@miller-tech/uap 2.21.2 → 2.36.1

package/dist/state/manifest.js

@@ -1,7 +1,7 @@
 /**
  * Implementation-State Manifest — a machine-generated snapshot of what this
  * project IS and where its implementation actually stands, derived from
- * ground truth (package.json, CHANGELOG, git branch, .factory registries)
+ * ground truth (package.json, git log, git branch, .factory registries)
  * rather than hand-maintained docs that drift.
  *
  * Written to `.uap/state-manifest.json`; the reactor injects a one-line
@@ -12,6 +12,7 @@
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from 'fs';
 import { join } from 'path';
+import { termSafeBounded } from '../utils/terminal-safe.js';
 const RECENT_CHANGES = 5;
 /** Digest re-generation threshold: a manifest older than this is stale. */
 const STALE_MS = 24 * 60 * 60 * 1000;
@@ -35,6 +36,30 @@ function gitBranch(projectRoot) {
         return undefined;
     }
 }
+/** Latest commit subjects, newest first — straight from the git log. Commit
+ * subjects are contributor-authored (untrusted) text: termSafeBounded strips
+ * terminal-control bytes, flattens to one line, and bounds the length, so a
+ * hostile subject cannot smuggle escapes or line structure into the digest. */
+function gitSubjects(projectRoot) {
+    try {
+        const out = execFileSync('git', ['log', '--pretty=%s', '-n', String(RECENT_CHANGES), '--no-merges'], {
+            cwd: projectRoot,
+            encoding: 'utf-8',
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            // Never inherit a poisoned GIT_DIR from a hook environment.
+            env: { ...process.env, GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_INDEX_FILE: undefined },
+        });
+        return out
+            .split('\n')
+            .map((line) => termSafeBounded(line, 160))
+            .filter(Boolean);
+    }
+    catch {
+        // not a git repo (or git unusable) — manifest still useful without it
+        return [];
+    }
+}
 function countEntries(dir) {
     try {
         if (!existsSync(dir))
@@ -59,20 +84,7 @@ export function generateStateManifest(projectRoot) {
     }
     const name = typeof pkg.name === 'string' ? pkg.name : 'unknown';
     const version = typeof pkg.version === 'string' ? pkg.version : '0.0.0';
-    const recentChanges = [];
-    try {
-        const changelog = readFileSync(join(projectRoot, 'CHANGELOG.md'), 'utf-8');
-        for (const line of changelog.split('\n')) {
-            if (line.startsWith('## ')) {
-                recentChanges.push(line.slice(3).trim().slice(0, 160));
-                if (recentChanges.length >= RECENT_CHANGES)
-                    break;
-            }
-        }
-    }
-    catch {
-        // no changelog — manifest still useful
-    }
+    const recentChanges = gitSubjects(projectRoot);
     const counts = {};
     const skillCount = countEntries(join(projectRoot, '.factory', 'skills'));
     const droidCount = countEntries(join(projectRoot, '.factory', 'droids'));
@@ -140,7 +152,11 @@ export function manifestDigest(manifest) {
         `${manifest.name} v${manifest.version}${manifest.branch ? ` (branch: ${manifest.branch})` : ''}`,
     ];
     if (manifest.recentChanges.length > 0) {
-        lines.push(`Recently shipped: ${manifest.recentChanges.slice(0, 3).join(' | ')}`.slice(0, 240));
+        // Choke-point defense: on the load path (readOrRefreshManifest) these
+        // entries can come from a planted .uap/state-manifest.json — re-strip
+        // before the digest reaches a session prompt.
+        const subjects = manifest.recentChanges.map((s) => termSafeBounded(s, 160));
+        lines.push(`Recently shipped: ${subjects.slice(0, 3).join(' | ')}`.slice(0, 240));
     }
     if (manifest.counts) {
         lines.push(Object.entries(manifest.counts)

package/dist/state/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/state/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC3G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAa5B,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE;YACrE,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,4DAA4D;YAC5D,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;SACjG,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,GAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAExE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvD,IAAI,aAAa,CAAC,MAAM,IAAI,cAAc;oBAAE,MAAM;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CACnD,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,aAAa;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,CAAC,4DAA4D;IAC/E,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;YACxE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACjG,CAAC;IACF,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC5B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/state/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC3G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAe5D,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE;YACrE,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,4DAA4D;YAC5D,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;SACjG,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;+EAG+E;AAC/E,SAAS,WAAW,CAAC,WAAmB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,EAAE;YACnG,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,4DAA4D;YAC5D,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;SACjG,CAAC,CAAC;QACH,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aACzC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,GAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAExE,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAE/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CACnD,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,aAAa;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,CAAC,4DAA4D;IAC/E,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;YACxE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACjG,CAAC;IACF,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,sEAAsE;QACtE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC5B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/utils/checkout-root.d.ts

