@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/policy/subagent-approval-policy.js

@@ -1 +1,55 @@
-const u=1,p="max",s="[P201-EV-MAX-POLICY]",c=new Set(["claude-code","cursor","vscode","gemini","codex","opencode","github-copilot-cli","kimi","antigravity","openclaw","grok","runner","unknown"]),r=e=>c.has(e)?e:"unknown",d=Object.freeze({"claude-code":{status:"validated",scope:"child",fallbackMode:"none",fallbackReasonCode:null},opencode:{status:"unvalidated",scope:"child",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},codex:{status:"unvalidated",scope:"inherited",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},gemini:{status:"unvalidated",scope:"inherited",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},vscode:{status:"unvalidated",scope:"session",fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},"github-copilot-cli":{status:"unvalidated",scope:"session",fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},kimi:{status:"unvalidated",scope:"inherited",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},cursor:{status:"unvalidated",scope:"session",fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},antigravity:{status:"unvalidated",scope:"inherited",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},grok:{status:"unvalidated",scope:"inherited",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},openclaw:{status:"unsupported",scope:"none",fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unsupported"},runner:{status:"unsupported",scope:"none",fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unsupported"},unknown:{status:"unsupported",scope:"none",fallbackMode:"shell-loop",fallbackReasonCode:"platform-target-unknown"}}),n=Object.freeze({disabled:0,standard:1,max:2});function f(e){return e==="max"||e==="standard"||e==="disabled"}function i(e){const a=r(e),o=d[a];return a==="unknown"?Object.freeze({platformTarget:a,maximumMode:"disabled",scope:o.scope,reductionReason:"platform-target-unknown"}):o.status==="unsupported"?Object.freeze({platformTarget:a,maximumMode:"disabled",scope:o.scope,reductionReason:"host-capability-unsupported"}):o.status==="unvalidated"?Object.freeze({platformTarget:a,maximumMode:"standard",scope:o.scope,reductionReason:"host-capability-unvalidated"}):Object.freeze({platformTarget:a,maximumMode:"max",scope:o.scope,reductionReason:"host-policy-reduced"})}function b(e={}){const a=e.userOverride??"max",o=e.hostPolicy??i(e.platformTarget),t=d[o.platformTarget],l=n[a]>n[o.maximumMode];return Object.freeze({schemaVersion:1,requestedMode:a,effectiveMode:l?o.maximumMode:a,source:e.userOverride?"user-override":"managed-default",platformTarget:o.platformTarget,scope:o.scope,effectiveReason:l?o.reductionReason:"requested-mode-honored",fallbackMode:t.fallbackMode,fallbackReasonCode:t.fallbackReasonCode})}function m(e,a,o){return Object.freeze({evidence:s,event:e,occurredAt:o,...a})}export{s as SUBAGENT_APPROVAL_EVIDENCE,p as SUBAGENT_APPROVAL_MANAGED_DEFAULT,u as SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,m as createSubagentApprovalAuditEvent,i as deriveSubagentHostApprovalPolicy,f as isSubagentApprovalMode,b as resolveSubagentApprovalPolicy};
+export const SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION = 1;
+export const SUBAGENT_APPROVAL_MANAGED_DEFAULT = 'max';
+export const SUBAGENT_APPROVAL_EVIDENCE = '[P201-EV-MAX-POLICY]';
+const TARGETS = new Set(['claude-code', 'cursor', 'vscode', 'gemini', 'codex', 'opencode', 'github-copilot-cli', 'kimi', 'antigravity', 'openclaw', 'grok', 'runner', 'unknown']);
+const normalizeTarget = (value) => TARGETS.has(value) ? value : 'unknown';
+const MATRIX = Object.freeze({
+    'claude-code': { status: 'validated', scope: 'child', fallbackMode: 'none', fallbackReasonCode: null },
