@guilz-dev/belay 0.8.1 → 0.9.0

package/dist/commands/classify-for-report.js

@@ -3,6 +3,7 @@ import { getAdapter } from '../adapters/registry.js';
 import { repoShellClassifierOptions } from '../adapters/shared/gate-runtime.js';
 import { detectAdapterName, loadConfigFile } from '../config-io.js';
 import { isCapabilityBrokerDemotionActive } from '../core/capability/broker.js';
+import { isContainedUnknownExecutionEligible } from '../core/contained-execution/eligibility.js';
 import { classifySubagent, classifyToolUse } from '../core/index.js';
 import { isTransactionalEligible } from '../core/transactional/index.js';
 import { classifyShell } from '../core/verdict/adapter.js';
@@ -26,6 +27,10 @@ export async function classifyForReport(params) {
             throw new Error('classify-for-report requires a command for shell classification.');
         }
         result = await classifyShell(params.command, cwd, repoRoot, config, classifierOptions);
+        result = {
+            ...result,
+            wouldMediate: isContainedUnknownExecutionEligible(config, { kind: 'shell', repoRoot }, result),
+        };
         input = params.command;
     }
     else if (kind === 'subagent') {

package/dist/commands/doctor.js

@@ -4,20 +4,24 @@ import path from 'node:path';
 import { getClaudeManagedHookEntries } from '../adapters/claude/hooks.js';
 import { getCodexManagedHookEntries } from '../adapters/codex/hooks.js';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { resolveScopedPaths } from '../adapters/layouts/scope.js';
 import { cleanupOrphanApprovalState } from '../cleanup-orphans.js';
-import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, } from '../config-io.js';
+import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, writeConfigFile, } from '../config-io.js';
 import { approvalSigningKeyPath } from '../core/approval-token.js';
 import { detectFenceDrift, summarizeAuditVisibility } from '../core/audit-summary.js';
 import { inspectBoundaryAttestationFile } from '../core/capability/boundary-attestation-sign.js';
 import { boundaryAttestationPath, boundarySessionStatus, } from '../core/capability/boundary-session.js';
-import { defaultControlPlaneDir } from '../core/config.js';
+import { configuredControlPlaneDir, defaultControlPlaneDir, hasForbiddenShellOverrideLists, stripForbiddenShellOverrideLists, } from '../core/config.js';
 import { verifyIntegrityManifest } from '../core/integrity.js';
 import { diagnoseJudge, stopJudgeSessionBrokers } from '../core/judge-doctor.js';
 import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
 import { listRecoveryCheckpoints } from '../core/recovery/checkpoint.js';
 import { recoveryApprovalSetupNotes, recoveryNotificationConfigured, recoveryNotificationSetupWarning, summarizeRecoveryCheckpointDiagnostics, } from '../core/recovery/operator-guidance.js';
+import { probeFileCheckpointBackend } from '../core/transactional/backend-selector.js';
+import { fileCheckpointIsolationReason } from '../core/transactional/file-checkpoint-isolation.js';
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
+import { isGitWorktreeAvailable } from '../core/transactional/git-worktree.js';
 import { getManagedHookEntries } from '../defaults.js';
 import { resolveNodeBinary } from '../node-resolution.js';
 import { readInstalledRuntimeProvenance } from '../runtime-provenance.js';
@@ -74,7 +78,7 @@ export async function doctorProject(options = {}) {
                 ...(loadedConfig.overrides.external.length > 0 ? ['overrides.external'] : []),
             ];
             if (ignoredShellOverrideLists.length > 0) {
-                warnings.push(`Legacy shell ${ignoredShellOverrideLists.join(' and ')} ${ignoredShellOverrideLists.length === 1 ? 'is' : 'are'} deprecated and ignored. Remove the command list; inspect the EffectPlan and correct effect semantics or resource scope instead.`);
+                issues.push(`Legacy shell ${ignoredShellOverrideLists.join(' and ')} ${ignoredShellOverrideLists.length === 1 ? 'is' : 'are'} forbidden (ADR-005). Remove the command list (or run belay doctor --fix); improve EffectPlan semantics, use one-shot approval, or approve an exact resource scope instead.`);
             }
             if (loadedConfig.version !== 4) {
                 warnings.push(`Config version is ${loadedConfig.version}; expected 4. Run belay upgrade to migrate.`);
@@ -233,6 +237,23 @@ export async function doctorProject(options = {}) {
         }
     }
     if (options.fix && loadedConfig) {
+        if (hasForbiddenShellOverrideLists(loadedConfig)) {
+            if (options.dryRun !== true) {
+                const stripped = stripForbiddenShellOverrideLists(loadedConfig);
+                await writeConfigFile(repoRoot, stripped, adapterName);
+                loadedConfig = stripped;
+                notes.push('Removed forbidden legacy shell override lists (overrides.allow / overrides.external).');
+                for (let index = issues.length - 1; index >= 0; index -= 1) {
+                    const issue = issues[index] ?? '';
+                    if (issue.includes('overrides.allow') || issue.includes('overrides.external')) {
+                        issues.splice(index, 1);
+                    }
+                }
+            }
+            else {
+                notes.push('Dry run: would remove forbidden legacy shell override lists.');
+            }
+        }
