@indigoai-us/hq-cli 5.239.0 → 5.241.0

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [5.241.0] — 2026-09-27
+
+### Fixed
+
+- A bot whose only persistent storage is a network share can now enroll.
+  Enrollment wrote its credentials and then locked them to the owner, and on
+  a CIFS/SMB share mounted with a fixed file mode — Azure Files is the one
+  that found this — that last step fails outright. Enrollment died there,
+  left a temp file holding the private key behind, and offered no way
+  forward: the only writable alternative was storage a container rebuild
+  erases.
+
+  The write now reports whether owner-only permissions actually took, rather
+  than assuming they did, and `hq agent enroll` says plainly when they did
+  not: the credential is readable by anything else with access to that
+  share. The file is still requested owner-only, the result is read back
+  from the filesystem instead of trusted, a refused chmod on ordinary
+  storage still fails loudly, and a failed write no longer leaves the secret
+  behind in a temp file.
+- Resume can keep a lane on its recorded account when it uses a CLI-selected
+  model, even if that account's configured default differs. A lane without an
+  account allowlist may use any otherwise eligible account.
+- With a worker-profile account pin, resume keeps a healthy recorded account
+  that is allowed by the pin even when the pin includes other accounts and the
+  recorded account's default differs from the lane's CLI-selected model.
+
+## [5.240.0] — 2026-09-27
+
+### Added
+
+- `hq lanes` worker profiles can pin a registry persona from `worker.yaml`.
+  The composed prompt includes the worker's instructions, skill paths, done
+  criteria, and stop checkpoints. Registry approval requirements are passed to
+  workers, enforced on external-action envelopes, and recorded through the new
+  senior-only `hq lanes approve` command.
+
 ## [5.239.0] — 2026-09-27
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -7507,6 +7507,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve-target";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--approval-context <base64url>";
+            readonly description: "Primary-authorized registry worker approval";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "reparent-target";
         readonly description: "";
@@ -8193,6 +8212,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "approve";
+        readonly description: "Record senior approval for a registry worker checkpoint";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--checkpoint <name>";
+            readonly description: "Exact registry worker checkpoint name";
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Why the checkpoint is approved";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "ask";
         readonly description: "Queue a mid-run question without blocking the lane";

package/dist/command-catalog.generated.js

@@ -9705,6 +9705,31 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve-target",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--approval-context <base64url>",
+                        "description": "Primary-authorized registry worker approval"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "reparent-target",
                 "description": "",
@@ -10601,6 +10626,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "approve",
+                "description": "Record senior approval for a registry worker checkpoint",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--checkpoint <name>",
+                        "description": "Exact registry worker checkpoint name"
+                    },
+                    {
+                        "flags": "--reason <text>",
+                        "description": "Why the checkpoint is approved"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "ask",
                 "description": "Queue a mid-run question without blocking the lane",

package/dist/commands/agent-enroll.d.ts

@@ -129,6 +129,14 @@ export interface EnrollResult {
     companyMismatch?: string;
     /** True when this enrolled beside a person's session in its own directory. */
     local: boolean;
+    /**
+     * False when the filesystem could not make the credential owner-only — a
+     * share mounted with a fixed file_mode. The identity works; anything else
+     * with access to that share can read it.
+     */
+    permissionsEnforced: boolean;
+    /** errno of the refused chmod, when there was one (EPERM on Azure Files). */
+    permissionsError?: string;
     /** The tree this identity lives in. */
     agentDir: string;
 }

