@guilz-dev/belay 0.8.0 → 0.9.0

package/dist/commands/classify-for-report.js

@@ -3,6 +3,7 @@ import { getAdapter } from '../adapters/registry.js';
 import { repoShellClassifierOptions } from '../adapters/shared/gate-runtime.js';
 import { detectAdapterName, loadConfigFile } from '../config-io.js';
 import { isCapabilityBrokerDemotionActive } from '../core/capability/broker.js';
+import { isContainedUnknownExecutionEligible } from '../core/contained-execution/eligibility.js';
 import { classifySubagent, classifyToolUse } from '../core/index.js';
 import { isTransactionalEligible } from '../core/transactional/index.js';
 import { classifyShell } from '../core/verdict/adapter.js';
@@ -26,6 +27,10 @@ export async function classifyForReport(params) {
             throw new Error('classify-for-report requires a command for shell classification.');
         }
         result = await classifyShell(params.command, cwd, repoRoot, config, classifierOptions);
+        result = {
+            ...result,
+            wouldMediate: isContainedUnknownExecutionEligible(config, { kind: 'shell', repoRoot }, result),
+        };
         input = params.command;
     }
     else if (kind === 'subagent') {

package/dist/commands/doctor.js

@@ -4,42 +4,33 @@ import path from 'node:path';
 import { getClaudeManagedHookEntries } from '../adapters/claude/hooks.js';
 import { getCodexManagedHookEntries } from '../adapters/codex/hooks.js';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { resolveScopedPaths } from '../adapters/layouts/scope.js';
 import { cleanupOrphanApprovalState } from '../cleanup-orphans.js';
-import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, } from '../config-io.js';
+import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, writeConfigFile, } from '../config-io.js';
 import { approvalSigningKeyPath } from '../core/approval-token.js';
 import { detectFenceDrift, summarizeAuditVisibility } from '../core/audit-summary.js';
 import { inspectBoundaryAttestationFile } from '../core/capability/boundary-attestation-sign.js';
 import { boundaryAttestationPath, boundarySessionStatus, } from '../core/capability/boundary-session.js';
-import { defaultControlPlaneDir } from '../core/config.js';
+import { configuredControlPlaneDir, defaultControlPlaneDir, hasForbiddenShellOverrideLists, stripForbiddenShellOverrideLists, } from '../core/config.js';
 import { verifyIntegrityManifest } from '../core/integrity.js';
 import { diagnoseJudge, stopJudgeSessionBrokers } from '../core/judge-doctor.js';
 import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
 import { listRecoveryCheckpoints } from '../core/recovery/checkpoint.js';
 import { recoveryApprovalSetupNotes, recoveryNotificationConfigured, recoveryNotificationSetupWarning, summarizeRecoveryCheckpointDiagnostics, } from '../core/recovery/operator-guidance.js';
+import { probeFileCheckpointBackend } from '../core/transactional/backend-selector.js';
+import { fileCheckpointIsolationReason } from '../core/transactional/file-checkpoint-isolation.js';
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
+import { isGitWorktreeAvailable } from '../core/transactional/git-worktree.js';
 import { getManagedHookEntries } from '../defaults.js';
 import { resolveNodeBinary } from '../node-resolution.js';
+import { readInstalledRuntimeProvenance } from '../runtime-provenance.js';
 import { egressStatus } from '../services/egress-service.js';
 import { sandboxStatus } from '../services/sandbox-service.js';
 import { PACKAGE_VERSION } from '../version.js';
 import { loadAuditRecords } from './audit.js';
 import { collectHealthSnapshot } from './health-snapshot.js';
 import { metricsProject } from './metrics.js';
-async function readRuntimeVersion(corePath) {
-    try {
-        const content = await readFile(corePath, 'utf8');
-        const stampMatch = content.match(/RUNTIME_BUILD_STAMP\s*=\s*"([^"]+)"/);
-        const versionMatch = content.match(/RUNTIME_PACKAGE_VERSION\s*=\s*"([^"]+)"/);
-        return {
-            stamp: stampMatch?.[1],
-            version: versionMatch?.[1],
-        };
-    }
-    catch {
-        return {};
-    }
-}
 function resolveDoctorAdapter(options, configAdapter) {
     if (options.adapter) {
         return options.adapter;
@@ -87,7 +78,7 @@ export async function doctorProject(options = {}) {
                 ...(loadedConfig.overrides.external.length > 0 ? ['overrides.external'] : []),
             ];
             if (ignoredShellOverrideLists.length > 0) {
-                warnings.push(`Legacy shell ${ignoredShellOverrideLists.join(' and ')} ${ignoredShellOverrideLists.length === 1 ? 'is' : 'are'} deprecated and ignored. Remove the command list; inspect the EffectPlan and correct effect semantics or resource scope instead.`);
+                issues.push(`Legacy shell ${ignoredShellOverrideLists.join(' and ')} ${ignoredShellOverrideLists.length === 1 ? 'is' : 'are'} forbidden (ADR-005). Remove the command list (or run belay doctor --fix); improve EffectPlan semantics, use one-shot approval, or approve an exact resource scope instead.`);
