@guilz-dev/belay 0.9.4 → 0.10.0

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import process from 'node:process';
 import { CLI_COMMAND } from './branding.js';
+import { issuePendingApprovalToken } from './commands/approval-token.js';
 import { approvePending } from './commands/approve.js';
 import { auditProject, formatAuditReport } from './commands/audit.js';
 import { doctorProject, formatDoctorReport } from './commands/doctor.js';
-import { dogfoodProject, formatDogfoodResult } from './commands/dogfood.js';
+import { checkDogfoodProject, dogfoodProject, formatDogfoodCheckResult, formatDogfoodResult, } from './commands/dogfood.js';
 import { explainCommand, formatExplainReport } from './commands/explain.js';
 import { formatHarvestReport, harvestApplyProject, harvestListProject } from './commands/harvest.js';
 import { formatMetricsReport, metricsProject } from './commands/metrics.js';
@@ -51,6 +52,13 @@ function parseArgs(argv) {
             options.force = true;
             continue;
         }
+        if (token === '--check') {
+            if (command !== 'dogfood') {
+                throw new Error('--check is only valid for dogfood.');
+            }
+            options.dogfoodCheck = true;
+            continue;
+        }
         if (token === '--adapter') {
             const next = rest[index + 1];
             if (!next || !['cursor', 'claude', 'codex'].includes(next)) {
@@ -472,12 +480,13 @@ function parseArgs(argv) {
                 token === 'get' ||
                 token === 'set' ||
                 token === 'unset' ||
+                token === 'trust' ||
                 token === 'credential' ||
                 token === 'judge') {
                 options.configSubcommand = token;
                 continue;
             }
-            throw new Error('config requires subcommand: list, get, set, unset, credential, or judge');
+            throw new Error('config requires subcommand: list, get, set, unset, trust, credential, or judge');
         }
         if (command === 'config' &&
             options.configSubcommand === 'credential' &&
@@ -519,7 +528,8 @@ function parseArgs(argv) {
             options.judgeUseProvider = token;
             continue;
         }
-        if ((command === 'revoke' || command === 'approve') && !options.approvalId) {
+        if ((command === 'revoke' || command === 'approve' || command === 'approval-token') &&
+            !options.approvalId) {
             options.approvalId = token;
             continue;
         }
@@ -534,10 +544,11 @@ function printHelp() {
 Usage:
   ${c} init [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--preset strict|standard|audit-first|l1-full-recommended] [--judge-profile local-ollama|cursor|claude|codex] [--judge-provider ollama|openai-compatible] [--judge-model <id>] [--judge-endpoint <url>] [--accept-cloud-judge] [--migrate-judge-default] [--with-skill] [--dogfood]
   ${c} config [--target <dir>] [--json]
-  ${c} config list|get|set|unset|judge [--target <dir>] [--json]
+  ${c} config list|get|set|unset|trust|judge [--target <dir>] [--json]
   ${c} config get <judge.path> [--target <dir>] [--json]
   ${c} config set <judge.path> <value> [--target <dir>]
   ${c} config unset <judge.path> [--target <dir>]
+  ${c} config trust [--target <dir>]
   ${c} config credential mode <project|apiKey> [--target <dir>]
   ${c} config credential set [--key-stdin] [--key-env <NAME>] [--target <dir>]
   ${c} config credential clear [--target <dir>]
@@ -547,6 +558,7 @@ Usage:
   ${c} uninstall [--target <dir>] [--adapter cursor] [--scope project|global]
   ${c} where [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--json]
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
+  ${c} dogfood --check --since <iso> [--target <dir>] [--adapter cursor|claude|codex] [--json]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
   ${c} quality [--target <dir>] [--corpus <path>] [--json]
@@ -568,6 +580,7 @@ Usage:
   ${c} judge use <ollama|codex|claude|cursor> [--model <id>] [--endpoint <url>] [--timeout <ms>] [--accept-cloud] [--cloud-consent-approval-id <id>] [--credential project|apiKey] [--key-stdin] [--key-env <NAME>]
   ${c} judge consent <ollama|codex|claude|cursor> [--endpoint <url>]
   ${c} approve <approval-id> [--replay] [--scope once|domain|path|workspace-root] [--path <path>] [--token <signed-token>] [--target <dir>]
+  ${c} approval-token <approval-id> [--target <dir>] [--json]
   ${c} revoke <approval-id> [--target <dir>]
   ${c} standing-allow revoke --fingerprint <fp> [--kind shell|tool|subagent] [--target <dir>]
   ${c} harvest list [--target <dir>] [--since <iso>] [--until <iso>] [--json]
@@ -615,6 +628,30 @@ async function main() {
             return;
         }
         if (command === 'dogfood') {
+            if (options.dogfoodCheck) {
+                if (options.enforce) {
+                    throw new Error('--check conflicts with --enforce.');
+                }
+                if (options.force) {
+                    throw new Error('--check conflicts with --force.');
+                }
+                if (!options.since) {
+                    throw new Error('--check requires --since <iso>.');
+                }
+                const report = await checkDogfoodProject({
+                    targetDir: options.targetDir,
+                    adapter: options.adapter,
+                    since: options.since,
+                });
+                if (options.json) {
+                    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+                }
+                else {
+                    process.stdout.write(formatDogfoodCheckResult(report));
+                }
+                process.exitCode = report.ok ? 0 : 1;
+                return;
+            }
             const result = await dogfoodProject({
                 targetDir: options.targetDir,
                 enforce: options.enforce,
@@ -1031,6 +1068,18 @@ async function main() {
             process.exitCode = result.ok ? 0 : 1;
             return;
         }
+        if (command === 'approval-token') {
+            if (!options.approvalId) {
+                throw new Error('approval-token requires an approval ID.');
+            }
+            const result = await issuePendingApprovalToken({
+                targetDir: options.targetDir,
+                approvalId: options.approvalId,
+            });
+            process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `${result.message}\n`);
+            process.exitCode = result.ok ? 0 : 1;
+            return;
+        }
         if (command === 'revoke') {
             if (!options.approvalId) {
                 throw new Error('revoke requires an approval ID.');

