@staix/agent-hub 0.29.0 → 0.31.0

package/src/hub/hub-tools.ts

@@ -8,7 +8,7 @@ import { NOTE_KINDS } from "./envelope.ts";
 
 /** Restricted to the fixed current-child tools server, never an ordinary peer tool. */
 /** The fixed MCP surface of a current owned implementer child; independent of broader project roles. */
-export const IMPLEMENTER_HUB_TOOL_NAMES: readonly string[] = Object.freeze(["hub_task_accept", "hub_task_decline", "hub_task_done", "hub_checkpoint", "hub_send", "hub_task_show", "hub_task_propose", "hub_remember", "hub_inbox", "hub_permission_request", "hub_study_show", "hub_experiment_show", "hub_experiment_record", "hub_study_handoff", "hub_specs", "hub_delivery_resolve"]);
+export const IMPLEMENTER_HUB_TOOL_NAMES: readonly string[] = Object.freeze(["hub_task_accept", "hub_task_decline", "hub_task_done", "hub_checkpoint", "hub_send", "hub_task_show", "hub_task_propose", "hub_remember", "hub_inbox", "hub_permission_request", "hub_study_show", "hub_experiment_show", "hub_experiment_record", "hub_study_handoff", "hub_specs", "hub_delivery_resolve", "hub_evidence_record"]);
 
 export const IMPLEMENTER_PERMISSION_TOOL = {
   name: "hub_permission_request",
@@ -36,6 +36,21 @@ const deliverablesSchema = {
   description: "files you delivered, as paths inside the project: the hub reads and hashes each file itself when you call this, a claimed hash is refused, and approval binds those hashes so a later edit reads as \"deliverable changed since review\". Works in a plain folder without git or a PR.",
   items: { type: "object", properties: { path: { type: "string", description: "project-relative path, forward slashes" }, format: { type: "string", description: "lowercase label such as md, pdf, docx, csv" }, version: { type: "string", description: "optional label such as v2" } }, required: ["path", "format"], additionalProperties: false },
 } as const;
+const reviewAnchor = {
+  type: "object", required: ["path", "selectors"], additionalProperties: false,
+  properties: {
+    path: { type: "string", minLength: 1, maxLength: 4096 }, side: { type: "string", enum: ["base", "head"] },
+    contentHash: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    projection: { type: "object", properties: { name: str, version: str }, required: ["name", "version"], additionalProperties: false },
+    selectors: { type: "array", minItems: 1, maxItems: 4, items: { oneOf: [
+      { type: "object", properties: { kind: { const: "lineRange" }, startLine: { type: "integer", minimum: 1 }, endLine: { type: "integer", minimum: 1 } }, required: ["kind", "startLine", "endLine"], additionalProperties: false },
+      { type: "object", properties: { kind: { const: "textQuote" }, exact: { type: "string", maxLength: 512, description: "At most 512 UTF-8 bytes" }, prefix: { type: "string", maxLength: 64 }, suffix: { type: "string", maxLength: 64 } }, required: ["kind", "exact", "prefix", "suffix"], additionalProperties: false },
+      { type: "object", properties: { kind: { const: "diffHunk" }, hunkHeader: { type: "string", maxLength: 256 } }, required: ["kind", "hunkHeader"], additionalProperties: false },
+      { type: "object", properties: { kind: { const: "structural" }, scheme: { type: "string", maxLength: 128 }, ref: { type: "string", maxLength: 512 } }, required: ["kind", "scheme", "ref"], additionalProperties: false },
+      { type: "object", properties: { kind: { const: "region" }, x: { type: "number", minimum: 0 }, y: { type: "number", minimum: 0 }, width: { type: "number", minimum: 0 }, height: { type: "number", minimum: 0 }, page: { type: "integer", minimum: 1 } }, required: ["kind", "x", "y", "width", "height"], additionalProperties: false },
+    ] } },
+  },
+} as const;
 const reviewFindings = {
   type: "array", maxItems: 64,
   description: "Head-bound findings; open Important findings carry across heads until explicitly fixed, false_positive or person-accepted; omission never settles them. Nits stay on their head. accepted is person-only and requires rationale. Nit count is capped by sdlc.max_nits (default 5).",
@@ -44,6 +59,7 @@ const reviewFindings = {
     pass: { type: "string", enum: ["bugs", "security", "compliance"] },
     severity: { type: "string", enum: ["important", "nit"] },
     path: { type: "string", minLength: 1, maxLength: 512 },
+    anchor: reviewAnchor,
     disposition: { type: "string", enum: ["open", "fixed", "false_positive", "accepted"] },
     rationale: { type: "string", minLength: 1, maxLength: 2048 },
   }, required: ["id", "pass", "severity", "disposition"], additionalProperties: false },
@@ -69,7 +85,7 @@ const plan = {
 } as const;
 
 // Accept may target a task from an older project profile; Tasks normalizes by the stored task profile.
-const acceptPlan = { ...plan, properties: { ...plan.properties, sections: list("document heading anchors, such as report.md#methods"), sources: list("citation ids, DOI or source URL ids"), claims: list("short claim ids to verify") } } as const;
+const acceptPlan = { ...plan, properties: { ...plan.properties, sections: list("document heading anchors, such as report.md#methods"), sources: list("registered src:<16 hex> source ids; list available ids with ahub source list"), claims: list("short claim ids to verify") } } as const;
 
 export interface HubTool {
   name: string;
@@ -85,6 +101,16 @@ const tool = (name: string, description: string, properties: Record<string, unkn
 
