@staix/agent-hub 0.14.0 → 0.15.0

package/src/hub/daemon.ts

@@ -1,5 +1,10 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { normalizeUsage } from "../omniroute/usage.ts";
+import { permissionPayload } from "./permission-payload.ts";
+import { readClaudeLaunchProof } from "./claude-launch-proof.ts";
 import { InboxPolling } from "./inbox-polling.ts";
 import { ActionBudgets, actionPolicyConfig, type ActionPolicyConfig } from "./action-policy.ts";
+import { actionGate, claudeActionClasses } from "./action-enforce.ts";
 import { ReleaseAuthorizations, releaseAuthorizationError } from "./sdlc-release-authorization.ts";
 import { parseReleaseGuardArgv, parseReleasePushUpdates } from "../cli/sdlc-release-guard.ts";
 import type { DocEvidence } from "./sdlc-release.ts";
@@ -58,7 +63,11 @@ import { ALL_MACHINE_LOCAL, configRepositoryPresent, configTracked, stripUntrust
 import { authorizeConfigLeaf, configApply, configIdentityScope, configChanges, validateEffectiveConfig, validatePetConfig } from "./config-apply.ts";
 import { resolveSettledRoles } from "./settled-roles.ts";
 import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSources } from "./config-reload.ts";
-import { eventLog, readEvents, tokenDeltas, type RoleIdentity } from "./events.ts";
+import { createConfigEditor } from "./config-edit-host.ts";
+import { readEditable } from "./config-edit.ts";
+import { eventLog, readEvents, type RoleIdentity } from "./events.ts";
+import { KimiUsage, kimiSeedRows } from "./kimi-usage.ts";
+import { kimiRowTotal } from "../adapters/kimi-wire-usage.ts";
 import { ExecutionBudget } from "./execution-budget.ts";
 import { claudeReportedTokens, readClaudeTranscriptCompletion, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
 import type { ServerWebSocket } from "bun";
@@ -93,7 +102,7 @@ import { fileURLToPath } from "node:url";
 import { realPath, hubHome } from "./project.ts";
 import { mainCheckoutBranch, mainCheckoutWarning } from "./main-checkout.ts";
 import type { BusEvent, PublishResult } from "./bus.ts";
-import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
+import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, IMPLEMENTER_HUB_TOOL_NAMES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
 import { Conductor, ConductorHolds, conductorPeer, conductorProgressSink, publicConductorTask, publicPeerBudget, type ConductEvent } from "./conductor.ts";
 import { SupervisionFeed } from "./supervision.ts";
 import { drainCliAudits } from "../cli/identity-audit.ts";
@@ -500,6 +509,8 @@ export interface DaemonOptions {
   checkoutBranch?: typeof mainCheckoutBranch;
   /** Host-only admission transport; never selected by project config or tools. */
   releaseHostAdmission?: (cwd: string) => Promise<ReleaseHostAdmission>;
+  /** Host-only (#285): Kimi's data home for its wire-log usage reader; default `KIMI_CODE_HOME`, else `~/.kimi-code`. Never read from config or tools. */
+  kimiHome?: string;
   /** Host-only evidence seam; never supplied by project config or control messages. */
   releaseDocEvidence?: (root: string) => Promise<DocEvidence | undefined>;
   projectId?: string;
@@ -544,6 +555,7 @@ interface Client {
   role?: "peer" | "console" | "tools";
   peer?: PeerId;
   launchId?: string;
+  toolsOwner?: { owner: PeerAdapter; launchId: string; generation: string; cwd: string };
   tail?: () => void;
   watch?: () => void;
   /** The one-launch Kimi TUI admission this socket attached under; its close clears only that admission. */
@@ -603,7 +615,10 @@ export async function startDaemon(opts: DaemonOptions) {
   const channelPeers = [...ADAPTERS.filter(definition => definition.transport === "claude-channel").map(definition => definition.kind),
     ...channelExtras.filter(id => adapterCatalog.definitionOf(id, declarations)?.transport === "claude-channel")];
   const executionRoots = new Map<string, string>();
-  const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string }>();
+  const childToolAuthority = new AsyncLocalStorage<{ by: string; current: () => boolean }>();
+  const implementerTranscripts = new Map<string, string>();
+  const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string; socket?: Sock; launchId?: string; generation?: string | number }>();
+  const verifiedTerminalRootsThisTurn = new Set<object>();
   const reviewerUnavailable = new Map<string, string>();
   const roles = { ...Object.fromEntries(adapterCatalog.definitions.filter(d => configuredIds.includes(d.kind)).map(d => [d.kind, [...d.roles]])), ...loadedConfig.roles };
   const permissionModesFromInstances: Record<string, PermissionMode> = {};
@@ -679,6 +694,13 @@ export async function startDaemon(opts: DaemonOptions) {
   let configRevision = 0;
   let reloadConfirmation: { token: string; fingerprint: string; revision: number; keys: string[] } | undefined;
   let pendingRestart: { key: string; reason: string }[] = [];
+  // #689: structural config edits. Assigned with the settings section; status and the settings view read it before then, so it is held here.
+  let configEditor: ReturnType<typeof createConfigEditor> | undefined;
+  const structuralScopes = new Set<string>();
+  let sdlcFileReads = 0;
+  let sdlcFileCache: { stamp: string; value: { mode: string; requiredChecks: readonly string[] } | string } | undefined;
+  /** What waits for a restart: the reload's own keys, then a changed sdlc.toml (read once at start). */
+  const allPendingRestart = (): { key: string; reason: string }[] => [...pendingRestart, ...(configEditor?.pendingRestart() ?? [])];
   let retainedConfig: { key: string; reason: string }[] = [];
   function retainedConfigAfterReload(sources: ConfigSources, fileConfig: HubConfig, rejected: readonly { key: string; reason: string }[], scope?: string): { key: string; reason: string }[] {
     const rows = new Map<string, string>();
@@ -840,6 +862,7 @@ export async function startDaemon(opts: DaemonOptions) {
         sock.data.watch?.();
         const peer = sock.data.peer ? bus.peers.get(sock.data.peer) : undefined;
         if (isWsPeer(peer)) {
+          if (sock.data.peer && executionOwners.get(sock.data.peer)?.socket === sock) revokeTerminalExecution(sock.data.peer);
           peer.detach(sock);
           if (!!sock.data.peer && !!definitionOf(sock.data.peer)?.attach?.admission && peer.state === "offline" && !peer.claiming && sock.data.kimiAdmission === kimiAdmissionId) clearKimiAdmission();
         }
@@ -1405,12 +1428,16 @@ export async function startDaemon(opts: DaemonOptions) {
     reviewOnly: reviewOnlyPeer,
     // #223: a headless reviewer's verdict holds only while the same child it started with still runs for that task.
     reviewAuthority: runningReviewAuthority,
+    requestAuthority: by => {
+      const scope = childToolAuthority.getStore();
+      return scope?.by === by ? () => scope.current() ? undefined : "Claude child generation or execution root changed" : undefined;
+    },
     // #223 R4: fresh only when the verdict comes from a reviewer session the hub started for this task's review.
     reviewContext: (by, task) => !!definitionOf(by)?.reviewer && (bus.peers.get(by) as ReviewerPrintPeer | undefined)?.reviewing === task ? "fresh" : "continuing",
     // Proof belongs to the adapter generation actually started in the validated root. A role-only
     // reload cannot turn a canonical reviewer process into an isolated implementation owner.
     ownerIsolation: () => Object.fromEntries(extraIds.map(id => {
-      const bound = executionOwners.get(id);
+      const bound = currentExecutionOwner(id);
       return [id, !!bound && bound.owner === bus.peers.get(id) && bound.cwd !== opts.cwd && bound.cwd === executionRoots.get(id)];
     })),
     recordPlanning: change => event({ type: "planning", ...change }),
@@ -1419,6 +1446,9 @@ export async function startDaemon(opts: DaemonOptions) {
     profile: profileName(config.profile),
     profileData: resolvedProfile,
     piiPaths: config.pii?.paths,
+    deny: config.local.deny,
+    // #509a: deliverables are hashed under the owner's verified execution root (a declared worktree instance's worktree), `undefined` when unproven.
