@logicseek/hello-cc 1.0.1 → 1.0.2

package/lib/cli/commands/lock.mjs

@@ -1,6 +1,13 @@
 // Lock CLI commands extracted from bin/hcc.mjs.
 // Factory pattern with injected deps.
 
+import { readTx } from '../../db/schema.mjs';
+import {
+  findRequestedLock,
+  upsertRequestedLock,
+  visibleLocksWithEvidence
+} from '../../core/coordination/locks.mjs';
+
 export function createLockCommands(deps) {
   const {
     connect,
@@ -109,21 +116,11 @@ export function createLockCommands(deps) {
           }
           const existing = subject.locks.find((row) => row.resource === requested.resource) || null;
           const expiresAt = leaseDeadline(t, ttl);
-          db.prepare(`
-            INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at, ttl_sec)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-            ON CONFLICT(resource) DO UPDATE SET
-              base_resource = excluded.base_resource,
-              scope = excluded.scope,
-              owner = excluded.owner,
-              task_id = excluded.task_id,
-              reason = excluded.reason,
-              expires_at = excluded.expires_at,
-              created_at = excluded.created_at,
-              ttl_sec = excluded.ttl_sec
-          `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, expiresAt, t, ttl);
+          const acquired = upsertRequestedLock(db, requested, {
+            owner: peer, task_id: taskId, reason, expires_at: expiresAt, created_at: t, ttl_sec: ttl
+          });
           addEvent(db, 'lock.acquired', peer, taskId, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null });
-          return { lock: db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource) };
+          return { lock: acquired };
         }
       });
       if (outcome.error) throw outcome.error;
@@ -143,7 +140,7 @@ export function createLockCommands(deps) {
     const db = connect(ctx);
     touchCurrentPeer(db, ctx, identity, null, 'shell');
     const result = tx(db, () => {
-      const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+      const existing = findRequestedLock(db, requested);
       if (!existing) return { released: false, ...requested };
       if (existing.owner !== peer && !opts.force) {
         throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });
@@ -166,7 +163,7 @@ export function createLockCommands(deps) {
     const db = connect(ctx);
     touchCurrentPeer(db, ctx, identity, 'working', 'shell');
     const lock = tx(db, () => {
-      const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+      const existing = findRequestedLock(db, requested);
       if (!existing) throw new CliError('NOT_FOUND', `No lock for ${lockLabel(requested)}`);
       if (existing.owner !== peer) throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });
       db.prepare('UPDATE locks SET expires_at = ?, ttl_sec = ? WHERE resource = ?').run(expiresAt, ttl, requested.resource);
@@ -180,9 +177,27 @@ export function createLockCommands(deps) {
     const opts = parseOpts(args, { booleans: ['all'] });
     const db = connect(ctx);
     const t = now();
-    const rows = opts.all || clockGraceSuppressed(t, readClockGraceUntil(db))
-      ? db.prepare('SELECT * FROM locks ORDER BY resource ASC').all()
-      : db.prepare('SELECT * FROM locks WHERE expires_at > ? ORDER BY resource ASC').all(t);
+    const { locks, owners, graceUntil } = readTx(db, () => {
+      const locks = db.prepare('SELECT * FROM locks ORDER BY resource ASC').all();
+      const graceUntil = readClockGraceUntil(db);
+      const expired = opts.all || clockGraceSuppressed(t, graceUntil)
+        ? [] : locks.filter((lock) => Number(lock.expires_at) <= t);
+      const owners = [...new Set(expired
+        .map((lock) => lock.owner))].map((owner) => ({
+        owner,
+        peer: db.prepare('SELECT * FROM peers WHERE id = ?').get(owner) || null,
+        binding: db.prepare('SELECT * FROM peer_bindings WHERE peer = ?').get(owner) || null
+      }));
+      return { locks, owners, graceUntil };
+    });
+    const evidenceByOwner = new Map(owners.map(({ owner, peer, binding }) => [
+      owner,
+      peer ? observePeerEvidence(ctx, peer, binding) : { state: 'unknown', reason: 'peer_missing' }
+    ]));
+    const rows = opts.all ? locks : visibleLocksWithEvidence(locks, t, {
+      graceActive: clockGraceSuppressed(t, graceUntil),
+      evidenceByOwner
+    });
     printResult(ctx, rows, (data) => table(data, [
       { label: 'resource', value: (r) => lockBaseResource(r) },
       { label: 'scope', value: (r) => lockScope(r) },

