@staix/agent-hub 0.18.0 → 0.19.0

package/src/hub/tasks.ts

@@ -1,4 +1,6 @@
 import { canonicalMemorySymbolNode, normalizeMemorySymbolInput, MEMORY_SYMBOL_LIMIT, type MemorySymbolNodes } from "./memory-symbols.ts";
+import { createHash } from "node:crypto";
+import { taskShellBindingValid, type TaskShellBinding } from "./task-shell-command.ts";
 import { buildTaskCodeSymbols, publicTaskCodeSymbols, taskCodeSymbolsDisjoint, HOST_CODE_SYMBOLS } from "./task-code-symbols.ts";
 import { normalizePlanSymbol, symbolsOverlap } from "./symbol-normalizer.ts";
 import { publicTestIntegrity, readTestIntegrity, testIntegrityBlockers, type TestIntegrity } from "./test-integrity.ts";
@@ -16,6 +18,7 @@ import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS, actualTaskDates, planningPatch, type P
 import { readMergeQueue, type DeliveryTask } from "./sdlc-queue.ts";
 import { guardedMerge, mergeModeFor, mergeView, type MergeView } from "./sdlc-merge.ts";
 import { mirrorVerdict as mirrorToGitHub, type MirrorVerdict } from "./sdlc-mirror.ts";
+import { CODE_SCOPE_LINE, evidenceOnlyNotice, type ReviewScope } from "./review-scope.ts";
 import { DEFAULT_MAX_NITS, parseReviewFindings, findingsForHead, findingHead as resolveFindingHead, findingTally, type ReviewFinding, type ReviewFindingSet } from "./review-findings.ts";
 import { readReleaseReadiness } from "./sdlc-release.ts";
 import { loadRoleCatalog, taskRole, taskRoleText, type RoleCatalog } from "./roles.ts";
@@ -104,6 +107,8 @@ export interface TasksDeps {
   privateTurn?: (peer: PeerId) => boolean;
   /** #223 R4: the hub's reading of a verdict's context (`fresh` only for a reviewer session started for this review). */
   reviewContext?: (by: PeerId, task: number) => "fresh" | "continuing" | undefined;
+  /** #852: what a reviewer reads. `code` (the fixed sandboxed reviewers by default, or a local `review_scope`) reads the code only; unset or `full` also runs tests and reads CI. */
+  reviewScope?: (peer: PeerId) => ReviewScope;
   /** #223 R2: a reviewer-only instance gets review facts, not the builder's done summary. */
   reviewOnly?: (peer: PeerId) => boolean;
   /** #223: captured when a verdict call starts; a non-undefined result refuses the verdict at every later check. */
@@ -698,6 +703,8 @@ export class Tasks {
       ...(h.selfReview ? { selfReview: true } : {}),
       ...(h.reviewerFamily ? { reviewerFamily: screenHistoryText(h.reviewerFamily, "reviewer family") } : {}),
       ...(h.reviewerReason ? { reviewerReason: h.reviewerReason } : {}),
+      ...(h.reviewScope === "code" ? { reviewScope: "code" as const } : {}),
+      ...(h.evidenceOnly ? { evidenceOnly: true as const } : {}),
       ...(h.unmetCriteria?.length ? { unmetCriteria: h.unmetCriteria } : {}),
       ...(h.deliverables?.length ? { deliverables: publicDeliverables(h.deliverables, this.nameable) } : {}),
       ...(h.reviewBlocked ? { reviewBlocked: true } : {}),
@@ -775,7 +782,7 @@ export class Tasks {
       if (h.owner === undefined || h.owner !== owner) since = i;
       owner = h.owner;
     });
-    return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
+    return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested" && h.evidenceOnly !== true).map((h) => h.by));
   }
 