+    executionRoot: peer => ownerWriteRoot(peer),
     catalog,
     sessionRoles: peer => bus.peers.has(peer) && bus.stateOf(peer) !== "offline" ? preparedSessionRoles.get(peer) ?? [] : [],
     projectedReview: task => reviewProjection(task),
@@ -1554,7 +1584,10 @@ export async function startDaemon(opts: DaemonOptions) {
   const facts: Facts = new Facts({ root: opts.cwd, repo: factsRepo, tmp: join(opts.stateDir, "facts"), instance: instanceId.slice(0, 8), scope: (peer) => repositoryFacts ? (scopes.has(peer) ? scopes.get(peer) : scopes.set(peer, tasks.factScope(peer)).get(peer)) : undefined, peers: () => [...bus.peers.keys()], nameable: tasks.nameable, deny: config.local.deny, privatePath: path => matchesPolicy(opts.cwd, path, config.pii?.paths ?? []), projection: file => projections.project(file) });
   const worktreeFacts = new Map<string, Facts>();
   const worktreeProjections = new Map<string, TextProjections>();
-  const executionRoot = (peer: string) => executionRoots.get(peer) ?? opts.cwd;
+  const executionRoot = (peer: string) => {
+    if (executionOwners.get(peer)?.socket && !currentExecutionOwner(peer)) return opts.cwd;
+    return executionRoots.get(peer) ?? opts.cwd;
+  };
   const repoFor = (peer: string, budget?: SnapshotBudget) => executionRoot(peer) === opts.cwd ? factsRepo : repoOf(executionRoot(peer), budget);
   const projectionsFor = (peer: string): TextProjections => {
     const root = executionRoot(peer);
@@ -1856,7 +1889,7 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       for (const move of record.moved) moves.set(JSON.stringify([move.id, move.role, move.to, move.title]), move);
       const unreadMoves = [...moves.values()];
-      if (definitionOf(record.peer)?.budget?.resetSoftTokensOnResume) kimiTokens.length = 0; // a new window: the old counts would pause it again at once
+      if (definitionOf(record.peer)?.budget?.resetSoftTokensOnResume) kimiUsage.reset(); // a new window: the old counts would pause it again at once
       const moved = unreadMoves.length ? `While you were paused these moved: ${unreadMoves.map((m) => `${m.title} (${m.role} -> ${m.to ?? "nobody"})`).join("; ")}. They stay where they are; ask the user if you should take one back.` : earlier.length ? "Moves from earlier pauses are preserved in the unread notices below." : "Nothing was moved while you were paused.";
       bus.publish(newEnvelope(HUB, `Your quota window has reset and the hub has resumed you (paused since ${new Date(record.since).toLocaleTimeString()}, ${record.reason}). ${moved}${earlier.length ? ` Earlier unread resume notices: ${earlier.join("\n")}` : ""} Messages queued for you follow.`, { to: [record.peer], kind: "budget", priority: "important", refs: { budgetResume: record.peer, budgetResumeMoves: unreadMoves, ...(earlier.length ? { budgetResumeEarlier: earlier } : {}) } }));
       // Publish the complete replacement before removing its evidence. A failed write keeps the old notices.
@@ -1868,8 +1901,28 @@ export async function startDaemon(opts: DaemonOptions) {
   // ponytail: a third full read of events.jsonl at startup (after nativeStopsSeen and claudeNativeUsageSeen). Measured at about 70 ms on the real
   // 46 MB, 238k-line log, so it is not folded into one pass across startup. Ceiling: the log is never rotated, so the cost grows with it; when a
   // read passes a few hundred ms, make one `readEvents` pass feed all three sets (or keep the resets in hub.db, the #683 U2 roll-up).
-  budget.seedResets(readEvents(join(opts.stateDir, "events.jsonl")).flatMap(e => e.type === "quota_reset" ? [{ peer: e.peer, window: e.window, ...(e.resetsAt !== undefined ? { resetsAt: e.resetsAt } : {}) }] : []));
-  const kimiTokens: { at: number; n: number }[] = [];
+  const startupEvents = readEvents(join(opts.stateDir, "events.jsonl"));
+  budget.seedResets(startupEvents.flatMap(e => e.type === "quota_reset" ? [{ peer: e.peer, window: e.window, ...(e.resetsAt !== undefined ? { resetsAt: e.resetsAt } : {}) }] : []));
+  // #285 phase 2: Kimi's consumption is the hub's own count of its session wire log (`src/adapters/kimi-wire-usage.ts`), not an ACP total.
+  const kimiUsage = new KimiUsage({
+    home: opts.kimiHome ?? process.env.KIMI_CODE_HOME ?? join(homedir(), ".kimi-code"),
+    now: () => Date.now(),
+    ceiling: () => config.budget.kimi_tokens_5h,
+    session: peer => contextSession(peer),
+    record: (peer, row, counted) => {
+      addTokens(peer, counted);
+      event({ type: "usage", peer, source: "kimi_wire", id: row.id, measuredAt: new Date(row.at).toISOString(), inputTokens: row.inputOther, outputTokens: row.output,
+        cacheReadTokens: row.inputCacheRead, cacheWriteTokens: row.inputCacheCreation, totalTokens: kimiRowTotal(row),
+        ...taskAttribution(peer), ...(row.model ? { servedModel: row.model } : {}) });
+    },
+    report: (peer, window) => budget.report(peer, [{ id: "tokens", used: window.used, resetsAt: window.resetsAt, source: `hub count, kimi wire log, of kimi_tokens_5h ${window.ceiling}` }]),
+    forget: peer => budget.forget(peer, "tokens"),
+    notice: line => notify(line),
+  });
+  kimiUsage.seed(kimiSeedRows(startupEvents, Math.max(0, ...startupEvents.flatMap(e => e.type === "budget_resume" && definitionOf(e.peer)?.budget?.resetSoftTokensOnResume ? [Date.parse(e.at)] : []).filter(Number.isFinite))));
+  /** A peer whose definition keeps host-owned soft token accounting (Kimi): its rows are read at a turn start (the floor), a turn end and a usage_update. */
+  const softTokenPeer = (peer: PeerId): boolean => !!definitionOf(peer)?.budget?.resetSoftTokensOnResume;
+  const collectKimiUsage = (peer: PeerId): void => { if (!softTokenPeer(peer)) return; try { kimiUsage.collect(peer); } catch (error) { log(`kimi usage: ${(error as Error).name}`); } };
   startupCleanup.push(() => budget.close());
   // #683 U2: events.jsonl folded into hub.db, a bounded pass at a time, so `usage` never rescans the log.
   const usageRollup = new UsageRollup(join(opts.stateDir, "hub.db"), join(opts.stateDir, "events.jsonl"));
@@ -1968,13 +2021,70 @@ export async function startDaemon(opts: DaemonOptions) {
   function privateSnapshotWindow(): boolean {
     return [...turns.values()].some(turn => turn.private) || board.list().some(task => !isClosedTaskState(task.state) && tasks.isPii(task));
   }
+  function revokeTerminalExecution(peer: string): void {
+    const bound = executionOwners.get(peer);
+    if (bound) verifiedTerminalRootsThisTurn.delete(bound);
+    executionOwners.delete(peer); executionRoots.delete(peer);
+    worktreeFacts.delete(peer); worktreeProjections.delete(peer);
+  }
+  function currentExecutionOwner(peer: string) {
+    const bound = executionOwners.get(peer);
+    if (bound?.socket) {
+      const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
+      if (!isWsPeer(bound.owner) || bound.owner.sessionGeneration !== bound.generation || !launch?.privateRecord || launch.launchId !== bound.launchId || launch.executionCwd !== bound.cwd) {
+        revokeTerminalExecution(peer);
+        return undefined;
+      }
+      // A new event-loop turn revalidates Git inventory and the attached branch before
+      // an admission/effect. Reuse only within synchronous code, never across an await.
+      if (!verifiedTerminalRootsThisTurn.has(bound)) {
+        try {
+          if (resolveInstanceExecutionCwd(opts.cwd, peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
+        } catch { revokeTerminalExecution(peer); return undefined; }
+        verifiedTerminalRootsThisTurn.add(bound);
+        queueMicrotask(() => verifiedTerminalRootsThisTurn.delete(bound));
+      }
+      // The hello claim is not attached until its asynchronous preface finishes.
+      if (!bound.owner.owns(bound.socket)) return undefined;
+    } else if (bound && definitionOf(peer)?.start.daemonPort === "claude-implementer") {
+      try {
+        if (bound.owner !== bus.peers.get(peer) || bound.owner.state === "offline" || bound.cwd === opts.cwd) throw new Error("execution root changed");
+        if (!verifiedTerminalRootsThisTurn.has(bound)) {
+          if (resolveInstanceExecutionCwd(opts.cwd, peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
+          verifiedTerminalRootsThisTurn.add(bound); queueMicrotask(() => verifiedTerminalRootsThisTurn.delete(bound));
+        }
+      } catch { revokeTerminalExecution(peer); return undefined; }
+    }
+    return bound;
+  }
   function ownerWriteRoot(peer: string): string | undefined {
     if (declarations[peer]) {
-      const bound = executionOwners.get(peer);
+      const bound = currentExecutionOwner(peer);
       if (!bound || bound.owner !== bus.peers.get(peer) || bound.cwd !== executionRoots.get(peer)) return undefined;
     }
     return executionRoot(peer);
   }
+  function implementerChatTask(peer: string): number | undefined {
+    const owned = board.list("in_progress").filter(task => task.owner === peer && !tasks.isPii(task));
+    return owned.length === 1 ? owned[0]!.id : undefined;
+  }
+  function currentImplementerTools(c: Client, verifyRoot = true): ReturnType<NonNullable<PeerAdapter["ownedTools"]>> {
+    const bound = c.toolsOwner, peer = c.peer;
+    if (!bound || !peer || c.role !== "tools" || stopping || recoveryActive() || !membershipAllowed(peer) || contextPii(peer) || definitionOf(peer)?.start.daemonPort !== "claude-implementer" || bus.peers.get(peer) !== bound.owner) return undefined;
+    const launch = bound.owner.ownedTools?.(bound.launchId);
+    if (!launch || launch.signal.aborted || launch.generation !== bound.generation || bound.cwd === opts.cwd) return undefined;
+    const root = verifyRoot ? ownerWriteRoot(peer) : executionOwners.get(peer)?.owner === bound.owner ? executionRoots.get(peer) : undefined;
+    if (root !== bound.cwd) return undefined;
+    if (launch.task !== undefined) {
+      const task = board.get(launch.task);
+      if (!task || task.owner !== peer || task.state === "cancelled" || tasks.isPii(task)) return undefined;
+    }
+    return launch;
+  }
+  function captureImplementerTools(c: Client): () => boolean {
+    const binding = c.toolsOwner, launch = currentImplementerTools(c);
+    return () => c.toolsOwner === binding && !!launch && currentImplementerTools(c) === launch;
+  }
   function canonicalWriteScope(repo: Repo, budget?: SnapshotBudget): boolean | undefined {
     // ponytail: D1 is inert for builtin owners while .worktrees exists (a deliberate false negative).
