@webpresso/agent-kit 3.3.3 → 3.3.5

package/dist/esm/mcp/blueprint/handlers/review-log.js

@@ -30,13 +30,20 @@ const reviewLogSchema = z.object({
 });
 /**
  * MCP wrapper around the SAME reviews.md-ledger writer `logReviewEntry` that
- * (an unwired) `wp review log` uses, plus the matching frontmatter `approvals:`
- * entry that `collectTrackedReviewProvenance` (the promotion approval gate)
- * actually reads. This is the tracked/frontmatter provenance path — the same
- * trust model a hand-authored `approvals:` block already had (the reviewer id
- * is caller-asserted, verified only by the referenced artifact/reviews.md
- * entry being tracked in git) — this tool just makes that existing path
- * reachable from MCP instead of a raw Write/Edit or a Bash/python workaround.
+ * (an unwired) `wp review log` uses. For NON-approval verdicts it also appends
+ * the matching frontmatter `approvals:` entry, so rejection attribution stays
+ * visible where readers already look. This is the tracked/frontmatter provenance
+ * path — the same trust model a hand-authored `approvals:` block already had (the
+ * reviewer id is caller-asserted, verified only by the referenced
+ * artifact/reviews.md entry being tracked in git) — this tool just makes that
+ * existing path reachable from MCP instead of a raw Write/Edit or a Bash/python
+ * workaround.
+ *
+ * It never writes a POLICY-APPROVAL entry (approve / approve-with-nits) into
+ * frontmatter. `collectTrackedReviewProvenance` — the legacy promotion leg — only
+ * counts policy approvals and never reads or hashes the blueprint body, so such
+ * an entry would be gate authority that survives an arbitrary rewrite of the
+ * plan. See `LEGACY_APPROVAL_LEG_ANCHOR_COMMIT` in `#lifecycle/rollout-anchor.js`.
  *
  * A policy-approval verdict (approve / approve-with-nits) REQUIRES
  * reviewer==="human" — matching `logReviewEvent`'s existing v2-ledger
@@ -143,22 +150,39 @@ export async function handleReviewLog(projectResolver, cwd, raw) {
             ...(rev ? { rev } : {}),
             ...(note ? { note } : {}),
         });
-        const overviewRaw = readFileSync(found.path, "utf8");
-        const parsed = matter(overviewRaw);
-        const existingApprovals = Array.isArray(parsed.data.approvals) ? parsed.data.approvals : [];
-        const approvalEntry = {
-            reviewer: entry.reviewer,
-            verdict: entry.verdict,
-            evidence: entry.evidence ?? "reviews.md",
-            artifact: entry.artifact ?? normalizedArtifactPath,
-            ...(entry.commit ? { commit: entry.commit } : {}),
-            ...(entry.rev ? { rev: entry.rev } : {}),
-        };
-        const updatedData = { ...parsed.data, approvals: [...existingApprovals, approvalEntry] };
-        const rendered = matter.stringify(parsed.content, updatedData);
-        writeFileAtomic(found.path, rendered, { encoding: "utf8" });
+        // Policy-approval verdicts are NOT projected into frontmatter `approvals:`.
+        // That field feeds `collectTrackedReviewProvenance`, the legacy promotion leg
+        // that carries no content binding at all: it matches a reviews.md record and
+        // a tracked artifact but never reads or hashes the blueprint body, and the
+        // gate supplies no `targetHash`. Writing an approval there would mint
+        // authority that survives an arbitrary rewrite of the plan. Non-approval
+        // verdicts (reject / no-verdict) are still recorded, because the legacy leg
+        // only ever counts policy approvals -- they are attribution, never authority.
+        //
+        // Nothing is lost: the approval is fully recorded in reviews.md and in the
+        // tracked artifact. Satisfying the promotion gate still requires a converged
+        // `wp review gate` run (content-addressed v2 ledger) or `wp review override`.
+        const mintsGateAuthority = isPolicyApprovalVerdict(entry.verdict);
+        if (!mintsGateAuthority) {
+            const overviewRaw = readFileSync(found.path, "utf8");
+            const parsed = matter(overviewRaw);
+            const existingApprovals = Array.isArray(parsed.data.approvals) ? parsed.data.approvals : [];
+            const approvalEntry = {
+                reviewer: entry.reviewer,
+                verdict: entry.verdict,
+                evidence: entry.evidence ?? "reviews.md",
+                artifact: entry.artifact ?? normalizedArtifactPath,
+                ...(entry.commit ? { commit: entry.commit } : {}),
+                ...(entry.rev ? { rev: entry.rev } : {}),
+            };
+            const updatedData = { ...parsed.data, approvals: [...existingApprovals, approvalEntry] };
+            const rendered = matter.stringify(parsed.content, updatedData);
+            writeFileAtomic(found.path, rendered, { encoding: "utf8" });
+        }
         return finishPayload({
-            summary: `Logged review ${entry.id} -> ${entry.blueprintSlug} and recorded approvals frontmatter`,
+            summary: mintsGateAuthority
+                ? `Logged review ${entry.id} -> ${entry.blueprintSlug} in reviews.md (no frontmatter approval recorded: an approval verdict must bind to reviewed content via wp review gate)`
+                : `Logged review ${entry.id} -> ${entry.blueprintSlug} and recorded approvals frontmatter`,
             event_id: entry.id,
             blueprint_slug: entry.blueprintSlug,
             reviewer: entry.reviewer,

