@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/domains/safety/action-classifier.ts

@@ -1,8 +1,11 @@
+import { globSync, lstatSync } from "node:fs";
+import { homedir } from "node:os";
 import path from "node:path";
 import { artifactDefaultPath } from "../../core/artifact-paths.js";
-import { canonicalizeExistingPath } from "../../core/path-canonical.js";
+import { canonicalizeExistingPath, canonicalizePath, canonicalizeRawPath } from "../../core/path-canonical.js";
 import { isHarnessExtensionToolName, ToolNames } from "../../core/tool-names.js";
-import { extractCommandCdTargets, extractCommandWriteTargets } from "./protected-artifacts.js";
+import { normalizeToolPath } from "../../tools/path-utils.js";
+import { type CommandPathEvent, extractCommandPathWalks } from "./protected-artifacts.js";
 
 /**
  * Deterministic action classifier for tool calls. Pure function, no I/O, no
@@ -174,19 +177,47 @@ function matchFirst(patterns: ReadonlyArray<NamedPattern>, haystack: string): Na
 	return null;
 }
 
-function resolveCandidate(p: string, baseCwd?: string): string {
+/**
+ * The directory a bash call runs in. The bash tool resolves its cwd argument
+ * lexically (resolveSafeCwd) and the kernel follows links on chdir, so this
+ * reads it the same way.
+ */
+function candidateBase(baseCwd?: string): string {
+	return canonicalizeExistingPath(path.resolve(baseCwd ?? process.cwd()));
+}
+
+/**
+ * Where a write through a model-supplied path lands. The kernel resolves an
+ * open or a redirect one component at a time, so `data/link/../x` lands beside
+ * the link's target, not in `data`. Null when the path cannot be canonicalized.
+ */
+function resolveCandidate(p: string, baseCwd?: string): string | null {
 	// ~ expansion is not performed here; any ~-prefixed path is treated as an
 	// absolute user-home reference. We keep it as-is so the caller-visible
 	// string drives the escape check, and classify conservatively as modify.
 	if (p.startsWith("~")) return p;
-	const base = canonicalizeExistingPath(path.resolve(baseCwd ?? process.cwd()));
-	const resolved = path.isAbsolute(p) ? path.resolve(p) : path.resolve(base, p);
-	return canonicalizeExistingPath(resolved);
+	return canonicalizeRawPath(p, candidateBase(baseCwd));
+}
+
+/**
+ * Where a shell `cd` lands, under both readings. A shell `cd` is logical by
+ * default: it collapses `link/..` against the path it names and then follows
+ * links. `cd -P` and `set -P` walk physically instead. Null for a reading that
+ * cannot be canonicalized.
+ */
+function resolveCdCandidates(target: string, baseCwd?: string): Array<string | null> {
+	const base = candidateBase(baseCwd);
+	const logical = canonicalizePath(path.resolve(base, target));
+	const physical = canonicalizeRawPath(target, base);
+	return logical === physical ? [logical] : [logical, physical];
 }
 
+// A path that cannot be canonicalized (a link loop, too many links) is
+// outside, never inside: nothing proves where a write through it lands.
 function isInsideCwd(abs: string): boolean {
-	const cwd = canonicalizeExistingPath(path.resolve(process.cwd()));
-	const candidate = canonicalizeExistingPath(abs);
+	const cwd = canonicalizePath(path.resolve(process.cwd()));
+	const candidate = canonicalizePath(abs);
+	if (cwd === null || candidate === null) return false;
 	const rel = path.relative(cwd, candidate);
 	return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
 }
@@ -196,6 +227,8 @@ function writePathClass(pathArg: string, baseCwd?: string): { cls: "system_modif
 		return { cls: "system_modify", reason: `write-path-home-escape: ${pathArg}` };
 	}
 	const abs = resolveCandidate(pathArg, baseCwd);
+	// Nothing proves where a write through an unresolvable path lands.
+	if (abs === null) return { cls: "system_modify", reason: `write-path-outside-cwd: ${pathArg}` };
 	const exempt = SYSTEM_WRITE_EXEMPT_PREFIXES.some((prefix) => isUnderPrefix(abs, prefix));
 	if (!exempt) {
 		for (const prefix of SYSTEM_WRITE_ROOT_PREFIXES) {
@@ -210,6 +243,201 @@ function writePathClass(pathArg: string, baseCwd?: string): { cls: "system_modif
 	return { cls: "write" };
 }
 
