@martinloop/mcp 0.8.9 → 0.9.0

package/dist/vendor/core/resume.d.ts

@@ -1,18 +1,28 @@
 import type { LoopRecord, RollbackBoundaryArtifact } from "../contracts/index.js";
 export interface RunExecutionLease {
-    schemaVersion: "martin.execution-lease.v1";
+    schemaVersion: "martin.execution-lease.v2";
     runId: string;
     token: string;
     owner: string;
     pid: number;
     hostname: string;
     acquiredAt: string;
+    capabilities: {
+        runControl: boolean;
+    };
+    processInstanceId: string;
+    heartbeatAt: string;
+    heartbeatSequence: number;
 }
 export interface AcquiredRunExecutionLease {
     lease: RunExecutionLease;
     path: string;
     release(): Promise<void>;
 }
+export interface ActiveRunExecutionLease {
+    lease: RunExecutionLease;
+    path: string;
+}
 export interface ResumeVerifierFailure {
     command: string;
     exitCode?: number;
@@ -36,4 +46,18 @@ export declare function acquireRunExecutionLease(input: {
     now?: () => string;
     host?: string;
     pid?: number;
+    runControlCapable?: boolean;
+}, hooks?: {
+    beforeStaleReclaim?: () => Promise<void>;
 }): Promise<AcquiredRunExecutionLease>;
+/**
+ * Returns the persisted execution lease only when its schema, run identity,
+ * supported owner and local process liveness are all authoritative. Control
+ * surfaces use this to avoid accepting commands for an abandoned or incapable
+ * executor.
+ */
+export declare function readActiveRunExecutionLease(input: {
+    runsRoot: string;
+    runId: string;
+    host?: string;
+}): Promise<ActiveRunExecutionLease | undefined>;

package/dist/vendor/core/resume.js

@@ -1,9 +1,12 @@
 /// <reference types="node" />
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, open, readFile, unlink } from "node:fs/promises";
+import { link, lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { hostname } from "node:os";
 import { join } from "node:path";
-import { artifactDir } from "./persistence/index.js";
+import { performance } from "node:perf_hooks";
+import { artifactDir, resolveReceiptIntegrityRoot } from "./persistence/index.js";
+import { authenticateManagedPathExclusions, RollbackStateUnavailableError } from "./rollback.js";
+const locallyOwnedExecutionLeases = new Map();
 export function evaluateRunResumability(loop) {
     if (loop.terminationEnvelope) {
         return { allowed: false, reason: "The run already has authoritative terminal evidence." };
@@ -73,7 +76,14 @@ export async function loadResumeCandidateBoundary(runsRoot, loop) {
         }
         throw error;
     });
-    return JSON.parse(raw);
+    const boundary = JSON.parse(raw);
+    if (loop.task.repoRoot) {
+        authenticateManagedPathExclusions(loop.task.repoRoot, boundary, [runsRoot, resolveReceiptIntegrityRoot()]);
+    }
+    else if (boundary.managedPathExclusions !== undefined) {
+        throw new RollbackStateUnavailableError("Rollback boundary managed path exclusions cannot be authenticated without a repository root.");
+    }
+    return boundary;
 }
 export async function loadResumeVerifierFailure(runsRoot, loop) {
     const attempt = loop.attempts.at(-1);
@@ -106,7 +116,7 @@ export async function loadResumeVerifierFailure(runsRoot, loop) {
         attemptIndex: attempt.index
     };
 }
-export async function acquireRunExecutionLease(input) {
+export async function acquireRunExecutionLease(input, hooks = {}) {
     const now = input.now ?? (() => new Date().toISOString());
     const host = input.host ?? hostname();
     const pid = input.pid ?? process.pid;
@@ -115,14 +125,18 @@ export async function acquireRunExecutionLease(input) {
     const path = join(directory, leaseFile);
     await mkdir(directory, { recursive: true });
     const token = `${pid}-${randomBytes(16).toString("hex")}`;
-    const lease = {
-        schemaVersion: "martin.execution-lease.v1",
+    let lease = {
+        schemaVersion: "martin.execution-lease.v2",
         runId: input.runId,
         token,
         owner: input.owner,
         pid,
         hostname: host,
-        acquiredAt: now()
+        acquiredAt: now(),
+        capabilities: { runControl: input.runControlCapable === true },
+        processInstanceId: randomBytes(16).toString("hex"),
+        heartbeatAt: wallClockIso(),
+        heartbeatSequence: 0
     };
     for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
@@ -134,10 +148,36 @@ export async function acquireRunExecutionLease(input) {
             finally {
                 await handle.close();
             }
+            const heartbeatPath = executionLeaseHeartbeatPath(path, lease.processInstanceId);