     // Bind each owner to its real execution worktree before narrowing this unknown scope.
@@ -2033,28 +2143,18 @@ export async function startDaemon(opts: DaemonOptions) {
     const paths = changedPaths(repo, from, to).filter(path => { const local = path.slice(repo.prefix.length); return scopes.some(scope => !scope || local === scope || local.startsWith(scope + "/")); });
     return projectedDiff({ repo, from, to, paths, projections, deny: config.local.deny, nameable: tasks.nameable, privatePath: path => matchesPolicy(root, join(repo.top, path), config.pii?.paths ?? []) });
   }
-  const delta = tokenDeltas();
-  /** Tokens a peer used, as increments: Kimi reports a session total (turned into increments below), Codex increments. */
+  /** Tokens a peer used, as increments. */
   let codexUsageSeq = 0; // per hub run: with the run id and peer it names one usage record
-  const addTokens = (peer: PeerId, n: number): number => {
+  const addTokens = (peer: PeerId, n: number, task?: number): number => {
     const supervisionTurn = supervisionTurns.get(peer);
     if (supervisionTurn && Number.isFinite(n) && n >= 0) supervisionTurn.tokens = (supervisionTurn.tokens ?? 0) + n;
     if (n > 0) {
-      event({ type: "tokens", peer, n, ...taskAttribution(peer) });
+      event({ type: "tokens", peer, n, ...taskAttribution(peer, task) });
       const turn = turns.get(peer);
       if (turn) turn.tokens += n;
     }
     return n;
   };
-  const onKimiTokens = (total: number, session: string, peer: string) => {
-    const n = addTokens(peer, delta(peer, total, session));
-    if (!config.budget.kimi_tokens_5h || !n) return;
-    const now = Date.now();
-    kimiTokens.push({ at: now, n });
-    while (kimiTokens.length && now - kimiTokens[0]!.at > 5 * 3_600_000) kimiTokens.shift();
-    const used = kimiTokens.reduce((s, t) => s + t.n, 0) / config.budget.kimi_tokens_5h;
-    budget.report(peer, [{ id: "tokens", used, resetsAt: kimiTokens[0]!.at + 5 * 3_600_000, source: "kimi usage_update (soft limit)" }]);
-  };
   // Claude's numbers arrive through the status line tee `ahub claude` installs (src/cli/statusline-tee.ts).
   let claudeUsageSeen = 0;
   let bandsRevision = ""; // #481 S7: the board revision and band configuration the last band evaluation that ran saw
@@ -2085,7 +2185,7 @@ export async function startDaemon(opts: DaemonOptions) {
       try { tasks.flushPlannerNotices(); } catch { /* the board remains authoritative if notice delivery fails */ }
       for (const pending of checkpointWaits.values()) if (!pending.valid()) pending.done(undefined);
       for (const [id, request] of permissions) if (request.expiresAt > Date.now()) supervision.approvalWaiting({ id, peer: request.peer, tool: request.tool ?? "unknown", createdAt: request.createdAt });
-      for (const row of bus.queueList()) if (row.state === "needs_review") supervision.needsReview(row.peer, row.id);
+      for (const row of bus.queueList(undefined, true)) if (row.state === "needs_review") supervision.needsReview(row.peer, row.id);
       feedBudgetPauses();
       supervision.checkRound();
       try {
@@ -2435,7 +2535,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "hub_task_decline":
         return line(await tasks.decline(by, a.id, a.reason, a.capacity === true));
       case "hub_task_done": {
-        const t = await tasks.done(by, a.id, a.summary, a.refs);
+        const t = await tasks.done(by, a.id, a.summary, a.refs, a.deliverables);
         const completion = t.history.findLast(h => h.by === by && (h.event === "done" || h.event === "done (checking)"));
         if (!piiTurn && !tasks.isPii(t) && completion && !completion.withheld && typeof a.summary === "string" && completion.note?.startsWith(a.summary)) {
           citeMemory(by, a.summary, `summary:${t.id}:${t.history.indexOf(completion)}`, [newEnvelope(by, "", { refs: { task: String(t.id) } })]);
@@ -2449,7 +2549,7 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "hub_sdlc_record":
         await tasks.specStageGate(by, a.id, a.receipt); // #481 S1: a live spec edit-time check before a build stage
-        return line(tasks.recordLifecycle(by, a.id, a.receipt));
+        return line(await tasks.recordSdlc(by, a.id, a.receipt));
       case "hub_review":
         return line(await tasks.review(by, a.id, a.verdict, a.note, a.unmet, a.head, a.coverage, a.findings));
       case "hub_remember":
@@ -2492,7 +2592,8 @@ export async function startDaemon(opts: DaemonOptions) {
       const task = board.get(Number(a.id));
       if (task?.state === "backlog") throw new PreEffectToolRefusal("backlog is read through planner tools");
       if (!task) return JSON.stringify(`no task #${a.id}`);
-      return JSON.stringify({ ...reviewerView(by, publicConductorTask(task, (t) => tasks.publicView(t, true))), ...briefField(task), flowRevision: task.history.length });
+      const peerDeliverables = await tasks.deliverableStatus(task);
+      return JSON.stringify({ ...reviewerView(by, publicConductorTask(task, (t) => tasks.publicView(t, true))), ...briefField(task), ...(peerDeliverables ? { deliverables: peerDeliverables } : {}), flowRevision: task.history.length });
     }
     if (op === "route_explain" && by !== USER) {
       if (a.id !== undefined && board.get(Number(a.id))?.state === "backlog") throw new PreEffectToolRefusal("backlog is read through planner tools");
@@ -2528,7 +2629,8 @@ export async function startDaemon(opts: DaemonOptions) {
         if (!task) return JSON.stringify(`no task #${a.id}`);
         const { codeSymbols: _storedCodeSymbols, ...detail } = task;
         const codeSymbols = tasks.publicView(task).codeSymbols;
-        return JSON.stringify({ ...detail, ...(codeSymbols ? { codeSymbols } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
+        const consoleDeliverables = await tasks.deliverableStatus(task);
+        return JSON.stringify({ ...detail, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
       }
       case "task_assign":
       case "task_assign_checked": {
@@ -2613,6 +2715,30 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   };
   const actionBudgets = new ActionBudgets(() => config.action_policy, contextSession);
+  // #636 slice 2: the always-ask gate of an ACP peer, built per peer from the host's own ports (root, task, PII screen); never from the agent.
+  const acpActionGate = (peer: PeerId) => actionGate({ budgets: actionBudgets, policy: () => config.action_policy, root: executionRoot,
+    task: p => board.list("in_progress").find(t => t.owner === p), publicView: task => tasks.publicView(task), isPrivate: p => !!turns.get(p)?.private || contextPii(p),
+    nameable: text => tasks.nameable(text) }, peer);
+  // A peer is enforceable only where the hub sees the call before it runs, in the mode it runs in now; anything else says why, never a silent claim.
+  // Claude: the launcher installed the PreToolUse hook (an `--unattended` launch skips every permission check, hooks included). ACP: a hub-owned
+  // adapter with the gate, and only while its native mode is `ask`: Kimi's `yolo` and `auto` modes send no request for a call they allow.
+  const actionEnforcement = (peer: PeerId): { enforced: boolean; reason?: string } => {
+    if (definitionOf(peer)?.transport === "claude-channel") {
+      const launch = claudePermissionLaunch(peer), attached = bus.peers.get(peer);
+      // The launch record outlives the process, so it proves nothing alone: the attached session must be the generation whose hook last spoke to the hub.