package/dist/commands/approval-token.d.ts

@@ -0,0 +1,10 @@
+export interface IssuePendingApprovalTokenOptions {
+    targetDir?: string;
+    approvalId: string;
+}
+export interface IssuePendingApprovalTokenResult {
+    ok: boolean;
+    message: string;
+    token?: string;
+}
+export declare function issuePendingApprovalToken(options: IssuePendingApprovalTokenOptions): Promise<IssuePendingApprovalTokenResult>;

package/dist/commands/approval-token.js

@@ -0,0 +1,26 @@
+import path from 'node:path';
+import { loadApprovalState, loadConfigFile } from '../config-io.js';
+import { isExpired } from '../core/approval.js';
+import { issueApprovalToken } from '../core/approval-token.js';
+import { configuredControlPlaneDir } from '../core/config.js';
+import { canonicalPath } from '../core/path-utils.js';
+export async function issuePendingApprovalToken(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const pending = await loadApprovalState(repoRoot, 'pending-approvals.json', config);
+    const approval = pending.approvals.find((entry) => entry.approvalId === options.approvalId);
+    if (!approval || isExpired(approval)) {
+        return { ok: false, message: `Pending approval not found: ${options.approvalId}` };
+    }
+    if (canonicalPath(approval.repoRoot) !== canonicalPath(repoRoot)) {
+        return { ok: false, message: `Approval repository does not match: ${options.approvalId}` };
+    }
+    const token = await issueApprovalToken({
+        approvalId: approval.approvalId,
+        fingerprint: approval.fingerprint,
+        repoRoot: approval.repoRoot,
+        issuedAt: approval.createdAt,
+        expiresAt: approval.expiresAt,
+    }, configuredControlPlaneDir(config));
+    return { ok: true, token, message: token };
+}

package/dist/commands/audit.d.ts

@@ -1,4 +1,5 @@
 import type { AuditRecord } from '../core/audit-types.js';
+import type { AdapterName } from '../types.js';
 export type AuditSubcommand = 'query' | 'summarize' | 'replay';
 export interface AuditOptions {
     targetDir?: string;
@@ -18,7 +19,7 @@ export interface AuditOptions {
     limit?: number;
     configPath?: string;
 }
-export declare function loadAuditRecords(repoRoot: string): Promise<AuditRecord[]>;
+export declare function loadAuditRecords(repoRoot: string, adapter?: AdapterName): Promise<AuditRecord[]>;
 export declare function auditProject(options: AuditOptions): Promise<{
     subcommand: string;
     records: AuditRecord[];

