@iowarp/clio-coder 0.3.3 → 0.3.6

package/src/domains/safety/decision-presentation.ts

@@ -0,0 +1,268 @@
+import type { ActionClass } from "./action-classifier.js";
+import type { AutonomyExposure } from "./autonomy.js";
+
+/** Closed consequence categories used only to explain an already-made decision request. */
+export const DECISION_TIERS = ["conversation", "workspace", "outward", "safety-net", "system", "worker"] as const;
+
+export type DecisionTier = (typeof DECISION_TIERS)[number];
+export type DecisionSemanticToken = "accent" | "action" | "warning";
+export type DecisionRequestKind = "question" | "permission";
+export type DecisionAffectedScope = "conversation" | "workspace" | "outward" | "system";
+export type DecisionReversibility = "reversible" | "limited" | "unknown";
+export type DecisionAuthorityEffect = "records-answer" | "grants-once";
+export type DecisionActionId = "record-answer" | "cancel" | "approve-once" | "deny" | "stop";
+
+export type DecisionAxis =
+	| { kind: "answer" }
+	| { kind: "autonomy"; level: string }
+	| { kind: "safety-net"; ruleId: string };
+
+export type DecisionOrigin = { kind: "main" } | { kind: "worker"; agentId: string; runId: string };
+
+/**
+ * Facts the host has already authenticated or derived from enforced policy.
+ * No model-authored title, question, reason, summary, or option label belongs
+ * here, so prose has no path to the tier selection.
+ */
+export interface TrustedDecisionFacts {
+	requestKind: DecisionRequestKind;
+	axis: DecisionAxis;
+	exposure: AutonomyExposure;
+	affectedScope: DecisionAffectedScope;
+	reversibility: DecisionReversibility;
+	origin: DecisionOrigin;
+	authorityEffect: DecisionAuthorityEffect;
+	tool?: string;
+	actionClass?: ActionClass;
+}
+
+export interface DecisionPresentationAction {
+	id: DecisionActionId;
+	label: string;
+	consequence: string;
+}
+
+/**
+ * This projection contains display data only. Registry admission and interview
+ * settlement never consume it, and it contains no allow, deny, or autonomy
+ * disposition that an execution layer could mistake for authority.
+ */
+export interface DecisionPresentation {
+	tier: DecisionTier;
+	tierLabel: string;
+	title: string;
+	semanticToken: DecisionSemanticToken;
+	authorizationCopy: string;
+	consequenceCopy: string;
+	reversibilityCopy: string;
+	requestedByCopy: string;
+	requiredActions: ReadonlyArray<DecisionPresentationAction>;
+}
+
+const ACTION_CLASSES = new Set<ActionClass>([
+	"read",
+	"write",
+	"execute",
+	"dispatch",
+	"system_modify",
+	"git_destructive",
+	"unknown",
+]);
+
+/** Unknown or malformed action classes classify conservatively as unknown. */
+export function decisionActionClass(value: unknown): ActionClass {
+	return typeof value === "string" && ACTION_CLASSES.has(value as ActionClass) ? (value as ActionClass) : "unknown";
+}
+
+function actionConsequence(actionClass: ActionClass): {
+	affectedScope: DecisionAffectedScope;
+	reversibility: DecisionReversibility;
+} {
+	switch (actionClass) {
+		case "read":
+			return { affectedScope: "workspace", reversibility: "reversible" };
+		case "write":
+			return { affectedScope: "workspace", reversibility: "reversible" };
+		case "execute":
+		case "dispatch":
+			return { affectedScope: "workspace", reversibility: "limited" };
+		case "system_modify":
+		case "git_destructive":
+		case "unknown":
+			return { affectedScope: "system", reversibility: "unknown" };
+	}
+}
+
+export function decisionFactsForPermission(input: {
+	tool: string;
+	actionClass: ActionClass;
+	axis: Exclude<DecisionAxis, { kind: "answer" }>;
+	origin: DecisionOrigin;
+	exposure?: AutonomyExposure;
+}): TrustedDecisionFacts {
+	const exposure = input.exposure ?? "local";
+	const consequence = actionConsequence(input.actionClass);
+	return {
+		requestKind: "permission",
+		axis: input.axis,
+		exposure,
+		affectedScope: exposure === "outward" ? "outward" : consequence.affectedScope,
+		reversibility: exposure === "outward" ? "limited" : consequence.reversibility,
+		origin: input.origin,
+		authorityEffect: "grants-once",
+		tool: input.tool,
+		actionClass: input.actionClass,
+	};
+}
+
+export function decisionFactsForAnswer(exposure: AutonomyExposure): TrustedDecisionFacts {
+	return {
+		requestKind: "question",
+		axis: { kind: "answer" },
+		exposure,
+		affectedScope: exposure === "outward" ? "outward" : "conversation",
+		reversibility: exposure === "outward" ? "limited" : "reversible",
+		origin: { kind: "main" },
+		authorityEffect: "records-answer",
+	};
+}
+
+function classifyTier(facts: TrustedDecisionFacts): DecisionTier {
+	if (facts.origin.kind === "worker") return "worker";
+	if (facts.affectedScope === "system") return "system";
+	if (facts.exposure === "outward" || facts.affectedScope === "outward") return "outward";
+	if (facts.axis.kind === "safety-net") return "safety-net";
+	if (facts.authorityEffect === "grants-once") return "workspace";
+	return "conversation";
+}
+
+function tierIdentity(tier: DecisionTier): {
+	tierLabel: string;
+	title: string;
+	semanticToken: DecisionSemanticToken;
+} {
+	switch (tier) {
+		case "conversation":
+			return { tierLabel: "Conversational answer", title: "Answer a question", semanticToken: "accent" };
+		case "workspace":
+			return { tierLabel: "Workspace authority", title: "Approve workspace action", semanticToken: "action" };
+		case "outward":
