@lannguyensi/harness 0.32.0 → 0.34.0

package/dist/policy-packs/builtin/branch-protection-runtime.d.ts

@@ -1,4 +1,5 @@
 import type { PolicyPack } from "../../schema/index.js";
+import { type ApprovalMarker, type CheckApprovalMarkerOptions, type MarkerCheck } from "./understanding-before-execution-runtime.js";
 export declare const PACK_NAME = "branch-protection";
 /**
  * Ledger tag written by the producer when the current branch is NOT in
@@ -8,14 +9,54 @@ export declare const PACK_NAME = "branch-protection";
  */
 export declare const NON_PROTECTED_TAG_PREFIX = "branch:non-protected";
 /**
- * Operator escape-hatch tag. Set via `mcp__agent-grounding__ledger_add`
- * (Bash is gated by this very pack, so a shell-based override would be
- * unreachable). The blocker substring-matches this prefix; the trailing
- * `:<reason>` is a free-form note the operator types so a later audit
- * can read WHY the override fired (e.g. `branch-protection-ack:hotfix
- * for prod`).
+ * Operator escape-hatch tag, kept as a best-effort AUDIT echo only.
+ *
+ * SECURITY (audit finding #39): this tag is NO LONGER a trusted override
+ * signal. The agent has direct `mcp__agent-grounding__ledger_add` access,
+ * so it could self-write `branch-protection-ack:<anything>` and bless its
+ * own protected-branch edit — exactly the self-approval backdoor the
+ * understanding gate closed in agent-tasks/88ca4bb3 by moving the
+ * canonical approval to a filesystem marker. The blocker now consults the
+ * operator-only marker file (see `checkBranchProtectionMarker` below); the
+ * `harness approve branch-protection` verb still records this ledger tag
+ * so `harness audit` / forensics keep a trail, but its presence alone
+ * never satisfies the gate. The trailing `:<reason>` stays free-form.
  */
 export declare const ACK_TAG_PREFIX = "branch-protection-ack";
+/**
+ * Marker-name namespace for an operator-written branch-protection
+ * override. The marker lives in the shared `.approvals/` directory under
+ * `harness.generated/` (the same directory the understanding gate uses),
+ * prefixed so it can never be confused with an understanding-gate session
+ * marker (`.approvals/<sessionId>`) or a task marker (`.approvals/task-<id>`):
+ * Claude Code / Codex session ids are UUIDs and never start with this
+ * literal, so the three namespaces stay disjoint.
+ *
+ * Why a marker and not the `branch-protection-ack` ledger tag: only a
+ * process the operator launched (their `!`-shell or any un-hooked
+ * terminal) can write under `harness.generated/` — Edit / Write / Bash
+ * are all gated, and the configured MCP servers expose no filesystem
+ * write. So the marker is the canonical override signal; the ledger row
+ * is a best-effort audit echo only.
+ */
+export declare const BRANCH_PROTECTION_MARKER_PREFIX = "branch-protection-";
+/** Marker filename (inside `.approvals/`) for a session's branch-protection override. */
+export declare function branchProtectionMarkerName(sessionId: string): string;
+/**
+ * Operator-side: write the canonical branch-protection override marker for
+ * `sessionId`. Atomic (delegates to `writeApprovalMarker`). Caller is
+ * `harness approve branch-protection`, run from the operator's un-hooked
+ * shell; if the agent could reach this path the gate's value would
+ * collapse, so it lives behind the approve CLI.
+ */
+export declare function writeBranchProtectionMarker(generatedDir: string, sessionId: string, marker: ApprovalMarker): string;
+/**
+ * Gate-side: is the operator's branch-protection override marker present
+ * for `sessionId`? Inherits `checkApprovalMarker`'s contract
+ * (existence-is-enough, symlink rejection, optional freshness via
+ * `maxAgeMs`); only the namespaced filename differs.
+ */
+export declare function checkBranchProtectionMarker(generatedDir: string, sessionId: string, opts?: CheckApprovalMarkerOptions): MarkerCheck;
 /**
  * Freshness window for the producer tag. Five minutes lets a single
  * branch-check satisfy a whole edit batch without re-running for every

