@intentic/sandbox-contract 1.240.0 → 1.242.0

package/src/workspace-state.test.ts

@@ -8,6 +8,7 @@ import {
     isReviewableLockedPath,
     REPORTED_MANIFEST_PATHS,
     SEARCHABLE_STATE_PATHS,
+    SHARED_STATE_PATHS,
     STATE_GROUP_DIR,
     type StateGroup,
     stateGroupOf,
@@ -47,14 +48,14 @@ describe(`staleQueryKeys`, () => {
     it(`matches a name family and a one-file-per-entry directory through one prefix each`, () => {
         // environment.Dockerfile, environment.custom.Dockerfile, environment.approved.Dockerfile: one entry.
         expect(staleQueryKeys([`.intentic/config/environment.custom.Dockerfile`], [])).toEqual([`environment`]);
-        expect(staleQueryKeys([`.intentic/config/drafts/post-1.json`], [])).toEqual([`drafts`]);
+        expect(staleQueryKeys([`.intentic/config/approvals/post-1.json`], [])).toEqual([`approvals`]);
     });
 
-    it(`refreshes the Drafts view when the AGENT writes a draft`, () => {
-        // The regression this table was reorganized around: the drafts skill writes these files directly, so
+    it(`refreshes the Approvals view when the AGENT writes a proposal`, () => {
+        // The regression this table was reorganized around: the approvals skill writes these files directly, so
         // there is no browser mutation to hang an invalidate on: the watcher push is the only signal, and it
         // used to be dropped on the floor.
-        expect(staleQueryKeys([`.intentic/config/drafts/post-1.json`], [])).toEqual([`drafts`]);
+        expect(staleQueryKeys([`.intentic/config/approvals/post-1.json`], [])).toEqual([`approvals`]);
     });
 
     it(`ignores unrelated churn under .intentic/`, () => {
@@ -158,7 +159,7 @@ describe(`WORKSPACE_STATE_FILES`, () => {
     it(`states a reason for every entry that invalidates nothing`, () => {
         // An empty `invalidates` is a real answer (daemon machine state, a deliberately-polled surface, a path
         // whose query keys belong to an extension), but a SILENT one is indistinguishable from the omission this
-        // table exists to prevent, which is exactly how drafts went missing. Requiring the reason is what makes
+        // table exists to prevent, which is exactly how approvals went missing. Requiring the reason is what makes
         // the difference visible at review time.
         for (const file of WORKSPACE_STATE_FILES) {
             if (file.invalidates.length === 0) {
@@ -172,10 +173,12 @@ describe(`WORKSPACE_STATE_FILES`, () => {
     });
 
     it(`keeps directory entries slash-terminated so they cannot swallow a sibling`, () => {
-        // `.intentic/config/drafts` without the slash would also prefix-match a future `.intentic/drafts-archive.json`.
+        // `.intentic/config/approvals` without the slash would also prefix-match a future `.intentic/approvals-archive.json`.
         for (const file of WORKSPACE_STATE_FILES.filter((entry) => entry.invalidates.length > 0)) {
             const isFamilyPrefix = file.path.endsWith(`.`);
-            const isFile = file.path.endsWith(`.json`) || file.path.endsWith(`.Dockerfile`);
+            // `.md` is the safety policy: the one state file whose reader is a model rather than a parser, so
+            // it is prose on disk rather than JSON.
+            const isFile = file.path.endsWith(`.json`) || file.path.endsWith(`.Dockerfile`) || file.path.endsWith(`.md`);
             expect(isFile || isFamilyPrefix || file.path.endsWith(`/`), file.path).toBe(true);
         }
     });
@@ -224,7 +227,7 @@ describe(`isLockedWorkspacePath`, () => {
         // The dir itself is browsable, and most of what is in it is a file a person may legitimately read.
         expect(isLockedWorkspacePath(`.intentic`)).toBe(false);
         expect(isLockedWorkspacePath(`.intentic/config/settings.json`)).toBe(false);
-        expect(isLockedWorkspacePath(`.intentic/config/drafts/post-1.json`)).toBe(false);
+        expect(isLockedWorkspacePath(`.intentic/config/approvals/post-1.json`)).toBe(false);
     });
 
