@nurix/nustack 0.23.12 → 0.23.14

package/dist/lib/onboarding/binding.js

@@ -6,6 +6,9 @@ import { readHeadCommit } from "../git-sync/core/repository.js";
 import { writeProjectManifests } from "./manifest_writer.js";
 import { installToolkit } from "../etna/manager.js";
 import { serializeProfileForBinding } from "../etna/profile.js";
+import { contractFieldsFromSummary, readProjectContract } from "../project_contract.js";
+import { hasEtnaMountHook, installHarnessMountHook } from "./session_hook.js";
+import { installCommitTrailerHook, trailerHookLine } from "./commit_trailer_hook.js";
 import { SYNC_PROTOCOL_VERSION } from "../git-sync/whitelist/types.js";
 export function computeRepositoryFingerprint(repository) {
     return createHash("sha256").update(repository.commonDir).digest("hex");
@@ -49,7 +52,19 @@ async function maybeRunTelemetry(input, binding) {
         return;
     await ensureBindingTelemetry({ baseUrl: input.baseUrl, store: input.store, binding }).catch(() => { });
 }
+export async function onboardingContractFields(root, baseUrl, profile) {
+    const held = await readProjectContract(root);
+    const fromSummary = profile.contractFields ?? contractFieldsFromSummary(null);
+    return {
+        origin: baseUrl,
+        door: baseUrl,
+        harness: fromSummary.harness,
+        branchPolicy: fromSummary.branchPolicy ?? null,
+        docsRoot: held.docsRoot ?? "docs",
+    };
+}
 export async function runRepositoryOnboarding(input) {
+    const root = input.repository.repositoryRoot;
     const baselineCommitId = input.baselineCommitId !== undefined ? input.baselineCommitId : readHeadCommit(input.repository);
     const established = await establishBinding({
         store: input.store,
@@ -64,8 +79,7 @@ export async function runRepositoryOnboarding(input) {
         etnaProfileJson: serializeProfileForBinding(input.profile),
         runTelemetry: input.runTelemetry,
     });
-    const install = await installToolkit(input.store, established.binding.id, input.profile, input.repository.repositoryRoot, input.toolkitDeps ?? {});
-    const projectManifest = await writeProjectManifests(input.repository.repositoryRoot, {
+    const projectManifest = await writeProjectManifests(root, {
         projectId: input.projectId,
         organizationId: input.organizationId,
         toolkit: {
@@ -74,7 +88,33 @@ export async function runRepositoryOnboarding(input) {
             rendererVersion: input.profile.rendererVersion,
             placementMapVersion: input.profile.placementMapVersion,
         },
+        contract: await onboardingContractFields(root, input.baseUrl, input.profile),
+    });
+    const notices = [];
+    const etnaMounts = await hasEtnaMountHook(root);
+    let sessionHook = "skipped_etna_mount";
+    if (etnaMounts) {
+        notices.push("etna's mount hook is in .claude/settings.json, so NuStack installed no session-start hook and mounted nothing: remove etna's SessionStart entry (.claude/hooks/mount.mjs), then re-run `nustack init`.");
+    }
+    else {
+        sessionHook = await installHarnessMountHook(root);
+        if (sessionHook === "skipped_unparsable")
+            notices.push(".claude/settings.json does not parse as JSON, so the session-start mount hook was not installed; the file was left untouched.");
+    }
+    const install = await installToolkit(input.store, established.binding.id, input.profile, root, {
+        ...(input.toolkitDeps ?? {}),
+        skipMount: etnaMounts,
+        writeContract: "when-unmodified",
+        projectId: input.projectId,
+        globals: { nustackUrl: input.baseUrl },
     });
+    const mount = install.mount ?? { status: "failed", code: "HARNESS_UNAVAILABLE", message: install.reason ?? "no harness to mount" };
+    if (mount.status === "failed")
+        notices.push(`harness not mounted (${mount.code}): ${mount.message ?? ""} — the next session start retries it.`);
+    const trailerHook = await installCommitTrailerHook(root);
+    const trailerLine = trailerHookLine(trailerHook);
+    if (trailerLine)
+        notices.push(trailerLine);
     return {
         flow: input.flow,
         projectId: input.projectId,
@@ -86,6 +126,10 @@ export async function runRepositoryOnboarding(input) {
         reused: !established.created,
         install,
         projectManifest,
+        sessionHook,
+        mount,
+        trailerHook,
+        notices,
         noPush: true,
     };
 }

