@iowarp/clio-coder 0.3.6 → 0.3.8

package/src/domains/dispatch/extension.ts

@@ -12,7 +12,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { type Dirent, existsSync, readdirSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve as resolvePath, sep } from "node:path";
-import { BusChannels, type DispatchCompletedPayload } from "../../core/bus-events.js";
+import { BusChannels, type DispatchCompletedPayload, type DispatchRunIdentity } from "../../core/bus-events.js";
 import { DEFAULT_SETTINGS, type DelegationToolGovernance } from "../../core/defaults.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
 import { GUARDRAIL_DEFAULTS } from "../../core/guardrails.js";
@@ -40,6 +40,12 @@ import { WORKER_RUNTIME_MEDIATES_CLIO_DISPATCH } from "../../engine/worker-runti
 import { toolPromptHintsForNames } from "../../tools/builtin-tool-catalog.js";
 import { networkToolsDisabled } from "../../tools/network-policy.js";
 import { applyToolProfile, assertToolProfileEnforceable, type ToolProfileName } from "../../tools/profiles.js";
+import {
+	applyTaskWorktree,
+	cleanupTaskWorktree,
+	createTaskWorktree,
+	gitCheckoutRoot,
+} from "../../tools/task-worktree.js";
 import { truncateUtf8 } from "../../tools/truncate-utf8.js";
 import {
 	serializeWorkerRuntimeDescriptor,
@@ -117,6 +123,7 @@ import { AssignmentRegistry, applyActiveRouteSelection, asAssignmentId } from ".
 import type { AssignmentAttemptStartEvent } from "./assignment-events.js";
 import { reconcileOrphanAssignments } from "./assignment-reconcile.js";
 import {
+	assignmentProcessOwnerAlive,
 	cancelStoredAssignment,
 	failQueuedAssignment,
 	getStoredAssignment,
@@ -138,6 +145,7 @@ import { type BatchState, createBatch, onRunComplete, snapshotBatch } from "./ba
 import { type RunToolBudgetEnvelope, resolveToolBudgetEnvelope } from "./budget-envelope.js";
 import { assessCapabilityMismatch, type CapabilityMismatch } from "./capability-match.js";
 import { capacityLeaseUsage, createNodeLeaseUsageReader } from "./capacity-lease.js";
+import { acquireCheckoutWriterLease, type CheckoutWriterLease } from "./checkout-writer-lease.js";
 import type {
 	DispatchAdmissionObserver,
 	DispatchContract,
@@ -159,6 +167,8 @@ import {
 import { routeFactVerdict } from "./fleet-preflight.js";
 import { competeStanceLiner, isBoundedGateRolePrompt } from "./gate-role-prompts.js";
 import { classifyHeartbeat, DEFAULT_HEARTBEAT_SPEC, type HeartbeatSpec, type HeartbeatStatus } from "./heartbeat.js";
+import { hostVerificationRejection, runHostVerification } from "./host-verification.js";
+import { renderDispatchIntentRequirements } from "./intent-requirements.js";
 import { adaptJointRouteInput } from "./joint-route-adapter.js";
 import {
 	configuredJointNodes,
@@ -173,6 +183,12 @@ import {
 	resultContractWasDue,
 	runStatusForOutcome,
 } from "./outcome.js";
+import {
+	type DispatchPathScope,
+	declaredScopeReplacementDiagnostic,
+	declaredScopeReplacementNotice,
+	resolveDispatchPathScope,
+} from "./path-scope.js";
 import { deriveEnvelopePhaseDurations, deriveRunPhaseDurations, recordRunTimingBestEffort } from "./phase-timing.js";
 import { createFleetPlacementPreviewResolver, createFleetPlacementResolver } from "./placement.js";
 import {
@@ -209,7 +225,7 @@ import { createRouteObserver, type RouteObservationHandle, type RouteObserver }
 import { reduceRouteQuality } from "./route-quality.js";
 import { defaultRoutingIntent } from "./routing-intent.js";
 import { detectRunIdentity } from "./run-identity.js";
-import { type Ledger, openLedger } from "./state.js";
+import { type Ledger, newRunId, openLedger } from "./state.js";
 import {
 	countToolCalls,
 	hasPotentiallyMutatingAttempt,
@@ -606,6 +622,14 @@ function recordWorkerRunEffect(recorder: RunEffectsRecorder, event: Record<strin
  */
 const DISPATCH_DRAIN_GRACE_MS = 2000;
 
+/**
+ * How many finalized runs keep their observed write targets in memory. The
+ * write boundary reads a run's record while closing the window it ran in, which
+ * is the same wave, so a few hundred runs of headroom is far more than the
+ * lookup ever reaches back for.
+ */
+const RUN_WRITE_TARGET_HISTORY = 512;
+
 async function awaitEventDrain(drained: Promise<void>, graceMs = DISPATCH_DRAIN_GRACE_MS): Promise<boolean> {
 	let timer: ReturnType<typeof setTimeout> | undefined;
 	const grace = new Promise<false>((resolve) => {
@@ -743,9 +767,14 @@ function pickOrchestratorScope(safety: SafetyContract): ScopeSpec {
 	return safety.scopes.workspace;
 }
 
-function pickWorkerScope(safety: SafetyContract, requestedActions: ReadonlyArray<ActionClass>): ScopeSpec {
+function pickWorkerScope(
+	safety: SafetyContract,
+	requestedActions: ReadonlyArray<ActionClass>,
+	pathScope: DispatchPathScope,
+): ScopeSpec {
 	if (requestedActions.every((action) => action === "read")) return safety.scopes.readonly;
-	return safety.scopes.workspace;
+	if (pathScope.writeBoundaries.length === 0) return safety.scopes.workspace;
+	return { ...safety.scopes.workspace, allowedWriteRoots: pathScope.writeBoundaries };
 }
 
 function deriveRequestedActions(tools: ReadonlyArray<ToolName>, safety: SafetyContract): ReadonlyArray<ActionClass> {
@@ -985,6 +1014,25 @@ function hasPersonaOverride(req: DispatchRequest): boolean {
 	return typeof req.systemPrompt === "string" && req.systemPrompt.trim().length > 0;
 }
 
+/**
+ * Whether this request's system prompt is a caller-authored persona rather
+ * than one of the coordinator's own bounded gate-role prompts.