package/dist/policy-packs/builtin/branch-protection-runtime.js

@@ -6,6 +6,7 @@
 // hook branch-protection` (blocker) — both under `src/cli/`. This module
 // is the small shared surface they pull from: tag formats, default
 // protected list, config parsing.
+import { checkApprovalMarker, writeApprovalMarker, } from "./understanding-before-execution-runtime.js";
 export const PACK_NAME = "branch-protection";
 /**
  * Ledger tag written by the producer when the current branch is NOT in
@@ -15,14 +16,60 @@ export const PACK_NAME = "branch-protection";
  */
 export const NON_PROTECTED_TAG_PREFIX = "branch:non-protected";
 /**
- * Operator escape-hatch tag. Set via `mcp__agent-grounding__ledger_add`
- * (Bash is gated by this very pack, so a shell-based override would be
- * unreachable). The blocker substring-matches this prefix; the trailing
- * `:<reason>` is a free-form note the operator types so a later audit
- * can read WHY the override fired (e.g. `branch-protection-ack:hotfix
- * for prod`).
+ * Operator escape-hatch tag, kept as a best-effort AUDIT echo only.
+ *
+ * SECURITY (audit finding #39): this tag is NO LONGER a trusted override
+ * signal. The agent has direct `mcp__agent-grounding__ledger_add` access,
+ * so it could self-write `branch-protection-ack:<anything>` and bless its
+ * own protected-branch edit — exactly the self-approval backdoor the
+ * understanding gate closed in agent-tasks/88ca4bb3 by moving the
+ * canonical approval to a filesystem marker. The blocker now consults the
+ * operator-only marker file (see `checkBranchProtectionMarker` below); the
+ * `harness approve branch-protection` verb still records this ledger tag
+ * so `harness audit` / forensics keep a trail, but its presence alone
+ * never satisfies the gate. The trailing `:<reason>` stays free-form.
  */
 export const ACK_TAG_PREFIX = "branch-protection-ack";
+/**
+ * Marker-name namespace for an operator-written branch-protection
+ * override. The marker lives in the shared `.approvals/` directory under
+ * `harness.generated/` (the same directory the understanding gate uses),
+ * prefixed so it can never be confused with an understanding-gate session
+ * marker (`.approvals/<sessionId>`) or a task marker (`.approvals/task-<id>`):
+ * Claude Code / Codex session ids are UUIDs and never start with this
+ * literal, so the three namespaces stay disjoint.
+ *
+ * Why a marker and not the `branch-protection-ack` ledger tag: only a
+ * process the operator launched (their `!`-shell or any un-hooked
+ * terminal) can write under `harness.generated/` — Edit / Write / Bash
+ * are all gated, and the configured MCP servers expose no filesystem
+ * write. So the marker is the canonical override signal; the ledger row
+ * is a best-effort audit echo only.
+ */
+export const BRANCH_PROTECTION_MARKER_PREFIX = "branch-protection-";
+/** Marker filename (inside `.approvals/`) for a session's branch-protection override. */
+export function branchProtectionMarkerName(sessionId) {
+    return `${BRANCH_PROTECTION_MARKER_PREFIX}${sessionId}`;
+}
+/**
+ * Operator-side: write the canonical branch-protection override marker for
+ * `sessionId`. Atomic (delegates to `writeApprovalMarker`). Caller is
+ * `harness approve branch-protection`, run from the operator's un-hooked
+ * shell; if the agent could reach this path the gate's value would
+ * collapse, so it lives behind the approve CLI.
+ */
+export function writeBranchProtectionMarker(generatedDir, sessionId, marker) {
+    return writeApprovalMarker(generatedDir, branchProtectionMarkerName(sessionId), marker);
+}
+/**
+ * Gate-side: is the operator's branch-protection override marker present
+ * for `sessionId`? Inherits `checkApprovalMarker`'s contract
+ * (existence-is-enough, symlink rejection, optional freshness via
+ * `maxAgeMs`); only the namespaced filename differs.
+ */
+export function checkBranchProtectionMarker(generatedDir, sessionId, opts = {}) {
+    return checkApprovalMarker(generatedDir, branchProtectionMarkerName(sessionId), opts);
+}
 /**
  * Freshness window for the producer tag. Five minutes lets a single
  * branch-check satisfy a whole edit batch without re-running for every

