@sabaiway/agent-workflow-kit 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -4,6 +4,44 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 3.3.0 — version-pin honesty: the profile stops claiming a limit it never observed (AD-062)
+
+`velocity --autonomy` told every user their credentials could not be protected by the sandbox —
+naming a harness version frozen in the source, 30 patch releases stale, while a comment three lines
+above recorded when the capability had actually arrived. A user who declared
+`redlines.credentials=deny` got no `sandbox.credentials` key and a confident explanation that the
+platform could not enforce it. Not a silent failure: a false claim about a security control.
+
+Nobody can guarantee a vendor's version format, install layout or settings schema stays put, so the
+fix is not "read the right version" — it is **never state what was not observed**. A pin goes stale
+silently; a probe goes stale loudly, and that direction is the whole point.
+
+- **`probeHarnessVersion`** reads the INSTALLED harness at render time — read-only PATH resolution,
+  never a spawn. Two layouts matched exactly (`claude/versions/<version>` and the
+  `@anthropic-ai/claude-code` package.json); a third-party wrapper whose name merely contains
+  "claude", a decorated version segment, and a prerelease all resolve to a STATED unknown. A
+  programming defect inside the walk is rethrown rather than reported as an unknown layout, and an
+  unreadable package.json surfaces instead of folding into "not found".
+- **A supported build now gets the protection.** `sandbox.credentials` is rendered, MERGED into
+  settings (hand-declared `files` and foreign entries survive), drift-checked and local-mask-checked
+  — the render owns exactly the entries for the env vars it protects, nothing more.
+- **Every honest limit is a loud degrade, not a note.** Coverage is stated PARTIAL (env vars only;
+  file credentials are NOT rendered, because that entry shape was never verified against an
+  installed build). `credentials=ask` degrades rather than being quietly upgraded to deny. An older
+  build, or one whose version cannot be RESOLVED from a recognised layout, degrades naming what was
+  observed or stating that nothing was — and a PASSING `--check` prints the degrades too, because
+  "in sync" only means the file matches the render. An UNREADABLE install (a permission error) or a
+  defect inside the probe is a different outcome on purpose: it throws loudly rather than degrading,
+  because "cannot confirm" must never read as "confirmed absent".
+- **New `version-pin` rung in `release-scan`.** A harness version literal under `tools/` fails the
+  scan unless a runtime probe sits beside it in the same JS file. The harness series is discovered
+  from the scanned file, never hardcoded — a scanner carrying its own pin would be an instance of the
+  class it catches, and a self-refusal test enforces that. Prose earns nothing: a `#` comment in a
+  shell script or a line of Markdown cannot hold a probe, so those files stay scanned.
+  **Stated residual, argued in the source:** the rung proves a probe is PRESENT, not that its result
+  is compared with the literal. Proving the latter is JS lexing; an approximation of it was tried and
+  withdrawn, because each increment of precision opened a new hole without buying the guarantee.
+
 ## 3.2.0 — plain language + posture as code: the friction cluster shipped as mechanism (AD-061)
 
 Carrier release for a friction cluster (kit 3.2.0 bundles the bridges + shared contract + the

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '3.2.0'
+  version: '3.3.0'
 ---
 
 # agent-workflow-kit

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/modes/velocity.md

@@ -55,7 +55,11 @@ Honesty notes: tier entries get **NO PreToolUse-hook residual coverage** — the
 
 1. **Preview by default** (writes nothing); **`--apply`** merges the render-owned blocks into `.claude/settings.json` (merge-don't-clobber — foreign top-level keys, existing `permissions.allow`, and foreign ask/deny entries preserved; a policy flip MOVES a red-line rule between ask/deny rather than duplicating it). It **refuses an absent policy** loudly (seed one first with `set-autonomy`). It **never writes `settings.local.json`**; a `settings.local.json` `defaultMode` that would mask the render is reported (local > project).
 2. **`--autonomy --check`** is a **read-only drift gate**: it recomputes the render and compares against the live render-owned blocks — exit `0` in sync, exit `1` on drift (naming the exact key). A hand-edit OUTSIDE those blocks never flags.
-3. **Version-sensitive (characterized against the real claude 2.1.185).** Sandbox keys are `sandbox.enabled` + `sandbox.autoAllowBashIfSandboxed`; `sandbox` level ⇒ auto-allow + `defaultMode: acceptEdits`, `prompt` level ⇒ auto-allow OFF + `defaultMode: default` (the sandbox stays enabled as a confine floor either way). Red-lines use the argument-matching `:*` wildcard (`Bash(git commit:*)` / `Bash(git push:*)` / `Bash(npm publish:*)`). Where 2.1.185 cannot express a red-line distinctly — a **network hard-block** (regular settings only prompt on egress), **credential denial** (`sandbox.credentials` is 2.1.187+ / mask 2.1.199+), or a **prompt-on-outside-write** — the render **DEGRADES LOUDLY** (never a silent allow, never pretend-security). A missing Linux dependency (`socat`/`bwrap`) or an unsupported platform degrades the WHOLE sandbox to unsandboxed — the render still lands the red-lines + `defaultMode` and caveats that ad-hoc scripts will still prompt.
+3. **Version-PROBED, never version-pinned.** The render reads the INSTALLED harness version at run time (`probeHarnessVersion` — a read-only PATH resolution, never a spawn) and names only what it observed. Sandbox keys are `sandbox.enabled` + `sandbox.autoAllowBashIfSandboxed`; `sandbox` level ⇒ auto-allow + `defaultMode: acceptEdits`, `prompt` level ⇒ auto-allow OFF + `defaultMode: default` (the sandbox stays enabled as a confine floor either way). Red-lines use the argument-matching `:*` wildcard (`Bash(git commit:*)` / `Bash(git push:*)` / `Bash(npm publish:*)`). Three branches, all loud:
+   - **Observed and supported** — `sandbox.credentials` IS rendered (and merged into settings.json, and drift-checked). Coverage is stated PARTIAL: env vars only. File credentials (`~/.ssh`) are **not** rendered, because that entry shape was never verified against an installed build — declare `sandbox.credentials.files` yourself if you need it. A `credentials=ask` policy degrades loudly too: the schema offers deny/mask and no ask mode, so `ask` is never quietly upgraded.
+   - **Observed but older than the capability** — no key rendered, degrade names **the observed version**.
+   - **Version unresolvable** — no key rendered, degrade STATES the unknown and its cause. Never a guess in either direction.
+   A **network hard-block** and a **prompt-on-outside-write** are not expressed by this render at all (stated as such, without claiming a platform limit it did not observe). A missing Linux dependency (`socat`/`bwrap`) or an unsupported platform degrades the WHOLE sandbox to unsandboxed — the render still lands the red-lines + `defaultMode` and caveats that ad-hoc scripts will still prompt.
 4. **`--autonomy` cannot combine** with `--accept-edits`, `--kit-tools`, or `--bridge-tier` (allowlist-mode flags) — a loud usage error.
 