+    opencode: { status: 'unvalidated', scope: 'child', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    codex: { status: 'unvalidated', scope: 'inherited', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    gemini: { status: 'unvalidated', scope: 'inherited', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    vscode: { status: 'unvalidated', scope: 'session', fallbackMode: 'root-inline', fallbackReasonCode: 'platform-child-unvalidated' },
+    'github-copilot-cli': { status: 'unvalidated', scope: 'session', fallbackMode: 'root-inline', fallbackReasonCode: 'platform-child-unvalidated' },
+    kimi: { status: 'unvalidated', scope: 'inherited', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    cursor: { status: 'unvalidated', scope: 'session', fallbackMode: 'root-inline', fallbackReasonCode: 'platform-child-unvalidated' },
+    antigravity: { status: 'unvalidated', scope: 'inherited', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    grok: { status: 'unvalidated', scope: 'inherited', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unvalidated' },
+    openclaw: { status: 'unsupported', scope: 'none', fallbackMode: 'root-inline', fallbackReasonCode: 'platform-child-unsupported' },
+    runner: { status: 'unsupported', scope: 'none', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-child-unsupported' },
+    unknown: { status: 'unsupported', scope: 'none', fallbackMode: 'shell-loop', fallbackReasonCode: 'platform-target-unknown' },
+});
+const MODE_RANK = Object.freeze({ disabled: 0, standard: 1, max: 2 });
+export function isSubagentApprovalMode(value) {
+    return value === 'max' || value === 'standard' || value === 'disabled';
+}
+export function deriveSubagentHostApprovalPolicy(platformTarget) {
+    const target = normalizeTarget(platformTarget);
+    const capability = MATRIX[target];
+    if (target === 'unknown')
+        return Object.freeze({ platformTarget: target, maximumMode: 'disabled', scope: capability.scope, reductionReason: 'platform-target-unknown' });
+    if (capability.status === 'unsupported')
+        return Object.freeze({ platformTarget: target, maximumMode: 'disabled', scope: capability.scope, reductionReason: 'host-capability-unsupported' });
+    if (capability.status === 'unvalidated')
+        return Object.freeze({ platformTarget: target, maximumMode: 'standard', scope: capability.scope, reductionReason: 'host-capability-unvalidated' });
+    return Object.freeze({ platformTarget: target, maximumMode: 'max', scope: capability.scope, reductionReason: 'host-policy-reduced' });
+}
+export function resolveSubagentApprovalPolicy(input = {}) {
+    const requestedMode = input.userOverride ?? SUBAGENT_APPROVAL_MANAGED_DEFAULT;
+    const hostPolicy = input.hostPolicy ?? deriveSubagentHostApprovalPolicy(input.platformTarget);
+    const capability = MATRIX[hostPolicy.platformTarget];
+    const reduced = MODE_RANK[requestedMode] > MODE_RANK[hostPolicy.maximumMode];
+    return Object.freeze({
+        schemaVersion: 1,
+        requestedMode,
+        effectiveMode: reduced ? hostPolicy.maximumMode : requestedMode,
+        source: input.userOverride ? 'user-override' : 'managed-default',
+        platformTarget: hostPolicy.platformTarget,
+        scope: hostPolicy.scope,
+        effectiveReason: reduced ? hostPolicy.reductionReason : 'requested-mode-honored',
+        fallbackMode: capability.fallbackMode,
+        fallbackReasonCode: capability.fallbackReasonCode,
+    });
+}
+export function createSubagentApprovalAuditEvent(event, resolution, occurredAt) {
+    return Object.freeze({ evidence: SUBAGENT_APPROVAL_EVIDENCE, event, occurredAt, ...resolution });
+}

package/packages/client/dist/private-execution/clean-baseline.js

@@ -1,2 +1,279 @@
