@lumoai/cli 1.59.0 → 1.60.0

package/assets/skill/SKILL.md

@@ -108,8 +108,9 @@ The command catalog below is a **map**: it lists every command grouped by domain
 ### Verification (machine acceptance loop) — see [verify.md](references/verify.md)
 
 - `lumo verify [task] [--note "<self-report>"] [--timeout <seconds>]` — run every MACHINE criterion's checkpointer locally and report a structured PASS/FAIL verdict per criterion. `--note` is an optional one-line self-report ("我改了 X,因为 Y 可验收"), frozen as the task's claim (source AGENT) when the round passes into IN_REVIEW. The round cap is the workspace's `verificationMaxRounds` (default 3) — read the actual budget off the `Round N/M` line the command prints, never assume a number. All-pass → task to IN_REVIEW (agent stops); a fail on the last round → escalate to human. **Run this before claiming a task is done.**
-- `lumo task status [task] [--full] [--json]` — read-only acceptance self-check (no LLM): the contract with each criterion's latest verdict, the current round, last failure reasons, `nextActions` (the unmet criteria, plus any undispositioned PR **security findings** as `SECURITY_FINDING` entries — `blocks DONE` vs `advisory`), a per-linked-PR **scan status line** (stage states incl. the L3 `hunt` layer, external-finding count, partial flag, external failure reason — LUM-735/739), and any OPEN boundary crossings; `--full` adds the dashboard sections (verification rollup, history, cost, struggle trail, trend) (fails closed — `null`/`⚠` means "could not confirm", not safe). **Run it first when resuming a task or after a round was rejected.**
-- `lumo crossing explain <id> --note "<text>"` — append an agent self-explanation ("申辩") to a boundary crossing; append-only, **never clears the crossing or unblocks Done** (disposition stays web + human-only). A review aid, not a self-clear.
+- `lumo task status [task] [--full] [--json]` — read-only acceptance self-check (no LLM): the contract with each criterion's latest verdict, the current round, last failure reasons, `nextActions` (the unmet criteria, plus any undispositioned PR **security findings** as `SECURITY_FINDING` entries — `blocks DONE` vs `advisory`), a per-linked-PR **scan status line** (stage states incl. the L3 `hunt` layer, external-finding count, partial flag, external failure reason — LUM-735/739) plus the hunt's per-category coverage line (LUM-762), and any OPEN boundary crossings; `--full` adds the dashboard sections (verification rollup, history, cost, struggle trail, trend) (fails closed — `null`/`⚠` means "could not confirm", not safe). **Run it first when resuming a task or after a round was rejected.**
+- `lumo crossing explain <id> --note "<text>"` — append an agent self-explanation ("申辩") to a boundary crossing; append-only, **never clears the crossing or unblocks Done**. A review aid, not a self-clear.
+- `lumo crossing disposition <id> --false-positive | --confirmed [--note "<text>"] [--task <LUM-N>]` — record the **user's** ruling on a task crossing through a **three-step** confirmation handshake the server enforces (LUM-769): (1) no step flag — prints the crossing (severity, detail, recurrence, your explanations) as an exit-4 envelope with a stage-1 **read receipt**, writes nothing; relay it and ask the user to confirm they have **read** it, then run its `confirmCommand` (`--receipt <r1> --confirm-read`); (2) that prints a second exit-4 envelope for the ruling with the stage-2 receipt; relay it and ask the user to **approve**, then run its `confirmCommand` (`--receipt <r2> --confirm`); (3) the write. Confirming the ruling before the read is acknowledged is refused and told to confirm the read first; never supply either step flag yourself. Either ruling clears that crossing's block on DONE and is audited as a CLI-channel disposition. Reverting to OPEN, repository suppression rules and steward (milestone) crossings stay web-only. See [verify.md](references/verify.md)
 
 ### Cost (per-operation token read-out) — see [task-context.md](references/task-context.md)
 
@@ -235,5 +236,5 @@ Don't guess these:
 - **Evidence before "done".** Never claim done from reading code — run `lumo verify`. While a PR is open, the task is IN_REVIEW, not DONE.
 - **Never set DONE yourself after a verify loop** — that adjudication is human-only. An unresolved send-back blocks the DONE transition with 409.
 - **Status updates are one direct call** (`task update --status done`), not a step-by-step walk through `in_progress → in_review → done`.
-- **Exit code 4 = the user must confirm — you may not.** A gated mutation (`--status done`, `sprint/milestone/doc delete`, `memory rm`, `task deps/artifact rm`, `sprint close --move-all/--backlog-all`, `worktree rm`, `doc rebuild-source` on an existing source) run without `--confirm` prints a `confirmation_required` envelope on stdout and does nothing. Show every line of its `changes` to the user, wait for their explicit approval, then run its `confirmCommand` verbatim. **Never add `--confirm` (or `--yes` / `--force`) yourself** — the flag means "the user has confirmed", and adding it on your own initiative is the exact failure the protocol exists to stop. **Exit code 5 = blocked by a human-only gate** (`DONE_BLOCKED`: a send-back, an undispositioned boundary crossing, a blocking security finding): relay its `blockers` and `remediation` to the user; nothing on the CLI clears it — no retry, no flag, no rewording a failed criterion. Details: [confirmation.md](references/confirmation.md)
+- **Exit code 4 = the user must confirm — you may not.** A gated mutation (`--status done`, `sprint/milestone/doc delete`, `memory rm`, `task deps/artifact rm`, `sprint close --move-all/--backlog-all`, `worktree rm`, `doc rebuild-source` on an existing source) run without `--confirm` prints a `confirmation_required` envelope on stdout and does nothing. Show every line of its `changes` to the user, wait for their explicit approval, then run its `confirmCommand` verbatim. **Never add `--confirm` (or `--yes` / `--force`) yourself** — the flag means "the user has confirmed", and adding it on your own initiative is the exact failure the protocol exists to stop. **Exit code 5 = blocked by a human-only gate** (`DONE_BLOCKED`: a send-back, an undispositioned boundary crossing, a blocking security finding): relay its `blockers` and `remediation` to the user; nothing on `task update` clears it — no retry, no flag, no rewording a failed criterion. A boundary crossing is the one blocker with a terminal path, and it is the user's: `lumo crossing disposition <id> --false-positive | --confirmed` prints an exit-4 envelope you relay exactly like `--status done` — never self-approve. Details: [confirmation.md](references/confirmation.md)
 - **Read the reference before composing a command** whose flags/edge-cases matter — don't run from memory.

package/assets/skill/references/confirmation.md

@@ -50,25 +50,27 @@ Nothing goes to stderr; the envelope is the command's result, not an error. **Ex
 - `--confirm` — the user approved. Present on every command in the table below.
 - `--yes` — legacy alias of `--confirm` on the commands that took it before LUM-755. Prefer `--confirm` in new invocations. `task update` never had `--yes` and does not gain it.
 - `--force` — a **second gate** that stays separate from `--confirm`: `worktree rm` uses it to acknowledge discarding uncommitted changes; `doc rebuild-source` uses it to acknowledge replacing an existing source. Missing `--force` also yields an envelope (exit 4) whose `confirmCommand` carries `--force --confirm`.
+- `--confirm-read` + `--receipt <token>` — the **read-acknowledgement handshake** (LUM-769) on `crossing disposition`, a three-step protocol the _server_ enforces, the way a web form is loaded, "I have read this" is ticked, and only then submit works. **Step 1** (no step flag) reads the crossing and obtains a stage-1 receipt bound to the crossing, the ruling, your session/member and the crossing's current state (ruling, recurrence, explanations); its envelope's `confirmCommand` carries `--receipt <r1> --confirm-read`. **Step 2** (`--confirm-read`, after the user says they have read it) has the server verify r1 and return the stage-2 receipt; the CLI prints a second envelope for the ruling whose `confirmCommand` carries `--receipt <r2> --confirm`. **Step 3** (`--confirm`, after the user approves the ruling) writes. Confirming the ruling with the stage-1 receipt is refused — locally before any request, and by the server with 409 — and told to confirm the read first; a receipt that is missing, forged, expired (10-minute TTL), for another reader/ruling, or older than the crossing's latest change (a recurrence, a new explanation, a ruling) is refused too, nothing written — re-run without a step flag for a fresh envelope. Each envelope lists its receipt under `receipt: { token, expiresAt }`. The audit row records shown / read-acknowledged / confirmed times. This makes the order un-skippable; it does not, and cannot, prove the user personally ticked the box — you relay each step — so the ruling is recorded as a CLI-channel disposition.
 