     it(`locks the ROOT's own .git and nobody else's`, () => {
@@ -320,52 +323,59 @@ describe(`VERSIONED_STATE_PATHS`, () => {
      * consequence of editing the table above: the review the flag itself exists to force. */
     it(`tracks exactly the configuration slice plus the agent's own authored output`, () => {
         expect(VERSIONED_STATE_PATHS.toSorted()).toEqual([
-            `.intentic/config/automations.json`,
+            `${STATE_DIR}/config/approvals/`,
+            `${STATE_DIR}/config/automations.json`,
+            // Which apps the daemon starts at boot: the starter site on a fresh box, and whatever the owner adds.
+            `${STATE_DIR}/config/autostart.json`,
             /* The connections themselves, and the entry that took the longest to earn its place: it was classed
              * `secret` on the strength of holding each capability's credential, which stopped being true when the
              * vault took the values out and left the shape behind. Connecting a deployment orchestrator, or
              * granting a connected computer shell and screen control, is the largest change made to what this
              * sandbox can DO, and it used to leave no diff. */
-            `.intentic/config/capabilities.json`,
-            `.intentic/config/capability-dismissals.json`,
+            `${STATE_DIR}/config/capabilities.json`,
+            `${STATE_DIR}/config/capability-dismissals.json`,
             /* The two entries the AGENT authors on its own initiative, and the reason `versioned` is not read as
              * config-only. Both are the sandbox acting outward: a draft publishes words under the owner's name,
              * a workspace extension is code that runs in the app and can serve HTTP with the workspace under
              * node:fs, and both used to reach that far with no diff anywhere. Kept rather than consumed, one
              * small file at a time, so tracking them yields a record instead of churn. */
-            `.intentic/config/drafts/`,
             /* Where each agent engine takes its version from. Tracked for the same reason heavy-commands is:
              * it is a standing decision about what runs for everyone on this workspace — tracking upstream's
              * newest Claude Code, or pinning one while a regression is open — and `git log` is the only thing
              * that answers "since when". */
-            `.intentic/config/engines.json`,
-            `.intentic/config/environment.Dockerfile`,
-            `.intentic/config/environment.custom.Dockerfile`,
-            `.intentic/config/environment.d/`,
-            `.intentic/config/extension-enablement.json`,
+            `${STATE_DIR}/config/engines.json`,
+            `${STATE_DIR}/config/environment.Dockerfile`,
+            `${STATE_DIR}/config/environment.custom.Dockerfile`,
+            `${STATE_DIR}/config/environment.d/`,
+            `${STATE_DIR}/config/extension-enablement.json`,
             /* Its twin, and the pair is the argument: the SWITCH was already tracked while the configuration
              * behind it was not, so a commit could record turning an extension on and say nothing about what it
              * was told to do. Tracked once its declared-secret values moved to the vault. */
-            `.intentic/config/extension-settings.json`,
+            `${STATE_DIR}/config/extension-settings.json`,
             // The owner's per-extension update posture (notify / agent / auto): a standing decision about
             // what may run unattended, which is exactly the kind of edit worth a line in `git log`.
-            `.intentic/config/extension-update-policy.json`,
+            `${STATE_DIR}/config/extension-update-policy.json`,
             // Which commands are heavy enough to take turns, and how many may run at once. Tracked because
             // raising that limit is a decision about every session sharing the box, and `git log` is the only
             // thing that answers "since when have we been allowing four of these at a time".
-            `.intentic/config/heavy-commands.json`,
-            `.intentic/config/loop-designs.json`,
-            `.intentic/config/personas.json`,
+            `${STATE_DIR}/config/heavy-commands.json`,
+            `${STATE_DIR}/config/loop-designs.json`,
+            `${STATE_DIR}/config/personas.json`,
             // A persona's own kit: the prompt it runs on and the skills only its turns reach. Tracked for the
             // reason its card is, one step further: this is the text that decides how that persona behaves.
-            `.intentic/config/personas/`,
-            `.intentic/config/settings.json`,
+            `${STATE_DIR}/config/personas/`,
+            /* The safety policy: prose deciding when an agent stops to ask before running something. Tracked for
+             * the reason settings.json is, and more sharply — it is the standing answer to "how much may this
+             * thing do unasked", the agent may edit it on the owner's instruction, and `git log` is the only
+             * thing that answers "since when did we stop being asked about force-pushes". */
+            `${STATE_DIR}/config/safety.md`,
+            `${STATE_DIR}/config/settings.json`,
             // The skills the owner wrote. Tracked for the reason the rules in settings.json are: text that
             // changes how the agent behaves is worth a diff and a line in `git log`.
-            `.intentic/config/skills/`,
-            `.intentic/config/templates.json`,
-            `.intentic/config/workflows.json`,
-            `.intentic/config/workspace-extensions/`,
+            `${STATE_DIR}/config/skills/`,
+            `${STATE_DIR}/config/templates.json`,
+            `${STATE_DIR}/config/workflows.json`,
+            `${STATE_DIR}/config/workspace-extensions/`,
         ]);
     });
 