-import{execFileSync as z}from"node:child_process";import{createHash as d}from"node:crypto";import{existsSync as C,lstatSync as x,readFileSync as v}from"node:fs";import{join as y,resolve as f}from"node:path";import{assertGitLifecyclePrivateFile as b,ensureGitLifecyclePrivateChildDirectory as E,gitLifecycleRuntimeDirectory as m,readGitLifecycleRuntimeSync as w}from"../git/git-lifecycle-store.js";import{anchoredAtomicWriteFile as H}from"../git/secure-filesystem-boundary.js";const N="809db253d486b5d2620d318666219e8a2b4df05016174ba3c8a33fa17b65802a";function G(r){if(!r||typeof r!="object"||Array.isArray(r))return!1;const e=r,t=e.steps_completed;return e.status!=="branch-ready"||typeof e.last_step!="string"||!Array.isArray(t)||t.length!==1||typeof t[0]!="string"||e.last_step.length>128||t[0].length>128||e.last_step!==t[0]?!1:d("sha256").update(e.last_step).digest("hex")===N}function g(r,e){const t=JSON.parse(r);if(!t||typeof t!="object"||Array.isArray(t))throw new Error("private-execution-clean-baseline-write-set-invalid");const i=t.stories,n=i&&typeof i=="object"&&!Array.isArray(i)?i[e]:void 0,a=n&&typeof n=="object"&&!Array.isArray(n)?n.files_to_modify:void 0;if(a!==void 0&&(!Array.isArray(a)||a.length>1024||a.some(c=>typeof c!="string"||c.length===0||c.length>1024||c.startsWith("/")||c.includes("\\")||c.includes("\0")||c.startsWith(".git/")||c.split("/").includes(".."))))throw new Error("private-execution-clean-baseline-write-set-invalid");if(!n)throw new Error("private-execution-clean-baseline-write-set-invalid");return[...new Set(a??[])].sort()}function I(r,e){const t=g(r,e);return d("sha256").update("private-yolo-authorized-write-set-v1\0").update(JSON.stringify(t)).digest("hex")}function A(r,e){const t=y(r,".neocortex","state.json"),i=x(t);if(!i.isFile()||i.isSymbolicLink())throw new Error("private-execution-clean-baseline-write-set-invalid");return I(v(t,"utf8"),e)}function _(r,e){return I(p(r,["show","HEAD:.neocortex/state.json"],16*1024*1024).toString("utf8"),e)}function p(r,e,t=1024*1024){const i={...process.env};for(const n of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete i[n];return z("git",[...e],{cwd:r,env:i,stdio:["ignore","pipe","pipe"],timeout:15e3,maxBuffer:t})}function l(r){return p(r,["rev-parse","HEAD"]).toString("utf8").trim()}function R(r){return p(r,["symbolic-ref","--quiet","--short","HEAD"]).toString("utf8").trim()}function O(r,e,t){const n=w(r,{required:!0}).epics[e]?.branch_lease,a=n&&typeof n=="object"&&!Array.isArray(n)?n:void 0,c=a?.ownerStoryId===t?a.sessionId:void 0;if(typeof c!="string"||!/^setup-[a-f0-9]{64}$/.test(c)||c!==a?.idempotencyKey||typeof a?.expiresAt!="string"||!Number.isFinite(Date.parse(a.expiresAt))||Date.parse(a.expiresAt)<=Date.now())throw new Error("private-execution-clean-baseline-lease-invalid");return c}async function T(r,e){const t=await m(r),i=await E(t,"private-execution"),n=`baseline-${d("sha256").update(e).digest("hex")}.json`;return{parent:i,name:n,path:y(i,n)}}async function P(r,e,t,i){try{const n=await m(r),a=await E(n,"private-execution"),c=`session-${d("sha256").update(e).digest("hex")}.json`,h=y(a,c);if(!C(h))return!1;await b(h,a);const s=JSON.parse(v(h,"utf8"));if(!s||typeof s!="object"||Array.isArray(s))return!1;const o=s,u=o.workspace&&typeof o.workspace=="object"&&!Array.isArray(o.workspace)?o.workspace:void 0,S=Number(o.sequence),D=w(r,{required:!0}).stories[e],W=S===0&&o.lastPatchSha256===null&&o.snapshotSha===u?.baseSha&&Array.isArray(o.graphHistory)&&o.graphHistory.length===2&&G(D);return o.schemaVersion===1&&o.kind==="private-yolo-isolated-session"&&o.storyId===e&&o.initialGraphRevision===t.graphRevision&&o.graphRevision===i&&o.setupSessionId===t.setupSessionId&&Array.isArray(o.graphHistory)&&o.graphHistory.length>1&&o.graphHistory.length<=65&&o.graphHistory[0]===t.graphRevision&&o.graphHistory[o.graphHistory.length-1]===i&&new Set(o.graphHistory).size===o.graphHistory.length&&Number.isSafeInteger(o.sequence)&&(S>0||W)&&typeof o.snapshotSha=="string"&&/^[a-f0-9]{40,64}$/.test(o.snapshotSha)&&u?.sourceRoot===r&&u.baseSha===t.headSha&&u.executionBranch===t.executionBranch}catch{return!1}}function k(r,e){const t=p(r,["status","--porcelain=v1","-z","--untracked-files=all"]);return t.byteLength===0?!0:e!