 ## Commands that use the protocol
 
-| Command                                                   | `changes` describes                                                                                                                                                                                                                            | Notes                                                                                                                                                                                                   |
-| --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `task update <id> --status done`                          | `Will move LUM-N "title" to DONE` · `Status: <current> → DONE` · one line per linked PR (`#926  merged   title  url`) or `Pull requests: none linked` · a trailing `⚠ N linked pull request(s) not merged: …` when any PR is open/closed/draft | Only `--status done` is gated; other statuses PATCH directly. The server's own DONE gates (unresolved send-back, open boundary crossing → 409) still apply after `--confirm`. See [tasks.md](tasks.md). |
-| `task deps rm <id> <edge>`                                | the resolved edge (short id, direction, other task, status, source)                                                                                                                                                                            | [task-deps.md](task-deps.md)                                                                                                                                                                            |
-| `task artifact rm <task> <artifact-id>`                   | artifact id, title, kind; "irreversible"                                                                                                                                                                                                       | [artifacts-figma.md](artifacts-figma.md)                                                                                                                                                                |
-| `memory rm <memoryId>`                                    | memory id, `[CATEGORY]`, a one-line content summary                                                                                                                                                                                            | [memory.md](memory.md)                                                                                                                                                                                  |
-| `doc delete <doc>`                                        | doc id + title; nested documents are deleted with it                                                                                                                                                                                           | [docs.md](docs.md)                                                                                                                                                                                      |
-| `sprint delete <ref>`                                     | sprint number + name; task count (tasks keep their data)                                                                                                                                                                                       | [sprints.md](sprints.md)                                                                                                                                                                                |
-| `sprint close <ref> --move-all` / `--backlog-all`         | sprint; every unfinished task and where it goes                                                                                                                                                                                                | Without a mode flag and with unfinished tasks the command is a plain exit-1 refusal (pick a mode). [sprints.md](sprints.md)                                                                             |
-| `milestone delete <ref>`                                  | milestone name; task count (tasks keep their data)                                                                                                                                                                                             | [milestones.md](milestones.md)                                                                                                                                                                          |
-| `worktree rm <LUM-N>`                                     | path + branch; `⚠ … uncommitted changes … discarded` when dirty; whether the branch is kept or deleted                                                                                                                                         | Dirty tree → `confirmCommand` carries `--force --confirm`. [worktree.md](worktree.md)                                                                                                                   |
-| `doc rebuild-source <doc>` (when a source already exists) | the server's 409 reason; what `--force` would replace                                                                                                                                                                                          | `confirmCommand` carries `--force --confirm`. [doc-editing.md](doc-editing.md)                                                                                                                          |
+| Command                                                      | `changes` describes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `task update <id> --status done`                             | `Will move LUM-N "title" to DONE` · `Status: <current> → DONE` · one line per linked PR (`#926  merged   title  url`) or `Pull requests: none linked` · a trailing `⚠ N linked pull request(s) not merged: …` when any PR is open/closed/draft                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Only `--status done` is gated; other statuses PATCH directly. The server's own DONE gates (unresolved send-back, open boundary crossing → 409) still apply after `--confirm`. See [tasks.md](tasks.md).                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `crossing disposition <id> --false-positive` / `--confirmed` | **Envelope 1 (read):** `Will disposition crossing <id> on LUM-N as FALSE_POSITIVE` · `Disposition: OPEN → FALSE_POSITIVE` · `[SEVERITY] CATEGORY — detail` · `Seen ×N while open` when it recurred · every agent explanation (`agent self-report · unverified`) or `Agent explanations: none recorded` · `Note to record: …` · `⚠ Approving clears this crossing's block on moving LUM-N to DONE` (or `Advisory crossing — it never blocked DONE…`) · `⚠ HIGH severity …` / `⚠ Irreversible category …` when they apply · `Step 1 of 2 — read receipt issued … valid until <time>`. **Envelope 2 (ruling, after `--confirm-read`):** `Read acknowledged for crossing <id> (shown <t1>, acknowledged <t2>)` · `Step 2 of 2 — record the ruling: OPEN → FALSE_POSITIVE on LUM-N` · the note · the ⚠ consequence line | LUM-769. Two envelopes, two approvals: envelope 1's `confirmCommand` ends in `--confirm-read`, envelope 2's in `--confirm` (see Flags). The crossing is read first on every path and the command fails closed (exit 1, no write) when that read or a receipt request errors; a step flag without its receipt, `--confirm` with the stage-1 receipt, or both step flags at once are refused before any request; an already-matching ruling is a no-op (exit 0). Reverting to OPEN and repository suppression rules stay web-only; steward (milestone) crossings are not reachable. See [verify.md](verify.md). |
+| `task deps rm <id> <edge>`                                   | the resolved edge (short id, direction, other task, status, source)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | [task-deps.md](task-deps.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `task artifact rm <task> <artifact-id>`                      | artifact id, title, kind; "irreversible"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | [artifacts-figma.md](artifacts-figma.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `memory rm <memoryId>`                                       | memory id, `[CATEGORY]`, a one-line content summary                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | [memory.md](memory.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `doc delete <doc>`                                           | doc id + title; nested documents are deleted with it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | [docs.md](docs.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `sprint delete <ref>`                                        | sprint number + name; task count (tasks keep their data)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | [sprints.md](sprints.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `sprint close <ref> --move-all` / `--backlog-all`            | sprint; every unfinished task and where it goes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Without a mode flag and with unfinished tasks the command is a plain exit-1 refusal (pick a mode). [sprints.md](sprints.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `milestone delete <ref>`                                     | milestone name; task count (tasks keep their data)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | [milestones.md](milestones.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `worktree rm <LUM-N>`                                        | path + branch; `⚠ … uncommitted changes … discarded` when dirty; whether the branch is kept or deleted                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Dirty tree → `confirmCommand` carries `--force --confirm`. [worktree.md](worktree.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `doc rebuild-source <doc>` (when a source already exists)    | the server's 409 reason; what `--force` would replace                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `confirmCommand` carries `--force --confirm`. [doc-editing.md](doc-editing.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 
 ## When the gate is human-only: `DONE_BLOCKED`, exit code 5
 
-Not every refusal is something the user can approve. The server's DONE gates — an **unresolved send-back**, an **undispositioned boundary crossing**, a **blocking security finding** — are verdicts on the agent's own work, and by design there is no CLI path to clear them (the interested party may not adjudicate itself). They are therefore **not** part of the confirmation protocol: no `--confirm`, no `--force`, nothing you can pass.
+Not every refusal is something the user can approve on the spot. The server's DONE gates — an **unresolved send-back**, an **undispositioned boundary crossing**, a **blocking security finding** — are verdicts on the agent's own work, and the interested party may not adjudicate itself: nothing on `task update` clears them — no `--confirm`, no `--force`, nothing you can pass. Since LUM-769 a **boundary crossing** does have a terminal path, but it is a separate command and it is the user's: `lumo crossing disposition <id> --false-positive | --confirmed` walks the exit-4 protocol above (you relay the crossing, the user rules, you re-run the `confirmCommand`). Send-backs and security findings still have no CLI path at all.
 
 What the CLI does instead: when `task update <id> --status done --confirm` is refused by one of these gates, it re-reads the task's acceptance status and open crossings, prints a structured error on **stdout** and exits **5**:
 
@@ -90,7 +92,7 @@ What the CLI does instead: when `task update <id> --status done --confirm` is re
   ],
   "unconfirmed": [],
   "remediation": [
-    "BOUNDARY_CROSSING: leave a rationale with `lumo crossing explain cmtw… --note \"…\"` (append-only; it does not clear anything). A human dispositions each crossing (false positive / confirmed) at https://…/my-tasks/LUM-48#boundary-crossings"
+    "BOUNDARY_CROSSING: leave a rationale with `lumo crossing explain cmtw… --note \"…\"` (append-only; it does not clear anything), then relay each crossing to the user. Once they rule, record it with `lumo crossing disposition cmtw… --false-positive` or `--confirmed` — it prints an exit-4 envelope for the user to approve; never self-approve. The web panel also works: https://…/my-tasks/LUM-48#boundary-crossings"
   ],
   "dispositionUrl": "https://…/my-tasks/LUM-48#boundary-crossings"
 }
@@ -101,9 +103,9 @@ What the CLI does instead: when `task update <id> --status done --confirm` is re
 | `message`     | The server's 409 text, verbatim.                                                                                                                                                                                                                                                                               |
 | `blockers`    | One entry per item holding the gate: `SEND_BACK` (criterionId, statement, failedAtRound, rejectionReason), `BOUNDARY_CROSSING` (id, severity, category, detail), `SECURITY_FINDING` (findingId, severity, ruleId, filePath, line, prNumber, statement). Built from the same read models as `lumo task status`. |
 | `unconfirmed` | Enrichment reads that failed (`boundary-crossings read failed: HTTP 500`). Non-empty means the blocker list may be incomplete — it never silently shrinks.                                                                                                                                                     |
-| `remediation` | One line per blocker kind present, naming only human-side or append-only paths: re-run `lumo verify`, `lumo crossing explain`, fix-and-push, the web disposition panel.                                                                                                                                        |
+| `remediation` | One line per blocker kind present, naming only human-side, append-only or user-approved paths: re-run `lumo verify`, `lumo crossing explain`, `lumo crossing disposition` (exit-4 envelope, the user rules), fix-and-push, the web disposition panel. Never a ready-to-run approval flag.                      |
 
-**Exit 4 vs exit 5:** 4 means "the user must approve, then you can proceed"; 5 means "a human must adjudicate elsewhere — nothing on the CLI moves this". On exit 5, relay `blockers` and `remediation` to the user. Do not retry, do not look for a flag, and do not reword or delete a failed criterion to get past a send-back (that is tampering and is audited). A 409 that is not a DONE gate (e.g. a permission refusal) keeps the plain exit-1 text on stderr.
+**Exit 4 vs exit 5:** 4 means "the user must approve, then you can proceed"; 5 means "a human must adjudicate — nothing on this command moves it". On exit 5, relay `blockers` and `remediation` to the user. Do not retry `task update`, do not look for a flag on it, and do not reword or delete a failed criterion to get past a send-back (that is tampering and is audited). For a `BOUNDARY_CROSSING` blocker the adjudication can happen in the terminal — `lumo crossing disposition <id> …` is itself an exit-4 command, so the user's ruling still comes through the protocol, never from you. Once every blocker is cleared, re-run the original `task update … --confirm` (its envelope was already approved). A 409 that is not a DONE gate (e.g. a permission refusal) keeps the plain exit-1 text on stderr.
 
 ## Example exchange
 

package/assets/skill/references/sessions.md

@@ -142,7 +142,7 @@ lumo session attach --steward cmxyz123...                 # by milestone id
 - Moving a task to `in_progress` with **yourself as the effective assignee** (whether already assigned to you or assigned in the same call) → 409. Dispatching to _someone else_ is planning and passes.
 - Red line unchanged: a steward writes no PASS of any kind; DONE stays human-only.
 