package/dist/lib/onboarding/commit_trailer_hook.js

@@ -0,0 +1,66 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+export const TRAILER_HOOK_MARKER = "# nustack:managed commit-msg v1";
+export const CHANGE_TRAILER_KEY = "NuStack-Change";
+export const TRAILER_HOOK_BODY = `#!/bin/sh
+${TRAILER_HOOK_MARKER}
+# Appends a ${CHANGE_TRAILER_KEY}: <32 lowercase hex> trailer, the change id NuStack's harness records key a
+# commit by. Written by the nustack CLI (nustack init, nustack harness mount); an amend or a rebase keeps the id.
+msg="$1"
+[ -f "$msg" ] || exit 0
+case "$(sed -n '1p' "$msg")" in
+    "fixup! "*|"squash! "*) exit 0 ;;
+esac
+grep -qi '^${CHANGE_TRAILER_KEY}:' "$msg" && exit 0
+id=$(od -An -N16 -tx1 /dev/urandom | tr -d ' \\n')
+[ \${#id} -eq 32 ] || exit 0
+git interpret-trailers --in-place --trailer "${CHANGE_TRAILER_KEY}: $id" "$msg"
+`;
+function git(root, args) {
+    try {
+        return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+export function isManagedTrailerHook(text) {
+    return text.split("\n").slice(0, 2).some((line) => line.trim() === TRAILER_HOOK_MARKER);
+}
+export async function installCommitTrailerHook(root) {
+    const commonDir = git(root, ["rev-parse", "--git-common-dir"]);
+    if (!commonDir)
+        return "skipped_not_git";
+    const hooksPath = git(root, ["config", "--get", "core.hooksPath"]);
+    if (hooksPath)
+        return "skipped_hooks_path";
+    const hooksDir = path.join(path.isAbsolute(commonDir) ? commonDir : path.join(root, commonDir), "hooks");
+    const hookFile = path.join(hooksDir, "commit-msg");
+    if (existsSync(hookFile)) {
+        const held = await readFile(hookFile, "utf8").catch(() => "");
+        if (!isManagedTrailerHook(held))
+            return "skipped_foreign_hook";
+        if (held === TRAILER_HOOK_BODY) {
+            await chmod(hookFile, 0o755);
+            return "installed";
+        }
+    }
+    await mkdir(hooksDir, { recursive: true });
+    await writeFile(hookFile, TRAILER_HOOK_BODY, { encoding: "utf8", mode: 0o755 });
+    await chmod(hookFile, 0o755);
+    return "installed";
+}
+export function trailerHookLine(value) {
+    switch (value) {
+        case "skipped_hooks_path":
+            return "NuStack-Change trailer hook not installed: core.hooksPath is set, so this repository's own hook manager owns commit-msg.";
+        case "skipped_foreign_hook":
+            return "NuStack-Change trailer hook not installed: a commit-msg hook NuStack did not write is already there.";
+        case "skipped_not_git":
+            return "NuStack-Change trailer hook not installed: this folder is not a git repository.";
+        default:
+            return null;
+    }
+}

