@indigoai-us/hq-cli 5.188.0 → 5.188.1

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.188.1] — 2026-09-25
+
+### Fixed
+
+- `hq lanes grant` now applies grants for Outpost-hosted lanes on their owner.
+  The primary sends a bounded hierarchy snapshot and its evaluated hq-flags
+  decision; the owner revalidates the authorized senior, applies carve,
+  occupancy, and terminal-parent checks, then syncs the changed record to the
+  primary. Dispatched lane errors include sanitized owner details.
+
 ## [5.188.0] — 2026-09-25
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -6915,6 +6915,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "grant-target";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--hire <n>";
+            readonly description: "Non-negative safe integer hire grant";
+        }, {
+            readonly flags: "--grant-context <base64url>";
+            readonly description: "Primary-authorized hire hierarchy and gate decision";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "grant";
         readonly description: "Set a lane's alive child-lane grant as its senior";

package/dist/command-catalog.generated.js

@@ -8937,6 +8937,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "grant-target",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--hire <n>",
+                        "description": "Non-negative safe integer hire grant"
+                    },
+                    {
+                        "flags": "--grant-context <base64url>",
+                        "description": "Primary-authorized hire hierarchy and gate decision"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "grant",
                 "description": "Set a lane's alive child-lane grant as its senior",

package/dist/commands/lanes.d.ts

@@ -12,7 +12,7 @@ export type { OutpostIdentity } from "../lib/lanes/admission-host.js";
 export { LANE_HIRE_GRANTS_FLAG };
 import { type OutpostDispatchResult } from "../lib/lanes/outpost-dispatch.js";
 import { emitLaneDecisionEvents, type LaneMesh } from "../lib/lanes/mesh-events.js";
-import { LANE_HIRE_GRANTS_FLAG, MAX_LANE_DEPTH, type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type MonitorEvidenceReader, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
+import { LANE_HIRE_GRANTS_FLAG, MAX_LANE_DEPTH, withLaneHireLocks, type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type MonitorEvidenceReader, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { type RunCompactionFn } from "../lib/lanes/compaction.js";
 import { type KnownModelsDeps, type ProbeCommand } from "../lib/lanes/models.js";
@@ -80,6 +80,10 @@ export interface LanesCommandDeps {
     lanePlacementEnabled?: () => boolean;
     /** Test seam for the default-off lane hire-grants rollout gate. */
     laneHireGrantsEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
+    /** Test seam for the SSM-only Outpost owner grant path. */
+    isSsmOwnerDispatch?: () => boolean;
+    /** Test seam for changing a lane between pre-lock and locked grant reads. */
+    withGrantHireLocks?: typeof withLaneHireLocks;
     /** Test seam for the default-off Claude account-balancing gate. */
     laneClaudeAccountBalanceEnabled?: () => boolean;
 }

