@iowarp/clio-coder 0.3.7 → 0.3.8

package/src/domains/providers/extension.ts

@@ -16,6 +16,7 @@ import { probeCapabilitiesForModel } from "./model-capabilities.js";
 import { loadPluginRuntimes } from "./plugins.js";
 import { getRuntimeRegistry } from "./registry.js";
 import { registerBuiltinRuntimes } from "./runtimes/builtins.js";
+import { listKnownModelsForRuntime } from "./support.js";
 import type { CapabilityFlags } from "./types/capability-flags.js";
 import { EMPTY_CAPABILITIES } from "./types/capability-flags.js";
 import {
@@ -204,6 +205,32 @@ export function mergeProbeResult(
 	return merge;
 }
 
+/**
+ * Whether a reachable target can serve the model it is configured to serve by
+ * default. Reachability alone was the whole of `health`, so a target whose
+ * `defaultModel` the server had never heard of printed `healthy` until the
+ * first turn. This is judged only from a live list on a runtime with no static
+ * catalog: the catalog is the authority for cloud runtimes, and a cached or
+ * descriptor-supplied list says nothing about the server in front of us.
+ * Returns the reason when the default is not served, null when it is or when
+ * there is no live evidence either way.
+ */
+export function unservedDefaultModelReason(
+	desc: Pick<RuntimeDescriptor, "id">,
+	target: Pick<TargetDescriptor, "defaultModel">,
+	merge: Pick<ProbeMerge, "discoveredModels" | "discoveredModelsSource" | "discoveredModelStates">,
+): string | null {
+	const model = target.defaultModel;
+	if (!model) return null;
+	if (merge.discoveredModelsSource !== "probe" || merge.discoveredModels.length === 0) return null;
+	if (listKnownModelsForRuntime(desc.id).length > 0) return null;
+	if (merge.discoveredModels.includes(model)) return null;
+	// LM Studio lists a loaded model under its instance id and keeps the model
+	// key in the state map; the request path resolves either.
+	if (merge.discoveredModelStates && model in merge.discoveredModelStates) return null;
+	return `default model '${model}' is not advertised by the target`;
+}
+
 export function createProvidersBundle(context: DomainContext): DomainBundle<ProvidersContract> {
 	const registry = getRuntimeRegistry();
 	const authStore = openAuthStorage();
@@ -292,13 +319,14 @@ export function createProvidersBundle(context: DomainContext): DomainBundle<Prov
 		const merge = mergeProbeResult(desc, target, probe, previous);
 		const { capabilities, contextWindowProvenance } = capabilitiesFor(desc, target, merge, kb);
 		const healthy = probe !== null ? probe.ok : null;
+		const unservedDefault = probe?.ok ? unservedDefaultModelReason(desc, target, merge) : null;
 		const health: TargetHealth =
 			probe === null
 				? (previous?.health ?? emptyHealth())
 				: {
-						status: healthy ? "healthy" : "down",
+						status: healthy ? (unservedDefault === null ? "healthy" : "degraded") : "down",
 						lastCheckAt: new Date().toISOString(),
-						lastError: probe.error ?? null,
+						lastError: probe.error ?? unservedDefault,
 						latencyMs: probe.latencyMs ?? null,
 					};
 		const available = availability.available && (probe === null || probe.ok);

package/src/domains/resources/common-loader.ts

@@ -7,6 +7,8 @@ import type { ResourceDiagnostic, ResourceScope, ResourceSourceInfo } from "./co
 
 export interface ResourceRoot {
 	path: string;
+	/** Package root for safely resolving extension-relative prompt references. */
+	rootPath?: string;
 	scope: ResourceScope;
 	source?: string;
 	/** Collision rank, higher wins. See {@link ResourceSourceInfo.precedence}. */
@@ -44,6 +46,7 @@ export function defaultScopedResourceRoots(kind: ExtensionResourceKind, cwd: str
 	return [
 		...enabledExtensionResourceRoots(kind, cwd).map((root) => ({
 			path: root.path,
+			rootPath: root.rootPath,
 			scope: "package" as const,
 			source: root.source,
 			precedence: COMPAT_RESOURCE_PRECEDENCE.extension,