+ *
+ * A reviewer, a compete judge, and a council synthesis all carry a system
+ * prompt the coordinator wrote, pinned by {@link isBoundedGateRolePrompt} to
+ * one exact text under one gate role and read-only autonomy. That is the
+ * topology speaking, not an operator reshaping a recipe, so it is not the
+ * thing the shadow and internal audiences are protected from. The ACP
+ * delegation path already draws the line here; without the same line, a
+ * council that seats the builtin read-only `researcher` (a shadow recipe, and
+ * the agent every unnamed council seats) refused `--synthesis judge` outright,
+ * before a single member ran.
+ */
+function hasCallerPersonaOverride(req: DispatchRequest): boolean {
+	if (!hasPersonaOverride(req)) return false;
+	return !isBoundedGateRolePrompt({ role: req.gate?.role, autonomy: req.autonomy, systemPrompt: req.systemPrompt });
+}
+
 function personaOverrideFor(req: DispatchRequest, staticCompositionHash: string | null): RunPersonaOverride | null {
 	if (!hasPersonaOverride(req) || staticCompositionHash === null) return null;
 	return { promptHash: staticCompositionHash };
@@ -995,9 +1043,8 @@ function personaOverrideFor(req: DispatchRequest, staticCompositionHash: string
  * flows through dynamic messages, never through the system prompt. The system
  * prompt itself is stable per recipe and tool surface with one exception: the
  * operator-editable layer (`additionalFragments`) folds in path-scoped project
- * rules selected by `workerWorkingContextPaths`, which are recalled from the
- * task and briefing text, so `staticCompositionHash` can differ between two
- * runs of one recipe when a rule's glob matches one task and not the other.
+ * rules selected from the canonical request scope, so `staticCompositionHash`
+ * can differ between two runs of one recipe when their scoped rules differ.
  * A local model's worker prefix cache misses on that flip; the trade was made
  * deliberately in #96 to keep rules scoped rather than shipped wholesale.
  */
@@ -1066,35 +1113,6 @@ function workerProjectContextIncludesVerification(body: string): boolean {
 	return body.includes("\nVerification expectations:\n");
 }
 
-/**
- * Path-like tokens in free text: a slash-separated segment, or a bare
- * `name.ext` token. The model-facing dispatch tool has no structured
- * path/file field, so a worker's task text is the only working-context
- * signal available at compile time; this is best-effort recall, not a
- * parser. A false-positive token is harmless because `selectActiveRules`
- * only activates a rule when the token matches that rule's own glob.
- */
-const PATH_TOKEN_RE = /(?:[\w.-]+\/)+[\w.-]+|\b[\w-]+\.[A-Za-z0-9]{1,8}\b/g;
-
-/**
- * Best-effort working-context paths for a dispatched worker: `writeRoots`
- * when the caller set them (the precise signal, for internal/programmatic
- * callers), plus path-like tokens recalled from the task and briefing text.
- * Feeds the same `selectActiveRules` a session uses, so a worker whose task
- * touches a ruled path reads that rule instead of never hearing about it.
- */
-function workerWorkingContextPaths(req: DispatchRequest): string[] {
-	const out = new Set<string>();
-	for (const root of req.writeRoots ?? []) out.add(root);
-	const text = `${req.task}\n${req.briefing ?? ""}`;
-	for (const match of text.matchAll(PATH_TOKEN_RE)) {
-		const token = match[0];
-		if (token.startsWith("http://") || token.startsWith("https://")) continue;
-		out.add(token);
-	}
-	return [...out];
-}
-
 export function buildDynamicPromptMessages(
 	req: DispatchRequest,
 	dynamicContext: WorkerDynamicContext = {},
@@ -1118,6 +1136,10 @@ export function buildDynamicPromptMessages(
 		const body = `Safety posture: autonomy ${autonomy}. ${workerSafetyOneLiner(autonomy, permission)} Worker permission routing: ${permission}.`;
 		messages.push({ id: "dispatch-safety-posture", body, contentHash: sha256(body) });
 	}
+	const requirements = renderDispatchIntentRequirements(req.intent);
+	if (requirements !== null) {
+		messages.push({ id: "dispatch-intent-requirements", body: requirements, contentHash: sha256(requirements) });
+	}
 	if (req.competeStance !== undefined) {
 		const body = competeStanceLiner(req.competeStance);
 		messages.push({ id: "dispatch-compete-stance", body, contentHash: sha256(body) });
@@ -1242,6 +1264,7 @@ interface DispatchAdmissionStage {
 
 interface DispatchWorkerSpecInput {
 	req: DispatchRequest;
+	pathScope: DispatchPathScope;
 	target: ResolvedTarget;
 	admission: DispatchAdmissionStage;
 	recipe?: AgentRecipe | null;
@@ -1261,6 +1284,7 @@ interface DispatchWorkerSpecInput {
 
 interface DispatchLifecycleStage {
 	recipe: AgentRecipe | null;
+	pathScope: DispatchPathScope;
 	admission: DispatchAdmissionStage;
 	target: ResolvedTarget;
 	cwd: string;
@@ -1296,6 +1320,7 @@ interface DispatchLifecycleStage {
 
 interface AcpDelegationLifecycleStage {
 	admission: DispatchAdmissionStage;
+	pathScope: DispatchPathScope;
 	agentConfig: ReturnType<ConfigContract["get"]>["delegation"]["agents"][number];
 	cwd: string;
 	systemPrompt: string;
@@ -1480,10 +1505,6 @@ function explicitToolCapability(
 	return typeof fromKnowledgeBase === "boolean" ? fromKnowledgeBase : null;
 }
 
-function writeConfinedRequest(req: DispatchRequest): boolean {
-	return req.writeRoots !== undefined && req.writeRoots.length > 0;
-}
-
 function effectiveToolNames(
 	allowedTools: ReadonlyArray<ToolName>,
 	target: ResolvedTarget,
@@ -1709,6 +1730,7 @@ function resolveDispatchAdmissionStage(
 	req: DispatchRequest,
 	recipe: AgentRecipe,
 	safety: SafetyContract,
+	pathScope: DispatchPathScope,
 ): DispatchAdmissionStage {
 	const recipeTools = recipe.tools;
 	const candidateTools = recipeTools && recipeTools.length > 0 ? (Array.from(recipeTools) as ToolName[]) : [];
@@ -1722,7 +1744,7 @@ function resolveDispatchAdmissionStage(
 	}
 	const requestedActions = deriveRequestedActions(allowedTools, safety);
 	const orchScope = pickOrchestratorScope(safety);
-	const workerScope = pickWorkerScope(safety, requestedActions);
+	const workerScope = pickWorkerScope(safety, requestedActions, pathScope);
 	const verdict = admit(
 		{
 			requestedScope: workerScope,
@@ -1747,7 +1769,7 @@ function resolveDelegationAdmissionStage(req: DispatchRequest, safety: SafetyCon
 	const allowedTools = applyToolProfile([], req.toolProfile);
 	const requestedActions = deriveRequestedActions(allowedTools, safety);
 	const orchScope = pickOrchestratorScope(safety);
-	const workerScope = pickWorkerScope(safety, requestedActions);
+	const workerScope = pickWorkerScope(safety, requestedActions, resolveDispatchPathScope(req));
 	const verdict = admit(
 		{
 			requestedScope: workerScope,
@@ -1825,9 +1847,17 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 	// The worker repairs against exactly the contract the orchestrator will seal.
