@guilz-dev/belay 0.3.0 → 0.4.0

package/dist/core/replay-scrub.js

@@ -0,0 +1,43 @@
+import { scrubValue } from './scrub.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export function subagentFingerprintSource(payload, scrubOptions) {
+    const toolInput = payload.tool_input;
+    if (toolInput && typeof toolInput === 'object') {
+        const input = toolInput;
+        return scrubValue({
+            description: input.description ?? '',
+            prompt: input.prompt ?? '',
+        }, scrubOptions);
+    }
+    const task = payload.task;
+    if (typeof task === 'string') {
+        return scrubValue({ task }, scrubOptions);
+    }
+    if (task && typeof task === 'object') {
+        const taskObj = task;
+        return scrubValue({
+            description: taskObj.description ?? '',
+            prompt: taskObj.prompt ?? '',
+        }, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export function fingerprintReplayPayload(kind, payload, scrubOptions) {
+    if (!payload) {
+        return undefined;
+    }
+    if (kind === 'tool') {
+        const toolInput = payload.tool_input;
+        if (toolInput && typeof toolInput === 'object') {
+            return scrubValue(toolInput, scrubOptions);
+        }
+    }
+    if (kind === 'subagent') {
+        return subagentFingerprintSource(payload, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}

package/dist/core/shell-tokenizer.d.ts

@@ -1,3 +1,5 @@
+export declare function isRedirectOperator(token: string): boolean;
+export declare function isFdDuplication(token: string): boolean;
 export declare function tokenizeShell(input: string): string[];
 export declare function normalizeShellCommand(command: string, repoRoot: string, normalizeToken: (t: string, r: string) => string): string;
 export declare function splitTopLevelSegments(tokens: string[]): string[][];