package/src/domains/resources/prompts/loader.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { parseCommandArgs, substituteArgs } from "../../../engine/prompt-templates.js";
@@ -13,7 +13,6 @@ import {
 import {
 	COMPAT_RESOURCE_PRECEDENCE,
 	defaultScopedResourceRoots,
-	readRootEntries,
 	sourceInfoForRoot,
 	splitYamlFrontmatter,
 	stringField,
@@ -33,6 +32,8 @@ export interface PromptTemplate {
 
 export interface PromptTemplateRoot {
 	path: string;
+	/** Present only for an installed extension resource root. */
+	rootPath?: string;
 	scope: ResourceScope;
 	source?: string;
 	precedence?: number;
@@ -139,6 +140,61 @@ function fallbackDescription(body: string): string {
 	return normalized.length > 60 ? `${normalized.slice(0, 57)}...` : normalized;
 }
 
+// Keep the suffix deliberately conservative. Prompt prose commonly places a
+// comma, parenthesis, or full stop immediately after an @path; treating that
+// punctuation as part of the filesystem reference makes a valid template look
+// unresolved. Extension bundles use portable path components, so these are the
+// only characters needed in a reference while still allowing `..` to be
+// detected and rejected by the containment check below.
+const EXTENSION_ROOT_REFERENCE = /\$\{extensionRoot\}(\/[A-Za-z0-9._~%+@/-]*)?/g;
+const EXTENSION_ROOT_TOKEN = "$" + "{extensionRoot}";
+
+function contained(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+
+/** Resolve only existing paths contained by the declaring extension package. */
+function resolveExtensionReferences(
+	body: string,
+	root: PromptTemplateRoot,
+	filePath: string,
+	diagnostics: ResourceDiagnostic[],
+): string | null {
+	if (root.rootPath === undefined || !body.includes(EXTENSION_ROOT_TOKEN)) return body;
+	let canonicalRoot: string;
+	try {
+		canonicalRoot = realpathSync(root.rootPath);
+	} catch (error) {
+		diagnostics.push({
+			type: "warning",
+			message: `extension root could not be resolved: ${error instanceof Error ? error.message : String(error)}`,
+			path: filePath,
+		});
+		return null;
+	}
+	let invalid: string | null = null;
+	const resolved = body.replace(EXTENSION_ROOT_REFERENCE, (reference, suffix: string | undefined) => {
+		const candidate = path.resolve(canonicalRoot, `.${suffix ?? ""}`);
+		try {
+			const canonicalCandidate = realpathSync(candidate);
+			if (!contained(canonicalRoot, canonicalCandidate)) invalid = reference;
+		} catch {
+			invalid = reference;
+		}
+		return candidate;
+	});
+	if (invalid !== null) {
+		diagnostics.push({
+			type: "warning",
+			message: `prompt template has an unresolved or escaping extension reference: ${invalid}`,
+			path: filePath,
+		});
+		return null;
+	}
+	return resolved;
+}
+
 function loadPromptFile(
 	filePath: string,
 	root: PromptTemplateRoot,
@@ -155,16 +211,28 @@ function loadPromptFile(
 		return null;
 	}
 
