@stigmer/runner 3.15.1 → 3.15.2-dev.20260913223433

package/src/activities/execute-cursor/__tests__/same-identity-reproposal.test.ts

@@ -35,7 +35,7 @@ import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/a
 import { ApprovalAction, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 
-import { approvalDecisionsOf } from "../../../harness/turn-context.js";
+import { approvalDecisionsOf } from "../../../harness/approval-decisions.js";
 import { MessageAccumulator, reconcileDeniedToolCalls, toolCallIdentityToken } from "../message-translator.js";
 import type { DeniedLedgerEntry } from "../approval-state.js";
 
@@ -83,7 +83,7 @@ function allToolCalls(messages: AgentMessage[]): ToolCall[] {
 
 /** The later turn: the model proposes the same edit under a fresh id, the hook denies it, the turn boundary reconciles. */
 async function laterTurnProposesSameEdit(seeded: AgentMessage[]): Promise<ToolCall[]> {
-  const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+  const acc = new MessageAccumulator(seeded, {});
   acc.processEvent(toolCallEvent(LATER_ID, "running"));
   acc.processEvent(toolCallEvent(LATER_ID, "error", "Blocked by hook"));
   acc.finalize();
@@ -158,7 +158,7 @@ describe("a later same-identity proposal never lands on a decided row (F9)", ()
       }),
     ];
 
-    const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+    const acc = new MessageAccumulator(seeded, {});
     acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "running"));
     acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "completed", RESULT_OF_FIRST));
     acc.finalize();

package/src/activities/execute-cursor/__tests__/sequential-gate-resume.test.ts

@@ -1,7 +1,7 @@
 /**
  * @regression file-hitl-phase0 — pins file-edit HITL fix #2 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
  *
- * Cursor analog of execute-deep-agent/__tests__/sequential-gate-resume.test.ts:
+ * Cursor analog of execute-deep-agent/__tests__/hermetic/hitl-sequential-gates.test.ts:
  * two SEQUENTIAL approval gates across a resume, on the Cursor deny-and-reconcile
  * harness instead of the native in-process gate.
  *
@@ -139,7 +139,7 @@ describe("Cursor sequential gates A->B across resume", () => {
     const committed = approvedGateA();
     const seeded = committed.map((m) => clone(AgentMessageSchema, m));
 
-    const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+    const acc = new MessageAccumulator(seeded, {});
     for (const event of resumeIntoGateB()) acc.processEvent(event);
     acc.finalize();
 

package/src/activities/execute-cursor/__tests__/turn-boundary.test.ts

@@ -1,21 +1,29 @@
 /**
  * Tests for the extracted turn boundary (turn-boundary.ts) — the post-run
- * pipeline shared by the primary path and the recovery retries.
+ * pipeline shared by the primary path and the recovery retries: the hook's
+ * denials become WAITING_APPROVAL gates, unattended and secret denials are
+ * attributed and settled, a foreign hook's block is reported (#205), and a
+ * row that hung inside the harness on a completing turn is settled and
+ * disclosed (#965).
  *
- * The load-bearing scenario is the recovery-retry sequence that motivated the
- * extraction (production case aex_01kws27q1e2esvkqjpvectttxf): the primary
- * boundary runs against an untouched tree (the resumed agent errored before
- * doing anything), the retry agent then edits files, and the boundary is
- * re-entered — the candidate must be authored exactly once and the turn must
- * pause for review. Runs against a REAL temp git repo with in-memory
- * transcript + status protos, mirroring capture-flow.test.ts.
+ * The turn's FILE CHANGES are not the boundary's since S3 M4: the runtime
+ * captures them once after `runTurn` returns (`harness/capture.ts`, proven
+ * in `harness/__tests__/capture.test.ts` and the kit's runtime arm), so the
+ * five capture arms this file carried until then — the candidate, the clean
+ * turn, the missing baseline, the recovery re-entry authoring exactly once,
+ * the full-ledger stamp exclusion — live there now, restated for the
+ * runtime's status-based rules. One arm changed meaning with the lift and is
+ * pinned below: a turn whose only pause would have been a file review is a
+ * COMPLETING turn to this boundary, so its hung rows are settled before the
+ * runtime's review, not after it (F-M4-P9, Q-M4-11).
+ *
+ * Runs against a temp workspace dir with in-memory transcript + status
+ * protos; the gate reads a denied file's `before` from that dir.
  */
 