-**Backstop (second layer, detector):** commits / PR creations produced during a steward session anyway (the CLI can't stop local git) are recorded as **`STEWARD_IMPLEMENTATION_ARTIFACT` boundary crossings against the milestone** — fail-closed (an unparseable Bash payload records an _unconfirmed_ crossing rather than nothing), disposition stays **web + human-only**, and there is **no CLI clear path** (`crossing explain` remains an appeal, never a clear).
+**Backstop (second layer, detector):** commits / PR creations produced during a steward session anyway (the CLI can't stop local git) are recorded as **`STEWARD_IMPLEMENTATION_ARTIFACT` boundary crossings against the milestone** — fail-closed (an unparseable Bash payload records an _unconfirmed_ crossing rather than nothing), disposition stays **web + human-only** — `lumo crossing disposition` (LUM-769) is task-scoped and cannot reach a milestone crossing — and there is **no CLI clear path** (`crossing explain` remains an appeal, never a clear).
 
 #### When to suggest
 

package/assets/skill/references/tasks.md

@@ -148,7 +148,7 @@ lumo task update LUM-48 --status done
 With no linked PR the PR lines collapse to `Pull requests: none linked` and there is no `⚠` line. Other flags on the same call (`--title`, `--add-tag`…) are preserved in `confirmCommand`.
 
 - **Show `changes` to the user and wait for an explicit yes**, then run `confirmCommand` unchanged. `--confirm` means the user confirmed — never add it on your own.
-- With `--confirm` the PATCH goes out directly. The server's own DONE gates still apply on top — an unresolved send-back, an undispositioned boundary crossing or a blocking security finding refuses with **409**, which the CLI turns into a structured **`DONE_BLOCKED` error on stdout with exit 5**: the 409 text verbatim, a `blockers[]` with ids (built from `task status` + the crossings read model), and `remediation` lines that only name human-side paths. There is no CLI path to clear any of them — relay, don't retry. See [confirmation.md](confirmation.md) "When the gate is human-only". Any other 409 stays plain text, exit 1.
+- With `--confirm` the PATCH goes out directly. The server's own DONE gates still apply on top — an unresolved send-back, an undispositioned boundary crossing or a blocking security finding refuses with **409**, which the CLI turns into a structured **`DONE_BLOCKED` error on stdout with exit 5**: the 409 text verbatim, a `blockers[]` with ids (built from `task status` + the crossings read model), and `remediation` lines that only name human-side or user-approved paths. Nothing on `task update` clears any of them — relay, don't retry. A boundary crossing is the one blocker with a terminal path, `lumo crossing disposition <id> …` (itself exit-4: the user rules, never you); once every blocker is cleared, re-run this `--confirm` call. See [confirmation.md](confirmation.md) "When the gate is human-only". Any other 409 stays plain text, exit 1.
 - `--confirm` is the only flag: there is no `--yes` or `--force` on `task update`. Every other status (`todo` / `in_progress` / `in_review`) PATCHes directly and ignores `--confirm`.
 - A failed lookup (404, network) exits 1 before any envelope.
 

package/assets/skill/references/verify.md

@@ -142,12 +142,13 @@ what's unmet and why (the exact failure tails), and how many rounds are left.
 
 - **Trend** (`--full`) — 规律 7 趋势非快照: the _movement_ of the key quantities across the task's attempts, not a single snapshot. Where History/Cost/Struggle list current values, this shows direction: **Pass rate** across verification rounds (`r1 60% → r2 100% (↑ +40pts)`), **Cost/session** across the task's sessions (`4.2K → 1.1K tokens (↓), 5.3K total` — per-session spend from the same source as the **Cost** total, so the trajectory's points sum to it), and **Rework** accrual (`3 accrued — 1 FAIL round, 1 reopen, +1 PR cycle (↑ from 0)`). **Honest about a single point:** with only one round and one session every quantity is one data point, so it prints `Single attempt so far — no trajectory yet (a trend needs ≥2 rounds or sessions)` rather than drawing a fake arrow off one value. When nothing was verified and no cost was measured it says `No verification rounds or measured cost yet — nothing to trend`. Carried in `--json` as `trend { passRate[], cost[], rework{} }`. Omitted only against an older server.
 
-- **Next actions** — the unmet criteria (latest verdict is not a pass: failed or never verified, HUMAN ones included) followed by any **undispositioned PR security findings** (LUM-737) as `• [SECURITY] [SEVERITY] PROVENANCE ruleId — file:line — title (PR #n · blocks DONE | advisory)`. This list IS the plan — recomputed from the event log + the latest scan per linked PR on every read, never maintained separately. The header counts them separately: `Next actions (N unmet · M security findings)`. A finding is **not** a criterion: fix it and push (a fixed fingerprint disappears from the next scan) or a human dispositions it in the web delivery panel — there is no CLI path to clear one, and a `blocks DONE` finding refuses DONE with 409. Empty + rounds recorded = awaiting human adjudication.
-  - **Per-PR scan status** (LUM-735): before the unconfirmed-PR lines, one line per linked PR that has a latest scan (open or closed alike): `PR #945 · scan CLEAN · secrets RAN · external RAN (2 external findings) · supplyChain RAN (1 dependency finding, 1 already on main) · judge RAN · hunt PARTIAL` — stage segments only for keys present, in secrets/external/supplyChain/judge/hunt order (`hunt` = the L3 vulnerability hunt, LUM-739: absent when `LUMO_SECURITY_HUNT=off`, `SKIPPED` when no trigger fired, `PENDING` while the workflow runs, `RAN` / `PARTIAL` (budget or subgraph cap hit) / `FAILED`; its findings are `LLM_JUDGE` advisory, never `blocks DONE`); `(N external findings)` (singular at 1) decorates only the external segment, and only when N > 0; `(N dependency findings[, M already on main])` (LUM-738; singular at 1) decorates only the supplyChain segment, only when N > 0, and prints bare `supplyChain <state>` against an older server without the counts; ` · partial` appended when the scan is partial; and, when `stages.external === 'FAILED'` and a **scrubbed scanner reason** was recorded (the `error` column carries the `external: ` provenance prefix), an appended ` — <reason without the prefix, tail 200 chars>` — an unprefixed `error` (stage A's own raw crash text) is never printed here, same P8 rule as the web panel and the PR summary (LUM-756). Fed by the additive `securityFindings.scans` array; omitted entirely (no lines) against an older server that doesn't send it.
+- **Next actions** — the unmet criteria (latest verdict is not a pass: failed or never verified, HUMAN ones included) followed by any **undispositioned PR security findings** (LUM-737) as `• [SECURITY] [SEVERITY] PROVENANCE ruleId — file:line — title (PR #n · blocks DONE | advisory[ — <cause>, downgraded])`. The trailing **downgrade cause** appears only on deterministic `secret:*` rows the scanner lowered to LOW — `placeholder value` (the matched string looks like `…EXAMPLE`, `YOUR_…`, `CHANGEME`…) or `test/fixture/doc path`. Downgrading is **not** suppression: the row is still reported so a human decides, and the cause is what lets you tell a recognised test fixture from a real leak without opening the file. Absent on rows scanned before the cause was recorded, and on any row that was not downgraded — silence means "not downgraded", never "cause unknown". This list IS the plan — recomputed from the event log + the latest scan per linked PR on every read, never maintained separately. The header counts them separately: `Next actions (N unmet · M security findings)`. A finding is **not** a criterion: fix it and push (a fixed fingerprint disappears from the next scan) or a human dispositions it in the web delivery panel — there is no CLI path to clear one, and a `blocks DONE` finding refuses DONE with 409. Empty + rounds recorded = awaiting human adjudication.
+  - **Per-PR scan status** (LUM-735): before the unconfirmed-PR lines, one line per linked PR that has a latest scan (open or closed alike): `PR #945 · scan CLEAN · Secrets: checked · Code scan: checked (2 external findings) · Dependencies: checked (1 dependency finding, 1 already on main) · AI review: checked · Exploit paths: ⚠ incomplete` — stage segments only for keys present, in secrets/external/supplyChain/judge/hunt order. **The stage keys are internal; what prints is their display label** (LUM-763, `shared/src/security-scan.ts`, shared with the GitHub PR summary so the two cannot drift): `secrets`→Secrets, `external`→Code scan, `supplyChain`→Dependencies, `judge`→AI review, `hunt`→Exploit paths; states render as `RAN`→checked, `SKIPPED`→skipped, `NOT_CONFIGURED`→off, `PENDING`→scanning, `PARTIAL`→⚠ incomplete, `SUPERSEDED`→⚠ superseded, `FAILED`→✗ failed. "checked" means the layer completed, **not** that it found nothing — findings are counted in their own segments and in the next-actions list (`hunt` = the L3 vulnerability hunt, LUM-739: absent when `LUMO_SECURITY_HUNT=off`, `SKIPPED` when no trigger fired, `PENDING` while the workflow runs, `RAN` / `PARTIAL` (budget hit, a planned task that never finished, or more surviving candidates than the falsifier cap) / `FAILED`; its findings are `LLM_JUDGE` advisory, never `blocks DONE`); `(N external findings)` (singular at 1) decorates only the Code scan segment, and only when N > 0; `(N dependency findings[, M already on main])` (LUM-738; singular at 1) decorates only the Dependencies segment, only when N > 0, and prints bare `Dependencies: <state>` against an older server without the counts; ` · partial` appended when the scan is partial; and, when `stages.external === 'FAILED'` and a **scrubbed scanner reason** was recorded (the `error` column carries the `external: ` provenance prefix), an appended ` — <reason without the prefix, tail 200 chars>` — an unprefixed `error` (stage A's own raw crash text) is never printed here, same P8 rule as the web panel and the PR summary (LUM-756). Fed by the additive `securityFindings.scans` array; omitted entirely (no lines) against an older server that doesn't send it.
+  - **Hunt coverage line** (LUM-762): indented under its scan line whenever the server sends the L3 hunt's per-category audit — `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done (2 attempts) · t3 race skipped`. `<n>/N done` is how many planned tasks finished (where N is the number of tasks the planning step selected for this scan, typically 0–3). Rows persisted before LUM-758 lack a planned-task count and fall back to the historical 6-category denominator (reading as `/6` instead). Each segment is `[taskId ]<category> <elapsed>s <stop>` — the `taskId` prefix (`t1`, `t2`, …) appears only on current rows where the task graph is present (post-LUM-758), and is omitted on pre-task-graph audit rows, so they render exactly as they always did. Elapsed is summed over the task's attempts; `(N attempts)` when the workflow retried it; no elapsed for a `skipped` task (the scan's budget ran out before its turn). Stop values: `done` · `steps` · `budget` · `timeout` · `error` · `skipped`. Headed by the same display label as the layer's own segment (LUM-763), so the detail line and the line above it never name the layer two different ways. This is the only surface that reads `huntAudit`, so it is where you answer "how long does a healthy task take" and "which tasks never ran" without paging through deploy logs. Absent on an older server and on scans with no usable audit (pre-LUM-739 rows, or a hunt that failed before its first batch) — no line, never a guess.
   - **Persisting findings** (LUM-738): a finding whose fingerprint is already on the repository's default-branch baseline (`persisting`) is not this PR's — it never appears as a next action, is not counted in `openFindings`, and shows muted (_already on the default branch_) in the web panel. Dependency findings (`kind=DEPENDENCY`, from osv-scanner) are advisory: they never block DONE.
   - **Fails closed:** `⚠ Security-scan check failed — could not confirm …` when the scan read errored, and one `⚠ PR #n: … — could not confirm it is clean.` line per open PR whose latest scan is missing / FAILED / still running. Silence means a successful read with nothing open, never a failed check.
-- **Open boundary crossings** — a trailing safety block when the task has ≥1 OPEN (undispositioned) forbidden-action crossing: a count, then one line per crossing `• [SEVERITY] CATEGORY — <clipped detail>` (highest-severity first), each followed by a read-only **attribution** line `↳ by model=<m> · agent=<type>[/branch] · session=<8-char prefix>` (who/what crossed; any dimension that couldn't be resolved server-side prints `unknown`, never a fabricated value), then a pointer to the web acceptance panel. Silent when there are none, so it never overshadows the criteria.
-  - **Read-only awareness** — this surfaces crossings detected elsewhere; there is no CLI path to disposition or clear one. Disposition stays web + human-only: an agent/CLI bearer cannot clear its own crossing from the terminal.
+- **Open boundary crossings** — a trailing safety block when the task has ≥1 OPEN (undispositioned) forbidden-action crossing: a count, then one line per crossing `• [SEVERITY] CATEGORY — <clipped detail>` (highest-severity first), each followed by a read-only **attribution** line `↳ by model=<m> · agent=<type>[/branch] · session=<8-char prefix>` (who/what crossed; any dimension that couldn't be resolved server-side prints `unknown`, never a fabricated value), then a pointer to `lumo crossing disposition` and the web acceptance panel. Silent when there are none, so it never overshadows the criteria.
+  - **Read-only awareness** — this block surfaces crossings detected elsewhere and clears nothing itself. The ruling is the user's: `lumo crossing disposition <id> --false-positive | --confirmed` (exit-4 envelope you relay, LUM-769 — see below) or the web panel. You never self-approve.
   - **The check fails closed:** if the crossings read itself errors (network / server / parse), the block prints `⚠ Boundary-crossing check failed (network/server error) — could not confirm whether any are undispositioned` instead of staying silent. Silence means a successful read with zero open crossings, never a failed check — a hiccup can no longer masquerade as "all clear".
 