package/lib/cli/commands/mcp.mjs

@@ -0,0 +1,28 @@
+import { CliError } from '../../shared/errors.mjs';
+import { parseOpts, required, validateOpts, wantsHelp } from '../../cli-args.mjs';
+import { loadScopedMcpBootstrap } from '../../mcp/scope.mjs';
+import { createScopedMcpTools } from '../../mcp/tools.mjs';
+import { serveMcpStdio } from '../../mcp/stdio.mjs';
+
+export function mcpHelp() {
+  console.log(`Usage: hcc --root PROJECT --db DATABASE mcp serve --peer PEER
+
+Serve project/peer-scoped coordination tools over MCP stdio. The executor must
+supply a private, temporary capability; --peer alone does not grant ownership.
+No global Codex configuration is changed. Task claiming and handoff never mark
+tasks done. Errors from tools are returned as MCP tool results.`);
+}
+
+export function createMcpCommands(dependencies) {
+  async function cmdMcp(ctx, args) {
+    if (!args[0] || wantsHelp(args)) return mcpHelp();
+    if (args[0] !== 'serve') throw new CliError('BAD_ARGS', 'Unknown MCP command');
+    const options = parseOpts(args.slice(1));
+    validateOpts('mcp serve', options, ['peer']);
+    const peer = required(options, 'peer');
+    const authority = loadScopedMcpBootstrap(ctx, peer);
+    const tools = createScopedMcpTools({ ...dependencies, ctx, authority });
+    await serveMcpStdio({ tools });
+  }
+  return { cmdMcp };
+}