package/dist/policy-packs/builtin/branch-protection-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-protection-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection-runtime.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,kCAAkC;AAIlC,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IAIvD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC;YACzC,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,kEAAkE,OAAO,GAAG,+BAA+B,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACvL,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC;YACzC,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,6GAA6G,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzL,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,wCAAwC,GAAG,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,MAAM,aAAa,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACvN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,aAAgC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"branch-protection-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection-runtime.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,kCAAkC;AAGlC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAIpB,MAAM,6CAA6C,CAAC;AAErD,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,OAAO,GAAG,+BAA+B,GAAG,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,SAAiB,EACjB,MAAsB;IAEtB,OAAO,mBAAmB,CAAC,YAAY,EAAE,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,SAAiB,EACjB,OAAmC,EAAE;IAErC,OAAO,mBAAmB,CAAC,YAAY,EAAE,0BAA0B,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IAIvD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC;YACzC,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,kEAAkE,OAAO,GAAG,+BAA+B,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACvL,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,CAAC,GAAG,0BAA0B,CAAC;YACzC,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,6GAA6G,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzL,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,wCAAwC,GAAG,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,MAAM,aAAa,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACvN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,aAAgC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/policy-packs/builtin/branch-protection.js

@@ -16,18 +16,23 @@
 //      consults the ledger on every Write/Edit (or `apply_patch`) and
 //      emits a Claude Code deny envelope unless either:
 //        - a fresh (<5m) `branch:non-protected` tag exists, OR
-//        - a `branch-protection-ack:` override tag exists (any age,
-//          written by the operator via `mcp__agent-grounding__ledger_add`
-//          since Bash is gated by this same pack).
+//        - the operator-only override marker exists at
+//          `harness.generated/.approvals/branch-protection-<sessionId>`,
+//          written by `harness approve branch-protection`. The legacy
+//          `branch-protection-ack:` ledger tag is no longer trusted as an
+//          override (audit finding #39): it is agent-writable via
+//          `mcp__agent-grounding__ledger_add`, so it could self-bless an
+//          edit. The marker lives under `harness.generated/`, which Edit /
+//          Write / Bash are all gated from writing.
 //
 // The producer is also runnable on-demand from the operator's `!` shell
 // — same CLI verb, no SessionStart event piped on stdin — so an agent
 // that just branched can refresh the gate without restarting the
 // session.
 //
-// Pack is OFF by default: it must be enabled per-installation via
-// `harness pack add branch-protection`. The `full` init template does
-// NOT wire it (revisit after one cycle of operator feedback).
+// Enabled per-installation via `harness pack add branch-protection`.
+// The `full` init template wires it with `enabled: true` (see
+// src/cli/init/templates.ts); the `solo` / `team` templates do not.
 import { z } from "zod";
 import { PolicyUxSchema } from "../../schema/policies.js";
 import { DEFAULT_RUNTIME } from "../runtime.js";
@@ -72,7 +77,7 @@ function buildHooks(runtime) {
             command: BLOCKER_COMMAND,
             blocking: "hard",
             budget_ms: 5000,
-            description: `Blocker: deny ${blockerMatch} on protected branches unless a fresh branch:non-protected tag or a branch-protection-ack override exists in the ledger.`,
+            description: `Blocker: deny ${blockerMatch} on protected branches unless a fresh branch:non-protected tag exists in the ledger or the operator-only override marker (harness approve branch-protection) is present.`,
         },
     ];
 }
@@ -113,7 +118,8 @@ While this pack is enabled, hooks are wired into the ${settingsArtefact}:
    \`${blockerMatch}\`: refuses the tool call unless EITHER
    - a \`${NON_PROTECTED_TAG_PREFIX}\` tag exists in the ledger from
      within the last ${minutes} minutes, OR
-   - a \`${ACK_TAG_PREFIX}:<reason>\` override tag exists (any age).
+   - the operator-only override marker exists at
+     \`harness.generated/.approvals/branch-protection-<sessionId>\`.
 
 ## Escape hatches
 
@@ -122,12 +128,16 @@ While this pack is enabled, hooks are wired into the ${settingsArtefact}:
   is gated by the Understanding Gate but the producer command is itself
   a \`harness ...\` invocation that the gate's allowlist accepts.
 