package/dist/core/shell-tokenizer.js

@@ -1,4 +1,72 @@
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
+const FD_DUPLICATION_PATTERN = /^\d+[<>]&(?:\d+|-)$/;
+const FD_REDIRECT_PATTERN = /^\d+(?:>>?|<)$/;
+function readDigits(input, index) {
+    let end = index;
+    while (end < input.length && /[0-9]/.test(input[end] ?? '')) {
+        end += 1;
+    }
+    return input.slice(index, end);
+}
+// This tokenizer only recognizes FD redirects when the digit run is immediately
+// followed by `>` or `<` (for example `2>&1`, `3>file`, `12>>log`, `3<file`,
+// `3<&1`). It does not try to recover bash's full word-boundary rules for cases
+// like `foo12>>bar` or `foo12<bar`.
+function readShellOperator(input, index) {
+    const char = input[index];
+    const next = input[index + 1] ?? '';
+    const digits = /[0-9]/.test(char) ? readDigits(input, index) : '';
+    const digitsLength = digits.length;
+    const afterDigits = digitsLength > 0 ? (input[index + digitsLength] ?? '') : '';
+    const afterDigitsNext = digitsLength > 0 ? (input[index + digitsLength + 1] ?? '') : '';
+    if (char === '&' && next === '&') {
+        return { token: '&&', length: 2 };
+    }
+    if (char === '|' && next === '|') {
+        return { token: '||', length: 2 };
+    }
+    if (char === '|' && next === '&') {
+        return { token: '|&', length: 2 };
+    }
+    if (char === '&' && next === '>') {
+        return { token: '&>', length: 2 };
+    }
+    if (digitsLength > 0 && (afterDigits === '>' || afterDigits === '<')) {
+        if (afterDigitsNext === '&') {
+            let end = index + digitsLength + 2;
+            while (end < input.length && /[0-9-]/.test(input[end] ?? '')) {
+                end += 1;
+            }
+            if (end > index + digitsLength + 2) {
+                return { token: input.slice(index, end), length: end - index };
+            }
+        }
+        if (afterDigits === '>' && afterDigitsNext === '>') {
+            return { token: `${digits}>>`, length: digitsLength + 2 };
+        }
+        return { token: `${digits}${afterDigits}`, length: digitsLength + 1 };
+    }
+    if (char === '>' && next === '>') {
+        return { token: '>>', length: 2 };
+    }
+    if (char === '&') {
+        return { token: '&', length: 1 };
+    }
+    if (char === '|' || char === ';' || char === '>' || char === '<') {
+        return { token: char, length: 1 };
+    }
+    return null;
+}
+export function isRedirectOperator(token) {
+    return (token === '>' ||
+        token === '>>' ||
+        token === '<' ||
+        token === '&>' ||
+        FD_REDIRECT_PATTERN.test(token));
+}
+export function isFdDuplication(token) {
+    return FD_DUPLICATION_PATTERN.test(token);
+}
 export function tokenizeShell(input) {
     const tokens = [];
     let buffer = '';
@@ -12,7 +80,6 @@ export function tokenizeShell(input) {
     };
     for (let index = 0; index < input.length; index += 1) {
         const char = input[index];
-        const next = input[index + 1] ?? '';
         if (escaping) {
             buffer += char;
             escaping = false;
@@ -35,27 +102,11 @@ export function tokenizeShell(input) {
             quote = char;
             continue;
         }
-        if (char === '&' && next === '&') {
-            flush();
-            tokens.push('&&');
-            index += 1;
-            continue;
-        }
-        if (char === '|' && next === '|') {
-            flush();
-            tokens.push('||');
-            index += 1;
-            continue;
-        }
-        if (char === '>' && next === '>') {