+            await writeLeaseAtomically(heartbeatPath, lease);
+            locallyOwnedExecutionLeases.set(path, `${lease.token}:${lease.processInstanceId}`);
+            let active = true;
+            let heartbeatPromise;
+            const heartbeat = setInterval(() => {
+                if (!active || heartbeatPromise)
+                    return;
+                const nextLease = {
+                    ...lease,
+                    heartbeatAt: wallClockIso(),
+                    heartbeatSequence: lease.heartbeatSequence + 1
+                };
+                heartbeatPromise = writeLeaseAtomically(heartbeatPath, nextLease)
+                    .then(() => { lease = nextLease; })
+                    .catch(() => undefined)
+                    .finally(() => { heartbeatPromise = undefined; });
+            }, 500);
+            heartbeat.unref();
             return {
                 lease,
                 path,
                 async release() {
+                    active = false;
+                    clearInterval(heartbeat);
+                    await heartbeatPromise;
+                    if (locallyOwnedExecutionLeases.get(path) ===
+                        `${lease.token}:${lease.processInstanceId}`) {
+                        locallyOwnedExecutionLeases.delete(path);
+                    }
                     try {
                         const existing = JSON.parse(await readFile(path, "utf8"));
                         if (existing.token === token)
@@ -147,29 +187,163 @@ export async function acquireRunExecutionLease(input) {
                         if (error.code !== "ENOENT")
                             throw error;
                     }
+                    await unlink(heartbeatPath).catch((error) => {
+                        if (error.code !== "ENOENT")
+                            throw error;
+                    });
                 }
             };
         }
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
-            const existing = await readLease(path);
+            const existing = await readLeaseWithHeartbeat(path);
             if (!existing)
                 continue;
             if (existing.hostname !== host) {
                 throw new Error(`Run ${input.runId} is leased by ${existing.owner} on ${existing.hostname}; refusing cross-host takeover.`);
             }
-            if (isProcessAlive(existing.pid)) {
+            if (isProcessAlive(existing.pid) && isFreshExecutionLease(existing)) {
                 throw new Error(`Run ${input.runId} is already executing under ${existing.owner} (pid ${existing.pid}).`);
             }
-            await unlink(path).catch((unlinkError) => {
-                if (unlinkError.code !== "ENOENT")
-                    throw unlinkError;
-            });
+            await hooks.beforeStaleReclaim?.();
+            await reclaimStaleExecutionLease(path, existing);
         }
     }
     throw new Error(`Unable to acquire execution lease for run ${input.runId}.`);
 }
+async function reclaimStaleExecutionLease(path, observed) {
+    const claimPath = `${path}.reclaim-${createHash("sha256")
+        .update(`${observed.token}:${observed.processInstanceId}`)
+        .digest("hex")
+        .slice(0, 24)}`;
+    try {
+        // The deterministic hard-link claim atomically elects one reclaimer for
+        // the observed lease inode. A stale observer can never unlink a successor.
+        await link(path, claimPath);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "EEXIST" || code === "ENOENT")
+            return false;
+        throw error;
+    }
+    try {
+        const claimedStat = await lstat(claimPath);
+        const claimed = await readLease(claimPath);
+        const currentStat = await lstat(path).catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (!claimed ||
+            !currentStat ||
+            claimed.token !== observed.token ||
+            claimed.processInstanceId !== observed.processInstanceId ||
+            claimedStat.dev !== currentStat.dev ||
+            claimedStat.ino !== currentStat.ino) {
+            return false;
+        }
+        await unlink(path);
+        await unlink(executionLeaseHeartbeatPath(path, observed.processInstanceId)).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+        return true;
+    }
+    finally {
+        await unlink(claimPath).catch(() => undefined);
+    }
+}
+/**
+ * Returns the persisted execution lease only when its schema, run identity,
+ * supported owner and local process liveness are all authoritative. Control
+ * surfaces use this to avoid accepting commands for an abandoned or incapable
+ * executor.