+/** More directories than this after a run of cds is treated as an unknown base. */
+const MAX_SHELL_BASES = 32;
+
+/**
+ * A word the shell expands at run time: a variable, a substitution, a glob, or
+ * a brace expansion (`{a,b}`, `{1..3}`). A lone `{}` is literal to the shell.
+ */
+function isDynamicShellPath(p: string): boolean {
+	return /[$`*?[]/u.test(p) || /\{[^{}]*(?:,|\.\.)[^{}]*\}/u.test(p);
+}
+
+function expandShellHome(p: string): string | null {
+	if (p === "~") return homedir();
+	if (p.startsWith("~/")) return path.join(homedir(), p.slice(2));
+	return p.startsWith("~") ? null : p;
+}
+
+/** Where the shell can be; null once a cd leaves it unknown. */
+type ShellBases = string[] | null;
+
+function mergeBases(left: ShellBases, right: ShellBases): ShellBases {
+	if (left === null || right === null) return null;
+	const merged = [...new Set([...left, ...right])];
+	return merged.length > MAX_SHELL_BASES ? null : merged;
+}
+
+/**
+ * Reasons a bash command reaches outside the workspace through the paths it
+ * names. The walk keeps every directory the shell can be in and resolves each
+ * relative write, cd, and link from all of them. A cd adds where it lands under
+ * both readings and never removes a directory, because the cd may fail, run in
+ * a pipeline, or be something the scanner misreads as a cd (a heredoc line, a
+ * backtick script), and a later command then runs where the shell already
+ * was. So the call's cwd is always a base, and nothing is judged from fewer
+ * directories than before cds were followed. A subshell's cds end at its `)`.
+ * A cd the shell expands at run time, or one a loop, a function, or CDPATH can
+ * repeat or redirect, leaves the base unknown, and a relative write after it
+ * cannot be placed.
+ */
+function bashPathReasons(command: string, argCwd: string | undefined): string[] {
+	const reasons = new Set<string>();
+	for (const walk of extractCommandPathWalks(command)) {
+		for (const reason of walkPathReasons(walk, argCwd)) reasons.add(reason);
+	}
+	return [...reasons];
+}
+
+function walkPathReasons(walk: ReadonlyArray<CommandPathEvent>, argCwd: string | undefined): string[] {
+	const writeReasons = new Set<string>();
+	const cdReasons = new Set<string>();
+	let bases: ShellBases = [candidateBase(argCwd)];
+	const subshells: ShellBases[] = [];
+	for (const event of walk) {
+		if (event.kind === "subshell") {
+			if (event.open) subshells.push(bases);
+			else if (subshells.length > 0) bases = subshells.pop() as ShellBases;
+			continue;
+		}
+		if (event.kind === "write") {
+			const target = event.target;
+			// `> $HOME/x`, `> ${OUT}`, and `tee {a,b}` land where the shell says.
+			if (isDynamicShellPath(target) && !target.startsWith("/dev/")) {
+				writeReasons.add(`write-path-unknown-base: ${target}`);
+			} else if (target.startsWith("~") || path.isAbsolute(target)) {
+				const decision = writePathClass(target);
+				if (decision.cls === "system_modify") writeReasons.add(decision.reason ?? `bash-write-target: ${target}`);
+			} else if (bases === null) {
+				writeReasons.add(`write-path-unknown-base: ${target}`);
+			} else {
+				for (const base of bases) {
+					const decision = writePathClass(target, base);
+					if (decision.cls === "system_modify") writeReasons.add(decision.reason ?? `bash-write-target: ${target}`);
+				}
+			}
+			continue;
+		}
+		if (event.kind === "link") {
+			for (const reason of linkReasons(event, bases)) writeReasons.add(reason);
+			continue;
+		}
+		const target = event.target;
+		if (target.startsWith("~")) {
+			cdReasons.add(`bash-cd-home-escape: ${target}`);
+			continue;
+		}
+		if (isDynamicShellPath(target)) {
+			bases = null;
+			continue;
+		}
+		const from = path.isAbsolute(target) ? [undefined] : (bases ?? []);
+		const landed: string[] = [];
+		for (const base of from) {
+			for (const landing of resolveCdCandidates(target, base)) {
+				// Inside means inside under the logical and the physical reading.
+				if (landing === null || !isInsideCwd(landing)) cdReasons.add(`bash-cd-outside-workspace: ${landing ?? target}`);
+				else landed.push(landing);
+			}
+		}
+		// A relative cd from an unknown base lands somewhere unknown too.