package/dist/commands/lanes.js

@@ -13,8 +13,10 @@ import * as path from "node:path";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 export { LANE_HIRE_GRANTS_FLAG };
@@ -81,7 +83,7 @@ function failJson(err) {
         if (err.error === "hire_grant_exhausted") {
             process.stderr.write(`hq lanes: ${err.message}\n`);
         }
-        printJson(err.toJSON());
+        printJson({ ...err.toJSON(), message: err.message });
         process.exit(1);
     }
     const message = err instanceof Error ? err.message : String(err);
@@ -255,6 +257,8 @@ function resolveDeps(deps = {}) {
         fetchText: deps.fetchText ?? defaultFetchText,
         lanePlacementEnabled: deps.lanePlacementEnabled ?? defaultLanePlacementEnabled,
         laneHireGrantsEnabled: deps.laneHireGrantsEnabled ?? defaultLaneHireGrantsEnabled,
+        isSsmOwnerDispatch: deps.isSsmOwnerDispatch ?? (() => isSsmRunCommandProcess()),
+        withGrantHireLocks: deps.withGrantHireLocks ?? withLaneHireLocks,
         laneClaudeAccountBalanceEnabled: deps.laneClaudeAccountBalanceEnabled ?? defaultLaneClaudeAccountBalanceEnabled,
     };
 }
@@ -451,6 +455,81 @@ function laneHireFields(lane, lanes) {
         hire_summary: hireSummary,
     };
 }
+function outpostCliOverride(ctx, outpostId) {
+    const envKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+    const configured = ctx.env[envKey];
+    const hqBinary = configured === undefined ? undefined : configured.trim();
+    if (configured !== undefined &&
+        (!hqBinary ||
+            !path.posix.isAbsolute(hqBinary) ||
+            hqBinary.includes("\0") ||
+            hqBinary.includes("\r") ||
+            hqBinary.includes("\n"))) {
+        throw new LanesError("outpost_lane_cli_invalid", `${envKey} must be an absolute remote executable path`, { outpost_id: outpostId });
+    }
+    return hqBinary;
+}
+function safeOwnerErrorValue(value, key = "") {
+    if (/(?:env|environment|token|secret|password|credential|authorization|api[_-]?key|access[_-]?key|private[_-]?key)/i.test(key)) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        return value
+            .replace(/\b(Bearer|Basic)\s+[^\s,;]+/gi, "$1 [redacted]")
+            .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16})\b/g, "[redacted]")
+            .replace(/\b["']?([A-Z][A-Z0-9_]{1,})["']?\s*[:=]\s*["']?([^\s"',;}]+)["']?/g, "$1=[redacted]");
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => safeOwnerErrorValue(item));
+    }
+    if (value === null || typeof value !== "object")
+        return value;
+    const safe = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+        const nested = safeOwnerErrorValue(childValue, childKey);
+        if (nested !== undefined)
+            safe[childKey] = nested;
+    }
+    return safe;
+}
+function ownerErrorFromOutput(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        process.stderr.write("hq lanes: Outpost lanes dispatch returned malformed JSON\n");
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const owner = parsed;
+    if (typeof owner.error !== "string" || !/^[a-z][a-z0-9_]{0,99}$/.test(owner.error)) {
+        return undefined;
+    }
+    if (safeOwnerErrorValue(owner.error) !== owner.error)
+        return undefined;
+    if (owner.error === "already_terminal" || owner.error === "outpost_self_target") {
+        return undefined;
+    }
+    const rawDetails = {};
+    for (const [key, value] of Object.entries(owner)) {
+        if (key !== "error" && key !== "message" && key !== "details")
+            rawDetails[key] = value;
+    }
+    if (owner.details !== null && typeof owner.details === "object" && !Array.isArray(owner.details)) {
+        Object.assign(rawDetails, owner.details);
+    }
+    const details = safeOwnerErrorValue(rawDetails);
+    const message = typeof owner.message === "string" && owner.message.trim()
+        ? String(safeOwnerErrorValue(owner.message))
+        : `Outpost owner returned ${owner.error}`;
+    return { error: owner.error, message, details };
+}
 async function ownerLaneHireFields(ctx, lane) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_lane_hire_summary_invalid", "Owner summary requires an Outpost-hosted lane", {
@@ -458,17 +537,7 @@ async function ownerLaneHireFields(ctx, lane) {
         });
     }
     const outpostId = lane.host.id;
-    const outpostCliEnvKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
-    const configuredHqBinary = ctx.env[outpostCliEnvKey];
-    const hqBinary = configuredHqBinary === undefined ? undefined : configuredHqBinary.trim();
-    if (configuredHqBinary !== undefined &&
-        (!hqBinary ||
