@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/local-executor/implementor-argv.d.ts

@@ -15,6 +15,20 @@ export interface ImplementorArgvPlan {
     /** Where the final proposal text is captured from after `await handle.done`. */
     capture: ImplementorCaptureSurface;
 }
+/**
+ * Claude read-only advisory variant for broad @agent/@all brainstorm turns.
+ *
+ * This is intentionally separate from `buildImplementorArgv('CLAUDE', 'plan')`:
+ * normal plan mode keeps Read/Grep/Glob for explicit repo inspection, while
+ * broad advisory turns should answer without crawling the workspace. Keeping
+ * this as a first-class argv builder lets the command allowlist and drift tests
+ * cover the exact runtime command instead of relying on ad hoc shell rewrites.
+ *
+ * Claude CLI has two related controls: `--allowed-tools` restricts an available
+ * tool set, while `--tools ""` disables all built-in tools. Use the latter here
+ * because broad advisory turns should have no file-inspection tools at all.
+ */
+export declare function buildClaudeNoToolsPlanArgv(): ImplementorArgvPlan;
 /**
  * D9 — the ONE shared `CODEVIBE_AGY_MODEL` resolver used by BOTH
  * `buildImplementorArgv` (the spawned argv) and `agyImplementorAllowlistEntries`
@@ -44,10 +58,19 @@ export declare const AGY_IMPLEMENTOR_PRINT_TIMEOUT = "3600s";
  * static template can neither pin the value nor omit it when set. Two
  * FULLY-PINNED templates (plan `--sandbox` vs execute
  * `--dangerously-skip-permissions` — the N-3 defense-in-depth split), with
- * `<workdir>` as the SOLE trailing wildcard. Appended by
+ * `<workdir> --print <prompt>` under the trailing wildcard. The prompt is
+ * necessarily argv-visible because Agy 1.1.2 removed its stdin prompt mode;
+ * the fixed mode/model/timeout prefix remains pinned. Appended by
  * `makeImplementorCommandScope` at scope construction.
  */
 export declare function agyImplementorAllowlistEntries(): string[];
+/**
+ * Materialize the trusted stdin payload into Agy 1.1.2's required
+ * `--print <prompt>` argument. Fail closed unless the argv is the exact
+ * canonical placeholder shape produced by `buildImplementorArgv`; callers
+ * cannot use this helper to rewrite arbitrary Agy commands.
+ */
+export declare function bindAgyPrintPrompt(argv: readonly string[], prompt: string | undefined, workingDir: string): string[];
 /**
  * D3 — the abs-path brief preamble for an agy implementor/decomposer/resolver
  * spawn. agy is WORKSPACE-CENTRIC: it ignores the process cwd, so the brief
@@ -60,9 +83,12 @@ export declare function agyImplementorAllowlistEntries(): string[];
 export declare function agyWorkdirBriefPreamble(workdir: string): string;
 /**
  * Build the implementor invocation argv for `agent` in `mode`. The leading
- * executable name (`claude` / `codex` / `gemini` / `agy`) is the argv[0] so
- * callers can pass the whole array to `spawnImplementor` (which resolves the
- * binary from PATH). The brief is fed on stdin by the caller (`stdinPayload`).
+ * executable name (`claude` / `codex` / `agy`) is the argv[0] so callers can
+ * pass the whole array to `spawnImplementor` (which resolves the binary from
+ * PATH). The caller supplies the brief through `stdinPayload`; Claude and
+ * Codex receive it on stdin, while Agy's spawn boundary replaces the canonical
+ * final empty `--print` placeholder with that validated payload. (GEMINI is
+ * SUNSET — the `case 'GEMINI'` throws; it is never a routable implementor.)
  *
  * `workdir` (AGY-2.0 D3) is REQUIRED for ANTIGRAVITY (agy is
  * workspace-centric — `--add-dir <workdir>` is its only view of the tree; the
@@ -71,6 +97,31 @@ export declare function agyWorkdirBriefPreamble(workdir: string): string;
  * ignore it.
  */
 export declare function buildImplementorArgv(agent: AgentKind, mode: ImplementorMode, workdir?: string): ImplementorArgvPlan;
+/**
+ * A1b (Codex summary never-read fix, READ side) — read a Codex implementor's
+ * `--output-last-message` capture file, resolving the HOST path the same way
+ * the reviewer provider does (`src/reviewer/providers/codex.ts::
+ * resolveLastMessagePaths` — the lifted shared pattern, not a duplicate):
+ *
+ *   1. The direct capture path (`plan.capture.path`, an absolute `os.tmpdir()`
+ *      file) — the legacy/unconfined case, where codex wrote the host tmp file.
+ *   2. `<workdir>/<basename>` — the CONFINED-substrate case. This candidate is
+ *      only ever populated because the spawn path REWRITES the codex argv:
+ *      `relocateCodexLastMessageForSubstrate` (below) turns the absolute value
+ *      into a bare basename when the substrate is proven engaged, so codex
+ *      (cwd = workdir on both A1/A5 backends) writes `<workdir>/<basename>` —
+ *      host-readable via the A1 bind-mount / the A5 shared fs. Without that
+ *      write-side rewrite an absolute tmp path is unwritable (A5) or lands in
+ *      the container's own /tmp (A1) and no read candidate could ever find it.
