@stigmer/runner 3.1.2 → 3.1.3

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -292,5 +292,16 @@ describe("buildEnhancedSystemPrompt", () => {
 
       expect(prompt).not.toContain("## Implement the approved plan");
     });
+
+    it("carries the plan-derived progress-tracking instruction (Tier 3)", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        buildFromPlan: true,
+        injectedFiles: [planFile],
+      });
+
+      expect(prompt).toContain("to-do list");
+      expect(prompt).toContain("break the plan into");
+    });
   });
 });

package/src/activities/execute-deep-agent/index.ts

@@ -50,6 +50,10 @@ import {
   captureBaselineToLedger,
   captureCandidateToLedger,
 } from "../../shared/filereview/capture.js";
+import {
+  captureFileChangeProgress,
+  newProgressCaptureState,
+} from "../../shared/filereview/progress.js";
 import { hasCandidateCaptured } from "../../shared/filereview/events.js";
 import { casBlobReader, type CasPathCapture } from "../../shared/filereview/cas-substrate.js";
 import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
@@ -319,6 +323,15 @@ export function createDeepAgentActivities(config: Config) {
           });
         }
 
+        // Per-turn state for mid-run live capture (DD-32): the last progress tree
+        // sha (short-circuit) + last capture time (floor), threaded across the
+        // streaming loop's persists via the beforePersist hook below. The capture
+        // flags are hoisted so the deferred hook does not depend on `setup`
+        // (non-null here, but not narrowable inside a later-invoked closure).
+        const progressState = newProgressCaptureState();
+        const progressCaptureMode = setup.captureMode;
+        const progressGitWorkspace = setup.gitWorkspace;
+
         const cancellationSignal = Context.current().cancellationSignal;
 
         const result: StreamResult = await streamExecution({
@@ -344,6 +357,23 @@ export function createDeepAgentActivities(config: Config) {
             globalBypass: setup.globalBypass,
           },
           streamVersion: setup.streamVersion,
+          // Mid-run live capture (DD-32): attach file_change_progress before each
+          // scheduled persist. Git capture mode only (a pinned baseline exists);
+          // deep-agent writes no runner-owned gate files into the tree, so no
+          // excludePaths — matching its turn-boundary candidate capture.
+          beforePersist: async (status) => {
+            if (!progressCaptureMode || !progressGitWorkspace || !captureBaselineTree) {
+              return;
+            }
+            await captureFileChangeProgress({
+              status,
+              gitRoot,
+              executionId,
+              changeSetId,
+              baselineTree: captureBaselineTree,
+              state: progressState,
+            });
+          },
         });
 
         await processPostStream({
@@ -556,9 +586,10 @@ export function createDeepAgentActivities(config: Config) {
         }
 
         // Plan mode: the agent's final message is the plan. Publish it as a
-        // first-class plan.md artifact so the UI can render a reviewable Plan
-        // card and a follow-up Implement run can reference it. Read-only mode
-        // produces no file to auto-publish, so this is the only artifact path.
+        // first-class plan artifact (named from the plan's title) so the UI can
+        // render a reviewable Plan card and a follow-up Implement run can
+        // reference it. Read-only mode produces no file to auto-publish, so
+        // this is the only artifact path.
         // Requires artifact storage; with none (proxy misconfig) the plan text
         // still lives in the final message — only the reviewable artifact is
         // skipped (mirrors Cursor's storage-guarded plan publish).

package/src/activities/execute-deep-agent/streaming-v3.ts

@@ -118,10 +118,15 @@ export async function streamExecutionV3(
         }
 
         statusBuilder.syncSubAgentExecutions();
+        // Mid-run live capture (DD-32): attach file_change_progress to the live
+        // status before it is persisted. Injected so this loop stays ignorant of
+        // file-review specifics; a no-op when the hook is absent or nothing changed.
+        const statusToPersist = statusBuilder.currentStatus;
+        await deps.beforePersist?.(statusToPersist);
         const signal = await persistStatus(
           client,
           executionId,
-          statusBuilder.currentStatus,
+          statusToPersist,
           { offload, retry: retryOptions },
         );
         scheduler.markUpdateSent(eventsProcessed);

package/src/activities/execute-deep-agent/streaming.ts

@@ -83,6 +83,13 @@ export interface StreamDependencies {
   readonly approvalProvider?: ApprovalPolicyProvider;
   /** Streaming protocol version. Defaults to "v2" if unset. */
   readonly streamVersion?: "v2" | "v3";
+  /**
+   * Optional hook invoked with the live status just before each scheduled
+   * persist. Used by mid-run live capture (DD-32) to attach file_change_progress.
+   * Kept as an injected callback (closing over the turn's baseline tree / change
+   * set id in index.ts) so this loop stays ignorant of file-review specifics.
+   */
+  readonly beforePersist?: (status: AgentExecutionStatus) => Promise<void>;
 }
 
 export interface StreamResult {
@@ -189,10 +196,14 @@ async function streamExecutionV2(
           statusBuilder.clearForceFlag();
         }
 