         const cleanup = await cleanupOrphanApprovalState(repoRoot, loadedConfig, {
             dryRun: options.dryRun === true,
         });
@@ -291,10 +312,27 @@ export async function doctorProject(options = {}) {
         else if (dogfood.unknownLocalEffect === 'deny' && dogfood.mode !== 'audit') {
             notes.push('Fail-closed policy is enabled in enforce mode.');
         }
+        const recoveryCohort = metrics.currentCohortRecovery;
+        const restoreTotal = recoveryCohort.restore.applied +
+            recoveryCohort.restore.conflict +
+            recoveryCohort.restore.rejected;
+        if (recoveryCohort.snapshot.attempts > 0 || restoreTotal > 0) {
+            notes.push(`Recovery cohort metrics: ${recoveryCohort.snapshot.attempts} snapshot attempt(s) (${recoveryCohort.snapshot.applied} applied, ${recoveryCohort.snapshot.skipped} skipped); restore outcomes ${recoveryCohort.restore.applied} applied / ${recoveryCohort.restore.conflict} conflict / ${recoveryCohort.restore.rejected} rejected.`);
+            if (recoveryCohort.snapshot.prepareSampleCount > 0) {
+                notes.push(`Recovery snapshot prepare latency (cohort): p50 ${recoveryCohort.snapshot.prepareMsP50 ?? 0}ms, p95 ${recoveryCohort.snapshot.prepareMsP95 ?? 0}ms (${recoveryCohort.snapshot.prepareSampleCount} samples).`);
+            }
+            if (Object.keys(recoveryCohort.snapshot.failuresByReason).length > 0) {
+                notes.push(`Recovery snapshot failures (cohort): ${Object.entries(recoveryCohort.snapshot.failuresByReason)
+                    .map(([reason, count]) => `${reason}=${count}`)
+                    .join(', ')}.`);
+            }
+        }
         if (loadedConfig.policy.transactional.enabled) {
-            notes.push('Transactional execution: enabled — low-confidence shell mutations run in an isolated git worktree; observed-safe effects are applied once and the hook denies re-execution.');
-            if (!existsSync(path.join(repoRoot, '.git'))) {
-                warnings.push('Transactional execution is enabled but this directory is not a git repository. Transactional worktrees will be skipped until git is available.');
+            notes.push('Transactional execution: enabled — low-confidence shell mutations run in an isolated git worktree or file-checkpoint mirror; observed-safe effects are applied once and the hook denies re-execution.');
+            const fileCheckpointEnabled = loadedConfig.policy.transactional.fileCheckpoint.enabled;
+            const allowNonGit = loadedConfig.policy.transactional.fileCheckpoint.allowNonGit;
+            if (!existsSync(path.join(repoRoot, '.git')) && !(fileCheckpointEnabled && allowNonGit)) {
+                warnings.push('Transactional execution is enabled but this directory is not a git repository. Enable file checkpoint with allowNonGit or initialize git before transactional recovery can run.');
             }
         }
         const fileCheckpoint = loadedConfig.policy.transactional.fileCheckpoint;
@@ -307,6 +345,35 @@ export async function doctorProject(options = {}) {
             if (!loadedConfig.policy.transactional.checkpoint?.enabled) {
                 warnings.push('File checkpoint is enabled but durable Recovery checkpointing is disabled; backend selection will fail closed.');
             }
+            const checkpointConfig = loadedConfig.policy.transactional.checkpoint;
+            const configuredBoundary = loadedConfig.capability?.boundaryDriver ??
+                (loadedConfig.sandbox.runtime === 'container' ? 'container' : null);
+            let attestation = null;
+            if (configuredBoundary) {
+                try {
+                    const session = await boundarySessionStatus({ repoRoot, config: loadedConfig });
+                    attestation = session.attestation;
+                }
+                catch {
+                    attestation = null;
+                }
+            }
+            const gitAvailable = await isGitWorktreeAvailable(repoRoot);
+            const backendContext = {
+                repoRoot,
+                stateDir: belayStateDir(loadedConfig, repoLocalDir),
+                cwd: repoRoot,
+                dirtyIgnoreRoots: protectedArtifactRoots(activeLayout, repoRoot, loadedConfig.controlPlane.enabled ? configuredControlPlaneDir(loadedConfig) : null),
+                fileCheckpoint,
+                durableCheckpointEnabled: checkpointConfig?.enabled === true,
+                boundaryAttestation: attestation,
+                boundaryAttestationFresh: false,
+                boundaryDriverId: configuredBoundary ?? undefined,
+            };
+            const isolationAvailable = fileCheckpointIsolationReason(backendContext) === null;
+            const fileCheckpointProbe = await probeFileCheckpointBackend(backendContext);
+            const fileCheckpointAvailable = loadedConfig.policy.transactional.enabled && fileCheckpointProbe.eligible;
+            notes.push(`File checkpoint eligibility: probe=${fileCheckpointAvailable ? 'available' : 'unavailable'}, workspace=${gitAvailable ? 'git' : 'non-git'}, isolation=${isolationAvailable ? (configuredBoundary ?? 'attested') : 'unavailable'}.`);
         }
         if (loadedConfig.policy.transactional.checkpoint?.enabled) {
             notes.push('Recovery checkpoint: enabled — repo-local pre-images are persisted before observed-safe transactional apply.');