package/dist/esm/mcp/blueprint/registration.js

@@ -289,7 +289,7 @@ export async function registerBlueprintTools(registrar, cwd, projectResolver = c
             next_action: nextActionOutputSchema,
         },
     }, (r) => handleTaskVerify(projectResolver, cwd, r), { title: "Blueprint Task Verify", destructiveHint: false, openWorldHint: false });
-    registrar.registerTool("wp_blueprint_review_log", 'Record a tracked review-ledger entry for a blueprint: writes the given artifact content under blueprints/<state>/<slug>/review-artifacts/, appends the matching structured entry to reviews.md (via the same logReviewEntry writer, distinct from the CLI\'s own `wp review log` subcommand), and appends the corresponding `approvals:` frontmatter entry to _overview.md that the legacy promotion approval path (`collectTrackedReviewProvenance`) reads. A `verdict` of approve or approve-with-nits REQUIRES reviewer="human" — this tool cannot mint a claude/codex/grok/OpenCode-Go frontmatter approval; satisfying the strong-reviewer promotion gate still requires either a converged `wp review gate` run or a maintainer directly authoring that frontmatter. Use this tool for reject/no-verdict entries from any reviewer, or a human-adjudicated approve/approve-with-nits — including the audit-trail note when `wp review gate` fails to converge. Returns { event_id, blueprint_slug, reviewer, verdict, status, artifact_path }.', {
+    registrar.registerTool("wp_blueprint_review_log", 'Record a tracked review-ledger entry for a blueprint: writes the given artifact content under blueprints/<state>/<slug>/review-artifacts/ and appends the matching structured entry to reviews.md (via the same logReviewEntry writer, distinct from the CLI\'s own `wp review log` subcommand). For reject/no-verdict it ALSO appends the corresponding `approvals:` frontmatter entry to _overview.md, so rejection attribution stays visible. It NEVER writes an approve/approve-with-nits entry into `approvals:`: that field feeds the legacy promotion path (`collectTrackedReviewProvenance`), which never reads or hashes the blueprint body, so an approval recorded there would keep satisfying the gate after the plan was rewritten. A `verdict` of approve or approve-with-nits additionally REQUIRES reviewer="human". Satisfying the promotion gate requires a converged `wp review gate` run (content-addressed v2 ledger) or `wp review override`. Use this tool for reject/no-verdict entries from any reviewer, or to record a human-adjudicated approve/approve-with-nits in reviews.md — including the audit-trail note when `wp review gate` fails to converge. Returns { event_id, blueprint_slug, reviewer, verdict, status, artifact_path }.', {
         type: "object",
         properties: {
             project_id: { type: "string" },

package/dist/esm/mcp/tools/_shared/redact.d.ts

@@ -1 +1,23 @@
+/**
+ * Redaction for the shared read-only MCP path (`wp_pr_status`, `wp_pr_wait`,
+ * `wp_run_wait` error tails, `_readonly-ops`, worker tails, hook logs — 11
+ * consumers). Output reaches agent context, session memory, and committed
+ * review artifacts in a public repository, so a credential surviving here is
+ * irreversible and externally exploitable.
+ *
+ * Three properties are load-bearing; changing any of them breaks a consumer:
+ *
+ * 1. {@link mask} is **partial disclosure by design** — first and last two
+ *    characters survive above six, and the mask is deterministic.
+ *    `run-wait.ts` redacts both sides of its SHA comparison and relies on
+ *    identical input producing identical output.
+ * 2. The generic 40+-character rule masks full commit SHAs as a side effect,
+ *    compensated downstream by that same mask-aware equality. Do not "fix" it
+ *    here without updating those consumers.
+ * 3. **Every quantifier is bounded.** Callers pass unbounded log text —
+ *    `run-wait.ts` redacts the whole tail *before* clipping it to 2000 bytes —
+ *    so an unbounded `[A-Za-z0-9_]*` around a keyword alternation backtracks
+ *    quadratically and a hostile CI log can stall the MCP path for tens of
+ *    seconds. Keep the `{0,64}` bounds.
+ */
 export declare function redactText(value: string | undefined): string | undefined;