 ### Responding to an open crossing — `lumo crossing explain`
@@ -163,11 +164,32 @@ lumo crossing explain <id> --note "this was a generated fixture, not a hand-edit
 This is the **inverse** of dispositioning, but it is the agent/CLI path
 (bearer-only; a clerk/human caller is refused). Behavior:
 
-- it can **only append** an append-only note — it **never clears the crossing or unblocks Done** (disposition stays web + human-only);
+- it can **only append** an append-only note — it **never clears the crossing or unblocks Done** (the user rules, via `lumo crossing disposition` or the web panel);
 - the note is shown to the human reviewer at disposition time, kept for later review, and explicitly labeled _agent self-report · unverified_;
 - `<id>` must be a crossing on the **session-bound task** (resolved from `$CLAUDE_CODE_SESSION_ID`; cross-task targets and unbound/mismatched sessions are rejected);
 - earlier explanations are immutable — a correction is a new note.
 
+### Recording the user's ruling — `lumo crossing disposition` (LUM-769)
+
+When the user has ruled on a crossing — in chat, after you relayed it — record
+that ruling from the terminal instead of sending them to the web panel:
+
+```bash
+lumo crossing disposition <id> --false-positive --note "covered by the run-outbound tests"
+```
+
+It is a gated mutation on the [confirmation protocol](confirmation.md), as a **three-step** handshake — two envelopes, two separate approvals from the user, and the server enforces the order:
+
+- **Step 1 — no step flag.** Reads the crossing, obtains a server-signed stage-1 **read receipt**, and prints an exit-4 envelope — severity, category, detail, `Seen ×N` when it recurred, every explanation you left (labelled _agent self-report · unverified_), the note, a `⚠` line saying that approving clears this crossing's block on DONE (plus `⚠ HIGH severity` / `⚠ Irreversible category` when they apply), and `Step 1 of 2 — read receipt issued … valid until <time>`. Nothing is written. Relay every line and **ask the user to confirm they have read it** — this envelope's `confirmCommand` ends in `--receipt <r1> --confirm-read`, not `--confirm`;
+- **Step 2 — `--confirm-read --receipt <r1>`**, only after the user says they read it. The server verifies r1 and returns the stage-2 receipt; the CLI prints a second exit-4 envelope for the ruling itself — `Read acknowledged … (shown <t1>, acknowledged <t2>)`, `Step 2 of 2 — record the ruling: OPEN → FALSE_POSITIVE`, the note, the ⚠ consequence line. Still nothing written. Relay it and **ask the user to approve the ruling** — its `confirmCommand` ends in `--receipt <r2> --confirm`;
+- **Step 3 — `--confirm --receipt <r2>`**, only after the user approves. POSTs the ruling (`FALSE_POSITIVE` | `CONFIRMED`, optional note, the stage-2 receipt); either value clears that crossing's DONE block, and the audit row records the shown / read-acknowledged / confirmed times. The web panel can still correct it later. **Never add `--confirm-read` or `--confirm` yourself** — each is the user's approval of that step, and the server records the ruling as a CLI-channel disposition (shown as _via CLI_ in the panel) precisely because it cannot verify the in-chat approvals;
+- **the receipts are the server's ordering check** (LUM-769): each is bound to the crossing, the ruling, your session/member and the crossing's state at read time, and expires after 10 minutes. Confirming the ruling with the stage-1 receipt (read not yet acknowledged) is refused — locally before any request, and by the server with 409 — and told to run `--confirm-read` first; a step flag without its receipt, or both step flags at once, is refused locally; a receipt that is forged, expired, for another reader/ruling, or older than the crossing's latest change (a recurrence, a new explanation, a ruling) is refused by the server with 409 and nothing is written — re-run without a step flag for a fresh envelope. If the server cannot issue receipts (no signing secret configured) step 1 fails closed and no envelope is printed;
+- the crossing is read first on both paths: a read that errors **fails closed** (exit 1, nothing written), an id not on the task is exit 1, and an already-matching ruling is a no-op (exit 0);
+- `<id>` resolves against the **session-bound task**; `--task <LUM-N>` overrides the binding (e.g. from a terminal with no session, or after DONE unbinds you);
+- **still web-only:** reverting a ruling to OPEN, repository suppression rules (LUM-751), and steward milestone crossings (`STEWARD_IMPLEMENTATION_ARTIFACT` has no task).
+
+After the last blocker is cleared, re-run the original `lumo task update <id> --status done --confirm` — its envelope was already approved.
+
 ### --json contract
 