package/dist/lib/onboarding/manifest_writer.js

@@ -5,8 +5,8 @@ import { legacyAppJsonPath, readBindingMarker, projectJsonPath } from "../projec
 import { manifestPath } from "../manifest.js";
 const CURRENT_BINDING_PROTOCOL_VERSION = 1;
 const CURRENT_DOCUMENT_PROTOCOL_VERSION = 1;
-function buildProjectManifest(identity) {
-    return {
+function buildProjectManifest(identity, existing) {
+    const owned = {
         schemaVersion: 2,
         workspaceId: identity.projectId,
         organizationId: identity.organizationId,
@@ -19,6 +19,22 @@ function buildProjectManifest(identity) {
             placementMapVersion: identity.toolkit.placementMapVersion,
         },
     };
+    const supplied = Object.fromEntries(Object.entries(identity.contract ?? {}).filter(([, value]) => value !== undefined));
+    return { ...(existing ?? {}), ...owned, ...supplied };
+}
+async function readExistingContract(root) {
+    const filePath = projectJsonPath(root);
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const parsed = JSON.parse(await readFile(filePath, "utf8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return null;
+        return parsed.schemaVersion === 2 ? parsed : null;
+    }
+    catch {
+        return null;
+    }
 }
 async function atomicWrite(target, content) {
     const prior = existsSync(target) ? await readFile(target, "utf8") : null;
@@ -54,7 +70,7 @@ export async function writeProjectManifests(root, identity, hooks = {}) {
         toolkit: { name: identity.toolkit.name, version: identity.toolkit.version },
     };
     delete nextService.nustackApp;
-    const projectManifest = buildProjectManifest(identity);
+    const projectManifest = buildProjectManifest(identity, await readExistingContract(root));
     const projectDir = path.dirname(projectJsonPath(root));
     await mkdir(projectDir, { recursive: true });
     const projectPrior = await atomicWrite(projectJsonPath(root), JSON.stringify(projectManifest, null, 2) + "\n");

package/dist/lib/onboarding/session_hook.js

@@ -0,0 +1,76 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+export const SETTINGS_PATH = ".claude/settings.json";
+export const HARNESS_MOUNT_MARKER = "nustack:managed:harness-mount";
+export const HARNESS_MOUNT_COMMAND = `nustack harness mount "$CLAUDE_PROJECT_DIR" >/dev/null || true # ${HARNESS_MOUNT_MARKER}`;
+const ETNA_MOUNT_HOOK = /\.claude\/hooks\/mount\.mjs/;
+const DEFAULT_INDENT = 2;
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function commandsOf(entry) {
+    if (!isObject(entry) || !Array.isArray(entry.hooks))
+        return [];
+    return entry.hooks.flatMap((hook) => (isObject(hook) && typeof hook.command === "string" ? [hook.command] : []));
+}
+function sessionStartEntries(settings) {
+    const hooks = settings.hooks;
+    if (!isObject(hooks) || !Array.isArray(hooks.SessionStart))
+        return [];
+    return hooks.SessionStart;
+}
+function isHarnessMountEntry(entry) {
+    return commandsOf(entry).some((command) => command.trimEnd().endsWith(`# ${HARNESS_MOUNT_MARKER}`));
+}
+function managedEntry() {
+    return { matcher: "", hooks: [{ type: "command", command: HARNESS_MOUNT_COMMAND }] };
+}
+function detectIndent(raw) {
+    const indented = /\n(\x20+)"/.exec(raw);
+    return indented?.[1] ? indented[1].length : DEFAULT_INDENT;
+}
+async function readSettings(root) {
+    const file = path.join(root, SETTINGS_PATH);
+    if (!existsSync(file))
+        return { kind: "absent" };
+    const raw = await readFile(file, "utf8").catch(() => null);
+    if (raw === null)
+        return { kind: "unparsable" };
+    if (raw.trim() === "")
+        return { kind: "parsed", settings: {}, indent: DEFAULT_INDENT };
+    try {
+        const parsed = JSON.parse(raw);
+        return isObject(parsed) ? { kind: "parsed", settings: parsed, indent: detectIndent(raw) } : { kind: "unparsable" };
+    }
+    catch {
+        return { kind: "unparsable" };
+    }
+}
+export async function hasEtnaMountHook(root) {
+    const read = await readSettings(root);
+    if (read.kind !== "parsed")
+        return false;
+    return sessionStartEntries(read.settings).some((entry) => commandsOf(entry).some((command) => ETNA_MOUNT_HOOK.test(command)));
+}
+export async function installHarnessMountHook(root) {
+    const read = await readSettings(root);
+    if (read.kind === "unparsable")
+        return "skipped_unparsable";
+    const settings = read.kind === "parsed" ? read.settings : {};
+    const indent = read.kind === "parsed" ? read.indent : DEFAULT_INDENT;
+    const entries = sessionStartEntries(settings);
+    if (entries.some((entry) => commandsOf(entry).some((command) => ETNA_MOUNT_HOOK.test(command))))
+        return "skipped_etna_mount";
+    const wanted = managedEntry();
+    const index = entries.findIndex(isHarnessMountEntry);
+    if (index >= 0 && JSON.stringify(entries[index]) === JSON.stringify(wanted))
+        return "present";
+    const nextEntries = index >= 0 ? entries.map((entry, at) => (at === index ? wanted : entry)) : [...entries, wanted];
+    const hooks = isObject(settings.hooks) ? settings.hooks : {};
+    const next = { ...settings, hooks: { ...hooks, SessionStart: nextEntries } };
+    const file = path.join(root, SETTINGS_PATH);
+    await mkdir(path.dirname(file), { recursive: true });
+    await writeFile(file, `${JSON.stringify(next, null, indent)}\n`, "utf8");
+    return "installed";
+}

