@indigoai-us/hq-cli 5.238.0 → 5.240.0

package/dist/lib/lanes/errors.d.ts

@@ -34,6 +34,6 @@ export declare class AccountResolutionError extends LanesError {
     constructor(error: "unknown_account" | "account_disabled" | "no_enabled_account" | "account_model_unavailable" | "account_quota_exhausted", message: string, details?: Record<string, unknown>);
 }
 export declare class WorkerResolutionError extends LanesError {
-    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable", message: string, details?: Record<string, unknown>);
+    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable" | "registry_worker_not_found" | "registry_worker_company_mismatch" | "registry_worker_inactive" | "registry_worker_invalid" | "registry_worker_unreadable" | "registry_worker_ambiguous", message: string, details?: Record<string, unknown>);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/lanes/index.d.ts

@@ -56,8 +56,10 @@ export type { KnownModels, KnownModelsDeps, ProbeCommand, ProbeResult } from "./
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export type { SessionCopyPlan, SessionCopyResult } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export type { WorkerProfile, WorkerProfileMeta, WorkerProfileRuntime, } from "./profile.js";
+export type { RegistryPersona } from "./registry-persona.js";
 export type { RegistryWorkerEntry, ResolvedLaneWorker, WorkerTenancy, WorkerYaml, } from "./registry.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export type { QuestionBody, RaiseLaneQuestionInput } from "./questions.js";

package/dist/lib/lanes/index.js

@@ -31,7 +31,8 @@ export { PROVIDER_REJECTED_REASON, PROVIDER_REJECTION_MESSAGE_CAP, parseClaudeRe
 export { CODEX_MODELS_CACHE_NAME, MODEL_PROBE_TIMEOUT_MS, claudeKnownModels, codexKnownModels, defaultProbe, grokKnownModels, knownModels, modelIsKnown, parseClaudeHelpModels, parseGrokModelsOutput, validateLaneModel, } from "./models.js";
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export { LANE_DELIVERY_MECHANISMS, LAUNCH_TRIGGERS, PROVIDER_SESSION_RESUME, PROVIDER_SESSION_PORTABLE, providerSessionPortable, sessionNotPortableMessage, parseGrokResultOutput, RESUMABLE_LANE_STATES, RESUME_COMMAND_STATES, SESSION_ID_ABSENT_REASONS, claimableStatesFor, deliveryRefusalReason, hasRecordedSessionId, isResumableLaneState, isResumeCommandState, laneDeliveryMechanism, parseClaudeResultOutput, parseCodexEventOutput, parseWorkerRunOutput, planLaneLaunch, providerSupportsSessionResume, readWorkerRunResult, resumeCommandRefusal, } from "./delivery.js";
 export { DROPBOX_DIR, INBOX_NAME, appendDropboxMessage, answerDropboxMessage, drainDropbox, dropboxDir, dropboxInboxPath, formatOperatorInstruction, hookAdditionalContextJson, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneIdForAnswerDelivery, operatorMessageRefusalReason, readToolActivity, recordToolActivity, runDrainHook, toolActivityPath, TOOL_ACTIVITY_NAME, } from "./dropbox.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target" | "approve-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -43,6 +43,7 @@ export interface OutpostLaneCommand {
     hire?: string;
     grantContext?: string;
     profileRepinContext?: string;
+    approvalContext?: string;
     senior?: string;
     reason?: string;
     compact?: boolean;

package/dist/lib/lanes/outpost-dispatch.js

@@ -151,6 +151,7 @@ export function buildOutpostLaneCommand(input) {
         ["--hire", input.hire],
         ["--grant-context", input.grantContext],
         ["--profile-repin-context", input.profileRepinContext],
+        ["--approval-context", input.approvalContext],
         ["--failed-resume-context", input.failedResumeContext],
         ["--senior", input.senior],
         ["--reason", input.reason],

