@quantiya/codevibe-core 2.0.8 → 2.0.10

package/dist/orchestration-shell/context-items.d.ts

@@ -81,6 +81,8 @@ export interface ContextItem {
     prev_hash: string | null;
     /** Typed payload per kind. */
     body: unknown;
+    /** Non-rendered counters/locator metadata; excluded from semantic content ids. */
+    telemetry?: unknown;
     /** ISO timestamp the item was authored (corpus-ready, §4.1). */
     authored_at: string;
 }
@@ -91,6 +93,7 @@ export interface ContextItemDraft {
     sensitivity: ContextItemSensitivity;
     visible_to: ContextItemProjectionRole[];
     body: unknown;
+    telemetry?: unknown;
     task_id?: string;
     track_id?: string;
     refs?: string[];

package/dist/orchestration-shell/direct-file-delete.d.ts

@@ -0,0 +1,22 @@
+export interface DirectFileDeleteRequest {
+    paths: string[];
+}
+export interface DirectFileDeleteResult {
+    deleted: string[];
+}
+/**
+ * Recognize only a closed, deterministic delete request. Anything ambiguous
+ * remains on the ordinary planner/implementor path.
+ *
+ * Supported examples:
+ *   Delete only a.txt.
+ *   Please delete only `a file.txt` and `b.txt`.
+ *   Delete only a.txt. Do not create, modify, or delete any other file.
+ */
+export declare function parseDirectFileDeleteRequest(text: string): DirectFileDeleteRequest | null;
+/**
+ * Delete only the explicitly named regular files. All targets are validated
+ * before the first mutation; each unlink is bound to the captured parent and
+ * file incarnation and directory-fsynced by the anchored helper.
+ */
+export declare function executeDirectFileDelete(cwd: string, request: DirectFileDeleteRequest): Promise<DirectFileDeleteResult>;

package/dist/orchestration-shell/flag-command.d.ts

@@ -0,0 +1,81 @@
+import type { AppSyncClient } from '../appsync';
+import { type AuditBrowserModel } from './audit-browser';
+import type { AuditFlagIndex } from './types';
+/**
+ * Build the session-scoped flag index from a just-rendered `/audit` browser
+ * model. Called at the `/audit <task-id>` dispatch site on a successful
+ * render; the entrypoint retains the result via `AUDIT_FLAG_INDEX_RETAINED`
+ * (last render wins — the reducer carries the `flagged` set forward).
+ * Shape-only: coordinates + wire kind + the precomputed flaggable bit; the
+ * decrypted payload never leaves the render.
+ */
+export declare function buildAuditFlagIndex(taskId: string, model: AuditBrowserModel): AuditFlagIndex;
+/**
+ * The minimal AppSync surface `/flag` needs — the existing
+ * `recordExecutionEvent` Class-A method (D4: the full plumbing below it
+ * already exists). Narrowed so tests inject a stub without the full client.
+ */
+export type FlagAppSyncClient = Pick<AppSyncClient, 'recordExecutionEvent'>;
+export interface RunFlagCommandDeps {
+    /** The authenticated AppSync client. */
+    appsyncClient: FlagAppSyncClient;
+    /** The retained last-rendered `/audit` index (null → never rendered). */
+    index: AuditFlagIndex | null;
+    /** The `/flag <entry-id>` argument. */
+    entryId: string;
+    /** Optional free-text note (encrypted into the flag payload; never logged). */
+    note?: string;
+    /** The shell session (locator/emit scoping + session-key lookup). */
+    sessionId: string;
+    /** Test seam — defaults to `keychainManager.getSessionKey(sessionId)`. */
+    getSessionKeyFn?: (sessionId: string) => Promise<string | null>;
+}
+/**
+ * The outcome of a `/flag` run. Every arm carries a ready-to-render `line`;
+ * `runFlagCommand` NEVER throws (mirrors `runAuditBrowser`).
+ */
+export type RunFlagCommandResult = {
+    kind: 'no_index';
+    line: string;
+} | {
+    kind: 'unknown_entry';
+    line: string;
+} | {
+    kind: 'not_flaggable';
+    line: string;
+} | {
+    kind: 'missing_seq';
+    line: string;
+} | {
+    kind: 'already_flagged';
+    line: string;
+} | {
+    kind: 'no_session_key';
+    line: string;
+} | {
+    kind: 'flagged';
+    entryId: string;
+    line: string;
+} | {
+    kind: 'server_rejected';
+    line: string;
+    reason: string;
+} | {
+    kind: 'error';
+    line: string;
+    reason: string;
+};
+/** `/flag` before any `/audit <task-id>` render — nothing to resolve against. */
+export declare const FLAG_NO_INDEX_LINE: string;
+/**
+ * Run `/flag <entry-id>`: retained-index resolve → client approve-subset
+ * check → locator + dedup-key construction → Class-A `FLAG_BAD_APPROVAL`
+ * emit with locator forwarding. Returns a discriminated result the shell
+ * renders; the CALLER dispatches `AUDIT_FLAG_RECORDED` on the `flagged` arm
+ * (the runner stays store-free, like `runAuditBrowser`).
+ */
+export declare function runFlagCommand(deps: RunFlagCommandDeps): Promise<RunFlagCommandResult>;
+/**
+ * Render a `RunFlagCommandResult` as the inline `/flag` shell output line.
+ */
+export declare function renderFlagResultText(result: RunFlagCommandResult): string;