+ */
+export async function readActiveRunExecutionLease(input) {
+    const host = input.host ?? hostname();
+    const directory = join(input.runsRoot, ".execution-leases");
+    const leaseFile = `${createHash("sha256").update(input.runId).digest("hex")}.json`;
+    const path = join(directory, leaseFile);
+    const lease = await readLeaseWithHeartbeat(path);
+    if (!isAdmissibleActiveLease(lease, input.runId, host))
+        return undefined;
+    // Same-process executors have a stronger identity proof than a sampled
+    // heartbeat: the unguessable token/instance pair is held in live memory.
+    // A stale lease whose PID was reused cannot satisfy this binding.
+    if (lease.pid === process.pid &&
+        locallyOwnedExecutionLeases.get(path) === `${lease.token}:${lease.processInstanceId}`) {
+        return { lease, path };
+    }
+    // A PID can be reused after the former owner crashes. Require the same
+    // unguessable process instance to advance its heartbeat before admitting a
+    // mutation; PID liveness alone is never authority.
+    await new Promise((resolve) => setTimeout(resolve, 650));
+    const confirmed = await readLeaseWithHeartbeat(path);
+    if (!isAdmissibleActiveLease(confirmed, input.runId, host) ||
+        confirmed.token !== lease.token ||
+        confirmed.processInstanceId !== lease.processInstanceId ||
+        confirmed.heartbeatSequence <= lease.heartbeatSequence) {
+        return undefined;
+    }
+    return { lease: confirmed, path };
+}
+function isAdmissibleActiveLease(lease, runId, host) {
+    return Boolean(lease &&
+        lease.schemaVersion === "martin.execution-lease.v2" &&
+        lease.runId === runId &&
+        Boolean(lease.token) &&
+        ["runMartin", "runMartin:resume"].includes(lease.owner) &&
+        lease.capabilities?.runControl === true &&
+        lease.hostname === host &&
+        isProcessAlive(lease.pid) &&
+        isFreshExecutionLease(lease));
+}
+function isFreshExecutionLease(lease) {
+    const heartbeat = Date.parse(lease.heartbeatAt);
+    const now = wallClockMs();
+    return Number.isFinite(heartbeat) && now - heartbeat <= 2_000 && heartbeat <= now + 5_000;
+}
+function wallClockMs() {
+    return performance.timeOrigin + performance.now();
+}
+function wallClockIso() {
+    return new Date(wallClockMs()).toISOString();
+}
+async function writeLeaseAtomically(path, lease) {
+    const temporaryPath = `${path}.heartbeat-${process.pid}-${randomBytes(8).toString("hex")}`;
+    const handle = await open(temporaryPath, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(lease, null, 2)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporaryPath, path);
+    }
+    finally {
+        await unlink(temporaryPath).catch(() => undefined);
+    }
+}
+function executionLeaseHeartbeatPath(path, processInstanceId) {
+    return `${path}.${processInstanceId}.heartbeat`;
+}
+async function readLeaseWithHeartbeat(path) {
+    const lease = await readLease(path);
+    if (!lease || lease.schemaVersion !== "martin.execution-lease.v2" || !lease.processInstanceId) {
+        return lease;
+    }
+    const heartbeat = await readLease(executionLeaseHeartbeatPath(path, lease.processInstanceId));
+    if (!heartbeat ||
+        heartbeat.token !== lease.token ||
+        heartbeat.processInstanceId !== lease.processInstanceId) {
+        return lease;
+    }
+    return heartbeat;
+}
 async function readLease(path) {
     try {
         return JSON.parse(await readFile(path, "utf8"));

package/dist/vendor/core/rollback.d.ts

@@ -10,12 +10,16 @@ export declare class RollbackStateUnavailableError extends Error {
 export declare function listAttemptChangedFilesSinceBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
+    /** Trusted, currently configured MartinLoop-owned roots. */
+    managedRoots?: string[];
     /** Include content changes to dirty/untracked paths that existed at the boundary. */
     includeBaselineSnapshotChanges?: boolean;
 }): string[];
 export declare function captureRollbackBoundary(input: {
     repoRoot?: string;
     capturedAt: string;
+    /** Absolute, configured MartinLoop-owned roots to exclude when contained in the repo. */
+    managedRoots?: string[];
 }): Promise<RollbackBoundaryArtifact | undefined>;
 /**
  * Git-ignored files the attempt created or modified since the boundary.
