@openrig/cli 0.5.0 → 0.5.2

package/daemon/assets/guidance/openrig-start.md

@@ -1,82 +1,39 @@
 # OpenRig Start
 
-You are running inside an OpenRig-managed topology.
+You are running inside an OpenRig-managed topology — a persistent team of agents in separate
+terminals, each with a name and a role, talking to each other directly.
 
-This file is the thin bootstrap overlay, not the full OpenRig manual.
-Use it to recover identity, communicate, and regain context after launch or compaction.
+**This file is deliberately thin.** Its only job is to get you your identity. It is not an
+orientation, and it cannot tell you what your rig is for or what you are supposed to be doing.
 
-When you are unsure which packaged skill applies, start with the global `openrig-skills` index. It routes to every shipped skill in one hop:
-
-- Claude Code: `~/.claude/skills/openrig-skills/SKILL.md`
-- Codex: `~/.agents/skills/openrig-skills/SKILL.md`
-
-For the full OpenRig command surface, load the packaged `openrig-user` skill now.
-If your runtime supports skills, use that mechanism.
-If it does not auto-load skills reliably, read the packaged copy directly from your current project or workspace:
-
-- Claude Code usually sees it under `.claude/skills/openrig-user/SKILL.md`
-- Codex usually sees it under `.agents/skills/openrig-user/SKILL.md`
-
-That skill covers the broader surface, including chatroom, discovery, adopt/bind/attach, lifecycle, specs, bundles, and richer operator workflows.
-
-Your per-session startup guidance also names the process skills for your role and pod.
-Load AND invoke those now, before proceeding with any work, using your runtime's supported skill mechanism.
-This shared overlay is only the common bootstrap floor, not the full operating manual for your seat.
-
-## Working missions and slices (the SDLC)
-
-If your seat works missions or slices, load the packaged `mission-slice-sop` skill BEFORE authoring or building — it teaches the flow the Living Notes UI projects: intent → mini-requirements + proof contract (→ mockups for UI slices) → plan-lock (`rig scope slice approve --scope spec`) → build the locked set → QA visual compare → `rig proof add … --media` drops (the C1 drop verb — never hand-place proof files) → proof-lock (`--scope delivery`).
-
-The conventions themselves (section names, proof-contract format, the two locks, C1 proof headers) live in ONE shipped document: `docs/reference/sdlc-conventions.md` in the repo, materialized at `$OPENRIG_HOME/reference/sdlc-conventions.md` (default `~/.openrig/reference/sdlc-conventions.md`) on an installed package. `rig scope slice create` scaffolds the convention sections for every template kind; `rig scope audit` is the advisory backstop — it records and advises, it never blocks your work.
-
-## Identity
-
-Run this first after launch or compaction to recover your identity:
+## Identity — run this first
 
 ```bash
 rig whoami --json
 ```
 
-This returns your rig, pod, member, peers, edges, and transcript path. Treat it as ground truth.
+Returns your rig, pod, member, peers, edges, and transcript path. **Treat it as ground truth.**
+A startup overlay can be stale; this one is small precisely so it has less room to be wrong.
 
-## Communication
+Run it again after any compaction, restart or restore — **before** concluding anything about
+where you are or what you were doing. And if a predecessor's transcript looks thin or empty,
+know that transcript capture is unreliable on some runtimes — **little or no output does not
+mean the session was quiet.**
 
-Send a message to a peer:
-```bash
-rig send <session> "message" --verify
-```
+## Reaching a peer
 
-Read a peer's terminal output:
 ```bash
-rig capture <session>
+rig send <session> "message"     # types into their terminal and presses enter
+rig capture <session>            # reads what is on their screen
 ```
 
-Broadcast to all peers in your rig:
-```bash
-rig broadcast --rig <name> "message"
-```
-
-## Secondary Transcript Check
-
-After compaction, recover work from durable artifacts first: the restore map,
-current `MISSION_NOTES.md`, and your owned queue items. Transcript output is a
-secondary check and may be unavailable or incomplete for some runtimes. Little
-or no output does not mean the session was quiet.
+The session name is the address. `rig --help` lists the rest of the surface.
 
