@indigoai-us/hq-cli 5.239.0 → 5.240.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.240.0] — 2026-09-27
+
+### Added
+
+- `hq lanes` worker profiles can pin a registry persona from `worker.yaml`.
+  The composed prompt includes the worker's instructions, skill paths, done
+  criteria, and stop checkpoints. Registry approval requirements are passed to
+  workers, enforced on external-action envelopes, and recorded through the new
+  senior-only `hq lanes approve` command.
+
 ## [5.239.0] — 2026-09-27
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -7507,6 +7507,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve-target";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--approval-context <base64url>";
+            readonly description: "Primary-authorized registry worker approval";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "reparent-target";
         readonly description: "";
@@ -8193,6 +8212,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve";
+        readonly description: "Record senior approval for a registry worker checkpoint";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--checkpoint <name>";
+            readonly description: "Exact registry worker checkpoint name";
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Why the checkpoint is approved";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "ask";
         readonly description: "Queue a mid-run question without blocking the lane";

package/dist/command-catalog.generated.js

@@ -9705,6 +9705,31 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve-target",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--approval-context <base64url>",
+                        "description": "Primary-authorized registry worker approval"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "reparent-target",
                 "description": "",
@@ -10601,6 +10626,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve",
+                "description": "Record senior approval for a registry worker checkpoint",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--checkpoint <name>",
+                        "description": "Exact registry worker checkpoint name"
+                    },
+                    {
+                        "flags": "--reason <text>",
+                        "description": "Why the checkpoint is approved"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "ask",
                 "description": "Queue a mid-run question without blocking the lane",