             }
             if (loadedConfig.version !== 4) {
                 warnings.push(`Config version is ${loadedConfig.version}; expected 4. Run belay upgrade to migrate.`);
@@ -234,7 +225,7 @@ export async function doctorProject(options = {}) {
         notes.push(`Node resolved at ${nodeResolution.path}`);
     }
     if (existsSync(corePath)) {
-        const runtimeVersions = await readRuntimeVersion(corePath);
+        const runtimeVersions = await readInstalledRuntimeProvenance(corePath);
         if (runtimeVersions.stamp && !runtimeVersions.stamp.startsWith(`${PACKAGE_VERSION}@`)) {
             warnings.push(`Installed runtime stamp (${runtimeVersions.stamp}) differs from package (${PACKAGE_VERSION}). Run belay upgrade.`);
         }
@@ -246,6 +237,23 @@ export async function doctorProject(options = {}) {
         }
     }
     if (options.fix && loadedConfig) {
+        if (hasForbiddenShellOverrideLists(loadedConfig)) {
+            if (options.dryRun !== true) {
+                const stripped = stripForbiddenShellOverrideLists(loadedConfig);
+                await writeConfigFile(repoRoot, stripped, adapterName);
+                loadedConfig = stripped;
+                notes.push('Removed forbidden legacy shell override lists (overrides.allow / overrides.external).');
+                for (let index = issues.length - 1; index >= 0; index -= 1) {
+                    const issue = issues[index] ?? '';
+                    if (issue.includes('overrides.allow') || issue.includes('overrides.external')) {
+                        issues.splice(index, 1);
+                    }
+                }
+            }
+            else {
+                notes.push('Dry run: would remove forbidden legacy shell override lists.');
+            }
+        }
         const cleanup = await cleanupOrphanApprovalState(repoRoot, loadedConfig, {
             dryRun: options.dryRun === true,
         });
@@ -269,25 +277,34 @@ export async function doctorProject(options = {}) {
     let dogfood = null;
     if (loadedConfig) {
         const auditRecords = await loadAuditRecords(repoRoot);
-        const auditVisibility = summarizeAuditVisibility(auditRecords);
+        const metrics = await metricsProject({ targetDir: repoRoot });
+        const cohortIdentity = metrics.currentCohort.identity;
+        const cohortAuditRecords = cohortIdentity
+            ? auditRecords.filter((record) => record.runtimeBuildStamp === cohortIdentity.runtimeBuildStamp &&
+                record.configFingerprint === cohortIdentity.configFingerprint)
+            : [];
+        const auditVisibility = summarizeAuditVisibility(cohortAuditRecords);
         const drift = detectFenceDrift(auditVisibility, {
             threshold: loadedConfig.policy.fenceWarnThreshold,
         });
         warnings.push(...drift.warnings);
         notes.push(...drift.notes);
-        const metrics = await metricsProject({ targetDir: repoRoot });
+        const cohort = metrics.currentCohort;
         dogfood = {
             active: loadedConfig.mode === 'audit' && loadedConfig.policy.unknownLocalEffect === 'deny',
             mode: loadedConfig.mode,
             unknownLocalEffect: loadedConfig.policy.unknownLocalEffect,
             readyForEnforce: metrics.dogfood.readyForEnforce,
-            gateEvents: metrics.gateEvents,
-            wouldBlockCount: metrics.wouldBlockCount,
-            wouldBlockRate: metrics.wouldBlockRate,
+            gateEvents: cohort.gateEvents,
+            wouldBlockCount: cohort.wouldBlockCount,
+            wouldBlockRate: cohort.wouldBlockRate,
+            excludedGateEvents: cohort.excludedGateEvents,
+            runtimeBuildStamp: cohort.identity?.runtimeBuildStamp,
+            configFingerprint: cohort.identity?.configFingerprint,
             notes: metrics.dogfood.notes,
         };
         if (dogfood.active) {
-            notes.push(`Dogfood active: ${dogfood.gateEvents} gate events, ${dogfood.wouldBlockCount} would-block (${(dogfood.wouldBlockRate * 100).toFixed(1)}%).`);
+            notes.push(`Dogfood active cohort: ${dogfood.gateEvents} gate events, ${dogfood.wouldBlockCount} would-block (${(dogfood.wouldBlockRate * 100).toFixed(1)}%); ${dogfood.excludedGateEvents} historical/mismatched event(s) excluded.`);
             if (dogfood.readyForEnforce) {
                 notes.push('Dogfood metrics suggest enforce mode is ready (belay dogfood --enforce).');
             }
@@ -295,10 +312,27 @@ export async function doctorProject(options = {}) {
         else if (dogfood.unknownLocalEffect === 'deny' && dogfood.mode !== 'audit') {
             notes.push('Fail-closed policy is enabled in enforce mode.');
         }
+        const recoveryCohort = metrics.currentCohortRecovery;
+        const restoreTotal = recoveryCohort.restore.applied +
