@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/reviewer/registry.d.ts

@@ -24,7 +24,6 @@ export declare class ReviewerRegistry implements ReviewerProvider {
      * ```ts
      * const registry = new ReviewerRegistry()
      *   .with('claude', new ClaudeReviewerProvider())
-     *   .with('gemini', new GeminiReviewerProvider())
      *   .with('codex',  new CodexReviewerProvider());
      * ```
      *
@@ -65,11 +64,18 @@ export declare class ReviewerRegistry implements ReviewerProvider {
     evaluate(spec: ReviewerSpec, gateId: string, opts?: ReviewerEvaluateOptions): Promise<ReviewerVerdict>;
 }
 /**
- * Production factory: build a registry pre-populated with all four
- * subprocess providers (Claude, Gemini, Codex, Antigravity) using the
+ * Production factory: build a registry pre-populated with the three
+ * supported subprocess providers (Claude, Codex, Antigravity) using the
  * standard binaries from PATH. Equivalent of Rust's
  * `withSubprocessProviders()` napi factory.
  *
+ * Gemini is SUNSET (2026-07): it is no longer registered here, so a policy
+ * that names a `gemini` reviewer fails closed via `evaluate`'s
+ * missing-provider path (throws `spawn_failed` → engine escalates to the
+ * user) rather than silently spawning `gemini`. The `'GEMINI'` AgentKind
+ * value is retained for backward-compatible deserialization of legacy
+ * records; it is simply not a routable reviewer.
+ *
  * Plugins call this once at startup and hand the registry to the
  * engine fan-out path. Inert registrations cost nothing — no
  * subprocess fires until the policy actually references that agent.
@@ -80,7 +86,6 @@ export declare class ReviewerRegistry implements ReviewerProvider {
  * ```ts
  * const registry = new ReviewerRegistry()
  *   .with('claude', new ClaudeReviewerProvider({ executable: '/opt/bin/claude' }))
- *   .with('gemini', new GeminiReviewerProvider({ executable: '/opt/bin/gemini' }))
  *   .with('codex',  new CodexReviewerProvider({  executable: '/opt/bin/codex' }));
  * ```
  */

package/node_modules/@quantiya/codevibe-core/dist/reviewer/token-usage.d.ts

@@ -9,6 +9,16 @@
  * never corrupts the accumulator.
  */
 export declare function finiteToken(n: unknown): number;
+/**
+ * Locate the FIRST balanced top-level `{...}` in `stdout` that parses to an object
+ * with `type === 'result'` — Claude may emit non-JSON warning / MCP lines before
+ * the terminal result envelope, so we scan candidate `{` positions rather than
+ * parsing the whole stdout blindly. Returns the parsed object, or null if none
+ * parses to a `result` envelope. Exported for the orchestration-shell advisory
+ * quota classifier ([#637] — the Claude usage-limit rides in this envelope's
+ * `result` field); never throws.
+ */
+export declare function firstResultEnvelope(stdout: string): Record<string, unknown> | null;
 /**
  * [P2-6] Unwrap a Claude Code `--output-format json` NON-interactive envelope into
  * `{ text, tokens }`. The ENTIRE body is `try/catch`-guarded — ANY throw (parse

package/node_modules/@quantiya/codevibe-core/dist/reviewer/types.d.ts

@@ -90,6 +90,9 @@ export interface ReviewerVerdict {
     /** Ordered list of specific changes. **Required** when `verdict === 'REVISE'`;
      *  empty for other verdicts (enforced by the output parser). */
     suggested_changes: string[];
+    /** Optional non-blocking risks or recommendations. These are displayed in
+     *  the terminal summary but never affect consensus or trigger revision. */
+    residual_observations: string[];
     /** Model identifier used (for cost attribution). */
     model_used: string | null;
     /** Tokens consumed by this reviewer. */

package/node_modules/@quantiya/codevibe-core/dist/reviewer/verdict-classifier.d.ts

@@ -59,4 +59,5 @@ export declare function resolveClassifiedVerdictFields(classification: VerdictCl
     verdict: VerdictKind;
     reasoning: string;
     suggested_changes: string[];
+    residual_observations: string[];
 };

package/node_modules/@quantiya/codevibe-core/dist/session/__tests__/device-registration-lease.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/__tests__/pending-session-create.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/__tests__/session-rekey-fingerprint.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/__tests__/session-resume-key-reconciliation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/__tests__/session-resume-pending-first.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/device-key-watcher.d.ts