==void 0&&l(r)===e&&t.toString("utf8")===" M .neocortex/continuity/continuity.sqlite\0"&&x(y(r,".neocortex/continuity/continuity.sqlite")).isFile()}function M(r,e){const t=f(r);try{const i=l(t);if(!k(t,e))throw new Error("private-execution-checkout-dirty");if(l(t)!==i)throw new Error("private-execution-checkout-raced");return i}catch(i){throw i instanceof Error&&/^private-execution-[a-z-]+$/.test(i.message)?i:new Error("private-execution-checkout-unverified")}}async function V(r,e,t,i){const n=f(r);if(!/^[a-f0-9]{40,64}$/.test(t)||e.kind!=="direct-yolo-setup-receipt"||l(n)!==t||R(n)!==e.executionBranch||!k(n,i))throw new Error("private-execution-clean-baseline-raced");const a=w(n,{required:!0}),c=a.epics[e.epicId]?.branch_lease;if(c?.ownerStoryId!==e.storyId||c.setupHeadSha!==t||p(n,["merge-base","--is-ancestor",e.originHeadSha,t]).byteLength!==0)throw new Error("private-execution-clean-baseline-raced");const h=_(n,e.storyId);if(h!==A(n,e.storyId)||l(n)!==t)throw new Error("private-execution-clean-baseline-raced");const s=a.epics[e.epicId]?.graph_revision;if(typeof s!="string"||!/^[a-f0-9]{64}$/.test(s))throw new Error("private-execution-clean-baseline-graph-invalid");const o=Object.freeze({schemaVersion:3,kind:"private-yolo-clean-baseline",storyId:e.storyId,epicId:e.epicId,executionBranch:e.executionBranch,headSha:t,setupSessionId:O(n,e.epicId,e.storyId),graphRevision:s,authorizedWriteSetSha256:h}),u=await T(n,e.storyId);await H(u.parent,u.name,`${JSON.stringify(o)}
-`)}async function j(r,e,t,i,n){const a=f(r);try{const c=await T(a,e);await b(c.path,c.parent);const h=JSON.parse(v(c.path,"utf8"));if(!h||typeof h!="object"||Array.isArray(h))throw new Error("private-execution-clean-baseline-invalid");const s=h,o=w(a,{required:!0}).epics[s.epicId]?.graph_revision,u=o===s.graphRevision||n===s.graphRevision&&o===i||typeof o=="string"&&await P(a,e,s,o);if(Object.keys(s).sort().join(",")!==["schemaVersion","kind","storyId","epicId","executionBranch","headSha","setupSessionId","graphRevision","authorizedWriteSetSha256"].sort().join(",")||s.schemaVersion!==3||s.kind!=="private-yolo-clean-baseline"||s.storyId!==e||s.executionBranch!==t||s.epicId!==e.split(".")[0]||typeof s.headSha!="string"||!/^[a-f0-9]{40,64}$/.test(s.headSha)||typeof s.authorizedWriteSetSha256!="string"||!/^[a-f0-9]{64}$/.test(s.authorizedWriteSetSha256)||typeof s.graphRevision!="string"||!/^[a-f0-9]{64}$/.test(s.graphRevision)||i!==void 0&&o!==i||!u||s.authorizedWriteSetSha256!==_(a,e)||s.authorizedWriteSetSha256!==A(a,e)||s.setupSessionId!==O(a,s.epicId,e)||l(a)!==s.headSha||R(a)!==t)throw new Error("private-execution-clean-baseline-invalid")}catch{throw new Error("private-execution-clean-baseline-unverified")}}async function B(r,e,t,i){return j(r,e,t,i)}async function K(r,e,t,i){await B(r,e,t,i);try{const n=g(p(f(r),["show","HEAD:.neocortex/state.json"],16777216).toString("utf8"),e);if(n.length===0)throw new Error("write-set-empty");return Object.freeze([...n])}catch{throw new Error("private-execution-clean-baseline-unverified")}}async function U(r,e,t,i,n){await j(r,e,t,n,i);try{const a=g(p(f(r),["show","HEAD:.neocortex/state.json"],16777216).toString("utf8"),e);if(a.length===0)throw new Error("write-set-empty");return Object.freeze([...a])}catch{throw new Error("private-execution-clean-baseline-unverified")}}function X(r,e,t){try{const i=g(r,e);if(i.length!==t.length||i.some((n,a)=>n!==t[a]))throw new Error("write-set-drift")}catch{throw new Error("private-execution-clean-baseline-write-set-unverified")}}export{M as capturePrivateYoloCleanHead,G as privateYoloRootOnlySetupReady,K as readPrivateYoloFrozenWriteSet,U as readPrivateYoloFrozenWriteSetForTransition,V as recordPrivateYoloCleanBaseline,X as verifyPrivateYoloCandidateWriteSet,B as verifyPrivateYoloCleanBaseline};