package/dist/orchestration-shell/gate-prompts.d.ts

@@ -461,11 +461,32 @@ export interface ReviewSummaryTerminalModel {
     };
     readonly tokenUsage: {
         readonly knownTotal: number | null;
+        readonly knownInput: number | null;
+        readonly knownOutput: number | null;
+        readonly knownCachedInput: number | null;
         readonly availability: string;
         readonly unavailableRoles: ReadonlyArray<string>;
+        readonly invocations: ReadonlyArray<ReviewSummaryTokenInvocationModel>;
     };
     readonly residualRisks: ReadonlyArray<string>;
 }
+export interface ReviewSummaryTokenInvocationModel {
+    readonly role: string;
+    readonly agent: string;
+    readonly taskId: string | null;
+    readonly trackIndex: number | null;
+    readonly round: number | null;
+    readonly gateId: string | null;
+    readonly seatId: number | null;
+    readonly reviewerRole: string | null;
+    readonly inputTokens: number | null;
+    readonly outputTokens: number | null;
+    readonly cachedInputTokens: number | null;
+    readonly totalTokens: number | null;
+    readonly elapsedMs: number | null;
+    readonly availability: string;
+    readonly unavailableReason: string | null;
+}
 /**
  * The fully-extracted, render-ready per-round review summary model. PURE
  * function of the decrypted summary. `null`-attached (entry has no
@@ -518,8 +539,28 @@ export interface DecryptedReviewSummaryInput {
     };
     readonly tokenUsage?: {
         readonly knownTotal?: number;
+        readonly knownInput?: number;
+        readonly knownOutput?: number;
+        readonly knownCachedInput?: number;
         readonly availability?: string;
         readonly unavailableRoles?: ReadonlyArray<string>;
+        readonly invocations?: ReadonlyArray<{
+            readonly role?: string;
+            readonly agent?: string;
+            readonly taskId?: string;
+            readonly trackIndex?: number;
+            readonly round?: number;
+            readonly gateId?: string;
+            readonly seatId?: number;
+            readonly reviewerRole?: string;
+            readonly inputTokens?: number;
+            readonly outputTokens?: number;
+            readonly cachedInputTokens?: number;
+            readonly totalTokens?: number;
+            readonly elapsedMs?: number;
+            readonly availability?: string;
+            readonly unavailableReason?: string;
+        }>;
     };
     readonly residualRisks?: ReadonlyArray<string>;
     readonly rounds?: ReadonlyArray<{

