@iowarp/clio-coder 0.3.1 → 0.3.3

package/src/domains/resources/skills/marketplace.ts

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { resolvePackageRoot } from "../../../core/package-root.js";
 import { clioConfigDir } from "../../../core/xdg.js";
 import {
 	type InstallSkillInput,
@@ -13,12 +14,21 @@ import { loadSkills, type Skill } from "./loader.js";
 /**
  * Local skill marketplace. Entries come from two real sources only:
  *
- *  1. A catalog directory of actual SKILL.md packages (for example the
- *     repo-level skills/ folder, or CLIO_CODER_SKILL_CATALOG_DIR). Metadata is read
- *     from the packages themselves via the normal skill loader.
- *  2. A JSON index file (CLIO_CODER_SKILL_MARKETPLACE_INDEX or
- *     <config>/skill-marketplace.json) whose entries point at installable
- *     sources.
+ *  1. A catalog directory of actual SKILL.md packages: CLIO_CODER_SKILL_CATALOG_DIR,
+ *     else a repo-level skills/ folder in the working tree, else the skills/
+ *     catalog the installed clio-coder package carries. Metadata is read from
+ *     the packages themselves via the normal skill loader.
+ *  2. A JSON index file: CLIO_CODER_SKILL_MARKETPLACE_INDEX, else
+ *     <config>/skill-marketplace.json, else the skill-marketplace.json the
+ *     package carries. Entries point at installable sources.
+ *
+ * The package fallbacks are what make a fresh npm install a marketplace at
+ * all: before them, an operator outside this repository with no env var set
+ * had no catalog and no index, so every bare-name install and every
+ * `/skill <name>` for a catalog skill failed. The package catalog is a
+ * marketplace source only, never a discovery root; catalog skills stay
+ * uninstalled until the operator asks, and install copies them out of the
+ * package into a Clio root without touching the network.
  *
  * There is no synthetic or hardcoded marketplace data; an empty result means
  * no marketplace is configured.
@@ -62,14 +72,45 @@ export interface DiscoverMarketplaceOptions {
 	catalogDir?: string | null;
 }
 
-function defaultIndexPath(): string | null {
+/**
+ * The catalog directory and index the installed package carries. Resolved
+ * lazily and defensively: a source checkout that has not built, or a package
+ * root the harness cannot locate, must degrade to "no package catalog" rather
+ * than throw out of a listing.
+ */
+function packageCatalogDir(): string | null {
+	try {
+		return path.join(resolvePackageRoot(), "skills");
+	} catch {
+		return null;
+	}
+}
+
+function packageIndexPath(): string | null {
 	try {
-		return path.join(clioConfigDir(), "skill-marketplace.json");
+		return path.join(resolvePackageRoot(), "skills", "skill-marketplace.json");
 	} catch {
 		return null;
 	}
 }
 
+/**
+ * Index precedence when no explicit path is given: the operator's config-dir
+ * copy beats the package's, so a hand-curated index still wins, and the
+ * package's own index is what a fresh install falls back to.
+ */
+function defaultIndexPath(): string | null {
+	try {
+		const configured = path.join(clioConfigDir(), "skill-marketplace.json");
+		if (existsSync(configured)) return configured;
+	} catch {
+		// Fall through: no config dir is not "no marketplace" once the package
+		// carries an index of its own.
+	}
+	const bundled = packageIndexPath();
+	return bundled && existsSync(bundled) ? bundled : null;
+}
+
 function isIndexSkill(value: unknown): value is { name: string; description: string; sourceUrl: string } {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
 	const record = value as Record<string, unknown>;
@@ -154,7 +195,12 @@ function resolveCatalogDir(options: DiscoverMarketplaceOptions): string | null {
 	const fromEnv = process.env.CLIO_CODER_SKILL_CATALOG_DIR;
 	if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv.trim());
 	const repoCatalog = path.join(options.cwd ?? process.cwd(), "skills");
-	return looksLikeSkillCatalog(repoCatalog) ? repoCatalog : null;
+	if (looksLikeSkillCatalog(repoCatalog)) return repoCatalog;
+	// The package's own catalog: rows resolve to local files, so a bare-name
+	// install copies out of the package and needs no network. From a checkout
+	// of this repository the two paths coincide.
+	const bundled = packageCatalogDir();
+	return bundled && looksLikeSkillCatalog(bundled) ? bundled : null;
 }
 