package/dist/commands/audit.js

@@ -7,8 +7,8 @@ import { parseAuditNdjson, toAuditRecord } from '../core/audit-metrics.js';
 import { buildApprovalRoundTrips, filterAuditRecords, summarizeRoundTrips, } from '../core/audit-query.js';
 import { mergeConfig } from '../core/config.js';
 import { diffReclassification } from '../core/reclassify.js';
-export async function loadAuditRecords(repoRoot) {
-    const config = await loadConfigFile(repoRoot);
+export async function loadAuditRecords(repoRoot, adapter) {
+    const config = await loadConfigFile(repoRoot, adapter);
     const auditLogPath = path.join(repoRoot, config.audit.logPath);
     let raw = '';
     try {

package/dist/commands/config.d.ts

@@ -1,7 +1,7 @@
 import { type JudgeProviderId } from '../core/verdict/judge-catalog.js';
 import type { AdapterName, InitOptions } from '../types.js';
 import { type SelectOptions } from './tui.js';
-export declare const BELAY_CONFIG_SUBCOMMANDS: readonly ["list", "get", "set", "unset", "credential", "judge"];
+export declare const BELAY_CONFIG_SUBCOMMANDS: readonly ["list", "get", "set", "unset", "trust", "credential", "judge"];
 export type BelayConfigSubcommand = (typeof BELAY_CONFIG_SUBCOMMANDS)[number];
 export interface BelayConfigOptions {
     targetDir?: string;

package/dist/commands/config.js

@@ -1,7 +1,8 @@
+import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { stdin as input, stdout as output } from 'node:process';
 import readline from 'node:readline/promises';
-import { loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { configPathFor, detectAdapterName, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeTrustedConfigFile, } from '../config-io.js';
 import { appendCliAuditEvent } from '../core/audit-io.js';
 import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
 import { clearJudgeCredentialStore, writeJudgeCredentialStore } from '../core/credential-store.js';
@@ -9,6 +10,7 @@ import { refreshIntegrityIfPinned } from '../core/integrity.js';
 import { defaultJudgeProviderForAdapter, hasValidCloudConsent, isCloudJudgeConfig, resolveJudgeUsePatch, } from '../core/judge-config.js';
 import { rejectDeprecatedJudgeModelAuto } from '../core/judge-model-policy.js';
 import { detectJudgeRuntimeCapabilities, resolveJudgeTransport, } from '../core/judge-runtime-detection.js';
+import { trustRepoConfig } from '../core/repo-config-trust.js';
 import { getJudgeProviderSpec, isJudgeProviderId, JUDGE_PROVIDER_IDS, normalizeLegacyProviderId, } from '../core/verdict/judge-catalog.js';
 import { normalizeJudgeRuntimeConfig } from '../core/verdict/judge-runtime-config.js';
 import { initProject } from '../installer.js';
@@ -21,6 +23,7 @@ export const BELAY_CONFIG_SUBCOMMANDS = [
     'get',
     'set',
     'unset',
+    'trust',
     'credential',
     'judge',
 ];
@@ -125,7 +128,7 @@ function warnCloudConsentIfNeeded(judge) {
 }
 async function persistJudge(repoRoot, config, judge, adapter) {
     const updated = { ...config, judge: normalizeJudgeConfig(judge) };
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     await refreshIntegrityIfPinned(repoRoot, updated);
     return updated;
 }
@@ -651,6 +654,29 @@ export async function runBelayConfig(options = {}) {
         return runBelayConfigInteractive({ targetDir: options.targetDir });
     }
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    if (options.subcommand === 'trust') {
+        const adapter = detectAdapterName(repoRoot);
+        const configPath = configPathFor(repoRoot, adapter);
+        let rawConfig;
+        try {
+            rawConfig = JSON.parse(await readFile(configPath, 'utf8'));
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT') {
+                throw new Error(`Missing repository config: ${configPath}`);
+            }
+            throw new Error(`Repository config is malformed JSON: ${configPath}`);
+        }
+        const record = await trustRepoConfig(repoRoot, adapter, rawConfig);
+        const merged = await loadConfigFile(repoRoot, adapter);
+        await refreshIntegrityIfPinned(repoRoot, merged);
+        return [
+            'Repository config trusted:',
+            JSON.stringify(rawConfig, null, 2),
+            `Trusted fingerprint: ${record.repoConfigFingerprint}`,
+            `Repository: ${record.repoRoot}`,
+        ].join('\n');
+    }
     const config = await loadConfigFile(repoRoot);
     if (options.subcommand === 'list') {
         const entries = listJudgeFields(config.judge);