package/dist/orchestration-shell/index.d.ts

@@ -4,13 +4,14 @@ import { Session } from '../types';
 import { OrchestrationStore } from './store';
 import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
-import { type GroupDecisionSubmitDeps } from './gate-decision-submit';
+import { type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from './gate-decision-submit';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
 import { loadReviewerWizardData } from './slash-routes/reviewers';
 import { createShellEventEmitter } from './emit-shell-event';
 import { type AgentMentionIntent, type CommandIntentTarget } from './command-intent';
 import { type BrainstormPanelActiveAgent } from './brainstorm-quorum';
 import { type RunAuditBrowserResult } from './audit-runner';
+import { type RunFlagCommandResult } from './flag-command';
 import { Tier } from './types';
 import type { ConversationEntry, PendingClarification } from './types';
 import { type GatePromptEnvelope, type DecryptedReviewSummaryInput } from './gate-prompts';
@@ -23,6 +24,7 @@ import type { LocalGemmaAdvisoryRunner } from '../planner/local-advisory';
 import type { LocalExecutor } from '../local-executor';
 import type { WorkItemInput, DisjointnessRejection, RevertManifestStore } from '../local-executor';
 import type { QuorumLoop } from './quorum-loop';
+import { type InvocationUsageSnapshot } from '../reviewer/token-usage';
 import { ensureFreshContextStore } from './context-store';
 import type { EnsureFreshResult } from './context-store';
 import { contextItemOccurrence, type ContextDurabilityReceipt } from './context-items';
@@ -231,6 +233,7 @@ export { compactSessionContext, maybeFireCompactionSafetyValve, rehydrateSession
 export { routeSlashCommand, applySlashOutput, type SlashOutput, type ShellAction, } from './slash-router';
 export { buildAuditBrowserModel, routeAuditEntry, auditKindLabel, auditKindCopy, renderAuditBrowserText, renderAuditEntryText, ENTRY_DETAILS_UNAVAILABLE, NO_AUDIT_ENTRIES, AUDIT_LOG_TOO_LARGE, AUDIT_LOG_TITLE, AUDIT_BROWSER_MAX_HEADLINE, WIRE_PUBLIC_PLAINTEXT_KINDS, type AuditBrowserModel, type AuditEntryModel, type AuditReviewerVerdictModel, type AuditTaskAuthorizedModel, type DecryptContentFn, } from './audit-browser';
 export { runAuditBrowser, renderAuditResultText, AUDIT_BROWSER_UPGRADE_HINT, type RunAuditBrowserResult, type RunAuditBrowserDeps, } from './audit-runner';
+export { buildAuditFlagIndex, runFlagCommand, renderFlagResultText, FLAG_NO_INDEX_LINE, type RunFlagCommandResult, type RunFlagCommandDeps, type FlagAppSyncClient, } from './flag-command';
 export { AuditLogPanel } from './components/AuditLogPanel';
 export { reducer } from './reducer';
 export { createOrchestrationStore, type OrchestrationStore } from './store';
@@ -385,7 +388,18 @@ export declare function handleSubscribedEvent(event: Event, store: Orchestration
  * and DROPS (never crashes the shell, never submits ciphertext). Async — the sync
  * subscription callback fires-and-forgets via `void`; every throw is caught here.
  */
-export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>): Promise<void>;
+export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>): Promise<boolean>;