 /**

package/src/domains/safety/action-classifier.ts

@@ -95,8 +95,10 @@ function baseClassify(tool: string): ActionClass | null {
 		case ToolNames.Monitor:
 		case ToolNames.AskUser:
 		case ToolNames.CredentialPresent:
-		// tasks mutates only the session's task ledger, never the workspace,
-		// so it stays read class and is never gated behind a confirmation.
+		// tasks pick mutates only Clio-owned session-ledger and project-local
+		// .clio-coder runtime state, never source-workspace files. By intentional
+		// policy it stays read class and ungated; the tool itself still requires
+		// a durable operator task id before it can mutate either store.
 		case ToolNames.Tasks:
 		// ledger posts a typed contribution to a coordination board and reads a
 		// local mirror. Neither touches the workspace, so it is never gated

package/src/domains/safety/audit.ts

@@ -85,7 +85,7 @@ export interface PermissionAuditRecord {
 	kind: "permission";
 	ts: string;
 	correlationId: string;
-	status: "requested" | "granted" | "denied";
+	status: "requested" | "granted" | "denied" | "expired";
 	requestId?: string;
 	origin?: string;
 	decidedBy?: string;
@@ -204,7 +204,13 @@ let dateFormatter = new Intl.DateTimeFormat("en-CA", DATE_OPTIONS);
 function localDateString(d: Date): string {
 	if (process.env.TZ !== dateFormatterZone) {
 		dateFormatterZone = process.env.TZ;
-		dateFormatter = new Intl.DateTimeFormat("en-CA", DATE_OPTIONS);
+		// The zone is passed explicitly, not left for Intl to pick up from
+		// process.env.TZ implicitly: see src/interactive/format-time.ts's
+		// syncZone() for the traced repro (issue #84) of a rebuilt formatter
+		// resolving to the wrong zone while process.env.TZ read correctly at
+		// both construction and format time. Same idiom, same fix.
+		const zone = dateFormatterZone === undefined ? undefined : { timeZone: dateFormatterZone };
+		dateFormatter = new Intl.DateTimeFormat("en-CA", { ...DATE_OPTIONS, ...zone });
 	}
 	return dateFormatter.format(d);
 }

package/src/domains/safety/extension.ts

@@ -31,7 +31,7 @@ import { CONFIRMED_SCOPE, isSubset, READONLY_SCOPE, WORKSPACE_SCOPE } from "./sc
 function isPermissionResolvedPayload(value: unknown): value is PermissionResolvedPayload {
 	if (!value || typeof value !== "object") return false;
 	const p = value as Record<string, unknown>;
-	if (p.status !== "granted" && p.status !== "denied") return false;
+	if (p.status !== "granted" && p.status !== "denied" && p.status !== "expired") return false;
 	if (p.tool !== undefined && typeof p.tool !== "string") return false;
 	if (p.actionClass !== undefined && typeof p.actionClass !== "string") return false;
 	if (p.reason !== undefined && typeof p.reason !== "string") return false;

package/src/domains/session/compaction/branch-summary.ts

@@ -123,7 +123,7 @@ function toolResultText(entry: MessageEntry): string {
  * stable for a given input. Tests rely on this determinism.
  *
  * Non-context-bearing kinds (modelChange, thinkingLevelChange, fileEntry,
- * sessionInfo, protectedArtifact, custom) are skipped: they never contribute
+ * sessionInfo, protectedArtifact, taskLedger, decisionLedger, custom) are skipped: they never contribute
  * to the replayed LLM context, so summarizing them would waste tokens on
  * bookkeeping.
  */
@@ -180,7 +180,8 @@ export function serializeConversation(entries: ReadonlyArray<SessionEntry>): str
 			);
 		}
 		// custom, modelChange, thinkingLevelChange, fileEntry, sessionInfo,
-		// protectedArtifact do not project into the serialized conversation.
+		// protectedArtifact, taskLedger, decisionLedger, and workerRun do not
+		// project into the serialized conversation.
 	}
 	return parts.join("\n\n");
 }