package/dist/lib/lanes/outpost-registry-worker-approval.d.ts

@@ -0,0 +1,18 @@
+import { type SeniorRef } from "./types.js";
+declare const APPROVAL_CONTEXT_SCHEMA: "hq-lane-registry-worker-approval-context.v1";
+export interface OutpostRegistryWorkerApprovalContext {
+    schema_version: typeof APPROVAL_CONTEXT_SCHEMA;
+    lane_id: string;
+    expected_senior: SeniorRef;
+    actor: string;
+    checkpoint: string;
+    reason: string;
+    approval_id: string;
+    registry_worker_id: string;
+    worker_yaml_sha256: string;
+    at: string;
+}
+export declare function createOutpostRegistryWorkerApprovalContext(input: Omit<OutpostRegistryWorkerApprovalContext, "schema_version">): string;
+export declare function parseOutpostRegistryWorkerApprovalContext(encoded: string, expectedLaneId: string): OutpostRegistryWorkerApprovalContext;
+export {};
+//# sourceMappingURL=outpost-registry-worker-approval.d.ts.map

package/dist/lib/lanes/outpost-registry-worker-approval.js

@@ -0,0 +1,109 @@
+import { LanesError } from "./errors.js";
+import { isSeniorKind } from "./types.js";
+const APPROVAL_CONTEXT_SCHEMA = "hq-lane-registry-worker-approval-context.v1";
+const MAX_CONTEXT_BYTES = 16 * 1024;
+function contextError(message) {
+    return new LanesError("registry_worker_approval_context_invalid", message, {});
+}
+function copySenior(senior) {
+    return senior.id === undefined
+        ? { kind: senior.kind }
+        : { kind: senior.kind, id: senior.id };
+}
+function parseSenior(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== "kind" && key !== "id"))
+        return null;
+    if (!isSeniorKind(record.kind))
+        return null;
+    if (record.id !== undefined &&
+        (typeof record.id !== "string" || !record.id.trim() || record.id.trim() !== record.id))
+        return null;
+    if ((record.kind === "session" || record.kind === "lane") && record.id === undefined)
+        return null;
+    if (record.kind === "user" && record.id !== undefined)
+        return null;
+    return copySenior({ kind: record.kind, ...(record.id === undefined ? {} : { id: record.id }) });
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function createOutpostRegistryWorkerApprovalContext(input) {
+    if (!nonEmpty(input.lane_id) ||
+        !nonEmpty(input.actor) ||
+        !nonEmpty(input.checkpoint) ||
+        !nonEmpty(input.reason) ||
+        !nonEmpty(input.approval_id) ||
+        !nonEmpty(input.registry_worker_id) ||
+        !/^sha256:[a-f0-9]{64}$/.test(input.worker_yaml_sha256) ||
+        !Number.isFinite(Date.parse(input.at))) {
+        throw contextError("Outpost registry worker approval fields are incomplete");
+    }
+    const context = {
+        schema_version: APPROVAL_CONTEXT_SCHEMA,
+        ...input,
+        expected_senior: copySenior(input.expected_senior),
+    };
+    const encoded = Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+    if (Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES) {
+        throw contextError(`Registry worker approval context for lane ${input.lane_id} is too large`);
+    }
+    return encoded;
+}
+export function parseOutpostRegistryWorkerApprovalContext(encoded, expectedLaneId) {
+    if (encoded.length === 0 ||
+        encoded.length > MAX_CONTEXT_BYTES ||
+        !/^[A-Za-z0-9_-]+$/.test(encoded) ||
+        Buffer.from(encoded, "base64url").toString("base64url") !== encoded) {
+        throw contextError("Registry worker approval context must be bounded canonical base64url text");
+    }
+    let raw;
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(encoded, "base64url"));
+        raw = JSON.parse(decoded);
+    }
+    catch {
+        throw contextError("Registry worker approval context is not valid UTF-8 JSON");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw contextError("Registry worker approval context must be a JSON object");
+    }
+    const record = raw;
+    const allowed = [
+        "schema_version", "lane_id", "expected_senior", "actor", "checkpoint", "reason",
+        "approval_id", "registry_worker_id", "worker_yaml_sha256", "at",
+    ];
+    if (Object.keys(record).some((key) => !allowed.includes(key))) {
+        throw contextError("Registry worker approval context contains unknown fields");
+    }
+    const expectedSenior = parseSenior(record.expected_senior);
+    if (record.schema_version !== APPROVAL_CONTEXT_SCHEMA ||
+        record.lane_id !== expectedLaneId ||
+        expectedSenior === null ||
+        !nonEmpty(record.actor) ||
+        !nonEmpty(record.checkpoint) ||
+        !nonEmpty(record.reason) ||
+        !nonEmpty(record.approval_id) ||
+        !nonEmpty(record.registry_worker_id) ||
+        typeof record.worker_yaml_sha256 !== "string" ||
+        !/^sha256:[a-f0-9]{64}$/.test(record.worker_yaml_sha256) ||
+        typeof record.at !== "string" ||
+        !Number.isFinite(Date.parse(record.at))) {
+        throw contextError(`Registry worker approval context is invalid for lane ${expectedLaneId}`);
+    }
+    return {
+        schema_version: APPROVAL_CONTEXT_SCHEMA,
+        lane_id: expectedLaneId,
+        expected_senior: expectedSenior,
+        actor: record.actor,
+        checkpoint: record.checkpoint,
+        reason: record.reason,
+        approval_id: record.approval_id,
+        registry_worker_id: record.registry_worker_id,
+        worker_yaml_sha256: record.worker_yaml_sha256,
+        at: record.at,
+    };
+}
+//# sourceMappingURL=outpost-registry-worker-approval.js.map