@@ -24,6 +28,8 @@ export declare function captureRollbackBoundary(input: {
 export declare function listIgnoredFileChangesSinceBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
+    /** Trusted, currently configured MartinLoop-owned roots. */
+    managedRoots?: string[];
 }): IgnoredFileChanges;
 export declare function restoreRollbackBoundary(input: {
     repoRoot?: string;
@@ -34,9 +40,17 @@ export declare function restoreRollbackBoundary(input: {
     removePaths?: string[];
     /** Pre-existing ignored paths to restore from the in-memory boundary. */
     restoreIgnoredPaths?: string[];
+    /** Trusted, currently configured MartinLoop-owned roots. */
+    managedRoots?: string[];
 }): Promise<RollbackOutcomeArtifact | undefined>;
 /**
  * Repo-relative links (symlinks or junctions) among `paths` whose target
  * resolves outside the repository. Paths are first collapsed to the link.
  */
 export declare function findEscapingLinks(repoRoot: string, paths: string[]): string[];
+export declare function filterManagedRollbackPaths(values: readonly string[], exclusions: readonly string[]): string[];
+/**
+ * Re-derive exclusion authority from trusted current configuration. Persisted
+ * rollback evidence records what was authorized, but never grants authority.
+ */
+export declare function authenticateManagedPathExclusions(repoRoot: string, boundary: RollbackBoundaryArtifact, managedRoots: readonly string[]): string[];

package/dist/vendor/core/rollback.js

@@ -2,7 +2,7 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { DEPENDENCY_AND_BUILD_DIRECTORIES, isInsideDependencyOrBuildDirectory } from "./output-directories.js";
 /** Past this many ignored files, further ignored directories stay collapsed. */
 const MAX_EXPANDED_IGNORED_FILES = 20_000;
@@ -25,25 +25,29 @@ export function listAttemptChangedFilesSinceBoundary(input) {
     }
     // Diff against the boundary commit (not the live HEAD) so that changes an
     // attempt commits are still reported as attempt changes.
-    const repoState = readRepoState(input.repoRoot, input.boundary?.headRef);
+    const exclusions = input.boundary
+        ? authenticateManagedPathExclusions(input.repoRoot, input.boundary, input.managedRoots ?? [])
+        : [];
+    const repoState = readRepoState(input.repoRoot, input.boundary?.headRef, exclusions);
     if (!input.boundary) {
         return uniqueSorted([...repoState.trackedDirtyFiles, ...repoState.untrackedFiles]);
     }
-    const baselineTracked = new Set(input.boundary.trackedDirtyFiles);
-    const baselineUntracked = new Set(input.boundary.untrackedFiles);
-    return uniqueSorted([
+    const baselineTracked = new Set(filterManagedRollbackPaths(input.boundary.trackedDirtyFiles, exclusions));
+    const baselineUntracked = new Set(filterManagedRollbackPaths(input.boundary.untrackedFiles, exclusions));
+    return filterManagedRollbackPaths(uniqueSorted([
         ...repoState.trackedDirtyFiles.filter((filePath) => !baselineTracked.has(filePath)),
         ...repoState.untrackedFiles.filter((filePath) => !baselineUntracked.has(filePath)),
         ...(input.includeBaselineSnapshotChanges
-            ? snapshotChangedPaths(input.repoRoot, input.boundary.snapshots)
+            ? snapshotChangedPaths(input.repoRoot, input.boundary.snapshots.filter((snapshot) => !isManagedRollbackPath(snapshot.path, exclusions)))
             : [])
-    ]);
+    ]), exclusions);
 }
 export async function captureRollbackBoundary(input) {
     if (!input.repoRoot) {
         return undefined;
     }
-    const repoState = readRepoState(input.repoRoot);
+    const managedPathExclusions = resolveManagedPathExclusions(input.repoRoot, input.managedRoots ?? []);
+    const repoState = readRepoState(input.repoRoot, "HEAD", managedPathExclusions);
     // Links are recorded by path only: their targets are never read or restored.