package/dist/commands/explain.js

@@ -103,11 +103,12 @@ export function formatExplainReport(report) {
             : 'Egress proxy: not configured',
         `Sandbox (L1 broker): ${report.sandbox.enabled ? 'enabled' : 'disabled'} (runtime=${report.sandbox.runtime}, fs broker active=${report.sandboxBrokerActive}, L1-full=${report.l1FullActive})`,
         `Transactional (L2): ${report.policy.transactional.enabled ? 'enabled' : 'disabled'} (eligible for this command=${report.transactionalEligible})`,
+        `Contained unknown execution: ${result.wouldMediate ? 'would mediate' : 'not eligible'}`,
         report.policy.transactional.enabled
             ? `Transactional band: [${report.policy.transactional.minConfidence}, ${report.policy.transactional.maxConfidence})`
             : 'Transactional band: not configured',
-        `Legacy overrides allow (deprecated, ignored): ${report.overrides.allow.join(', ') || '(none)'}`,
-        `Legacy overrides external (deprecated, ignored): ${report.overrides.external.join(', ') || '(none)'}`,
+        `Legacy overrides allow (forbidden, ignored): ${report.overrides.allow.join(', ') || '(none)'}`,
+        `Legacy overrides external (forbidden, ignored): ${report.overrides.external.join(', ') || '(none)'}`,
         '',
         `Verdict: ${result.verdict}`,
         `Reason: ${result.reason}`,