+            recoveryCohort.restore.conflict +
+            recoveryCohort.restore.rejected;
+        if (recoveryCohort.snapshot.attempts > 0 || restoreTotal > 0) {
+            notes.push(`Recovery cohort metrics: ${recoveryCohort.snapshot.attempts} snapshot attempt(s) (${recoveryCohort.snapshot.applied} applied, ${recoveryCohort.snapshot.skipped} skipped); restore outcomes ${recoveryCohort.restore.applied} applied / ${recoveryCohort.restore.conflict} conflict / ${recoveryCohort.restore.rejected} rejected.`);
+            if (recoveryCohort.snapshot.prepareSampleCount > 0) {
+                notes.push(`Recovery snapshot prepare latency (cohort): p50 ${recoveryCohort.snapshot.prepareMsP50 ?? 0}ms, p95 ${recoveryCohort.snapshot.prepareMsP95 ?? 0}ms (${recoveryCohort.snapshot.prepareSampleCount} samples).`);
+            }
+            if (Object.keys(recoveryCohort.snapshot.failuresByReason).length > 0) {
+                notes.push(`Recovery snapshot failures (cohort): ${Object.entries(recoveryCohort.snapshot.failuresByReason)
+                    .map(([reason, count]) => `${reason}=${count}`)
+                    .join(', ')}.`);
+            }
+        }
         if (loadedConfig.policy.transactional.enabled) {
-            notes.push('Transactional execution: enabled — low-confidence shell mutations run in an isolated git worktree; observed-safe effects are applied once and the hook denies re-execution.');
-            if (!existsSync(path.join(repoRoot, '.git'))) {
-                warnings.push('Transactional execution is enabled but this directory is not a git repository. Transactional worktrees will be skipped until git is available.');
+            notes.push('Transactional execution: enabled — low-confidence shell mutations run in an isolated git worktree or file-checkpoint mirror; observed-safe effects are applied once and the hook denies re-execution.');
+            const fileCheckpointEnabled = loadedConfig.policy.transactional.fileCheckpoint.enabled;
+            const allowNonGit = loadedConfig.policy.transactional.fileCheckpoint.allowNonGit;
+            if (!existsSync(path.join(repoRoot, '.git')) && !(fileCheckpointEnabled && allowNonGit)) {
+                warnings.push('Transactional execution is enabled but this directory is not a git repository. Enable file checkpoint with allowNonGit or initialize git before transactional recovery can run.');
             }
         }
         const fileCheckpoint = loadedConfig.policy.transactional.fileCheckpoint;
@@ -311,6 +345,35 @@ export async function doctorProject(options = {}) {
             if (!loadedConfig.policy.transactional.checkpoint?.enabled) {
                 warnings.push('File checkpoint is enabled but durable Recovery checkpointing is disabled; backend selection will fail closed.');
             }
+            const checkpointConfig = loadedConfig.policy.transactional.checkpoint;
+            const configuredBoundary = loadedConfig.capability?.boundaryDriver ??
+                (loadedConfig.sandbox.runtime === 'container' ? 'container' : null);
+            let attestation = null;
+            if (configuredBoundary) {
+                try {
+                    const session = await boundarySessionStatus({ repoRoot, config: loadedConfig });
+                    attestation = session.attestation;
+                }
+                catch {
+                    attestation = null;
+                }
+            }
+            const gitAvailable = await isGitWorktreeAvailable(repoRoot);
+            const backendContext = {
+                repoRoot,
+                stateDir: belayStateDir(loadedConfig, repoLocalDir),
+                cwd: repoRoot,
+                dirtyIgnoreRoots: protectedArtifactRoots(activeLayout, repoRoot, loadedConfig.controlPlane.enabled ? configuredControlPlaneDir(loadedConfig) : null),
+                fileCheckpoint,
+                durableCheckpointEnabled: checkpointConfig?.enabled === true,
+                boundaryAttestation: attestation,
+                boundaryAttestationFresh: false,
+                boundaryDriverId: configuredBoundary ?? undefined,
+            };
+            const isolationAvailable = fileCheckpointIsolationReason(backendContext) === null;
+            const fileCheckpointProbe = await probeFileCheckpointBackend(backendContext);
+            const fileCheckpointAvailable = loadedConfig.policy.transactional.enabled && fileCheckpointProbe.eligible;
+            notes.push(`File checkpoint eligibility: probe=${fileCheckpointAvailable ? 'available' : 'unavailable'}, workspace=${gitAvailable ? 'git' : 'non-git'}, isolation=${isolationAvailable ? (configuredBoundary ?? 'attested') : 'unavailable'}.`);
         }
         if (loadedConfig.policy.transactional.checkpoint?.enabled) {
             notes.push('Recovery checkpoint: enabled — repo-local pre-images are persisted before observed-safe transactional apply.');