     const snapshotPaths = uniqueSorted([
         ...repoState.trackedDirtyFiles,
@@ -53,7 +57,7 @@ export async function captureRollbackBoundary(input) {
     for (const filePath of snapshotPaths) {
         snapshots.push(await readRollbackSnapshot(input.repoRoot, filePath));
     }
-    const observedIgnoredFiles = readIgnoredInventory(input.repoRoot);
+    const observedIgnoredFiles = readIgnoredInventory(input.repoRoot, managedPathExclusions);
     const ignoredFiles = observedIgnoredFiles.map(({ path, size, mtimeMs }) => ({
         path,
         size,
@@ -69,7 +73,8 @@ export async function captureRollbackBoundary(input) {
         trackedDirtyFiles: repoState.trackedDirtyFiles,
         untrackedFiles: repoState.untrackedFiles,
         snapshots,
-        ignoredFiles
+        ignoredFiles,
+        ...(managedPathExclusions.length > 0 ? { managedPathExclusions } : {})
     };
     ignoredObservations.set(boundary, new Map(observedIgnoredFiles.map((entry) => [entry.path, entry])));
     ignoredContentSnapshots.set(boundary, captureIgnoredContent(input.repoRoot, ignoredFiles));
@@ -80,16 +85,23 @@ export async function captureRollbackBoundary(input) {
  * Boundaries recorded before the ignored inventory existed report nothing.
  */
 export function listIgnoredFileChangesSinceBoundary(input) {
-    if (!input.repoRoot || !input.boundary?.ignoredFiles) {
+    if (!input.repoRoot || !input.boundary) {
         return makeIgnoredFileChanges([], [], []);
     }
-    const baseline = new Map(input.boundary.ignoredFiles.map((entry) => [entry.path, entry]));
+    const exclusions = authenticateManagedPathExclusions(input.repoRoot, input.boundary, input.managedRoots ?? []);
+    if (!input.boundary.ignoredFiles) {
+        return makeIgnoredFileChanges([], [], []);
+    }
+    const baseline = new Map(input.boundary.ignoredFiles
+        .filter((entry) => !isManagedRollbackPath(entry.path, exclusions))
+        .map((entry) => [entry.path, entry]));
     const baselineObservations = ignoredObservations.get(input.boundary);
     const created = [];
     const modified = [];
-    const currentEntries = readIgnoredInventory(input.repoRoot);
+    const currentEntries = readIgnoredInventory(input.repoRoot, exclusions);
     const current = new Map(currentEntries.map((entry) => [entry.path, entry]));
     const deleted = input.boundary.ignoredFiles
+        .filter((entry) => !isManagedRollbackPath(entry.path, exclusions))
         .filter((entry) => !current.has(entry.path))
         .map((entry) => entry.path);
     for (const entry of currentEntries) {
@@ -141,16 +153,18 @@ export async function restoreRollbackBoundary(input) {
             error: "Rollback boundary was unavailable for this attempt."
         };
     }
-    const before = readRepoState(input.repoRoot, input.boundary.headRef);
+    const exclusions = authenticateManagedPathExclusions(input.repoRoot, input.boundary, input.managedRoots ?? []);
+    const before = readRepoState(input.repoRoot, input.boundary.headRef, exclusions);
     const currentHead = readGitScalar(input.repoRoot, ["rev-parse", "HEAD"]);
     const headMoved = input.boundary.headRef !== undefined && currentHead !== input.boundary.headRef;
-    const removePaths = uniqueSorted(input.removePaths ?? []);
-    const restoreIgnoredPaths = uniqueSorted(input.restoreIgnoredPaths ?? []);
-    const snapshotsUnchanged = await rollbackSnapshotsMatch(input.repoRoot, input.boundary.snapshots);
+    const removePaths = filterManagedRollbackPaths(uniqueSorted(input.removePaths ?? []), exclusions);
+    const restoreIgnoredPaths = filterManagedRollbackPaths(uniqueSorted(input.restoreIgnoredPaths ?? []), exclusions);
+    const rollbackSnapshots = input.boundary.snapshots.filter((snapshot) => !isManagedRollbackPath(snapshot.path, exclusions));
+    const snapshotsUnchanged = await rollbackSnapshotsMatch(input.repoRoot, rollbackSnapshots);
     if (!headMoved &&
         removePaths.length === 0 &&
