@quantiya/codevibe-core 2.0.7 → 2.0.9

package/dist/orchestration-shell/task-progress.d.ts

@@ -1,6 +1,8 @@
 /**
  * One desktop-local progress phase. Discriminated by `phase`. Every variant is
- * counts + labels + paths only — NEVER plaintext (see the module invariant).
+ * counts + labels + paths only — never workspace/diff/reasoning plaintext —
+ * with the module invariant's ONE documented exception: `halt_notice.message`
+ * (controlled operational notice text; see the header + the entry's carve-out).
  */
 export type TaskProgressEvent = ({
     phase: 'shadow_created';
@@ -43,6 +45,7 @@ export type TaskProgressEvent = ({
     phase: 'round_failed';
     round: number;
     reason: string;
+    taskId?: string;
 } | {
     phase: 'continuation_offered';
     round: number;
@@ -57,10 +60,15 @@ export type TaskProgressEvent = ({
 } | {
     phase: 'promoted';
     files: number;
+    taskId?: string;
 } | {
     phase: 'discarding';
 } | {
     phase: 'discarded';
+    taskId?: string;
+} | {
+    phase: 'not_applied';
+    taskId?: string;
 } | {
     phase: 'waiting_user';
 } | {
@@ -71,6 +79,9 @@ export type TaskProgressEvent = ({
     phase: 'agent_advisory';
 } | {
     phase: 'progress_cleared';
+} | {
+    phase: 'halt_notice';
+    message: string;
 }) & {
     epoch?: number;
     tokens?: number;
@@ -109,9 +120,12 @@ export declare function formatTokens(n: number): string;
  */
 export declare function isSpinnerPhase(phase: TaskProgressEvent['phase']): boolean;
 /**
- * Render the user-facing ONE-LINE text for a progress event. Pure (no plaintext
- * — only counts/labels/paths/elapsed). The TUI shows spinner phases as an
- * ephemeral live line and milestone phases as persisted scrollback entries.
+ * Render the user-facing ONE-LINE text for a progress event. Pure. No
+ * workspace/diff/reasoning plaintext — counts/labels/paths/elapsed, plus the
+ * module invariant's ONE documented exception: `halt_notice` renders its
+ * controlled operational `message` verbatim (see the header carve-out). The
+ * TUI shows spinner phases as an ephemeral live line and milestone phases as
+ * persisted scrollback entries.
  */
 export declare function renderProgressLine(event: TaskProgressEvent): string;
 /**

package/dist/orchestration-shell/team-decompose.d.ts

@@ -18,17 +18,17 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
                 access: z.ZodEnum<["write", "read"]>;
             }, "strip", z.ZodTypeAny, {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }, {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }>, "many">;
             test_surfaces: z.ZodArray<z.ZodString, "many">;
             auto_modified_files: z.ZodArray<z.ZodString, "many">;
         }, "strip", z.ZodTypeAny, {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -36,7 +36,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         }, {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -50,7 +50,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -63,7 +63,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -73,13 +73,12 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         implementorAgent?: unknown;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    decompose: true;
     workItems: {
         description: string;
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -88,14 +87,14 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         implementorAgent: "CLAUDE" | "CODEX" | "ANTIGRAVITY";
         isSharedTestOwner: boolean;
     }[];
-}, {
     decompose: true;
+}, {
     workItems: {
         description: string;
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -104,6 +103,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         isSharedTestOwner: boolean;
         implementorAgent?: unknown;
     }[];
+    decompose: true;
 }>, z.ZodObject<{
     decompose: z.ZodLiteral<false>;
     reason: z.ZodString;