package/dist/commands/metrics.js

@@ -29,6 +29,42 @@ export async function metricsProject(options = {}) {
         activeCohort,
     });
 }
+function formatRecoveryMetricsSection(label, metrics, excluded) {
+    const lines = [
+        '',
+        label,
+        `Snapshot attempts: ${metrics.snapshot.attempts} (${metrics.snapshot.applied} applied, ${metrics.snapshot.skipped} skipped)`,
+    ];
+    if (excluded) {
+        lines.push(`- excluded historical/mismatched snapshot attempts: ${excluded.snapshotAttempts}`, `- excluded historical/mismatched restore events: ${excluded.restoreEvents}`);
+    }
+    if (metrics.snapshot.prepareSampleCount > 0) {
+        lines.push(`Snapshot prepare latency: p50 ${metrics.snapshot.prepareMsP50 ?? 0}ms, p95 ${metrics.snapshot.prepareMsP95 ?? 0}ms (${metrics.snapshot.prepareSampleCount} samples)`);
+    }
+    if (Object.keys(metrics.snapshot.byBackend).length > 0) {
+        lines.push('Snapshot backends:');
+        for (const [backend, count] of Object.entries(metrics.snapshot.byBackend).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${backend}: ${count}`);
+        }
+    }
+    if (Object.keys(metrics.snapshot.byResourceKind).length > 0) {
+        lines.push('Snapshot resource kinds:');
+        for (const [resourceKind, count] of Object.entries(metrics.snapshot.byResourceKind).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${resourceKind}: ${count}`);
+        }
+    }
+    if (Object.keys(metrics.snapshot.failuresByReason).length > 0) {
+        lines.push('Snapshot failures by reason:');
+        for (const [reason, count] of Object.entries(metrics.snapshot.failuresByReason).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${reason}: ${count}`);
+        }
+    }
+    const restoreTotal = metrics.restore.applied + metrics.restore.conflict + metrics.restore.rejected;
+    if (restoreTotal > 0) {
+        lines.push(`Restore outcomes: ${metrics.restore.applied} applied, ${metrics.restore.conflict} conflict, ${metrics.restore.rejected} rejected`);
+    }
+    return lines;
+}
 export function formatMetricsReport(report) {
     const lines = [
         `belay metrics for ${report.auditLogPath}`,
@@ -37,6 +73,7 @@ export function formatMetricsReport(report) {
         `All-time would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
         `All-time classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
         `All-time approvals recorded during audit: ${report.approvalRecordedCount}`,
+        `Contained execution: would mediate ${report.containedExecution.wouldMediate}; complete ${report.containedExecution.complete}; failed ${report.containedExecution.failed}; timed out ${report.containedExecution.timedOut}`,
     ];
     lines.push('', 'Current readiness cohort:');
     if (report.currentCohort.identity) {
@@ -51,6 +88,7 @@ export function formatMetricsReport(report) {
     lines.push(`- would-block: ${report.currentCohort.wouldBlockCount} (${(report.currentCohort.wouldBlockRate * 100).toFixed(1)}%)`);
     lines.push(`- classifier-quality would-block: ${report.currentCohort.classifierWouldBlockCount} (${(report.currentCohort.classifierWouldBlockRate * 100).toFixed(1)}%)`);
     lines.push(`- approvals recorded during audit: ${report.currentCohort.approvalRecordedCount}`);
+    lines.push(`- contained execution: would mediate ${report.currentCohort.containedExecution.wouldMediate}; complete ${report.currentCohort.containedExecution.complete}; failed ${report.currentCohort.containedExecution.failed}; timed out ${report.currentCohort.containedExecution.timedOut}`);
     lines.push(`- availability-caused asks: ${report.currentCohort.availabilityAsks.total}`);
     if (Object.keys(report.currentCohort.wouldBlockByReason).length > 0) {
         lines.push('', 'Current-cohort would-block by reason:');
@@ -152,5 +190,9 @@ export function formatMetricsReport(report) {
         }
         lines.push('', report.dogfood.readyForEnforce ? 'Ready for enforce: yes' : 'Ready for enforce: not yet');
     }
+    lines.push(...formatRecoveryMetricsSection('All-time recovery metrics:', report.recovery), ...formatRecoveryMetricsSection('Current-cohort recovery metrics:', report.currentCohortRecovery, {
+        snapshotAttempts: report.currentCohortRecovery.excludedSnapshotAttempts,
+        restoreEvents: report.currentCohortRecovery.excludedRestoreEvents,
+    }));
     return `${lines.join('\n')}\n`;
 }