package/dist/esm/mcp/tools/_shared/redact.js

@@ -1,22 +1,128 @@
-const KEY_PATTERNS = [
-    /\b(?:GH_PACKAGES_TOKEN|GITHUB_TOKEN|GITHUB_PAT|NEON_API_KEY(?:_PLATFORM)?|CHEF_CI_TOKEN)\b\s*=\s*([^\s]+)/giu,
+/**
+ * Redaction for the shared read-only MCP path (`wp_pr_status`, `wp_pr_wait`,
+ * `wp_run_wait` error tails, `_readonly-ops`, worker tails, hook logs — 11
+ * consumers). Output reaches agent context, session memory, and committed
+ * review artifacts in a public repository, so a credential surviving here is
+ * irreversible and externally exploitable.
+ *
+ * Three properties are load-bearing; changing any of them breaks a consumer:
+ *
+ * 1. {@link mask} is **partial disclosure by design** — first and last two
+ *    characters survive above six, and the mask is deterministic.
+ *    `run-wait.ts` redacts both sides of its SHA comparison and relies on
+ *    identical input producing identical output.
+ * 2. The generic 40+-character rule masks full commit SHAs as a side effect,
+ *    compensated downstream by that same mask-aware equality. Do not "fix" it
+ *    here without updating those consumers.
+ * 3. **Every quantifier is bounded.** Callers pass unbounded log text —
+ *    `run-wait.ts` redacts the whole tail *before* clipping it to 2000 bytes —
+ *    so an unbounded `[A-Za-z0-9_]*` around a keyword alternation backtracks
+ *    quadratically and a hostile CI log can stall the MCP path for tens of
+ *    seconds. Keep the `{0,64}` bounds.
+ */
+/** Key-name fragments that advertise a secret. */
+const SECRET_WORD = "PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?";
+/**
+ * Optional opening quote OUTSIDE the capture, then the value up to the first
+ * closing delimiter.
+ *
+ * Both halves matter. Excluding quotes from the class stops a greedy capture
+ * pulling the closing quote into the mask (`sk***6"` instead of `sk***56`).
+ * Consuming an optional *opening* quote is what keeps `KEY="secret"` matching
+ * at all — omitting it makes the `+` match zero characters, the pattern fail,
+ * and the most common real-world shape (quoted shell/JSON/YAML values) sail
+ * through completely unredacted.
+ */
+// `\x60` is the backtick: a literal one cannot appear inside a String.raw
+// template, and `\`` is an invalid escape under the `u` flag.
+const QUOTED_VALUE = String.raw `["'\x60]?([^\s"'\x60,;)\]}\[]+)`;
+/** As above, with a length floor — see the `:` rule below. */
+const QUOTED_VALUE_LONG = String.raw `["'\x60]?([^\s"'\x60,;)\]}\[]{12,})`;
+/**
+ * Optional closing quote on the KEY, before the separator. JSON and quoted-key
+ * YAML put it there — `{"password":"…"}` — and without this the separator match
+ * fails on the key's own closing quote and the whole line sails through.
+ */
+const KEY_CLOSE = String.raw `["']?[ \t]*`;
+/**
+ * Credential value for the keyword rules (`Bearer`, `Basic`, `Cookie`), which
+ * carry no assignment signal at all — and whose keywords are ordinary English
+ * words. Without a floor, `Basic checks passed` becomes
+ * `Basic [REDACTED] passed`, and that reaches users: `pr-upsert.ts` pushes PR
+ * **titles** through this function, so "Add Bearer token support" would render
+ * corrupted.
+ *
+ * So the value must be ≥12 characters AND contain at least one uppercase
+ * letter, digit or base64 punctuation — enough to separate `dXNlcjpwYXNzd29yZA==`
+ * from `authentication`.
+ *
+ * The keyword rules therefore drop the `i` flag and spell each casing out.
+ * Under `i`, `[A-Z]` also matches lowercase, so this lookahead would be
+ * silently satisfied by any long lowercase word and the check would do nothing.
+ */
+const KEYWORD_CRED = String.raw `["'\x60]?((?:(?=[^\s"'\x60,;)\]}\[]*[A-Z0-9+/=_-])[^\s"'\x60,;)\]}\[]{12,}|[^\s"'\x60,;)\]}\[]{24,}))`;