-            !path.posix.isAbsolute(hqBinary) ||
-            hqBinary.includes("\0") ||
-            hqBinary.includes("\r") ||
-            hqBinary.includes("\n"))) {
-        throw new LanesError("outpost_lane_cli_invalid", `${outpostCliEnvKey} must be an absolute remote executable path`, { outpost_id: outpostId });
-    }
+    const hqBinary = outpostCliOverride(ctx, outpostId);
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
@@ -2783,7 +2852,8 @@ async function dispatchCreatedOutpostLane(ctx, input) {
         const staged = await ctx.stageOutpostPayload(outpostId, bytes);
         const command = buildOutpostPickupCommand(staged.getUrl);
         const dispatched = await ctx.dispatchOutpostExec({ outpostId, command });
-        if (preserveQueuedOnFailure && dispatched.done !== true) {
+        const dispatchedOwnerError = ownerErrorFromOutput(dispatched.stdout);
+        if (preserveQueuedOnFailure && dispatched.done !== true && !dispatchedOwnerError) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup exec has not finished; its outcome is unknown", {
                 outpost_id: outpostId,
                 lane_id: lane.lane_id,
@@ -2813,6 +2883,40 @@ async function dispatchCreatedOutpostLane(ctx, input) {
             await emitLaneTerminalStateSoft(ctx, cancelled);
             return cancelled;
         }
+        const ownerError = dispatchedOwnerError;
+        if (ownerError) {
+            if (preserveQueuedOnFailure) {
+                throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                    outpost_id: outpostId,
+                    lane_id: lane.lane_id,
+                    command_id: dispatched.commandId,
+                    status: dispatched.status,
+                    done: dispatched.done ?? false,
+                    exit_code: dispatched.exitCode,
+                    ...(remote?.pickup_persisted === false ||
+                        ownerError.details.pickup_persisted === false
+                        ? { pickup_persisted: false }
+                        : {}),
+                    owner_error: ownerError,
+                });
+            }
+            const failed = markDispatchFailure(hqRoot, lane.lane_id, {
+                outpost_id: outpostId,
+                command_id: dispatched.commandId,
+                exit_code: dispatched.exitCode,
+                status: dispatched.status,
+                owner_error: ownerError,
+            });
+            await emitLaneTerminalStateSoft(ctx, failed);
+            throw new LanesError(DISPATCH_TERMINAL_REASON, `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                outpost_id: outpostId,
+                lane_id: failed.lane_id,
+                state: failed.state,
+                terminal_reason: DISPATCH_TERMINAL_REASON,
+                command_id: dispatched.commandId,
+                owner_error: ownerError,
+            });
+        }
         if (preserveQueuedOnFailure && remote?.pickup_persisted === false) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup finished and reported that it did not persist the lane", {
                 outpost_id: outpostId,
@@ -2980,19 +3084,24 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
     const outpostId = lane.host.id;
+    const grantContext = action === "grant"
+        ? createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()), await ctx.laneHireGrantsEnabled(lane.company))
+        : undefined;
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
-                action,
+                action: action === "grant" ? "grant-target" : action,
                 laneId: lane.lane_id,
+                hqBinary: action === "grant" ? outpostCliOverride(ctx, outpostId) : undefined,
                 text: options.text,
                 project: options.project,
                 story: options.story,
                 account: options.account,
                 model: options.model,
                 hire: options.hire,
+                grantContext,
                 compact: options.compact,
             }),
         });
@@ -3000,6 +3109,18 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch ${action} for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
@@ -3014,13 +3135,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     }
     const remote = parseRemoteJson(dispatched.stdout, "Outpost lane command");
     if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
-            ? remote.message
-            : `Outpost ${outpostId} rejected the ${action} command`, {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: dispatched.commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     const resultConfirmed = remote !== null &&