+ *      The workdir is the round's shadow dir.
+ *
+ * The first readable candidate wins; it is best-effort unlinked after the read
+ * (we own the file's lifecycle — mirrors the reviewer/decomposer cleanup).
+ * NEVER throws: a missing/unreadable file on every candidate returns `''` (the
+ * summary is an audit-only nicety; the captured diff, not the summary, is the
+ * round's contract).
+ */
+export declare function readImplementorLastMessage(capturePath: string, workdir?: string): string;
 /**
  * Positive runtime evidence that this process is ACTUALLY inside a container —
  * the confinement boundary that `CODEVIBE_TRUSTED_CONTAINER` asserts. Docker
@@ -118,7 +169,7 @@ export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inCo
  * namespaces / macOS Seatbelt) and is the only filesystem confinement.
  *
  * NARROW BY DESIGN:
- *   - Only CODEX is affected (Claude/Gemini have no bwrap inner sandbox).
+ *   - Only CODEX is affected (Claude + Antigravity have no bwrap inner sandbox).
  *   - Only `workspace-write` (the EXECUTE variant) is rewritten. `read-only`
  *     (PLAN mode) is left untouched — it is a DELIBERATE write restriction, and
  *     `danger-full-access` would let a plan-mode agent write, violating the plan
@@ -127,6 +178,37 @@ export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inCo
  * Pure; returns a NEW array when it rewrites, the same array otherwise.
  */
 export declare function applyOuterBoundarySandbox(argv: readonly string[], agent: AgentKind, outerBoundaryConfines: boolean): string[];
+/**
+ * A1b (Codex summary never-read fix, WRITE side) — substrate-aware relocation
+ * of the Codex `--output-last-message` value. Mirrors the reviewer provider's
+ * `resolveLastMessagePaths(sandboxed=true, …)` contract on the IMPLEMENTOR
+ * path: under the CP-7 substrate codex CANNOT write the host `os.tmpdir()`
+ * (A1 Docker never mounts host /tmp — an absolute tmp path writes the
+ * CONTAINER's own /tmp, unreadable by the host; A5 Seatbelt grants writes to
+ * the WORKDIR only — the write is DENIED outright; the reviewer provider
+ * documents the same false-on-both-backends failure at codex.ts:143-152). So
+ * when the substrate is PROVEN engaged, rewrite the absolute capture path to
+ * its bare BASENAME: codex's cwd IS the workdir on both backends (A5 `exec`
+ * spawns with `cwd: workdir`; A1 runs in `/workspace`, the workdir
+ * bind-mount), so the file lands at `<workdir>/<basename>` — exactly where
+ * `readImplementorLastMessage`'s relocated candidate reads it back.
+ *
+ * Called from `LocalExecutor.spawnImplementor` at the SAME per-spawn rewrite
+ * point as `applyOuterBoundarySandbox`, gated on the engager's OWN
+ * `substrateEngaged` proof — NOT predicted at argv-build time (the engage
+ * outcome — substrate vs reduced_trust vs legacy — is only knowable when the
+ * engager actually runs), and NOT on the trusted-container boundary (there the
+ * desktop and codex share ONE fs namespace, so the absolute tmp path works and
+ * must stay — it is read candidate #1).
+ *
+ * NARROW BY DESIGN (mirrors `applyOuterBoundarySandbox`):
+ *   - Only CODEX (the only file-capture agent) is affected.
+ *   - Only when `substrateEngaged`; the unconfined argv is byte-identical.
+ *   - The command-allowlist templates end `--output-last-message *`, so the
+ *     rewritten argv still passes `enforceCommand` (drift-guard-tested).
+ * Pure; returns a NEW array when it rewrites, a copy otherwise.
+ */
+export declare function relocateCodexLastMessageForSubstrate(argv: readonly string[], agent: AgentKind, substrateEngaged: boolean): string[];
 /**
  * Authority `commandAllowlist` entries covering EVERY (agent, mode) argv
  * `buildImplementorArgv` can produce. The single-impl + team LEs seed this
@@ -142,8 +224,8 @@ export declare function applyOuterBoundarySandbox(argv: readonly string[], agent
  *
  * Matching (authority.ts `enforceCommand`): an entry is a LITERAL full
  * `argv.join(' ')` match, OR a ` *`-suffix TEMPLATE (prefix match).
- *   - Claude / Gemini argvs are fixed → literal entries. (Gemini's `-p ''`
- *     empty arg yields a DOUBLE space in the join — preserved verbatim here.)
+ *   - Claude argvs are fixed → literal entries. (Gemini is SUNSET as of
+ *     2026-07 and is no longer a routable implementor, so it has no entry.)
  *   - Codex carries a per-spawn temp path in `--output-last-message <tmp>` →
  *     a ` *` template: the literal prefix up to `--output-last-message`, then
  *     the wildcard absorbs the varying path + trailing `-`.