+/**
+ * Patterns whose **first capture group** is the secret. Only that group is
+ * masked, so the header name, config key or URL host stays readable — a
+ * redactor that destroys the line it protects gets routed around.
+ */
+const CAPTURING_PATTERNS = [
+    // Originally-named credential env assignments.
+    new RegExp(String.raw `\b(?:GH_PACKAGES_TOKEN|GITHUB_TOKEN|GITHUB_PAT|NEON_API_KEY(?:_PLATFORM)?|CHEF_CI_TOKEN)\b` +
+        KEY_CLOSE +
+        String.raw `=[ \t]*` +
+        QUOTED_VALUE, "giu"),
+    // Generic secret-named key with `=`. Assignment is an unambiguous signal, so
+    // no length floor: `PASSWORD=x` should mask even when short.
+    new RegExp(String.raw `\b[A-Za-z0-9_]{0,64}(?:${SECRET_WORD})[A-Za-z0-9_]{0,64}` +
+        KEY_CLOSE +
+        String.raw `=[ \t]*` +
+        QUOTED_VALUE, "giu"),
+    // Generic secret-named key with `:`. Deliberately stricter than `=`, because
+    // `:` is overloaded across YAML, tables, markdown and plain prose — without a
+    // floor this masks `tokens: 512`, `secret: true`, `credentials: verified for
+    // 3 users` and `**Token:** an opaque handle`, corrupting ordinary CI output.
+    // A 12-character floor admits real secrets while excluding those.
+    new RegExp(String.raw `\b[A-Za-z0-9_]{0,64}(?:${SECRET_WORD})[A-Za-z0-9_]{0,64}` +
+        KEY_CLOSE +
+        String.raw `:[ \t]*` +
+        QUOTED_VALUE_LONG, "giu"),
+    // `Authorization: Bearer <token>` / bare `Bearer <token>`. Casings spelled
+    // out because `KEYWORD_CRED`'s lookahead is case-sensitive by necessity.
+    new RegExp(String.raw `\b(?:Bearer|bearer|BEARER)\s+` + KEYWORD_CRED, "gu"),
+    // `Authorization: Basic <base64>` — same header family, and the base64 is
+    // usually under the generic 40-character floor.
+    new RegExp(String.raw `\b(?:Basic|basic|BASIC)\s+` + KEYWORD_CRED, "gu"),
+    // Session cookies: the cookie NAME (`session`, `sid`) never matches a
+    // secret-word rule, so the value needs its own case or session tokens ride
+    // through CI and proxy logs intact. Anchoring on `name=` both avoids matching
+    // prose after a bare `Cookie:` and keeps the cookie name readable in output.
+    new RegExp(String.raw `\b(?:Set-|set-|SET-)?(?:Cookie|cookie|COOKIE)\s*:\s*[^\s=;]{1,64}=` + KEYWORD_CRED, "gu"),
+    // Credential-bearing URL userinfo: `https://user:pass@host/…`. Masking the
+    // whole userinfo keeps the host, which is what makes the log useful.
+    /:\/\/([^\s/@]+)@/gu,
 ];
-const TOKEN_PATTERNS = [
+/** Patterns where the entire match is the secret. */
+const WHOLE_MATCH_PATTERNS = [
     /\bghp_[A-Za-z0-9]{20,}\b/gu,
     /\b(?:cf|sk|tok)_[A-Za-z0-9_-]{16,}\b/gu,
+    // JWTs, whose segments routinely fall under the generic 40-character floor.
+    /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/gu,
     /\b[A-Za-z0-9+/_-]{40,}\b/gu,
 ];
 export function redactText(value) {
     if (!value)
         return value;
     let output = value;
-    for (const pattern of KEY_PATTERNS) {
-        output = output.replace(pattern, (whole, token) => {
-            const trimmed = String(token ?? "").trim();
-            return whole.includes("=") ? whole.replace(trimmed, mask(trimmed)) : mask(trimmed);
+    for (const pattern of CAPTURING_PATTERNS) {
+        output = output.replace(pattern, (whole, secret) => {
+            const trimmed = String(secret ?? "").trim();
+            if (trimmed.length === 0)
+                return whole;
+            return whole.replace(trimmed, mask(trimmed));
         });
     }
-    for (const pattern of TOKEN_PATTERNS) {
+    for (const pattern of WHOLE_MATCH_PATTERNS) {
         output = output.replace(pattern, (token) => mask(token));
     }
     return output;