-	const name = path.basename(filePath, ext);
+	const relativePath = path.relative(root.path, filePath);
+	if (
+		relativePath === "" ||
+		relativePath === ".." ||
+		relativePath.startsWith(`..${path.sep}`) ||
+		path.isAbsolute(relativePath)
+	) {
+		diagnostics.push({ type: "warning", message: "prompt template escaped its discovery root", path: filePath });
+		return null;
+	}
+	const name = relativePath.slice(0, -ext.length).split(path.sep).join(":");
 	if (name.trim().length === 0) return null;
 	const { frontmatter, body } = splitOptionalFrontmatter(raw, filePath, diagnostics);
-	const description = stringField(frontmatter, "description") ?? fallbackDescription(body);
+	const resolvedBody = resolveExtensionReferences(body, root, filePath, diagnostics);
+	if (resolvedBody === null) return null;
+	const description = stringField(frontmatter, "description") ?? fallbackDescription(resolvedBody);
 	const argumentHint = stringField(frontmatter, "argument-hint") ?? stringField(frontmatter, "argumentHint");
 	const sourceInfo: ResourceSourceInfo = sourceInfoForRoot(root, filePath);
 	const template: PromptTemplate = {
 		name,
 		description,
-		content: body.trim(),
+		content: resolvedBody.trim(),
 		filePath,
 		sourceInfo,
 		trusted: root.trusted !== false,
@@ -178,10 +246,42 @@ function loadPromptRoot(
 	diagnostics: ResourceDiagnostic[],
 ): ResourceCandidate<PromptTemplate>[] {
 	const candidates: ResourceCandidate<PromptTemplate>[] = [];
-	for (const entry of readRootEntries(root, "prompt template", diagnostics)) {
-		if (!entry.isFile()) continue;
-		const candidate = loadPromptFile(path.join(root.path, entry.name), root, diagnostics);
-		if (candidate) candidates.push(candidate);
+	const pending = [root.path];
+	while (pending.length > 0) {
+		const directory = pending.pop();
+		if (!directory) continue;
+		let entries: import("node:fs").Dirent[];
+		try {
+			const stat = lstatSync(directory);
+			if (stat.isSymbolicLink() || !stat.isDirectory()) {
+				diagnostics.push({
+					type: "warning",
+					message: "prompt template root contains a non-directory or symbolic link",
+					path: directory,
+				});
+				continue;
+			}
+			entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+			diagnostics.push({
+				type: "warning",
+				message: `prompt template directory could not be read: ${error instanceof Error ? error.message : String(error)}`,
+				path: directory,
+			});
+			continue;
+		}
+		for (const entry of [...entries].reverse()) {
+			const filePath = path.join(directory, entry.name);
+			if (entry.isSymbolicLink()) {
+				diagnostics.push({ type: "warning", message: "prompt template symbolic link was ignored", path: filePath });
+			} else if (entry.isDirectory()) {
+				pending.push(filePath);
+			} else if (entry.isFile()) {
+				const candidate = loadPromptFile(filePath, root, diagnostics);
+				if (candidate) candidates.push(candidate);
+			}
+		}
 	}
 	return candidates;
 }
@@ -210,13 +310,18 @@ export function loadPromptTemplates(input: LoadPromptTemplatesInput = {}): Promp
 }
 
 function parsePromptCommand(input: string): { name: string; rest: string } | null {
-	const trimmed = input.trim();
-	if (!trimmed.startsWith("/")) return null;
-	const withoutSlash = trimmed.slice(1);
+	const framed = input.trimStart();
+	if (!framed.startsWith("/")) return null;
+	const withoutSlash = framed.slice(1);
 	const separator = withoutSlash.search(/\s/);
 	const name = separator === -1 ? withoutSlash : withoutSlash.slice(0, separator);
 	if (name.length === 0 || name.includes("/")) return null;
-	const rest = separator === -1 ? "" : withoutSlash.slice(separator).trim();
+	// Leading whitespace before `/` and the first whitespace after the command
+	// are framing. A CRLF pair is one delimiter. Every subsequent byte belongs
+	// to the argument payload, including indentation, blank lines, and trailing
+	// whitespace, so raw `$ARGUMENTS` substitution can be exact at its boundary.
+	const delimiterWidth = separator !== -1 && withoutSlash.slice(separator, separator + 2) === "\r\n" ? 2 : 1;
+	const rest = separator === -1 ? "" : withoutSlash.slice(separator + delimiterWidth);
 	return { name, rest };
 }
 