package/dist/commands/lanes.js

@@ -24,6 +24,7 @@ import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
+import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostQuestionAnswerCommand, buildOutpostQuestionListCommand, buildOutpostQuestionShowCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
@@ -40,7 +41,7 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { keepAliveExclusion, LEAD_LANE_KEEP_ALIVE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
@@ -3059,6 +3060,9 @@ async function runCreate(ctx, opts) {
                     worker_profile: profile.id,
                     worker_profile_hash: profile.contentHash,
                     worker_profile_ignored: ignoredWorkerProfileFields(provider),
+                    ...(profile.registryWorker !== undefined
+                        ? { registry_worker: registryWorkerRecord(profile.registryWorker) }
+                        : {}),
                 }
                 : {}),
             keep_alive: keepAlive,
@@ -3470,7 +3474,12 @@ function verifyOutpostProfileContent(hqRoot, lane) {
     if (lane.host.kind !== "outpost" || lane.worker_profile === undefined)
         return;
     const expectedHash = lane.worker_profile_hash;
-    const profile = loadWorkerProfile(hqRoot, lane.worker_profile);
+    const profile = loadWorkerProfileWithRegistry(hqRoot, lane.worker_profile, {
+        laneCompany: lane.company?.slug ?? lane.mesh_company?.slug,
+        ...(lane.registry_worker !== undefined
+            ? { registryWorkerRecord: lane.registry_worker }
+            : {}),
+    });
     if (expectedHash !== profile.contentHash) {
         throw new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(lane.worker_profile)} on Outpost ${lane.host.id} does not match the hash recorded by the creator`, {
             lane_id: lane.lane_id,
@@ -3692,7 +3701,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                     ? "grant-target"
                     : action === "reparent"
                         ? "reparent-target"
-                        : action,
+                        : action === "approve"
+                            ? "approve-target"
+                            : action,
                 laneId: lane.lane_id,
                 hqBinary: action === "grant" || action === "reparent"
                     ? outpostCliOverride(ctx, outpostId)
@@ -3712,6 +3723,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 grantContext: contexts.grantContext,
                 profileRepinContext: contexts.profileRepinContext,
                 failedResumeContext: contexts.failedResumeContext,
+                approvalContext: options.approvalContext,
                 compact: options.compact,
             }),
         });
@@ -3820,17 +3832,20 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             ? remote.accepted === true
             : action === "grant"
                 ? remote.hire_grant === Number(options.hire)
-                : action === "reparent"
-                    ? remote.lane !== null && typeof remote.lane === "object" &&
-                        Array.isArray(remote.changed_descendant_ids)
-                    : (((remote.delivery_status === "worker_spawned" ||
-                        remote.delivery_status === "queued_on_target_account") &&
-                        remote.lane !== undefined) ||
-                        (remote.delivery_status === "queued_on_admission" &&
-                            remote.lane !== null &&
-                            typeof remote.lane === "object" &&
-                            !Array.isArray(remote.lane) &&
-                            remote.lane.state === "queued")));
+                : action === "approve"
+                    ? remote.checkpoint === options.checkpoint &&
+                        remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane)
+                    : action === "reparent"
+                        ? remote.lane !== null && typeof remote.lane === "object" &&
+                            Array.isArray(remote.changed_descendant_ids)
+                        : (((remote.delivery_status === "worker_spawned" ||
+                            remote.delivery_status === "queued_on_target_account") &&
+                            remote.lane !== undefined) ||
+                            (remote.delivery_status === "queued_on_admission" &&
+                                remote.lane !== null &&
+                                typeof remote.lane === "object" &&
+                                !Array.isArray(remote.lane) &&
+                                remote.lane.state === "queued")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3866,7 +3881,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
-    if (action === "reparent" || action === "resume") {
+    if (action === "approve" || action === "reparent" || action === "resume") {
         const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
         const descendants = [];
         if (action === "reparent") {
@@ -5189,6 +5204,141 @@ async function runGrant(ctx, laneId, opts) {
     const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
     printGrantResult(hqRoot, updated);
 }
+async function runApprove(ctx, laneId, opts) {
+    const checkpoint = opts.checkpoint?.trim();
+    const reason = opts.reason?.trim();
+    if (!checkpoint) {
+        throw new LanesError("registry_worker_checkpoint_required", "--checkpoint requires a non-empty checkpoint name", { lane_id: laneId });
+    }
+    if (!reason) {
+        throw new LanesError("registry_worker_approval_reason_required", "--reason requires a non-empty explanation", { lane_id: laneId });
+    }
+    assertNoSecretText("approval reason", reason);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    const remoteOutpost = initial.host.kind === "outpost" && !laneIsHostedHere(ctx, initial);
+    if (!initial.registry_worker ||
+        (!initial.registry_worker.approval_required && initial.registry_worker.human_checkpoints.length === 0)) {
+        throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+    }
+    const allowed = initial.registry_worker.human_checkpoints.length > 0
+        ? initial.registry_worker.human_checkpoints
+        : ["external_publish"];
+    if (!allowed.includes(checkpoint)) {
+        throw new LanesError("registry_worker_checkpoint_unknown", `Checkpoint ${JSON.stringify(checkpoint)} is not declared by the lane's registry worker`, { lane_id: laneId, checkpoint, accepted: allowed });
+    }
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(initial.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (remoteOutpost) {
+        const approvalContext = createOutpostRegistryWorkerApprovalContext({
+            lane_id: initial.lane_id,
+            expected_senior: initial.senior,
+            actor: resumeProfileRepinActor(ctx),
+            checkpoint,
+            reason,
+            approval_id: randomBytes(16).toString("hex"),
+            registry_worker_id: initial.registry_worker.id,
+            worker_yaml_sha256: initial.registry_worker.worker_yaml_sha256,
+            at: ctx.now().toISOString(),
+        });