package/dist/commands/explain.js

@@ -103,11 +103,12 @@ export function formatExplainReport(report) {
             : 'Egress proxy: not configured',
         `Sandbox (L1 broker): ${report.sandbox.enabled ? 'enabled' : 'disabled'} (runtime=${report.sandbox.runtime}, fs broker active=${report.sandboxBrokerActive}, L1-full=${report.l1FullActive})`,
         `Transactional (L2): ${report.policy.transactional.enabled ? 'enabled' : 'disabled'} (eligible for this command=${report.transactionalEligible})`,
+        `Contained unknown execution: ${result.wouldMediate ? 'would mediate' : 'not eligible'}`,
         report.policy.transactional.enabled
             ? `Transactional band: [${report.policy.transactional.minConfidence}, ${report.policy.transactional.maxConfidence})`
             : 'Transactional band: not configured',
-        `Legacy overrides allow (deprecated, ignored): ${report.overrides.allow.join(', ') || '(none)'}`,
-        `Legacy overrides external (deprecated, ignored): ${report.overrides.external.join(', ') || '(none)'}`,
+        `Legacy overrides allow (forbidden, ignored): ${report.overrides.allow.join(', ') || '(none)'}`,
+        `Legacy overrides external (forbidden, ignored): ${report.overrides.external.join(', ') || '(none)'}`,
         '',
         `Verdict: ${result.verdict}`,
         `Reason: ${result.reason}`,