+/** Physical clean-checkout provenance for the P222.16 private YOLO beta. */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { assertGitLifecyclePrivateFile, ensureGitLifecyclePrivateChildDirectory, gitLifecycleRuntimeDirectory, readGitLifecycleRuntimeSync, } from '../git/git-lifecycle-store.js';
+import { anchoredAtomicWriteFile } from '../git/secure-filesystem-boundary.js';
+// Compare the server-owned setup stage through its pinned digest. The
+// published client must not carry the workflow step identifier in plaintext.
+const ROOT_ONLY_SETUP_STEP_SHA256 = '809db253d486b5d2620d318666219e8a2b4df05016174ba3c8a33fa17b65802a';
+export function privateYoloRootOnlySetupReady(story) {
+    if (!story || typeof story !== 'object' || Array.isArray(story))
+        return false;
+    const record = story;
+    const steps = record.steps_completed;
+    if (record.status !== 'branch-ready' || typeof record.last_step !== 'string'
+        || !Array.isArray(steps) || steps.length !== 1 || typeof steps[0] !== 'string'
+        || record.last_step.length > 128 || steps[0].length > 128
+        || record.last_step !== steps[0])
+        return false;
+    return createHash('sha256').update(record.last_step).digest('hex') === ROOT_ONLY_SETUP_STEP_SHA256;
+}
+/** Freeze the clean C01 claim; an agent must not enlarge its own C08 write set. */
+function authorizedWriteSet(stateText, storyId) {
+    const state = JSON.parse(stateText);
+    if (!state || typeof state !== 'object' || Array.isArray(state)) {
+        throw new Error('private-execution-clean-baseline-write-set-invalid');
+    }
+    const stories = state.stories;
+    const story = stories && typeof stories === 'object' && !Array.isArray(stories)
+        ? stories[storyId] : undefined;
+    const files = story && typeof story === 'object' && !Array.isArray(story)
+        ? story.files_to_modify : undefined;
+    if (files !== undefined && (!Array.isArray(files) || files.length > 1024 || files.some((item) => typeof item !== 'string' || item.length === 0 || item.length > 1024
+        || item.startsWith('/') || item.includes('\\') || item.includes('\0')
+        || item.startsWith('.git/') || item.split('/').includes('..')))) {
+        throw new Error('private-execution-clean-baseline-write-set-invalid');
+    }
+    if (!story)
+        throw new Error('private-execution-clean-baseline-write-set-invalid');
+    return [...new Set(files ?? [])].sort();
+}
+function authorizedWriteSetSha256(stateText, storyId) {
+    const paths = authorizedWriteSet(stateText, storyId);
+    return createHash('sha256').update('private-yolo-authorized-write-set-v1\0')
+        .update(JSON.stringify(paths)).digest('hex');
+}
+function workingWriteSetSha256(root, storyId) {
+    const statePath = join(root, '.neocortex', 'state.json');
+    const stateFile = lstatSync(statePath);
+    if (!stateFile.isFile() || stateFile.isSymbolicLink()) {
+        throw new Error('private-execution-clean-baseline-write-set-invalid');
+    }
+    return authorizedWriteSetSha256(readFileSync(statePath, 'utf8'), storyId);
+}
+function committedWriteSetSha256(root, storyId) {
+    return authorizedWriteSetSha256(git(root, ['show', 'HEAD:.neocortex/state.json'], 16 * 1024 * 1024).toString('utf8'), storyId);
+}
+function git(root, args, maxBuffer = 1024 * 1024) {
+    const environment = { ...process.env };
+    for (const key of [
+        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
+    ])
+        delete environment[key];
+    return execFileSync('git', [...args], {
+        cwd: root, env: environment, stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 15_000, maxBuffer,
+    });
+}
+function physicalHead(root) {
+    return git(root, ['rev-parse', 'HEAD']).toString('utf8').trim();
+}
+function physicalBranch(root) {
+    return git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']).toString('utf8').trim();
+}
+function setupSessionId(root, epicId, storyId) {