package/node_modules/@quantiya/codevibe-core/dist/local-executor/index.d.ts

@@ -5,11 +5,12 @@ export { agyImplementorAllowlistEntries, agyWorkdirBriefPreamble, AGY_IMPLEMENTO
 export { verifyClassBEd25519, classBCanonicalForSigning, ed25519PublicKeyFromRaw, type ClassBCryptoVerifyResult, } from './class-b-verify';
 export { TrackRegistry, TrackProcess, trackKey } from './track-registry';
 export { EmitShellEventFn, HookBridge, HookBridgeDeps, } from './hook-bridge';
-export { LocalExecutorImpl, LocalExecutorImplDeps, MergeGateAppSyncClient, MergeGateContentEncryptor, makeEmptyScope, } from './local-executor-impl';
+export { LocalExecutorImpl, LocalExecutorImplDeps, MergeGateAppSyncClient, MergeGateContentEncryptor, TEAM_TRACK_HEARTBEAT_INTERVAL_MS, makeEmptyScope, } from './local-executor-impl';
 export type { SubstrateEngager, SubstrateEngageResult, StrictBadgeSink, } from './local-executor-impl';
 export { Cp7AuditWriter, CP7_CANONICAL_FORM_VERSION, GENESIS_PREV_HASH, canonicalJson, canonicalEntryBytes, computeEntryHash, verifyChain, } from './cp7-audit-writer';
 export type { Cp7AuditEntry } from './cp7-audit-writer';
-export { ClassAEmitter, ClassAEmitterContext, ClassAEnvelope, ClassAMessageType, ClassASink, DEFAULT_DEDUPE_CAP, EmitterLogger, ExecutionEventKind, ExecutorRefusalPayload, FileChangePayload, LocalStubSink, ProcessExitedPayload, ProcessSpawnedPayload, ToolUsePayload, VerificationGateKind, VerificationResultPayload, VerificationRunPayload, isValidUlid, } from './class-a-emit';
+export { ClassAEmitter, ClassAEmitterContext, ClassAEnvelope, ClassAMessageType, ClassASink, DEFAULT_DEDUPE_CAP, EmitterLogger, ExecutionEventKind, ExecutorRefusalPayload, FileChangePayload, LocalStubSink, ProcessExitedPayload, ProcessSpawnedPayload, TrackProgressPayload, ToolUsePayload, VerificationGateKind, VerificationResultPayload, VerificationRunPayload, isValidUlid, } from './class-a-emit';
+export { HostedClassASink, HOSTED_CLASS_A_EMIT_TIMEOUT_MS, type HostedClassARecordTransport, } from './hosted-class-a-sink';
 export { DEFAULT_GATE_TIMEOUT_MS, GateRunResult, SUMMARY_CAP_BYTES, TIMEOUT_EXIT_CODE, VerificationGateRequest, VerificationRunnerDeps, runVerificationGates, truncateUtf8Safe, } from './verification-runner';
 export { ClassBConsumer, ClassBConsumerDeps, ClassBConsumerState, ClassBVerificationResult, INBOUND_REPLAY_CAP, INBOUND_REPLAY_TTL_MS, UlidReplayRegistry, verifyClassBSignature, normalizeTrackAssignedWire, isValidTrackAssignedPayload, } from './class-b-consumer';
 export { DeviceSigningKey, canonicalJsonForSigning, signClassAEnvelope, signMergeClassification, } from './class-a-sign';

package/node_modules/@quantiya/codevibe-core/dist/local-executor/local-executor-impl.d.ts

@@ -3,29 +3,32 @@ import { AuthorityScope } from './authority';
 import { ClassAEmitter, ClassAEmitterContext, ClassASink, VerificationGateKind } from './class-a-emit';
 import { type DeviceSigningKey } from './class-a-sign';
 import { EmitShellEventFn } from './hook-bridge';
-import { MergeResult, SubmitMergeGateVerdictInput } from './task-group-types';
+import { SubmitMergeGateVerdictInput } from './task-group-types';
 import { TrackRegistry } from './track-registry';
-import { AgentKind, AuthorityAction, ClassBInbound, GateDispatchPayload, HookEvent, ImplementorHandle, LocalExecutor, MergeGateDispatchPayload, ProbeHandle, ProcessRole, ReviewerDispatchPayload, ReviseFeedbackPayload, ReviewerHandle, SpawnArgs, TrackAssignedPayload } from './types';
+import { AgentKind, AuthorityAction, ClassBInbound, GateDispatchPayload, HookEvent, ImplementorHandle, LocalExecutor, MergeGateDispatchPayload, ProbeHandle, ProcessRole, ReviewerDispatchPayload, ReviseFeedbackPayload, ReviewerHandle, SpawnArgs, TrackAssignedPayload, type DurableSessionResourceDisposeOptions, type WorkspaceDisposeOptions } from './types';
 import { type TeamExecution } from './team-execution-flag';
+import { type SnapshotBundlesView, type SnapshotMergeGateResult } from './snapshot-merge';
+import { type WorkspaceRootAuthority } from './workspace-authority';
 import type { RenderedConflict, TrackIntentDiff } from './wb2-review-bundle';
 import type { ConflictModelCaller } from './class2-resolver';
 import type { ConflictResolverContext } from './merge-conflict-resolve';
 import { type ContentCipher } from './conflict-resolution-durable-store';
-import type { TrackTipsView } from './durable-store';
+import type { PromoteManifestInput, SnapshotPromotionJournalV1, TrackTipsView } from './durable-store';
+import { type ReviewedShadowDiffFile, type ShadowEnv } from './workspace-shadow';
 /**
  * CP-7 W2 Stage-2 HIGH (Finding 2) — STRICT delivery sink for the
  * `tier:'none'` (moat-OFF) reduced-trust badge.