 	// A gate role that overrides the recipe contract gets no worker-side repair,
 	// for the same reason it gets no recipe validation.
-	if (appliesRecipeResultContract(input.req.gate?.role) && input.recipe?.resultContract) {
-		spec.resultContract = input.recipe.resultContract;
-	}
+	//
+	// The request's own override is the contract whether or not the seated
+	// recipe declares one, because that is the resolution the seal already uses.
+	// Requiring a recipe contract here meant a caller-supplied override against a
+	// recipe with none was sealed but never sent, so the worker spent no repair
+	// round on a contract it was never told about and the run failed on a shape
+	// nothing had asked it for.
+	const workerResultContract = appliesRecipeResultContract(input.req.gate?.role)
+		? (input.req.resultContractOverride ?? input.recipe?.resultContract)
+		: undefined;
+	if (workerResultContract) spec.resultContract = workerResultContract;
 	const product = input.req.product ?? input.recipe?.product;
 	if (product) spec.product = product;
 	// The orchestrator's tool decision is the one the run was admitted under and
@@ -1878,14 +1908,9 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 		if (escalation) spec.escalation = { timeoutMs: escalation.timeoutMs, fallback: escalation.fallback };
 	}
 	assertRuntimeCanHonorWorkerPermissionMode(input.target.runtime, spec.onPermission);
-	// Carry write-root confinement to the worker safety seam. Refuse it up front
-	// on runtimes that cannot mediate per-tool calls (subprocess) so it is never
-	// silently ignored. Roots are resolved against the job cwd so a relative root
-	// reaches the worker absolute, matching the validation contract.
-	if (input.req.writeRoots !== undefined && input.req.writeRoots.length > 0) {
-		const jobCwd = input.req.cwd !== undefined && input.req.cwd.length > 0 ? input.req.cwd : process.cwd();
-		spec.writeRoots = input.req.writeRoots.map((root) => resolvePath(jobCwd, root));
-	}
+	// Carry canonical write boundaries to the worker safety seam. Exact files
+	// remain exact and trailing-slash entries remain subtrees after resolution.
+	if (input.pathScope.writeBoundaries.length > 0) spec.writeRoots = [...input.pathScope.writeBoundaries];
 	assertWriteRootsEnforceable(input.target.runtime, spec.writeRoots);
 	// Carry the tool profile so external CLI runtimes that cannot mediate
 	// per-tool calls can refuse a narrowing profile they would otherwise ignore.
@@ -2380,6 +2405,26 @@ export function createDispatchBundle(
 	const active = new Map<string, ActiveRun>();
 	const targetCooldowns = new Map<string, { until: number; reason: string }>();
 	const ownedReservations = new Set<string>();
+	/**
+	 * Paths each finalized run's own tool calls aimed a successful mutation at,
+	 * newest last. `null` records a run whose write record is unusable, which is
+	 * a different answer from an empty list and has to survive as one.
+	 *
+	 * Held in memory rather than sealed into the receipt: the only reader is the
+	 * write boundary closing a window seconds later in this process, and a
+	 * per-run path list is run-shaped evidence the receipt schema does not carry.
+	 * Bounded because a long session finalizes many runs and none of this is
+	 * needed once its window has closed.
+	 */
+	const runWriteTargets = new Map<string, ReadonlyArray<string> | null>();
+	const recordRunWriteTargets = (runId: string, paths: ReadonlyArray<string> | null): void => {
+		runWriteTargets.set(runId, paths);
+		while (runWriteTargets.size > RUN_WRITE_TARGET_HISTORY) {
+			const oldest = runWriteTargets.keys().next();
+			if (oldest.done === true) break;
+			runWriteTargets.delete(oldest.value);
+		}
+	};
 	const capacityAdmission = createCapacityAdmissionController({
 		limits: () => {
 			const settings = getEffectiveSettings();
@@ -3161,6 +3206,27 @@ export function createDispatchBundle(
 		targetCooldowns.set(key, { until: now() + cooldownMs, reason: failureClass });
 	}
 
+	function publishDispatchPathScope(req: DispatchRequest, pathScope: DispatchPathScope): void {
+		const replacementDiagnostic = declaredScopeReplacementDiagnostic(pathScope);
+		if (replacementDiagnostic !== null) {
+			reportDispatchDiagnostic("typed scope replacement", new Error(replacementDiagnostic));
+		}
+		// Only the replacement case reaches the transcript. A dispatch that
+		// declared no intent is the ordinary case rather than an anomaly, and one
+		// receipt in ninety-nine carries an intent key today, so noticing it would
+		// warn on almost every dispatch and teach the operator to skip the channel.