@@ -3642,6 +3761,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
                 outcome: "unknown",
                 ...(commandId !== undefined ? { command_id: commandId } : {}),
                 check_command: checkCommand,
+                ...(dispatchDetails.owner_error !== undefined
+                    ? { owner_error: dispatchDetails.owner_error }
+                    : {}),
             });
         }
         let restored = false;
@@ -3682,6 +3804,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
             source_host: before.host,
             target_host: target,
             source_restored: restored,
+            ...(dispatchDetails.owner_error !== undefined
+                ? { owner_error: dispatchDetails.owner_error }
+                : {}),
             ...(rollbackError !== undefined
                 ? { rollback_error: dispatchErrorMessage(rollbackError) }
                 : {}),
@@ -3711,6 +3836,18 @@ async function dispatchRemoteLaneMove(ctx, source, target, account) {
     catch (err) {
         throw new LanesError("lane_move_dispatch_failed", `Could not ask Outpost ${source.host.id} to move lane ${source.lane_id}: ${dispatchErrorMessage(err)}`, { lane_id: source.lane_id, source_outpost: source.host.id });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${source.host.id} rejected the lane move: ${ownerError.message}`, {
+            lane_id: source.lane_id,
+            source_outpost: source.host.id,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true || dispatched.status !== "Success" || dispatched.exitCode !== 0) {
         throw new LanesError("lane_move_dispatch_failed", `Outpost ${source.host.id} did not confirm the lane move`, {
             lane_id: source.lane_id,
@@ -3830,40 +3967,54 @@ function callerMatchesSenior(ctx, seniorRef) {
 function forceAdmissionAuthorized(ctx, lane) {
     return callerMatchesSenior(ctx, lane.senior);
 }
-async function runGrant(ctx, laneId, opts) {
-    if (opts.hire === undefined) {
-        throw new LanesError("missing_hire_grant", "--hire is required", {});
-    }
-    const hireGrant = parseHireGrant(opts.hire);
+async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContext) {
     const hqRoot = ctx.hqRoot();
     const initial = readLane(hqRoot, laneId);
-    if (!callerMatchesSenior(ctx, initial.senior)) {
+    if (authorization === "senior" && !callerMatchesSenior(ctx, initial.senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
-    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
-        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
-        return;
+    if (authorization === "ssm-owner-dispatch" &&
+        (initial.host.kind !== "outpost" || !laneIsHostedHere(ctx, initial))) {
+        throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: initial.host });
     }
-    const enforce = await ctx.laneHireGrantsEnabled(initial.company);
+    if (authorization === "ssm-owner-dispatch" &&
+        (!grantContext || !sameHireGrantSenior(initial.senior, grantContext.expected_senior))) {
+        throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed after the primary authorized its grant update`, { lane_id: laneId, current_senior: initial.senior });
+    }
+    const enforce = grantContext?.enforcement_enabled ??
+        await ctx.laneHireGrantsEnabled(initial.company);
     const lockedLaneIds = [
         laneId,
         ...(initial.senior.kind === "lane" && initial.senior.id
             ? [initial.senior.id]
             : []),
     ];
-    const updated = withLaneHireLocks(hqRoot, lockedLaneIds, () => {
+    const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
-        if (!callerMatchesSenior(ctx, current.senior)) {
+        if (authorization === "senior" && !callerMatchesSenior(ctx, current.senior)) {
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
-        const hierarchy = loadAllLanes(hqRoot);
+        if (authorization === "ssm-owner-dispatch" &&
+            (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current))) {
+            throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (authorization === "ssm-owner-dispatch" &&
+            (!grantContext || !sameHireGrantSenior(current.senior, grantContext.expected_senior))) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed before the Outpost applied the grant update`, { lane_id: laneId, current_senior: current.senior });
+        }
+        const hierarchy = grantContext?.hierarchy ?? loadAllLanes(hqRoot);
         if (enforce && current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
                     lane_id: laneId,