package/lib/cli/commands/native.mjs

@@ -0,0 +1,130 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { setTimeout as delay } from 'node:timers/promises';
+import { CliError } from '../../shared/errors.mjs';
+import { parseOpts, validateOpts, wantsHelp, intOpt } from '../../cli-args.mjs';
+import { printResult } from '../../format.mjs';
+import { commandPath } from '../../cli-runtime.mjs';
+import { nativePaths, readNativePointer } from '../../runtime/native/store.mjs';
+import { nativeRequest } from '../../runtime/native/client.mjs';
+import { startNativeService } from '../../runtime/native/service.mjs';
+
+export function nativeHelp() {
+  console.log(`Usage: hcc native up|status|down
+       hcc native start --peer NAME --provider codex|claude|dsh [--cwd DIR] [--model MODEL] [--binary PATH] [--resume last]
+       hcc native send --peer NAME --body TEXT [--from NAME] [--task ID]
+       hcc native events --peer NAME [--after ID]
+       hcc native deliveries [--peer NAME]
+       hcc native requests --peer NAME
+       hcc native respond --peer NAME --request ID --decision accept|decline|cancel [--response-file JSON]
+       hcc native interrupt --peer NAME [--turn ID]
+       hcc native close --peer NAME
+
+Native workers share the project task/message/lock bus. Only HCC-owned saved
+sessions can resume. Existing TUI/Desktop sessions keep their own transport.
+Providers retain their permission checks; interactive requests await an explicit Web or local response.
+Claude workers require the optional @anthropic-ai/claude-agent-sdk package.
+dsh workers use the ACP profile, not its Web-service terminal.`);
+}
+
+export function createNativeCommands(deps) {
+  async function up(ctx) {
+    if (readNativePointer(ctx)) {
+      try { return await nativeRequest(ctx, 'GET', '/status', null, { timeoutMs: 2000 }); }
+      catch (error) {
+        if (error.code !== 'NATIVE_RUNTIME_OFFLINE') throw error;
+      }
+    }
+    const paths = nativePaths(ctx, { create: true });
+    const log = fs.openSync(paths.log, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW || 0), 0o600);
+    if (!fs.fstatSync(log).isFile() || fs.fstatSync(log).nlink !== 1) {
+      fs.closeSync(log);
+      throw new CliError('NATIVE_STATE_UNSAFE', 'Native runtime log must be a private regular file');
+    }
+    const child = spawn(process.execPath, [commandPath(), '--root', fs.realpathSync(ctx.root), '--db', path.resolve(ctx.dbPath), 'native', 'serve'], {
+      cwd: ctx.root, env: process.env, detached: true, stdio: ['ignore', log, log]
+    });
+    fs.closeSync(log);
+    let failed;
+    child.on('error', (error) => { failed = error; });
+    child.unref();
+    const deadline = Date.now() + 10000;
+    while (Date.now() < deadline) {
+      if (failed) throw new CliError('NATIVE_RUNTIME_START_FAILED', failed.message);
+      if (readNativePointer(ctx)) {
+        try { return await nativeRequest(ctx, 'GET', '/status', null, { timeoutMs: 1000 }); } catch {}
+      }
+      await delay(100);
+    }
+    throw new CliError('NATIVE_RUNTIME_START_FAILED', `Native runtime did not become ready. Inspect ${paths.log}`);
+  }
+
+  async function cmdNative(ctx, args) {
+    const command = args[0];
+    if (!command || wantsHelp(args)) return nativeHelp();
+    const opts = parseOpts(args.slice(1));
+    const allowed = {
+      up: [], serve: [], down: [], status: [],
+      start: ['peer', 'provider', 'cwd', 'model', 'binary', 'resume'],
+      send: ['peer', 'body', 'from', 'task'],
+      events: ['peer', 'after'], deliveries: ['peer'], requests: ['peer'],
+      respond: ['peer', 'request', 'decision', 'response-file'],
+      interrupt: ['peer', 'turn'], close: ['peer']
+    };
+    if (!Object.hasOwn(allowed, command)) throw new CliError('BAD_ARGS', `Unknown native command: ${command}`);
+    validateOpts(`native ${command}`, opts, allowed[command]);
+    if (['start', 'send', 'events', 'interrupt', 'close', 'requests', 'respond'].includes(command) && !opts.peer) throw new CliError('BAD_ARGS', 'Missing --peer');
+    if (command === 'start' && !opts.provider) throw new CliError('BAD_ARGS', 'Missing --provider');
+    if (command === 'start' && opts.provider === 'claude' && opts.binary !== undefined) throw new CliError('BAD_ARGS', 'Claude workers use the Agent SDK; --binary is available for Codex and dsh');
+    if (command === 'send' && !opts.body?.trim()) throw new CliError('BAD_ARGS', 'Missing --body');
+    let result;
+    if (command === 'up') result = await up(ctx);
+    else if (command === 'serve') {
+      const service = await startNativeService(ctx, deps);
+      const shutdown = () => { void service.shutdown().catch((error) => console.error(JSON.stringify({ code: error.code, message: error.message }))); };
+      process.once('SIGTERM', shutdown);
+      process.once('SIGINT', shutdown);
+      return;
+    } else if (command === 'start') {
+      await up(ctx);
+      result = await nativeRequest(ctx, 'POST', '/workers', { peer: opts.peer, provider: opts.provider,
+        cwd: opts.cwd ? path.resolve(ctx.cwd, opts.cwd) : ctx.root, model: opts.model, binary: opts.binary, resume: opts.resume });
+    } else if (command === 'send') {
+      const taskId = intOpt(opts, 'task', null);
+      if (taskId !== null && taskId < 1) throw new CliError('BAD_ARGS', 'Task ID must be positive');
+      const sender = deps.resolveCurrentPeer(ctx, opts, 'from', 'shell').id;
+      result = await nativeRequest(ctx, 'POST', '/send', { peer: opts.peer, from: sender, body: opts.body, taskId });
+    } else if (command === 'events') {
+      const after = intOpt(opts, 'after', 0);
+      if (after < 0) throw new CliError('BAD_ARGS', 'Event cursor must be nonnegative');
+      result = await nativeRequest(ctx, 'GET', `/events?peer=${encodeURIComponent(opts.peer)}&after=${after}`);
+    } else if (command === 'deliveries') {
+      result = await nativeRequest(ctx, 'GET', `/deliveries${opts.peer ? `?peer=${encodeURIComponent(opts.peer)}` : ''}`);
+    } else if (command === 'requests' || command === 'respond') {
+      const state = await nativeRequest(ctx, 'GET', '/workers/' + encodeURIComponent(opts.peer) + '/state');
+      if (command === 'requests') result = state.snapshot.pendingApprovals || [];
+      else {
+        if (!opts.request || !['accept', 'decline', 'cancel'].includes(opts.decision)) throw new CliError('BAD_ARGS', 'Respond requires --request ID and --decision accept|decline|cancel');
+        const pending = (state.snapshot.pendingApprovals || []).filter(request => String(request.requestId) === opts.request);
+        if (pending.length !== 1) throw new CliError('NATIVE_APPROVAL_MISMATCH', 'Select an exact pending request from hcc native requests');
+        let response = {};
+        if (opts['response-file']) {
+          const data = fs.readFileSync(path.resolve(ctx.cwd, opts['response-file']), 'utf8');
+          if (data.length > 100000) throw new CliError('BAD_ARGS', 'Response file exceeds the limit');
+          try { response = JSON.parse(data); } catch { throw new CliError('BAD_ARGS', 'Response file must contain JSON'); }
+          if (!response || typeof response !== 'object' || Array.isArray(response) || Object.keys(response).some(key => !['permissions','scope','answers'].includes(key))) throw new CliError('BAD_ARGS', 'Response file accepts permissions, scope and answers only');
+        }
+        const request = pending[0];
+        result = await nativeRequest(ctx, 'POST', '/respond', { peer: opts.peer, generation: state.generation,
+          owner: state.owner, provider: state.provider, executorId: state.owner, sessionId: request.sessionId,
+          turnId: request.turnId, requestId: request.requestId, decision: opts.decision, ...response });
+      }
+    } else if (command === 'interrupt') result = await nativeRequest(ctx, 'POST', '/interrupt', { peer: opts.peer, turnId: opts.turn });
+    else if (command === 'close') result = await nativeRequest(ctx, 'POST', '/close', { peer: opts.peer });
+    else if (command === 'down') result = await nativeRequest(ctx, 'POST', '/down', {});
+    else result = await nativeRequest(ctx, 'GET', '/status');
+    printResult(ctx, result, (data) => JSON.stringify(data, null, 2));
+  }
+  return { cmdNative };
+}