+		// Its provenance is not lost: the receipt seals `pathProvenance`, and the
+		// approval artifact renders every inferred entry in full before a
+		// supervised dispatch runs, which is where an operator can still act on it.
+		const notice = declaredScopeReplacementNotice(pathScope);
+		if (notice !== null) {
+			context.bus.emit(BusChannels.DispatchScopeNotice, {
+				...notice,
+				agentId: req.agentId,
+			});
+		}
+	}
+
 	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
 		const recipe = agents.get(req.agentId);
 		if (!recipe) {
@@ -3172,7 +3238,7 @@ export function createDispatchBundle(
 				`dispatch: agent '${req.agentId}' is a ${spec.audience} agent reserved for Clio internal orchestration`,
 			);
 		}
-		if (hasPersonaOverride(req) && (spec.audience === "shadow" || spec.audience === "internal")) {
+		if (hasCallerPersonaOverride(req) && (spec.audience === "shadow" || spec.audience === "internal")) {
 			throw new Error(`dispatch: persona overrides are not allowed for ${spec.audience} agent '${req.agentId}'`);
 		}
 		// A read-only recipe pointed at a mutating task is knowable here and costs
@@ -3194,7 +3260,9 @@ export function createDispatchBundle(
 						specs: agents.listSpecs(),
 					});
 		if (capabilityMismatch?.verdict === "refuse") throw new Error(capabilityMismatch.detail);
-		const admission = resolveDispatchAdmissionStage(req, recipe, safety);
+		const pathScope = resolveDispatchPathScope(req);
+		publishDispatchPathScope(req, pathScope);
+		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
 		const target = resolveDispatchTarget(
 			req,
@@ -3213,7 +3281,7 @@ export function createDispatchBundle(
 		const sessionAutonomy = settings?.autonomy ?? "auto-edit";
 		const effectiveAutonomy = clampWorkerAutonomy(sessionAutonomy, req.autonomy);
 		const effectiveTools = withLedgerToolNarrowing(
-			effectiveToolNames(admission.allowedTools, target, writeConfinedRequest(req), deniedToolNames(req)),
+			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, spec, effectiveTools, target);
@@ -3242,7 +3310,7 @@ export function createDispatchBundle(
 				dynamic: false,
 			},
 			cwd,
-			workingContextPaths: workerWorkingContextPaths(req),
+			workingContextPaths: pathScope.workingContextPaths,
 		});
 		const systemPrompt = compiledWorkerPrompt.systemPrompt;
 		const budgetEnvelope = resolveEffectiveWorkerBudget({
@@ -3286,6 +3354,7 @@ export function createDispatchBundle(
 		const limitations = runtimeLimitations(runtimeKind, target.runtime.id);
 		return {
 			recipe,
+			pathScope,
 			admission: effectiveAdmission,
 			target,
 			cwd,
@@ -3323,12 +3392,7 @@ export function createDispatchBundle(
 	): AcpDelegationLifecycleStage {
 		const agentId = req.delegationAgentId;
 		if (!agentId) throw new Error("dispatch: missing delegationAgentId");
-		const boundedGateRolePrompt = isBoundedGateRolePrompt({
-			role: req.gate?.role,
-			autonomy: req.autonomy,
-			systemPrompt: req.systemPrompt,
-		});
-		if (hasPersonaOverride(req) && !boundedGateRolePrompt) {
+		if (hasCallerPersonaOverride(req)) {
 			throw new Error(`dispatch: persona overrides are not allowed for ACP delegation agent '${agentId}'`);
 		}
 		if (req.agentId && maybeAgents) {
@@ -3357,6 +3421,7 @@ export function createDispatchBundle(
 			);
 		}
 		const cwd = req.cwd ?? process.cwd();
+		const pathScope = resolveDispatchPathScope(req);
 		const personaBody = workerPersonaBody(req, null, []);
 		// ACP owns an unknown external tool inventory, so it receives the raw
 		// bounded persona rather than a native Clio schema-harness claim.
