@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/local-executor/merge-conflict-resolve.d.ts

@@ -33,6 +33,17 @@ export interface ConflictResolverContext {
         class2Paths: readonly string[];
         implementorAgent: string;
         implementorTaskId: string;
+        /**
+         * A1d / P2 resolver-intent (design §5/§8.1) — the slot's two sides, so the
+         * resolver builder can compute BOTH sides' bounded INTENT diffs
+         * (`baseSha → oursCommit` = the integration so far; `baseSha → theirsCommit`
+         * = the incoming track) for the resolver brief. `baseSha` is optional
+         * (absent on the reconstruction-replay path) — absent ⇒ the intent-diff
+         * projection degrades gracefully (brief shape unchanged).
+         */
+        oursCommit: string;
+        theirsCommit: string;
+        baseSha?: string;
     }) => Promise<AgenticResolveOutcome>;
     /** Shared-contract detector tuning (always-gate globs + planner shared_contracts). */
     detectorOpts?: SharedContractDetectorOptions;
@@ -98,4 +109,12 @@ export declare function resolveSlotConflicts(args: {
     incomingImplementorTaskId?: string;
     /** CP-14 WB2 — tags durable records PENDING for this resolve attempt (recovery case 3). */
     attemptId?: string;
+    /**
+     * A1d / P2 resolver-intent — the merge-train's pinned integration base
+     * (`foundation.baseSha` / the journal record's `baseSha`), threaded through to
+     * the agentic resolver so it can compute both sides' intent diffs. Optional:
+     * absent (e.g. the reconstruction-replay caller) ⇒ no intent diffs (graceful
+     * degrade; never gates a resolve).
+     */
+    baseSha?: string;
 }): Promise<SlotResolveResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/process-identity.d.ts

@@ -0,0 +1,16 @@
+export interface ProcessIdentity {
+    pid: number;
+    /** Boot-bound, high-resolution OS creation identity. */
+    incarnationId: string;
+}
+export interface ProcessMetadata {
+    identity: ProcessIdentity;
+    processGroupId: number | null;
+}
+/** Same native identity reader embedded into fd-anchored helper processes. */
+export declare const PROCESS_IDENTITY_SYNC_HELPER_SOURCE: string;
+/** Read exact process metadata from one platform-owned source. */
+export declare function readProcessMetadata(pid: number): Promise<ProcessMetadata | null>;
+export declare function readProcessIdentity(pid: number): Promise<ProcessIdentity | null>;
+export declare function currentProcessIdentity(): Promise<ProcessIdentity>;
+export declare function isProcessIdentityAlive(identity: ProcessIdentity): Promise<boolean>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/process-tree.d.ts

