@indigoai-us/hq-cli 5.238.0 → 5.240.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.240.0] — 2026-09-27
+
+### Added
+
+- `hq lanes` worker profiles can pin a registry persona from `worker.yaml`.
+  The composed prompt includes the worker's instructions, skill paths, done
+  criteria, and stop checkpoints. Registry approval requirements are passed to
+  workers, enforced on external-action envelopes, and recorded through the new
+  senior-only `hq lanes approve` command.
+
+## [5.239.0] — 2026-09-27
+
+### Added
+
+- `hq core checkpoint` can skip a knowledge link to a concept entity whose
+  name is also the name of an entity of another type, such as a concept
+  `hq-secrets` beside a project `HQ Secrets`. The report lists the skipped
+  link as rejected with reason `ambiguous_type`. Signal and session inputs,
+  other links and new entities are unchanged. Behind the hq-flags flag
+  `checkpoint.ontology.skip-ambiguous-concept-links`, off by default.
+
 ## [5.238.0] — 2026-09-27
 
 ### Added: Lane orphan reporting

package/dist/command-catalog.generated.d.ts

@@ -7507,6 +7507,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve-target";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--approval-context <base64url>";
+            readonly description: "Primary-authorized registry worker approval";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "reparent-target";
         readonly description: "";
@@ -8193,6 +8212,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve";
+        readonly description: "Record senior approval for a registry worker checkpoint";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--checkpoint <name>";
+            readonly description: "Exact registry worker checkpoint name";
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Why the checkpoint is approved";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "ask";
         readonly description: "Queue a mid-run question without blocking the lane";

package/dist/command-catalog.generated.js

@@ -9705,6 +9705,31 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve-target",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--approval-context <base64url>",
+                        "description": "Primary-authorized registry worker approval"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "reparent-target",
                 "description": "",
@@ -10601,6 +10626,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve",
+                "description": "Record senior approval for a registry worker checkpoint",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--checkpoint <name>",
+                        "description": "Exact registry worker checkpoint name"
+                    },
+                    {
+                        "flags": "--reason <text>",
+                        "description": "Why the checkpoint is approved"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "ask",
                 "description": "Queue a mid-run question without blocking the lane",