-Read recent transcript output:
-```bash
-rig transcript <session> --tail 100
-```
-
-Search transcripts for specific content:
-```bash
-rig transcript <session> --grep "pattern"
-```
+## What this file is not
 
-## After Compaction
+It is not the manual, and these commands are a fraction of what is available.
 
-If you lose context, run `rig whoami --json` immediately. It tells you who you
-are, who your peers are, and how to reach them. Rebuild the work from the
-restore map, current `MISSION_NOTES.md`, and your owned queue items. Use
-`rig transcript` only as a secondary check; if it returns little or nothing,
-do not conclude that the session was quiet.
+**If nobody has walked you through this system, say so rather than inferring it.** What your rig
+is for, how work moves here, and what you are allowed to do are not in this file and are not
+guessable from it — and guessing your way into a rig is how an agent builds the wrong thing
+correctly.

package/daemon/assets/plugins/openrig-core/README.md

@@ -4,7 +4,7 @@ Canonical OpenRig skills and hooks for cross-runtime agent topology coordination
 
 ## What this plugin ships
 
-**Skills (10):** the canonical OpenRig operating knowledge — how to use the `rig` CLI, how to design rig topologies, how to recover from compaction, how to hand work off durably between agents, and how to maintain seat continuity across handovers and restarts.
+**Skills (12):** the canonical OpenRig operating knowledge — how to use the `rig` CLI, how to design rig topologies, how to recover from compaction, how to hand work off durably between agents, how to maintain seat continuity across handovers and restarts, how to apply a permission policy to a seat's live harness, and how to decide who does a task.
 
 **Hooks:** activity-tracking hooks (Claude Code: 4 events; Codex: 3 events) that POST agent state to the OpenRig daemon for real-time UI seat-status updates.
 

package/daemon/assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs

@@ -45,6 +45,7 @@ function buildOpenRigPayload(providerPayload, env = process.env, now = () => new
   const sessionName = firstString(env.OPENRIG_SESSION_NAME, env.RIGGED_SESSION_NAME);
   const nodeId = firstString(env.OPENRIG_NODE_ID, env.RIGGED_NODE_ID);
   const runtime = firstString(env.OPENRIG_RUNTIME, env.RIGGED_RUNTIME);
+  const generation = firstString(env.OPENRIG_OCCUPANT_GENERATION, env.RIGGED_OCCUPANT_GENERATION);
   const hookEvent = firstString(
     providerPayload.hookEvent,
     providerPayload.hookEventName,
@@ -69,6 +70,7 @@ function buildOpenRigPayload(providerPayload, env = process.env, now = () => new
     sessionName,
     nodeId,
     runtime,
+    generation,
     hookEvent,
     subtype,
     occurredAt: now().toISOString(),

package/daemon/assets/plugins/openrig-core/hooks/scripts/compaction-restore-bridge.cjs

@@ -44,6 +44,15 @@ function firstString(...values) {
   return null;
 }
 
+// A3-R3 injectable clock (slice 51-01): the marker stamps below default to real
+// wall-clock, but become deterministic when the shared hermetic env-var
+// OPENRIG_TEST_CLOCK_NOW is set (an ISO instant). An empty/absent var = production
+// real-time (absence is the production state — the only unguarded path, on purpose).
+function nowIso(env = process.env) {
+  const injected = env.OPENRIG_TEST_CLOCK_NOW;
+  return typeof injected === "string" && injected.trim().length > 0 ? injected : new Date().toISOString();
+}
+
 function openrigHome(env = process.env) {
   return firstString(env.OPENRIG_HOME, env.RIGGED_HOME) || path.join(os.homedir(), ".openrig");
 }
@@ -97,6 +106,24 @@ function findMarker(payload, env = process.env) {
   return marker;
 }
 