@@ -0,0 +1,123 @@
+import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
+import { type ProcessIdentity } from './process-identity';
+import { type WorkspaceRootAuthority } from './workspace-authority';
+export type ProcessTreeOwnership = 'none' | 'posix-host' | 'posix-group' | 'windows-job';
+/**
+ * Spawn through an original-handle POSIX host. The host owns the target's
+ * detached group, drains it on normal completion/cancellation, and exits only
+ * after absence proof. No reusable PID/PGID becomes recovery authority.
+ */
+export declare function spawnPosixOwnedProcess(command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2], seams?: {
+    spawnExecutable?: SpawnExecutable;
+    cleanupTimeoutMs?: number;
+    persistOwner?: (owner: ProcessCleanupOwner) => Promise<void>;
+    /** Exact task/verification cwd incarnation held through target launch. */
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic directory-durability failure seam. */
+    syncOwnerDirectory?: (dir: string, file: string) => Promise<void>;
+}): ChildProcess;
+/** Original-handle status channel; missing/malformed status fails closed. */
+export declare function processHostCleanupStatus(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<boolean>;
+/** Durable target-group identity emitted before the supervised command settles. */
+export declare function processHostCleanupOwner(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<ProcessCleanupOwner | undefined>;
+/**
+ * Prove that a POSIX host's target group is gone. A well-behaved host reports
+ * its own proof. If the host crashes before it can report, use the already
+ * authenticated target-group identity to recover and prove cleanup. Starting
+ * this promise when the child is wired also prevents inherited output pipes
+ * from deadlocking the later `close` event after a host crash.
+ */
+export declare function ensureProcessHostCleanup(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<boolean>;
+/** Spawn a Windows command inside a kill-on-close Job Object. */
+export declare function spawnWindowsJobProcess(command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2], seams?: {
+    spawnExecutable?: SpawnExecutable;
+    systemRoot?: string;
+    desktopIdentity?: ProcessIdentity;
+    hostIdentity?: ProcessIdentity;
+    /** Exact task/verification cwd incarnation held by the native host. */
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic A→B seam before the trusted bootstrap launch. */
+    beforeHostSpawn?: (hostDir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic A→B seam before durable owner publication. */
+    beforeOwnerPublication?: (hostDir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal isolated process-host root for deterministic tests. */
+    tempRoot?: string;
+}): Promise<ChildProcess>;
+export declare function sweepOrphanWindowsHostDirs(tempRoot: string, seams?: {
+    /** @internal deterministic replacement after authority capture, before owner read. */
+    beforeOwnerRead?: (dir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic replacement after liveness decision, before removal. */
+    beforeOwnerRemoval?: (dir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic liveness seam. */
+    isOwnerAlive?: (owner: ProcessIdentity) => Promise<boolean>;
+    /** @internal deterministic wall clock. */
+    now?: () => number;
+}): Promise<void>;
+/** Crash-durable identity used to retry a cleanup proof without a live handle. */
+export interface ProcessCleanupOwner {
+    pid: number;
+    ownership: 'posix-group';
+    /** Wall-clock lower-bound captured immediately before spawn. */
+    startedAtMs: number;
+    /** OS-native process incarnation, not reusable with the numeric PID/PGID. */
+    incarnationId: string;
+}
+/** Restart/session-start sweep for owners durably published before user code ran. */
+export declare function reapDurableProcessOwners(opts?: {
+    /** @internal isolated registry root for tests. */
+    rootDir?: string;
+    /** @internal deterministic same-inode growth seam. */
+    afterOwnerStat?: (file: string) => Promise<void> | void;
+    /** @internal lower deterministic helper deadline for tests. */
+    helperTimeoutMs?: number;
+    /** @internal deterministic blocked registry enumeration seam. */
+    testHangDirectoryStage?: 'open' | 'read' | 'close';
+    /** @internal deterministic blocked owner-record seam. */
+    testHangOwnerReadStage?: 'open' | 'read' | 'close';
+    /** @internal deterministic owner-record replacement before exact retirement. */
+    beforeOwnerRetirement?: (file: string) => Promise<void> | void;
+}): Promise<{
+    reaped: number;
+    retained: number;
+}>;
+export declare class ProcessTreeTerminationError extends Error {
+    constructor(message: string);
+}
+type SpawnExecutable = (command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2]) => ChildProcess;
+type ProcessKill = (pid: number, signal?: NodeJS.Signals | number) => boolean;
+type ReadProcessIncarnation = (pid: number) => Promise<string | null>;
+/** Windows Job Objects drain with their host handle and never persist PID authority. */
+export declare function captureProcessCleanupOwner(args: {
+    pid: number;
+    ownership: ProcessTreeOwnership;
+    startedAtMs: number;
+    /** @internal deterministic native-identity seam. */
+    readProcessIncarnation?: ReadProcessIncarnation;
+}): Promise<ProcessCleanupOwner | undefined>;
+export declare function processTreeOwnership(substrateOwned: boolean, platform?: NodeJS.Platform): ProcessTreeOwnership;
+/**
+ * Terminate a process tree CodeVibe owns. POSIX uses a detached process group;
+ * Windows launches close their original Job Object host handle.
+ */
+export declare function terminateOwnedProcessTree(args: {
+    pid: number;
+    ownership: ProcessTreeOwnership;
+    directKill: () => void;
+    timeoutMs?: number;
+    /** @internal deterministic POSIX signal seam. */
+    processKill?: ProcessKill;
+    /** @internal deterministic POSIX wait seam. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Captured immediately after spawn and required before a POSIX group signal. */
+    cleanupOwner?: ProcessCleanupOwner;
+    /** @internal deterministic OS-incarnation seam. */
+    readProcessIncarnation?: ReadProcessIncarnation;
+}): Promise<void>;
+/** Retry a previously unverified owned tree after restart/session teardown. */
+export declare function retryProcessCleanupOwner(owner: ProcessCleanupOwner, seams?: {
+    processKill?: ProcessKill;
+    readProcessIncarnation?: ReadProcessIncarnation;
+    sleep?: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+}): Promise<void>;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/local-executor/revert-reconcile.d.ts