@@ -1,5 +1,6 @@
 import { AppSyncClient } from '../appsync/appsync-client';
 import { Logger } from '../logger';
+export declare function isOwnDeviceRegistration(ownDeviceId: string, registeredDeviceId: string): boolean;
 /**
  * Start the device-key registration watcher for the authenticated user.
  *

package/node_modules/@quantiya/codevibe-core/dist/session/index.d.ts

@@ -1,5 +1,7 @@
-export { resumeOrCreateSession, prepareSessionEncryption } from './session-resume';
-export type { ResumeOrCreateSessionInput, ResumeOrCreateSessionResult } from './session-resume';
+export { resumeOrCreateSession, prepareSessionEncryption, PlannerProxyServiceKeyMissingError, SessionEncryptionPreparationError, } from './session-resume';
+export type { ResumeOrCreateSessionInput, ResumeOrCreateSessionResult, SessionEncryptionPreparationFailureKind, } from './session-resume';
+export { createSessionWithPendingLedger, replayPendingSessionCreateForIntent, } from './pending-session-create';
+export type { PendingSessionCreateIntent } from './pending-session-create';
 export { rekeySessionForNewDevices } from './session-rekey';
 export { startDeviceKeyWatcher } from './device-key-watcher';
 export { registerDeviceEncryptionKey } from './register-device-key';

package/node_modules/@quantiya/codevibe-core/dist/session/pending-session-create.d.ts

@@ -0,0 +1,61 @@
+import { type AppSyncClient } from '../appsync';
+import type { Logger } from '../logger';
+import type { CreateSessionInput, Session } from '../types';
+interface PendingSessionCreateRecord {
+    schema: 'codevibe.pending_session_create.v2';
+    sessionId: string;
+    creationRequestId: string;
+    intentFingerprint: string;
+    input: CreateSessionInput;
+    sessionKey: string | null;
+    createdAt: string;
+}
+export interface PendingSessionCreateIntent {
+    userId: string;
+    agentType: NonNullable<CreateSessionInput['agentType']>;
+    /** Plain local path. It is persisted only inside the sealed ledger. */
+    projectPath: string;
+}
+declare function ledgerPath(sessionId: string): string;
+declare function fingerprintIntent(intent: PendingSessionCreateIntent): string;
+declare function readPending(sessionId: string): Promise<PendingSessionCreateRecord | null>;
+declare function removePending(sessionId: string, record?: PendingSessionCreateRecord): Promise<void>;
+declare function findPendingForIntent(intent: PendingSessionCreateIntent, logger: Logger): Promise<PendingSessionCreateRecord | null>;
+/**
+ * Persist one exact create envelope before network I/O and replay it unchanged
+ * after an ambiguous transport failure or process restart.
+ */
+export declare function createSessionWithPendingLedger(args: {
+    input: CreateSessionInput;
+    sessionKey: string | null;
+    intent: PendingSessionCreateIntent;
+    appSyncClient: Pick<AppSyncClient, 'createSession'>;
+    logger: Logger;
+    /**
+     * Synchronous lifecycle handoff fired immediately after the backend response
+     * is proven to match the sealed request, before keychain or ledger cleanup.
+     */
+    onAdmitted?: (session: Session) => void;
+}): Promise<{
+    session: Session;
+    sessionKey: string | null;
+}>;
+/** Replay an interrupted create before minting a new id for the same intent. */
+export declare function replayPendingSessionCreateForIntent(args: {
+    intent: PendingSessionCreateIntent;
+    appSyncClient: Pick<AppSyncClient, 'createSession'>;
+    logger: Logger;
+    onAdmitted?: (session: Session) => void;
+}): Promise<{
+    session: Session;
+    sessionKey: string | null;
+} | null>;
+export declare const pendingSessionCreateTestSeams: {
+    ledgerPath: typeof ledgerPath;
+    readPending: typeof readPending;
+    removePending: typeof removePending;
+    findPendingForIntent: typeof findPendingForIntent;
+    fingerprintIntent: typeof fingerprintIntent;
+    setRemovalFault(fault: "after_tombstone" | null): void;
+};
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session/register-device-key.d.ts