+        // Mid-run live capture (DD-32): attach file_change_progress to the live
+        // status before persisting (see streaming-v3.ts for the rationale).
+        const statusToPersist = statusBuilder.currentStatus;
+        await deps.beforePersist?.(statusToPersist);
         const signal = await persistStatus(
           client,
           executionId,
-          statusBuilder.currentStatus,
+          statusToPersist,
           { offload, retry: retryOptions },
         );
         scheduler.markUpdateSent(eventsProcessed);

package/src/shared/__tests__/implement-plan-prompt.test.ts

@@ -5,7 +5,7 @@ import {
 } from "../implement-plan-prompt.js";
 
 describe("findApprovedPlanPath", () => {
-  it("finds the plan by its canonical filename among attachment paths", () => {
+  it("finds the plan by the legacy filename among attachment paths", () => {
     expect(
       findApprovedPlanPath([
         ".stigmer/inputs/data.csv",
@@ -14,15 +14,28 @@ describe("findApprovedPlanPath", () => {
     ).toBe(".stigmer/inputs/plan.md");
   });
 
+  it("finds a title-named <slug>_<id>.plan.md plan", () => {
+    expect(
+      findApprovedPlanPath([
+        ".stigmer/inputs/data.csv",
+        ".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md",
+      ]),
+    ).toBe(".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md");
+  });
+
   it("returns undefined when no plan attachment resolved", () => {
     expect(findApprovedPlanPath([".stigmer/inputs/data.csv"])).toBeUndefined();
     expect(findApprovedPlanPath([])).toBeUndefined();
   });
 
-  it("matches the basename exactly — a plan-adjacent filename is not the plan", () => {
+  it("matches the plan convention only — a plan-adjacent filename is not the plan", () => {
     expect(
       findApprovedPlanPath([".stigmer/inputs/my-plan.md.bak"]),
     ).toBeUndefined();
+    // A file merely containing "plan" is not a plan artifact.
+    expect(
+      findApprovedPlanPath([".stigmer/inputs/myplan.md"]),
+    ).toBeUndefined();
   });
 });
 
@@ -45,4 +58,29 @@ describe("buildImplementPlanDirective", () => {
     expect(directive).toContain("conversation above");
     expect(directive).not.toContain("plan.md");
   });
+
+  // Tier 3 (plan-driven build progress): both variants instruct the agent to
+  // derive its to-do list from the plan and keep it current — the agent's todo
+  // tool is the single writer of status.todos, so this instruction is the
+  // entire plan→progress linkage.
+  it("instructs plan-derived progress tracking in the attached variant", () => {
+    const directive = buildImplementPlanDirective(".stigmer/inputs/plan.md");
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+  });
+
+  it("instructs plan-derived progress tracking in the conversation-only variant", () => {
+    const directive = buildImplementPlanDirective(undefined);
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+    // The progress block must never name the file — this variant exists
+    // because no plan file materialized.
+    expect(directive).not.toContain("plan.md");
+  });
 });

package/src/shared/__tests__/plan-artifact.test.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { describe, it, expect } from "vitest";
 import { create } from "@bufbuild/protobuf";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
@@ -11,8 +12,9 @@ import { makeInMemoryArtifactStorage } from "../../__test-utils__/fake-artifact-
 import {
   extractFinalPlanText,
   publishPlanArtifact,
+  planArtifactName,
+  isPlanArtifactName,
   PLAN_ARTIFACT_NAME,
-  PLAN_ARTIFACT_SANDBOX_PATH,
 } from "../plan-artifact.js";
 
 /** Records uploads and returns deterministic download URLs (canonical double + shim). */
@@ -27,6 +29,11 @@ function fakeStorage(): ArtifactStorage & { uploads: { key: string; content: Buf
   return Object.assign(storage, { uploads });
 }
 