+      if (!launch) return { enforced: false, reason: "no hub permission hook in this Claude session (start it with ahub claude)" };
+      if (launch.unattended) return { enforced: false, reason: "this Claude launch is --unattended: its permission checks, hooks included, are off" };
+      if (!isWsPeer(attached) || attached.state === "offline" || claudePermissionGenerations.get(peer) !== attached.sessionGeneration)
+        return { enforced: false, reason: "no live Claude session has run the hub permission hook yet" };
+      return { enforced: true };
+    }
+    const owner = bus.peers.get(peer);
+    if (isAcpPeer(owner) && owner.actionGated) {
+      const mode = owner.permissionModeState;
+      return mode === "ask" ? { enforced: true } : { enforced: false, reason: mode === "unknown" || mode === "unmanaged" ? "its native approval mode is not managed by the hub, so a request may never be sent" : `its native mode ${mode} sends no request for a call it allows` };
+    }
+    return { enforced: false };
+  };
   const permissionMode = (peer: string): PermissionMode => permissionModes.get(peer) ?? "ask";
   const permissionModeSources = new Map(Object.entries(defaultSources).map(([peer, value]) => [peer, value.source]));
   const unattendedPeers = new Set<string>();
@@ -2632,8 +2758,10 @@ export async function startDaemon(opts: DaemonOptions) {
     owner: row => {
       const owner = bus.peers.get(row.peer), proof = owner?.terminalOwner?.(row.launchId);
       if (!proof) return undefined;
+      const terminalRootCurrent = () => !declarations[row.peer] || definitionOf(row.peer)?.transport !== "claude-channel" || !config.roles[row.peer]?.includes("implementer") || (ownerWriteRoot(row.peer) === row.executionCwd && row.executionCwd !== opts.cwd);
+      if (!terminalRootCurrent()) return undefined;
       return { ...proof, isCurrent: () => {
-        if (stopping || !membershipAllowed(row.peer) || bus.peers.get(row.peer) !== owner) return false;
+        if (stopping || !membershipAllowed(row.peer) || bus.peers.get(row.peer) !== owner || !terminalRootCurrent()) return false;
         const current = owner?.terminalOwner?.(row.launchId);
         return current?.generation === proof.generation && current?.nativePid === proof.nativePid;
       } };
@@ -2706,8 +2834,8 @@ export async function startDaemon(opts: DaemonOptions) {
       if (value.instanceId !== instanceId) return {};
       let currentLauncher = false;
       try {
-        const launch = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
-        if (launch.instanceId === instanceId && typeof launch.launchId === "string" && launch.launchId) {
+        const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
+        if (launch) {
           currentLauncher = true;
           if (value.launchId !== launch.launchId) return {};
         }
@@ -2806,7 +2934,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // filled one stays in the row and never matches.
   const ADDED_COLUMNS = [["deps", "[]"], ["plan", "{}"]] as const;
   const integrity = (older = 0) => {
-    const queues = Object.fromEntries(Object.keys(bus.snapshot().queues).sort().map((id) => [id, bus.queueIds(id)]));
+    const queues = Object.fromEntries(Object.keys(bus.snapshot(false).queues).sort().map((id) => [id, bus.queueIds(id)]));
     const boardState = board.list().sort((a, b) => a.id - b.id).map((t) => {
       const row: Record<string, unknown> = { ...t };
       for (const [col, empty] of ADDED_COLUMNS.slice(0, older)) if (JSON.stringify(row[col]) === empty) delete row[col];
@@ -2885,7 +3013,7 @@ export async function startDaemon(opts: DaemonOptions) {
     instanceId,
     version: VERSION,
     pluginBundle: SERVER_JS,
-    pendingRestart,
+    pendingRestart: allPendingRestart(),
     retainedConfig,
     ...(() => { const warning = mainCheckoutWarning(opts.cwd, tasks.publicMetadataText, checkoutBranch); return warning ? { mainCheckout: warning } : {}; })(),
     startModes: Object.fromEntries([...START_MODE_PEERS, ...configuredIds].map(peer => [peer, startModeOf(config.peers, peer, declarations, adapterCatalog)])),
@@ -2904,6 +3032,8 @@ export async function startDaemon(opts: DaemonOptions) {
     readOnlyPeers: extraIds.filter(readOnlyPeer),
     // #450 I3: the instance ids this daemon bound at startup; a launcher selects only one of these.
     activeInstances: extraIds,
+    ownerIsolation: Object.fromEntries(extraIds.map(id => [id, !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd])),
+    ownerIsolationNotes: Object.fromEntries(extraIds.filter(id => definitionOf(id)?.transport === "claude-channel" && !ownerWriteRoot(id)).map(id => [id, "terminal execution root not verified; owner admission refused"])),
     stopping,
     pid: process.pid,
     cwd: opts.cwd,
@@ -2911,11 +3041,11 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(dashboard ? { uiOrigin: dashboard.origin } : {}),
     codexProxyPort: opts.codexProxyPort,
     peers: Object.fromEntries(
-      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); return [id, { state: bus.stateOf(id), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(isCodexPeer(p) && p.statusNotice ? { statusNotice: p.statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(summary.oldestQueuedAt !== undefined ? { oldestQueuedAt: summary.oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
+      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); return [id, { state: bus.stateOf(id), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(isCodexPeer(p) && p.statusNotice ? { statusNotice: p.statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(declarations[id] && config.roles[id]?.includes("implementer") && definitionOf(id)?.transport === "claude-channel" ? { ownerIsolation: !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd, ...(!ownerWriteRoot(id) ? { ownerIsolationNote: "terminal execution root not verified; owner admission refused" } : {}) } : {}), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(summary.oldestQueuedAt !== undefined ? { oldestQueuedAt: summary.oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
     ),
     taskWip: Object.fromEntries(peerIds.map(id => [id, { wip: tasks.wip(id), wipLimit: tasks.wipLimit(id) }])),
     boardReadCapabilities: { releaseFilter: true, columnMetadata: true },
-    actionPolicyInfo: Object.fromEntries(peerIds.map(id => [id, actionBudgets.status(id, false)])),
+    actionPolicyInfo: Object.fromEntries(peerIds.map(id => { const e = actionEnforcement(id); return [id, actionBudgets.status(id, e.enforced, e.reason)]; })),
     roleInfo: Object.fromEntries(peerIds.map(id => [id, { flowRoles: config.roles[id] ?? [], catalogRoles: roleState(id), ...(config.roles[id]?.includes("planner") ? { planner: plannerSource } : {}) }])),
     planner: { peers: plannerPeers(), source: plannerSource },
     ...(pendingPermissionDefaults.size ? { permissionDefaults: [...pendingPermissionDefaults].map(([peer, source]) => ({ peer, mode: "never-ask", source })) } : {}),
@@ -2969,7 +3099,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // A queue change is not a bus event: without this, status.json reports the queue as it was before the last
   // message and keeps a phantom `queued N` after the queue drains (measured on a live 0.6.3 hub).
   function heldRows(peer: PeerId) {
-    return bus.queueList(peer).filter(row => row.state === "needs_review").map(row => ({
+    return bus.queueList(peer, true).filter(row => row.state === "needs_review").map(row => ({
       id: row.id, senders: [...new Set(row.originals.map(env => sanitize(env.from)))],
       kinds: [...new Set(row.originals.map(env => env.kind))], createdAt: row.createdAt,
       context: deliveryTaskContext(row.originals, board, peer),
@@ -2985,7 +3115,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (settlingSuperseded || stopping || recoveryActive() || bus.isRecoveryHeld) return;
     settlingSuperseded = true;
     try {
-      for (const row of bus.queueList()) {
+      for (const row of bus.queueList(undefined, true)) {
         if (row.state !== "needs_review" || row.reason?.startsWith("requested stop:")) continue;
         const reason = supersededDeliveryReason(row.originals, board, row.peer);
         if (!reason) continue;
@@ -3286,7 +3416,9 @@ export async function startDaemon(opts: DaemonOptions) {
         const preparedRoles = preparedSessionRoleIdentities.get(e.peer)?.map(role => ({ ...role })) ?? null;
         turns.set(e.peer, { id, capture, start: Date.now(), tokens: 0, writeTasks, branches, writeScope, deliveryTask: delivery, attribution, preparedRoles, ...(start ? { tree: start.tree, head: start.head, commit: start.commit, reflog: start.reflog, snapshotMs: start.ms } : {}), ...(pii ? { private: true } : {}) });
         event({ type: "turn_start", peer: e.peer, turn: id });
+        if (softTokenPeer(e.peer)) try { kimiUsage.turnStarted(e.peer); } catch { /* counting never costs a turn */ }
       } else if (!busy && open) {
+        collectKimiUsage(e.peer); // before the turn closes: its rows count toward the turn's tokens
         turns.delete(e.peer);
         let afterTurn: (() => void) | undefined;
         let files: number | undefined;
@@ -3374,6 +3506,10 @@ export async function startDaemon(opts: DaemonOptions) {
           try { tasks.recordOwnerTurn(e.peer, open.writeTasks, changed, !!open.taskEffect || !!open.effectsPending); } catch { /* advisory cannot fail native completion */ }
         }
       }
+      if (e.state === "offline" && softTokenPeer(e.peer)) { collectKimiUsage(e.peer); kimiUsage.drop(e.peer); }
+      // #636: a class-budget allowance belongs to the owner that earned it. A stopped, crashed or removed owner that later resumes the same native
+      // session id starts from zero (a replaced adapter's own `offline` is muted, so a new owner also revokes where it is created).
+      if (e.state === "offline") actionBudgets.revoke(e.peer);
       if (e.state === "offline") { offlineSince.set(e.peer, offlineSince.get(e.peer) ?? Date.now()); supervision.peerOffline(e.peer); supervisionTurns.delete(e.peer); }
       else offlineSince.delete(e.peer);
       // A session that ended may come back without hooks: its context path is verified again or not at all (issue #108).