@@ -1,5 +1,15 @@
 import { AppSyncClient } from '../appsync/appsync-client';
 import { Logger } from '../logger';
+export declare function registrationLeaseIsFresh(lastUsedAt: string | undefined, nowMs?: number): boolean;
+export interface RegisterDeviceEncryptionKeyOptions {
+    /**
+     * Publish even when the normal registration lease is fresh. Recovery paths
+     * use this to emit the mutation that wakes peer device-key subscriptions.
+     */
+    force?: boolean;
+    /** Structured diagnostic explaining why a forced registration was needed. */
+    reason?: string;
+}
 /**
  * Register the current device's ECDH public key with the backend.
  *
@@ -10,4 +20,4 @@ import { Logger } from '../logger';
  * @param appSyncClient Authenticated AppSyncClient.
  * @param logger Plugin-specific logger so log lines are tagged correctly.
  */
-export declare function registerDeviceEncryptionKey(appSyncClient: AppSyncClient, logger: Logger): Promise<void>;
+export declare function registerDeviceEncryptionKey(appSyncClient: AppSyncClient, logger: Logger, options?: RegisterDeviceEncryptionKeyOptions): Promise<void>;

package/node_modules/@quantiya/codevibe-core/dist/session/session-rekey.d.ts

@@ -8,8 +8,8 @@ export interface RekeyOptions {
      * they already have an entry in `session.encryptedKeys`. Use this
      * when you know a specific device just re-registered — for example,
      * when handling an `onDeviceKeyRegistered` subscription event — so
-     * a rotated public key gets a fresh wrapped entry. The old entry
-     * is left intact; the new one is appended via `grantSessionKey`.
+     * a rotated public key gets a fresh wrapped entry. The backend replaces
+     * the recipient's prior entry atomically and collapses legacy duplicates.
      *
      * Default: empty. The bulk diff path (catch-up after disconnect,
      * catch-up at session resume) does not pass this and relies on the
@@ -23,14 +23,14 @@ export interface RekeyOptions {
  * key to any device that is missing an entry (or that the caller has
  * explicitly marked as needing a fresh wrap via `forceDeviceIds`).
  *
- * Safe to call repeatedly. No-op when every registered device already
- * has an entry and nothing is forced. Does not modify or remove existing
- * entries — only appends new ones via the grantSessionKey mutation.
+ * Safe to call repeatedly. No-op when every registered device has an envelope
+ * bound to its current public key and nothing is forced.
  *
  * @param sessionId  The session to re-key.
- * @param sessionKey The plaintext session key (base64). The caller must
- *                   already hold this — typically from
- *                   keychainManager.getCachedSessionKey(sessionId).
+ * @param sessionKey The caller's current plaintext session key (base64).
+ *                   This is only an admission hint: after fetching the
+ *                   authoritative row, the function re-derives/loads the key
+ *                   for that row's exact generation before wrapping.
  * @param appSyncClient Authenticated AppSyncClient.
  * @param options Optional behavior knobs. See RekeyOptions.
  * @returns The number of new grants that succeeded.

package/node_modules/@quantiya/codevibe-core/dist/session/session-resume.d.ts

@@ -19,10 +19,24 @@ export interface ResumeOrCreateSessionInput {
     metadata?: Record<string, any>;
 }
 export interface ResumeOrCreateSessionResult {
+    /**
+     * The authoritative backend row ID. This can differ from the requested ID
+     * when a sealed, ambiguous create is replayed for the same launch intent.
+     * Callers MUST bind subscriptions, heartbeats, and events to this value.
+     */
+    sessionId: string;
     /** Whether an existing session was found and reactivated */
     resumed: boolean;
     /** The E2E session key (for encrypting/decrypting events), or null if no encryption */
     sessionKey: string | null;
+    /**
+     * The session-key generation of the AUTHORITATIVE row (§4.5 key-gen binding),
+     * or null when unencrypted / the backend echoed no generation. Callers stamp
+     * this onto `expectedSessionKeyGen` so a key rotation racing an event write is
+     * rejected by the backend ConditionCheck rather than committing an
+     * undecryptable row (tool-event consolidation #229/#230).
+     */
+    sessionKeyGen: string | null;
 }
 /**
  * CP-1.b IMPL r5 H-2 — Typed error thrown by `prepareSessionEncryption()`
@@ -45,7 +59,13 @@ export interface ResumeOrCreateSessionResult {
  * shell-side typed error closes the funnel at session-create time so
  * the user never reaches a session that can't be decrypted.
  */
-export declare class PlannerProxyServiceKeyMissingError extends Error {
+export type SessionEncryptionPreparationFailureKind = 'backend_unavailable' | 'local_key_unavailable';
+export declare class SessionEncryptionPreparationError extends Error {
+    readonly kind: SessionEncryptionPreparationFailureKind;
+    readonly cause?: unknown;
+    constructor(kind: SessionEncryptionPreparationFailureKind, message: string, cause?: unknown);
+}
+export declare class PlannerProxyServiceKeyMissingError extends SessionEncryptionPreparationError {
     constructor(msg: string);
 }
 /**