+        const operator = readShellOperator(input, index);
+        if (operator) {
             flush();
-            tokens.push('>>');
-            index += 1;
-            continue;
-        }
-        if (char === '|' || char === ';' || char === '>' || char === '<') {
-            flush();
-            tokens.push(char);
+            tokens.push(operator.token);
+            index += operator.length - 1;
             continue;
         }
         if (char === '\n' || char === '\r') {
@@ -84,7 +135,12 @@ export function splitTopLevelSegments(tokens) {
     const segments = [];
     let current = [];
     for (const token of tokens) {
-        if (token === '&&' || token === '||' || token === ';' || token === '|') {
+        if (token === '&&' ||
+            token === '||' ||
+            token === ';' ||
+            token === '|' ||
+            token === '&' ||
+            token === '|&') {
             if (current.length > 0) {
                 segments.push(current);
             }
@@ -118,7 +174,10 @@ export function extractRedirectTargets(tokens) {
     const targets = [];
     for (let index = 0; index < tokens.length; index += 1) {
         const token = tokens[index];
-        if (token === '>' || token === '>>' || token === '<') {
+        if (isFdDuplication(token)) {
+            continue;
+        }
+        if (isRedirectOperator(token)) {
             const next = tokens[index + 1];
             if (next) {
                 targets.push(next);

package/dist/core/standing-allow.d.ts

@@ -0,0 +1,50 @@
+import type { BelayConfigV4 } from './config.js';
+import type { GatedActionKind } from './gate-contract.js';
+import type { ClassifyResult } from './types.js';
+export type StandingAllowSource = 'provably-benign-corpus' | 'must-allow-catalog' | 'operator' | 'availability-reconfirmed';
+export interface StandingAllowEntry {
+    kind: GatedActionKind;
+    fingerprint: string;
+    source: StandingAllowSource;
+    reason: string;
+    summary?: string;
+    createdAt: string;
+    expiresAt: string;
+    repoRoot?: string;
+}
+export interface StandingAllowFile {
+    version: 1;
+    entries: StandingAllowEntry[];
+}
+export interface StandingAllowMatch {
+    source: StandingAllowSource;
+    catalogCommand?: string;
+    entryId?: string;
+}
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export declare const DEFAULT_STANDING_ALLOW_TTL_MS: number;
+export declare function standingAllowFile(config: BelayConfigV4, repoLocalStateDir: string): string;
+export declare function isTier0StandingAllowBlocked(result: ClassifyResult): boolean;
+export declare function compactStandingAllow(state: StandingAllowFile, now?: number): StandingAllowFile;
+export declare function loadStandingAllow(filePath: string): Promise<StandingAllowFile>;
+export declare function saveStandingAllow(filePath: string, state: StandingAllowFile): Promise<void>;
+export declare function resolveStandingAllowMatch(params: {
+    kind: GatedActionKind;
+    result: ClassifyResult;
+    repoRoot: string;
+    state: StandingAllowFile;
+    now?: number;
+}): StandingAllowMatch | null;
+export declare function addStandingAllowEntry(state: StandingAllowFile, entry: Omit<StandingAllowEntry, 'createdAt' | 'expiresAt'> & {
+    createdAt?: string;
+    expiresAt?: string;
+    ttlMs?: number;
+}): StandingAllowFile;
+export declare function revokeStandingAllowEntry(state: StandingAllowFile, params: {
+    kind: GatedActionKind;
+    fingerprint: string;
+    repoRoot?: string;
+}): {
+    state: StandingAllowFile;
+    removed: boolean;
+};