package/dist/commands/lanes.js

@@ -24,6 +24,7 @@ import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
+import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostQuestionAnswerCommand, buildOutpostQuestionListCommand, buildOutpostQuestionShowCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
@@ -40,7 +41,7 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { keepAliveExclusion, LEAD_LANE_KEEP_ALIVE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
@@ -3059,6 +3060,9 @@ async function runCreate(ctx, opts) {
                     worker_profile: profile.id,
                     worker_profile_hash: profile.contentHash,
                     worker_profile_ignored: ignoredWorkerProfileFields(provider),
+                    ...(profile.registryWorker !== undefined
+                        ? { registry_worker: registryWorkerRecord(profile.registryWorker) }
+                        : {}),
                 }
                 : {}),
             keep_alive: keepAlive,
@@ -3470,7 +3474,12 @@ function verifyOutpostProfileContent(hqRoot, lane) {
     if (lane.host.kind !== "outpost" || lane.worker_profile === undefined)
         return;
     const expectedHash = lane.worker_profile_hash;
-    const profile = loadWorkerProfile(hqRoot, lane.worker_profile);
+    const profile = loadWorkerProfileWithRegistry(hqRoot, lane.worker_profile, {
+        laneCompany: lane.company?.slug ?? lane.mesh_company?.slug,
+        ...(lane.registry_worker !== undefined
+            ? { registryWorkerRecord: lane.registry_worker }
+            : {}),
+    });
     if (expectedHash !== profile.contentHash) {
         throw new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(lane.worker_profile)} on Outpost ${lane.host.id} does not match the hash recorded by the creator`, {
             lane_id: lane.lane_id,
@@ -3692,7 +3701,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                     ? "grant-target"
                     : action === "reparent"
                         ? "reparent-target"
-                        : action,
+                        : action === "approve"
+                            ? "approve-target"
+                            : action,
                 laneId: lane.lane_id,
                 hqBinary: action === "grant" || action === "reparent"
                     ? outpostCliOverride(ctx, outpostId)
@@ -3712,6 +3723,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 grantContext: contexts.grantContext,
                 profileRepinContext: contexts.profileRepinContext,
                 failedResumeContext: contexts.failedResumeContext,
+                approvalContext: options.approvalContext,
                 compact: options.compact,
             }),
         });
@@ -3820,17 +3832,20 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             ? remote.accepted === true
             : action === "grant"
                 ? remote.hire_grant === Number(options.hire)
-                : action === "reparent"
-                    ? remote.lane !== null && typeof remote.lane === "object" &&
-                        Array.isArray(remote.changed_descendant_ids)
-                    : (((remote.delivery_status === "worker_spawned" ||
-                        remote.delivery_status === "queued_on_target_account") &&
-                        remote.lane !== undefined) ||
-                        (remote.delivery_status === "queued_on_admission" &&
-                            remote.lane !== null &&
-                            typeof remote.lane === "object" &&
-                            !Array.isArray(remote.lane) &&
-                            remote.lane.state === "queued")));
+                : action === "approve"
+                    ? remote.checkpoint === options.checkpoint &&
+                        remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane)
+                    : action === "reparent"
+                        ? remote.lane !== null && typeof remote.lane === "object" &&
+                            Array.isArray(remote.changed_descendant_ids)
+                        : (((remote.delivery_status === "worker_spawned" ||
+                            remote.delivery_status === "queued_on_target_account") &&
+                            remote.lane !== undefined) ||
+                            (remote.delivery_status === "queued_on_admission" &&
+                                remote.lane !== null &&
+                                typeof remote.lane === "object" &&
+                                !Array.isArray(remote.lane) &&
+                                remote.lane.state === "queued")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3866,7 +3881,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
-    if (action === "reparent" || action === "resume") {
+    if (action === "approve" || action === "reparent" || action === "resume") {
         const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
         const descendants = [];
         if (action === "reparent") {
@@ -5189,6 +5204,141 @@ async function runGrant(ctx, laneId, opts) {
     const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
     printGrantResult(hqRoot, updated);
 }
+async function runApprove(ctx, laneId, opts) {
+    const checkpoint = opts.checkpoint?.trim();
+    const reason = opts.reason?.trim();
+    if (!checkpoint) {
+        throw new LanesError("registry_worker_checkpoint_required", "--checkpoint requires a non-empty checkpoint name", { lane_id: laneId });
+    }
+    if (!reason) {
+        throw new LanesError("registry_worker_approval_reason_required", "--reason requires a non-empty explanation", { lane_id: laneId });
+    }
+    assertNoSecretText("approval reason", reason);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    const remoteOutpost = initial.host.kind === "outpost" && !laneIsHostedHere(ctx, initial);
+    if (!initial.registry_worker ||
+        (!initial.registry_worker.approval_required && initial.registry_worker.human_checkpoints.length === 0)) {
+        throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+    }
+    const allowed = initial.registry_worker.human_checkpoints.length > 0
+        ? initial.registry_worker.human_checkpoints
+        : ["external_publish"];
+    if (!allowed.includes(checkpoint)) {
+        throw new LanesError("registry_worker_checkpoint_unknown", `Checkpoint ${JSON.stringify(checkpoint)} is not declared by the lane's registry worker`, { lane_id: laneId, checkpoint, accepted: allowed });
+    }
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(initial.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (remoteOutpost) {
+        const approvalContext = createOutpostRegistryWorkerApprovalContext({
+            lane_id: initial.lane_id,
+            expected_senior: initial.senior,
+            actor: resumeProfileRepinActor(ctx),
+            checkpoint,
+            reason,
+            approval_id: randomBytes(16).toString("hex"),
+            registry_worker_id: initial.registry_worker.id,
+            worker_yaml_sha256: initial.registry_worker.worker_yaml_sha256,
+            at: ctx.now().toISOString(),
+        });