+// R5 absent-when-needed: the expected-sentinel the PreCompact hook drops FIRST (same seat
+// key + identity binding as the marker). Its presence-without-a-marker is what makes an
+// absent marker LOUD; its lifecycle mirrors the marker (removed once the marker delivers).
+function sentinelPath(payload, env = process.env) {
+  const key = sessionKey(payload, env);
+  return key ? path.join(markerDir(env), `${key}.expected.json`) : null;
+}
+
+function findSentinel(payload, env = process.env) {
+  const p = sentinelPath(payload, env);
+  return p ? readMarker(p) : null;
+}
+
+function removeSentinel(payload, env = process.env) {
+  const p = sentinelPath(payload, env);
+  if (p) { try { fs.unlinkSync(p); } catch { /* best-effort cleanup */ } }
+}
+
 function writeMarker(marker) {
   fs.writeFileSync(marker.filePath, `${JSON.stringify(marker.data, null, 2)}\n`, "utf8");
 }
@@ -123,6 +150,22 @@ function buildRestoreContext(marker) {
   return pieces.join("\n");
 }
 
+// R5 marker-lifecycle (stale-firing-premise-false): a marker records the identity of
+// the compaction it was written for (its own transcriptPath / sessionId, stamped by the
+// PreCompact writer from the same Claude input). The bridge fires ONLY when the current
+// start MATCHES that premise — binding to EVENT+IDENTITY, not recency (a clock window
+// misfires both directions; recency would only ever be a belt). A legacy marker that
+// recorded no identity falls back to the seat-key + deliver-once behavior (transitional).
+function premiseMatches(markerData, payload) {
+  const markerTranscript = firstString(markerData.transcriptPath);
+  const markerSession = firstString(markerData.sessionId);
+  if (!markerTranscript && !markerSession) return true; // legacy marker: no identity to gate on
+  const payloadTranscript = firstString(payload.transcript_path, payload.transcriptPath);
+  const payloadSession = firstString(payload.session_id, payload.sessionId);
+  if (markerTranscript) return payloadTranscript === markerTranscript;
+  return payloadSession === markerSession;
+}
+
 function hookEventName(payload) {
   return firstString(
     payload.hook_event_name,
@@ -138,22 +181,41 @@ async function main() {
   const payload = parseJson(await readStdin());
   const eventName = hookEventName(payload);
   const marker = findMarker(payload);
-  if (!marker) return;
+  if (!marker) {
+    // R5 absent-when-needed: LOUD iff a matching expected-sentinel is present (a compaction
+    // WAS expected for this seat/session — the PreCompact hook drops the sentinel FIRST) but
+    // the marker is absent/unresolvable (write failed / hook died partway / packet lost).
+    // No sentinel = no hook = policy off = silent by construction. Stderr, so it never
+    // pollutes the additionalContext stdout.
+    const sentinel = findSentinel(payload);
+    if (sentinel && premiseMatches(sentinel.data, payload)) {
+      process.stderr.write(
+        "OpenRig compaction restore: a restore packet was EXPECTED for this session but its marker is missing or unresolvable — the PreCompact write may have failed. Fall back to the JSONL restore (claude-compaction-restore skill).\n",
+      );
+    }
+    return;
+  }
 
   marker.data.lastBridgeEvent = eventName;
   if (eventName === "PostCompact") {
-    marker.data.postCompactAt = new Date().toISOString();
+    marker.data.postCompactAt = nowIso();
     writeMarker(marker);
     return;
   }
 
+  // R5: stale-firing gate — never deliver a marker written for a different compaction.
+  if (!premiseMatches(marker.data, payload)) {
+    return;
+  }
+
   if (marker.data.deliveryCount && marker.data.deliveryCount > 0) {
     return;
   }
 
-  marker.data.deliveredAt = new Date().toISOString();
+  marker.data.deliveredAt = nowIso();
   marker.data.deliveryCount = Number(marker.data.deliveryCount || 0) + 1;
   writeMarker(marker);
+  removeSentinel(payload); // R5: expectation fulfilled — clear the sentinel so it can't false-loud later
 
   process.stdout.write(`${JSON.stringify({
     continue: true,

package/daemon/assets/plugins/openrig-core/skills/claude-compaction-restore/scripts/precompact-hook.mjs