-**Autonomy invariants:** policy-only (never seeds the allowlist, leaves `permissions.allow` untouched) · writes only `.claude/settings.json` (never `settings.local.json`) · refuses an absent policy · merge-don't-clobber · degrades loudly where 2.1.185 can't enforce · previews by default · never commits.
+**Autonomy invariants:** policy-only (never seeds the allowlist, leaves `permissions.allow` untouched) · writes only `.claude/settings.json` (never `settings.local.json`) · refuses an absent policy · merge-don't-clobber · **names only the version it observed, and states the unknown when it observed none** · degrades loudly wherever the render cannot express a red-line · previews by default · never commits.

package/tools/recipes.mjs

@@ -394,7 +394,10 @@ const projectTopOf = (cwd) => {
   }
 };
 
-export const composeAutonomyFacts = async (cwd) => {
+// `deps` is threaded to the render check because that check now PROBES the installed harness: without
+// a seam the render state would vary with the machine composing the facts, and a caller could not
+// pin it. Production passes nothing and probes for real.
+export const composeAutonomyFacts = async (cwd, deps = {}) => {
   try {
     const root = projectTopOf(cwd);
     const { loadAutonomy, resolveAutonomy, isSparseSeedConfig } = await import('./autonomy-config.mjs');
@@ -411,7 +414,7 @@ export const composeAutonomyFacts = async (cwd) => {
     let renderState;
     try {
       const { checkAutonomyProfile } = await import('./velocity-profile.mjs');
-      renderState = checkAutonomyProfile({ cwd: root }).inSync
+      renderState = checkAutonomyProfile({ cwd: root }, deps).inSync
         ? 'in sync'
         : 'DRIFT — re-run the velocity --autonomy render';
     } catch (err) {

package/tools/release-scan.mjs

@@ -63,6 +63,81 @@ export const scanText = (text, { allowlist = ALLOWLIST } = {}) => {
   return findings;
 };
 
+// ── the version-pin rung ─────────────────────────────────────────────────────────────────────────
+// A hardcoded harness version under tools/ is a documentation claim frozen in code: it goes stale by
+// default and nothing reports it. This rung refuses a BARE pin and demands a runtime probe beside
+// it — the probe is what converts silent staleness into a loud degrade.
+//
+// A line is a claim when it names the harness AND carries a version literal. The rung reports
+// exactly those lines — it deliberately does NOT spread the claimed series across the rest of the
+// file, which was measured to flag an unrelated dependency constant that merely shared a major.minor
+// with the claim two lines above it. Nothing is lost by the narrower rule: the exemption is
+// FILE-scoped, so a single refusal already forces the probe that makes every literal in the file
+// honest. (This comment names the harness without a literal on the same line ON PURPOSE — the rung
+// scans its own source, and a worked example here would make the scanner refuse itself.)
+//
+// STATED RESIDUAL, not an oversight: a claim split across lines — the harness named on one line, the
+// literal on another — is NOT detected. Closing it needs whole-file arming, which trades this narrow
+// miss for a broad false-positive class. Deliberate line splitting is left to human review; this rung
+// is a guard against staleness that accumulates by default, not against an author evading it.
+const HARNESS_CLAIM_RE = /\bclaude\b/i;
+const SEMVER_LITERAL_RE = /\b\d+\.\d+\.\d+\b/g;
+const TOOLS_SEGMENT = 'tools';
+const PATH_SEP_RE = /[/\\]/;
+const VERSION_PIN_REMEDY =
+  'pair it with a runtime probe (probeHarnessVersion) that compares the pin to the installed build '
+  + 'and degrades loudly, or move the literal into a test fixture or changelog entry, where it '
+  + 'records history instead of asserting a live platform fact';
+
+// Three exemptions, each because the literal is NOT a live claim there. A test fixture and a
+// changelog entry record what was true at a moment; a file that CALLS the probe already reports its
+// own staleness, which is the entire behaviour the rung exists to demand.
+//
+// The probe exemption is a REFERENCE test, deliberately: it asks exactly what the decision asks —
+// that a runtime probe sits beside the literal — and claims nothing more.
+//
+// It was briefly a CALL test. Separating a call from a declaration, a comment, a string and a regex
+// literal is JS lexing, and hand-rolling that opened a new hole in three consecutive review rounds:
+// a legitimate member call wrongly refused, then a per-character recursion that would crash this
+// scanner inside the commit gate, then a regex literal read as a call. The repo does own a real
+// lexical code mask — in root tooling a shipped kit tool cannot import — and extracting it is queued
+// as its own work rather than approximated again here.
+//
+// STATED RESIDUAL, and why the precision was not worth its risk: even a perfect call detector proves
+// only that the probe is REACHABLE in this file, never that its result is compared against the
+// literal. That stronger guarantee was never on offer, so the rung stops where the decision stops
+// and says so. The exemption stays scoped to files that could call anything at all — a `#` comment
+// in a shell script and a line of Markdown prose earn nothing.
+const PROBE_CALLABLE_EXT = new Set(['.mjs', '.js']);
+const PROBE_SYMBOL = 'probeHarnessVersion';
+const TEST_FILE_RE = /\.test\.mjs$/;
+const CHANGELOG_FILE_RE = /^CHANGELOG\.md$/i;
+
+const semverLiteralsIn = (line) => line.match(SEMVER_LITERAL_RE) ?? [];
+const isUnderTools = (path) => String(path).split(PATH_SEP_RE).includes(TOOLS_SEGMENT);
+const isRecordNotClaim = (path) => {
+  const name = basename(String(path));
+  return TEST_FILE_RE.test(name) || CHANGELOG_FILE_RE.test(name);
+};
+
+// PURE: classify one file's text. Path-aware — the same literal is a claim under tools/ and history
+// in a changelog, so the verdict cannot be made from the bytes alone.
+export const scanVersionPins = (text, path) => {
+  if (!isUnderTools(path) || isRecordNotClaim(path)) return [];
+  const probeCallable = PROBE_CALLABLE_EXT.has(extname(String(path)));
+  if (probeCallable && text.includes(PROBE_SYMBOL)) return [];
+  return text.split('\n').flatMap((line, idx) => {
+    const pinned = HARNESS_CLAIM_RE.test(line) ? semverLiteralsIn(line) : [];
+    return pinned.length === 0
+      ? []
+      : [{
+        line: idx + 1,
+        kind: 'version-pin',
+        detail: `harness version pin ${pinned.join(', ')} with no runtime probe in this file — a version literal frozen in code goes stale silently; ${VERSION_PIN_REMEDY}`,
+      }];
+  });
+};
+
 const TEXT_EXT = new Set(['.md', '.mjs', '.js', '.json', '.sh', '.yml', '.yaml', '.txt', '']);
 const EXCLUDE_DIR_NAMES = new Set(['node_modules', '.git', 'plans', 'scan-fixtures']);
 // Only the TEST is self-excluded — it necessarily contains attribution fixtures. The scanner source
@@ -81,34 +156,90 @@ const walk = (path, acc = []) => {
   return acc;
 };
 