@@ -3460,7 +3596,8 @@ export async function startDaemon(opts: DaemonOptions) {
       catch { try { log(`permission observer failed for ${req.peer}`); } catch { /* settlement is authoritative */ } }
     };
     if (stopping || signal?.aborted) { observed("aborted"); return { outcome: "cancelled" }; }
-    if (opts.unattended) { observed("automatic"); return { outcome: "answered", optionId: req.options.find((o) => o.kind === "allow_once")?.optionId }; }
+    // Always-ask (#636): a classed call is never answered for the person, `--unattended` included; it waits for a person and expires as a denial.
+    if (opts.unattended && !req.classed) { observed("automatic"); return { outcome: "answered", optionId: req.options.find((o) => o.kind === "allow_once")?.optionId }; }
     const id = randomUUID().slice(0, 8);
     // The title is written by an agent and read by the person approving it: escape sequences and carriage returns
     // could repaint the terminal line, so everything but newline and tab is made visible.
@@ -3676,7 +3813,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const owner = bus.peers.get(peer);
     const stopNotice = definitionOf(peer)?.cli.stopNotice?.(isWsPeer(owner) ? "tui" : !owner ? startMode(peer) : "headless", owner);
     if (stopNotice) return { ok: false, error: stopNotice };
-    if (!(isAcpPeer(owner) || isPiPeer(owner) || isLocalPeer(owner) || isReviewerPrintPeer(owner))) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
+    if (!(isAcpPeer(owner) || isPiPeer(owner) || isLocalPeer(owner) || isReviewerPrintPeer(owner) || definitionOf(peer)?.start.daemonPort === "claude-implementer" && !!owner?.ownedTools)) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
     if (isPiPeer(owner) && owner.mode !== "headless") return { ok: false, error: "Pi belongs to a native TUI terminal; end it in its terminal" };
     if (owner.state === "offline" && !(isAcpPeer(owner) && owner.pendingOwnedProcess)) return { ok: false, error: `peer is already offline; start it with ${startCommand(peer)} before stopping it` };
     if (starting.has(peer) || requestedPeerStops.has(peer) || permissionChanges.has(peer)) return { ok: false, error: "peer lifecycle or permission change is in progress; wait for ahub status before retrying" };
@@ -3852,9 +3989,11 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (adapter?.start.acpCommand) {
       const cmd = adapter.start.acpCommand(config.kimi_cmd, args.model);
+      actionBudgets.revoke(peer); // a new owner never inherits the allowance of the one it replaces, even for the same session id
       const kimi: AcpPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["acp"]({
         onActivity: item => activityRings[peer]?.append(item),
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
+        actionGate: acpActionGate(peer),
         cmd, kind: adapter.kind,
         permissionMode: permissionMode(peer),
         ...(args.model ? { launchModel: args.model } : {}),
@@ -3868,7 +4007,6 @@ export async function startDaemon(opts: DaemonOptions) {
         // session's configured MCP servers (issue #138). Exact names only; a stopping hub approves nothing.
         autoApprove: (title) => !stopping && HUB_TOOL_TITLES.has(title),
         log,
-        onTokens: (total, session) => onKimiTokens(total, session, peer),
         // Pause synchronously before the adapter requeues a provider-refused prompt (#306).
         onQuotaRefusal: (window) => {
           budget.report(peer, [window], true);
@@ -3879,6 +4017,7 @@ export async function startDaemon(opts: DaemonOptions) {
         // adapter's own session id; report() drops it when that is not the daemon's current session. An invalid
         // shape reports a null reading: unknown, not the previous value (#285).
         onUsageDiagnostic: (observation, sessionId) => {
+          if (observation.source === "usage_update") collectKimiUsage(peer); // phase 2: the update is the cue to read the wire log, never a token total
           if (observation.source !== "usage_update" || observation.shape !== "context-used") return;
           const current = contextSession(peer);
           if (!current) return;
@@ -3904,9 +4043,11 @@ export async function startDaemon(opts: DaemonOptions) {
         userArgs: [], unattended: false, env: {}, nativeCommand: configuredIds.includes(adapter.kind) ? undefined : config.qwen_cmd, model: args.model });
       const mcpServers = [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv(peer, true)).map(([name, value]) => ({ name, value })) }];
       const permission = readOnlyPeer(peer) ? "read-only" as const : permissionMode(peer);
+      actionBudgets.revoke(peer); // a new owner never inherits the allowance of the one it replaces, even for the same session id
       const owner = adapter.start.create({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: undefined, permission, mcpServers, daemon: { acp: {
         onActivity: item => activityRings[peer]?.append(item),
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
+        actionGate: acpActionGate(peer),
         kind: adapter.kind, cmd: [launch.cmd, ...launch.args], permissionMode: permission === "read-only" ? "ask" : permission,
         ...(externalIds.has(adapter.kind) ? { requireOwnedGroup: true, requireLoadSessionEcho: true, nativePolicy: adapter.permission.genericAcp ?? {} } : {}),
         ...(args.model ? { launchModel: args.model } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
@@ -4256,6 +4397,51 @@ export async function startDaemon(opts: DaemonOptions) {
       await local.start();
       return { ok: true, model: route ? `${route} (fallback ${routing.local.fixed_model})` : (args.model ?? routing.local.fixed_model) };
     }
+    if (adapter?.start.daemonPort === "claude-implementer") {
+      if (args.unattended) return { ok: false, error: "Claude implementer refuses unattended permission bypass" };
+      const currentRoot = () => {
+        const roles = config.roles[peer] ?? [];
+        return !stopping && !recoveryActive() && membershipAllowed(peer) && !contextPii(peer) && roles.includes("implementer") && roles.every(role => role === "implementer" || role === "verifier") && permissionMode(peer) !== "never-ask" && resolveInstanceExecutionCwd(opts.cwd, peer, declarations, roles, adapterCatalog) === executionCwd && executionCwd !== opts.cwd;
+      };
+      try { if (!declarations[peer]?.worktree || !currentRoot()) return { ok: false, error: "Claude implementer requires an isolated worktree and ask permissions" }; }
+      catch { return { ok: false, error: "Claude implementer execution root unavailable" }; }
+      if (existing?.state === "busy") return { ok: false, error: "Claude implementer is busy; cleanup must finish before restart" };
+      if (existing) { mute(existing); await existing.stop(); if (!currentRoot()) throw new Error("Claude implementer startup admission changed"); }
+      const selected = permissionMode(peer);
+      if (selected !== "ask" && selected !== "ask-when-needed") return { ok: false, error: "Claude implementer refuses never-ask" };
+      const implementer = adapter.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: selected, mcpServers: [], daemon: DAEMON_PORTS["claude-implementer"]({
+        cwd: executionCwd, stateDir: opts.stateDir, projectRoot: opts.cwd, instanceId, server: SERVER_JS,
+        factsHook: join(import.meta.dir, "..", "cli", "facts-hook.ts"), systemPrompt: sessionRoleContract(peer), mode: selected, watchdogMs: config.watchdog_ms,
+        admit: env => {
+          try {
+            if (env.private || !currentRoot() || bus.peers.get(peer) !== implementer) return false;
+            if (env.refs?.task === undefined) return true;
+            const task = board.get(Number(env.refs.task));
+            return !!task && task.owner === peer && !tasks.isPii(task) && ["proposed", "in_progress", "changes_requested"].includes(task.state);
+          } catch { return false; }
+        },
+        chatTask: () => implementerChatTask(peer),
+        transcriptPersisted: (task, session) => {
+          const path = implementerTranscripts.get(`${peer}:${task}:${session}`);
+          return path ? pathEvidence(path, lstatSync) : "unknown";
+        },
+        onUsage: (usage, task) => {
+          if (bus.peers.get(peer) !== implementer) return;
+          const normalized = normalizeUsage(usage), total = claudeReportedTokens(normalized);
+          if (total !== undefined) addTokens(peer, total, task);
+          event({ type: "usage", peer, source: "claude_result", id: `${runId}:${peer}:${++codexUsageSeq}`, ...normalized,
+            ...(total !== undefined ? { totalTokens: total } : {}), ...taskAttribution(peer, task) });
+        }, notify,
+      }) });
+      await implementer.start();
+      try {
+        if (!currentRoot()) throw new Error("Claude implementer startup admission changed");
+        recoveryTaskPreface(peer); await ensurePreface(peer);
+        if (!currentRoot()) throw new Error("Claude implementer startup admission changed");
+        executionOwners.set(peer, { owner: implementer, cwd: executionCwd }); bus.add(implementer);
+        return { ok: true };
+      } catch (error) { await implementer.stop().catch(() => {}); throw error; }
+    }
     if (adapter?.reviewer) {
       const backend = adapter.reviewer.backend;
       if (!backend || !adapter.start.create) return { ok: false, error: "reviewer has no verified runtime" };
@@ -4545,7 +4731,7 @@ export async function startDaemon(opts: DaemonOptions) {
       instanceId,
       attention: attentionStatus.attentionInput,
       pet,
-      status: { peers: peerView, pendingRestart, retainedConfig, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo },
+      status: { peers: peerView, pendingRestart: allPendingRestart(), retainedConfig, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo },
       boardCapabilities: { backlog: true },
       planningCapabilities: { enabled: true, wipPull: true, split: true },
       releases: tasks.releaseList(USER),
@@ -4674,7 +4860,7 @@ export async function startDaemon(opts: DaemonOptions) {
         settledHolderChange = JSON.stringify(oldHolders) !== JSON.stringify(newHolders);
         if (settledHolderChange) effect = `planner ${JSON.stringify(oldHolders.planners)} -> ${JSON.stringify(newHolders.planners)}; conductor ${JSON.stringify(oldHolders.conductors)} -> ${JSON.stringify(newHolders.conductors)}`;
       }
-      const input = { key, before, acceptedFallback, settledHolderChange, after: machine && rawChanged ? rawAfter : after, source: route ? "routing" as const : "config" as const, sourceFile: origin?.name, tracked, authority, guard, confirmed: !!scope || confirmed.includes(key) };
+      const input = { key, before, acceptedFallback, settledHolderChange, after: machine && rawChanged ? rawAfter : after, source: route ? "routing" as const : "config" as const, sourceFile: origin?.name, tracked, authority, guard, confirmed: !!scope || confirmed.includes(key), structural: !!scope && structuralScopes.has(scope) };
       const decision = authorizeConfigLeaf(input);
       if (!decision.allowed) {
         const next = `${decision.reason}; review and run ahub settings reload, or revert this key${machine && tracked !== false ? "; move machine-local declarations to an untracked local file first" : ""}`;
@@ -4854,7 +5040,7 @@ export async function startDaemon(opts: DaemonOptions) {
   /** For the dashboard: the rows, and until when this session may raise. A project whose files do not read still gets its dashboard. */
   // ponytail: reads the two config files and the undo record and parses the routing files on each dashboard poll; cache by mtime if a page ever feels it.