+			return { tierLabel: "Outward consequence", title: "Confirm outward consequence", semanticToken: "warning" };
+		case "safety-net":
+			return { tierLabel: "Safety-net confirmation", title: "Safety-net confirmation", semanticToken: "warning" };
+		case "system":
+			return { tierLabel: "System change", title: "Approve system change", semanticToken: "warning" };
+		case "worker":
+			return { tierLabel: "Worker escalation", title: "Worker needs approval", semanticToken: "action" };
+	}
+}
+
+function requestedByCopy(facts: TrustedDecisionFacts): string {
+	const requester =
+		facts.origin.kind === "worker" ? `worker ${facts.origin.agentId} (run ${facts.origin.runId})` : "main agent";
+	if (facts.axis.kind === "answer") return requester;
+	if (facts.axis.kind === "safety-net") return `${requester} through safety-net rail ${facts.axis.ruleId}`;
+	return `${requester} through autonomy level (${facts.axis.level})`;
+}
+
+function authorizationCopy(facts: TrustedDecisionFacts): string {
+	if (facts.authorityEffect === "records-answer") {
+		return facts.exposure === "outward"
+			? "Your response records an answer about an outward step. It does not publish or send anything by itself."
+			: "Your response records an answer for this interview. It grants no tool authority.";
+	}
+	const tool = facts.tool ?? "the presented tool";
+	const actionClass = facts.actionClass ?? "unknown";
+	if (tool === "ask_user" && facts.exposure === "outward") {
+		return "Approval opens this one outward-decision interview. It does not publish or send anything by itself.";
+	}
+	return `Approval authorizes one ${actionClass} call to ${tool}. It does not change the autonomy level.`;
+}
+
+function consequenceCopy(facts: TrustedDecisionFacts, tier: DecisionTier): string {
+	switch (tier) {
+		case "conversation":
+			return "The answer stays in this session's decision record.";
+		case "workspace":
+			return facts.actionClass === "read"
+				? "The call reads within the workspace without mutating it."
+				: "The call can affect files or processes inside the workspace.";
+		case "outward":
+			return "The resulting step can reach people or systems outside the workspace.";
+		case "safety-net":
+			return "An always-on safety-net rail requires a one-shot operator decision before this call can run.";
+		case "system":
+			return "The call can change state outside the workspace or state the classifier cannot safely bound.";
+		case "worker":
+			return "A dispatched worker is parked. Your answer returns only to that run's exact request.";
+	}
+}
+
+function reversibilityCopy(facts: TrustedDecisionFacts): string {
+	if (facts.requestKind === "question") {
+		return facts.reversibility === "reversible"
+			? "Reversible: yes. The recorded answer can be superseded later."
+			: "Reversible: not guaranteed. An outward step that later uses this answer may have lasting effects.";
+	}
+	if (facts.actionClass === "read" && facts.reversibility === "reversible") {
+		return "Reversible: yes. This call does not mutate the workspace.";
+	}
+	switch (facts.reversibility) {
+		case "reversible":
+			return "Reversible: yes. Workspace changes can be reviewed and reverted.";
+		case "limited":
+			return "Reversible: not guaranteed. Effects that already ran or reached an outward system may remain.";
+		case "unknown":
+			return "Reversible: unknown. Treat the effect as not safely reversible.";
+	}
+}
+
+function requiredActions(facts: TrustedDecisionFacts, tier: DecisionTier): ReadonlyArray<DecisionPresentationAction> {
+	if (facts.authorityEffect === "records-answer") {
+		return [
+			{
+				id: "record-answer",
+				label: facts.exposure === "outward" ? "Record outward answer" : "Record answer",
+				consequence: "Records the selected or typed answer without granting tool authority.",
+			},
+			{ id: "cancel", label: "Cancel", consequence: "Closes the interview without recording an answer for this round." },
+		];
+	}
+	const approveLabel =
+		tier === "system"
+			? "Approve system change once"
+			: tier === "safety-net"
+				? "Approve guarded action once"
+				: tier === "worker"
+					? "Approve worker request once"
+					: tier === "outward"
+						? "Approve outward decision once"
+						: "Approve workspace action once";
+	const stopConsequence =
+		facts.origin.kind === "worker"
+			? "Denies this worker request and ends the active main-agent turn. Other worker requests retain their timeout policy."
+			: "Denies every parked request from this turn and ends the run.";
+	return [
+		{
+			id: "approve-once",
+			label: approveLabel,
+			consequence: "Runs only the presented request and does not change the autonomy level.",
+		},
+		{ id: "deny", label: "Deny this request", consequence: "Denies only the presented request and advances the queue." },
+		{ id: "stop", label: "Deny and stop", consequence: stopConsequence },
+	];
+}
+
+/** Pure presentation classifier. It performs no I/O and has no execution authority. */
+export function classifyDecisionPresentation(facts: TrustedDecisionFacts): DecisionPresentation {
+	const tier = classifyTier(facts);
+	return {
+		tier,
+		...tierIdentity(tier),
+		authorizationCopy: authorizationCopy(facts),
+		consequenceCopy: consequenceCopy(facts, tier),
+		reversibilityCopy: reversibilityCopy(facts),
+		requestedByCopy: requestedByCopy(facts),
+		requiredActions: requiredActions(facts, tier),
+	};
+}