@@ -0,0 +1,2 @@
+export declare function mainCheckoutRoot(projectRoot: string): string;
+//# sourceMappingURL=checkout-root.d.ts.map

package/dist/utils/checkout-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-root.d.ts","sourceRoot":"","sources":["../../src/utils/checkout-root.ts"],"names":[],"mappings":"AAoBA,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqB5D"}

package/dist/utils/checkout-root.js

@@ -0,0 +1,43 @@
+/**
+ * The main-checkout root anchor (moved from src/policies/liveness.ts so
+ * non-policy state can share it without importing the policies layer).
+ *
+ * The gate hook strips `/.worktrees/<name>` to find it
+ * (${CHECKOUT_ROOT%%/.worktrees/*}); the writers must anchor the same way or
+ * a worktree session — the workflow CLAUDE.md MANDATES — writes state and
+ * reads it back where other surfaces never look (review should-fix,
+ * 2026-07-13; reintroduced as a BLOCKER by the 2026-10-11 attention-queue
+ * review: dashboard cwd, hook PROJECT_DIR, and CLI cwd resolved three
+ * different queue files). Non-git roots (unit fixtures, tmp dirs) pass
+ * through unchanged.
+ */
+import { spawnSync } from 'child_process';
+import { sep } from 'path';
+/** Roots are stable for a process lifetime; callers resolve this on every
+ *  queue read/write and must not spawn git per call. */
+const cache = new Map();
+export function mainCheckoutRoot(projectRoot) {
+    const hit = cache.get(projectRoot);
+    if (hit !== undefined)
+        return hit;
+    let root = projectRoot;
+    try {
+        const r = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd: projectRoot,
+            encoding: 'utf-8',
+        });
+        if (r.status === 0) {
+            const top = (r.stdout ?? '').trim();
+            if (top) {
+                const i = top.indexOf(`${sep}.worktrees${sep}`);
+                root = i === -1 ? top : top.slice(0, i);
+            }
+        }
+    }
+    catch {
+        root = projectRoot;
+    }
+    cache.set(projectRoot, root);
+    return root;
+}
+//# sourceMappingURL=checkout-root.js.map

package/dist/utils/checkout-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-root.js","sourceRoot":"","sources":["../../src/utils/checkout-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3B;wDACwD;AACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;YAC3D,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;gBAChD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/resolve-uap-bin.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveUapBin(): {
+    cmd: string;
+    preArgs: string[];
+};
+//# sourceMappingURL=resolve-uap-bin.d.ts.map

package/dist/utils/resolve-uap-bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-uap-bin.d.ts","sourceRoot":"","sources":["../../src/utils/resolve-uap-bin.ts"],"names":[],"mappings":"AAeA,wBAAgB,aAAa,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAclE"}

package/dist/utils/resolve-uap-bin.js

@@ -0,0 +1,33 @@
+/**
+ * Resolve the uap executable for detached child spawns (deliver launch/resume,
+ * fleet dashboard spawn-on-demand).
+ *
+ * PATH often lacks the npm global bin, and a launch that silently died with
+ * ENOENT was a real dash-audit hazard. Resolution order:
+ *   1. UAP_BIN env override (operator/debug).
+ *   2. This module's own install: <root>/dist/bin/cli.js run with the SAME
+ *      node binary that runs the dashboard (no PATH, no shell).
+ *   3. Bare 'uap' as the last resort (interactive PATH).
+ */
+import { existsSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+export function resolveUapBin() {
+    if (process.env.UAP_BIN)
+        return { cmd: process.env.UAP_BIN, preArgs: [] };
+    try {
+        // ESM: this file is <root>/dist/utils/resolve-uap-bin.js
+        const selfUrl = import.meta.url;
+        if (selfUrl.startsWith('file:')) {
+            const here = fileURLToPath(selfUrl);
+            const cli = join(dirname(here), '..', 'bin', 'cli.js');
+            if (existsSync(cli))
+                return { cmd: process.execPath, preArgs: [cli] };
+        }
+    }
+    catch {
+        /* fall through to PATH */
+    }
+    return { cmd: 'uap', preArgs: [] };
+}
+//# sourceMappingURL=resolve-uap-bin.js.map