   /** Workload is board/queue data only: wip() never calls health() or weights(). */
@@ -872,7 +879,7 @@ export class Tasks {
         if (!OWNERSHIP_EVENTS.has(given.event) || given.event === "unassigned" || given.owner !== peer || given.profile !== profile || given.by === peer) return [];
         const next = t.history.findIndex((h, j) => j > i && OWNERSHIP_EVENTS.has(h.event));
         const span = t.history.slice(i + 1, next < 0 ? undefined : next + 1);
-        if (span.some((h) => failed.includes(h.event))) return [{ outcome: "failed" }];
+        if (span.some((h) => failed.includes(h.event) && h.evidenceOnly !== true)) return [{ outcome: "failed" }];
         if (next >= 0 || t.state !== "approved") return []; // handed on without a failure (a relay), or still open
         const accepted = span.find((h) => h.event === "accepted" && h.by === peer);
         // The work stage ends at its first done call: checks and an integration step are not the work itself.
@@ -1038,6 +1045,85 @@ export class Tasks {
   wip(peer: PeerId, except?: number): number {
     return this.d.board.plannerWip(peer, except);
   }
+
+  /** Host-observed task branch/root binding (#845), never a tool-call branch claim or an execution grant. */
+  bindShellBranch(peer: PeerId, id: number, binding: TaskShellBinding & { worktree: string }, current: () => boolean): boolean {
+    try {
+      if (!Number.isSafeInteger(id) || id < 1 || !taskShellBindingValid(binding) || !this.publicMetadataText(binding.branch)
+        || !current() || this.d.privateTurn?.(peer)) return false;
+      const task = this.d.board.get(id), root = this.d.executionRoot?.(peer);
+      if (!task || task.owner !== peer || !["in_progress", "changes_requested"].includes(task.state) || this.isPii(task)
+        || !root || realPath(root) === realPath(this.d.cwd) || realPath(root) !== realPath(binding.worktree)) return false;
+      const worktree = createHash("sha256").update(realPath(root)).digest("hex");
+      const previous = task.history.findLast(entry => entry.by === HUB && entry.event === "shell branch bound");
+      if (previous) {
+        const saved: unknown = JSON.parse(previous.note ?? "");
+        if (!saved || typeof saved !== "object" || Array.isArray(saved)) return false;
+        const record = saved as Record<string, unknown>;
+        if (record.branch !== binding.branch || record.worktree !== worktree) return false;
+      }
+      if (task.refs.branch !== undefined && task.refs.branch !== binding.branch) return false;
+      const scope = this.repositories.scope(task.refs);
+      const others = this.d.board.list().filter(row => row.id !== id && !isClosedTaskState(row.state))
+        .map(row => ({ row, scope: this.repositories.scope(row.refs) }));
+      if (scope.key !== this.repositories.project.key || others.some(other => other.scope.key === scope.key && other.row.refs.branch === binding.branch)) return false;
+      if (!current() || this.d.privateTurn?.(peer) || this.d.board.get(id)?.history.length !== task.history.length) return false;
+      if (previous) return true;
+      let recorded = false;
+      this.releaseNotice(`task #${id}: execution branch binding unavailable`, () => {
+        this.d.board.update(id, HUB, "shell branch bound", { refs: { branch: binding.branch } }, JSON.stringify({ branch: binding.branch, worktree }), {}, task.history.length);
+        recorded = true;
+      });
+      return recorded;
+    } catch { return false; }
+  }
+  private capacityBefore(task: Task): Map<PeerId, number> {
+    return new Map([...new Set([task.owner, task.reserved])].filter((peer): peer is PeerId => !!peer).map(peer => [peer, this.wip(peer)]));
+  }
+
+  /** Write-driven wake-ups (#785): one unsettled ids-only task notice per planner, never a polling pull. */
+  private writePlannerNotices(task: Task, before: ReadonlyMap<PeerId, number>, approved = false): void {
+    this.releaseNotice(`task #${task.id}: could not notify planner about ready work`, () => {
+      const changes = new Map<PeerId, { capacity: Set<PeerId>; ready: Set<number> }>();
+      const add = (planner: PeerId, peer?: PeerId, id?: number) => {
+        if (!this.d.bus.isRostered(planner)) return;
+        const change = changes.get(planner) ?? { capacity: new Set<PeerId>(), ready: new Set<number>() };
+        if (peer) change.capacity.add(peer);
+        if (id !== undefined) change.ready.add(id);
+        changes.set(planner, change);
+      };
+      for (const [peer, used] of before) if (this.wip(peer) < used) for (const planner of this.taskPlanner(task)) add(planner, peer);
+      if (approved) for (const card of this.d.board.list("backlog")) {
+        if (card.deps?.includes(task.id) && !this.waitsFor(card).length) for (const planner of this.taskPlanner(card)) add(planner, undefined, card.id);
+      }
+      for (const [planner, change] of changes) this.releaseNotice(`could not notify planner ${planner} about ready work`, () => {
+        const pending = this.d.bus.pendingEnvelopes(planner).filter(env => env.from === HUB && env.kind === "task" && env.body.startsWith("Planner work ready:"));
+        // The bus retains these hub-written lines across restart; an in-memory cache would lose unsettled events.
+        for (const env of pending) for (const line of env.body.split("\n")) {
+          const capacity = /^capacity_released: (\S+) WIP \d+; reserved ready (?:#\d+|none)$/.exec(line);
+          if (capacity) change.capacity.add(capacity[1]!);
+          const ready = /^backlog_ready: #(\d+)$/.exec(line);
+          if (ready && Number.isSafeInteger(Number(ready[1]))) change.ready.add(Number(ready[1]));
+        }
+        const lines: string[] = [];
+        for (const peer of change.capacity) {
+          const top = this.d.board.list().filter(card => ["backlog", "proposed"].includes(card.state) && !card.owner && card.reserved === peer
+            && this.taskPlanner(card).includes(planner) && !card.pinned && taskCanPlan(card) && !this.waitsFor(card).length && !this.excluded(card).includes(peer)
+            && (card.release == null || ["planning", "active"].includes(this.d.board.release(card.release)?.state ?? ""))).sort(this.readyOrder)[0];
+          lines.push(`capacity_released: ${peer} WIP ${this.wip(peer)}; reserved ready ${top ? `#${top.id}` : "none"}`);
+        }
+        for (const id of change.ready) {
+          const card = this.d.board.get(id);
+          if (card?.state === "backlog" && this.taskPlanner(card).includes(planner) && !this.waitsFor(card).length) lines.push(`backlog_ready: #${id}`);
+          else change.ready.delete(id);
+        }