+    const runtime = readGitLifecycleRuntimeSync(root, { required: true });
+    const rawLease = runtime.epics[epicId]?.branch_lease;
+    const lease = rawLease && typeof rawLease === 'object' && !Array.isArray(rawLease)
+        ? rawLease : undefined;
+    const sessionId = lease?.ownerStoryId === storyId ? lease.sessionId : undefined;
+    if (typeof sessionId !== 'string' || !/^setup-[a-f0-9]{64}$/.test(sessionId)
+        || sessionId !== lease?.idempotencyKey || typeof lease?.expiresAt !== 'string'
+        || !Number.isFinite(Date.parse(lease.expiresAt)) || Date.parse(lease.expiresAt) <= Date.now()) {
+        throw new Error('private-execution-clean-baseline-lease-invalid');
+    }
+    return sessionId;
+}
+async function location(root, storyId) {
+    const runtimeDirectory = await gitLifecycleRuntimeDirectory(root);
+    const parent = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'private-execution');
+    const name = `baseline-${createHash('sha256').update(storyId).digest('hex')}.json`;
+    return { parent, name, path: join(parent, name) };
+}
+async function sessionGraphContinuationMatches(root, storyId, baseline, graphRevision) {
+    try {
+        const runtimeDirectory = await gitLifecycleRuntimeDirectory(root);
+        const parent = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'private-execution');
+        const name = `session-${createHash('sha256').update(storyId).digest('hex')}.json`;
+        const path = join(parent, name);
+        if (!existsSync(path))
+            return false;
+        await assertGitLifecyclePrivateFile(path, parent);
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return false;
+        const session = value;
+        const workspace = session.workspace && typeof session.workspace === 'object'
+            && !Array.isArray(session.workspace) ? session.workspace : undefined;
+        const sequence = Number(session.sequence);
+        const runtimeStory = readGitLifecycleRuntimeSync(root, { required: true }).stories[storyId];
+        const rootOnlySetupTransition = sequence === 0
+            && session.lastPatchSha256 === null
+            && session.snapshotSha === workspace?.baseSha
+            && Array.isArray(session.graphHistory) && session.graphHistory.length === 2
+            && privateYoloRootOnlySetupReady(runtimeStory);
+        return session.schemaVersion === 1 && session.kind === 'private-yolo-isolated-session'
+            && session.storyId === storyId && session.initialGraphRevision === baseline.graphRevision
+            && session.graphRevision === graphRevision && session.setupSessionId === baseline.setupSessionId
+            && Array.isArray(session.graphHistory) && session.graphHistory.length > 1
+            && session.graphHistory.length <= 65
+            && session.graphHistory[0] === baseline.graphRevision
+            && session.graphHistory[session.graphHistory.length - 1] === graphRevision
+            && new Set(session.graphHistory).size === session.graphHistory.length
+            && Number.isSafeInteger(session.sequence) && (sequence > 0 || rootOnlySetupTransition)
+            && typeof session.snapshotSha === 'string' && /^[a-f0-9]{40,64}$/.test(session.snapshotSha)
+            && workspace?.sourceRoot === root && workspace.baseSha === baseline.headSha
+            && workspace.executionBranch === baseline.executionBranch;
+    }
+    catch {
+        return false;
+    }
+}
+/** Call immediately before root C01 setup; a dirty or ambiguous checkout fails closed. */
+function checkoutCleanAfterInvoke(root, entryCleanHead) {
+    const status = git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']);
+    if (status.byteLength === 0)
+        return true;
+    // The invoke continuity recorder may update its tracked SQLite file before
+    // C01 setup. Admit only that exact worktree-only change after a clean entry
+    // observation bound to the same physical HEAD.