package/dist/esm/mcp/tools/gain.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { resolveManagedRtkExecutable } from "#tool-runtime/managed-rtk.js";
 import { createSummaryOutputSchema, createSummaryResult } from "./_shared/result.js";
 import { readonlyOpsBaseSchema, resolveReadonlyCwd, runReadonlyCommand } from "./_readonly-ops.js";
 const inputSchema = readonlyOpsBaseSchema
@@ -19,8 +20,12 @@ const outputSchema = createSummaryOutputSchema({
     }),
 });
 function commandFor(input) {
-    if (input.source === "rtk")
-        return { command: "rtk", args: ["gain", "--format", "json"] };
+    if (input.source === "rtk") {
+        const rtkBin = resolveManagedRtkExecutable();
+        if (!rtkBin)
+            return null;
+        return { command: rtkBin, args: ["gain", "--format", "json"] };
+    }
     return { command: "./bin/wp", args: input.sessions ? ["gain", "--sessions"] : ["gain"] };
 }
 const tool = {
@@ -39,6 +44,27 @@ const tool = {
         const input = inputSchema.parse(raw ?? {});
         const cwd = resolveReadonlyCwd(input);
         const command = commandFor(input);
+        if (command === null) {
+            return createSummaryResult({
+                passed: false,
+                summary: "managed RTK not available (wp setup --with rtk or WP_RTK_BIN)",
+                exitCode: 1,
+                counts: { commandCount: 0, passedCount: 0, failedCount: 1 },
+                details: {
+                    cwd,
+                    source: input.source,
+                    format: input.format,
+                    sessions: input.sessions,
+                    command: {},
+                    result: { error: "managed_rtk_missing" },
+                },
+                rawOutput: "",
+                truncated: false,
+                timedOut: false,
+                aborted: false,
+                warnings: ["managed RTK binary missing"],
+            });
+        }
         const result = await runReadonlyCommand("gain", command.command, command.args, {
             cwd,
             timeoutMs: input.timeoutMs,