package/src/domains/safety/default-path-policy.ts

@@ -61,6 +61,14 @@ export const DEFAULT_DAMAGE_CONTROL_PATH_POLICY: PathPolicyInput = {
 		"*.dump",
 	],
 	readOnlyPaths: [
+		// Clio's own operator-authority files in the project. `safety.yaml` is the
+		// policy that gates the model's tools, and `verifiers.yaml` is an argv
+		// catalog that verify() executes; a model that can author either one can
+		// widen its own permissions in two tool calls. Both are authored by the
+		// operator through the CLI (`clio-coder verifiers author` lands nothing
+		// before `--yes`), so model-side writes and deletes are refused.
+		".clio-coder/safety.yaml",
+		".clio-coder/verifiers.yaml",
 		"/etc/",
 		"/usr/",
 		"/bin/",

package/src/domains/safety/finish-contract.ts

@@ -1,5 +1,5 @@
 import { ToolNames } from "../../core/tool-names.js";
-import { isVerificationScriptName } from "../../core/verification-scripts.js";
+import { isProjectVerifierCheckId, isVerificationScriptName } from "../../core/verification-scripts.js";
 import {
 	detectValidationCommand,
 	extractCommandDeleteTargets,
@@ -399,8 +399,9 @@ export function typedValidationSummary(toolName: string, payload: Record<string,
 			const path = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
 			return `verify frontend ${path}`;
 		}
-		if (!isVerificationScriptName(check)) return null;
-		return `npm run ${check}`;
+		if (isVerificationScriptName(check)) return `npm run ${check}`;
+		if (isProjectVerifierCheckId(check)) return `verify ${check}`;
+		return null;
 	}
 	return null;
 }