package/dist/lib/lanes/profile.d.ts

@@ -7,6 +7,9 @@
  * must be re-read for every spawn.
  */
 import { type LaneRecord, type LaneProvider } from "./types.js";
+import type { RegistryWorkerRecord } from "./types.js";
+import { type RegistryPersona } from "./registry-persona.js";
+export declare const REGISTRY_PERSONA_PROMPT_MAX_CHARS = 12000;
 export interface WorkerProfileMeta {
     version?: string;
     provider: LaneProvider;
@@ -18,6 +21,7 @@ export interface WorkerProfileMeta {
     source?: string;
     accounts?: string[];
     keep_alive?: boolean;
+    registry_worker?: string;
 }
 export interface WorkerProfile {
     id: string;
@@ -28,6 +32,7 @@ export interface WorkerProfile {
     policyFiles: string[];
     hookFiles: string[];
     contentHash: string;
+    registryWorker?: RegistryPersona;
 }
 export interface WorkerProfileRuntime {
     settingsPath?: string;
@@ -41,6 +46,11 @@ export declare function personalWorkerProfileDir(hqRoot: string, id: string): st
 /** A meta.yaml file is the explicit marker for a personal worker profile. */
 export declare function workerProfileMarker(hqRoot: string, id: string): "absent" | "present";
 export declare function loadWorkerProfile(hqRoot: string, id: string, options?: LoadWorkerProfileOptions): WorkerProfile;
+export declare function loadWorkerProfileWithRegistry(hqRoot: string, id: string, options?: {
+    laneCompany?: string;
+    registryWorkerRecord?: RegistryWorkerRecord;
+    onUnknownMetaFields?: (fields: readonly string[]) => void;
+}): WorkerProfile;
 export interface EffectiveLaneKeepAlive {
     enabled: boolean;
     source: "lane" | "none";