package/src/domains/session/compaction/cut-point.ts

@@ -70,6 +70,7 @@ function isValidCutPoint(entry: SessionEntry): boolean {
 		case "label":
 		case "protectedArtifact":
 		case "taskLedger":
+		case "decisionLedger":
 		case "workerRun":
 			return false;
 	}
@@ -96,7 +97,7 @@ function findValidCutPoints(entries: ReadonlyArray<SessionEntry>, startIndex: nu
  * accumulating `keepRecentTokens`, the pi-coding-agent reference left
  * `cutIndex` at the oldest valid cut, which made `compact()` produce an
  * empty `pre` slice and the chat-loop report "nothing to compact" on
- * populated sessions below the keep-recent window. Clio's manual `/compact`
+ * populated sessions below the keep-recent window. Clio's manual `/context compact`
  * expects to summarize whatever older history exists, so when no suffix
  * crosses the threshold the cut falls back to the newest turn start (user
  * message, bashExecution, or branchSummary). Sessions with only a single

package/src/domains/session/compaction/tokens.ts

@@ -53,7 +53,7 @@ function estimateSummary(entry: BranchSummaryEntry | CompactionSummaryEntry): nu
 /**
  * Estimate the token load of a single session entry. Non-context-bearing
  * kinds (modelChange, thinkingLevelChange, fileEntry, sessionInfo,
- * label, protectedArtifact, taskLedger, workerRun) return 0 so they never
+ * label, protectedArtifact, taskLedger, decisionLedger, workerRun) return 0 so they never
  * distort the context budget.
  */
 export function estimateTokens(entry: SessionEntry): number {
@@ -76,6 +76,7 @@ export function estimateTokens(entry: SessionEntry): number {
 		case "label":
 		case "protectedArtifact":
 		case "taskLedger":
+		case "decisionLedger":
 		case "workerRun":
 			return 0;
 	}

package/src/domains/session/context-ledger.ts

@@ -84,6 +84,12 @@ export interface BuildContextLedgerInput {
 	 * a prompt has compiled.
 	 */
 	projectPreload?: string | null;
+	/**
+	 * Absolute paths of the effective project handbooks the compiled prompt
+	 * selected, ancestor to nearest. Null before a prompt has compiled; empty
+	 * when the workspace has no parseable handbook.
+	 */
+	projectHandbookFiles?: ReadonlyArray<string> | null;
 	lastCompaction?: {
 		stage: string;
 		tokensBefore: number;
@@ -152,6 +158,11 @@ export interface ContextLedger {
 	compactionAuto: boolean;
 	/** Preload class label for the project category detail line; null when unknown. */
 	projectPreload: string | null;
+	/**
+	 * Which handbook files won for this session, ancestor to nearest (an
+	 * override resets the inherited chain). Null before a prompt has compiled.
+	 */
+	projectHandbookFiles: ReadonlyArray<string> | null;
 	toolCount: number;
 	/** Non-empty content categories in display order (excludes reserve/free). */
 	groups: ReadonlyArray<ContextLedgerGroup>;
@@ -170,6 +181,8 @@ export interface ContextLedger {
 const SEGMENT_CATEGORY: Readonly<Record<string, ContextLedgerCategory>> = {
 	identity: "system",
 	"operating-contract": "system",
+	delegation: "agents",
+	skills: "skills",
 	safety: "system",
 	runtime: "system",
 	"tool-contract": "system",
@@ -339,6 +352,7 @@ export function buildContextLedger(input: BuildContextLedgerInput): ContextLedge
 		compactionThreshold: effectiveThreshold,
 		compactionAuto: input.compactionAuto === true,
 		projectPreload: input.projectPreload ?? null,
+		projectHandbookFiles: input.projectHandbookFiles ?? null,
 		toolCount: Math.max(0, Math.floor(input.toolCount ?? 0)),
 		groups,
 		meter,