package/dist/commands/metrics.js

@@ -2,6 +2,7 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { loadConfigFile } from '../config-io.js';
 import { computeAuditMetrics, parseAuditNdjson } from '../core/audit-metrics.js';
+import { resolveActiveAuditCohort } from '../runtime-provenance.js';
 function formatFingerprintPreview(fingerprint) {
     if (fingerprint.length <= 12) {
         return fingerprint;
@@ -20,21 +21,87 @@ export async function metricsProject(options = {}) {
         raw = '';
     }
     const records = parseAuditNdjson(raw);
+    const activeCohort = await resolveActiveAuditCohort(repoRoot, config);
     return computeAuditMetrics(records, {
         auditLogPath: config.audit.logPath,
         mode: config.mode,
         unknownLocalEffect: config.policy.unknownLocalEffect,
+        activeCohort,
     });
 }
+function formatRecoveryMetricsSection(label, metrics, excluded) {
+    const lines = [
+        '',
+        label,
+        `Snapshot attempts: ${metrics.snapshot.attempts} (${metrics.snapshot.applied} applied, ${metrics.snapshot.skipped} skipped)`,
+    ];
+    if (excluded) {
+        lines.push(`- excluded historical/mismatched snapshot attempts: ${excluded.snapshotAttempts}`, `- excluded historical/mismatched restore events: ${excluded.restoreEvents}`);
+    }
+    if (metrics.snapshot.prepareSampleCount > 0) {
+        lines.push(`Snapshot prepare latency: p50 ${metrics.snapshot.prepareMsP50 ?? 0}ms, p95 ${metrics.snapshot.prepareMsP95 ?? 0}ms (${metrics.snapshot.prepareSampleCount} samples)`);
+    }
+    if (Object.keys(metrics.snapshot.byBackend).length > 0) {
+        lines.push('Snapshot backends:');
+        for (const [backend, count] of Object.entries(metrics.snapshot.byBackend).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${backend}: ${count}`);
+        }
+    }
+    if (Object.keys(metrics.snapshot.byResourceKind).length > 0) {
+        lines.push('Snapshot resource kinds:');
+        for (const [resourceKind, count] of Object.entries(metrics.snapshot.byResourceKind).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${resourceKind}: ${count}`);
+        }
+    }
+    if (Object.keys(metrics.snapshot.failuresByReason).length > 0) {
+        lines.push('Snapshot failures by reason:');
+        for (const [reason, count] of Object.entries(metrics.snapshot.failuresByReason).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${reason}: ${count}`);
+        }
+    }
+    const restoreTotal = metrics.restore.applied + metrics.restore.conflict + metrics.restore.rejected;
+    if (restoreTotal > 0) {
+        lines.push(`Restore outcomes: ${metrics.restore.applied} applied, ${metrics.restore.conflict} conflict, ${metrics.restore.rejected} rejected`);
+    }
+    return lines;
+}
 export function formatMetricsReport(report) {
     const lines = [
         `belay metrics for ${report.auditLogPath}`,
         `Schema: v${report.schemaVersion}`,
-        `Gate events: ${report.gateEvents}`,
-        `Would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
-        `Classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
-        `Approvals recorded during audit: ${report.approvalRecordedCount}`,
+        `All-time gate events: ${report.gateEvents}`,
+        `All-time would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
+        `All-time classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
+        `All-time approvals recorded during audit: ${report.approvalRecordedCount}`,
+        `Contained execution: would mediate ${report.containedExecution.wouldMediate}; complete ${report.containedExecution.complete}; failed ${report.containedExecution.failed}; timed out ${report.containedExecution.timedOut}`,
     ];
+    lines.push('', 'Current readiness cohort:');
+    if (report.currentCohort.identity) {
+        lines.push(`- runtime build: ${report.currentCohort.identity.runtimeBuildStamp}`);
+        lines.push(`- config fingerprint: ${formatFingerprintPreview(report.currentCohort.identity.configFingerprint)}`);
+    }
+    else {
+        lines.push('- identity: unavailable');
+    }
+    lines.push(`- matching gate events: ${report.currentCohort.gateEvents}`);
+    lines.push(`- excluded historical/mismatched gate events: ${report.currentCohort.excludedGateEvents}`);
+    lines.push(`- would-block: ${report.currentCohort.wouldBlockCount} (${(report.currentCohort.wouldBlockRate * 100).toFixed(1)}%)`);
+    lines.push(`- classifier-quality would-block: ${report.currentCohort.classifierWouldBlockCount} (${(report.currentCohort.classifierWouldBlockRate * 100).toFixed(1)}%)`);
+    lines.push(`- approvals recorded during audit: ${report.currentCohort.approvalRecordedCount}`);
+    lines.push(`- contained execution: would mediate ${report.currentCohort.containedExecution.wouldMediate}; complete ${report.currentCohort.containedExecution.complete}; failed ${report.currentCohort.containedExecution.failed}; timed out ${report.currentCohort.containedExecution.timedOut}`);
+    lines.push(`- availability-caused asks: ${report.currentCohort.availabilityAsks.total}`);
+    if (Object.keys(report.currentCohort.wouldBlockByReason).length > 0) {
+        lines.push('', 'Current-cohort would-block by reason:');
+        for (const [reason, count] of Object.entries(report.currentCohort.wouldBlockByReason).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${reason}: ${count}`);
+        }
+    }
+    if (report.currentCohort.topWouldBlockSummaries.length > 0) {
+        lines.push('', 'Current-cohort top would-block summaries:');
+        for (const entry of report.currentCohort.topWouldBlockSummaries) {
+            lines.push(`- [${entry.reason}] x${entry.count}: ${entry.summary}`);
+        }
+    }
     if (report.approvalLatency.count > 0) {
         lines.push(`Approval latency: median ${report.approvalLatency.medianMs ?? 0}ms, p95 ${report.approvalLatency.p95Ms ?? 0}ms (${report.approvalLatency.count} samples)`);
     }
@@ -123,5 +190,9 @@ export function formatMetricsReport(report) {
         }
         lines.push('', report.dogfood.readyForEnforce ? 'Ready for enforce: yes' : 'Ready for enforce: not yet');
     }
+    lines.push(...formatRecoveryMetricsSection('All-time recovery metrics:', report.recovery), ...formatRecoveryMetricsSection('Current-cohort recovery metrics:', report.currentCohortRecovery, {
+        snapshotAttempts: report.currentCohortRecovery.excludedSnapshotAttempts,
+        restoreEvents: report.currentCohortRecovery.excludedRestoreEvents,
+    }));
     return `${lines.join('\n')}\n`;
 }