 /** #601: a campaign's contract and handoff are model-written text about its sources. The write tools' arguments and every study result stay out of memory capture. */
 export const STUDY_TOOLS = new Set(["hub_study_draft", "hub_study_revise", "hub_study_show", "hub_experiment_show", "hub_experiment_record", "hub_study_handoff"]);
+/** Research-only publication. Recognized globally for dispatch/capture, never added to the dev schemas. */
+export const EVIDENCE_RECORD_TOOL = tool("hub_evidence_record", "Record a provenance link for a claim on your current in-progress research task. Read hub_task_show or ahub task show --json and copy claims[].claimId and claims[].claimRevision for the selected slot; do not reconstruct identities or hash claim text. Projection hash/version and scalar locator are declared metadata in T1, not resolved or verified. A relation proposes supports, contradicts or context; it never creates a person verdict. Private turns, tasks and sources refuse. The actor is host-stamped; no fetch, resolver or synthesis check runs.", {
+  id: { type: "string", pattern: "^ev:[0-9a-f]{32}$" }, taskId: id,
+  claimId: { type: "string", minLength: 1, maxLength: 64, pattern: "^claim:[1-9][0-9]{0,15}:(?:0|[1-9][0-9]{0,15}):[1-9][0-9]?$", description: "Canonical #901 claim:<taskId>:<created>:<slot> identity: safe integer parts, slots 1-50; no claim text." }, claimRevision: { type: "string", pattern: "^[0-9a-f]{16}$" },
+  sourceId: { type: "string", pattern: "^src:[0-9a-f]{16}$" },
+  rawSha256: { type: "string", pattern: "^[0-9a-f]{64}$" }, projectionSha256: { type: "string", pattern: "^[0-9a-f]{64}$" },
+  projectionVersion: { type: "string", minLength: 1, maxLength: 64, pattern: "^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,63}$" },
+  locator: { type: "object", properties: { start: { type: "integer", minimum: 0, maximum: Number.MAX_SAFE_INTEGER }, end: { type: "integer", minimum: 1, maximum: Number.MAX_SAFE_INTEGER } }, required: ["start", "end"], additionalProperties: false, description: "Declared zero-based, half-open Unicode scalar-value offsets; nonempty span <=4096. T2 will resolve the immutable projection." },
+  relation: { type: "string", enum: ["supports", "contradicts", "context"] }, revision: { type: "integer", minimum: 1, description: "Default 1; later revisions name the existing link id." },
+}, ["taskId", "claimId", "claimRevision", "sourceId", "rawSha256", "projectionSha256", "projectionVersion", "locator", "relation"]);
 /** #604: a handoff's arguments cross to another project, so neither tool's arguments nor result are captured to memory. */
 export const HANDOFF_TOOLS = new Set(["hub_task_handoff", "hub_task_handoffs"]);
 export const BOUNDED_TASK_TOOLS = new Set(["hub_task_spec", "hub_check_start", "hub_check_result", "hub_check_cancel"]);
@@ -99,7 +125,7 @@ export const TASK_TOOLS: HubTool[] = [
   tool("hub_delivery_retry", "Request one redelivery of your own needs_review delivery. An earlier attempt may have effects: inspect those effects before acting. Refuses another peer's row or any lineage already explicitly retried; a repeated uncertain row needs the person. Never completes/discards a delivery or changes task state.", { delivery_id: { type: "string", minLength: 1, maxLength: 256 } }, ["delivery_id"]),
   tool("hub_delivery_resolve", "Confirm completion or discard your own needs_review delivery using the revision shown by hub_inbox. Requires a reason. Never replays the delivery or changes task state; another peer's row and stale revisions are refused.", { delivery_id: { type: "string", minLength: 1, maxLength: 256 }, revision: { type: "integer", minimum: 0 }, action: { type: "string", enum: ["completed", "discard"] }, reason: { type: "string", minLength: 1, maxLength: 1000 } }, ["delivery_id", "revision", "action", "reason"]),
   tool("hub_backlog_list", "Read public backlog cards with planning revisions. Configured planners only; PII remains a stub.", {}),
-  tool("hub_backlog_plan", "Plan an unpinned backlog item outside frozen releases with the revision you read and a bounded reason. Omit fields or give {} for a note-only revision. fields.sdlc accepts only repo/issue identity on unstarted backlog work; relinking clears old spec acceptance. A person's rank is retained. Actual dates cannot be set.", { id, revision: { type: "integer", minimum: 0 }, reason: { type: "string", maxLength: 1000 }, fields: { type: "object", properties: { sdlc: { type: "object", minProperties: 1, properties: { repo: { type: ["string", "null"], maxLength: 400 }, issue: { type: ["integer", "null"], minimum: 1 } }, additionalProperties: false }, rank: { type: ["integer", "null"], minimum: 0 }, priority: { type: ["integer", "null"], minimum: 0, maximum: 3 }, release: { type: ["integer", "null"], minimum: 1 }, plannedStart: { type: ["integer", "null"], minimum: 1 }, due: { type: ["integer", "null"], minimum: 1 }, deps: { type: "array", maxItems: 64, uniqueItems: true, items: { type: "integer", minimum: 1 } }, reserved: { type: ["string", "null"], minLength: 1, maxLength: 32 } }, additionalProperties: false } }, ["id", "revision", "reason"]),
+  tool("hub_backlog_plan", "Plan an unpinned backlog item outside frozen releases with the revision you read and a bounded reason. Omit fields or give {} for a note-only revision. fields.sdlc accepts only repo/issue identity on unstarted backlog work; relinking clears old spec acceptance. A person's rank is retained. Actual dates cannot be set. fields.needsPerson (marking a leg only the person can run) is the person's: an agent that sends it, or plans a marked card, is refused.", { id, revision: { type: "integer", minimum: 0 }, reason: { type: "string", maxLength: 1000 }, fields: { type: "object", properties: { sdlc: { type: "object", minProperties: 1, properties: { repo: { type: ["string", "null"], maxLength: 400 }, issue: { type: ["integer", "null"], minimum: 1 } }, additionalProperties: false }, rank: { type: ["integer", "null"], minimum: 0 }, priority: { type: ["integer", "null"], minimum: 0, maximum: 3 }, release: { type: ["integer", "null"], minimum: 1 }, plannedStart: { type: ["integer", "null"], minimum: 1 }, due: { type: ["integer", "null"], minimum: 1 }, deps: { type: "array", maxItems: 64, uniqueItems: true, items: { type: "integer", minimum: 1 } }, reserved: { type: ["string", "null"], minLength: 1, maxLength: 32 }, needsPerson: { type: "boolean" } }, additionalProperties: false } }, ["id", "revision", "reason"]),
   tool("hub_backlog_pull", "Reserve a WIP slot and pull ready unpinned backlog work into To Do at its current revision. Preserves person order/reservations and frozen scope; pending unowned work can be undone with hub_backlog_undo.", { id, revision: { type: "integer", minimum: 0 }, reason: { type: "string", minLength: 1, maxLength: 1000 } }, ["id", "revision", "reason"]),