+        for (const env of pending) this.d.bus.withdraw(env.id);
+        const env = newEnvelope(HUB, sanitize(`Planner work ready:\n${lines.join("\n")}\nRead the current board before planning or pulling work.`), { to: [planner], kind: "task" });
+        if (!this.d.bus.publish(env).includes(planner)) throw new Error("the notice was not queued");
+      });
+    });
+  }
+
   /** #784 AC3: the read-only breakdown of `wip` for status, the console and the dashboard: one grouped query for every peer. Admission still reads `wip()`. */
   wipBreakdown(peers: readonly PeerId[]): Record<string, { wip: number; active: number; reviewWait: number; reserved: number; wipLimit: number }> {
     const grouped = this.d.board.plannerWipBreakdown();
@@ -1380,7 +1466,9 @@ export class Tasks {
     if (entry.planning.pull) {
       const release = task.release == null ? undefined : this.d.board.release(task.release);
       if (task.state !== "proposed" || task.owner || taskHasStarted(task) || by !== USER && (task.pinned || release && ["frozen", "shipped", "dropped"].includes(release.state))) throw new PreEffectToolRefusal("planner pull undo is no longer eligible");
+      const capacity = this.capacityBefore(task);
       const returned = this.d.board.undoPlannedPull(id, by, revision);
+      this.writePlannerNotices(returned, capacity);
       this.offered.delete(id); this.incomingBacklog.add(id);
       this.planningRecorded({ by, task: id, fields: ["pull", "reserved"], revision: returned.planningRevision! });
       return returned;
@@ -1760,7 +1848,9 @@ export class Tasks {
     this.plannerWriteAuthority(by);
     const confirmed = validate();
     if (confirmed.history.length !== flow) throw new PreEffectToolRefusal("task changed during untouched return");
+    const capacity = this.capacityBefore(confirmed);
     const returned = this.d.board.update(confirmed.id, by, "backlog returned untouched", { state: "backlog", owner: null, reviewer: null }, input.reason.trim(), { ...(withheld ? { withheld: true } : {}) }, flow);
+    this.writePlannerNotices(returned, capacity);
     this.offered.delete(confirmed.id);
     this.cohorts.leave(confirmed.id);
     this.withdrawRoleRequest(confirmed, returned, "owner");
@@ -1783,7 +1873,9 @@ export class Tasks {
     if (!pull && taskHasStarted(task)) throw new PreEffectToolRefusal(`task #${n}: started work cannot return to backlog`);
     const pulled = task.history.findLast(entry => entry.event === "backlog pulled" || entry.event === "backlog returned");
     const restoreReservation = !pull && pulled?.planning?.pull && !task.history.slice(task.history.lastIndexOf(pulled) + 1).some(entry => entry.event === "reserved" || entry.planning?.fields.includes("reserved"));
+    const capacity = this.capacityBefore(task);
     const next = this.d.board.update(n, by, pull ? "backlog pulled" : "backlog returned", { state: pull ? "proposed" : "backlog", owner: null, reviewer: null, ...(restoreReservation ? { reserved: pulled.planning!.previous.reserved ?? null } : {}) });
+    this.writePlannerNotices(next, capacity);
     this.offered.delete(n);
     if (!pull) { this.incomingBacklog.add(n); return next; }
     const waits = this.waitsFor(next);
@@ -2612,7 +2704,9 @@ export class Tasks {
     const task = validate();
     if (task.history.length !== revision) throw new PreEffectToolRefusal("task flow revision changed");
     const cancelled = { reason: input.reason.trim(), ...(input.supersededBy ? { supersededBy: input.supersededBy.trim() } : {}), flowRevision: revision + 1, ...(withheld ? { withheld: true as const } : {}) };
+    const capacity = this.capacityBefore(task);
     const next = this.d.board.update(task.id, by, "cancelled", { state: "cancelled", reserved: null, cancelled }, cancelled.reason, { ...(withheld ? { withheld: true as const } : {}) }, revision);
+    this.writePlannerNotices(next, capacity);
     this.releaseNotice(`task #${task.id}: cancellation cohort cleanup unavailable`, () => this.cohorts.leave(task.id));
     this.offered.delete(task.id);
     this.releaseNotice(`task #${task.id}: cancellation stall cleanup unavailable`, () => this.d.board.clearStall(task.id));
@@ -2863,7 +2957,7 @@ export class Tasks {
     }
     const rows = this.d.board.list();
     const tasks: MetricTask[] = rows.map(task => ({ id: task.id, private: this.isPii(task), history: task.history.map(entry => ({ at: entry.at, event: entry.event,
-      ...(entry.reviewCost?.head ? { requestHead: entry.reviewCost.head } : {}), ...(entry.reviewFindings?.head ? { verdictHead: entry.reviewFindings.head } : {}) })) }));
+      ...(entry.reviewCost?.head ? { requestHead: entry.reviewCost.head } : {}), ...(entry.reviewFindings?.head ? { verdictHead: entry.reviewFindings.head } : {}), ...(entry.evidenceOnly ? { evidenceOnly: true as const } : {}) })) }));
     const visibleIds = new Set(rows.filter(task => !this.isPii(task)).map(task => task.id));
     const byKind: Record<string, number> = {};
     for (const stall of this.stalled()) if (visibleIds.has(stall.task)) byKind[stall.cause.kind] = (byKind[stall.cause.kind] ?? 0) + 1;
@@ -3688,12 +3782,17 @@ export class Tasks {
     const task = this.need(id, true, true);
     this.mine(task, by, "owner", true);
     // The owner it is declined for goes on the entry, also when the console declines for it: `excluded()` keeps it out (#207).
+    const capacityBefore = this.capacityBefore(task);
     const planned = this.plannerPullRecord(task)?.pull === true;
     const back = this.d.board.update(task.id, by, "declined", { ...(["in_progress", "changes_requested"].includes(task.state) ? { state: "proposed" as const } : {}), ...(planned ? { reserved: null } : {}) }, reason, task.owner ? { from: task.owner, ...(capacity === true ? { capacity: true as const } : {}) } : {});
     if (planned) this.offered.delete(task.id);
     this.d.notify(`task ${this.publicTitle(back)} declined${capacity === true ? " (capacity only)" : ""} by ${by}${reason && !this.isPii(back) ? `: ${reason}` : ""}`);
     // A capacity decline is not in excluded(), so this move's own reroute leaves the decliner out explicitly.
-    return this.assignOwner(back, HUB, { event: "reassigned", reason: "declined", clearOnFail: true, ...(capacity === true && task.owner ? { exclude: [task.owner] } : {}), ...(planned ? { planner: true } : {}) });
+    try {
+      return await this.assignOwner(back, HUB, { event: "reassigned", reason: "declined", clearOnFail: true, ...(capacity === true && task.owner ? { exclude: [task.owner] } : {}), ...(planned ? { planner: true } : {}) });
+    } finally {
+      this.writePlannerNotices(this.d.board.get(task.id) ?? back, capacityBefore);
+    }
   }
 