package/dist/commands/doctor.js

@@ -1,8 +1,6 @@
-import { execFile } from 'node:child_process';
 import { existsSync, realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { promisify } from 'node:util';
 import { getClaudeManagedHookEntries } from '../adapters/claude/hooks.js';
 import { codexHooksTomlIncludesCommand, getCodexManagedHookEntries, } from '../adapters/codex/hooks.js';
 import { hasCurrentCursorDispatcherGeneration } from '../adapters/cursor/dispatcher-generation.js';
@@ -11,18 +9,21 @@ import { getAdapterLayout } from '../adapters/layouts/index.js';
 import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { resolveScopedPaths } from '../adapters/layouts/scope.js';
 import { cleanupOrphanApprovalState } from '../cleanup-orphans.js';
-import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, writeConfigFile, } from '../config-io.js';
+import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredConfig, pendingApprovalsPath, repoLocalStateDirFor, writeTrustedConfigFile, } from '../config-io.js';
 import { approvalSigningKeyPath } from '../core/approval-token.js';
 import { auditRecordHasLegacyCorrelationPlaceholders } from '../core/audit-legacy-archive.js';
 import { detectFenceDrift, summarizeAuditVisibility } from '../core/audit-summary.js';
 import { inspectBoundaryAttestationFile } from '../core/capability/boundary-attestation-sign.js';
 import { boundaryAttestationPath, boundarySessionStatus, } from '../core/capability/boundary-session.js';
 import { configuredControlPlaneDir, defaultControlPlaneDir, hasForbiddenShellOverrideLists, stripForbiddenShellOverrideLists, } from '../core/config.js';
+import { detectUndogfoodedLinkedWorktrees } from '../core/dogfood-environment.js';
 import { runtimeIntegrityFiles, verifyIntegrityManifest } from '../core/integrity.js';
 import { diagnoseJudge, stopJudgeSessionBrokers } from '../core/judge-doctor.js';
 import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
+import { notificationConfigIssues } from '../core/notify.js';
 import { listRecoveryCheckpoints } from '../core/recovery/checkpoint.js';
 import { recoveryApprovalSetupNotes, recoveryNotificationConfigured, recoveryNotificationSetupWarning, summarizeRecoveryCheckpointDiagnostics, } from '../core/recovery/operator-guidance.js';
+import { inspectRepoConfigTrust } from '../core/repo-config-trust.js';
 import { probeFileCheckpointBackend } from '../core/transactional/backend-selector.js';
 import { fileCheckpointIsolationReason } from '../core/transactional/file-checkpoint-isolation.js';
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
@@ -36,7 +37,6 @@ import { PACKAGE_VERSION } from '../version.js';
 import { loadAuditRecords } from './audit.js';
 import { collectHealthSnapshot } from './health-snapshot.js';
 import { metricsProject } from './metrics.js';
-const execFileAsync = promisify(execFile);
 function resolveDoctorAdapter(options, configAdapter) {
     if (options.adapter) {
         return options.adapter;
@@ -111,55 +111,6 @@ async function cursorOriginIssues(hooksDir, installScope, repoRoot) {
     }
     return issues;
 }
-async function listLinkedWorktreePaths(repoRoot) {
-    try {
-        const { stdout } = await execFileAsync('git', ['worktree', 'list', '--porcelain'], {
-            cwd: repoRoot,
-            encoding: 'utf8',
-        });
-        return stdout
-            .split(/\r?\n/)
-            .filter((line) => line.startsWith('worktree '))
-            .map((line) => line.slice('worktree '.length).trim())
-            .filter((entry) => entry.length > 0);
-    }
-    catch {
-        return [];