package/dist/lib/origin_guard.js

@@ -0,0 +1,43 @@
+import { HarnessError, HARNESS_CODES } from "./harness/codes.js";
+export const PLATFORM_DEFAULT_ORIGIN = "https://apps.nustack.ai";
+export const contractOrigins = new Set();
+export function originOf(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return url.trim().replace(/\/+$/, "");
+    }
+}
+export function isPlatformDefault(url) {
+    return originOf(url) === originOf(PLATFORM_DEFAULT_ORIGIN);
+}
+export function recordContractOrigin(url) {
+    if (!isPlatformDefault(url))
+        contractOrigins.add(originOf(url));
+}
+export function isContractOrigin(url) {
+    return contractOrigins.has(originOf(url));
+}
+export function originMismatchError(origin, credentialOrigin, credentialKind) {
+    const held = credentialKind === "pat"
+        ? "a personal access token (NUSTACK_TOKEN) is never sent to an origin a repository names"
+        : credentialKind === "none"
+            ? "this machine is not signed in to it, and a sign-in never opens for an origin a repository names"
+            : `this machine's sign-in is for ${credentialOrigin ?? "another origin"}`;
+    return new HarnessError(HARNESS_CODES.ORIGIN_MISMATCH, `This repository's .nustack/workspace.json names ${origin} as its NuStack origin, but ${held}. ` +
+        `To use ${origin}, state it outside the repository: \`nustack login --nustack-url ${origin}\`, or set NUSTACK_URL=${origin}.`);
+}
+export function refusedContractOrigin(credentialOrigin, origin) {
+    const candidates = origin === undefined ? [...contractOrigins] : isContractOrigin(origin) ? [originOf(origin)] : [];
+    const held = credentialOrigin === null ? null : originOf(credentialOrigin);
+    return candidates.find((candidate) => candidate !== held) ?? null;
+}
+export function isOriginMismatch(error) {
+    return error instanceof HarnessError && error.code === HARNESS_CODES.ORIGIN_MISMATCH;
+}
+export function nullUnlessOriginRefused(error) {
+    if (isOriginMismatch(error))
+        throw error;
+    return null;
+}