+        await dispatchOutpostLaneCommand(ctx, initial, "approve", {
+            approvalContext,
+            checkpoint,
+        });
+        return;
+    }
+    assertLaneRunsHereForOperatorMutation(ctx, initial, "approve");
+    const approvalId = randomBytes(16).toString("hex");
+    const at = ctx.now().toISOString();
+    const actor = resumeProfileRepinActor(ctx);
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "approve");
+        if (!callerMatchesSenior(ctx, current.senior)) {
+            throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(current.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: current.senior });
+        }
+        if (JSON.stringify(current.registry_worker) !== JSON.stringify(initial.registry_worker) ||
+            !current.registry_worker ||
+            !current.registry_worker.human_checkpoints.concat(current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0
+                ? ["external_publish"]
+                : []).includes(checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker approval contract changed before the checkpoint was recorded`, { lane_id: laneId });
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(current.registry_worker_approval_history ?? [], {
+                event: "approved",
+                approval_id: approvalId,
+                checkpoint,
+                registry_worker_id: current.registry_worker.id,
+                worker_yaml_sha256: current.registry_worker.worker_yaml_sha256,
+                reason,
+                actor,
+                at,
+            }),
+        };
+    });
+    printJson({ ok: true, action: "approve", lane_id: laneId, checkpoint, lane: updated });
+}
+async function runApproveOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("registry_worker_approval_dispatch_unauthorized", "The Outpost approval target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.approvalContext === undefined) {
+        throw new LanesError("registry_worker_approval_context_invalid", "--approval-context is required on the Outpost owner target", { lane_id: laneId });
+    }
+    const authorization = parseOutpostRegistryWorkerApprovalContext(opts.approvalContext, laneId);
+    assertNoSecretText("approval reason", authorization.reason);
+    const hqRoot = ctx.hqRoot();
+    const validateOwnerState = (current) => {
+        if (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current)) {
+            throw new LanesError("lane_remote", `Outpost approval target cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (!sameHireGrantSenior(current.senior, authorization.expected_senior) ||
+            current.registry_worker?.id !== authorization.registry_worker_id ||
+            current.registry_worker.worker_yaml_sha256 !== authorization.worker_yaml_sha256) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s senior or registry worker changed after approval was authorized`, { lane_id: laneId });
+        }
+        if (!current.registry_worker ||
+            (!current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0)) {
+            throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+        }
+        const allowed = current.registry_worker.human_checkpoints.length > 0
+            ? current.registry_worker.human_checkpoints
+            : ["external_publish"];
+        if (!allowed.includes(authorization.checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker no longer declares checkpoint ${JSON.stringify(authorization.checkpoint)}`, { lane_id: laneId, checkpoint: authorization.checkpoint });
+        }
+    };
+    validateOwnerState(readLane(hqRoot, laneId));
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        validateOwnerState(current);
+        const history = current.registry_worker_approval_history ?? [];
+        if (history.some((entry) => entry.event === "approved" && entry.approval_id === authorization.approval_id)) {
+            return current;
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(history, {
+                event: "approved",
+                approval_id: authorization.approval_id,
+                checkpoint: authorization.checkpoint,
+                registry_worker_id: authorization.registry_worker_id,
+                worker_yaml_sha256: authorization.worker_yaml_sha256,
+                reason: authorization.reason,
+                actor: authorization.actor,
+                at: authorization.at,
+            }),
+        };
+    });
+    printJson({
+        ok: true,
+        action: "approve",
+        lane_id: laneId,
+        checkpoint: authorization.checkpoint,
+        lane: updated,
+    });
+}
 async function runGrantOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
         throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
@@ -5350,7 +5500,9 @@ async function runAdmit(ctx, laneId, opts) {
     }, ctx.sleep);
 }
 function resolveResumeProfile(ctx, lane, workerId) {
-    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug);
+    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug, undefined, lane.worker_profile === workerId.trim() && lane.registry_worker !== undefined
+        ? { registryWorkerRecord: lane.registry_worker }
+        : {});
     if (worker.profile === undefined) {
         throw new LanesError("worker_profile_required", `Worker ${JSON.stringify(workerId)} resolves to a registry worker, not a reusable provider profile; resume --worker requires personal/workers/<id>/meta.yaml`, { worker: workerId, path: worker.path });
     }
@@ -5393,6 +5545,9 @@ function applyResumeProfileAndEffort(current, next, input) {
         next.worker_pack = input.profile.pack;
         next.worker_profile = profile.id;
         next.worker_profile_hash = profile.contentHash;
+        next.registry_worker = profile.registryWorker !== undefined
+            ? registryWorkerRecord(profile.registryWorker)
+            : undefined;
         if (input.profileRepin !== undefined &&
             current.host.kind === "outpost" &&
             current.worker_profile_hash !== profile.contentHash) {
@@ -9282,6 +9437,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("approve-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--approval-context <base64url>", "Primary-authorized registry worker approval")
+        .action(wrap(async (laneId, opts) => {
+        await runApproveOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("reparent-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
@@ -9581,6 +9743,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, options) => {
         await runStop(ctx, laneId, options.reason);
     }));
+    lanes
+        .command("approve")
+        .description("Record senior approval for a registry worker checkpoint")
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--checkpoint <name>", "Exact registry worker checkpoint name")
+        .requiredOption("--reason <text>", "Why the checkpoint is approved")
+        .action(wrap(async (laneId, opts) => {
+        await runApprove(ctx, laneId, opts);
+    }));
     lanes
         .command("ask")
         .description("Queue a mid-run question without blocking the lane")