@@ -238,7 +343,7 @@ export function expandPromptTemplateInput(input: string, templates: PromptTempla
 	const args = parseCommandArgs(command.rest);
 	return {
 		expanded: true,
-		text: substituteArgs(template.content, args),
+		text: substituteArgs(template.content, args, command.rest),
 		args,
 		template,
 		diagnostics: templates.diagnostics,

package/src/domains/safety/policy-engine.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { artifactDefaultPath } from "../../core/artifact-paths.js";
+import { pathBoundaryCovers, resolvePathBoundary } from "../../core/path-boundary.js";
 import { canonicalizeExistingPath } from "../../core/path-canonical.js";
 import { ToolNames } from "../../core/tool-names.js";
 import { clioConfigDir } from "../../core/xdg.js";
@@ -89,7 +90,8 @@ export interface SafetyPolicyEngineOptions {
 	rulePacks?: RulePacks;
 	projectPolicy?: LoadedProjectSafetyPolicy;
 	/**
-	 * Absolute directories a write-class tool call is confined to for this run.
+	 * Absolute path boundaries a write-class tool call is confined to for this run.
+	 * Exact files omit a trailing slash and subtrees retain one.
 	 * When present and non-empty, a write/edit target outside every root is a
 	 * final BLOCK (reason code "write-root"). Empty or absent disables the check.
 	 * Enforced at the worker safety seam so both the native worker registry and
@@ -182,9 +184,7 @@ function evaluateWriteRoots(roots: ReadonlyArray<string>, writeRootCwd: string,
 	const target = writeRootTargetPath(call);
 	if (target === null) return null;
 	const resolved = path.resolve(writeRootCwd, target);
-	for (const root of roots) {
-		if (resolved === root || resolved.startsWith(`${root}${path.sep}`)) return null;
-	}
+	if (pathBoundaryCovers(roots, resolved)) return null;
 	return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
 }
 
@@ -193,7 +193,7 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 	// Write-root containment resolves lexically, so it keeps its own un-canonicalized
 	// cwd and roots to compare like against like (the design mandates no symlink chasing).
 	const writeRootCwd = path.resolve(options.cwd ?? process.cwd());
-	const writeRoots = (options.writeRoots ?? []).map((root) => path.resolve(root));
+	const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
 	const packs = options.rulePacks ?? getCachedDefaultRulePacks();
 	const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
 	const projectPolicyRoot =

package/src/domains/safety/run-effects.ts

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { ToolNames } from "../../core/tool-names.js";
+import { classify } from "./action-classifier.js";
 import { typedValidationSummary } from "./finish-contract.js";
 import {
 	detectValidationCommand,
@@ -25,6 +26,13 @@ import {
  * bash command that writes through a script) leaves the path absent from the
  * set and the validator falls back to the filesystem rather than to a failed
  * conformance.
+ *
+ * `writeRecordComplete` is the other half of that sentence, and it exists for
+ * the reader that cannot fall back to the filesystem. The write boundary uses
+ * this record the other way round, to decide that a path the run did *not*
+ * write is somebody else's and must survive. Reading an under-reporting set as
+ * a closed list would clear a step of a write it really made, so the recorder
+ * says outright whether the set is closed.
  */
 export interface RunEffects {
 	/** Absolute paths the run's successful tool calls aimed a mutation at. */
@@ -56,6 +64,18 @@ export interface RunEffects {
 	 * wider set.
 	 */
 	verificationCommands: ReadonlySet<string>;
+	/**
+	 * False once the run made a successful call to a tool that can mutate a path
+	 * its own arguments do not name. After such a call `mutatedPaths` is a lower
+	 * bound rather than the whole list, so a reader that would treat an absent
+	 * path as proof the run did not write it has to stop treating it that way.
+	 *
+	 * The downgrade covers the whole run rather than the one call, because an
+	 * opaque call's effect is unbounded. A shell command, a project script, or a
+	 * spawned worker can write anywhere the process can reach, so once one has
+	 * run there is no path left in the checkout that the record can clear.
+	 */
+	writeRecordComplete: boolean;
 }
 