package/dist/utils/resolve-uap-bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-uap-bin.js","sourceRoot":"","sources":["../../src/utils/resolve-uap-bin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,yDAAyD;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC"}

package/dist/utils/terminal-safe.d.ts

@@ -0,0 +1,12 @@
+/** Strip terminal-control bytes (keeps tab/newline/CR). */
+export declare function termSafe(s: string): string;
+/**
+ * Same strip, then flatten to ONE line and bound the length — for strings
+ * that become prompt text or single-line display fields (model ids, labels).
+ * Line breaks are structure a hostile string must not smuggle in: collapsing
+ * them to a space keeps the text honest and the shape fixed.
+ */
+export declare function termSafeBounded(s: string, max: number): string;
+/** Strip ANSI escape sequences and every C0/C1 control byte (incl. newline). */
+export declare function stripControlChars(text: string): string;
+//# sourceMappingURL=terminal-safe.d.ts.map

package/dist/utils/terminal-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-safe.d.ts","sourceRoot":"","sources":["../../src/utils/terminal-safe.ts"],"names":[],"mappings":"AAcA,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9D;AAmBD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD"}

package/dist/utils/terminal-safe.js

@@ -0,0 +1,53 @@
+/**
+ * Terminal-safe rendering  — strip the C0/C1 control
+ * characters that could steer an operator's terminal from data we did not
+ * author: JSON report fields, analytics-store model ids, commit subjects.
+ *
+ * Kept characters: `\t`, `\n`, `\r` (layout, not control); everything else in
+ * C0 (U+0000–U+001F), DEL (U+007F), and C1 (U+0080–U+009F) is removed. This
+ * is defense-in-depth at ONE choke point, not a trust boundary: the strings
+ * it cleans come from repo/store files an operator could equally `cat` — but
+ * a UAP surface must not be a better terminal-injection mule than `cat`.
+ */
+// eslint-disable-next-line no-control-regex -- matching control bytes IS this module's job; the regex strips what it matches
+const CONTROL_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;
+/** Strip terminal-control bytes (keeps tab/newline/CR). */
+export function termSafe(s) {
+    return s.replace(CONTROL_CHARS, '');
+}
+/**
+ * Same strip, then flatten to ONE line and bound the length — for strings
+ * that become prompt text or single-line display fields (model ids, labels).
+ * Line breaks are structure a hostile string must not smuggle in: collapsing
+ * them to a space keeps the text honest and the shape fixed.
+ */
+export function termSafeBounded(s, max) {
+    return termSafe(s)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, max);
+}
+/**
+ * Sequence-aware strip — the strong form of `termSafe`. Removes whole ANSI
+ * OSC sequences (hyperlinks, window-title writes) and CSI sequences (colors,
+ * cursor movement) BEFORE deleting the remaining C0/C1 bytes. `termSafe` only
+ * deletes bytes, leaving a sequence's payload characters behind (an OSC-52
+ * clipboard write defangs to `]52;c;base64…`); this form removes the sequence
+ * entire. Unlike `termSafe` it also removes `\t`/`\n`/`\r` — callers that
+ * need single-line output or preserved layout must normalize whitespace
+ * FIRST, because a newline deleted after normalization cannot glue two
+ * words together.
+ */
+/* eslint-disable no-control-regex -- matching control bytes IS this module's job; the regexes strip what they match */
+const OSC_SEQUENCE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+const CSI_SEQUENCE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+const ANY_CONTROL_BYTE = /[\x00-\x1f\x7f-\x9f]/g;
+/* eslint-enable no-control-regex */
+/** Strip ANSI escape sequences and every C0/C1 control byte (incl. newline). */
+export function stripControlChars(text) {
+    return text
+        .replace(OSC_SEQUENCE, '')
+        .replace(CSI_SEQUENCE, '')
+        .replace(ANY_CONTROL_BYTE, '');
+}
+//# sourceMappingURL=terminal-safe.js.map

package/dist/utils/terminal-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-safe.js","sourceRoot":"","sources":["../../src/utils/terminal-safe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,6HAA6H;AAC7H,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,GAAW;IACpD,OAAO,QAAQ,CAAC,CAAC,CAAC;SACf,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,uHAAuH;AACvH,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,oCAAoC;AAEpC,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI;SACR,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/docs/ATTRIBUTION.md

@@ -27,6 +27,7 @@ The full dependency graph lives in `package.json`; these deserve explicit mentio
 because UAP embeds, vendors, or builds core workflows around them:
 