-- **Explicit override** (any age, lasts the session): write the ack tag
-  via \`mcp__agent-grounding__ledger_add\` with
-  \`content: "${ACK_TAG_PREFIX}:<reason>"\`. Use this when you have a
-  deliberate reason to edit a protected branch — version bumps, CI
-  workflow patches, etc. The override survives session restarts only as
-  long as the ledger row does.
+- **Explicit override** (operator only): from an un-hooked shell run
+  \`harness approve branch-protection --session <sessionId>\`. This writes
+  the canonical approval marker the blocker consults. Use it when you have
+  a deliberate reason to edit a protected branch (version bumps, CI
+  workflow patches, hotfixes). SECURITY (audit finding #39): a
+  \`${ACK_TAG_PREFIX}:<reason>\` ledger tag is NO LONGER sufficient on its
+  own — it is agent-writable via \`mcp__agent-grounding__ledger_add\`, so
+  the gate would otherwise be self-approvable. The approve verb still
+  records that ledger tag for audit, but only the marker file (which the
+  agent cannot write) opens the gate.
 
 ## Out of scope (v1)
 

package/dist/policy-packs/builtin/branch-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-protection.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,uCAAuC;AACvC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,oEAAoE;AACpE,0EAA0E;AAC1E,mDAAmD;AACnD,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,WAAW;AACX,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,8DAA8D;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,wKAAwK;SAC3K;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,iBAAiB,YAAY,0HAA0H;SACrK;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAA2B,EAAE,OAAgB;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;IAC1D,OAAO,kBAAkB,SAAS;;;;;;;;EAQlC,OAAO;;;;EAIP,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;uDAMS,gBAAgB;;kCAErC,gBAAgB;;oBAE9B,wBAAwB;;;+BAGb,eAAe;OACvC,YAAY;WACR,wBAAwB;uBACZ,OAAO;WACnB,cAAc;;;;;oCAKW,gBAAgB;;;;;;gBAMpC,cAAc;;;;;;;;;;;;;;;EAe5B,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;cACR,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"branch-protection.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,uCAAuC;AACvC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,uDAAuD;AACvD,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,kEAAkE;AAClE,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,WAAW;AACX,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,wKAAwK;SAC3K;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,iBAAiB,YAAY,0KAA0K;SACrN;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAA2B,EAAE,OAAgB;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;IAC1D,OAAO,kBAAkB,SAAS;;;;;;;;EAQlC,OAAO;;;;EAIP,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;uDAMS,gBAAgB;;kCAErC,gBAAgB;;oBAE9B,wBAAwB;;;+BAGb,eAAe;OACvC,YAAY;WACR,wBAAwB;uBACZ,OAAO;;;;;;;oCAOM,gBAAgB;;;;;;;;;MAS9C,cAAc;;;;;;;;;;;;;;;;EAgBlB,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;cACR,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/policy-packs/builtin/solution-acceptance-runtime.d.ts

@@ -36,6 +36,15 @@ export interface Verdict {
 }
 /** Env knob that overrides the verdict directory (mirrors the producer). */
 export declare const VERDICT_DIR_ENV = "SOLUTION_VERDICT_DIR";
+/**
+ * Env knob that supplies the verdict id for SOLO / non-agent-tasks sessions.
+ * The completion-gate consults it ONLY when no agent-tasks `active-claim` is
+ * recorded (resolution order: active-claim first, then this env, then
+ * fail-closed), so a claimed session's id stays authoritative and cannot be
+ * redirected by an env var. A sessionId fallback is intentionally still NOT a
+ * source (the wrong-scope bug class understanding-gate closed).
+ */
+export declare const VERDICT_ID_ENV = "SOLUTION_VERDICT_ID";
 /**
  * Stable tail of the default verdict dir. The write-guard's reference
  * detection matches on this so ANY spelling of the home prefix is caught
@@ -61,6 +70,15 @@ export declare function verdictDir(env?: NodeJS.ProcessEnv, homedir?: () => stri
  */
 export declare function sanitizeVerdictId(id: string): string;
 export declare function verdictPathFor(dir: string, id: string): string;
+/**
+ * Resolve the explicit verdict id from `SOLUTION_VERDICT_ID`, or null when it
+ * is unset, blank, or not a safe single path segment. Validated through
+ * `sanitizeVerdictId` so a traversal-y or empty value fails closed here
+ * (returns null -> the gate denies) rather than reaching the marker read. This
+ * is the solo / non-agent-tasks fallback the completion-gate uses only when no
+ * active-claim is present.
+ */
+export declare function resolveExplicitVerdictId(env?: NodeJS.ProcessEnv): string | null;
 /**
  * Read + validate the verdict marker for `id`, or null when it is absent,
  * unparseable, a symlink, or not a regular file. The lstat + symlink reject