@@ -439,7 +449,7 @@ describe(`state groups`, () => {
 
     it(`sorts the entries a browsing owner would recognise`, () => {
         expect(stateGroupPaths(`config`)).toContain(`.intentic/config/personas/`);
-        expect(stateGroupPaths(`config`)).toContain(`.intentic/config/drafts/`);
+        expect(stateGroupPaths(`config`)).toContain(`.intentic/config/approvals/`);
         expect(stateGroupPaths(`records`)).toContain(`.intentic/records/sessions/claude/`);
         expect(stateGroupPaths(`records`)).toContain(`.intentic/records/artifacts/`);
         expect(stateGroupPaths(`local`)).toContain(`.intentic/local/cache/`);
@@ -491,6 +501,44 @@ describe(`state groups`, () => {
     });
 });
 
+/* THE MOUNT BOUNDARY, and the claim that lets isolation bind by group instead of over the whole state dir: the
+ * shared prefixes and the tracked entries never overlap. A tracked entry under a shared prefix would be the old
+ * bug back in one folder, git in a worktree writing through a bind onto the live tree, and an untracked entry
+ * under no shared prefix is a transcript or a staged doc written into a per-worktree copy nobody reads. */
+describe(`SHARED_STATE_PATHS`, () => {
+    const under = (path: string, prefix: string): boolean => path === prefix || path.startsWith(prefix);
+
+    it(`is the four untracked groups whole, plus the one untracked entry inside config`, () => {
+        expect(SHARED_STATE_PATHS.toSorted()).toEqual([
+            `.intentic/config/docs/`,
+            `.intentic/identity/`,
+            `.intentic/local/`,
+            `.intentic/records/`,
+            `.intentic/secrets/`,
+        ]);
+    });
+
+    it(`never covers a tracked entry`, () => {
+        for (const path of VERSIONED_STATE_PATHS) {
+            expect([path, SHARED_STATE_PATHS.some((shared) => under(path, shared))]).toEqual([path, false]);
+        }
+    });
+
+    it(`covers every untracked entry`, () => {
+        for (const file of WORKSPACE_STATE_FILES) {
+            if (file.versioned !== true) {
+                expect([file.path, SHARED_STATE_PATHS.some((shared) => under(file.path, shared))]).toEqual([file.path, true]);
+            }
+        }
+    });
+
+    it(`spells every prefix as a directory, so a bind can never prefix-match a sibling`, () => {
+        for (const path of SHARED_STATE_PATHS) {
+            expect(path.endsWith(`/`), path).toBe(true);
+        }
+    });
+});
+
 /* WHAT THE OWNER'S MACHINE KEEPS. The sync ignored the whole state dir, so losing a sandbox lost every persona,
  * skill, automation, draft and transcript in it: a backup that held only the source tree. These pin the two
  * halves of the fix: the slice that now comes down, and the credentials that still must not. */

package/src/workspace-state.ts

@@ -10,11 +10,11 @@ import type { StateFile } from "./state-portability.js";
  * maintained separately from the paths the daemon actually writes (composition.ts), two lists of the same
  * fact, in two packages, with nothing tying them together.
  *
- * They drifted, exactly as that shape always does. `.intentic/drafts/` is written by the AGENT (the drafts
- * skill puts a file there) and rendered by the Drafts view, but it was never added to the browser's table, so
- * a draft appearing on disk while the owner watched the page changed nothing until they refocused the tab.
- * Extension settings and the members list were missing for the same reason; writing them out is what showed
- * that neither is a drafts-shaped hole, see their entries.
+ * They drifted, exactly as that shape always does. The approvals queue is written by the AGENT (the approvals
+ * skill puts a file there) and rendered by the Approvals view, but it was never added to the browser's table,
+ * so a proposal appearing on disk while the owner watched the page changed nothing until they refocused the
+ * tab. Extension settings and the members list were missing for the same reason; writing them out is what
+ * showed that neither is an approvals-shaped hole, see their entries.
  *
  * So the binding is declared HERE, once, in the package both the daemon and the browser already import, and
  * each side derives what it needs: the daemon builds its store paths from `path`, the browser builds its
@@ -38,7 +38,7 @@ import type { StateFile } from "./state-portability.js";
  * `path` is workspace-root-relative, forward-slash, the space `workspaceChanged` paths arrive in. Matching is
  * by PREFIX, which lets one entry cover three shapes without a second matching rule:
  *   - an exact file      `.intentic/config/settings.json`
- *   - a directory        `.intentic/config/drafts/`     (one file per draft)
+ *   - a directory        `.intentic/config/approvals/`  (one file per approval)
  *   - a name family      `.intentic/config/environment.custom.` (…Dockerfile and anything later named beside it)
  * A directory entry keeps its trailing slash so it can never prefix-match a sibling file. Entries may NEST,
  * see stateFileFor, which resolves the longest match rather than the first. */
@@ -221,6 +221,46 @@ const STATE_FILES = [
     },
 