package/dist/lib/checkpoint-ontology/apply.js

@@ -262,6 +262,25 @@ export function applyOntologyRun(options) {
     }
     report.candidates = rawCandidates.length;
     const index = buildEntityIndex(company.dir);
+    // checkpoint.ontology.skip-ambiguous-concept-links: canonical names held by entities of more than one type.
+    // Names compare in the non-organization form for every type (lowercase, keeps + and #, no squashing),
+    // so "C++" and "C", or "AB" and "A B", stay distinct.
+    const crossTypeKey = (name) => normalizeEntityName(name, "concept");
+    const crossTypeNames = new Set();
+    if (plan.skip_ambiguous_concept_links === true) {
+        const typesByName = new Map();
+        for (const entity of index.byRel.values()) {
+            const name = crossTypeKey(entity.canonical_name);
+            if (name === "")
+                continue;
+            const types = typesByName.get(name) ?? new Set();
+            types.add(entity.type);
+            typesByName.set(name, types);
+        }
+        for (const [name, types] of typesByName)
+            if (types.size > 1)
+                crossTypeNames.add(name);
+    }
     const inputs = liveInputs(options.hqRoot, company, plan);
     const blocked = new Set();
     const updates = new Map();
@@ -313,8 +332,14 @@ export function applyOntologyRun(options) {
             continue;
         }
         if (resolved.tier === 1 || resolved.tier === 2) {
-            report.matched += 1;
             const linked = index.byRel.get(resolved.target);
+            if (input.kind === "knowledge" &&
+                linked.type === "concept" &&
+                crossTypeNames.has(crossTypeKey(linked.canonical_name))) {
+                note(report.rejected, "ambiguous_type");
+                continue;
+            }
+            report.matched += 1;
             report.links.push({ input: candidate.input, action: "link", type: linked.type, canonical_name: linked.canonical_name, path: resolved.target });
             if (resolved.tier === 1 && resolved.duplicates.length > 0) {
                 report.suspect_duplicates.push({ name: canonical, type: candidate.type, paths: [resolved.target, ...resolved.duplicates] });