package/dist/commands/quality.js

@@ -1,10 +1,10 @@
 import path from 'node:path';
 import { loadConfigFile } from '../config-io.js';
-import { computeAuditMetrics } from '../core/audit-metrics.js';
 import { runCorpusEvaluation } from '../corpus/evaluate.js';
 import { passesHardGates } from '../corpus/gates.js';
 import { loadAuditRecords } from './audit.js';
 import { harvestReportFromRecords } from './harvest.js';
+import { metricsProject } from './metrics.js';
 export const QUALITY_REPORT_SCHEMA_VERSION = 1;
 export async function qualityCheck(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
@@ -13,11 +13,7 @@ export async function qualityCheck(options = {}) {
     const corpusMetrics = await runCorpusEvaluation(corpusDir);
     const hardGatesOk = passesHardGates(corpusMetrics.gates);
     const auditRecords = await loadAuditRecords(repoRoot);
-    const metrics = computeAuditMetrics(auditRecords, {
-        auditLogPath: config.audit.logPath,
-        mode: config.mode,
-        unknownLocalEffect: config.policy.unknownLocalEffect,
-    });
+    const metrics = await metricsProject({ targetDir: repoRoot });
     const harvest = harvestReportFromRecords(auditRecords);
     const notes = [
         'Overall ok reflects corpus hard gates only; audit and harvest signals are advisory.',

package/dist/commands/recovery-checkpoints.d.ts

@@ -12,10 +12,13 @@ export declare function recoveryCheckpointCommand(options: {
     backendCounts: {
         [k: string]: number;
     };
+    resourceKindCounts: {
+        [k: string]: number;
+    };
     fileCheckpoint: {
         enabled: boolean;
         allowNonGit: boolean;
-        isolation: string | null;
+        isolation: import("../core/capability/attestation.js").BoundaryDriverId | null;
         copyStrategy: import("../core/transactional/file-clone.js").FileCloneStrategy | undefined;
         probe: string;
     };
@@ -55,6 +58,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -86,6 +90,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -117,6 +122,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -144,6 +150,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;