package/dist/lib/lanes/profile.js

@@ -13,11 +13,13 @@ import { parseUserYaml } from "../../utils/user-yaml-error.js";
 import { WorkerResolutionError } from "./errors.js";
 import { PROVIDER_EFFORT_LEVELS } from "./effort.js";
 import { LANE_PROVIDERS, isLaneProvider, } from "./types.js";
+import { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 const PROFILE_META = "meta.yaml";
 const PROFILE_SYSTEM_PROMPT = "system-prompt.md";
 const PROFILE_SETTINGS = "settings.json";
 const PROFILE_POLICIES = "policies";
 const PROFILE_HOOKS = "hooks";
+export const REGISTRY_PERSONA_PROMPT_MAX_CHARS = 12_000;
 const PROFILE_META_KEYS = new Set([
     "version",
     "provider",
@@ -29,6 +31,7 @@ const PROFILE_META_KEYS = new Set([
     "source",
     "accounts",
     "keep_alive",
+    "registry_worker",
 ]);
 function isPlainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -214,6 +217,7 @@ function parseMeta(id, dir, raw, options = {}) {
         }
         accounts = raw.accounts.map((item) => item.trim());
     }
+    const registryWorker = optionalString("registry_worker");
     return {
         ...(version !== undefined ? { version } : {}),
         provider: providerValue,
@@ -225,6 +229,7 @@ function parseMeta(id, dir, raw, options = {}) {
         ...(maxConcurrent !== undefined ? { max_concurrent: maxConcurrent } : {}),
         ...(source !== undefined ? { source } : {}),
         ...(accounts !== undefined ? { accounts } : {}),
+        ...(registryWorker !== undefined ? { registry_worker: registryWorker } : {}),
     };
 }
 function validatePolicyFrontmatter(id, profileDir, relative) {
@@ -373,6 +378,39 @@ export function loadWorkerProfile(hqRoot, id, options = {}) {
         contentHash: hashProfileFiles(dir, hashFiles),
     };
 }
+export function loadWorkerProfileWithRegistry(hqRoot, id, options = {}) {
+    const profile = loadWorkerProfile(hqRoot, id, options);
+    const requestedId = profile.meta.registry_worker;
+    if (requestedId === undefined) {
+        if (options.registryWorkerRecord !== undefined) {
+            throw new WorkerResolutionError("registry_worker_invalid", `Worker profile ${JSON.stringify(id)} no longer names its recorded registry worker`, { worker: id, registry_worker: options.registryWorkerRecord.id });
+        }
+        return profile;
+    }
+    const persona = options.registryWorkerRecord !== undefined
+        ? (() => {
+            if (options.registryWorkerRecord?.id !== requestedId) {
+                throw new WorkerResolutionError("registry_worker_invalid", `Worker profile ${JSON.stringify(id)} names registry worker ${JSON.stringify(requestedId)}, but the lane records ${JSON.stringify(options.registryWorkerRecord?.id)}`, {
+                    worker: id,
+                    profile_registry_worker: requestedId,
+                    lane_registry_worker: options.registryWorkerRecord?.id,
+                });
+            }
+            return loadRegistryPersonaFromRecord(hqRoot, options.registryWorkerRecord);
+        })()
+        : resolveRegistryPersona(hqRoot, requestedId, options.laneCompany);
+    const record = registryWorkerRecord(persona);
+    const hash = createHash("sha256")
+        .update(profile.contentHash)
+        .update("\0registry_worker\0")
+        .update(JSON.stringify({ id: record.id, path: record.path, worker_yaml_sha256: record.worker_yaml_sha256 }))
+        .digest("hex");
+    return {
+        ...profile,
+        registryWorker: persona,