package/dist/commands/agent-enroll.js

@@ -252,7 +252,7 @@ export async function enrollHost(opts, deps = {}) {
     // server can bind the code to it, and a failed call leaves a harmless
     // unenrolled key behind (regenerated on the next attempt).
     const pair = (deps.generateKeyPair ?? generateHostKeyPair)();
-    writeHostKeyPair(paths, pair);
+    const keyWrite = writeHostKeyPair(paths, pair);
     let res;
     try {
         res = await doFetch(`${apiBaseUrl}${ENROLL_PATH}`, {
@@ -290,8 +290,12 @@ export async function enrollHost(opts, deps = {}) {
         companySlug: parsed.companySlug,
         apiBaseUrl,
     };
-    writeMachineCreds(paths, creds);
+    const credsWrite = writeMachineCreds(paths, creds);
+    const enforced = keyWrite.enforced && credsWrite.enforced;
+    const permissionsError = keyWrite.chmodError ?? credsWrite.chmodError;
     return {
+        permissionsEnforced: enforced,
+        ...(permissionsError ? { permissionsError } : {}),
         local: target.local,
         agentDir: paths.agentDir,
         agentUid: parsed.agentUid,
@@ -305,6 +309,10 @@ export async function enrollHost(opts, deps = {}) {
             : {}),
     };
 }
+/** Directory label for the permissions note — never the credential itself. */
+function paths_agentDirLabel() {
+    return agentKitPaths(os.homedir(), process.env).agentDir;
+}
 export function registerAgentEnrollCommand(agent) {
     agent
         .command("enroll <code>")
@@ -330,6 +338,15 @@ export function registerAgentEnrollCommand(agent) {
                     `  directory beside them: ${result.agentDir}. Their session was not read or changed.\n` +
                     `  Every hq agent command finds this tree on its own — no environment to set.`));
             }
+            if (!result.permissionsEnforced) {
+                // Not a warning to bury: the credential is on disk and working,
+                // but this filesystem cannot keep it to one owner.
+                console.log(chalk.yellow(`  note: this filesystem could not make the credential owner-only` +
+                    `${result.permissionsError ? ` (chmod: ${result.permissionsError})` : ""}.\n` +
+                    `        Anything with access to ${paths_agentDirLabel()} can read it. That is\n` +
+                    `        usually a network share mounted with a fixed file_mode. Keep the\n` +
+                    `        share itself restricted, or move the identity to local storage.`));
+            }
             console.log(`  host fingerprint: ${result.hostFingerprint}`);
             console.log(`  credentials:      ${result.credsPath} (0600)`);
             console.log(`  host key:         ${result.hostKeyPath} (0600)`);