 export interface RunEffectsRecorder {
@@ -70,6 +90,39 @@ interface PendingEffects {
 	paths: ReadonlyArray<string>;
 	validationCommand: string | null;
 	verificationCommand: string | null;
+	opaque: boolean;
+}
+
+/**
+ * Action classes whose successful calls write only paths their own arguments
+ * name. `read` covers the observe, retrieve, interact, and orchestrate-bookkeeping
+ * tools, none of which touch a source-workspace file: `git` is a closed
+ * status/diff/log surface, and `tasks`, `ledger`, and `context` write Clio's own
+ * state. `write` covers `write`, `edit`, and `artifact`, whose target
+ * `toolMutationPaths` resolves from the call itself, including the artifact
+ * tool's default path.
+ */
+const ENUMERABLE_ACTION_CLASSES: ReadonlySet<string> = new Set(["read", "write"]);
+
+/**
+ * Whether a successful call to this tool can mutate a path its own recorded
+ * arguments do not name.
+ *
+ * Asked of the classifier rather than of a hand-written list, because
+ * `src/tools/policy.ts` asserts at bootstrap that every registered tool's
+ * `baseActionClass` equals what this classifier returns and what the plane
+ * table declares. A tool added to the execute or orchestrate-dispatch plane is
+ * therefore opaque the day it is registered, with no list to remember to update.
+ *
+ * The classifier is asked about the tool name alone. Bash's argument scan can
+ * escalate a single call to `system_modify` or `git_destructive`, and those are
+ * still bash; the question here is what the tool can do, not what one call was
+ * caught doing. An unregistered name (a dynamic or MCP tool) classifies as
+ * `unknown` and is opaque, which is the fail-closed answer for a tool whose
+ * arguments this process has no schema for.
+ */
+export function toolWritesOpaquely(toolName: string): boolean {
+	return !ENUMERABLE_ACTION_CLASSES.has(classify({ tool: toolName }).actionClass);
 }
 
 /**
@@ -157,18 +210,23 @@ export function createRunEffectsRecorder(cwd: string): RunEffectsRecorder {
 	const failedMutationPaths = new Set<string>();
 	const validationCommands = new Set<string>();
 	const verificationCommands = new Set<string>();
+	let opaqueWriteObserved = false;
 	return {
 		start(toolCallId, toolName, args) {
 			const paths = mutationTargets(toolName, args);
 			const validationCommand = validationCommandOf(toolName, args, "finish-contract");
 			const verificationCommand = validationCommandOf(toolName, args, "grounding");
-			if (paths.length === 0 && validationCommand === null && verificationCommand === null) return;
+			const opaque = toolWritesOpaquely(toolName);
+			// An opaque call is tracked even when it exposed no path and no
+			// command, because the fact that it ran at all is the finding.
+			if (!opaque && paths.length === 0 && validationCommand === null && verificationCommand === null) return;
 			// A bash call may re-base its relative paths with its own cwd argument.
 			const base = typeof args?.cwd === "string" && args.cwd.length > 0 ? path.resolve(cwd, args.cwd) : cwd;
 			pending.set(toolCallId, {
 				paths: paths.map((target) => path.resolve(base, target)),
 				validationCommand,
 				verificationCommand,
+				opaque,
 			});
 		},
 		finish(toolCallId, failed) {
@@ -179,6 +237,10 @@ export function createRunEffectsRecorder(cwd: string): RunEffectsRecorder {
 				for (const target of effects.paths) failedMutationPaths.add(target);
 				return;
 			}
+			// Success-gated on purpose. A shell command the safety policy blocked,
+			// or one that came back an error, never reached the filesystem, so it
+			// leaves the record closed.
+			if (effects.opaque) opaqueWriteObserved = true;
 			for (const target of effects.paths) mutatedPaths.add(target);
 			if (effects.validationCommand !== null) validationCommands.add(effects.validationCommand);
 			if (effects.verificationCommand !== null) verificationCommands.add(effects.verificationCommand);
@@ -191,6 +253,7 @@ export function createRunEffectsRecorder(cwd: string): RunEffectsRecorder {
 				failedMutationPaths: new Set([...failedMutationPaths].filter((target) => !mutatedPaths.has(target))),
 				validationCommands: new Set(validationCommands),
 				verificationCommands: new Set(verificationCommands),
+				writeRecordComplete: !opaqueWriteObserved,
 			};
 		},
 	};

package/src/domains/safety/scope.ts

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { asDirectoryPathBoundary, pathBoundaryEntryCovers, resolvePathBoundary } from "../../core/path-boundary.js";
 import type { ActionClass } from "./action-classifier.js";
 