@@ -6,7 +6,12 @@ import { spawnSync } from "node:child_process";
 
 const skillRoot = path.resolve(new URL("..", import.meta.url).pathname);
 const restoreScript = path.join(skillRoot, "scripts", "restore-from-jsonl.mjs");
-const outRoot = "/tmp/claude-compaction-restore";
+// P6(C) injectable output-root: the packet base defaults to the shared
+// /tmp/claude-compaction-restore (production), but becomes per-run isolated when the
+// hermetic env-var OPENRIG_COMPACTION_OUT_ROOT is set — so concurrent writers with the
+// same injected clock + sessionId no longer collide on the same `${sessionId}-${stamp}`
+// dir. Mirrors the injectable-clock seam (OPENRIG_TEST_CLOCK_NOW). Empty/absent = /tmp.
+const outRoot = process.env.OPENRIG_COMPACTION_OUT_ROOT || "/tmp/claude-compaction-restore";
 const defaultRestoreInstruction =
   "Read the claude-compaction-restore skill and follow its \"If You Just Compacted\" protocol.";
 
@@ -24,6 +29,14 @@ function getOpenRigHome() {
   return process.env.OPENRIG_HOME || process.env.RIGGED_HOME || path.join(os.homedir(), ".openrig");
 }
 
+// A3-R3 injectable clock (slice 51-01): marker.createdAt defaults to real wall-clock,
+// but becomes deterministic when the shared hermetic env-var OPENRIG_TEST_CLOCK_NOW is
+// set (an ISO instant). Empty/absent = production real-time.
+function nowIso() {
+  const injected = process.env.OPENRIG_TEST_CLOCK_NOW;
+  return typeof injected === "string" && injected.trim().length > 0 ? injected : new Date().toISOString();
+}
+
 function expandInstructionPath(filePath) {
   if (filePath.startsWith("~/")) return path.join(os.homedir(), filePath.slice(2));
   if (filePath.startsWith("${OPENRIG_HOME}/")) {
@@ -41,6 +54,50 @@ function readInstructionFile(filePath) {
   return fs.readFileSync(expanded, "utf8");
 }
 
+// OPR.0.4.1.09 / R5 marker-lifecycle (foreign-content-in-marker face): the hook
+// path must apply the SAME seat-check the daemon enforcer's resolvePostCompactExtra
+// applies (rev1-r2 dcd95bd9), or a FOREIGN seat's global messageFilePath leaks into
+// THIS seat's marker. Parse a WELL-FORMED leading `---` frontmatter for a declared
+// seat (target_seat / seat / session); body text is never scanned; a broken/absent
+// fence is GENERIC (valid for any seat). Byte-mirrors the enforcer regexes.
+function declaredSeatOf(content) {
+  const fm = /^\s*---\s*\n([\s\S]*?)\n---/.exec(content);
+  if (!fm) return null;
+  const m = /^[ \t]*(?:target[_-]?seat|seat|session(?:[_-]?name)?)[ \t]*:[ \t]*["']?([^"'\n#]+?)["']?[ \t]*$/im.exec(fm[1]);
+  return m ? m[1].trim() : null;
+}
+
+function sanitizeSeat(value) {
+  return value.replace(/[^a-zA-Z0-9_.@-]/g, "_");
+}
+
+// Resolve the post-compaction extra FOR THIS SEAT (mirror of the enforcer): (1) prefer
+// a per-seat compaction/post-compact-extra/<seat>.md — no cross-seat contamination
+// possible; (2) fall back to the global ONLY when it does not declare a DIFFERENT seat
+// (a wrong-seat global is REFUSED). Generic/undeclared/configured-but-absent stay
+// allowed. Returns the path to read, or null when nothing valid for this seat.
+function resolveSeatSafeExtraPath(globalFilePathRaw) {
+  const rawSeat = process.env.OPENRIG_SESSION_NAME || process.env.RIGGED_SESSION_NAME || "";
+  const seatKey = rawSeat ? sanitizeSeat(rawSeat) : "";
+  if (seatKey) {
+    const perSeatPath = path.join(getOpenRigHome(), "compaction", "post-compact-extra", `${seatKey}.md`);
+    if (fs.existsSync(perSeatPath)) {
+      const declared = declaredSeatOf(fs.readFileSync(perSeatPath, "utf8"));
+      if (declared && sanitizeSeat(declared) !== seatKey) return null; // wrong-seat per-seat file
+      return perSeatPath;
+    }
+  }
+  const trimmed = (globalFilePathRaw || "").trim();
+  if (!trimmed) return null;
+  const expanded = expandInstructionPath(trimmed);
+  // configured-but-absent: keep the path (an absent file cannot be a wrong-seat leak;
+  // readInstructionFile returns "" so nothing is appended).
+  if (!fs.existsSync(expanded)) return trimmed;
+  const declared = declaredSeatOf(fs.readFileSync(expanded, "utf8"));
+  if (declared && sanitizeSeat(declared) !== seatKey) return null; // foreign-seat global REFUSED
+  return trimmed;
+}
+
 function sessionKey(input) {
   const raw = [
     process.env.OPENRIG_SESSION_NAME,
@@ -58,12 +115,28 @@ function pendingMarkerPath(input) {
   return path.join(getOpenRigHome(), "compaction", "restore-pending", `${sessionKey(input)}.json`);
 }
 