 - **[llama.cpp](https://github.com/ggml-org/llama.cpp) / ik_llama.cpp** — the local inference backend the whole local-model path (deliver, recipes, slot budgeting) is built against.
+- **[bubblewrap](https://github.com/containers/bubblewrap)** (GNOME) — the unprivileged kernel sandbox (`uap sandbox`) behind the sandboxed delivery path: read-only root mounts, per-session writable holes, and the `--unshare-net` egress cut are all bwrap primitives.
 - **Qwen** (Alibaba) — the local models UAP's local-first delivery pipeline is tuned for and benchmarked with.
 - **[Qdrant](https://qdrant.tech/)** + **nomic-embed-text** — the semantic long-term memory store and its embeddings.
 - **[uPlot](https://github.com/leeoniya/uPlot)** (MIT) — vendored (with license) in `web/vendor/` for the dashboard's charts.

package/docs/DASHBOARD_UPLIFT_SPEC.md

@@ -26,14 +26,14 @@ web/dash/core.js            data layer + app shell: WS/SSE/poll channels, global
                             api() POST helper, expand/collapse helpers, drill navigation (goAgent(id)).
 web/dash/charts.js          uPlot chart + sparkline builders (ported 1:1 from current behaviour).
 web/dash/styles.css         all CSS (ported + new tab/drawer/table/control styles), tokens only.
-web/dash/tab-overview.js    aggregate KPIs + hero charts + live summaries with drill links.
-web/dash/tab-tasks.js       Tasks & Epics: kanban + table + create/edit/status/assignee/delete + epic ledger.
-web/dash/tab-agents.js      Agents & Sessions: agent grid -> per-agent drawer; session history -> per-session drawer.
-web/dash/tab-orchestration.js  mission->epic->task tree + agents + orchestrate on/off/auto + ledger controls.
-web/dash/tab-deliver.js     deliver run registry list + launch form + cancel/resume + per-run telemetry.
-web/dash/tab-policies.js    policies table (existing controls) + compliance + audit + live events.
-web/dash/tab-models.js      models/routing config + session usage + routing decisions.
-web/dash/tab-memory.js      L1-L4 + compression + hit/miss gauge + recent queries + savings-by-influence.
+web/dash/tabs.js            inline tabs: overview (+ service-health strip) / tasks & epics kanban /
+                            agents / orchestration / deliver / memory. (The six per-tab stub
+                            files were dead weight — never loaded by dashboard.html — and
+                            were removed.)
+web/dash/tab-policies.js    full policies panel (order/view/duplicate/import/export) +
+                            compliance + audit + live events.
+web/dash/tab-models.js      models & placement: registry, ledger, pending placement
+                            apply/dismiss, unload, auto-load policy, preview.
 ```
 Server change: `server.ts` static handler currently serves `/vendor/`; extend it to ALSO serve
 `/dash/` (same path-traversal guard, content types add `.css`, `.js`).

package/docs/INDEX.md

@@ -1,13 +1,13 @@
 # UAP Documentation
 
-The complete documentation for the **Universal Agent Protocol** (`@miller-tech/uap` v2.11.0) — the discipline layer that turns a talented-but-unreliable AI coding agent into a dependable member of your software delivery line. 367 TypeScript modules across 26 subsystems, 459 vitest suites plus a ~1,200-test Python enforcer/proxy suite, 60+ CLI command registrations, 32 executable policy enforcers, 9 supported agent harnesses.
+The complete documentation for the **Universal Agent Protocol** (`@miller-tech/uap`) — the discipline layer that turns a talented-but-unreliable AI coding agent into a dependable member of your software delivery line. 447 TypeScript modules across 34 subsystems, 530 vitest suites (~6,250 tests) plus a ~1,400-test Python enforcer/proxy suite, 60 top-level CLI commands (~211 registrations including subcommands), 34 executable policy enforcers, 9 supported agent harnesses.
 
 > **Reviewing the system?** The reverse-engineered, code-verified reference set lives in
 > [`documentation/`](../documentation/architecture.md): architecture, flows, permissions
 > (incl. trust boundaries and enforcement gaps), variables/secrets, scheduled work, and
 > embedded automation. Start there for an honest map of what's enforced vs. documented.
 
-New here? The friendliest way in is the **[Delivery Pipeline tour](guides/DELIVERY_PIPELINE.md)** — it walks the whole factory floor, station by station, showing where agents normally break and what UAP puts in place to catch it. Then grab the [Quickstart](getting-started/QUICKSTART.md).