package/src/domains/safety/policy-engine.ts

@@ -4,6 +4,7 @@ import { artifactDefaultPath } from "../../core/artifact-paths.js";
 import { canonicalizeExistingPath } from "../../core/path-canonical.js";
 import { ToolNames } from "../../core/tool-names.js";
 import { clioConfigDir } from "../../core/xdg.js";
+import { type DeclaredCheck, loadProjectVerifierCatalog } from "../../tools/verify/catalog.js";
 import { type ActionClass, type Classification, type ClassifierCall, classify } from "./action-classifier.js";
 import type { DamageControlMatch, DamageControlRule } from "./damage-control.js";
 import { DEFAULT_DAMAGE_CONTROL_PATH_POLICY, mergePathPolicyInputs } from "./default-path-policy.js";
@@ -225,7 +226,9 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			const rawClassification = classify(call);
 			const command = commandArg(call.args);
 			const callCwd = cwdArg(call.args, cwd);
-			const scan = damageControlScan(call);
+			const catalogCheck = resolveVerifyCatalogCheck(call, cwd);
+			const catalogCommand = catalogCheck === null ? null : catalogCheck.command.join(" ");
+			const scan = catalogCommand ?? damageControlScan(call);
 			const hit = scan ? matchSourcedRule(scan, sourcedRules) : null;
 			const classification = effectiveClassification(rawClassification, hit?.match);
 
@@ -335,8 +338,9 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			// command; the one carve-out is the exit-code-only presence check
 			// (`grep -q`/`grep -sq` with a ^NAME= pattern), which is the safe
 			// protocol the credentials skill teaches.
-			if (call.tool === ToolNames.Bash && command !== null) {
-				const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, command, callCwd);
+			const scannedCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+			if (scannedCommand !== null) {
+				const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, scannedCommand, callCwd);
 				if (secretRead !== null) {
 					const blockInput: Omit<
 						SafetyPolicyDecision,
@@ -407,9 +411,22 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			};
 			if (hit?.match.ruleId !== undefined) allowInput.ruleId = hit.match.ruleId;
 			if (hit?.match !== undefined) allowInput.match = hit.match;
-			// The typed execution tool (verify) is bounded by its own check
-			// allowlist, so it sits in the no-prompt set.
-			if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
+			// The typed execution tool (verify) sits in the no-prompt set when the
+			// check is a package script or the frontend validator: both are bounded
+			// by the verification-script family and run a fixed argv shape. A
+			// project-catalog check runs whatever argv the workspace file declares,
+			// so it is unrecognized: auto-edit parks it for one confirmation that
+			// shows the argv, full-auto runs it, and the damage-control match and
+			// zero-access scan above have already seen the declared vector.
+			if (classification.actionClass === "execute") {
+				allowInput.execRecognition = catalogCheck === null ? "recognized" : "unrecognized";
+				if (catalogCheck !== null) {
+					allowInput.reasons = [
+						...allowInput.reasons,
+						`project verifier '${catalogCheck.id}' runs declared argv: ${catalogCommand ?? ""}`,
+					];
+				}
+			}
 			return allowDecision(base, allowInput);
 		},
 		metadata() {
@@ -958,6 +975,31 @@ function damageControlScan(call: ClassifierCall): string {
 	return typeof pathArg === "string" ? pathArg : "";
 }
 
+/**
+ * The project-catalog check a verify call resolves to, or null for a listing,
+ * the frontend validator, a package script, or an id the catalog does not
+ * declare. The catalog is an argv vector the operator authored, but the file
+ * sits in the workspace, so the engine reads it fresh on every verify call and
+ * treats the declared argv exactly like a bash command string: it is what the
+ * damage-control rules and the zero-access read guard scan, and it is not in
+ * the no-prompt set. An unreadable or invalid catalog resolves to null here and
+ * fails closed in the tool itself.
+ */
+function resolveVerifyCatalogCheck(call: ClassifierCall, workspaceRoot: string): DeclaredCheck | null {
+	if (call.tool !== ToolNames.Verify) return null;
+	const check = call.args?.check;
+	if (typeof check !== "string") return null;
+	const id = check.trim();
+	if (id.length === 0 || id === "frontend") return null;
+	try {
+		const catalog = loadProjectVerifierCatalog(workspaceRoot);
+		if (!catalog.ok || catalog.source === null) return null;
+		return catalog.source.checks.find((candidate) => candidate.id === id) ?? null;
+	} catch {
+		return null;
+	}
+}
+
 function serializeArgs(args?: Record<string, unknown>): string {
 	if (!args) return "";
 	const parts: string[] = [];