package/dist/commands/lanes.js

@@ -24,6 +24,7 @@ import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
+import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostQuestionAnswerCommand, buildOutpostQuestionListCommand, buildOutpostQuestionShowCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
@@ -40,7 +41,7 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { keepAliveExclusion, LEAD_LANE_KEEP_ALIVE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
@@ -3059,6 +3060,9 @@ async function runCreate(ctx, opts) {
                     worker_profile: profile.id,
                     worker_profile_hash: profile.contentHash,
                     worker_profile_ignored: ignoredWorkerProfileFields(provider),
+                    ...(profile.registryWorker !== undefined
+                        ? { registry_worker: registryWorkerRecord(profile.registryWorker) }
+                        : {}),
                 }
                 : {}),
             keep_alive: keepAlive,
@@ -3470,7 +3474,12 @@ function verifyOutpostProfileContent(hqRoot, lane) {
     if (lane.host.kind !== "outpost" || lane.worker_profile === undefined)
         return;
     const expectedHash = lane.worker_profile_hash;
-    const profile = loadWorkerProfile(hqRoot, lane.worker_profile);
+    const profile = loadWorkerProfileWithRegistry(hqRoot, lane.worker_profile, {
+        laneCompany: lane.company?.slug ?? lane.mesh_company?.slug,
+        ...(lane.registry_worker !== undefined
+            ? { registryWorkerRecord: lane.registry_worker }
+            : {}),
+    });
     if (expectedHash !== profile.contentHash) {
         throw new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(lane.worker_profile)} on Outpost ${lane.host.id} does not match the hash recorded by the creator`, {
             lane_id: lane.lane_id,
@@ -3692,7 +3701,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                     ? "grant-target"
                     : action === "reparent"
                         ? "reparent-target"
-                        : action,
+                        : action === "approve"
+                            ? "approve-target"
+                            : action,
                 laneId: lane.lane_id,
                 hqBinary: action === "grant" || action === "reparent"
                     ? outpostCliOverride(ctx, outpostId)
@@ -3712,6 +3723,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 grantContext: contexts.grantContext,
                 profileRepinContext: contexts.profileRepinContext,
                 failedResumeContext: contexts.failedResumeContext,
+                approvalContext: options.approvalContext,
                 compact: options.compact,
             }),
         });
@@ -3820,17 +3832,20 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             ? remote.accepted === true
             : action === "grant"
                 ? remote.hire_grant === Number(options.hire)
-                : action === "reparent"
-                    ? remote.lane !== null && typeof remote.lane === "object" &&
-                        Array.isArray(remote.changed_descendant_ids)
-                    : (((remote.delivery_status === "worker_spawned" ||
-                        remote.delivery_status === "queued_on_target_account") &&
-                        remote.lane !== undefined) ||
-                        (remote.delivery_status === "queued_on_admission" &&
-                            remote.lane !== null &&
-                            typeof remote.lane === "object" &&
-                            !Array.isArray(remote.lane) &&
-                            remote.lane.state === "queued")));
+                : action === "approve"
+                    ? remote.checkpoint === options.checkpoint &&
+                        remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane)
+                    : action === "reparent"
+                        ? remote.lane !== null && typeof remote.lane === "object" &&
+                            Array.isArray(remote.changed_descendant_ids)
+                        : (((remote.delivery_status === "worker_spawned" ||
+                            remote.delivery_status === "queued_on_target_account") &&
+                            remote.lane !== undefined) ||
+                            (remote.delivery_status === "queued_on_admission" &&
+                                remote.lane !== null &&
+                                typeof remote.lane === "object" &&
+                                !Array.isArray(remote.lane) &&
+                                remote.lane.state === "queued")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3866,7 +3881,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
-    if (action === "reparent" || action === "resume") {
+    if (action === "approve" || action === "reparent" || action === "resume") {
         const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
         const descendants = [];
         if (action === "reparent") {
@@ -5189,6 +5204,141 @@ async function runGrant(ctx, laneId, opts) {
     const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
     printGrantResult(hqRoot, updated);
 }
+async function runApprove(ctx, laneId, opts) {
+    const checkpoint = opts.checkpoint?.trim();
+    const reason = opts.reason?.trim();
+    if (!checkpoint) {
+        throw new LanesError("registry_worker_checkpoint_required", "--checkpoint requires a non-empty checkpoint name", { lane_id: laneId });
+    }
+    if (!reason) {
+        throw new LanesError("registry_worker_approval_reason_required", "--reason requires a non-empty explanation", { lane_id: laneId });
+    }
+    assertNoSecretText("approval reason", reason);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    const remoteOutpost = initial.host.kind === "outpost" && !laneIsHostedHere(ctx, initial);
+    if (!initial.registry_worker ||
+        (!initial.registry_worker.approval_required && initial.registry_worker.human_checkpoints.length === 0)) {
+        throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+    }
+    const allowed = initial.registry_worker.human_checkpoints.length > 0
+        ? initial.registry_worker.human_checkpoints
+        : ["external_publish"];
+    if (!allowed.includes(checkpoint)) {
+        throw new LanesError("registry_worker_checkpoint_unknown", `Checkpoint ${JSON.stringify(checkpoint)} is not declared by the lane's registry worker`, { lane_id: laneId, checkpoint, accepted: allowed });
+    }
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(initial.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (remoteOutpost) {
+        const approvalContext = createOutpostRegistryWorkerApprovalContext({
+            lane_id: initial.lane_id,
+            expected_senior: initial.senior,
+            actor: resumeProfileRepinActor(ctx),
+            checkpoint,
+            reason,
+            approval_id: randomBytes(16).toString("hex"),
+            registry_worker_id: initial.registry_worker.id,
+            worker_yaml_sha256: initial.registry_worker.worker_yaml_sha256,
+            at: ctx.now().toISOString(),
+        });
+        await dispatchOutpostLaneCommand(ctx, initial, "approve", {
+            approvalContext,
+            checkpoint,
+        });
+        return;
+    }
+    assertLaneRunsHereForOperatorMutation(ctx, initial, "approve");
+    const approvalId = randomBytes(16).toString("hex");
+    const at = ctx.now().toISOString();
+    const actor = resumeProfileRepinActor(ctx);
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "approve");
+        if (!callerMatchesSenior(ctx, current.senior)) {
+            throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(current.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: current.senior });
+        }
+        if (JSON.stringify(current.registry_worker) !== JSON.stringify(initial.registry_worker) ||
+            !current.registry_worker ||
+            !current.registry_worker.human_checkpoints.concat(current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0