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { execFile } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { create, type JsonObject } from "@bufbuild/protobuf";
 import {
@@ -25,26 +33,17 @@ import {
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import {
-  FileReviewEventType,
-  MessageType,
-  ToolCallStatus,
-} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { captureBaselineToLedger } from "../capture-flow.js";
+import { MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { isToolCallRowHidden } from "../../../shared/tool-row.js";
 import { denialLedgerPath } from "../approval-state.js";
 import { toolCallIdentityToken, UNRESOLVED_TOOL_CALL_ERROR } from "../message-translator.js";
 import { runTurnBoundary, type TurnBoundaryOptions } from "../turn-boundary.js";
 
-const execFileAsync = promisify(execFile);
 const EXEC_ID = "exec-boundary-1";
-const CHANGE_SET_ID = `${EXEC_ID}:0`;
 
 let repo: string;
 let hitlDir: string;
 
-async function git(args: string[]): Promise<void> {
-  await execFileAsync("git", args, { cwd: repo });
-}
 async function write(rel: string, content: string): Promise<void> {
   await writeFile(join(repo, rel), content, "utf-8");
 }
@@ -68,46 +67,39 @@ function streamedEdit(id: string, path: string, content: string): AgentMessage {
   });
 }
 
-/** Boundary options for this repo's turn; overrides layer the per-test shape. */
-function boundaryOpts(
-  status: AgentExecutionStatus,
-  baselineTree: string,
-  overrides?: Partial<TurnBoundaryOptions>,
-): TurnBoundaryOptions {
+/** Boundary options for this turn; overrides layer the per-test shape. */
+function boundaryOpts(status: AgentExecutionStatus, overrides?: Partial<TurnBoundaryOptions>): TurnBoundaryOptions {
   return {
     status,
     executionId: EXEC_ID,
-    changeSetId: CHANGE_SET_ID,
     hitlDir,
-    captureMode: true,
-    baselineTree,
     primaryWorkspaceDir: repo,
-    gitWorkspace: true,
     turnStartMessageIndex: 0,
-    approvalGrants: undefined,
-    globalBypass: false,
-    seededSubAgents: [],
-    artifactStorage: undefined,
     mergedPolicies: new Map(),
     ...overrides,
   };
 }
 
-function candidateEvents(status: AgentExecutionStatus) {
-  return (status.fileReviewEventStream?.events ?? []).filter(
-    (e) => e.eventType === FileReviewEventType.CANDIDATE_CAPTURED,
-  );
+/** A FAILED tool call carrying Cursor's generic hook-block error text (#205). */
+function hookBlockedCall(id: string, name: string, args: JsonObject) {
+  return create(ToolCallSchema, {
+    id,
+    name,
+    status: ToolCallStatus.TOOL_CALL_FAILED,
+    error: "Command blocked by a hook.",
+    args,
+  });
+}
+
+/** Append one entry to this turn's denial ledger. */
+async function appendLedgerEntry(entry: Record<string, unknown>): Promise<void> {
+  await writeFile(denialLedgerPath(hitlDir), JSON.stringify(entry) + "\n", { flag: "a" });
 }
 
 beforeEach(async () => {
   repo = await mkdtemp(join(tmpdir(), "stigmer-boundary-repo-"));
   hitlDir = await mkdtemp(join(tmpdir(), "stigmer-boundary-hitl-"));
-  await git(["init", "-q"]);
-  await git(["config", "user.email", "t@t.local"]);
-  await git(["config", "user.name", "t"]);
   await write("notes.md", "original notes\n");
-  await git(["add", "-A"]);
-  await git(["commit", "-q", "-m", "initial"]);
 });
 
 afterEach(async () => {
@@ -116,98 +108,8 @@ afterEach(async () => {
 });
 