@@ -42,6 +42,10 @@ export interface ReconcileDeps {
         alreadyReverted: string[];
         conflicts: string[];
     }>;
+    /** Verify exact stored post-images, transition APPLIED, then ACK before GC. */
+    acknowledgeSnapshotPromotion?: (taskGroupId: string) => Promise<void>;
+    /** Exact base/post acceptance finalizer shared with the live decision path. */
+    finalizeAcceptedGroup?: (taskGroupId: string) => Promise<void>;
     /**
      * HIGH-1 / LOCK #589-J — the COMMIT transport for CLAIM-crash recovery. Present
      * for a TEAM session (the same `claimGroupDecision` SDK the live decision uses).
@@ -63,6 +67,18 @@ export interface ReconcileDeps {
      * to a later start (the marker survives; never block on a missing key).
      */
     getSessionKey?: (sessionId: string) => Promise<string | null>;
+    /**
+     * CP-8-FULL Stage-2 R1 Codex F1/HIGH — drive the per-track + group convergence
+     * emit (the SAME `driveGroupDecisionConvergence` chokepoint the live gate uses)
+     * for a CLAIM-crash-recovered decision, so a decision COMMITted at startup still
+     * emits its typed `TEAM_TRACK_STATUS` + `TEAM_GROUP_RESOLVED` terminal to mobile
+     * (D4: mobile keys the resolved banner off `TEAM_GROUP_RESOLVED`). Present for a
+     * TEAM session alongside `commitClient`; ABSENT (non-team / older callers) → the
+     * recovery COMMIT still lands, only the wire emit is skipped (no regression vs the
+     * pre-CP-8 recovery, which emitted nothing). The outcome is the DECISION-driven
+     * `decisionToGroupOutcome` — identical to the live path, so the two never diverge.
+     */
+    driveGroupConvergence?: (taskGroupId: string, outcome: string) => Promise<void>;
     /** Optional clock injection for deterministic GC tests. */
     now?: () => number;
 }

package/node_modules/@quantiya/codevibe-core/dist/local-executor/revert-runner.d.ts

@@ -1,4 +1,5 @@
 import { RevertManifestStore } from './durable-store';
+import { type CasHelperCrashStage } from './workspace-shadow';
 /** The outcome of a group revert (Fork A: clean-where-safe + surface). */
 export interface RevertResult {
     /** Paths reverted (created→deleted, modified/deleted→restored) THIS pass. */
@@ -8,10 +9,22 @@ export interface RevertResult {
     /** Paths the user edited after apply — left as-is, surfaced (NEVER clobbered). */
     conflicts: string[];
 }
+/** @internal deterministic filesystem-race seams used by regression tests. */
+export interface RevertRunnerEnv {
+    afterDisplacement?: (path: string, recoveryName: string) => Promise<void>;
+    /** @internal deterministic race seam immediately before the reverse CAS. */
+    beforeMutationCommit?: (path: string) => Promise<void>;
+    /** @internal deterministic race seam immediately before final-state proof. */
+    beforeFinalVerification?: () => Promise<void>;
+    /** @internal deterministic post-COMMIT helper-death seam. */
+    testCrashHelperStage?: (path: string) => CasHelperCrashStage | undefined;
+    /** @internal swap/race seam before each manifest/journal filesystem proof. */
+    beforeJournalFileRead?: (path: string) => Promise<void> | void;
+}
 /**
  * Revert the whole group's applied tree off its durable manifest + journal.
  * Reverse `promoteOrder`; clean-where-safe; idempotent + crash-resumable.
  *
  * `workingDir` is the real workspace root the team applied into.
  */
-export declare function revertGroup(store: RevertManifestStore, taskGroupId: string, workingDir: string): Promise<RevertResult>;
+export declare function revertGroup(store: RevertManifestStore, taskGroupId: string, workingDir: string, env?: RevertRunnerEnv): Promise<RevertResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/reviewer-rationale-flag.d.ts