package/dist/orchestration-shell/types.d.ts

@@ -136,6 +136,29 @@ export interface RunningTaskState {
     exitCode?: number;
     bypassReason?: 'deterministic_shortcut' | 'planner_outage' | 'planner_degraded_explicit_override';
 }
+/**
+ * P10 E3 r2 — one row of the bare-`/audit` session listing (the
+ * `sessionTasks` value). Deliberately NOT `RunningTaskState`: Agent Teams
+ * child tasks arrive via TEAM_TRACK_ASSIGNED (Stage-2 r1 Codex MED-1) which
+ * carries no pid, so forcing that shape would fabricate fields. Display-only.
+ */
+export interface SessionTaskRecord {
+    taskId: string;
+    /** Implementor agent when known; a team ASSIGNED event may omit it. */
+    agentKind?: string;
+    /** 'single' = TASK_LIFECYCLE-tracked; 'team' = Agent Teams track. */
+    origin: 'single' | 'team';
+    /**
+     * Singles: the lifecycle status — 'running' at dispatch, flipped terminal
+     * by the task-end CLOSER progress events (promoted → 'completed',
+     * discarded → 'cancelled', round_failed → 'failed'; Stage-2 r1 Codex
+     * MED-2 — no production TASK_LIFECYCLE dispatch ever carries a terminal
+     * status). Team rows: the TeamTrackState label verbatim.
+     */
+    status: string;
+    /** Singles: the dispatch stamp. Team rows: first-observed stamp. */
+    startedAt: string;
+}
 /**
  * §5.1 LOCK (lines 547-556). Single reviewer subprocess identity +
  * verdict. `reviewerKind` is hand-listed per CP-1 — CP-3 Stage A
@@ -356,6 +379,7 @@ export type ConversationEntry = {
         serverDecision: string | null;
     };
     reviewSummary?: ReviewSummaryPanelModel;
+    queuedReviewSummaries?: Readonly<Record<string, ReviewSummaryPanelModel>>;
 } | {
     kind: 'gate-panel';
     id: string;
@@ -544,13 +568,15 @@ export interface TeamState {
  * the user is in control (a gate prompt is shown → `waiting_user` clears it).
  * Milestones (diff captured, verdicts received, promoted, …) are NOT stored here
  * — they are appended to `conversation` as persisted scrollback entries. This is
- * desktop-LOCAL only: counts/labels/elapsed, never plaintext (see
+ * desktop-LOCAL only: counts/labels/elapsed, never plaintext — `halt_notice`,
+ * the union's one free-text exception, can never open or refresh this live
+ * line (reducer phase-family guard); it is scrollback-only (see
  * `task-progress.ts`).
  */
 export interface LiveProgress {
     /** The phase of the in-flight spinner line. */
     phase: TaskProgressEvent['phase'];
-    /** The BOUNDED live label (counts/labels/paths only — no plaintext, no embedded timer). */
+    /** The BOUNDED live label (counts/labels/paths only — no plaintext; `halt_notice` never reaches here; no embedded timer). */
     text: string;
     /** When this line was last refreshed. Retained; currently unused (no component reads it). */
     updatedAt: string;
@@ -582,6 +608,11 @@ export interface OrchestrationState {
     plannerHealth: PlannerHealthState;
     conversation: ConversationEntry[];
     runningTasks: Map<string, RunningTaskState>;
+    sessionTasks: Map<string, SessionTaskRecord>;
+    lastReviewerProgress: {
+        text: string;
+        at: string;
+    } | null;
     queuedTasks: QueuedTask[];
     activeReviewerSeats: Map<string, ReviewerSeatState>;
     currentGate: GateState | null;
@@ -637,6 +668,57 @@ export interface OrchestrationState {
      * keyboard focus. Non-team / Companion / CP-1.a sessions never open it.
      */
     reviewerWizard: ReviewerWizardState | null;
+    /**
+     * `[ADDITIVE WIDENING — O1 C1 (#652)]` per
+     * PHASE-O1-C1-SAFETY-OBSERVABILITY-DESIGN.md §3.1 item 1: the shell used to
+     * render and DISCARD the `/audit` browser model; `/flag <entry-id>` needs
+     * session-scoped retention of the LAST-rendered listing's
+     * `entryId → {seqNum, kind, flaggable}` mapping to build the plaintext
+     * target locator without re-querying. `null` until the first successful
+     * `/audit <task-id>` render. Desktop-local only; row COORDINATES + closed
+     * enum labels only — never decrypted payload content.
+     */
+    auditFlagIndex: AuditFlagIndex | null;
+}
+/**
+ * One retained `/audit` listing row, keyed by its audit `entry_id` in
+ * {@link AuditFlagIndex.entries}. Shape-only: row coordinates + the plaintext
+ * wire kind + the precomputed flag-eligibility bit (derived from the decrypted
+ * `gate_resolved` outcome at render time — the decrypted payload itself is
+ * NOT retained).
+ */
+export interface AuditFlagEntryRecord {
+    /**
+     * The flagged row's audit-table sort key — the zero-padded 16-digit
+     * `seqNum` string exactly as surfaced by `queryAudit`'s additive
+     * `AuditEntryWireRow.seqNum` projection (core-rs `types.rs`), or `null`
+     * when the row predates the projection (stale backend) — `/flag` then
+     * fails closed with an actionable message.
+     */
+    seqNum: string | null;
+    /** Plaintext snake_case wire kind (e.g. `gate_resolved`). */
+    kind: string;
+    /**
+     * True iff the entry is a decrypted `gate_resolved` row whose outcome is
+     * the quorum's approve consensus (`consensus_approve` / `proceed`) — the
+     * client-side defense-in-depth subset check of design §3.1 item 1 (the
+     * server independently enforces the same subset, §3.1 item 4).
+     */
+    flaggable: boolean;
+}
+/**
+ * The session-scoped retained `/audit` mapping (design §3.1 item 1). Replaced
+ * wholesale on each successful `/audit <task-id>` render (last render wins);
+ * `flagged` carries forward across renders so "already flagged" survives
+ * re-listing. Lives in {@link OrchestrationState.auditFlagIndex}.
+ */
+export interface AuditFlagIndex {
+    /** The task whose listing was rendered — becomes `flaggedTaskId`. */
+    taskId: string;
+    /** `entryId → record` for every entry in the last-rendered listing. */
+    entries: Map<string, AuditFlagEntryRecord>;
+    /** Entry ids flagged this session (dedup no-op render on repeat `/flag`). */
+    flagged: Set<string>;
 }
 /**
  * Snapshot threaded into the interactive `/reviewer-setup` wizard when it
@@ -823,6 +905,12 @@ export type OrchestrationAction = {
     wizard: ReviewerWizardState;
 } | {
     type: 'REVIEWER_WIZARD_CLOSE';
+} | {
+    type: 'AUDIT_FLAG_INDEX_RETAINED';
+    index: AuditFlagIndex;
+} | {
+    type: 'AUDIT_FLAG_RECORDED';
+    entryId: string;
 } | {
     type: 'EXIT';
 };