package/lib/cli/commands/run.mjs

@@ -18,6 +18,7 @@ import {
   readExternalBufferMetadata
 } from '../../runtime/buffer-evidence.mjs';
 import { inspectProcessIdentity } from '../../process/identity.mjs';
+import { resolvePeerEvidence } from '../../core/peers/evidence.mjs';
 import {
   capturePtyStartupEvidence,
   installPtyTerminationHandlers,
@@ -73,22 +74,58 @@ async function cmdRun(ctx, args) {
   }
 
   const db = connect(ctx);
+  const wrapperIdentity = runtimeProcessIdentity();
   try {
-    upsertPeer(db, {
-      id, kind, role,
-      worktree: cwd,
-      branch: detectBranch(cwd),
-      pid: process.pid,
-      status: 'running',
-      capabilities: 'run-wrapper'
-    });
-    upsertCanonicalPeerBinding(db, binding, Boolean(opts.force));
-    addEvent(db, 'run.session.started', id, null, auditPayload({
-      actor: id,
-      target: id,
-      command: [command, ...commandArgs].join(' '),
-      cwd
-    }));
+    let registered = false;
+    for (let attempt = 0; attempt < 2 && !registered; attempt += 1) {
+      const previous = db.prepare('SELECT * FROM peers WHERE id = ?').get(id) || null;
+      const evidence = previous ? resolvePeerEvidence({
+        peer: previous,
+        processes: [{
+          storedIdentity: {
+            pid: Number(previous.pid),
+            startToken: previous.pid_start_token,
+            commandHash: previous.pid_command_hash
+          },
+          current: inspectProcessIdentity(previous.pid)
+        }]
+      }) : null;
+      registered = tx(db, () => {
+        const current = db.prepare('SELECT * FROM peers WHERE id = ?').get(id) || null;
+        if (JSON.stringify(current) !== JSON.stringify(previous)) return false;
+        if (previous && evidence.state !== 'dead' && (
+          previous.pid || ['running', 'working', 'busy', 'starting', 'blocked', 'detached'].includes(previous.status)
+        )) {
+          throw new CliError('PEER_SESSION_EXISTS', `Peer ${id} already has a live or unresolved owner`, {
+            peer: id,
+            evidence_state: evidence.state
+          });
+        }
+        upsertPeer(db, {
+          id, kind, role,
+          worktree: cwd,
+          branch: detectBranch(cwd),
+          pid: process.pid,
+          processIdentity: wrapperIdentity,
+          status: 'running',
+          capabilities: 'run-wrapper'
+        });
+        upsertCanonicalPeerBinding(db, binding, Boolean(opts.force));
+        addEvent(db, 'run.session.started', id, null, auditPayload({
+          actor: id,
+          target: id,
+          command: [command, ...commandArgs].join(' '),
+          cwd
+        }));
+        return true;
+      });
+    }
+    if (!registered) {
+      throw new CliError('SUBJECT_CHANGED', `Peer ${id} changed while its owner was being observed; retry`, {
+        peer: id,
+        retryable: true
+      });
+    }
   } finally {
     db.close();
   }
@@ -107,12 +144,20 @@ async function cmdRun(ctx, args) {
   });
   const db2 = connect(ctx);
   try {
-    db2.prepare('UPDATE peers SET status = ?, last_seen_at = ? WHERE id = ?').run('exited', now(), id);
-    addEvent(db2, 'run.session.exited', id, null, auditPayload({
-      actor: id,
-      target: id,
-      ...exitCode
-    }));
+    tx(db2, () => {
+      const mutation = db2.prepare(`
+        UPDATE peers SET status = ?, last_seen_at = ?
+        WHERE id = ? AND pid IS ? AND pid_start_token IS ? AND pid_command_hash IS ?
+      `).run('exited', now(), id, process.pid, wrapperIdentity?.startToken || null,
+        wrapperIdentity?.commandHash || null);
+      if (Number(mutation.changes) > 0) {
+        addEvent(db2, 'run.session.exited', id, null, auditPayload({
+          actor: id,
+          target: id,
+          ...exitCode
+        }));
+      }
+    });
   } finally {
     db2.close();
   }