+/** Mirrors the runner's content-hash discriminator so tests can assert exact names. */
+function planId(text: string): string {
+  return createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 8);
+}
+
 function statusWith(...messages: { type: MessageType; content: string }[]) {
   return create(AgentExecutionStatusSchema, {
     messages: messages.map((m) =>
@@ -59,30 +66,129 @@ describe("extractFinalPlanText", () => {
   });
 });
 
+describe("planArtifactName", () => {
+  it("derives a hyphenated <slug>_<id>.plan.md name from the plan's leading # H1", () => {
+    const text = "# Plan Card UX Cleanup\n\nBody";
+    // "Plan Card…" has no label separator, so the genuine word "plan" survives.
+    expect(planArtifactName(text)).toBe(`plan-card-ux-cleanup_${planId(text)}.plan.md`);
+  });
+
+  it("strips a leading 'Plan:' LABEL (colon/dash-anchored) from the slug", () => {
+    const text = "# Plan: Fix the download UX\n\nbody";
+    expect(planArtifactName(text)).toBe(`fix-the-download-ux_${planId(text)}.plan.md`);
+  });
+
+  it("collapses runs of punctuation/whitespace and trims edge hyphens", () => {
+    const text = "#  Fix: the (download) UX!! \nx";
+    expect(planArtifactName(text)).toBe(`fix-the-download-ux_${planId(text)}.plan.md`);
+  });
+
+  it("unwraps a ```markdown fenced plan before reading the title (SDK parity)", () => {
+    const text = "```markdown\n# Named Plan\n\nbody\n```";
+    expect(planArtifactName(text)).toBe(`named-plan_${planId(text)}.plan.md`);
+  });
+
+  it("unwraps a bare ``` fenced plan before reading the title (SDK parity)", () => {
+    const text = "```\n# Bare Fenced Plan\n\nbody\n```";
+    expect(planArtifactName(text)).toBe(`bare-fenced-plan_${planId(text)}.plan.md`);
+  });
+
+  it("caps the slug length so filenames stay bounded", () => {
+    const longTitle = "# " + "word ".repeat(40); // ~200 chars of words
+    const name = planArtifactName(longTitle);
+    const match = /^(.+)_[0-9a-f]{8}\.plan\.md$/.exec(name);
+    expect(match).not.toBeNull();
+    const slug = match![1];
+    expect(slug.length).toBeLessThanOrEqual(60);
+    expect(slug.endsWith("-")).toBe(false);
+  });
+
+  it("falls back to a bare <id>.plan.md when there is no leading H1", () => {
+    const noTitle = "No title here\n\nbody";
+    expect(planArtifactName(noTitle)).toBe(`${planId(noTitle)}.plan.md`);
+    // An H1 further down is body content, not the title.
+    const later = "intro\n\n# Later Heading";
+    expect(planArtifactName(later)).toBe(`${planId(later)}.plan.md`);
+  });
+
+  it("falls back to a bare <id>.plan.md when the title is only the 'Plan:' label", () => {
+    const text = "# Plan:\n\nbody";
+    expect(planArtifactName(text)).toBe(`${planId(text)}.plan.md`);
+  });
+
+  it("falls back to a bare <id>.plan.md when the title has no alphanumerics", () => {
+    const text = "# ---\n\nbody";
+    expect(planArtifactName(text)).toBe(`${planId(text)}.plan.md`);
+  });
+
+  it("never freshly emits the legacy plan.md name", () => {
+    for (const text of ["# A Title\n\nbody", "no heading", "# Plan:\n\nx"]) {
+      expect(planArtifactName(text)).not.toBe(PLAN_ARTIFACT_NAME);
+    }
+  });
+});
+
+describe("isPlanArtifactName", () => {
+  it("accepts the legacy exact name and any *.plan.md", () => {
+    expect(isPlanArtifactName("plan.md")).toBe(true);
+    expect(isPlanArtifactName("feature_x.plan.md")).toBe(true);
+    expect(isPlanArtifactName("fix-the-download-ux_a1b2c3d4.plan.md")).toBe(true);
+    expect(isPlanArtifactName("a1b2c3d4.plan.md")).toBe(true);
+  });
+
+  it("rejects non-plan filenames", () => {
+    expect(isPlanArtifactName("notes.md")).toBe(false);
+    expect(isPlanArtifactName("plan.md.bak")).toBe(false);
+    expect(isPlanArtifactName("myplan.md")).toBe(false);
+  });
+});
+
 describe("publishPlanArtifact", () => {
-  it("uploads plan.md and registers a FILE artifact on the status", async () => {
+  it("uploads the named plan and registers a FILE artifact on the status", async () => {
     const status = create(AgentExecutionStatusSchema, {});
     const storage = fakeStorage();
 