@@ -0,0 +1,10 @@
+/** The env var that enables reviewer-visible implementor rationale (opt-IN). */
+export declare const REVIEWER_RATIONALE_ENV_VAR = "CODEVIBE_REVIEWER_RATIONALE";
+/**
+ * Is reviewer-visible implementor rationale enabled? DEFAULT-OFF. ONLY the
+ * canonical truthy tokens (`1`/`true`/`on`/`yes`, case-insensitive) enable it;
+ * anything else — including unset, empty, and garbage — is OFF (fail-closed:
+ * a typo can never silently widen what reviewers see). `env` is injected for
+ * deterministic tests; production passes `process.env`.
+ */
+export declare function isReviewerRationaleEnabled(env?: NodeJS.ProcessEnv): boolean;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/snapshot-merge.d.ts

@@ -0,0 +1,124 @@
+import type { VerificationGateKind } from './class-a-emit';
+import type { GateRunResult } from './verification-runner';
+import { type MetadataBudget } from './bounded-directory';
+import type { PromoteManifestInput, RevertManifestEntry, RevertManifestStore, SnapshotPromotionJournalV1 } from './durable-store';
+import { WorkspaceShadow, type ReviewedShadowDiffFile, type ShadowEnv } from './workspace-shadow';
+import { type WorkspaceRootAuthority } from './workspace-authority';
+export declare const SNAPSHOT_TRACK_BUNDLE_VERSION: 2;
+export interface SnapshotTrackBundle {
+    version: typeof SNAPSHOT_TRACK_BUNDLE_VERSION;
+    /** Durable authority is scoped to exactly one hosted task group. */
+    taskGroupId: string;
+    trackIndex: number;
+    /** Exact hosted child task/generation whose authorization produced these bytes. */
+    taskId: string;
+    dispatchGeneration: number;
+    /** Exact canonical user-root instance that supplied every reviewed base. */
+    workspaceRootAuthority: WorkspaceRootAuthority;
+    files: ReviewedShadowDiffFile[];
+    testSurfaces: string[];
+    createdAtMs: number;
+    /** Content address over the reviewed bytes and pre-image hashes. */
+    bundleHash: string;
+}
+export interface SnapshotBundlesView {
+    bundles: SnapshotTrackBundle[];
+}
+/** Collect declared tests incrementally under one aggregate metadata budget. */
+export declare function collectSnapshotTestSurfaces(bundles: readonly Pick<SnapshotTrackBundle, 'testSurfaces'>[]): string[];
+export declare function createSnapshotTrackBundle(args: {
+    taskGroupId: string;
+    trackIndex: number;
+    taskId?: string;
+    dispatchGeneration?: number;
+    workspaceRootAuthority: WorkspaceRootAuthority;
+    files: readonly ReviewedShadowDiffFile[];
+    testSurfaces?: readonly string[];
+    nowMs?: number;
+}): SnapshotTrackBundle;
+export type SnapshotMergePlan = {
+    status: 'merged';
+    files: ReviewedShadowDiffFile[];
+} | {
+    status: 'conflict';
+    paths: string[];
+    reason: string;
+};
+export interface SnapshotMergePlanOptions {
+    signal?: AbortSignal;
+    /** @internal deterministic aggregate-work ceiling for tests. */
+    maxWork?: number;
+    /** @internal deterministic planning deadline for tests. */
+    timeoutMs?: number;
+}
+/** Charge every file occurrence, including the same path repeated by tracks. */
+export declare function assertSnapshotBundleFileOccurrenceBounds(bundles: readonly Pick<SnapshotTrackBundle, 'files'>[], budget?: MetadataBudget, label?: string): void;
+/** Pure-filesystem N-track merge rooted in each file's reviewed base hash. */
+export declare function planSnapshotMerge(workingDir: string, taskGroupId: string, bundles: readonly SnapshotTrackBundle[], opts?: SnapshotMergePlanOptions): Promise<SnapshotMergePlan>;
+export declare function verifySnapshotTrackBundle(bundle: SnapshotTrackBundle, expectedTaskGroupId: string, sharedBudgets?: {
+    files?: MetadataBudget;
+    testSurfaces?: MetadataBudget;
+}): void;
+export declare function snapshotPromotionOperationHash(taskGroupId: string, bundles: readonly SnapshotTrackBundle[], gateKinds: readonly VerificationGateKind[]): string;
+export interface RunSnapshotMergeGateArgs {
+    workingDir: string;
+    taskGroupId: string;
+    ownerTrackIndex: number;
+    bundles: readonly SnapshotTrackBundle[];