package/lib/cli/commands/task.mjs

@@ -1,5 +1,7 @@
 // Task CLI commands extracted from bin/hcc.mjs.
 
+import { visibleLocksWithEvidence } from '../../core/coordination/locks.mjs';
+
 const TASK_STATUS_SHORTCUTS = new Set(['running', 'review', 'blocked', 'abandoned']);
 
 export function createTaskCommands(deps) {
@@ -270,9 +272,10 @@ export function createTaskCommands(deps) {
       peerRow.evidence_reason = evidence.reason;
     }
     const graceUntil = readClockGraceUntil(db);
-    const locks = clockGraceSuppressed(t, graceUntil)
-      ? db.prepare('SELECT * FROM locks').all()
-      : db.prepare('SELECT * FROM locks WHERE expires_at > ?').all(t);
+    const locks = visibleLocksWithEvidence(db.prepare('SELECT * FROM locks').all(), t, {
+      graceActive: clockGraceSuppressed(t, graceUntil),
+      evidenceByOwner: new Map(peers.map((peer) => [peer.id, { state: peer.evidence_state }]))
+    });
     rows = annotateTasksWithLiveness(rows, peers, locks, t, ACTIVE_PEER_TTL, graceUntil);
     printResult(ctx, rows, (data) => table(data, [
       { label: 'id', value: (r) => `#${r.id}` },

package/lib/cli-args.mjs

@@ -6,6 +6,10 @@ export function splitGlobalArgs(argv) {
   const rest = [];
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
+    if (arg === '--') {
+      rest.push(...argv.slice(i));
+      break;
+    }
     if (arg === '--json') {
       global.json = true;
     } else if (arg === '--root') {

package/lib/coordination-state.mjs

@@ -11,6 +11,9 @@ import { timelineFromRows } from './core/coordination/timeline.mjs';
 import { readTx } from './db/schema.mjs';
 import { clockGraceSuppressed, readClockGraceUntil } from './shared/clock-grace.mjs';
 import { classifyPeerActivity } from './core/peers/evidence.mjs';
+import { shellQuoteArg } from './format.mjs';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
 
 const DEFAULT_ACTIVE_PEER_TTL = 600;
 const DEFAULT_LOCK_TTL = 900;
@@ -147,13 +150,24 @@ export function createCoordinationState(deps = {}) {
       '[hello-cc coordination]',
       `peer: ${peerId}`,
       'This is live project coordination context injected by hello-cc.',
-      'You are not isolated for project coordination: hcc is the source of truth for other Claude/Codex/shell sessions in this project.',
+      'You are not isolated for project coordination: hcc is the source of truth for other Claude/Codex/dsh/shell sessions in this project.',
       'If the user asks what other sessions are doing, what tasks exist, or whether you can see other sessions, do not answer from generic model knowledge and do not say sessions are isolated. Run hcc status, hcc state, hcc peers, hcc task list, hcc msg inbox, and hcc lock list, then answer from those results.',
       'Tasks are project work facts, not read/unread items. Open tasks stay relevant to every session until they are marked done or abandoned. Messages are the unread/ack notification channel.',
       'If you already own a current task, continue that task until handoff/done/blocked; do not claim a different task just because a new prompt arrived.',
       'When a hello-cc message asks for a response, reply with hcc msg reply --id <message-id> --body "<answer>" so the answer stays in the same thread.'
     ];
 