package/dist/lib/project_contract.js

@@ -0,0 +1,104 @@
+import { existsSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+export const CONTRACT_PATH = ".nustack/workspace.json";
+export const LEGACY_HARNESS_MANIFEST_PATH = ".claude/harness.json";
+const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+function parseObject(text) {
+    if (text === null)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function contractObject(text) {
+    const parsed = parseObject(text);
+    return parsed !== null && parsed.schemaVersion === 2 ? parsed : null;
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : null;
+}
+function urlOf(value) {
+    const trimmed = nonEmpty(value);
+    return trimmed === null ? null : trimmed.replace(/\/+$/, "");
+}
+export function docsRootDeclaration(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim().replace(/[\\/]+$/, "");
+    if (trimmed === "" || /^([A-Za-z]:)?[\\/]/.test(trimmed))
+        return null;
+    return trimmed.split(/[\\/]/).includes("..") ? null : trimmed;
+}
+export function harnessOf(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const harness = value;
+    if (harness.track === "latest")
+        return { track: "latest" };
+    const pin = nonEmpty(harness.pin);
+    const digest = typeof harness.digest === "string" ? harness.digest.trim() : "";
+    return pin !== null && DIGEST_PATTERN.test(digest) ? { pin, digest } : null;
+}
+function doorOf(holder) {
+    if (holder === null || !Object.hasOwn(holder, "door"))
+        return undefined;
+    return urlOf(holder.door);
+}
+function legacyMount(legacy) {
+    const mount = legacy?.mount;
+    return typeof mount === "object" && mount !== null && !Array.isArray(mount) ? mount : null;
+}
+export function parseProjectContract(contractText, legacyText) {
+    const contract = contractObject(contractText);
+    const legacy = parseObject(legacyText);
+    const contractDoor = doorOf(contract);
+    const legacyDoor = doorOf(legacyMount(legacy));
+    return {
+        projectId: contract === null ? null : nonEmpty(contract.workspaceId),
+        harness: contract === null ? null : harnessOf(contract.harness),
+        door: contractDoor !== undefined ? contractDoor : legacyDoor,
+        doorSource: contractDoor !== undefined ? "contract" : legacyDoor !== undefined ? "legacy" : null,
+        origin: contract === null ? null : urlOf(contract.origin),
+        docsRoot: (contract === null ? null : docsRootDeclaration(contract.docsRoot)) ?? docsRootDeclaration(legacy?.docsRoot),
+        branchPolicy: contract?.branchPolicy === "trunk" || contract?.branchPolicy === "branch" ? contract.branchPolicy : null,
+        contractPresent: contract !== null,
+        legacyPresent: legacyText !== null,
+        legacyVersion: nonEmpty(legacy?.version),
+    };
+}
+function readTextSync(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        return readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+async function readText(file) {
+    if (!existsSync(file))
+        return null;
+    return readFile(file, "utf8").catch(() => null);
+}
+export async function readProjectContract(root) {
+    return parseProjectContract(await readText(path.join(root, CONTRACT_PATH)), await readText(path.join(root, LEGACY_HARNESS_MANIFEST_PATH)));
+}
+export function readProjectContractSync(root) {
+    return parseProjectContract(readTextSync(path.join(root, CONTRACT_PATH)), readTextSync(path.join(root, LEGACY_HARNESS_MANIFEST_PATH)));
+}
+export function contractFieldsFromSummary(summary) {
+    if (summary === null)
+        return { harness: { track: "latest" }, branchPolicy: null };
+    const harness = summary.harness;
+    const branchPolicy = summary.branchPolicy === "trunk" || summary.branchPolicy === "branch" ? summary.branchPolicy : null;
+    if (harness?.track === "pinned" && typeof harness.digest === "string" && DIGEST_PATTERN.test(harness.digest)) {
+        return { harness: { pin: harness.version, digest: harness.digest }, branchPolicy };
+    }
+    return { harness: { track: "latest" }, branchPolicy };
+}