package/src/domains/session/contract.ts

@@ -47,6 +47,14 @@ export type ClioSessionMetaExtension = {
 	workspace?: WorkspaceSnapshot;
 	/** Ordered record of skills activated in this session. */
 	skillActivations?: SkillActivation[];
+	/**
+	 * The turn `/tree` last switched the append point to, persisted so it
+	 * survives quit + resume. `resume()`/`switchBranch()` prefer this over
+	 * inferring the leaf from timestamps (`computeLeafId`) when it still
+	 * names a real turn; a plain append clears it, since once the tree grows
+	 * past it the inferred newest-node leaf is correct again.
+	 */
+	pinnedLeafTurnId?: string | null;
 };
 
 export type SessionMeta = ClioSessionMeta & ClioSessionMetaExtension;
@@ -130,6 +138,13 @@ export interface SessionContract {
 	 * otherwise the helper appends directly to that session's transcript.
 	 */
 	editLabel(turnId: string, label: string, sessionId?: string): void;
+	/**
+	 * Persist the session's display name as a session-wide SessionInfoEntry.
+	 * Empty or whitespace-only names clear the name when history is rebuilt.
+	 * If the target session is current, writes flow through the live writer;
+	 * otherwise the entry is durably appended directly to its transcript.
+	 */
+	setName(name: string, sessionId?: string): void;
 	/**
 	 * Remove the given session. By default, wipes the session directory.
 	 * `opts.keepFiles` preserves the transcript and only tombstones meta.json.