@@ -3383,6 +3448,7 @@ export function createDispatchBundle(
 		const personaOverride = personaOverrideFor(req, staticCompositionHash);
 		return {
 			admission,
+			pathScope,
 			agentConfig: configured,
 			cwd,
 			systemPrompt,
@@ -3418,6 +3484,7 @@ export function createDispatchBundle(
 		finalPromise: Promise<RunReceipt>;
 	}> {
 		const lifecycle = resolveAcpDelegationLifecycle(req, settings);
+		publishDispatchPathScope(req, lifecycle.pathScope);
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		const targetId = `delegation:${lifecycle.agentConfig.id}`;
 		const runtimeId = "acp";
@@ -3610,10 +3677,12 @@ export function createDispatchBundle(
 		let identity!: ReturnType<typeof detectRunIdentity>;
 		try {
 			envelope = ledgerRef.create({
+				...(req.runIdHint !== undefined ? { id: req.runIdHint } : {}),
 				agentId: req.agentId,
 				executionRole: withAttemptRole(req.executionRole, req.lineage?.attempt ?? 0),
 				requestOrigin: lifecycle.requestOrigin,
 				task: req.task,
+				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
 				targetId,
 				wireModelId,
 				runtimeId,
@@ -3645,6 +3714,7 @@ export function createDispatchBundle(
 				...(lifecycle.pipeline ? { pipeline: lifecycle.pipeline } : {}),
 				...(lifecycle.briefing ? { briefing: lifecycle.briefing } : {}),
 				...(req.gate !== undefined ? { gate: req.gate } : {}),
+				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
 			});
@@ -3787,6 +3857,8 @@ export function createDispatchBundle(
 				executionRole: envelope.executionRole,
 				requestOrigin: lifecycle.requestOrigin,
 				task: req.task,
+				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
+				pathScope: structuredClone(lifecycle.pathScope.provenance),
 				targetId,
 				wireModelId,
 				runtimeId,
@@ -3801,6 +3873,7 @@ export function createDispatchBundle(
 				...(lifecycle.pipeline ? { pipeline: lifecycle.pipeline } : {}),
 				...(lifecycle.briefing ? { briefing: lifecycle.briefing } : {}),
 				...(req.gate !== undefined ? { gate: req.gate } : {}),
+				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
 				projectContext: lifecycle.projectContext,
@@ -3913,6 +3986,7 @@ export function createDispatchBundle(
 				durationMs,
 				exitCode: receipt.exitCode,
 				toolActivity: receipt.toolActivity ?? null,
+				...(receipt.hostVerification !== undefined ? { hostVerification: receipt.hostVerification.status } : {}),
 				...(receipt.skillActivations && receipt.skillActivations.length > 0
 					? { skillActivations: [...receipt.skillActivations] }
 					: {}),
@@ -4262,6 +4336,7 @@ export function createDispatchBundle(
 		const spec = buildDispatchWorkerSpec(
 			{
 				req,
+				pathScope: lifecycle.pathScope,
 				target: lifecycle.target,
 				admission: lifecycle.admission,
 				recipe: lifecycle.recipe,
@@ -4444,7 +4519,8 @@ export function createDispatchBundle(
 			if (
 				event.type === "clio_run_outcome" &&
 				isRunOutcomeCode(event.payload?.outcomeCode) &&
-				event.payload.outcomeCode !== "worker_final_output_missing"
+				event.payload.outcomeCode !== "worker_final_output_missing" &&
+				event.payload.outcomeCode !== "host_verification_rejected"
 			) {
 				if (acceptsOutcomeCodeEvents) {
 					trustedOutcomeCodes.add(event.payload.outcomeCode);
@@ -4604,11 +4680,13 @@ export function createDispatchBundle(
 		let identity!: ReturnType<typeof detectRunIdentity>;
 		try {
 			envelope = ledgerRef.create({
+				...(req.runIdHint !== undefined ? { id: req.runIdHint } : {}),
 				agentId: req.agentId,
 				executionRole: withAttemptRole(req.executionRole, req.lineage?.attempt ?? 0),
 				agentAudience: lifecycle.agentAudience,
 				requestOrigin: lifecycle.requestOrigin,
 				task: req.task,
+				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
 				budget: lifecycle.budgetEnvelope,
 				targetId: lifecycle.target.target.id,
 				wireModelId: lifecycle.target.wireModelId,
@@ -4658,6 +4736,7 @@ export function createDispatchBundle(
 				...(lifecycle.pipeline ? { pipeline: lifecycle.pipeline } : {}),
 				...(lifecycle.briefing ? { briefing: lifecycle.briefing } : {}),
 				...(req.gate !== undefined ? { gate: req.gate } : {}),
+				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
 				...(heartbeatAt ? { heartbeatAt: heartbeatIso(heartbeatAt.current) } : {}),
@@ -4678,6 +4757,7 @@ export function createDispatchBundle(
 				budget: lifecycle.budgetEnvelope,
 				...(placement !== undefined && placement !== null ? { node: placement.node.id } : {}),
 				...(req.gate !== undefined ? { gate: { role: req.gate.role, cycle: req.gate.cycle } } : {}),
+				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.reroutes !== undefined && req.reroutes.length > 0 ? { rerouteCount: req.reroutes.length } : {}),
 				...(lifecycle.target.modelCapabilities !== undefined &&
 				lifecycle.target.modelCapabilities !== null &&
@@ -4829,6 +4909,15 @@ export function createDispatchBundle(
 			const tokenCount =
 				tokenMeter.inputTokens + tokenMeter.outputTokens + tokenMeter.cacheReadTokens + tokenMeter.cacheWriteTokens;
 			const protectedArtifacts = protectedArtifactReceiptSummary(spec.protectedArtifactState);
+			const fleetGate = (() => {
+				if (req.fleetGateReceipt === undefined) return null;
+				try {
+					const content = readFileSync(resolvePath(lifecycle.cwd, req.fleetGateReceipt.path));
+					return { path: req.fleetGateReceipt.path, pathHash: createHash("sha256").update(content).digest("hex") };
+				} catch {
+					return { path: req.fleetGateReceipt.path, pathHash: createHash("sha256").update("").digest("hex") };
+				}
+			})();
 			// Sealed from the stored board, never from anything the worker said
 			// about itself. Absent when the run had no ledger.