+		bases = event.unmodeled || bases === null ? null : mergeBases(bases, landed);
+	}
+	return [...writeReasons, ...cdReasons];
+}
+
+/**
+ * A link a command creates is followed by every later path through it, which
+ * static admission cannot model. A symbolic link whose text, resolved from the
+ * link's directory, leaves the workspace escalates the command, and so does a
+ * hard link to a file outside it, since a write through the link changes that
+ * file. A link whose target or directory the shell expands at run time counts
+ * as outside. `mv` and a link-keeping `cp` escalate when a source is an
+ * existing link that resolves outside, and a link made from `xargs` or `find
+ * -exec` input always escalates.
+ */
+function linkReasons(event: Extract<CommandPathEvent, { kind: "link" }>, bases: ShellBases): string[] {
+	const reasons: string[] = [];
+	const label = event.symbolic ? "bash-symlink-outside-workspace" : "bash-hardlink-outside-workspace";
+	if (event.origin === "input") return event.sources.map((source) => `${label}: ${source}`);
+	if (event.origin === "copied") {
+		for (const base of bases ?? [null]) {
+			for (const source of event.sources) {
+				const landing = copiedLinkOutside(source, base);
+				if (landing !== null) reasons.push(`${label}: ${landing}`);
+			}
+		}
+		return [...new Set(reasons)];
+	}
+	const outside = (source: string, from: string | null): string | null => {
+		const expanded = expandShellHome(source);
+		if (expanded === null || isDynamicShellPath(source)) return source;
+		if (!path.isAbsolute(expanded) && from === null) return source;
+		const landing = canonicalizeRawPath(expanded, from ?? process.cwd());
+		return landing !== null && isInsideCwd(landing) ? null : (landing ?? source);
+	};
+	const dirsFrom = (base: string | null): Array<string | null> => {
+		if (!event.symbolic) return [base];
+		return event.linkDirs.map((dir) => {
+			const expanded = expandShellHome(dir);
+			if (expanded === null || isDynamicShellPath(dir)) return null;
+			if (!path.isAbsolute(expanded) && base === null) return null;
+			return canonicalizeRawPath(expanded, base ?? process.cwd());
+		});
+	};
+	for (const base of bases ?? [null]) {
+		for (const from of dirsFrom(base)) {
+			for (const source of event.sources) {
+				const landing = outside(source, from);
+				if (landing !== null) reasons.push(`${label}: ${landing}`);
+			}
+		}
+	}
+	return [...new Set(reasons)];
+}
+
+/** More matches than this for a moved or copied glob count as outside. */
+const MAX_COPIED_LINK_MATCHES = 256;
+
+/**
+ * Where an existing link a command moves or copies points, when that is
+ * outside the workspace; null when the source is not a link or points inside.
+ * A glob or brace source is matched now, from the base; a variable or a
+ * substitution cannot be, so it counts as outside.
+ */
+function copiedLinkOutside(source: string, base: string | null): string | null {
+	const expanded = expandShellHome(source);
+	if (expanded === null || /[$`]/u.test(source)) return source;
+	if (!path.isAbsolute(expanded) && base === null) return source;
+	const from = base ?? process.cwd();
+	let matches = [expanded];
+	if (isDynamicShellPath(source)) {
+		try {
+			matches = globSync(expanded, { cwd: from });
+		} catch {
+			return source;
+		}
+		if (matches.length > MAX_COPIED_LINK_MATCHES) return source;
+	}
+	for (const match of matches) {
+		// The kernel follows every component but the last, which is the link itself.
+		const parent = canonicalizeRawPath(path.dirname(match), from);
+		if (parent === null) return source;
+		const entry = path.join(parent, path.basename(match));
+		let isLink = false;
+		try {
+			isLink = lstatSync(entry).isSymbolicLink();
+		} catch {
+			continue;
+		}
+		if (!isLink) continue;
+		const landing = canonicalizeRawPath(entry, "/");
+		if (landing === null || !isInsideCwd(landing)) return landing ?? source;
+	}
+	return null;
+}
+
 /**
  * The artifact tool writes a default file name when the call names no path, so
  * a classifier that only reads the path argument saw no target at all and
@@ -232,7 +460,51 @@ export function webFetchIsOutward(args: Record<string, unknown> | undefined): bo
 	return (method !== "GET" && method !== "HEAD") || args?.body !== undefined;
 }
 