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -68,6 +68,16 @@ export declare const NO_LINK_ALIASES_FLAG = "checkpoint.ontology.no-link-aliases
  * the model cannot see that `John Smith` already exists.
  */
 export declare const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-people";
+/**
+ * A knowledge input does not link to a concept entity whose canonical name is
+ * also the canonical name of an entity of another type (`concept/hq-secrets`
+ * beside `project/hq-secrets`). The plan carries
+ * `skip_ambiguous_concept_links: true`, and apply rejects the link as
+ * `ambiguous_type`. CO-46: 34 of the 73 false positives on the knowledge
+ * fixtures were such concept links; skipping them raised precision from 0.733
+ * to 0.803 and cost recall 0.023 on a replay of six runs.
+ */
+export declare const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
 export declare const PLAN_FILE = "ontology-plan.json";
 export declare const CANDIDATES_FILE = "ontology-candidates.json";
 export declare const REPORT_FILE = "ontology-report.json";
@@ -138,6 +148,8 @@ export interface OntologyPlan {
     link_aliases?: false;
     /** Set by checkpoint.ontology.first-name-people: apply defers a one-word person who may be an existing fuller name. */
     first_name_people?: true;
+    /** Set by checkpoint.ontology.skip-ambiguous-concept-links: apply rejects a knowledge link to a concept whose name another type also holds. */
+    skip_ambiguous_concept_links?: true;
     inputs: PlanInput[];
     /** The session's summary, decisions and learnings, for the `session` input. */
     session_text: string | null;

package/dist/lib/checkpoint-ontology/plan.js

@@ -72,6 +72,16 @@ export const NO_LINK_ALIASES_FLAG = "checkpoint.ontology.no-link-aliases";
  * the model cannot see that `John Smith` already exists.
  */
 export const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-people";
+/**
+ * A knowledge input does not link to a concept entity whose canonical name is
+ * also the canonical name of an entity of another type (`concept/hq-secrets`
+ * beside `project/hq-secrets`). The plan carries
+ * `skip_ambiguous_concept_links: true`, and apply rejects the link as
+ * `ambiguous_type`. CO-46: 34 of the 73 false positives on the knowledge
+ * fixtures were such concept links; skipping them raised precision from 0.733
+ * to 0.803 and cost recall 0.023 on a replay of six runs.
+ */
+export const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
 export const PLAN_FILE = "ontology-plan.json";
 export const CANDIDATES_FILE = "ontology-candidates.json";
 export const REPORT_FILE = "ontology-report.json";
@@ -254,6 +264,7 @@ export async function planOntologyRun(options) {
     const hintsOn = await options.readFlag(ENTITY_HINTS_FLAG, company);
     const noLinkAliases = await options.readFlag(NO_LINK_ALIASES_FLAG, company);
     const firstNamePeople = await options.readFlag(FIRST_NAME_PEOPLE_FLAG, company);
+    const skipAmbiguousConceptLinks = await options.readFlag(SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG, company);
     const touched = sessionTouched(hqRoot, company, payload.files);
     // A first run takes its boundary from the entity tree, so the ledger is
     // refreshed before merge-back moves any `last_updated` forward.
@@ -368,6 +379,7 @@ export async function planOntologyRun(options) {
         ...(multiWriter ? { multi_writer: multiWriter } : {}),
         ...(noLinkAliases ? { link_aliases: false } : {}),
         ...(firstNamePeople ? { first_name_people: true } : {}),
+        ...(skipAmbiguousConceptLinks ? { skip_ambiguous_concept_links: true } : {}),
         inputs,
         session_text: sessionText,
         pending_after_run: remaining,

package/dist/lib/lanes/approval-gate.d.ts

@@ -0,0 +1,8 @@
+import type { LaneEnvelope, LaneRecord } from "./types.js";
+export interface RegistryApprovalGateResult {
+    envelope: LaneEnvelope;
+    approvedIdsToConsume: string[];
+    violation: boolean;
+}
+export declare function enforceRegistryApprovalGate(lane: LaneRecord, envelope: LaneEnvelope): RegistryApprovalGateResult;
+//# sourceMappingURL=approval-gate.d.ts.map