 describe("runTurnBoundary", () => {
-  it("authors a candidate, stamps the row, and pauses when the turn edited files", async () => {
-    const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
-
-    await write("notes.md", "original notes\n\n## TODO\n- ship\n");
-    status.messages.push(
-      streamedEdit("tc-1", "notes.md", "original notes\n\n## TODO\n- ship\n"),
-    );
-
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
-
-    expect(result.waiting).toBe(true);
-    expect(result.capturedChangeCount).toBe(1);
-    expect(result.deniedToolCallCount).toBe(0);
-    expect(candidateEvents(status)).toHaveLength(1);
-    // The streamed row is stamped with the change set id (observational record
-    // anchoring the decision surface).
-    expect(status.messages[0].toolCalls[0].fileChangeSetId).toBe(CHANGE_SET_ID);
-  });
-
-  it("reports a clean turn when nothing changed (no candidate, no pause)", async () => {
-    const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
-
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
-
-    expect(result.waiting).toBe(false);
-    expect(result.capturedChangeCount).toBe(0);
-    expect(result.deniedToolCallCount).toBe(0);
-    expect(candidateEvents(status)).toHaveLength(0);
-  });
-
-  it("skips capture when no baseline was authored this turn", async () => {
-    const status = newStatus();
-    await write("notes.md", "edited without a baseline\n");
-
-    const result = await runTurnBoundary(
-      boundaryOpts(status, "", { baselineTree: undefined }),
-    );
-
-    expect(result.waiting).toBe(false);
-    expect(result.capturedChangeCount).toBe(0);
-    expect(candidateEvents(status)).toHaveLength(0);
-  });
-
-  it("re-entered after a no-op primary call, authors the candidate exactly once (recovery-retry sequence)", async () => {
-    const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
-
-    // Primary boundary: the resumed agent errored before touching anything —
-    // the tree is at baseline, no candidate is authored, the turn looks clean.
-    const primary = await runTurnBoundary(boundaryOpts(status, baseline));
-    expect(primary.waiting).toBe(false);
-    expect(candidateEvents(status)).toHaveLength(0);
-
-    // Recovery retry: a fresh agent re-ran the prompt and created the file.
-    await write("notes.md", "original notes\n\nretry made this edit\n");
-    status.messages.push(
-      streamedEdit("tc-retry", "notes.md", "original notes\n\nretry made this edit\n"),
-    );
-
-    // Boundary re-entry: the retry's edit reaches the ledger and arms the gate.
-    const retry = await runTurnBoundary(boundaryOpts(status, baseline));
-    expect(retry.waiting).toBe(true);
-    expect(retry.capturedChangeCount).toBe(1);
-    expect(candidateEvents(status)).toHaveLength(1);
-    expect(status.messages[0].toolCalls[0].fileChangeSetId).toBe(CHANGE_SET_ID);
-  });
-
   it("surfaces a hook denial as a WAITING_APPROVAL gate and pauses", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
 
     // The hook gated a shell command mid-turn; the streamed call is still
     // RUNNING (Cursor reported the deny to the model, not a completion).
@@ -230,37 +132,17 @@ describe("runTurnBoundary", () => {
       "utf-8",
     );
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     expect(result.waiting).toBe(true);
     expect(result.deniedToolCallCount).toBe(1);
-    expect(result.capturedChangeCount).toBe(0);
     expect(shellCall.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 
   // ── Issue #205: unattributed hook blocks and the kind split ────────────────
 
-  /** A FAILED tool call carrying Cursor's generic hook-block error text. */
-  function hookBlockedCall(id: string, name: string, args: JsonObject) {
-    return create(ToolCallSchema, {
-      id,
-      name,
-      status: ToolCallStatus.TOOL_CALL_FAILED,
-      error: "Command blocked by a hook.",
-      args,
-    });
-  }
-
-  /** Append one entry to this turn's denial ledger. */
-  async function appendLedgerEntry(entry: Record<string, unknown>): Promise<void> {
-    await writeFile(denialLedgerPath(hitlDir), JSON.stringify(entry) + "\n", { flag: "a" });
-  }
-
   it("reports a foreign hook block on a non-pausing turn (the #205 silent-complete shape)", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
-    });
 
     // A foreign .cursor/hooks.json hook denied the write: Cursor stamped its
     // generic error, our ledger stayed empty, the tree is untouched. Before
@@ -272,7 +154,7 @@ describe("runTurnBoundary", () => {
     );
 
     const result = await runTurnBoundary(
-      boundaryOpts(status, baseline, { foreignGatingHooks: ["./team-policy.sh"] }),
+      boundaryOpts(status, { foreignGatingHooks: ["./team-policy.sh"] }),
     );
 
     expect(result.waiting).toBe(false);
@@ -286,9 +168,6 @@ describe("runTurnBoundary", () => {
 
   it("attributes a secret hard-block (kind:'secret'): no pause, no false foreign-hook report", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
-    });
 