package/dist/esm/mcp/tools/worktree.js

@@ -15,6 +15,7 @@ import { gitBranchExists, listEntries, resolveNewWorktreeTarget, resolveWorktree
 import { deriveRepoNamespace, resolveKnownManagedWorktreeRoots, resolveWorktreeRoot, } from "#worktrees/location.js";
 import { readRepoOriginUrl, repoManagedRoot } from "#worktrees/manager.js";
 import { buildWorktreeInventory, canonicalizeWorktreePath, isManagedWorktreePath, resolveRepoIdentity, } from "#worktrees/identity.js";
+import { isStaleWorktreeRegistration, pruneStaleGitWorktreeMetadata, } from "#worktrees/git-metadata.js";
 import { findRegistryCandidatesByPath, pruneStaleWorktreeRegistryEntries, removeWorktreeRegistryEntries, repoScopedPathPredicate, upsertWorktreeRegistryEntry, } from "#worktrees/registry.js";
 const ACTIONS = ["list", "root", "new", "remove", "prune", "refresh"];
 const MUTATING_ACTIONS = new Set(["new", "remove", "prune", "refresh"]);
@@ -105,6 +106,53 @@ function isRegisteredManagedWorktree(resolvedPath, _context) {
     // a legacy-root worktree registered by an earlier binary authorizes removal.
     return findRegistryCandidatesByPath(canonicalizeWorktreePath(resolvedPath)).length > 0;
 }
+/**
+ * A stale registration may already have lost its registry entry to an earlier
+ * prune, so registration alone cannot gate reconciling it. Fall back to the
+ * managed-root boundary, which still keeps unmanaged worktrees protected.
+ */
+function isRemovableManagedTarget(resolved, context, stale) {
+    if (isRegisteredManagedWorktree(resolved, context))
+        return true;
+    if (!stale)
+        return false;
+    return isManagedWorktreePath(canonicalizeWorktreePath(resolved), resolveKnownManagedWorktreeRoots());
+}
+/** Reconcile git + registry for a worktree whose directory is already gone. */
+function clearStaleRegistration(input, repoRoot, resolved, entries, entry) {
+    const gitPruned = pruneStaleGitWorktreeMetadata(repoRoot, entries);
+    if (gitPruned.error) {
+        return {
+            passed: false,
+            summary: `wp_worktree remove failed: git worktree prune failed: ${gitPruned.error}`,
+            action: input.action,
+            executed: false,
+            warnings: ["git_worktree_prune_failed"],
+            nextAction: "Inspect the repository's git worktree admin records and retry.",
+        };
+    }
+    const warnings = [];
+    try {
+        removeWorktreeRegistryEntries(repoScopedPathPredicate(resolved, { authoritativeRepoKey: resolveRepoIdentity(repoRoot) }));
+    }
+    catch {
+        warnings.push("registry_cleanup_failed");
+    }
+    return {
+        passed: true,
+        summary: `Cleared stale worktree registration ${resolved} (directory already gone)`,
+        action: input.action,
+        executed: true,
+        removed: {
+            path: resolved,
+            ...(entry?.branch ? { branch: entry.branch.replace("refs/heads/", "") } : {}),
+        },
+        warnings,
+        ...(warnings.includes("registry_cleanup_failed")
+            ? { nextAction: "Run wp_worktree prune with execute:true to repair stale registry metadata." }
+            : {}),
+    };
+}
 function refreshManagedEntries(repoRoot) {
     const { originUrl, repoNamespace } = managedContext(repoRoot);
     const knownRoots = resolveKnownManagedWorktreeRoots();
@@ -234,6 +282,7 @@ function handleRemove(input, repoRoot) {
     }
     const entry = entries.find((candidate) => candidate.path === resolved);
     const context = managedContext(repoRoot);
+    const stale = isStaleWorktreeRegistration(entry, resolved, existsSync);
     if (resolved === repoRoot) {
         return {
             passed: false,
@@ -243,7 +292,7 @@ function handleRemove(input, repoRoot) {
             warnings: ["main_checkout_protected"],
         };
     }
-    if (!isRegisteredManagedWorktree(resolved, context)) {
+    if (!isRemovableManagedTarget(resolved, context, stale)) {
         return {
             passed: false,
             summary: `wp_worktree remove refused: ${resolved} is not a registered managed worktree for this repository`,
@@ -263,6 +312,10 @@ function handleRemove(input, repoRoot) {
             nextAction: "Unlock the worktree explicitly with git after confirming it is safe, then retry.",
         };
     }
+    // Checked before the dirty gate: `git status` fails in a missing directory,
+    // which would otherwise be reported as "uncommitted changes".
+    if (stale)
+        return clearStaleRegistration(input, repoRoot, resolved, entries, entry);
     if (isDirty(resolved)) {
         return {
             passed: false,
@@ -368,6 +421,10 @@ const tool = {
                     warnings: [],
                 }, false);
             }
+            // Reconcile git's own admin records FIRST: a hand-deleted worktree
+            // directory leaves a record that still claims its branch, and it would
+            // otherwise read as live below and pin its registry entry in place too.
+            const gitPruned = pruneStaleGitWorktreeMetadata(repoRoot, listEntries(repoRoot));
             // Repository-scoped, three-state prune across every known root: only THIS
             // repo's entries proven stale against a COMPLETE git-live inventory drop;
             // unknown, other-repo, and live-legacy entries are retained. `existsSync`
@@ -377,12 +434,17 @@ const tool = {
                 inventory,
                 scope: { authoritativeRepoKey: resolveRepoIdentity(repoRoot) },
             });
+            const gitSummary = gitPruned.error
+                ? ""
+                : ` and ${gitPruned.prunedPaths.length} stale git worktree registration${gitPruned.prunedPaths.length === 1 ? "" : "s"}`;
             return result({
                 passed: true,
-                summary: `Pruned ${pruned.removed.length} stale managed registry entr${pruned.removed.length === 1 ? "y" : "ies"}`,
+                summary: `Pruned ${pruned.removed.length} stale managed registry entr${pruned.removed.length === 1 ? "y" : "ies"}${gitSummary}`,
                 action: input.action,
                 executed: true,
-                warnings: pruned.warnings,
+                warnings: gitPruned.error
+                    ? [...pruned.warnings, `git_worktree_prune_failed:${gitPruned.error}`]
+                    : pruned.warnings,
             }, false);
         }
         catch (error) {