+    const planText = "# Plan Card UX Cleanup\n1. step one\n2. step two\n";
+    const name = `plan-card-ux-cleanup_${planId(planText)}.plan.md`;
     await publishPlanArtifact({
       status,
       executionId: "aex_123",
-      planText: "# Plan\n1. step one\n2. step two\n",
+      planText,
       artifactStorage: storage,
     });
 
     expect(storage.uploads).toHaveLength(1);
-    expect(storage.uploads[0].key).toBe("artifacts/aex_123/plan.md");
+    expect(storage.uploads[0].key).toBe(`artifacts/aex_123/${name}`);
     expect(storage.uploads[0].contentType).toBe("text/markdown");
 
     expect(status.artifacts).toHaveLength(1);
     const artifact = status.artifacts[0];
-    expect(artifact.name).toBe(PLAN_ARTIFACT_NAME);
-    expect(artifact.sandboxPath).toBe(PLAN_ARTIFACT_SANDBOX_PATH);
+    expect(artifact.name).toBe(name);
+    expect(artifact.sandboxPath).toBe(`.stigmer/plans/${name}`);
     expect(artifact.kind).toBe(ExecutionArtifactKind.FILE);
-    expect(artifact.storageKey).toBe("artifacts/aex_123/plan.md");
+    expect(artifact.storageKey).toBe(`artifacts/aex_123/${name}`);
     expect(artifact.sizeBytes).toBeGreaterThan(0n);
     expect(artifact.contentHash).toHaveLength(64);
+    // The filename's <id> is the leading 8 hex of the full content hash.
+    expect(artifact.contentHash.startsWith(planId(planText))).toBe(true);
+  });
+
+  it("uses a bare <id>.plan.md name for a titleless plan (never the legacy plan.md)", async () => {
+    const status = create(AgentExecutionStatusSchema, {});
+    const storage = fakeStorage();
+
+    const planText = "just a paragraph, no heading";
+    const name = `${planId(planText)}.plan.md`;
+    await publishPlanArtifact({
+      status,
+      executionId: "aex_notitle",
+      planText,
+      artifactStorage: storage,
+    });
+
+    expect(status.artifacts[0].name).toBe(name);
+    expect(status.artifacts[0].name).not.toBe(PLAN_ARTIFACT_NAME);
+    expect(storage.uploads[0].key).toBe(`artifacts/aex_notitle/${name}`);
   });
 
   it("is a no-op for empty plan text (nothing to publish)", async () => {
@@ -100,20 +206,47 @@ describe("publishPlanArtifact", () => {
     expect(status.artifacts).toHaveLength(0);
   });
 
-  it("replaces an existing plan.md rather than appending a duplicate", async () => {
+  it("replaces an existing plan rather than appending a duplicate", async () => {
     const status = create(AgentExecutionStatusSchema, {});
     const storage = fakeStorage();
 
     await publishPlanArtifact({ status, executionId: "aex_re", planText: "v1", artifactStorage: storage });
     await publishPlanArtifact({ status, executionId: "aex_re", planText: "v2 longer plan", artifactStorage: storage });
 
+    // Replacement is at the STATUS level, matched by the *.plan.md predicate:
+    // exactly one plan artifact survives. Because names are content-derived,
+    // the two differing-content writes land under DIFFERENT keys (the first is
+    // an orphan blob) — but this synthetic double-publish never happens in
+    // production, where publishPlanArtifact runs once per execution finalization
+    // and a same-content retry re-writes the same key.
     expect(status.artifacts).toHaveLength(1);
     expect(storage.uploads).toHaveLength(2);
-    // The surviving artifact reflects the latest content hash.
     const latestHash = storage.uploads[1].content;
     expect(status.artifacts[0].sizeBytes).toBe(BigInt(latestHash.length));
   });
 