package/dist/commands/recovery-checkpoints.d.ts

@@ -12,10 +12,13 @@ export declare function recoveryCheckpointCommand(options: {
     backendCounts: {
         [k: string]: number;
     };
+    resourceKindCounts: {
+        [k: string]: number;
+    };
     fileCheckpoint: {
         enabled: boolean;
         allowNonGit: boolean;
-        isolation: string | null;
+        isolation: import("../core/capability/attestation.js").BoundaryDriverId | null;
         copyStrategy: import("../core/transactional/file-clone.js").FileCloneStrategy | undefined;
         probe: string;
     };
@@ -55,6 +58,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -86,6 +90,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -117,6 +122,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;
@@ -144,6 +150,7 @@ export declare function recoveryCheckpointCommand(options: {
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
+    resourceKindCounts?: undefined;
     fileCheckpoint?: undefined;
     enabled?: undefined;
     checkpointCount?: undefined;

package/dist/commands/recovery-checkpoints.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import path from 'node:path';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { ensureBelayStateDir, loadConfigFile } from '../config-io.js';
 import { compactApprovals, createApprovalRecordWithEnvelope } from '../core/approval.js';
 import { createGateApprovalStore } from '../core/approval-service.js';
@@ -12,6 +14,8 @@ import { notifyDeny } from '../core/notify.js';
 import { canonicalPath } from '../core/path-utils.js';
 import { listRecoveryCheckpoints, RECOVERY_CHECKPOINT_CORRUPT, RECOVERY_RESTORE_CONFLICT, RECOVERY_RESTORE_REASON, recoveryCheckpointStorageBytes, recoveryRestoreBinding, restoreRecoveryCheckpoint, showRecoveryCheckpoint, } from '../core/recovery/checkpoint.js';
 import { formatRecoveryStateDiagnostic, recoveryNotificationConfigured, recoveryNotificationSetupWarning, summarizeRecoveryCheckpointDiagnostics, } from '../core/recovery/operator-guidance.js';
+import { probeFileCheckpointBackend } from '../core/transactional/backend-selector.js';
+import { fileCheckpointIsolationReason } from '../core/transactional/file-checkpoint-isolation.js';
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
 async function appendRecoveryAudit(repoRoot, config, event) {
     try {
@@ -116,28 +120,43 @@ export async function recoveryCheckpointCommand(options) {
             backend,
             checkpoints.filter((checkpoint) => checkpoint.backend === backend).length,
         ]));
+        const resourceKindCounts = Object.fromEntries([
+            ...new Set(checkpoints.map((checkpoint) => checkpoint.resourceKind ?? 'git_repository')),
+        ].map((resourceKind) => [
+            resourceKind,
+            checkpoints.filter((checkpoint) => (checkpoint.resourceKind ?? 'git_repository') === resourceKind).length,
+        ]));
         const checkpointBackends = Object.keys(backendCounts);
         const fileCheckpointConfig = config.policy.transactional.fileCheckpoint;
         const configuredBoundary = config.capability?.boundaryDriver ??
             (config.sandbox.runtime === 'container' ? 'container' : null);
-        let isolation = configuredBoundary;
-        let isolationAvailable = false;
+        let attestation = null;
         if (configuredBoundary) {
             try {
                 const session = await boundarySessionStatus({ repoRoot, config });
-                isolationAvailable =
-                    session.fresh === true && session.attestation?.isolatesWorkspaceMounts === true;
-                isolation = isolationAvailable ? (session.attestation?.driver ?? configuredBoundary) : null;
+                attestation = session.attestation;
             }
             catch {
-                isolation = null;
+                attestation = null;
             }
         }
         const copyStrategy = fileCheckpointConfig.enabled ? await probeFileCloneStrategy() : null;
-        const fileCheckpointAvailable = fileCheckpointConfig.enabled &&
-            config.policy.transactional.enabled &&
-            checkpointConfig.enabled &&