+    gateKinds: readonly VerificationGateKind[];
+    shadowEnv?: ShadowEnv;
+    persistPreImages: (entries: PromoteManifestInput[]) => Promise<void>;
+    readPromotion: () => Promise<SnapshotPromotionJournalV1 | null>;
+    preparePromotion: (operationHash: string, files: readonly ReviewedShadowDiffFile[], workspaceRootAuthority: WorkspaceRootAuthority) => Promise<void>;
+    markPromotionApplied: (operationHash: string) => Promise<void>;
+    timeoutMs?: number;
+    /** @internal deterministic merge-planning aggregate-work ceiling for tests. */
+    mergePlanMaxWork?: number;
+    /** @internal deterministic merge-planning deadline for tests. */
+    mergePlanTimeoutMs?: number;
+    /** Session shutdown signal; checked at every mutation boundary. */
+    signal?: AbortSignal;
+    /** Register/unregister the disposable integration snapshot with its owner. */
+    onShadowCreated?: (shadow: WorkspaceShadow) => void;
+    onShadowDisposed?: (shadow: WorkspaceShadow) => void;
+    /** @internal deterministic cleanup-safety seam. */
+    runGate?: (gateKind: VerificationGateKind, cwd: string, timeoutMs: number, signal?: AbortSignal, workingDirAuthority?: WorkspaceRootAuthority) => Promise<GateRunResult | null>;
+    /** @internal swap/race seam immediately before a durable-journal filesystem proof. */
+    beforeJournalFileRead?: (path: string) => Promise<void> | void;
+}
+/**
+ * `UNRESOLVED` is deliberately not a wire-level MergeResult. It means durable
+ * promotion authority may still describe landed user-tree bytes, so the local
+ * executor must leave the hosted gate pending and re-drive reconciliation.
+ */
+export type SnapshotMergeGateResult = 'PASS' | 'FAIL' | 'UNRESOLVED';
+/** Merge, verify, and promote once. Every disposable directory is finally-owned. */
+export declare function runSnapshotMergeGate(args: RunSnapshotMergeGateArgs): Promise<SnapshotMergeGateResult>;
+/** Verify a stored group promotion is exactly present before startup ACK/GC. */
+export declare function verifyStoredSnapshotPromotion(workingDir: string, journal: SnapshotPromotionJournalV1): Promise<boolean>;
+/** Verify that a PREPARED promotion never left its exact reviewed bases. */
+export declare function verifyStoredSnapshotPromotionBases(workingDir: string, journal: SnapshotPromotionJournalV1): Promise<boolean>;
+/** Prove that a pre-PREPARE manifest never crossed its first mutation boundary. */
+export declare function verifyStoredManifestBases(workingDir: string, entries: readonly RevertManifestEntry[]): Promise<boolean>;
+/** Dispose ordinary durable resources authored during this desktop session. */
+export declare function disposeStoredSnapshotSessionResources(store: RevertManifestStore, workingDir: string): Promise<{
+    removed: string[];
+    retained: string[];
+}>;
+/**
+ * Retire every active filesystem-promotion state before flipping the group
+ * lifecycle accepted. PREPARED may mean either all post-images landed or no
+ * mutation landed; both are proven exactly. Any mixed/unknown state remains
+ * nonterminal with its pending-decision recovery anchor intact.
+ */
+export declare function finalizeStoredSnapshotGroupAcceptance(store: RevertManifestStore, workingDir: string, taskGroupId: string): Promise<void>;
+/**
+ * Reconcile the durable PREPARED/APPLIED journal after the hosted engine has
+ * confirmed successful group completion. This is the same exact post-image
+ * proof used at startup, but it runs during the live session so ordinary
+ * success does not retain bundles, pre-images, or journals until restart.
+ */
+export declare function completeStoredSnapshotGroup(store: RevertManifestStore, workingDir: string, taskGroupId: string): Promise<void>;
+/** Current reviewed mutation authority always carries exact pre/post modes. */
+export declare function assertExactReviewedDiffFile(value: unknown): asserts value is ReviewedShadowDiffFile;
+export declare function assertExactSnapshotPromotionJournal(value: unknown): asserts value is SnapshotPromotionJournalV1;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/task-group-types.d.ts