+  it("replaces a prior plan even when the derived name changed (predicate match)", async () => {
+    const status = create(AgentExecutionStatusSchema, {});
+    const storage = fakeStorage();
+
+    await publishPlanArtifact({
+      status,
+      executionId: "aex_rename",
+      planText: "# First Title\n\nbody",
+      artifactStorage: storage,
+    });
+    const secondText = "# Second Title\n\nbody";
+    await publishPlanArtifact({
+      status,
+      executionId: "aex_rename",
+      planText: secondText,
+      artifactStorage: storage,
+    });
+
+    expect(status.artifacts).toHaveLength(1);
+    expect(status.artifacts[0].name).toBe(`second-title_${planId(secondText)}.plan.md`);
+  });
+
   it("never throws when the upload fails (publish is non-fatal)", async () => {
     const status = create(AgentExecutionStatusSchema, {});
     const { storage: failing } = makeInMemoryArtifactStorage();

package/src/shared/filereview/__tests__/capture.test.ts

@@ -14,7 +14,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { clone, create } from "@bufbuild/protobuf";
+import { clone, create, toBinary } from "@bufbuild/protobuf";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
@@ -28,6 +28,7 @@ import {
   FileCaptureClass,
   FileChangeKind,
   FileChangeSetStatus,
+  FileChangeType,
   FileDecisionAction,
   FileDecisionScope,
   FileReviewBlockReason,
@@ -41,7 +42,9 @@ import {
   captureBaselineToLedger,
   captureCandidateToLedger,
   deriveCaptureMode,
+  partitionGitChangesBySecret,
 } from "../capture.js";
+import type { GitSubstrateChange } from "../git-substrate.js";
 import { casBlobReader } from "../cas-substrate.js";
 
 const execFileAsync = promisify(execFile);
@@ -609,6 +612,184 @@ describe("capture orchestration — secret-blocked DIFF_UNREVIEWABLE (DD-E)", ()
   });
 });
 