package/dist/orchestration-shell/workspace-shutdown.d.ts

@@ -0,0 +1,47 @@
+export interface WorkspaceShutdownOperations {
+    flushPlannerCache?: () => Promise<void>;
+    clearPlannerSession?: () => void;
+    disposeQuorumWorkspaces?: () => Promise<void>;
+    drainLocalWorkspaces?: () => Promise<void>;
+    /** Settle already-admitted shell turns after their agent processes drain. */
+    drainShellSubmissions?: () => Promise<void>;
+    /** Flush the settled turns' local and hosted canonical context publications. */
+    finalizeContextItemPublications?: () => Promise<void>;
+    /** Audit/retry exact advisory-image authority after every owning turn settles. */
+    disposeAdvisoryAttachmentAuthority?: () => Promise<void>;
+    disposeLocalDurableSessionResources?: () => Promise<void>;
+    /** Final hosted terminal mutation; no local or hosted turn publication follows. */
+    retireHostedSession?: () => Promise<void>;
+    onPlannerFlushFailure?: (error: Error) => void;
+    onWorkspaceFailure?: (error: Error) => void;
+}
+export interface StartedWorkspaceShutdown {
+    /**
+     * Every teardown phase, including best-effort planner flush and hosted
+     * retirement. This is the operation governed by the shell's normal/signal
+     * responsiveness deadline.
+     */
+    completion: Promise<void>;
+    /**
+     * The local resource-retirement boundary. A normal process exit must await
+     * this even after the broader teardown deadline expires, otherwise a large
+     * authenticated snapshot deletion can be killed halfway through and leak its
+     * private workspace.
+     */
+    resourceRetirement: Promise<void>;
+}
+/**
+ * Start every independent shutdown fence before awaiting any one owner.
+ *
+ * The LocalExecutor's shared durable group retirement is deliberately a final
+ * phase: Quorum may still have an already-admitted terminal publisher that is
+ * allowed to finish while its ingress is closed. Only after both Quorum and
+ * LocalExecutor drains settle can the durable store be enumerated exactly once
+ * without a late publisher recreating a group behind the cleanup pass.
+ */
+export declare function startWorkspaceShutdownOperations(operations: WorkspaceShutdownOperations): StartedWorkspaceShutdown;
+/**
+ * Compatibility surface for callers that need the complete shutdown rather
+ * than its separately-observable local resource boundary.
+ */
+export declare function runWorkspaceShutdownOperations(operations: WorkspaceShutdownOperations): Promise<void>;