+    if (snapshot.peers.some((peer) => peer.id === peerId && peer.kind === 'dsh')) {
+      const hccBin = fileURLToPath(new URL('../bin/hcc.mjs', import.meta.url));
+      const command = ['env', 'HCC_PEER=' + peerId, 'HCC_ROOT=' + ctx.root,
+        'HCC_DB=' + ctx.dbPath, process.execPath, hccBin].map(shellQuoteArg).join(' ');
+      parts.push('[hello-cc dsh session commands]');
+      parts.push('Every dsh agent has its own peer identity. Use this exact command prefix for ALL hcc commands, including the commands shown above and below:');
+      parts.push(command);
+      parts.push(`For example: ${command} status; ${command} msg inbox; ${command} msg reply --id <message-id> --body "<answer>".`);
+      parts.push('The prefix selects this session and project even when other session variables are inherited. Do not use a bare hcc command or borrow another peer identity.');
+    }
+
     if (peers.length > 0) {
       parts.push('[hello-cc known peers]');
       parts.push(...peers.map((peer) => {

package/lib/core/coordination/event-retention.mjs

@@ -1,4 +1,4 @@
-const CURRENT_TMUX_AUTHORITIES = `
+export const DURABLE_RUNTIME_EVENTS = `
   SELECT MAX(e.id)
   FROM events e
   JOIN peer_bindings b
@@ -7,10 +7,22 @@ const CURRENT_TMUX_AUTHORITIES = `
     AND b.transport = 'tmux'
     AND (b.runtime_target IS NULL OR b.runtime_target = json_extract(e.payload, '$.pane'))
   GROUP BY b.peer, b.runtime_target
+  UNION
+  SELECT MAX(e.id) FROM events e
+  WHERE e.type IN ('web.adoption.paused','web.adoption.resumed') AND json_valid(e.payload)
+  GROUP BY json_extract(e.payload, '$.peer'), json_extract(e.payload, '$.pane')
+  UNION
+  SELECT e.id FROM events e WHERE e.type = 'codex.submission.pending'
+  UNION
+  SELECT e.id FROM events e WHERE e.type = 'task.result.recorded'
+  UNION
+  SELECT e.id FROM events e WHERE e.type = 'native.web.submission.pending'
+  UNION
+  SELECT e.id FROM events e WHERE e.type = 'codex.executor.started'
 `;
 
 export function pruneOldEventsPreservingTmuxAuthority(db, cutoff, options = {}) {
-  const predicate = `created_at < ? AND id NOT IN (${CURRENT_TMUX_AUTHORITIES})`;
+  const predicate = `created_at < ? AND id NOT IN (${DURABLE_RUNTIME_EVENTS})`;
   const count = db.prepare(`SELECT COUNT(*) AS n FROM events WHERE ${predicate}`).get(cutoff).n;
   if (!options.dryRun) db.prepare(`DELETE FROM events WHERE ${predicate}`).run(cutoff);
   return Number(count || 0);

package/lib/core/coordination/gc-plan.mjs

@@ -2,23 +2,13 @@ import { randomBytes } from 'node:crypto';
 
 import { readTx, tx } from '../../db/schema.mjs';
 import { aggregateCleanupFailure } from '../../shared/cleanup-error.mjs';
+import { DURABLE_RUNTIME_EVENTS } from './event-retention.mjs';
 
 export const HISTORY_GC_BATCH_SIZE = 256;
 
 const HISTORY_CATEGORIES = Object.freeze(['events', 'tasks', 'messages', 'handoffs']);
 const PLAN_CHANGED = Symbol('gc-plan-changed');
 