+// R5 absent-when-needed: drop a lightweight EXPECTED sentinel FIRST (before the packet is
+// generated + the marker is written), carrying the SAME identity binding the marker gets.
+// Its presence-without-a-marker is what lets the bridge be LOUD about a missing packet
+// (hook died partway / write failed); policy off = no hook = no sentinel = silent.
+function writeExpectedSentinel(input) {
+  const p = path.join(getOpenRigHome(), "compaction", "restore-pending", `${sessionKey(input)}.expected.json`);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, `${JSON.stringify({
+    version: 1,
+    sessionName: process.env.OPENRIG_SESSION_NAME || process.env.RIGGED_SESSION_NAME || null,
+    sessionId: input.session_id || input.sessionId || null,
+    transcriptPath: input.transcript_path || null,
+    createdAt: nowIso(),
+  }, null, 2)}\n`, "utf8");
+}
+
 function writePendingRestoreMarker(input, parsed, restoreInstruction, customMessage) {
   const markerPath = pendingMarkerPath(input);
   fs.mkdirSync(path.dirname(markerPath), { recursive: true });
   const payload = {
     version: 1,
-    createdAt: new Date().toISOString(),
+    createdAt: nowIso(),
     sessionName: process.env.OPENRIG_SESSION_NAME || process.env.RIGGED_SESSION_NAME || null,
     sessionId: input.session_id || input.sessionId || null,
     transcriptPath: input.transcript_path || null,
@@ -118,13 +191,18 @@ function readClaudeCompactionMessage() {
     parts.push(`Inline restore instruction:\n${inline}`);
   }
   if (filePath && filePath.length > 0) {
-    try {
-      const fileText = readInstructionFile(filePath);
-      if (fileText) {
-        parts.push(`Additional restore instruction file (${filePath}):\n${fileText}`);
+    // R5 seat-check: resolve to the per-seat extra or a seat-safe global; a
+    // foreign-seat global resolves to null and is never injected into this marker.
+    const resolved = resolveSeatSafeExtraPath(filePath);
+    if (resolved) {
+      try {
+        const fileText = readInstructionFile(resolved);
+        if (fileText) {
+          parts.push(`Additional restore instruction file (${resolved}):\n${fileText}`);
+        }
+      } catch {
+        // Keep any inline instruction; unreadable extra files degrade quietly.
       }
-    } catch {
-      // Keep any inline instruction; unreadable extra files degrade quietly.
     }
   }
   if (parts.length > 0) return parts.join("\n\n");
@@ -140,7 +218,16 @@ function buildSystemMessage(restoreInstruction, customMessage) {
 }
 