 /**
@@ -15,15 +16,7 @@ export interface ScopeSpec {
 }
 
 function normalizeRoot(root: string): string {
-	return path.resolve(root);
-}
-
-function isUnder(child: string, parent: string): boolean {
-	const c = normalizeRoot(child);
-	const p = normalizeRoot(parent);
-	if (c === p) return true;
-	const rel = path.relative(p, c);
-	return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+	return resolvePathBoundary(process.cwd(), root);
 }
 
 export function isSubset(worker: ScopeSpec, orchestrator: ScopeSpec): boolean {
@@ -31,7 +24,9 @@ export function isSubset(worker: ScopeSpec, orchestrator: ScopeSpec): boolean {
 		if (!orchestrator.allowedActions.has(action)) return false;
 	}
 	for (const root of worker.allowedWriteRoots) {
-		const covered = orchestrator.allowedWriteRoots.some((outer) => isUnder(root, outer));
+		const covered = orchestrator.allowedWriteRoots.some((outer) =>
+			pathBoundaryEntryCovers(normalizeRoot(outer), normalizeRoot(root)),
+		);
 		if (!covered) return false;
 	}
 	if (worker.allowNetwork && !orchestrator.allowNetwork) return false;
@@ -48,14 +43,14 @@ export const READONLY_SCOPE: ScopeSpec = {
 
 export const WORKSPACE_SCOPE: ScopeSpec = {
 	allowedActions: new Set<ActionClass>(["read", "write", "execute", "dispatch"]),
-	allowedWriteRoots: [process.cwd()],
+	allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
 	allowNetwork: true,
 	allowDispatch: true,
 };
 
 export const CONFIRMED_SCOPE: ScopeSpec = {
 	allowedActions: new Set<ActionClass>(["read", "write", "execute", "dispatch", "system_modify"]),
-	allowedWriteRoots: [process.cwd()],
+	allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
 	allowNetwork: true,
 	allowDispatch: true,
 };

package/src/engine/acp/server.ts

@@ -1233,7 +1233,10 @@ function safeProbeReason(
 	} catch {
 		return "not-configured";
 	}
-	return status.available && status.health.status === "healthy" ? null : "unreachable";
+	// Degraded is reachable with a default the server does not serve; a client
+	// that names its own model can still use the target.
+	const reachable = status.health.status === "healthy" || status.health.status === "degraded";
+	return status.available && reachable ? null : "unreachable";
 }
 
 interface AcpPermissionBridge {

package/src/engine/prompt-templates.ts

@@ -1 +1,18 @@
-export { parseCommandArgs, substituteArgs } from "@earendil-works/pi-agent-core";
+import { parseCommandArgs, substituteArgs as substituteParsedArgs } from "@earendil-works/pi-agent-core";
+
+export { parseCommandArgs };
+
+const RAW_ARGUMENTS_PLACEHOLDER = /\$ARGUMENTS/g;
+
+/**
+ * Substitute prompt arguments while optionally retaining the exact raw text
+ * for `$ARGUMENTS`. Positional, slice, and `$@` placeholders keep Pi's
+ * shell-style parsing semantics.
+ */
+export function substituteArgs(content: string, args: string[], rawArguments?: string): string {
+	if (rawArguments === undefined) return substituteParsedArgs(content, args);
+	return content
+		.split(RAW_ARGUMENTS_PLACEHOLDER)
+		.map((segment) => substituteParsedArgs(segment, args))
+		.join(rawArguments);
+}