@@ -74,12 +74,13 @@ export interface CreateTaskGroupInput {
      * CP-14 P1 (§2.1) — the team EXECUTION MODEL: `'worktree_merge' |
      * ({@link TeamExecution}) — always `'worktree_merge'` since the §10
      * retirement (2026-07-03; strict pre-P1 disjointness,
-     * byte-identical). Send `'worktree_merge'` ONLY when this client will run the
-     * merge-train (its own `resolveTeamExecution`); that opts the group into
-     * overlapping-track dispatch (the merge-train + the server-side shared-contract
-     * gate become the authority). Snake_case wire value end-to-end (no GraphQL
-     * enum) — typed as the {@link TeamExecution} union for compile-time safety;
-     * the GraphQL field is `String`.
+     * byte-identical). The value is now a backward-compatible capability label,
+     * not a promise that Git or a worktree exists: the desktop integrates reviewed
+     * filesystem bundles. It opts the group into overlapping-track dispatch (the
+     * desktop integration gate + server-side shared-contract gate become the
+     * authority). Snake_case wire value end-to-end (no GraphQL enum) — typed as
+     * the {@link TeamExecution} union for compile-time safety; the GraphQL field
+     * is `String`.
      */
     executionModel?: TeamExecution;
     /**

package/node_modules/@quantiya/codevibe-core/dist/local-executor/team-execution-flag.d.ts

@@ -1,4 +1,4 @@
-/** The single execution model. `legacy_disjoint` was deleted 2026-07-03 (§10). */
+/** The single backward-compatible wire label; it does not imply a Git dependency. */
 export type TeamExecution = 'worktree_merge';
 /** The hard default — and only — execution model. */
 export declare const DEFAULT_TEAM_EXECUTION: TeamExecution;
@@ -17,5 +17,5 @@ export declare function isTeamExecution(v: unknown): v is TeamExecution;
  * legacy path no longer exists to be selected).
  */
 export declare function resolveTeamExecution(_override?: TeamExecution | null | undefined, _env?: NodeJS.ProcessEnv): TeamExecution;
-/** True — the merge-before-push model is the only execution model. */
+/** True — the reviewed-bundle merge model is the only execution model. */
 export declare function isWorktreeMergeEnabled(_override?: TeamExecution | null | undefined, _env?: NodeJS.ProcessEnv): boolean;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/track-registry.d.ts

@@ -45,6 +45,8 @@ export declare class TrackRegistry {
     forGroup(taskGroupId: string): TrackProcess[];
     /** Drop a track entry (e.g., after it terminates). */
     delete(taskGroupId: string, trackIndex: number): void;
+    /** Retire all session-owned membership at the terminal disposal boundary. */
+    clear(): void;
     /** Test-only — number of tracked processes. */
     get sizeForTests(): number;
 }