package/node_modules/@quantiya/codevibe-core/dist/substrate/command-runner.d.ts

@@ -1,4 +1,5 @@
 import type { CommandResult, CommandRunner, RunnerProc } from './types';
+import type { WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 /**
  * The production `CommandRunner` — runs `docker` / `sandbox-exec` via
  * `node:child_process`. No shell is used (argv is passed directly to
@@ -15,5 +16,6 @@ export declare class ChildProcessCommandRunner implements CommandRunner {
         signal?: AbortSignal;
         env?: Readonly<Record<string, string>>;
         cwd?: string;
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/node_modules/@quantiya/codevibe-core/dist/substrate/docker.d.ts

@@ -1,5 +1,6 @@
 import { type ForwarderFactory } from './forwarder';
 import type { CommandRunner, EgressObservationHook, Substrate, SubstrateHandle, SubstrateSpec } from './types';
+import { type WorkspaceRootAuthority, type WorkspaceRootLease } from '../local-executor/workspace-authority';
 /** Where, inside the container, the worktree is mounted (the agent's cwd/home). */
 export declare const CONTAINER_WORKDIR = "/workspace";
 /** Injectable deps — default-wired to the real runtime; stubbed in unit tests. */
@@ -14,12 +15,13 @@ export interface DockerSubstrateDeps {
     image?: string;
     /**
      * Override the host root for the per-session scratch dir (default:
-     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`),
-     * the relay script, and the scrubbed git-proxy (in `gitproxy/`) — no secrets.
-     * The git-proxy now lives UNDER this dir (MED fix), so the one
-     * teardown/rollback rm removes it.
+     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`)
+     * and the relay script — no secrets or repository metadata.
+     * The one teardown/rollback removal retires the complete session authority.
      */
     sessionRoot?: string;
+    /** Original-handle bind source (native Linux by default; injectable for seam tests). */
+    acquireWorkdirLease?: (authority: WorkspaceRootAuthority) => Promise<WorkspaceRootLease>;
 }
 /** The deterministic per-session container name. */
 export declare function containerName(id: string): string;
@@ -44,10 +46,11 @@ export declare function buildContainerEntrypoint(sanitizedEnv: Readonly<Record<s
  * surface the conformance test pins:
  *   - `--network none`         → STRUCTURAL default-deny (only `lo`, no egress).
  *   - `-v <workdir>:/workspace` → ONLY the worktree mounted (rw).
- *   - `-v <gitProxy>:/workspace/.git:ro` → scrubbed `.git`, read-only (if any).
  *   - `-v <relayScript>:/codevibe/relay.js:ro` → the in-container relay (ro).
  *   - `-v <udsDir>:/codevibe/broker:rw`  → the bind-mounted broker UDS dir (rw,
  *     so the container's `connect()` works; the dir holds only the socket).
+ *   - `-v <bootstrap>:/codevibe/agent:ro` → broker helper + token file (ro).
+ *   - `-v <agentConfig>:/codevibe/agent-config:rw` → non-secret CLI config/runtime.
  *   - env via repeated `-e K=V` built EXACTLY from `spec.sanitizedEnv` (no host
  *     env passthrough; `docker run` does NOT inherit the host env). MED fix:
  *     the `-e` flags ADD to the image's baked env, so the AUTHORITATIVE wipe is
@@ -61,7 +64,6 @@ export declare function buildRunArgv(args: {
     id: string;
     image: string;
     workdir: string;
-    gitProxyPath: string | null;
     relayScriptPath: string;
     udsDir: string;
     sanitizedEnv: Readonly<Record<string, string>>;
@@ -70,6 +72,11 @@ export declare function buildRunArgv(args: {
         hostDir: string;
         sandboxDir: string;
     };
+    /** CP-7 PART D — mutable CLI config/runtime mount (`hostDir`→`sandboxDir:rw`). */
+    agentConfig?: {
+        hostDir: string;
+        sandboxDir: string;
+    };
 }): string[];
 /**
  * `docker exec [-i] <name> env -i <sanitizedEnv> <argv...>` — run the agent
@@ -94,40 +101,15 @@ export declare class DockerSubstrate implements Substrate {
     private readonly onEgressDenied;
     private readonly image;
     private readonly sessionRoot;
+    private readonly acquireWorkdirLease;
     constructor(deps?: DockerSubstrateDeps);
     launch(spec: SubstrateSpec): Promise<SubstrateHandle>;
     private rollback;
-    /**
-     * r5 HIGH-2 (Codex — NULL-vs-THROW gap). The proxy build produced no usable
-     * proxy (it returned `null` OR threw). Decide the safe outcome by whether the
-     * workdir actually HAS a `.git`:
-     *
-     *   - NO `<workdir>/.git`            → return `null` (a non-git workdir; the
-     *                                      `docker run` mounts only the worktree,
-     *                                      git reports "not a repository" — no
-     *                                      credential surface either way).
-     *   - `<workdir>/.git` EXISTS        → write an EMPTY SCRUBBED `.git` overlay
-     *                                      (a dir with ONLY a stripped synthetic
-     *                                      `config` — NO remotes/creds/hooks) and
-     *                                      return its path, so the `:ro` bind mount
-     *                                      SHADOWS the real `.git`. Degraded git
-     *                                      reads, but the credential surface is
-     *                                      fail-closed.
-     *   - overlay write ALSO fails       → roll back + throw (NEVER mount the
-     *                                      worktree with a live `.git`).
-     *
-     * Used for BOTH the null-return and the throw path so a workdir with a real
-     * but unresolvable `.git` can never reach the agent un-shadowed. `fsp.stat`
-     * (NOT `lstat`) follows a `.git` that is a symlink/dir/file alike — any of
-     * those "exists" cases must be shadowed.
-     */
-    private ensureGitOverlayOrFailClosed;
     private assertDockerAvailable;
 }
 export declare const __testing: {
     DEFAULT_IMAGE: string;
     CONTAINER_WORKDIR: string;
-    CONTAINER_GIT: string;
     CONTAINER_RELAY_PATH: string;
     CONTAINER_BROKER_DIR: string;
     RELAY_PORT: number;