package/src/domains/session/decision-board.ts

@@ -0,0 +1,190 @@
+import type { AskUserToolPolicy } from "../../tools/registry.js";
+import type { DecisionLedgerEntry, DecisionRecord } from "./entries.js";
+
+export interface DecisionLedgerEntryFields {
+	kind: "decisionLedger";
+	parentTurnId: string;
+	interviewId: string;
+	interviewStatus: "complete" | "cancelled";
+	startedAt: string;
+	endedAt: string;
+	roundCount: number;
+	summary?: string;
+	transcriptPath?: string;
+	decisions: DecisionRecord[];
+}
+
+export interface DecisionBoardStoreDeps {
+	/** Current session id, used to keep the in-memory fold scoped to one ledger. */
+	getSessionId?: () => string | null;
+	/** Active-path entries for the current session. */
+	readEntries?: () => ReadonlyArray<unknown>;
+	/** The current branch leaf used to anchor operator-authored revisions. */
+	getActiveLeafTurnId?: () => string | null;
+	/** Acknowledged session append. A throw means the board did not change. */
+	appendEntry?: (entry: DecisionLedgerEntryFields) => void;
+	now?: () => Date;
+}
+
+export interface DecisionBoardStore {
+	/** Latest snapshot per interview, newest interview first. */
+	snapshot(): ReadonlyArray<DecisionLedgerEntry>;
+	/** Persist the one host-finalized snapshot for a settled interview. */
+	recordFinalizedInterview(policy: AskUserToolPolicy): boolean;
+	/** Append an operator revision snapshot anchored to the active branch leaf. */
+	supersede(interviewId: string, key: string, correction?: string): DecisionLedgerEntryFields;
+	/** Force the next read to refold, including after a same-session tree switch. */
+	invalidate(): void;
+}
+
+function answeredAtForDecision(policy: AskUserToolPolicy, sourceQuestion: string): string | undefined {
+	for (let index = policy.rounds.length - 1; index >= 0; index -= 1) {
+		const round = policy.rounds[index];
+		if (!round?.answeredAt) continue;
+		if (round.answers.some((answer) => answer.question === sourceQuestion)) return round.answeredAt;
+		if (round.questions.some((question) => question.question === sourceQuestion)) return round.answeredAt;
+	}
+	return undefined;
+}
+
+/**
+ * Convert the settled, host-owned policy into the complete durable snapshot.
+ * The policy already keeps last-value-wins decisions; the defensive map also
+ * makes conversion deterministic for hand-built policies and older callers.
+ */
+export function finalizedInterviewEntryFields(policy: AskUserToolPolicy): DecisionLedgerEntryFields | null {
+	if (policy.rounds.length === 0 && policy.decisions.length === 0) return null;
+	if (!policy.turnId) throw new Error(`decision board: interview ${policy.id} has no originating user turn`);
+	if (policy.status !== "complete" && policy.status !== "cancelled") {
+		throw new Error(`decision board: interview ${policy.id} finalized with status ${policy.status}`);
+	}
+	const endedAt = policy.endedAt ?? policy.updatedAt;
+	const decisionsByKey = new Map<string, DecisionRecord>();
+	for (const decision of policy.decisions) {
+		const decidedAt = decision.source_question
+			? (answeredAtForDecision(policy, decision.source_question) ?? endedAt)
+			: endedAt;
+		decisionsByKey.set(decision.key, {
+			key: decision.key,
+			value: decision.value,
+			...(decision.label ? { label: decision.label } : {}),
+			...(decision.source_question ? { source_question: decision.source_question } : {}),
+			status: "active",
+			decidedAt,
+		});
+	}
+	return {
+		kind: "decisionLedger",
+		parentTurnId: policy.turnId,
+		interviewId: policy.id,
+		interviewStatus: policy.status,
+		startedAt: policy.startedAt,
+		endedAt,
+		roundCount: policy.rounds.length,
+		...(policy.summary ? { summary: policy.summary } : {}),
+		...(policy.transcriptPath ? { transcriptPath: policy.transcriptPath } : {}),
+		decisions: [...decisionsByKey.values()],
+	};
+}
+
+function isDecisionLedgerEntry(value: unknown): value is DecisionLedgerEntry {
+	return !!value && typeof value === "object" && (value as { kind?: unknown }).kind === "decisionLedger";
+}
+
+/** Last full snapshot wins independently for each interview. */
+export function foldDecisionBoard(entries: ReadonlyArray<unknown>): DecisionLedgerEntry[] {
+	const lastByInterview = new Map<string, { entry: DecisionLedgerEntry; index: number }>();
+	for (let index = 0; index < entries.length; index += 1) {
+		const raw = entries[index];
+		if (!isDecisionLedgerEntry(raw)) continue;
+		lastByInterview.set(raw.interviewId, { entry: raw, index });
+	}
+	return [...lastByInterview.values()]
+		.sort((left, right) => {
+			const byEndedAt = right.entry.endedAt.localeCompare(left.entry.endedAt);
+			return byEndedAt !== 0 ? byEndedAt : right.index - left.index;
+		})
+		.map(({ entry }) => entry);
+}
+
+function activeLeafFromEntries(entries: ReadonlyArray<unknown>): string | null {
+	for (let index = entries.length - 1; index >= 0; index -= 1) {
+		const entry = entries[index];
+		if (entry && typeof entry === "object" && (entry as { kind?: unknown }).kind === "message") {
+			const turnId = (entry as { turnId?: unknown }).turnId;
+			if (typeof turnId === "string" && turnId.length > 0) return turnId;
+		}
+	}
+	return null;
+}
+
+export function createDecisionBoardStore(deps: DecisionBoardStoreDeps = {}): DecisionBoardStore {
+	let cachedSessionId: string | null | undefined;
+	let dirty = true;
+	let interviews: DecisionLedgerEntry[] = [];
+
+	const syncToSession = (): void => {
+		const sessionId = deps.getSessionId?.() ?? null;
+		if (!dirty && sessionId === cachedSessionId) return;
+		const entries = deps.readEntries?.() ?? [];
+		interviews = foldDecisionBoard(entries);
+		cachedSessionId = sessionId;
+		dirty = false;
+	};
+
+	const append = (entry: DecisionLedgerEntryFields): void => {
+		if (!deps.appendEntry) throw new Error("decision board: no session ledger is available");
+		deps.appendEntry(entry);
+		// Read the acknowledged append back through the active-path source. This
+		// never publishes a snapshot the ledger did not accept.
+		dirty = true;
+	};
+
+	return {
+		snapshot(): ReadonlyArray<DecisionLedgerEntry> {
+			syncToSession();
+			return interviews;
+		},
+		recordFinalizedInterview(policy: AskUserToolPolicy): boolean {
+			const entry = finalizedInterviewEntryFields(policy);
+			if (entry === null) return false;
+			append(entry);
+			return true;
+		},
+		supersede(interviewId: string, key: string, correction?: string): DecisionLedgerEntryFields {
+			syncToSession();
+			const interview = interviews.find((candidate) => candidate.interviewId === interviewId);
+			if (!interview) throw new Error(`decision board: interview ${interviewId} was not found on the active branch`);
+			const selected = interview.decisions.find((decision) => decision.key === key);
+			if (!selected) throw new Error(`decision board: decision ${key} was not found in interview ${interviewId}`);
+			const revisedAt = (deps.now?.() ?? new Date()).toISOString();
+			const normalizedCorrection = correction?.trim();
+			const entries = deps.readEntries?.() ?? [];
+			const parentTurnId = deps.getActiveLeafTurnId?.() ?? activeLeafFromEntries(entries);
+			if (!parentTurnId) throw new Error("decision board: no active branch leaf is available for the revision");
+			const revision: DecisionLedgerEntryFields = {
+				kind: "decisionLedger",
+				parentTurnId,
+				interviewId: interview.interviewId,
+				interviewStatus: interview.interviewStatus,
+				startedAt: interview.startedAt,
+				endedAt: interview.endedAt,
+				roundCount: interview.roundCount,
+				...(interview.summary ? { summary: interview.summary } : {}),
+				...(interview.transcriptPath ? { transcriptPath: interview.transcriptPath } : {}),
+				decisions: interview.decisions.map((decision) => {
+					if (decision.key !== selected.key) return { ...decision };
+					const next: DecisionRecord = { ...decision, status: "superseded", revisedAt };
+					if (normalizedCorrection) next.correction = normalizedCorrection;
+					else delete next.correction;
+					return next;
+				}),
+			};
+			append(revision);
+			return revision;
+		},
+		invalidate(): void {
+			dirty = true;
+		},
+	};
+}