-export function classify(call: ClassifierCall): Classification {
+/** Tools that resolve their path through path-utils, against the process cwd. */
+const PATH_UTILS_TOOLS: ReadonlySet<string> = new Set([
+	ToolNames.Read,
+	ToolNames.Ls,
+	ToolNames.Grep,
+	ToolNames.Find,
+	ToolNames.Write,
+	ToolNames.Edit,
+	ToolNames.Artifact,
+]);
+
+/**
+ * The call as its tool reads it. The file tools drop a leading `@` and fold
+ * Unicode spaces before they resolve a path, and they resolve it against the
+ * process cwd whatever `cwd` the call carries; bash does the same spelling
+ * change to its `cwd`. Judging the raw arguments judged a different path:
+ * `@../x` read as a directory named `@..` inside the workspace, and a `cwd`
+ * padded with missing levels pulled `../../x` back inside it. Idempotent, so
+ * the policy engine normalizes once and classify can do it again.
+ */
+export function normalizeCallPaths(call: ClassifierCall): ClassifierCall {
+	const args = call.args;
+	if (!args) return call;
+	if (call.tool === ToolNames.Bash) {
+		if (typeof args.cwd !== "string") return call;
+		const cwd = normalizeToolPath(args.cwd);
+		return cwd === args.cwd ? call : { ...call, args: { ...args, cwd } };
+	}
+	if (!PATH_UTILS_TOOLS.has(call.tool)) return call;
+	let next: Record<string, unknown> | null = null;
+	for (const key of ["path", "file_path", "filePath"]) {
+		const value = args[key];
+		if (typeof value !== "string") continue;
+		const normalized = normalizeToolPath(value);
+		if (normalized !== value) next = { ...(next ?? args), [key]: normalized };
+	}
+	if ("cwd" in args) {
+		next = { ...(next ?? args) };
+		delete next.cwd;
+	}
+	return next === null ? call : { ...call, args: next };
+}
+
+export function classify(rawCall: ClassifierCall): Classification {
+	const call = normalizeCallPaths(rawCall);
 	if (call.tool === ToolNames.WebFetch && webFetchIsOutward(call.args)) {
 		return { actionClass: "write", reasons: ["web-fetch:outward"] };
 	}
@@ -264,28 +536,7 @@ export function classify(call: ClassifierCall): Classification {
 		const command = typeof call.args?.command === "string" ? call.args.command : null;
 		const argCwd = typeof call.args?.cwd === "string" && call.args.cwd.length > 0 ? call.args.cwd : undefined;
 		if (command !== null) {
-			const targetReasons: string[] = [];
-			for (const target of extractCommandWriteTargets(command)) {
-				const decision = writePathClass(target, argCwd);
-				if (decision.cls === "system_modify") {
-					targetReasons.push(decision.reason ?? `bash-write-target: ${target}`);
-				}
-			}
-			// A `cd` outside the workspace re-bases every relative path after it,
-			// so static write-target extraction stops describing what the command
-			// touches. Escalate through the same system_modify confirm gate as an
-			// out-of-workspace write target; inside-workspace `cd` stays plain
-			// execute.
-			for (const target of extractCommandCdTargets(command)) {
-				if (target.startsWith("~")) {
-					targetReasons.push(`bash-cd-home-escape: ${target}`);
-					continue;
-				}
-				const abs = resolveCandidate(target, argCwd);
-				if (!isInsideCwd(abs)) {
-					targetReasons.push(`bash-cd-outside-workspace: ${abs}`);
-				}
-			}
+			const targetReasons = bashPathReasons(command, argCwd);
 			if (targetReasons.length > 0) {
 				return { actionClass: "system_modify", reasons: targetReasons };
 			}