package/node_modules/@quantiya/codevibe-core/dist/local-executor/types.d.ts

@@ -1,12 +1,15 @@
 import type { ChildProcess } from 'node:child_process';
 import type { SubstrateHandle, SubstrateProc } from '../substrate/types';
 import type { AuthorityRefusal, AuthorityScope } from './authority';
+import type { WorkspaceRootAuthority } from './workspace-authority';
 export type ProcessRole = 'implementor' | 'reviewer' | 'health_probe' | 'auth_probe' | 'model_probe';
 export type AgentKind = 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
 export type FailureClass = null | 'quota_exhausted' | 'auth_failed' | 'timeout' | 'unavailable' | 'user_aborted';
 export interface SpawnArgs {
     argv: string[];
     workingDir: string;
+    /** Exact cwd incarnation for every task-scoped mutable/verification spawn. */
+    workingDirAuthority?: WorkspaceRootAuthority;
     role: ProcessRole;
     agentKind?: AgentKind;
     timeoutMs: number | null;
@@ -15,8 +18,13 @@ export interface SpawnArgs {
     stdinPayload?: string;
     signal?: AbortSignal;
     taskId?: string;
+    lifecycleAudit?: 'active_task' | 'none';
     onProcessSpawned?: ProcessSpawnedHook;
     onProcessExited?: ProcessExitedHook;
+    /** Persist process-group cleanup authority before any unconfined user code runs. */
+    onCleanupOwnerReady?: (owner: import('./process-tree').ProcessCleanupOwner) => Promise<void>;
+    /** Retire the durable owner only after exact descendant absence is proven. */
+    onCleanupOwnerRetired?: (owner: import('./process-tree').ProcessCleanupOwner) => Promise<void>;
     substrate?: SubstrateHandle;
     requireConfined?: boolean;
 }
@@ -32,9 +40,13 @@ export interface ProcessExitedInfo {
     failureClass: FailureClass;
     exitedAt: string;
     runtimeMs: number;
+    /** False means owned descendants could not be proven gone; cwd must be retained. */
+    workspaceCleanupSafe?: boolean;
+    /** Persistable owner used to retry descendant quiescence after failure/restart. */
+    workspaceCleanupOwner?: import('./process-tree').ProcessCleanupOwner;
 }
-export type ProcessSpawnedHook = (info: ProcessSpawnedInfo) => void;
-export type ProcessExitedHook = (info: ProcessExitedInfo) => void;
+export type ProcessSpawnedHook = (info: ProcessSpawnedInfo) => void | Promise<void>;
+export type ProcessExitedHook = (info: ProcessExitedInfo) => void | Promise<void>;
 export interface SpawnHandleBase {
     pid: number;
     role: ProcessRole;
@@ -373,6 +385,17 @@ export type HookEvent = {
     contentB64: string;
     timestamp: string;
 };
+export interface WorkspaceDisposeOptions {
+    strict?: boolean;
+    /**
+     * Fence and drain LocalExecutor activity, but leave shared durable task-group
+     * retirement to the session coordinator after Quorum publishers also drain.
+     */
+    deferDurableSessionResources?: boolean;
+}
+export interface DurableSessionResourceDisposeOptions {
+    strict?: boolean;
+}
 export interface LocalExecutor {
     spawnImplementor(args: SpawnArgs): Promise<ImplementorHandle>;
     spawnReviewer(args: SpawnArgs): Promise<ReviewerHandle>;
@@ -406,6 +429,13 @@ export interface LocalExecutor {
      * implementations / tests.
      */
     recoverLaunchTrack?(payload: TrackAssignedPayload): Promise<'registered' | 'duplicate' | 'rejected'>;
+    /** Reclaim session-owned integration workspaces during normal shell teardown. */
+    disposeWorkspaces?(opts?: WorkspaceDisposeOptions): Promise<void>;
+    /**
+     * Final shared durable-store retirement. The shell invokes this only after
+     * both Quorum terminal publishers and LocalExecutor activity have drained.
+     */
+    disposeDurableSessionResources?(opts?: DurableSessionResourceDisposeOptions): Promise<void>;
 }
 export interface SpawnedProcess {
     child: ChildProcess | SubstrateProc;
@@ -414,4 +444,6 @@ export interface SpawnedProcess {
     agentKind: AgentKind | undefined;
     spawnedAt: string;
     spawnedAtMs: number;
+    /** Direct children have an OS-specific process-tree owner; substrate owns its own. */
+    processTreeOwnership: import('./process-tree').ProcessTreeOwnership;
 }

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/build.d.ts

@@ -1,6 +1,11 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface BuildGateArgs {
     cwd: string;
     timeoutMs: number;
+    signal?: AbortSignal;
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic manifest-absence authority seam. */
+    beforeManifestAbsence?: () => Promise<void> | void;
 }
 export declare function runBuildGate(args: BuildGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/deploy-preflight.d.ts

@@ -1,6 +1,8 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface DeployPreflightGateArgs {
     cwd: string;
     timeoutMs: number;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runDeployPreflightGate(args: DeployPreflightGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/diff-sanity.d.ts