package/dist/lib/records/door.js

@@ -1,8 +1,7 @@
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { resolveNuStackUrl } from "../nustack_client.js";
+import { assertCredentialOrigin, resolveNuStackOrigin } from "../nustack_client.js";
 import { resolveProjectId } from "../project_context.js";
+import { readProjectContract } from "../project_contract.js";
+import { originOf } from "../origin_guard.js";
 export const RECORD_KINDS = ["obligation", "gate_event", "changelog", "memory", "backlog", "proposal", "triage"];
 export const LEGACY_KIND_TRANSLATION = { "backlog.remove": "backlog", bookkeeping: "obligation" };
 export const RECORDS_BATCH_CAP = 200;
@@ -23,33 +22,41 @@ export function translatedKindOf(kind) {
     return isLegacyKind(kind) ? LEGACY_KIND_TRANSLATION[kind] : kind;
 }
 export async function readMountDoor(root) {
-    const manifest = path.join(root, ".claude", "harness.json");
-    if (!existsSync(manifest))
-        return undefined;
-    try {
-        const parsed = JSON.parse(await readFile(manifest, "utf8"));
-        if (!parsed.mount || !("door" in parsed.mount))
-            return undefined;
-        const door = parsed.mount.door;
-        return typeof door === "string" && door.trim() !== "" ? door.trim().replace(/\/+$/, "") : null;
-    }
-    catch {
-        return undefined;
-    }
+    return (await readProjectContract(root)).door;
 }
 export async function resolveDoor(root, globals, projectFlag) {
     const project = await resolveProjectId(root, projectFlag ? { project: projectFlag } : {});
     if (!project.ok)
         return { kind: "store", projectId: null, root, reason: "this folder is not bound to a Project" };
-    const door = await readMountDoor(root);
+    const contract = await readProjectContract(root);
+    const door = contract.door;
     if (door === null)
         return { kind: "store", projectId: project.projectId, root, reason: "the harness manifest configures no door" };
-    return { kind: "door", projectId: project.projectId, doorUrl: door ?? resolveNuStackUrl(globals), isPlatformDefault: door === undefined, root };
+    let origin;
+    try {
+        origin = resolveNuStackOrigin(globals, root).url;
+    }
+    catch (error) {
+        return { kind: "store", projectId: project.projectId, root, reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (door !== undefined && contract.doorSource === "contract" && originOf(door) !== originOf(origin)) {
+        const reason = `the contract's door ${door} is not on the resolved origin ${origin}; records stay local`;
+        process.stderr.write(`nustack: ${reason}\n`);
+        return { kind: "store", projectId: project.projectId, root, reason };
+    }
+    return { kind: "door", projectId: project.projectId, doorUrl: door ?? origin, isPlatformDefault: door === undefined, root };
 }
 export function retryDelayMs(attempts) {
     return Math.min(RETRY_BASE_MS * 2 ** Math.max(0, attempts - 1), RETRY_CEILING_MS);
 }
 export async function postRecords(doorUrl, projectId, request, bearer) {
+    try {
+        await assertCredentialOrigin(doorUrl);
+    }
+    catch (error) {
+        const code = typeof error.code === "string" ? error.code : null;
+        return { ok: false, status: 0, code, message: error instanceof Error ? error.message : String(error) };
+    }
     let response;
     try {
         response = await fetch(`${doorUrl}/api/v2/projects/${encodeURIComponent(projectId)}/records`, {

package/dist/lib/records/drain.js

@@ -3,6 +3,7 @@ import { closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync, unl
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureAccessToken } from "../auth_grant.js";
+import { isOriginMismatch } from "../origin_guard.js";
 import { recordsDrainLockPath } from "../local_store/paths.js";
 import { resolveNuStackUrl } from "../nustack_client.js";
 import { RECORDS_BATCH_CAP, postRecords, resolveDoor, retryDelayMs } from "./door.js";
@@ -84,14 +85,19 @@ async function drainPass(store, globals, result, shouldIgnoreBackoff) {
         if (first.row.credential === "device")
             bearer = deviceToken;
         else {
-            if (personToken === undefined)
-                personToken = (await ensureAccessToken().catch(() => null))?.accessToken ?? null;
+            if (personToken === undefined) {
+                personToken = await ensureAccessToken().then((auth) => auth?.accessToken ?? null, (error) => {
+                    if (isOriginMismatch(error))
+                        result.originRefusal = error.message;
+                    return null;
+                });
+            }
             bearer = personToken;
         }
         for (let start = 0; start < list.length; start += RECORDS_BATCH_CAP) {
             const batch = list.slice(start, start + RECORDS_BATCH_CAP);
             if (bearer === null) {
-                backoffAll(store, batch, "this device is signed out", result);
+                backoffAll(store, batch, result.originRefusal ?? "this device is signed out", result);
                 continue;
             }
             await sendBatch(store, batch, first.row.kind, bearer, result);
@@ -140,7 +146,7 @@ async function sendBatch(store, batch, kind, bearer, result) {
     }
 }
 export async function drainRecords(store, globals, options = {}) {
-    const result = { sent: 0, refused: 0, lastError: null };
+    const result = { sent: 0, refused: 0, lastError: null, originRefusal: null };
     pruneSynced(store, Date.now());
     for (let pass = 0; pass < MAX_PASSES; pass += 1) {
         options.onPass?.();