package/src/domains/safety/audit.ts

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { closeSync, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
 import { join } from "node:path";
+import { writeDiagnostic } from "../../core/diagnostics.js";
 import { clioStateDir, stateRootRemoved } from "../../core/xdg.js";
 import type { SafetyPolicyDecision } from "./policy-engine.js";
 
@@ -404,7 +405,7 @@ interface OpenFile {
 function logAuditError(err: unknown, path?: string): void {
 	const msg = err instanceof Error ? err.message : String(err);
 	const where = path ? ` (${path})` : "";
-	process.stderr.write(`[clio-coder:audit] ${msg}${where}\n`);
+	writeDiagnostic(`[clio-coder:audit] ${msg}${where}\n`);
 }
 
 /** Cadence of the background safety flush that bounds how long rows can sit unfsynced. */

package/src/domains/safety/autonomy.ts

@@ -49,8 +49,8 @@ export const DEFAULT_AUTONOMY_EXPOSURE: AutonomyExposure = "local";
 export interface AutonomyMappingOptions {
 	/**
 	 * Execute-class calls only: true when the command is in the no-prompt set
-	 * (built-in allowlist, project policy command) or is a typed execution tool
-	 * (verify). Raw bash outside that set is unrecognized.
+	 * (built-in allowlist or approved project policy command). Typed verify
+	 * calls also pass their underlying command through the safety net.
 	 */
 	executeRecognized?: boolean;
 	/**
@@ -66,6 +66,12 @@ export interface AutonomyMappingOptions {
 	 * behavior every call had before the tier existed.
 	 */
 	exposure?: AutonomyExposure;
+	/**
+	 * Read-class path tools only (read, ls, grep, find): true when the path the
+	 * call names resolves outside the workspace and outside Clio's own readable
+	 * roots. The policy engine decides it and carries it as `readScope`.
+	 */
+	readOutsideWorkspace?: boolean;
 }
 
 /**
@@ -104,6 +110,12 @@ export function mapAutonomy(
 	// level it describes is "inspect and answer" and the outward effect it is
 	// confirming is itself denied there.
 	if ((level === "auto-edit" || level === "suggest") && options.exposure === "outward") return "ask";
+	// The workspace is what the operator handed over. A read, listing, or
+	// search aimed outside it asks at every supervised level and runs at
+	// full-auto. `read-only` never invokes approvals, so the ask is its deny.
+	if (actionClass === "read" && options.readOutsideWorkspace === true && level !== "full-auto") {
+		return level === "read-only" ? "deny" : "ask";
+	}
 	if (actionClass === "read") return "allow";
 	if (level === "read-only") return "deny";
 	if (level === "suggest") return "ask";
@@ -131,9 +143,27 @@ export function mapAutonomy(
 