-            isolationAvailable;
+        const adapterLayout = getAdapterLayout(config.adapter);
+        const backendContext = {
+            repoRoot,
+            stateDir,
+            cwd: repoRoot,
+            dirtyIgnoreRoots: protectedArtifactRoots(adapterLayout, repoRoot, config.controlPlane.enabled ? configuredControlPlaneDir(config) : null),
+            fileCheckpoint: fileCheckpointConfig,
+            durableCheckpointEnabled: checkpointConfig.enabled,
+            boundaryAttestation: attestation,
+            boundaryAttestationFresh: false,
+            boundaryDriverId: configuredBoundary ?? undefined,
+        };
+        const isolationAvailable = fileCheckpointIsolationReason(backendContext) === null;
+        const fileCheckpointProbe = await probeFileCheckpointBackend(backendContext);
+        const fileCheckpointAvailable = config.policy.transactional.enabled && fileCheckpointProbe.eligible;
+        const isolation = isolationAvailable ? (attestation?.driver ?? configuredBoundary) : null;
         return {
             ok: true,
             subcommand: 'status',
@@ -149,6 +168,7 @@ export async function recoveryCheckpointCommand(options) {
                     : 'git_worktree',
             availableBackends: ['git_worktree', 'file_checkpoint'],
             backendCounts,
+            resourceKindCounts,
             fileCheckpoint: {
                 enabled: fileCheckpointConfig.enabled,
                 allowNonGit: fileCheckpointConfig.allowNonGit,
@@ -304,9 +324,13 @@ export async function recoveryCheckpointCommand(options) {
 }
 export function formatRecoveryCheckpointResult(result) {
     if (result.subcommand === 'status') {
+        const fileCheckpoint = result.fileCheckpoint;
+        const backendCounts = result.backendCounts;
+        const resourceKindCounts = result.resourceKindCounts;
         const lines = [
             `belay recover status for ${result.repoRoot}`,
             `Backend: ${result.backend}`,
+            `Available backends: ${result.availableBackends?.join(', ') ?? 'git_worktree, file_checkpoint'}`,
             `Checkpointing: ${result.enabled ? 'enabled' : 'disabled'}`,
             `Checkpoints: ${result.checkpointCount} (${result.recoverableCount} recoverable)`,
             `Needs manual repair: ${result.needsManualRepairCount ?? 0}`,
@@ -314,6 +338,15 @@ export function formatRecoveryCheckpointResult(result) {
             `Storage: ${result.storageBytes} bytes`,
             `States: ${JSON.stringify(result.states)}`,
         ];
+        if (backendCounts && Object.keys(backendCounts).length > 0) {
+            lines.push(`Backend counts: ${JSON.stringify(backendCounts)}`);
+        }
+        if (resourceKindCounts && Object.keys(resourceKindCounts).length > 0) {
+            lines.push(`Resource kind counts: ${JSON.stringify(resourceKindCounts)}`);
+        }
+        if (fileCheckpoint) {
+            lines.push(`File checkpoint: enabled=${fileCheckpoint.enabled ? 'yes' : 'no'}, allowNonGit=${fileCheckpoint.allowNonGit ? 'yes' : 'no'}, probe=${fileCheckpoint.probe ?? 'unknown'}, isolation=${fileCheckpoint.isolation ?? 'none'}${fileCheckpoint.copyStrategy ? `, copyStrategy=${fileCheckpoint.copyStrategy}` : ''}`);
+        }
         const advisories = result.advisories;
         if (advisories && advisories.length > 0) {
             lines.push('', 'Advisories:');
@@ -330,7 +363,7 @@ export function formatRecoveryCheckpointResult(result) {
             return 'No recovery checkpoints found.\n';
         const lines = checkpoints.map((item) => {
             const diagnostic = formatRecoveryStateDiagnostic(item.state, item.stateDetail);
-            const base = `${item.checkpointId}\t${item.state}\t${item.changeCount} changes\treceipt:${item.receiptHash?.slice(0, 12) ?? '-'}\t${item.createdAt}`;
+            const base = `${item.checkpointId}\t${item.state}\t${item.backend}\t${item.resourceKind}\t${item.changeCount} changes\treceipt:${item.receiptHash?.slice(0, 12) ?? '-'}\t${item.createdAt}`;
             return diagnostic ? `${base}\n  ${diagnostic}` : base;
         });
         return `${lines.join('\n')}\n`;