package/dist/reviewer/output-parser.d.ts

@@ -19,7 +19,26 @@ export interface ParsedVerdict {
      * via `revise_missing_changes` / `suggested_changes_require_revise`).
      */
     suggested_changes: string[];
+    /**
+     * Ordered non-blocking observations from the explicit
+     * `RESIDUAL OBSERVATIONS:` section. These never count as suggested changes.
+     */
+    residual_observations: string[];
+}
+export interface ResidualObservationSplit {
+    /** Reviewer output with the explicit residual section removed. */
+    reviewText: string;
+    /** Ordered, non-empty residual observations. */
+    residualObservations: string[];
 }
+/**
+ * Split the optional P15 residual-observation section from reviewer prose.
+ *
+ * The heading must occupy its own line. Bullets are preferred, but plain
+ * non-empty lines are retained as observations so harmless reviewer format
+ * drift cannot turn a non-blocking note into a revision request.
+ */
+export declare function splitResidualObservations(raw: string): ResidualObservationSplit;
 /**
  * Why a reviewer's reply failed the locked-format check. Discriminated
  * union; the subprocess layer maps any of these into `ReviewerError` with

package/dist/reviewer/providers/codex.d.ts

@@ -3,6 +3,7 @@ import { type SubprocessOutcome } from '../subprocess.js';
 import type { ReviewerVerdict } from '../types.js';
 import { type VerdictClassifier } from '../verdict-classifier.js';
 import type { BuiltCommand } from './claude.js';
+import { type InvocationUsageSnapshot } from '../token-usage.js';
 /** Construction options. */
 export interface CodexReviewerProviderOptions {
     /** Override the `codex` executable path. Production callers pass nothing
@@ -58,15 +59,16 @@ export declare function buildCommand(executable: string, spec: ReviewerSpec, las
 export declare function buildVerdict(spec: ReviewerSpec, gateId: string, outcome: SubprocessOutcome, lastMessage: string, classifyVerdict?: VerdictClassifier): Promise<ReviewerVerdict>;
 /**
  * Sum `usage.input_tokens + usage.output_tokens` across every
- * `turn.completed` JSONL event in `stdout`. Returns `null` when no
- * `turn.completed` event reported any token count, so dashboards can
- * distinguish "no data" from a real zero.
+ * `turn.completed` JSONL event in `stdout`. Returns `null` when usage is absent,
+ * partial, or invalid so legacy call sites do not turn unknown values into a
+ * false complete total.
  *
  * Lenient: malformed JSONL lines are silently skipped (Codex's stream is
  * designed to be append-only, so partial flushes during timeout could
  * leave a final truncated line).
  */
 export declare function sumCodexTokens(stdout: string): number | null;
+export declare function extractCodexUsageSnapshot(stdout: string, elapsedMs?: number | null): InvocationUsageSnapshot;
 /**
  * Generate a unique-per-spawn path for `--output-last-message`. Lives in
  * the OS temp dir; we own its lifecycle (create on codex's side, read +