+        await dispatchOutpostLaneCommand(ctx, initial, "approve", {
+            approvalContext,
+            checkpoint,
+        });
+        return;
+    }
+    assertLaneRunsHereForOperatorMutation(ctx, initial, "approve");
+    const approvalId = randomBytes(16).toString("hex");
+    const at = ctx.now().toISOString();
+    const actor = resumeProfileRepinActor(ctx);
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "approve");
+        if (!callerMatchesSenior(ctx, current.senior)) {
+            throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(current.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: current.senior });
+        }
+        if (JSON.stringify(current.registry_worker) !== JSON.stringify(initial.registry_worker) ||
+            !current.registry_worker ||
+            !current.registry_worker.human_checkpoints.concat(current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0
+                ? ["external_publish"]
+                : []).includes(checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker approval contract changed before the checkpoint was recorded`, { lane_id: laneId });
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(current.registry_worker_approval_history ?? [], {
+                event: "approved",
+                approval_id: approvalId,
+                checkpoint,
+                registry_worker_id: current.registry_worker.id,
+                worker_yaml_sha256: current.registry_worker.worker_yaml_sha256,
+                reason,
+                actor,
+                at,
+            }),
+        };
+    });
+    printJson({ ok: true, action: "approve", lane_id: laneId, checkpoint, lane: updated });
+}
+async function runApproveOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("registry_worker_approval_dispatch_unauthorized", "The Outpost approval target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.approvalContext === undefined) {
+        throw new LanesError("registry_worker_approval_context_invalid", "--approval-context is required on the Outpost owner target", { lane_id: laneId });
+    }
+    const authorization = parseOutpostRegistryWorkerApprovalContext(opts.approvalContext, laneId);
+    assertNoSecretText("approval reason", authorization.reason);
+    const hqRoot = ctx.hqRoot();
+    const validateOwnerState = (current) => {
+        if (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current)) {
+            throw new LanesError("lane_remote", `Outpost approval target cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (!sameHireGrantSenior(current.senior, authorization.expected_senior) ||
+            current.registry_worker?.id !== authorization.registry_worker_id ||
+            current.registry_worker.worker_yaml_sha256 !== authorization.worker_yaml_sha256) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s senior or registry worker changed after approval was authorized`, { lane_id: laneId });
+        }
+        if (!current.registry_worker ||
+            (!current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0)) {
+            throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+        }
+        const allowed = current.registry_worker.human_checkpoints.length > 0
+            ? current.registry_worker.human_checkpoints
+            : ["external_publish"];
+        if (!allowed.includes(authorization.checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker no longer declares checkpoint ${JSON.stringify(authorization.checkpoint)}`, { lane_id: laneId, checkpoint: authorization.checkpoint });
+        }
+    };
+    validateOwnerState(readLane(hqRoot, laneId));
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        validateOwnerState(current);
+        const history = current.registry_worker_approval_history ?? [];
+        if (history.some((entry) => entry.event === "approved" && entry.approval_id === authorization.approval_id)) {
+            return current;
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(history, {
+                event: "approved",
+                approval_id: authorization.approval_id,
+                checkpoint: authorization.checkpoint,
+                registry_worker_id: authorization.registry_worker_id,
+                worker_yaml_sha256: authorization.worker_yaml_sha256,
+                reason: authorization.reason,
+                actor: authorization.actor,
+                at: authorization.at,
+            }),
+        };
+    });
+    printJson({
+        ok: true,
+        action: "approve",
+        lane_id: laneId,
+        checkpoint: authorization.checkpoint,
+        lane: updated,
+    });
+}
 async function runGrantOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
         throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
@@ -5350,7 +5500,9 @@ async function runAdmit(ctx, laneId, opts) {
     }, ctx.sleep);
 }
 function resolveResumeProfile(ctx, lane, workerId) {
-    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug);
+    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug, undefined, lane.worker_profile === workerId.trim() && lane.registry_worker !== undefined
+        ? { registryWorkerRecord: lane.registry_worker }
+        : {});
     if (worker.profile === undefined) {
         throw new LanesError("worker_profile_required", `Worker ${JSON.stringify(workerId)} resolves to a registry worker, not a reusable provider profile; resume --worker requires personal/workers/<id>/meta.yaml`, { worker: workerId, path: worker.path });
     }
@@ -5393,6 +5545,9 @@ function applyResumeProfileAndEffort(current, next, input) {
         next.worker_pack = input.profile.pack;
         next.worker_profile = profile.id;
         next.worker_profile_hash = profile.contentHash;
+        next.registry_worker = profile.registryWorker !== undefined
+            ? registryWorkerRecord(profile.registryWorker)
+            : undefined;
         if (input.profileRepin !== undefined &&
             current.host.kind === "outpost" &&
             current.worker_profile_hash !== profile.contentHash) {
@@ -9282,6 +9437,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("approve-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--approval-context <base64url>", "Primary-authorized registry worker approval")
+        .action(wrap(async (laneId, opts) => {
+        await runApproveOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("reparent-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
@@ -9581,6 +9743,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, options) => {
         await runStop(ctx, laneId, options.reason);
     }));
+    lanes
+        .command("approve")
+        .description("Record senior approval for a registry worker checkpoint")
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--checkpoint <name>", "Exact registry worker checkpoint name")
+        .requiredOption("--reason <text>", "Why the checkpoint is approved")
+        .action(wrap(async (laneId, opts) => {
+        await runApprove(ctx, laneId, opts);
+    }));
     lanes
         .command("ask")
         .description("Queue a mid-run question without blocking the lane")

