@stigmer/runner 3.12.1 → 3.12.3

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -753,11 +753,47 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([]);
     });
 
-    it("still gates a gitignored DELETE (no CAS capture path, parity with deep-agent)", async () => {
+    it("stages a non-secret gitignored DELETE and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
-      expect(h.decide(hookDelete("app.log")).permission).toBe("deny");
+      writeFileSync(join(h.root, "app.log"), "DOOMED", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      // Flowed, not denied — reviewed post-hoc as a DELETE entry, not a pause.
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.secretPaths).toEqual([]);
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("app.log");
+      // The pre-delete bytes are staged — the restorable "before" side.
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("DOOMED");
+    });
+
+    it("first-touch-wins across write-then-delete: the true pre-turn before survives", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
+      writeFileSync(join(h.root, "app.log"), "ORIGINAL", "utf-8");
+      expect(h.decide(hookWrite("app.log", "REWRITTEN")).permission).toBe("allow");
+      // Simulate the write having applied, then a delete later this turn.
+      writeFileSync(join(h.root, "app.log"), "REWRITTEN", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("ORIGINAL");
+    });
+
+    it("keeps a SECRET-LIKE gitignored delete on the deny-gate: approvable, never staged (issue #303)", async () => {
+      // Unlike a secret write (hard-blocked — its content must never surface), a
+      // delete's args expose no secret content, so a human may approve it. Its
+      // before-bytes must never enter the sidecar though: staging would both
+      // persist the secret bytes and mark the path "secret", making the boundary
+      // author a blocking DIFF_UNREVIEWABLE for a merely-gated delete.
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: [".env"] });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval"); // gated, not blocked
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]); // no secret marker for a gated delete
     });
 
     it("with captureIgnored OFF, a gitignored write stays denied and stages nothing", async () => {
@@ -768,10 +804,10 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     });
   });
 
-  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write is
-  // CAS-staged and flowed for review (not only gitignored ones), a delete stays
-  // gated (no CAS delete-capture path, parity with the deep-agent), and shell/MCP
-  // gate as always. The workspace is deliberately NOT git-initialized.
+  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write and
+  // (issue #303) every non-secret delete is CAS-staged and flowed for review —
+  // not only gitignored ones — while shell/MCP gate as always. The workspace is
+  // deliberately NOT git-initialized.
   describe("non-git workspace CAS capture (Slice 2c)", () => {
     it("stages EVERY write (not just gitignored) and allows it, no denial", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
@@ -806,12 +842,27 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([".env"]);
     });
 
-    it("still gates a DELETE (deny-gate, parity with deep-agent) and stages nothing", async () => {
+    it("stages a DELETE with its pre-delete bytes and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
-      expect(h.decide(hookDelete("notes.md")).permission).toBe("deny");
-      expect(h.ledger()).toHaveLength(1);
+      writeFileSync(join(h.root, "notes.md"), "KEEP ME", "utf-8");
+      expect(h.decide(hookDelete("notes.md")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("notes.md");
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("KEEP ME");
+    });
+
+    it("keeps a secret-like DELETE gated (approvable) and stages nothing", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval");
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]);
     });
 
     it("still gates shell (never git-reversible, never CAS-captured)", async () => {

package/src/activities/execute-cursor/__tests__/skill-resolver.test.ts

@@ -1,10 +1,18 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, existsSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { resolveSkills } from "../skill-resolver.js";
+import { ConnectError, Code } from "@connectrpc/connect";
+import { resolveSkills, downloadArtifact } from "../skill-resolver.js";
 import { buildZip } from "../../../__test-utils__/zip-fixtures.js";
 
+/** A server that predates the transfer lane (#675) answers the mint RPC
+ * with UNIMPLEMENTED — the default posture for these tests, which keeps
+ * every pre-existing case pinned to the unary getSkillArtifact fallback. */
+function unimplementedMint() {
+  return vi.fn().mockRejectedValue(new ConnectError("unimplemented", Code.Unimplemented));
+}
+
 // ─── Helpers ─────────────────────────────────────────────────────────────
 
 function makeTempDir(prefix: string): string {
@@ -17,6 +25,7 @@ function makeSkillProto(overrides: {
   description?: string;
   skillMd?: string;
   artifactStorageKey?: string;
+  versionHash?: string;
 } = {}) {
   return {
     metadata: {
@@ -31,7 +40,7 @@ function makeSkillProto(overrides: {
     },
     status: {
       artifactStorageKey: overrides.artifactStorageKey ?? "",
-      versionHash: "abc",
+      versionHash: overrides.versionHash ?? "abc",
     },
   } as any;
 }
@@ -72,15 +81,18 @@ describe("resolveSkills — artifact extraction", () => {
     const client = {
       getSkillByReference: vi.fn(),
       getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
+      getSkillArtifactDownloadUrl: unimplementedMint(),
       ...clientOverrides,
     } as any;
 