+New here? Start with the **[Delivery Pipeline tour](guides/DELIVERY_PIPELINE.md)** — it walks the whole factory floor, station by station, showing where agents normally break and what UAP puts in place to catch it, all under one principle: *enforce, don't suggest*. Then grab the [Quickstart](getting-started/QUICKSTART.md).
 
 ---
 
@@ -79,7 +79,7 @@ Full map: **[The UAP Delivery Pipeline](guides/DELIVERY_PIPELINE.md)**.
 | [Self-Harness](design/SELF_HARNESS.md) | Self-improving harness (shipped as `uap self-harness`): autonomous mine→propose→validate loop over a bounded Mod DSL; cross-model transfer, online mining |
 | [LLM Self-Tuning (analysis)](design/LLM_SELF_TUNING_ANALYSIS.md) | The design behind `uap tune`: quality signal, LLM-guided + Gaussian-process flag search, closed-loop validation, model profiles, real-time adaptation |
 | [Product Naming (analysis)](design/PRODUCT_NAMING.md) | UAP rename candidates: availability sweeps (npm/PyPI/domains), AI-space collision checks, railway-theme shortlist, recommendation. No decision committed; availability data is point-in-time |
-| [ADRs](architecture/adr/) | Architecture decision records: [0001 AutoMode risk floor](architecture/adr/0001-automode-risk-floor.md) (Python heuristic scorer ahead of the TS SYS1 head), [0002 Evidence-bound ship](architecture/adr/0002-evidence-bound-ship.md) (gate evidence bound to the candidate SHA) |
+| [ADRs](architecture/adr/) | Architecture decision records: [0001 AutoMode risk floor](architecture/adr/0001-automode-risk-floor.md) (Python heuristic scorer ahead of the TS SYS1 head), [0002 Evidence-bound ship](architecture/adr/0002-evidence-bound-ship.md) (gate evidence bound to the candidate SHA), … [0009 Completion-triggered dispatch + per-leaf model dials](architecture/adr/0009-completion-triggered-dispatch-and-per-leaf-model-dials.md), [0010 Attention queue + AFK auto-decider](architecture/adr/0010-attention-queue-and-afk-auto-decider.md), [0011 Sandbox grants + network egress boundary](architecture/adr/0011-sandbox-grants-and-network-egress-boundary.md), [0012 Operator legibility surfaces](architecture/adr/0012-operator-legibility-surfaces.md) |
 
 ## Reference
 
@@ -137,11 +137,12 @@ the decision record.
 
 | Doc | What it covers |
 |---|---|
-| [Deliver hardening plan](plans/deliver-hardening-plan-2026-07-13.md) | The 14-defect audit (batches A–D) that became v1.224.0: scoped rollback, declared gates, polyglot execution, config routing, liveness, operator overrides |
+| [Deliver hardening plan](plans/deliver-hardening-plan-2026-07-13.md) | The 14-defect hardening plan (batches A–D): scoped rollback, declared gates, polyglot execution, config routing, liveness, operator overrides |
 | [Deliver hardening review response](plans/deliver-hardening-review-response-2026-07-13.md) | Parallel-review findings and their dispositions — the rationale behind the root-owned trust model |
 | [Harness engineering uplift](plans/harness-engineering-uplift-2026-07-31.md) | Three-paper analysis of harness variance and what UAP does about it |
 | [K3 UAP uplift validation](plans/k3-uap-uplift-validation.md) | Plan to measure UAP's paired uplift on Kimi K3 by re-running Terminal-Bench 2.1 with Factory Droid as the harness, UAP on vs off |
-| [Qwen3.8 UAP re-test plan](plans/qwen38-uap-retest-plan.md) | Plan to re-run the paired benchmark matrix on the current local Qwen3.8-27B stack with UAP v1.224.x, replicating the +20pp gate-loop finding and checking the hardened deliver pipeline |
+| [Qwen3.8 UAP re-test plan](plans/qwen38-uap-retest-plan.md) | Plan to re-run the paired benchmark matrix on the current local Qwen3.8-27B stack, replicating the +20pp gate-loop finding and checking the hardened deliver pipeline |
+| [Model-performance proof options](plans/model-performance-proof-options.md) | The benchmark/test menu for demonstrating UAP's benefits with honest numbers: four separately-provable claims, six options (free-first), discrimination status required on every delta |
 | [System-1 uplift plan](plans/system1-uplift-2026-09-18.md) | Approved uplift from the 2026-09-18 ten-source analysis (Jev/Foreman/Fluent/CEK et al): Wave 0 quick wins + Wave 1 System-1 decision layer, local-only classifier trained from UAP telemetry |
 
 ## Specs & performance

package/docs/architecture/OVERVIEW.md

@@ -1,6 +1,10 @@
 # UAP Architecture Overview
 
-`v1.224.0` · 367 TypeScript modules across 26 `src/` subsystems · 459 vitest suites (+ a ~1,200-test Python enforcer/proxy suite)