package/dist/lib/lanes/approval-gate.js

@@ -0,0 +1,90 @@
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function text(value) {
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
+}
+function externalActionCheckpoint(artifactValue) {
+    const artifact = record(artifactValue);
+    if (!artifact)
+        return undefined;
+    const kind = (text(artifact.kind) ?? text(artifact.type) ?? "").toLowerCase().replace(/[\s-]+/g, "_");
+    const status = (text(artifact.status) ?? text(artifact.state) ?? "").toLowerCase();
+    const hasDate = (...keys) => keys.some((key) => text(artifact[key]) !== undefined);
+    const url = text(artifact.url) ?? "";
+    const mergedPr = (["pr", "pull_request", "merged_pr"].includes(kind) ||
+        /\/(?:pull|pulls|merge_requests)\/\d+(?:\/|$)/i.test(url)) &&
+        (status === "merged" || artifact.merged === true || hasDate("merged_at")) ||
+        artifact.merged === true || status === "merged";
+    const pushedTag = (["tag", "git_tag"].includes(kind) ||
+        text(artifact.tag) !== undefined || text(artifact.tag_name) !== undefined) &&
+        (status === "pushed" || artifact.pushed === true || hasDate("pushed_at"));
+    const publishedPackage = (["package", "npm_package", "published_package"].includes(kind) ||
+        text(artifact.package) !== undefined || text(artifact.package_name) !== undefined) &&
+        (status === "published" || artifact.published === true || hasDate("published_at"));
+    const deployment = ["deploy", "deployment", "deployed"].includes(kind) &&
+        (status === "" || ["deployed", "success", "succeeded", "successful", "complete", "completed", "live"].includes(status) ||
+            artifact.deployed === true || hasDate("deployed_at"));
+    if (!mergedPr && !pushedTag && !publishedPackage && !deployment)
+        return undefined;
+    return text(artifact.checkpoint) ?? null;
+}
+function approvedEvents(history, workerId, workerYamlSha256) {
+    const consumed = new Set(history.flatMap((entry) => entry.event === "consumed" ? [entry.approval_id] : []));
+    return history.filter((entry) => entry.event === "approved" &&
+        entry.registry_worker_id === workerId &&
+        entry.worker_yaml_sha256 === workerYamlSha256 &&
+        !consumed.has(entry.approval_id));
+}
+export function enforceRegistryApprovalGate(lane, envelope) {
+    const registryWorker = lane.registry_worker;
+    const gateEnabled = registryWorker !== undefined &&
+        (registryWorker.approval_required || registryWorker.human_checkpoints.length > 0);
+    if (!gateEnabled || envelope.decision !== "done") {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const actionCheckpoints = envelope.artifacts
+        .map(externalActionCheckpoint)
+        .filter((checkpoint) => checkpoint !== undefined);
+    if (actionCheckpoints.length === 0) {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const missingCheckpoint = actionCheckpoints.includes(null);
+    const requiredCheckpoints = [...new Set(actionCheckpoints.filter((checkpoint) => checkpoint !== null))];
+    const configuredCheckpoints = registryWorker.human_checkpoints.length > 0
+        ? new Set(registryWorker.human_checkpoints)
+        : new Set(["external_publish"]);
+    const approvals = approvedEvents(lane.registry_worker_approval_history ?? [], registryWorker.id, registryWorker.worker_yaml_sha256);
+    const used = [];
+    const missing = missingCheckpoint ? ["(checkpoint missing)"] : [];
+    for (const checkpoint of requiredCheckpoints) {
+        if (!configuredCheckpoints.has(checkpoint)) {
+            missing.push(checkpoint);
+            continue;
+        }
+        const approval = approvals.find((entry) => entry.checkpoint === checkpoint && !used.includes(entry.approval_id));
+        if (!approval)
+            missing.push(checkpoint);
+        else
+            used.push(approval.approval_id);
+    }
+    if (missing.length === 0) {
+        return { envelope, approvedIdsToConsume: used, violation: false };
+    }
+    return {
+        envelope: {
+            ...envelope,
+            decision: "blocked",
+            summary: `External action requires senior approval at checkpoint: ${missing.join(", ")}.`,
+            story_status: "review",
+            blocked_reason: "approval_gate_violated",
+            story_complete: false,
+            story_complete_reason: "The reported external action has no matching recorded approval.",
+        },
+        approvedIdsToConsume: [],
+        violation: true,
+    };
+}
+//# sourceMappingURL=approval-gate.js.map