 /**
  * Rejection text for autonomy `deny` dispositions. Only `read-only` produces
- * denies, so the message is the propose-instead contract from §2.3.
+ * denies, so the message is the propose-instead contract from §2.3, or the
+ * search-scope text when the denied call is a read outside the workspace.
  */
-export function autonomyDenyRejection(level: AutonomyLevel, tool: string, actionClass: ActionClass): RejectionMessage {
+export function autonomyDenyRejection(
+	level: AutonomyLevel,
+	tool: string,
+	actionClass: ActionClass,
+	readOutsideWorkspace = false,
+): RejectionMessage {
+	if (readOutsideWorkspace) {
+		return {
+			short: `${tool} denied: the path is outside the workspace at autonomy ${level}`,
+			detail:
+				`The path resolves outside the workspace. Autonomy ${level} reads, lists, and searches inside the workspace ` +
+				"and denies a path outside it without prompting.",
+			hints: [
+				"Work from paths inside the workspace, or name the outside path to the operator as text.",
+				"The operator can raise the level in interactive /settings or with clio-coder run --autonomy <level>.",
+			],
+		};
+	}
 	return {
 		short: `${tool} denied: autonomy level is ${level}`,
 		detail:
@@ -162,7 +192,20 @@ export function autonomyAskRejection(
 	tool: string,
 	actionClass: ActionClass,
 	exposure: AutonomyExposure = DEFAULT_AUTONOMY_EXPOSURE,
+	readOutsideWorkspace = false,
 ): RejectionMessage {
+	if (readOutsideWorkspace && exposure !== "outward") {
+		return {
+			short: `${tool} needs approval: the path is outside the workspace at autonomy ${level}`,
+			detail:
+				`The path resolves outside the workspace, through a link, a \`..\`, or an absolute path. ` +
+				`Autonomy ${level} reads, lists, and searches inside the workspace without asking and parks a path outside it for the operator.`,
+			hints: [
+				"Approving resumes only this call.",
+				"Autonomy full-auto reads outside the workspace without asking; zero-access paths stay refused at every level.",
+			],
+		};
+	}
 	if (exposure === "outward") {
 		return {
 			short: `${tool} needs approval: outward-facing gate at autonomy ${level}`,
@@ -182,15 +225,15 @@ export function autonomyAskRejection(
 			"The call is parked until the operator approves it once or cancels it.",
 		hints: [
 			"Approving resumes only this call.",
-			"Recognized commands can be added to .clio-coder/safety.yaml.",
-			// The sanctioned pivots for a gated shell command: typed verification
-			// and read-class observe tools run without approval at this level,
-			// and models otherwise stall retrying denied bash for checks or
-			// directory listings.
+			"The operator can approve command declarations in .clio-coder/safety.yaml; declarations do not bypass the autonomy level or safety net.",
+			// Offer available tools without promising that changing the tool
+			// spelling bypasses the execution approval or a safety-net rail.
 			...(actionClass === "execute"
 				? [
-						'A declared package or project-catalog check runs without approval through the verify tool: verify(check="<id>").',
-						"Read-only inspection runs without approval through the ls, read, grep, and find tools.",
+						level === "suggest"
+							? 'Declared checks can use verify(check="<id>"), but execution still requires approval at autonomy suggest.'
+							: 'For a declared check, use verify(check="<id>"). Recognized test commands can run without an autonomy prompt; other checks may still require safety-net confirmation.',
+						"Workspace inspection can use the ls, read, grep, and find tools; path protections and safety-net rules still apply.",
 					]
 				: []),
 		],

package/src/domains/safety/decision-presentation.ts

@@ -173,6 +173,9 @@ function authorizationCopy(facts: TrustedDecisionFacts): string {
 	}
 	const tool = facts.tool ?? "the presented tool";
 	const actionClass = facts.actionClass ?? "unknown";
+	if (facts.origin.kind === "worker") {
+		return `Approval authorizes this ${actionClass} call to ${tool} and identical calls under the same permission conditions for this worker run. Each call still passes the safety net. The autonomy level does not change.`;
+	}
 	if (tool === "ask_user" && facts.exposure === "outward") {
 		return "Approval opens this one outward-decision interview. It does not publish or send anything by itself.";
 	}
@@ -194,7 +197,7 @@ function consequenceCopy(facts: TrustedDecisionFacts, tier: DecisionTier): strin
 		case "system":
 			return "The call can change state outside the workspace or state the classifier cannot safely bound.";
 		case "worker":
-			return "A dispatched worker is parked. Your answer returns only to that run's exact request.";
+			return "A dispatched worker is parked. This run remembers your answer for the same tool, arguments, approval axis, and safety classification; other runs are unaffected.";
 	}
 }
 