package/src/domains/session/entries.ts

@@ -85,10 +85,10 @@ export interface BranchSummaryEntry extends BaseSessionEntry {
 
 /**
  * Why a compaction run fired. Persisted on CompactionSummaryEntry so post-mortem
- * tools can distinguish a threshold-driven shrink from a user-issued /compact
+ * tools can distinguish a threshold-driven shrink from a user-issued `/context compact`
  * and from a context-overflow retry.
  *   - "auto"      : pre-submit context-pressure trigger via shouldCompact().
- *   - "force"     : explicit /compact slash command or CLIO_CODER_FORCE_COMPACT=1.
+ *   - "force"     : explicit `/context compact` command or CLIO_CODER_FORCE_COMPACT=1.
  *   - "overflow"  : compact-and-retry path after a context overflow error.
  */
 export type CompactionTrigger = "auto" | "force" | "overflow";
@@ -183,6 +183,8 @@ export interface TaskLedgerGoal {
 	status: TaskLedgerStatus;
 	parentGoalId?: string | null;
 	description?: string;
+	origin?: "agent" | "user";
+	userTaskId?: string;
 }
 
 export interface TaskLedgerValidationEvidence {
@@ -197,12 +199,39 @@ export interface TaskLedgerValidationEvidence {
 
 export interface TaskLedgerEntry extends BaseSessionEntry {
 	kind: "taskLedger";
+	boardId?: string;
 	goals: TaskLedgerGoal[];
 	subgoals: TaskLedgerGoal[];
 	activeRunIds: string[];
 	requiredValidationEvidence: TaskLedgerValidationEvidence[];
 }
 
+export type DecisionStatus = "active" | "superseded";
+
+export interface DecisionRecord {
+	key: string;
+	value: string;
+	label?: string;
+	source_question?: string;
+	status: DecisionStatus;
+	decidedAt: string;
+	revisedAt?: string;
+	correction?: string;
+}
+
+/** One complete, branch-anchored snapshot of a settled operator interview. */
+export interface DecisionLedgerEntry extends BaseSessionEntry {
+	kind: "decisionLedger";
+	interviewId: string;
+	interviewStatus: "complete" | "cancelled";
+	startedAt: string;
+	endedAt: string;
+	roundCount: number;
+	summary?: string;
+	transcriptPath?: string;
+	decisions: DecisionRecord[];
+}
+
 /** Who asked for a dispatched run. Internal runs never reach the transcript, so they never reach this entry. */
 export type WorkerRunOrigin = "user" | "agent";
 