-export const scanPaths = (paths, opts = {}) => {
+// Per-target outcomes. A caller-NAMED target that contributes no file must never fold into the
+// clean verdict — an empty file list and a clean one print identically, so a mis-aimed scan would
+// read as proof of cleanliness. `unmatchedGlob` is the one benign zero: the gate declaration lists
+// shell globs, and bash passes an unmatched glob through literally, so a path that still carries a
+// glob metacharacter is an optional target the shell found nothing for, not a mis-aim.
+export const TARGET = Object.freeze({
+  scanned: 'scanned',
+  missing: 'missing',
+  unmatchedGlob: 'unmatched-glob',
+  excluded: 'excluded',
+  empty: 'empty',
+});
+
+const GLOB_META_RE = /[*?[\]]/;
+
+// PURE-ish (one fs read): classify ONE caller-named target and collect the files it contributes.
+// Every zero-contribution status names its own cause, so the refusal can state the remedy rather
+// than a bare count (a count without a location is the defect class this family bans).
+export const classifyTarget = (path) => {
+  if (!existsSync(path)) {
+    return GLOB_META_RE.test(path)
+      ? { path, status: TARGET.unmatchedGlob, files: [] }
+      : { path, status: TARGET.missing, files: [] };
+  }
+  const st = statSync(path);
+  const name = basename(path);
+  if (st.isDirectory() && EXCLUDE_DIR_NAMES.has(name)) return { path, status: TARGET.excluded, files: [] };
+  if (st.isFile() && (EXCLUDE_FILE_NAMES.has(name) || !TEXT_EXT.has(extname(path)) || path.endsWith('.tgz'))) {
+    return { path, status: TARGET.excluded, files: [] };
+  }
+  const files = walk(path);
+  return { path, status: files.length > 0 ? TARGET.scanned : TARGET.empty, files };
+};
+
+// Why each zero-contribution status refuses, and the one legal remedy for it.
+const TARGET_REMEDY = Object.freeze({
+  [TARGET.missing]: 'the path does not exist — fix the target, or drop it from the target list',
+  [TARGET.excluded]: `the target itself is excluded (directory names: ${[...EXCLUDE_DIR_NAMES].join(', ')}; non-text or self-excluded files) — name the FILES to scan instead of the directory`,
+  [TARGET.empty]: 'the target exists but holds no scannable text file — fix the target, or drop it from the target list',
+});
+
+const findingsIn = (targets, opts) => {
   const report = [];
-  for (const p of paths) {
-    if (!existsSync(p)) continue;
-    for (const file of walk(resolve(p))) {
-      const findings = scanText(readFileSync(file, 'utf8'), opts);
-      for (const f of findings) report.push({ file, ...f });
+  for (const target of targets) {
+    for (const file of target.files) {
+      const text = readFileSync(file, 'utf8');
+      for (const finding of scanText(text, opts)) report.push({ file, ...finding });
+      for (const finding of scanVersionPins(text, file)) report.push({ file, ...finding });
     }
   }
   return report;
 };
 
+export const scanPaths = (paths, opts = {}) => findingsIn(paths.map((p) => classifyTarget(resolve(p))), opts);
+
 export const main = (argv) => {
   const reportOnly = argv.includes('--report');
   const paths = argv.filter((a) => a !== '--report');
   if (paths.length === 0) {
     console.error('usage: release-scan.mjs [--report] <path>...');
-    process.exit(2);
+    return 2;
+  }
+  const targets = paths.map((p) => classifyTarget(resolve(p)));
+  for (const target of targets) {
+    if (target.status === TARGET.unmatchedGlob) {
+      console.log(`[release-scan] skipped ${target.path} — no file matched this glob (an optional target, stated not silent).`);
+    }
+  }
+  const misaimed = targets.filter((target) => TARGET_REMEDY[target.status] !== undefined);
+  for (const target of misaimed) {
+    console.log(`[release-scan] target ${target.path} contributed NO file (${target.status}) — ${TARGET_REMEDY[target.status]}`);
   }
-  const report = scanPaths(paths);
+  const report = findingsIn(targets);
   for (const r of report) console.log(`[${r.kind}] ${r.file}:${r.line} — ${r.detail}`);
-  if (report.length === 0) {
+  if (misaimed.length > 0) {
+    console.log(`\n[release-scan] ${misaimed.length} mis-aimed target(s) — this run proves nothing about them, so the clean verdict is refused.`);
+  }
+  if (report.length > 0) console.log(`\n[release-scan] ${report.length} finding(s).`);
+  if (report.length === 0 && misaimed.length === 0) {
     console.log('[release-scan] clean — no AI attribution or reviewer-round identity found.');
-    return;
+    return 0;
   }
-  console.log(`\n[release-scan] ${report.length} finding(s).`);
-  if (!reportOnly) process.exit(1);
+  return reportOnly ? 0 : 1;
 };
 
 const isDirectRun = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
-if (isDirectRun) main(process.argv.slice(2));
+if (isDirectRun) process.exitCode = main(process.argv.slice(2));