+    // Re-run resolution for the same session — the mount-cache tests model
+    // one session's successive executions, which share the platform dir.
+    const resolveAgain = () =>
+      resolveSkills(client, refs, { sessionId, primaryWorkspaceDir: workspaceDir });
+
     try {
-      const result = await resolveSkills(client, refs, {
-        sessionId,
-        primaryWorkspaceDir: workspaceDir,
-      });
-      return { result, platformDir, client };
+      const result = await resolveAgain();
+      return { result, platformDir, client, resolveAgain };
     } catch (err) {
       // Clean up on failure
       rmSync(platformDir, { recursive: true, force: true });
@@ -189,6 +201,159 @@ describe("resolveSkills — artifact extraction", () => {
     }
   });
 
+  it("re-resolving an unchanged version skips the artifact download (mount cache hit)", async () => {
+    const artifact = buildZip([
+      { name: "SKILL.md", content: "# Cached" },
+      { name: "references/guide.md", content: "guide" },
+    ]);
+    const getSkillByReference = vi.fn().mockResolvedValue(
+      makeSkillProto({
+        name: "cached-skill",
+        slug: "cached-skill",
+        skillMd: "# Cached",
+        artifactStorageKey: "artifacts/cached.zip",
+        versionHash: "hash-v1",
+      }),
+    );
+    const getSkillArtifact = vi.fn().mockResolvedValue({ artifact });
+
+    const { result, platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("cached-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      expect(result).toHaveLength(1);
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
+
+      const second = await resolveAgain();
+      expect(second).toHaveLength(1);
+      expect(second[0].name).toBe("cached-skill");
+      // Metadata was re-fetched (latest-version freshness)...
+      expect(client.getSkillByReference).toHaveBeenCalledTimes(2);
+      // ...but the artifact transfer and rewrite were skipped.
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
+
+      const skillDir = join(platformDir, "skills", "cached-skill");
+      expect(readFileSync(join(skillDir, "references", "guide.md"), "utf-8")).toBe("guide");
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("re-downloads on version change and clears stale files from the old mount", async () => {
+    const v1 = makeSkillProto({
+      name: "evolving-skill",
+      slug: "evolving-skill",
+      skillMd: "# V1",
+      artifactStorageKey: "artifacts/v1.zip",
+      versionHash: "hash-v1",
+    });
+    const v2 = makeSkillProto({
+      name: "evolving-skill",
+      slug: "evolving-skill",
+      skillMd: "# V2",
+      artifactStorageKey: "artifacts/v2.zip",
+      versionHash: "hash-v2",
+    });
+    const artifactV1 = buildZip([{ name: "references/removed-in-v2.md", content: "old" }]);
+    const artifactV2 = buildZip([{ name: "references/new-in-v2.md", content: "new" }]);
+
+    const getSkillByReference = vi.fn().mockResolvedValueOnce(v1).mockResolvedValueOnce(v2);
+    const getSkillArtifact = vi
+      .fn()
+      .mockResolvedValueOnce({ artifact: artifactV1 })
+      .mockResolvedValueOnce({ artifact: artifactV2 });
+
+    const { platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("evolving-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      const skillDir = join(platformDir, "skills", "evolving-skill");
+      expect(readFileSync(join(skillDir, "references", "removed-in-v2.md"), "utf-8")).toBe("old");
+
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "SKILL.md"), "utf-8")).toBe("# V2");
+      expect(readFileSync(join(skillDir, "references", "new-in-v2.md"), "utf-8")).toBe("new");
+      // The v1-only file must not linger in the v2 mount (the stale-file leak).
+      expect(existsSync(join(skillDir, "references", "removed-in-v2.md"))).toBe(false);
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("does not cache a SKILL.md-only fallback — the next execution retries the download", async () => {
+    const proto = makeSkillProto({
+      name: "retry-skill",
+      slug: "retry-skill",
+      skillMd: "# Retry",
+      artifactStorageKey: "artifacts/retry.zip",
+      versionHash: "hash-v1",
+    });
+    const artifact = buildZip([{ name: "references/late.md", content: "finally" }]);
+    const getSkillByReference = vi.fn().mockResolvedValue(proto);
+    const getSkillArtifact = vi
+      .fn()
+      .mockRejectedValueOnce(new Error("Network timeout"))
+      .mockResolvedValueOnce({ artifact });
+
+    const { result, platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("retry-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      // First pass degraded to SKILL.md only.