@@ -261,6 +290,7 @@ export type SessionEntry =
 	| ProtectedArtifactEntry
 	| SkillActivationEntry
 	| TaskLedgerEntry
+	| DecisionLedgerEntry
 	| WorkerRunEntry;
 
 export type SessionFileEntry = SessionHeader | SessionEntry;
@@ -285,6 +315,7 @@ export const SESSION_ENTRY_KINDS = [
 	"protectedArtifact",
 	"skillActivation",
 	"taskLedger",
+	"decisionLedger",
 	"workerRun",
 ] as const;
 
@@ -354,6 +385,8 @@ const TASK_LEDGER_EVIDENCE_STATUSES: readonly TaskLedgerEvidenceStatus[] = [
 	"failed",
 	"missing",
 ];
+const DECISION_STATUSES: readonly DecisionStatus[] = ["active", "superseded"];
+const DECISION_INTERVIEW_STATUSES = ["complete", "cancelled"] as const;
 const WORKER_RUN_ORIGINS: readonly WorkerRunOrigin[] = ["user", "agent"];
 const WORKER_RUN_RUNTIME_KINDS: readonly WorkerRunRuntimeKind[] = ["clio", "acp", "claude-sdk", "claude-code"];
 
@@ -372,7 +405,11 @@ function isTaskLedgerGoal(value: unknown): value is TaskLedgerGoal {
 	if (!isString(value.id) || !isString(value.title)) return false;
 	if (!isOneOf(value.status, TASK_LEDGER_STATUSES)) return false;
 	if (value.parentGoalId !== undefined && !isNullableString(value.parentGoalId)) return false;
-	return isOptionalString(value.description);
+	const hasPairedProvenance =
+		value.origin === "user"
+			? isString(value.userTaskId) && /^u[1-9]\d*$/.test(value.userTaskId)
+			: (value.origin === undefined || value.origin === "agent") && value.userTaskId === undefined;
+	return isOptionalString(value.description) && hasPairedProvenance;
 }
 
 function isTaskLedgerEvidence(value: unknown): value is TaskLedgerValidationEvidence {
@@ -387,6 +424,17 @@ function isTaskLedgerEvidence(value: unknown): value is TaskLedgerValidationEvid
 	);
 }
 
+function isDecisionRecord(value: unknown): value is DecisionRecord {
+	if (!isRecord(value)) return false;
+	if (!isString(value.key) || !/^[a-z0-9]+(?:_[a-z0-9]+)*$/.test(value.key)) return false;
+	if (!isString(value.value) || !isOneOf(value.status, DECISION_STATUSES) || !isString(value.decidedAt)) return false;
+	if (!isOptionalString(value.label) || !isOptionalString(value.source_question)) return false;
+	if (!isOptionalString(value.revisedAt) || !isOptionalString(value.correction)) return false;
+	return value.status === "superseded"
+		? isString(value.revisedAt)
+		: value.revisedAt === undefined && value.correction === undefined;
+}
+
 function isOptionalCompactionUsage(value: unknown): boolean {
 	if (value === undefined) return true;
 	if (!isRecord(value)) return false;
@@ -487,6 +535,7 @@ export function isSessionEntry(value: unknown): value is SessionEntry {
 			return isSkillActivation(v.activation);
 		case "taskLedger":
 			return (
+				isOptionalString(v.boardId) &&
 				Array.isArray(v.goals) &&
 				v.goals.every(isTaskLedgerGoal) &&
 				Array.isArray(v.subgoals) &&
@@ -495,6 +544,20 @@ export function isSessionEntry(value: unknown): value is SessionEntry {
 				Array.isArray(v.requiredValidationEvidence) &&
 				v.requiredValidationEvidence.every(isTaskLedgerEvidence)
 			);
+		case "decisionLedger":
+			return (
+				isString(v.interviewId) &&
+				isOneOf(v.interviewStatus, DECISION_INTERVIEW_STATUSES) &&
+				isString(v.startedAt) &&
+				isString(v.endedAt) &&
+				isNumber(v.roundCount) &&
+				Number.isInteger(v.roundCount) &&
+				v.roundCount >= 0 &&
+				isOptionalString(v.summary) &&
+				isOptionalString(v.transcriptPath) &&
+				Array.isArray(v.decisions) &&
+				v.decisions.every(isDecisionRecord)
+			);
 		case "workerRun":
 			return (
 				isString(v.assignmentId) &&