  *
  * The ordinary `emitShellEvent` chokepoint RESOLVES WITHOUT EMITTING when the
- * cohort flag is off, the session is a `cp1a-local-*` stub, or no session key
- * exists (see `emit-shell-event.ts`); the team store tap likewise ignores the
+ * no session key exists (see
+ * `emit-shell-event.ts`); the team store tap likewise ignores the
  * `cp7_reduced_trust` notification. A `tier:'none'` badge routed through it can
  * therefore "succeed" (await resolves) while the user sees NOTHING — and the
  * legacy unsandboxed spawn would proceed on only a WARN.
  *
  * A `StrictBadgeSink` MUST instead CONFIRM that the user-facing NOTIFICATION was
  * ACTUALLY delivered (e.g. `createEvent` was invoked) and THROW when it cannot
- * deliver (cohort off / no session / stub / tap-ignored). For `tier:'none'` a
+ * deliver (no session / stub / tap-ignored). For `tier:'none'` a
  * throw → FAIL CLOSED (no legacy spawn). It is INTENTIONALLY separate from the
  * audit emit: audit emission stays on the existing Class-A / shell-event path;
  * this sink is ONLY the user-facing moat-OFF warning.
@@ -44,7 +47,9 @@ export type StrictBadgeSink = (badge: {
  * inject a mock without constructing the full GraphQL client.
  */
 export interface MergeGateAppSyncClient {
-    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput): Promise<{
+    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput, opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
         outcome: string;
     }>;
 }
@@ -73,6 +78,7 @@ export type SubstrateEngageResult = {
     reducedTrust: boolean;
     reducedTrustReason?: string;
     substrateHandle: SubstrateHandle;
+    agentConfigDir?: string;
     refreshBrokerToken(): Promise<void>;
     teardown(): Promise<void>;
 } | {
@@ -93,14 +99,36 @@ export type SubstrateEngager = (input: {
     taskId: string;
     agentKind: AgentKind;
     workdir: string;
+    /** Exact task-workspace incarnation selected by the orchestration owner. */
+    workdirAuthority?: WorkspaceRootAuthority;
     role: ProcessRole;
+    /**
+     * A1d (design §8.1) — the spawn demands hard confinement (`SpawnArgs.
+     * requireConfined`; today only the WB2 agentic class-2 resolver dispatch).
+     * Threaded so the engager can build the WRITE-CONFINED resolver row for a
+     * broker-less reduced-trust agent (GEMINI/ANTIGRAVITY) instead of returning
+     * an immediate `reduced_trust` — which the requireConfined guard below would
+     * fail-close to the human gate (the design's mandatory fallback, which still
+     * applies whenever the row cannot be established).
+     */
+    requireConfined?: boolean;
 }) => Promise<SubstrateEngageResult>;
+/** Backend lease is 15 minutes; three renewal opportunities fit inside it. */
+export declare const TEAM_TRACK_HEARTBEAT_INTERVAL_MS: number;
 export interface LocalExecutorImplDeps {
     sessionId: string;
     initialScope?: AuthorityScope;
     baseCtx: Omit<ClassAEmitterContext, 'taskId'>;
     adapter: AgentKind;
     sink?: ClassASink;
+    /**
+     * Hosted Class A sink dedicated to team-child progress/lease renewal.
+     * Keeping this explicit prevents pre-task/refusal events from being sent
+     * against a placeholder task id while still making team liveness durable.
+     */
+    teamProgressSink?: ClassASink;
+    /** Production team construction refuses admission without the hosted sink. */
+    requireHostedTrackHeartbeat?: boolean;
     emitShellEvent: EmitShellEventFn;
     logger?: {
         warn: (msg: string, meta?: Record<string, unknown>) => void;
@@ -114,7 +142,7 @@ export interface LocalExecutorImplDeps {
     /**
      * Builds the `SpawnArgs.argv` for a track's implementor given the track
      * payload + canonicalized state dir. The shell knows which agent binary
-     * (claude/gemini/codex) to invoke and the prompt wiring; the LE only
+     * (claude/codex/agy) to invoke and the prompt wiring; the LE only
      * orchestrates spawn + idempotency + state-dir isolation. When omitted, the
      * MergeGate happy-path + idempotency tests still exercise the registry via a
      * `spawnTrackImplementor` stub.
@@ -131,9 +159,9 @@ export interface LocalExecutorImplDeps {
     /** E2E content encryptor. Defaults to `cryptoService` if injected by the shell. */
     contentEncryptor?: MergeGateContentEncryptor;
     /**
-     * Repo root (canonicalized absolute) — the parent under which per-track state
-     * dirs `<repoRoot>/.codevibe/state/<group>/<track>/` live, and the cwd the
-     * MergeGate integration check runs in. Required for team sessions.