package/src/engine/worker-runtime.ts

@@ -23,7 +23,7 @@ import { type ToolName, ToolNames } from "../core/tool-names.js";
 import {
 	type ObservedReadRanges,
 	type ObservedRunEffects,
-	parseResultContract,
+	parseWorkerResultContract,
 	RESULT_CONTRACT_REPAIR_LIMIT,
 	type ResultContract,
 	resultContractRepairMessages,
@@ -362,8 +362,11 @@ export function startWorkerRun(input: WorkerRunInput, emit: WorkerEventEmit): Wo
 	assertResponseSchemaRuntime(input);
 	// The wire carries the contract as data; the one strict parser owns its
 	// shape. The worker subprocess may not import it (it stays slim), so the
-	// check lands here, before any model call.
-	if (input.resultContract !== undefined) parseResultContract(input.resultContract, "WorkerSpec.resultContract");
+	// check lands here, before any model call. The wire parser, not the recipe
+	// one: a dispatch request may override the seated recipe's postcondition
+	// with a kind the coordinator authors, and the recipe parser refusing those
+	// killed every council vote member with a fatal spec error.
+	if (input.resultContract !== undefined) parseWorkerResultContract(input.resultContract, "WorkerSpec.resultContract");
 	if (input.runtime.id === "claude-sdk") {
 		return startClaudeSdkWorkerRun(input, emit);
 	}

package/src/interactive/dispatch-board.ts

@@ -24,6 +24,11 @@ import {
 	type RunStatus,
 	runKindSupportsLiveSteering,
 } from "../domains/dispatch/types.js";
+import {
+	summarizeTrustStatus,
+	type TrustSummaryProjection,
+	type TrustVerdict,
+} from "../domains/evidence/trust-projection.js";
 import {
 	COST_NOT_MEASURED,
 	costAggregateForAmount,
@@ -113,6 +118,13 @@ export interface DispatchBoardRow {
 	council?: { group: string; label: string; color?: string; round: number };
 	/** Orchestrator-executed declared verification status. */
 	hostVerification?: "verified" | "rejected" | "skipped";
+	/**
+	 * The canonical trust projection of the sealed receipt, read back from
+	 * disk and authenticated against the ledger row. Absent while the run is
+	 * live or when the receipt could not be read back, so the card never
+	 * implies a verdict the terminal bus event cannot carry.
+	 */
+	trust?: TrustSummaryProjection;
 	/** Dead-node failover hops recorded on this run's chain. */
 	rerouteCount?: number;
 	/** Assignment retry attempts observed on the assignment event stream. */
@@ -651,7 +663,15 @@ export function renderDispatchCard(
 		`${theme.fg("dim", "ttft")} ${theme.fg("muted", ttft)}`,
 		`${theme.fg("dim", "cost")} ${theme.fg("muted", cost)}`,
 	];
-	const hostVerification = theme.fg("info", `host_verification=${row.hostVerification ?? "not_requested"}`);
+	// The trust line is the canonical projection, styled by its verdict tier;
+	// a host check is folded into that projection as validation grounding, so
+	// it is named as a secondary fact and never as independent verification.
+	const trustUnits = [
+		row.trust === undefined
+			? theme.fg("dim", isTerminalStatus(row.status) ? "trust: receipt not read back" : "trust: not sealed yet")
+			: theme.fg(trustVerdictToken(row.trust.verdict), `${trustVerdictGlyph(row.trust.verdict)} ${row.trust.text}`),
+		...(row.hostVerification !== undefined ? [theme.fg("muted", `host checks ${row.hostVerification}`)] : []),
+	];
 	const contextUnit = formatWorkerContextMeter(row.lastContextTokens ?? 0, row.contextWindow, theme);
 	// The phase column: a fleet step says which wave it belongs to and which
 	// step it is; every other run leaves the cell empty rather than inventing a
@@ -670,7 +690,7 @@ export function renderDispatchCard(
 			? [truncateToWidth(`${cardKvKey(theme, "task")}${theme.fg("muted", row.taskSummary)}`, contentWidth, "…", false)]
 			: []),
 		cardUnitsLine(theme, "status", statusUnits, contentWidth),
-		cardUnitsLine(theme, "evidence", [hostVerification], contentWidth),
+		cardUnitsLine(theme, "trust", trustUnits, contentWidth),
 		...(row.budget !== undefined
 			? [
 					truncateToWidth(
@@ -1160,6 +1180,33 @@ function parseOptionalDetail(value: unknown): string | null {
 	return detail.length > 0 ? detail : null;
 }
 