+// A git-TRACKED secret-like file (a committed credentials.json, .env.example,
+// ...) FLOWS in capture mode (the gate allows tracked mutations with no secret
+// check), so it reaches the turn boundary in the git diff WITH real bytes. Those
+// bytes must never enter the ledger: the capture seam authors it content-less
+// (SECRET_WITHHELD / GIT_TRACKED), discard-only, and the git substrate reverts
+// it byte-exact on reject. This is the one place that can withhold a DELETE's
+// baseline (before) secret too — the gate never sees a delete's content.
+// (DD-26 follow-up #3.)
+describe("capture orchestration — git-tracked secret withheld (DD-26 follow-up #3)", () => {
+  const SECRET_PATH = "config/credentials.json";
+  const BASELINE_SECRET = "OLD_API_KEY=sk-live-OLDSECRET-do-not-persist-111\n";
+  const NEW_SECRET = "NEW_API_KEY=sk-live-NEWSECRET-do-not-persist-222\n";
+
+  async function commitBaselineSecret(): Promise<void> {
+    await write(SECRET_PATH, BASELINE_SECRET);
+    await git(["add", "-A"]);
+    await git(["commit", "-q", "-m", "add tracked secret"]);
+  }
+
+  // Serialize the WHOLE persisted status (ledger + any rows) and assert neither
+  // the baseline nor the new secret bytes survive anywhere — the leak-scan that
+  // would FAIL before this fix (the git diff carried the inline body).
+  function assertNoSecretBytes(status: AgentExecutionStatus): void {
+    const wire = Buffer.from(toBinary(AgentExecutionStatusSchema, status));
+    expect(wire.includes(Buffer.from(BASELINE_SECRET))).toBe(false);
+    expect(wire.includes(Buffer.from(NEW_SECRET))).toBe(false);
+  }
+
+  it("MODIFY: content-less SECRET_WITHHELD/GIT_TRACKED entry; PARTIAL_BLOCKED; nothing persisted", async () => {
+    await commitBaselineSecret();
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID, harnessId: HARNESS,
+    });
+    await write(SECRET_PATH, NEW_SECRET); // the agent edits the committed secret
+
+    await captureCandidateToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      baselineTree: baseline, harnessId: HARNESS,
+    });
+
+    const entry = candidateChanges(status).find((c) => (c.pathAfter || c.pathBefore) === SECRET_PATH)!;
+    expect(entry).toBeDefined();
+    expect(entry.captureClass).toBe(FileCaptureClass.GIT_TRACKED);
+    expect(entry.kind).toBe(FileChangeKind.MODIFY);
+    expect(entry.diffComplete).toBe(false);
+    expect(entry.blockedReason).toBe(FileReviewBlockReason.SECRET_WITHHELD);
+    // No content and no enforcement digests on EITHER side (before is secret too).
+    expect(entry.before).toBeUndefined();
+    expect(entry.after).toBeUndefined();
+    expect(entry.beforeSha256).toBe("");
+    expect(entry.afterSha256).toBe("");
+    expect(candidateCompleteness(status)).toBe(DiffCompleteness.PARTIAL_BLOCKED);
+    assertNoSecretBytes(status);
+  });
+
+  it("CREATE: a newly-created tracked secret is content-less (kind ADD, no after bytes)", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID, harnessId: HARNESS,
+    });
+    await write(SECRET_PATH, NEW_SECRET); // brand-new secret file this turn
+
+    await captureCandidateToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      baselineTree: baseline, harnessId: HARNESS,
+    });
+
+    const entry = candidateChanges(status).find((c) => (c.pathAfter || c.pathBefore) === SECRET_PATH)!;
+    expect(entry.kind).toBe(FileChangeKind.ADD);
+    expect(entry.captureClass).toBe(FileCaptureClass.GIT_TRACKED);
+    expect(entry.diffComplete).toBe(false);
+    expect(entry.blockedReason).toBe(FileReviewBlockReason.SECRET_WITHHELD);
+    expect(entry.after).toBeUndefined();
+    expect(entry.afterSha256).toBe("");
+    expect(candidateCompleteness(status)).toBe(DiffCompleteness.PARTIAL_BLOCKED);
+    assertNoSecretBytes(status);
+  });
+
+  it("DELETE: withholds the deleted file's baseline (before) secret bytes (kind DELETE)", async () => {
+    await commitBaselineSecret();
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID, harnessId: HARNESS,
+    });
+    await rm(join(repo, SECRET_PATH), { force: true }); // the agent deletes the secret
+
+    await captureCandidateToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      baselineTree: baseline, harnessId: HARNESS,
+    });
+
+    const entry = candidateChanges(status).find((c) => c.pathBefore === SECRET_PATH)!;
+    expect(entry).toBeDefined();
+    expect(entry.kind).toBe(FileChangeKind.DELETE);
+    expect(entry.captureClass).toBe(FileCaptureClass.GIT_TRACKED);
+    expect(entry.diffComplete).toBe(false);
+    // The DELETE's `before` side is the committed secret — the leak only this
+    // seam can withhold (the gate never sees a delete's content).
+    expect(entry.before).toBeUndefined();
+    expect(entry.beforeSha256).toBe("");
+    expect(candidateCompleteness(status)).toBe(DiffCompleteness.PARTIAL_BLOCKED);
+    assertNoSecretBytes(status);
+  });
+
+  it("mixed set: the non-secret file stays keepable; the secret reverts byte-exact on reject", async () => {
+    await commitBaselineSecret();
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID, harnessId: HARNESS,
+    });
+    await write("notes.md", "planton notes\n"); // reviewable tracked change
+    await write(SECRET_PATH, NEW_SECRET); // withheld tracked secret change
+
+    await captureCandidateToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      baselineTree: baseline, harnessId: HARNESS,
+    });
+
+    const byPath = new Map(candidateChanges(status).map((c) => [c.pathAfter || c.pathBefore, c]));
+    // The non-secret file is fully reviewable/keepable (content present).
+    expect(byPath.get("notes.md")!.diffComplete).toBe(true);
+    expect(byPath.get("notes.md")!.after).toBeDefined();
+    expect(byPath.get("notes.md")!.blockedReason).toBe(FileReviewBlockReason.UNSPECIFIED);
+    // The secret rides alongside content-less, forcing the set PARTIAL_BLOCKED.
+    expect(byPath.get(SECRET_PATH)!.diffComplete).toBe(false);
+    expect(byPath.get(SECRET_PATH)!.blockedReason).toBe(FileReviewBlockReason.SECRET_WITHHELD);
+    expect(candidateCompleteness(status)).toBe(DiffCompleteness.PARTIAL_BLOCKED);
+    assertNoSecretBytes(status);
+
+    // Keep the reviewable file; discard the secret. The git substrate reverts the
+    // secret to its committed baseline BYTE-EXACT (not deleted) and keeps notes.md.
+    const changeSet = decidedChangeSet(status, {
+      "notes.md": FileDecisionAction.APPROVE,
+      [SECRET_PATH]: FileDecisionAction.REJECT,
+    });
+    const result = await applyCaptureDecisions({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSet, harnessId: HARNESS,
+    });
+
+    expect(result.failed).toBe(false);
+    expect(result.approvedPaths).toEqual(["notes.md"]);
+    expect(result.rejectedPaths).toEqual([SECRET_PATH]);
+    expect(await read("notes.md")).toBe("planton notes\n");
+    expect(await read(SECRET_PATH)).toBe(BASELINE_SECRET); // reverted byte-exact
+    // Even after reconcile, no secret bytes are anywhere in the persisted status.
+    assertNoSecretBytes(status);
+  });
+});
+
+// partitionGitChangesBySecret: the pure split the composition relies on.
+describe("partitionGitChangesBySecret (pure)", () => {
+  const mk = (path: string): GitSubstrateChange => ({
+    path,
+    changeType: FileChangeType.MODIFY,
+    before: { kind: "inline", text: "a" },
+    after: { kind: "inline", text: "b" },
+  });
+
+  it("routes secret-like paths to `secret` and everything else to `safe`", () => {
+    const { safe, secret } = partitionGitChangesBySecret([
+      mk("src/main.ts"),
+      mk("config/credentials.json"),
+      mk(".env"),
+      mk("README.md"),
+      mk("keys/id_rsa"),
+    ]);
+    expect(safe.map((c) => c.path)).toEqual(["src/main.ts", "README.md"]);
+    expect(secret.map((c) => c.path)).toEqual(["config/credentials.json", ".env", "keys/id_rsa"]);
+  });
+
+  it("returns everything safe when no path is secret-like", () => {
+    const { safe, secret } = partitionGitChangesBySecret([mk("a.ts"), mk("b/c.md")]);
+    expect(safe).toHaveLength(2);
+    expect(secret).toHaveLength(0);
+  });
+});
+
 // Slice 2a (DD-21 D2): the shared orchestration must capture and reconcile a
 // NON-GIT workspace entirely from the CAS manifest — no git refs, no whole-tree
 // snapshot, bounded to the paths the observer actually touched. These exercise