     const secretRow = hookBlockedCall("tc-secret", "edit", { path: ".env" });
     status.messages.push(
@@ -302,7 +181,7 @@ describe("runTurnBoundary", () => {
       "utf-8",
     );
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     // Not a pause (the agent was told to move on), not a foreign block (our
     // own kinded entry attributes it), and never a WAITING_APPROVAL overlay.
@@ -314,9 +193,6 @@ describe("runTurnBoundary", () => {
 
   it("mixed turn: pauses on our anchor while still reporting the foreign block", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
-    });
 
     const ourGated = create(ToolCallSchema, {
       id: "tc-ours", name: "shell",
@@ -329,7 +205,7 @@ describe("runTurnBoundary", () => {
     );
     await appendLedgerEntry({ toolName: "shell", token: toolCallIdentityToken(ourGated), kind: "approval" });
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     // The pause wins (a pausing turn is never silent); the foreign block is
     // still surfaced so the caller can log it next to the approval.
@@ -338,41 +214,8 @@ describe("runTurnBoundary", () => {
     expect(result.unattributedHookBlocks.map((b) => b.toolCallId)).toEqual(["tc-theirs"]);
   });
 
-  it("excludes a kinded (secret) deny from the flowed-edit stamp (full-ledger deniedTokens)", async () => {
-    const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
-    });
-
-    // One edit genuinely flowed (tree changed + streamed row); one secret-like
-    // write was hard-blocked (FAILED row + kind:"secret" entry, tree untouched).
-    await write("notes.md", "original notes\nplus a real edit\n");
-    status.messages.push(streamedEdit("tc-flowed", "notes.md", "original notes\nplus a real edit\n"));
-    const secretRow = hookBlockedCall("tc-secret", "edit", { path: ".env" });
-    status.messages.push(
-      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [secretRow] }),
-    );
-    await appendLedgerEntry({ toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" });
-
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
-
-    // The flowed edit is captured + stamped; the secret-blocked row is NOT
-    // stamped into a change set that does not contain its file — every ledger
-    // kind means "this action did not execute", so the stamp uses the FULL set.
-    expect(result.waiting).toBe(true);
-    expect(result.capturedChangeCount).toBe(1);
-    expect(status.messages[0].toolCalls[0].fileChangeSetId).toBe(CHANGE_SET_ID);
-    expect(secretRow.fileChangeSetId).toBe("");
-  });
-
   it("waits for the denial-stop cancel to settle before reading the ledger", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
 
     const shellCall = create(ToolCallSchema, {
       id: "tc-late",
@@ -398,7 +241,7 @@ describe("runTurnBoundary", () => {
     })();
 
     const result = await runTurnBoundary(
-      boundaryOpts(status, baseline, { denialCancelSettled }),
+      boundaryOpts(status, { denialCancelSettled }),
     );
 
     expect(result.deniedToolCallCount).toBe(1);
@@ -431,15 +274,9 @@ describe("runTurnBoundary — unresolved tool calls on a completing turn (issue
 
   it("settles the incident shape to INTERRUPTED and discloses it (regression: aex_01m1a6ww)", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
     status.messages.push(hangingGenerateImage("tc-genimage-1"));
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     // The turn completes (no pause) — but not silently.
     expect(result.waiting).toBe(false);
@@ -461,39 +298,52 @@ describe("runTurnBoundary — unresolved tool calls on a completing turn (issue
     expect(last.content).toContain("No approval is pending");
   });
 