   function settingsSnapshot(session?: DashboardSession): { settings?: Record<string, unknown> } {
-    try { return { settings: { ...settingsView(), ...(session?.settings ? { sessionUntil: session.settingsUntil } : {}) } }; }
+    try { return { settings: { ...settingsView(), ...(session?.settings ? { sessionUntil: session.settingsUntil } : {}), ...(configEditor ? { configEdit: configEditor.view() } : {}) } }; }
     catch { return {}; }
   }
   function settingsView(): { rows: SettingRow[]; undo?: string; pendingRestart: { key: string; reason: string }[]; retainedConfig: { key: string; reason: string }[] } {
@@ -4876,7 +5062,7 @@ export async function startDaemon(opts: DaemonOptions) {
     });
     const undo = pendingUndo(opts.stateDir);
     const planner = `In force: ${plannerPeers().join(", ") || "nobody"} (${plannerSource}). Setting it makes that peer the only planner; agents cannot change it.`;
-    return { pendingRestart, retainedConfig, rows: rows.map(row => row.key === "planner" ? { ...row, hint: planner } : row), ...(undo ? { undo } : {}) };
+    return { pendingRestart: allPendingRestart(), retainedConfig, rows: rows.map(row => row.key === "planner" ? { ...row, hint: planner } : row), ...(undo ? { undo } : {}) };
   }
   /** The same announcement whatever surface made the change: events.jsonl, hub.log and every open console. */
   const recordSetting = (key: string, from: SettingValue, to: SettingValue, source: "dashboard" | "terminal", undo = false, reason?: string) => {
@@ -5114,6 +5300,46 @@ export async function startDaemon(opts: DaemonOptions) {
     return { ...preview, ...identity, lines: [`Undo ${def.key}: put back ${settingText(value)}`, ...(Array.isArray(preview.lines) ? preview.lines : []), "The saved previous machine-local file is revalidated before writing."] };
   }
 
+  // #689: structural config edits (src/hub/config-edit-host.ts). The editor decides authority, the typed confirmation and the audit event;
+  // the daemon supplies the loaders' verdict, the hold and the one scoped reload path. A structural key is allowed through reload authority
+  // only while its own scope is registered here, for the duration of that one reload.
+  configEditor = createConfigEditor({
+    cwd: opts.cwd, stateDir: opts.stateDir,
+    check: (file, text) => {
+      if (file !== "config.local.json") return;
+      const texts = configSourceTexts(opts.cwd);
+      texts["config.local.json"] = text;
+      const sources = parseConfigSources(texts, undefined, opts.cwd, externalAdapters);
+      const candidate = loadConfig(opts.cwd, sources.layers, sources.routing.retired ?? [], externalDefinitions);
+      // Bounds and kinds are the raw-config check parseConfigSources just ran; the effective merge below is loadConfig itself.
+      checkJcodeInstanceHomes(sources.identity.instances, candidate.jcode_home);
+    },
+    held: () => stopping || recoveryActive() ? "recovery or shutdown" : undefined,
+    reload: async (authority, key) => {
+      structuralScopes.add(key);
+      try { return await reloadConfig(authority, key); } finally { structuralScopes.delete(key); }
+    },
+    event: entry => event(entry),
+    notify: text => notify(text),
+    changed: () => writeStatus(),
+    pending: () => pendingRestart,
+    effective: path => valueAt(config, path),
+    runningSdlc: () => ({ mode: lifecycleConfig.mode, requiredChecks: lifecycleConfig.requiredChecks }),
+    // Status and the settings view poll this: read sdlc.toml again only when its stamp changed. ponytail: the stamp is mtime, ctime, inode and size, so an in-place rewrite of the same size inside one filesystem timestamp tick is missed until the next change; it feeds display only (a status line), never an authority. A watcher is the upgrade if a poll ever shows.
+    fileSdlc: () => {
+      const stamp = (() => { try { const info = statSync(join(opts.cwd, ".agenthub", "sdlc.toml")); return `${info.mtimeMs}:${info.ctimeMs}:${info.ino}:${info.size}`; } catch { return "-"; } })();
+      if (sdlcFileCache?.stamp !== stamp) {
+        let value: { mode: string; requiredChecks: readonly string[] } | string;
+        sdlcFileReads++;
+        try { const loaded = loadSdlc(opts.cwd, VERSION); value = { mode: loaded.mode, requiredChecks: loaded.requiredChecks }; } catch (error) { value = sanitize((error as Error).message).slice(0, 300); }
+        sdlcFileCache = { stamp, value };
+      }
+      return sdlcFileCache.value;
+    },
+    declared: () => Object.fromEntries(Object.entries(declarations).map(([id, value]) => [id, { ...value }])),
+    localConfig: () => { try { const text = readEditable(opts.cwd, "config.local.json"); const doc = text === null ? {} : JSON.parse(text); return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : {}; } catch { return {}; } },
+  });
+
   async function uiAction(a: Record<string, unknown>, session?: DashboardSession): Promise<unknown> {
     const bad = { ok: false, error: "invalid or unavailable dashboard action" };
     // #269: a session opened by `ahub ui --settings` may raise authority while its window lasts; any other may not.
@@ -5199,6 +5425,11 @@ export async function startDaemon(opts: DaemonOptions) {
         return a.undo === true ? settingsUndoPreview() : settingsPreview(a.key, a.value);
       case "setting_reload":
         return reloadConfig(authority);
+      case "config_edit_preview":
+        return configEditor!.preview(a.edit, authority);
+      case "config_edit_apply":
+        // A dashboard session is never given the typed confirmation of an executable key: that is the console's, and refused here by the editor.