 try {
+  // Slice 51-01 RIDER (leak-visibility, review-r1 escalation): OPENRIG_TEST_CLOCK_NOW is
+  // read by nowIso() to make createdAt deterministic in tests — but a LEAKED var in a
+  // real seat would silently FREEZE production createdAt. Announce loudly on stderr when
+  // active so any leak is visible in seat logs; absence stays silent (production path).
+  // MUST stay byte-identical to STUB_CLOCK_ANNOUNCEMENT in stub-runner.ts.
+  if (typeof process.env.OPENRIG_TEST_CLOCK_NOW === "string" && process.env.OPENRIG_TEST_CLOCK_NOW.trim().length > 0) {
+    process.stderr.write("OPENRIG_TEST_CLOCK_NOW active — timestamps are injected\n");
+  }
   const input = readHookInput();
+  writeExpectedSentinel(input); // R5: sentinel FIRST, before the packet + marker (catches hook-died-partway)
   const args = [restoreScript, "--out", outRoot, "--json"];
   if (input.cwd) args.push("--cwd", input.cwd);
   if (input.transcript_path && input.transcript_path.endsWith(".jsonl") && fs.existsSync(input.transcript_path)) {

package/daemon/assets/plugins/openrig-core/skills/claude-compaction-restore/scripts/restore-from-jsonl.mjs

@@ -5,7 +5,10 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 
 const TEXT_LIMIT = 4000;
-const DEFAULT_OUT = "/tmp/claude-compaction-restore";
+// P6(C) injectable output-root (mirrors precompact-hook.mjs): per-run isolation when
+// OPENRIG_COMPACTION_OUT_ROOT is set, real /tmp default in production. Guards a direct
+// invocation (the hook passes --out explicitly) against the same cross-writer collision.
+const DEFAULT_OUT = process.env.OPENRIG_COMPACTION_OUT_ROOT || "/tmp/claude-compaction-restore";
 
 function parseArgs(argv) {
   const args = {
@@ -375,8 +378,16 @@ function restoreInstructions(summary, outputPaths) {
   return lines.join("\n");
 }
 
+// A3-R3 injectable clock (slice 51-01): the packet output-dir timestamped path
+// defaults to real wall-clock, but becomes deterministic when the shared hermetic
+// env-var OPENRIG_TEST_CLOCK_NOW is set (an ISO instant). Empty/absent = production.
+function nowIso() {
+  const injected = process.env.OPENRIG_TEST_CLOCK_NOW;
+  return typeof injected === "string" && injected.trim().length > 0 ? injected : new Date().toISOString();
+}
+
 function writeOutputs(summary, outRoot) {
-  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const stamp = nowIso().replace(/[:.]/g, "-");
   const base = path.join(outRoot, `${summary.sessionId ?? "unknown-session"}-${stamp}`);
   fs.mkdirSync(base, { recursive: true });
 

package/daemon/dist/adapters/claude-code-adapter.d.ts

@@ -32,6 +32,9 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
     private autoDriveProviderPrompts;
     private activityRelayPath;
     private claudeHooksManifestPath;
+    /** P20 — called after a projected file is written to a target, so the manifest
+     *  records what we last wrote (→ operator-vs-stale discrimination). No-op by default. */
+    private recordProjection;
     constructor(deps: {
         tmux: TmuxAdapter;
         fsOps: ClaudeAdapterFsOps;
@@ -45,6 +48,9 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
         /** DI source of the canonical claude.json hooks manifest — the event vocabulary
          *  is derived (filtered to relay events) from it, not a parallel constant. */
         claudeHooksManifestPath?: string;
+        /** P20 — record-at-apply hook (startup wires it to the projection manifest store).
+         *  Absent → no-op (the manifest stays empty → discrimination safe-degrades to P17). */
+        recordProjection?: (targetPath: string, content: string) => void;
     });
     listInstalled(binding: NodeBinding): Promise<InstalledResource[]>;
     project(plan: ProjectionPlan, binding: NodeBinding): Promise<ProjectionResult>;