   /**
@@ -4037,7 +4136,9 @@ export class Tasks {
     const completedRefs = cleanRefs(refs);
     this.warmRepository({ ...task, refs: { ...task.refs, ...completedRefs } });
     const noWrites = this.noWritesRecorded({ ...task, refs: { ...task.refs, ...completedRefs } });
+    const capacity = this.capacityBefore(task);
     const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection), ...(reviewCost ? { reviewCost } : {}), ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
+    this.writePlannerNotices(next, capacity, next.state === "approved");
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
     const memorySymbols = this.completionMemorySymbols(next);
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\nChanged-symbol memory anchors: ${memorySymbols.state === "known" ? memorySymbols.nodes.length : "unknown (no complete code facts)"}\n${summary ?? ""}`, withheld, memorySymbols);
@@ -4235,9 +4336,12 @@ export class Tasks {
         ? "No check ran for this class: verify the outcome yourself."
         : "No check ran for this class: run the affected tests yourself.";
     // #824: the hub's own exact-head CI evidence, from the admission this request already carries (no new gh call). Nothing here comes from the builder's summary or a recorded claim.
-    const verified = this.hubVerifiedBlock(task, admission);
+    const codeScoped = this.d.reviewScope?.(reviewer) === "code";
+    const verified = codeScoped ? "" : this.hubVerifiedBlock(task, admission);
     const ciPassed = admission?.ready === true && !this.isPii(task);
-    const checkResult = check ? `Check result: ${(check.note ?? "").split("\n")[0]}`
+    // #852 AC2: a code-scope reviewer's sandbox cannot run tests or read CI, so its Hub-verified and check lines are replaced by one fixed line.
+    const checkResult = codeScoped ? CODE_SCOPE_LINE
+      : check ? `Check result: ${(check.note ?? "").split("\n")[0]}`
       : ciPassed ? "CI passed at this exact head (see the Hub-verified line above); do not list test execution or CI evidence as unmet: name the specific missing test or behaviour instead."
       : noCheckWording;
     const checklistTemplates = profile.review_checklist ?? [
@@ -4431,6 +4535,11 @@ export class Tasks {
     let parsed: ReviewFinding[];
     try { parsed = parseReviewFindings(findings, { person: by === USER, maxNits: this.d.sdlc?.config().maxNits ?? DEFAULT_MAX_NITS }); }
     catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid structured findings"); }
+    // #852 AC3 (amended): a code-scope reviewer's changes_requested is always recorded, never refused. Without an open structured finding it is
+    // evidence-only: it does not count toward rejections or escalation, the task returns to its owner as usual, and the conductor gets one ids-only
+    // notice. The rule is structural (a finding with disposition open), never a reading of the unmet text.
+    const codeScope = by !== USER && this.d.reviewScope?.(by) === "code";
+    const evidenceOnly = codeScope && verdict === "changes_requested" && !parsed.some(finding => finding.disposition === "open");
     const resolvedHead = this.findingHead(initial);
     let findingHead = resolvedHead;
     if (head !== undefined) {
@@ -4512,7 +4621,7 @@ export class Tasks {
     }
     if (verdict === "approved" && this.d.sdlc && this.d.sdlc.config().mode !== "off") { await this.lifecycleGate(task, "approval", reviewedHead, proposedSets(task)); task = valid(); }
     let candidate: Extract<CandidateInput, { kind: "fail" }> | undefined;
-    if (verdict === "changes_requested" && items.length && this.d.candidates && !withheld && !this.isPii(task) && !this.d.privateTurn?.(by)) {
+    if (verdict === "changes_requested" && !evidenceOnly && items.length && this.d.candidates && !withheld && !this.isPii(task) && !this.d.privateTurn?.(by)) {
       const input: CandidateInput = { project: this.d.store?.project ?? this.d.project, kind: "fail", approach: this.publicTitle(task), symptom: items.join("\n"),
         cause: "unknown: review unmet items do not establish a cause", retryWhen: "unknown: a person must review the unmet items before accepting",
         evidenceRefs: [`task:${task.id}`, `reviewed-head:${reviewedHead ?? task.refs.commit ?? "unknown"}`] };
@@ -4531,9 +4640,11 @@ export class Tasks {
     // #507b: unmet items that start with a recorded criterion id name that criterion. The ids come from the checklist on the board as it is at this
     // write (the `task` just rechecked by valid()), never from the caller; a PII task carries none, its checklist being private.
     const unmetCriteria = pii ? [] : unmetCriteriaIds(items, checklistOf(task.sdlc));
-    const flag = { ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(unmetCriteria.length ? { unmetCriteria } : {}), ...(boundDeliverables ? { deliverables: boundDeliverables } : {}), ...(reviewContext ? { reviewContext } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
+    const flag = { ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(unmetCriteria.length ? { unmetCriteria } : {}), ...(boundDeliverables ? { deliverables: boundDeliverables } : {}), ...(reviewContext ? { reviewContext } : {}), ...(codeScope ? { reviewScope: "code" as const } : {}), ...(evidenceOnly ? { evidenceOnly: true as const } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
     if (verdict === "approved") {
+      const capacity = this.capacityBefore(task);
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0, ...(reviewedHead && task.sdlc ? { sdlc: { ...task.sdlc, reviewedHead, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), "merge") } } : {}) }, note, flag);
+      this.writePlannerNotices(next, capacity, next.state === "approved");
       if (next.owner) {
         this.d.board.recordOutcome(next.owner, next.class, true);
         this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
@@ -4552,17 +4663,19 @@ export class Tasks {
       this.releaseNotice(`task #${next.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(next, by, parsed, withheld));
       return next;
     }
-    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note, flag);
+    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: evidenceOnly ? task.rejections : task.rejections + 1 }, note, flag);
     void this.mirrorVerdict(rejected, by, "changes_requested", reviewedHead ?? rejected.sdlc?.reviewedHead, note, withheld);
-    this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));
+    if (!evidenceOnly) this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));
     if (candidate && !pii && !this.d.privateTurn?.(by) && this.candidateTextAllowed(JSON.stringify({ candidate, refs: rejected.refs, plan: rejected.plan }), rejected)) {
       try { this.d.memoryCheck?.(); this.d.candidates?.put({ ...candidate, evidenceRefs: [...candidate.evidenceRefs, `review:${rejected.id}:${rejected.history.length}`] }, "public"); } catch { /* a saved review remains authoritative if the optional sidecar fails */ }
     }
     this.cohorts.withdraw(rejected.id); // open again: its done intent no longer counts (issue #107)
-    if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
-    this.contradict(rejected);
+    // Evidence-only is not a verdict on the owner's work: no failed outcome, no contradiction of an earlier approval, and no escalation count.
+    if (rejected.owner && !evidenceOnly) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
+    if (!evidenceOnly) this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`, withheld);
-    if (rejected.rejections >= (this.d.escalateAfter?.() ?? ESCALATE_AFTER)) {
+    if (evidenceOnly) this.tellConductorEvidenceOnly(rejected, by);
+    if (!evidenceOnly && rejected.rejections >= (this.d.escalateAfter?.() ?? ESCALATE_AFTER)) {
       let moved: Task;
       try {
         moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`, "rejections");
@@ -4587,6 +4700,19 @@ export class Tasks {
     return reopened;
   }
 