+     * Repo root (canonicalized absolute) — anchors validation of the legacy
+     * `state_dir` wire field and is the real folder the MergeGate ultimately
+     * promotes into. No per-track state directory is materialized.
      */
     repoRoot?: string;
     /**
@@ -151,12 +179,27 @@ export interface LocalExecutorImplDeps {
         taskId: string;
         taskGroupId: string;
         trackIndex: number;
+        dispatchGeneration: number;
         agent: AgentKind;
         writePaths: string[];
         autoModifiedFiles: string[];
         /** #590 — the track's own-module test files; part of the declared write
          *  scope (engine disjointness-validated) so a test write stays in-lane. */
         testSurfaces: string[];
+    }) => Promise<'accepted' | 'refused'>;
+    /**
+     * Terminal group-lifecycle bridge. The QuorumLoop owns the real per-track
+     * implementor handles and task snapshots; LocalExecutor's registry contains
+     * membership-only handles. The callback must publish its fence synchronously
+     * when called, then drain/abort/clean the exact members before resolving.
+     */
+    haltTeamTaskGroup?: (info: {
+        taskGroupId: string;
+        members: readonly {
+            taskId: string;
+            trackIndex: number;
+            dispatchGeneration: number;
+        }[];
     }) => Promise<void>;
     /**
      * CP-12 W4 (#593, Stage-2 r1 Codex MED) — corrupt-brief TOMBSTONE predicate
@@ -170,7 +213,7 @@ export interface LocalExecutorImplDeps {
      * Keyed by `(taskGroupId, trackIndex)` (#593 Stage-2 r2) — B.2 recovery
      * aggregates across groups, so a tombstone must be scoped to its group.
      */
-    isTrackTombstoned?: (taskGroupId: string, trackIndex: number) => boolean;
+    isTrackTombstoned?: (taskGroupId: string, trackIndex: number, taskId: string, dispatchGeneration: number) => boolean;
     /**
      * #592 PROVENANCE GUARD (live path, wired to `QuorumLoop.isForeignTeamGroup`).
      * `launchTrack` consults it right after the tombstone gate — BEFORE any registry
@@ -201,8 +244,8 @@ export interface LocalExecutorImplDeps {
      * `tier:'none'` (moat-OFF) reduced-trust badge. When supplied (production
      * wiring in cli.ts), the moat-OFF badge is delivered through THIS sink — which
      * confirms the NOTIFICATION actually reached `createEvent` and THROWS on a
-     * silent no-op (cohort off / no session key / stub / tap-ignored) — instead of
-     * the cohort-gated `emitShellEvent` that can resolve without emitting. A throw
+     * silent no-op (no session key / stub / tap-ignored) — instead of
+     * `emitShellEvent` that can resolve without emitting. A throw
      * here makes the `tier:'none'` path FAIL CLOSED (no unsandboxed spawn).
      *
      * ABSENT (default) → the legacy behavior: the badge goes through
@@ -246,41 +289,38 @@ export interface LocalExecutorImplDeps {
      * MergeGate so it never calls this).
      */
     awaitTaskShadowQuiescent?: (taskId: string) => Promise<void>;
-    /**
-     * TEST SEAM — override the bounded await for member track tips in the
-     * `worktree_merge` gate (default {@link TRACK_TIP_AWAIT_MS}). The engine
-     * dispatches `MergeGateDispatch` as soon as the LAST track flips Passed, but
-     * the desktop commits each track's tip asynchronously on its OWN
-     * `TaskAuthorized` receipt — so the dispatch can arrive BEFORE the final
-     * track's commit has even STARTED (the shadow-ops mutex is not yet held, so
-     * the quiescence barrier passes straight through). Dogfood-pinned 2026-07-02:
-     * team-joint-conflict read a missing tip 0.1s before the commit landed →
-     * FAIL verdict stored → the real train's later PASS hit the #C12-1 replay →
-     * "Team halted — merge_integration_failure" AFTER a successful promote.
-     */
+    /** Bounded await for every reviewed member bundle (legacy option name). */
     trackTipAwaitMs?: number;
+    /** Overall deadline shared by initial hosted verdict submit + same-key replay. */
+    mergeGateSubmitTimeoutMs?: number;
     /**
-     * CP-14 — the team execution model. Since the §10 retirement (2026-07-03)
-     * `worktree_merge` is the ONLY model: the merge gate always runs
-     * {@link runWorktreeMergeGate} (merge-train the committed track branches +
-     * promote the integration tip). Retained as a dep for wire/test stability.
+     * CP-14 — the team execution wire model. `worktree_merge` is the only label,
+     * but the live desktop implementation uses reviewed bundles and filesystem
+     * snapshots. Retained as a dep for wire/test stability.
      */
     teamExecution?: TeamExecution;
-    /**
-     * CP-14 Wave A — read the durable committed track tips (the merge-train inputs)
-     * for a group. Backed by `RevertManifestStore.readTrackTips`. REQUIRED when
-     * `teamExecution === 'worktree_merge'` (the gate fails closed without it).