package/dist/core/standing-allow.js

@@ -0,0 +1,175 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { STANDING_ALLOW_CATALOG } from '../corpus/standing-allow-catalog.generated.js';
+import { belayStateDir } from './config.js';
+const EMPTY_STANDING_ALLOW = {
+    version: 1,
+    entries: [],
+};
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export const DEFAULT_STANDING_ALLOW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const PROVABLY_BENIGN_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.provablyBenign.map((entry) => entry.normalizedCommand));
+const MUST_ALLOW_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.mustAllow.map((entry) => entry.normalizedCommand));
+/** Reasons that must never be silenced via standing-allow (defense in depth with signal checks). */
+const STANDING_ALLOW_BLOCKED_REASONS = new Set([
+    'external_effect',
+    'tier1_catastrophic',
+    'protected_artifact',
+    'pipe_to_shell',
+    'command_substitution',
+]);
+export function standingAllowFile(config, repoLocalStateDir) {
+    return `${belayStateDir(config, repoLocalStateDir)}/standing-allow.json`;
+}
+export function isTier0StandingAllowBlocked(result) {
+    if (result.reason.startsWith('tier0_') || STANDING_ALLOW_BLOCKED_REASONS.has(result.reason)) {
+        return true;
+    }
+    const signals = result.assessment?.signals ?? [];
+    return signals.some((signal) => signal === 'tier0_external' || signal === 'tier1_catastrophic');
+}
+function isExpired(iso, now = Date.now()) {
+    const parsed = Date.parse(iso);
+    return Number.isNaN(parsed) || parsed <= now;
+}
+export function compactStandingAllow(state, now = Date.now()) {
+    return {
+        version: 1,
+        entries: state.entries.filter((entry) => !isExpired(entry.expiresAt, now)),
+    };
+}
+function sanitizeStandingAllowEntries(input) {
+    if (!Array.isArray(input)) {
+        return [];
+    }
+    return input.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object') {
+            return [];
+        }
+        const record = entry;
+        if ((record.kind !== 'shell' && record.kind !== 'tool' && record.kind !== 'subagent') ||
+            typeof record.fingerprint !== 'string' ||
+            !record.fingerprint.trim() ||
+            typeof record.expiresAt !== 'string' ||
+            typeof record.createdAt !== 'string' ||
+            typeof record.reason !== 'string') {
+            return [];
+        }
+        const source = record.source;
+        if (source !== 'operator' && source !== 'availability-reconfirmed') {
+            return [];
+        }
+        return [
+            {
+                kind: record.kind,
+                fingerprint: record.fingerprint,
+                source,
+                reason: record.reason,
+                createdAt: record.createdAt,
+                expiresAt: record.expiresAt,
+                ...(typeof record.summary === 'string' ? { summary: record.summary } : {}),
+                ...(typeof record.repoRoot === 'string' ? { repoRoot: record.repoRoot } : {}),
+            },
+        ];
+    });
+}
+export async function loadStandingAllow(filePath) {
+    if (!existsSync(filePath)) {
+        return { ...EMPTY_STANDING_ALLOW };
+    }
+    const raw = JSON.parse(await readFile(filePath, 'utf8'));
+    const rawCount = Array.isArray(raw.entries) ? raw.entries.length : 0;
+    const entries = sanitizeStandingAllowEntries(raw.entries);
+    const compacted = compactStandingAllow({ version: 1, entries });
+    if (rawCount !== compacted.entries.length || entries.length !== compacted.entries.length) {
+        await saveStandingAllow(filePath, compacted);
+    }
+    return compacted;
+}
+export async function saveStandingAllow(filePath, state) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const compacted = compactStandingAllow(state);
+    await writeFile(filePath, `${JSON.stringify(compacted, null, 2)}\n`, 'utf8');
+}
+function matchBundledCatalog(kind, normalizedCommand) {
+    if (kind !== 'shell' || !normalizedCommand) {
+        return null;
+    }
+    if (PROVABLY_BENIGN_COMMANDS.has(normalizedCommand)) {
+        return { source: 'provably-benign-corpus', catalogCommand: normalizedCommand };
+    }
+    if (MUST_ALLOW_COMMANDS.has(normalizedCommand)) {
+        return { source: 'must-allow-catalog', catalogCommand: normalizedCommand };
+    }
+    return null;
+}
+function matchStateEntry(params) {
+    const now = params.now ?? Date.now();
+    const match = params.state.entries.find((entry) => entry.kind === params.kind &&
+        entry.fingerprint === params.fingerprint &&
+        !isExpired(entry.expiresAt, now) &&
+        (entry.repoRoot === undefined || entry.repoRoot === params.repoRoot));
+    if (!match) {
+        return null;
+    }
+    return { source: match.source, entryId: match.fingerprint };
+}
+export function resolveStandingAllowMatch(params) {
+    if (params.result.verdict !== 'deny_pending_approval') {
+        return null;
+    }
+    if (isTier0StandingAllowBlocked(params.result)) {
+        return null;
+    }
+    const normalizedCommand = params.result.normalizedCommand ?? params.result.summary ?? '';
+    const catalogMatch = matchBundledCatalog(params.kind, normalizedCommand);
+    if (catalogMatch) {
+        return catalogMatch;
+    }
+    return matchStateEntry({
+        kind: params.kind,
+        fingerprint: params.result.fingerprint,
+        repoRoot: params.repoRoot,
+        state: params.state,
+        now: params.now,
+    });
+}
+export function addStandingAllowEntry(state, entry) {
+    const createdAt = entry.createdAt ?? new Date().toISOString();
+    const ttlMs = entry.ttlMs ?? DEFAULT_STANDING_ALLOW_TTL_MS;
+    const expiresAt = entry.expiresAt ?? new Date(Date.parse(createdAt) + ttlMs).toISOString();
+    const next = {
+        kind: entry.kind,
+        fingerprint: entry.fingerprint,
+        source: entry.source,
+        reason: entry.reason,
+        createdAt,
+        expiresAt,
+        ...(entry.summary ? { summary: entry.summary } : {}),
+        ...(entry.repoRoot ? { repoRoot: entry.repoRoot } : {}),
+    };
+    const filtered = state.entries.filter((existing) => !(existing.kind === next.kind &&
+        existing.fingerprint === next.fingerprint &&
+        existing.repoRoot === next.repoRoot));
+    return compactStandingAllow({
+        version: 1,
+        entries: [...filtered, next],
+    });
+}
+export function revokeStandingAllowEntry(state, params) {
+    const before = state.entries.length;
+    const entries = state.entries.filter((entry) => {
+        if (entry.kind !== params.kind || entry.fingerprint !== params.fingerprint) {
+            return true;
+        }
+        if (params.repoRoot && entry.repoRoot && entry.repoRoot !== params.repoRoot) {
+            return true;
+        }
+        return false;
+    });
+    return {
+        state: { version: 1, entries },
+        removed: entries.length < before,
+    };
+}