   tool("hub_backlog_split", "Split unstarted backlog work into two to eight staged parts. The original card retains integration/acceptance and depends on the children. Use after for existing prerequisite ids and afterParts for earlier zero-based part indexes. Latest unused unchanged children can be undone with hub_backlog_undo.", { id, revision: { type: "integer", minimum: 0 }, reason: { type: "string", minLength: 1, maxLength: 1000 }, parts: { type: "array", minItems: 2, maxItems: 8, items: { type: "object", properties: { title: { type: "string", minLength: 1, maxLength: 300 }, detail: { type: "string", maxLength: 8000 }, class: str, refs, plan, after: { type: "array", maxItems: 64, uniqueItems: true, items: { type: "integer", minimum: 1 } }, afterParts: { type: "array", maxItems: 8, uniqueItems: true, items: { type: "integer", minimum: 0 } } }, required: ["title"], additionalProperties: false } } }, ["id", "revision", "reason", "parts"]),
   tool("hub_backlog_undo", "Undo your latest planning change at its current revision. Refuses intervening changes and another actor's edit.", { id, revision: { type: "integer", minimum: 1 } }, ["id", "revision"]),
@@ -108,7 +134,7 @@ export const TASK_TOOLS: HubTool[] = [
   tool("hub_study_show", "Read a research campaign's coverage and stop projection: per unit round, state, handoff completeness and budget support, and why dispatch is held. Read-only. A private campaign, task or source shows ids, counts and states only, never its question, scope, path or excerpt. Give no id to list this project's campaigns, at most 50 per call: when the reply carries `next`, pass it as `after` for the following page.", { id: str, after: str }),
   tool("hub_experiment_record", "Record experiment metadata for your current in-progress campaign unit: protocol, attempt, event or comparison plan, or relay a signed runner receipt. The hub validates ownership, sources, campaign and signatures. It runs no command, starts no experiment and contacts no runner. Refused during a PII turn.", { kind: { type: "string", enum: ["protocol", "attempt", "event", "plan", "receipt"] }, taskId: id, protocol: { type: "object" }, attempt: { type: "object" }, attemptId: str, idempotencyKey: str, event: { type: "object" }, plan: { type: "object" }, receipt: { type: "object" }, signature: str }, ["kind"]),
   tool("hub_experiment_show", "Read the experiment attempts of a research campaign, one attempt, or one baseline/variant comparison under a recorded plan. Read-only: it runs no command and reads no file. Every metric, hash and setting says where it came from (declared by an agent, host-observed, runner-attested or person-attested); a declared value is never shown as observed, failed, cancelled and unknown attempts stay in the counts, and a repeat is never an independent reproduction. A private campaign, task or source shows ids, counts and states only. Give campaignId (with after to page, at most 50 rows), or attemptId, or planHash with baselineAttemptId and variantAttemptId.", { campaignId: str, attemptId: str, after: { type: "integer", minimum: 0 }, eventAfter: { type: "integer", minimum: 0 }, limit: { type: "integer", minimum: 1, maximum: 50 }, planHash: str, baselineAttemptId: str, variantAttemptId: str }),
-  tool("hub_task_handoff", "Hand work that belongs to ANOTHER project that runs agent-hub to that project's board. Use it instead of implementing it from this session: a feature or behavior change first needs a spec issue in that project (pass its number as issue); a mechanical chore (an exact version pin, a regenerated file) goes straight to a task. The target is a registered project (its root or id) whose hub is running; it is not queued. Planner, conductor or person only. Never for a [pii] task or during a private turn. You learn the task's state changes as kind task messages.", { project: str, title: str, class: { type: "string", description: "task class, default implement" }, detail: str, paths: { type: "array", items: str, description: "repository-relative paths in the TARGET project" }, issue: { type: "integer", minimum: 1, description: "the target repository's issue number" }, task: { type: "integer", minimum: 1, description: "your own task in THIS project that this work comes from; a [pii] task is refused" } }, ["project", "title"]),
+  tool("hub_task_handoff", "Hand work that belongs to ANOTHER project that runs agent-hub to that project's board. Use it instead of implementing it from this session: a feature or behavior change first needs a spec issue in that project (pass its number as issue); a mechanical chore (an exact version pin, a regenerated file) goes straight to a task. The target is a registered project (its root or id) whose hub is running; it is not queued. Planner, conductor or person only. Never for a [pii] task or during a private turn. A spec issue that already has an open task on the target's board is refused with those task ids: use them, or pass duplicate_ok with your reason if this is separate work. A reply of outcome_unknown means the target may have filed it: retry with the handoffKey it names, never without. You learn the task's state changes as kind task messages.", { project: str, title: str, class: { type: "string", description: "task class, default implement" }, detail: str, paths: { type: "array", items: str, description: "repository-relative paths in the TARGET project" }, issue: { type: "integer", minimum: 1, description: "the target repository's issue number" }, task: { type: "integer", minimum: 1, description: "your own task in THIS project that this work comes from; a [pii] task is refused" }, duplicate_ok: { type: "string", description: "why a second task on an issue that already has an open one is wanted; without it the target refuses a duplicate" }, handoffKey: { type: "string", description: "only to retry a handoff reported as outcome_unknown: the key that refusal named (a lowercase UUID v4). The same request with it is filed once; omit it for a new handoff" } }, ["project", "title"]),
   tool("hub_task_handoffs", "List what this project handed to other projects, with the last state each target reported. Read-only.", {}),
   tool("hub_study_handoff", "Record the handoff for the research unit you currently own and have in progress: evidence per source, unresolved questions, contradictions and limitations, or insufficientEvidence. Only the bound owner; every required field must be present. Not a task completion.", { handoff: { type: "object" } }, ["handoff"]),
   tool("hub_release_new", "Create a future release planning row. Planner/person only; no activation, publish or release authorization.", { name: { type: "string", minLength: 1, maxLength: 64 }, goal: { type: "string", minLength: 1, maxLength: 1000 }, order: { type: "integer", minimum: 0 } }, ["name", "goal", "order"]),
@@ -120,9 +146,9 @@ export const TASK_TOOLS: HubTool[] = [
 