package/tools/run-gates.mjs

@@ -77,6 +77,12 @@ const USAGE = [
   '',
   `Runs the gates declared in <cwd>/${GATES_REL} (one bash command line each, project root as cwd).`,
   'Prints a per-gate PASS/FAIL table + one machine-readable summary line; exit 0 iff all green.',
+  '',
+  'Producer env: AW_GIT_DIR (inside a git tree) and AW_LCOV_FILE (--final only) are computed and',
+  'exported to every gate child, and STRIPPED from the inherited environment first — a host-set',
+  'value never stands in for a computed one. A selected gate referencing a producer variable this',
+  'run will not set is refused BEFORE anything spawns (exit 1), naming the gate, the variable, and',
+  'the remedy — never left to expand to empty and fail far from its cause.',
   'Sandbox-safe: the runner itself needs no network and writes only repo-local state — the D4 sandbox',
   'lane; each DECLARED gate command is the project\'s own, so ITS sandbox-safety is command-shape',
   'dependent (first try the sandbox-safe shape — cache under $TMPDIR, offline/notifier off).',
@@ -184,12 +190,37 @@ export const selectGates = (gates, onlyIds) => {
 // NODE_TEST_CONTEXT is stripped: a `node --test` gate spawned while run-gates is itself running
 // under a parent test context would otherwise inherit it, hit Node's recursive-run guard, silently
 // skip every file, and exit 0 — a vacuous false green.
+// The variables this runner PRODUCES for gate children. They are stripped from the inherited
+// environment before every spawn: composing the child env as {...process.env, ...injected} would
+// let a stale or hostile HOST value stand in whenever this run injects nothing, so a gate would
+// silently attest against the wrong git dir or lcov instead of the computed one.
+export const RESERVED_PRODUCER_ENV = Object.freeze(['AW_GIT_DIR', 'AW_LCOV_FILE']);
+
 export const spawnGateViaBash = (cmd, cwd, extraEnv = {}) => {
-  const env = { ...process.env, ...extraEnv };
+  const env = { ...process.env };
   delete env.NODE_TEST_CONTEXT;
-  return spawnSync('bash', ['-c', cmd], { cwd, env, encoding: 'utf8', maxBuffer: MAX_GATE_OUTPUT_BYTES });
+  for (const name of RESERVED_PRODUCER_ENV) delete env[name];
+  return spawnSync('bash', ['-c', cmd], { cwd, env: { ...env, ...extraEnv }, encoding: 'utf8', maxBuffer: MAX_GATE_OUTPUT_BYTES });
 };
 
+// A `$VAR` / `${VAR}` reference to a producer variable. A `${VAR:-default}` form is deliberately NOT
+// matched — a cmd carrying its own fallback does not depend on the injection.
+const referencesProducer = (cmd, name) => new RegExp(`\\$\\{${name}\\}|\\$${name}(?![A-Za-z0-9_])`).test(cmd);
+
+const PRODUCER_RECOVERY = Object.freeze({
+  AW_GIT_DIR: 'run from inside a git work tree — the runner resolves the git dir there and exports it to every gate.',
+  AW_LCOV_FILE: 'AW_LCOV_FILE is produced only by --final — run with --final, or drop the reference from the gate cmd.',
+});
+
+// Which SELECTED gates reference a producer variable this run will not set. Such a reference
+// expands to empty and fails the gate somewhere far from its cause, so it is refused before
+// anything spawns, naming the gate, the variable, and the one remedy.
+export const findUnmetProducerRefs = (gates, injected) =>
+  gates.flatMap((gate) =>
+    RESERVED_PRODUCER_ENV
+      .filter((name) => !injected.includes(name) && referencesProducer(gate.cmd, name))
+      .map((name) => ({ id: gate.id, name })));
+
 // The command the bash preflight runs before ANY gate: proves bash itself spawns on this host,
 // so "no bash" is one loud exit-6 error up front — never a per-gate spawn-failure cascade.
 export const BASH_PROBE_CMD = 'true';
@@ -378,6 +409,16 @@ export const runCli = (argv, deps = {}) => {
       // gate child env — a stray host AW_LCOV_FILE can never desync the checker from the receipt.
       gateSpawn = (cmd, cwd2) => spawn(cmd, cwd2, { AW_GIT_DIR: gitDir, AW_LCOV_FILE: join(gitDir, LCOV_BASENAME) });
     }
+    const injectedEnv = [...(gitDir === null ? [] : ['AW_GIT_DIR']), ...(opts.final ? ['AW_LCOV_FILE'] : [])];
+    const unmet = findUnmetProducerRefs(selected, injectedEnv);
+    if (unmet.length > 0) {
+      for (const { id, name } of unmet) {
+        logError(`[run-gates] gate "${id}" references $${name}, which this run will not set — it would expand to empty and fail far from its cause.`);
+        logError(`   Recovery: ${PRODUCER_RECOVERY[name]}`);
+      }
+      log(composeSummaryLine({ status: 'fail' }));
+      return EXIT.fail;
+    }
     const probe = spawn(BASH_PROBE_CMD, projectDir);
     if (probe.error && probe.error.code === 'ENOENT') {
       logError(

package/tools/velocity-profile.mjs

@@ -1,5 +1,5 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { basename, dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 // The --autonomy render reads the per-project autonomy policy through the read-only autonomy core
 // (AD-044). This file is the family's one .claude/settings.json writer, so the policy render lives here;
@@ -9,6 +9,7 @@ import { AUTONOMY_REL, loadAutonomy, resolveAutonomy, COMMAND_REDLINES } from '.
 // The bridge-wrappers tier's placement probe (AD-044 Plan 4, Decision 2): a tier entry derives ONLY
 // for a PLACED bridge wrapper — findOnPath is the same read-only PATH scan the backend detector uses.
 import { findOnPath } from './detect-backends.mjs';
+import { compareSemver } from './semver-lite.mjs';
 
 // Velocity-profile core + writer: a fixed, audited read-only allowlist that an onboarding step seeds
 // into `.claude/settings.json` so routine read-only commands stop idling on approval prompts.
@@ -982,12 +983,12 @@ export const writeVelocityProfile = ({ cwd, acceptEdits = false, dryRun = true,
 // ── the --autonomy render (AD-044) ───────────────────────────────────────────────────────────────
 // Render docs/ai/autonomy.json into the .claude/settings.json blocks the render OWNS — the `sandbox`
 // block + permissions.ask/deny red-lines + permissions.defaultMode — per the Decision-6 invariant,
-// wired to what the REAL claude 2.1.185 accepts (Step 3.1). POLICY-ONLY: never seeds the read-only
+// wired to what the installed harness accepts, READ AT RUN TIME. POLICY-ONLY: never seeds the read-only
 // allowlist and never touches permissions.allow as a value; a sibling of the flagless allowlist merge
 // (mergeProjectSettings) that follows the identical merge-don't-clobber discipline. Preview-then-apply,
 // dry-run default. Refuses an absent policy (a writer renders only a declared policy).
 