+    return entryCleanHead !== undefined && physicalHead(root) === entryCleanHead
+        && status.toString('utf8') === ' M .neocortex/continuity/continuity.sqlite\0'
+        && lstatSync(join(root, '.neocortex/continuity/continuity.sqlite')).isFile();
+}
+export function capturePrivateYoloCleanHead(projectRoot, entryCleanHead) {
+    const root = resolve(projectRoot);
+    try {
+        const before = physicalHead(root);
+        if (!checkoutCleanAfterInvoke(root, entryCleanHead)) {
+            throw new Error('private-execution-checkout-dirty');
+        }
+        if (physicalHead(root) !== before)
+            throw new Error('private-execution-checkout-raced');
+        return before;
+    }
+    catch (error) {
+        if (error instanceof Error && /^private-execution-[a-z-]+$/.test(error.message))
+            throw error;
+        throw new Error('private-execution-checkout-unverified');
+    }
+}
+/** Persist only after physical setup succeeded without changing the clean HEAD. */
+export async function recordPrivateYoloCleanBaseline(projectRoot, setup, cleanHeadSha, entryCleanHead) {
+    const root = resolve(projectRoot);
+    if (!/^[a-f0-9]{40,64}$/.test(cleanHeadSha) || setup.kind !== 'direct-yolo-setup-receipt'
+        || physicalHead(root) !== cleanHeadSha
+        || physicalBranch(root) !== setup.executionBranch
+        || !checkoutCleanAfterInvoke(root, entryCleanHead)) {
+        throw new Error('private-execution-clean-baseline-raced');
+    }
+    const runtime = readGitLifecycleRuntimeSync(root, { required: true });
+    const lease = runtime.epics[setup.epicId]?.branch_lease;
+    if (lease?.ownerStoryId !== setup.storyId || lease.setupHeadSha !== cleanHeadSha
+        || git(root, ['merge-base', '--is-ancestor', setup.originHeadSha, cleanHeadSha]).byteLength !== 0) {
+        throw new Error('private-execution-clean-baseline-raced');
+    }
+    const committedWriteSet = committedWriteSetSha256(root, setup.storyId);
+    if (committedWriteSet !== workingWriteSetSha256(root, setup.storyId)
+        || physicalHead(root) !== cleanHeadSha) {
+        throw new Error('private-execution-clean-baseline-raced');
+    }
+    const graphRevision = runtime.epics[setup.epicId]?.graph_revision;
+    if (typeof graphRevision !== 'string' || !/^[a-f0-9]{64}$/.test(graphRevision)) {
+        throw new Error('private-execution-clean-baseline-graph-invalid');
+    }
+    const record = Object.freeze({
+        schemaVersion: 3, kind: 'private-yolo-clean-baseline', storyId: setup.storyId,
+        epicId: setup.epicId, executionBranch: setup.executionBranch, headSha: cleanHeadSha,
+        setupSessionId: setupSessionId(root, setup.epicId, setup.storyId),
+        graphRevision,
+        authorizedWriteSetSha256: committedWriteSet,
+    });
+    const target = await location(root, setup.storyId);
+    await anchoredAtomicWriteFile(target.parent, target.name, `${JSON.stringify(record)}\n`);
+}
+/** A C08 commit can only consume the exact C01 session that began from clean Git. */
+async function verifyPrivateYoloCleanBaselineInternal(projectRoot, storyId, executionBranch, expectedGraphRevision, transitionFromGraphRevision) {
+    const root = resolve(projectRoot);
+    try {
+        const target = await location(root, storyId);
+        await assertGitLifecyclePrivateFile(target.path, target.parent);
+        const parsed = JSON.parse(readFileSync(target.path, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('private-execution-clean-baseline-invalid');
+        }
+        const record = parsed;
+        const runtimeGraphRevision = readGitLifecycleRuntimeSync(root, { required: true }).epics[record.epicId]?.graph_revision;
+        const graphMatches = runtimeGraphRevision === record.graphRevision
+            || transitionFromGraphRevision === record.graphRevision
+                && runtimeGraphRevision === expectedGraphRevision