+447 TypeScript modules across 34 `src/` subsystems · 530 vitest suites (~6,250 tests, + a ~1,400-test Python enforcer/proxy suite)
+
+> **Why it looks like this:** every station exists because a specific failure
+> class shows up there in real agentic delivery — the architecture is the
+> codified countermeasure, station by station.
 
 > **Code-verified reference:** this narrative overview is the intent-level floor plan. For
 > the reverse-engineered, implementation-accurate map — including trust boundaries,
@@ -52,6 +56,14 @@ to the subsystem that guards it. Read this as the conveyor belt your work rides:
 | **7. Shipping** — merge & release | regressions, broken CI, skipped version bumps | worktree→PR flow, version/completion gates, CI feedback watcher, never-regress, git-safety |
 | **8. Feedback** — learn from it | same mistake every session | **memory promotion**, pattern RL, session analysis |
 
+Three stations are tightened against the failure classes named in
+mtlynch.io's *Why Are Coding Agents So Dumb?*: plan **legibility** (a
+readability gate over plans + the version-pinned **self-knowledge card**),
+**scheduling** (completion-triggered dispatch with per-leaf model dials), and
+**autonomy** (the attention queue + AFK auto-decider: the agent asks instead
+of stopping, and an unattended decision adopts the recorded safe default,
+logged, never silent).
+
 Cross-cutting through every station: **policy gates** are the executable rules
 posted at each station, the **MCP Router** keeps the context lean so the belt
 never jams, and UAP runs across **9 harnesses** so the same floor plan applies
@@ -255,7 +267,7 @@ interpreter-mediated writes), memory-before-plan, MCP-router-first,
 and more. Levels: **REQUIRED** blocks, **RECOMMENDED** logs,
 **OPTIONAL** informs.
 
-Two trust anchors sit above the policies themselves (v1.224): the
+Two trust anchors sit above the policies themselves: the
 **operator-overrides file** (`.uap/operator-overrides.json` — temporary,
 expiring bypasses) and the **liveness cache** (`.uap/policy-liveness.json` —
 for policies that declare liveness requirements, a record that their compliant
@@ -273,7 +285,7 @@ compound invisibly until the codebase fights every change. This station turns
 ten software-quality metrics into a machine-checked budget that can only
 tighten.
 
-The quality-metrics gate (v1.223) polices cyclomatic/cognitive complexity,
+The quality-metrics gate polices cyclomatic/cognitive complexity,
 Halstead difficulty, LOC-per-file, coverage, CRAP, surviving mutants, dead
 code, duplicate blocks, and explicit `any`/`unknown` — deterministically, with
 no LLM in the loop. The built-in scanner (LOC, complexity, any-types) always

package/docs/architecture/PROTOCOL.md

@@ -1,6 +1,6 @@
 # The UAP Protocol
 
-`v1.224.0`
+`v2.30.0`
 
 > **🏭 Where this fits:** Cross-cutting (the factory rulebook) — with no shared
 > contract, each station's rules are guesswork and your agent slips broken work
@@ -77,6 +77,12 @@ hook, which MUST:
    this in the agent's context.
 2. **Clean stale state.** Deregister dead agents and release abandoned work
    claims so coordination state stays accurate.
+3. **Surface waiting decisions.** Sweep the operator attention queue —
+   grace-elapsed asks adopt their recorded safe default (logged on the item,
+   never silent); asks with no safe default escalate — then emit a bounded
+   block of still-open asks (plus a while-you-were-away summary) into the
+   session banner. Item text is rendered with an untrusted-data disclaimer;
+   `UAP_ATTENTION_OFF=1` silences the rail end-to-end.
 
 The hook is **self-healing and fail-open**: it auto-creates missing
 coordination/memory DBs and never exits non-zero. Its output is advisory

package/docs/architecture/adr/0006-operator-directed-model-placement.md

@@ -0,0 +1,86 @@
+# ADR 0006: Operator-directed model placement (registry + ledger + proxy gate)
+
+- Status: Accepted
+- Date: 2026-10-08
+- Spec: `docs/specs/operator-model-placement.md`
+
+## Context
+
+One 24 GiB GPU, seven placeable model configs, one of them resident and filling
+the card (measured 21,812 MiB of 24,576; host RSS 52.9 GiB of 121.7 GiB). Model
+switching today is a hand-run shell script (`~/.config/uap/model-switch.sh`)
+with no drain, no verification, and no rollback. The proxy forwards to a single
+upstream (`LLAMA_CPP_BASE`, one constant, 35 references) and has no model
+lifecycle at all. Requests for a non-resident model either fail or silently get