-// The exact 2.1.185 sandbox settings keys (Step 3.1, characterized against the real CLI + official docs).
+// The sandbox settings keys this render owns (characterized against the real CLI + official docs).
 const SANDBOX_KEY = 'sandbox';
 const SANDBOX_ENABLED_KEY = 'enabled';
 const SANDBOX_AUTOALLOW_KEY = 'autoAllowBashIfSandboxed';
@@ -1075,6 +1076,153 @@ export const probeSandboxAvailability = (deps = {}) => {
   return { platform, sandbox: 'none', available: false, missing: [], reason: `native ${platform} sandbox unsupported — use WSL2 on Windows` };
 };
 
+// ── the harness-version probe ────────────────────────────────────────────────────────────────────
+// A version literal frozen in code is a documentation claim: it goes stale by default and nothing
+// reports it. Nobody can guarantee another vendor's version format, install layout or settings
+// shape, so this probe does NOT promise a correct answer — it promises that being wrong is LOUD.
+// A pin goes stale silently; a probe goes stale with a stated unknown. That direction-of-failure IS
+// the whole value. Read-only (PATH scan + realpath via findOnPath), never a spawn — the same
+// doctrine probeSandboxAvailability follows.
+const HARNESS_BIN = 'claude';
+// Two install layouts, both read-only, both matched EXACTLY. The native installer puts the binary at
+// …/claude/versions/<semver>; an npm install carries the @anthropic-ai/claude-code package.json a few
+// levels up. Identity is checked, never guessed from a substring: a third-party wrapper called
+// my-claude-wrapper@9.0.0 must resolve to UNKNOWN, because a false "supported" renders a protection
+// that is not there — strictly worse than an honest unknown, which at least degrades loudly.
+const HARNESS_PKG_NAME = '@anthropic-ai/claude-code';
+const HARNESS_VERSIONS_DIR = 'versions';
+const HARNESS_PKG_SEARCH_DEPTH = 5;
+// The ONLY fs errors that mean "keep walking". EACCES is deliberately NOT here: an unreadable
+// package.json means we cannot confirm, which must surface rather than read as "not the harness".
+// A coded TypeError (Node attaches codes like ERR_INVALID_ARG_TYPE to programming defects) must not
+// pass as an expected walk failure — that is how a defect would masquerade as an unknown layout.
+const WALK_SKIP_FS_CODES = Object.freeze(['ENOENT', 'ENOTDIR', 'EISDIR', 'ELOOP', 'ENAMETOOLONG']);
+// Strict: the whole segment must be a version, so a decorated or trailing-garbage name is unknown
+// rather than a prefix-parsed guess.
+const STRICT_SEMVER_RE = /^\d+\.\d+\.\d+$/;
+
+const unknownHarness = (reason) => ({ version: null, source: null, reason });
+
+const ancestorDirs = (start, depth) => {
+  const step = (acc) => {
+    const last = acc[acc.length - 1];
+    const parent = dirname(last);
+    return acc.length >= depth || parent === last ? acc : step([...acc, parent]);
+  };
+  return step([start]);
+};
+
+// The native layout, matched in FULL: …/claude/versions/<version>. Checking only the `versions/`
+// parent would accept /opt/my-wrapper/versions/9.0.0 as the official harness, so the grandparent is
+// checked too, and the version segment must match strictly — a prefix parse would read
+// `2.1.215-tampered` as a clean version.
+const harnessVersionFromNativeLayout = (installPath) => {
+  const versionsDir = dirname(installPath);
+  const isNativeLayout = basename(versionsDir) === HARNESS_VERSIONS_DIR && basename(dirname(versionsDir)) === HARNESS_BIN;
+  const segment = basename(installPath);
+  return isNativeLayout && STRICT_SEMVER_RE.test(segment) ? segment : null;
+};
+
+// A walk failure is EXPECTED (no package.json at that ancestor, or a malformed one) and is skipped;
+// every other error class rethrows. A probe that swallowed a programming defect would report
+// "unrecognised install layout" — a wrong reason, which is the exact defect this feature exists to
+// stop, just relocated into the probe itself.
+const readPackageVersionAt = (dir, readFile) => {
+  try {
+    const pkg = JSON.parse(readFile(join(dir, 'package.json'), UTF8));
+    // Strict, like the native layout: a prefix parse would read `2.1.187-beta.0` as the stable
+    // `2.1.187` and switch a capability on for a build that may not have it. A prerelease is an
+    // honest unknown, not a rounding-down opportunity.
+    return pkg.name === HARNESS_PKG_NAME && STRICT_SEMVER_RE.test(String(pkg.version)) ? String(pkg.version) : null;
+  } catch (err) {
+    if (err instanceof SyntaxError) return null;
+    if (err instanceof TypeError || err instanceof RangeError || err instanceof ReferenceError) throw err;
+    if (err && WALK_SKIP_FS_CODES.includes(err.code)) return null;
+    throw err;
+  }
+};
+
+// Short-circuits at the first confirmed package: an eager map would keep walking after the answer
+// was already found, so an unrelated ancestor's EACCES would abort a probe that had SUCCEEDED.
+// Fail-loud on an unreadable ancestor still applies for every dir visited BEFORE the confirmation.