-     */
+    /** Deprecated offline migration reader. The live dispatch path never calls it. */
     readTrackTips?: (taskGroupId: string) => Promise<TrackTipsView>;
-    /**
-     * TEST SEAM (§10 retirement, 2026-07-03) — override the worktree merge gate
-     * body. Defaults to the real {@link runWorktreeMergeBranch} (merge-train +
-     * promote). Mirrors the `runVerificationGatesFn` precedent: unit tests of the
-     * classification/signing/submission flow AROUND the gate inject a fixed
-     * result instead of standing up a real git fixture with track branches (the
-     * merge-train itself has its own fixture-backed suites).
-     */
-    worktreeMergeGateFn?: (payload: MergeGateDispatchPayload, repoRootCanonical: string, gateKinds: VerificationGateKind[]) => Promise<MergeResult>;
+    /** Git-independent reviewed track bundles (the default team merge inputs). */
+    readTrackBundles?: (taskGroupId: string) => Promise<SnapshotBundlesView>;
+    /** Durable all-generation/cross-process fence around gate + hosted submission. */
+    withSnapshotMergeGateFence?: <T>(taskGroupId: string, operation: () => Promise<T>, signal?: AbortSignal) => Promise<T>;
+    /** Persist merged pre-images before the one group promotion mutates user files. */
+    persistSnapshotPreImages?: (taskGroupId: string, ownerTrackIndex: number, entries: PromoteManifestInput[]) => Promise<void>;
+    readSnapshotPromotion?: (taskGroupId: string) => Promise<SnapshotPromotionJournalV1 | null>;
+    prepareSnapshotPromotion?: (taskGroupId: string, operationHash: string, files: readonly ReviewedShadowDiffFile[], workspaceRootAuthority: WorkspaceRootAuthority) => Promise<void>;
+    markSnapshotPromotionApplied?: (taskGroupId: string, operationHash: string) => Promise<void>;
+    /** Optional shadow lifecycle hooks shared with implementor workspaces. */
+    snapshotShadowEnv?: ShadowEnv;
+    /** Mark a successfully accepted group terminal and reclaim its bundle state. */
+    completeSnapshotGroup?: (taskGroupId: string) => Promise<void>;
+    /** Normal-exit retirement of all ordinary durable resources from this session. */
+    disposeSnapshotSessionResources?: () => Promise<void>;
+    /**
+     * Legacy-named TEST SEAM around the merge-gate body. Production defaults to
+     * the reviewed-bundle filesystem snapshot implementation.
+     */
+    worktreeMergeGateFn?: (payload: MergeGateDispatchPayload, repoRootCanonical: string, gateKinds: VerificationGateKind[]) => Promise<SnapshotMergeGateResult>;
     /**
      * Audited-path fix (Fix 1) — surface a hosted-side PolicyRejection to the
      * DESKTOP. The LE already emits a mobile-bound NOTIFICATION via
@@ -376,6 +416,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     private scope;
     private taskId;
     private readonly emitter;
+    private readonly trackProgressEmitter?;
     private readonly bridge;
     private readonly classBConsumer;
     private readonly emitShellEvent;
@@ -384,6 +425,11 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     private readonly sessionId;
     private readonly trackRegistry;
     private readonly trackPayloads;
+    private readonly trackHeartbeats;
+    /** Hosted heartbeat requests admitted before a terminal/session fence. */
+    private readonly trackHeartbeatEmits;
+    /** Every accepted TrackAssigned launch coroutine, including pre-bridge awaits. */
+    private readonly trackLaunchPromises;
     private readonly resolvedMergeOutcomes;
     /**
      * CP-14 concurrent-dispatch dedup — the ONE in-flight merge-gate run per
@@ -392,6 +438,20 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * the #TC-7 replay path (re-submit → server replays the stored outcome).
      */
     private readonly inFlightMergeGates;
+    /** Disposable integration snapshots not owned by the QuorumLoop task map. */
+    private readonly integrationShadows;
+    /** Sticky exact task ids used by the post-drain durable enumeration. */
+    private readonly integrationTaskIdsOwned;
+    /** Group-terminal fence, installed before any halt await or registry abort. */
+    private readonly haltedTaskGroups;
+    private readonly integrationAbort;
+    private workspaceShutdown;
+    /** Auditless advisory spawns admitted before the session shutdown fence. */
+    private readonly advisorySpawnAdmissions;
+    /** Process-tree failures discovered after an advisory handle was returned. */
+    private readonly advisoryProcessCleanupFailures;
+    /** One exact final retirement result, reusable by strict/non-strict callers. */
+    private durableSessionResourceFailures;
     private _lastMergeGateEmitMs;
     private readonly teamDeps;
     private readonly logger;
@@ -423,6 +483,20 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     spawnImplementor(args: SpawnArgs): Promise<ImplementorHandle>;
     spawnReviewer(_args: SpawnArgs): Promise<ReviewerHandle>;
     spawnHealthProbe(args: SpawnArgs): Promise<ProbeHandle>;
+    /**
+     * Publish advisory ownership synchronously before the first spawn await.
+     * Caller cancellation and session shutdown converge on one signal.