package/dist/policy-packs/builtin/solution-acceptance-runtime.js

@@ -75,6 +75,15 @@ export function resolveProtectedCompletionTools(pack) {
 }
 /** Env knob that overrides the verdict directory (mirrors the producer). */
 export const VERDICT_DIR_ENV = "SOLUTION_VERDICT_DIR";
+/**
+ * Env knob that supplies the verdict id for SOLO / non-agent-tasks sessions.
+ * The completion-gate consults it ONLY when no agent-tasks `active-claim` is
+ * recorded (resolution order: active-claim first, then this env, then
+ * fail-closed), so a claimed session's id stays authoritative and cannot be
+ * redirected by an env var. A sessionId fallback is intentionally still NOT a
+ * source (the wrong-scope bug class understanding-gate closed).
+ */
+export const VERDICT_ID_ENV = "SOLUTION_VERDICT_ID";
 /**
  * Stable tail of the default verdict dir. The write-guard's reference
  * detection matches on this so ANY spelling of the home prefix is caught
@@ -116,6 +125,29 @@ export function sanitizeVerdictId(id) {
 export function verdictPathFor(dir, id) {
     return path.join(dir, `${sanitizeVerdictId(id)}.json`);
 }
+/**
+ * Resolve the explicit verdict id from `SOLUTION_VERDICT_ID`, or null when it
+ * is unset, blank, or not a safe single path segment. Validated through
+ * `sanitizeVerdictId` so a traversal-y or empty value fails closed here
+ * (returns null -> the gate denies) rather than reaching the marker read. This
+ * is the solo / non-agent-tasks fallback the completion-gate uses only when no
+ * active-claim is present.
+ */
+export function resolveExplicitVerdictId(env = process.env) {
+    const raw = env[VERDICT_ID_ENV];
+    if (typeof raw !== "string")
+        return null;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return null;
+    try {
+        sanitizeVerdictId(trimmed);
+    }
+    catch {
+        return null;
+    }
+    return trimmed;
+}
 /**
  * Read + validate the verdict marker for `id`, or null when it is absent,
  * unparseable, a symlink, or not a regular file. The lstat + symlink reject

package/dist/policy-packs/builtin/solution-acceptance-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"solution-acceptance-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/solution-acceptance-runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,6CAA6C;AAC7C,EAAE;AACF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAEhB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uFAAuF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAgB;IAC9D,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IACnF,IACE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,GAAe,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC;AAeD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAwB,EAAE,CAAC,OAAO;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,IAAI,GACR,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,EAAU;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,EAAU;IACjD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,aAAa;IAC5B,CAAC;IACD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,EACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/D,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACvE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,WAA0B,EAC1B,EAAU;IAEV,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gDAAgD,EAAE,uDAAuD;YACjH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,EAAE,iBAAiB,GAAG,uCAAuC;YACzG,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mEAAmE,EAAE,cAAc;YAC3F,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CAA0C,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8CAA8C;YACrL,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oCAAoC,EAAE,sBAAsB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI;QACnJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,qCAAqC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAW;IACnE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,4DAA4D;IAC5D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,oBAAoB;IACpB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"solution-acceptance-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/solution-acceptance-runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,6CAA6C;AAC7C,EAAE;AACF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAEhB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uFAAuF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAgB;IAC9D,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IACnF,IACE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,GAAe,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC;AAeD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAwB,EAAE,CAAC,OAAO;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,IAAI,GACR,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,EAAU;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,EAAU;IACjD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,aAAa;IAC5B,CAAC;IACD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,EACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/D,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACvE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,WAA0B,EAC1B,EAAU;IAEV,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gDAAgD,EAAE,uDAAuD;YACjH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,EAAE,iBAAiB,GAAG,uCAAuC;YACzG,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mEAAmE,EAAE,cAAc;YAC3F,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CAA0C,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8CAA8C;YACrL,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oCAAoC,EAAE,sBAAsB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI;QACnJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,qCAAqC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAW;IACnE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,4DAA4D;IAC5D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,oBAAoB;IACpB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution-runtime.d.ts