package/dist/core/types.d.ts

@@ -67,11 +67,16 @@ export interface ClassifierOptions {
     /** When true with sandbox enabled, outside-repo rules defer to fs-scope allowlist. */
     brokerFsScope?: boolean;
     fsScopeAllowlist?: FsScopeAllowlistFile;
+    trustedWorkspaceRoots?: string[];
     /** Test override: inject Tier1 judge without changing config.judge. */
     tier1Judge?: import('./verdict/types.js').Tier1Judge;
     /** When false, path resolution stays fail-closed (opaque cd chains). Default: Boolean(cwd). */
     trustedCwd?: boolean;
 }
+export interface ApprovalScopeHint {
+    scope: 'workspace-root';
+    path: string;
+}
 export interface ApprovalRecord {
     approvalId: string;
     kind: 'shell' | 'subagent' | 'tool' | 'egress' | 'capability';
@@ -87,6 +92,16 @@ export interface ApprovalRecord {
     /** Original gated input for explain-last-ask (ApprovalState v2). */
     input?: string;
     inputKind?: 'shell' | 'tool' | 'subagent';
+    /** Replay envelope: working directory when the action was gated. */
+    cwd?: string;
+    /** Replay envelope: tool name for tool/subagent actions. */
+    toolName?: string;
+    /** Replay envelope: canonical payload hash for strict replay validation. */
+    payloadHash?: string;
+    /** Replay envelope: scrubbed payload JSON for explain (size-capped at write time). */
+    payloadJson?: string;
+    /** Optional scope hint for structured capability approvals. */
+    scopeHint?: ApprovalScopeHint;
 }
 export interface ApprovalStateFile {
     version: 1 | 2;

package/dist/core/verdict/adapter.js

@@ -1,4 +1,5 @@
 import { judgeTraceAuditFields } from './judge-audit.js';
+import { recordJudgeLatency } from './judge-baseline.js';
 import { createJudgeFromConfig } from './judge-factory.js';
 import { verdict } from './verdict.js';
 export function resolveClassifierTrustedCwd(cwd, options, explicit) {
@@ -16,11 +17,14 @@ export function buildVerdictContext(params) {
         cwd: params.cwd,
         repoRoot: params.repoRoot,
         trustedCwd: resolveClassifierTrustedCwd(params.cwd, params.options, params.trustedCwd),
+        trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
         sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
         protectedArtifactRoots: protectedArtifactRoots.length > 0 ? [...new Set(protectedArtifactRoots)] : undefined,
         customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
         customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
-        judge: params.judge ?? params.options?.tier1Judge ?? createJudgeFromConfig(params.config),
+        judge: params.judge ??
+            params.options?.tier1Judge ??
+            createJudgeFromConfig(params.config, { repoRoot: params.repoRoot }),
         mode: params.config.mode,
         unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
         unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell,
@@ -28,7 +32,12 @@ export function buildVerdictContext(params) {
 }
 export async function classifyShell(command, cwd, repoRoot, config, options = {}, judge) {
     const context = buildVerdictContext({ cwd, repoRoot, config, options, judge });
+    const started = Date.now();
     const result = await verdict(command, context);
+    const elapsed = Date.now() - started;
+    if (result.confidence !== 'llm') {
+        recordJudgeLatency('tier0', elapsed);
+    }
     return verdictToClassifyResult(result);
 }
 function mapLegacyReason(result) {

package/dist/core/verdict/containment.d.ts

@@ -6,13 +6,13 @@ export interface PathTargetAnalysis {
     signals: string[];
 }
 export declare function resolveTrustedPath(token: string, trustedCwd: string, trusted: boolean): string | null;
-export declare function locationForPath(resolvedPath: string | null, repoRoot: string): VerdictLocation;
+export declare function locationForPath(resolvedPath: string | null, repoRoot: string, trustedWorkspaceRoots?: string[]): VerdictLocation;
 export declare function isGitPath(resolvedPath: string, repoRoot: string): boolean;
-export declare function isHighStakesPath(resolvedPath: string, repoRoot: string, sensitivePaths: string[], protectedRoots?: string[]): boolean;
+export declare function isHighStakesPath(resolvedPath: string, repoRoot: string, sensitivePaths: string[], protectedRoots?: string[], trustedWorkspaceRoots?: string[]): boolean;
 /** ADR-002 M3: destructive shell head on git/sensitive path (not broad category ask). */
 export declare function isDestructiveMutationHead(head: string): boolean;
 export declare function touchesProtectedRoot(resolvedPath: string, protectedRoots: string[]): boolean;
-export declare function isDestructiveHighStakesMutation(head: string, resolvedPath: string, repoRoot: string, sensitivePaths: string[], protectedRoots?: string[]): boolean;
+export declare function isDestructiveHighStakesMutation(head: string, resolvedPath: string, repoRoot: string, sensitivePaths: string[], protectedRoots?: string[], trustedWorkspaceRoots?: string[]): boolean;
 export declare function analyzePathTargets(params: {
     targets: string[];
     cwd: string;
@@ -20,5 +20,6 @@ export declare function analyzePathTargets(params: {
     trustedCwd: boolean;
     sensitivePaths: string[];
     protectedArtifactRoots?: string[];
+    trustedWorkspaceRoots?: string[];
 }): PathTargetAnalysis;
 export declare function cwdRelative(repoRoot: string, cwd: string): string;