+/**
+ * Route a mobile composer reply through the desktop's canonical gate state
+ * machine. Mobile always transports the text as an encrypted `USER_PROMPT`;
+ * only the desktop that owns the live prompt interprets it as a numbered
+ * option, a required note, `/cancel`, or ordinary free text.
+ *
+ * Returns `true` only when the active gate consumed the input. A non-numeric
+ * line against an awaiting-number gate remains an ordinary prompt and returns
+ * `false`, matching the desktop TTY behavior.
+ */
+export declare function routeMobileGatePromptInput(deps: GateDecisionSubmitDeps, text: string): Promise<boolean>;
 /**
  * Build the single `(event) => void` callback the AppSync events subscription
  * invokes. Routes each delivered event to exactly ONE handler:
@@ -790,6 +804,14 @@ export interface HandleShellUserInputDeps extends StructuralSummaryRunDeps {
      * rewrite without live fetch / decrypt.
      */
     runAuditBrowserFn?: (taskId: string) => Promise<RunAuditBrowserResult>;
+    /**
+     * O1 C1 (#652) — Test seam for the async `/flag <entry-id>` dispatch.
+     * Defaults to `runFlagCommand` over `args.appsyncClient` + the retained
+     * `store` flag index + `args.session.sessionId`. Tests inject a stub to
+     * drive the PENDING-marker rewrite (+ the `AUDIT_FLAG_RECORDED` dispatch
+     * on the `flagged` arm) without live emit / keychain I/O.
+     */
+    runFlagCommandFn?: (entryId: string, note?: string) => Promise<RunFlagCommandResult>;
     /**
      * CP-4 §4.2 — Test seam for the pre-classify context-store refresh. Defaults
      * to the real `ensureFreshContextStore` (probe → recompute-if-stale → persist
@@ -843,10 +865,12 @@ export interface HandleShellUserInputDeps extends StructuralSummaryRunDeps {
  * could overlap and interleave the clarification state machine
  * (USER_INPUT bookkeeping + classify + PLANNER_DECISION), corrupting it.
  *
- * Slash commands (`text.startsWith('/')`, matching `handleShellUserInput`'s own
- * routing) bypass the queue: they're fast, never trigger a planner classify,
- * never touch clarification state, and include `/quit` — so they must stay
- * responsive instead of waiting behind a slow/hung planner turn.
+ * Slash commands (`text.trimStart().startsWith('/')`, matching
+ * `handleShellUserInput`'s own routing) bypass the queue: they're fast, never
+ * trigger a planner classify, never touch clarification state, and include
+ * `/quit` — so they must stay responsive instead of waiting behind a slow/hung
+ * planner turn. Leading paste whitespace is presentation noise, not permission
+ * to reinterpret an explicit command as natural language.
  *
  * The returned function preserves the caller-visible contract: it returns the
  * promise for THIS submission's processing (so an awaiting caller still gets the
@@ -936,6 +960,7 @@ export interface BrainstormTurnOwnership {
             authorAgent: BrainstormPanelActiveAgent;
             status: 'completed' | 'quota_walled' | 'failed';
             boundedBody: string;
+            usage: InvocationUsageSnapshot;
         }>;
         prompt: {
             kind: 'legacy_joined';