+  /**
+   * #852 AC3: one task-weight notice to the configured conductor for a verdict recorded as evidence-only. Ids only (task and reviewer), so nothing of
+   * the review or the task reaches it; a PII task's notice is private. With no conductor the person sees one console notice instead.
+   */
+  private tellConductorEvidenceOnly(task: Task, reviewer: PeerId): void {
+    const conductors = Object.entries(this.d.roles ?? {}).filter(([, roles]) => Array.isArray(roles) && roles.includes("conductor")).map(([actor]) => actor).filter(actor => actor !== reviewer);
+    const text = evidenceOnlyNotice(task.id, reviewer);
+    if (!conductors.length) { this.releaseNotice(text); return; }
+    this.releaseNotice(`task #${task.id}: could not tell the conductor a code-scope review was evidence-only`, () => {
+      this.d.bus.publish(newEnvelope(HUB, sanitize(text), { to: conductors, kind: "task", refs: { task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
+    });
+  }
+
   /** Task-level escalation: the next attached peer in the class's escalate_to takes over, with the history. */
   async escalate(by: PeerId, id: unknown, why = "by hand", reason: TaskMoveReason | undefined = by === HUB ? undefined : "manual", preEffect = false): Promise<Task> {
     let task = this.need(id, true, preEffect);