package/src/domains/safety/redaction.ts

@@ -0,0 +1,73 @@
+/**
+ * Display-time secret redaction for tool arguments.
+ *
+ * Two surfaces need the same rules and must not drift. The transcript's tool
+ * renderer projects a call's arguments for the operator's own screen, and the
+ * worker tool-admission seam composes a bounded action descriptor that crosses
+ * the NDJSON stdout boundary. A credential that one of them scrubs and the
+ * other prints is a leak, so the patterns live here and both import them.
+ *
+ * This is presentation only. Execution, receipts, and the safety verdict all
+ * keep the original argument values; nothing here changes what a tool runs.
+ */
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+const SECRET_KEY_RE =
+	/(?:api[-_]?key|access[-_]?key|auth(?:orization)?|credential|password|private[-_]?key|secret|token)/iu;
+const ENV_KEY_RE = /^env(?:ironment)?$/iu;
+const SECRET_STRING_RE = /(https?:\/\/[^\s/@]+:)[^\s/@]+@/giu;
+const SECRET_URL_PARAM_RE =
+	/([?&](?:api[-_]?key|access[-_]?token|auth(?:orization)?|credential|password|secret|token)[^=\s]*=)[^&#\s]+/giu;
+const SECRET_ASSIGNMENT_RE =
+	/(?<![A-Z0-9_])((?:[A-Z0-9_]*(?:ACCESS|API|AUTH|CREDENTIAL|KEY|PASS(?:WORD)?|PRIVATE|SECRET|TOKEN)[A-Z0-9_]*)=)[^\s;&|]+/giu;
+const SECRET_FLAG_RE =
+	/(--?(?:[a-z0-9-]*(?:api[-_]?key|access[-_]?token|auth(?:orization)?|credential|password|secret|token)[a-z0-9-]*))(=|\s+)([^\s;&|]+)/giu;
+
+/** Scrub credentials embedded in one string: URL userinfo, query params, `KEY=value`, and `--flag value`. */
+export function redactSecretString(value: string): string {
+	return value
+		.replace(SECRET_STRING_RE, "$1[redacted]@")
+		.replace(SECRET_URL_PARAM_RE, "$1[redacted]")
+		.replace(SECRET_ASSIGNMENT_RE, "$1[redacted]")
+		.replace(SECRET_FLAG_RE, "$1$2[redacted]");
+}
+
+/** Whether an argument key names a secret outright, so its value never renders. */
+export function isSecretArgKey(key: string): boolean {
+	return SECRET_KEY_RE.test(key);
+}
+
+/** Whether an argument key names an environment block, whose every string value is a candidate secret. */
+function isEnvironmentArgKey(key: string): boolean {
+	return ENV_KEY_RE.test(key);
+}
+
+function redactEnvironmentValue(value: unknown, depth: number): unknown {
+	if (depth > 8) return "[redacted nested values]";
+	if (typeof value === "string") return "[redacted]";
+	if (Array.isArray(value)) return value.map((item) => redactEnvironmentValue(item, depth + 1));
+	if (!isPlainObject(value)) return value;
+	const out: Record<string, unknown> = {};
+	for (const [childKey, childValue] of Object.entries(value)) {
+		out[childKey] = redactEnvironmentValue(childValue, depth + 1);
+	}
+	return out;
+}
+
+/** Project tool arguments for display only; execution and receipts retain the original values. */
+export function redactToolArgs(value: unknown, key = "", depth = 0): unknown {
+	if (isSecretArgKey(key)) return "[redacted]";
+	if (isEnvironmentArgKey(key)) return redactEnvironmentValue(value, depth);
+	if (typeof value === "string") return redactSecretString(value);
+	if (depth > 8) return "[redacted nested values]";
+	if (Array.isArray(value)) return value.map((item) => redactToolArgs(item, key, depth + 1));
+	if (!isPlainObject(value)) return value;
+	const out: Record<string, unknown> = {};
+	for (const [childKey, childValue] of Object.entries(value)) {
+		out[childKey] = redactToolArgs(childValue, childKey, depth + 1);
+	}
+	return out;
+}