+rewritten by `_reconcile_wire_model()`.
+
+## Decision
+
+1. **Two-file registry.** Reviewed defaults in `config/model-registry.json`,
+   machine-local measured footprints in `~/.uap/model-registry.json`,
+   deep-merged local-over-repo, with per-field provenance reported by
+   `uap models validate`. Unknown cost fails closed: an unmeasured config can
+   be served if resident but can never be loaded or evicted. The registry
+   references the capacity policy rather than restating its numbers (ownership
+   table in the spec, §4.1).
+2. **Placement state lives in a versioned, advisory-locked ledger**
+   (`~/.uap/placement.json`). The ledger records intent; a live probe records
+   fact; when they disagree the probe wins and the disagreement is surfaced.
+3. **Enforcement is TypeScript, hosted on the dashboard server, invoked by the
+   Python proxy over loopback HTTP.** No new daemon; one process owns placement
+   state, and the TUI and dashboard read the same one. The proxy discovers the
+   controller via `PROXY_PLACEMENT_CONTROLLER` emitted by `uap setup`; the
+   control surface is loopback-bound regardless of the dashboard `--host`.
+4. **`paused` means weights offloaded and reloaded from disk later** — not the
+   proxy's existing save/restore, which checkpoints KV to host RAM and frees no
+   VRAM. Where an engine has no reload path, `paused` is display-only and the
+   only executable option is `kill`.
+5. **Admission runs in the proxy after wire-model resolution**, default
+   `PROXY_PLACEMENT_MODE=off`, gated per entry route (the gate is a function of
+   the resolved wire model, not a side effect of one route's rewrite step —
+   `_reconcile_wire_model` has exactly one call site). Parked requests get
+   `409 model_placement_pending`; the proxy never holds a socket across an
+   unbounded operator decision. A swap invalidates the proxy's process-lifetime
+   upstream-id cache before any pending request is released.
+6. **Leases and backpressure become target-keyed** with an additive
+   `target = 'default'` legacy bucket, preserving the
+   delete-then-count-then-insert transaction ordering that makes
+   `acquireModelSlot()` safe today. `target` is the placement target identity
+   (device + endpoint), never the model name. The migration is guarded by a
+   `PRAGMA table_info` probe (the coordination DB has no version marker), on the
+   precedent of `src/memory/short-term/schema.ts`.
+
+## Consequences
+
+Positive: placement decisions become data (`uap doctor`, `uap models validate`)
+instead of prose in profile files; displacement is expressed in MiB rather than
+unit names; the operator sees the victim list before committing, and
+enforcement aborts if the re-derived list differs.
+
+Negative: the proxy gains a control-plane dependency on the dashboard process
+(no dashboard means read-only admission and `reason: no_controller`); the
+teardown/start time envelope is unmeasured, so drain and hold timeouts ship as
+conservative defaults labelled unvalidated; the coordination DB gains a table
+rebuild with no version marker, so the migration must be probe-guarded;
+per-target upstream addressing (phase 1.5) is a prerequisite refactor in the
+17k-line proxy and cannot be skipped.
+
+Neutral: `uap models` sits next to the existing `uap model` command.
+
+## Alternatives Considered
+
+- **Enforcement in the proxy (Python).** Rejected: the proxy has no subprocess
+  or systemd machinery in 17k lines, and the TS side already owns the units,
+  the capacity policy, the lease ledger, and the dashboard.
+- **A dedicated placement daemon.** Rejected: two processes holding placement
+  state, and a new thing to supervise on a box that already supervises too
+  much.
+- **Derive cost from GGUF file sizes.** Rejected by measurement: 79 GiB on disk
+  for a 21.8 GiB GPU footprint, and 15 GiB on disk for a config needing 22+ GiB.
+  Disk size is not a proxy for anything.
+- **Use the existing save/restore path for `paused`.** Rejected: it frees no
+  VRAM, costs 10-20 s per slot, and may not fit in ~29 GiB of available host
+  RAM against a 52.9 GiB resident process.
+- **Advertise a fixed VRAM cost per model.** Rejected: cost is per config and
+  drifts with engine build and flags; unmeasured entries are marked
+  `unmeasured` rather than guessed.

package/docs/architecture/adr/0007-auto-displacement-allowlist-as-standing-consent.md

@@ -0,0 +1,79 @@
+# ADR 0007: Auto-displacement allowlist as standing operator consent
+