+                ? ["external_publish"]
+                : []).includes(checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker approval contract changed before the checkpoint was recorded`, { lane_id: laneId });
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(current.registry_worker_approval_history ?? [], {
+                event: "approved",
+                approval_id: approvalId,
+                checkpoint,
+                registry_worker_id: current.registry_worker.id,
+                worker_yaml_sha256: current.registry_worker.worker_yaml_sha256,
+                reason,
+                actor,
+                at,
+            }),
+        };
+    });
+    printJson({ ok: true, action: "approve", lane_id: laneId, checkpoint, lane: updated });
+}
+async function runApproveOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("registry_worker_approval_dispatch_unauthorized", "The Outpost approval target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.approvalContext === undefined) {
+        throw new LanesError("registry_worker_approval_context_invalid", "--approval-context is required on the Outpost owner target", { lane_id: laneId });
+    }
+    const authorization = parseOutpostRegistryWorkerApprovalContext(opts.approvalContext, laneId);
+    assertNoSecretText("approval reason", authorization.reason);
+    const hqRoot = ctx.hqRoot();
+    const validateOwnerState = (current) => {
+        if (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current)) {
+            throw new LanesError("lane_remote", `Outpost approval target cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (!sameHireGrantSenior(current.senior, authorization.expected_senior) ||
+            current.registry_worker?.id !== authorization.registry_worker_id ||
+            current.registry_worker.worker_yaml_sha256 !== authorization.worker_yaml_sha256) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s senior or registry worker changed after approval was authorized`, { lane_id: laneId });
+        }
+        if (!current.registry_worker ||
+            (!current.registry_worker.approval_required && current.registry_worker.human_checkpoints.length === 0)) {
+            throw new LanesError("registry_worker_approval_unavailable", `Lane ${laneId} has no registry worker approval gate`, { lane_id: laneId });
+        }
+        const allowed = current.registry_worker.human_checkpoints.length > 0
+            ? current.registry_worker.human_checkpoints
+            : ["external_publish"];
+        if (!allowed.includes(authorization.checkpoint)) {
+            throw new LanesError("registry_worker_approval_stale", `Lane ${laneId}'s registry worker no longer declares checkpoint ${JSON.stringify(authorization.checkpoint)}`, { lane_id: laneId, checkpoint: authorization.checkpoint });
+        }
+    };
+    validateOwnerState(readLane(hqRoot, laneId));
+    const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
+        validateOwnerState(current);
+        const history = current.registry_worker_approval_history ?? [];
+        if (history.some((entry) => entry.event === "approved" && entry.approval_id === authorization.approval_id)) {
+            return current;
+        }
+        return {
+            ...current,
+            registry_worker_approval_history: appendCappedHistory(history, {
+                event: "approved",
+                approval_id: authorization.approval_id,
+                checkpoint: authorization.checkpoint,
+                registry_worker_id: authorization.registry_worker_id,
+                worker_yaml_sha256: authorization.worker_yaml_sha256,
+                reason: authorization.reason,
+                actor: authorization.actor,
+                at: authorization.at,
+            }),
+        };
+    });
+    printJson({
+        ok: true,
+        action: "approve",
+        lane_id: laneId,
+        checkpoint: authorization.checkpoint,
+        lane: updated,
+    });
+}
 async function runGrantOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
         throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
@@ -5350,7 +5500,9 @@ async function runAdmit(ctx, laneId, opts) {
     }, ctx.sleep);
 }
 function resolveResumeProfile(ctx, lane, workerId) {
-    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug);
+    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug, undefined, lane.worker_profile === workerId.trim() && lane.registry_worker !== undefined
+        ? { registryWorkerRecord: lane.registry_worker }
+        : {});
     if (worker.profile === undefined) {
         throw new LanesError("worker_profile_required", `Worker ${JSON.stringify(workerId)} resolves to a registry worker, not a reusable provider profile; resume --worker requires personal/workers/<id>/meta.yaml`, { worker: workerId, path: worker.path });
     }
@@ -5393,6 +5545,9 @@ function applyResumeProfileAndEffort(current, next, input) {
         next.worker_pack = input.profile.pack;
         next.worker_profile = profile.id;
         next.worker_profile_hash = profile.contentHash;
+        next.registry_worker = profile.registryWorker !== undefined
+            ? registryWorkerRecord(profile.registryWorker)
+            : undefined;
         if (input.profileRepin !== undefined &&
             current.host.kind === "outpost" &&
             current.worker_profile_hash !== profile.contentHash) {
@@ -5766,6 +5921,10 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         : lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
             ? lane.model
             : undefined;
+    const recordedModelAccount = lane.account !== undefined &&
+        (lane.model_source === "cli" || lane.model_source === "preserved")
+        ? lane.account
+        : undefined;
     const preservedModel = repairUnavailableAccount && lane.model_source === "account"
         ? lane.model ?? currentConfig?.model
         : undefined;
@@ -5789,7 +5948,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         currentConfig?.enabled === true &&
         currentTargetAccount?.enabled === true &&
         currentTargetAccount.logged_in === true &&
-        (model === undefined || currentConfig.model === undefined || currentConfig.model === model))
+        (model === undefined || currentConfig.model === undefined || currentConfig.model === model ||
+            lane.account === recordedModelAccount))
         return undefined;
     const selected = selectClaudeAccount({
         hosts: balanceHosts.snapshots,
@@ -5797,6 +5957,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         config,
         ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
         ...(model !== undefined ? { model } : {}),
+        ...(recordedModelAccount !== undefined ? { recordedModelAccount } : {}),
         unavailableHosts: balanceHosts.unavailableHosts,
     });
     const historyReason = lane.account === undefined
@@ -9282,6 +9443,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("approve-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--approval-context <base64url>", "Primary-authorized registry worker approval")
+        .action(wrap(async (laneId, opts) => {
+        await runApproveOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("reparent-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
@@ -9581,6 +9749,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, options) => {
         await runStop(ctx, laneId, options.reason);
     }));
+    lanes
+        .command("approve")
+        .description("Record senior approval for a registry worker checkpoint")
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--checkpoint <name>", "Exact registry worker checkpoint name")
+        .requiredOption("--reason <text>", "Why the checkpoint is approved")
+        .action(wrap(async (laneId, opts) => {
+        await runApprove(ctx, laneId, opts);
+    }));
     lanes
         .command("ask")
         .description("Queue a mid-run question without blocking the lane")