package/src/local/deny.ts

@@ -31,6 +31,17 @@ const HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
 /** A regex source matching `name` with any number of HFS+-ignorable code points interleaved, at the ends included. */
 const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
 
+/**
+ * `config.worktree`, the per-worktree config git reads beside `config` (#518), folded in BOTH halves as two NAME-only regex sources that a rule must both match. One SBPL regex
+ * literal dies at 1024 bytes in UTF-8 and every folded character costs about 65 bytes, so the whole name (1071) cannot be one literal, and a byte class cannot hold the
+ * multi-byte code points (the engine is byte-oriented, verified), so the fold stays an alternation. The first source pins the front (a folded `config`, a dot, then the rest of
+ * the name), the second the end (a folded `worktree`). Together they match every spelling of `config.worktree` with ignorable code points anywhere in it, and also
+ * `config.<anything>worktree` in the same directory, which is over-refused on purpose and names no file git uses.
+ * The root a rule is scoped to is NEVER part of these literals: it goes in its own `require-all` filter, so a long project or git path cannot push a folded name over the limit
+ * (#518 review: a 450-byte path made a 1083-byte literal when the root and the name shared one).
+ */
+const CONFIG_WORKTREE_NAME: readonly [string, string] = [`^.*/${hfsFoldedName("config")}\\.[^/]*$`, `^.*/[^/]*${hfsFoldedName("worktree")}$`];
+
 /**
  * Seatbelt rules for the hub's and git's own names (#270). `.agenthub` is refused anywhere under the project root.
  * `.git` is refused at any depth, the name itself included, so a planted repository cannot arrive by creation,
@@ -53,32 +64,101 @@ const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) =>
  * long project path would trip. ponytail: the modules rules do contain the (plain) modules root; a project path
  * over roughly 600 bytes with submodules would exceed the limit — fold the root's segments if one ever shows up.
  */
-export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit?: { root: string; entries: string[] }): string[] {
+/**
+ * `hooks` as the entry directly under `parent`, and everything below it, anchored by DEPTH instead of by the unanchored any-prefix name: that one also matches an ancestor of the
+ * project that happens to be named `hooks`, and paired with a plain root prefix it refused every write below the root (#520). Seatbelt ignores a `{n}` repeat, so the depth is
+ * written out as that many `/[^/]+` terms (verified with the real sandbox-exec), which keeps the literal independent of the path's characters and costs 6 bytes a component.
+ * A path with more than MAX_ANCHOR_DEPTH components would push the folded name past the 1024-byte limit, which stops every sandboxed command, so it falls back to the
+ * unanchored name: that over-refuses only when an ancestor is named `hooks`, never under-protects. Pair it with a plain `^<parent>/` filter.
+ */
+const MAX_ANCHOR_DEPTH = 80;
+const hooksUnder = (parent: string): string => {
+  const depth = parent.split("/").filter(Boolean).length;
+  return depth > MAX_ANCHOR_DEPTH ? `^.*/${hfsFoldedName("hooks")}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName("hooks")}(/|$)`;
+};
+
+export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit: readonly { root: string; entries: string[]; dirs?: string[] }[] = [], worktreesRoot?: string): string[] {
   const git = hfsFoldedName(".git");
   const re = (s: string) => `(regex ${sbplString(s)})`;
   const external = gitDirs.flatMap((d) => [
     `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     `(subpath ${sbplString(`${d}/hooks`)})`,
     `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
   ]);
-  const modules = moduleGit
-    ? [
-        // Every name matches whole components only: `(.*/)?` forces a boundary, so a submodule named `catalogs`
-        // or `prefs` keeps the refusal and one named `webhooks` keeps its ordinary writes (#281 round 2).
-        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-        // A submodule git dir as a directory entry: no rename, replace, symlink or recreate. The basename is
-        // folded (HFS+ opens the folded spelling as the real entry); the plain prefix is the path as discovered.
-        ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname(d))}/${hfsFoldedName(basename(d))}$`)),
-      ]
+  // Every modules tree (#518, #520): the common dir's, a linked worktree's own, each sibling's, and the `modules/` of every discovered submodule git dir. Nothing is exempt by name:
+  // a `refs` or `logs` component does not make a path safe, because a later unsandboxed `git submodule update --init` reuses any git dir found at `<modules>/<name>` and runs its
+  // config and hooks. So under a modules root, everything that is not inside a DISCOVERED git dir is refused (that is a plant, a new or a renamed git dir), and inside each discovered
+  // git dir `D` the protected files are anchored to `D` itself: `D/config`, `D/config.worktree`, `D/hooks` and what is below it, and `D/worktrees/*/config.worktree`.
+  // Ordinary git work writes `D/refs`, `D/logs`, `D/objects`, `D/index`, `D/HEAD`, ... and none of those is refused, so no refs/logs exception is needed.
+  // Each literal holds either a path or a folded name, never both (the 1024-byte limit, #518 review); the folded names sit in `^.*/<name>$` filters beside a plain anchor.