+      expect(result).toHaveLength(1);
+      const skillDir = join(platformDir, "skills", "retry-skill");
+      expect(existsSync(join(skillDir, "references"))).toBe(false);
+
+      // Second pass retries and completes the mount.
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "references", "late.md"), "utf-8")).toBe("finally");
+
+      // Third pass is a cache hit.
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("treats a corrupted mount marker as stale and remounts", async () => {
+    const artifact = buildZip([{ name: "references/guide.md", content: "guide" }]);
+    const getSkillByReference = vi.fn().mockResolvedValue(
+      makeSkillProto({
+        name: "tampered-skill",
+        slug: "tampered-skill",
+        skillMd: "# Tampered",
+        artifactStorageKey: "artifacts/tampered.zip",
+        versionHash: "hash-v1",
+      }),
+    );
+    const getSkillArtifact = vi.fn().mockResolvedValue({ artifact });
+
+    const { platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("tampered-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      const skillDir = join(platformDir, "skills", "tampered-skill");
+      writeFileSync(join(skillDir, ".stigmer-mount.json"), "not json {");
+
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "references", "guide.md"), "utf-8")).toBe("guide");
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
   it("SKILL.md from spec takes precedence over ZIP copy", async () => {
     const specContent = "# Authoritative SKILL.md from spec";
     const zipContent = "# Stale SKILL.md from ZIP";
@@ -224,3 +389,97 @@ describe("resolveSkills — artifact extraction", () => {
     }
   });
 });
+
+// ─── downloadArtifact — transfer lane routing (#675) ─────────────────────
+
+describe("downloadArtifact — transfer lane routing", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  function makeClient(overrides: Record<string, any> = {}) {
+    return {
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
+      getSkillArtifactDownloadUrl: unimplementedMint(),
+      ...overrides,
+    } as any;
+  }
+
+  it("fetches bytes over HTTP when the server mints a download URL", async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4, 5]);
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
+        sizeBytes: 5n,
+        ttlSeconds: 0,
+      }),
+    });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      arrayBuffer: async () => bytes.buffer,
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const got = await downloadArtifact(client, "skills/abc.zip");
+
+    expect(got).toEqual(bytes);
+    expect(fetchMock).toHaveBeenCalledWith("http://localhost:7234/v1/skill-artifacts/skills/abc.zip");
+    // The unary lane (10MB-capped) must not be touched when the URL lane works.
+    expect(client.getSkillArtifact).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the unary RPC when the server predates the lane", async () => {
+    const bytes = new Uint8Array([9, 9]);
+    const client = makeClient({
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: bytes }),
+    });
+    vi.stubGlobal("fetch", vi.fn()); // must never be called
+
+    const got = await downloadArtifact(client, "skills/abc.zip");
+
+    expect(got).toEqual(bytes);
+    expect(client.getSkillArtifact).toHaveBeenCalledWith("skills/abc.zip");
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("does NOT fall back on non-Unimplemented mint failures", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockRejectedValue(
+        new ConnectError("boom", Code.Internal),
+      ),
+    });
+
+    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow("boom");
+    // Falling back here would mask real server faults behind the capped lane.
+    expect(client.getSkillArtifact).not.toHaveBeenCalled();
+  });
+
+  it("rejects truncated fetches via the minted size", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
+        sizeBytes: 100n,
+        ttlSeconds: 0,
+      }),
+    });
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
+      ok: true,
+      arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer,
+    }));
+
+    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow(/truncated/);
+  });
+
+  it("surfaces HTTP failures with the status code", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/gone.zip",
+        sizeBytes: 0n,
+        ttlSeconds: 0,
+      }),
+    });
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 404 }));
+
+    await expect(downloadArtifact(client, "skills/gone.zip")).rejects.toThrow(/HTTP 404/);
+  });
+});