package/dist/orchestration-shell/quorum-loop.d.ts

@@ -369,8 +369,8 @@ export interface QuorumLoopDeps {
      */
     detectedAgents?: string[];
     /**
-     * #585 auto-continuation (Max) — the resolved subscription tier (from
-     * `resumeOrCreateSession`: env override → getSubscriptionStatus → FREE).
+     * #585 auto-continuation (Max) — the resolved authenticated subscription tier
+     * threaded from CLI startup/resume.
      * MAX → a quota-exhausted continuation handoff AUTO-ACCEPTS on the strongest
      * available agent (no prompt). Pro/Free/unresolved/absent → the existing
      * `continuation_offer_handoff` prompt (fail-closed). Auto-continuation only
@@ -963,6 +963,14 @@ export declare class QuorumLoop {
      * This also makes concurrent B.1+B.2 safe (no per-op toggle race).
      */
     private recoverySeedingDepth;
+    /**
+     * Recovery B.1 and B.2 can overlap. A per-call two-row batch is therefore
+     * insufficient: two concurrent calls could each launch two implementors.
+     * These permits are owned by the QuorumLoop/session and cover the complete
+     * `launchRecoveredTrack` operation across every recovery entry path.
+     */
+    private activeRecoveryRelaunches;
+    private readonly recoveryRelaunchWaiters;
     /**
      * Every asynchronously delivered session coroutine that can reach a task
      * workspace: Class-B consumption, shadow recovery, and B.1/B.2 team
@@ -978,6 +986,10 @@ export declare class QuorumLoop {
     private startSessionWork;
     private admittedSessionWorkMayContinue;
     private trackTeamRecovery;
+    private acquireRecoveryRelaunchPermit;
+    private releaseRecoveryRelaunchPermit;
+    private cancelRecoveryRelaunchWaiters;
+    private withRecoveryRelaunchPermit;
     /**
      * §4.3 — TEAM Class B packets buffered while the recovery seed barrier is up
      * (`recoverySeedingDepth > 0`). Drained through the normal live handlers AFTER
@@ -1083,8 +1095,11 @@ export declare class QuorumLoop {
      * never call each other), so it cannot self-deadlock.
      */
     private readonly shadowOpsByTask;
+    /** Abort only the read-only waits owned by non-draining startup recovery. */
+    private readonly backgroundRecoveryAbortControllers;
     /** Once set, no new implementor workspace may be created for this session. */
     private shuttingDown;
+    private awaitBackgroundRecoveryStep;
     /**
      * Serialize one shadow lifecycle op for `taskId` behind any in-flight op for
      * the same task. The op's result/rejection is returned to ITS caller; a
@@ -1447,7 +1462,7 @@ export declare class QuorumLoop {
      * Gemini/Antigravity are out of scope (undefined). NEVER throws — a read/parse
      * failure yields `undefined` (segment simply omitted), never breaks the round.
      */
-    private extractImplementorTokens;
+    private extractImplementorUsage;
     /**
      * PHASE-589/469 W1+W2 (LOCK #589-E/F/H) — on a TEAM track local hard-fail (any
      * of the 4 closed reasons: `verification_failure` / `out_of_scope_write` /
@@ -1529,6 +1544,35 @@ export declare class QuorumLoop {
      * `TaskGroupHalted` convergence is the authoritative group resolution).
      */
     reportTeamTrackUserResolved(taskId: string, postAction: PostDecisionAction): void;
+    /**
+     * H3 / Option B (#657) — emit the POSITIVE cancel-confirmation milestone on the
+     * final-approval CANCEL path. Final-approval "Do not apply. Leave the task in its
+     * current state" RETAINS the shadow and mutates nothing, so it triggers NEITHER