 			const ledgerContribution = (() => {
@@ -4864,6 +4953,8 @@ export function createDispatchBundle(
 				outcome,
 				outcomeCode,
 				lineage,
+				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
+				pathScope: structuredClone(lifecycle.pathScope.provenance),
 				identity,
 				node: placement?.node ?? LOCAL_RUN_NODE,
 				...receiptAttestationFields(worker.attestation?.() ?? null),
@@ -4874,7 +4965,9 @@ export function createDispatchBundle(
 				...(lifecycle.briefing ? { briefing: lifecycle.briefing } : {}),
 				...(steering.length > 0 ? { steering: steering.map((entry) => ({ ...entry })) } : {}),
 				...(req.gate !== undefined ? { gate: req.gate } : {}),
+				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
+				...(fleetGate !== null ? { fleetGate } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
 				projectContext: lifecycle.projectContext,
 				rulesApplied: lifecycle.rulesApplied,
@@ -5004,6 +5097,7 @@ export function createDispatchBundle(
 				durationMs,
 				exitCode: receipt.exitCode,
 				toolActivity: receipt.toolActivity ?? null,
+				...(receipt.hostVerification !== undefined ? { hostVerification: receipt.hostVerification.status } : {}),
 				...(receipt.skillActivations && receipt.skillActivations.length > 0
 					? { skillActivations: [...receipt.skillActivations] }
 					: {}),
@@ -5102,7 +5196,7 @@ export function createDispatchBundle(
 				const capturedOutput = outputCapture.snapshot();
 				const observedRunEffects = runEffects.snapshot();
 				const appliedResultContract = appliesRecipeResultContract(req.gate?.role)
-					? (lifecycle.recipe?.resultContract ?? null)
+					? (req.resultContractOverride ?? lifecycle.recipe?.resultContract ?? null)
 					: null;
 				const resultContract = validateRecipeResult({
 					contract: appliedResultContract,
@@ -5166,13 +5260,40 @@ export function createDispatchBundle(
 					finalDetail = [finalDetail, describeUngroundedValidations(validationGrounding)].filter(Boolean).join("; ");
 				}
 				const hasTerminalArtifact =
-					lifecycle.recipe?.resultContract.kind === "architect-plan" && resultValidation?.conformance === "pass";
+					(req.resultContractOverride ?? lifecycle.recipe?.resultContract)?.kind === "architect-plan" &&
+					resultValidation?.conformance === "pass";
 				if (finalOutcome === "succeeded" && !hasDurableFinalOutput(capturedOutput) && !hasTerminalArtifact) {
 					finalOutcome = "failed";
 					outcomeCode = "worker_final_output_missing";
 					finalDetail = WORKER_FINAL_OUTPUT_MISSING_DETAIL;
 					failureMessage = finalDetail;
 				}
+				const hostVerification = await runHostVerification({
+					runId: envelope.id,
+					request: req,
+					workerSuccessful: finalOutcome === "succeeded",
+					onDiagnostic: (error) => reportDispatchDiagnostic(`write host verification memo for ${envelope.id}`, error),
+				});
+				const hostRejection = hostVerificationRejection(hostVerification);
+				if (hostRejection !== null && finalOutcome === "succeeded") {
+					finalOutcome = "failed";
+					outcomeCode = hostRejection.outcomeCode;
+					finalDetail = hostRejection.detail;
+					failureMessage = finalDetail;
+				}
+				let worktreeReceipt: RunReceiptDraft["worktree"];
+				if (req.taskWorktree !== undefined && finalOutcome === "succeeded") {
+					worktreeReceipt = applyTaskWorktree({
+						worktree: req.taskWorktree,
+						apply: req.apply ?? "merge",
+						protectedPaths: getProtectedArtifactState().artifacts.map((artifact) => artifact.path),
+					});
+					if (worktreeReceipt.reason !== undefined) {
+						finalOutcome = "failed";
+						finalDetail = worktreeReceipt.reason;
+						failureMessage = finalDetail;
+					}
+				}
 				const status = runStatusForOutcome(finalOutcome);
 				const failureClass = classifyFailure(evidence, result, finalOutcome, outcomeCode);
 				const receiptDraft = buildReceiptDraft(
@@ -5186,6 +5307,8 @@ export function createDispatchBundle(
 					sealedResultContractFact,
 					validationGrounding === null ? null : { ...validationGrounding, ungrounded: [...validationGrounding.ungrounded] },
 				);
+				if (hostVerification !== undefined) receiptDraft.hostVerification = hostVerification;
+				if (worktreeReceipt !== undefined) receiptDraft.worktree = worktreeReceipt;
 				const ledgerPatch: Partial<RunEnvelope> = {
 					status,
 					outcome: finalOutcome,
@@ -5215,7 +5338,33 @@ export function createDispatchBundle(
 				}
 				ledgerRef.update(envelope.id, ledgerPatch);
 				const receipt = ledgerRef.recordReceipt(envelope.id, sealRouteDecision(receiptDraft, routeObservation.decision));
+				// Two independent ways a run's write record can fail to be a closed
+				// list, and either one files it as `null` rather than as an empty
+				// one. The difference decides whether the write boundary may clear a
+				// path it did not see this run touch.
+				//
+				// The telemetry axis is whether the events were seen at all: a
+				// subprocess runtime publishes no tool events, and a partial trail
+				// has its holes exactly where an unobserved write would sit.
+				//
+				// The opacity axis is whether the events that were seen say enough.
+				// A run that called bash, verify, dispatch, or steer to a clean exit
+				// could have written through a channel no argument names, so nothing
+				// in the checkout can be cleared on the strength of its absence from
+				// the set. That run's window keeps today's blame-the-whole-diff
+				// behaviour; a run that never touched such a tool keeps the
+				// protection.