package/daemon/dist/adapters/claude-code-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAMvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,sHAAsH;IACtH,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,mGAAmG;IACnG,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IACtD,QAAQ,CAAC,OAAO,iBAAiB;IACjC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,gBAAgB,CAAe;IACvC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,wBAAwB,CAAU;IAC1C,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,uBAAuB,CAAgB;gBAEnC,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;QAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,iFAAiF;QACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;sFAC8E;QAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC;IAYK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmD9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IA+EzB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAqBhE,8FAA8F;IAC9F,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI3F,wFAAwF;IACxF,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;YAM7E,kBAAkB;IAkFhC,OAAO,CAAC,YAAY;IAuDpB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,iBAAiB;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAmBrB;;;;OAIG;IACH;;;;;;OAMG;YACW,kBAAkB;IAehC,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAmB/B,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;CA+ErC"}
+{"version":3,"file":"claude-code-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAOvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,sHAAsH;IACtH,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,mGAAmG;IACnG,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IACtD,QAAQ,CAAC,OAAO,iBAAiB;IACjC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,gBAAgB,CAAe;IACvC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,wBAAwB,CAAU;IAC1C,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,uBAAuB,CAAgB;IAC/C;6FACyF;IACzF,OAAO,CAAC,gBAAgB,CAAgD;gBAE5D,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;QAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,iFAAiF;QACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;sFAC8E;QAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;+FACuF;QACvF,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;KAClE;IAaK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmD9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA0DlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IAyFzB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAqBhE,8FAA8F;IAC9F,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI3F,wFAAwF;IACxF,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;YAM7E,kBAAkB;IAkFhC,OAAO,CAAC,YAAY;IAuDpB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,iBAAiB;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAmBrB;;;;OAIG;IACH;;;;;;OAMG;YACW,kBAAkB;IAehC,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAmB/B,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;CA+ErC"}