@@ -1,6 +1,18 @@
+import { type ShadowDiffFile } from '../workspace-shadow';
 import type { GateRunResult } from '../verification-runner';
+import { type WorkspaceRootAuthority } from '../workspace-authority';
 export interface DiffSanityGateArgs {
     cwd: string;
     timeoutMs: number;
+    files?: readonly ShadowDiffFile[];
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic root-replacement seam. */
+    afterAuthorityCheck?: () => Promise<void> | void;
+    /** @internal deterministic A→B→A restoration before the final check. */
+    beforeAuthorityCompletion?: () => Promise<void> | void;
+    /** @internal deterministic entry replacement/removal after enumeration. */
+    beforeFileRead?: (relativePath: string) => Promise<void> | void;
+    /** @internal deterministic directory replacement after parent enumeration. */
+    beforeDirectoryRead?: (relativePath: string) => Promise<void> | void;
 }
 export declare function runDiffSanityGate(args: DiffSanityGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/hostile-grep.d.ts

@@ -1,6 +1,8 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface HostileGrepGateArgs {
     cwd: string;
     timeoutMs: number;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runHostileGrepGate(args: HostileGrepGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/lint.d.ts

@@ -1,6 +1,8 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface LintGateArgs {
     cwd: string;
     timeoutMs: number;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runLintGate(args: LintGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/shell-runner.d.ts

@@ -1,5 +1,6 @@
 import { spawn as nodeSpawn } from 'node:child_process';
 import type { GateRunResult } from '../verification-runner';
+import { type WorkspaceRootAuthority } from '../workspace-authority';
 export declare const VERIFICATION_RUNNER_ROLE = "verification_runner";
 export interface ShellRunArgs {
     /** Command to execute (e.g. "cargo", "npm", "git"). */
@@ -8,8 +9,12 @@ export interface ShellRunArgs {
     args: string[];
     /** Working directory — caller (gate wrapper) MUST pass the repo root. */
     cwd: string;
+    /** Exact cwd incarnation authorized before any pathname-based gate discovery. */
+    workingDirAuthority?: WorkspaceRootAuthority;
     /** Per-gate timeout budget in milliseconds. Required (LOCK #C3E-4). */
     timeoutMs: number;
+    /** Cooperative session-shutdown cancellation. */
+    signal?: AbortSignal;
     /** Optional extra env overrides on top of the marker injection. */
     extraEnv?: Record<string, string>;
     /** Optional clock seam for tests. Defaults to Date.now. */

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/source-traceability.d.ts

@@ -1,6 +1,8 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface SourceTraceabilityGateArgs {
     cwd: string;
     timeoutMs: number;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runSourceTraceabilityGate(args: SourceTraceabilityGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/tests.d.ts

@@ -1,6 +1,9 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface TestsGateArgs {
     cwd: string;
     timeoutMs: number;
+    signal?: AbortSignal;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runTestsGate(args: TestsGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-gates/typecheck.d.ts

@@ -1,6 +1,9 @@
 import type { GateRunResult } from '../verification-runner';
+import type { WorkspaceRootAuthority } from '../workspace-authority';
 export interface TypecheckGateArgs {
     cwd: string;
     timeoutMs: number;
+    signal?: AbortSignal;
+    workingDirAuthority?: WorkspaceRootAuthority;
 }
 export declare function runTypecheckGate(args: TypecheckGateArgs): Promise<GateRunResult>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/verification-runner.d.ts

@@ -1,4 +1,5 @@
 import type { ClassAEmitter, ClassAEmitterContext, VerificationGateKind, VerificationResultPayload } from './class-a-emit';
+import { type WorkspaceRootAuthority } from './workspace-authority';
 export declare const DEFAULT_GATE_TIMEOUT_MS = 300000;
 export declare const TIMEOUT_EXIT_CODE = 124;
 export declare const SUMMARY_CAP_BYTES = 4096;
@@ -8,6 +9,7 @@ export interface VerificationGateRequest {
     sessionId: string;
     gateKinds: VerificationGateKind[];
     cwd: string;
+    cwdAuthority?: WorkspaceRootAuthority;
     timeoutMsOverride?: number;
 }
 export interface GateRunResult {
@@ -16,6 +18,10 @@ export interface GateRunResult {
     stderr: string;
     durationMs: number;
     timedOut?: boolean;
+    /** False means process-tree cleanup was not verified; caller must retain cwd. */
+    workspaceCleanupSafe?: boolean;
+    /** Persistable owner used to retry quiescence when cleanup was unverified. */
+    workspaceCleanupOwner?: import('./process-tree').ProcessCleanupOwner;
 }
 export interface VerificationRunnerDeps {
     emitter: ClassAEmitter;