     { path: ".intentic/config/settings.json", invalidates: ["settings", "manifests"], portability: "carry", versioned: true },
+    /* The safety policy the command judge reads before every flagged command (safety-policy.ts).
+     *
+     * `carry` and `versioned`, and both matter more here than for any other config file. It is a decision about
+     * how much an agent may do unasked in THIS workspace, so a fresh sandbox should arrive already governed by
+     * it rather than by the shipped default; and a change to it is exactly the kind a reviewer should see, since
+     * "since when did we stop asking about force-pushes" is a question only `git log` can answer. Being prose
+     * rather than JSON is what makes that diff worth reading.
+     *
+     * Absent is a normal state and not an unconfigured one: the daemon falls back to DEFAULT_SAFETY_POLICY,
+     * which describes the posture the product already had. */
+    { path: ".intentic/config/safety.md", invalidates: ["safety-policy"], portability: "carry", versioned: true },
+    /* What the policy above actually decided, newest first, written several times a turn by the command gate.
+     *
+     * `derived`, and therefore under `local/` rather than beside the session transcripts in `records/`: it is
+     * evidence about what ran on THIS machine, bounded and self-trimming, and an export that carried it would
+     * arrive claiming a fresh sandbox had already judged three hundred commands. The folder is the rule here,
+     * not a filing preference — the git exclude, the search allow-list and the export bundle all read the
+     * prefix (see the layout guard in workspace-state.test.ts).
+     *
+     * Its own query key rather than the policy's, because the two change at completely different rates and a
+     * verdict landing must not invalidate the document somebody is editing. */
+    {
+        path: ".intentic/local/safety-log.json",
+        invalidates: ["safety-log"],
+        portability: "derived",
+        note: "The target starts its own record of what it decided.",
+    },
+    /* Which of the workspace's apps the daemon starts on EVERY boot (scaffold/autostart.ts). The starter-site
+     * seed writes the first entry; the `autostart` boot step reads it, which is what puts the starter's dev
+     * server up on a first boot, on a boot over a prewarmed pool volume (where the seed has nothing to do), and
+     * after every wake of a hosted machine (panels are stopped by a restart, so without this a returning user
+     * met "isn't running" every time). `carry`: an exported workspace should arrive with the same things
+     * running. Invalidates nothing: the browser reads what is running off /panels, never off this file. */
+    {
+        path: ".intentic/config/autostart.json",
+        invalidates: [],
+        why: "The browser reads what is running off /panels; this file only tells the daemon what to start at boot.",
+        portability: "carry",
+        versioned: true,
+    },
     /* Which agent commands are heavy enough to take turns, and how many may run at once (the daemon reads it
      * per Bash command: platform/heavy-commands.ts).
      *
@@ -261,22 +301,24 @@ const STATE_FILES = [
      * that page but reads its own route, and a channel change must not cost every open Environment tab a
      * re-read of the overlay it did not touch. */
     { path: ".intentic/config/engines.json", invalidates: ["engines"], portability: "carry", versioned: true },
-    /* Written by the AGENT's file tools (the drafts skill), read by the owner's approval inbox, the one entry
+    /* Written by the AGENT's file tools (the approvals skill), read by the owner's approval inbox, the one entry
      * here whose whole point is that a change arrives from outside the browser that renders it. `authored`:
-     * a draft is text somebody wrote, and "find the reddit draft about X" is an ordinary search.
-     *
-     * `versioned` because a draft is the furthest-reaching thing the agent writes: these words go out under the
-     * owner's name, to an audience, and cannot be recalled. The approval inbox already gates that, but a gate is
-     * not a record. Declining one used to erase it, so the question "what has this agent tried to post" had no
-     * answer at all, and an approved post's own history (what was proposed, what the owner changed, when it
-     * actually went) lived only in a file nobody could diff.
-     *
-     * It costs almost nothing to track, which is why the ledger objection does not reach it: a draft is one small
-     * file per post, it is written a handful of times across its whole life (proposed → approved → posted, with
-     * `postedAt`/`postedUrl` stamped at the end), and it is KEPT afterwards rather than consumed, so tracking
-     * yields a durable record instead of the add/delete churn a queue would produce. Nothing in a draft is a
-     * credential: it is a platform, a target URL and the body itself, all of it bound for publication anyway. */
-    { path: ".intentic/config/drafts/", invalidates: ["drafts"], portability: "carry", versioned: true, authored: true },
+     * an approval is text somebody wrote, a post or a description of an action, and "find the reddit post
+     * about X" is an ordinary search.
+     *
+     * `versioned` because an approval is the furthest-reaching thing the agent writes: a post goes out under the
+     * owner's name, to an audience, and cannot be recalled; an action spends or sends or deletes. The inbox
+     * already gates that, but a gate is not a record. Declining one used to erase it, so the question "what has
+     * this agent tried to do" had no answer at all, and an approved item's own history (what was proposed, what
+     * the owner changed, when it actually happened) lived only in a file nobody could diff.
+     *
+     * It costs almost nothing to track, which is why the ledger objection does not reach it: an approval is one
+     * small file, written a handful of times across its whole life (proposed → approved → done, with
+     * `finishedAt`/`result` stamped at the end), and it is KEPT afterwards rather than consumed, so tracking
+     * yields a durable record instead of the add/delete churn a queue would produce. Nothing in one is a
+     * credential: a platform, a target, the words, a description of what will be done, all of it meant to be
+     * read by the owner anyway. */
+    { path: ".intentic/config/approvals/", invalidates: ["approvals"], portability: "carry", versioned: true, authored: true },
     // ---- declared by the extension that renders them (contributes.files), not here ----
     // The path is the DAEMON's (automations-store writes both), the query keys are the intentic.automations
     // extension's. It declares them in its own manifest and the browser unions the two lists, so uninstalling
@@ -310,7 +352,7 @@ const STATE_FILES = [
     {
         path: ".intentic/records/approvals/",
         invalidates: [],
-        why: "Declared by the intentic.automations extension's contributes.files, `automation-approvals` is its query key, not core's.",
+        why: "Declared by the intentic.approvals extension's contributes.files (the page that lists held wakes), `automation-approvals` is its query key, not core's.",
         portability: "carry",
     },
     /* The bug-report inbox, one file per fingerprint, written by the daemon's issues-store as reports arrive
@@ -321,8 +363,8 @@ const STATE_FILES = [
      * exported and restored elsewhere that arrived claiming nothing had ever crashed would have thrown away
      * the one record that says which bug is worth fixing first, and the counts are the whole of that record.
      *
-     * NOT `versioned`, and the drafts entry is the contrast worth reading: a draft is authored, reviewable and
-     * goes out under the owner's name, so it earns a diff. An issue is machine-recorded telemetry whose count
+     * NOT `versioned`, and the approvals entry is the contrast worth reading: an approval is authored, reviewable
+     * and acts under the owner's name, so it earns a diff. An issue is machine-recorded telemetry whose count
      * moves on every crash: tracking it would put a commit's worth of churn in `git log` per bad afternoon,
      * and nothing in it is a decision anybody made. */
     {
@@ -344,7 +386,7 @@ const STATE_FILES = [
     },
     /* The documentation STAGING tree (documentation extension's paths.ts): generation writes here, the owner
      * reads and approves here, publishing copies into the repo. `authored` is the whole nature of the entry,
-     * these are draft READMEs, drafts-shaped in every way that matters, and "find the staged page about X" is
+     * these are draft READMEs, approvals-shaped in every way that matters, and "find the staged page about X" is
      * as ordinary a search as finding a post draft. */
     {
         path: ".intentic/config/docs/",
@@ -440,10 +482,10 @@ const STATE_FILES = [
         versioned: true,
     },
     /* Workspace extensions: one directory per extension, consumed straight from the workspace, no clone, no
-     * install moment. Written like drafts, by the agent's own file tools (which is the point: an agent authors
+     * install moment. Written like approvals, by the agent's own file tools (which is the point: an agent authors
      * an extension and it is live for the daemon and every session at once, since .intentic is shared), so this
      * push is what makes one appearing or changing show up on the Extensions tab while the owner watches.
-     * `authored` for the same reason as drafts: this is source the agent wrote and will be asked to find,
+     * `authored` for the same reason as approvals: this is source the agent wrote and will be asked to find,
      * unlike `.intentic/extensions/` below, which is CLONES of source that lives elsewhere.
      *
      * `versioned` FOR THAT SAME REASON, which is the whole argument. Every other load path an extension can take
@@ -682,7 +724,7 @@ export const WORKSPACE_STATE_FILES: readonly WorkspaceStateFile[] = STATE_FILES;
 export const VERSIONED_STATE_PATHS: readonly string[] = WORKSPACE_STATE_FILES.filter((file) => file.versioned).map((file) => file.path);
 