                 });
             }
-            const parent = readLane(hqRoot, current.senior.id);
+            const parent = hierarchy.find((lane) => lane.lane_id === current.senior.id);
+            if (!parent) {
+                throw new LanesError(authorization === "ssm-owner-dispatch"
+                    ? "hire_grant_context_invalid"
+                    : "hire_grant_senior_invalid", `Lane ${laneId}'s senior lane is missing from the grant hierarchy`, { lane_id: laneId, senior_lane_id: current.senior.id });
+            }
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
@@ -3901,9 +4052,44 @@ async function runGrant(ctx, laneId, opts) {
             hire_grant: hireGrant,
         }));
     });
-    const fields = laneHireFields(updated, loadAllLanes(hqRoot));
+    return updated;
+}
+function printGrantResult(hqRoot, updated, hierarchy) {
+    const fields = laneHireFields(updated, hierarchy ?? loadAllLanes(hqRoot));
     printJson({ ok: true, action: "grant", lane_id: updated.lane_id, lane: updated, ...fields });
 }
+async function runGrant(ctx, laneId, opts) {
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
+        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
+        return;
+    }
+    const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
+    printGrantResult(hqRoot, updated);
+}
+async function runGrantOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    if (opts.grantContext === undefined) {
+        throw new LanesError("hire_grant_context_invalid", "--grant-context is required", { lane_id: laneId });
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const grantContext = parseOutpostHireGrantContext(opts.grantContext, laneId);
+    const hqRoot = ctx.hqRoot();
+    printGrantResult(hqRoot, await applyHireGrant(ctx, laneId, hireGrant, "ssm-owner-dispatch", grantContext), grantContext.hierarchy);
+}
 async function runBackfillGrants(ctx, opts) {
     if (opts.apply && opts.dryRun) {
         throw new LanesError("hire_grant_backfill_mode_conflict", "Pass either --dry-run or --apply, not both", {});
@@ -5718,6 +5904,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
         !commandId ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
+        const ownerError = ownerErrorFromOutput(dispatched.stdout);
+        if (ownerError) {
+            throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+                lane_id: laneId,
+                outpost_id: outpostId,
+                command_id: stopCommandId,
+                sync_command_id: commandId || null,
+                owner_error: ownerError,
+            });
+        }
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not confirm a lane read after stop ${laneId}`, {
             lane_id: laneId,
             outpost_id: outpostId,
@@ -5741,6 +5937,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
             cause: err instanceof Error ? err.message : String(err),
         });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+            owner_error: ownerError,
+        });
+    }
     if (remote?.ok !== true || remote.action !== "show") {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return lane ${laneId} after stop`, {
             lane_id: laneId,
@@ -5771,6 +5977,18 @@ async function dispatchOutpostLaneStop(ctx, lane) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch stop for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the stop command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     const commandId = dispatched.commandId?.trim();
     if (dispatched.done !== true || !commandId) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return a completed stop command for lane ${lane.lane_id}`, {
@@ -5814,13 +6032,13 @@ async function dispatchOutpostLaneStop(ctx, lane) {
         syncCommandId = owner.commandId;
     }
     else if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
+        throw new LanesError("outpost_dispatch_failed", typeof remote.message === "string"
             ? remote.message
             : `Outpost ${outpostId} rejected the stop command for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     else {
@@ -6661,6 +6879,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("grant-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .option("--hire <n>", "Non-negative safe integer hire grant")
+        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy and gate decision")
+        .action(wrap(async (laneId, opts) => {
+        await runGrantOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("grant")
         .description("Set a lane's alive child-lane grant as its senior")