package/dist/esm/mcp/tools/wp-ui-compose.js

@@ -29,20 +29,52 @@ const tool = {
         openWorldHint: false,
     },
     handler: async (raw) => {
-        const input = inputSchema.parse(raw ?? {});
+        const parsed = inputSchema.safeParse(raw ?? {});
+        if (!parsed.success) {
+            const summary = `Invalid wp_ui_compose input: ${parsed.error.issues.map((i) => i.message).join("; ")}`;
+            return {
+                content: [{ type: "text", text: summary }],
+                structuredContent: {
+                    passed: false,
+                    summary,
+                    ok: false,
+                    diagnostics: parsed.error.issues.map((i) => ({
+                        path: i.path.length > 0 ? i.path.join(".") : "(root)",
+                        message: i.message,
+                    })),
+                },
+                isError: true,
+            };
+        }
+        const input = parsed.data;
+        if (input.profile === "admin-crud") {
+            if (input.spec === null || typeof input.spec !== "object" || Array.isArray(input.spec)) {
+                const summary = "Invalid wp_ui_compose admin-crud spec: expected a non-null object (not string/array/empty coercion)";
+                return {
+                    content: [{ type: "text", text: summary }],
+                    structuredContent: {
+                        passed: false,
+                        summary,
+                        ok: false,
+                        diagnostics: [{ path: "spec", message: summary }],
+                    },
+                    isError: true,
+                };
+            }
+        }
         const composeInput = input.profile === "admin-crud"
             ? {
                 profile: "admin-crud",
                 kind: input.kind,
-                spec: input.spec && typeof input.spec === "object" && !Array.isArray(input.spec)
-                    ? input.spec
-                    : {},
+                spec: input.spec,
             }
             : { profile: "ops-report", spec: input.spec };
         const result = composeValidate(composeInput, { cwd: input.cwd });
         const summary = result.ok
             ? `compose ok (${result.profile})`
             : `compose failed (${result.profile}): ${result.diagnostics.map((d) => d.message).join("; ")}`;
+        // MCP tool execution errors (incl. domain validation) use isError:true so
+        // models self-correct; diagnostics stay in content text + structuredContent.
         return {
             content: [{ type: "text", text: summary }],
             structuredContent: {
@@ -55,7 +87,9 @@ const tool = {
                 registrySource: result.registrySource,
                 registryVersion: result.registryVersion,
                 warnings: result.warnings,
+                blockTypesValidated: result.blockTypesValidated,
             },
+            ...(result.ok ? {} : { isError: true }),
         };
     },
 };

package/dist/esm/mcp/tools/wp-ui-preview.js

@@ -19,9 +19,20 @@ const tool = {
         openWorldHint: false,
     },
     handler: async (raw) => {
+        const parsed = inputSchema.safeParse(raw ?? {});
+        if (!parsed.success) {
+            const message = `Invalid wp_ui_preview input: ${parsed.error.issues.map((i) => i.message).join("; ")} (ops-report profile only; admin-crud is not supported)`;
+            return {
+                content: [{ type: "text", text: message }],
+                structuredContent: {
+                    passed: false,
+                    summary: message,
+                },
+                isError: true,
+            };
+        }
         try {
-            const input = inputSchema.parse(raw ?? {});
-            const { path } = previewOpsReport({ cwd: input.cwd, spec: input.spec });
+            const { path } = previewOpsReport({ cwd: parsed.data.cwd, spec: parsed.data.spec });
             const summary = `ops-report preview written: ${path}`;
             return {
                 content: [{ type: "text", text: summary }],
@@ -33,11 +44,7 @@ const tool = {
             };
         }
         catch (error) {
-            const message = error instanceof z.ZodError
-                ? `Invalid wp_ui_preview input: ${error.issues.map((i) => i.message).join("; ")} (ops-report profile only; admin-crud is not supported)`
-                : error instanceof Error
-                    ? error.message
-                    : String(error);
+            const message = error instanceof Error ? error.message : String(error);
             return {
                 content: [{ type: "text", text: message }],
                 structuredContent: {