package/src/shared/filereview/__tests__/cas-substrate.test.ts

@@ -97,6 +97,40 @@ describe("snapshotCasChangeSet — classification", () => {
     expect(del.before?.sha256).toBe(sha256Bytes(bytes("BYE=1")));
   });
 
+  it("counts display line changes from the in-memory bytes at capture", async () => {
+    const { storage } = makeFakeStorage();
+    const { manifest } = await snapshotCasChangeSet({
+      storage,
+      executionId: EXEC,
+      changeSetId: CHANGE_SET,
+      captures: [
+        { path: "created.env", before: null, after: bytes("A=1\nB=2\n"), captureClass: IGNORED },
+        { path: "changed.env", before: bytes("OLD=1\n"), after: bytes("OLD=2\n"), captureClass: IGNORED },
+        // Binary side: no text diff exists, so no counts may claim one does.
+        { path: "blob.bin", before: null, after: new Uint8Array([0, 1, 2]), captureClass: IGNORED },
+      ],
+    });
+    const byPath = new Map(manifest.files.map((f) => [f.pathAfter || f.pathBefore, f]));
+
+    expect(byPath.get("created.env")!.lineCounts).toEqual({ linesAdded: 2, linesRemoved: 0 });
+    expect(byPath.get("changed.env")!.lineCounts).toEqual({ linesAdded: 1, linesRemoved: 1 });
+    expect(byPath.get("blob.bin")!.lineCounts).toBeUndefined();
+  });
+
+  it("keeps line counts out of the persisted manifest (display data, not an enforcement record)", async () => {
+    const { storage, readBlob } = makeFakeStorage();
+    const { ref } = await snapshotCasChangeSet({
+      storage,
+      executionId: EXEC,
+      changeSetId: CHANGE_SET,
+      captures: [
+        { path: "changed.env", before: bytes("OLD=1\n"), after: bytes("OLD=2\n"), captureClass: IGNORED },
+      ],
+    });
+    const roundTripped = await loadCasManifest({ readBlob, ref });
+    expect(roundTripped.files[0].lineCounts).toBeUndefined();
+  });
+
   it("drops a touched-but-unchanged path (before == after)", async () => {
     const { storage } = makeFakeStorage();
     const { manifest } = await snapshotCasChangeSet({