package/dist/lib/lanes/hire-grant-dispatch.d.ts

@@ -0,0 +1,21 @@
+import { type LaneRecord, type LaneState, type SeniorRef } from "./types.js";
+declare const HIRE_GRANT_CONTEXT_SCHEMA: "hq-lane-hire-grant-context.v1";
+export interface HireGrantLaneSnapshot {
+    lane_id: string;
+    state: LaneState;
+    senior: SeniorRef;
+    hire_grant?: number;
+}
+export interface OutpostHireGrantContext {
+    schema_version: typeof HIRE_GRANT_CONTEXT_SCHEMA;
+    enforcement_enabled: boolean;
+    expected_senior: SeniorRef;
+    hierarchy: HireGrantLaneSnapshot[];
+}
+/** Encode only the owner-relevant hierarchy from the primary's complete store. */
+export declare function createOutpostHireGrantContext(target: LaneRecord, lanes: readonly LaneRecord[], enforcementEnabled: boolean): string;
+/** Decode and validate an owner grant context, binding it to the target lane. */
+export declare function parseOutpostHireGrantContext(encoded: string, targetLaneId: string): OutpostHireGrantContext;
+export declare function sameHireGrantSenior(a: SeniorRef, b: SeniorRef): boolean;
+export {};
+//# sourceMappingURL=hire-grant-dispatch.d.ts.map