package/dist/lib/lanes/approval-gate.d.ts

@@ -0,0 +1,8 @@
+import type { LaneEnvelope, LaneRecord } from "./types.js";
+export interface RegistryApprovalGateResult {
+    envelope: LaneEnvelope;
+    approvedIdsToConsume: string[];
+    violation: boolean;
+}
+export declare function enforceRegistryApprovalGate(lane: LaneRecord, envelope: LaneEnvelope): RegistryApprovalGateResult;
+//# sourceMappingURL=approval-gate.d.ts.map

package/dist/lib/lanes/approval-gate.js

@@ -0,0 +1,90 @@
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function text(value) {
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
+}
+function externalActionCheckpoint(artifactValue) {
+    const artifact = record(artifactValue);
+    if (!artifact)
+        return undefined;
+    const kind = (text(artifact.kind) ?? text(artifact.type) ?? "").toLowerCase().replace(/[\s-]+/g, "_");
+    const status = (text(artifact.status) ?? text(artifact.state) ?? "").toLowerCase();
+    const hasDate = (...keys) => keys.some((key) => text(artifact[key]) !== undefined);
+    const url = text(artifact.url) ?? "";
+    const mergedPr = (["pr", "pull_request", "merged_pr"].includes(kind) ||
+        /\/(?:pull|pulls|merge_requests)\/\d+(?:\/|$)/i.test(url)) &&
+        (status === "merged" || artifact.merged === true || hasDate("merged_at")) ||
+        artifact.merged === true || status === "merged";
+    const pushedTag = (["tag", "git_tag"].includes(kind) ||
+        text(artifact.tag) !== undefined || text(artifact.tag_name) !== undefined) &&
+        (status === "pushed" || artifact.pushed === true || hasDate("pushed_at"));
+    const publishedPackage = (["package", "npm_package", "published_package"].includes(kind) ||
+        text(artifact.package) !== undefined || text(artifact.package_name) !== undefined) &&
+        (status === "published" || artifact.published === true || hasDate("published_at"));
+    const deployment = ["deploy", "deployment", "deployed"].includes(kind) &&
+        (status === "" || ["deployed", "success", "succeeded", "successful", "complete", "completed", "live"].includes(status) ||
+            artifact.deployed === true || hasDate("deployed_at"));
+    if (!mergedPr && !pushedTag && !publishedPackage && !deployment)
+        return undefined;
+    return text(artifact.checkpoint) ?? null;
+}
+function approvedEvents(history, workerId, workerYamlSha256) {
+    const consumed = new Set(history.flatMap((entry) => entry.event === "consumed" ? [entry.approval_id] : []));
+    return history.filter((entry) => entry.event === "approved" &&
+        entry.registry_worker_id === workerId &&
+        entry.worker_yaml_sha256 === workerYamlSha256 &&
+        !consumed.has(entry.approval_id));
+}
+export function enforceRegistryApprovalGate(lane, envelope) {
+    const registryWorker = lane.registry_worker;
+    const gateEnabled = registryWorker !== undefined &&
+        (registryWorker.approval_required || registryWorker.human_checkpoints.length > 0);
+    if (!gateEnabled || envelope.decision !== "done") {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const actionCheckpoints = envelope.artifacts
+        .map(externalActionCheckpoint)
+        .filter((checkpoint) => checkpoint !== undefined);
+    if (actionCheckpoints.length === 0) {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const missingCheckpoint = actionCheckpoints.includes(null);
+    const requiredCheckpoints = [...new Set(actionCheckpoints.filter((checkpoint) => checkpoint !== null))];
+    const configuredCheckpoints = registryWorker.human_checkpoints.length > 0
+        ? new Set(registryWorker.human_checkpoints)
+        : new Set(["external_publish"]);
+    const approvals = approvedEvents(lane.registry_worker_approval_history ?? [], registryWorker.id, registryWorker.worker_yaml_sha256);
+    const used = [];
+    const missing = missingCheckpoint ? ["(checkpoint missing)"] : [];
+    for (const checkpoint of requiredCheckpoints) {
+        if (!configuredCheckpoints.has(checkpoint)) {
+            missing.push(checkpoint);
+            continue;
+        }
+        const approval = approvals.find((entry) => entry.checkpoint === checkpoint && !used.includes(entry.approval_id));
+        if (!approval)
+            missing.push(checkpoint);
+        else
+            used.push(approval.approval_id);
+    }
+    if (missing.length === 0) {
+        return { envelope, approvedIdsToConsume: used, violation: false };
+    }
+    return {
+        envelope: {
+            ...envelope,
+            decision: "blocked",
+            summary: `External action requires senior approval at checkpoint: ${missing.join(", ")}.`,
+            story_status: "review",
+            blocked_reason: "approval_gate_violated",
+            story_complete: false,
+            story_complete_reason: "The reported external action has no matching recorded approval.",
+        },
+        approvedIdsToConsume: [],
+        violation: true,
+    };
+}
+//# sourceMappingURL=approval-gate.js.map

package/dist/lib/lanes/errors.d.ts

@@ -34,6 +34,6 @@ export declare class AccountResolutionError extends LanesError {
     constructor(error: "unknown_account" | "account_disabled" | "no_enabled_account" | "account_model_unavailable" | "account_quota_exhausted", message: string, details?: Record<string, unknown>);
 }
 export declare class WorkerResolutionError extends LanesError {
-    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable", message: string, details?: Record<string, unknown>);
+    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable" | "registry_worker_not_found" | "registry_worker_company_mismatch" | "registry_worker_inactive" | "registry_worker_invalid" | "registry_worker_unreadable" | "registry_worker_ambiguous", message: string, details?: Record<string, unknown>);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/lanes/index.d.ts