+const harnessVersionFromPackageJson = (installPath, readFile) => {
+  for (const dir of ancestorDirs(dirname(installPath), HARNESS_PKG_SEARCH_DEPTH)) {
+    const version = readPackageVersionAt(dir, readFile);
+    if (version !== null) return version;
+  }
+  return null;
+};
+
+// probeHarnessVersion(deps) → { version, source, reason }. `version` is null whenever the installed
+// build could not be read; `reason` then STATES why, so a caller can say "unknown" instead of
+// inventing either direction.
+export const probeHarnessVersion = (deps = {}) => {
+  const locate = deps.findOnPath ?? findOnPath;
+  const readFile = deps.readFile ?? readFileSync;
+  const found = locate(HARNESS_BIN, deps);
+  if (!found.path) {
+    return unknownHarness(`no ${HARNESS_BIN} binary resolved on PATH (${found.state}) — the installed harness version is unknown`);
+  }
+  const version = harnessVersionFromNativeLayout(found.path) ?? harnessVersionFromPackageJson(found.path, readFile);
+  return version === null
+    ? unknownHarness(`resolved ${HARNESS_BIN} to ${found.path}, but no version could be read from that install layout — the installed harness version is unknown`)
+    : { version, source: found.path, reason: `read from the resolved ${HARNESS_BIN} install path ${found.path}` };
+};
+
+// The capability threshold: sandbox credential denial arrived here. This literal is HISTORY (the
+// release where the key appeared), never a claim about the installed build — it is only ever
+// compared against a version the probe OBSERVED, which is what keeps it honest.
+const CREDENTIALS_DENY_SINCE = '2.1.187';
+const CREDENTIALS_KEY = 'credentials';
+const CREDENTIAL_DENY_MODE = 'deny';
+// The env vars the profile protects when the installed build supports it. File-based credentials
+// (~/.ssh) are deliberately NOT rendered: the entry shape for sandbox.credentials.files was not
+// verified against an installed build, and this profile never renders what it has not observed.
+const PROTECTED_ENV_VARS = Object.freeze(['NPM_TOKEN', 'GITHUB_TOKEN']);
+// A caller that did not probe gets the same treatment as a failed probe — a stated unknown. The
+// default must never be an assumed capability in either direction.
+const HARNESS_UNPROBED = Object.freeze({
+  version: null,
+  source: null,
+  reason: 'the harness version was not probed by this caller',
+});
+
+// Inside the credentials block this render owns EXACTLY the envVars entries for the names it
+// protects. Everything else — `files`, `allowPlaintextInject`, any other envVar — is the
+// maintainer's, and the degrade explicitly invites them to declare it. So the block follows the same
+// merge-don't-clobber contract as the rest of the sandbox key, and drift compares only the owned
+// slice: a maintainer who takes the tool's own advice must never be told their settings drifted.
+const isOwnedEnvVar = (entry) => isJsonObject(entry) && PROTECTED_ENV_VARS.includes(entry.name);
+
+// Canonical projection: same keys, same order, sorted by name. Comparing raw entries would flag a
+// hand-written {mode, name} as drift against an identical {name, mode} — a warning about nothing,
+// which trains the reader to ignore the loud channel this whole feature depends on.
+const ownedEnvVarsIn = (block) => {
+  const entries = isJsonObject(block) && Array.isArray(block.envVars) ? block.envVars : [];
+  return entries
+    .filter(isOwnedEnvVar)
+    .map((entry) => ({ name: entry.name, mode: entry.mode }))
+    .sort((a, b) => String(a.name).localeCompare(String(b.name)));
+};
+
+const mergeCredentialsBlock = (existing, rendered) => {
+  const base = isJsonObject(existing) ? existing : {};
+  const foreignEnvVars = (Array.isArray(base.envVars) ? base.envVars : []).filter((e) => !isOwnedEnvVar(e));
+  if (rendered !== undefined) return { ...base, envVars: [...foreignEnvVars, ...rendered.envVars] };
+  const withoutOwned = { ...base };
+  if (foreignEnvVars.length) withoutOwned.envVars = foreignEnvVars;
+  else delete withoutOwned.envVars;
+  return Object.keys(withoutOwned).length > 0 ? withoutOwned : undefined;
+};
+
+const observedPhrase = (harness) =>
+  harness.version !== null
+    ? `observed ${HARNESS_BIN} ${harness.version}`
+    : `the installed ${HARNESS_BIN} version could not be determined — ${harness.reason}`;
+
+const supportsCredentialDenial = (harness) =>
+  harness.version !== null && compareSemver(harness.version, CREDENTIALS_DENY_SINCE) >= 0;
+
 // effectiveAutonomyLevel(resolved) → the ONE global level the (global, static) settings file renders.
 // The autonomy policy is per-activity (Decision 2), but .claude/settings.json is global and the
 // plan.end/exec.end checkpoints are BEHAVIORAL, not machine-enforced (Decision 1). Global auto-allow is
@@ -1086,15 +1234,22 @@ export const effectiveAutonomyLevel = (resolved) => {
   return levels.length > 0 && levels.every((l) => l === AUTONOMY_SANDBOX) ? AUTONOMY_SANDBOX : AUTONOMY_PROMPT;
 };
 