package/dist/lib/lanes/hire-grant-dispatch.js

@@ -0,0 +1,167 @@
+import { aliveDirectChildren } from "./hire-grants.js";
+import { LanesError } from "./errors.js";
+import { isLaneState, isSeniorKind, } from "./types.js";
+const HIRE_GRANT_CONTEXT_SCHEMA = "hq-lane-hire-grant-context.v1";
+const MAX_CONTEXT_BYTES = 48 * 1024;
+const MAX_CONTEXT_LANES = 256;
+function contextError(message) {
+    return new LanesError("hire_grant_context_invalid", message, {});
+}
+function sameSenior(a, b) {
+    return a.kind === b.kind && a.id === b.id;
+}
+function copySenior(senior) {
+    return senior.id === undefined
+        ? { kind: senior.kind }
+        : { kind: senior.kind, id: senior.id };
+}
+function snapshot(lane) {
+    return {
+        lane_id: lane.lane_id,
+        state: lane.state,
+        senior: copySenior(lane.senior),
+        ...(lane.hire_grant === undefined ? {} : { hire_grant: lane.hire_grant }),
+    };
+}
+/** Encode only the owner-relevant hierarchy from the primary's complete store. */
+export function createOutpostHireGrantContext(target, lanes, enforcementEnabled) {
+    const current = lanes.find((lane) => lane.lane_id === target.lane_id);
+    if (!current || !sameSenior(current.senior, target.senior)) {
+        throw new LanesError("hire_grant_hierarchy_unavailable", `Cannot build an authoritative hire-grant hierarchy for lane ${target.lane_id}`, { lane_id: target.lane_id });
+    }
+    const relevant = new Map();
+    relevant.set(current.lane_id, current);
+    if (enforcementEnabled) {
+        if (current.senior.kind === "lane") {
+            const parentId = current.senior.id;
+            const parent = parentId ? lanes.find((lane) => lane.lane_id === parentId) : undefined;
+            if (!parent) {
+                throw new LanesError("hire_grant_senior_invalid", `Lane ${target.lane_id} has no senior lane in the primary hierarchy`, { lane_id: target.lane_id, senior_lane_id: parentId ?? null });
+            }
+            relevant.set(parent.lane_id, parent);
+            for (const sibling of aliveDirectChildren(lanes, parent.lane_id)) {
+                relevant.set(sibling.lane_id, sibling);
+            }
+        }
+        for (const child of aliveDirectChildren(lanes, current.lane_id)) {
+            relevant.set(child.lane_id, child);
+        }
+    }
+    const hierarchy = [...relevant.values()]
+        .map(snapshot)
+        .sort((a, b) => a.lane_id.localeCompare(b.lane_id));
+    if (hierarchy.length > MAX_CONTEXT_LANES) {
+        throw new LanesError("hire_grant_hierarchy_too_large", `Lane ${target.lane_id} has too many related lanes to dispatch a bounded grant check`, { lane_id: target.lane_id, related_lane_count: hierarchy.length });
+    }
+    const context = {
+        schema_version: HIRE_GRANT_CONTEXT_SCHEMA,
+        enforcement_enabled: enforcementEnabled,
+        expected_senior: copySenior(current.senior),
+        hierarchy,
+    };
+    const encoded = Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+    if (Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES) {
+        throw new LanesError("hire_grant_hierarchy_too_large", `Lane ${target.lane_id} has too much related state to dispatch a bounded grant check`, { lane_id: target.lane_id, encoded_bytes: Buffer.byteLength(encoded, "utf8") });
+    }
+    return encoded;
+}
+function parseSenior(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== "kind" && key !== "id"))
+        return null;
+    if (!isSeniorKind(record.kind))
+        return null;
+    if (record.id !== undefined &&
+        (typeof record.id !== "string" || !record.id.trim() || record.id.trim() !== record.id))
+        return null;
+    if ((record.kind === "session" || record.kind === "lane") && record.id === undefined)
+        return null;
+    if (record.kind === "user" && record.id !== undefined)
+        return null;
+    return record.id === undefined
+        ? { kind: record.kind }
+        : { kind: record.kind, id: record.id };
+}
+function parseLaneSnapshot(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => !["lane_id", "state", "senior", "hire_grant"].includes(key)))
+        return null;
+    if (typeof record.lane_id !== "string" || !record.lane_id.trim())
+        return null;
+    if (!isLaneState(record.state))
+        return null;
+    const senior = parseSenior(record.senior);
+    if (!senior)
+        return null;
+    if (record.hire_grant !== undefined &&
+        (typeof record.hire_grant !== "number" || !Number.isSafeInteger(record.hire_grant) || record.hire_grant < 0)) {
+        return null;
+    }
+    return {
+        lane_id: record.lane_id,
+        state: record.state,
+        senior,
+        ...(record.hire_grant === undefined ? {} : { hire_grant: record.hire_grant }),
+    };
+}
+/** Decode and validate an owner grant context, binding it to the target lane. */
+export function parseOutpostHireGrantContext(encoded, targetLaneId) {
+    if (!encoded || !/^[A-Za-z0-9_-]+$/.test(encoded) ||
+        Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES ||
+        Buffer.from(encoded, "base64url").toString("base64url") !== encoded) {
+        throw contextError("Outpost grant context is not canonical base64url");
+    }
+    let raw;
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(encoded, "base64url"));
+        raw = JSON.parse(decoded);
+    }
+    catch {
+        throw contextError("Outpost grant context is not valid UTF-8 JSON");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw contextError("Outpost grant context must be an object");
+    }
+    const record = raw;
+    if (Object.keys(record).some((key) => !["schema_version", "enforcement_enabled", "expected_senior", "hierarchy"].includes(key))) {
+        throw contextError("Outpost grant context contains unknown fields");
+    }
+    if (record.schema_version !== HIRE_GRANT_CONTEXT_SCHEMA ||
+        typeof record.enforcement_enabled !== "boolean" ||
+        !Array.isArray(record.hierarchy) ||
+        record.hierarchy.length === 0 || record.hierarchy.length > MAX_CONTEXT_LANES) {
+        throw contextError("Outpost grant context has an unsupported or incomplete shape");
+    }
+    const expectedSenior = parseSenior(record.expected_senior);
+    const hierarchy = record.hierarchy.map(parseLaneSnapshot);
+    if (!expectedSenior || hierarchy.some((lane) => lane === null)) {
+        throw contextError("Outpost grant context contains an invalid senior or lane snapshot");
+    }
+    const snapshots = hierarchy;
+    const byId = new Map(snapshots.map((lane) => [lane.lane_id, lane]));
+    if (byId.size !== snapshots.length) {
+        throw contextError("Outpost grant context contains duplicate lane snapshots");
+    }
+    const target = byId.get(targetLaneId);
+    if (!target || !sameSenior(target.senior, expectedSenior)) {
+        throw contextError("Outpost grant context does not match the target's expected senior");
+    }
+    if (record.enforcement_enabled && expectedSenior.kind === "lane" &&
+        (!expectedSenior.id || !byId.has(expectedSenior.id))) {
+        throw contextError("Outpost grant context is missing the target's senior lane");
+    }
+    return {
+        schema_version: HIRE_GRANT_CONTEXT_SCHEMA,
+        enforcement_enabled: record.enforcement_enabled,
+        expected_senior: expectedSenior,
+        hierarchy: snapshots,
+    };
+}
+export function sameHireGrantSenior(a, b) {
+    return sameSenior(a, b);
+}
+//# sourceMappingURL=hire-grant-dispatch.js.map