   tool("hub_task_propose", "Put a piece of work on the shared task board. The hub assigns an owner by class (routing.toml) unless you name one. Classes: plan, implement, bulk_edit, test, review, summarize, triage. Name the class when you know it; without one the hub tries to pick it. Name yourself as owner to claim work nobody assigned you: it starts in progress. Put the paths the work touches in refs, set refs.repo for work in another repository, and when you claim work, a plan; the hub says when they overlap another open task.", { title: str, class: { type: "string", enum: ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] }, detail: str, role: { type: "string", description: "catalog role id for this task class; guidance only, no routing or authority change" }, refs, plan, owner: { type: "string", description: "peer id; yours to claim the work, omit to let the hub route it. With after, the owner is reserved: offered the task first once it is ready" }, after: { type: "array", items: { type: "integer" }, description: "ids of tasks that must be approved first; until then this one waits, offered to nobody, and cannot be claimed" }, backlog: { type: "boolean", description: "stage unoffered work; owner is only a reservation, even when naming yourself" }, urgent: { type: "boolean", description: "hand it over even when its owner is paused for quota only briefly" }, needs_network: { type: "boolean", description: "the work needs the network (a package registry, git fetch or push, an API); it is never offered to a peer whose shell has none" }, needs_worktree: { type: "boolean", description: "the work needs its own git worktree on a task branch (the repository rule); it is never offered to a sandboxed peer, which cannot create one" }, goal: { type: "string", description: "id of this project's long-term task (ahub goal list) the work is part of" } }, ["title"]),
   tool("hub_task_accept", "Take a task that was assigned to you, with your plan for it. Set refs.repo for work in another repository; acceptance may correct only that repository metadata.", { id, plan: acceptPlan, refs: { ...refs, properties: { repo: refs.properties.repo } } }, ["id"]),
-  tool("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str, superseded_by: str, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
+  tool("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. The configured conductor may also cancel a task another project handed this one that nobody has accepted. Keeps history and does not stop a native turn or delete files.", { id, reason: str, superseded_by: str, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer. A plain decline is a lasting refusal: you are never offered this task again. Pass capacity: true when you only have no room right now: you are skipped for this move only, and a later reroute or planner pull may offer it to you again.", { id, reason: str, capacity: { type: "boolean" } }, ["id"]),
-  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When re-filing work after review, set refs.commit to the new full SHA; summary text does not change the review head. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck }, ["id", "summary"]),
+  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When re-filing work after review, set refs.commit to the new full SHA; summary text does not change the review head. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck, resolved: { type: "array", maxItems: 64, uniqueItems: true, items: str, description: "Sent person comment ids addressed by this admitted completion; this is an owner claim, not check or verdict proof" } }, ["id", "summary"]),
   tool("hub_sdlc_record", "Record artifact ids or claimed local checks on your task. This grants no authority or external-check evidence. Only its owner/reviewer or the person may record; only its reviewer/person may name a reviewed head or phase checklist. Phase evidence refs are content hashes, not external verification.", { id, receipt: { type: "object", properties: { deliverables: deliverablesSchema, stage: { type: "string", enum: ["spec", "plan", "implement", "review", "verify", "merge", "release"] }, repo: str, issue: id, pr: id, localHead: str, localResult: { type: "string", enum: ["passed", "failed", "unknown"] }, reviewedHead: str, phase: { type: "object", properties: { id: str, head: str, tasks: { type: "array", maxItems: 64, items: { type: "object", properties: { id, after: { type: "array", maxItems: 16, items: id } }, required: ["id", "after"], additionalProperties: false } }, criteria: { type: "array", maxItems: 32, items: { type: "object", properties: { id: str, required: { type: "boolean" }, result: { type: "string", enum: ["verified", "failed", "unverified"] }, refs: { type: "array", maxItems: 8, items: str } }, required: ["id", "required", "result", "refs"], additionalProperties: false } } }, required: ["id", "tasks", "criteria"], additionalProperties: false } }, additionalProperties: false } }, ["id", "receipt"]),
   tool("hub_task_list", "The task board, newest updated first, 50 compact rows (id, state, owner, reviewer, title) per call. The reply is {tasks, total, next?}: pass next as cursor for the following page. Use ids for full rows of specific tasks, or detail: true for full rows of a page. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested", "cancelled"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" }, limit: { type: "integer", minimum: 1, maximum: 200, description: "rows per page, default 50" }, cursor: { type: "string", description: "the next value from the previous reply, unchanged" }, ids: { type: "array", minItems: 1, maxItems: 200, items: { type: "integer", minimum: 1 }, description: "full rows for exactly these task numbers; no paging" }, detail: { type: "boolean", description: "full rows instead of compact rows" } }),
   tool("hub_specs", "Read the project's design-spec checks or find specs covering repository-relative paths. Read-only; at most 20 result items are returned. Does not reveal private task data.", { action: { type: "string", enum: ["check", "covers"] }, paths: { type: "array", maxItems: 32, items: { type: "string", minLength: 1, maxLength: 2000 } } }, ["action"]),
@@ -154,10 +180,38 @@ export const PLANNER_REVIEW_TOOLS: HubTool[] = [
   tool("hub_plan_review", "Record a planner review against the task planning revision and host-read issue edit time. Configured planner or person only; never accepts caller issue timestamps.", { id, revision: { type: "integer", minimum: 0 }, reason: { ...str, maxLength: 1000 }, ...costPlanProperties }, ["id", "revision", "reason"]),
   tool("hub_sdlc_costs", "Read bounded review and CI cost metrics for linked merged PRs. Planner/person only; metadata only, no board writes.", { repo: str }),
   tool("hub_sdlc_metrics", "Read SDLC metrics from board history: time from acceptance to plan, first review and merge, first-pass approval and rework rounds, first-pass CI and same-head reruns, stale-head re-reviews, stalls, and the control band tiers when sdlc.toml sets [bands]. Planner/person only; read-only, no model and no GitHub issue.", { since: str }),
-  tool("hub_backlog_return_untouched", "Return accepted but untouched work to the backlog with its history and planning retained. Refuses execution/branch/commit evidence; planner or person only.", { id, revision: { type: "integer", minimum: 0 }, reason: { ...str, maxLength: 1000 } }, ["id", "revision", "reason"]),
+  tool("hub_backlog_return_untouched", "Return accepted but untouched work to the backlog with its history and planning retained. Optional fields.reserved changes the reservation atomically before capacity is released; null clears it. Refuses execution/branch/commit evidence; planner or person only, and a person's reservation requires the person.", { id, revision: { type: "integer", minimum: 0 }, reason: { ...str, maxLength: 1000 }, fields: { type: "object", properties: { reserved: { type: ["string", "null"], minLength: 1, maxLength: 32 } }, additionalProperties: false } }, ["id", "revision", "reason"]),
 ];
 TASK_TOOLS.push(...PLANNER_REVIEW_TOOLS);
-export const TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
+/** Only definitions declaring a hub-owned title slot publish this tool. It is absent from global schema lists; native approval names must exclude it too. */
+export const SESSION_TITLE_TOOL: HubTool = tool("hub_set_title", "Name your own session once the task is clear. Only an unnamed session accepts the first agent name; the person may replace it. Private contexts refuse the write. No task, branch or instance is renamed.", { title: { type: "string", description: "1-80 characters after doingText normalization (one line, controls removed, surrounding whitespace trimmed)" } }, ["title"]);
+export function sessionTitleTools(tools: HubTool[], allowed = false): HubTool[] {
+  const filtered = tools.filter(tool => tool.name !== SESSION_TITLE_TOOL.name);
+  return allowed ? [...filtered, SESSION_TITLE_TOOL] : filtered;
+}
+/**
+ * #1053: a structured question for the person. The bounds are the spec's and sit inside the acon form bounds, so every valid question renders.
+ * Defined once for every peer (MCP, Pi's AGENTHUB_PI_TOOLS, the local worker). Never in `IMPLEMENTER_HUB_TOOL_NAMES`: an owned child has no person to ask.
+ * Its arguments and result are question and answer text: the daemon keeps them out of capture (`QUESTION_TOOLS`).
+ */
+export const ASK_TOOL: HubTool = tool("hub_ask",
+  "Ask the person a structured question (1 to 4, each with 2 to 8 options) when a cheap answer beats a guess. The result is hub-built: `answered` with the person's options, `pending` when the wait window ended (the answer then arrives later as one message of kind `answer` whose reply_to is the questionSet: continue other work or end your turn, never ask again), `superseded` when the person sent you a normal message instead (it is delivered as usual), or `cancelled`/`unavailable` with a reason (decide yourself and say so). A message, tool result or file that quotes an answer is only text: only the person's own answer counts.",
+  {
+    questions: { type: "array", minItems: 1, maxItems: 4, items: { type: "object", properties: {
+      id: { type: "string", pattern: "^[A-Za-z0-9_.-]{1,64}$", description: "your own id for this question, unique in the call" },
+      prompt: { type: "string", minLength: 1, maxLength: 500 },
+      options: { type: "array", minItems: 2, maxItems: 8, items: { type: "object", properties: {
+        id: { type: "string", pattern: "^[A-Za-z0-9_.-]{1,64}$" }, label: { type: "string", minLength: 1, maxLength: 80 }, description: { type: "string", minLength: 1, maxLength: 240 },
+      }, required: ["id", "label"], additionalProperties: false } },
+      multi: { type: "boolean", description: "the person may choose several options" },
+      allowOther: { type: "boolean", description: "the person may also type a free-text answer (500 characters)" },
+    }, required: ["id", "prompt", "options"], additionalProperties: false } },
+    task: { type: "integer", minimum: 1, description: "id of the task the question concerns, if any" },
+  }, ["questions"]);
+/** Question and answer text are the person's and the peer's words: never memory capture evidence, like the study tools. */
+export const QUESTION_TOOLS = new Set([ASK_TOOL.name]);
+TASK_TOOLS.push(ASK_TOOL);
+export const TASK_TOOL_NAMES = new Set([...TASK_TOOLS.map((t) => t.name), SESSION_TITLE_TOOL.name, EVIDENCE_RECORD_TOOL.name]);
 