 `--json` emits the full read model with a top-level `version` field (currently

package/dist/cli/src/commands/crossing-disposition.js

@@ -0,0 +1,342 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeCrossingDisposition = describeCrossingDisposition;
+exports.describeRulingConfirmation = describeRulingConfirmation;
+exports.crossingDisposition = crossingDisposition;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const confirmation_1 = require("../lib/confirmation");
+const bound_task_1 = require("../lib/bound-task");
+const open_crossings_1 = require("../lib/open-crossings");
+/**
+ * The changes[] block of the read envelope (step 1, exit 4): what ruling is
+ * about to be recorded, on which crossing, with everything the user needs to
+ * judge it — severity, category, detail, recurrence, and the agent's own
+ * explanations (labelled as an unverified self-report). The ⚠ lines carry
+ * the consequence: approving clears this crossing's block on DONE.
+ */
+function describeCrossingDisposition(crossing, target, ctx) {
+    const lines = [
+        `Will disposition crossing ${(0, sanitize_1.sanitizeField)(crossing.id)} on ${ctx.taskIdentifier} as ${target}`,
+        `Disposition: ${crossing.disposition ?? 'OPEN'} → ${target}`,
+    ];
+    const detail = (0, sanitize_1.sanitizeField)(crossing.detail).replace(/\s+/g, ' ').trim();
+    lines.push(`[${crossing.severity}] ${(0, sanitize_1.sanitizeField)(crossing.category)}${detail ? ` — ${detail}` : ''}`);
+    if ((crossing.occurrenceCount ?? 1) > 1) {
+        lines.push(`Seen ×${crossing.occurrenceCount} while open`);
+    }
+    const explanations = crossing.explanations ?? [];
+    if (explanations.length === 0) {
+        lines.push('Agent explanations: none recorded');
+    }
+    else {
+        lines.push(`Agent explanations (${explanations.length}, agent self-report · unverified):`);
+        for (const e of explanations) {
+            lines.push(`  - ${(0, sanitize_1.sanitizeField)(e.note).replace(/\s+/g, ' ').trim()}`);
+        }
+    }
+    if (ctx.note)
+        lines.push(`Note to record: ${(0, sanitize_1.sanitizeField)(ctx.note)}`);
+    if (crossing.advisory) {
+        lines.push('Advisory crossing — it never blocked DONE; the ruling is for the record only');
+    }
+    else {
+        lines.push(`⚠ Approving clears this crossing's block on moving ${ctx.taskIdentifier} to DONE`);
+    }
+    if (crossing.severity === 'HIGH') {
+        lines.push('⚠ HIGH severity — this class always needs a human decision; make sure the user has read the detail above');
+    }
+    if (crossing.reversible === false) {
+        lines.push('⚠ Irreversible category — the action reached outside the repo; a false-positive ruling should rest on the detail, not on the explanation alone');
+    }
+    return lines;
+}
+/**
+ * The changes[] block of the ruling envelope (step 2, exit 4): the read is
+ * acknowledged and recorded; what remains is the ruling itself.
+ */
+function describeRulingConfirmation(crossing, target, ctx) {
+    const lines = [
+        `Read acknowledged for crossing ${(0, sanitize_1.sanitizeField)(crossing.id)} (shown ${ctx.readAt}, acknowledged ${ctx.readAcknowledgedAt}) — recorded with the ruling`,
+        `Step 2 of 2 — record the ruling: ${crossing.disposition ?? 'OPEN'} → ${target} on ${ctx.taskIdentifier}`,
+    ];
+    if (ctx.note)
+        lines.push(`Note to record: ${(0, sanitize_1.sanitizeField)(ctx.note)}`);
+    lines.push(crossing.advisory
+        ? 'Advisory crossing — it never blocked DONE; the ruling is for the record only'
+        : `⚠ Approving clears this crossing's block on moving ${ctx.taskIdentifier} to DONE`);
+    return lines;
+}
+/**
+ * `lumo crossing disposition <id> --false-positive | --confirmed [--note …]
+ * [--task LUM-N] [--receipt <token>] [--confirm-read | --confirm]` — rule on
+ * a boundary crossing from the terminal (LUM-769), through a THREE-step
+ * confirmation handshake the server enforces:
+ *
+ *   1. no step flag: read the crossing, obtain a stage-1 READ RECEIPT
+ *      (bound to crossing, ruling, caller and the crossing's current state),
+ *      print the read envelope (exit 4), write nothing. Its confirmCommand
+ *      carries `--receipt <r1> --confirm-read`;
+ *   2. `--confirm-read --receipt <r1>`: the user confirmed they read it. The
+ *      server verifies r1 and issues the stage-2 receipt; the CLI prints the
+ *      ruling envelope (exit 4), write nothing. Its confirmCommand carries
+ *      `--receipt <r2> --confirm`;
+ *   3. `--confirm --receipt <r2>`: the user approved the ruling. The server
+ *      verifies r2 — a stage-1 receipt is refused with "confirm read first",
+ *      as is anything forged, expired, foreign or stale — then writes, with
+ *      the shown / acknowledged / confirmed timestamps on the audit row.
+ *
+ * Skipping or reordering a step is refused at the CLI before any request
+ * where it can be told locally (no receipt, a stage-1 receipt with --confirm,
+ * a stage-2 receipt with --confirm-read) and by the server otherwise. The
+ * agent relays each envelope and never supplies a step flag on its own.
+ * Server-side the ruling is stamped `channel: 'CLI'` so the audit trail keeps
+ * it apart from a web-panel click. What stays web-only: reverting to OPEN and
+ * the repository suppression rule — neither exists on this path.
+ */
+async function crossingDisposition(crossingId, options = {}) {
+    if (!crossingId || crossingId.trim() === '') {
+        console.error('Error: a crossing id is required: lumo crossing disposition <id> --false-positive | --confirmed');
+        return 1;
+    }
+    const target = pickTarget(options);
+    if (!target) {
+        console.error('Error: pass exactly one of --false-positive or --confirmed (the ruling to record).');
+        return 1;
+    }
+    if (options.confirmRead && options.confirm) {
+        console.error('Error: --confirm-read and --confirm are separate steps — run them one at a time, each from the envelope the previous step printed.');
+        return 1;
+    }
+    const note = options.note?.trim() || undefined;
+    const receipt = options.receipt?.trim() || undefined;
+    // Local ordering checks — cheap, and they name the missing step before any
+    // request goes out. The server re-checks all of them.
+    if (options.confirm) {
+        if (!receipt) {
+            console.error('Error: --confirm requires the stage-2 read receipt (--receipt <token>) from the --confirm-read step. Run the command without any step flag first, relay the envelope, confirm the read, relay that envelope, then re-run its confirmCommand verbatim.');
+            return 1;
+        }
+        if (receipt.startsWith('r1.')) {
+            console.error('Error: read not yet acknowledged — this is the stage-1 receipt. Run the command with --confirm-read --receipt <this token> first (after the user confirms they read the envelope); only the receipt that step returns is accepted with --confirm.');
+            return 1;
+        }
+    }
+    if (options.confirmRead) {
+        if (!receipt) {
+            console.error('Error: --confirm-read requires the read receipt (--receipt <token>) from the envelope. Run the command without any step flag first and relay the envelope.');
+            return 1;
+        }
+        if (receipt.startsWith('r2.')) {
+            console.error('Error: this receipt already acknowledges the read — the next step is --confirm with this same receipt (after the user approves the ruling).');
+            return 1;
+        }
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
+    const bound = await (0, bound_task_1.resolveBoundTask)({
+        base,
+        headers,
+        explicit: options.task,
+        sessionId,
+    });
+    if (!bound.ok) {
+        console.error(bound.message);
+        return 1;
+    }
+    const taskId = bound.taskIdentifier;
+    // Read the crossing first, on every path: the envelopes need it, and a
+    // confirmed write against a crossing that can't be read must not go out
+    // (fail closed — a read hiccup never turns into a blind ruling).
+    const read = await readCrossing(base, headers, taskId, crossingId);
+    if (read.status === 'error') {
+        console.error(`Error: could not confirm the crossing (${read.reason}) — nothing was written.`);
+        return 1;
+    }
+    const crossing = read.crossing;
+    if (!crossing) {
+        console.error(`Error: crossing ${(0, sanitize_1.sanitizeField)(crossingId)} not found on ${taskId}. Ids are listed by \`lumo task status ${taskId}\`.`);
+        return 1;
+    }
+    if (crossing.disposition === target) {
+        process.stdout.write(`Crossing ${(0, sanitize_1.sanitizeField)(crossing.id)} is already ${target} — nothing to do.\n`);
+        return;
+    }
+    // Step 1 — read envelope.
+    if (!options.confirmRead && !options.confirm) {
+        const issued = await requestReceipt(base, headers, taskId, crossingId, {
+            disposition: target,
+        });
+        if (issued.status === 'error') {
+            console.error(`Error: could not obtain a read receipt for the crossing (${issued.reason}) — nothing was written and no envelope can be issued.`);
+            return 1;
+        }
+        return (0, confirmation_1.emitConfirmation)({
+            command: 'crossing disposition',
+            changes: [
+                ...describeCrossingDisposition(crossing, target, {
+                    taskIdentifier: taskId,
+                    note,
+                }),
+                `Step 1 of 2 — read receipt issued for this crossing as read above (valid until ${issued.expiresAt}; void if the crossing changes). Next: the user confirms they have READ it, then run the command below; the ruling itself is confirmed in a second envelope`,
+            ],
+            confirmFlag: '--confirm-read',
+            receipt: { token: issued.receipt, expiresAt: issued.expiresAt },
+        });
+    }
+    // Step 2 — acknowledge the read, get the stage-2 receipt, ruling envelope.
+    if (options.confirmRead) {
+        const issued = await requestReceipt(base, headers, taskId, crossingId, {
+            disposition: target,
+            acknowledge: receipt,
+        });
+        if (issued.status === 'error') {
+            console.error(`Error: read acknowledgement rejected (${issued.reason}) — nothing was written.`);
+            return 1;
+        }
+        return (0, confirmation_1.emitConfirmation)({
+            command: 'crossing disposition',
+            changes: describeRulingConfirmation(crossing, target, {
+                taskIdentifier: taskId,
+                note,
+                readAt: issued.readAt,
+                readAcknowledgedAt: issued.readAcknowledgedAt ?? issued.readAt,
+            }),
+            confirmFlag: '--confirm',
+            receipt: { token: issued.receipt, expiresAt: issued.expiresAt },
+        });
+    }
+    // Step 3 — the write.
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(taskId)}/boundary-crossings/${encodeURIComponent(crossingId)}/disposition`, {
+            method: 'POST',
+            headers: { ...headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                disposition: target,
+                ...(note ? { dispositionNote: note } : {}),
+                receipt,
+            }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        const errBody = (await res.json().catch(() => null));
+        const detail = errBody && typeof errBody.error === 'string'
+            ? (0, sanitize_1.sanitizeField)(errBody.error)
+            : '';
+        console.error(`Error: disposition rejected (HTTP ${res.status})${detail ? ` — ${detail}` : ''}`);
+        return 1;
+    }
+    const outcome = (await res.json());
+    const url = (0, open_crossings_1.dispositionUrl)(apiUrl, creds.workspaceSlug ?? '', taskId);
+    process.stdout.write(`✓ Dispositioned crossing ${(0, sanitize_1.sanitizeField)(outcome.crossingId)} as ${outcome.disposition ?? 'OPEN'} (read acknowledged and ruling approved via CLI).\n` +
+        (crossing.advisory
+            ? ''
+            : `  This clears its block on moving ${taskId} to DONE. `) +
+        `The ruling is audited on the task timeline as a CLI-channel disposition with the shown / read-acknowledged / confirmed times; it can be corrected in the web panel: ${url}\n`);
+    return;
+}
+function pickTarget(options) {
+    if (options.falsePositive && options.confirmed)
+        return null;
+    if (options.falsePositive)
+        return 'FALSE_POSITIVE';
+    if (options.confirmed)
+        return 'CONFIRMED';
+    return null;
+}
+/** The handshake's server call (LUM-769): stage 1 without `acknowledge`,
+ *  stage 2 with the stage-1 receipt in it. Fails closed — without a receipt
+ *  no envelope is issued, because its confirmCommand could never be accepted. */
+async function requestReceipt(base, headers, taskId, crossingId, body) {
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(taskId)}/boundary-crossings/${encodeURIComponent(crossingId)}/disposition/receipt`, {
+            method: 'POST',
+            headers: { ...headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            reason: err instanceof Error ? err.message : 'network error',
+        };
+    }
+    if (!res.ok) {
+        const errBody = (await res.json().catch(() => null));
+        const detail = errBody && typeof errBody.error === 'string'
+            ? ` — ${(0, sanitize_1.sanitizeField)(errBody.error)}`
+            : '';
+        return { status: 'error', reason: `HTTP ${res.status}${detail}` };
+    }
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        return { status: 'error', reason: 'invalid response body' };
+    }
+    if (typeof data.receipt !== 'string' || data.receipt.length === 0) {
+        return { status: 'error', reason: 'no receipt in response' };
+    }
+    const str = (v) => (typeof v === 'string' ? v : '');
+    return {
+        status: 'ok',
+        receipt: data.receipt,
+        expiresAt: str(data.expiresAt),
+        readAt: str(data.readAt),
+        readAcknowledgedAt: typeof data.readAcknowledgedAt === 'string'
+            ? data.readAcknowledgedAt
+            : null,
+    };
+}
+/** One task-scoped read of the LUM-435 view; the crossing picked by id. Fails
+ *  closed: transport / non-ok / unparseable → error, never "not found". */
+async function readCrossing(base, headers, taskId, crossingId) {
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(taskId)}/boundary-crossings`, { headers });
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            reason: err instanceof Error ? err.message : 'network error',
+        };
+    }
+    if (res.status === 401) {
+        return { status: 'error', reason: 'API key invalid or revoked' };
+    }
+    if (!res.ok)
+        return { status: 'error', reason: `HTTP ${res.status}` };
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        return { status: 'error', reason: 'invalid response body' };
+    }
+    const rows = Array.isArray(data.crossings) ? data.crossings : [];
+    return { status: 'ok', crossing: rows.find(c => c.id === crossingId) ?? null };
+}