-// renderAutonomySettings(resolved, probe) → the render-owned blocks + honesty notes/degrades. PURE. The
+// renderAutonomySettings(resolved, probe, harness) → the render-owned blocks + honesty notes/degrades. PURE. The
 // sandbox is ALWAYS enabled (the Decision-1 floor: BOTH levels confine); auto-allow + defaultMode follow
 // the collapsed level. Command red-lines land under ask/deny by value. The three non-command red-lines
-// are the sandbox DEFAULTS (network prompt-on-egress; fs cwd+$TMPDIR confine) — where 2.1.185 cannot
+// are the sandbox DEFAULTS (network prompt-on-egress; fs cwd+$TMPDIR confine) — where this render cannot
 // express a value distinctly it DEGRADES LOUDLY (never a silent allow, never silent pretend-security).
-export const renderAutonomySettings = (resolved, probe) => {
+export const renderAutonomySettings = (resolved, probe, harness = HARNESS_UNPROBED) => {
   const level = effectiveAutonomyLevel(resolved);
   const wantsSandbox = level === AUTONOMY_SANDBOX;
-  const sandbox = { [SANDBOX_ENABLED_KEY]: true, [SANDBOX_AUTOALLOW_KEY]: wantsSandbox };
+  const credentialsSupported = supportsCredentialDenial(harness);
+  const sandbox = {
+    [SANDBOX_ENABLED_KEY]: true,
+    [SANDBOX_AUTOALLOW_KEY]: wantsSandbox,
+    ...(credentialsSupported
+      ? { [CREDENTIALS_KEY]: { envVars: PROTECTED_ENV_VARS.map((name) => ({ name, mode: CREDENTIAL_DENY_MODE })) } }
+      : {}),
+  };
   const defaultMode = DEFAULT_MODE_FOR[level];
   const ask = [];
   const deny = [];
@@ -1103,20 +1258,34 @@ export const renderAutonomySettings = (resolved, probe) => {
   }
   const notes = [];
   const degrades = [];
-  // network — 2.1.185 regular settings cannot HARD-BLOCK egress; both values render as no allowedDomains
-  // (prompt-on-egress). deny DEGRADES LOUDLY (can't hard-block); ask is the faithful sandbox default.
+  // network — this render owns no egress-blocking key, so both values land as prompt-on-egress. The
+  // degrade states what THIS RENDER does not express; it never claims a platform limit it did not
+  // observe, and it names the version it did observe (or states the unknown).
   if (resolved.redlines.network === 'deny') {
-    degrades.push('network=deny requested, but claude 2.1.185 regular settings cannot HARD-BLOCK egress — rendered as prompt-on-egress (the sandbox default: no domains pre-allowed, a new domain still prompts). A silent hard block needs managed settings (allowManagedDomainsOnly).');
+    degrades.push(`network=deny requested, but this render expresses no HARD egress block (${observedPhrase(harness)}) — rendered as prompt-on-egress (the sandbox default: no domains pre-allowed, a new domain still prompts). A silent hard block needs managed settings (allowManagedDomainsOnly).`);
   } else {
     notes.push('network=ask → prompt on each new domain (the sandbox default; no domains pre-allowed).');
   }
-  // credentials — 2.1.185 has NO sandbox.credentials at all (deny added 2.1.187, mask 2.1.199). BOTH
-  // values degrade loudly — never silent pretend-security.
-  degrades.push(`credentials=${resolved.redlines.credentials} requested, but claude 2.1.185 has NO sandbox credential denial (deny added in 2.1.187, mask in 2.1.199) — NPM_TOKEN/GITHUB_TOKEN and ~/.ssh are NOT hidden from sandboxed commands. Upgrade to 2.1.187+ for sandbox.credentials.`);
-  // fs_outside_repo — the sandbox default is a HARD confine to cwd+$TMPDIR; 2.1.185 has no
-  // prompt-on-outside-write, so `ask` DEGRADES LOUDLY to the deny form (hard confine).
+  // credentials — rendered when the OBSERVED version reaches the threshold, degraded loudly when it
+  // does not or when the version is unknown. Reporting a platform limit that does not exist is the
+  // defect; so is pretending protection that was never confirmed.
+  if (credentialsSupported) {
+    // The installed schema offers deny|mask — there is NO ask mode, so `ask` cannot be expressed and
+    // DEGRADES LOUDLY to the deny form rather than being quietly upgraded. And even on deny the
+    // coverage is PARTIAL: env vars only, because the files entry shape was never verified against an
+    // installed build. Partial protection reported as success is the same defect as the false claim
+    // this render replaced — so it degrades too, never a note.
+    if (resolved.redlines.credentials === 'ask') {
+      degrades.push(`credentials=ask requested, but sandbox.${CREDENTIALS_KEY} offers no ask mode (${observedPhrase(harness)}) — rendered as the deny form: ${PROTECTED_ENV_VARS.join('/')} are unset for sandboxed commands with no prompt.`);
+    }
+    degrades.push(`credentials=${resolved.redlines.credentials} coverage is PARTIAL (${observedPhrase(harness)}) — sandbox.${CREDENTIALS_KEY} denies ${PROTECTED_ENV_VARS.join('/')} only. File-based credentials (~/.ssh and any other secret FILE) stay readable by sandboxed commands: this profile does not render ${CREDENTIALS_KEY}.files, whose entry shape it has not verified against an installed build. Declare them yourself if you need them.`);
+  } else {
+    degrades.push(`credentials=${resolved.redlines.credentials} requested, but ${observedPhrase(harness)}; sandbox credential denial arrived in ${CREDENTIALS_DENY_SINCE}, so ${PROTECTED_ENV_VARS.join('/')} and ~/.ssh are NOT hidden from sandboxed commands here. Upgrade to ${CREDENTIALS_DENY_SINCE}+ (or fix the install so the version can be read) for sandbox.${CREDENTIALS_KEY}.`);
+  }
+  // fs_outside_repo — the sandbox default is a HARD confine to cwd+$TMPDIR; this render expresses no
+  // prompt-on-outside-write mode, so `ask` DEGRADES LOUDLY to the deny form (hard confine).
   if (resolved.redlines.fs_outside_repo === 'ask') {
-    degrades.push('fs_outside_repo=ask requested, but claude 2.1.185 has no prompt-on-outside-write — rendered as the deny form (writes hard-confined to cwd+$TMPDIR; an outside write is blocked, then auto-retried through the normal permission flow).');
+    degrades.push(`fs_outside_repo=ask requested, but this render expresses no prompt-on-outside-write mode (${observedPhrase(harness)}) — rendered as the deny form (writes hard-confined to cwd+$TMPDIR; an outside write is blocked, then auto-retried through the normal permission flow).`);
   } else {
     notes.push('fs_outside_repo=deny → writes confined to cwd+$TMPDIR (the sandbox default).');
   }
@@ -1147,7 +1316,14 @@ export const mergeAutonomySettings = (projectData, render) => {
   else delete mergedPermissions.ask;
   if (mergedDeny.length) mergedPermissions.deny = mergedDeny;
   else delete mergedPermissions.deny;
+  // The credentials block is render-OWNED like the two flags above: it must be written when the
+  // render carries it and REMOVED when it does not, or a stale block would outlive the capability
+  // that justified it. A render that carries no credentials key protects nothing, so leaving a
+  // previous one in place would keep claiming a protection this run did not render.
+  const mergedCredentials = mergeCredentialsBlock(existingSandbox[CREDENTIALS_KEY], render.sandbox[CREDENTIALS_KEY]);
   const mergedSandbox = { ...existingSandbox, [SANDBOX_ENABLED_KEY]: true, [SANDBOX_AUTOALLOW_KEY]: render.sandbox[SANDBOX_AUTOALLOW_KEY] };
+  if (mergedCredentials === undefined) delete mergedSandbox[CREDENTIALS_KEY];
+  else mergedSandbox[CREDENTIALS_KEY] = mergedCredentials;
   return { ...base, [SANDBOX_KEY]: mergedSandbox, permissions: mergedPermissions };
 };
 