+     * the promote (`promoted`) NOR the discard (`discarded`) milestone — the decision
+     * was previously SILENT in non-TTY (a canceling user got no confirmation, and the
+     * E2E harness had no positive signal to assert, so an unwired/hung Cancel was
+     * indistinguishable from a correct one). This emits `not_applied` ("Not applied —
+     * your tree is unchanged") so the user AND the harness get a positive terminal
+     * that the Cancel actually resolved.
+     *
+     * SELF-GUARDING single source of truth: fires ONLY for a `final_approval_resolved`
+     * postAction whose `decision` is NOT `approve` (Approve promotes via the
+     * TaskAuthorized edge → `promoted`; Abort/Reject-restart discard → `discarded`; an
+     * `open_new_round`/`continuation_switch_*` postAction keeps working, no terminal).
+     * Reuses the SAME `approve`-vs-else discriminator the engine's
+     * `handle_final_approval` + `postActionTeamTrackState` use
+     * (`decision.trim().toLowerCase()`), so it can never diverge from the
+     * Passed/Failed track classification.
+     *
+     * Fires for BOTH single-impl and team tracks (unlike the team-only
+     * `reportTeamTrackUserResolved`) — every Cancel deserves the confirmation. Called
+     * by the shell's `onTerminalDecision` (the shared TTY + non-TTY gate-resolution
+     * chokepoint) after a successful `applyUserDecision`. `emitProgress` already wraps
+     * the listener so a throwing consumer can NEVER break the decision path. NO
+     * wire/schema change (progress is desktop-LOCAL) — `not_applied` carries ONLY the
+     * taskId (SECURITY INVARIANT: no user content, mirrors `discarded`).
+     */
+    reportFinalApprovalCancelled(taskId: string, postAction: PostDecisionAction): void;
     /**
      * Authoritative TaskGroupHalted bridge from LocalExecutor. Calling this async
      * method publishes the terminal group fence synchronously (before its first
@@ -1777,6 +1821,20 @@ export declare class QuorumLoop {
      * RUNS (it always runs; the badge only informs the user).
      */
     private surfaceReviewerReducedTrust;
+    /**
+     * Local-only shape summary of the review a failing seat was working on.
+     *
+     * 2026-08-22 (dogfood): a reviewer wall-clock expiry told us WHEN it gave up
+     * and nothing about WHAT it faced, so a single load-induced timeout on a
+     * one-file diff looked indistinguishable from a systemic defect. These counts
+     * separate the three candidate causes (big diff / big workspace / saturated
+     * host) on the next occurrence.
+     *
+     * Counts and labels ONLY — never diff content, paths, or agent output. This
+     * feeds a `logger.warn` that stays on the desktop; nothing here reaches the
+     * wire. Fail-soft: diagnostics must never throw inside an error handler.
+     */
+    private describeReviewShapeForDiagnostics;
     /**
      * Wave B §2.1 confinement TRI-STATE for a merge-gate model/reviewer invocation
      * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (not opted out + a Trusted
@@ -1944,7 +2002,9 @@ export declare class QuorumLoop {
      * while `pending` and un-expired), so the approved code is never lost; a
      * re-delivered packet (or the next live edge) promotes it.
      */
-    recoverShadows(): Promise<void>;
+    recoverShadows(opts?: {
+        drainOnShutdown?: boolean;
+    }): Promise<void>;
     private recoverShadowsOwned;
     /**
      * Session-exit ownership boundary. Stop future creates, wait behind every