package/src/domains/session/compaction/compact.ts

@@ -12,6 +12,8 @@
 
 import { stream } from "../../../engine/ai.js";
 import type { EngineModel, Usage } from "../../../engine/types.js";
+import { foldWorkingSet } from "../../context/working-set/fold.js";
+import { recallableRefListing } from "../../context/working-set/recall.js";
 import type { CompactionUsage, SessionEntry } from "../entries.js";
 import { serializeConversation } from "./branch-summary.js";
 import { findCutPoint } from "./cut-point.js";
@@ -307,6 +309,23 @@ function formatFileOperations(fileOps: FileOperations): string {
 	return sections.length > 0 ? `\n\n${sections.join("\n\n")}` : "";
 }
 
+function formatRecallableRefs(entries: ReadonlyArray<SessionEntry>, firstKeptEntryIndex: number): string {
+	const entryIndexes = new Map<string, number>();
+	for (let index = 0; index < entries.length; index += 1) {
+		const entry = entries[index];
+		if (entry) entryIndexes.set(entry.turnId, index);
+	}
+	const view = foldWorkingSet(entries);
+	const evictedBeforeCut = new Map(
+		[...view.evicted].filter(([ref]) => (entryIndexes.get(ref) ?? Number.POSITIVE_INFINITY) < firstKeptEntryIndex),
+	);
+	const listing = recallableRefListing(entries, { ...view, evicted: evictedBeforeCut });
+	if (listing.refs.length === 0) return "";
+	const rows = [...listing.refs];
+	if (listing.remaining > 0) rows.push(`and ${listing.remaining} more`);
+	return `\n\n<recallable-refs>\n${rows.join("\n")}\n</recallable-refs>`;
+}
+
 function numberOrZero(value: unknown): number {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
 }
@@ -457,7 +476,10 @@ export async function compact(input: CompactInput): Promise<CompactResult> {
 		}
 	}
 
-	const summary = `${summaryParts.join("\n\n---\n\n").trim()}${formatFileOperations(fileOps)}`.trim();
+	const summary = `${summaryParts.join("\n\n---\n\n").trim()}${formatFileOperations(fileOps)}${formatRecallableRefs(
+		input.entries,
+		cut.firstKeptEntryIndex,
+	)}`.trim();
 
 	return {
 		summary,

package/src/domains/session/compaction/cut-point.ts

@@ -72,6 +72,8 @@ function isValidCutPoint(entry: SessionEntry): boolean {
 		case "taskLedger":
 		case "decisionLedger":
 		case "workerRun":
+		case "contextEviction":
+		case "contextRecall":
 			return false;
 	}
 }

package/src/domains/session/compaction/tokens.ts

@@ -34,7 +34,18 @@ export interface TokenEstimator {
 }
 
 function estimateMessage(entry: MessageEntry): number {
-	return estimateAgentMessageTokens(entry);
+	// Usage invalidation is bookkeeping for token-anchor selection. The replay
+	// builder carries it as AgentMessage metadata, but providers never see it in
+	// message content, so it cannot change a projected entry's prompt cost. Drop
+	// it here so plan-time pricing and the post-event projection use one byte
+	// definition even though only the latter has applied the stamp.
+	if (entry.role !== "assistant" || !entry.payload || typeof entry.payload !== "object") {
+		return estimateAgentMessageTokens(entry);
+	}
+	const payload = entry.payload as Record<string, unknown>;
+	if (!("contextUsageInvalidated" in payload)) return estimateAgentMessageTokens(entry);
+	const { contextUsageInvalidated: _stamp, ...promptPayload } = payload;
+	return estimateAgentMessageTokens({ ...entry, payload: promptPayload });
 }
 
 function estimateBashExecution(entry: BashExecutionEntry): number {
@@ -78,6 +89,10 @@ export function estimateTokens(entry: SessionEntry): number {
 		case "taskLedger":
 		case "decisionLedger":
 		case "workerRun":
+		// Working-set bookkeeping: refs and markers, never bodies. The
+		// projection accounts for marker cost on the projected messages.
+		case "contextEviction":
+		case "contextRecall":
 			return 0;
 	}
 }

package/src/domains/session/context-ledger.ts

@@ -16,7 +16,7 @@
  * proportional reconciliation the footer bar already performs.
  */
 