package/dist/commands/session.d.ts

@@ -15,6 +15,11 @@ export declare function sessionStatusProject(params: {
     ok: boolean;
     attestationPath: string;
     fresh: boolean;
+    containedExecutionFresh?: boolean;
     attestation: Awaited<ReturnType<typeof boundarySessionStatus>>['attestation'];
 }>;
+export declare function sessionStatusOk(status: {
+    fresh: boolean;
+    containedExecutionFresh?: boolean;
+}): boolean;
 export declare function formatSessionStatusReport(report: Awaited<ReturnType<typeof sessionStatusProject>>): string;

package/dist/commands/session.js

@@ -31,12 +31,16 @@ export async function sessionStatusProject(params) {
     const config = await loadConfigFile(repoRoot);
     const status = await boundarySessionStatus({ repoRoot, config });
     return {
-        ok: status.fresh,
+        ok: sessionStatusOk(status),
         attestationPath: status.attestationPath,
         fresh: status.fresh,
+        containedExecutionFresh: status.containedExecutionFresh,
         attestation: status.attestation,
     };
 }
+export function sessionStatusOk(status) {
+    return status.fresh || status.containedExecutionFresh === true;
+}
 export function formatSessionStatusReport(report) {
     if (!report.attestation) {
         return `No boundary attestation at ${report.attestationPath}. Run belay session start.`;
@@ -45,6 +49,9 @@ export function formatSessionStatusReport(report) {
         `Attestation: ${report.attestationPath}`,
         `Driver: ${report.attestation.driver}`,
         `Fresh: ${report.fresh ? 'yes' : 'no'}`,
+        ...(report.containedExecutionFresh === undefined
+            ? []
+            : [`Contained execution fresh: ${report.containedExecutionFresh ? 'yes' : 'no'}`]),
         `Expires: ${report.attestation.expiresAt}`,
         `Materializes grants: ${report.attestation.materializesGrants ? 'yes' : 'no'}`,
     ].join('\n');

package/dist/config-io.js

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { getAdapterLayout } from './adapters/layouts/index.js';
 import { compactApprovals, isExpired, mergeApprovalStates } from './core/approval.js';
 import { mutateApprovalStateWithRetry } from './core/capability/approval-state-mutation.js';
-import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, } from './core/config.js';
+import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, stripForbiddenShellOverrideLists, } from './core/config.js';
 import { resolveLayeredConfig, teamConfigPath, } from './core/config-layers.js';
 export function resolveAdapterName(config) {
     if (config.adapter === 'claude') {
@@ -210,7 +210,7 @@ export async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoR
 export async function writeConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
     const configPath = configPathFor(repoRoot, adapter);
     await mkdir(path.dirname(configPath), { recursive: true });
-    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    await writeFile(configPath, `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`, 'utf8');
 }
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);