package/dist/orchestration-shell/task-progress.d.ts

@@ -5,6 +5,9 @@
  * (controlled operational notice text; see the header + the entry's carve-out).
  */
 export type TaskProgressEvent = ({
+    phase: 'preparing_workspace';
+    round: number;
+} | {
     phase: 'shadow_created';
     round: number;
 } | {
@@ -66,6 +69,9 @@ export type TaskProgressEvent = ({
 } | {
     phase: 'discarded';
     taskId?: string;
+} | {
+    phase: 'not_applied';
+    taskId?: string;
 } | {
     phase: 'waiting_user';
 } | {

package/dist/orchestration-shell/types.d.ts

@@ -379,6 +379,7 @@ export type ConversationEntry = {
         serverDecision: string | null;
     };
     reviewSummary?: ReviewSummaryPanelModel;
+    queuedReviewSummaries?: Readonly<Record<string, ReviewSummaryPanelModel>>;
 } | {
     kind: 'gate-panel';
     id: string;
@@ -667,6 +668,57 @@ export interface OrchestrationState {
      * keyboard focus. Non-team / Companion / CP-1.a sessions never open it.
      */
     reviewerWizard: ReviewerWizardState | null;
+    /**
+     * `[ADDITIVE WIDENING — O1 C1 (#652)]` per
+     * PHASE-O1-C1-SAFETY-OBSERVABILITY-DESIGN.md §3.1 item 1: the shell used to
+     * render and DISCARD the `/audit` browser model; `/flag <entry-id>` needs
+     * session-scoped retention of the LAST-rendered listing's
+     * `entryId → {seqNum, kind, flaggable}` mapping to build the plaintext
+     * target locator without re-querying. `null` until the first successful
+     * `/audit <task-id>` render. Desktop-local only; row COORDINATES + closed
+     * enum labels only — never decrypted payload content.
+     */
+    auditFlagIndex: AuditFlagIndex | null;
+}
+/**
+ * One retained `/audit` listing row, keyed by its audit `entry_id` in
+ * {@link AuditFlagIndex.entries}. Shape-only: row coordinates + the plaintext
+ * wire kind + the precomputed flag-eligibility bit (derived from the decrypted
+ * `gate_resolved` outcome at render time — the decrypted payload itself is
+ * NOT retained).
+ */
+export interface AuditFlagEntryRecord {
+    /**
+     * The flagged row's audit-table sort key — the zero-padded 16-digit
+     * `seqNum` string exactly as surfaced by `queryAudit`'s additive
+     * `AuditEntryWireRow.seqNum` projection (core-rs `types.rs`), or `null`
+     * when the row predates the projection (stale backend) — `/flag` then
+     * fails closed with an actionable message.
+     */
+    seqNum: string | null;
+    /** Plaintext snake_case wire kind (e.g. `gate_resolved`). */
+    kind: string;
+    /**
+     * True iff the entry is a decrypted `gate_resolved` row whose outcome is
+     * the quorum's approve consensus (`consensus_approve` / `proceed`) — the
+     * client-side defense-in-depth subset check of design §3.1 item 1 (the
+     * server independently enforces the same subset, §3.1 item 4).
+     */
+    flaggable: boolean;
+}
+/**
+ * The session-scoped retained `/audit` mapping (design §3.1 item 1). Replaced
+ * wholesale on each successful `/audit <task-id>` render (last render wins);
+ * `flagged` carries forward across renders so "already flagged" survives
+ * re-listing. Lives in {@link OrchestrationState.auditFlagIndex}.
+ */
+export interface AuditFlagIndex {
+    /** The task whose listing was rendered — becomes `flaggedTaskId`. */
+    taskId: string;
+    /** `entryId → record` for every entry in the last-rendered listing. */
+    entries: Map<string, AuditFlagEntryRecord>;
+    /** Entry ids flagged this session (dedup no-op render on repeat `/flag`). */
+    flagged: Set<string>;
 }
 /**
  * Snapshot threaded into the interactive `/reviewer-setup` wizard when it
@@ -853,6 +905,12 @@ export type OrchestrationAction = {
     wizard: ReviewerWizardState;
 } | {
     type: 'REVIEWER_WIZARD_CLOSE';
+} | {
+    type: 'AUDIT_FLAG_INDEX_RETAINED';
+    index: AuditFlagIndex;
+} | {
+    type: 'AUDIT_FLAG_RECORDED';
+    entryId: string;
 } | {
     type: 'EXIT';
 };

package/dist/orchestration-shell/workspace-shutdown.d.ts

@@ -15,6 +15,21 @@ export interface WorkspaceShutdownOperations {
     onPlannerFlushFailure?: (error: Error) => void;
     onWorkspaceFailure?: (error: Error) => void;
 }
+export interface StartedWorkspaceShutdown {
+    /**
+     * Every teardown phase, including best-effort planner flush and hosted
+     * retirement. This is the operation governed by the shell's normal/signal
+     * responsiveness deadline.
+     */
+    completion: Promise<void>;
+    /**
+     * The local resource-retirement boundary. A normal process exit must await
+     * this even after the broader teardown deadline expires, otherwise a large
+     * authenticated snapshot deletion can be killed halfway through and leak its
+     * private workspace.
+     */
+    resourceRetirement: Promise<void>;
+}
 /**
  * Start every independent shutdown fence before awaiting any one owner.
  *
@@ -24,4 +39,9 @@ export interface WorkspaceShutdownOperations {
  * LocalExecutor drains settle can the durable store be enumerated exactly once
  * without a late publisher recreating a group behind the cleanup pass.
  */
+export declare function startWorkspaceShutdownOperations(operations: WorkspaceShutdownOperations): StartedWorkspaceShutdown;
+/**
+ * Compatibility surface for callers that need the complete shutdown rather
+ * than its separately-observable local resource boundary.
+ */
 export declare function runWorkspaceShutdownOperations(operations: WorkspaceShutdownOperations): Promise<void>;