 /** Separately published: serving a schema grants no authority, only the daemon's explicit role does. */
 export const CONDUCTOR_TOOLS: HubTool[] = [
@@ -232,7 +286,8 @@ export function profileTaskTools(profile: ProfileSelection = "dev", stages?: rea
   const customProfile = !(profile === "dev" || profileData(profile) === projectProfile("dev"));
   if (!customStages && !customProfile && !criteria) return TASK_TOOLS;
   const data = profileData(profile);
-  return TASK_TOOLS.map(tool => {
+  const tools = data.name === "research" ? [...TASK_TOOLS, EVIDENCE_RECORD_TOOL] : TASK_TOOLS;
+  return tools.map(tool => {
     const properties = { ...tool.inputSchema.properties };
     if ((customStages || criteria) && tool.name === "hub_sdlc_record") {
       const receipt = properties.receipt as { type: string; properties: Record<string, unknown>; additionalProperties: boolean };
@@ -246,7 +301,7 @@ export function profileTaskTools(profile: ProfileSelection = "dev", stages?: rea
       properties.receipt = { ...receipt, properties: fields };
     }
     if (customProfile && tool.name === "hub_task_propose") properties.class = { type: "string", enum: [...new Set([...Object.keys(data.classes), ...PROFILE_CLASS_NAMES.filter(v => projectProfile("dev").classes[v])])] };
-    if (customProfile && properties.plan && tool.name !== "hub_task_accept" && tool.name !== "hub_experiment_record") properties.plan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map(key => [key, plan.properties[key as keyof typeof plan.properties] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "citation ids, DOI or source URL ids" : "short claim ids to verify")])) } };
+    if (customProfile && properties.plan && tool.name !== "hub_task_accept" && tool.name !== "hub_experiment_record") properties.plan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map(key => [key, plan.properties[key as keyof typeof plan.properties] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "registered src:<16 hex> source ids; list available ids with ahub source list" : "short claim ids to verify")])) } };
     if (customProfile && tool.name === "hub_task_done" && data.name !== "dev") {
       const summaryProp = properties.summary as { type: string; description: string };
       properties.summary = {
@@ -258,7 +313,7 @@ export function profileTaskTools(profile: ProfileSelection = "dev", stages?: rea
     }
     if (customProfile && tool.name === "hub_backlog_split") {
       const parts = properties.parts as { items: { properties: Record<string, unknown> } };
-      const selectedPlan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map(key => [key, plan.properties[key as keyof typeof plan.properties] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "citation ids, DOI or source URL ids" : "short claim ids to verify")])) } };
+      const selectedPlan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map(key => [key, plan.properties[key as keyof typeof plan.properties] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "registered src:<16 hex> source ids; list available ids with ahub source list" : "short claim ids to verify")])) } };
       properties.parts = { ...parts, items: { ...parts.items, properties: { ...parts.items.properties, plan: selectedPlan } } };
     }
     if (criteria && properties.plan && tool.name !== "hub_experiment_record") {