 /* The `.intentic` slice a workspace SEARCH may surface: configuration a person reviews (`versioned`) plus the
- * authored-content dirs (`authored`), drafts, staged docs, workspace extensions. Everything else under
+ * authored-content dirs (`authored`), approvals, staged docs, workspace extensions. Everything else under
  * `.intentic` is machine state, and the search engine (iq's floor) denies it BY DEFAULT off this list, the
  * same default-deny the portability classes are built on and for the same reason: a deny list is a list a new
  * ledger is forgotten from, and the forgetting is silent, it ranked loop iteration history and cloned
@@ -714,8 +756,8 @@ export const SEARCHABLE_STATE_PATHS: readonly string[] = WORKSPACE_STATE_FILES.f
  * the same three questions it always did; the group, the folder it belongs in, and every rule that reads them
  * follow with no further edit. */
 export type StateGroup =
-    /* Reviewed and reviewable: settings, personas, skills, drafts, staged docs, the environment overlay. Tracked
-     * by the root repo, searchable, backed up, and carried into a new sandbox. Two of its members (drafts, staged
+    /* Reviewed and reviewable: settings, personas, skills, approvals, staged docs, the environment overlay. Tracked
+     * by the root repo, searchable, backed up, and carried into a new sandbox. Two of its members (approvals, staged
      * docs) are authored content rather than configuration, and the folder is still called `config`, the word
      * that makes seventeen of the nineteen instantly clear beats one that makes all nineteen vague. */
     | "config"
@@ -784,6 +826,32 @@ export const stateGroupOf = (file: WorkspaceStateFile): StateGroup => {
 export const stateGroupPaths = (group: StateGroup): readonly string[] =>
     WORKSPACE_STATE_FILES.filter((file) => stateGroupOf(file) === group).map((file) => file.path);
 