-const CURRENT_TMUX_AUTHORITIES = `
-  SELECT MAX(e.id)
-  FROM events e
-  JOIN peer_bindings b
-    ON b.peer = json_extract(e.payload, '$.target_peer')
-  WHERE e.type = 'tmux.session.attached'
-    AND b.transport = 'tmux'
-    AND (b.runtime_target IS NULL OR b.runtime_target = json_extract(e.payload, '$.pane'))
-  GROUP BY b.peer, b.runtime_target
-`;
-
 function rowById(db, table, column, value) {
   return db.prepare(`SELECT * FROM ${table} WHERE ${column} = ?`).get(value) || null;
 }
@@ -108,7 +98,7 @@ function insertSnapshotCategory(db, snapshot, category) {
     db.prepare(`
       INSERT INTO ${table}(category, id)
       SELECT 'events', id FROM events
-      WHERE created_at < ? AND id NOT IN (${CURRENT_TMUX_AUTHORITIES})
+      WHERE created_at < ? AND id NOT IN (${DURABLE_RUNTIME_EVENTS})
     `).run(snapshot.cutoff);
   } else if (category === 'tasks') {
     db.prepare(`
@@ -416,7 +406,7 @@ function captureHistoryGcPlanFromSnapshot(db, cutoff, options, snapshot) {
         FROM ${table} s
         JOIN events e ON e.id = s.id
         WHERE s.category = 'events' AND s.id > ? AND e.created_at < ?
-          AND e.id NOT IN (${CURRENT_TMUX_AUTHORITIES})
+          AND e.id NOT IN (${DURABLE_RUNTIME_EVENTS})
         ORDER BY s.id ASC
         LIMIT ?
       `).all(after.events, cutoff, allocation);

package/lib/core/coordination/locks.mjs

@@ -44,3 +44,48 @@ export function locksConflict(a, b) {
   return lockBaseResource(a) === lockBaseResource(b) &&
     (lockScope(a) === WHOLE_LOCK_SCOPE || lockScope(b) === WHOLE_LOCK_SCOPE || lockScope(a) === lockScope(b));
 }
+
+export function findRequestedLock(db, requested) {
+  const row = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource) || null;
+  return row && lockBaseResource(row) === requested.base_resource && lockScope(row) === requested.scope
+    ? row
+    : null;
+}
+
+// Keep the persisted key format compatible with existing locks. A whole-resource
+// name can equal a scoped key, but that physical collision is never authority to
+// update or remove the other logical resource.
+export function upsertRequestedLock(db, requested, lease) {
+  const result = db.prepare(`
+    INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at, ttl_sec)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(resource) DO UPDATE SET
+      base_resource = excluded.base_resource,
+      scope = excluded.scope,
+      owner = excluded.owner,
+      task_id = excluded.task_id,
+      reason = excluded.reason,
+      expires_at = excluded.expires_at,
+      created_at = excluded.created_at,
+      ttl_sec = excluded.ttl_sec
+    WHERE COALESCE(NULLIF(locks.base_resource, ''), locks.resource) = excluded.base_resource
+      AND COALESCE(NULLIF(locks.scope, ''), '*') = excluded.scope
+  `).run(requested.resource, requested.base_resource, requested.scope, lease.owner,
+    lease.task_id ?? null, lease.reason || '', lease.expires_at, lease.created_at, lease.ttl_sec);
+  if (Number(result.changes) !== 1) {
+    throw new CliError('LOCK_RESOURCE_COLLISION', `Resource ${lockLabel(requested)} collides with an existing lock key`, {
+      resource: requested.base_resource,
+      scope: requested.scope,
+      lock_resource: requested.resource
+    });
+  }
+  return findRequestedLock(db, requested);
+}
+
+export function visibleLocksWithEvidence(locks, nowSec, {
+  graceActive = false,
+  evidenceByOwner = new Map()
+} = {}) {
+  return (locks || []).filter((lock) => graceActive || Number(lock.expires_at) > nowSec ||
+    evidenceByOwner.get(lock.owner)?.state === 'live');
+}