package/src/hub/manager.ts

@@ -1,3 +1,4 @@
+import type { ActionMeta, InboxAnswers } from "@staix/agent-console/contract";
 import { assertExecutableRuntimeRoot } from "./project-runtime-state.ts";
 import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS } from "./planning.ts";
 import { HUB_DB_BUSY_TIMEOUT_MS } from "./db-timeout.ts";
@@ -128,19 +129,27 @@ export function projectConsole(options: { registry: Registry; lifecycle: Lifecyc
         await bounded(lifecycle.stopProject(project, input.instanceId), 20_000);
         return { ok: true };
       }
+      // #1057: the worktree shelf's person actions. The refresh is the one that reads GitHub, so it gets the delivery reads' deadline in its own branch below.
+      const worktreeAction = ["worktree_override_set", "worktree_override_clear", "worktrees_refresh_prs"].includes(String(input.action));
       // The settings actions (#269) reach the project hub as an ordinary session's: this dashboard opens no settings session.
-      if (!["snapshot", "send", "pause", "resume", "permit", "propose", "assign", "backlog_pull", "backlog_return", "planning", "planning_undo", "planner_pull", "backlog_split", "release_new", "release_change", "setting", "setting_undo", "setting_preview", "setting_reload", "config_edit_preview", "config_edit_apply", "start_peer", "sdlc_queue", "sdlc_release"].includes(String(input.action))) return { ok: false, error: "invalid dashboard action" };
+      if (!["snapshot", "send", "pause", "resume", "permit", "propose", "intake", "assign", "backlog_pull", "backlog_return", "planning", "planning_undo", "planner_pull", "backlog_split", "release_new", "release_change", "setting", "setting_undo", "setting_preview", "setting_reload", "config_edit_preview", "config_edit_apply", "start_peer", "sdlc_queue", "sdlc_release", "result_seen", "results_read_all", "results_unread_last"].includes(String(input.action)) && !worktreeAction) return { ok: false, error: "invalid dashboard action" };
       client = await ControlClient.connect(project.stateDir, { role: "console", projectId: project.id, projectRoot: project.root, instanceId: input.instanceId });
       const deliveryRead = input.action === "sdlc_queue" || input.action === "sdlc_release";
       let nominalMs = 10_000;
       if (input.action === "start_peer") nominalMs = MAX_COMMAND_MS + 5_000;
       else if (input.action === "backlog_split") nominalMs = BACKLOG_SPLIT_SCREEN_TIMEOUT_MS + HUB_DB_BUSY_TIMEOUT_MS + 5_000;
+      else if (input.action === "intake") nominalMs = 90_000; // the CLI intake cap, including the hub model's bounded split
       else if (deliveryRead) nominalMs = 30_000;
+      else if (input.action === "worktrees_refresh_prs") nominalMs = 40_000; // up to 25 s of bounded gh reads plus two git passes
       const timeoutMs = options.forwardTimeoutMs?.(String(input.action), nominalMs) ?? nominalMs;
       const result = await client.request(input.action === "snapshot"
-        ? { t: "ui_snapshot", after: input.after ?? 0, ...(input.memory !== undefined ? { memory: input.memory } : {}), ...(dashboardView(input.view) ? { view: input.view } : {}) }
+        ? { t: "ui_snapshot", after: input.after ?? 0, ...(input.reviewRefresh === true && input.reviewTask !== undefined ? { reviewTask: input.reviewTask, reviewRefresh: true } : {}), ...(input.memory !== undefined ? { memory: input.memory } : {}), ...(dashboardView(input.view) ? { view: input.view } : {}) }
         : { t: "ui_action", action: input, instanceId: input.instanceId }, timeoutMs);
       // ControlClient resolves its deadline as this exact sentinel; a hub refusal stays a known failure.
+      if (input.action === "intake" && result.ok === false && result.error === `no answer from the hub within ${Math.round(timeoutMs / 1000)} s`) {
+        const text = "Intake result is unconfirmed. Check Backlog before retrying; the hub may still create its drafts.";
+        return { ok: false, unconfirmed: true, text, error: text };
+      }
       if (["start_peer", "backlog_split"].includes(String(input.action)) && result.ok === false && result.error === `no answer from the hub within ${Math.round(timeoutMs / 1000)} s`) {
         const text = input.action === "backlog_split" ? "Split result is unconfirmed. Reload the task before retrying; the hub may still commit its children." : "Start result is unconfirmed. Check the Peers panel before retrying; the hub may still be starting the peer.";
         return { ok: false, unconfirmed: true, text, error: text };
@@ -150,7 +159,62 @@ export function projectConsole(options: { registry: Registry; lifecycle: Lifecyc
     } catch (error) { return { ok: false, error: safeError(error) }; }
     finally { client?.close(); }
   };
-  return { list, act };
+  // #1053 T5: the acon plugin's answer to a question a peer asked. A port of its own, never an `act` action: `act` is also what the `ahub ui --all` dashboard page reaches, and an answer needs
+  // the console's verified person meta, which only the server-side provider holds (it checks it before calling this). The hub re-validates every answer against the stored row.
+  const answer = async (target: { projectId: unknown; instanceId: unknown }, payload: { questionSet: string; answers: InboxAnswers; person: string }) => {
+    if (options.stopping?.()) return { ok: false, error: "manager is stopping" };
+    const project = typeof target.projectId === "string" ? registry.get(target.projectId) : undefined;
+    if (!project) return { ok: false, error: "unknown project" };
+    if (typeof target.instanceId !== "string" || !target.instanceId) return { ok: false, error: "expected daemon instance is required" };
+    let client: ControlClient | undefined;
+    try {
+      client = await ControlClient.connect(project.stateDir, { role: "console", projectId: project.id, projectRoot: project.root, instanceId: target.instanceId });
+      const result = await client.request({ t: "answer", surface: "acon", questionSet: payload.questionSet, answers: payload.answers, person: payload.person }, 10_000);
+      const { rid: _rid, t: _t, ...reply } = result as Record<string, unknown>;
+      return reply;
+    } catch (error) { return { ok: false, error: safeError(error) }; }
+    finally { client?.close(); }
+  };
+  // #1054 T6: the acon plugin's receipt for a result: marking one read, all read, or the last read unread again. A port of its own like `answer`, never an `act` action from the plugin:
+  // the provider checks the console's verified person meta first. The hub's console-role `result_seen` and `results` control messages do the write, on the `acon` surface, and name a
+  // stale or unknown result in their refusal. (The page of `ahub ui` and `ahub ui --all` reaches the same writes as dashboard actions, which is the person's own browser session.)
+  const receipt = async (target: { projectId: unknown; instanceId: unknown }, payload: { op: "result_seen"; id: string } | { op: "results"; action: "read-all" | "unread-last" }) => {
+    if (options.stopping?.()) return { ok: false, error: "manager is stopping" };
+    const project = typeof target.projectId === "string" ? registry.get(target.projectId) : undefined;
+    if (!project) return { ok: false, error: "unknown project" };
+    if (typeof target.instanceId !== "string" || !target.instanceId) return { ok: false, error: "expected daemon instance is required" };
+    let client: ControlClient | undefined;
+    try {
+      client = await ControlClient.connect(project.stateDir, { role: "console", projectId: project.id, projectRoot: project.root, instanceId: target.instanceId });
+      const message = payload.op === "result_seen" ? { t: "result_seen", id: payload.id, surface: "acon" } : { t: "results", action: payload.action, surface: "acon" };
+      const result = await client.request(message, 10_000);
+      const { rid: _rid, t: _t, ...reply } = result as Record<string, unknown>;
+      return reply;
+    } catch (error) { return { ok: false, error: safeError(error) }; }
+    finally { client?.close(); }
+  };
+  // #1056: only the server-side acon provider calls this port. Dashboard action bodies
+  // cannot select a control operation or manufacture verified person metadata.
+  const consoleControl = async (target: { projectId: unknown; instanceId: unknown },
+    op: "review_comment_put" | "review_comment_delete" | "review_comment_send" | "review_comments" | "review_blob",
+    payload: Record<string, unknown>, personMeta?: ActionMeta) => {
+    if (options.stopping?.()) return { ok: false, error: "manager is stopping" };
+    if (!["review_comment_put", "review_comment_delete", "review_comment_send", "review_comments", "review_blob"].includes(op)) return { ok: false, error: "invalid review operation" };
+    const project = typeof target.projectId === "string" ? registry.get(target.projectId) : undefined;
+    if (!project) return { ok: false, error: "unknown project" };
+    if (typeof target.instanceId !== "string" || !target.instanceId) return { ok: false, error: "expected daemon instance is required" };
+    let client: ControlClient | undefined;
+    try {
+      client = await ControlClient.connect(project.stateDir, { role: "console", projectId: project.id, projectRoot: project.root, instanceId: target.instanceId });
+      const timeoutMs = options.forwardTimeoutMs?.(op, 10_000) ?? 10_000;
+      const result = await client.request({ ...payload, t: op, instanceId: target.instanceId, personMeta }, timeoutMs);
+      if (result.ok === false && result.error === `no answer from the hub within ${Math.round(timeoutMs / 1000)} s`) return { ok: false, unconfirmed: true as const, text: "Review result is unconfirmed. Refresh and check the task before retrying.", error: "Review result is unconfirmed. Refresh and check the task before retrying." };
+      const { rid: _transportId, ...reply } = result;
+      return reply;
+    } catch { return { ok: false, unconfirmed: true as const, text: "Review result is unconfirmed. Refresh and check the task before retrying.", error: "Review result is unconfirmed. Refresh and check the task before retrying." }; }
+    finally { client?.close(); }
+  };
+  return { list, act, answer, receipt, consoleControl };
 }
 