package/dist/lib/agent-kit/creds.d.ts

@@ -7,6 +7,22 @@
  * module reads `~/.hq/cognito-tokens.json` — a human's session is never
  * consulted, copied, or reused by an agent identity (policy
  * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
  */
 import type { AgentKitPaths, KitComponent } from "./paths.js";
 /** Exact `machine-creds.json` shape for an external agent (api-contract v1). */
@@ -33,8 +49,20 @@ export interface HostKeyPair {
 /** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
 export declare function hostFingerprint(publicPem: string): string;
 export declare function generateHostKeyPair(): HostKeyPair;
-export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): void;
-export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): void;
+/**
+ * What a write could actually guarantee about who can read the file.
+ * `enforced: false` means the bytes are on disk but readable beyond the
+ * owner — true of a share mounted with a fixed `file_mode`.
+ */
+export interface PrivateFileOutcome {
+    enforced: boolean;
+    /** Mode observed after the write, when it could be read back. */
+    observedMode?: number;
+    /** errno of a refused chmod (EPERM on Azure Files), when there was one. */
+    chmodError?: string;
+}
+export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): PrivateFileOutcome;
+export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): PrivateFileOutcome;
 /**
  * Read the creds file without trusting it: returns null unless it is an
  * external-agent file with every contract field present.