-    }
-}
-async function detectUndogfoodedLinkedWorktrees(params) {
-    const repoRootCanonical = realpathSync(params.repoRoot);
-    const worktrees = await listLinkedWorktreePaths(params.repoRoot);
-    const warnings = [];
-    for (const worktreePath of worktrees) {
-        let canonicalPath = worktreePath;
-        try {
-            canonicalPath = realpathSync(worktreePath);
-        }
-        catch {
-            // Keep the original path for warning output when the entry is stale.
-        }
-        if (canonicalPath === repoRootCanonical) {
-            continue;
-        }
-        const configPath = params.layout.configPath(worktreePath);
-        if (!existsSync(configPath)) {
-            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has no belay.config.json (defaults to enforce). Run belay dogfood in each worktree you use with Cursor.`);
-            continue;
-        }
-        try {
-            const candidate = await loadLayeredConfig(worktreePath, params.adapterName);
-            const dogfoodEnabled = candidate.config.mode === 'audit' && candidate.config.policy.unknownLocalEffect === 'deny';
-            if (!dogfoodEnabled) {
-                warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} is not in dogfood mode (mode=${candidate.config.mode}, unknownLocalEffect=${candidate.config.policy.unknownLocalEffect}). Run belay dogfood in each worktree you use with Cursor.`);
-            }
-        }
-        catch {
-            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has an unreadable belay.config.json. Run belay doctor and belay dogfood in that worktree.`);
-        }
-    }
-    return warnings;
-}
 export async function doctorProject(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const issues = [];
@@ -184,12 +135,17 @@ export async function doctorProject(options = {}) {
             configPath = activeLayout.configPath(repoRoot);
             hooksPath = activeLayout.hooksSettingsPath(repoRoot);
             corePath = path.join(activeLayout.runtimeDir(repoRoot), 'core.mjs');
+            const trust = await inspectRepoConfigTrust(repoRoot, adapterName, rawConfig);
+            if (!trust.trusted) {
+                issues.push(`Repository config is not trusted (${trust.reason}) at ${trust.recordPath}. Review it, then run belay config trust.`);
+            }
             if (rawConfig.version === undefined) {
                 warnings.push('Config is missing "version". Set "version": 3 explicitly to avoid ambiguous migration.');
             }
             const layered = await loadLayeredConfig(repoRoot, adapterName);
             loadedConfig = layered.config;
             configProvenance = layered.provenance;
+            issues.push(...notificationConfigIssues(loadedConfig.notifications, repoRoot));
             for (const entry of layered.provenance) {
                 notes.push(`Config layer [${entry.source}]: ${entry.path}`);
             }
@@ -446,7 +402,7 @@ export async function doctorProject(options = {}) {
         if (hasForbiddenShellOverrideLists(loadedConfig)) {
             if (options.dryRun !== true) {
                 const stripped = stripForbiddenShellOverrideLists(loadedConfig);
-                await writeConfigFile(repoRoot, stripped, adapterName);
+                await writeTrustedConfigFile(repoRoot, stripped, adapterName);
                 loadedConfig = stripped;
                 notes.push('Removed forbidden legacy shell override lists (overrides.allow / overrides.external).');
                 for (let index = issues.length - 1; index >= 0; index -= 1) {