+        contentHash: `sha256:${hash}`,
+    };
+}
 /** Resolve keep-alive from the lane record; profile metadata only seeds new spawns. */
 export function resolveLaneKeepAlive(_hqRoot, lane) {
     return lane.keep_alive === undefined
@@ -381,6 +419,9 @@ export function resolveLaneKeepAlive(_hqRoot, lane) {
 }
 export function workerProfilePrompt(profile, delivery = "prompt") {
     const parts = [profile.systemPrompt.trimEnd()];
+    if (profile.registryWorker !== undefined) {
+        parts.push(formatRegistryWorkerPrompt(profile.registryWorker));
+    }
     if (delivery === "hook")
         return parts.join("\n");
     for (const relative of profile.policyFiles) {
@@ -389,6 +430,53 @@ export function workerProfilePrompt(profile, delivery = "prompt") {
     }
     return parts.join("\n");
 }
+function formatRegistryWorkerPrompt(persona) {
+    const lines = [
+        "## Registry worker",
+        `Description: ${persona.description}`,
+        "",
+        "Instructions:",
+        persona.instructions || "No additional instructions were supplied.",
+    ];
+    if (persona.skillFiles.length > 0) {
+        lines.push("", "Skills (path references only; do not inline these files):");
+        for (const file of persona.skillFiles)
+            lines.push(`- ${file}`);
+    }
+    if (persona.postExecute.length > 0) {
+        lines.push("", "Done criteria:");
+        for (const command of persona.postExecute)
+            lines.push(`- ${command}`);
+    }
+    const safetyLines = [];
+    if (persona.humanCheckpoints.length > 0) {
+        safetyLines.push("Human checkpoints:");
+        for (const checkpoint of persona.humanCheckpoints) {
+            safetyLines.push(`- STOP before proceeding with ${checkpoint}. Report that this checkpoint is reached to the senior and wait for approval. Do not perform the action before it is approved.`);
+        }
+    }
+    else if (persona.approvalRequired) {
+        safetyLines.push("Human checkpoint:", "- STOP before any external publish action. Report checkpoint external_publish to the senior and wait for approval. Do not perform the action before it is approved.");
+    }
+    if (persona.approvalRequired || persona.humanCheckpoints.length > 0) {
+        safetyLines.push("For an approved external action, include the exact approved checkpoint in the artifact's checkpoint field. Each approval applies to the next matching envelope only.");
+    }
+    if (safetyLines.length > 0)
+        lines.push("");
+    const complete = [...lines, ...safetyLines].join("\n");
+    if (complete.length <= REGISTRY_PERSONA_PROMPT_MAX_CHARS)
+        return complete;
+    const suffix = [
+        "",
+        `[Registry worker section truncated at ${REGISTRY_PERSONA_PROMPT_MAX_CHARS} characters; descriptive material, skill paths, or done criteria may be omitted.]`,
+        ...(safetyLines.length > 0 ? ["", ...safetyLines] : []),
+    ].join("\n");
+    const prefixBudget = REGISTRY_PERSONA_PROMPT_MAX_CHARS - suffix.length;
+    if (prefixBudget < 0) {
+        throw new WorkerResolutionError("registry_worker_invalid", `Registry worker ${JSON.stringify(persona.id)} checkpoint instructions exceed the bounded prompt limit`, { worker: persona.id, max_chars: REGISTRY_PERSONA_PROMPT_MAX_CHARS });
+    }
+    return `${lines.join("\n").slice(0, prefixBudget).trimEnd()}${suffix}`;
+}
 export function ignoredWorkerProfileFields(provider) {
     return provider === "claude" ? [] : ["settings", "hooks"];
 }