package/dist/cli/src/commands/crossing-explain.js

@@ -4,14 +4,16 @@ exports.crossingExplain = crossingExplain;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const bound_task_1 = require("../lib/bound-task");
 /**
  * `lumo crossing explain <id> --note "…"` — append an agent self-explanation
  * ("申辩") to a boundary crossing (LUM-542).
  *
  * This is the AGENT side of the boundary-crossing review loop and the deliberate
  * inverse of dispositioning: it can only ADD an append-only note for the human
- * reviewer to weigh — it never clears the crossing or unblocks Done (a human
- * dispositions that, in the web acceptance panel). The crossing must belong to
+ * reviewer to weigh — it never clears the crossing or unblocks Done (the user
+ * rules on that: `lumo crossing disposition` through the exit-4 confirmation
+ * protocol, or the web acceptance panel). The crossing must belong to
  * the task this session is bound to; the binding is how the target task is
  * resolved, so run it inside a session attached via `lumo session attach`.
  */
@@ -39,24 +41,9 @@ async function crossingExplain(crossingId, options = {}) {
         headers['X-Lumo-Session-Id'] = sessionId;
     // The crossing is addressed by id, but the route is task-scoped — resolve the
     // bound task from the session so the server can verify the crossing is on it.
-    if (!sessionId) {
-        console.error('Error: $CLAUDE_CODE_SESSION_ID is not set — run inside a session bound via `lumo session attach <LUM-N>`.');
-        return 1;
-    }
-    let bound;
-    try {
-        const res = await fetch(`${base}/api/sessions/${encodeURIComponent(sessionId)}`, { headers });
-        bound = res.ok
-            ? (await res.json())
-            : null;
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`Error: could not reach Lumo API (${msg})`);
-        return 1;
-    }
-    if (!bound?.taskIdentifier) {
-        console.error('Error: this session is not bound to a task. Run `lumo session attach <LUM-N>` first.');
+    const bound = await (0, bound_task_1.resolveBoundTask)({ base, headers, sessionId });
+    if (!bound.ok) {
+        console.error(bound.message);
         return 1;
     }
     const taskId = bound.taskIdentifier;
@@ -88,6 +75,8 @@ async function crossingExplain(crossingId, options = {}) {
     const outcome = (await res.json());
     process.stdout.write(`✓ Recorded an explanation on crossing ${(0, sanitize_1.sanitizeField)(outcome.crossingId)}.\n` +
         '  This is an append-only note for the human reviewer — it does not clear ' +
-        'the crossing or unblock Done.\n');
+        'the crossing or unblock Done. Once the user rules, record it with ' +
+        '`lumo crossing disposition <id> --false-positive | --confirmed` (exit-4 envelope) ' +
+        'or in the web panel.\n');
     return;
 }

package/dist/cli/src/commands/task-status.js

@@ -43,7 +43,11 @@ function formatSecurityAction(a) {
     const where = a.line == null ? a.filePath : `${a.filePath}:${a.line}`;
     const title = (0, sanitize_1.sanitizeField)(a.statement.split(' — ').slice(1).join(' — '));
     const tag = a.blocking ? 'blocks DONE' : 'advisory';
-    return `[${a.severity}] ${a.provenance} ${(0, sanitize_1.sanitizeField)(a.ruleId)} — ${(0, sanitize_1.sanitizeField)(where)} — ${title} (PR #${a.prNumber} · ${tag})`;
+    // LUM-758 follow-up: a downgraded row is still reported on purpose, so the
+    // line has to say WHY it is LOW — otherwise a placeholder the scanner already
+    // recognised reads as an unexplained credential.
+    const note = (0, sanitize_1.sanitizeField)((0, security_scan_1.secretDowngradeNote)(a.secretDowngrade));
+    return `[${a.severity}] ${a.provenance} ${(0, sanitize_1.sanitizeField)(a.ruleId)} — ${(0, sanitize_1.sanitizeField)(where)} — ${title} (PR #${a.prNumber} · ${tag}${note})`;
 }
 const SECURITY_HINT = 'Fix the findings and push (a fixed finding disappears on the next scan), or ask a human to disposition them in the web delivery panel — disposition is human-only, you cannot disposition them yourself, and a blocking finding refuses DONE with 409.';
 /** Render the `[SECURITY]` next-action lines (LUM-737 review): shared by the
@@ -57,40 +61,39 @@ function pushSecurityActions(lines, securityActions) {
 /** Fail-closed security coverage lines (LUM-737): a failed read and every
  *  open PR without a successful scan are stated, never left silent. */
 const EXTERNAL_ERROR_TAIL = 200;
-const SCAN_STAGE_ORDER = [
-    'secrets',
-    'external',
-    'supplyChain',
-    'judge',
-    'hunt',
-];
+const SCAN_STAGE_ORDER = security_scan_1.SCAN_STAGE_KEYS;
 /** LUM-735 — one line per linked PR's latest scan: `PR #945 · scan CLEAN ·
- *  secrets RAN · external RAN (2 external findings) · supplyChain RAN
- *  (1 dependency finding, 1 already on main) · judge RAN · hunt RAN`.
+ *  Secrets: checked · Code scan: checked (2 external findings) ·
+ *  Dependencies: checked (1 dependency finding, 1 already on main) ·
+ *  AI review: checked · Exploit paths: checked`.
  *  Stage segments only for keys present, in
  *  secrets/external/supplyChain/judge/hunt order (LUM-739 added the hunt
- *  layer); the `(N external findings)` count only decorates the external
+ *  layer); the `(N external findings)` count only decorates the Code scan
  *  segment, the dependency count (LUM-738, with its already-on-main share)
- *  only the supplyChain segment, and each only when N > 0. */
+ *  only the Dependencies segment, and each only when N > 0.
+ *  LUM-763: the stage keys are internal — what prints is the display label
+ *  from `shared/src/security-scan.ts`, the same map the GitHub PR summary
+ *  and the web panel render from. */
 function formatScanSummaryLine(s) {
     const segments = [];
     for (const key of SCAN_STAGE_ORDER) {
         const state = s.stages[key];
         if (!state)
             continue;
+        const head = `${(0, security_scan_1.scanStageLabel)(key)}: ${(0, security_scan_1.scanStageStateLabel)(state)}`;
         if (key === 'external' && s.externalFindings > 0) {
             const noun = s.externalFindings === 1 ? 'finding' : 'findings';
-            segments.push(`external ${state} (${s.externalFindings} external ${noun})`);
+            segments.push(`${head} (${s.externalFindings} external ${noun})`);
         }
         else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
             const n = s.dependencyFindings ?? 0;
             const noun = n === 1 ? 'finding' : 'findings';
             const persisting = s.persistingFindings ?? 0;
             const tail = persisting > 0 ? `, ${persisting} already on main` : '';
-            segments.push(`supplyChain ${state} (${n} dependency ${noun}${tail})`);
+            segments.push(`${head} (${n} dependency ${noun}${tail})`);
         }
         else {
-            segments.push(`${key} ${state}`);
+            segments.push(head);
         }
     }
     let line = `  PR #${s.prNumber} · scan ${s.status}`;
@@ -108,6 +111,29 @@ function formatScanSummaryLine(s) {
     }
     return line;
 }
+/**
+ * LUM-762 — the hunt's per-task read-out, one indented line under its scan:
+ * `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done
+ * (2 attempts) · t3 race skipped`. Headed by the same display label as the
+ * layer's own segment (LUM-763) — the detail line and the line above it
+ * must not name the layer two different ways. This is the only place the stored `huntAudit` surfaces, so
+ * it is what answers "how long does a healthy batch take" and "which ones
+ * never ran" (`skipped`) without paging through deploy logs. Elapsed time is
+ * summed over a task's attempts; a skipped task has none to print.
+ *
+ * LUM-758: a plan may hold two tasks of the same category, so the row is led
+ * by its task id. Pre-task-graph audits carry no id — the row then prints
+ * exactly as it always did.
+ */
+function formatHuntCoverageLine(hunt) {
+    const parts = hunt.categories.map(c => {
+        const attempts = c.attempts > 1 ? ` (${c.attempts} attempts)` : '';
+        const spent = c.stopped === 'skipped' ? '' : `${(c.elapsedMs / 1000).toFixed(1)}s `;
+        const id = c.taskId === undefined ? '' : `${c.taskId} `;
+        return `${id}${c.category} ${spent}${c.stopped}${attempts}`;
+    });
+    return `    ${(0, security_scan_1.scanStageLabel)('hunt')} ${hunt.done}/${hunt.total} done · ${parts.join(' · ')}`;
+}
 function pushSecurityCoverage(lines, data) {
     if (data.securityFindings === undefined)
         return; // older server
@@ -118,6 +144,10 @@ function pushSecurityCoverage(lines, data) {
     // LUM-735: absent `scans` = older server; tolerate silently, no block.
     for (const s of data.securityFindings.scans ?? []) {
         lines.push(formatScanSummaryLine(s));
+        // LUM-762: absent/null = older server or no usable audit — stay silent.
+        if (s.hunt && s.hunt.categories.length > 0) {
+            lines.push(formatHuntCoverageLine(s.hunt));
+        }
     }
     for (const u of data.securityFindings.unconfirmedPrs) {
         const why = u.reason === 'NONE'
@@ -589,7 +619,7 @@ function pushOpenCrossings(lines, extras) {
         lines.push(`  • [${c.severity}] ${(0, sanitize_1.sanitizeField)(c.category)}${tail}`);
         lines.push(`    ${formatAttribution(c.attribution)}`);
     }
-    lines.push('  Disposition is human-only in the web acceptance panel:');
+    lines.push("  Disposition is the user's call: relay each crossing, then `lumo crossing disposition <id> --false-positive | --confirmed` (exit-4 envelope; never self-approve), or the web acceptance panel:");
     if (extras.dispositionUrl) {
         lines.push(`    ${extras.dispositionUrl}`);
     }