package/dist/core/verdict/containment.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { matchesSensitivePath } from '../glob.js';
-import { canonicalPath, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from '../path-utils.js';
+import { canonicalPath, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, resolveWorkspaceRootMatch, } from '../path-utils.js';
 import { isOutsideRepoSecretCredentialPath } from './persistent-paths.js';
 export { isOutsideRepoSecretCredentialPath, isPersistentAgentPath } from './persistent-paths.js';
 function expandHome(token) {
@@ -26,11 +26,11 @@ export function resolveTrustedPath(token, trustedCwd, trusted) {
     }
     return canonicalPath(path.resolve(trustedCwd, expanded));
 }
-export function locationForPath(resolvedPath, repoRoot) {
+export function locationForPath(resolvedPath, repoRoot, trustedWorkspaceRoots = []) {
     if (!resolvedPath) {
         return 'unknown';
     }
-    if (pathWithinRoot(repoRoot, resolvedPath)) {
+    if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolvedPath)) {
         return 'repo_local';
     }
     return 'repo_outside';
@@ -41,17 +41,22 @@ export function isGitPath(resolvedPath, repoRoot) {
         return false;
     }
     const normalized = relative.replaceAll('\\', '/');
-    return normalized === '.git' || normalized.startsWith('.git/');
+    return (normalized === '.git' ||
+        normalized.startsWith('.git/') ||
+        normalized.endsWith('/.git') ||
+        normalized.includes('/.git/'));
 }
-export function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+export function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = [], trustedWorkspaceRoots = []) {
     if (isGitPath(resolvedPath, repoRoot)) {
         return true;
     }
-    const relative = relativeWithinRepo(repoRoot, resolvedPath);
-    if (relative !== null && matchesSensitivePath(relative.replaceAll('\\', '/'), sensitivePaths)) {
+    const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolvedPath);
+    if (workspaceMatch !== null &&
+        matchesSensitivePath(workspaceMatch.relativePath.replaceAll('\\', '/'), sensitivePaths)) {
         return true;
     }
-    if (relative === null && isOutsideRepoSecretCredentialPath(resolvedPath)) {
+    if ((workspaceMatch === null || workspaceMatch.kind === 'trusted') &&
+        isOutsideRepoSecretCredentialPath(resolvedPath)) {
         return true;
     }
     return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
@@ -73,14 +78,14 @@ export function isDestructiveMutationHead(head) {
 export function touchesProtectedRoot(resolvedPath, protectedRoots) {
     return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath) || root === resolvedPath);
 }
-export function isDestructiveHighStakesMutation(head, resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+export function isDestructiveHighStakesMutation(head, resolvedPath, repoRoot, sensitivePaths, protectedRoots = [], trustedWorkspaceRoots = []) {
     if (touchesProtectedRoot(resolvedPath, protectedRoots)) {
         return true;
     }
     if (!isDestructiveMutationHead(head)) {
         return false;
     }
-    return isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, []);
+    return isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, [], trustedWorkspaceRoots);
 }
 export function analyzePathTargets(params) {
     const signals = [];
@@ -96,10 +101,10 @@ export function analyzePathTargets(params) {
     for (const target of params.targets) {
         const resolved = resolveTrustedPath(target, params.cwd, params.trustedCwd) ??
             resolveMutationTarget(target, params.cwd);
-        const location = locationForPath(resolved, params.repoRoot);
+        const location = locationForPath(resolved, params.repoRoot, params.trustedWorkspaceRoots);
         locations.add(location);
         if (resolved &&
-            isHighStakesPath(resolved, params.repoRoot, params.sensitivePaths, params.protectedArtifactRoots)) {
+            isHighStakesPath(resolved, params.repoRoot, params.sensitivePaths, params.protectedArtifactRoots, params.trustedWorkspaceRoots)) {
             isHighStakes = true;
             signals.push('high_stakes_path');
         }