package/dist/lib/records/refusalLog.js

@@ -2,7 +2,36 @@ import { randomUUID } from "node:crypto";
 import { RECORD_SCHEMA_VERSION } from "./door.js";
 import { idempotencyKeyOf } from "./naturalKey.js";
 import { writeRecords } from "./recordsTable.js";
-export const REFUSAL_GATE_IDS = ["records-validation", "records-unknown-kind", "agent-owned-obligation", "secret-scan"];
+export const REFUSAL_GATE_IDS = [
+    "records-validation",
+    "records-unknown-kind",
+    "agent-owned-obligation",
+    "secret-scan",
+    "ownership",
+    "plan-gate",
+    "ledger",
+    "frozen-record",
+    "changelog",
+    "changelog-entry",
+    "package-table",
+    "protected-file",
+    "output-gate",
+    "branch-worktree",
+    "live-command",
+    "commit-claim",
+    "foreign-claim",
+    "open-denials",
+    "exit-stop",
+    "queue",
+    "completion-integrity",
+    "changelog-presence",
+    "commit-gate",
+    "file-gate",
+    "bash-write-screen",
+    "harness-checks",
+    "hook.rule_unavailable",
+    "hook.deadline",
+];
 const TEXT_CAP = 20_000;
 const clip = (text) => (text.length > TEXT_CAP ? `${text.slice(0, TEXT_CAP - 1)}…` : text || "-");
 export function logRefusals(store, entries, context) {

package/dist/lib/session-engine/supervisor.js

@@ -1,13 +1,11 @@
 import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { createInterface } from "node:readline";
 import { ClaudeSession } from "./claudeAdapter.js";
 import { FRAME_VERSION, parseInboundFrame, serializeFrame, } from "./frames.js";
 import { inspectSession, reclaimSession } from "./prune.js";
 import { sessionRegistryPath, readSessionRegistry, updateSessionRegistry } from "./registry.js";
 import { createSessionWorktree } from "./worktree.js";
-import { mountHarness } from "../harness/mount.js";
+import { readProjectContract } from "../project_contract.js";
 function defaultProbeClaude(env) {
     return new Promise((resolve) => {
         execFile("claude", ["--version"], { env, timeout: 5_000 }, (error, stdout) => {
@@ -41,14 +39,7 @@ export class SessionSupervisor {
         this.emit({ v: FRAME_VERSION, type: "session.error", sessionId, code, message });
     }
     async boundProjectOf(projectPath) {
-        try {
-            const parsed = JSON.parse(await readFile(path.join(projectPath, ".nustack", "workspace.json"), "utf8"));
-            const id = parsed?.workspaceId;
-            return typeof id === "string" && id.trim() ? id.trim() : null;
-        }
-        catch {
-            return null;
-        }
+        return (await readProjectContract(projectPath)).projectId;
     }
     async moveSessionRow(record, to) {
         const client = this.options.sessions;
@@ -133,17 +124,14 @@ export class SessionSupervisor {
         }
     }
     async mountInto(sessionId, root, projectId) {
-        const lookup = this.options.sessions?.harnessManifestUrl;
-        if (!lookup)
+        const mount = this.options.mountHarness;
+        if (!mount)
             return;
+        const log = this.options.log ?? ((line) => process.stderr.write(`${line}\n`));
         try {
-            const manifestUrl = await lookup.call(this.options.sessions, projectId);
-            if (!manifestUrl)
-                return;
-            await (this.options.mountHarness ?? mountHarness)(root, manifestUrl);
+            await mount(root, { projectId, writeContract: "never", runtime: "claude-code", log: () => { } });
         }
         catch (error) {
-            const log = this.options.log ?? ((line) => process.stderr.write(`${line}\n`));
             log(`nustack: harness mount skipped for session ${sessionId} - ${error instanceof Error ? error.message : String(error)}`);
         }
     }

package/dist/lib/sessions/client.js

@@ -34,18 +34,6 @@ export function makeSessionsClient(baseUrl, accessToken) {
         async setVendorSessionId(projectId, sessionId, vendorSessionId) {
             return this.transitionSession(projectId, sessionId, "running", { vendorSessionId });
         },
-        async harnessManifestUrl(projectId) {
-            const safeId = assertSafeOpaqueId("The Project id", projectId);
-            const response = await globalThis.fetch(`${baseUrl}/api/v2/projects/${encodeURIComponent(safeId)}`, {
-                headers,
-                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-            });
-            const payload = (await response.json().catch(() => null));
-            if (!response.ok)
-                throw new Error(`project summary fetch failed: HTTP ${response.status}`);
-            const url = payload?.data?.harness?.manifestUrl;
-            return typeof url === "string" && url ? url : null;
-        },
     };
 }
 export function sessionsClientFromEnv(env = process.env) {