+     */
+    private admitAdvisorySpawn;
+    private bindAdvisorySpawn;
+    private settleAdvisorySpawn;
+    /**
+     * Abort and drain every auditless implementor admission to a fixed point.
+     * `handle.done` includes verified process-tree cleanup and registered exit
+     * hooks, so resolving this phase is the safe boundary before a shell turn
+     * removes the image the process was reading.
+     */
+    private drainAdvisorySpawns;
     /**
      * CP-7 PART F — engage the trusted-execution substrate for ONE implementor
      * spawn. Returns the `SpawnArgs` to launch with (substrate-augmented on the
@@ -448,7 +522,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *     ambient `process.env` reachable): the badge MUST be DELIVERED before the
      *     agent runs. It is routed through the STRICT delivery sink
      *     (`deps.strictBadgeSink`) which CONFIRMS the NOTIFICATION actually reached
-     *     `createEvent` and THROWS on a silent no-op (cohort off / no session key /
+     *     `createEvent` and THROWS on a silent no-op (no session key /
      *     stub / tap-ignored) — the ordinary `emitShellEvent` would RESOLVE without
      *     emitting in those cases (Finding 2). This method AWAITS that delivery with
      *     a bounded timeout and RE-THROWS on a reject/timeout. The WARN log stays
@@ -491,6 +565,12 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * discards EXACTLY the rejected task's shadow. Optional for non-WS callers.
      */
     consumeClassB(packet: ClassBInbound, envelopeTaskId?: string): Promise<void>;
+    private stopExactTrackHeartbeat;
+    private stopTaskGroupHeartbeats;
+    private stopAllTrackHeartbeats;
+    private startTrackHeartbeat;
+    private retireTaskGroupMembership;
+    private removeExactTrackRegistration;
     /**
      * #C12-14 — launch the implementor for one track. IDEMPOTENT by
      * `(task_group_id, track_index, dispatch_generation)`: a duplicate
@@ -498,13 +578,18 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * (#C12-17). A strictly-newer generation (dispute re-dispatch, #C12-19)
      * supersedes the stale entry.
      *
-     * Steps: (1) idempotency check; (2) create + canonicalize the per-track
-     * `state_dir` via the existing spawn authority guard (NO bypass —
-     * `fs.realpath` exactly as `spawnSubprocess` requires); (3) advance the
-     * per-track authority scope to `ownership_scope`; (4) spawn the implementor
-     * in `state_dir` with the track's child `task_id`.
+     * Steps: (1) idempotency check; (2) validate the legacy per-track `state_dir`
+     * wire value without creating it; (3) register membership; (4) bridge the
+     * task into the QuorumLoop, which launches in a disposable WorkspaceShadow.
      */
     private launchTrack;
+    /**
+     * Bind membership changes to the durable group fence shared by reviewed
+     * bundle publication and merge-gate execution. A newer track generation can
+     * never replace membership while older reviewed bytes are being integrated
+     * or their hosted verdict is still in flight.
+     */
+    private launchTrackFenced;
     /**
      * CP-12 W4 (#593) — the public team-dispatch recovery entrypoint. Exposes the
      * EXACT private `launchTrack` body (register + brief bridge) so the QuorumLoop
@@ -518,13 +603,6 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *                    → recovery skips it (no repair, no gate dispatch).
      */
     recoverLaunchTrack(payload: TrackAssignedPayload): Promise<'registered' | 'duplicate' | 'rejected'>;
-    /**
-     * FIX-4 — wrap a track's `SpawnArgs` with the Class A process-lifecycle
-     * audit hooks, mirroring the single-track `spawnWithLifecycle` path but bound
-     * to the TRACK's own `task_id` as the Class A context (so PROCESS_SPAWNED /
-     * PROCESS_EXITED envelopes attribute to the right track, not the team task).
-     */
-    private withTrackLifecycle;
     /**
      * #C12-7/#C12-8 — MergeGate runner. The `owner_track_index` track runs the
      * shared integration check, derives a PASS/FAIL classification from the gate
@@ -538,14 +616,12 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * SharedFileConflict / ScopeViolation / ReviewerDisagreement / BudgetExhausted.
      */
     /**
-     * CP-14 Wave A — the `worktree_merge` merge-gate branch: build the merge-train
-     * inputs from the durable committed tips + the live member set, run
-     * {@link runWorktreeMergeGate} (merge-train → Tier-1 → promote the integration
-     * tip), and map the outcome to a `MergeResult` for the engine verdict. A
-     * `merged_promoted` ⇒ PASS; ANY halt ⇒ FAIL (the user tree is untouched by
-     * construction — #C14-AON — so there is no content to revert). FAILS CLOSED if
-     * `readTrackTips` is unwired (the gate cannot read its inputs).
+     * Live Git-independent merge branch: await every reviewed track bundle, merge
+     * against exact pre-image hashes, verify in a disposable snapshot, and promote
+     * once. Missing inputs, drift, overlap, or a failed gate all fail closed.
      */
+    private runSnapshotMergeBranch;
+    /** Legacy reader for pre-migration Git branch-tip records. Not live-selected. */
     private runWorktreeMergeBranch;
     /**
      * [P1b] GUARANTEED LOCAL freeze for the merge-gate timer. Wraps the inner gate
@@ -566,6 +642,26 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * still propagates (the `finally` only emits — it never swallows).