         restoreIgnoredPaths.length === 0 &&
-        repoStateMatchesBoundary(before, input.boundary) &&
+        repoStateMatchesBoundary(before, input.boundary, exclusions) &&
         snapshotsUnchanged) {
         return {
             attempted: false,
@@ -171,8 +185,8 @@ export async function restoreRollbackBoundary(input) {
             rewindAttemptCommits(input.repoRoot, input.boundary, currentHead);
             rewoundHead = { from: currentHead, to: input.boundary.headRef };
         }
-        const baselineTracked = new Set(input.boundary.trackedDirtyFiles);
-        const baselineUntracked = new Set(input.boundary.untrackedFiles);
+        const baselineTracked = new Set(filterManagedRollbackPaths(input.boundary.trackedDirtyFiles, exclusions));
+        const baselineUntracked = new Set(filterManagedRollbackPaths(input.boundary.untrackedFiles, exclusions));
         for (const filePath of before.trackedDirtyFiles) {
             if (!baselineTracked.has(filePath)) {
                 if (existsInHead(input.repoRoot, filePath)) {
@@ -192,7 +206,7 @@ export async function restoreRollbackBoundary(input) {
                 deletedFiles.add(filePath);
             }
         }
-        for (const snapshot of input.boundary.snapshots) {
+        for (const snapshot of rollbackSnapshots) {
             await restoreRollbackSnapshot(input.repoRoot, snapshot);
             if (snapshot.existed) {
                 restoredFiles.add(snapshot.path);
@@ -217,8 +231,8 @@ export async function restoreRollbackBoundary(input) {
             await writeFile(absolutePath, contents);
             restoredFiles.add(filePath);
         }
-        const after = readRepoState(input.repoRoot, input.boundary.headRef);
-        const restored = repoStateMatchesBoundary(after, input.boundary) &&
+        const after = readRepoState(input.repoRoot, input.boundary.headRef, exclusions);
+        const restored = repoStateMatchesBoundary(after, input.boundary, exclusions) &&
             (input.boundary.headRef === undefined ||
                 readGitScalar(input.repoRoot, ["rev-parse", "HEAD"]) === input.boundary.headRef);
         return {
@@ -237,7 +251,7 @@ export async function restoreRollbackBoundary(input) {
         };
     }
     catch (error) {
-        const after = readRepoState(input.repoRoot, input.boundary.headRef);
+        const after = readRepoState(input.repoRoot, input.boundary.headRef, exclusions);
         return {
             attempted: true,
             status: "failed",
@@ -251,13 +265,13 @@ export async function restoreRollbackBoundary(input) {
         };
     }
 }
-function readRepoState(repoRoot, baseRef = "HEAD") {
+function readRepoState(repoRoot, baseRef = "HEAD", managedPathExclusions = []) {
     return {
-        trackedDirtyFiles: readGitLines(repoRoot, ["diff", "--name-only", baseRef, "--", "."]),
+        trackedDirtyFiles: filterManagedRollbackPaths(readGitLines(repoRoot, ["diff", "--name-only", baseRef, "--", "."]), managedPathExclusions),
         // Git for Windows lists untracked files *through* junctions, so a link to a
         // directory outside the repo would otherwise surface that directory's files as
         // repo paths. Collapse every such path to the link itself.
-        untrackedFiles: collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard", "--", "."]))
+        untrackedFiles: filterManagedRollbackPaths(collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard", "--", "."])), managedPathExclusions)
     };
 }
 /**
@@ -357,10 +371,10 @@ function unstagePath(repoRoot, filePath) {
         throw new Error(`git rm --cached failed for ${filePath}: ${gitFailureMessage(result)}`);
     }
 }
-function readIgnoredInventory(repoRoot) {
+function readIgnoredInventory(repoRoot, managedPathExclusions = []) {
     const collapsed = collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, [
         "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "--", "."