@@ -1256,6 +1432,16 @@ const collectLocalMasks = (localData, render) => {
       masks.push({ key: `${SANDBOX_KEY}.${k}`, local: localSandbox[k], rendered: render.sandbox[k] });
     }
   }
+  // credentials is render-owned too, and local > project applies to the WHOLE key: a local block
+  // that drops or weakens a rendered entry silently removes a protection the preview just reported.
+  // Compared on the owned slice only, so a local file that merely ADDS its own entries is not a mask.
+  if (hasOwn(localSandbox, CREDENTIALS_KEY)) {
+    const localOwned = ownedEnvVarsIn(localSandbox[CREDENTIALS_KEY]);
+    const renderedOwned = ownedEnvVarsIn(render.sandbox[CREDENTIALS_KEY]);
+    if (JSON.stringify(localOwned) !== JSON.stringify(renderedOwned)) {
+      masks.push({ key: `${SANDBOX_KEY}.${CREDENTIALS_KEY}`, local: localOwned, rendered: renderedOwned });
+    }
+  }
   return masks;
 };
 
@@ -1310,7 +1496,7 @@ export const writeAutonomyProfile = ({ cwd, apply = false } = {}, deps = {}) =>
   }
   const resolved = resolveAutonomy(config);
   const probe = probeSandboxAvailability(deps);
-  const render = renderAutonomySettings(resolved, probe);
+  const render = renderAutonomySettings(resolved, probe, probeHarnessVersion(deps));
   const preflight = preflightVelocityProfile({ cwd: projectDir }, deps);
   // local-mask honesty: a settings.local.json value for ANY render-owned key (defaultMode + the sandbox
   // enable/auto-allow keys) that differs from the render's MASKS it (local > project). Reported loudly;
@@ -1369,7 +1555,7 @@ export const checkAutonomyProfile = ({ cwd } = {}, deps = {}) => {
   if (source === 'none' || config === null) {
     throw makeVelocityProfileError(VELOCITY_NO_POLICY, `no ${AUTONOMY_REL} to check against — seed a policy first (set-autonomy previews, then --write)`);
   }
-  const render = renderAutonomySettings(resolveAutonomy(config), probeSandboxAvailability(deps));
+  const render = renderAutonomySettings(resolveAutonomy(config), probeSandboxAvailability(deps), probeHarnessVersion(deps));
   const settings = readSettingsFile(join(projectDir, SETTINGS_FILE), { ...deps, cwd: projectDir });
   const data = settings.present ? settings.data : {};
   const drift = [];
@@ -1380,6 +1566,13 @@ export const checkAutonomyProfile = ({ cwd } = {}, deps = {}) => {
   if (liveSandbox[SANDBOX_AUTOALLOW_KEY] !== render.sandbox[SANDBOX_AUTOALLOW_KEY]) {
     drift.push(`${SANDBOX_KEY}.${SANDBOX_AUTOALLOW_KEY}: expected ${render.sandbox[SANDBOX_AUTOALLOW_KEY]}, found ${JSON.stringify(liveSandbox[SANDBOX_AUTOALLOW_KEY])}`);
   }
+  // The credentials block is render-owned in BOTH directions: a removed one is a protection that
+  // silently stopped applying, and a leftover one claims a protection this render did not make.
+  const liveOwnedCredentials = ownedEnvVarsIn(liveSandbox[CREDENTIALS_KEY]);
+  const wantOwnedCredentials = ownedEnvVarsIn(render.sandbox[CREDENTIALS_KEY]);
+  if (JSON.stringify(liveOwnedCredentials) !== JSON.stringify(wantOwnedCredentials)) {
+    drift.push(`${SANDBOX_KEY}.${CREDENTIALS_KEY}.envVars (render-owned entries): expected ${JSON.stringify(wantOwnedCredentials)}, found ${JSON.stringify(liveOwnedCredentials)}`);
+  }
   const perms = getPermissions(data);
   if (perms[DEFAULT_MODE_KEY] !== render.defaultMode) {
     drift.push(`permissions.${DEFAULT_MODE_KEY}: expected ${render.defaultMode}, found ${JSON.stringify(perms[DEFAULT_MODE_KEY])}`);
@@ -1399,12 +1592,28 @@ export const checkAutonomyProfile = ({ cwd } = {}, deps = {}) => {
     if (inExpected !== 1) drift.push(`permissions.${want}: expected exactly one ${rule} (redlines.${rl}=${want}), found ${inExpected}`);
     if (inOther !== 0) drift.push(`permissions.${other}: ${rule} present ${inOther}× but redlines.${rl}=${want} (belongs under ${want})`);
   }
-  return { inSync: drift.length === 0, drift, source, level: render.level, settingsPresent: settings.present };
+  // The degrades ride along even when the check PASSES. "In sync" only means the file matches the
+  // render — it says nothing about what that render could not protect. Dropping them here would let
+  // an unknown or too-old harness report a clean IN SYNC while the credential protection is simply
+  // absent: exactly the silent-success shape this whole change exists to remove.
+  // A local file that masks a render-owned key defeats the rendered value silently (local > project),
+  // so the check must read it too. Without this a local block weakening sandbox.credentials still
+  // produced IN SYNC while the report claimed the tokens were denied — a false all-clear about a
+  // security control, which is the exact defect class this change exists to close.
+  const localSettings = readSettingsFile(join(projectDir, SETTINGS_LOCAL_FILE), { ...deps, cwd: projectDir });
+  const localMasks = collectLocalMasks(localSettings.present ? localSettings.data : undefined, render);
+  for (const m of localMasks) {
+    drift.push(`${SETTINGS_LOCAL_FILE} masks ${m.key}: local ${JSON.stringify(m.local)} overrides the rendered ${JSON.stringify(m.rendered)} (local > project)`);
+  }
+  return { inSync: drift.length === 0, drift, degrades: render.degrades, localMasks, source, level: render.level, settingsPresent: settings.present };
 };
 
 export const formatAutonomyCheck = (c) =>
   c.inSync
-    ? `autonomy --check: IN SYNC — ${SETTINGS_FILE} matches the ${c.source} render (level ${c.level}).`
+    ? [
+        `autonomy --check: IN SYNC — ${SETTINGS_FILE} matches the ${c.source} render (level ${c.level}).`,
+        ...(c.degrades ?? []).map((d) => `  ⚠ DEGRADE: ${d}`),
+      ].join('\n')
     : [
         `autonomy --check: DRIFT — ${SETTINGS_FILE} diverges from the ${c.source} render (level ${c.level}):`,
         ...c.drift.map((d) => `  ✗ ${d}`),