+            || typeof runtimeGraphRevision === 'string'
+                && await sessionGraphContinuationMatches(root, storyId, record, runtimeGraphRevision);
+        if (Object.keys(record).sort().join(',') !== [
+            'schemaVersion', 'kind', 'storyId', 'epicId', 'executionBranch', 'headSha', 'setupSessionId',
+            'graphRevision', 'authorizedWriteSetSha256',
+        ].sort().join(',') || record.schemaVersion !== 3 || record.kind !== 'private-yolo-clean-baseline'
+            || record.storyId !== storyId || record.executionBranch !== executionBranch
+            || record.epicId !== storyId.split('.')[0] || typeof record.headSha !== 'string'
+            || !/^[a-f0-9]{40,64}$/.test(record.headSha)
+            || typeof record.authorizedWriteSetSha256 !== 'string'
+            || !/^[a-f0-9]{64}$/.test(record.authorizedWriteSetSha256)
+            || typeof record.graphRevision !== 'string' || !/^[a-f0-9]{64}$/.test(record.graphRevision)
+            || expectedGraphRevision !== undefined && runtimeGraphRevision !== expectedGraphRevision
+            || !graphMatches
+            || record.authorizedWriteSetSha256 !== committedWriteSetSha256(root, storyId)
+            || record.authorizedWriteSetSha256 !== workingWriteSetSha256(root, storyId)
+            || record.setupSessionId !== setupSessionId(root, record.epicId, storyId)
+            || physicalHead(root) !== record.headSha || physicalBranch(root) !== executionBranch) {
+            throw new Error('private-execution-clean-baseline-invalid');
+        }
+    }
+    catch {
+        throw new Error('private-execution-clean-baseline-unverified');
+    }
+}
+export async function verifyPrivateYoloCleanBaseline(projectRoot, storyId, executionBranch, expectedGraphRevision) {
+    return verifyPrivateYoloCleanBaselineInternal(projectRoot, storyId, executionBranch, expectedGraphRevision);
+}
+/** Read the exact C01 claim only after its physical session and graph still verify. */
+export async function readPrivateYoloFrozenWriteSet(projectRoot, storyId, executionBranch, graphRevision) {
+    await verifyPrivateYoloCleanBaseline(projectRoot, storyId, executionBranch, graphRevision);
+    try {
+        const paths = authorizedWriteSet(git(resolve(projectRoot), ['show', 'HEAD:.neocortex/state.json'], 16 * 1024 * 1024).toString('utf8'), storyId);
+        if (paths.length === 0)
+            throw new Error('write-set-empty');
+        return Object.freeze([...paths]);
+    }
+    catch {
+        throw new Error('private-execution-clean-baseline-unverified');
+    }
+}
+/** Used only while the root reconciles a server-persisted successor graph. */
+export async function readPrivateYoloFrozenWriteSetForTransition(projectRoot, storyId, executionBranch, initialGraphRevision, nextGraphRevision) {
+    await verifyPrivateYoloCleanBaselineInternal(projectRoot, storyId, executionBranch, nextGraphRevision, initialGraphRevision);
+    try {
+        const paths = authorizedWriteSet(git(resolve(projectRoot), ['show', 'HEAD:.neocortex/state.json'], 16 * 1024 * 1024).toString('utf8'), storyId);
+        if (paths.length === 0)
+            throw new Error('write-set-empty');
+        return Object.freeze([...paths]);
+    }
+    catch {
+        throw new Error('private-execution-clean-baseline-unverified');
+    }
+}
+/** A clone may advance step state, but cannot rewrite the frozen C01 path claim. */
+export function verifyPrivateYoloCandidateWriteSet(stateText, storyId, frozenPaths) {
+    try {
+        const candidate = authorizedWriteSet(stateText, storyId);
+        if (candidate.length !== frozenPaths.length
+            || candidate.some((path, index) => path !== frozenPaths[index])) {
+            throw new Error('write-set-drift');
+        }
+    }
+    catch {
+        throw new Error('private-execution-clean-baseline-write-set-unverified');
+    }
+}