package/dist/reduced-trust-notice.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Per-session de-duplication for the CP-7 reduced-trust rationale.
+ *
+ * WHY (2026-08-22, dogfood): the reduced-trust rationale is ~600 characters and
+ * was surfaced in FULL once per agent — implementor, reviewer seat 0, reviewer
+ * seat 1 — so a single one-file task printed roughly 1.8 KB of identical
+ * boilerplate that buried the actual progress milestones. In the live transcript
+ * the banner outweighed every `●` line combined.
+ *
+ * The rationale is genuinely important the FIRST time: it tells the operator the
+ * trusted-execution moat is weakened for this session and why. It carries no new
+ * information on the second and third repetition within the same session, where
+ * the tier and reason are identical.
+ *
+ * So: surface the full rationale ONCE per (session, tier, reason), and collapse
+ * every later occurrence to a one-line reminder that still names the actor. The
+ * WARN log is unaffected — the durable forensic record keeps every occurrence in
+ * full; only the user-facing surface is de-duplicated.
+ *
+ * Keyed on (sessionId, tier, reason) rather than sessionId alone so a session
+ * that DEGRADES (e.g. `sandbox_exec` → `none`, or a different reason) surfaces
+ * the new rationale in full rather than silently collapsing a more severe
+ * posture into a one-liner.
+ */
+/**
+ * True the FIRST time this exact (session, tier, reason) rationale is surfaced;
+ * false for every later call. Call once per user-facing surfacing decision.
+ */
+export declare function shouldSurfaceFullReducedTrustRationale(sessionId: string, tier: string, reason: string): boolean;
+/**
+ * Undo a claim (Stage-1 LOW-15). The caller test-and-sets BEFORE surfacing, so
+ * a surfacing that then THROWS would otherwise burn the "first" slot: every
+ * later actor collapses to "(same posture as above)" pointing at a rationale
+ * the operator never saw. Callers that surface fallibly must release on failure.
+ */
+export declare function releaseReducedTrustRationaleClaim(sessionId: string, tier: string, reason: string): void;
+/**
+ * The collapsed one-line form for a repeat occurrence. Names the actor so the
+ * operator can still see WHICH agent is reduced-trust, and points at the full
+ * rationale already in scrollback.
+ */
+export declare function collapsedReducedTrustLine(actor: string): string;
+/** Test-only reset — the Set is module-global and would leak across cases. */
+export declare function __resetReducedTrustNoticesForTest(): void;

package/dist/reviewer/providers/codex.d.ts

@@ -3,6 +3,7 @@ import { type SubprocessOutcome } from '../subprocess.js';
 import type { ReviewerVerdict } from '../types.js';
 import { type VerdictClassifier } from '../verdict-classifier.js';
 import type { BuiltCommand } from './claude.js';
+import { type InvocationUsageSnapshot } from '../token-usage.js';
 /** Construction options. */
 export interface CodexReviewerProviderOptions {
     /** Override the `codex` executable path. Production callers pass nothing
@@ -58,15 +59,16 @@ export declare function buildCommand(executable: string, spec: ReviewerSpec, las
 export declare function buildVerdict(spec: ReviewerSpec, gateId: string, outcome: SubprocessOutcome, lastMessage: string, classifyVerdict?: VerdictClassifier): Promise<ReviewerVerdict>;
 /**
  * Sum `usage.input_tokens + usage.output_tokens` across every
- * `turn.completed` JSONL event in `stdout`. Returns `null` when no
- * `turn.completed` event reported any token count, so dashboards can
- * distinguish "no data" from a real zero.
+ * `turn.completed` JSONL event in `stdout`. Returns `null` when usage is absent,
+ * partial, or invalid so legacy call sites do not turn unknown values into a
+ * false complete total.
  *
  * Lenient: malformed JSONL lines are silently skipped (Codex's stream is
  * designed to be append-only, so partial flushes during timeout could
  * leave a final truncated line).
  */
 export declare function sumCodexTokens(stdout: string): number | null;
+export declare function extractCodexUsageSnapshot(stdout: string, elapsedMs?: number | null): InvocationUsageSnapshot;
 /**
  * Generate a unique-per-spawn path for `--output-last-message`. Lives in
  * the OS temp dir; we own its lifecycle (create on codex's side, read +