+/* WHAT AN ISOLATED TURN SHARES LIVE WITH THE MAIN TREE, and what is its own. The state dir is split along ONE
+ * line, and it is the line git already draws: what the root repo TRACKS (`versioned`) is the worktree's own
+ * checkout, edited on the agent's branch, reviewed in its diff and landed like code; everything git does NOT
+ * track is bound in from the main tree (agents/isolation.ts), one directory for every conversation, because a
+ * transcript, a ledger, a browser capture or a staged doc written into a per-worktree copy is simply lost.
+ *
+ * The two used to be one bind over the whole dir, with the tracked slice sparse-excluded from every worktree to
+ * keep git from writing through it. That put the ONE thing a person reviews outside the one door that records
+ * provenance: an agent's settings edit, approval, environment fragment or skill went straight into the owner's
+ * working tree, unattributed, with no branch commit and nothing for a land to conflict on. Binding by group
+ * ends both problems at once, nothing tracked sits behind a bind, so nothing git does in a worktree can reach
+ * the live tree, and the sparse machinery has nothing left to guard.
+ *
+ * WHOLE GROUP DIRS WHERE THE WHOLE GROUP IS UNTRACKED (records, local, identity, secrets), not their entries: a
+ * file an extension writes under `records/` without declaring it must still land in the shared tree, and a
+ * per-entry bind would strand it in the worktree. Only a group that MIXES tracked and untracked entries (config,
+ * for the staged docs tree) is bound entry by entry. Derived, so a store added tomorrow is placed by its
+ * `versioned` flag alone, and the layout guard in workspace-state.test.ts pins that no tracked entry can ever
+ * sit under a shared prefix. Trailing slash kept on every entry, as the table spells directories. */
+export const SHARED_STATE_PATHS: readonly string[] = STATE_GROUPS.flatMap((group) => {
+    const files = WORKSPACE_STATE_FILES.filter((file) => stateGroupOf(file) === group);
+    return files.some((file) => file.versioned === true)
+        ? files.filter((file) => file.versioned !== true).map((file) => file.path)
+        : [`${STATE_GROUP_DIR[group]}/`];
+});
+
 /* THE SLICE DESKTOP-SYNC COPIES DOWN, ordinary state and the records that bind this sandbox to its owner,
  * minus anything that opted out (see `backup` on the interface).
  *
@@ -927,7 +995,7 @@ export const isReviewableLockedPath = (relPath: string): boolean => {
  * files beside it spelled the same layout a SECOND way, `join(root, ".intentic", "settings.json")`, with
  * nothing tying the two spellings together. Rename a store's file and this table keeps declaring the old name:
  * no error, no failing test, just a view that quietly stops refreshing, which is the exact failure the table was
- * written to end and the exact way drafts went missing.
+ * written to end and the exact way approvals went missing.
  *
  * So the daemon joins through `statePath` (workspace/state-paths.ts), which takes one of THESE and nothing else.
  * A rename is now a compile error at every site that names the file, in both packages, or it is not a rename. */