-import type { ContextWindowSource } from "../providers/index.js";
+import type { ContextWindowSlots, ContextWindowSource } from "../providers/index.js";
 import { DEFAULT_COMPACTION_THRESHOLD } from "./compaction/auto.js";
 
 /** Distinct buckets a context window is divided into for display. */
@@ -46,6 +46,8 @@ export interface BuildContextLedgerInput {
 	contextWindow: number | null;
 	/** Which layer answered `contextWindow`; omitted before a runtime resolves. */
 	contextWindowSource?: ContextWindowSource | null;
+	/** The server-side split the probed window is a share of, when there is one. */
+	contextWindowSlots?: ContextWindowSlots | null;
 	/**
 	 * Per-segment token estimates from the prompt compiler's segment manifest.
 	 * When empty, `systemPromptTokens` is used as a single opaque system bucket.
@@ -122,6 +124,8 @@ export interface PromptCacheStats {
 	 * combination the overlay renders as a warning.
 	 */
 	backendVerdict: "hot" | "partial" | "cold" | "small" | null;
+	/** Cache disturbances Clio expected before the last settled run. */
+	expectedColdReasons?: ReadonlyArray<string>;
 }
 
 export interface ContextLedgerGroup {
@@ -144,6 +148,12 @@ export interface ContextLedger {
 	 * the difference decides whether autocompact fires in time.
 	 */
 	contextWindowSource: ContextWindowSource | null;
+	/**
+	 * Present when `contextWindow` is one slot's share of the server's KV
+	 * budget, so the overlay can show `196,608 (786,432 / 4 slots)` instead of
+	 * a number that looks like the whole server.
+	 */
+	contextWindowSlots: ContextWindowSlots | null;
 	/** Sum of every content category (system..pending). */
 	usedTokens: number;
 	/** Autocompact headroom held in reserve above the conversation. */
@@ -344,6 +354,7 @@ export function buildContextLedger(input: BuildContextLedgerInput): ContextLedge
 		model: input.model ?? null,
 		contextWindow: window,
 		contextWindowSource: input.contextWindowSource ?? null,
+		contextWindowSlots: input.contextWindowSlots ?? null,
 		usedTokens,
 		reserveTokens,
 		freeTokens,

package/src/domains/session/decision-board.ts

@@ -1,4 +1,5 @@
 import type { AskUserToolPolicy } from "../../tools/registry.js";
+import type { AutonomyExposure } from "../safety/autonomy.js";
 import type { DecisionLedgerEntry, DecisionRecord } from "./entries.js";
 
 export interface DecisionLedgerEntryFields {
@@ -11,6 +12,7 @@ export interface DecisionLedgerEntryFields {
 	roundCount: number;
 	summary?: string;
 	transcriptPath?: string;
+	exposure?: AutonomyExposure;
 	decisions: DecisionRecord[];
 }
 
@@ -83,6 +85,7 @@ export function finalizedInterviewEntryFields(policy: AskUserToolPolicy): Decisi
 		roundCount: policy.rounds.length,
 		...(policy.summary ? { summary: policy.summary } : {}),
 		...(policy.transcriptPath ? { transcriptPath: policy.transcriptPath } : {}),
+		exposure: policy.exposure ?? "local",
 		decisions: [...decisionsByKey.values()],
 	};
 }
@@ -172,6 +175,7 @@ export function createDecisionBoardStore(deps: DecisionBoardStoreDeps = {}): Dec
 				roundCount: interview.roundCount,
 				...(interview.summary ? { summary: interview.summary } : {}),
 				...(interview.transcriptPath ? { transcriptPath: interview.transcriptPath } : {}),
+				...(interview.exposure ? { exposure: interview.exposure } : {}),
 				decisions: interview.decisions.map((decision) => {
 					if (decision.key !== selected.key) return { ...decision };
 					const next: DecisionRecord = { ...decision, status: "superseded", revisedAt };