-  it("leaves non-terminal rows to the pause machinery on a PAUSING turn", async () => {
+  it("leaves non-terminal rows to the pause machinery on a PAUSING turn (a denial pauses)", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
+    // Our hook denied a shell — the turn pauses for that approval…
+    const ourGated = create(ToolCallSchema, {
+      id: "tc-ours", name: "shell",
+      status: ToolCallStatus.TOOL_CALL_RUNNING,
+      args: { command: "rm -rf build" },
     });
-    // A captured file change makes the turn pause…
-    await write("notes.md", "original notes\npaused-turn edit\n");
-    status.messages.push(
-      streamedEdit("tc-edit-1", "notes.md", "original notes\npaused-turn edit\n"),
-    );
+    status.messages.push(create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [ourGated] }));
+    await appendLedgerEntry({ toolName: "shell", token: toolCallIdentityToken(ourGated), kind: "approval" });
     // …while a hanging row rides the same turn.
     status.messages.push(hangingGenerateImage("tc-genimage-2"));
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     expect(result.waiting).toBe(true);
     expect(result.settledUnresolvedCount).toBe(0);
-    // Untouched by THIS sweep (a pausing turn's rows belong to the reconcile /
-    // collapse machinery, which has its own treatment for orphaned attempts).
-    expect(status.messages[1].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);
+    // Untouched by THIS sweep: a pausing turn's rows belong to the reconcile /
+    // collapse machinery, which has its own treatment for an attempt that
+    // streamed after the gate (the hidden SKIPPED twin), never #965's
+    // INTERRUPTED-with-disclosure.
+    const hung = status.messages[1].toolCalls[0];
+    expect(hung.status).not.toBe(ToolCallStatus.TOOL_CALL_INTERRUPTED);
+    expect(isToolCallRowHidden(hung), "collapsed by the reconcile, not settled by the sweep").toBe(true);
+  });
+
+  it("a turn whose only change is a flowed file edit is COMPLETING here: the hung row is settled before the runtime's review (F-M4-P9)", async () => {
+    const status = newStatus();
+    // The edit flowed and the tree changed — until S3 M4 that made the turn
+    // `waiting` and hid the hung row behind the review; the runtime captures
+    // the edit after this boundary, so the boundary now tells the truth
+    // about the row first.
+    await write("notes.md", "original notes\nflowed edit\n");
+    status.messages.push(streamedEdit("tc-edit-1", "notes.md", "original notes\nflowed edit\n"));
+    status.messages.push(hangingGenerateImage("tc-genimage-2"));
+
+    const result = await runTurnBoundary(boundaryOpts(status));
+
+    expect(result.waiting).toBe(false);
+    expect(result.settledUnresolvedCount).toBe(1);
+    expect(status.messages[1].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_INTERRUPTED);
+    expect(status.messages[0].toolCalls[0].fileChangeSetId, "the stamp is the runtime's, after this boundary").toBe("");
   });
 
   it("never settles a ledger-attributed row — that is the kinded machinery's call", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
     const secretWrite = create(ToolCallSchema, {
       id: "tc-secret-1",
       name: "edit",
@@ -515,7 +365,7 @@ describe("runTurnBoundary — unresolved tool calls on a completing turn (issue
       "utf-8",
     );
 
-    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+    const result = await runTurnBoundary(boundaryOpts(status));
 
     expect(result.settledUnresolvedCount).toBe(0);
     expect(secretWrite.status).toBe(ToolCallStatus.TOOL_CALL_PENDING);
@@ -523,12 +373,6 @@ describe("runTurnBoundary — unresolved tool calls on a completing turn (issue
 
   it("scopes to THIS turn: seeded prior-turn rows and terminal rows are untouched", async () => {
     const status = newStatus();
-    const baseline = await captureBaselineToLedger({
-      status,
-      gitRoot: repo,
-      executionId: EXEC_ID,
-      changeSetId: CHANGE_SET_ID,
-    });
     // Message 0 is seeded prior-turn context (already adjudicated elsewhere).
     status.messages.push(hangingGenerateImage("tc-prior-turn"));
     // Message 1 opens this turn: one real terminal row.
@@ -547,7 +391,7 @@ describe("runTurnBoundary — unresolved tool calls on a completing turn (issue
     );
 
     const result = await runTurnBoundary(
-      boundaryOpts(status, baseline, { turnStartMessageIndex: 1 }),
+      boundaryOpts(status, { turnStartMessageIndex: 1 }),
     );
 
     expect(result.settledUnresolvedCount).toBe(0);

package/src/activities/execute-cursor/__tests__/turn-stream.test.ts

@@ -2,8 +2,7 @@
  * Unit tests for the Cursor harness's shared stream seam (turn-stream.ts).
  *
  * These lock the behaviors the old bare retry loops used to DROP — live persist,
- * DD-32/DD-33 mid-run progress, sub-agent tracking, the first-denial early stop
- * — and the loop's side of the adapter contract: progress reported per event
+ * sub-agent tracking, the first-denial early stop — and the loop's side of the adapter contract: progress reported per event
  * and per delta, usage reported priced, the persist awaited, and the runtime's
  * stop signal honoured at every event boundary and inside a blocked pull by
  * cancelling the SDK run. Since S2 M3 the loop no longer decides WHY it
@@ -30,7 +29,6 @@ import {
   type StreamableRun,
   type TurnStreamState,
 } from "../turn-stream.js";
-import type { ProgressSubstrate } from "../../../shared/filereview/progress.js";
 