package/dist/contracts/drafts.contract.d.ts

@@ -1,57 +0,0 @@
-export declare const draftsContract: {
-    list: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("zod").ZodObject<{
-        drafts: import("zod").ZodArray<import("zod").ZodObject<{
-            platform: import("zod").ZodString;
-            actsAs: import("zod").ZodOptional<import("zod").ZodString>;
-            content: import("zod").ZodString;
-            title: import("zod").ZodOptional<import("zod").ZodString>;
-            target: import("zod").ZodOptional<import("zod").ZodString>;
-            media: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-            scheduledAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            status: import("zod").ZodDefault<import("zod").ZodEnum<{
-                approved: "approved";
-                failed: "failed";
-                posted: "posted";
-                posting: "posting";
-                proposed: "proposed";
-            }>>;
-            createdAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            postingAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            postedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            postedUrl: import("zod").ZodOptional<import("zod").ZodString>;
-            error: import("zod").ZodOptional<import("zod").ZodString>;
-            id: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>>;
-        invalid: import("zod").ZodArray<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-    upsert: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<import("zod").ZodObject<{
-        platform: import("zod").ZodString;
-        actsAs: import("zod").ZodOptional<import("zod").ZodString>;
-        content: import("zod").ZodString;
-        title: import("zod").ZodOptional<import("zod").ZodString>;
-        target: import("zod").ZodOptional<import("zod").ZodString>;
-        media: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-        scheduledAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        status: import("zod").ZodDefault<import("zod").ZodEnum<{
-            approved: "approved";
-            failed: "failed";
-            posted: "posted";
-            posting: "posting";
-            proposed: "proposed";
-        }>>;
-        createdAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        postingAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        postedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        postedUrl: import("zod").ZodOptional<import("zod").ZodString>;
-        error: import("zod").ZodOptional<import("zod").ZodString>;
-        id: import("zod").ZodString;
-    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-        ok: import("zod").ZodLiteral<true>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-    remove: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<import("zod").ZodObject<{
-        id: import("zod").ZodString;
-    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-        ok: import("zod").ZodLiteral<true>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-};
-//# sourceMappingURL=drafts.contract.d.ts.map

package/dist/contracts/drafts.contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"drafts.contract.d.ts","sourceRoot":"","sources":["../../src/contracts/drafts.contract.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc;IACvB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;IAQJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;IASN,MAAM;;;;;CAST,CAAC"}

package/dist/contracts/drafts.contract.js

@@ -1,32 +0,0 @@
-import { oc } from "@orpc/contract";
-import { DraftIdParamSchema, DraftsListSchema, DraftSummarySchema } from "../schemas/drafts.js";
-import { OkSchema } from "../schemas/shared.js";
-export const draftsContract = {
-    list: oc
-        .route({
-        method: "GET",
-        path: "/drafts",
-        summary: "Posts waiting for your approval",
-        description: "The queue of things an agent has written and would like to publish. Nothing here has gone anywhere yet.",
-    })
-        .output(DraftsListSchema),
-    upsert: oc
-        .route({
-        method: "POST",
-        path: "/drafts",
-        summary: "Approve, edit or retry a draft",
-        description: "All three are the same act with a different field changed, so they share one call. Send the draft back as you want it.",
-    })
-        .input(DraftSummarySchema)
-        .output(OkSchema),
-    remove: oc
-        .route({
-        method: "DELETE",
-        path: "/drafts/{id}",
-        summary: "Reject a draft",
-        description: "Throws one away unposted.",
-    })
-        .input(DraftIdParamSchema)
-        .output(OkSchema),
-};
-//# sourceMappingURL=drafts.contract.js.map