package/dist/cli/src/index.js

@@ -66,6 +66,7 @@ const priority_1 = require("./commands/priority");
 const criteria_audit_1 = require("./commands/criteria-audit");
 const verify_1 = require("./commands/verify");
 const crossing_explain_1 = require("./commands/crossing-explain");
+const crossing_disposition_1 = require("./commands/crossing-disposition");
 const outcome_1 = require("./commands/outcome");
 const task_context_1 = require("./commands/task-context");
 const task_create_1 = require("./commands/task-create");
@@ -274,12 +275,23 @@ program
     .action(wrap((task, options) => (0, verify_1.verify)(task, options)));
 const crossing = program
     .command('crossing')
-    .description('Inspect and annotate boundary crossings');
+    .description('Inspect, annotate and (with user approval) disposition boundary crossings');
 crossing
     .command('explain <id>')
     .description('Append an agent self-explanation ("申辩") to a boundary crossing (LUM-542). Append-only and for the human reviewer — it never clears the crossing or unblocks Done (a human dispositions that). Targets a crossing on the session-bound task.')
     .requiredOption('--note <text>', 'The explanation to record (the rationale for the action / why it may be a false positive)')
     .action(wrap((id, options) => (0, crossing_explain_1.crossingExplain)(id, options)));
+crossing
+    .command('disposition <id>')
+    .description("Rule on a boundary crossing from the terminal (LUM-769) through a three-step confirmation handshake the server enforces: (1) no step flag — prints the crossing (severity, detail, agent explanations) as an envelope with a stage-1 read receipt, exit 4, writes nothing; (2) --confirm-read --receipt <r1> after the user confirms they READ it — returns the stage-2 receipt and a second envelope for the ruling, exit 4; (3) --confirm --receipt <r2> after the user approves the ruling — writes. Confirming before the read is acknowledged is refused and told to confirm the read first. Relay each envelope; never supply a step flag yourself. Either ruling clears the crossing's block on DONE and is audited as a CLI-channel disposition. Reverting to OPEN and repository suppression rules stay web-only. Targets a crossing on the session-bound task unless --task is given.")
+    .option('--false-positive', 'Rule the crossing a false positive (not a real issue)')
+    .option('--confirmed', 'Rule the crossing confirmed (a real issue, acknowledged)')
+    .option('--note <text>', 'Optional disposition note recorded with the ruling')
+    .option('--task <identifier>', 'Task the crossing belongs to (defaults to the session-bound task)')
+    .option('--receipt <token>', "Read receipt from the previous step's envelope (its confirmCommand carries it); required with --confirm-read (stage 1 receipt) and --confirm (stage 2 receipt), verified server-side")
+    .option('--confirm-read', 'Step 2: the user confirmed they have read the envelope (never add this on your own initiative). Returns the ruling envelope; writes nothing')
+    .option('--confirm', 'Step 3: the user approved the ruling (never add this on your own initiative). Refused unless the read was confirmed first')
+    .action(wrap((id, options) => (0, crossing_disposition_1.crossingDisposition)(id, options)));
 const outcome = program
     .command('outcome')
     .description('Read the post-hoc outcome well (LUM-598)');

package/dist/cli/src/lib/blocked-error.js

@@ -13,10 +13,14 @@ exports.emitBlocked = emitBlocked;
  * The confirmation protocol (confirmation.ts, exit 4) covers mutations the
  * USER can approve. Some refusals are different in kind: the server's DONE
  * gates — an unresolved send-back, an undispositioned boundary crossing, a
- * blocking security finding — are verdicts on the agent's own work, and by
- * design there is no CLI path to clear them (the interested party may not
- * adjudicate itself). Echoing the 409 text and exiting 1 left the agent
- * grepping prose to learn that. Instead the CLI now:
+ * blocking security finding — are verdicts on the agent's own work, and the
+ * agent may not adjudicate itself: nothing on `task update` clears them.
+ * Since LUM-769 a boundary crossing does have a terminal path, but it is the
+ * USER's — `lumo crossing disposition` walks the same exit-4 protocol (the
+ * agent relays the crossing, the user rules, the agent re-runs with the
+ * approval flag); send-backs and security findings stay human-side / web.
+ * Echoing the 409 text and exiting 1 left the agent grepping prose to learn
+ * that. Instead the CLI now:
  *
  *   1. recognises the gate refusal (`isDoneGateRefusal`);
  *   2. re-reads the existing read models — `GET …/status` for send-backs and
@@ -100,9 +104,10 @@ async function collectDoneBlockers(args) {
     return { blockers, unconfirmed };
 }
 /**
- * One line per blocker kind present. Every line names a human-side path or
- * the append-only `crossing explain` — never a flag or command that would let
- * the agent clear its own blocker.
+ * One line per blocker kind present. Every line names a human-side path, the
+ * append-only `crossing explain`, or the user-approved `crossing disposition`
+ * (exit-4 protocol) — never a ready-to-run flag that would let the agent
+ * clear its own blocker on its own initiative.
  */
 function buildRemediation(blockers, unconfirmed, ctx) {
     const kinds = new Set(blockers.map(b => b.kind));
@@ -114,7 +119,7 @@ function buildRemediation(blockers, unconfirmed, ctx) {
         const ids = blockers
             .filter(b => b.kind === 'BOUNDARY_CROSSING')
             .map(b => b.id);
-        lines.push(`BOUNDARY_CROSSING: leave a rationale with \`lumo crossing explain ${ids[0]} --note "…"\` (append-only; it does not clear anything). A human dispositions each crossing (false positive / confirmed) at ${ctx.dispositionUrl}`);
+        lines.push(`BOUNDARY_CROSSING: leave a rationale with \`lumo crossing explain ${ids[0]} --note "…"\` (append-only; it does not clear anything), then relay each crossing to the user. Once they rule, record it with \`lumo crossing disposition ${ids[0]} --false-positive\` or \`--confirmed\` — it prints an exit-4 envelope for the user to approve; never self-approve. The web panel also works: ${ctx.dispositionUrl}`);
     }
     if (kinds.has('SECURITY_FINDING')) {
         lines.push('SECURITY_FINDING: fix and push — a fixed fingerprint disappears from the next scan — or a human marks it false positive / accepted risk in the web delivery panel.');
@@ -167,7 +172,7 @@ function renderBlocked(err, isTTY) {
         '',
         'What can move it:',
         ...err.remediation.map(r => `  - ${r}`),
-        `  Disposition (human-only): ${err.dispositionUrl}`,
+        `  Web disposition panel: ${err.dispositionUrl}`,
     ];
     return lines.join('\n') + '\n';
 }

package/dist/cli/src/lib/bound-task.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBoundTask = resolveBoundTask;
+async function resolveBoundTask(args) {
+    const explicit = args.explicit?.trim();
+    if (explicit)
+        return { ok: true, taskIdentifier: explicit };
+    if (!args.sessionId) {
+        return {
+            ok: false,
+            message: 'Error: $CLAUDE_CODE_SESSION_ID is not set — run inside a session bound via `lumo session attach <LUM-N>`, or pass --task <LUM-N>.',
+        };
+    }
+    let bound;
+    try {
+        const res = await fetch(`${args.base}/api/sessions/${encodeURIComponent(args.sessionId)}`, { headers: args.headers });
+        bound = res.ok
+            ? (await res.json())
+            : null;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, message: `Error: could not reach Lumo API (${msg})` };
+    }
+    if (!bound?.taskIdentifier) {
+        return {
+            ok: false,
+            message: 'Error: this session is not bound to a task. Run `lumo session attach <LUM-N>` first, or pass --task <LUM-N>.',
+        };
+    }
+    return { ok: true, taskIdentifier: bound.taskIdentifier };
+}