package/node_modules/@quantiya/codevibe-core/dist/substrate/index.d.ts

@@ -8,5 +8,4 @@ export { SubstrateUnavailableError, SubstrateLaunchError } from "./errors";
 export { ChildProcessCommandRunner } from "./command-runner";
 export { HostEgressForwarder, defaultForwarderFactory } from "./forwarder";
 export type { ForwarderSpec, ForwarderFactory } from "./forwarder";
-export { buildScrubbedGitProxy, resolveGitCommonDir } from "./git-proxy";
 export { IN_CONTAINER_RELAY_SOURCE, CONTAINER_RELAY_PATH, CONTAINER_BROKER_DIR, CONTAINER_BROKER_SOCK, BROKER_SOCK_NAME, RELAY_PORT, } from "./relay-script";

package/node_modules/@quantiya/codevibe-core/dist/substrate/sandbox-exec.d.ts

@@ -62,25 +62,12 @@ export interface SandboxExecDeps {
 export declare function buildSeatbeltProfile(workdir: string, execPath?: string, 
 /**
  * CP-7 PART D — extra READ-ONLY dirs to grant (the apiKeyHelper bootstrap dir
- * holding the helper script + broker-token file + agent config). Read-only:
- * the agent reads the current token; no write grant (the host owns rotation).
+ * holding the helper script + broker-token file). Read-only: the agent reads
+ * the current token; no write grant (the host owns rotation).
  * These are explicit, scoped subpaths — NOT $HOME / /Users (the MED-fix
  * invariant that host secrets stay unreadable still holds).
  */
 extraReadDirs?: readonly string[], 
-/**
- * Stage-2 HIGH (Codex — the `.git` credential leak). The host path of the
- * SCRUBBED `.git` proxy (built by `git-proxy.ts`, same as A1's mount). When
- * provided, the profile (a) GRANTS read on it (read-only — the agent runs
- * `git` against it via `GIT_DIR`) and (b) DENIES read+write of the REAL
- * `<workdir>/.git`, so the agent CANNOT read the host repo's credential
- * helpers / tokenized remotes / hooks / reflogs directly. Without this the A5
- * agent runs on the host fs and the `(allow file-read* (subpath "<wd>"))`
- * grant would expose the real `.git`. Null/absent for a non-git workdir (the
- * `.git` deny is still emitted — denying a non-existent path is harmless and
- * keeps the profile shape uniform).
- */
-gitProxyDir?: string | null, 
 /**
  * r5 HIGH-1 (Codex) — the home dir to anchor the file-keychain (`~/.codevibe`)
  * DENY at. Default `os.homedir()`; injectable for deterministic tests. The
@@ -102,7 +89,21 @@ homedir?: string,
  * Null/absent → no audit deny is emitted (e.g. a unit test without a real audit
  * tree); production always threads the resolved audit dir.
  */
-auditDir?: string | null): string;
+auditDir?: string | null, 
+/**
+ * Extra dirs that the agent may read/write. Used only for the mutable CLI
+ * config/runtime dir; the broker-token helper stays in `extraReadDirs`.
+ */
+extraWriteDirs?: readonly string[], 
+/**
+ * A1d (design §8.1 — the resolver sandbox lattice). Network posture:
+ * `'loopback'` (default — the CP-7 broker tier, byte-identical profile) or
+ * `'open'` (the resolver-confinement row for a broker-less reduced-trust
+ * agent: inbound stays denied, ALL outbound is allowed so the agent's own
+ * file-authed model call reaches its vendor directly). See
+ * {@link SubstrateSpec.networkPosture}.
+ */
+networkPosture?: 'loopback' | 'open'): string;
 /**
  * A5 macOS `sandbox-exec` substrate (`egressFidelity: 'coarse'`). See file
  * header. NOT the default — the LE selects it as the macOS Docker-fallback.

package/node_modules/@quantiya/codevibe-core/dist/substrate/types.d.ts

@@ -1,4 +1,5 @@
 import type { Readable, Writable } from "node:stream";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 /**
  * Isolation backend for a substrate. `firecracker` is [DEF →
  * A3-after-C2] — declared so the union admits the hosted runner without
@@ -24,10 +25,12 @@ export type EgressFidelity = "strict" | "coarse";
 export interface SubstrateSpec {
     isolationTech: IsolationTech;
     /**
-     * Canonical host path of the session worktree — the ONLY filesystem
-     * mounted (§6 Q3 git-proxy).
+     * Canonical host path of the session workspace — the only mutable filesystem
+     * mounted; repository metadata is hidden by the substrate.