@@ -56,8 +56,10 @@ export type { KnownModels, KnownModelsDeps, ProbeCommand, ProbeResult } from "./
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export type { SessionCopyPlan, SessionCopyResult } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export type { WorkerProfile, WorkerProfileMeta, WorkerProfileRuntime, } from "./profile.js";
+export type { RegistryPersona } from "./registry-persona.js";
 export type { RegistryWorkerEntry, ResolvedLaneWorker, WorkerTenancy, WorkerYaml, } from "./registry.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export type { QuestionBody, RaiseLaneQuestionInput } from "./questions.js";

package/dist/lib/lanes/index.js

@@ -31,7 +31,8 @@ export { PROVIDER_REJECTED_REASON, PROVIDER_REJECTION_MESSAGE_CAP, parseClaudeRe
 export { CODEX_MODELS_CACHE_NAME, MODEL_PROBE_TIMEOUT_MS, claudeKnownModels, codexKnownModels, defaultProbe, grokKnownModels, knownModels, modelIsKnown, parseClaudeHelpModels, parseGrokModelsOutput, validateLaneModel, } from "./models.js";
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export { LANE_DELIVERY_MECHANISMS, LAUNCH_TRIGGERS, PROVIDER_SESSION_RESUME, PROVIDER_SESSION_PORTABLE, providerSessionPortable, sessionNotPortableMessage, parseGrokResultOutput, RESUMABLE_LANE_STATES, RESUME_COMMAND_STATES, SESSION_ID_ABSENT_REASONS, claimableStatesFor, deliveryRefusalReason, hasRecordedSessionId, isResumableLaneState, isResumeCommandState, laneDeliveryMechanism, parseClaudeResultOutput, parseCodexEventOutput, parseWorkerRunOutput, planLaneLaunch, providerSupportsSessionResume, readWorkerRunResult, resumeCommandRefusal, } from "./delivery.js";
 export { DROPBOX_DIR, INBOX_NAME, appendDropboxMessage, answerDropboxMessage, drainDropbox, dropboxDir, dropboxInboxPath, formatOperatorInstruction, hookAdditionalContextJson, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneIdForAnswerDelivery, operatorMessageRefusalReason, readToolActivity, recordToolActivity, runDrainHook, toolActivityPath, TOOL_ACTIVITY_NAME, } from "./dropbox.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target" | "approve-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -43,6 +43,7 @@ export interface OutpostLaneCommand {
     hire?: string;
     grantContext?: string;
     profileRepinContext?: string;
+    approvalContext?: string;
     senior?: string;
     reason?: string;
     compact?: boolean;

package/dist/lib/lanes/outpost-dispatch.js

@@ -151,6 +151,7 @@ export function buildOutpostLaneCommand(input) {
         ["--hire", input.hire],
         ["--grant-context", input.grantContext],
         ["--profile-repin-context", input.profileRepinContext],
+        ["--approval-context", input.approvalContext],
         ["--failed-resume-context", input.failedResumeContext],
         ["--senior", input.senior],
         ["--reason", input.reason],

package/dist/lib/lanes/outpost-registry-worker-approval.d.ts

@@ -0,0 +1,18 @@
+import { type SeniorRef } from "./types.js";
+declare const APPROVAL_CONTEXT_SCHEMA: "hq-lane-registry-worker-approval-context.v1";
+export interface OutpostRegistryWorkerApprovalContext {
+    schema_version: typeof APPROVAL_CONTEXT_SCHEMA;
+    lane_id: string;
+    expected_senior: SeniorRef;
+    actor: string;
+    checkpoint: string;
+    reason: string;
+    approval_id: string;
+    registry_worker_id: string;
+    worker_yaml_sha256: string;
+    at: string;
+}
+export declare function createOutpostRegistryWorkerApprovalContext(input: Omit<OutpostRegistryWorkerApprovalContext, "schema_version">): string;
+export declare function parseOutpostRegistryWorkerApprovalContext(encoded: string, expectedLaneId: string): OutpostRegistryWorkerApprovalContext;
+export {};
+//# sourceMappingURL=outpost-registry-worker-approval.d.ts.map