package/src/activities/execute-cursor/capture-flow.ts

@@ -112,10 +112,11 @@ export function captureBaselineToLedger(opts: {
  * bytes withheld from durable storage.
  *
  * `deniedTokens` are the identities the hook gated this turn (shell/MCP, or a
- * gitignored delete). A streamed file-edit row whose identity is in that set is
- * left for the deny-gate reconcile path — it did NOT flow. A flowed gitignored
- * write is NOT in that set (the hook allowed it), so it is stamped like any
- * other flowed edit and its captured delta surfaces as a CAS entry in the set.
+ * secret-like delete — non-secret CAS deletes flow since issue #303). A streamed
+ * file-edit row whose identity is in that set is left for the deny-gate
+ * reconcile path — it did NOT flow. A flowed gitignored write or delete is NOT
+ * in that set (the hook allowed it), so it is stamped like any other flowed
+ * edit and its captured delta surfaces as a CAS entry in the set.
  *
  * `hitlDir`/`storage` are omitted only by callers with no artifact storage
  * (captureIgnored off); the CAS half is then skipped and this is a git-only

package/src/activities/execute-cursor/cas-observations.ts

@@ -1,5 +1,6 @@
 /**
- * The Cursor harness's disk-backed observer for gitignored file writes — the
+ * The Cursor harness's disk-backed observer for CAS-owned file mutations —
+ * gitignored / non-git writes, and (issue #303) pre-delete byte capture — the
  * out-of-process analog of the deep-agent `CasCaptureFilesystemBackend`
  * ({@link ../execute-deep-agent/cas-capture-backend.js}).
  *
@@ -185,14 +186,19 @@ export function buildSecretClassifyScript(): string {
 
 /**
  * Build the standalone Node.js script the hook runs to observe a single
- * gitignored write — the disk-backed mirror of `CasCaptureFilesystemBackend`'s
- * `recordBefore` plus the DD-E secret gate.
+ * CAS-owned mutation — the disk-backed mirror of `CasCaptureFilesystemBackend`'s
+ * `recordBefore` plus the DD-E secret gate. Staging is mutation-agnostic: it
+ * records the PRE-mutation bytes, so the hook runs it for a write/edit and —
+ * issue #303 — for a delete (whose before-bytes exist only until the tool runs;
+ * the boundary later reads after=null and authors the DELETE). The hook's
+ * delete arm pre-classifies secrets and never invokes this for a secret-like
+ * delete (a gated delete must not leave a "secret" marker in the sidecar).
  *
  * Invoked as `printf %s "$SALIENT" | node -e '<this>' <workspaceRoot> <obsDir>`
  * — the (arbitrary) salient path arrives on stdin so no argv escaping is needed;
  * the two absolute paths ride argv. Prints one token on stdout for the hook:
  *  - `captured` — non-secret: staged the pre-turn bytes (first-touch-wins), the
- *    hook then ALLOWS the write to flow;
+ *    hook then ALLOWS the mutation to flow;
  *  - `secret`   — secret-like: recorded a content-less marker, the hook then
  *    DENIES with the security message (nothing is written);
  *  - `error`    — the path escaped the workspace or a filesystem error occurred,

package/src/activities/execute-cursor/hook-script.ts

@@ -574,9 +574,8 @@ if echo "$STATE" | grep -q '"captureIgnored":true'; then
 fi
 # gitWorkspace selects the capture substrate (Slice 2c). Default true when the
 # key is absent (older state files). When false the workspace is NOT a git tree:
-# there is no git snapshot, so EVERY file write is CAS-staged below (not only
-# gitignored ones), the git-tracked flow arm is skipped, and a delete stays gated
-# (no CAS delete-capture path, parity with the deep-agent).
+# there is no git snapshot, so EVERY file write/delete is CAS-staged below (not
+# only gitignored ones) and the git-tracked flow arm is skipped.
 GIT_WORKSPACE=true
 if echo "$STATE" | grep -q '"gitWorkspace":false'; then
   GIT_WORKSPACE=false
@@ -597,9 +596,10 @@ fi
 # secret-like one must be hard-blocked in every mode. WHICH writes are CAS-owned
 # depends on the substrate: in a git tree it is only the GITIGNORED writes (git
 # captures the tracked ones); in a NON-GIT workspace it is EVERY write (there is
-# no git snapshot). Only a built-in write/edit (category "write") takes this arm;
-# deletes and shell/MCP stay on the deny-gate below (parity with the deep-agent
-# approval gate). The staging runs on the runner's own Node binary (the
+# no git snapshot). Only a built-in write/edit (category "write") takes THIS arm;
+# deletes take their own staging arm just below (issue #303), shell/MCP stay on
+# the deny-gate (parity with the deep-agent approval gate). The staging runs on
+# the runner's own Node binary (the
 # disk-backed mirror of CasCaptureFilesystemBackend.recordBefore): the salient
 # path rides stdin (no argv escaping), the workspace root and the per-turn
 # cas-observations dir ride argv. "captured" -> allow (apply-then-review);
@@ -629,6 +629,32 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
   fi
 fi
 