      */
     workdir: string;
+    /** Exact host workdir incarnation for task-scoped mutable launches. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /**
      * Where the broker actually listens on the HOST (e.g.
      * `127.0.0.1:<ephemeral>`).
@@ -59,8 +62,7 @@ export interface SubstrateSpec {
     /**
      * CP-7 PART D (§3.3 agy-R3 bootstrap) — OPTIONAL, additive. The host
      * directory holding the agent's `apiKeyHelper` script + the broker-token
-     * file + the agent config (Claude `settings.json` / Codex `config.toml`),
-     * bind-mounted READ-ONLY into the sandbox at `sandboxDir` so the wiped,
+     * file, bind-mounted READ-ONLY into the sandbox at `sandboxDir` so the wiped,
      * `--network none` agent can read the CURRENT broker token from a file
      * WITHOUT a network/IPC fetch. The host LE REFRESHES the token file
      * out-of-band on rotation; the read-only mount lets the host rewrite the
@@ -71,11 +73,25 @@ export interface SubstrateSpec {
      * wire; every existing `SubstrateSpec` construction still compiles.
      */
     agentBootstrap?: {
-        /** Host dir holding the helper script + token file + agent config (0700). */
+        /** Host dir holding the helper script + token file (0700). */
         hostDir: string;
         /** Read-only mount point inside the sandbox (NOT under the workdir). */
         sandboxDir: string;
     };
+    /**
+     * CP-7 PART D follow-up — mutable CLI config/runtime dir. Real agent CLIs
+     * create small startup/cache files beside their config (`CODEX_HOME`,
+     * `CLAUDE_CONFIG_DIR`). The broker-token helper stays in
+     * {@link agentBootstrap} and remains read-only; this separate dir is writable
+     * and contains only non-secret config/runtime state. It also lives outside the
+     * workdir so it never appears in diffs. LOCAL-ONLY; never on any wire.
+     */
+    agentConfig?: {
+        /** Host dir holding settings/config/runtime files (0700). */
+        hostDir: string;
+        /** Writable mount/grant point inside the sandbox. */
+        sandboxDir: string;
+    };
     /**
      * CP-7 W3 — Stage-2 r1 HIGH (A5 audit-readability). OPTIONAL, additive. The
      * RESOLVED per-task audit DIR (the sibling `.codevibe/audit/<group>/<track>/`
@@ -88,6 +104,22 @@ export interface SubstrateSpec {
      * construction still compiles (absent → no audit deny is emitted).
      */
     auditDir?: string;
+    /**
+     * A1d (design §8.1 — the write-capable resolver sandbox lattice). OPTIONAL,
+     * additive; A5-only (A1 ignores it — the docker row is never launched with an
+     * open posture). Network posture the Seatbelt profile emits:
+     *   - `'loopback'` (default, absent) — deny all network, re-allow loopback
+     *     only: the CP-7 broker tier (the agent's ONLY model path is the broker).
+     *   - `'open'` — deny inbound, allow ALL outbound: the RESOLVER-CONFINEMENT
+     *     row for a broker-less reduced-trust agent (agy/gemini) whose model call
+     *     dials its vendor DIRECTLY with its own file-based auth. The confinement
+     *     objective on that row is FS-WRITE confinement (writes stay strictly
+     *     inside the disposable merge workspace), not egress pinning — the engage
+     *     result carries a reduced-trust badge for the open egress.
+     * A LOCAL-ONLY field — never on any wire; every existing `SubstrateSpec`
+     * construction still compiles (absent → loopback, byte-identical profile).
+     */
+    networkPosture?: "loopback" | "open";
 }
 /**
  * A structural `ChildProcess` subset. The LE widens its internal child
@@ -214,5 +246,7 @@ export interface CommandRunner {
         env?: Readonly<Record<string, string>>;
         /** Child working directory. Absent → inherit the parent's cwd. */
         cwd?: string;
+        /** Exact cwd incarnation held through native process creation. */
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/__tests__/reviewer-credential-preflight.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/apikey-bootstrap.d.ts