package/dist/commands/recovery-checkpoints.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import path from 'node:path';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { ensureBelayStateDir, loadConfigFile } from '../config-io.js';
 import { compactApprovals, createApprovalRecordWithEnvelope } from '../core/approval.js';
 import { createGateApprovalStore } from '../core/approval-service.js';
@@ -12,6 +14,8 @@ import { notifyDeny } from '../core/notify.js';
 import { canonicalPath } from '../core/path-utils.js';
 import { listRecoveryCheckpoints, RECOVERY_CHECKPOINT_CORRUPT, RECOVERY_RESTORE_CONFLICT, RECOVERY_RESTORE_REASON, recoveryCheckpointStorageBytes, recoveryRestoreBinding, restoreRecoveryCheckpoint, showRecoveryCheckpoint, } from '../core/recovery/checkpoint.js';
 import { formatRecoveryStateDiagnostic, recoveryNotificationConfigured, recoveryNotificationSetupWarning, summarizeRecoveryCheckpointDiagnostics, } from '../core/recovery/operator-guidance.js';
+import { probeFileCheckpointBackend } from '../core/transactional/backend-selector.js';
+import { fileCheckpointIsolationReason } from '../core/transactional/file-checkpoint-isolation.js';
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
 async function appendRecoveryAudit(repoRoot, config, event) {
     try {
@@ -116,28 +120,43 @@ export async function recoveryCheckpointCommand(options) {
             backend,
             checkpoints.filter((checkpoint) => checkpoint.backend === backend).length,
         ]));
+        const resourceKindCounts = Object.fromEntries([
+            ...new Set(checkpoints.map((checkpoint) => checkpoint.resourceKind ?? 'git_repository')),
+        ].map((resourceKind) => [
+            resourceKind,
+            checkpoints.filter((checkpoint) => (checkpoint.resourceKind ?? 'git_repository') === resourceKind).length,
+        ]));
         const checkpointBackends = Object.keys(backendCounts);
         const fileCheckpointConfig = config.policy.transactional.fileCheckpoint;
         const configuredBoundary = config.capability?.boundaryDriver ??
             (config.sandbox.runtime === 'container' ? 'container' : null);
-        let isolation = configuredBoundary;
-        let isolationAvailable = false;
+        let attestation = null;
         if (configuredBoundary) {
             try {
                 const session = await boundarySessionStatus({ repoRoot, config });
-                isolationAvailable =
-                    session.fresh === true && session.attestation?.isolatesWorkspaceMounts === true;
-                isolation = isolationAvailable ? (session.attestation?.driver ?? configuredBoundary) : null;
+                attestation = session.attestation;
             }
             catch {
-                isolation = null;
+                attestation = null;
             }
         }
         const copyStrategy = fileCheckpointConfig.enabled ? await probeFileCloneStrategy() : null;
-        const fileCheckpointAvailable = fileCheckpointConfig.enabled &&
-            config.policy.transactional.enabled &&
-            checkpointConfig.enabled &&
-            isolationAvailable;
+        const adapterLayout = getAdapterLayout(config.adapter);
+        const backendContext = {
+            repoRoot,
+            stateDir,
+            cwd: repoRoot,
+            dirtyIgnoreRoots: protectedArtifactRoots(adapterLayout, repoRoot, config.controlPlane.enabled ? configuredControlPlaneDir(config) : null),
+            fileCheckpoint: fileCheckpointConfig,
+            durableCheckpointEnabled: checkpointConfig.enabled,
+            boundaryAttestation: attestation,
+            boundaryAttestationFresh: false,
+            boundaryDriverId: configuredBoundary ?? undefined,
+        };
+        const isolationAvailable = fileCheckpointIsolationReason(backendContext) === null;
+        const fileCheckpointProbe = await probeFileCheckpointBackend(backendContext);
+        const fileCheckpointAvailable = config.policy.transactional.enabled && fileCheckpointProbe.eligible;
+        const isolation = isolationAvailable ? (attestation?.driver ?? configuredBoundary) : null;
         return {
             ok: true,
             subcommand: 'status',
@@ -149,6 +168,7 @@ export async function recoveryCheckpointCommand(options) {
                     : 'git_worktree',
             availableBackends: ['git_worktree', 'file_checkpoint'],
             backendCounts,
+            resourceKindCounts,
             fileCheckpoint: {
                 enabled: fileCheckpointConfig.enabled,
                 allowNonGit: fileCheckpointConfig.allowNonGit,
@@ -304,9 +324,13 @@ export async function recoveryCheckpointCommand(options) {
 }
 export function formatRecoveryCheckpointResult(result) {
     if (result.subcommand === 'status') {
+        const fileCheckpoint = result.fileCheckpoint;
+        const backendCounts = result.backendCounts;
+        const resourceKindCounts = result.resourceKindCounts;
         const lines = [
             `belay recover status for ${result.repoRoot}`,
             `Backend: ${result.backend}`,
+            `Available backends: ${result.availableBackends?.join(', ') ?? 'git_worktree, file_checkpoint'}`,
             `Checkpointing: ${result.enabled ? 'enabled' : 'disabled'}`,
             `Checkpoints: ${result.checkpointCount} (${result.recoverableCount} recoverable)`,
             `Needs manual repair: ${result.needsManualRepairCount ?? 0}`,
@@ -314,6 +338,15 @@ export function formatRecoveryCheckpointResult(result) {
             `Storage: ${result.storageBytes} bytes`,
             `States: ${JSON.stringify(result.states)}`,
         ];
+        if (backendCounts && Object.keys(backendCounts).length > 0) {
+            lines.push(`Backend counts: ${JSON.stringify(backendCounts)}`);
+        }
+        if (resourceKindCounts && Object.keys(resourceKindCounts).length > 0) {
+            lines.push(`Resource kind counts: ${JSON.stringify(resourceKindCounts)}`);
+        }
+        if (fileCheckpoint) {
+            lines.push(`File checkpoint: enabled=${fileCheckpoint.enabled ? 'yes' : 'no'}, allowNonGit=${fileCheckpoint.allowNonGit ? 'yes' : 'no'}, probe=${fileCheckpoint.probe ?? 'unknown'}, isolation=${fileCheckpoint.isolation ?? 'none'}${fileCheckpoint.copyStrategy ? `, copyStrategy=${fileCheckpoint.copyStrategy}` : ''}`);
+        }
         const advisories = result.advisories;
         if (advisories && advisories.length > 0) {
             lines.push('', 'Advisories:');
@@ -330,7 +363,7 @@ export function formatRecoveryCheckpointResult(result) {
             return 'No recovery checkpoints found.\n';
         const lines = checkpoints.map((item) => {
             const diagnostic = formatRecoveryStateDiagnostic(item.state, item.stateDetail);
-            const base = `${item.checkpointId}\t${item.state}\t${item.changeCount} changes\treceipt:${item.receiptHash?.slice(0, 12) ?? '-'}\t${item.createdAt}`;
+            const base = `${item.checkpointId}\t${item.state}\t${item.backend}\t${item.resourceKind}\t${item.changeCount} changes\treceipt:${item.receiptHash?.slice(0, 12) ?? '-'}\t${item.createdAt}`;
             return diagnostic ? `${base}\n  ${diagnostic}` : base;
         });
         return `${lines.join('\n')}\n`;