package/lib/core/coordination/results.mjs

@@ -0,0 +1,79 @@
+import { randomUUID } from 'node:crypto';
+import { tx } from '../../db/schema.mjs';
+import { CliError } from '../../shared/errors.mjs';
+
+export const RESULT_EVENT = 'task.result.recorded';
+const STAGES = new Set(['local', 'publication', 'business']);
+const STATUSES = new Set(['passed', 'failed', 'pending']);
+const KINDS = new Set(['verification', 'command', 'diff']);
+
+function text(value, field, max, required = false) {
+  if (value !== undefined && value !== null && typeof value !== 'string') {
+    throw new CliError('BAD_REQUEST', `${field} must be text`);
+  }
+  const result = (value || '').trim();
+  if ((required && !result) || result.length > max) throw new CliError('BAD_REQUEST', `${field} must contain ${required ? '1' : '0'} to ${max} characters`);
+  return result;
+}
+
+// Evidence records do not mutate task status. The owner is checked in the same
+// transaction as the insert, including after a concurrent task takeover.
+export function recordTaskResult(db, input, { now = () => Math.floor(Date.now() / 1000), addEvent } = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new CliError('BAD_REQUEST', 'A result object is required');
+  const peer = text(input.peer, 'peer', 200, true);
+  const taskId = input.taskId;
+  if (!Number.isSafeInteger(taskId) || taskId < 1) throw new CliError('BAD_REQUEST', 'taskId must be a positive integer');
+  const stage = input.stage || 'local', status = input.status || 'pending';
+  const kind = input.kind || 'verification', source = input.source || 'user';
+  if (!STAGES.has(stage) || !STATUSES.has(status) || !KINDS.has(kind) || !['user', 'executor'].includes(source)) {
+    throw new CliError('BAD_REQUEST', 'Unsupported result stage, status, kind or source');
+  }
+  if (source === 'executor' && stage !== 'local') throw new CliError('BAD_REQUEST', 'Executor records can only report local evidence');
+  const evidence = input.evidence || [];
+  if (!Array.isArray(evidence) || evidence.length > 20) throw new CliError('BAD_REQUEST', 'evidence must contain up to 20 text references');
+  const references = evidence.map((entry) => text(entry, 'evidence', 2000, true));
+  if (source === 'user' && status === 'passed' && !references.length) {
+    throw new CliError('BAD_REQUEST', 'A passed verification needs an evidence reference');
+  }
+  const record = {
+    result_id: randomUUID(), result_key: text(input.resultKey, 'resultKey', 700) || randomUUID(),
+    peer, task_id: taskId, stage, status, kind, source,
+    title: text(input.title, 'title', 300, true), details: text(input.details, 'details', 64000), evidence: references,
+    command: text(input.command, 'command', 64000), diff: text(input.diff, 'diff', 64000),
+    executor_id: text(input.executorId, 'executorId', 512) || null,
+    thread_id: text(input.threadId, 'threadId', 512) || null,
+    turn_id: text(input.turnId, 'turnId', 512) || null,
+    item_id: text(input.itemId, 'itemId', 512) || null,
+    exit_code: Number.isSafeInteger(input.exitCode) ? input.exitCode : null,
+    created_at: now()
+  };
+  return tx(db, () => {
+    const task = db.prepare('SELECT id, owner, title, status FROM tasks WHERE id = ?').get(taskId);
+    if (!task) throw new CliError('NOT_FOUND', 'Task not found');
+    if (task.owner !== peer) throw new CliError('TASK_OWNER_MISMATCH', 'This task belongs to a different peer');
+    const previous = db.prepare(`SELECT id, payload, created_at FROM events WHERE type = ?
+      AND task_id = ? AND actor = ? AND json_valid(payload) AND json_extract(payload, '$.result_key') = ?
+      ORDER BY id DESC LIMIT 1`).get(RESULT_EVENT, taskId, peer, record.result_key);
+    if (previous) return { ...JSON.parse(previous.payload), id: previous.id, created_at: previous.created_at };
+    record.task_title = task.title;
+    record.task_status = task.status;
+    if (addEvent) addEvent(db, RESULT_EVENT, peer, taskId, record);
+    else db.prepare('INSERT INTO events(type,actor,task_id,payload,created_at) VALUES(?,?,?,?,?)')
+      .run(RESULT_EVENT, peer, taskId, JSON.stringify(record), record.created_at);
+    return { ...record, id: Number(db.prepare('SELECT last_insert_rowid() AS id').get().id) };
+  });
+}
+
+export function listTaskResults(db, { peer, taskId = null, limit = 100 } = {}) {
+  if (!peer || !Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new CliError('BAD_REQUEST', 'peer and a limit from 1 to 200 are required');
+  if (taskId !== null && (!Number.isSafeInteger(taskId) || taskId < 1)) throw new CliError('BAD_REQUEST', 'taskId must be a positive integer');
+  return db.prepare(`SELECT id,payload,created_at FROM events
+    WHERE type = ? AND actor = ? AND (? IS NULL OR task_id = ?) AND json_valid(payload)
+    ORDER BY id DESC LIMIT ?`).all(RESULT_EVENT, peer, taskId, taskId, limit)
+    .map((row) => ({ ...JSON.parse(row.payload), id: row.id, created_at: row.created_at }));
+}
+
+export function summarizeTaskResults(results) {
+  return Object.fromEntries([...STAGES].map((stage) => [stage,
+    results.find((record) => record.stage === stage && record.kind === 'verification') || null]));
+}