@@ -7,6 +7,8 @@ export declare const CLAUDE_SETTINGS_NAME = "settings.json";
 export declare const CODEX_CONFIG_NAME = "config.toml";
 /** Where, inside the sandbox, the bootstrap dir is mounted (NOT the workdir). */
 export declare const SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent";
+/** Where, inside the sandbox, the mutable CLI config dir is mounted. */
+export declare const SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config";
 /** The Codex model-provider id the broker config registers. */
 export declare const CODEX_PROVIDER_ID = "codevibe_broker";
 /** Inputs for materializing the bootstrap. */
@@ -27,12 +29,24 @@ export interface ApiKeyBootstrapInput {
      * Used to bake ABSOLUTE in-sandbox paths into the helper/config.
      */
     sandboxDir?: string;
+    /**
+     * The mount point of the mutable CLI config dir INSIDE the sandbox. It holds
+     * settings/config/runtime files, not the broker token. For A1 this is a rw
+     * mount (e.g. {@link SANDBOX_AGENT_CONFIG_DIR}); for A5 use
+     * `{ configDirEqualsHostDir: true }`.
+     */
+    sandboxConfigDir?: string;
     /**
      * A5 mode — the bootstrap is NOT mounted; the sandbox reads it directly from
      * the host fs, so the in-sandbox path == the created host dir. When true,
      * `sandboxDir` is ignored and the baked paths use the host dir.
      */
     sandboxDirEqualsHostDir?: boolean;
+    /**
+     * A5 mode for the mutable config dir — sandbox path == host path. Defaults to
+     * `sandboxDirEqualsHostDir` when unset.
+     */
+    configDirEqualsHostDir?: boolean;
     /** Override the host root for the bootstrap dir (default os.tmpdir()). */
     hostRoot?: string;
     /**
@@ -54,10 +68,14 @@ export interface ApiKeyBootstrapInput {
  * import('../substrate/types').SubstrateSpec.agentBootstrap} wants.
  */
 export declare class ApiKeyBootstrap {
-    /** Host dir holding the helper + token file + agent config (0700). */
+    /** Host dir holding the helper + token file (0700). */
     readonly hostDir: string;
     /** In-sandbox mount point of {@link hostDir}. */
     readonly sandboxDir: string;
+    /** Host dir holding mutable CLI config/runtime files (0700). */
+    readonly configHostDir: string;
+    /** In-sandbox path of {@link configHostDir}. */
+    readonly configSandboxDir: string;
     /** Host path of the token file (the LE rewrites this on rotation). */
     private readonly tokenFileHostPath;
     private constructor();
@@ -72,6 +90,11 @@ export declare class ApiKeyBootstrap {
         hostDir: string;
         sandboxDir: string;
     };
+    /** The writable CLI config/runtime dir mount/grant. */
+    get configSpec(): {
+        hostDir: string;
+        sandboxDir: string;
+    };
     /**
      * REFRESH the broker token (rotation / on a broker 401). Atomically rewrites
      * the token file (write a temp + rename) so the agent never reads a partial