+  const allDirs = moduleGit.flatMap((tree) => tree.dirs ?? []);
+  const modules = moduleGit.flatMap((tree) => {
+    const root = sbplEscape(tree.root);
+    const found = tree.dirs ?? [];   // absent means nothing is exempt: everything under the root is refused, which fails closed
+    const inside = found.map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ");
+    const anchored = found.flatMap((d) => {
+      const dir = sbplEscape(d);
+      return [
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/`)} ${re(hooksUnder(d))})`,
+        // A linked worktree of a submodule keeps its own config.worktree one level down.
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        // The directories on the way to those files are directory-entry targets, so none can be moved out of the protected path, edited and put back (#520 review): `worktrees`
+        // and each `worktrees/<name>` (no rename, replace, symlink or removal), and the `hooks` directory itself. The root and the folded name are separate filters.
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("worktrees")}$`)})`,
+        re(`^${dir}/worktrees/[^/]+$`),
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("hooks")}$`)})`,
+        // A submodule's own linked worktrees keep their `modules/` at `D/worktrees/<wt>/modules` (#520 review), inside the exemption above. Everything under one that is not inside a
+        // DISCOVERED git dir is refused, whether the worktree exists yet or not (the pattern needs no discovery), and the `modules` entry itself cannot be renamed or replaced.
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/modules/.`)} ${allDirs.filter((f) => f.startsWith(`${d}/worktrees/`)).map((f) => `(require-not ${re(`^${sbplEscape(f)}(/|$)`)})`).join(" ")})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`,
+      ];
+    });
+    return [
+      // Everything under the root that is not inside a discovered git dir. The root's own entry is a directory entry rule below, so this is the contents.
+      `(require-all ${re(`^${root}/.`)} ${inside})`,
+      ...anchored,
+      // A submodule git dir as a directory entry: no rename, replace, symlink or recreate. The basename is folded (HFS+ opens the folded spelling as the real entry);
+      // the directory and the folded name are separate filters (a ~520-byte git path went over the limit when they shared one, #518 review).
+      ...tree.entries.map((d) => `(require-all ${re(`^${sbplEscape(dirname(d))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename(d))}$`)})`),
+    ];
+  });
+  // Every linked worktree's git dir under `<common>/worktrees/` by pattern, not by discovery (#518): a sibling's `modules/` tree that does not exist yet, or a sibling created
+  // after this profile was built, is as protected as one that does. The sandbox can write the common dir, so it could otherwise pre-create them. The worktree name is one
+  // plain component (a folded spelling of `worktrees` or of a sibling's name on HFS+ is the same residual as the folded `modules` component above).
+  const siblings = worktreesRoot
+    ? (() => {
+        const w = sbplEscape(worktreesRoot);
+        return [
+          // The ancestors of every protected git dir, as directory entries: no rename, replace, symlink or recreate. Without them the container or a worktree git dir could be moved
+          // out of the protected path, its submodule config or hooks edited, and moved back (#518 review). Git itself never renames or removes these during ordinary work.
+          // The container's folded name and the directory it sits in are separate filters (one literal holding both grows with the path); a worktree git dir has any name.
+          `(require-all ${re(`^${sbplEscape(dirname(worktreesRoot))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename(worktreesRoot))}$`)})`,
+          re(`^${w}/[^/]+$`),
+          // A worktree git dir's own `config` and `config.worktree`: direct children only.
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+          // A worktree git dir's own `hooks` directory and everything in it, which git runs for that worktree, anchored by depth so an ancestor named `hooks` is not matched (#520).
+          // Its `modules/` is a different component, so this never reaches a submodule's own tree.
+          `(require-all ${re(`^${w}/[^/]+/`)} ${re(hooksUnder(`${worktreesRoot}/x`))})`,
+          // Every write under any worktree's `modules/` that is not inside a DISCOVERED submodule git dir (#520): a plant, or a tree that does not exist yet. The discovered git dirs
+          // (the sandboxed worktree's own, and any sibling's that exists) are exempt here and get their anchored rules from their own tree above. No name is exempt.
+          `(require-all ${re(`^${w}/[^/]+/modules/.`)} ${moduleGit.flatMap((tree) => tree.dirs ?? []).filter((d) => d.startsWith(`${worktreesRoot}/`)).map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ")})`,
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`,
+        ];
+      })()
     : [];
   return [
     `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
     re(`^.*/${git}$`),
     re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    `(require-all ${re(`^.*/${git}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
     `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
     ...modules,
+    ...siblings,
     ...external,
   ];
 }