@@ -12,6 +12,18 @@ export interface PersistedReport {
     sessionId: string | null;
     approvalStatus: string | null;
     approvedAt: string | null;
+    /**
+     * ISO timestamp the producer stamped when it wrote the report; null
+     * for legacy reports without the field.
+     */
+    createdAt: string | null;
+    /**
+     * Effective creation time in epoch ms, resolved `createdAt` →
+     * filename ISO prefix → file mtime. Unlike mtime alone this survives
+     * the approval rewrite (which bumps mtime and would otherwise make a
+     * weeks-old report sort as the freshest, harness-discovery C1).
+     */
+    createdAtMs: number;
 }
 /**
  * Env var the persisted-report directory can be set from. Honored by
@@ -44,14 +56,39 @@ export declare function reportsDirForManifest(manifestPath: string): string;
 /** Build the per-session ledger tag the pack searches for. */
 export declare function approvedLedgerTagFor(sessionId: string): string;
 /**
- * List persisted reports under `dir`, newest-first by mtime. Missing
- * directory returns []. Any I/O error on a single file is silently
- * skipped; the caller falls through to the ledger result. The package
- * writes filenames as `<iso>-<slug>-<hash>.json` so the alphabetical
- * sort would also work for ISO prefixes, but mtime is robust against
- * the package changing its naming convention later.
+ * List persisted reports under `dir`, newest-first by creation time
+ * (JSON `createdAt`, falling back to the filename ISO prefix, falling
+ * back to mtime). Missing directory returns []. Any I/O error on a
+ * single file is silently skipped; the caller falls through to the
+ * ledger result.
+ *
+ * Creation time, NOT mtime, is the sort key: `harness approve
+ * understanding` rewrites the report it flips, which bumps mtime and
+ * made an old just-approved report sort as the freshest
+ * (harness-discovery C1). mtime survives only as the last-resort
+ * fallback for files that carry neither timestamp.
  */
 export declare function listPersistedReports(dir: string): PersistedReport[];
+/**
+ * Maximum age a sessionId-null report may have for the tolerant
+ * fallback to adopt it on the `harness approve understanding` path.
+ * Sized for the real flow (Stop hook persists at turn end, operator
+ * approves within minutes) with slack for a slow read-through. Live
+ * repro that motivated it: a 17-day-old pending report got adopted,
+ * validated, and stamped for a fresh session because the producer had
+ * silently failed to persist the fresh report (harness-discovery C1,
+ * friction-log #67).
+ */
+export declare const TOLERANT_FALLBACK_MAX_AGE_MS: number;
+/**
+ * Tolerance for a sessionId-less candidate whose `createdAt` lies in
+ * the FUTURE relative to the approve-time clock. A future creation
+ * time is suspect either way: a forged `createdAt` (the producer's
+ * Metadata block lets the agent author it) or serious clock skew.
+ * Beyond this skew the fallback rejects the candidate just like a
+ * stale one rather than trusting a timestamp that cannot be right.
+ */
+export declare const TOLERANT_FALLBACK_FUTURE_SKEW_MS: number;
 export interface FindReportOptions {
     /**
      * Behaviour of the sessionId-null tolerant fallback (older Stop-hook
@@ -70,15 +107,50 @@ export interface FindReportOptions {
      *    report into the live session (harness/0dce3880 friction #1).
      */
     tolerantFallback?: "any" | "uncompleted";
+    /**
+     * Maximum age (relative to `now`) of a sessionId-null candidate the
+     * tolerant fallback may adopt; older candidates are skipped and
+     * surfaced via `FindReportSelection.staleRejected`. Strict sessionId
+     * matches are never age-limited. Unset means no limit (the legacy
+     * gate-read / expiry contract).
+     */
+    maxFallbackAgeMs?: number;
+    /** Clock anchor for the age computation; defaults to the wall clock. */
+    now?: Date;
+}
+export interface FindReportSelection {
+    report: PersistedReport | null;
+    /**
+     * True when `report` was adopted via the sessionId-null tolerant
+     * fallback rather than a strict sessionId match. Callers that bind
+     * the report to a session (the approve flow) surface this loudly so
+     * the operator can verify the adoption.
+     */
+    fallbackAdopted: boolean;
+    /**
+     * sessionId-null candidates skipped for exceeding `maxFallbackAgeMs`,
+     * newest first. Lets the caller distinguish "no report at all" from
+     * "only stale candidates existed", which are different failures: the
+     * latter usually means the producer failed to persist the fresh
+     * report (harness-discovery C1).
+     */
+    staleRejected: PersistedReport[];
 }
 /**
- * Return the freshest report for a given session_id, or the freshest
+ * Select the freshest report for a given session_id, or the freshest
  * applicable report when the persisted file lacks a sessionId field
- * (older package versions). null when nothing matches.
+ * (older package versions). `report: null` when nothing matches.
  *
  * The strict (sessionId-equals) match always wins. The tolerant
- * fallback's appetite is controlled by `opts.tolerantFallback` — see
- * `FindReportOptions`.
+ * fallback's appetite is controlled by `opts.tolerantFallback` and
+ * `opts.maxFallbackAgeMs` — see `FindReportOptions`. The selection
+ * result carries enough context (`fallbackAdopted`, `staleRejected`)
+ * for the caller to be loud about non-strict adoptions.
+ */
+export declare function selectReportForSession(reports: PersistedReport[], sessionId: string, opts?: FindReportOptions): FindReportSelection;
+/**
+ * Back-compat wrapper around `selectReportForSession` for callers that
+ * only need the report (the gate read and expiry paths).
  */
 export declare function findLatestReportForSession(reports: PersistedReport[], sessionId: string, opts?: FindReportOptions): PersistedReport | null;
 export interface PersistedReportApprovalCheck {