package/dist/esm/review/authority.js

@@ -9,6 +9,7 @@ import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { evaluateReviewEvents, parseReviewEventLog } from "./events.js";
+import { isPolicyApprovalVerdict } from "./verdict.js";
 import { createDeliverySubjectAtRef, createLegacyPlanSubjectAtRef, createPlanSubjectAtRef, createPreTagsStripPlanSubjectAtRef, resolveReviewCommit, } from "./subject.js";
 const GIT_TIMEOUT_MS = 5_000;
 const GIT_MAX_BUFFER_BYTES = 128 * 1024 * 1024;
@@ -114,6 +115,54 @@ function markCompromisedArtifactEvents(cwd, entries, blueprintDirectory, events)
     }
     return { compromisedIds, issues };
 }
+/** Bounded `git branch -a --contains <commit>` probe, tolerant of a pruned/unknown object. */
+function branchesContainingCommit(cwd, commit) {
+    try {
+        const output = gitBuffer(cwd, ["branch", "-a", "--contains", commit]).toString("utf8");
+        return output
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0);
+    }
+    catch {
+        return null;
+    }
+}
+// Diagnostic-only: names historical ledger approvals whose `reviewedCommit` is
+// no longer reachable from any branch (typically because a rebase rewrote the
+// history that commit lived on). Such an approval no longer matches the
+// current subjectDigest, so it already contributes zero approvals under the
+// existing policy in ./events.ts -- this only makes the reason visible instead
+// of the operator seeing a bare "approvals does not satisfy the promotion
+// reviewer mix" and mistaking a dead commit ref for a genuinely missing
+// review. Never mutates `approvals`/`matching`; policy is unchanged.
+function markOrphanedApprovalEvents(cwd, events, current) {
+    const issues = [];
+    const seen = new Set();
+    for (const event of events) {
+        if (event.purpose !== current.purpose ||
+            event.blueprintSlug !== current.blueprintSlug ||
+            event.subjectScheme !== current.subjectScheme ||
+            event.subjectDigest === current.subjectDigest ||
+            event.status !== "complete" ||
+            !isPolicyApprovalVerdict(event.verdict)) {
+            continue;
+        }
+        const key = `${event.reviewer}:${event.reviewedCommit}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const branches = branchesContainingCommit(cwd, event.reviewedCommit);
+        if (branches === null || branches.length === 0) {
+            issues.push(`Historical approval from ${event.reviewer} (event ${event.id}) reviewed commit ` +
+                `${event.reviewedCommit}, which is unreachable from any branch (git branch -a ` +
+                `--contains ${event.reviewedCommit} found nothing) -- likely orphaned by a rebase. ` +
+                "This approval does not count toward the current subject; rebase this worktree onto " +
+                "the latest base and re-run the gate.");
+        }
+    }
+    return issues;
+}
 export function readReviewAuthorityAtRef(cwd, ref, stableSlug, purpose) {
     const commit = resolveReviewCommit(cwd, ref);
     const entries = parseRefTree(cwd, commit);
@@ -131,6 +180,12 @@ export function readReviewAuthorityAtRef(cwd, ref, stableSlug, purpose) {
     const subject = purpose === "plan"
         ? createPlanSubjectAtRef(cwd, commit, stableSlug, overview.path)
         : createDeliverySubjectAtRef(cwd, commit, stableSlug, overview.path);
+    const orphanIssues = markOrphanedApprovalEvents(cwd, events, {
+        purpose,
+        blueprintSlug: stableSlug,
+        subjectScheme: subject.scheme,
+        subjectDigest: subject.digest,
+    });
     let evaluation = evaluateReviewEvents(events, {
         purpose,
         blueprintSlug: stableSlug,
@@ -166,7 +221,7 @@ export function readReviewAuthorityAtRef(cwd, ref, stableSlug, purpose) {
         subject,
         events,
         ...evaluation,
-        issues,
+        issues: [...issues, ...orphanIssues],
     };
 }
 export function readWorkingReviewEvents(blueprintPath, stableSlug) {

package/dist/esm/review/delivery-verifier.d.ts

@@ -21,6 +21,10 @@ export interface ReviewGateVerification {
     readonly logPath?: string;
     readonly sandbox?: ReviewSandboxMode;
     readonly sandboxReason?: string;
+    readonly violations?: readonly {
+        readonly section: string;
+        readonly message: string;
+    }[];
 }
 /** Runs one gate command in the review checkout and returns its raw result. */
 export type RunSandboxedGate = (args: {

package/dist/esm/review/delivery-verifier.js

@@ -18,7 +18,15 @@ export async function verifyDeliveryPromotionGates(input) {
             parsed.violations[0]?.message === "missing Trust Dossier section") {
             return undefined;
         }
-        return { status: "failed", commands: [], failureCode: "malformed-trust-dossier" };
+        return {
+            status: "failed",
+            commands: [],
+            failureCode: "malformed-trust-dossier",
+            violations: parsed.violations.map((violation) => ({
+                section: violation.section,
+                message: violation.message,
+            })),
+        };
     }
     const gates = parsed.dossier?.gates ?? [];
     if (gates.length === 0)