package/dist/commands/dogfood-check.d.ts

@@ -0,0 +1,3 @@
+import type { DogfoodCheckOptions, DogfoodCheckResult } from '../types.js';
+export declare function checkDogfoodProject(options: DogfoodCheckOptions): Promise<DogfoodCheckResult>;
+export declare function formatDogfoodCheckResult(result: DogfoodCheckResult): string;

package/dist/commands/dogfood-check.js

@@ -0,0 +1,116 @@
+import path from 'node:path';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { detectAdapterName, loadConfigFile } from '../config-io.js';
+import { isGateRecord, parseTimestamp } from '../core/audit-query.js';
+import { summarizeAuditVisibility } from '../core/audit-summary.js';
+import { detectUndogfoodedLinkedWorktrees } from '../core/dogfood-environment.js';
+import { matchesAuditCohort, resolveActiveAuditCohort } from '../runtime-provenance.js';
+import { loadAuditRecords } from './audit.js';
+function isDogfoodMode(config) {
+    return config.mode === 'audit' && config.policy?.unknownLocalEffect === 'deny';
+}
+function baseResult(repoRoot, since) {
+    return {
+        ok: false,
+        repoRoot,
+        since,
+        gateEvents: 0,
+        auditModeDenyCount: 0,
+        hostDeniedAfterAllowCount: 0,
+        shellPreToolUseCount: 0,
+        mismatchedCohortCount: 0,
+        environmentSkewCount: 0,
+        failures: [],
+    };
+}
+export async function checkDogfoodProject(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const since = options.since;
+    const result = baseResult(repoRoot, since);
+    const sinceMs = parseTimestamp(since);
+    if (sinceMs === null) {
+        result.failures.push('invalid_since');
+        return result;
+    }
+    const adapter = options.adapter ?? detectAdapterName(repoRoot);
+    const config = await loadConfigFile(repoRoot, adapter);
+    const dogfoodActive = isDogfoodMode(config);
+    if (!dogfoodActive) {
+        result.failures.push('dogfood_inactive');
+    }
+    const records = await loadAuditRecords(repoRoot, adapter);
+    const invalidTimestampRecord = records.some((record) => parseTimestamp(record.timestamp) === null);
+    if (invalidTimestampRecord) {
+        result.failures.push('invalid_timestamp_record');
+    }
+    const inWindowRecords = records.filter((record) => {
+        const recordMs = parseTimestamp(record.timestamp);
+        return recordMs !== null && recordMs >= sinceMs;
+    });
+    const activeCohort = await resolveActiveAuditCohort(repoRoot, config);
+    const inWindowGateRecords = inWindowRecords.filter((record) => isGateRecord(record));
+    let cohortGateRecords = inWindowGateRecords;
+    let cohortScopedRecords = inWindowRecords;
+    if (activeCohort) {
+        cohortGateRecords = inWindowGateRecords.filter((record) => matchesAuditCohort(record, activeCohort));
+        const cohortEventRecords = new Set(cohortGateRecords);
+        cohortScopedRecords = inWindowRecords.filter((record) => !isGateRecord(record) || cohortEventRecords.has(record));
+        result.mismatchedCohortCount = inWindowGateRecords.length - cohortGateRecords.length;
+    }
+    else {
+        result.mismatchedCohortCount = inWindowGateRecords.length;
+        if (inWindowGateRecords.length > 0) {
+            result.failures.push('active_cohort_unavailable');
+        }
+    }
+    result.gateEvents = cohortGateRecords.length;
+    result.auditModeDenyCount = cohortGateRecords.filter((record) => record.mode === 'audit' && record.permission === 'deny').length;
+    result.shellPreToolUseCount = cohortGateRecords.filter((record) => record.kind === 'shell' && record.event === 'preToolUse').length;
+    result.hostDeniedAfterAllowCount =
+        summarizeAuditVisibility(cohortScopedRecords).hostDeniedAfterAllowCount;
+    if (result.gateEvents === 0) {
+        result.failures.push('no_gate_events_since_cutoff');
+    }
+    if (result.auditModeDenyCount > 0) {
+        result.failures.push('audit_mode_permission_deny');
+    }
+    if (result.hostDeniedAfterAllowCount > 0) {
+        result.failures.push('host_denied_after_allow');
+    }
+    if (result.shellPreToolUseCount > 0) {
+        result.failures.push('shell_event_recorded_as_preToolUse');
+    }
+    if (result.mismatchedCohortCount > 0) {
+        result.failures.push('mismatched_active_cohort');
+    }
+    if (dogfoodActive) {
+        const environmentWarnings = await detectUndogfoodedLinkedWorktrees({
+            repoRoot,
+            adapterName: adapter,
+            layout: getAdapterLayout(adapter),
+        });
+        result.environmentSkewCount = environmentWarnings.length;
+        if (result.environmentSkewCount > 0) {
+            result.failures.push('environment_skew');
+        }
+    }
+    result.ok = result.failures.length === 0;
+    return result;
+}
+export function formatDogfoodCheckResult(result) {
+    const lines = [
+        `dogfood check for ${result.repoRoot}`,
+        `since: ${result.since}`,
+        `gate events: ${result.gateEvents}`,
+        `audit-mode deny count: ${result.auditModeDenyCount}`,
+        `host denied-after-allow count: ${result.hostDeniedAfterAllowCount}`,
+        `shell preToolUse count: ${result.shellPreToolUseCount}`,
+        `mismatched active cohort count: ${result.mismatchedCohortCount}`,
+        `environment skew count: ${result.environmentSkewCount}`,
+        `status: ${result.ok ? 'ok' : 'fail'}`,
+    ];
+    if (!result.ok) {
+        lines.push(`failures: ${result.failures.join(', ')}`);
+    }
+    return `${lines.join('\n')}\n`;
+}

