    };
-  }
-  describeStop(reason, budgetDetail) {
-    const claimed = this.store.getSweep().claimed;
-    const cards = `${claimed} card${claimed === 1 ? "" : "s"}`;
-    const resume = "Resume with `harmony-agent sweep resume`.";
-    switch (reason) {
-      case "card_cap":
-        return `card cap reached — ${cards} claimed this sweep, cap is ${this.config.maxCardsPerSweep}. ${resume}`;
-      case "operator":
-        return `stopped by the operator after ${cards}. ${resume}`;
-      case "daily_budget":
-        return `daily spend cap reached${budgetDetail ? ` (${budgetDetail})` : ""} after ${cards} — claiming starts again on its own when the UTC day rolls over.`;
-    }
-  }
-}
-function describeCaps(sweep, dailyBudgetCents) {
-  const cards = sweep.maxCardsPerSweep < 0 ? "no cap" : String(sweep.maxCardsPerSweep);
-  return `cards/sweep ${cards} · spend/day ${formatDailyCap(dailyBudgetCents)}`;
-}
-function sweepBannerLine(config) {
-  const sweep = config.sweep;
-  const scope = sweep.requireLabel ? `cards labelled "${sweep.requireLabel}"` : "unassigned cards";
-  const extra = sweep.trustedAuthors.length;
-  const authors = extra ? `you + ${extra} trusted author${extra === 1 ? "" : "s"}` : "you only";
-  return `Sweep ON — claims ${scope} in ${config.pickupColumns.join(", ")}, ` + `authored by ${authors}; caps: ${describeCaps(sweep, config.budget.dailyBudgetCents)}; ` + `${sweep.maxProbesPerTick} probes/tick`;
-}
-var TAG37 = "sweep";
-var init_sweep_guard = () => {};
-
 // src/watcher.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { isPretty as isPretty2, log as log40 } from "@gethmy/harness";
 import { createClient } from "@supabase/supabase-js";
+function toPresenceColumns(names) {
+  return names.map((n) => n.trim()).filter((n) => n.length > 0).slice(0, MAX_PRESENCE_COLUMNS).map((n) => n.slice(0, MAX_PRESENCE_COLUMN_LENGTH));
+}
 
 class Watcher {
   credentials;
   projectId;
   identity;
+  routing;
   onCardBroadcast;
   onAgentCommand;
   channel = null;
   presenceChannel = null;
   supabase = null;
   daemonId = randomUUID3();
+  startedAt = new Date().toISOString();
+  sweep = null;
   connected = false;
   presenceTracked = false;
   suppressStartupLogs = true;
@@ -13987,10 +14216,11 @@ class Watcher {
     log40.warn(TAG38, `removeChannel(${old.topic}) returned "${status}" and the client still holds that topic — retrying the removal`);
     return false;
   }
-  constructor(credentials, projectId, identity, onCardBroadcast, onAgentCommand) {
+  constructor(credentials, projectId, identity, routing, onCardBroadcast, onAgentCommand) {
     this.credentials = credentials;
     this.projectId = projectId;
     this.identity = identity;
+    this.routing = routing;
     this.onCardBroadcast = onCardBroadcast;
     this.onAgentCommand = onAgentCommand;
   }
@@ -14002,6 +14232,42 @@ class Watcher {
     this.subscribeBroadcast();
     this.subscribePresence();
   }
+  presencePayload() {
+    const implement = toPresenceColumns(this.routing.pickupColumns);
+    const review = toPresenceColumns(this.routing.reviewColumns);
+    return {
+      daemonId: this.daemonId,
+      startedAt: this.startedAt,
+      userId: this.identity.userId,
+      agentId: this.identity.agentId,
+      userEmail: this.identity.userEmail,
+      agentIdentifier: this.identity.agentIdentifier,
+      agentName: this.identity.agentName,
+      ...this.sweep ? { sweep: this.sweep } : {},
+      ...implement.length ? { pickup: { implement, review } } : {}
+    };
+  }
+  publishSweep(state) {
+    if (sameSweepPresence(this.sweep, state))
+      return;
+    this.sweep = state;
+    if (!this.presenceTracked || this.stopping)
+      return;
+    const channel = this.presenceChannel;
+    if (!channel)
+      return;
+    (async () => {
+      let status;
+      try {
+        status = await channel.track(this.presencePayload());
+      } catch (err) {
+        status = `threw (${String(err)})`;
+      }
+      if (status !== "ok") {
+        log40.debug(TAG38, `Presence sweep update returned "${status}"`);
+      }
+    })();
+  }
   subscribePresence() {
     if (!this.supabase)
       return;
@@ -14016,15 +14282,7 @@ class Watcher {
       if (status === "SUBSCRIBED") {
         let trackStatus;
         try {
-          trackStatus = await presenceChannel.track({
-            daemonId: this.daemonId,
-            startedAt: new Date().toISOString(),
-            userId: this.identity.userId,
-            agentId: this.identity.agentId,
-            userEmail: this.identity.userEmail,
-            agentIdentifier: this.identity.agentIdentifier,
-            agentName: this.identity.agentName
-          });
+          trackStatus = await presenceChannel.track(this.presencePayload());
         } catch (err) {
           trackStatus = `error (${String(err)})`;
         }
@@ -14185,8 +14443,10 @@ class Watcher {
     log40.info(TAG38, "Broadcast subscription stopped");
   }
 }
-var TAG38 = "watcher";
-var init_watcher = () => {};
+var TAG38 = "watcher", MAX_PRESENCE_COLUMNS = 24, MAX_PRESENCE_COLUMN_LENGTH = 120;
+var init_watcher = __esm(() => {
+  init_sweep_guard();
+});
 
 // src/worktree-gc.ts
 var exports_worktree_gc = {};
@@ -14581,6 +14841,7 @@ async function main() {
     validateBudgetConfig(config.agent);
     validateSweepConfig(config.agent);
     validateRankingConfig(config.agent);
+    validateVerificationConfig(config.agent);
   } catch (err) {
     if (err instanceof ConfigValidationError) {
       banner.fail();
@@ -14725,7 +14986,11 @@ async function main() {
       };
     },
     handleCommand: (cmd, cardId) => pool.handleAgentCommand(cardId, cmd),
-    handleSweepCommand: (cmd) => cmd === "stop" ? sweepGuard.halt("operator") : sweepGuard.resume(),
+    handleSweepCommand: async (cmd) => {
+      const snapshot = cmd === "stop" ? await sweepGuard.halt("operator") : await sweepGuard.resume();
+      reconciler.publishSweepState();
+      return snapshot;
+    },
     getSweep: () => sweepGuard.snapshot(),
     handleAccountResume: () => accountGuard.resume(),
     getAccount: () => accountGuard.snapshot()
@@ -14736,6 +15001,9 @@ async function main() {
     userEmail: config.userEmail,
     agentIdentifier: config.agentIdentifier,
     agentName: config.agentName
+  }, {
+    pickupColumns: config.agent.pickupColumns,
+    reviewColumns
   }, async (event) => {
     await handleBroadcast(event, client, pool, config, agentId);
   }, async (command) => {
@@ -14775,6 +15043,7 @@ async function main() {
     shutdown("unhandledRejection");
   });
   await watcher.start();
+  reconciler.setSweepPresenceSink((state) => watcher.publishSweep(state));
   reconciler.start();
   mergeMonitor?.start();
   worktreeGc.start();