package/dist/reviewer/token-usage.d.ts

@@ -1,14 +1,39 @@
 /**
- * [P2-0] Clamp an UNTYPED token field (from agent CLI JSON) to a finite,
- * non-negative INTEGER. Token fields come from untyped agent JSON — a string /
- * object / `NaN` / negative / fractional value would poison the per-task
- * accumulator (→ `NaN` render, or a reopened window showing a LOWER total),
- * violating the "token count is a number" invariant. Every numeric ingress
- * (`unwrapClaudeJson` usage reads, Codex `sumCodexTokens` per-event sum, the
- * QuorumLoop `addTaskTokens`) gates on this, so a malformed field contributes 0,
- * never corrupts the accumulator.
+ * [P2-0] Clamp an UNTYPED token field (from agent CLI JSON) to the same finite,
+ * bounded INTEGER contract the runtime persists. Token fields come from untyped
+ * agent JSON — a string / object / `NaN` / negative / fractional / over-contract
+ * value would poison the per-task accumulator or fabricate usage. Malformed
+ * fields contribute 0 to legacy additive counters and canonical snapshots mark
+ * reported invalid fields as `usage_invalid`.
  */
 export declare function finiteToken(n: unknown): number;
+export type InvocationUsageAvailability = 'complete' | 'partial' | 'unavailable';
+export interface InvocationUsageSnapshot {
+    /** Prompt/input tokens. `cachedInputTokens` is a subset, not an addend. */
+    inputTokens: number | null;
+    /** Output/completion tokens. */
+    outputTokens: number | null;
+    /** Cached input token subset when the provider exposes it. */
+    cachedInputTokens: number | null;
+    /** Backward-compatible aggregate: input + output, never cache-added. */
+    totalTokens: number | null;
+    /** End-to-end invocation elapsed time when known. */
+    elapsedMs: number | null;
+    availability: InvocationUsageAvailability;
+    /** Closed reason label when availability is unavailable/partial. */
+    unavailableReason: string | null;
+}
+export declare function tokenFieldAvailable(value: unknown): value is number;
+export declare function usageSnapshotFromParts(args: {
+    inputTokens: number;
+    outputTokens: number;
+    cachedInputTokens?: number;
+    elapsedMs?: number | null;
+    inputTokensAvailable?: boolean;
+    outputTokensAvailable?: boolean;
+    cachedInputTokensAvailable?: boolean;
+}): InvocationUsageSnapshot;
+export declare function unavailableUsageSnapshot(reason: string, elapsedMs?: number | null): InvocationUsageSnapshot;
 /**
  * Locate the FIRST balanced top-level `{...}` in `stdout` that parses to an object
  * with `type === 'result'` — Claude may emit non-JSON warning / MCP lines before
@@ -31,12 +56,16 @@ export declare function firstResultEnvelope(stdout: string): Record<string, unkn
  *   • `is_error === true` OR `result` not a non-empty string → `{ text:'', tokens:
  *     undefined }`. The CALLER treats an empty/failed result as an agent FAILURE
  *     (reviewer ESCALATE / resolver human-gate — same as today), NOT a silent pass.
- *   • else → `{ text: result, tokens: (finiteToken(usage.input_tokens) +
- *     finiteToken(usage.output_tokens)) || undefined }`. `finiteToken` clamps
- *     absent/malformed usage to 0 (no `TypeError`, no `NaN`); cache tokens are
- *     excluded in v1 (input+output only — see design "Known v1 limitation").
+ *   • else → `{ text: result, tokens: totalTokens || undefined }`. `finiteToken`
+ *     clamps absent/malformed usage to 0 (no `TypeError`, no `NaN`). Claude's
+ *     documented input total is uncached input plus cache-write/cache-read
+ *     buckets, while `cachedInputTokens` remains the cached subset. The older
+ *     `cached_input_tokens` alias is intentionally ignored unless backed by
+ *     documented Claude result-envelope evidence.
  */
+export declare function extractClaudeUsageSnapshot(stdout: string, elapsedMs?: number | null): InvocationUsageSnapshot;
 export declare function unwrapClaudeJson(stdout: string): {
     text: string;
     tokens?: number;
+    usage: InvocationUsageSnapshot;
 };

package/dist/reviewer/types.d.ts

@@ -1,3 +1,4 @@
+import type { InvocationUsageSnapshot } from './token-usage.js';
 /**
  * Agent kinds the reviewer subprocess layer can spawn.
  *
@@ -90,6 +91,9 @@ export interface ReviewerVerdict {
     /** Ordered list of specific changes. **Required** when `verdict === 'REVISE'`;
      *  empty for other verdicts (enforced by the output parser). */
     suggested_changes: string[];
+    /** Optional non-blocking risks or recommendations. These are displayed in
+     *  the terminal summary but never affect consensus or trigger revision. */
+    residual_observations: string[];
     /** Model identifier used (for cost attribution). */
     model_used: string | null;
     /** Tokens consumed by this reviewer. */
@@ -98,4 +102,6 @@ export interface ReviewerVerdict {
     latency_ms: number | null;
     /** ISO 8601 UTC timestamp string when the reviewer returned the verdict. */
     submitted_at: string;
+    /** Canonical input/output/cache/elapsed usage snapshot. Additive post-launch. */
+    usage?: InvocationUsageSnapshot;
 }