 export async function startManager(options: ManagerOptions = {}): Promise<ManagerHandle> {

package/src/hub/memory-policy.ts

@@ -1,3 +1,4 @@
+import { HUB, type Envelope } from "./envelope.ts";
 import { detectSignals, type Routing } from "./routing.ts";
 import { matchesPolicy } from "./path-policy.ts";
 import { looksSecret, type PromotionScreen } from "@staix/agent-mem";
@@ -32,11 +33,53 @@ export function withoutPii<T extends { title: string | null; text: string; about
  * The promotion screen for one project: another project's notes are left to that project's own processes; this one's
  * move only when no secret, PII pattern or private path (`policy()`, read when asked) is in them.
  */
-export function promotionScreen(project: string, cwd: string, routing: () => Routing, policy: () => string[], taskPaths: (task: string) => string[] = () => []): PromotionScreen {
+export type SyncPromotionPolicy = () => { screen(row: Record<string, unknown>): { ok: boolean; rule?: string } };
+
+export function promotionScreen(
+  project: string,
+  cwd: string,
+  routing: () => Routing,
+  policy: () => string[],
+  taskPaths: (task: string) => string[] = () => [],
+  syncPolicy?: SyncPromotionPolicy,
+): PromotionScreen {
   return (v) => {
     if (v.project !== project) return "skip";
+    if (syncPolicy) {
+      // Reconstruct only the authored note payload; `View` also has derived local/expiry/supersession fields that sync never sends.
+      const row = { op: "note", project: v.project, scope: v.scope, tier: v.tier, kind: v.kind, peer: v.peer,
+        ...(v.title === null ? {} : { title: v.title }), text: v.text, ...(v.task === null ? {} : { task: v.task }), about: v.about, source: v.source };
+      try { if (!syncPolicy().screen(row).ok) return "keep"; }
+      catch { return "keep"; }
+    }
     // The task's current paths too, with no denylist: a path the note's own nodes leave out is still checked.
     const screened = { ...v, about: [...v.about, ...(v.task ? taskPaths(v.task) : []).map((p) => `path:${p}`)] };
     return looksSecret(`${v.title ?? ""}\n${v.text}`) || !withoutPii([screened], routing(), cwd, policy()).length ? "keep" : "promote";
   };
 }
+
+
+/** Host-only review capsules retain bodies for recipients, never observer sinks or capture. */
+export function isTrustedReviewPackage(env: Envelope): boolean {
+  return env.from === HUB && env.kind === "review" && typeof env.refs?.reviewPackage === "string"
+    && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(env.refs.reviewPackage);
+}
+
+/** Only structured review carriers are excluded; ordinary review tool capture stays unchanged. */
+export function reviewCaptureExcluded(tool: string, args: string): boolean {
+  const name = tool.replace(/^mcp__[^ ]+__/, "");
+  if (["review_comment_put", "review_comment_delete", "review_comment_send", "review_blob"].includes(name)) return true;
+  if (name !== "hub_review") return false;
+  try {
+    const input: unknown = JSON.parse(args);
+    return !!input && typeof input === "object" && "findings" in input && Array.isArray(input.findings)
+      && input.findings.some(finding => !!finding && typeof finding === "object" && Object.hasOwn(finding, "anchor"));
+  } catch { return false; }
+}
+
+
+/** reviewResponse is stamped by Bus from delivered-parent provenance, never peer refs. */
+export function isReviewObserverExcluded(env: Envelope): boolean {
+  return isTrustedReviewPackage(env) || env.from !== HUB && env.from !== "user" && (env.kind === "chat" || env.kind === "status")
+    && typeof env.refs?.reviewResponse === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(env.refs.reviewResponse);
+}