package/src/local/sandbox.ts

@@ -48,38 +48,76 @@ function externalGitDirs(root: string): string[] {
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 
+/** `<common>/worktrees`: where every linked worktree keeps its git dir. The rules for it are patterns, so they need no worktree to exist (#518). */
+function worktreesRoot(root: string): string | undefined {
+  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? join(resolve(root, out.stdout.trim()), "worktrees") : undefined;
+}
+
 /**
- * The project's submodule git directories live under the common dir's `modules/` tree (the worktree case included:
- * it is the main repo's `.git/modules`). Returns the modules root and every directory entry that must not be
- * renamed, replaced, symlinked or recreated: each discovered git dir (a directory holding HEAD and config) and
- * every component between it and the modules root (#281). Discovered in the hub process, outside the sandbox.
+ * One modules tree: its root, the submodule git dirs found directly under it (`dirs`, each a directory holding HEAD and config, however it is named) and every directory entry
+ * that must not be renamed, replaced, symlinked or recreated (the root, each git dir and every component between them, #281). Everything else under the root is refused to
+ * write (#520): a git dir that is not discovered here is a plant, whatever its name.
  */
-function moduleGitDirs(root: string): { root: string; entries: string[] } | undefined {
-  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
-  if (out.status !== 0) return undefined;
-  const modulesRoot = join(resolve(root, out.stdout.trim()), "modules");
-  const dirs: string[] = [];
-  const walk = (dir: string, depth: number): void => {
-    if (depth > 8) return; // submodules do not nest deeper in practice; the regex rules still cover the names
-    let entries: Dirent[];
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return; // no modules tree (no submodules): nothing to discover
+export interface ModuleGit { root: string; entries: string[]; dirs?: string[] }
+
+/** The deepest submodule nesting the profile follows: a git dir below it is not exempt, so a write there fails closed instead of going unprotected. */
+const MODULE_DEPTH = 8;
+
+/**
+ * The submodule git directories the project can reach, as modules trees. A plain checkout keeps them under the common dir's `modules/`; a LINKED worktree keeps its own under that
+ * worktree's git dir, `<common>/worktrees/<wt>/modules/`, so the trees are the common dir's, this worktree's own git dir's (whether or not it exists yet, so it cannot be pre-created)
+ * and every sibling worktree's that already has one: the common dir is writable from here (#518). Every discovered git dir also gets a tree of its own for its `modules/`, existing
+ * or not, so a submodule of a submodule is covered the same way (#520). Discovered in the hub process, outside the sandbox.
+ */
+function moduleGitDirs(root: string): ModuleGit[] {
+  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir", "--absolute-git-dir"], { encoding: "utf8" });
+  if (out.status !== 0) return [];
+  const [commonRaw, ownRaw] = out.stdout.trim().split("\n");
+  if (!commonRaw || !ownRaw) return [];
+  const common = resolve(root, commonRaw), own = resolve(root, ownRaw);
+  const roots = new Set<string>([join(common, "modules"), join(own, "modules")]);
+  try {
+    for (const e of readdirSync(join(common, "worktrees"), { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const modules = join(common, "worktrees", e.name, "modules");
+      if (existsSync(modules)) roots.add(modules);
     }
-    const names = new Set(entries.map((e) => e.name));
-    if (names.has("HEAD") && names.has("config")) {
-      dirs.push(dir);
-      const nested = join(dir, "modules");
-      if (names.has("modules")) walk(nested, depth + 1); // a submodule of a submodule
-      return;
+  } catch { /* no linked worktrees */ }
+  const trees: ModuleGit[] = [];
+  const tree = (modulesRoot: string, nesting: number): void => {
+    const dirs: string[] = [];
+    const walk = (dir: string, depth: number): void => {
+      if (depth > 8) return; // a path this deep is not a submodule layout git makes
+      let entries: Dirent[];
+      try {
+        entries = readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return; // no modules tree (no submodules): nothing to discover
+      }
+      const names = new Set(entries.map((e) => e.name));
+      if (names.has("HEAD") && names.has("config")) { dirs.push(dir); return; }
+      for (const e of entries) if (e.isDirectory()) walk(join(dir, e.name), depth + 1);
+    };
+    walk(modulesRoot, 0);
+    // Past the nesting limit nothing is exempt, so a write below it is refused rather than left unprotected.
+    const found = nesting >= MODULE_DEPTH ? [] : dirs;
+    const entries = new Set<string>([modulesRoot]);
+    for (const d of found) for (let p = d; p.length > modulesRoot.length; p = dirname(p)) entries.add(p);
+    trees.push({ root: modulesRoot, entries: [...entries], dirs: found });
+    for (const d of found) {
+      tree(join(d, "modules"), nesting + 1); // a submodule of a submodule, whether or not it exists yet
+      // A submodule is a repository: its linked worktrees keep their own modules trees at `<d>/worktrees/<wt>/modules`. Existing ones are discovered here; ones that do not exist yet
+      // are covered by pattern in hubWriteRegexes (#520 review).
+      try {
+        for (const e of readdirSync(join(d, "worktrees"), { withFileTypes: true })) {
+          if (e.isDirectory() && existsSync(join(d, "worktrees", e.name, "modules"))) tree(join(d, "worktrees", e.name, "modules"), nesting + 1);
+        }
+      } catch { /* no linked worktrees */ }
     }
-    for (const e of entries) if (e.isDirectory()) walk(join(dir, e.name), depth + 1);
   };
-  walk(modulesRoot, 0);
-  const entries = new Set<string>([modulesRoot]);
-  for (const d of dirs) for (let p = d; p.length > modulesRoot.length; p = dirname(p)) entries.add(p);
-  return { root: modulesRoot, entries: [...entries] };
+  for (const modulesRoot of roots) tree(modulesRoot, 0);
+  return trees;
 }
 
 /** The system directories a deny-default profile lets commands read and run from: dyld, frameworks, toolchains. */
@@ -111,6 +149,7 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
   const moduleGit = moduleGitDirs(root);
+  const worktrees = worktreesRoot(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
@@ -144,7 +183,7 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
     // at any depth (creation, rename, symlink, gitfile), a submodule git dir's config and hooks under
     // .git/modules/ are refused at the depth submodules nest (#281), and the external git dirs get folded
     // hooks/config rules (#270). The cost: git init, clone and worktree add no longer run inside the sandbox.
-    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit, worktrees).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).

package/src/local/shell-environment.ts

@@ -0,0 +1,10 @@
+import { homedir } from "node:os";
+
+export interface HostShellEnvironment extends Record<string, string> { PATH: string; HOME: string; LANG: string; TERM: string }
+
+/** The #816 executor's fixed baseline, shared by the proof and host wrapper; never inherit a native agent's environment.
+ * ponytail: Seatbelt's accepted source stays byte-identical and adds TMPDIR separately; a future shared-executor
+ * extraction must preserve the runtime environment parity test and explicitly revise that source's byte guard. */
+export function hostShellEnvironment(extra: Readonly<Record<string, string>> = {}): HostShellEnvironment {
+  return { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...extra };
+}

package/src/ui/index.html

@@ -1674,6 +1674,7 @@ function render(snapshot) {
       if (peer.pullOnly && adapterDisplay[id]?.pullOnlyRead) more.append(el('p', 'Last hub_inbox read: ' + (typeof peer.lastInboxAt === 'number' ? Math.max(0, Math.floor((Date.now() - peer.lastInboxAt) / 1000)) + 's ago' : 'never'), 'meta'));
       if (peer.paused) more.append(el('p', peer.paused, 'meta'));
       if (peer.requestedModel) more.append(el('p', 'Requested: ' + peer.requestedModel, 'meta'));
+      if (peer.reviewScope === 'code' || peer.reviewScope === 'full') more.append(el('p', 'Review scope: ' + (peer.reviewScope === 'code' ? 'code only (cannot run tests or read CI; the merger gates on exact-head CI)' : 'full'), 'meta'));
       if (typeof peer.modelSource === 'string' && peer.modelSource) more.append(el('p', 'Model source: ' + peer.modelSource, 'meta'));
       for (const backend of peer.backends || []) {
         if (backend.requestedModel) more.append(el('p', backend.kind.toUpperCase() + ': ' + (backend.actualModel || 'model not reported') + ' (' + backend.state + ')', 'meta'));