package/dist/reviewer/verdict-classifier.d.ts

@@ -59,4 +59,5 @@ export declare function resolveClassifiedVerdictFields(classification: VerdictCl
     verdict: VerdictKind;
     reasoning: string;
     suggested_changes: string[];
+    residual_observations: string[];
 };

package/dist/session/session-rekey.d.ts

@@ -27,9 +27,10 @@ export interface RekeyOptions {
  * bound to its current public key and nothing is forced.
  *
  * @param sessionId  The session to re-key.
- * @param sessionKey The plaintext session key (base64). The caller must
- *                   already hold this — typically from
- *                   keychainManager.getCachedSessionKey(sessionId).
+ * @param sessionKey The caller's current plaintext session key (base64).
+ *                   This is only an admission hint: after fetching the
+ *                   authoritative row, the function re-derives/loads the key
+ *                   for that row's exact generation before wrapping.
  * @param appSyncClient Authenticated AppSyncClient.
  * @param options Optional behavior knobs. See RekeyOptions.
  * @returns The number of new grants that succeeded.

package/dist/substrate/__tests__/command-runner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/substrate/command-runner.d.ts

@@ -1,4 +1,5 @@
 import type { CommandResult, CommandRunner, RunnerProc } from './types';
+import type { WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 /**
  * The production `CommandRunner` — runs `docker` / `sandbox-exec` via
  * `node:child_process`. No shell is used (argv is passed directly to
@@ -15,5 +16,6 @@ export declare class ChildProcessCommandRunner implements CommandRunner {
         signal?: AbortSignal;
         env?: Readonly<Record<string, string>>;
         cwd?: string;
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/dist/substrate/docker.d.ts

@@ -1,5 +1,6 @@
 import { type ForwarderFactory } from './forwarder';
 import type { CommandRunner, EgressObservationHook, Substrate, SubstrateHandle, SubstrateSpec } from './types';
+import { type WorkspaceRootAuthority, type WorkspaceRootLease } from '../local-executor/workspace-authority';
 /** Where, inside the container, the worktree is mounted (the agent's cwd/home). */
 export declare const CONTAINER_WORKDIR = "/workspace";
 /** Injectable deps — default-wired to the real runtime; stubbed in unit tests. */
@@ -14,12 +15,13 @@ export interface DockerSubstrateDeps {
     image?: string;
     /**
      * Override the host root for the per-session scratch dir (default:
-     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`),
-     * the relay script, and the scrubbed git-proxy (in `gitproxy/`) — no secrets.
-     * The git-proxy now lives UNDER this dir (MED fix), so the one
-     * teardown/rollback rm removes it.
+     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`)
+     * and the relay script — no secrets or repository metadata.
+     * The one teardown/rollback removal retires the complete session authority.
      */
     sessionRoot?: string;
+    /** Original-handle bind source (native Linux by default; injectable for seam tests). */
+    acquireWorkdirLease?: (authority: WorkspaceRootAuthority) => Promise<WorkspaceRootLease>;
 }
 /** The deterministic per-session container name. */
 export declare function containerName(id: string): string;
@@ -44,7 +46,6 @@ export declare function buildContainerEntrypoint(sanitizedEnv: Readonly<Record<s
  * surface the conformance test pins:
  *   - `--network none`         → STRUCTURAL default-deny (only `lo`, no egress).
  *   - `-v <workdir>:/workspace` → ONLY the worktree mounted (rw).
- *   - `-v <gitProxy>:/workspace/.git:ro` → scrubbed `.git`, read-only (if any).
  *   - `-v <relayScript>:/codevibe/relay.js:ro` → the in-container relay (ro).
  *   - `-v <udsDir>:/codevibe/broker:rw`  → the bind-mounted broker UDS dir (rw,
  *     so the container's `connect()` works; the dir holds only the socket).
@@ -63,7 +64,6 @@ export declare function buildRunArgv(args: {
     id: string;
     image: string;
     workdir: string;
-    gitProxyPath: string | null;
     relayScriptPath: string;
     udsDir: string;
     sanitizedEnv: Readonly<Record<string, string>>;
@@ -101,40 +101,15 @@ export declare class DockerSubstrate implements Substrate {
     private readonly onEgressDenied;
     private readonly image;
     private readonly sessionRoot;
+    private readonly acquireWorkdirLease;
     constructor(deps?: DockerSubstrateDeps);
     launch(spec: SubstrateSpec): Promise<SubstrateHandle>;
     private rollback;
-    /**
-     * r5 HIGH-2 (Codex — NULL-vs-THROW gap). The proxy build produced no usable
-     * proxy (it returned `null` OR threw). Decide the safe outcome by whether the
-     * workdir actually HAS a `.git`:
-     *
-     *   - NO `<workdir>/.git`            → return `null` (a non-git workdir; the
-     *                                      `docker run` mounts only the worktree,
-     *                                      git reports "not a repository" — no
-     *                                      credential surface either way).
-     *   - `<workdir>/.git` EXISTS        → write an EMPTY SCRUBBED `.git` overlay
-     *                                      (a dir with ONLY a stripped synthetic
-     *                                      `config` — NO remotes/creds/hooks) and
-     *                                      return its path, so the `:ro` bind mount
-     *                                      SHADOWS the real `.git`. Degraded git
-     *                                      reads, but the credential surface is
-     *                                      fail-closed.
-     *   - overlay write ALSO fails       → roll back + throw (NEVER mount the
-     *                                      worktree with a live `.git`).
-     *
-     * Used for BOTH the null-return and the throw path so a workdir with a real
-     * but unresolvable `.git` can never reach the agent un-shadowed. `fsp.stat`
-     * (NOT `lstat`) follows a `.git` that is a symlink/dir/file alike — any of
-     * those "exists" cases must be shadowed.
-     */
-    private ensureGitOverlayOrFailClosed;
     private assertDockerAvailable;
 }
 export declare const __testing: {
     DEFAULT_IMAGE: string;
     CONTAINER_WORKDIR: string;
-    CONTAINER_GIT: string;
     CONTAINER_RELAY_PATH: string;
     CONTAINER_BROKER_DIR: string;
     RELAY_PORT: number;