-    ]));
+    ])).filter((entry) => !isManagedRollbackPath(entry, managedPathExclusions));
     const inventory = [];
     let expanded = 0;
     const hashBudget = { remainingBytes: MAX_HASHED_IGNORED_TOTAL_BYTES };
@@ -374,9 +388,9 @@ function readIgnoredInventory(repoRoot) {
         if (isDirectory && expanded >= MAX_EXPANDED_IGNORED_FILES) {
             throw new RollbackStateUnavailableError(`Ignored rollback inventory exceeds the ${String(MAX_EXPANDED_IGNORED_FILES)}-file observation limit at ${entry}`);
         }
-        const files = isDirectory
+        const files = (isDirectory
             ? collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, ["ls-files", "--others", "--ignored", "--exclude-standard", "--", entry]))
-            : [entry];
+            : [entry]).filter((filePath) => !isManagedRollbackPath(filePath, managedPathExclusions));
         for (const filePath of files) {
             if (expanded >= MAX_EXPANDED_IGNORED_FILES) {
                 throw new RollbackStateUnavailableError(`Ignored rollback inventory exceeds the ${String(MAX_EXPANDED_IGNORED_FILES)}-file observation limit at ${entry}`);
@@ -619,9 +633,8 @@ function resolveRepoPath(repoRoot, filePath, options = {}) {
     }
     return resolvedPath;
 }
-function repoStateMatchesBoundary(state, boundary) {
-    return arraysEqual(state.trackedDirtyFiles, boundary.trackedDirtyFiles) &&
-        arraysEqual(state.untrackedFiles, boundary.untrackedFiles);
+function repoStateMatchesBoundary(state, boundary, exclusions = []) {
+    return arraysEqual(state.trackedDirtyFiles, filterManagedRollbackPaths(boundary.trackedDirtyFiles, exclusions)) && arraysEqual(state.untrackedFiles, filterManagedRollbackPaths(boundary.untrackedFiles, exclusions));
 }
 function arraysEqual(left, right) {
     if (left.length !== right.length) {
@@ -632,6 +645,50 @@ function arraysEqual(left, right) {
 function uniqueSorted(values) {
     return [...new Set(values.map((value) => normalizeRepoPath(value)).filter(Boolean))].sort();
 }
+export function filterManagedRollbackPaths(values, exclusions) {
+    return values.filter((value) => !isManagedRollbackPath(value, exclusions));
+}
+/**
+ * Re-derive exclusion authority from trusted current configuration. Persisted
+ * rollback evidence records what was authorized, but never grants authority.
+ */
+export function authenticateManagedPathExclusions(repoRoot, boundary, managedRoots) {
+    const expected = resolveManagedPathExclusions(repoRoot, managedRoots);
+    const persistedValue = boundary.managedPathExclusions;
+    if (persistedValue !== undefined &&
+        (!Array.isArray(persistedValue) || persistedValue.some((entry) => typeof entry !== "string"))) {
+        throw new RollbackStateUnavailableError("Rollback boundary managed path exclusions are invalid and cannot be trusted.");
+    }
+    const persisted = uniqueSorted(persistedValue ?? []);
+    if (!arraysEqual(persisted, expected)) {
+        throw new RollbackStateUnavailableError("Rollback boundary managed path exclusions do not match the configured MartinLoop roots.");
+    }
+    return expected;
+}
+function isManagedRollbackPath(value, exclusions) {
+    const path = normalizeRepoPath(value).replace(/\/$/u, "");
+    return exclusions.some((entry) => {
+        const root = normalizeRepoPath(entry).replace(/\/$/u, "");
+        return root.length > 0 && (path === root || path.startsWith(`${root}/`));
+    });
+}
+function resolveManagedPathExclusions(repoRoot, roots) {
+    const absoluteRepoRoot = resolve(repoRoot);
+    return uniqueSorted(roots.flatMap((root) => {
+        const absoluteRoot = resolve(root);
+        const relativeRoot = relative(absoluteRepoRoot, absoluteRoot);
+        if (relativeRoot === "" ||
+            relativeRoot === ".." ||
+            relativeRoot.startsWith(`..${sep}`) ||
+            isAbsolute(relativeRoot)) {
+            return [];
+        }
+        // A configured link/junction is not an authenticated in-repository
+        // persistence root. Reuse rollback's link-safe resolver and fail closed.
+        resolveRepoPath(absoluteRepoRoot, relativeRoot);
+        return [relativeRoot];
+    }));
+}
 function normalizeRepoPath(value) {
     return value.trim().replace(/\\/gu, "/");
 }

package/dist/vendor/core/swarm/live-runtime.js

@@ -656,6 +656,8 @@ export async function runLiveSwarmWithDependencies(input, dependencies) {
                 }
             },
             metadata: {
+                executionMode: "governed",
+                governanceClaimEligible: "true",
                 "swarm.parentId": record.swarmId,
                 "swarm.agentId": agent.agentId,
                 "swarm.taskIds": JSON.stringify([task.taskId]),