package/dist/policy-packs/builtin/understanding-before-execution-runtime.js

@@ -85,7 +85,20 @@ function safeJsonParse(text) {
         return null;
     }
 }
-function readPersistedReport(filePath) {
+/**
+ * Parse the ISO prefix of a producer filename
+ * (`2026-05-24T06-16-39-409Z-<slug>-<hash>.json`) into epoch ms. The
+ * producer flattens `:` and `.` to `-` for filesystem safety; undo that
+ * before `Date.parse`. null when the name does not carry the prefix.
+ */
+function parseFilenameIsoMs(name) {
+    const m = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z/.exec(name);
+    if (!m)
+        return null;
+    const ms = Date.parse(`${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z`);
+    return Number.isNaN(ms) ? null : ms;
+}
+function readPersistedReport(filePath, mtimeMs) {
     let raw;
     try {
         raw = fs.readFileSync(filePath, "utf8");
@@ -97,20 +110,32 @@ function readPersistedReport(filePath) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
         return null;
     const obj = parsed;
+    const createdAt = typeof obj["createdAt"] === "string" ? obj["createdAt"] : null;
+    const createdAtJsonMs = createdAt !== null ? Date.parse(createdAt) : Number.NaN;
+    const createdAtMs = !Number.isNaN(createdAtJsonMs)
+        ? createdAtJsonMs
+        : (parseFilenameIsoMs(path.basename(filePath)) ?? mtimeMs);
     return {
         filePath,
         sessionId: typeof obj["sessionId"] === "string" ? obj["sessionId"] : null,
         approvalStatus: typeof obj["approvalStatus"] === "string" ? obj["approvalStatus"] : null,
         approvedAt: typeof obj["approvedAt"] === "string" ? obj["approvedAt"] : null,
+        createdAt,
+        createdAtMs,
     };
 }
 /**
- * List persisted reports under `dir`, newest-first by mtime. Missing
- * directory returns []. Any I/O error on a single file is silently
- * skipped; the caller falls through to the ledger result. The package
- * writes filenames as `<iso>-<slug>-<hash>.json` so the alphabetical
- * sort would also work for ISO prefixes, but mtime is robust against
- * the package changing its naming convention later.
+ * List persisted reports under `dir`, newest-first by creation time
+ * (JSON `createdAt`, falling back to the filename ISO prefix, falling
+ * back to mtime). Missing directory returns []. Any I/O error on a
+ * single file is silently skipped; the caller falls through to the
+ * ledger result.
+ *
+ * Creation time, NOT mtime, is the sort key: `harness approve
+ * understanding` rewrites the report it flips, which bumps mtime and
+ * made an old just-approved report sort as the freshest
+ * (harness-discovery C1). mtime survives only as the last-resort
+ * fallback for files that carry neither timestamp.
  */
 export function listPersistedReports(dir) {
     let names;
@@ -134,34 +159,61 @@ export function listPersistedReports(dir) {
         }
         if (!stat.isFile())
             continue;
-        const report = readPersistedReport(full);
+        const report = readPersistedReport(full, stat.mtimeMs);
         if (!report)
             continue;
-        reports.push({ report, mtimeMs: stat.mtimeMs });
+        reports.push(report);
     }
-    reports.sort((a, b) => b.mtimeMs - a.mtimeMs);
-    return reports.map((r) => r.report);
+    reports.sort((a, b) => b.createdAtMs - a.createdAtMs);
+    return reports;
 }
 /**
- * Return the freshest report for a given session_id, or the freshest
+ * Maximum age a sessionId-null report may have for the tolerant
+ * fallback to adopt it on the `harness approve understanding` path.
+ * Sized for the real flow (Stop hook persists at turn end, operator
+ * approves within minutes) with slack for a slow read-through. Live