package/dist/contracts/drafts.contract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"drafts.contract.js","sourceRoot":"","sources":["../../src/contracts/drafts.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAKhD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC1B,IAAI,EAAE,EAAE;SACH,KAAK,CAAC;QACH,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,yGAAyG;KACzH,CAAC;SACD,MAAM,CAAC,gBAAgB,CAAC;IAC7B,MAAM,EAAE,EAAE;SACL,KAAK,CAAC;QACH,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,wHAAwH;KACxI,CAAC;SACD,KAAK,CAAC,kBAAkB,CAAC;SACzB,MAAM,CAAC,QAAQ,CAAC;IACrB,MAAM,EAAE,EAAE;SACL,KAAK,CAAC;QACH,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,2BAA2B;KAC3C,CAAC;SACD,KAAK,CAAC,kBAAkB,CAAC;SACzB,MAAM,CAAC,QAAQ,CAAC;CACxB,CAAC"}

package/dist/definition-action.d.ts

@@ -1,7 +0,0 @@
-import { z } from "zod";
-export declare const DefinitionActionSchema: z.ZodObject<{
-    subject: z.ZodString;
-    detail: z.ZodString;
-}, z.core.$strip>;
-export type DefinitionAction = z.infer<typeof DefinitionActionSchema>;
-//# sourceMappingURL=definition-action.d.ts.map

package/dist/definition-action.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-action.d.ts","sourceRoot":"","sources":["../src/definition-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;iBAAwD,CAAC;AAC5F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/definition-action.js

@@ -1,3 +0,0 @@
-import { z } from "zod";
-export const DefinitionActionSchema = z.object({ subject: z.string(), detail: z.string() });
-//# sourceMappingURL=definition-action.js.map

package/dist/definition-action.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-action.js","sourceRoot":"","sources":["../src/definition-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/publish-drafts.d.ts

@@ -1,7 +0,0 @@
-export declare const APPROVAL_HOLD_MS = 60000;
-export declare const DIRECT_PUBLISH_PLATFORMS: ReadonlySet<string>;
-export declare const publishTurnPrompt: (drafts: readonly {
-    readonly id: string;
-    readonly platform: string;
-}[]) => string;
-//# sourceMappingURL=publish-drafts.d.ts.map

package/dist/publish-drafts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"publish-drafts.d.ts","sourceRoot":"","sources":["../src/publish-drafts.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAYvC,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AASlF,eAAO,MAAM,iBAAiB,WAAY,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,KAAG,MAiB1F,CAAC"}

package/dist/publish-drafts.js

@@ -1,20 +0,0 @@
-export const APPROVAL_HOLD_MS = 60_000;
-export const DIRECT_PUBLISH_PLATFORMS = new Set(["discord"]);
-export const publishTurnPrompt = (drafts) => [
-    `Publish these approved post drafts, which are due now. They live in .intentic/config/drafts/, one JSON file each:`,
-    ``,
-    ...drafts.map((draft) => `- ${draft.id}.json (${draft.platform})`),
-    ``,
-    `Take them ONE AT A TIME, and for each:`,
-    `1. Read the file. Set "status":"posting" BEFORE you act, so a turn that dies here cannot double-post.`,
-    `2. Post exactly its "content": with its "title", "target" and "media", using that platform's skill.`,
-    `   A "target" that is a URL means this draft is a REPLY to whatever is at it: open that exact URL and`,
-    `   reply where it lands. On reddit a comment permalink (.../comments/<post>/<slug>/<comment>/) has to`,
-    `   nest under that comment rather than becoming a new top-level comment on the thread.`,
-    `3. Set "status":"posted" plus "postedAt" (epoch ms) and, when the platform gives you one, "postedUrl".`,
-    `   If it failed, set "status":"failed" plus an "error" saying what went wrong in plain words the owner`,
-    `   can act on, then move to the next draft instead of retrying in a loop.`,
-    ``,
-    `Never rewrite the content: the owner approved these exact words. Never touch a draft not listed above.`,
-].join(`\n`);
-//# sourceMappingURL=publish-drafts.js.map

package/dist/publish-drafts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"publish-drafts.js","sourceRoot":"","sources":["../src/publish-drafts.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAYvC,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AASlF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAqE,EAAU,EAAE,CAC/G;IACI,mHAAmH;IACnH,EAAE;IACF,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,EAAE,UAAU,KAAK,CAAC,QAAQ,GAAG,CAAC;IAClE,EAAE;IACF,wCAAwC;IACxC,uGAAuG;IACvG,qGAAqG;IACrG,uGAAuG;IACvG,uGAAuG;IACvG,wFAAwF;IACxF,wGAAwG;IACxG,wGAAwG;IACxG,2EAA2E;IAC3E,EAAE;IACF,wGAAwG;CAC3G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}