package/dist/conformance/contained-execution-guarantee.d.ts

@@ -0,0 +1,121 @@
+import { CONTAINED_EXECUTION_APPROVAL_FALLBACK_REASONS } from '../core/contained-execution/policy.js';
+/**
+ * Normative contained-execution capability contract.
+ *
+ * This is intentionally not a LayerProfileId: it describes one opt-in mediated execution and
+ * never upgrades the surrounding configuration to L1-full.
+ */
+export interface ContainedUnknownExecutionGuarantee {
+    id: 'contained-unknown-execution-v1';
+    optIn: true;
+    runtime: 'docker-only';
+    l1Full: false;
+    materializesGrants: false;
+    deniesUngrantedEffects: false;
+    authority: {
+        shell: 'effect-plan-only';
+        commandIdentityEligibility: false;
+        forbiddenInputs: readonly [
+            'executable',
+            'prefix',
+            'fingerprint',
+            'corpus-membership',
+            'framework-identity'
+        ];
+    };
+    audit: {
+        wouldMediate: true;
+        containedRouteExecution: 'none';
+        readsAttestation: false;
+        preparesMirror: false;
+        startsContainer: false;
+        gatePermission: 'allow';
+        hostExecution: 'delegated-to-host';
+    };
+    enforce: {
+        originalHostCommand: 'deny';
+        mirror: 'file_copy';
+        startsAtMostOnce: true;
+        workspaceChanges: 'discard';
+        output: {
+            scrub: 'mandatory';
+            tailBytes: 16384;
+            userRedactionCanDisable: false;
+        };
+        audit: 'safe-metadata-only';
+    };
+    attestation: {
+        signed: true;
+        fresh: true;
+        immutableImageId: true;
+        configuredDockerBinary: 'absolute-bound';
+        configuredDockerSocket: 'local-unix-bound';
+        daemonIdentity: true;
+        configurationBound: true;
+    };
+    boundary: {
+        network: 'none';
+        readOnlyRoot: true;
+        sanitizedHostEnvironment: true;
+        resourceLimits: true;
+        logDriver: 'none';
+        mount: 'one-private-mirror-at-original-guest-path';
+        excluded: readonly [
+            'host-source',
+            'git-metadata',
+            'control-plane',
+            'docker-socket',
+            'devices',
+            'unrelated-host-paths'
+        ];
+        cleanupConfirmed: true;
+    };
+    fallback: {
+        approvalOnly: typeof CONTAINED_EXECUTION_APPROVAL_FALLBACK_REASONS;
+    };
+    failure: {
+        /** Every setup failure other than the exact approval fallback set denies before host replay. */
+        setup: {
+            categories: readonly [
+                'boundary',
+                'capability',
+                'image',
+                'mirror',
+                'lease',
+                'container-lifecycle',
+                'cleanup'
+            ];
+            outcome: 'deny';
+            hostExecution: 'deny';
+            approval: 'none';
+            approvalStateMutation: 'none';
+        };
+        /** A started container that times out or exits nonzero is terminal, never an approval. */
+        command: {
+            timeout: 'contained_execution_failed';
+            nonzero: 'contained_execution_failed';
+            hostExecution: 'deny';
+            approval: 'none';
+        };
+    };
+    outcomes: {
+        success: {
+            exitCode: 0;
+            outcome: 'contained_execution_complete';
+            hostExecution: 'deny';
+            approval: 'none';
+        };
+    };
+}
+export type ContainedUnknownExecutionScenario = {
+    id: string;
+    kind: 'eligible-unknown-local';
+    command: string;
+} | {
+    id: string;
+    kind: 'ineligible-network';
+    command: string;
+};
+export declare const CONTAINED_UNKNOWN_EXECUTION_GUARANTEE: ContainedUnknownExecutionGuarantee;
+/** Executable EffectPlan scenarios; routing and output use the gate/executor suites. */
+export declare const CONTAINED_UNKNOWN_EXECUTION_SCENARIOS: readonly ContainedUnknownExecutionScenario[];