+- Status: Accepted
+- Date: 2026-10-09
+- Spec: `docs/specs/operator-model-placement.md` §4.4.1, §6 (phase-4 note)
+- Supersedes: none — extends ADR 0006's core invariant ("never evict without
+  explicit operator confirmation") to the request-driven case.
+
+## Context
+
+Placement is request-driven: a gated request that parks because its
+model is not resident can load itself, so the operator stops running
+`uap models apply` by hand (the motivating case: running `ugc-factory`
+end-to-end without manual model switching). The spec's phase table originally
+said phase 4 ships "auto-load alongside; never displacement", and the core
+invariant says an operator confirms every eviction. On this machine
+`load_alongside` has no solutions at all (one config holds 21,812 of 24,576
+MiB), so alongside-only auto mode would auto-load nothing that matters here
+and the operator would keep hand-running swaps for exactly the models they
+already trust.
+
+## Decision
+
+1. **Non-displacing options auto-enforce whenever the policy is enabled**
+   (`~/.uap/placement-auto.json`, opt-in, fail-closed). Reuse needs nothing;
+   load-alongside evicts nothing; the budget math already said it fits.
+2. **Displacement auto-enforces only for models on an explicit allowlist**,
+   recorded by `uap models auto --allow-displace <model> --yes`. The allowlist
+   IS the explicit operator confirmation the core invariant requires:
+   - standing, not per-event — the `--yes` gate prints exactly what is being
+     consented to ("UNLOADS the current resident(s) — the minimal set that
+     makes room, re-evaluated at load time — and loads the requested one
+     WITHOUT an operator prompt between them");
+   - deliberate — nothing enters it by default, and a bare `--allow-displace`
+     without `--yes` records nothing;
+   - auditable and revocable — the file is plain JSON in `~/.uap`, per-model
+     removal via `--disallow-displace`, whole feature off via `--disable`.
+3. **The consent subject is the model being LOADED, not the victim.** Victims
+   are dynamic: enforcement re-derives the minimal eviction set and
+   drift-checks it against the live ledger at run time (`enforce.ts`), so a
+   static victim list would go stale the moment residents change. The loaded
+   model is the stable thing the operator is vouching for.
+4. **Run-shape guards bound the standing consent** (phase-4 parallel review):
+   one run per requested model, single-flight machine-wide, a hard concurrency
+   cap, a failure cooldown that kills any drain→stop→fail→rollback
+   oscillation, TTL extension so the supervised entry outlives its run, and a
+   run that never rejects (a ledger-write throw must not kill the dashboard).
+
+## Consequences
+
+- The operator's machines can swap models unattended, but only for models
+  they explicitly named; everything else still parks for a human `apply`.
+- The allowlist must be reviewed like any standing credential: a model on it
+  can be loaded by any gated client request while the resident is evicted
+  without a prompt. `uap models auto` (status) is the audit surface.
+- "Never displacement" in the phase table was amended to "never displacement
+  by default" — the reasoning lives in the spec §6 phase-4 note and here.
+- The proxy stays dumb (reason strings only); the controller remains the
+  single decision-maker, and the policy file is the single authority
+  (independent of `PROXY_PLACEMENT_MODE`).
+
+## Addendum (2026-10-11): idle unload uses the same doctrine
+
+Auto-load had no reverse: residents loaded by §4.4.1 held their device until
+a human stopped them. The idle sweep (spec §4.4.2) extends this ADR's
+reasoning to auto-UNLOAD, which is also an unattended change to what runs on
+the machine:
+
+- `unload_allow` is standing consent with the same shape as
+  `allow_displace`: `uap models auto --allow-unload <model> --yes` (the
+  `--yes` gate prints what stops, when), per-model revocation via
+  `--disallow-unload`, feature off with no `unload_idle_after_secs` recorded.
+- The consent subject is again the model, not the moment: the clock resets on
+  every gated request served, an unwatched resident's clock starts at first
+  observation (arming never evicts the already-idle), and unknown endpoint
+  state (`ss` unable to answer) is a refusal to unload, never a guess.
+- The stop reuses the operator's full `unloadPlacement` machinery — the
+  standing consent covers WHEN, and the drain/in-flight/rollback guards
+  still bound it per-event.