package/daemon/dist/adapters/claude-code-adapter.js

@@ -7,6 +7,7 @@ import { assessNativeResumeProbe } from "../domain/native-resume-probe.js";
 import { mergeManagedBlock } from "../domain/managed-blocks.js";
 import { shellQuote } from "./shell-quote.js";
 import { validateClaudeActivityHookDelivery } from "../domain/claude-activity-hooks.js";
+import { observeClaudePermission } from "../domain/permission-drift.js";
 const SHELL_COMMANDS = new Set(["bash", "fish", "nu", "sh", "tmux", "zsh"]);
 // Real Claude Code binary needs 1-3s to write the new fork session-name
 // file under ~/.claude/sessions/. Poll instead of single-shot lookup.
@@ -29,6 +30,9 @@ export class ClaudeCodeAdapter {
     autoDriveProviderPrompts;
     activityRelayPath;
     claudeHooksManifestPath;
+    /** P20 — called after a projected file is written to a target, so the manifest
+     *  records what we last wrote (→ operator-vs-stale discrimination). No-op by default. */
+    recordProjection;
     constructor(deps) {
         this.tmux = deps.tmux;
         this.fs = deps.fsOps;
@@ -39,6 +43,7 @@ export class ClaudeCodeAdapter {
         this.autoDriveProviderPrompts = deps.autoDriveProviderPrompts ?? false;
         this.activityRelayPath = deps.activityRelayPath ?? null;
         this.claudeHooksManifestPath = deps.claudeHooksManifestPath ?? null;
+        this.recordProjection = deps.recordProjection ?? (() => { });
     }
     async listInstalled(binding) {
         const results = [];
@@ -131,7 +136,11 @@ export class ClaudeCodeAdapter {
                     case "skill_install": {
                         const targetDir = nodePath.join(binding.cwd, ".claude", "skills", nodePath.basename(nodePath.dirname(file.absolutePath)));
                         this.fs.mkdirp(targetDir);
-                        this.fs.writeFile(nodePath.join(targetDir, nodePath.basename(file.path)), content);
+                        const skillTarget = nodePath.join(targetDir, nodePath.basename(file.path));
+                        this.fs.writeFile(skillTarget, content);
+                        // P20 — record what we just wrote so the next projection can tell a
+                        // stale re-projection (safe overwrite) from an operator edit (protect).
+                        this.recordProjection(skillTarget, content);
                         break;
                     }
                     case "send_text": {
@@ -168,6 +177,15 @@ export class ClaudeCodeAdapter {
         // The SAME decision (claudePostureFlag) is used on the restore path (claude-resume.ts).
         // OPR.0.4.8.3 Seam B: a per-seat resolved policy posture (binding.launchPosture) overrides env.
         const permissionMode = claudePostureFlag(process.env, binding.launchPosture);
+        const appliedLaunch = observeClaudePermission(permissionMode);
+        // 51-07: a per-agent model declared in the spec (member.model ?? profile ?? defaults, resolved
+        // onto binding.model at instantiate) is emitted as `--model <x>` on the launch command. Absent →
+        // empty string → the command is byte-identical (regression pin). ADDITIVE ONLY: this sits beside
+        // the permissionMode/posture flag but never alters it (the D1 model-only fence). Mirrors codex's
+        // modelArg (codex-runtime-adapter.ts). NOTE: the restore path (claude-resume.ts) + the native
+        // resume-cmd builder are the named A2 restore-parity follow-on, not this atom.
+        const model = binding.model?.trim();
+        const modelArg = model ? ` --model ${shellQuote(model)}` : "";
         // Fork branch: build `claude --resume <parent> --fork-session --name <seat>`
         // and capture the NEW post-fork session id. The parent token is NEVER
         // persisted onto the new seat record (identity-honesty bedrock).
@@ -182,7 +200,7 @@ export class ClaudeCodeAdapter {
             if (!parentId) {
                 return { ok: false, error: "claude-code fork: forkSource.value is required (parent native_id)" };
             }
-            const cmd = `claude ${permissionMode} --resume ${parentId} --fork-session --name ${opts.name}`;
+            const cmd = `claude ${permissionMode}${modelArg} --resume ${parentId} --fork-session --name ${opts.name}`;
             const textResult = await this.tmux.sendText(binding.tmuxSession, cmd);
             if (!textResult.ok) {
                 return { ok: false, error: `Failed to send launch command: ${textResult.message}` };
@@ -203,12 +221,12 @@ export class ClaudeCodeAdapter {
                     error: `claude-code fork: could not capture new post-fork session id from claude session storage after ${FORK_POLL_ATTEMPTS} polls (${(FORK_POLL_ATTEMPTS * FORK_POLL_DELAY_MS) / 1000}s ceiling)`,
                 };
             }
-            return { ok: true, resumeToken: newToken, resumeType: "claude_id" };
+            return { ok: true, resumeToken: newToken, resumeType: "claude_id", appliedLaunch };
         }
         const generatedSessionId = opts.resumeToken ? null : this.sessionIdFactory();
         const cmd = opts.resumeToken
-            ? `claude ${permissionMode} --resume ${opts.resumeToken} --name ${opts.name}`
-            : `claude ${permissionMode} --session-id ${generatedSessionId} --name ${opts.name}`;
+            ? `claude ${permissionMode}${modelArg} --resume ${opts.resumeToken} --name ${opts.name}`
+            : `claude ${permissionMode}${modelArg} --session-id ${generatedSessionId} --name ${opts.name}`;
         const textResult = await this.tmux.sendText(binding.tmuxSession, cmd);
         if (!textResult.ok) {
             return { ok: false, error: `Failed to send launch command: ${textResult.message}` };
@@ -222,12 +240,12 @@ export class ClaudeCodeAdapter {
             const verification = await this.verifyResumeLaunch(binding.tmuxSession);
             if (!verification.ok)
                 return verification;
-            return { ok: true, resumeToken: opts.resumeToken, resumeType: "claude_id" };
+            return { ok: true, resumeToken: opts.resumeToken, resumeType: "claude_id", appliedLaunch };
         }
         // Belt-and-suspenders: prefer an immediately discoverable persisted session,
         // but fall back to the UUID we assigned explicitly at launch time.
         const token = this.captureResumeToken(opts.name);
-        return { ok: true, resumeToken: token ?? generatedSessionId ?? undefined, resumeType: "claude_id" };
+        return { ok: true, resumeToken: token ?? generatedSessionId ?? undefined, resumeType: "claude_id", appliedLaunch };
     }
     async checkReady(binding) {
         if (!binding.tmuxSession) {