package/dist/commands/dogfood.d.ts

@@ -2,4 +2,5 @@ import { isDogfoodConfig, loadOperationalInsights } from '../operational-insight
 import type { DogfoodOptions, DogfoodResult } from '../types.js';
 export declare function dogfoodProject(options?: DogfoodOptions): Promise<DogfoodResult>;
 export declare function formatDogfoodResult(result: DogfoodResult): string;
+export { checkDogfoodProject, formatDogfoodCheckResult } from './dogfood-check.js';
 export { isDogfoodConfig, loadOperationalInsights };

package/dist/commands/dogfood.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { configPathFor, loadConfigFile, writeConfigFile } from '../config-io.js';
+import { configPathFor, loadConfigFile, writeTrustedConfigFile } from '../config-io.js';
 import { mergeConfig } from '../core/config.js';
 import { isDogfoodConfig, loadOperationalInsights } from '../operational-insights.js';
 import { metricsProject } from './metrics.js';
@@ -19,7 +19,7 @@ export async function dogfoodProject(options = {}) {
             unknownLocalEffect: 'deny',
         },
     });
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     return {
         ok: true,
         repoRoot,
@@ -53,7 +53,7 @@ async function promoteDogfoodToEnforce(repoRoot, configPath, force, adapter = 'c
         ...existing,
         mode: 'enforce',
     });
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     return {
         ok: true,
         repoRoot,
@@ -68,4 +68,5 @@ async function promoteDogfoodToEnforce(repoRoot, configPath, force, adapter = 'c
 export function formatDogfoodResult(result) {
     return `${result.message}\n`;
 }
+export { checkDogfoodProject, formatDogfoodCheckResult } from './dogfood-check.js';
 export { isDogfoodConfig, loadOperationalInsights };

package/dist/commands/judge.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { stdin as input, stdout as output } from 'node:process';
 import { createInterface } from 'node:readline/promises';
-import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeTrustedConfigFile, } from '../config-io.js';
 import { appendCliAuditEvent } from '../core/audit-io.js';
 import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
 import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
@@ -176,7 +176,7 @@ export async function judgeUse(options) {
     }
     const after = normalizeJudgeConfig(patch.judge);
     const updated = { ...config, judge: after };
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     await refreshIntegrityIfPinned(repoRoot, updated);
     await appendCliAuditEvent(repoRoot, updated, {
         event: 'judge_provider_changed',