+/** Only an authenticated independent pass earns the success token; sealed alone is never green. */
+function trustVerdictToken(verdict: TrustVerdict): ClioToken {
+	switch (verdict) {
+		case "reviewed":
+			return "success";
+		case "grounded":
+			return "info";
+		case "unverified":
+			return "muted";
+		case "compromised":
+			return "error";
+		default:
+			return "dim";
+	}
+}
+
+function trustVerdictGlyph(verdict: TrustVerdict): string {
+	switch (verdict) {
+		case "reviewed":
+			return GLYPH.ok;
+		case "compromised":
+			return GLYPH.error;
+		default:
+			return "◇";
+	}
+}
+
 function terminalDetail(row: DispatchBoardRow): string | null {
 	if (row.status !== "failed" && row.status !== "dead" && row.status !== "aborted") return null;
 	return parseOptionalDetail(row.outcomeDetail);
@@ -1319,6 +1366,7 @@ function toRow(entry: DispatchBoardEntry, now: number): DispatchBoardRow {
 		...(entry.gate !== undefined ? { gate: { ...entry.gate } } : {}),
 		...(entry.council !== undefined ? { council: { ...entry.council } } : {}),
 		...(entry.hostVerification !== undefined ? { hostVerification: entry.hostVerification } : {}),
+		...(entry.trust !== undefined ? { trust: entry.trust } : {}),
 		...(entry.rerouteCount !== undefined ? { rerouteCount: entry.rerouteCount } : {}),
 		...(entry.failoverHops !== undefined ? { failoverHops: entry.failoverHops } : {}),
 		...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
@@ -1394,8 +1442,10 @@ export function createDispatchBoardStore(
 	 * before it publishes one, so this is the first moment the file exists.
 	 */
 	const settleFromReceipt = (entry: DispatchBoardEntry): void => {
-		const text = readReceipt?.(entry.runId)?.text;
+		const facts = readReceipt?.(entry.runId);
+		const text = facts?.text;
 		entry.progress.settle(typeof text === "string" && text.trim().length > 0 ? text : undefined);
+		if (facts?.trust !== undefined) entry.trust = summarizeTrustStatus(facts.trust);
 	};
 
 	// Payloads arrive typed off the bus, but the board keeps its runtime

package/src/interactive/interactive-event-projection.ts

@@ -3,6 +3,7 @@ import {
 	type ConfigReloadFailedPayload,
 	type ContextPrunedPayload,
 	type ContextWarningPayload,
+	type DispatchScopeNoticePayload,
 	type LoopBlockedPayload,
 	type RuntimeNoticePayload,
 	type ToolBudgetExceededPayload,
@@ -271,6 +272,19 @@ export function createInteractiveEventProjection(deps: InteractiveEventProjectio
 	);
 
 	remainingUnsubscribers.push(
+		deps.bus.on(BusChannels.DispatchScopeNotice, (payload) => {
+			const event = payload as DispatchScopeNoticePayload | null | undefined;
+			if (
+				!event ||
+				typeof event !== "object" ||
+				!["typed_scope_replaced_inferred_paths", "legacy_scope_inferred", "legacy_scope_empty"].includes(event.code) ||
+				typeof event.message !== "string"
+			) {
+				return;
+			}
+			deps.appendTranscriptNotice("warn", event.message);
+			deps.requestRender();
+		}),
 		deps.bus.on(BusChannels.LoopBlocked, (payload) => {
 			const event = payload as LoopBlockedPayload | null | undefined;
 			if (!event || typeof event !== "object" || typeof event.tool !== "string" || typeof event.repeatCount !== "number") {