@@ -234,7 +237,7 @@ function requiredActions(facts: TrustedDecisionFacts, tier: DecisionTier): Reado
 			: tier === "safety-net"
 				? "Approve guarded action once"
 				: tier === "worker"
-					? "Approve worker request once"
+					? "Approve matching calls in this worker run"
 					: tier === "outward"
 						? "Approve outward decision once"
 						: "Approve workspace action once";
@@ -246,9 +249,19 @@ function requiredActions(facts: TrustedDecisionFacts, tier: DecisionTier): Reado
 		{
 			id: "approve-once",
 			label: approveLabel,
-			consequence: "Runs only the presented request and does not change the autonomy level.",
+			consequence:
+				facts.origin.kind === "worker"
+					? "Runs this request and remembers approval for identical calls under the same permission conditions in this worker run."
+					: "Runs only the presented request and does not change the autonomy level.",
+		},
+		{
+			id: "deny",
+			label: "Deny this request",
+			consequence:
+				facts.origin.kind === "worker"
+					? "Denies this request and remembers denial for identical calls under the same permission conditions in this worker run."
+					: "Denies only the presented request and advances the queue.",
 		},
-		{ id: "deny", label: "Deny this request", consequence: "Denies only the presented request and advances the queue." },
 		{ id: "stop", label: "Deny and stop", consequence: stopConsequence },
 	];
 }

package/src/domains/safety/finish-contract-registration.ts

@@ -10,6 +10,7 @@
  * model request. Every decision is also written to the audit ledger.
  */
 
+import { type TurnConstraints, turnAllowsContinuation, turnAllowsTool } from "../../core/turn-constraints.js";
 import { VERIFICATION_SCRIPT_FAMILY_HINT } from "../../core/verification-scripts.js";
 import type { MiddlewareEffect, MiddlewareHookInput, MiddlewareHookRegistration } from "../middleware/index.js";
 import type { UserTaskAcceptance } from "../user-tasks/acceptance.js";
@@ -38,6 +39,7 @@ export const HIGH_RIGOR_REVALIDATION_MESSAGE =
 	`and reason of what could not be verified. Do not end the turn until you have validated or recorded the limitation.`;
 
 export interface CreateFinishContractRegistrationOptions {
+	getTurnConstraints?: () => TurnConstraints | undefined;
 	/**
 	 * Current session entries for evidence collection, or null when no session
 	 * is active. A null return disables assessment for the turn, matching the
@@ -102,10 +104,32 @@ export function createFinishContractRegistration(
 			recordDecision(options, input.turnId ?? null, assessment, rigor);
 			if (assessment.kind !== "engage") return [];
 			if (rigor === "high") {
+				const constraints = options.getTurnConstraints?.();
+				const attached =
+					typeof input.metadata?.activeToolNames === "string" ? input.metadata.activeToolNames.split(",") : undefined;
+				const available = (name: string) =>
+					turnAllowsTool(constraints, name) && (attached === undefined || attached.includes(name));
+				const verificationTools = ["verify", "bash", "run_script"].filter(available);
+				const canRecordLimitation = available("limitation");
+				if (!turnAllowsContinuation(constraints) || (verificationTools.length === 0 && !canRecordLimitation)) {
+					return [
+						{
+							kind: "inject_reminder",
+							severity: "warn",
+							message:
+								"[Clio Coder] validation evidence is missing. Report the change as unverified and name outstanding acceptance checks. The current task scope does not permit automatic validation recovery; this notice grants no additional authority.",
+						},
+					];
+				}
 				// Withhold the completion and force a re-prompt: a continuation
 				// request carries the turn onward, and the paired reminder gives
 				// the directive its own visible system-reminder line.
-				const message = activeAcceptance?.verification.length ? assessment.message : HIGH_RIGOR_REVALIDATION_MESSAGE;
+				const message =
+					verificationTools.length > 0 && canRecordLimitation
+						? activeAcceptance?.verification.length
+							? assessment.message
+							: HIGH_RIGOR_REVALIDATION_MESSAGE
+						: `[Clio Coder] high-rigor finish gate: validation evidence is missing. ${verificationTools.length > 0 ? `Use an authorized check through ${verificationTools.join(" or ")}; if the operator excluded validation, report the blocker without running it.` : "Record the unavailable validation with limitation."} Do not claim checks passed without evidence.`;
 				return [
 					{ kind: "request_continuation", message },
 					{ kind: "inject_reminder", message, severity: "warn" },