package/dist/commands/recovery-checkpoints.js

@@ -5,7 +5,6 @@ import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { ensureBelayStateDir, loadConfigFile } from '../config-io.js';
 import { compactApprovals, createApprovalRecordWithEnvelope } from '../core/approval.js';
 import { createGateApprovalStore } from '../core/approval-service.js';
-import { issueApprovalToken } from '../core/approval-token.js';
 import { appendCliAuditEvent } from '../core/audit-io.js';
 import { mutateApprovalStateWithRetry } from '../core/capability/approval-state-mutation.js';
 import { boundarySessionStatus } from '../core/capability/boundary-session.js';
@@ -253,20 +252,12 @@ export async function recoveryCheckpointCommand(options) {
         }
         const notificationConfigured = recoveryNotificationConfigured(config);
         if (notificationConfigured) {
-            const approvalToken = await issueApprovalToken({
-                approvalId: request.approvalId,
-                fingerprint: request.fingerprint,
-                repoRoot: request.repoRoot,
-                issuedAt: request.createdAt,
-                expiresAt: request.expiresAt,
-            }, configuredControlPlaneDir(config));
             await notifyDeny(config.notifications, {
                 approvalId: request.approvalId,
                 reason: request.reason,
                 summary: request.summary,
                 repoRoot: request.repoRoot,
                 fingerprint: request.fingerprint,
-                approvalToken,
             });
         }
         const auditRecorded = await appendRecoveryAudit(repoRoot, config, {
@@ -287,8 +278,8 @@ export async function recoveryCheckpointCommand(options) {
             paths: binding.paths,
             auditRecorded,
             message: notificationConfigured
-                ? `Signed out-of-band approval required for ${request.approvalId}. Use the token delivered through the configured notification channel, then run \`belay approve ${request.approvalId} --token <signed-token>\` and repeat this command.`
-                : `${recoveryNotificationSetupWarning()} Pending approval id: ${request.approvalId}.`,
+                ? `Signed approval required for ${request.approvalId}. Run \`belay approval-token ${request.approvalId}\` locally, then \`belay approve ${request.approvalId} --token <signed-token>\`, and repeat this command.`
+                : `${recoveryNotificationSetupWarning()} Pending approval id: ${request.approvalId}. Run \`belay approval-token ${request.approvalId}\` locally to retrieve the signed token.`,
         };
     }
     try {

package/dist/config-io.d.ts

@@ -17,6 +17,7 @@ export declare function migrateControlPlaneApprovalsToRepoLocal(repoRoot: string
 export declare function loadLayeredConfig(repoRoot: string, adapter?: AdapterName): Promise<LayeredConfigResult>;
 export declare function loadConfigFile(repoRoot: string, adapter?: AdapterName): Promise<BelayConfigV3>;
 export declare function writeConfigFile(repoRoot: string, config: BelayConfigV3, adapter?: AdapterName): Promise<void>;
+export declare function writeTrustedConfigFile(repoRoot: string, config: BelayConfigV3, adapter?: AdapterName): Promise<void>;
 export declare function mergeAndWriteConfig(repoRoot: string, adapter?: AdapterName): Promise<BelayConfigV3>;
 export declare function loadApprovalState(repoRoot: string, fileName: 'pending-approvals.json' | 'approved-approvals.json', config: BelayConfigV3): Promise<ApprovalStateFile>;
 export declare function saveApprovalState(repoRoot: string, fileName: 'pending-approvals.json' | 'approved-approvals.json', state: ApprovalStateFile, config: BelayConfigV3): Promise<void>;

package/dist/config-io.js

@@ -7,6 +7,7 @@ import { compactApprovals, isExpired, mergeApprovalStates } from './core/approva
 import { mutateApprovalStateWithRetry } from './core/capability/approval-state-mutation.js';
 import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, stripForbiddenShellOverrideLists, } from './core/config.js';
 import { resolveLayeredConfig, teamConfigPath, } from './core/config-layers.js';
+import { trustRepoConfig } from './core/repo-config-trust.js';
 export function resolveAdapterName(config) {
     if (config.adapter === 'claude') {
         return 'claude';
@@ -221,6 +222,12 @@ export async function writeConfigFile(repoRoot, config, adapter = resolveAdapter
         await unlink(temporaryPath).catch(() => undefined);
     }
 }
+export async function writeTrustedConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
+    await writeConfigFile(repoRoot, config, adapter);
+    const configPath = configPathFor(repoRoot, adapter);
+    const parsed = JSON.parse(await readFile(configPath, 'utf8'));
+    await trustRepoConfig(repoRoot, adapter, parsed);
+}
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);
     const configPath = layout.configPath(repoRoot);
@@ -229,7 +236,7 @@ export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
         existing = JSON.parse(await readFile(configPath, 'utf8'));
     }
     const merged = mergeConfig(existing, layout.defaultConfig(repoRoot));
-    await writeConfigFile(repoRoot, merged, adapter);
+    await writeTrustedConfigFile(repoRoot, merged, adapter);
     await ensureBelayStateDir(merged, repoRoot);
     if (merged.controlPlane.enabled) {
         await migrateRepoLocalApprovalsToControlPlane(repoRoot, merged);