+        return configEditor!.apply(a.edit, authority, undefined, a.reason);
       default:
         return bad;
     }
@@ -5245,6 +5476,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (externalIds.size && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("external_adapter_modules"))) return "target lacks external_adapter_modules; verified external definitions cannot be preserved by that daemon";
       if (configuredIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("configured_acp"))) return "target lacks configured_acp; project adapter definitions cannot be preserved by that daemon";
       if (extraIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("peer_instances"))) return "target lacks peer_instances; declared instance identities cannot be restored by that daemon";
+      if (extraIds.some(id => adapterCatalog.definitionOf(declarations[id]!.kind)?.transport === "claude-channel" && declarations[id]!.roles?.includes("implementer")) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("role_stages"))) return "target lacks role_stages; declared Claude implementer authority cannot be restored by that daemon";
       if (board.releases().some(release => release.train && ["active", "frozen"].includes(release.state)) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("release_trains"))) return "target lacks release_trains; active or frozen train safeguards cannot be preserved";
       if ((extraIds.some(id => !!definitionOf(id)?.reviewer) || config.review.pool !== undefined) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("reviewer_pool"))) return "target lacks reviewer_pool; fresh review-only variants and pool policy cannot be preserved";
       return undefined;
@@ -5366,11 +5598,8 @@ export async function startDaemon(opts: DaemonOptions) {
   }
 
   function claudePermissionLaunch(peer: string): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined {
-    try {
-      const row = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
-      if (row.instanceId !== instanceId || row.permissionHook !== true || typeof row.launchId !== "string" || !row.launchId) return undefined;
-      return { launchId: row.launchId, unattended: row.unattended === true, ...(typeof row.hookPurpose === "string" ? { hookPurpose: row.hookPurpose } : {}) };
-    } catch { return undefined; }
+    const row = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
+    return row?.permissionHook ? row : undefined;
   }
   async function changePermission(peer: unknown, mode: unknown, confirmed: unknown): Promise<Record<string, unknown>> {
     if (!isSupportedPeer(peer)) return { ok: false, error: "unknown permission peer" };
@@ -5480,7 +5709,10 @@ export async function startDaemon(opts: DaemonOptions) {
 
   function onMessage(sock: Sock, msg: any): void {
     const c = sock.data;
-    const reply = (body: Record<string, unknown>) => { if (sock.readyState === WebSocket.OPEN) sock.send(JSON.stringify({ rid: msg.rid, ...body })); };
+    const reply = (body: Record<string, unknown>) => {
+      if (c.toolsOwner && !currentImplementerTools(c)) body = { ok: false, error: "Claude child generation or execution root changed" };
+      if (sock.readyState === WebSocket.OPEN) sock.send(JSON.stringify({ rid: msg.rid, ...body }));
+    };
     if (!c.authed) {
       if (msg.t !== "hello" || msg.token !== token) return sock.close(4401, "bad token");
       if (msg.v !== PROTOCOL) {
@@ -5501,6 +5733,13 @@ export async function startDaemon(opts: DaemonOptions) {
         c.peer = String(msg.peer ?? "");
         if (!PEER_ID.test(c.peer) || c.peer === USER || c.peer === "hub") return sock.close(4403, "peer id is reserved or malformed");
         if (!membershipAllowed(c.peer)) return sock.close(4000, "peer is off roster; retry when a person adds it");
+        if (definitionOf(c.peer)?.start.daemonPort === "claude-implementer") {
+          const owner = bus.peers.get(c.peer), launch = owner?.ownedTools?.(msg.launchId), root = ownerWriteRoot(c.peer);
+          if (!owner || !launch || launch.signal.aborted || !root || root === opts.cwd || typeof msg.launchId !== "string") return sock.close(4403, "this process is not the current Claude child");
+          c.launchId = msg.launchId;
+          c.toolsOwner = { owner, launchId: launch.launchId, generation: launch.generation, cwd: root };
+          if (!currentImplementerTools(c)) return sock.close(4403, "Claude child admission changed");
+        }
         // #368: a hub-tools socket for an owned Jcode (a project-file MCP entry, which names no peer) is admitted only with the launch id of that
         // peer's current owned launch. A forged AGENTHUB_PEER_ID in some other process has no such id, so it never acts as that peer.
         if (definitionOf(c.peer)?.start.daemonPort === "owned-acp") {
@@ -5517,8 +5756,8 @@ export async function startDaemon(opts: DaemonOptions) {
         if (definitionOf(c.peer)?.transport === "claude-channel" && msg.launchId !== undefined) {
           let currentLaunch: unknown;
           try {
-            const launch = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", c.peer)), "utf8"));
-            if (launch.instanceId === instanceId && typeof launch.launchId === "string" && launch.launchId) currentLaunch = launch.launchId;
+            const launch = readClaudeLaunchProof(opts.stateDir, c.peer, instanceId);
+            if (launch) currentLaunch = launch.launchId;
           } catch { /* No current launch evidence: retain plain/pre-daemon attachment compatibility. */ }
           if (currentLaunch !== undefined && msg.launchId !== currentLaunch) return sock.close(4430, "Claude launch ended; start a new session with ahub claude");
           if (typeof msg.launchId === "string" && msg.launchId.length <= 128) c.launchId = msg.launchId;
@@ -5534,6 +5773,17 @@ export async function startDaemon(opts: DaemonOptions) {
         preparedSessionRoles.delete(c.peer); // an external transport has no receipt for this daemon's native preamble
         preparedSessionRoleIdentities.delete(c.peer);
         ws.claim(sock, msg.channel === false);
+        if (declarations[c.peer] && definitionOf(c.peer)?.transport === "claude-channel") {
+          revokeTerminalExecution(c.peer);
+          const launch = readClaudeLaunchProof(opts.stateDir, c.peer, instanceId);
+          try {
+            const root = resolveInstanceExecutionCwd(opts.cwd, c.peer, declarations, config.roles[c.peer] ?? [], adapterCatalog);
+            if (root !== opts.cwd && launch?.privateRecord && launch.launchId === c.launchId && launch.executionCwd === root && typeof msg.cwd === "string" && realPath(msg.cwd) === root) {
+              executionRoots.set(c.peer, root);
+              executionOwners.set(c.peer, { owner: ws, cwd: root, socket: sock, launchId: launch.launchId, generation: ws.sessionGeneration });
+            }
+          } catch { /* Unknown or changed worktree evidence never grants owner isolation. */ }
+        }
         if (kimiPull) { clearTimeout(kimiAdmissionExpiry); kimiAdmissionExpiry = undefined; c.kimiAdmission = kimiAdmissionId; }
         if (definitionOf(c.peer)?.transport === "claude-channel") logPermissionStart(c.peer);
         writeStatus(); // the claim has to be visible before the preface, or a standing-by session takes the id back
@@ -5548,7 +5798,24 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (stopping && msg.t !== "status" && msg.t !== "kill" && !(c.role === "console" && msg.t === "native_hook_launch" && msg.op === "end")) return void reply({ ok: false, error: "hub is stopping" });
     if (c.role !== "console" && c.peer && !membershipAllowed(c.peer)) return void reply({ ok: false, error: `${c.peer} is off roster` });
+    if (c.toolsOwner && !currentImplementerTools(c)) return void reply({ ok: false, error: "Claude child generation or execution root changed" });
     switch (msg.t) {
+      case "permission_request": {
+        const peer = c.peer, launch = currentImplementerTools(c), current = captureImplementerTools(c);
+        if (!peer || !launch || c.role !== "tools" || typeof msg.tool !== "string" || !msg.input || typeof msg.input !== "object" || Array.isArray(msg.input)) return void reply({ ok: false, behavior: "deny", message: "permission unavailable" });
+        const shown = permissionPayload(msg.tool, msg.input, tasks.publicMetadataText);
+        const pending = new AbortController(), abortPending = () => pending.abort();
+        launch.signal.addEventListener("abort", abortPending, { once: true });
+        // Heartbeats keep an approval alive; they grant nothing. Admission and the final
+        // answer still revalidate native root evidence, without synchronous Git on every tick.
+        const heartbeat = setInterval(() => { if (currentImplementerTools(c, false) === launch) c.toolsOwner?.owner.keepApprovalAlive?.(); else pending.abort(); }, Math.max(10, Math.min(1000, Math.floor(config.watchdog_ms / 3)))); heartbeat.unref();
+        c.toolsOwner?.owner.keepApprovalAlive?.();
+        void requestPermission({ peer, title: shown.title, tool: shown.tool, classed: true, options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }, pending.signal).then(result => {
+          const allowed = current() && result.outcome === "answered" && result.optionId === "allow";
+          reply({ ok: true, behavior: allowed ? "allow" : "deny", ...(allowed ? {} : { message: result.outcome === "expired" ? "no person answered" : "permission denied" }) });
+        }, () => reply({ ok: true, behavior: "deny", message: "hub permission unavailable" })).finally(() => { clearInterval(heartbeat); launch.signal.removeEventListener("abort", abortPending); }).catch(() => {});
+        return;
+      }
       case "permission_default": {
         if (typeof msg.peer === "string" && rosterChanging === msg.peer) return void reply({ ok: false, error: `${msg.peer} roster change is in progress` });
         if (c.role !== "console") return void reply({ ok: false, error: "permission default confirmation is a human console action" });
@@ -5624,6 +5891,18 @@ export async function startDaemon(opts: DaemonOptions) {
         return void reply({ ok: true });
       }
       case "inbox": {
+        if (c.toolsOwner) {
+          const peer = c.peer!, current = captureImplementerTools(c), launch = currentImplementerTools(c);
+          try {
+            // Inspect the still-pending batch before pull commits/removes it: private work never reaches this native child.
+            const pending = bus.pendingEnvelopes(peer);
+            if (!current() || pending.some(env => { const task = env.refs?.task === undefined ? undefined : board.get(Number(env.refs.task)); return env.private || contextPii(peer) || !!task && tasks.isPii(task); })) return void reply({ ok: false, error: "private inbox delivery refused" });
+            if (!launch || pending.some(env => (env.refs?.task === undefined ? implementerChatTask(peer) : Number(env.refs.task)) !== launch.task)) return void reply({ ok: false, error: "inbox delivery belongs to another task session" });
+            const envs = bus.pull(peer);
+            if (!envs) return void reply({ ok: false, error: queueHold(peer) ?? "delivery held" });
+            return void reply({ ok: true, envs, waiting: bus.queued(peer), waitingImportant: bus.queuedImportant(peer) });
+          } catch { return void reply({ ok: false, error: "delivery journal unavailable" }); }
+        }
         // The attached session can explicitly claim queued work even during a native turn (#493).
         // Pull and push share holds and journal settlement; work read here is completed, never pushed again.
         const peer = c.peer ? bus.peers.get(c.peer) : undefined;
@@ -5792,6 +6071,21 @@ export async function startDaemon(opts: DaemonOptions) {
         };
         try {
           const peer = c.peer;
+          if (definitionOf(peer)?.start.daemonPort === "claude-implementer") {
+            const launch = currentImplementerTools(c), root = ownerWriteRoot(peer);
+            if (!launch || !root || root === opts.cwd || sessionId !== launch.sessionId || msg.nativeLaunchId !== launch.launchId || msg.nativeInstanceId !== instanceId) return void reply({ t: "facts", ok: false });
+            if (typeof msg.transcriptPath === "string" && isAbsolute(msg.transcriptPath) && basename(msg.transcriptPath) === `${launch.sessionId}.jsonl`) {
+              try {
+                const projects = realPath(join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude"), "projects")), transcript = realPath(msg.transcriptPath);
+                if (transcript.startsWith(`${projects}/`) && statSync(transcript).isFile() && launch.task !== undefined) implementerTranscripts.set(`${peer}:${launch.task}:${launch.sessionId}`, transcript);
+              } catch { /* Exact path is not yet present or is unreadable: unknown preserves session identity. */ }
+            }
+            const mode = permissionMode(peer);
+            if (mode !== "ask" && mode !== "ask-when-needed") return void reply({ t: "facts", ok: false });
+            const blocked = scopedWriteBlocked(phase, mode, msg.tool, () => projectFileTool(msg.tool, msg.input, root, config.protect_instruction_files, config.data?.readonly));
+            const actionClasses = phase === "pre" && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, root) : [];
+            return void reply({ t: "facts", ok: true, ...(phase === "pre" ? { permission: mode === "ask-when-needed" && blocked ? "ask" : mode, projectRoot: root, protectInstructionFiles: config.protect_instruction_files, ...(actionClasses.length ? { actionClasses } : {}) } : {}) });
+          }
           let nativeClaude = false;
           if (definitionOf(peer)?.transport === "claude-channel" && sessionId && msg.nativeInstanceId === instanceId) {
             let expectedLaunch: string | undefined;
@@ -5800,8 +6094,8 @@ export async function startDaemon(opts: DaemonOptions) {
               expectedLaunch = Array.isArray(rows) ? rows.find(row => row?.peer === peer && definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === instanceId)?.launchId : undefined;
             } catch { /* an ordinary terminal has no Orca recovery identity */ }
             try {
-              const launch = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
-              if (launch.instanceId === instanceId && typeof launch.launchId === "string") expectedLaunch = launch.launchId;
+              const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
+              if (launch) expectedLaunch = launch.launchId;
             } catch { /* older/manual launches do not have a launcher marker */ }
             const current = claudeSession(peer);
             if ((phase === "stop" || phase === "post") && current.sessionId && current.sessionId !== sessionId) return void reply({ t: "facts", ok: false });
@@ -5818,10 +6112,14 @@ export async function startDaemon(opts: DaemonOptions) {
           if (definitionOf(peer)?.transport === "claude-channel" && msg.nativeInstanceId !== undefined && msg.nativeInstanceId !== instanceId) return void reply({ t: "facts", ok: false });
           const nativePeer = nativeClaude ? bus.peers.get(peer) : undefined;
           const permissionLaunch = definitionOf(peer)?.transport === "claude-channel" ? claudePermissionLaunch(peer) : undefined;
-          const permission = nativeClaude && permissionLaunch && !permissionLaunch.unattended && msg.nativeLaunchId === permissionLaunch.launchId ? permissionMode(peer) : undefined;
+          const writeRoot = declarations[peer]?.worktree ? ownerWriteRoot(peer) : executionRoot(peer);
+          if (declarations[peer]?.worktree && writeRoot === undefined) return void reply({ t: "facts", ok: false });
+          const permission = nativeClaude && permissionLaunch && !permissionLaunch.unattended && msg.nativeLaunchId === permissionLaunch.launchId && writeRoot !== undefined ? permissionMode(peer) : undefined;
           if (permission !== undefined && isWsPeer(nativePeer)) claudePermissionGenerations.set(peer, nativePeer.sessionGeneration);
-          const protectedWrite = scopedWriteBlocked(phase, permission, msg.tool, () => projectFileTool(msg.tool, msg.input, opts.cwd, config.protect_instruction_files, config.data?.readonly));
-          const permissionReply = phase === "pre" && permission !== undefined ? { permission: permission === "ask-when-needed" && protectedWrite ? "ask" : permission, projectRoot: opts.cwd, protectInstructionFiles: config.protect_instruction_files } : {};
+          const protectedWrite = scopedWriteBlocked(phase, permission, msg.tool, () => projectFileTool(msg.tool, msg.input, writeRoot ?? opts.cwd, config.protect_instruction_files, config.data?.readonly));
+          // Always-ask (#636): a classed call is asked about in every permission mode. The hub names only the classes, under the same verified root as the file policy above; the hook turns them into `ask`.
+          const actionClasses = phase === "pre" && permission !== undefined && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, writeRoot ?? opts.cwd) : [];
+          const permissionReply = phase === "pre" && permission !== undefined ? { permission: permission === "ask-when-needed" && protectedWrite ? "ask" : permission, projectRoot: writeRoot ?? opts.cwd, protectInstructionFiles: config.protect_instruction_files, ...(actionClasses.length ? { actionClasses } : {}) } : {};
           // Permission-only hooks carry no native-turn evidence and must never drive busy state.
           const purpose = permissionLaunch?.hookPurpose ?? msg.hookPurpose;
           const observesNative = purpose === "facts" || purpose === "idle" || purpose === "facts-and-idle" || (purpose === undefined && (config.coordination === "turn-free" || config.task_sweep.enabled || config.roles[peer]?.includes("conductor")));
@@ -6069,7 +6367,7 @@ export async function startDaemon(opts: DaemonOptions) {
         catch (error) { return void reply({ ok: false, error: (error as Error).message }); }
       case "settings_get":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
-        return void reply({ ok: true, ...settingsView(), roster: rosterView() });
+        return void reply({ ok: true, ...settingsView(), roster: rosterView(), configEdit: (() => { const view = configEditor!.view(); return { revisions: view.revisions, known: view.known }; })() });
       case "settings_reload":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person command" });
         return void reloadConfig("terminal", undefined, msg.confirm).then(reply, () => reply({ ok: false, error: "configuration reload could not be confirmed; inspect hub.log" }));
@@ -6083,6 +6381,16 @@ export async function startDaemon(opts: DaemonOptions) {
       case "settings_undo":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
         return void settingsUndo("terminal", msg.confirm, msg.now, msg.reason, msg.key, msg.undoDigest).then(reply, () => reply({ ok: false, error: "the setting could not be undone; inspect hub.log" }));
+      case "config_edit_get":
+        if (c.role !== "console") return void reply({ ok: false, error: "config edits are a person's: run ahub settings edit in a terminal" });
+        return void reply({ ok: true, ...configEditor!.view() });
+      case "config_edit_preview":
+        if (c.role !== "console") return void reply({ ok: false, error: "config edits are a person's: run ahub settings edit in a terminal" });
+        return void reply(configEditor!.preview(msg.edit, "terminal"));
+      case "config_edit_apply":
+        if (c.role !== "console") return void reply({ ok: false, error: "config edits are a person's: run ahub settings edit in a terminal" });
+        void configEditor!.apply(msg.edit, "terminal", msg.confirm, msg.reason).then(reply, () => reply({ ok: false, error: "the config edit could not be completed; inspect hub.log" }));
+        return;
       case "kimi_launch_end": {
         if (c.role !== "console") return void reply({ ok: false, error: "Kimi launch cleanup is console only" });
         if (typeof msg.admissionId === "string" && msg.admissionId === kimiAdmissionId) clearKimiAdmission();
@@ -6132,8 +6440,9 @@ export async function startDaemon(opts: DaemonOptions) {
           });
         return;
       case "task":
+        if (c.toolsOwner && !IMPLEMENTER_HUB_TOOL_NAMES.includes(String(msg.op))) return void reply({ t: "task", ok: false, error: "tool is not available to this Claude implementer child" });
         if (recoveryActive() && recoveryPhase !== "preparing" && String(msg.op) !== "hub_checkpoint") return void reply({ t: "task", ok: false, error: "recovery is holding mutations" });
-        taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {}).then(
+        (c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {})).then(
           (text) => reply({ t: "task", ok: true, text }),
           (e: Error) => reply({ t: "task", ok: false, error: e.message }),
         );
@@ -6393,7 +6702,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // After a crash that recorded Pi, crash recovery starts it (#66): its recorded session first, a fresh one if that fails.
   const piRecovered = !archivedPiContinuity && !!crashed?.peers.some((p) => definitionOf(p.peer)?.session.restoreOnStart);
   if (piAutoStart() && !recoveryActive() && !piRecovered) autoStartPi();
-  return { bus, token, port: server.port as number, bandEvaluations: () => bandEvaluations, stop, stopped: new Promise<void>((r) => (onStop = r)) };
+  return { bus, token, port: server.port as number, bandEvaluations: () => bandEvaluations, sdlcFileReads: () => sdlcFileReads, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { await cleanup(); } catch { /* preserve startup error */ } }
   }