package/dist/lib/lanes/reconcile.js

@@ -11,6 +11,7 @@ import { parseUserYaml } from "../../utils/user-yaml-error.js";
 import { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, } from "./admission.js";
 import { accountStatus, isCredentialProven, resolveAccount } from "./accounts.js";
 import { effectiveAccountHome } from "./account-home.js";
+import { enforceRegistryApprovalGate } from "./approval-gate.js";
 import { loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
 import { MAX_LANE_DEPTH } from "./constants.js";
 import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./errors.js";
@@ -1059,13 +1060,22 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                         process.stderr.write(`hq lanes reconcile: terminal ask refused for ${lane.lane_id}: ${questionRefusalCode}\n`);
                     }
                 }
+                let terminalEnvelope = latest?.envelope;
+                let terminalClassification = repairedClassification;
                 const result = casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "running", (current) => {
+                    const approvalGate = latest?.envelope
+                        ? enforceRegistryApprovalGate(current, latest.envelope)
+                        : undefined;
+                    terminalEnvelope = approvalGate?.envelope ?? latest?.envelope;
+                    terminalClassification = approvalGate?.violation
+                        ? { state: "blocked", reason: "approval_gate_violated" }
+                        : repairedClassification;
                     const next = {
                         ...current,
-                        state: repairedClassification.state,
+                        state: terminalClassification.state,
                         queued_reason: undefined,
-                        terminal_reason: repairedClassification.reason ?? "host_lost",
-                        interrupted_at: repairedClassification.state === "interrupted" ? nowIso : undefined,
+                        terminal_reason: terminalClassification.reason ?? "host_lost",
+                        interrupted_at: terminalClassification.state === "interrupted" ? nowIso : undefined,
                         ...(providerRejection
                             ? { terminal_details: providerRejectionDetails(providerRejection, current) }
                             : {}),
@@ -1073,8 +1083,16 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                         ...(quota?.marker ? { model_quota_marker: quota.marker } : {}),
                         last_host_report_at: nowIso,
                     };
-                    if (latest?.envelope) {
-                        const envelope = latest.envelope;
+                    if (approvalGate && !approvalGate.violation && approvalGate.approvedIdsToConsume.length > 0) {
+                        next.registry_worker_approval_history = approvalGate.approvedIdsToConsume.reduce((history, approvalId) => appendCappedHistory(history, {
+                            event: "consumed",
+                            approval_id: approvalId,
+                            envelope_ref: latest.ref,
+                            at: nowIso,
+                        }), current.registry_worker_approval_history ?? []);
+                    }
+                    if (terminalEnvelope && latest) {
+                        const envelope = terminalEnvelope;
                         next.story_status = envelope.story_status;
                         if (envelope.story_complete !== undefined) {
                             next.story_complete = envelope.story_complete;
@@ -1095,6 +1113,15 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                                     : { blocked_reason: undefined }),
                             }
                             : story);
+                        if (approvalGate?.violation) {
+                            next.last_envelope = {
+                                ref: latest.ref,
+                                decision: envelope.decision,
+                                at: nowIso,
+                                artifacts: envelope.artifacts,
+                                blocked_reason: envelope.blocked_reason,
+                            };
+                        }
                     }
                     return next;
                 }, deps.dryRun);
@@ -1102,20 +1129,20 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     summary.dead_host.push({
                         id: lane.lane_id,
                         from: "running",
-                        to: repairedClassification.state,
-                        reason: repairedClassification.reason ?? "host_lost",
+                        to: terminalClassification.state,
+                        reason: terminalClassification.reason ?? "host_lost",
                     });
-                    if (latest?.envelope && questionRefusalCode === null) {
+                    if (terminalEnvelope && latest && questionRefusalCode === null) {
                         const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
                         if (mesh) {
                             const meshEmitTimeoutMs = deps.meshEmitTimeoutMs ?? 10_000;
                             let timer;
                             try {
-                                const questionIds = latest.envelope.decision === "ask"
-                                    ? envelopeQuestionIds(lane.lane_id, latest.ref, latest.envelope)
+                                const questionIds = terminalEnvelope.decision === "ask"
+                                    ? envelopeQuestionIds(lane.lane_id, latest.ref, terminalEnvelope)
                                     : undefined;
                                 await Promise.race([
-                                    emitLaneDecisionEvents(mesh, result.record, latest.envelope, { questionIds }),
+                                    emitLaneDecisionEvents(mesh, result.record, terminalEnvelope, { questionIds }),
                                     new Promise((_resolve, reject) => {
                                         timer = setTimeout(() => reject(new Error(`terminal mesh emit timed out after ${meshEmitTimeoutMs}ms`)), meshEmitTimeoutMs);
                                     }),

package/dist/lib/lanes/registry-persona.d.ts

@@ -0,0 +1,20 @@
+import type { RegistryWorkerRecord } from "./types.js";
+export interface RegistryPersona {
+    id: string;
+    /** Registry-relative worker directory. Kept for stable resume resolution. */
+    path: string;
+    workerYamlSha256: string;
+    description: string;
+    instructions: string;
+    /** Skill files are path references only. Their contents are never inlined. */
+    skillFiles: string[];
+    postExecute: string[];
+    approvalRequired: boolean;
+    humanCheckpoints: string[];
+}
+/** Resolve an active registry worker for a lane without company fallback. */
+export declare function resolveRegistryPersona(hqRoot: string, id: string, laneCompany: string | undefined): RegistryPersona;
+/** Re-read the recorded path on resume; registry changes cannot redirect a lane. */
+export declare function loadRegistryPersonaFromRecord(hqRoot: string, record: RegistryWorkerRecord): RegistryPersona;
+export declare function registryWorkerRecord(persona: RegistryPersona): RegistryWorkerRecord;
+//# sourceMappingURL=registry-persona.d.ts.map