 // A stream event is only inspected by the loop for `type`/`name`/`status`/
 // `message`; the accumulator (stubbed) owns the rest, so a minimal cast is safe.
@@ -109,9 +107,6 @@ function buildDeps(overrides: Partial<CursorTurnStreamDeps> = {}): BuiltDeps {
     // contentDirty (accumulator.isDirty) forces the persist, so shouldSendUpdate
     // is never consulted; markUpdateSent must still exist.
     scheduler: { shouldSendUpdate: () => false, markUpdateSent: vi.fn() },
-    progressSubstrate: undefined,
-    progressState: { lastAtMs: 0 },
-    changeSetId: "exec-test:0",
     hitlDir: undefined,
     ...overrides,
   } as unknown as CursorTurnStreamDeps;
@@ -150,26 +145,6 @@ describe("consumeCursorTurnStream", () => {
     expect(accumulator.trackSubAgentExecution).toHaveBeenCalledTimes(1);
   });
 
-  it("attaches DD-32/DD-33 mid-run progress when a substrate is present", async () => {
-    const capture = vi.fn(async () => ({ delta: { entries: [] }, changed: true }));
-    const progressSubstrate = { capture } as unknown as ProgressSubstrate;
-    const { deps, sink } = buildDeps({ progressSubstrate });
-
-    await consumeCursorTurnStream(mockRun([ev({ type: "assistant" })]), deps);
-
-    expect(capture).toHaveBeenCalled();
-    // changed:true → the transient snapshot is attached to status.
-    expect(sink.status.fileChangeProgress).toBeDefined();
-  });
-
-  it("does not touch progress when no substrate is configured", async () => {
-    const { deps, sink } = buildDeps({ progressSubstrate: undefined });
-
-    await consumeCursorTurnStream(mockRun([ev({ type: "assistant" })]), deps);
-
-    expect(sink.status.fileChangeProgress).toBeUndefined();
-  });
-
   it("captures a stream ERROR status message onto state.streamErrorMessage", async () => {
     const { deps, state } = buildDeps();
 

package/src/activities/execute-cursor/adapter.ts

@@ -37,11 +37,13 @@
  * pins it, which is what lets the contract kit run this adapter outside any
  * activity context).
  *
- * The file-review boundary (`turn-boundary.ts`) runs whole inside `turn.ts`
- * for S2 (Q-S2-1): five of its six steps read the denial ledger, this
- * harness's deny-and-retry primitive. S3 lifts the capture into the runtime
- * with both harnesses' captures in view; `types.ts`'s "the file-review
- * boundary is the runtime's" becomes true then.
+ * The turn boundary (`turn-boundary.ts`) runs inside `turn.ts` and reads
+ * this harness's deny-and-retry evidence — the denial ledger — into WAITING
+ * rows and settled rows. The file-review capture is NOT here since S3 M4:
+ * the runtime pins the baseline before this adapter runs and captures the
+ * whole turn's tree after it returns (`harness/capture.ts`); what this
+ * adapter contributes is the hook sidecar it binds as the runtime's CAS
+ * observations (`turn-setup.ts` `installGate`).
  *
  * Extracted from `index.ts` `createCursorActivities` at S2 M3b; split from
  * the turn body at S2 M5. The seventeen hermetic goldens under

package/src/activities/execute-cursor/approval-policy.ts

@@ -105,8 +105,11 @@ export const SALIENT_ARG_FIELDS = ["file_path", "path", "target_notebook", "comm
  * `edit`/`shell`/`delete` all return true. Only mutating/destructive tools are
  * gated; everything else (read-only built-ins, and — at the hook layer —
  * auto-approved MCP tools) is allowed. This "gate the dangerous set, allow the
- * rest" model mirrors the native harness's resolveToolApproval. It is
- * deliberately fail-OPEN for unknown tools: the merged MCP policy map carries
+ * rest" model is the platform's one approval rule, read through the shared
+ * `approvalCategory` / `toolApprovalCategory` (`shared/tool-kind.ts`) that the
+ * native gate (`middleware/approval-gate.ts` `resolveToolApproval`) also
+ * reads — one taxonomy, two enforcement points. It is deliberately fail-OPEN
+ * for unknown tools: the merged MCP policy map carries
  * only the tools that REQUIRE approval, so a fail-closed default would wrongly
  * deny every auto-approved MCP tool, which the hook cannot distinguish from an
  * unknown built-in by name.