package/src/domains/safety/finish-contract.ts

@@ -3,6 +3,7 @@ import { ToolNames } from "../../core/tool-names.js";
 import { isProjectVerifierCheckId, isVerificationScriptName } from "../../core/verification-scripts.js";
 import { effectiveToolCall } from "../../tools/surface.js";
 import { type DeclaredCheckSourceRef, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH } from "../../tools/verify/catalog.js";
+import { validateTrustStatus } from "../evidence/trust-status.js";
 import type { UserTaskAcceptance } from "../user-tasks/acceptance.js";
 import {
 	detectValidationCommand,
@@ -13,7 +14,7 @@ import {
 import type { Rigor } from "./rigor.js";
 
 export const FINISH_CONTRACT_ADVISORY_MESSAGE =
-	"[Clio Coder] finish-contract advisory: you changed files this turn without recording validation evidence or a limitation receipt. Run a verification command or call limitation with the scope and reason.";
+	"[Clio Coder] finish-contract advisory: you changed files this turn without recording validation evidence or a limitation receipt. Report the change as unverified. Run checks only within the operator's authorized scope; this advisory does not authorize tests, scripts, or additional tools.";
 
 /**
  * The recent-window cap (entries since the last user message). Exported so a
@@ -573,8 +574,9 @@ function dispatchReceiptEvidence(
  * (`{mode, runIds, receiptCount, failedCount, runs:[{runId, agentId, exitCode}]}`
  * where exit codes live per-run) as well as the legacy single-run shape
  * (`{exitCode, runId, agentId}`). A batch counts only when it has at least one
- * run and every run exited cleanly, so a partially-failed dispatch never poses
- * as validation evidence.
+ * run and every run exited cleanly. Current results must also carry verified
+ * integrity and validated evidence on their canonical trust axes, so failed or
+ * ungrounded checks never become validation evidence through process success.
  */
 function passedDispatchReceiptSummary(
 	details: Record<string, unknown>,
@@ -582,7 +584,7 @@ function passedDispatchReceiptSummary(
 ): string | null {
 	if (Array.isArray(details.runs)) {
 		const runs = details.runs.map(asRecord);
-		if (runs.length === 0 || runs.some((run) => run === null || run.exitCode !== 0)) return null;
+		if (runs.length === 0 || runs.some((run) => run === null || !passedDispatchRun(run))) return null;
 		if (typeof details.failedCount === "number" && details.failedCount !== 0) return null;
 		const first = runs[0];
 		const runId = typeof first?.runId === "string" && first.runId.length > 0 ? first.runId : "unknown";
@@ -590,7 +592,7 @@ function passedDispatchReceiptSummary(
 		const extra = runs.length > 1 ? ` (+${runs.length - 1} more)` : "";
 		return `dispatch receipt passed: run ${runId} agent ${agentId}${extra}`;
 	}
-	if (details.exitCode === 0) {
+	if (passedDispatchRun(details)) {
 		const runId = typeof details.runId === "string" && details.runId.length > 0 ? details.runId : "unknown";
 		const agentId = dispatchReceiptAgentId(typeof details.agentId === "string" ? details.agentId : undefined, candidate);
 		return `dispatch receipt passed: run ${runId} agent ${agentId}`;
@@ -598,6 +600,19 @@ function passedDispatchReceiptSummary(
 	return null;
 }
 
+function passedDispatchRun(run: Record<string, unknown>): boolean {
+	if (run.exitCode !== 0) return false;
+	// Historical results predate canonical trust status. For current results,
+	// a clean process exit cannot overrule failed, absent, or ungrounded validation.
+	if (!("trustStatus" in run)) return true;
+	const trust = validateTrustStatus(run.trustStatus);
+	return (
+		trust.ok &&
+		trust.status.artifactIntegrity.state === "verified" &&
+		trust.status.validationGrounding.state === "validated"
+	);
+}
+
 /** Prefer the receipt's own agent id, then the dispatch call's, then unknown. */
 function dispatchReceiptAgentId(
 	receiptAgentId: string | undefined,