+				const writeRecordUsable =
+					receipt.safety?.toolTelemetry?.coverage === "complete" && observedRunEffects.writeRecordComplete;
+				recordRunWriteTargets(envelope.id, writeRecordUsable ? [...observedRunEffects.mutatedPaths] : null);
 				await ledgerRef.persist();
+				if (worktreeReceipt?.applied === true && req.taskWorktree !== undefined) {
+					try {
+						cleanupTaskWorktree(req.taskWorktree, true);
+					} catch (cleanupError) {
+						reportDispatchDiagnostic(`clean applied task worktree ${req.taskWorktree.runId}`, cleanupError);
+					}
+				}
 				active.delete(envelope.id);
 				recordTargetOutcome(
 					lifecycle.target.target.id,
@@ -5303,10 +5452,58 @@ export function createDispatchBundle(
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<RunReceipt>;
 	}> {
+		let prepared = req;
+		let createdWorktree: DispatchRequest["taskWorktree"];
+		let writerLease: CheckoutWriterLease | undefined;
+		const writerRecipe = agents.get(req.agentId);
+		if (writerRecipe !== null && normalizeAgentSpec(writerRecipe).capabilityClass === "workspace-edit") {
+			const checkout = req.taskWorktree?.root ?? gitCheckoutRoot(req.cwd ?? process.cwd());
+			if (checkout !== null) writerLease = acquireCheckoutWriterLease({ checkout });
+		}
+		if (req.worktree === true && req.taskWorktree === undefined) {
+			const requestedCwd = resolvePath(req.cwd ?? process.cwd());
+			const root = gitCheckoutRoot(requestedCwd);
+			if (root === null) throw new Error("worktree_non_git_checkout");
+			if (req.taskWorktreeDestination !== undefined && root !== req.taskWorktreeDestination) {
+				writerLease?.release();
+				throw new Error("dispatch: worktree merge destination differs from the approved execution snapshot");
+			}
+			const runId = newRunId();
+			let taskWorktree: NonNullable<DispatchRequest["taskWorktree"]>;
+			try {
+				taskWorktree = createTaskWorktree(root, runId);
+			} catch (error) {
+				writerLease?.release();
+				throw error;
+			}
+			createdWorktree = taskWorktree;
+			const cwdRelative = relative(root, requestedCwd);
+			const workerCwd = resolvePath(taskWorktree.path, cwdRelative);
+			const writeRoots = req.writeRoots?.map((entry) => {
+				const rel = relative(root, entry);
+				return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? entry : resolvePath(taskWorktree.path, rel);
+			});
+			prepared = {
+				...req,
+				runIdHint: runId,
+				taskWorktree,
+				cwd: workerCwd,
+				protectedArtifactRemap: { sourceRoot: root, workerRoot: taskWorktree.path },
+				...(writeRoots === undefined ? {} : { writeRoots }),
+			};
+		}
 		let handle: Awaited<ReturnType<typeof dispatchAttempt>>;
 		try {
-			handle = await dispatchAttempt(req, observer);
+			handle = await dispatchAttempt(prepared, observer);
 		} catch (error) {
+			writerLease?.release();
+			if (createdWorktree !== undefined) {
+				try {
+					cleanupTaskWorktree(createdWorktree, true);
+				} catch (cleanupError) {
+					reportDispatchDiagnostic(`clean task worktree ${createdWorktree.runId} after admission failure`, cleanupError);
+				}
+			}
 			if (req.reservation !== undefined && req.lineage === undefined) {
 				rollbackDispatchReservation(req.reservation.ownerId, now());
 			}
@@ -5314,7 +5511,7 @@ export function createDispatchBundle(
 		}
 		// Requests carrying lineage are internal attempts (retry or nested
 		// orchestration) and retain the per-attempt handle contract.
-		if (req.lineage) return handle;
+		if (req.lineage) return { ...handle, finalPromise: handle.finalPromise.finally(() => writerLease?.release()) };
 
 		const assignment = assignments.open(handle.runId, assignmentPolicyFor(handle.effectiveRequest));
 		persistAssignment(registerAssignment(assignment.id), `${assignment.id}:open`);
@@ -5327,9 +5524,10 @@ export function createDispatchBundle(
 		const reservation = req.reservation;
 		const terminal =
 			reservation === undefined
-				? assignment.terminal
+				? assignment.terminal.finally(() => writerLease?.release())
 				: assignment.terminal.finally(() => {
 						releaseDispatchReservationMember(reservation.ownerId, reservation.memberId, now());
+						writerLease?.release();
 					});
 		return { runId: handle.runId, events: assignment.events, finalPromise: terminal };
 	}
@@ -5393,10 +5591,11 @@ export function createDispatchBundle(
 				`dispatch: agent '${req.agentId}' is a ${agentSpec.audience} agent reserved for Clio internal orchestration`,
 			);
 		}
-		if (hasPersonaOverride(req) && (agentSpec.audience === "shadow" || agentSpec.audience === "internal")) {
+		if (hasCallerPersonaOverride(req) && (agentSpec.audience === "shadow" || agentSpec.audience === "internal")) {
 			throw new Error(`dispatch: persona overrides are not allowed for ${agentSpec.audience} agent '${req.agentId}'`);
 		}
-		const admission = resolveDispatchAdmissionStage(req, recipe, safety);
+		const pathScope = resolveDispatchPathScope(req);
+		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
 		const target = resolveDispatchTarget(
 			req,
@@ -5409,14 +5608,14 @@ export function createDispatchBundle(
 		);
 		enforceCapabilityGate(target.target.id, target.modelCapabilities, req.requiredCapabilities);
 		const effectiveTools = withLedgerToolNarrowing(
-			effectiveToolNames(admission.allowedTools, target, writeConfinedRequest(req), deniedToolNames(req)),
+			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, agentSpec, effectiveTools, target);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.workers.onPermission ?? "deny");
 		assertWorkerBudgetEnforceable(target.runtime, agentSpec.budget !== null || req.budget !== undefined);
 		assertResponseSchemaEnforceable(target.runtime, target.modelCapabilities, req.responseSchema, effectiveTools.length);
-		assertWriteRootsEnforceable(target.runtime, req.writeRoots);
+		assertWriteRootsEnforceable(target.runtime, pathScope.writeBoundaries);
 		assertProtectedArtifactsEnforceable(
 			target.runtime.id,
 			target.runtime.kind !== "subprocess",
@@ -5713,6 +5912,137 @@ export function createDispatchBundle(
 		};
 	}
 
+	async function sealCouncilSynthesis(input: {
+		group: string;
+		round: number;
+		kind: "none" | "vote" | "judge";
+		text: string;
+		subjects: ReadonlyArray<{ runId: string; digest: string | null }>;
+		template: RunReceipt;
+	}): Promise<RunReceipt> {
+		const l = requireLedger();
+		const runId = newRunId();
+		const task = `Council ${input.kind} synthesis`;
+		// The synthesis is the council's own verdict, filed under the origin the
+		// council was asked from: an internal origin would keep it out of the
+		// transcript worker fold, and with it out of /share.