      */
     private runMergeGate;
+    /**
+     * Wait for bundle publishers without owning their fence. Each attempt first
+     * drains the current task lifecycle mutexes, then briefly enters the durable
+     * fence and checks exact task/generation bundle readiness. A ready attempt
+     * retains the same fence continuously through integration and hosted submit.
+     */
+    private runMergeGateFenced;
+    /** True only for a missing exact current-generation bundle; malformed input is classified inside the gate. */
+    private snapshotInputsMissing;
+    /**
+     * Normal session teardown for integration snapshots. Abort their verification
+     * children, await the full in-flight gate coroutines (which own their snapshot
+     * `finally` blocks), then reclaim any remaining directories. Marker TTL cleanup
+     * is only the hard-crash fallback.
+     */
+    private retireIntegrationShadow;
+    private cleanupDurableIntegrationSnapshots;
+    private getDurableSessionResourceFailures;
+    disposeDurableSessionResources(opts?: DurableSessionResourceDisposeOptions): Promise<void>;
+    disposeWorkspaces(opts?: WorkspaceDisposeOptions): Promise<void>;
     /** The single-flight merge-gate run body (P1b freeze wrapper). See {@link runMergeGate}. */
     private runMergeGateExclusive;
     /**
@@ -575,6 +671,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * A thrown exit never returns → the wrapper's boolean stays `false` → freeze.
      */
     private runMergeGateInner;
+    private submitMergeGateVerdictWithDeadline;
     /**
      * PHASE-589+469 W1 (§5.A / §5.C / #TC-2 / #TC-3) — drive the desktop CLI
      * convergence from the AUTHORITATIVE engine `outcome`. Emits, via the SAME
@@ -591,6 +688,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * uses). Team-only path — single-impl never reaches runMergeGate (#TC-8).
      */
     private emitGroupConvergence;
+    private emitGroupConvergenceOwned;
     /**
      * PHASE-589/469 W3.2 (D2) — drive the per-track render flip + group-resolved
      * render for a USER GROUP DECISION (the 5-option escalation COMMIT), through
@@ -629,18 +727,16 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *      non-negative safe integer. Otherwise a `task_group_id` of
      *      "../../../../tmp/x" makes the DERIVED path itself escape, and the
      *      packet's matching `state_dir` then passes the exact-match check.
-     *   1. Compute the trusted state root `realpath(realpath(repoRoot)/.codevibe/
-     *      state)` (realpath resolves any symlinked component).
-     *   2. DERIVE `realpath(stateRoot)/<task_group_id>/<track_index>`, mkdir -p,
-     *      realpath it (canonical workingDir for the spawn guard).
-     *   3. CONTAINMENT CHECK — the realpath'd derived dir MUST stay strictly under
-     *      the realpath'd state root (catches both `..`-segment AND symlinked-
-     *      component escapes).
-     *   4. Verify the payload's supplied `state_dir` resolves to EXACTLY the
-     *      derived path. A mismatch / escape ⇒ REJECT (return null): no spawn, no
-     *      scope grant. Never feed an attacker-controlled path into the grant.
+     *   1. Canonicalize the repo root and derive the virtual legacy state path
+     *      `<repo>/.codevibe/state/<task_group_id>/<track_index>` lexically.
+     *   2. Reject any existing path component that is a symlink/non-directory.
+     *      Nothing is created: team implementors now run in disposable snapshots,
+     *      so materializing these obsolete state directories would only leak disk
+     *      entries on every TrackAssigned.
+     *   3. Verify the payload's supplied `state_dir` normalizes to EXACTLY the
+     *      derived path. A mismatch / escape ⇒ REJECT (return null).
      *
-     * Returns the canonical derived dir on success, or `null` on a confinement
+     * Returns the normalized derived path on success, or `null` on a confinement
      * violation (logged here; the caller drops the packet).
      */
     private canonicalizeStateDir;
@@ -675,7 +771,8 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * §2.3 — emit a per-track progress event carrying `track_index` + `task_id`
      * in metadata so mobile/desktop CAN render per-track threads (CP-8 #469
      * renders; W2.b adds the wire attribution only). Emitting a per-track
-     * progress event also renews that track's lease (#C12-18). This path is ONLY
+     * progress event is the UI/status projection only. The independently signed
+     * Class A heartbeat owns backend lease renewal (#C12-18). This path is ONLY
      * for group tracks — single-track events go through the hook bridge and OMIT
      * the field (backward-compatible).
      */
@@ -708,6 +805,10 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     get emitterForTests(): ClassAEmitter;
     /** CP-12 W2.b — expose the per-track registry for idempotency introspection. */
     get trackRegistryForTests(): TrackRegistry;
+    /** @internal exact terminal-retirement assertions. */
+    get trackPayloadCountForTests(): number;
+    /** @internal recurring lease owner count. */
+    get trackHeartbeatCountForTests(): number;
     private contextOrNull;
     /**
      * Context resolver for ClassBConsumer emit paths (refusals + PolicyRejection).