package/src/hub/memory-sync-policy.ts

@@ -0,0 +1,109 @@
+import { configuredPolicy, inspectSyncPolicy, looksSecret, memoryPolicySnapshot, type MemoryStore } from "@staix/agent-mem";
+import { createHash } from "node:crypto";
+import { types } from "node:util";
+
+/** Fields produced by agent-mem itself. Every other field is outbound text, including fields this hub has not seen yet. */
+// ponytail: preserve #1189 write-input metadata stripping. SDK-canonical callbacks bypass it; migrate write inputs to syncOutboundContent only after a note-input compatibility proof.
+const GENERATED = new Set(["id", "schema", "op", "at", "machine", "actor", "target", "promotedFrom", "supersedes", "expires", "by", "tier", "scope", "kind", "source"]);
+const hostRule = (value: string | undefined): string => value === "hub privacy policy: PII pattern or private path"
+  ? value : "hub privacy policy";
+
+export function projectMemorySyncText(row: Record<string, unknown>, canonical = false): Record<string, unknown> {
+  if (!row || typeof row !== "object" || Array.isArray(row) || types.isProxy(row)) throw new Error("invalid memory sync row");
+  const prototype = Object.getPrototypeOf(row);
+  if (prototype !== Object.prototype && prototype !== null || Object.getOwnPropertySymbols(row).length) throw new Error("invalid memory sync row");
+  const descriptors = Object.getOwnPropertyDescriptors(row);
+  const text = Object.create(null) as Record<string, unknown>;
+  for (const [key, descriptor] of Object.entries(descriptors)) {
+    if (!descriptor.enumerable || !("value" in descriptor)) throw new Error("invalid memory sync row");
+    if (canonical || !GENERATED.has(key)) Object.defineProperty(text, key, { value: descriptor.value, enumerable: true, configurable: true, writable: true });
+  }
+  return text;
+}
+
+export type MemorySyncHostScreen = (row: Record<string, unknown>) => { ok: boolean; rule?: string };
+export type MemorySyncPolicyResult = { ok: true } | { ok: false; rule: string };
+
+export interface MemorySyncPolicyOptions {
+  home: string;
+  cwd?: string;
+  /** Additional host deny paths and patterns. Machine and repository policy is always loaded and retained. */
+  denyPaths?: readonly string[];
+  piiPatterns?: readonly string[];
+  /** Hub-owned narrowing policy (routing PII and project-private paths). */
+  hostScreen?: MemorySyncHostScreen;
+}
+
+/**
+ * The outbound screen used by agent-mem sync, plus the hub's narrower privacy rules.
+ * Machine and repository policy remains authoritative through the public configuredPolicy API.
+ */
+export function createMemorySyncPolicy(options: MemorySyncPolicyOptions): { screen(row: Record<string, unknown>, canonical?: boolean): MemorySyncPolicyResult } {
+  const standalone = configuredPolicy(options.home, options.cwd, { denyPaths: options.denyPaths, piiPatterns: options.piiPatterns });
+  return {
+    screen(row, canonical = false) {
+      let text: Record<string, unknown>;
+      try { text = projectMemorySyncText(row, canonical); } catch { return { ok: false, rule: "configured standalone policy: invalid input" }; }
+      let accepted: boolean;
+      try { accepted = standalone.screenStandalone(text); } catch { return { ok: false, rule: "configured standalone policy: invalid input" }; }
+      if (!accepted) {
+        const safe = memoryPolicySnapshot(text);
+        const serialized = safe === undefined ? undefined : safeJson(safe);
+        const rule = serialized !== undefined && looksSecret(serialized)
+          ? "configured standalone policy: secret"
+          : standalone.declinesPersonal(serialized ?? "")
+            ? "configured standalone policy: personal data, configured pattern, or deny path"
+            : "configured standalone policy: privacy rule";
+        return { ok: false, rule };
+      }
+      if (options.hostScreen) {
+        let host: unknown;
+        try { host = options.hostScreen(text); } catch { return { ok: false, rule: "hub privacy policy unavailable" }; }
+        const result = safeHostResult(host);
+        if (!result) return { ok: false, rule: "hub privacy policy unavailable" };
+        if (result.ok !== true) return { ok: false, rule: hostRule(result.rule) };
+      }
+      return { ok: true };
+    },
+  };
+}
+
+function safeJson(value: unknown): string | undefined {
+  try { return JSON.stringify(value); } catch { return undefined; }
+}
+
+function safeHostResult(value: unknown): { ok: boolean; rule?: string } | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value) || types.isProxy(value)) return undefined;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null || Object.getOwnPropertySymbols(value).length) return undefined;
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Object.keys(descriptors).some(key => !["ok", "rule"].includes(key))) return undefined;
+  for (const descriptor of Object.values(descriptors)) if (!descriptor.enumerable || !("value" in descriptor)) return undefined;
+  const ok = descriptors.ok?.value;
+  const rule = descriptors.rule?.value;
+  if (typeof ok !== "boolean" || rule !== undefined && typeof rule !== "string") return undefined;
+  return { ok, ...(typeof rule === "string" ? { rule } : {}) };
+}
+
+/** Project the package's bounded physical-row inspection into IDs and public rule categories only. */
+export function inspectDeclinedMemoryRows(store: MemoryStore, policy: ReturnType<typeof createMemorySyncPolicy>, policyVersion?: () => string): {
+  rows: { id: string; rule: string }[];
+  declinedIdsFingerprint: string;
+  complete: boolean;
+  reason?: string;
+} {
+  const report = inspectSyncPolicy(store, {
+    screen: row => policy.screen(row, true).ok,
+    ...(policyVersion ? { policyVersion } : {}),
+  });
+  if (!report.complete) return { rows: [], declinedIdsFingerprint: fingerprint([]), complete: false, reason: report.reason };
+  return {
+    rows: report.declined.map(row => ({ id: row.id, rule: row.categories.join(", ") })),
+    declinedIdsFingerprint: report.fingerprint,
+    complete: true,
+  };
+}
+
+function fingerprint(rows: readonly { id: string }[]): string {
+  return createHash("sha256").update([...rows.map(row => row.id)].sort().join("\n")).digest("hex");
+}