+ * repro that motivated it: a 17-day-old pending report got adopted,
+ * validated, and stamped for a fresh session because the producer had
+ * silently failed to persist the fresh report (harness-discovery C1,
+ * friction-log #67).
+ */
+export const TOLERANT_FALLBACK_MAX_AGE_MS = 15 * 60_000;
+/**
+ * Tolerance for a sessionId-less candidate whose `createdAt` lies in
+ * the FUTURE relative to the approve-time clock. A future creation
+ * time is suspect either way: a forged `createdAt` (the producer's
+ * Metadata block lets the agent author it) or serious clock skew.
+ * Beyond this skew the fallback rejects the candidate just like a
+ * stale one rather than trusting a timestamp that cannot be right.
+ */
+export const TOLERANT_FALLBACK_FUTURE_SKEW_MS = 5 * 60_000;
+/**
+ * Select the freshest report for a given session_id, or the freshest
  * applicable report when the persisted file lacks a sessionId field
- * (older package versions). null when nothing matches.
+ * (older package versions). `report: null` when nothing matches.
  *
  * The strict (sessionId-equals) match always wins. The tolerant
- * fallback's appetite is controlled by `opts.tolerantFallback` — see
- * `FindReportOptions`.
+ * fallback's appetite is controlled by `opts.tolerantFallback` and
+ * `opts.maxFallbackAgeMs` — see `FindReportOptions`. The selection
+ * result carries enough context (`fallbackAdopted`, `staleRejected`)
+ * for the caller to be loud about non-strict adoptions.
  */
-export function findLatestReportForSession(reports, sessionId, opts = {}) {
+export function selectReportForSession(reports, sessionId, opts = {}) {
     // Strict match first.
     for (const r of reports) {
-        if (r.sessionId === sessionId)
-            return r;
+        if (r.sessionId === sessionId) {
+            return { report: r, fallbackAdopted: false, staleRejected: [] };
+        }
     }
     // Tolerant fallback: a report without sessionId is treated as
     // applicable to whichever session is asking. Only kicks in when no
-    // sessionId-tagged report exists, so harnessed sessions with proper
-    // tagging never hit this path.
+    // matching sessionId-tagged report exists — which includes the case
+    // where the producer Stop hook silently failed to persist the live
+    // session's report, so the candidates here may be entirely unrelated
+    // leftovers. `maxFallbackAgeMs` is the guard against adopting those.
     const mode = opts.tolerantFallback ?? "any";
+    const nowMs = (opts.now ?? new Date()).getTime();
+    const staleRejected = [];
     for (const r of reports) {
         if (r.sessionId !== null)
             continue;
@@ -172,9 +224,23 @@ export function findLatestReportForSession(reports, sessionId, opts = {}) {
             // the live session to a stale, unrelated report.
             continue;
         }
-        return r;
+        if (opts.maxFallbackAgeMs !== undefined) {
+            const ageMs = nowMs - r.createdAtMs;
+            if (ageMs > opts.maxFallbackAgeMs || ageMs < -TOLERANT_FALLBACK_FUTURE_SKEW_MS) {
+                staleRejected.push(r);
+                continue;
+            }
+        }
+        return { report: r, fallbackAdopted: true, staleRejected };
     }
-    return null;
+    return { report: null, fallbackAdopted: false, staleRejected };
+}
+/**
+ * Back-compat wrapper around `selectReportForSession` for callers that
+ * only need the report (the gate read and expiry paths).
+ */
+export function findLatestReportForSession(reports, sessionId, opts = {}) {
+    return selectReportForSession(reports, sessionId, opts).report;
 }
 /**
  * Phase 6 #6 — substring-pollution defence shared by every PreToolUse