package/dist/substrate/index.d.ts

@@ -8,5 +8,4 @@ export { SubstrateUnavailableError, SubstrateLaunchError } from "./errors";
 export { ChildProcessCommandRunner } from "./command-runner";
 export { HostEgressForwarder, defaultForwarderFactory } from "./forwarder";
 export type { ForwarderSpec, ForwarderFactory } from "./forwarder";
-export { buildScrubbedGitProxy, resolveGitCommonDir } from "./git-proxy";
 export { IN_CONTAINER_RELAY_SOURCE, CONTAINER_RELAY_PATH, CONTAINER_BROKER_DIR, CONTAINER_BROKER_SOCK, BROKER_SOCK_NAME, RELAY_PORT, } from "./relay-script";

package/dist/substrate/sandbox-exec.d.ts

@@ -68,19 +68,6 @@ export declare function buildSeatbeltProfile(workdir: string, execPath?: string,
  * invariant that host secrets stay unreadable still holds).
  */
 extraReadDirs?: readonly string[], 
-/**
- * Stage-2 HIGH (Codex — the `.git` credential leak). The host path of the
- * SCRUBBED `.git` proxy (built by `git-proxy.ts`, same as A1's mount). When
- * provided, the profile (a) GRANTS read on it (read-only — the agent runs
- * `git` against it via `GIT_DIR`) and (b) DENIES read+write of the REAL
- * `<workdir>/.git`, so the agent CANNOT read the host repo's credential
- * helpers / tokenized remotes / hooks / reflogs directly. Without this the A5
- * agent runs on the host fs and the `(allow file-read* (subpath "<wd>"))`
- * grant would expose the real `.git`. Null/absent for a non-git workdir (the
- * `.git` deny is still emitted — denying a non-existent path is harmless and
- * keeps the profile shape uniform).
- */
-gitProxyDir?: string | null, 
 /**
  * r5 HIGH-1 (Codex) — the home dir to anchor the file-keychain (`~/.codevibe`)
  * DENY at. Default `os.homedir()`; injectable for deterministic tests. The