+# --- Capture mode: observe CAS-owned deletes for review (issue #303) --------
+# The delete twin of the write arm above — a non-secret CAS-owned delete stages
+# its before-bytes (the one moment they still exist on disk) and flows; the
+# turn boundary then reads after=null and authors a reviewable, restorable
+# DELETE entry. One deliberate difference from the write arm: the path is
+# classified for secret-likeness BEFORE any staging touches the sidecar. A
+# secret-like delete must stay on the deny-gate below where a human may still
+# approve it (its args expose no secret content, unlike a write) — staging it
+# would both persist the secret before-bytes and mark the sidecar "secret",
+# making the boundary author a blocking DIFF_UNREVIEWABLE for a merely-gated
+# delete. Every failure mode (secret, classify error, staging error) falls
+# through to the deny-gate rather than denying here, so grants and leases keep
+# applying to a gated delete exactly as before this arm existed; the eventual
+# resolution records its own ledger kind.
+if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "delete" ] && [ -n "$SALIENT" ] && { [ "$GIT_WORKSPACE" = "false" ] || __stigmer_is_gitignored "$SALIENT"; }; then
+  DELETE_SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo error)
+  if [ "$DELETE_SECRET_RESULT" = "ok" ]; then
+    OBS_DIR="$(dirname "$STATE_FILE")/${CAS_OBSERVATIONS_DIRNAME}"
+    OBS_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${observationStagingScript}' "$GIT_ROOT" "$OBS_DIR" 2>/dev/null || echo error)
+    if [ "$OBS_RESULT" = "captured" ]; then
+      echo '{"permission":"allow"}'
+      exit 0
+    fi
+  fi
+fi
+
 # --- 1a. MCP capability manifest: enabled_tools (issue #350) ---
 # Runs BEFORE the auto-approve-all shortcut and every grant check because
 # enabled_tools is a capability manifest, not an approval gate: no bypass may
@@ -700,13 +726,13 @@ if [ -n "$CATEGORY" ]; then
   # Capture mode (GIT tree only): a git-tracked file mutation (write/edit/delete)
   # flows freely — the runner captures the whole change set with git at the turn
   # boundary and gates it per-file for review. A gitignored path is invisible to
-  # that git snapshot: a non-secret gitignored WRITE was already handled above
-  # (staged + allowed, or hard-blocked) when captureIgnored is on; here it only
-  # reaches the deny-gate when captureIgnored is off (no artifact storage) or it is
-  # a gitignored DELETE (no CAS capture path, parity with deep-agent). shell
-  # (category "shell") never takes this branch and stays gated as always. In a
-  # NON-GIT workspace this arm is skipped entirely (there is no git diff): writes
-  # were CAS-staged above and a delete falls through to the deny-gate.
+  # that git snapshot: a non-secret gitignored WRITE or DELETE was already
+  # handled above (staged + allowed, hard-blocked, or left to fall through) when
+  # captureIgnored is on; here it only reaches the deny-gate when captureIgnored
+  # is off (no artifact storage), or it is a secret-like DELETE (approvable, but
+  # never staged — issue #303). shell (category "shell") never takes this branch
+  # and stays gated as always. In a NON-GIT workspace this arm is skipped
+  # entirely (there is no git diff): writes and deletes were CAS-staged above.
   if [ "$CAPTURE_MODE" = "true" ] && [ "$GIT_WORKSPACE" = "true" ] && { [ "$CATEGORY" = "write" ] || [ "$CATEGORY" = "delete" ]; }; then
     if ! __stigmer_is_gitignored "$SALIENT"; then
       echo '{"permission":"allow"}'