package/dist/lib/lanes/hire-grants.d.ts

@@ -1,7 +1,8 @@
 import { type LaneRecord } from "./types.js";
 export declare const LANE_HIRE_GRANTS_FLAG = "lanes.hire-grants";
-export declare function aliveDirectChildren(lanes: readonly LaneRecord[], parentLaneId: string): LaneRecord[];
-export declare function assignedChildHireGrants(children: readonly LaneRecord[], exceptLaneId?: string): number;
+export type LaneHireGrantRow = Pick<LaneRecord, "lane_id" | "state" | "senior" | "hire_grant">;
+export declare function aliveDirectChildren<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string): T[];
+export declare function assignedChildHireGrants(children: readonly LaneHireGrantRow[], exceptLaneId?: string): number;
 export interface HireGrantAdmissionSnapshot {
     parent: LaneRecord;
     children: LaneRecord[];

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -36,6 +36,7 @@ export interface OutpostLaneCommand {
     account?: string;
     model?: string;
     hire?: string;
+    grantContext?: string;
     compact?: boolean;
 }
 export interface OutpostExecPort {

package/dist/lib/lanes/outpost-dispatch.js

@@ -105,6 +105,7 @@ export function buildOutpostLaneCommand(input) {
         ["--account", input.account],
         ["--model", input.model],
         ["--hire", input.hire],
+        ["--grant-context", input.grantContext],
     ]) {
         if (value !== undefined)
             args.push(flag, value);

package/dist/lib/lanes/ssm-command-context.d.ts

@@ -0,0 +1,12 @@
+export interface SsmRunCommandContextDeps {
+    platform?: string;
+    parentPid?: number;
+    readFileSync?: (path: string, encoding: "utf8") => string;
+}
+/**
+ * True only for a Linux process descended from the root-owned SSM Run Command
+ * worker chain. Outpost owner-only lane mutations use this to distinguish an
+ * SSM dispatch from a normal local CLI invocation.
+ */
+export declare function isSsmRunCommandProcess(deps?: SsmRunCommandContextDeps): boolean;
+//# sourceMappingURL=ssm-command-context.d.ts.map

package/dist/lib/lanes/ssm-command-context.js

@@ -0,0 +1,52 @@
+import * as fs from "node:fs";
+const SSM_WORKER_CHAIN = [
+    "ssm-document-wo",
+    "ssm-agent-worke",
+    "amazon-ssm-agen",
+];
+/**
+ * True only for a Linux process descended from the root-owned SSM Run Command
+ * worker chain. Outpost owner-only lane mutations use this to distinguish an
+ * SSM dispatch from a normal local CLI invocation.
+ */
+export function isSsmRunCommandProcess(deps = {}) {
+    if ((deps.platform ?? process.platform) !== "linux")
+        return false;
+    const readFileSync = deps.readFileSync ?? ((filePath, encoding) => fs.readFileSync(filePath, encoding));
+    let pid = deps.parentPid ?? process.ppid;
+    const lineage = [];
+    for (let depth = 0; depth < 32 && pid > 1; depth += 1) {
+        let status;
+        let command;
+        try {
+            status = readFileSync(`/proc/${pid}/status`, "utf8");
+            command = readFileSync(`/proc/${pid}/comm`, "utf8").trim();
+        }
+        catch (err) {
+            const code = err !== null && typeof err === "object" && "code" in err
+                ? err.code
+                : undefined;
+            if (code === "ENOENT" || code === "EACCES" || code === "EPERM")
+                return false;
+            throw err;
+        }
+        const parentMatch = /^PPid:\s*(\d+)\s*$/m.exec(status);
+        const uidMatch = /^Uid:\s*\d+\s+(\d+)\s+\d+\s+\d+\s*$/m.exec(status);
+        if (!parentMatch || !uidMatch || !command)
+            return false;
+        const parentPid = Number(parentMatch[1]);
+        const effectiveUid = Number(uidMatch[1]);
+        if (!Number.isSafeInteger(parentPid) || !Number.isSafeInteger(effectiveUid))
+            return false;
+        lineage.push({ pid, parentPid, command, effectiveUid });
+        pid = parentPid;
+    }
+    for (let start = 0; start <= lineage.length - SSM_WORKER_CHAIN.length; start += 1) {
+        const chain = lineage.slice(start, start + SSM_WORKER_CHAIN.length);
+        if (chain.every((entry, index) => entry.effectiveUid === 0 && entry.command.startsWith(SSM_WORKER_CHAIN[index]))) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=ssm-command-context.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.188.0",
+  "version": "5.188.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {