@staix/agent-hub 0.17.0 → 0.18.0

package/src/hub/tasks.ts

@@ -13,7 +13,9 @@ import { VERSION } from "../version.ts";
 import { NoWriteTurns } from "./no-writes.ts";
 import { readGitHubImport, type GitHubSource, type GitHubImportSelection } from "./github-import.ts";
 import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS, actualTaskDates, planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
-import { readMergeQueue } from "./sdlc-queue.ts";
+import { readMergeQueue, type DeliveryTask } from "./sdlc-queue.ts";
+import { guardedMerge, mergeModeFor, mergeView, type MergeView } from "./sdlc-merge.ts";
+import { mirrorVerdict as mirrorToGitHub, type MirrorVerdict } from "./sdlc-mirror.ts";
 import { DEFAULT_MAX_NITS, parseReviewFindings, findingsForHead, findingHead as resolveFindingHead, findingTally, type ReviewFinding, type ReviewFindingSet } from "./review-findings.ts";
 import { readReleaseReadiness } from "./sdlc-release.ts";
 import { loadRoleCatalog, taskRole, taskRoleText, type RoleCatalog } from "./roles.ts";
@@ -44,7 +46,7 @@ import { coverageGap, renderReviewBrief, type ReviewBrief } from "./review-brief
 import { definitionOf as builtinDefinitionOf } from "../adapters/registry.ts";
 import { ADAPTERS, DEFAULT_REVIEW_POOL, definitionOf, familyOf, type ProjectAdapterCatalog } from "../adapters/registry.ts";
 import { plannerGrooming, nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
-import { planningIssueReceipt, linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
+import { planningIssueReceipt, linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type MergeRecord, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
 
 export type TaskAssignmentRole = "owner" | "reviewer" | "planner";
 
@@ -130,7 +132,7 @@ export interface TasksDeps {
   /** Optional persisted task/run execution limits (issue #102). */
   executionBudget?: ExecutionBudget;
   /** Reviewer choice from recorded review outcomes (issue #35); off unless the project config turns it on. */
-  review?: { adaptive: boolean; min_reviews: number; pool?: readonly string[]; rerotate?: boolean };
+  review?: { adaptive: boolean; min_reviews: number; pool?: readonly string[]; rerotate?: boolean; same_family?: "fallback" | "never" };
   /** Peers whose recent deliveries all failed, with the reason (issue #89); routing skips them. */
   capabilities?: () => Record<PeerId, PeerCapabilities>;
   repository?: string;
@@ -790,7 +792,7 @@ export class Tasks {
     const held = this.d.held?.();
     const workload = this.instanceRouting();
     const peers = workload.instances ? [...new Set([...(this.d.adapterCatalog?.definitions ?? ADAPTERS).map(adapter => adapter.kind), ...Object.keys(workload.instances), ...this.d.bus.peers.keys()])] : (this.d.adapterCatalog?.definitions ?? ADAPTERS).map(adapter => adapter.kind);
-    return { ...workload, reviewPool: { pool: this.d.review?.pool ?? DEFAULT_REVIEW_POOL, rerotate: this.d.review?.rerotate, required: this.d.review?.pool !== undefined }, ...(this.d.capabilities ? { capabilities: this.d.capabilities(), repository: this.d.repository } : {}), pullOnly: [...this.d.bus.peers.values()].filter(peer => (this.d.adapterCatalog?.definitionOf ?? definitionOf)(peer.id, workload.instances)?.attach?.pullOnlyForms?.length && peer.pullOnly).map(peer => peer.id), offRoster: peers.filter(peer => !this.d.bus.isRostered(peer)), ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
+    return { ...workload, reviewPool: { pool: this.d.review?.pool ?? DEFAULT_REVIEW_POOL, rerotate: this.d.review?.rerotate, required: this.d.review?.pool !== undefined, ...(this.d.review?.same_family === "never" ? { sameFamily: "never" as const } : {}) }, ...(this.d.capabilities ? { capabilities: this.d.capabilities(), repository: this.d.repository } : {}), pullOnly: [...this.d.bus.peers.values()].filter(peer => (this.d.adapterCatalog?.definitionOf ?? definitionOf)(peer.id, workload.instances)?.attach?.pullOnlyForms?.length && peer.pullOnly).map(peer => peer.id), offRoster: peers.filter(peer => !this.d.bus.isRostered(peer)), ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
   }
 
   private reviewHead(task: Task): string | undefined { return task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead; }
@@ -799,7 +801,7 @@ export class Tasks {
     const head = this.reviewHead(task);
     const round = task.state === "in_review" ? task.history.slice(task.history.findLastIndex(entry => entry.event === "done") + 1) : [];
     const failed = [...new Set(round.flatMap(entry => entry.reviewerFailure?.head === head && entry.reviewerFailure ? [entry.reviewerFailure.peer] : []))];
-    return { pool: this.d.review?.pool ?? DEFAULT_REVIEW_POOL, rerotate: this.d.review?.rerotate, failed, required: this.d.review?.pool !== undefined };
+    return { pool: this.d.review?.pool ?? DEFAULT_REVIEW_POOL, rerotate: this.d.review?.rerotate, failed, required: this.d.review?.pool !== undefined, ...(this.d.review?.same_family === "never" ? { sameFamily: "never" as const } : {}) };
   }
 
   private manuallyNamedReviewer(task: Task): boolean {
@@ -948,10 +950,31 @@ export class Tasks {
     return task.planner && holders.includes(task.planner) && this.d.bus.isRostered(task.planner) ? [task.planner] : holders;
   }
 
+  /** Current planner rulings amend review context, never person-only plan-departure acceptance. */
+  plannerRulings(task: Task, recipient: PeerId): { historyIndex: number; by: PeerId; at: number; note: string }[] {
+    if (this.isPii(task)) return [];
+    const boundary = task.history.findLastIndex(entry => entry.event === "accepted" || entry.event === "claimed");
+    if (boundary < 0) return [];
+    const planners = new Set(this.taskPlanner(task));
+    const rulings: { historyIndex: number; by: PeerId; at: number; note: string }[] = [];
+    for (let historyIndex = boundary + 1; historyIndex < task.history.length && rulings.length < 5; historyIndex++) {
+      const entry = task.history[historyIndex]!;
+      if (entry.event !== "plan reviewed" || !planners.has(entry.by) || !this.d.roles?.[entry.by]?.includes("planner")
+        || typeof entry.note !== "string" || !entry.note.trim() || !Number.isFinite(entry.at)) continue;
+      // Screen the entire original note before the display bound, including a sensitive suffix past 1000 characters.
+      const note = sanitize(this.screen(task, entry.note, "planner ruling", recipient, entry.withheld)).slice(0, 1000);
+      rulings.push({ historyIndex, by: entry.by, at: entry.at, note });
+    }
+    return rulings;
+  }
+
   private planningAuthority(by: PeerId, task?: Pick<Task, "planner">): void {
     if (by !== USER && (!this.d.roles?.[by]?.includes("planner") || task !== undefined && !this.taskPlanner(task).includes(by))) throw new PreEffectToolRefusal(`planning requires a person or configured planner role${task ? "; only the task's effective planner may act" : ""}`);
   }
 
+  /** #812 AC5: a peer holding the configured planner role. The conductor's task reads accept it; it grants no write. */
+  isConfiguredPlanner(peer: PeerId): boolean { return peer !== USER && peer !== HUB && !!this.d.roles?.[peer]?.includes("planner"); }
+
   private plannerWriteAuthority(by: PeerId, task?: Pick<Task, "planner">): void {
     if (by !== USER && this.d.privateTurn?.(by)) throw new PreEffectToolRefusal("planner writes are unavailable during a private turn");
     this.planningAuthority(by, task);
@@ -1015,6 +1038,14 @@ export class Tasks {
   wip(peer: PeerId, except?: number): number {
     return this.d.board.plannerWip(peer, except);
   }
+  /** #784 AC3: the read-only breakdown of `wip` for status, the console and the dashboard: one grouped query for every peer. Admission still reads `wip()`. */
+  wipBreakdown(peers: readonly PeerId[]): Record<string, { wip: number; active: number; reviewWait: number; reserved: number; wipLimit: number }> {
+    const grouped = this.d.board.plannerWipBreakdown();
+    return Object.fromEntries(peers.map(peer => {
+      const row = grouped[peer] ?? { active: 0, reviewWait: 0, reserved: 0 };
+      return [peer, { wip: row.active + row.reviewWait + row.reserved, ...row, wipLimit: this.wipLimit(peer) }];
+    }));
+  }
   private prerequisiteOf(task: Task, prerequisite: number): boolean {
     const pending = [...(task.deps ?? [])], seen = new Set<number>();
     while (pending.length) { const id = pending.pop()!; if (id === prerequisite) return true; if (seen.has(id)) continue; seen.add(id); pending.push(...(this.d.board.get(id)?.deps ?? [])); }
@@ -2202,12 +2233,14 @@ export class Tasks {
   }
 
   /** `override`: a person's explicit assign, which past refusals do not block and which drops an agent's reservation (#207). */
-  private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; namedOwner?: PeerId; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean; roster?: boolean; planner?: boolean; expectedFlowRevision?: number; refuseNamed?: "pre" | "plain"; plannerPull?: { revision: number; note: string; withheld: boolean; guard: () => void } } = {}): Promise<Task> {
+  private async assignOwner(task: Task, by: PeerId, opts: { current?: () => void; candidates?: PeerId[]; namedOwner?: PeerId; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean; roster?: boolean; planner?: boolean; expectedFlowRevision?: number; refuseNamed?: "pre" | "plain"; plannerPull?: { revision: number; note: string; withheld: boolean; guard: () => void } } = {}): Promise<Task> {
+    opts.current?.();
     if (task.state === "backlog" && !opts.plannerPull) throw new PreEffectToolRefusal(`task #${task.id}: pull backlog work before assigning it`);
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
     let stagedClaimGap: string | undefined;
     if (mode !== "off" && this.isBuildTask(task)) {
       const gap = task.sdlc?.planReview ? await this.planReviewGap(task) : "plan not reviewed since proposal";
+      opts.current?.();
       const current = this.d.board.get(task.id);
       if (!current || !this.ownerAssignmentCurrent(task, current)) {
         if (opts.plannerPull) throw new PreEffectToolRefusal("planner pull changed during admission");
@@ -2263,6 +2296,7 @@ export class Tasks {
     const assignmentNote = this.assignmentNote(`${opts.note ?? `to ${a.owner}`}${passed}`, a);
     const binding = this.plannerBinding(task, a, !!opts.plannerPull);
     const assignmentExtra = { ...this.reviewMetadata(a), ...(binding ? { plannerReason: binding.plannerReason } : {}), ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) };
+    opts.current?.();
     const next = opts.plannerPull
       ? this.d.board.pullAssigned(task.id, by, a.owner, opts.plannerPull.revision, opts.plannerPull.note, opts.plannerPull.withheld, a.reviewer ?? null, assignmentNote, assignmentExtra, task.history.length, binding)
       : this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(binding ? { planner: binding.planner } : {}), ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, assignmentNote, assignmentExtra, opts.expectedFlowRevision);
@@ -2280,6 +2314,7 @@ export class Tasks {
     // The cohort record formed just below reads it, and so does `route explain` while that turn lasts.
     if (opts.claim && a.owner === by && this.d.bus.peers.get(by)?.state === "busy") this.sent.set(handOver(next, by), by);
     try {
+      opts.current?.();
       if (opts.plannerPull && task.offer) {
         const prior = { ...task, owner: task.offer.owner };
         this.withdrawRoleRequest(prior, next, "owner");
@@ -2293,7 +2328,7 @@ export class Tasks {
         this.tellEarlierOwners(next, hits);
       }
       this.announceRouting(next, a);
-      if (!opts.claim || a.owner !== by) await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits), opts.contextWithheld);
+      if (!opts.claim || a.owner !== by) await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits), opts.contextWithheld, opts.current);
     } catch (e) {
       // Everything between the write and the end of the delivery is in here: the move is fact, and a failure is a
       // delivery failure (#297). The one console notice is printed here, once, for every caller; callers decide
@@ -2371,8 +2406,10 @@ export class Tasks {
   }
 
   /** `contextWithheld`: the PII screen did not clear a budget hand-off (#198); an escalation's reason is the hub's own words. */
-  private async sendTask(task: Task, a: Assignment, context?: string, overlap = "", contextWithheld = false): Promise<void> {
+  private async sendTask(task: Task, a: Assignment, context?: string, overlap = "", contextWithheld = false, currentAuthority?: () => void): Promise<void> {
+    currentAuthority?.();
     const brief = this.isPii(task) ? undefined : await this.d.briefs?.forTask(task.owner!, task, this.planGuardItems(task)).catch(() => undefined);
+    currentAuthority?.();
     const current = this.d.board.get(task.id);
     if (!current || !this.ownerAssignmentCurrent(task, current)) throw new AssignmentSupersededError(current ?? task);
     task = current;
@@ -2402,7 +2439,9 @@ export class Tasks {
     const owner = task.owner!;
     const idle = this.d.bus.stateOf(owner) === "idle";
     const env = newEnvelope(HUB, body, { to: [owner], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id), taskRecipient: "owner", taskOffer: task.history.length }, ...(pii ? { private: true } : {}) });
+    currentAuthority?.();
     this.d.board.recordTaskOffer(task.id, { envelopeId: env.id, owner, assignmentFlowRevision: task.history.length, ...(this.d.offerPullOnly ? { pullOnly: this.d.offerPullOnly(owner) } : {}) }, task.history.length);
+    currentAuthority?.();
     this.d.bus.publish(env);
     if (idle && this.d.bus.stateOf(owner) === "busy" && !this.d.bus.queueIds(owner).includes(env.id)) this.sent.set(handOver(task, owner), owner);
   }
@@ -2562,7 +2601,8 @@ export class Tasks {
       if (by !== USER) {
         this.planningAuthority(by, task);
         const proposer = task.history.find(h => h.event === "proposed" || h.event === "backlogged")?.by;
-        if (proposer !== by || !["backlog", "proposed"].includes(task.state) || taskHasStarted(task)) throw new PreEffectToolRefusal("planner may cancel only its own historically unaccepted backlog or proposed work");
+        // #812 AC5: back in proposed or backlog with no execution evidence (the `hub_backlog_return_untouched` test: no branch, commit, PR, local check, done, verdict or reopen), an accepted-then-declined task is cancellable; any such evidence keeps today's refusal.
+        if (proposer !== by || !["backlog", "proposed"].includes(task.state) || taskHasWorkEvidence(task)) throw new PreEffectToolRefusal("planner may cancel only its own historically unaccepted backlog or proposed work");
       }
       return task;
     };
@@ -3052,10 +3092,15 @@ export class Tasks {
     return this.d.board.update(task.id, by, "lifecycle", { sdlc: next }, undefined, { ...this.planObservation({ ...task, sdlc: next }), ...(invalidatesDeparture ? { planDepartureInvalidated: true } : {}), ...(deliverables ? { deliverables } : {}) });
   }
 
+  /** The board as the merge queue and the guarded merge read it (#786): ids, dependencies, privacy, receipts, findings and plans. */
+  private deliveryLinks(config: SdlcConfig): DeliveryTask[] {
+    return this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t), findings: this.isPii(t) ? undefined : this.reviewFindingSets(t), plan: config.mode === "off" || this.isPii(t) ? undefined : { paths: this.planPaths(t), revision: t.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(t.plan ?? {}), accepted: this.validPlanDepartures(t) } }));
+  }
+
   async deliveryQueue(repo: string) {
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     const before = workflowHash(this.d.board.list().map(t => ({ id: t.id, state: t.state, after: t.deps, sdlc: t.sdlc, history: t.history.length })));
-    const links = this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t), findings: this.isPii(t) ? undefined : this.reviewFindingSets(t), plan: config.mode === "off" || this.isPii(t) ? undefined : { paths: this.planPaths(t), revision: t.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(t.plan ?? {}), accepted: this.validPlanDepartures(t) } }));
+    const links = this.deliveryLinks(config);
     const report = await readMergeQueue(repo, config, links, this.d.sdlc?.gh, this.publicMetadataText);
     // Policy can change across remote awaits without any board write. Never return its stale public projection.
     const currentPrivacy = this.d.board.list().map(task => ({ id: task.id, private: this.isPii(task) }));
@@ -3081,6 +3126,150 @@ export class Tasks {
     }
     return report;
   }
+  private readonly mergesInFlight = new Set<number>();
+  /** #786: who may ask for a guarded merge. The hub's own approval trigger acts as HUB; a peer must be the one configured conductor. */
+  private mergeAuthority(by: PeerId): boolean {
+    if (by === USER || by === HUB) return true;
+    const holders = Object.entries(this.d.roles ?? {}).filter(([, roles]) => Array.isArray(roles) && roles.includes("conductor")).map(([actor]) => actor);
+    return holders.length === 1 && holders[0] === by;
+  }
+  /**
+   * #786 T1/T2: the guarded merge of one approved task. `sdlc.auto_merge` (or the repository's table) says whether it only reports (`dry-run`) or acts (`on`);
+   * `opts.dryRun` forces a report. Every gate is re-read right now (`sdlc-merge.ts`); this method owns authority, privacy and the notices, which name the task
+   * and the gates only (a PII task shows its stub and is never merged by the hub). Off/dry-run write nothing to the board; on-mode records gate refusals
+   * and post-run host observations, claiming eligible post-MERGED remote cleanup and owner notices durably.
+   */
+  async guardedMerge(by: PeerId, id: unknown, opts: { dryRun?: boolean; trigger?: "review" | "command" } = {}): Promise<{ task: number } & MergeView> {
+    if (!this.mergeAuthority(by)) throw new Error("only the console user or the configured conductor may merge");
+    const task = this.need(id), label = `#${task.id}`;   // the number only: a notice about a merge never carries a title (a PII task has none to show)
+    const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    const mode = opts.dryRun ? "dry-run" as const : mergeModeFor(config, task.sdlc?.repo);
+    const refuse = (gate: string) => {
+      if(mode==="on")this.recordMergeRefusal(task.id,by,[gate]);
+      return { task: task.id, ...mergeView({ mode, decision: { refused: [gate] }, ran: false }) };
+    };
+    if (this.isPii(task)) return refuse("private task: a person merges");
+    if (mode === "off") return refuse("auto_merge is off for this repository");
+    if (this.mergesInFlight.has(task.id)) return refuse("a merge check for this task is already running");
+    const previous=task.sdlc?.merge;
+    if(previous && !(opts.trigger==="command" && previous.state==="not_merged") && previous.repo===task.sdlc?.repo && previous.pr===task.sdlc.pr && previous.head===task.sdlc.reviewedHead)
+      return refuse("merge attempt already recorded: inspect its result and any uncertain cleanup before acting");
+    // Ephemeral identity excludes merge progress so our own durable writes cannot rebind the observation.
+    const artifactIdentity=(row:Task)=>JSON.stringify([row.sdlc?.repo,row.sdlc?.pr,row.sdlc?.issue,row.sdlc?.head,row.sdlc?.reviewedHead,row.sdlc?.localHead,row.refs.repo,row.refs.commit]);
+    const initialArtifact=artifactIdentity(task);
+    const artifactCurrent=()=>{const row=this.d.board.get(task.id);return !!row && artifactIdentity(row)===initialArtifact;};
+    this.mergesInFlight.add(task.id);
+    try {
+      const links = this.deliveryLinks(config), subject = links.find(link => link.id === task.id)!;
+      const queueIdentity = workflowHash({ config, links });
+      const outcome = await guardedMerge({ mode, subject, state: task.state, taskState: n => this.d.board.get(n)?.state, config, tasks: links, run: this.d.sdlc?.gh ?? sdlcGh, readableMetadata: this.publicMetadataText,
+        recordMerge: record=>this.recordMergeResult(task.id,by,record,artifactCurrent),
+        beforeMerge: () => {
+          if (!this.mergeAuthority(by)) return "merge authority changed during the merge check: nothing was run";
+          // The queue used every link, not only the subject. A changed dependency artifact or ordering edge invalidates that remote evidence.
+          const currentConfig = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+          return workflowHash({ config: currentConfig, links: this.deliveryLinks(currentConfig) }) === queueIdentity
+            ? undefined : "merge queue inputs changed during the merge check: nothing was run";
+        },
+        // Read synchronously at dispatch, after the last PR read: the task (state, receipt, privacy, dependencies, findings), the configuration and mode in force, and whether
+        // the asker may still act and the hub may still write. Nothing is awaited between this read and the gh call.
+        fresh: () => {
+          const now = this.d.board.get(task.id), cfg = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+          const current = now && this.deliveryLinks(cfg).find(link => link.id === now.id);
+          return now && current ? { subject: current, state: now.state, config: cfg, mode: opts.dryRun ? "dry-run" : mergeModeFor(cfg, now.sdlc?.repo), allowed: this.mergeAuthority(by) && !this.d.bus.isRecoveryHeld && !this.d.bus.storageError } : undefined;
+        } });
+      if(mode==="on" && !outcome.ran && "refused" in outcome.decision)this.recordMergeRefusal(task.id,by,outcome.decision.refused);
+      if(outcome.result?.state==="merged") {
+        try {this.mergeOwnerNotice(task.id,by,artifactCurrent);} catch {this.releaseNotice(`task ${label}: merge owner notice unconfirmed`);}
+      }
+      const view = mergeView(outcome);
+      const head = (text?: string) => text ? text.slice(0, 8) : "unknown";
+      if (outcome.result && (this.isPii(this.d.board.get(task.id) ?? task) || this.d.privateTurn?.(by))) this.releaseNotice(`task ${label}: merge result withheld`);
+      else if (outcome.result) this.releaseNotice(outcome.result.state === "merged" ? `task ${label}: merged (squash, commit ${head(outcome.result.mergeCommit)})` : `task ${label}: gh pr merge exited ${outcome.result.exit}; GitHub reports it ${outcome.result.state === "unknown" ? "unreadable" : "not merged"}`);
+      else if (opts.trigger === "review") this.releaseNotice("action" in outcome.decision ? `task ${label}: auto-merge dry-run: would merge at ${head(outcome.decision.head)}` : `task ${label}: auto-merge refused: ${outcome.decision.refused.join("; ")}`);
+      return { task: task.id, ...view };
+    } finally { this.mergesInFlight.delete(task.id); }
+  }
+  private recordMergeRefusal(id:number,by:PeerId,gates:string[]):void {
+    const current=this.d.board.get(id);
+    if(!current)return;
+    const note=JSON.stringify({gates:gates.slice(0,32).map(g=>this.publicMetadataText(g)?g.slice(0,256):"merge gate withheld")});
+    if(!current.history.some(h=>h.by===HUB && h.event==="merge refused" && h.note===note))
+      this.d.board.update(id,HUB,"merge refused",{},note,{...(this.isPii(current)||this.d.privateTurn?.(by)?{withheld:true}:{})});
+  }
+  private mergeRecordCurrent(id:number,by:PeerId,record:MergeRecord,artifactCurrent:()=>boolean):Task|undefined {
+    const now=this.d.board.get(id);
+    return artifactCurrent() && now && now.sdlc?.repo===record.repo && now.sdlc.pr===record.pr && now.sdlc.reviewedHead===record.head
+      && now.state==="approved" && !this.isPii(now) && !this.d.privateTurn?.(by) && this.mergeAuthority(by)
+      && !this.d.bus.isRecoveryHeld && !this.d.bus.storageError ? now : undefined;
+  }
+  /** Save host facts without ever rebinding an old result to a replacement artifact. */
+  private recordMergeResult(id: number, by: PeerId, record: MergeRecord,artifactCurrent:()=>boolean): boolean {
+    const now=this.d.board.get(id);
+    if(!now)return false;
+    const allowed=this.mergeRecordCurrent(id,by,record,artifactCurrent)!==undefined;
+    // A bounded old-attempt fact remains history even after a relink or privacy/authority change. No remote prose or branch name is retained.
+    const note=JSON.stringify(record);
+    if(allowed) {
+      if(JSON.stringify(now.sdlc!.merge)!==note)this.d.board.update(id,HUB,"merge result",{sdlc:{...now.sdlc!,merge:record}},note);
+    } else if(!now.history.some(h=>h.by===HUB && h.event==="merge result (detached)" && h.note===note)) {
+      this.d.board.update(id,HUB,"merge result (detached)",{},note,{...(this.isPii(now)||this.d.privateTurn?.(by)?{withheld:true}:{})});
+    }
+    // Board observers run synchronously. A claim write can itself revoke authority, privacy or artifact identity.
+    return this.mergeRecordCurrent(id,by,record,artifactCurrent)!==undefined && JSON.stringify(this.d.board.get(id)?.sdlc?.merge)===note;
+  }
+
+  /** Claim before publishing: a lost acknowledgement remains unknown and is never automatically sent twice. */
+  private mergeOwnerNotice(id:number,by:PeerId,artifactCurrent:()=>boolean):void {
+    const task=this.d.board.get(id),record=task?.sdlc?.merge;
+    if(!task || !record || record.state!=="merged" || !record.mergeCommit || record.ownerNotice!=="not_started")return;
+    const claimed:MergeRecord={...record,ownerNotice:"claimed"};
+    if(!this.recordMergeResult(id,by,claimed,artifactCurrent))return;
+    const current=this.mergeRecordCurrent(id,by,claimed,artifactCurrent);
+    if(!current)return;
+    const view=this.publicView(current);
+    if(view.title==="[pii]")return;
+    const owner=typeof view.owner==="string"?view.owner:undefined;
+    const body=`Task #${id}: GitHub reports the PR merged (commit ${record.mergeCommit.slice(0,8)}). Remote branch cleanup: ${record.cleanup}. Remove your local worktree and local branch when safe; the hub leaves them in place.`;
+    // Public projection and a synchronous claim observer must not let stale owner text escape.
+    const last=this.mergeRecordCurrent(id,by,claimed,artifactCurrent);
+    if(!last || (last.owner??undefined)!==owner)return;
+    let sent=false;
+    try {
+      if(owner && owner!==USER)sent=this.d.bus.publish(newEnvelope(HUB,body,{to:[owner],kind:"task",refs:{task:String(id),taskRecipient:"owner"}})).includes(owner);
+      else {this.d.notify(body);sent=true;}
+    } catch { /* The durable claim keeps an uncertain publication from being repeated. */ }
+    this.recordMergeResult(id,by,{...claimed,ownerNotice:sent?"sent":"unknown"},artifactCurrent);
+  }
+  /**
+   * #786 T3 (AC1): mirror a saved verdict as ONE `COMMENT` review on the head it was given for (`sdlc-mirror.ts`). Gated by the same `auto_merge` setting as the merge: off posts
+   * nothing, dry-run only reports, on posts. Never awaited by the verdict and never throws: the returned promise always resolves, and a failure is a notice naming the task number.
+   * The note goes out only when it is public: not a PII task, not withheld by the review screen, not in a private turn and matching no private pattern; otherwise the review is its headline alone.
+   */
+  private mirrorVerdict(task: Task, by: PeerId, verdict: MirrorVerdict, head: string | undefined, note: string | undefined, withheld: boolean): Promise<void> {
+    try {
+      const repo = task.sdlc?.repo, pr = task.sdlc?.pr;
+      if (!repo || !pr || !head) return Promise.resolve();
+      const mode = mergeModeFor(this.d.sdlc?.config() ?? sdlcConfig(undefined), repo);
+      if (mode === "off") return Promise.resolve();
+      const text = note && !withheld && !this.isPii(task) && !this.d.privateTurn?.(by) && this.publicMetadataText(note) ? note : undefined;
+      const label = `#${task.id}`;
+      return Promise.resolve().then(() => mirrorToGitHub({ repo, pr, head, verdict, task: task.id, reviewer: by, ...(text !== undefined ? { note: text } : {}), mode, run: this.d.sdlc?.gh ?? sdlcGh })).then(out => {
+        if (out.reason === "posted") this.releaseNotice(`task ${label}: ${verdict} mirrored to GitHub as a comment review`);
+        else if (out.reason === "post failed") this.releaseNotice(`task ${label}: verdict mirror could not be posted`);
+        else if (out.reason === "dry-run") this.releaseNotice(`task ${label}: verdict mirror dry-run: would post one ${verdict} comment review at ${head.slice(0, 8)}`);
+      }).catch(() => this.releaseNotice(`task ${label}: verdict mirror unavailable`));
+    } catch { return Promise.resolve(); }
+  }
+  /** After an approving verdict, never blocking or failing it: the check runs on a later tick and reports through a notice. `after` (the verdict mirror) settles first, so the review lands before the PR can merge. */
+  private autoMerge(task: Task, after?: Promise<void>): void {
+    try {
+      if (!task.sdlc?.repo || !task.sdlc.pr || mergeModeFor(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc.repo) === "off") return;
+      const label = `#${task.id}`;
+      // Promise.resolve().then also catches a synchronous throw, which would otherwise escape a microtask.
+      void Promise.resolve(after).then(() => this.guardedMerge(HUB, task.id, { trigger: "review" })).catch(() => this.releaseNotice(`task ${label}: auto-merge check unavailable`));
+    } catch { /* an approval never fails because of the merge check */ }
+  }
   async releaseReadiness(repo: string, liveIssues: number[]) {
     const report = await readReleaseReadiness(this.d.cwd, repo, liveIssues, { gh: this.d.sdlc?.gh });
     if (report.documents) report.documents.documents = report.documents.documents.map(d => {
@@ -4006,6 +4195,21 @@ export class Tasks {
     return admitted;
   }
 
+  /**
+   * #824: one `Hub-verified at <head>` line from the review admission, for every reviewer. Ready: the required checks that passed at this exact head (and an identical-tree run when the hub
+   * reused one) and that no bot review thread is waiting for a reply (the readiness rule: an unresolved thread a person already answered does not block, so the line says exactly that). Not ready (advise mode sends anyway): its blockers. No admission (sdlc off, or a request sent without one) and a PII task: no block, the
+   * admission of a PII task being only a stub. Every word comes from the hub's own readiness read; blockers are fixed hub strings, never PR text.
+   */
+  private hubVerifiedBlock(task: Task, admission?: ReviewReadiness): string {
+    if (!admission || this.isPii(task)) return "";
+    const head = admission.head ?? this.reviewHead(task) ?? "unknown head";
+    if (admission.ready) {
+      const names = admission.checks?.length ? admission.checks.join(", ") : "the required checks";
+      return `Hub-verified at ${head}: required checks ${names} passed at this exact head${admission.reusedRun !== undefined ? ` via identical-tree run ${admission.reusedRun}` : ""}; no bot review thread is waiting for a reply.\n`;
+    }
+    return `Hub-verified at ${head}: not ready: ${admission.blockers.join("; ")}.\n`;
+  }
+
   private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): boolean {
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
     if (mode === "enforce" && !admission?.ready) {
@@ -4030,7 +4234,12 @@ export class Tasks {
       : profile.name === "general"
         ? "No check ran for this class: verify the outcome yourself."
         : "No check ran for this class: run the affected tests yourself.";
-    const checkResult = check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : noCheckWording;
+    // #824: the hub's own exact-head CI evidence, from the admission this request already carries (no new gh call). Nothing here comes from the builder's summary or a recorded claim.
+    const verified = this.hubVerifiedBlock(task, admission);
+    const ciPassed = admission?.ready === true && !this.isPii(task);
+    const checkResult = check ? `Check result: ${(check.note ?? "").split("\n")[0]}`
+      : ciPassed ? "CI passed at this exact head (see the Hub-verified line above); do not list test execution or CI evidence as unmet: name the specific missing test or behaviour instead."
+      : noCheckWording;
     const checklistTemplates = profile.review_checklist ?? [
       "Map the changed signatures and call sites to {target}, and name each one that does not match.",
       "{check}",
@@ -4051,10 +4260,16 @@ export class Tasks {
       ? ["Deliverables (the hub hashed these files when the task was done; approval binds these hashes):",
         ...delivered.map(d => `- ${d.id}: ${d.path ?? "(path withheld)"} [${d.format}${d.version ? ` ${d.version}` : ""}] sha256 ${d.sha256.slice(0, 16)}, ${d.bytes} bytes`)].join("\n") + "\n"
       : "";
+    const rulings = this.plannerRulings(task, reviewer);
+    const rulingsBlock = rulings.length ? rulings.map(ruling => [
+      `Planner rulings (recorded by the configured planner ${ruling.by}; they amend the plan for this review):`,
+      `- ${new Date(ruling.at).toISOString()}: ${ruling.note.replace(/[\r\n]+/g, " ")}`,
+    ].join("\n")).join("\n") + "\n" : "";
     const checklist = deliverablesBlock + criteriaBlock + [
       "Checklist:",
       ...this.planGuardItems(task).map(item => `- Check the plan against this live fail before the remaining checks: ${item.line}`),
       ...checklistLines.map(line => `- ${line}`),
+      ...(rulings.length ? ["- a departure a listed ruling names is not an unmet item by itself; judge its code."] : []),
     ].join("\n");
     // #223 R2: a reviewer-only instance judges from facts; the builder's narrative stays out, earlier findings go in.
     const reviewOnly = this.d.reviewOnly?.(reviewer) === true;
@@ -4072,7 +4287,7 @@ export class Tasks {
     const brief = this.briefText(task);
     // #572 AC3: advisory only, from git state never from task text, so it is safe for a PII task too.
     const checkout = mainCheckoutWarning(this.d.cwd, this.publicMetadataText);
-    const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${carriedText}${conformanceText}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet, findings: [{id, pass: "bugs" | "security" | "compliance", severity: "important" | "nit", path?, disposition: "open" | "fixed" | "false_positive"}]}. Reuse finding ids when updating their disposition; only the person may accept a finding with a rationale.`;
+    const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${carriedText}${conformanceText}${rulingsBlock}${verified}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet, findings: [{id, pass: "bugs" | "security" | "compliance", severity: "important" | "nit", path?, disposition: "open" | "fixed" | "false_positive"}]}. Reuse finding ids when updating their disposition; only the person may accept a finding with a rationale.`;
     return this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) })).includes(reviewer);
   }
 
@@ -4332,11 +4547,13 @@ export class Tasks {
       this.releaseNotice(`task ${this.publicTitle(next)}: could not tell ${next.owner ?? "its owner"} it was approved`, () =>
         this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner, withheld)}` : ""}`, pii));
       await this.releaseDependents(next);
+      this.autoMerge(next, this.mirrorVerdict(next, by, "approved", reviewedHead ?? next.sdlc?.reviewedHead, note, withheld));
       // A proposal storage failure cannot roll back the saved verdict; another matching verdict retries it.
       this.releaseNotice(`task #${next.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(next, by, parsed, withheld));
       return next;
     }
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note, flag);
+    void this.mirrorVerdict(rejected, by, "changes_requested", reviewedHead ?? rejected.sdlc?.reviewedHead, note, withheld);
     this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));
     if (candidate && !pii && !this.d.privateTurn?.(by) && this.candidateTextAllowed(JSON.stringify({ candidate, refs: rejected.refs, plan: rejected.plan }), rejected)) {
       try { this.d.memoryCheck?.(); this.d.candidates?.put({ ...candidate, evidenceRefs: [...candidate.evidenceRefs, `review:${rejected.id}:${rejected.history.length}`] }, "public"); } catch { /* a saved review remains authoritative if the optional sidecar fails */ }
@@ -4531,17 +4748,20 @@ export class Tasks {
   }
 
   /** A roster removal offers work through the quota relay's constraints, preserving assignments nobody can take. */
-  async reassignForRoster(peer: PeerId): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
-    return this.reassignWork(peer, undefined, false, true);
+  async reassignForRoster(peer: PeerId, current?: () => void): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+    return this.reassignWork(peer, undefined, false, true, current);
   }
 
-  private async reassignWork(peer: PeerId, context: string | undefined, urgentOnly: boolean, roster: boolean): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+  private async reassignWork(peer: PeerId, context: string | undefined, urgentOnly: boolean, roster: boolean, current?: () => void): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+    current?.();
     const moved: { id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[] = [];
     const routing = this.d.routing(), why = roster ? `roster removal of ${peer}` : `budget pause of ${peer}`;
     // Budget context is screened exactly as before; a roster removal supplies no agent-written context.
     const moves = (t: Task) => (!urgentOnly || t.signals.includes("urgent")) && t.owner === peer && OPEN.includes(t.state);
     const contextWithheld = context && this.d.board.list().some((t) => moves(t) && !this.isPii(t)) ? await this.withholds("handoff", context) : false;
+    current?.();
     for (const task of this.d.board.list()) {
+      current?.();
       if (urgentOnly && !task.signals.includes("urgent")) continue;
       if (task.owner === peer && (OPEN.includes(task.state) || roster && task.state === "in_review")) {
         const pii = this.isPii(task);
@@ -4552,19 +4772,22 @@ export class Tasks {
         const back = !roster && task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, why) : task;
         let next: Task;
         try {
-          next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", reason: roster ? "manual" : "budget", note: why, ...(roster ? { roster: true } : { clearOnFail: true }), ...(context ? { context, contextWithheld } : {}) });
+          next = await this.assignOwner(back, HUB, { current, candidates, exclude: [peer], event: "reassigned", reason: roster ? "manual" : "budget", note: why, ...(roster ? { roster: true } : { clearOnFail: true }), ...(context ? { context, contextWithheld } : {}) });
         } catch (e) {
           // The move is saved and its central #297 notice already spoke; relay the
           // remaining tasks and run the roster tail on the saved row as on success.
           if (!(e instanceof AssignmentUndeliveredError)) throw e;
           next = e.task;
         }
+        // A saved assignment failure is retained, but never permits a revoked initiating operation to continue.
+        current?.();
         if (!this.ownOwnerMove(back, next, HUB, "reassigned") && !this.ownOwnerMove(back, next, HUB, "unassigned")) continue;
         if (roster) {
           if (!next.owner || next.owner === peer) continue;
           this.releaseNotice(`task ${this.publicTitle(next)} moved from ${peer} to ${next.owner} (off roster)`);
           if (next.state === "in_review" && next.reviewer && next.reviewer !== task.reviewer && next.reviewer !== USER) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${next.reviewer}`, () => this.sendReview(next, next.reviewer!, `(${peer} owned this and is off roster.)`));
         }
+        current?.();
         moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner, role: "owner" });
       } else if (task.reviewer === peer && !isClosedTaskState(task.state)) {
         const a = assign(task, this.states(), routing, { exclude: [peer], candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), ...this.weights(task.class, task) });
@@ -4573,8 +4796,10 @@ export class Tasks {
           this.releaseNotice(`task ${this.publicTitle(task)}: its reviewer ${peer} is off roster and nobody else can review; the reviewer stays ${peer}; use ahub review ${task.id}`);
           continue;
         }
+        current?.();
         const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, this.assignmentNote(why, a), this.reviewMetadata(a));
         moved.push({ id: task.id, title: this.publicTitle(task), to: reviewer, role: "reviewer" });
+        current?.();
         if (next.state === "in_review" && reviewer && reviewer !== USER) {
           if (roster) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${reviewer}`, () => this.sendReview(next, reviewer, `(${peer} was reviewing this and is off roster.)`));
           else this.sendReview(next, reviewer, `(${peer} was reviewing this and is paused for quota.)`);

package/src/local/tools.ts

@@ -17,6 +17,8 @@ const approvalError = (picked: ToolApproval, denied: string): string | undefined
   : picked === "expired" ? APPROVAL_EXPIRED_TEXT
   : picked === "aborted" ? "error: approval withdrawn because the turn ended; no operation was executed" : denied;
 
+export type ShellPermitPolicy = { forceAsk?: true };
+export type ShellExecutionCheck = "valid" | "ask" | "aborted";
 export interface ToolContext {
   readOnly?: string[];
   cwd: string;
@@ -29,7 +31,9 @@ export interface ToolContext {
   /** Turn cancellation signal, including the execution-budget wall cap. */
   signal?: AbortSignal;
   /** Only true permits an effect; expiry and abort remain distinct from a person's denial. */
-  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver, originalPath?: string, input?: unknown) => Promise<ToolApproval>;
+  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver, originalPath?: string, input?: unknown, policy?: ShellPermitPolicy) => Promise<ToolApproval>;
+  /** Host-only synchronous recheck, immediately before a shell process can be spawned. */
+  shellExecutionCheck?: (input: unknown) => ShellExecutionCheck;
   /** Trusted process status, independent of what its stdout says. */
   onProcessExit?: (code: number | null) => void;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
@@ -102,7 +106,7 @@ export const TOOL_SCHEMAS = [
   fn("read", "Read a text file inside the project. Returns numbered lines.", { path: str, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } }, ["path"]),
   fn("write", "Create or overwrite a file inside the project. Needs the user's approval.", { path: str, content: str }, ["path", "content"]),
   fn("edit", "Replace one exact, unique occurrence of `old` with `new` in a file. Needs the user's approval.", { path: str, old: str, new: str }, ["path", "old", "new"]),
-  fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Needs the user's approval.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
+  fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Follows hub permission policy: proven bounded read-only commands may run automatically in ask-when-needed; other commands ask.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
   fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
   fn("hub_send", "Send a message to the other agents now, before your turn ends. Conclusions only. Your final answer is shared anyway; use this for something that cannot wait.", { text: str, to: { type: "array", items: str } }, ["text"]),
 ];
@@ -179,8 +183,17 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!command.trim()) return "error: empty command";
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, a), "error: the user did not approve this command");
-        if (refused) return refused;
+        const input=Object.freeze({...a,command});
+        for(let attempt=0;;attempt++) {
+          const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, input, attempt?{forceAsk:true}:undefined), "error: the user did not approve this command");
+          if (refused) return refused;
+          if(ctx.signal?.aborted)return "error: turn cancelled before shell execution";
+          let check:ShellExecutionCheck="valid";
+          try {check=ctx.shellExecutionCheck?.(input)??"valid";}catch{check="ask";}
+          if(check==="aborted" || ctx.signal?.aborted)return "error: turn cancelled before shell execution";
+          if(check==="valid")break;
+          if(attempt)return "error: read-only shell proof remained unstable; no command was executed";
+        }
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, readOnlyData: !!ctx.readOnly?.length, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
         try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;

package/src/ui/index.html

@@ -1399,7 +1399,8 @@ function renderBoard(snapshot, peers, ids) {
       const data=(snapshot.boardLegend || []).find(item=>item.peer===id), row=el('div',undefined,'agent-slot');
       row.append(peerMark(id),el('p',String(peers[id].state || 'unknown'),'meta'));
       const wip=data && Number.isSafeInteger(data.wip) && data.wip>=0 ? data.wip : 'unknown';
-      row.append(el('p','WIP '+wip+(Number.isSafeInteger(data?.wipLimit) ? '/'+data.wipLimit : '')+' / permission '+(data?.permissionMode || 'unknown'),'meta'));
+      const split=data?.wipBreakdown,splitText=split && [split.active,split.reviewWait,split.reserved].every(Number.isSafeInteger) ? ' (active '+split.active+', review-wait '+split.reviewWait+', reserved '+split.reserved+')' : '';
+      row.append(el('p','WIP '+wip+(Number.isSafeInteger(data?.wipLimit) ? '/'+data.wipLimit : '')+splitText+' / permission '+(data?.permissionMode || 'unknown'),'meta'));
       if (Array.isArray(data?.activeTasks) && data.activeTasks.length) row.append(el('p','Active tasks: '+data.activeTasks.map(id=>'#'+id).join(', '),'meta'));
       const filter=el('button','View '+id);filter.type='button';filter.addEventListener('click',()=>{if(!boardViewState)return;peerFilter.value=id;renderBoard(boardViewState.snapshot,boardViewState.peers,boardViewState.ids)});row.append(filter);
       if (eligible.includes(id)) dropTarget(row,card=>card.assignable,{action:'assign',peer:id});