package/dist/cli/src/lib/confirmation.js

@@ -42,27 +42,54 @@ function shellQuote(arg) {
         return arg;
     return `'${arg.replace(/'/g, `'\\''`)}'`;
 }
+/** Flags that belong to a previous step of a handshake and must not carry
+ *  over into the next step's command: the step flags themselves and a prior
+ *  `--receipt <token>` pair (the next envelope brings its own receipt). */
+const STEP_FLAGS = new Set(['--confirm', '--confirm-read']);
+function stripStepFlags(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (STEP_FLAGS.has(a))
+            continue;
+        if (a === '--receipt') {
+            i++; // drop its value too
+            continue;
+        }
+        if (a.startsWith('--receipt='))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
 /**
- * Rebuild the invocation the user ran, plus `--confirm` (and any
- * `extraFlags`). Flags already present in argv are never duplicated, and
- * `--confirm` always lands last so the command reads as "…, approved".
+ * Rebuild the invocation the user ran, plus the approval flag (default
+ * `--confirm`) and any `extraFlags`. Step flags and a prior `--receipt` from
+ * an earlier handshake step are dropped first, flags already present in argv
+ * are never duplicated, and the approval flag always lands last so the
+ * command reads as "…, approved".
  */
-function buildConfirmCommand(argv = process.argv.slice(2), extraFlags = []) {
-    const kept = argv.filter(a => a !== '--confirm');
+function buildConfirmCommand(argv = process.argv.slice(2), extraFlags = [], confirmFlag = '--confirm') {
+    const kept = stripStepFlags(argv);
     const parts = ['lumo', ...kept.map(shellQuote)];
     for (const flag of extraFlags) {
         if (!kept.includes(flag))
             parts.push(flag);
     }
-    parts.push('--confirm');
+    parts.push(confirmFlag);
     return parts.join(' ');
 }
 function buildEnvelope(input) {
+    const extraFlags = [
+        ...(input.extraFlags ?? []),
+        ...(input.receipt ? ['--receipt', input.receipt.token] : []),
+    ];
     return {
         status: 'confirmation_required',
         command: input.command,
         changes: input.changes,
-        confirmCommand: buildConfirmCommand(input.argv, input.extraFlags),
+        confirmCommand: buildConfirmCommand(input.argv, extraFlags, input.confirmFlag ?? '--confirm'),
+        ...(input.receipt ? { receipt: input.receipt } : {}),
     };
 }
 /** JSON for pipes; the same fields as readable text for a terminal. */
@@ -72,7 +99,10 @@ function renderConfirmation(envelope, isTTY) {
     const lines = [
         `Confirmation required — \`lumo ${envelope.command}\` was not run.`,
         ...envelope.changes.map(c => `  - ${c}`),
-        'Re-run with --confirm once the user has approved:',
+        ...(envelope.receipt
+            ? [`Read receipt issued (valid until ${envelope.receipt.expiresAt}).`]
+            : []),
+        `Re-run with ${envelope.confirmCommand.endsWith('--confirm-read') ? '--confirm-read' : '--confirm'} once the user has approved:`,
         `  ${envelope.confirmCommand}`,
     ];
     return lines.join('\n') + '\n';

package/dist/cli/src/lib/open-crossings.js

@@ -28,9 +28,9 @@ function normalizeSeverity(s) {
  * first, via the EXISTING LUM-435 read endpoint — `GET …/boundary-crossings`
  * returns every crossing (open and dispositioned); we keep only the
  * undispositioned ones (`disposition == null`). This is the **read/awareness**
- * half of the acceptance loop: there is no new query and, by construction, no
- * way to clear a crossing — disposition stays web + human-only
- * (LUM-426/435/422).
+ * half of the acceptance loop: there is no new query and this helper cannot
+ * clear anything — a ruling goes through `lumo crossing disposition` (exit-4
+ * user approval, LUM-769) or the web panel.
  *
  * Fails *closed*, not open (LUM-480): any transport / non-ok HTTP / parse
  * failure returns `{ status: 'error', reason }` so the caller can say "check
@@ -75,9 +75,9 @@ async function fetchOpenCrossings(apiUrl, token, taskIdentifier) {
     return { status: 'ok', crossings };
 }
 /**
- * The web deep link where a HUMAN dispositions crossings. Disposition is
- * web-only and human-only (LUM-426/435/422); the terminal only ever points
- * here, it never clears anything itself. Built from the workspace slug +
+ * The web deep link where a human dispositions crossings in the panel — the
+ * counterpart of `lumo crossing disposition` (LUM-769); the awareness surfaces
+ * (task status, DONE_BLOCKED) point here. Built from the workspace slug +
  * identifier alone (the `/my-tasks/<id>` route needs no project slug), so no
  * extra fetch is required.
  */

package/dist/shared/src/security-scan.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXTERNAL_ERROR_PREFIX = void 0;
+exports.SECRET_DOWNGRADE_LABELS = exports.SCAN_STAGE_STATE_LABELS = exports.SCAN_STAGE_LABELS = exports.SCAN_STAGE_STATES = exports.SCAN_STAGE_KEYS = exports.EXTERNAL_ERROR_PREFIX = void 0;
 exports.externalFailureReason = externalFailureReason;
+exports.scanStageLabel = scanStageLabel;
+exports.scanStageStateLabel = scanStageStateLabel;
+exports.secretDowngradeNote = secretDowngradeNote;
 /**
  * PR security scan — the one `PrSecurityScan.error` shape that may be shown
  * as an external-scanner reason (spec P8). Shared by the web panel, the PR
@@ -27,3 +30,96 @@ function externalFailureReason(error) {
     const reason = error.slice(exports.EXTERNAL_ERROR_PREFIX.length);
     return reason.length > 0 ? reason : null;
 }
+/**
+ * LUM-763 — the scan's five layers, as stored.
+ *
+ * These keys are a persisted contract, not a display choice: they sit in
+ * `PrSecurityScan.stages` on every historical row, travel over the
+ * task-status API, and are read by CLIs older than this change. They do not
+ * get renamed; only what a reader is shown does.
+ */
+exports.SCAN_STAGE_KEYS = [
+    'secrets',
+    'external',
+    'supplyChain',
+    'judge',
+    'hunt',
+];
+/** The states a layer can be in. `ScanStageState` in `lib/security-scan/types.ts` derives from this. */
+exports.SCAN_STAGE_STATES = [
+    'RAN',
+    'FAILED',
+    'SKIPPED',
+    'NOT_CONFIGURED',
+    'PENDING',
+    'PARTIAL',
+    'SUPERSEDED',
+];
+/**
+ * What each layer is called where a person reads it — the PR comment and
+ * `lumo task status`, which share this map so the two cannot drift (the web
+ * panel renders the same wording through `securityScan.stage.*` in i18n).
+ *
+ * Named for what the layer checks, never for who runs it or which model it
+ * uses: `external` was accurate only while the scanners were the customer's,
+ * and stopped being true the moment Lumo started running them itself.
+ */
+exports.SCAN_STAGE_LABELS = {
+    secrets: 'Secrets',
+    external: 'Code scan',
+    supplyChain: 'Dependencies',
+    judge: 'AI review',
+    hunt: 'Exploit paths',
+};
+/**
+ * What each state is called. `RAN` deliberately reads as "checked", not as a
+ * tick or "clean": it means the layer completed, and a layer that completed
+ * may well have found something — the findings are counted on their own
+ * lines. Only the states that leave the scan incomplete carry a glyph, so
+ * attention is drawn to "do not trust this line" and never to "this is fine"
+ * (spec P9 — a security signal never claims safety it did not establish).
+ */
+exports.SCAN_STAGE_STATE_LABELS = {
+    RAN: 'checked',
+    FAILED: '✗ failed',
+    SKIPPED: 'skipped',
+    NOT_CONFIGURED: 'off',
+    PENDING: 'scanning',
+    PARTIAL: '⚠ incomplete',
+    SUPERSEDED: '⚠ superseded',
+};
+/** The layer's display name; an unrecognised key renders as itself rather than vanishing. */
+function scanStageLabel(key) {
+    return exports.SCAN_STAGE_LABELS[key] ?? key;
+}
+/** The state's display name; an unrecognised state renders as itself. */
+function scanStageStateLabel(state) {
+    return exports.SCAN_STAGE_STATE_LABELS[state] ?? state;
+}
+/**
+ * LUM-758 follow-up — why a deterministic secret hit was lowered to LOW.
+ *
+ * Downgrading is not suppression: the row is still reported, deliberately, so
+ * that a human decides. But a reported row with no stated cause reads as an
+ * unexplained credential, which is how a test fixture the scanner *already
+ * recognised* as a placeholder ends up looking like an open risk. These say
+ * which rule fired, in the same words on every surface.
+ *
+ * Phrased as a property of the value or the path, never as a verdict: the
+ * scanner knows the string looks like a placeholder, not that it is harmless.
+ */
+exports.SECRET_DOWNGRADE_LABELS = {
+    PLACEHOLDER_VALUE: 'placeholder value',
+    DOWNGRADED_PATH: 'test/fixture/doc path',
+};
+/**
+ * The parenthesised note appended to a rendered finding line, or `''` when the
+ * row carries no downgrade — an unrecognised reason renders as itself rather
+ * than vanishing, so a value added server-side is never silently dropped by an
+ * older CLI.
+ */
+function secretDowngradeNote(reason) {
+    if (!reason)
+        return '';
+    return ` — ${exports.SECRET_DOWNGRADE_LABELS[reason] ?? reason}, downgraded`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.59.0",
+  "version": "1.60.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",