package/dist/core/verdict/judge-audit.d.ts

@@ -1,2 +1,3 @@
 import type { JudgeTrace } from './types.js';
+export declare function hashJudgeSessionRef(value: string): string;
 export declare function judgeTraceAuditFields(trace?: JudgeTrace): Record<string, unknown>;

package/dist/core/verdict/judge-audit.js

@@ -1,3 +1,7 @@
+import { createHash } from 'node:crypto';
+export function hashJudgeSessionRef(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
 export function judgeTraceAuditFields(trace) {
     if (!trace) {
         return {};
@@ -10,6 +14,33 @@ export function judgeTraceAuditFields(trace) {
         ...(trace.outboundRedacted !== undefined
             ? { judgeOutboundRedacted: trace.outboundRedacted }
             : {}),
-        ...(trace.fallbackReason ? { judgeFallbackReason: trace.fallbackReason } : {}),
+        ...(trace.judgeFallbackReason
+            ? { judgeFallbackReason: trace.judgeFallbackReason }
+            : trace.fallbackReason
+                ? { judgeFallbackReason: trace.fallbackReason }
+                : {}),
+        ...(trace.judgeSessionUsed !== undefined ? { judgeSessionUsed: trace.judgeSessionUsed } : {}),
+        ...(trace.judgeSessionReused !== undefined
+            ? { judgeSessionReused: trace.judgeSessionReused }
+            : {}),
+        ...(trace.judgeSessionRefHash ? { judgeSessionRefHash: trace.judgeSessionRefHash } : {}),
+        ...(trace.judgeSessionResetReason
+            ? { judgeSessionResetReason: trace.judgeSessionResetReason }
+            : {}),
+        ...(trace.judgeConnectMs !== undefined ? { judgeConnectMs: trace.judgeConnectMs } : {}),
+        ...(trace.judgeEvalMs !== undefined ? { judgeEvalMs: trace.judgeEvalMs } : {}),
+        ...(trace.judgeParseMs !== undefined ? { judgeParseMs: trace.judgeParseMs } : {}),
+        ...(trace.judgeShadowCompared !== undefined
+            ? { judgeShadowCompared: trace.judgeShadowCompared }
+            : {}),
+        ...(trace.judgeShadowMismatch !== undefined
+            ? { judgeShadowMismatch: trace.judgeShadowMismatch }
+            : {}),
+        ...(trace.judgeShadowMismatchRateWindow !== undefined
+            ? { judgeShadowMismatchRateWindow: trace.judgeShadowMismatchRateWindow }
+            : {}),
+        ...(trace.judgeKillSwitchTriggered !== undefined
+            ? { judgeKillSwitchTriggered: trace.judgeKillSwitchTriggered }
+            : {}),
     };
 }

package/dist/core/verdict/judge-baseline.d.ts

@@ -0,0 +1,20 @@
+import { JUDGE_LATENCY_SLO } from './judge-runtime-config.js';
+export type JudgeLatencyPhase = 'tier0' | 'tier1_spawn' | 'tier1_session' | 'tier1_connect' | 'tier1_eval' | 'tier1_parse';
+export interface JudgeLatencySample {
+    phase: JudgeLatencyPhase;
+    latencyMs: number;
+    at: number;
+}
+export interface JudgeLatencyPercentiles {
+    p50: number;
+    p95: number;
+    count: number;
+}
+export declare function resetJudgeLatencySamples(): void;
+export declare function recordJudgeLatency(phase: JudgeLatencyPhase, latencyMs: number, at?: number): void;
+export declare function judgeLatencyPercentiles(phase: JudgeLatencyPhase): JudgeLatencyPercentiles;
+export declare function judgeLatencySloReport(): {
+    slo: typeof JUDGE_LATENCY_SLO;
+    measured: Record<JudgeLatencyPhase, JudgeLatencyPercentiles>;
+    sessionMeetsTarget: boolean;
+};