+		const origin = input.template.requestOrigin ?? "agent";
+		const gate = { role: "synthesis" as const, group: input.group, cycle: input.round, subjects: [...input.subjects] };
+		const council = { group: input.group, label: "synthesis", round: input.round };
+		const created = l.create({
+			id: runId,
+			agentId: "council-synthesis",
+			executionRole: "judge",
+			requestOrigin: origin,
+			task,
+			targetId: input.template.targetId,
+			wireModelId: input.template.wireModelId,
+			runtimeId: input.template.runtimeId,
+			runtimeKind: input.template.runtimeKind,
+			sessionId: input.template.sessionId,
+			cwd: input.template.reproducibility?.cwd ?? process.cwd(),
+		});
+		const endedAt = new Date().toISOString();
+		l.update(runId, {
+			status: "completed",
+			outcome: "succeeded",
+			endedAt,
+			exitCode: 0,
+			gate,
+			council,
+			...(input.template.plan !== undefined ? { plan: input.template.plan } : {}),
+		});
+		const receipt = l.recordReceipt(runId, {
+			runId,
+			agentId: "council-synthesis",
+			executionRole: "judge",
+			requestOrigin: origin,
+			task,
+			targetId: input.template.targetId,
+			wireModelId: input.template.wireModelId,
+			runtimeId: input.template.runtimeId,
+			runtimeKind: input.template.runtimeKind,
+			startedAt: created.startedAt,
+			endedAt,
+			outcome: "succeeded",
+			outcomeDetail: null,
+			exitCode: 0,
+			tokenCount: 0,
+			inputTokenCount: 0,
+			outputTokenCount: 0,
+			reasoningTokenCount: 0,
+			cacheReadTokenCount: 0,
+			cacheWriteTokenCount: 0,
+			output: { state: "final", text: input.text, bytes: Buffer.byteLength(input.text, "utf8"), truncated: false },
+			costUsd: 0,
+			costProvenance: "unknown",
+			compiledPromptHash: null,
+			staticCompositionHash: null,
+			clioVersion: readClioVersion(),
+			piMonoVersion: readPiMonoVersion(),
+			platform: process.platform,
+			nodeVersion: process.version,
+			toolCalls: 0,
+			toolStats: [],
+			verification: { state: "unverified", basis: "no-validation-tool" },
+			routingIntent: defaultRoutingIntent({}),
+			quality: createRunReceiptQuality({ runtimeEnforceable: false, enforcementPassed: null, resultContract: null }),
+			reproducibility: collectReproducibility(input.template.reproducibility?.cwd ?? process.cwd(), null),
+			sessionId: input.template.sessionId,
+			gate,
+			council,
+			...(input.template.plan !== undefined ? { plan: input.template.plan } : {}),
+		});
+		await l.persist();
+		// The synthesis never ran as a worker, so nothing else publishes its
+		// lifecycle. The Fleet Runs board and /share are built from these
+		// events, and a council whose synthesis they cannot see is a council
+		// whose verdict the operator cannot read or share.
+		const identity: DispatchRunIdentity = {
+			runId,
+			agentId: "council-synthesis",
+			task,
+			requestOrigin: origin,
+			targetId: receipt.targetId,
+			wireModelId: receipt.wireModelId,
+			runtimeId: receipt.runtimeId,
+			runtimeKind: receipt.runtimeKind,
+			gate: { role: gate.role, cycle: gate.cycle },
+			council,
+		};
+		context.bus.emit(BusChannels.DispatchEnqueued, { ...identity, requestOrigin: origin });
+		context.bus.emit(BusChannels.DispatchStarted, {
+			...identity,
+			requestOrigin: origin,
+			pid: null,
+			assignmentId: runId,
+			attempt: 0,
+		});
+		context.bus.emit(BusChannels.DispatchCompleted, {
+			...identity,
+			requestOrigin: origin,
+			outcome: "succeeded",
+			outcomeCode: null,
+			outcomeDetail: null,
+			lineage: input.template.lineage ?? { parentRunId: null, rootRunId: runId, attempt: 0, depth: 0 },
+			tokenCount: 0,
+			inputTokenCount: 0,
+			outputTokenCount: 0,
+			cacheReadTokenCount: 0,
+			cacheWriteTokenCount: 0,
+			reasoningTokenCount: 0,
+			staticShellHash: null,
+			sessionShellHash: null,
+			dynamicHash: null,
+			costUsd: 0,
+			costProvenance: "unknown",
+			durationMs: 0,
+			exitCode: 0,
+			toolActivity: null,
+		});
+		return receipt;
+	}
+
 	const extension: DomainExtension = {
 		async start() {
 			// No in-memory executor survives a process restart, so every active
@@ -5743,6 +6073,7 @@ export function createDispatchBundle(
 				const reconciledLedger = ledger;
 				const reconciled = await reconcileOrphanAssignments({
 					listRunning: () => listStoredAssignments().filter((record) => record.status === "running"),
+					ownerAlive: assignmentProcessOwnerAlive,
 					lookupAttempt: (runId) => {
 						const envelope = reconciledLedger?.get(runId) ?? null;
 						if (!envelope) return null;
@@ -5752,7 +6083,8 @@ export function createDispatchBundle(
 							succeeded: envelope.outcome === "succeeded",
 						};
 					},
-					settle: (assignmentId, terminalRunId, status) => settleStoredAssignment(assignmentId, terminalRunId, status),
+					settle: (assignmentId, terminalRunId, status, owner) =>
+						settleStoredAssignment(assignmentId, terminalRunId, status, owner),
 				});
 				if ((reconciled.recovered > 0 || reconciled.abandoned > 0) && process.env.CLIO_CODER_INTERACTIVE !== "1") {
 					process.stderr.write(
@@ -5947,6 +6279,7 @@ export function createDispatchBundle(
 		protectedArtifactState: () => getProtectedArtifactState(),
 		dispatch,
 		dispatchBatch,
+		sealCouncilSynthesis,
 		listRuns(status) {
 			const l = requireLedger();
 			return status ? l.list({ status }) : l.list();
@@ -5955,6 +6288,11 @@ export function createDispatchBundle(
 			if (!ledger) return null;
 			return ledger.get(runId);
 		},
+		observedRunWrites(runId) {
+			// A run this process never finalized, or finalized long enough ago to
+			// have been evicted, is unknown rather than silent, so both answer null.
+			return runWriteTargets.get(runId) ?? null;
+		},
 		assignments: {
 			get: (id) => assignments.get(id),
 			getStored: (id) => getStoredAssignment(id),