package/dist/commands/session.d.ts

@@ -15,6 +15,11 @@ export declare function sessionStatusProject(params: {
     ok: boolean;
     attestationPath: string;
     fresh: boolean;
+    containedExecutionFresh?: boolean;
     attestation: Awaited<ReturnType<typeof boundarySessionStatus>>['attestation'];
 }>;
+export declare function sessionStatusOk(status: {
+    fresh: boolean;
+    containedExecutionFresh?: boolean;
+}): boolean;
 export declare function formatSessionStatusReport(report: Awaited<ReturnType<typeof sessionStatusProject>>): string;

package/dist/commands/session.js

@@ -31,12 +31,16 @@ export async function sessionStatusProject(params) {
     const config = await loadConfigFile(repoRoot);
     const status = await boundarySessionStatus({ repoRoot, config });
     return {
-        ok: status.fresh,
+        ok: sessionStatusOk(status),
         attestationPath: status.attestationPath,
         fresh: status.fresh,
+        containedExecutionFresh: status.containedExecutionFresh,
         attestation: status.attestation,
     };
 }
+export function sessionStatusOk(status) {
+    return status.fresh || status.containedExecutionFresh === true;
+}
 export function formatSessionStatusReport(report) {
     if (!report.attestation) {
         return `No boundary attestation at ${report.attestationPath}. Run belay session start.`;
@@ -45,6 +49,9 @@ export function formatSessionStatusReport(report) {
         `Attestation: ${report.attestationPath}`,
         `Driver: ${report.attestation.driver}`,
         `Fresh: ${report.fresh ? 'yes' : 'no'}`,
+        ...(report.containedExecutionFresh === undefined
+            ? []
+            : [`Contained execution fresh: ${report.containedExecutionFresh ? 'yes' : 'no'}`]),
         `Expires: ${report.attestation.expiresAt}`,
         `Materializes grants: ${report.attestation.materializesGrants ? 'yes' : 'no'}`,
     ].join('\n');

package/dist/commands/status.js

@@ -54,7 +54,7 @@ export function formatStatusReport(report) {
         `Approved (awaiting use): ${report.approved.length}`,
         `Expired pending (not yet compacted): ${report.expiredPendingCount}`,
         `Dogfood: ${report.dogfood.active ? 'active' : 'inactive'} (mode=${report.dogfood.mode}, unknownLocalEffect=${report.dogfood.unknownLocalEffect})`,
-        `Metrics: ${report.dogfood.gateEvents} gate events, ${report.dogfood.wouldBlockCount} would-block (${(report.dogfood.wouldBlockRate * 100).toFixed(1)}%)`,
+        `Current cohort metrics: ${report.dogfood.gateEvents} gate events, ${report.dogfood.wouldBlockCount} would-block (${(report.dogfood.wouldBlockRate * 100).toFixed(1)}%), ${report.dogfood.excludedGateEvents} historical/mismatched excluded`,
         `Ready for enforce: ${report.dogfood.readyForEnforce ? 'yes' : 'not yet'}`,
         `File checkpoint: ${report.fileCheckpoint.enabled ? 'enabled' : 'disabled'} (transactional=${report.fileCheckpoint.transactionalEnabled}, durable=${report.fileCheckpoint.durableCheckpointEnabled}, nonGit=${report.fileCheckpoint.allowNonGit})`,
         `File checkpoint limits: files=${report.fileCheckpoint.maxFiles}, sourceBytes=${report.fileCheckpoint.maxSourceBytes}, workspaceBytes=${report.fileCheckpoint.maxWorkspaceBytes}, prepareTimeoutMs=${report.fileCheckpoint.prepareTimeoutMs}, copyConcurrency=${report.fileCheckpoint.copyConcurrency}`,

package/dist/config-io.js

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { getAdapterLayout } from './adapters/layouts/index.js';
 import { compactApprovals, isExpired, mergeApprovalStates } from './core/approval.js';
 import { mutateApprovalStateWithRetry } from './core/capability/approval-state-mutation.js';
-import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, } from './core/config.js';
+import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, stripForbiddenShellOverrideLists, } from './core/config.js';
 import { resolveLayeredConfig, teamConfigPath, } from './core/config-layers.js';
 export function resolveAdapterName(config) {
     if (config.adapter === 'claude') {
@@ -210,7 +210,7 @@ export async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoR
 export async function writeConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
     const configPath = configPathFor(repoRoot, adapter);
     await mkdir(path.dirname(configPath), { recursive: true });
-    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    await writeFile(configPath, `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`, 'utf8');
 }
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);