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/engage-substrate.d.ts

@@ -2,6 +2,7 @@ import { type RotationHandle } from "../credential-broker";
 import type { BrokerDeps } from "../credential-broker/broker";
 import type { ModelGatewayBroker, UpstreamClient, VendorProvider } from "../credential-broker/types";
 import type { ProcessRole } from "../local-executor/types";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 import type { SubstrateHandle } from "../substrate/types";
 import { type FallbackLadderDeps } from "./fallback-ladder";
 /** Map the implementor agent to the broker provider (Claude+Codex only, §6 Q4). */
@@ -21,8 +22,25 @@ export interface EngageSubstrateInput {
     agentKind: "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY";
     /** Canonical host path of the session worktree (the only fs mounted). */
     workdir: string;
+    /** Exact workdir incarnation for task-scoped mutable dispatch. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /** The implementor role marker value (always 'implementor' here). */
     role: ProcessRole;
+    /**
+     * A1d (design §8.1 — the write-capable resolver sandbox lattice). Set by the
+     * LE when the SPAWN demands hard confinement (`SpawnArgs.requireConfined` —
+     * today only the CP-14 WB2 agentic class-2 resolver dispatch). For a
+     * BROKER-LESS reduced-trust agent (GEMINI/ANTIGRAVITY, `providerForAgent` →
+     * null) this flips the null-provider branch from an immediate
+     * `reduced_trust` return to the RESOLVER-CONFINEMENT row: an FS-write-scoped
+     * A5 sandbox (writes confined strictly to `workdir` — the disposable merge
+     * workspace) with OPEN egress + the agent's own file-based auth, no broker.
+     * When the row cannot be established (no A5 tier), `reduced_trust` is
+     * returned and the LE's `requireConfined` guard fail-closes the spawn — the
+     * design's mandatory fallback-to-human-gate. Absent/false → byte-identical
+     * legacy behavior for every existing caller.
+     */
+    requireConfined?: boolean;
     /** Ladder deps (injectable for tests). */
     ladderDeps?: FallbackLadderDeps;
     /** Broker upstream client override (tests inject a stub; default real fetch). */
@@ -74,6 +92,8 @@ export interface SubstrateEngaged {
     reducedTrust: boolean;
     reducedTrustReason?: string;
     substrateHandle: SubstrateHandle;
+    /** In-sandbox writable CLI config dir (settings.json/config.toml). */
+    agentConfigDir: string;
     /** The complete env the agent runs under (markers folded) — for assertions. */
     finalEnv: Readonly<Record<string, string>>;
     /** Rotate the broker token in the bootstrap token file (on a broker 401). */

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/index.d.ts

@@ -6,6 +6,8 @@ export { buildSanitizedBaseEnv, assertNoAmbientCreds, SAFE_ENV_ALLOWLIST, SANDBO
 export type { SanitizedEnvInput } from "./sanitized-env";
 export { ApiKeyBootstrap, SANDBOX_BOOTSTRAP_DIR, HELPER_SCRIPT_NAME, TOKEN_FILE_NAME, CODEX_PROVIDER_ID, } from "./apikey-bootstrap";
 export type { ApiKeyBootstrapInput } from "./apikey-bootstrap";
+export { assertReviewerVendorCredential, reviewerProviderFor, withReviewerCredentialPreflight, ReviewerCredentialMissingError, REVIEWER_CREDENTIAL_MISSING, } from "./reviewer-credential-preflight";
+export type { ReviewerCredentialStore } from "./reviewer-credential-preflight";
 export { scrubLeEnvOrReexec, buildScrubbedLeEnv, findCredShapedKeys, isCredShapedEnvKey, LE_ENV_SCRUBBED_MARKER, } from "./le-env-scrub";
 export type { LeEnvScrubDeps } from "./le-env-scrub";
 export { Cp7AuditWriter, CP7_CANONICAL_FORM_VERSION, GENESIS_PREV_HASH, canonicalJson, canonicalEntryBytes, computeEntryHash, verifyChain, } from "../local-executor/cp7-audit-writer";